@smthrs/sync 0.0.0-stage → 1.0.0-rc.4

package/src/BranchRpcs.ts

@@ -0,0 +1,163 @@
+/**
+ * The branch collaboration wire contract: the RPC projection of the write
+ * and presence paths that complement the read-only {@link SyncRpcs}.
+ *
+ * Authorization has two stages. Opening a branch is the bootstrap: no
+ * capability can exist yet, so `CreateBranch` requires an authenticated
+ * workspace principal supplied by the group's {@link SyncAuth} middleware,
+ * and its handler refuses any other principal.
+ *
+ * Every later procedure carries its own share capability and authorizes
+ * through {@link BranchShare}: past the bootstrap the capability IS the
+ * credential, and cross-branch or expired capabilities are refused by the
+ * same service boundary the in-process callers use.
+ *
+ * @since 0.1.0
+ */
+
+import * as Schema from "effect/Schema"
+import { Rpc, RpcGroup } from "effect/unstable/rpc"
+import {
+  Access,
+  Announcement,
+  BranchId,
+  CommandReceipt,
+  LeaveRequest,
+  Participant,
+  RosterRequest,
+  ShareCapability,
+  SubmitRequest
+} from "./BranchProtocol.ts"
+import { SyncError } from "./SyncError.ts"
+import { SyncAuth } from "./SyncRpcs.ts"
+
+/**
+ * Maximum lifetime the branch bootstrap may mint.
+ *
+ * @category constants
+ * @since 0.1.0
+ */
+export const maximumBranchTtlMs = 24 * 60 * 60 * 1000
+
+/**
+ * Schema for a request to open a new shared branch.
+ *
+ * The RPC authentication middleware must establish the workspace principal
+ * before the handler mints the first write capability.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const CreateBranchPayload = Schema.Struct({
+  ttlMs: Schema.Int.check(
+    Schema.isGreaterThan(0),
+    Schema.isLessThanOrEqualTo(maximumBranchTtlMs)
+  )
+})
+
+/**
+ * A request to open a new shared branch.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type CreateBranchPayload = typeof CreateBranchPayload.Type
+
+/**
+ * Schema for the freshly opened branch and its owner capability.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const CreateBranchResponse = Schema.Struct({
+  branchId: BranchId,
+  capability: ShareCapability
+})
+
+/**
+ * The freshly opened branch and its owner capability.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type CreateBranchResponse = typeof CreateBranchResponse.Type
+
+/**
+ * Schema for a request to mint a share link for a branch.
+ *
+ * The presenting capability must hold write access to the branch — only a
+ * collaborator can invite one — and the minted link never outlives the
+ * capability it was minted from.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const MintSharePayload = Schema.Struct({
+  capability: ShareCapability,
+  access: Access,
+  ttlMs: Schema.Int.check(Schema.isGreaterThan(0))
+})
+
+/**
+ * A request to mint a share link for a branch.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type MintSharePayload = typeof MintSharePayload.Type
+
+/**
+ * Schema for one roster emission on a branch watch stream.
+ *
+ * @category schemas
+ * @since 0.1.0
+ */
+export const RosterFrame = Schema.Struct({
+  participants: Schema.Array(Participant)
+})
+
+/**
+ * One roster emission on a branch watch stream.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type RosterFrame = typeof RosterFrame.Type
+
+/**
+ * The remote procedures of branch collaboration.
+ *
+ * The capability-bearing payloads ARE the `BranchProtocol` request schemas the
+ * branch services take, not copies of them. Four wire payloads used to
+ * re-declare the message their service already owned, and the announce copy
+ * had already drifted: it accepted `displayName: ""` where the service
+ * requires a non-empty name, so a wire-legal announce reached a `Participant`
+ * constructor and threw a defect outside the declared `SyncError` channel.
+ * Naming one schema on both sides makes that drift impossible rather than
+ * fixed once, and keeps this group free of the services themselves.
+ *
+ * @category groups
+ * @since 0.1.0
+ */
+export const BranchRpcs = RpcGroup.make(
+  Rpc.make("Branch.CreateBranch", {
+    payload: CreateBranchPayload,
+    success: CreateBranchResponse,
+    error: SyncError
+  }),
+  Rpc.make("Branch.MintShare", { payload: MintSharePayload, success: ShareCapability, error: SyncError }),
+  Rpc.make("Branch.Submit", { payload: SubmitRequest, success: CommandReceipt, error: SyncError }),
+  Rpc.make("Branch.Announce", { payload: Announcement, success: Participant, error: SyncError }),
+  Rpc.make("Branch.Leave", { payload: LeaveRequest, success: Schema.Null, error: SyncError }),
+  Rpc.make("Branch.Roster", {
+    payload: RosterRequest,
+    success: Schema.Array(Participant),
+    error: SyncError
+  }),
+  Rpc.make("Branch.PresenceOn", {
+    payload: RosterRequest,
+    success: Schema.Literals(["unknown", "present", "empty"]),
+    error: SyncError
+  }),
+  Rpc.make("Branch.WatchRoster", { payload: RosterRequest, success: RosterFrame, error: SyncError, stream: true })
+).middleware(SyncAuth)

package/src/BranchServer.ts

@@ -0,0 +1,202 @@
+/**
+ * The server-side handlers of {@link BranchRpcs}: a thin projection of the
+ * branch services onto the wire.
+ *
+ * Five procedures forward to the service that owns their boundary and add
+ * nothing: `Branch.Submit` to {@link BranchCommands}, and `Branch.Announce`,
+ * `Branch.Leave`, `Branch.Roster`, and `Branch.WatchRoster` to
+ * {@link BranchPresence}. Two enforce policy here, on top of what
+ * {@link BranchShare} checks: `Branch.CreateBranch` refuses any principal that
+ * is not an authenticated workspace, and `Branch.MintShare` verifies write
+ * access, refuses an expired parent, and caps the child at the parent's
+ * expiry. `BranchShare.mint` performs none of those checks, so an in-process
+ * host that mints through the service directly must gate the principal and
+ * the parent capability itself.
+ *
+ * @since 0.1.0
+ */
+
+import * as Clock from "effect/Clock"
+import * as Effect from "effect/Effect"
+import type * as Layer from "effect/Layer"
+import * as Stream from "effect/Stream"
+import type * as Rpc from "effect/unstable/rpc/Rpc"
+import type * as RpcGroup from "effect/unstable/rpc/RpcGroup"
+import * as BranchCommands from "./BranchCommands.ts"
+import * as BranchIds from "./BranchIds.ts"
+import * as BranchPresence from "./BranchPresence.ts"
+import { BranchId, type Participant } from "./BranchProtocol.ts"
+import { BranchRpcs } from "./BranchRpcs.ts"
+import * as BranchShare from "./BranchShare.ts"
+import * as Admission from "./internal/Admission.ts"
+import { SyncError } from "./SyncError.ts"
+import * as SyncPrincipal from "./SyncPrincipal.ts"
+
+/**
+ * Whether two roster emissions say the same thing.
+ *
+ * `list` returns participants sorted by id, so the comparison is positional.
+ * The lease itself is part of the key: a heartbeat that only extends a lease
+ * IS a change the watcher wants, because it is the evidence the participant is
+ * still there.
+ *
+ * The rendering is JSON rather than delimiter-joined fields. Participant ids
+ * and display names are `NonEmptyString` with no charset constraint, so every
+ * separator is a character they may carry, including the control bytes this
+ * used to join on. Two rosters differing only in where a field boundary falls
+ * then rendered identically and a watcher never observed the change. JSON
+ * quotes and escapes each field, so distinct rosters render distinctly.
+ */
+const rosterKey = (participants: ReadonlyArray<Participant>): string =>
+  JSON.stringify(
+    participants.map((participant) => [
+      participant.participantId,
+      participant.displayName,
+      participant.sessionId,
+      participant.kind,
+      participant.where,
+      participant.watching,
+      participant.for_member,
+      participant.leaseExpiresAtMs,
+      participant.cursor === null ? null : [participant.cursor.cardId, participant.cursor.offset]
+    ])
+  )
+
+const sameRoster = (
+  left: ReadonlyArray<Participant>,
+  right: ReadonlyArray<Participant>
+): boolean => rosterKey(left) === rosterKey(right)
+
+/**
+ * Provides the branch RPC handlers over the branch services.
+ *
+ * With {@link BranchPresence.layerNoop}, roster reads and watches fail with
+ * `unsupported`: unavailable presence cannot establish an empty roster.
+ *
+ * A roster watch emits the roster as of subscription, then re-lists on every
+ * presence change for the branch AND at least once per second, emitting
+ * only when the roster it read differs from the one it last sent.
+ *
+ * All three of those are triggers into ONE sequential reader. The roster is
+ * mutable state behind an effect, so concurrent readers can complete out of
+ * order, and a watcher that receives an older roster after a newer one keeps
+ * the older one: `changesWith` compares against the previous emission, not
+ * against the freshest state. Serializing the reads is what makes the last
+ * value a watcher holds the most recent one that was read.
+ *
+ * The periodic re-list is what makes expiry observable. A lapsed lease
+ * publishes nothing — the roster drops it the next time somebody lists — so a
+ * watch driven by change events alone never saw the LAST participant leave,
+ * and a burst of announcements on unrelated branches could slide the one
+ * notification this watch needed out of the shared feed. Both are bounded by
+ * one second: a departure is visible within 1 s of lease expiry,
+ * whether or not a survivor reports it.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerHandlers: Layer.Layer<
+  Rpc.ToHandler<RpcGroup.Rpcs<typeof BranchRpcs>>,
+  never,
+  | BranchShare.BranchShare
+  | BranchPresence.BranchPresence
+  | BranchCommands.BranchCommands
+  | BranchIds.BranchIds
+> = BranchRpcs.toLayer(
+  Effect.gen(function*() {
+    const share = yield* BranchShare.BranchShare
+    const presence = yield* BranchPresence.BranchPresence
+    const commands = yield* BranchCommands.BranchCommands
+    const ids = yield* BranchIds.BranchIds
+
+    return BranchRpcs.of({
+      "Branch.CreateBranch": ({ ttlMs }) =>
+        Effect.gen(function*() {
+          const principal = yield* SyncPrincipal.SyncPrincipal
+          if (!SyncPrincipal.isWorkspace(principal)) {
+            return yield* new SyncError({
+              code: "unauthorized",
+              message: "Creating a branch requires an authenticated workspace principal"
+            })
+          }
+          // Decoded, not branded: `BranchIds` is a host port whose `fresh` is
+          // typed `Effect<string>`, so a host id source yielding "" turned an
+          // asserted `BranchId` into a schema defect inside `mint` rather than
+          // the `SyncError` this handler declares.
+          const branchId = yield* Admission.decode(BranchId, yield* ids.fresh, "invalid_request")
+          const capability = yield* share.mint({
+            branchId,
+            capabilityId: yield* ids.fresh,
+            access: "write",
+            ttlMs
+          })
+          return { branchId: capability.claims.branchId, capability }
+        }),
+      "Branch.MintShare": ({ capability, access, ttlMs }) =>
+        Effect.gen(function*() {
+          const claims = yield* share.verify(capability, {
+            branchId: capability.claims.branchId,
+            access: "write"
+          })
+          const capabilityId = yield* ids.fresh
+          const nowMs = yield* Clock.currentTimeMillis
+          // ID generation may outlast the parent. Refuse before minting, and
+          // pass the absolute ceiling so the signing clock cannot extend it.
+          if (nowMs >= claims.expiresAtMs) {
+            return yield* new SyncError({
+              code: "unauthorized",
+              message: "The share capability has expired"
+            })
+          }
+          // A link never outlives the capability it was minted from.
+          return yield* share.mint({
+            branchId: claims.branchId,
+            capabilityId,
+            access,
+            ttlMs,
+            maxExpiresAtMs: claims.expiresAtMs
+          })
+        }),
+      "Branch.Submit": (payload) => commands.submit(payload),
+      "Branch.Announce": (payload) => presence.announce(payload),
+      "Branch.Leave": (payload) => Effect.as(presence.leave(payload), null),
+      "Branch.Roster": (payload) => presence.list(payload),
+      "Branch.PresenceOn": (payload) => presence.presenceOn(payload),
+      "Branch.WatchRoster": (payload) =>
+        Stream.merge(
+          // The subscription's own snapshot is a TRIGGER like the other two,
+          // not a fourth reader. Reading it here concurrently with them let
+          // the roster a change produced overtake it: `presence.list` is an
+          // effect against mutable state, three of them ran at once, and the
+          // slowest one won the merge. `changesWith` compares an emission only
+          // against the one before it, so the older roster passed the filter
+          // and the watcher's LAST value said a participant who had already
+          // left was still present, until the next change or lease tick.
+          Stream.succeed(undefined),
+          Stream.merge(
+            presence.changes.pipe(
+              Stream.filter((branchId) => branchId === payload.branchId),
+              Stream.map(() => undefined)
+            ),
+            // A lapsed lease publishes nothing, so a watch driven only by
+            // change events never observes the LAST participant leaving, and
+            // an unrelated branch's burst can slide the one notification this
+            // watch needed out of the shared feed. Re-listing at least once per second
+            // bounds both: a departure is visible within 1 s of expiry, whether or not anyone reports it.
+            Stream.fromEffectRepeat(Effect.sleep(Math.min(presence.leaseMs, 1_000))).pipe(Stream.map(() => undefined))
+          )
+        ).pipe(
+          // ONE reader, sequential by default, so a roster is read in the
+          // order its trigger arrived and every emission is at least as fresh
+          // as the one before it.
+          Stream.mapEffect(() => presence.list(payload)),
+          // Deduplicated over the WHOLE stream, initial emission included.
+          // Applied to the change half alone, its first value always passed,
+          // so a change that left the roster identical still sent the watcher
+          // a second copy of what it had just been given.
+          Stream.changesWith(sameRoster),
+          Stream.map((participants) => ({ participants }))
+        )
+    })
+  })
+)

package/src/BranchShare.ts

@@ -0,0 +1,297 @@
+/**
+ * Share capabilities: the authorization boundary of a shared branch.
+ *
+ * A share link carries a capability, not a session. The capability names
+ * exactly one branch, one access level, and one expiry, and it is signed, so
+ * the holder cannot widen it. Every branch operation authorizes through
+ * `verify`, which is therefore the single place cross-branch access and
+ * expired links are refused.
+ *
+ * The signature is HMAC-SHA-256 over a length-prefixed encoding of the claims,
+ * led by a scheme label. Length prefixes matter: without them a branch id
+ * ending in the separator could be re-cut into a different, still-validly-
+ * signed claim set. The label matters for the same reason across schemes: a
+ * branch capability can never verify as a workspace capability even if one
+ * secret is misconfigured into both authorities. Web Crypto is used directly
+ * so the same module runs in the browser and on node.
+ *
+ * A `kid` inside the claims names the key that signed them, so a branch secret
+ * rotates the way the workspace secret already did: the new key signs, the
+ * retired key stays in the verification keyring, and the share links already
+ * out keep working until they expire.
+ *
+ * @since 0.1.0
+ */
+
+import * as Clock from "effect/Clock"
+import * as Config from "effect/Config"
+import * as Context from "effect/Context"
+import * as Effect from "effect/Effect"
+import * as Layer from "effect/Layer"
+import * as Schema from "effect/Schema"
+import { Access, BranchId, ShareCapability, ShareClaims } from "./BranchProtocol.ts"
+import * as Admission from "./internal/Admission.ts"
+import * as shareSigner from "./internal/ShareSigner.ts"
+import type { SyncError } from "./SyncError.ts"
+
+/**
+ * The branch and access one authorization request needs.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface AuthorizeRequest {
+  readonly branchId: BranchId
+  readonly access: Access
+}
+
+/**
+ * What a freshly minted capability grants.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const MintRequest = Schema.Struct({
+  branchId: BranchId,
+  capabilityId: Schema.NonEmptyString,
+  access: Access,
+  ttlMs: Schema.Int.check(Schema.isGreaterThan(0)),
+  /** Absolute expiry ceiling for a capability delegated from a parent. */
+  maxExpiresAtMs: Schema.optionalKey(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+})
+
+/**
+ * What a freshly minted capability grants.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type MintRequest = typeof MintRequest.Type
+
+/**
+ * Share capability operations.
+ *
+ * `mint` fails with a `SyncError` when the Web Crypto signing operation
+ * rejects or the absolute expiry ceiling has elapsed; `verify` fails with a
+ * `SyncError` when signing rejects or the capability is refused.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export interface Service {
+  readonly mint: (request: MintRequest) => Effect.Effect<ShareCapability, SyncError>
+  readonly verify: (
+    capability: ShareCapability,
+    request: AuthorizeRequest
+  ) => Effect.Effect<ShareClaims, SyncError>
+}
+
+/**
+ * The branch share-capability authority.
+ *
+ * @category services
+ * @since 0.1.0
+ */
+export class BranchShare extends Context.Service<BranchShare, Service>()("@smthrs/sync/BranchShare") {}
+
+const denied = shareSigner.unauthorized
+
+/**
+ * Constructs a share authority that mints nothing and trusts nothing.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeNoop = (overrides: Partial<Service> = {}): Service =>
+  BranchShare.of({
+    // Both operations FAIL. `mint` used to die, which contradicted its own
+    // declared `Effect<ShareCapability, SyncError>` and left a consumer
+    // wired to this authority unable to tell "sharing is off" from a bug.
+    mint: () => Effect.fail(denied("Branch sharing is unavailable")),
+    verify: () => Effect.fail(denied("Branch sharing is unavailable")),
+    ...overrides
+  })
+
+/**
+ * Provides a share authority that refuses every capability.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerNoop: Layer.Layer<BranchShare> = Layer.succeed(BranchShare, makeNoop())
+
+/**
+ * Domain separation: the label leads the signed encoding, so a branch
+ * signature can never be replayed as a workspace signature (or any later
+ * scheme's) under a shared secret. `WorkspaceShare` has always led with its
+ * own label; a one-sided label protects one direction, and the branch side is
+ * the one anonymous share-link holders reach.
+ */
+const schemeLabel = "@smthrs/sync/BranchShare/v2"
+
+/** Length-prefixed so no two distinct claim sets share an encoding. */
+const canonical = (claims: ShareClaims): string =>
+  shareSigner.lengthPrefixed([
+    schemeLabel,
+    claims.kid,
+    claims.branchId,
+    claims.capabilityId,
+    claims.access,
+    String(claims.issuedAtMs),
+    String(claims.expiresAtMs)
+  ])
+
+/**
+ * The claim fields, copied out of the capability the caller owns.
+ *
+ * `Schema.Class` instances are not frozen, and `verify` awaits Web Crypto
+ * between signing the claims and authorizing them. Reading the caller's object
+ * again after the await let an in-process holder of the same instance widen
+ * `access` — or move `expiresAtMs` — between the signature that was checked
+ * and the checks that follow it.
+ */
+const snapshot = (claims: ShareClaims): ShareClaims =>
+  new ShareClaims({
+    kid: claims.kid,
+    branchId: claims.branchId,
+    capabilityId: claims.capabilityId,
+    access: claims.access,
+    issuedAtMs: claims.issuedAtMs,
+    expiresAtMs: claims.expiresAtMs
+  })
+
+/**
+ * One named signing key. The secret is `Redacted` so a keyring never renders
+ * it into logs or inspection output.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Key = shareSigner.Key
+
+/**
+ * A keyring: the key that signs new capabilities plus every key still
+ * accepted for verification. Rotation adds a new active key and keeps the
+ * retired one in `keys` until its outstanding links expire, so rotating the
+ * branch secret no longer breaks every share link that is already out.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type Keyring = shareSigner.Keyring
+
+/**
+ * Constructs the HMAC-SHA-256 share authority over a keyring.
+ *
+ * Every key is imported up front, so a misconfigured keyring — an unknown
+ * active kid, a duplicate kid, or a key Web Crypto refuses — fails at
+ * construction rather than at the first request. Secrets enter as `Redacted`
+ * values: an authority never holds a plain string that a log, a span, or an
+ * inspection of the keyring could render.
+ *
+ * @category constructors
+ * @since 0.1.0
+ */
+export const makeHmac = (keyring: Keyring): Effect.Effect<Service, SyncError> =>
+  Effect.map(
+    shareSigner.importKeyring(keyring, "branch"),
+    (ring) => {
+      const mint = Effect.fn("BranchShare.mint")(function*(request: MintRequest) {
+        // Decoded, not read: the declared parameter type admits an empty
+        // branch id, an empty capability id and a non-positive ttl that the
+        // schema forbids, and reading them straight into `new ShareClaims`
+        // turned a caller's bad argument into a defect out of an operation
+        // whose type promises a `SyncError`. A `ttlMs` of 0 minted an
+        // already-expired capability instead of being refused.
+        const admitted = yield* Admission.decode(MintRequest, request, "invalid_request")
+        yield* Effect.annotateCurrentSpan({ branchId: admitted.branchId, access: admitted.access })
+        const issuedAtMs = yield* Clock.currentTimeMillis
+        const maxExpiresAtMs = admitted.maxExpiresAtMs ?? Infinity
+        if (issuedAtMs >= maxExpiresAtMs) {
+          return yield* Effect.fail(denied("The share capability has expired"))
+        }
+        const claims = new ShareClaims({
+          kid: ring.activeKid,
+          branchId: admitted.branchId,
+          capabilityId: admitted.capabilityId,
+          access: admitted.access,
+          issuedAtMs,
+          expiresAtMs: Math.min(issuedAtMs + admitted.ttlMs, maxExpiresAtMs)
+        })
+        return new ShareCapability({
+          claims,
+          signature: yield* shareSigner.signHmac(ring.active, canonical(claims))
+        })
+      })
+
+      const verify = Effect.fn("BranchShare.verify")(function*(
+        capability: ShareCapability,
+        request: AuthorizeRequest
+      ) {
+        yield* Effect.annotateCurrentSpan({ branchId: request.branchId, access: request.access })
+        // Everything authorized below is read from these locals, never from
+        // the caller's objects, which may change while Web Crypto is awaited.
+        const claims = snapshot(capability.claims)
+        const signature = capability.signature
+        const branchId = request.branchId
+        const key = ring.verification.get(claims.kid)
+        if (key === undefined) {
+          return yield* Effect.fail(denied("The share capability names an unknown signing key"))
+        }
+        yield* shareSigner.verifyClaims({
+          key,
+          canonical: canonical(claims),
+          signature,
+          expiresAtMs: claims.expiresAtMs,
+          granted: claims.access,
+          requested: request.access,
+          subject: "The share capability",
+          // The one check this authority adds, run after the signature so a
+          // forged claim set is refused as a bad signature and never reported
+          // back as the branch it names.
+          scope: claims.branchId === branchId
+            ? Effect.void
+            : Effect.fail(denied(`The share capability is scoped to branch ${claims.branchId}`))
+        })
+        return claims
+      })
+
+      return BranchShare.of({ mint, verify })
+    }
+  )
+
+/**
+ * Provides the HMAC-SHA-256 share authority over a keyring.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerHmac = (keyring: Keyring): Layer.Layer<BranchShare, SyncError> =>
+  Layer.effect(BranchShare, makeHmac(keyring))
+
+/**
+ * Provides the branch share authority from configuration: the secret from
+ * `SMITHERS_SYNC_BRANCH_SECRET` (read as `Redacted`, never logged) and the key
+ * name from `SMITHERS_SYNC_BRANCH_KEY_ID`, defaulting to `primary`. Rotation
+ * beyond one configured key uses {@link layerHmac} with an explicit keyring.
+ *
+ * The names are the branch authority's own, not the workspace's: the scheme
+ * label makes one secret in both authorities survivable, not advisable, and a
+ * deployment that rotates one credential should not silently invalidate the
+ * other's outstanding capabilities.
+ *
+ * There is deliberately no default secret: a deployment that configures
+ * neither name fails to construct the authority, and every branch operation
+ * stays closed.
+ *
+ * @category layers
+ * @since 1.0.0-rc.0
+ */
+export const layerConfig: Layer.Layer<BranchShare, SyncError | Config.ConfigError> = Layer.effect(
+  BranchShare,
+  Effect.gen(function*() {
+    const secret = yield* Config.Redacted("SMITHERS_SYNC_BRANCH_SECRET")
+    const kid = yield* Config.String("SMITHERS_SYNC_BRANCH_KEY_ID").pipe(Config.withDefault("primary"))
+    return yield* makeHmac({ activeKid: kid, keys: [{ kid, secret }] })
+  })
+)