@yielded/auth-electron 0.1.0-beta.17

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel van der Merwe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,51 @@
+# @yielded/auth-electron
+
+Open hosted sign-in in the system browser and keep the native session in
+Electron's main process. The renderer receives public session data, never credentials.
+
+Install alongside Electron and Effect:
+
+```sh
+bun add @yielded/auth-electron@beta @yielded/auth@beta effect
+```
+
+Import `BrowserLogin` from `@yielded/auth-electron`. The
+[Electron example](../../examples/browser-login-electron) shows complete setup.
+
+- Hold Electron's single-instance lock, then acquire
+  `makeBrowser({ hostedUrl, returnUrl })` synchronously before `app.whenReady()`.
+  Keep it in the application's `Scope` so callbacks can arrive during startup.
+- After readiness, provide `layerVault({ path })` with Effect `FileSystem` and
+  `Path`. Use one writer and a private absolute path per app, backend, and client.
+- Provide both services to core `BrowserLogin.makeClient`, sharing the vault with
+  the native `OperationHttpClient`. Keep credential-bearing operations in main.
+
+The hosted page requires HTTPS, except for loopback HTTP development. Register
+the exact return URL with the server. Electron does not support `ephemeral: true`;
+it cannot promise a private system-browser session or close the tab on cancellation.
+
+## Callback setup
+
+For custom schemes, macOS requires a packaged app declaring the scheme in
+`Info.plist`. Linux requires a packaged app with an installed `.desktop` handler
+selected as default. Windows supports packaged apps and development registration
+with the executable and application paths. See the example for platform steps.
+
+HTTPS callbacks require a signed, packaged macOS app with an Associated Domains
+entitlement and a matching website association. Follow the
+[claimed HTTPS callback setup](../../docs/src/content/docs/reference/browser-login.md#apple-association)
+to compose and host your app's association file. Browser and user
+preferences may still require **Open in app**. Windows and Linux support only
+custom schemes through this adapter.
+
+## Storage and recovery
+
+OS encryption is required. Linux needs GNOME Keyring or KWallet; there is no
+plaintext fallback. Keep the signing identity stable for macOS Keychain access.
+Windows encryption does not isolate the vault from other apps running as the same user.
+
+Pending login state survives restarts; use `resume` while the attempt is valid.
+Never delete an unreadable vault or reset an uncertain exchange just to restart login:
+a native session may already exist. Follow
+[session recovery](../../docs/src/content/docs/reference/browser-login.md#recovery)
+before retiring the attempt or resetting storage.

package/dist/BrowserLogin.d.mts

@@ -0,0 +1,8 @@
+import { layerBrowser, makeBrowser } from "./internal/browser.mjs";
+import { layerVault } from "./internal/vault.mjs";
+declare namespace BrowserLogin_d_exports {
+  export { layerBrowser, layerVault, makeBrowser };
+}
+//#endregion
+export { BrowserLogin_d_exports, layerBrowser, layerVault, makeBrowser };
+//# sourceMappingURL=BrowserLogin.d.mts.map

package/dist/BrowserLogin.mjs

@@ -0,0 +1,13 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.mjs";
+import { layerBrowser, makeBrowser } from "./internal/browser.mjs";
+import { layerVault } from "./internal/vault.mjs";
+//#region src/BrowserLogin.ts
+var BrowserLogin_exports = /* @__PURE__ */ __exportAll({
+	layerBrowser: () => layerBrowser,
+	layerVault: () => layerVault,
+	makeBrowser: () => makeBrowser
+});
+//#endregion
+export { BrowserLogin_exports, layerBrowser, layerVault, makeBrowser };
+
+//# sourceMappingURL=BrowserLogin.mjs.map

package/dist/BrowserLogin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserLogin.mjs","names":[],"sources":["../src/BrowserLogin.ts"],"sourcesContent":["export { makeBrowser, layerBrowser } from \"./internal/browser\";\nexport { layerVault } from \"./internal/vault\";\n"],"mappings":""}

package/dist/_virtual/_rolldown/runtime.mjs

@@ -0,0 +1,13 @@
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+export { __exportAll };

package/dist/index.d.mts

@@ -0,0 +1,2 @@
+import { BrowserLogin_d_exports } from "./BrowserLogin.mjs";
+export { BrowserLogin_d_exports as BrowserLogin };

package/dist/index.mjs

@@ -0,0 +1,2 @@
+import { BrowserLogin_exports } from "./BrowserLogin.mjs";
+export { BrowserLogin_exports as BrowserLogin };

package/dist/internal/browser.d.mts

@@ -0,0 +1,30 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { Effect, Layer, Schema } from "effect";
+//#region src/internal/browser.d.ts
+declare const optionsSchema: Schema.Struct<{
+  readonly hostedUrl: Schema.String;
+  readonly returnUrl: Schema.String;
+}>;
+/** Acquire synchronously in the main process BEFORE app.whenReady(), under the
+ * application's Scope. The host must already hold app.requestSingleInstanceLock().
+ * No import-time listeners, protocol registration, or external browser launch.
+ * HTTPS callbacks require packaged macOS with signed associated domains and a
+ * matching website association. Only OS-delivered Universal Links are accepted;
+ * this adapter cannot preflight the OS association. Custom schemes require a
+ * packaged Info.plist on macOS or installed .desktop handler on Linux. Windows
+ * also supports the default Electron executable in development.
+ */
+export declare const makeBrowser: (options: {
+  readonly hostedUrl: string;
+  readonly returnUrl: string;
+}) => Effect.Effect<{
+  readonly open: (input: {
+    readonly url: string;
+    readonly returnUrl: string;
+    readonly ephemeral: boolean;
+  }) => Effect.Effect<string, BrowserLogin.PlatformError>;
+}, BrowserLogin.PlatformError, import("effect/Scope").Scope>;
+/** Build before app readiness, or use makeBrowser for synchronous startup capture. */
+export declare const layerBrowser: (options: typeof optionsSchema.Type) => Layer.Layer<BrowserLogin.Browser, BrowserLogin.PlatformError, never>;
+//#endregion
+//# sourceMappingURL=browser.d.mts.map

package/dist/internal/browser.mjs

@@ -0,0 +1,142 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { Effect, Layer, Schema } from "effect";
+import { app, shell } from "electron";
+//#region src/internal/browser.ts
+const unavailable = () => BrowserLogin.PlatformError.make({ reason: "unavailable" });
+const optionsSchema = Schema.Struct({
+	hostedUrl: BrowserLogin.HostedUrl,
+	returnUrl: BrowserLogin.ReturnUrl
+});
+/** Acquire synchronously in the main process BEFORE app.whenReady(), under the
+* application's Scope. The host must already hold app.requestSingleInstanceLock().
+* No import-time listeners, protocol registration, or external browser launch.
+* HTTPS callbacks require packaged macOS with signed associated domains and a
+* matching website association. Only OS-delivered Universal Links are accepted;
+* this adapter cannot preflight the OS association. Custom schemes require a
+* packaged Info.plist on macOS or installed .desktop handler on Linux. Windows
+* also supports the default Electron executable in development.
+*/
+const makeBrowser = Effect.fnUntraced(function* (options) {
+	if (process.type !== "browser" || !app.hasSingleInstanceLock()) return yield* unavailable();
+	const config = yield* Schema.decodeEffect(optionsSchema)(options).pipe(Effect.mapError(unavailable));
+	const target = new URL(config.returnUrl);
+	const scheme = target.protocol.slice(0, -1);
+	const universalLink = scheme === "https";
+	if (universalLink && (process.platform !== "darwin" || !app.isPackaged || target.port !== "")) return yield* unavailable();
+	const callbackSchema = Schema.String.check(Schema.isMaxLength(2304), Schema.makeFilter((text) => {
+		try {
+			const url = new URL(text);
+			const keys = [...url.searchParams.keys()];
+			if (url.href !== text || url.username || url.password || url.hash || keys.length !== 2 || !keys.includes("code") || !keys.includes("state") || !Schema.is(BrowserLogin.Random)(url.searchParams.get("code")) || !Schema.is(BrowserLogin.Random)(url.searchParams.get("state"))) return false;
+			url.search = "";
+			return url.href === config.returnUrl;
+		} catch {
+			return false;
+		}
+	}));
+	const openSchema = Schema.Struct({
+		returnUrl: Schema.Literal(config.returnUrl),
+		ephemeral: Schema.Literal(false),
+		url: Schema.String.check(Schema.isMaxLength(config.hostedUrl.length + 9 + 43), Schema.makeFilter((text) => {
+			try {
+				const url = new URL(text);
+				if (url.href !== text || url.hash || [...url.searchParams.keys()].join() !== "attempt" || !Schema.is(BrowserLogin.Random)(url.searchParams.get("attempt"))) return false;
+				url.search = "";
+				return url.href === config.hostedUrl;
+			} catch {
+				return false;
+			}
+		}))
+	});
+	const queued = [];
+	let receive;
+	let close;
+	let disposed = false;
+	const capture = (url) => {
+		if (disposed || !Schema.is(callbackSchema)(url)) return;
+		if (receive !== void 0) receive(url);
+		else if (!queued.includes(url) && queued.length < 8) queued.push(url);
+	};
+	const openUrl = (event, url) => {
+		if (!Schema.is(callbackSchema)(url)) return;
+		event.preventDefault();
+		capture(url);
+	};
+	const secondInstance = (_event, argv) => {
+		for (const arg of argv) capture(arg);
+	};
+	const activitySchema = Schema.Struct({ webpageURL: callbackSchema });
+	const continueActivity = (event, type, _userInfo, details) => {
+		if (type !== "NSUserActivityTypeBrowsingWeb" || !Schema.is(activitySchema)(details)) return;
+		event.preventDefault();
+		capture(details.webpageURL);
+	};
+	yield* Effect.acquireRelease(Effect.sync(() => {
+		if (universalLink) app.on("continue-activity", continueActivity);
+		else {
+			app.on("open-url", openUrl);
+			app.on("second-instance", secondInstance);
+			for (const arg of process.argv) capture(arg);
+		}
+	}), () => Effect.sync(() => {
+		disposed = true;
+		if (universalLink) app.removeListener("continue-activity", continueActivity);
+		else {
+			app.removeListener("open-url", openUrl);
+			app.removeListener("second-instance", secondInstance);
+		}
+		queued.length = 0;
+		close?.();
+	}));
+	const prepare = Effect.try({
+		try: () => {
+			if (!app.isReady() || disposed) return false;
+			if (universalLink) return process.platform === "darwin" && app.isPackaged;
+			if (process.platform === "linux") return app.isPackaged && app.isDefaultProtocolClient(scheme);
+			if (process.platform === "darwin") return app.isPackaged && app.setAsDefaultProtocolClient(scheme) && app.isDefaultProtocolClient(scheme);
+			if (process.platform !== "win32") return false;
+			const args = process.defaultApp ? [app.getAppPath()] : [];
+			return app.setAsDefaultProtocolClient(scheme, process.execPath, args) && app.isDefaultProtocolClient(scheme, process.execPath, args);
+		},
+		catch: unavailable
+	}).pipe(Effect.flatMap((available) => available ? Effect.void : Effect.fail(unavailable())));
+	return BrowserLogin.Browser.of({ open: Effect.fnUntraced(function* (input) {
+		const request = yield* Schema.decodeUnknownEffect(openSchema)(input).pipe(Effect.mapError(unavailable));
+		yield* prepare;
+		return yield* Effect.callback((resume) => {
+			if (receive !== void 0) {
+				resume(Effect.fail(BrowserLogin.PlatformError.make({ reason: "busy" })));
+				return;
+			}
+			let active = true;
+			const cleanup = () => {
+				if (!active) return;
+				active = false;
+				receive = void 0;
+				close = void 0;
+			};
+			const finish = (result) => {
+				if (active) {
+					cleanup();
+					resume(result);
+				}
+			};
+			receive = (url) => finish(Effect.succeed(url));
+			close = () => finish(Effect.fail(unavailable()));
+			const pending = queued.shift();
+			if (pending !== void 0) receive(pending);
+			else try {
+				shell.openExternal(request.url).catch(() => finish(Effect.fail(unavailable())));
+			} catch {
+				finish(Effect.fail(unavailable()));
+			}
+			return Effect.sync(cleanup);
+		}).pipe(Effect.timeout("10 minutes"), Effect.catchTag("TimeoutError", () => Effect.fail(BrowserLogin.PlatformError.make({ reason: "expired" }))));
+	}) });
+});
+/** Build before app readiness, or use makeBrowser for synchronous startup capture. */
+const layerBrowser = (options) => Layer.effect(BrowserLogin.Browser, makeBrowser(options));
+//#endregion
+export { layerBrowser, makeBrowser };
+
+//# sourceMappingURL=browser.mjs.map

package/dist/internal/browser.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.mjs","names":[],"sources":["../../src/internal/browser.ts"],"sourcesContent":["import * as BrowserLogin from \"@yielded/auth/BrowserLogin\";\nimport { Effect, Layer, Schema } from \"effect\";\nimport { app, shell, type Event } from \"electron\";\n\nconst unavailable = () => BrowserLogin.PlatformError.make({ reason: \"unavailable\" });\n\nconst optionsSchema = Schema.Struct({\n  hostedUrl: BrowserLogin.HostedUrl,\n  returnUrl: BrowserLogin.ReturnUrl,\n});\n\n/** Acquire synchronously in the main process BEFORE app.whenReady(), under the\n * application's Scope. The host must already hold app.requestSingleInstanceLock().\n * No import-time listeners, protocol registration, or external browser launch.\n * HTTPS callbacks require packaged macOS with signed associated domains and a\n * matching website association. Only OS-delivered Universal Links are accepted;\n * this adapter cannot preflight the OS association. Custom schemes require a\n * packaged Info.plist on macOS or installed .desktop handler on Linux. Windows\n * also supports the default Electron executable in development.\n */\nexport const makeBrowser = Effect.fnUntraced(function* (options: typeof optionsSchema.Type) {\n  if (process.type !== \"browser\" || !app.hasSingleInstanceLock()) return yield* unavailable();\n\n  const config = yield* Schema.decodeEffect(optionsSchema)(options).pipe(\n    Effect.mapError(unavailable),\n  );\n\n  const target = new URL(config.returnUrl);\n  const scheme = target.protocol.slice(0, -1);\n  const universalLink = scheme === \"https\";\n\n  if (universalLink && (process.platform !== \"darwin\" || !app.isPackaged || target.port !== \"\"))\n    return yield* unavailable();\n\n  const callbackSchema = Schema.String.check(\n    Schema.isMaxLength(2304),\n    Schema.makeFilter((text) => {\n      try {\n        const url = new URL(text);\n        const keys = [...url.searchParams.keys()];\n\n        if (\n          url.href !== text ||\n          url.username ||\n          url.password ||\n          url.hash ||\n          keys.length !== 2 ||\n          !keys.includes(\"code\") ||\n          !keys.includes(\"state\") ||\n          !Schema.is(BrowserLogin.Random)(url.searchParams.get(\"code\")) ||\n          !Schema.is(BrowserLogin.Random)(url.searchParams.get(\"state\"))\n        )\n          return false;\n        url.search = \"\";\n\n        return url.href === config.returnUrl;\n      } catch {\n        return false;\n      }\n    }),\n  );\n\n  const openSchema = Schema.Struct({\n    returnUrl: Schema.Literal(config.returnUrl),\n    ephemeral: Schema.Literal(false),\n    url: Schema.String.check(\n      Schema.isMaxLength(config.hostedUrl.length + \"?attempt=\".length + 43),\n      Schema.makeFilter((text) => {\n        try {\n          const url = new URL(text);\n\n          if (\n            url.href !== text ||\n            url.hash ||\n            [...url.searchParams.keys()].join() !== \"attempt\" ||\n            !Schema.is(BrowserLogin.Random)(url.searchParams.get(\"attempt\"))\n          )\n            return false;\n          url.search = \"\";\n\n          return url.href === config.hostedUrl;\n        } catch {\n          return false;\n        }\n      }),\n    ),\n  });\n\n  const queued: string[] = [];\n  let receive: ((url: string) => void) | undefined;\n  let close: (() => void) | undefined;\n  let disposed = false;\n\n  const capture = (url: string) => {\n    if (disposed || !Schema.is(callbackSchema)(url)) return;\n    if (receive !== undefined) receive(url);\n    else if (!queued.includes(url) && queued.length < 8) queued.push(url);\n  };\n\n  const openUrl = (event: Event, url: string) => {\n    if (!Schema.is(callbackSchema)(url)) return;\n    event.preventDefault();\n    capture(url);\n  };\n\n  const secondInstance = (_event: Event, argv: string[]) => {\n    for (const arg of argv) capture(arg);\n  };\n\n  const activitySchema = Schema.Struct({ webpageURL: callbackSchema });\n\n  const continueActivity = (event: Event, type: string, _userInfo: unknown, details: unknown) => {\n    if (type !== \"NSUserActivityTypeBrowsingWeb\" || !Schema.is(activitySchema)(details)) return;\n    event.preventDefault();\n    capture(details.webpageURL);\n  };\n\n  yield* Effect.acquireRelease(\n    Effect.sync(() => {\n      if (universalLink) app.on(\"continue-activity\", continueActivity);\n      else {\n        app.on(\"open-url\", openUrl);\n        app.on(\"second-instance\", secondInstance);\n        for (const arg of process.argv) capture(arg);\n      }\n    }),\n    () =>\n      Effect.sync(() => {\n        disposed = true;\n        if (universalLink) app.removeListener(\"continue-activity\", continueActivity);\n        else {\n          app.removeListener(\"open-url\", openUrl);\n          app.removeListener(\"second-instance\", secondInstance);\n        }\n        queued.length = 0;\n        close?.();\n      }),\n  );\n\n  const prepare = Effect.try({\n    try: () => {\n      if (!app.isReady() || disposed) return false;\n      // Associated domains are verified by macOS when routing the callback.\n      // Registering as the default HTTPS handler would not establish ownership.\n      if (universalLink) return process.platform === \"darwin\" && app.isPackaged;\n      if (process.platform === \"linux\")\n        return app.isPackaged && app.isDefaultProtocolClient(scheme);\n      if (process.platform === \"darwin\")\n        return (\n          app.isPackaged &&\n          app.setAsDefaultProtocolClient(scheme) &&\n          app.isDefaultProtocolClient(scheme)\n        );\n      if (process.platform !== \"win32\") return false;\n      const args = process.defaultApp ? [app.getAppPath()] : [];\n\n      return (\n        app.setAsDefaultProtocolClient(scheme, process.execPath, args) &&\n        app.isDefaultProtocolClient(scheme, process.execPath, args)\n      );\n    },\n    catch: unavailable,\n  }).pipe(Effect.flatMap((available) => (available ? Effect.void : Effect.fail(unavailable()))));\n\n  return BrowserLogin.Browser.of({\n    open: Effect.fnUntraced(function* (input) {\n      const request = yield* Schema.decodeUnknownEffect(openSchema)(input).pipe(\n        Effect.mapError(unavailable),\n      );\n\n      yield* prepare;\n\n      return yield* Effect.callback<string, BrowserLogin.PlatformError>((resume) => {\n        if (receive !== undefined) {\n          resume(Effect.fail(BrowserLogin.PlatformError.make({ reason: \"busy\" })));\n\n          return;\n        }\n        let active = true;\n\n        const cleanup = () => {\n          if (!active) return;\n          active = false;\n          receive = undefined;\n          close = undefined;\n        };\n\n        const finish = (result: Effect.Effect<string, BrowserLogin.PlatformError>) => {\n          if (active) {\n            cleanup();\n            resume(result);\n          }\n        };\n\n        receive = (url) => finish(Effect.succeed(url));\n        close = () => finish(Effect.fail(unavailable()));\n        const pending = queued.shift();\n\n        if (pending !== undefined) receive(pending);\n        else {\n          try {\n            void shell.openExternal(request.url).catch(() => finish(Effect.fail(unavailable())));\n          } catch {\n            finish(Effect.fail(unavailable()));\n          }\n        }\n\n        return Effect.sync(cleanup);\n      }).pipe(\n        Effect.timeout(\"10 minutes\"),\n        Effect.catchTag(\"TimeoutError\", () =>\n          Effect.fail(BrowserLogin.PlatformError.make({ reason: \"expired\" })),\n        ),\n      );\n    }),\n  });\n});\n\n/** Build before app readiness, or use makeBrowser for synchronous startup capture. */\nexport const layerBrowser = (options: typeof optionsSchema.Type) =>\n  Layer.effect(BrowserLogin.Browser, makeBrowser(options));\n"],"mappings":";;;;AAIA,MAAM,oBAAoB,aAAa,cAAc,KAAK,EAAE,QAAQ,cAAc,CAAC;AAEnF,MAAM,gBAAgB,OAAO,OAAO;CAClC,WAAW,aAAa;CACxB,WAAW,aAAa;AAC1B,CAAC;;;;;;;;;;AAWD,MAAa,cAAc,OAAO,WAAW,WAAW,SAAoC;CAC1F,IAAI,QAAQ,SAAS,aAAa,CAAC,IAAI,sBAAsB,GAAG,OAAO,OAAO,YAAY;CAE1F,MAAM,SAAS,OAAO,OAAO,aAAa,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC,KAChE,OAAO,SAAS,WAAW,CAC7B;CAEA,MAAM,SAAS,IAAI,IAAI,OAAO,SAAS;CACvC,MAAM,SAAS,OAAO,SAAS,MAAM,GAAG,EAAE;CAC1C,MAAM,gBAAgB,WAAW;CAEjC,IAAI,kBAAkB,QAAQ,aAAa,YAAY,CAAC,IAAI,cAAc,OAAO,SAAS,KACxF,OAAO,OAAO,YAAY;CAE5B,MAAM,iBAAiB,OAAO,OAAO,MACnC,OAAO,YAAY,IAAI,GACvB,OAAO,YAAY,SAAS;EAC1B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,IAAI;GACxB,MAAM,OAAO,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC;GAExC,IACE,IAAI,SAAS,QACb,IAAI,YACJ,IAAI,YACJ,IAAI,QACJ,KAAK,WAAW,KAChB,CAAC,KAAK,SAAS,MAAM,KACrB,CAAC,KAAK,SAAS,OAAO,KACtB,CAAC,OAAO,GAAG,aAAa,MAAM,CAAC,CAAC,IAAI,aAAa,IAAI,MAAM,CAAC,KAC5D,CAAC,OAAO,GAAG,aAAa,MAAM,CAAC,CAAC,IAAI,aAAa,IAAI,OAAO,CAAC,GAE7D,OAAO;GACT,IAAI,SAAS;GAEb,OAAO,IAAI,SAAS,OAAO;EAC7B,QAAQ;GACN,OAAO;EACT;CACF,CAAC,CACH;CAEA,MAAM,aAAa,OAAO,OAAO;EAC/B,WAAW,OAAO,QAAQ,OAAO,SAAS;EAC1C,WAAW,OAAO,QAAQ,KAAK;EAC/B,KAAK,OAAO,OAAO,MACjB,OAAO,YAAY,OAAO,UAAU,SAAS,IAAqB,EAAE,GACpE,OAAO,YAAY,SAAS;GAC1B,IAAI;IACF,MAAM,MAAM,IAAI,IAAI,IAAI;IAExB,IACE,IAAI,SAAS,QACb,IAAI,QACJ,CAAC,GAAG,IAAI,aAAa,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,aACxC,CAAC,OAAO,GAAG,aAAa,MAAM,CAAC,CAAC,IAAI,aAAa,IAAI,SAAS,CAAC,GAE/D,OAAO;IACT,IAAI,SAAS;IAEb,OAAO,IAAI,SAAS,OAAO;GAC7B,QAAQ;IACN,OAAO;GACT;EACF,CAAC,CACH;CACF,CAAC;CAED,MAAM,SAAmB,CAAC;CAC1B,IAAI;CACJ,IAAI;CACJ,IAAI,WAAW;CAEf,MAAM,WAAW,QAAgB;EAC/B,IAAI,YAAY,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC,GAAG,GAAG;EACjD,IAAI,YAAY,KAAA,GAAW,QAAQ,GAAG;OACjC,IAAI,CAAC,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,GAAG,OAAO,KAAK,GAAG;CACtE;CAEA,MAAM,WAAW,OAAc,QAAgB;EAC7C,IAAI,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC,GAAG,GAAG;EACrC,MAAM,eAAe;EACrB,QAAQ,GAAG;CACb;CAEA,MAAM,kBAAkB,QAAe,SAAmB;EACxD,KAAK,MAAM,OAAO,MAAM,QAAQ,GAAG;CACrC;CAEA,MAAM,iBAAiB,OAAO,OAAO,EAAE,YAAY,eAAe,CAAC;CAEnE,MAAM,oBAAoB,OAAc,MAAc,WAAoB,YAAqB;EAC7F,IAAI,SAAS,mCAAmC,CAAC,OAAO,GAAG,cAAc,CAAC,CAAC,OAAO,GAAG;EACrF,MAAM,eAAe;EACrB,QAAQ,QAAQ,UAAU;CAC5B;CAEA,OAAO,OAAO,eACZ,OAAO,WAAW;EAChB,IAAI,eAAe,IAAI,GAAG,qBAAqB,gBAAgB;OAC1D;GACH,IAAI,GAAG,YAAY,OAAO;GAC1B,IAAI,GAAG,mBAAmB,cAAc;GACxC,KAAK,MAAM,OAAO,QAAQ,MAAM,QAAQ,GAAG;EAC7C;CACF,CAAC,SAEC,OAAO,WAAW;EAChB,WAAW;EACX,IAAI,eAAe,IAAI,eAAe,qBAAqB,gBAAgB;OACtE;GACH,IAAI,eAAe,YAAY,OAAO;GACtC,IAAI,eAAe,mBAAmB,cAAc;EACtD;EACA,OAAO,SAAS;EAChB,QAAQ;CACV,CAAC,CACL;CAEA,MAAM,UAAU,OAAO,IAAI;EACzB,WAAW;GACT,IAAI,CAAC,IAAI,QAAQ,KAAK,UAAU,OAAO;GAGvC,IAAI,eAAe,OAAO,QAAQ,aAAa,YAAY,IAAI;GAC/D,IAAI,QAAQ,aAAa,SACvB,OAAO,IAAI,cAAc,IAAI,wBAAwB,MAAM;GAC7D,IAAI,QAAQ,aAAa,UACvB,OACE,IAAI,cACJ,IAAI,2BAA2B,MAAM,KACrC,IAAI,wBAAwB,MAAM;GAEtC,IAAI,QAAQ,aAAa,SAAS,OAAO;GACzC,MAAM,OAAO,QAAQ,aAAa,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC;GAExD,OACE,IAAI,2BAA2B,QAAQ,QAAQ,UAAU,IAAI,KAC7D,IAAI,wBAAwB,QAAQ,QAAQ,UAAU,IAAI;EAE9D;EACA,OAAO;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,cAAe,YAAY,OAAO,OAAO,OAAO,KAAK,YAAY,CAAC,CAAE,CAAC;CAE7F,OAAO,aAAa,QAAQ,GAAG,EAC7B,MAAM,OAAO,WAAW,WAAW,OAAO;EACxC,MAAM,UAAU,OAAO,OAAO,oBAAoB,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KACnE,OAAO,SAAS,WAAW,CAC7B;EAEA,OAAO;EAEP,OAAO,OAAO,OAAO,UAA8C,WAAW;GAC5E,IAAI,YAAY,KAAA,GAAW;IACzB,OAAO,OAAO,KAAK,aAAa,cAAc,KAAK,EAAE,QAAQ,OAAO,CAAC,CAAC,CAAC;IAEvE;GACF;GACA,IAAI,SAAS;GAEb,MAAM,gBAAgB;IACpB,IAAI,CAAC,QAAQ;IACb,SAAS;IACT,UAAU,KAAA;IACV,QAAQ,KAAA;GACV;GAEA,MAAM,UAAU,WAA8D;IAC5E,IAAI,QAAQ;KACV,QAAQ;KACR,OAAO,MAAM;IACf;GACF;GAEA,WAAW,QAAQ,OAAO,OAAO,QAAQ,GAAG,CAAC;GAC7C,cAAc,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC;GAC/C,MAAM,UAAU,OAAO,MAAM;GAE7B,IAAI,YAAY,KAAA,GAAW,QAAQ,OAAO;QAExC,IAAI;IACF,MAAW,aAAa,QAAQ,GAAG,CAAC,CAAC,YAAY,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;GACrF,QAAQ;IACN,OAAO,OAAO,KAAK,YAAY,CAAC,CAAC;GACnC;GAGF,OAAO,OAAO,KAAK,OAAO;EAC5B,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,YAAY,GAC3B,OAAO,SAAS,sBACd,OAAO,KAAK,aAAa,cAAc,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CACpE,CACF;CACF,CAAC,EACH,CAAC;AACH,CAAC;;AAGD,MAAa,gBAAgB,YAC3B,MAAM,OAAO,aAAa,SAAS,YAAY,OAAO,CAAC"}

package/dist/internal/vault.d.mts

@@ -0,0 +1,13 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { FileSystem, Layer, Path } from "effect";
+//#region src/internal/vault.d.ts
+/** One writer per private application/environment path, protected by the host's
+ * single-instance lock. Never reset an unreadable store: it may contain the
+ * Exchanging fence. Writes fsync ciphertext, close, rename on the same filesystem,
+ * then sync the parent on POSIX (the replaced file on Windows).
+ */
+export declare const layerVault: (options: {
+  readonly path: string;
+}) => Layer.Layer<BrowserLogin.Vault, BrowserLogin.PlatformError, FileSystem.FileSystem | Path.Path>;
+//#endregion
+//# sourceMappingURL=vault.d.mts.map

package/dist/internal/vault.mjs

@@ -0,0 +1,113 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { DateTime, Effect, FileSystem, Layer, Path, Schema, Semaphore } from "effect";
+import { app, safeStorage } from "electron";
+import { Buffer } from "node:buffer";
+import { OperationHttpError } from "@yielded/auth/OperationHttp";
+//#region src/internal/vault.ts
+const recordSchema = BrowserLogin.VaultRecord;
+const slots = recordSchema.fields.credentials.key.literals;
+const recordJson = Schema.fromJsonString(recordSchema);
+const failure = () => BrowserLogin.PlatformError.make({ reason: "storage" });
+/** One writer per private application/environment path, protected by the host's
+* single-instance lock. Never reset an unreadable store: it may contain the
+* Exchanging fence. Writes fsync ciphertext, close, rename on the same filesystem,
+* then sync the parent on POSIX (the replaced file on Windows).
+*/
+const layerVault = (options) => Layer.effect(BrowserLogin.Vault, Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const checkEncryption = Effect.try({
+		try: () => process.type === "browser" && app.isReady() && app.hasSingleInstanceLock() && safeStorage.isEncryptionAvailable() && (process.platform !== "linux" || [
+			"gnome_libsecret",
+			"kwallet",
+			"kwallet5",
+			"kwallet6"
+		].includes(safeStorage.getSelectedStorageBackend())),
+		catch: failure
+	}).pipe(Effect.flatMap((available) => available ? Effect.void : Effect.fail(failure())));
+	yield* checkEncryption;
+	const destination = yield* Schema.decodeEffect(Schema.NonEmptyString.check(Schema.makeFilter((value) => path.isAbsolute(value))))(options.path).pipe(Effect.mapError(failure));
+	const directory = path.dirname(destination);
+	yield* fs.makeDirectory(directory, {
+		recursive: true,
+		mode: 448
+	}).pipe(Effect.mapError(failure));
+	const gate = yield* Semaphore.make(1);
+	const readRecord = Effect.gen(function* () {
+		yield* checkEncryption;
+		const stat = yield* fs.stat(destination).pipe(Effect.catchTag("PlatformError", (error) => error.reason._tag === "NotFound" ? Effect.void : Effect.fail(error)));
+		if (stat === void 0) return { credentials: {} };
+		if (stat.type !== "File" || stat.size > 1048576) return yield* failure();
+		const bytes = yield* fs.readFile(destination);
+		const json = yield* Effect.try({
+			try: () => safeStorage.decryptString(Buffer.from(bytes)),
+			catch: failure
+		});
+		return yield* Schema.decodeEffect(recordJson)(json, { onExcessProperty: "error" });
+	}).pipe(Effect.mapError(failure));
+	const writeRecord = Effect.fnUntraced(function* (record) {
+		yield* checkEncryption;
+		const json = yield* Schema.encodeEffect(recordJson)(record);
+		const bytes = yield* Effect.try({
+			try: () => safeStorage.encryptString(json),
+			catch: failure
+		});
+		yield* Effect.scoped(Effect.gen(function* () {
+			const temporary = yield* fs.makeTempFileScoped({
+				directory,
+				prefix: ".auth-"
+			});
+			yield* fs.chmod(temporary, 384);
+			yield* Effect.scoped(Effect.gen(function* () {
+				const file = yield* fs.open(temporary, {
+					flag: "w",
+					mode: 384
+				});
+				yield* file.writeAll(bytes);
+				yield* file.sync;
+			}));
+			yield* fs.rename(temporary, destination);
+			yield* (yield* fs.open(process.platform === "win32" ? destination : directory, { flag: process.platform === "win32" ? "r+" : "r" })).sync;
+		}));
+	}, Effect.mapError(failure));
+	const locked = (effect) => gate.withPermits(1)(Effect.uninterruptible(effect));
+	const read = locked(Effect.gen(function* () {
+		const record = yield* readRecord;
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const credentials = {};
+		for (const slot of slots) {
+			const value = record.credentials[slot];
+			if (value !== void 0 && value.expiresAtMillis > now) credentials[slot] = value.credential;
+		}
+		return credentials;
+	})).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+	const accept = (commands) => locked(Effect.gen(function* () {
+		const record = yield* readRecord;
+		const credentials = { ...record.credentials };
+		for (const command of commands) if (command._tag === "Clear") delete credentials[command.slot];
+		else credentials[command.slot] = {
+			credential: command.credential,
+			expiresAtMillis: command.expiresAtMillis
+		};
+		yield* writeRecord({
+			...record,
+			credentials
+		});
+	})).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+	return BrowserLogin.Vault.of({
+		read,
+		accept,
+		loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),
+		saveAttempt: (attempt) => locked(Effect.gen(function* () {
+			const record = yield* readRecord;
+			yield* writeRecord(attempt === void 0 ? { credentials: record.credentials } : {
+				...record,
+				attempt
+			});
+		}))
+	});
+}));
+//#endregion
+export { layerVault };
+
+//# sourceMappingURL=vault.mjs.map

package/dist/internal/vault.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.mjs","names":[],"sources":["../../src/internal/vault.ts"],"sourcesContent":["import { Buffer } from \"node:buffer\";\n\nimport * as BrowserLogin from \"@yielded/auth/BrowserLogin\";\nimport { OperationHttpError } from \"@yielded/auth/OperationHttp\";\nimport type { NativeCredentials } from \"@yielded/auth/OperationHttpClient\";\nimport type { CredentialSlot } from \"@yielded/auth/Operations\";\nimport {\n  DateTime,\n  Effect,\n  FileSystem,\n  Layer,\n  Path,\n  type Redacted,\n  Schema,\n  Semaphore,\n} from \"effect\";\nimport { app, safeStorage } from \"electron\";\n\nconst recordSchema = BrowserLogin.VaultRecord;\nconst slots = recordSchema.fields.credentials.key.literals;\n\nconst recordJson = Schema.fromJsonString(recordSchema);\nconst failure = () => BrowserLogin.PlatformError.make({ reason: \"storage\" });\n\n/** One writer per private application/environment path, protected by the host's\n * single-instance lock. Never reset an unreadable store: it may contain the\n * Exchanging fence. Writes fsync ciphertext, close, rename on the same filesystem,\n * then sync the parent on POSIX (the replaced file on Windows).\n */\nexport const layerVault = (options: { readonly path: string }) =>\n  Layer.effect(\n    BrowserLogin.Vault,\n    Effect.gen(function* () {\n      const fs = yield* FileSystem.FileSystem;\n      const path = yield* Path.Path;\n\n      const checkEncryption = Effect.try({\n        try: () =>\n          process.type === \"browser\" &&\n          app.isReady() &&\n          app.hasSingleInstanceLock() &&\n          safeStorage.isEncryptionAvailable() &&\n          (process.platform !== \"linux\" ||\n            [\"gnome_libsecret\", \"kwallet\", \"kwallet5\", \"kwallet6\"].includes(\n              safeStorage.getSelectedStorageBackend(),\n            )),\n        catch: failure,\n      }).pipe(Effect.flatMap((available) => (available ? Effect.void : Effect.fail(failure()))));\n\n      yield* checkEncryption;\n\n      const destination = yield* Schema.decodeEffect(\n        Schema.NonEmptyString.check(Schema.makeFilter((value) => path.isAbsolute(value))),\n      )(options.path).pipe(Effect.mapError(failure));\n\n      const directory = path.dirname(destination);\n\n      yield* fs\n        .makeDirectory(directory, { recursive: true, mode: 0o700 })\n        .pipe(Effect.mapError(failure));\n      const gate = yield* Semaphore.make(1);\n\n      const readRecord = Effect.gen(function* () {\n        yield* checkEncryption;\n\n        const stat = yield* fs\n          .stat(destination)\n          .pipe(\n            Effect.catchTag(\"PlatformError\", (error) =>\n              error.reason._tag === \"NotFound\" ? Effect.void : Effect.fail(error),\n            ),\n          );\n\n        if (stat === undefined) return { credentials: {} } satisfies typeof recordSchema.Type;\n        if (stat.type !== \"File\" || stat.size > 1048576) return yield* failure();\n        const bytes = yield* fs.readFile(destination);\n\n        const json = yield* Effect.try({\n          try: () => safeStorage.decryptString(Buffer.from(bytes)),\n          catch: failure,\n        });\n\n        return yield* Schema.decodeEffect(recordJson)(json, { onExcessProperty: \"error\" });\n      }).pipe(Effect.mapError(failure));\n\n      const writeRecord = Effect.fnUntraced(function* (record: typeof recordSchema.Type) {\n        yield* checkEncryption;\n        const json = yield* Schema.encodeEffect(recordJson)(record);\n\n        const bytes = yield* Effect.try({\n          try: () => safeStorage.encryptString(json),\n          catch: failure,\n        });\n\n        yield* Effect.scoped(\n          Effect.gen(function* () {\n            const temporary = yield* fs.makeTempFileScoped({ directory, prefix: \".auth-\" });\n\n            yield* fs.chmod(temporary, 0o600);\n            yield* Effect.scoped(\n              Effect.gen(function* () {\n                const file = yield* fs.open(temporary, { flag: \"w\", mode: 0o600 });\n\n                yield* file.writeAll(bytes);\n                yield* file.sync;\n              }),\n            );\n            yield* fs.rename(temporary, destination);\n\n            const committed = yield* fs.open(\n              process.platform === \"win32\" ? destination : directory,\n              { flag: process.platform === \"win32\" ? \"r+\" : \"r\" },\n            );\n\n            yield* committed.sync;\n          }),\n        );\n      }, Effect.mapError(failure));\n\n      const locked = <A, E>(effect: Effect.Effect<A, E>) =>\n        gate.withPermits(1)(Effect.uninterruptible(effect));\n\n      const read: NativeCredentials[\"read\"] = locked(\n        Effect.gen(function* () {\n          const record = yield* readRecord;\n          const now = DateTime.toEpochMillis(yield* DateTime.now);\n          const credentials: Partial<Record<CredentialSlot, Redacted.Redacted<string>>> = {};\n\n          for (const slot of slots) {\n            const value = record.credentials[slot];\n\n            if (value !== undefined && value.expiresAtMillis > now)\n              credentials[slot] = value.credential;\n          }\n\n          return credentials;\n        }),\n      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"credentials\" })));\n\n      const accept: NativeCredentials[\"accept\"] = (commands) =>\n        locked(\n          Effect.gen(function* () {\n            const record = yield* readRecord;\n            const credentials = { ...record.credentials };\n\n            for (const command of commands) {\n              if (command._tag === \"Clear\") delete credentials[command.slot];\n              else\n                credentials[command.slot] = {\n                  credential: command.credential,\n                  expiresAtMillis: command.expiresAtMillis,\n                };\n            }\n            yield* writeRecord({ ...record, credentials });\n          }),\n        ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"credentials\" })));\n\n      return BrowserLogin.Vault.of({\n        read,\n        accept,\n        loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),\n        saveAttempt: (attempt) =>\n          locked(\n            Effect.gen(function* () {\n              const record = yield* readRecord;\n\n              yield* writeRecord(\n                attempt === undefined\n                  ? { credentials: record.credentials }\n                  : { ...record, attempt },\n              );\n            }),\n          ),\n      });\n    }),\n  );\n"],"mappings":";;;;;;AAkBA,MAAM,eAAe,aAAa;AAClC,MAAM,QAAQ,aAAa,OAAO,YAAY,IAAI;AAElD,MAAM,aAAa,OAAO,eAAe,YAAY;AACrD,MAAM,gBAAgB,aAAa,cAAc,KAAK,EAAE,QAAQ,UAAU,CAAC;;;;;;AAO3E,MAAa,cAAc,YACzB,MAAM,OACJ,aAAa,OACb,OAAO,IAAI,aAAa;CACtB,MAAM,KAAK,OAAO,WAAW;CAC7B,MAAM,OAAO,OAAO,KAAK;CAEzB,MAAM,kBAAkB,OAAO,IAAI;EACjC,WACE,QAAQ,SAAS,aACjB,IAAI,QAAQ,KACZ,IAAI,sBAAsB,KAC1B,YAAY,sBAAsB,MACjC,QAAQ,aAAa,WACpB;GAAC;GAAmB;GAAW;GAAY;EAAU,CAAC,CAAC,SACrD,YAAY,0BAA0B,CACxC;EACJ,OAAO;CACT,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,cAAe,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAE,CAAC;CAEzF,OAAO;CAEP,MAAM,cAAc,OAAO,OAAO,aAChC,OAAO,eAAe,MAAM,OAAO,YAAY,UAAU,KAAK,WAAW,KAAK,CAAC,CAAC,CAClF,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;CAE7C,MAAM,YAAY,KAAK,QAAQ,WAAW;CAE1C,OAAO,GACJ,cAAc,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC,CAAC,CAC1D,KAAK,OAAO,SAAS,OAAO,CAAC;CAChC,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC;CAEpC,MAAM,aAAa,OAAO,IAAI,aAAa;EACzC,OAAO;EAEP,MAAM,OAAO,OAAO,GACjB,KAAK,WAAW,CAAC,CACjB,KACC,OAAO,SAAS,kBAAkB,UAChC,MAAM,OAAO,SAAS,aAAa,OAAO,OAAO,OAAO,KAAK,KAAK,CACpE,CACF;EAEF,IAAI,SAAS,KAAA,GAAW,OAAO,EAAE,aAAa,CAAC,EAAE;EACjD,IAAI,KAAK,SAAS,UAAU,KAAK,OAAO,SAAS,OAAO,OAAO,QAAQ;EACvE,MAAM,QAAQ,OAAO,GAAG,SAAS,WAAW;EAE5C,MAAM,OAAO,OAAO,OAAO,IAAI;GAC7B,WAAW,YAAY,cAAc,OAAO,KAAK,KAAK,CAAC;GACvD,OAAO;EACT,CAAC;EAED,OAAO,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM,EAAE,kBAAkB,QAAQ,CAAC;CACnF,CAAC,CAAC,CAAC,KAAK,OAAO,SAAS,OAAO,CAAC;CAEhC,MAAM,cAAc,OAAO,WAAW,WAAW,QAAkC;EACjF,OAAO;EACP,MAAM,OAAO,OAAO,OAAO,aAAa,UAAU,CAAC,CAAC,MAAM;EAE1D,MAAM,QAAQ,OAAO,OAAO,IAAI;GAC9B,WAAW,YAAY,cAAc,IAAI;GACzC,OAAO;EACT,CAAC;EAED,OAAO,OAAO,OACZ,OAAO,IAAI,aAAa;GACtB,MAAM,YAAY,OAAO,GAAG,mBAAmB;IAAE;IAAW,QAAQ;GAAS,CAAC;GAE9E,OAAO,GAAG,MAAM,WAAW,GAAK;GAChC,OAAO,OAAO,OACZ,OAAO,IAAI,aAAa;IACtB,MAAM,OAAO,OAAO,GAAG,KAAK,WAAW;KAAE,MAAM;KAAK,MAAM;IAAM,CAAC;IAEjE,OAAO,KAAK,SAAS,KAAK;IAC1B,OAAO,KAAK;GACd,CAAC,CACH;GACA,OAAO,GAAG,OAAO,WAAW,WAAW;GAOvC,QAAO,OALkB,GAAG,KAC1B,QAAQ,aAAa,UAAU,cAAc,WAC7C,EAAE,MAAM,QAAQ,aAAa,UAAU,OAAO,IAAI,CACpD,EAAA,CAEiB;EACnB,CAAC,CACH;CACF,GAAG,OAAO,SAAS,OAAO,CAAC;CAE3B,MAAM,UAAgB,WACpB,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,gBAAgB,MAAM,CAAC;CAEpD,MAAM,OAAkC,OACtC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,cAA0E,CAAC;EAEjF,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,QAAQ,OAAO,YAAY;GAEjC,IAAI,UAAU,KAAA,KAAa,MAAM,kBAAkB,KACjD,YAAY,QAAQ,MAAM;EAC9B;EAEA,OAAO;CACT,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC;CAEhF,MAAM,UAAuC,aAC3C,OACE,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,cAAc,EAAE,GAAG,OAAO,YAAY;EAE5C,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,SAAS,SAAS,OAAO,YAAY,QAAQ;OAEvD,YAAY,QAAQ,QAAQ;GAC1B,YAAY,QAAQ;GACpB,iBAAiB,QAAQ;EAC3B;EAEJ,OAAO,YAAY;GAAE,GAAG;GAAQ;EAAY,CAAC;CAC/C,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC;CAElF,OAAO,aAAa,MAAM,GAAG;EAC3B;EACA;EACA,aAAa,OAAO,WAAW,KAAK,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC,CAAC;EAC3E,cAAc,YACZ,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO;GAEtB,OAAO,YACL,YAAY,KAAA,IACR,EAAE,aAAa,OAAO,YAAY,IAClC;IAAE,GAAG;IAAQ;GAAQ,CAC3B;EACF,CAAC,CACH;CACJ,CAAC;AACH,CAAC,CACH"}

package/package.json

@@ -0,0 +1 @@
+{"name":"@yielded/auth-electron","version":"0.1.0-beta.17","dependencies":{"@yielded/auth":"0.1.0-beta.17"},"devDependencies":{"@types/node":"26.1.2","effect":"4.0.0","electron":"44.5.1","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0","electron":"^44.5.1"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./BrowserLogin":{"types":"./dist/BrowserLogin.d.mts","default":"./dist/BrowserLogin.mjs"}},"description":"Main-process Electron browser login and encrypted credential custody for Yielded Auth.","homepage":"https://yielded.dev/auth/","license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-electron"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json"}}

package/src/BrowserLogin.ts

@@ -0,0 +1,2 @@
+export { makeBrowser, layerBrowser } from "./internal/browser";
+export { layerVault } from "./internal/vault";

package/src/index.ts

@@ -0,0 +1 @@
+export * as BrowserLogin from "./BrowserLogin.ts";

package/src/internal/browser.ts

@@ -0,0 +1,221 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { Effect, Layer, Schema } from "effect";
+import { app, shell, type Event } from "electron";
+
+const unavailable = () => BrowserLogin.PlatformError.make({ reason: "unavailable" });
+
+const optionsSchema = Schema.Struct({
+  hostedUrl: BrowserLogin.HostedUrl,
+  returnUrl: BrowserLogin.ReturnUrl,
+});
+
+/** Acquire synchronously in the main process BEFORE app.whenReady(), under the
+ * application's Scope. The host must already hold app.requestSingleInstanceLock().
+ * No import-time listeners, protocol registration, or external browser launch.
+ * HTTPS callbacks require packaged macOS with signed associated domains and a
+ * matching website association. Only OS-delivered Universal Links are accepted;
+ * this adapter cannot preflight the OS association. Custom schemes require a
+ * packaged Info.plist on macOS or installed .desktop handler on Linux. Windows
+ * also supports the default Electron executable in development.
+ */
+export const makeBrowser = Effect.fnUntraced(function* (options: typeof optionsSchema.Type) {
+  if (process.type !== "browser" || !app.hasSingleInstanceLock()) return yield* unavailable();
+
+  const config = yield* Schema.decodeEffect(optionsSchema)(options).pipe(
+    Effect.mapError(unavailable),
+  );
+
+  const target = new URL(config.returnUrl);
+  const scheme = target.protocol.slice(0, -1);
+  const universalLink = scheme === "https";
+
+  if (universalLink && (process.platform !== "darwin" || !app.isPackaged || target.port !== ""))
+    return yield* unavailable();
+
+  const callbackSchema = Schema.String.check(
+    Schema.isMaxLength(2304),
+    Schema.makeFilter((text) => {
+      try {
+        const url = new URL(text);
+        const keys = [...url.searchParams.keys()];
+
+        if (
+          url.href !== text ||
+          url.username ||
+          url.password ||
+          url.hash ||
+          keys.length !== 2 ||
+          !keys.includes("code") ||
+          !keys.includes("state") ||
+          !Schema.is(BrowserLogin.Random)(url.searchParams.get("code")) ||
+          !Schema.is(BrowserLogin.Random)(url.searchParams.get("state"))
+        )
+          return false;
+        url.search = "";
+
+        return url.href === config.returnUrl;
+      } catch {
+        return false;
+      }
+    }),
+  );
+
+  const openSchema = Schema.Struct({
+    returnUrl: Schema.Literal(config.returnUrl),
+    ephemeral: Schema.Literal(false),
+    url: Schema.String.check(
+      Schema.isMaxLength(config.hostedUrl.length + "?attempt=".length + 43),
+      Schema.makeFilter((text) => {
+        try {
+          const url = new URL(text);
+
+          if (
+            url.href !== text ||
+            url.hash ||
+            [...url.searchParams.keys()].join() !== "attempt" ||
+            !Schema.is(BrowserLogin.Random)(url.searchParams.get("attempt"))
+          )
+            return false;
+          url.search = "";
+
+          return url.href === config.hostedUrl;
+        } catch {
+          return false;
+        }
+      }),
+    ),
+  });
+
+  const queued: string[] = [];
+  let receive: ((url: string) => void) | undefined;
+  let close: (() => void) | undefined;
+  let disposed = false;
+
+  const capture = (url: string) => {
+    if (disposed || !Schema.is(callbackSchema)(url)) return;
+    if (receive !== undefined) receive(url);
+    else if (!queued.includes(url) && queued.length < 8) queued.push(url);
+  };
+
+  const openUrl = (event: Event, url: string) => {
+    if (!Schema.is(callbackSchema)(url)) return;
+    event.preventDefault();
+    capture(url);
+  };
+
+  const secondInstance = (_event: Event, argv: string[]) => {
+    for (const arg of argv) capture(arg);
+  };
+
+  const activitySchema = Schema.Struct({ webpageURL: callbackSchema });
+
+  const continueActivity = (event: Event, type: string, _userInfo: unknown, details: unknown) => {
+    if (type !== "NSUserActivityTypeBrowsingWeb" || !Schema.is(activitySchema)(details)) return;
+    event.preventDefault();
+    capture(details.webpageURL);
+  };
+
+  yield* Effect.acquireRelease(
+    Effect.sync(() => {
+      if (universalLink) app.on("continue-activity", continueActivity);
+      else {
+        app.on("open-url", openUrl);
+        app.on("second-instance", secondInstance);
+        for (const arg of process.argv) capture(arg);
+      }
+    }),
+    () =>
+      Effect.sync(() => {
+        disposed = true;
+        if (universalLink) app.removeListener("continue-activity", continueActivity);
+        else {
+          app.removeListener("open-url", openUrl);
+          app.removeListener("second-instance", secondInstance);
+        }
+        queued.length = 0;
+        close?.();
+      }),
+  );
+
+  const prepare = Effect.try({
+    try: () => {
+      if (!app.isReady() || disposed) return false;
+      // Associated domains are verified by macOS when routing the callback.
+      // Registering as the default HTTPS handler would not establish ownership.
+      if (universalLink) return process.platform === "darwin" && app.isPackaged;
+      if (process.platform === "linux")
+        return app.isPackaged && app.isDefaultProtocolClient(scheme);
+      if (process.platform === "darwin")
+        return (
+          app.isPackaged &&
+          app.setAsDefaultProtocolClient(scheme) &&
+          app.isDefaultProtocolClient(scheme)
+        );
+      if (process.platform !== "win32") return false;
+      const args = process.defaultApp ? [app.getAppPath()] : [];
+
+      return (
+        app.setAsDefaultProtocolClient(scheme, process.execPath, args) &&
+        app.isDefaultProtocolClient(scheme, process.execPath, args)
+      );
+    },
+    catch: unavailable,
+  }).pipe(Effect.flatMap((available) => (available ? Effect.void : Effect.fail(unavailable()))));
+
+  return BrowserLogin.Browser.of({
+    open: Effect.fnUntraced(function* (input) {
+      const request = yield* Schema.decodeUnknownEffect(openSchema)(input).pipe(
+        Effect.mapError(unavailable),
+      );
+
+      yield* prepare;
+
+      return yield* Effect.callback<string, BrowserLogin.PlatformError>((resume) => {
+        if (receive !== undefined) {
+          resume(Effect.fail(BrowserLogin.PlatformError.make({ reason: "busy" })));
+
+          return;
+        }
+        let active = true;
+
+        const cleanup = () => {
+          if (!active) return;
+          active = false;
+          receive = undefined;
+          close = undefined;
+        };
+
+        const finish = (result: Effect.Effect<string, BrowserLogin.PlatformError>) => {
+          if (active) {
+            cleanup();
+            resume(result);
+          }
+        };
+
+        receive = (url) => finish(Effect.succeed(url));
+        close = () => finish(Effect.fail(unavailable()));
+        const pending = queued.shift();
+
+        if (pending !== undefined) receive(pending);
+        else {
+          try {
+            void shell.openExternal(request.url).catch(() => finish(Effect.fail(unavailable())));
+          } catch {
+            finish(Effect.fail(unavailable()));
+          }
+        }
+
+        return Effect.sync(cleanup);
+      }).pipe(
+        Effect.timeout("10 minutes"),
+        Effect.catchTag("TimeoutError", () =>
+          Effect.fail(BrowserLogin.PlatformError.make({ reason: "expired" })),
+        ),
+      );
+    }),
+  });
+});
+
+/** Build before app readiness, or use makeBrowser for synchronous startup capture. */
+export const layerBrowser = (options: typeof optionsSchema.Type) =>
+  Layer.effect(BrowserLogin.Browser, makeBrowser(options));

package/src/internal/vault.ts

@@ -0,0 +1,176 @@
+import { Buffer } from "node:buffer";
+
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { OperationHttpError } from "@yielded/auth/OperationHttp";
+import type { NativeCredentials } from "@yielded/auth/OperationHttpClient";
+import type { CredentialSlot } from "@yielded/auth/Operations";
+import {
+  DateTime,
+  Effect,
+  FileSystem,
+  Layer,
+  Path,
+  type Redacted,
+  Schema,
+  Semaphore,
+} from "effect";
+import { app, safeStorage } from "electron";
+
+const recordSchema = BrowserLogin.VaultRecord;
+const slots = recordSchema.fields.credentials.key.literals;
+
+const recordJson = Schema.fromJsonString(recordSchema);
+const failure = () => BrowserLogin.PlatformError.make({ reason: "storage" });
+
+/** One writer per private application/environment path, protected by the host's
+ * single-instance lock. Never reset an unreadable store: it may contain the
+ * Exchanging fence. Writes fsync ciphertext, close, rename on the same filesystem,
+ * then sync the parent on POSIX (the replaced file on Windows).
+ */
+export const layerVault = (options: { readonly path: string }) =>
+  Layer.effect(
+    BrowserLogin.Vault,
+    Effect.gen(function* () {
+      const fs = yield* FileSystem.FileSystem;
+      const path = yield* Path.Path;
+
+      const checkEncryption = Effect.try({
+        try: () =>
+          process.type === "browser" &&
+          app.isReady() &&
+          app.hasSingleInstanceLock() &&
+          safeStorage.isEncryptionAvailable() &&
+          (process.platform !== "linux" ||
+            ["gnome_libsecret", "kwallet", "kwallet5", "kwallet6"].includes(
+              safeStorage.getSelectedStorageBackend(),
+            )),
+        catch: failure,
+      }).pipe(Effect.flatMap((available) => (available ? Effect.void : Effect.fail(failure()))));
+
+      yield* checkEncryption;
+
+      const destination = yield* Schema.decodeEffect(
+        Schema.NonEmptyString.check(Schema.makeFilter((value) => path.isAbsolute(value))),
+      )(options.path).pipe(Effect.mapError(failure));
+
+      const directory = path.dirname(destination);
+
+      yield* fs
+        .makeDirectory(directory, { recursive: true, mode: 0o700 })
+        .pipe(Effect.mapError(failure));
+      const gate = yield* Semaphore.make(1);
+
+      const readRecord = Effect.gen(function* () {
+        yield* checkEncryption;
+
+        const stat = yield* fs
+          .stat(destination)
+          .pipe(
+            Effect.catchTag("PlatformError", (error) =>
+              error.reason._tag === "NotFound" ? Effect.void : Effect.fail(error),
+            ),
+          );
+
+        if (stat === undefined) return { credentials: {} } satisfies typeof recordSchema.Type;
+        if (stat.type !== "File" || stat.size > 1048576) return yield* failure();
+        const bytes = yield* fs.readFile(destination);
+
+        const json = yield* Effect.try({
+          try: () => safeStorage.decryptString(Buffer.from(bytes)),
+          catch: failure,
+        });
+
+        return yield* Schema.decodeEffect(recordJson)(json, { onExcessProperty: "error" });
+      }).pipe(Effect.mapError(failure));
+
+      const writeRecord = Effect.fnUntraced(function* (record: typeof recordSchema.Type) {
+        yield* checkEncryption;
+        const json = yield* Schema.encodeEffect(recordJson)(record);
+
+        const bytes = yield* Effect.try({
+          try: () => safeStorage.encryptString(json),
+          catch: failure,
+        });
+
+        yield* Effect.scoped(
+          Effect.gen(function* () {
+            const temporary = yield* fs.makeTempFileScoped({ directory, prefix: ".auth-" });
+
+            yield* fs.chmod(temporary, 0o600);
+            yield* Effect.scoped(
+              Effect.gen(function* () {
+                const file = yield* fs.open(temporary, { flag: "w", mode: 0o600 });
+
+                yield* file.writeAll(bytes);
+                yield* file.sync;
+              }),
+            );
+            yield* fs.rename(temporary, destination);
+
+            const committed = yield* fs.open(
+              process.platform === "win32" ? destination : directory,
+              { flag: process.platform === "win32" ? "r+" : "r" },
+            );
+
+            yield* committed.sync;
+          }),
+        );
+      }, Effect.mapError(failure));
+
+      const locked = <A, E>(effect: Effect.Effect<A, E>) =>
+        gate.withPermits(1)(Effect.uninterruptible(effect));
+
+      const read: NativeCredentials["read"] = locked(
+        Effect.gen(function* () {
+          const record = yield* readRecord;
+          const now = DateTime.toEpochMillis(yield* DateTime.now);
+          const credentials: Partial<Record<CredentialSlot, Redacted.Redacted<string>>> = {};
+
+          for (const slot of slots) {
+            const value = record.credentials[slot];
+
+            if (value !== undefined && value.expiresAtMillis > now)
+              credentials[slot] = value.credential;
+          }
+
+          return credentials;
+        }),
+      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+
+      const accept: NativeCredentials["accept"] = (commands) =>
+        locked(
+          Effect.gen(function* () {
+            const record = yield* readRecord;
+            const credentials = { ...record.credentials };
+
+            for (const command of commands) {
+              if (command._tag === "Clear") delete credentials[command.slot];
+              else
+                credentials[command.slot] = {
+                  credential: command.credential,
+                  expiresAtMillis: command.expiresAtMillis,
+                };
+            }
+            yield* writeRecord({ ...record, credentials });
+          }),
+        ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+
+      return BrowserLogin.Vault.of({
+        read,
+        accept,
+        loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),
+        saveAttempt: (attempt) =>
+          locked(
+            Effect.gen(function* () {
+              const record = yield* readRecord;
+
+              yield* writeRecord(
+                attempt === undefined
+                  ? { credentials: record.credentials }
+                  : { ...record, attempt },
+              );
+            }),
+          ),
+      });
+    }),
+  );