@yielded/auth-react-native 0.1.0-beta.13 → 0.1.0-beta.15

package/README.md

@@ -1,8 +1,18 @@
 # @yielded/auth-react-native
 
-Client-local iOS passkey registration, authentication, and capability checks for
-`@yielded/auth`. Import `* as ReactNativePasskey` from this package and construct
-the adapter with `ReactNativePasskey.make()`, or provide `ReactNativePasskey.layer`.
+Client-local iOS passkeys and browser login for `@yielded/auth`. Applications own
+authentication workflows, HTTP, sessions, and native application configuration.
+Core has no React Native dependency. Passkeys require iOS 16+; browser login's
+minimum depends on the chosen Expo SDK. Android is unsupported.
+
+Import the package root for passkeys, or `@yielded/auth-react-native/BrowserLogin`
+for browser login. Install only the optional native peers for the entrypoint you
+use, autolink with CocoaPods, and rebuild the application.
+
+## Passkeys
+
+Import `* as ReactNativePasskey` from this package and construct the adapter with
+`ReactNativePasskey.make()`, or provide `ReactNativePasskey.layer`.
 
 Install this package and its `react-native` and `react-native-passkey` peers only
 in the native application. `@yielded/auth` does not depend on React Native or
@@ -17,3 +27,74 @@ prompt, and the shared busy guard stays held until the native promise settles.
 
 See the [iOS setup guide](../../docs/src/content/docs/guide/passkeys.md#prompt-in-an-ios-react-native-app)
 and [API reference](../../docs/src/content/docs/reference/passkey-react-native.md).
+
+## Browser login
+
+Open your hosted sign-in page with Expo WebBrowser and keep the native session in
+Expo SecureStore. See the [browser-login guide](../../docs/src/content/docs/guide/browser-login.mdx)
+for the shared client, server policy, and recovery flow.
+
+Install the peers matching your Expo SDK:
+
+| Expo SDK | `expo-web-browser` | `expo-secure-store` | Minimum iOS |
+| -------- | ------------------ | ------------------- | ----------- |
+| 54       | `~15.0.11`         | `~15.0.8`           | 16          |
+| 57       | `~57.0.3`          | `~57.0.4`           | 16.4        |
+
+For SDK 54:
+
+```sh
+bun add @yielded/auth-react-native@beta effect expo-web-browser@~15.0.11 expo-secure-store@~15.0.8 react-native-url-polyfill
+```
+
+Plain React Native apps must first [install Expo Modules](https://docs.expo.dev/bare/installing-expo-modules/).
+Rebuild the native app after installing the peers.
+
+Load the required [WHATWG URL polyfill](https://github.com/charpeni/react-native-url-polyfill)
+in your application entrypoint before any auth imports:
+
+```ts
+import "react-native-url-polyfill/auto";
+import "./app";
+```
+
+Supply core's `BrowserLogin.Browser` and `BrowserLogin.Vault` with separate Layers:
+
+```ts
+import { Layer } from "effect";
+import * as NativeBrowserLogin from "@yielded/auth-react-native/BrowserLogin";
+
+export const NativeLoginLive = Layer.merge(
+  NativeBrowserLogin.layerBrowser,
+  NativeBrowserLogin.layerVault({ service: "com.example.app.auth.production" }),
+);
+```
+
+Create one vault Layer per authentication lifetime and share it with
+`BrowserLogin.makeClient` and your native HTTP client's credentials service.
+Choose a dedicated `service` per app, server environment, and client ID; keep it
+stable across restarts and allow no other writers. Storage is device-only,
+available while unlocked, and does not use biometric gating. Keychain data can
+survive app deletion.
+
+Your app also supplies `Crypto.Crypto` with cryptographically secure random bytes
+and SHA-256. React Native does not supply browser `SubtleCrypto`.
+With [`expo-crypto`](https://docs.expo.dev/versions/v54.0.0/sdk/crypto/), use
+`getRandomValues` and `digest`; `getRandomBytes` can fall back to `Math.random`
+in development.
+
+The hosted page must use HTTPS. For a custom callback, register a reverse-domain
+scheme in `CFBundleURLTypes` and the exact return URL, such as
+`com.example.app://auth/callback`, with your server.
+
+HTTPS callbacks require iOS 17.4+ and a signed `webcredentials:<callback-host>`
+[Associated Domains entitlement](https://developer.apple.com/documentation/xcode/supporting-associated-domains).
+The host's `apple-app-site-association` file must list the app's `PREFIX.bundleID`
+under `webcredentials.apps`. Register the exact callback URL on the server; app IDs
+belong to your association setup. The optional
+[association helper](../../docs/src/content/docs/reference/browser-login.md#apple-association)
+contributes paths to your app-owned file. Older iOS versions reject HTTPS callbacks.
+
+Let this adapter own the authentication session: do not open a competing
+WebBrowser session or handle its callback through `Linking`. On SDK 54, a failed
+presentation can stay pending; interrupt login before trying again.

package/dist/BrowserLogin.d.mts

@@ -0,0 +1,16 @@
+import { Layer } from "effect";
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+//#region src/BrowserLogin.d.ts
+/** iOS ASWebAuthenticationSession; HTTPS callbacks require iOS 17.4+ and
+ * associated web credentials domains. Each open owns its Scope and dismissal;
+ * interruption retains the shared busy guard until the native promise settles. */
+export declare const layerBrowser: Layer.Layer<BrowserLogin.Browser, never, never>;
+/** Use a fresh, dedicated SecureStore service per app, server environment and client ID.
+ * Build this Layer once per authentication lifetime; no other process or Layer
+ * may write this service. Keep its name stable across restarts; SecureStore has
+ * no cross-process compare-and-set contract. */
+export declare const layerVault: (options: {
+  readonly service: string;
+}) => Layer.Layer<BrowserLogin.Vault, BrowserLogin.PlatformError, never>;
+//#endregion
+//# sourceMappingURL=BrowserLogin.d.mts.map

package/dist/BrowserLogin.mjs

@@ -0,0 +1,174 @@
+import { DateTime, Effect, Layer, Schema, Semaphore } from "effect";
+import { Platform } from "react-native";
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { OperationHttpError } from "@yielded/auth/OperationHttp";
+import * as SecureStore from "expo-secure-store";
+import * as WebBrowser from "expo-web-browser";
+//#region src/BrowserLogin.ts
+const failure = (reason) => BrowserLogin.PlatformError.make({ reason });
+const environment = Effect.try({
+	try: () => Platform.OS === "ios" && Number.parseInt(String(Platform.Version), 10) >= 16,
+	catch: () => failure("unavailable")
+}).pipe(Effect.flatMap((supported) => supported ? Effect.void : Effect.fail(failure("unavailable"))));
+const openInput = Schema.Struct({
+	url: Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(4096), Schema.makeFilter((text) => {
+		try {
+			const url = new URL(text);
+			return url.href === text && url.protocol === "https:" && !url.username && !url.password && !url.hash;
+		} catch {
+			return false;
+		}
+	})),
+	returnUrl: Schema.Union([BrowserLogin.HttpsReturnUrl, BrowserLogin.ReturnUrl.check(Schema.makeFilter((text) => !text.startsWith("https:")))]),
+	ephemeral: Schema.Boolean
+});
+const browserResult = Schema.Union([Schema.Struct({
+	type: Schema.Literal("success"),
+	url: Schema.String.check(Schema.isMaxLength(8192))
+}), Schema.Struct({ type: Schema.Literals(["cancel", "dismiss"]) })]);
+let activeBrowser;
+const settle = (lease) => {
+	lease.settled = true;
+	if (activeBrowser === lease) activeBrowser = void 0;
+};
+const acquireBrowser = Effect.sync(() => {
+	if (activeBrowser !== void 0) return void 0;
+	const lease = {
+		started: false,
+		settled: false,
+		listening: true
+	};
+	activeBrowser = lease;
+	return lease;
+}).pipe(Effect.flatMap((lease) => lease === void 0 ? Effect.fail(failure("busy")) : Effect.succeed(lease)));
+const releaseBrowser = (lease) => Effect.sync(() => {
+	lease.listening = false;
+	if (!lease.started) settle(lease);
+	if (lease.settled) return;
+	try {
+		WebBrowser.dismissAuthSession();
+	} catch {}
+});
+const prompt = (lease, input) => Effect.callback((resume, signal) => {
+	lease.started = true;
+	try {
+		const options = {
+			preferEphemeralSession: input.ephemeral,
+			preferUniversalLinks: true
+		};
+		WebBrowser.openAuthSessionAsync(input.url, input.returnUrl, options).then((value) => {
+			settle(lease);
+			if (lease.listening && !signal.aborted) resume(Effect.succeed(value));
+		}, () => {
+			settle(lease);
+			if (lease.listening && !signal.aborted) resume(Effect.fail(failure("unavailable")));
+		});
+	} catch {
+		settle(lease);
+		resume(Effect.fail(failure("unavailable")));
+	}
+});
+/** iOS ASWebAuthenticationSession; HTTPS callbacks require iOS 17.4+ and
+* associated web credentials domains. Each open owns its Scope and dismissal;
+* interruption retains the shared busy guard until the native promise settles. */
+const layerBrowser = Layer.succeed(BrowserLogin.Browser, BrowserLogin.Browser.of({ open: Effect.fnUntraced(function* (input) {
+	yield* environment;
+	const request = yield* Schema.decodeEffect(openInput)(input).pipe(Effect.mapError(() => failure("callback")));
+	if (request.returnUrl.startsWith("https:")) {
+		if (!(yield* Effect.try({
+			try: () => {
+				const [major = 0, minor = 0] = String(Platform.Version).split(".").map(Number);
+				return major > 17 || major === 17 && minor >= 4;
+			},
+			catch: () => failure("unavailable")
+		}))) return yield* failure("unavailable");
+	}
+	return yield* Effect.scoped(Effect.gen(function* () {
+		const lease = yield* Effect.acquireRelease(acquireBrowser, releaseBrowser);
+		const result = yield* Schema.decodeUnknownEffect(browserResult)(yield* prompt(lease, request)).pipe(Effect.mapError(() => failure("callback")));
+		if (result.type !== "success") return yield* failure("cancelled");
+		return yield* Schema.decodeEffect(Schema.String.check(Schema.makeFilter((text) => {
+			try {
+				const url = new URL(text);
+				if (url.href !== text || url.username || url.password || url.hash) return false;
+				url.search = "";
+				return url.href === request.returnUrl;
+			} catch {
+				return false;
+			}
+		})))(result.url).pipe(Effect.mapError(() => failure("callback")));
+	}));
+}) }));
+const vaultRecord = BrowserLogin.VaultRecord;
+const slots = vaultRecord.fields.credentials.key.literals;
+const vaultJson = Schema.fromJsonString(vaultRecord);
+const vaultKey = "yielded-auth.browser-login";
+const storedValue = Schema.NullOr(Schema.String.check(Schema.isMaxLength(1048576)));
+/** Use a fresh, dedicated SecureStore service per app, server environment and client ID.
+* Build this Layer once per authentication lifetime; no other process or Layer
+* may write this service. Keep its name stable across restarts; SecureStore has
+* no cross-process compare-and-set contract. */
+const layerVault = (options) => Layer.effect(BrowserLogin.Vault, Effect.gen(function* () {
+	yield* environment;
+	const storageOptions = {
+		keychainService: yield* Schema.decodeEffect(Schema.NonEmptyString.check(Schema.isMaxLength(256)))(options.service).pipe(Effect.mapError(() => failure("storage"))),
+		keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+		requireAuthentication: false
+	};
+	const gate = yield* Semaphore.make(1);
+	const readRecord = Effect.gen(function* () {
+		const result = yield* Effect.tryPromise({
+			try: () => SecureStore.getItemAsync(vaultKey, storageOptions),
+			catch: () => failure("storage")
+		}).pipe(Effect.flatMap(Schema.decodeUnknownEffect(storedValue)), Effect.mapError(() => failure("storage")));
+		if (result === null) return { credentials: {} };
+		return yield* Schema.decodeEffect(vaultJson)(result, { onExcessProperty: "error" }).pipe(Effect.mapError(() => failure("storage")));
+	});
+	const writeRecord = Effect.fnUntraced(function* (record) {
+		const encoded = yield* Schema.encodeEffect(vaultJson)(record).pipe(Effect.mapError(() => failure("storage")));
+		yield* Effect.tryPromise({
+			try: () => SecureStore.setItemAsync(vaultKey, encoded, storageOptions),
+			catch: () => failure("storage")
+		});
+	});
+	const locked = (work) => gate.withPermits(1)(Effect.uninterruptible(work));
+	const read = locked(Effect.gen(function* () {
+		const record = yield* readRecord;
+		const now = DateTime.toEpochMillis(yield* DateTime.now);
+		const credentials = {};
+		for (const slot of slots) {
+			const value = record.credentials[slot];
+			if (value !== void 0 && value.expiresAtMillis > now) credentials[slot] = value.credential;
+		}
+		return credentials;
+	})).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+	const accept = (commands) => locked(Effect.gen(function* () {
+		const record = yield* readRecord;
+		const credentials = { ...record.credentials };
+		for (const command of commands) if (command._tag === "Clear") delete credentials[command.slot];
+		else credentials[command.slot] = {
+			credential: command.credential,
+			expiresAtMillis: command.expiresAtMillis
+		};
+		yield* writeRecord({
+			...record,
+			credentials
+		});
+	})).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+	return BrowserLogin.Vault.of({
+		read,
+		accept,
+		loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),
+		saveAttempt: (attempt) => locked(Effect.gen(function* () {
+			const record = yield* readRecord;
+			yield* writeRecord(attempt === void 0 ? { credentials: record.credentials } : {
+				...record,
+				attempt
+			});
+		}))
+	});
+}));
+//#endregion
+export { layerBrowser, layerVault };
+
+//# sourceMappingURL=BrowserLogin.mjs.map

package/dist/BrowserLogin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserLogin.mjs","names":[],"sources":["../src/BrowserLogin.ts"],"sourcesContent":["import * as BrowserLogin from \"@yielded/auth/BrowserLogin\";\nimport { OperationHttpError } from \"@yielded/auth/OperationHttp\";\nimport type { NativeCredentials } from \"@yielded/auth/OperationHttpClient\";\nimport type { CredentialSlot } from \"@yielded/auth/Operations\";\nimport { DateTime, Effect, Layer, type Redacted, Schema, Semaphore } from \"effect\";\nimport * as SecureStore from \"expo-secure-store\";\nimport * as WebBrowser from \"expo-web-browser\";\nimport { Platform } from \"react-native\";\n\nconst failure = (reason: BrowserLogin.PlatformError[\"reason\"]) =>\n  BrowserLogin.PlatformError.make({ reason });\n\nconst environment = Effect.try({\n  try: () => Platform.OS === \"ios\" && Number.parseInt(String(Platform.Version), 10) >= 16,\n  catch: () => failure(\"unavailable\"),\n}).pipe(\n  Effect.flatMap((supported) => (supported ? Effect.void : Effect.fail(failure(\"unavailable\")))),\n);\n\nconst openInput = Schema.Struct({\n  url: Schema.String.check(\n    Schema.isMinLength(1),\n    Schema.isMaxLength(4096),\n    Schema.makeFilter((text) => {\n      try {\n        const url = new URL(text);\n\n        return (\n          url.href === text &&\n          url.protocol === \"https:\" &&\n          !url.username &&\n          !url.password &&\n          !url.hash\n        );\n      } catch {\n        return false;\n      }\n    }),\n  ),\n  returnUrl: Schema.Union([\n    BrowserLogin.HttpsReturnUrl,\n    BrowserLogin.ReturnUrl.check(Schema.makeFilter((text) => !text.startsWith(\"https:\"))),\n  ]),\n  ephemeral: Schema.Boolean,\n});\n\nconst browserResult = Schema.Union([\n  Schema.Struct({\n    type: Schema.Literal(\"success\"),\n    url: Schema.String.check(Schema.isMaxLength(8192)),\n  }),\n  Schema.Struct({ type: Schema.Literals([\"cancel\", \"dismiss\"]) }),\n]);\n\ninterface Lease {\n  started: boolean;\n  settled: boolean;\n  listening: boolean;\n}\n\n// The bridge owns a single native resolver. All Layers in this installed module\n// share admission; applications must not call the peer independently.\nlet activeBrowser: Lease | undefined;\n\nconst settle = (lease: Lease) => {\n  lease.settled = true;\n  if (activeBrowser === lease) activeBrowser = undefined;\n};\n\nconst acquireBrowser = Effect.sync(() => {\n  if (activeBrowser !== undefined) return undefined;\n  const lease: Lease = { started: false, settled: false, listening: true };\n\n  activeBrowser = lease;\n\n  return lease;\n}).pipe(\n  Effect.flatMap((lease) =>\n    lease === undefined ? Effect.fail(failure(\"busy\")) : Effect.succeed(lease),\n  ),\n);\n\nconst releaseBrowser = (lease: Lease) =>\n  Effect.sync(() => {\n    lease.listening = false;\n    if (!lease.started) settle(lease);\n    if (lease.settled) return;\n    try {\n      WebBrowser.dismissAuthSession();\n    } catch {\n      // Dismissal is best-effort. Keep admission held until native settlement even\n      // if dismissal fails; never deliver a late callback to another attempt.\n    }\n  });\n\nconst prompt = (lease: Lease, input: typeof openInput.Type) =>\n  Effect.callback<unknown, BrowserLogin.PlatformError>((resume, signal) => {\n    lease.started = true;\n    try {\n      // SDK 54 binds HTTPS callbacks directly; SDK 57 requires this opt-in.\n      const options = {\n        preferEphemeralSession: input.ephemeral,\n        preferUniversalLinks: true,\n      };\n\n      void WebBrowser.openAuthSessionAsync(input.url, input.returnUrl, options).then(\n        (value: unknown) => {\n          settle(lease);\n          if (lease.listening && !signal.aborted) resume(Effect.succeed(value));\n        },\n        () => {\n          settle(lease);\n          if (lease.listening && !signal.aborted) resume(Effect.fail(failure(\"unavailable\")));\n        },\n      );\n    } catch {\n      settle(lease);\n      resume(Effect.fail(failure(\"unavailable\")));\n    }\n  });\n\n/** iOS ASWebAuthenticationSession; HTTPS callbacks require iOS 17.4+ and\n * associated web credentials domains. Each open owns its Scope and dismissal;\n * interruption retains the shared busy guard until the native promise settles. */\nexport const layerBrowser = Layer.succeed(\n  BrowserLogin.Browser,\n  BrowserLogin.Browser.of({\n    open: Effect.fnUntraced(function* (input) {\n      yield* environment;\n\n      const request = yield* Schema.decodeEffect(openInput)(input).pipe(\n        Effect.mapError(() => failure(\"callback\")),\n      );\n\n      if (request.returnUrl.startsWith(\"https:\")) {\n        // Reject before invoking Expo's fallback to callbackURLScheme on older iOS.\n        const supported = yield* Effect.try({\n          try: () => {\n            const [major = 0, minor = 0] = String(Platform.Version).split(\".\").map(Number);\n\n            return major > 17 || (major === 17 && minor >= 4);\n          },\n          catch: () => failure(\"unavailable\"),\n        });\n\n        if (!supported) return yield* failure(\"unavailable\");\n      }\n\n      return yield* Effect.scoped(\n        Effect.gen(function* () {\n          const lease = yield* Effect.acquireRelease(acquireBrowser, releaseBrowser);\n\n          const result = yield* Schema.decodeUnknownEffect(browserResult)(\n            yield* prompt(lease, request),\n          ).pipe(Effect.mapError(() => failure(\"callback\")));\n\n          if (result.type !== \"success\") return yield* failure(\"cancelled\");\n\n          // Bind the full target even when the OS matches only the custom scheme;\n          // core owns state/code validation and the exchange decision.\n          return yield* Schema.decodeEffect(\n            Schema.String.check(\n              Schema.makeFilter((text) => {\n                try {\n                  const url = new URL(text);\n\n                  if (url.href !== text || url.username || url.password || url.hash) return false;\n                  url.search = \"\";\n\n                  return url.href === request.returnUrl;\n                } catch {\n                  return false;\n                }\n              }),\n            ),\n          )(result.url).pipe(Effect.mapError(() => failure(\"callback\")));\n        }),\n      );\n    }),\n  }),\n);\n\nconst vaultRecord = BrowserLogin.VaultRecord;\nconst slots = vaultRecord.fields.credentials.key.literals;\n\nconst vaultJson = Schema.fromJsonString(vaultRecord);\n\nconst vaultKey = \"yielded-auth.browser-login\";\nconst storedValue = Schema.NullOr(Schema.String.check(Schema.isMaxLength(1048576)));\n\n/** Use a fresh, dedicated SecureStore service per app, server environment and client ID.\n * Build this Layer once per authentication lifetime; no other process or Layer\n * may write this service. Keep its name stable across restarts; SecureStore has\n * no cross-process compare-and-set contract. */\nexport const layerVault = (options: { readonly service: string }) =>\n  Layer.effect(\n    BrowserLogin.Vault,\n    Effect.gen(function* () {\n      yield* environment;\n\n      const service = yield* Schema.decodeEffect(\n        Schema.NonEmptyString.check(Schema.isMaxLength(256)),\n      )(options.service).pipe(Effect.mapError(() => failure(\"storage\")));\n\n      const storageOptions = {\n        keychainService: service,\n        keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,\n        // Biometric changes must not invalidate the exchange fence.\n        requireAuthentication: false,\n      } satisfies SecureStore.SecureStoreOptions;\n\n      const gate = yield* Semaphore.make(1);\n\n      const readRecord: Effect.Effect<typeof vaultRecord.Type, BrowserLogin.PlatformError> =\n        Effect.gen(function* () {\n          const result = yield* Effect.tryPromise({\n            try: () => SecureStore.getItemAsync(vaultKey, storageOptions),\n            catch: () => failure(\"storage\"),\n          }).pipe(\n            Effect.flatMap(Schema.decodeUnknownEffect(storedValue)),\n            Effect.mapError(() => failure(\"storage\")),\n          );\n\n          if (result === null) return { credentials: {} } satisfies typeof vaultRecord.Type;\n\n          return yield* Schema.decodeEffect(vaultJson)(result, {\n            onExcessProperty: \"error\",\n          }).pipe(Effect.mapError(() => failure(\"storage\")));\n        });\n\n      const writeRecord = Effect.fnUntraced(function* (record: typeof vaultRecord.Type) {\n        const encoded = yield* Schema.encodeEffect(vaultJson)(record).pipe(\n          Effect.mapError(() => failure(\"storage\")),\n        );\n\n        // SecureStore updates existing iOS items with SecItemUpdate. Always replace\n        // the whole record, including clears; never delete the item before writing.\n        yield* Effect.tryPromise({\n          try: () => SecureStore.setItemAsync(vaultKey, encoded, storageOptions),\n          catch: () => failure(\"storage\"),\n        });\n      });\n\n      // SecureStore promises are not cancellable. Admitted operations must settle\n      // before releasing this gate or acknowledging an Exchanging checkpoint.\n      const locked = <A, E>(work: Effect.Effect<A, E>) =>\n        gate.withPermits(1)(Effect.uninterruptible(work));\n\n      const read: NativeCredentials[\"read\"] = locked(\n        Effect.gen(function* () {\n          const record = yield* readRecord;\n          const now = DateTime.toEpochMillis(yield* DateTime.now);\n          const credentials: Partial<Record<CredentialSlot, Redacted.Redacted<string>>> = {};\n\n          for (const slot of slots) {\n            const value = record.credentials[slot];\n\n            if (value !== undefined && value.expiresAtMillis > now)\n              credentials[slot] = value.credential;\n          }\n\n          return credentials;\n        }),\n      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"credentials\" })));\n\n      const accept: NativeCredentials[\"accept\"] = (commands) =>\n        locked(\n          Effect.gen(function* () {\n            const record = yield* readRecord;\n            const credentials = { ...record.credentials };\n\n            for (const command of commands) {\n              if (command._tag === \"Clear\") delete credentials[command.slot];\n              else\n                credentials[command.slot] = {\n                  credential: command.credential,\n                  expiresAtMillis: command.expiresAtMillis,\n                };\n            }\n            yield* writeRecord({ ...record, credentials });\n          }),\n        ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: \"credentials\" })));\n\n      return BrowserLogin.Vault.of({\n        read,\n        accept,\n        loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),\n        saveAttempt: (attempt) =>\n          locked(\n            Effect.gen(function* () {\n              const record = yield* readRecord;\n\n              yield* writeRecord(\n                attempt === undefined\n                  ? { credentials: record.credentials }\n                  : { ...record, attempt },\n              );\n            }),\n          ),\n      });\n    }),\n  );\n"],"mappings":";;;;;;;AASA,MAAM,WAAW,WACf,aAAa,cAAc,KAAK,EAAE,OAAO,CAAC;AAE5C,MAAM,cAAc,OAAO,IAAI;CAC7B,WAAW,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,SAAS,OAAO,GAAG,EAAE,KAAK;CACrF,aAAa,QAAQ,aAAa;AACpC,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,cAAe,YAAY,OAAO,OAAO,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAE,CAC/F;AAEA,MAAM,YAAY,OAAO,OAAO;CAC9B,KAAK,OAAO,OAAO,MACjB,OAAO,YAAY,CAAC,GACpB,OAAO,YAAY,IAAI,GACvB,OAAO,YAAY,SAAS;EAC1B,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,IAAI;GAExB,OACE,IAAI,SAAS,QACb,IAAI,aAAa,YACjB,CAAC,IAAI,YACL,CAAC,IAAI,YACL,CAAC,IAAI;EAET,QAAQ;GACN,OAAO;EACT;CACF,CAAC,CACH;CACA,WAAW,OAAO,MAAM,CACtB,aAAa,gBACb,aAAa,UAAU,MAAM,OAAO,YAAY,SAAS,CAAC,KAAK,WAAW,QAAQ,CAAC,CAAC,CACtF,CAAC;CACD,WAAW,OAAO;AACpB,CAAC;AAED,MAAM,gBAAgB,OAAO,MAAM,CACjC,OAAO,OAAO;CACZ,MAAM,OAAO,QAAQ,SAAS;CAC9B,KAAK,OAAO,OAAO,MAAM,OAAO,YAAY,IAAI,CAAC;AACnD,CAAC,GACD,OAAO,OAAO,EAAE,MAAM,OAAO,SAAS,CAAC,UAAU,SAAS,CAAC,EAAE,CAAC,CAChE,CAAC;AAUD,IAAI;AAEJ,MAAM,UAAU,UAAiB;CAC/B,MAAM,UAAU;CAChB,IAAI,kBAAkB,OAAO,gBAAgB,KAAA;AAC/C;AAEA,MAAM,iBAAiB,OAAO,WAAW;CACvC,IAAI,kBAAkB,KAAA,GAAW,OAAO,KAAA;CACxC,MAAM,QAAe;EAAE,SAAS;EAAO,SAAS;EAAO,WAAW;CAAK;CAEvE,gBAAgB;CAEhB,OAAO;AACT,CAAC,CAAC,CAAC,KACD,OAAO,SAAS,UACd,UAAU,KAAA,IAAY,OAAO,KAAK,QAAQ,MAAM,CAAC,IAAI,OAAO,QAAQ,KAAK,CAC3E,CACF;AAEA,MAAM,kBAAkB,UACtB,OAAO,WAAW;CAChB,MAAM,YAAY;CAClB,IAAI,CAAC,MAAM,SAAS,OAAO,KAAK;CAChC,IAAI,MAAM,SAAS;CACnB,IAAI;EACF,WAAW,mBAAmB;CAChC,QAAQ,CAGR;AACF,CAAC;AAEH,MAAM,UAAU,OAAc,UAC5B,OAAO,UAA+C,QAAQ,WAAW;CACvE,MAAM,UAAU;CAChB,IAAI;EAEF,MAAM,UAAU;GACd,wBAAwB,MAAM;GAC9B,sBAAsB;EACxB;EAEA,WAAgB,qBAAqB,MAAM,KAAK,MAAM,WAAW,OAAO,CAAC,CAAC,MACvE,UAAmB;GAClB,OAAO,KAAK;GACZ,IAAI,MAAM,aAAa,CAAC,OAAO,SAAS,OAAO,OAAO,QAAQ,KAAK,CAAC;EACtE,SACM;GACJ,OAAO,KAAK;GACZ,IAAI,MAAM,aAAa,CAAC,OAAO,SAAS,OAAO,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC;EACpF,CACF;CACF,QAAQ;EACN,OAAO,KAAK;EACZ,OAAO,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC;CAC5C;AACF,CAAC;;;;AAKH,MAAa,eAAe,MAAM,QAChC,aAAa,SACb,aAAa,QAAQ,GAAG,EACtB,MAAM,OAAO,WAAW,WAAW,OAAO;CACxC,OAAO;CAEP,MAAM,UAAU,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAC3D,OAAO,eAAe,QAAQ,UAAU,CAAC,CAC3C;CAEA,IAAI,QAAQ,UAAU,WAAW,QAAQ,GAWnC;MAAA,EAAC,OAToB,OAAO,IAAI;GAClC,WAAW;IACT,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAAK,OAAO,SAAS,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;IAE7E,OAAO,QAAQ,MAAO,UAAU,MAAM,SAAS;GACjD;GACA,aAAa,QAAQ,aAAa;EACpC,CAAC,IAEe,OAAO,OAAO,QAAQ,aAAa;CAAA;CAGrD,OAAO,OAAO,OAAO,OACnB,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,OAAO,OAAO,eAAe,gBAAgB,cAAc;EAEzE,MAAM,SAAS,OAAO,OAAO,oBAAoB,aAAa,CAAC,CAC7D,OAAO,OAAO,OAAO,OAAO,CAC9B,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,UAAU,CAAC,CAAC;EAEjD,IAAI,OAAO,SAAS,WAAW,OAAO,OAAO,QAAQ,WAAW;EAIhE,OAAO,OAAO,OAAO,aACnB,OAAO,OAAO,MACZ,OAAO,YAAY,SAAS;GAC1B,IAAI;IACF,MAAM,MAAM,IAAI,IAAI,IAAI;IAExB,IAAI,IAAI,SAAS,QAAQ,IAAI,YAAY,IAAI,YAAY,IAAI,MAAM,OAAO;IAC1E,IAAI,SAAS;IAEb,OAAO,IAAI,SAAS,QAAQ;GAC9B,QAAQ;IACN,OAAO;GACT;EACF,CAAC,CACH,CACF,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,UAAU,CAAC,CAAC;CAC/D,CAAC,CACH;AACF,CAAC,EACH,CAAC,CACH;AAEA,MAAM,cAAc,aAAa;AACjC,MAAM,QAAQ,YAAY,OAAO,YAAY,IAAI;AAEjD,MAAM,YAAY,OAAO,eAAe,WAAW;AAEnD,MAAM,WAAW;AACjB,MAAM,cAAc,OAAO,OAAO,OAAO,OAAO,MAAM,OAAO,YAAY,OAAO,CAAC,CAAC;;;;;AAMlF,MAAa,cAAc,YACzB,MAAM,OACJ,aAAa,OACb,OAAO,IAAI,aAAa;CACtB,OAAO;CAMP,MAAM,iBAAiB;EACrB,iBAAiB,OALI,OAAO,aAC5B,OAAO,eAAe,MAAM,OAAO,YAAY,GAAG,CAAC,CACrD,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,SAAS,CAAC,CAAC;EAI/D,oBAAoB,YAAY;EAEhC,uBAAuB;CACzB;CAEA,MAAM,OAAO,OAAO,UAAU,KAAK,CAAC;CAEpC,MAAM,aACJ,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO,OAAO,WAAW;GACtC,WAAW,YAAY,aAAa,UAAU,cAAc;GAC5D,aAAa,QAAQ,SAAS;EAChC,CAAC,CAAC,CAAC,KACD,OAAO,QAAQ,OAAO,oBAAoB,WAAW,CAAC,GACtD,OAAO,eAAe,QAAQ,SAAS,CAAC,CAC1C;EAEA,IAAI,WAAW,MAAM,OAAO,EAAE,aAAa,CAAC,EAAE;EAE9C,OAAO,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,QAAQ,EACnD,kBAAkB,QACpB,CAAC,CAAC,CAAC,KAAK,OAAO,eAAe,QAAQ,SAAS,CAAC,CAAC;CACnD,CAAC;CAEH,MAAM,cAAc,OAAO,WAAW,WAAW,QAAiC;EAChF,MAAM,UAAU,OAAO,OAAO,aAAa,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,KAC5D,OAAO,eAAe,QAAQ,SAAS,CAAC,CAC1C;EAIA,OAAO,OAAO,WAAW;GACvB,WAAW,YAAY,aAAa,UAAU,SAAS,cAAc;GACrE,aAAa,QAAQ,SAAS;EAChC,CAAC;CACH,CAAC;CAID,MAAM,UAAgB,SACpB,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,gBAAgB,IAAI,CAAC;CAElD,MAAM,OAAkC,OACtC,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,MAAM,SAAS,cAAc,OAAO,SAAS,GAAG;EACtD,MAAM,cAA0E,CAAC;EAEjF,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,QAAQ,OAAO,YAAY;GAEjC,IAAI,UAAU,KAAA,KAAa,MAAM,kBAAkB,KACjD,YAAY,QAAQ,MAAM;EAC9B;EAEA,OAAO;CACT,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC;CAEhF,MAAM,UAAuC,aAC3C,OACE,OAAO,IAAI,aAAa;EACtB,MAAM,SAAS,OAAO;EACtB,MAAM,cAAc,EAAE,GAAG,OAAO,YAAY;EAE5C,KAAK,MAAM,WAAW,UACpB,IAAI,QAAQ,SAAS,SAAS,OAAO,YAAY,QAAQ;OAEvD,YAAY,QAAQ,QAAQ;GAC1B,YAAY,QAAQ;GACpB,iBAAiB,QAAQ;EAC3B;EAEJ,OAAO,YAAY;GAAE,GAAG;GAAQ;EAAY,CAAC;CAC/C,CAAC,CACH,CAAC,CAAC,KAAK,OAAO,eAAe,mBAAmB,KAAK,EAAE,QAAQ,cAAc,CAAC,CAAC,CAAC;CAElF,OAAO,aAAa,MAAM,GAAG;EAC3B;EACA;EACA,aAAa,OAAO,WAAW,KAAK,OAAO,KAAK,WAAW,OAAO,OAAO,CAAC,CAAC;EAC3E,cAAc,YACZ,OACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO;GAEtB,OAAO,YACL,YAAY,KAAA,IACR,EAAE,aAAa,OAAO,YAAY,IAClC;IAAE,GAAG;IAAQ;GAAQ,CAC3B;EACF,CAAC,CACH;CACJ,CAAC;AACH,CAAC,CACH"}

package/package.json

@@ -1 +1 @@
-{"name":"@yielded/auth-react-native","version":"0.1.0-beta.13","dependencies":{"@yielded/auth":"0.1.0-beta.13"},"devDependencies":{"@effect/vitest":"4.0.0","effect":"4.0.0","react-native":"0.81.4","react-native-passkey":"3.6.2","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0","react-native":">=0.81 <1","react-native-passkey":"~3.6.2"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"}},"description":"iOS passkey ceremonies for Yielded Auth and React Native.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-react-native"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"}}
+{"name":"@yielded/auth-react-native","version":"0.1.0-beta.15","dependencies":{"@yielded/auth":"0.1.0-beta.15"},"devDependencies":{"@effect/vitest":"4.0.0","effect":"4.0.0","expo":"54.0.37","expo-secure-store":"15.0.8","expo-web-browser":"15.0.11","react-native":"0.81.4","react-native-passkey":"3.6.2","typescript":"7.0.2","vite-plus":"0.3.3"},"peerDependencies":{"effect":"^4.0.0","expo-secure-store":"~15.0.8 || ~57.0.4","expo-web-browser":"~15.0.11 || ~57.0.3","react-native":">=0.81 <1","react-native-passkey":"~3.6.2"},"exports":{".":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"./BrowserLogin":{"types":"./dist/BrowserLogin.d.mts","default":"./dist/BrowserLogin.mjs"}},"description":"iOS passkey and browser login adapters for Yielded Auth and React Native.","homepage":"https://yielded.dev/auth/","bugs":{"url":"https://github.com/yielded-dev/auth/issues"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/yielded-dev/auth.git","directory":"packages/auth-react-native"},"files":["dist","src"],"type":"module","sideEffects":[],"publishConfig":{"access":"public"},"scripts":{"build":"vp pack","check":"tsc --noEmit -p tsconfig.json","test":"vp test --passWithNoTests"},"peerDependenciesMeta":{"expo-secure-store":{"optional":true},"expo-web-browser":{"optional":true},"react-native-passkey":{"optional":true}}}

package/src/BrowserLogin.ts

@@ -0,0 +1,302 @@
+import * as BrowserLogin from "@yielded/auth/BrowserLogin";
+import { OperationHttpError } from "@yielded/auth/OperationHttp";
+import type { NativeCredentials } from "@yielded/auth/OperationHttpClient";
+import type { CredentialSlot } from "@yielded/auth/Operations";
+import { DateTime, Effect, Layer, type Redacted, Schema, Semaphore } from "effect";
+import * as SecureStore from "expo-secure-store";
+import * as WebBrowser from "expo-web-browser";
+import { Platform } from "react-native";
+
+const failure = (reason: BrowserLogin.PlatformError["reason"]) =>
+  BrowserLogin.PlatformError.make({ reason });
+
+const environment = Effect.try({
+  try: () => Platform.OS === "ios" && Number.parseInt(String(Platform.Version), 10) >= 16,
+  catch: () => failure("unavailable"),
+}).pipe(
+  Effect.flatMap((supported) => (supported ? Effect.void : Effect.fail(failure("unavailable")))),
+);
+
+const openInput = Schema.Struct({
+  url: Schema.String.check(
+    Schema.isMinLength(1),
+    Schema.isMaxLength(4096),
+    Schema.makeFilter((text) => {
+      try {
+        const url = new URL(text);
+
+        return (
+          url.href === text &&
+          url.protocol === "https:" &&
+          !url.username &&
+          !url.password &&
+          !url.hash
+        );
+      } catch {
+        return false;
+      }
+    }),
+  ),
+  returnUrl: Schema.Union([
+    BrowserLogin.HttpsReturnUrl,
+    BrowserLogin.ReturnUrl.check(Schema.makeFilter((text) => !text.startsWith("https:"))),
+  ]),
+  ephemeral: Schema.Boolean,
+});
+
+const browserResult = Schema.Union([
+  Schema.Struct({
+    type: Schema.Literal("success"),
+    url: Schema.String.check(Schema.isMaxLength(8192)),
+  }),
+  Schema.Struct({ type: Schema.Literals(["cancel", "dismiss"]) }),
+]);
+
+interface Lease {
+  started: boolean;
+  settled: boolean;
+  listening: boolean;
+}
+
+// The bridge owns a single native resolver. All Layers in this installed module
+// share admission; applications must not call the peer independently.
+let activeBrowser: Lease | undefined;
+
+const settle = (lease: Lease) => {
+  lease.settled = true;
+  if (activeBrowser === lease) activeBrowser = undefined;
+};
+
+const acquireBrowser = Effect.sync(() => {
+  if (activeBrowser !== undefined) return undefined;
+  const lease: Lease = { started: false, settled: false, listening: true };
+
+  activeBrowser = lease;
+
+  return lease;
+}).pipe(
+  Effect.flatMap((lease) =>
+    lease === undefined ? Effect.fail(failure("busy")) : Effect.succeed(lease),
+  ),
+);
+
+const releaseBrowser = (lease: Lease) =>
+  Effect.sync(() => {
+    lease.listening = false;
+    if (!lease.started) settle(lease);
+    if (lease.settled) return;
+    try {
+      WebBrowser.dismissAuthSession();
+    } catch {
+      // Dismissal is best-effort. Keep admission held until native settlement even
+      // if dismissal fails; never deliver a late callback to another attempt.
+    }
+  });
+
+const prompt = (lease: Lease, input: typeof openInput.Type) =>
+  Effect.callback<unknown, BrowserLogin.PlatformError>((resume, signal) => {
+    lease.started = true;
+    try {
+      // SDK 54 binds HTTPS callbacks directly; SDK 57 requires this opt-in.
+      const options = {
+        preferEphemeralSession: input.ephemeral,
+        preferUniversalLinks: true,
+      };
+
+      void WebBrowser.openAuthSessionAsync(input.url, input.returnUrl, options).then(
+        (value: unknown) => {
+          settle(lease);
+          if (lease.listening && !signal.aborted) resume(Effect.succeed(value));
+        },
+        () => {
+          settle(lease);
+          if (lease.listening && !signal.aborted) resume(Effect.fail(failure("unavailable")));
+        },
+      );
+    } catch {
+      settle(lease);
+      resume(Effect.fail(failure("unavailable")));
+    }
+  });
+
+/** iOS ASWebAuthenticationSession; HTTPS callbacks require iOS 17.4+ and
+ * associated web credentials domains. Each open owns its Scope and dismissal;
+ * interruption retains the shared busy guard until the native promise settles. */
+export const layerBrowser = Layer.succeed(
+  BrowserLogin.Browser,
+  BrowserLogin.Browser.of({
+    open: Effect.fnUntraced(function* (input) {
+      yield* environment;
+
+      const request = yield* Schema.decodeEffect(openInput)(input).pipe(
+        Effect.mapError(() => failure("callback")),
+      );
+
+      if (request.returnUrl.startsWith("https:")) {
+        // Reject before invoking Expo's fallback to callbackURLScheme on older iOS.
+        const supported = yield* Effect.try({
+          try: () => {
+            const [major = 0, minor = 0] = String(Platform.Version).split(".").map(Number);
+
+            return major > 17 || (major === 17 && minor >= 4);
+          },
+          catch: () => failure("unavailable"),
+        });
+
+        if (!supported) return yield* failure("unavailable");
+      }
+
+      return yield* Effect.scoped(
+        Effect.gen(function* () {
+          const lease = yield* Effect.acquireRelease(acquireBrowser, releaseBrowser);
+
+          const result = yield* Schema.decodeUnknownEffect(browserResult)(
+            yield* prompt(lease, request),
+          ).pipe(Effect.mapError(() => failure("callback")));
+
+          if (result.type !== "success") return yield* failure("cancelled");
+
+          // Bind the full target even when the OS matches only the custom scheme;
+          // core owns state/code validation and the exchange decision.
+          return yield* Schema.decodeEffect(
+            Schema.String.check(
+              Schema.makeFilter((text) => {
+                try {
+                  const url = new URL(text);
+
+                  if (url.href !== text || url.username || url.password || url.hash) return false;
+                  url.search = "";
+
+                  return url.href === request.returnUrl;
+                } catch {
+                  return false;
+                }
+              }),
+            ),
+          )(result.url).pipe(Effect.mapError(() => failure("callback")));
+        }),
+      );
+    }),
+  }),
+);
+
+const vaultRecord = BrowserLogin.VaultRecord;
+const slots = vaultRecord.fields.credentials.key.literals;
+
+const vaultJson = Schema.fromJsonString(vaultRecord);
+
+const vaultKey = "yielded-auth.browser-login";
+const storedValue = Schema.NullOr(Schema.String.check(Schema.isMaxLength(1048576)));
+
+/** Use a fresh, dedicated SecureStore service per app, server environment and client ID.
+ * Build this Layer once per authentication lifetime; no other process or Layer
+ * may write this service. Keep its name stable across restarts; SecureStore has
+ * no cross-process compare-and-set contract. */
+export const layerVault = (options: { readonly service: string }) =>
+  Layer.effect(
+    BrowserLogin.Vault,
+    Effect.gen(function* () {
+      yield* environment;
+
+      const service = yield* Schema.decodeEffect(
+        Schema.NonEmptyString.check(Schema.isMaxLength(256)),
+      )(options.service).pipe(Effect.mapError(() => failure("storage")));
+
+      const storageOptions = {
+        keychainService: service,
+        keychainAccessible: SecureStore.WHEN_UNLOCKED_THIS_DEVICE_ONLY,
+        // Biometric changes must not invalidate the exchange fence.
+        requireAuthentication: false,
+      } satisfies SecureStore.SecureStoreOptions;
+
+      const gate = yield* Semaphore.make(1);
+
+      const readRecord: Effect.Effect<typeof vaultRecord.Type, BrowserLogin.PlatformError> =
+        Effect.gen(function* () {
+          const result = yield* Effect.tryPromise({
+            try: () => SecureStore.getItemAsync(vaultKey, storageOptions),
+            catch: () => failure("storage"),
+          }).pipe(
+            Effect.flatMap(Schema.decodeUnknownEffect(storedValue)),
+            Effect.mapError(() => failure("storage")),
+          );
+
+          if (result === null) return { credentials: {} } satisfies typeof vaultRecord.Type;
+
+          return yield* Schema.decodeEffect(vaultJson)(result, {
+            onExcessProperty: "error",
+          }).pipe(Effect.mapError(() => failure("storage")));
+        });
+
+      const writeRecord = Effect.fnUntraced(function* (record: typeof vaultRecord.Type) {
+        const encoded = yield* Schema.encodeEffect(vaultJson)(record).pipe(
+          Effect.mapError(() => failure("storage")),
+        );
+
+        // SecureStore updates existing iOS items with SecItemUpdate. Always replace
+        // the whole record, including clears; never delete the item before writing.
+        yield* Effect.tryPromise({
+          try: () => SecureStore.setItemAsync(vaultKey, encoded, storageOptions),
+          catch: () => failure("storage"),
+        });
+      });
+
+      // SecureStore promises are not cancellable. Admitted operations must settle
+      // before releasing this gate or acknowledging an Exchanging checkpoint.
+      const locked = <A, E>(work: Effect.Effect<A, E>) =>
+        gate.withPermits(1)(Effect.uninterruptible(work));
+
+      const read: NativeCredentials["read"] = locked(
+        Effect.gen(function* () {
+          const record = yield* readRecord;
+          const now = DateTime.toEpochMillis(yield* DateTime.now);
+          const credentials: Partial<Record<CredentialSlot, Redacted.Redacted<string>>> = {};
+
+          for (const slot of slots) {
+            const value = record.credentials[slot];
+
+            if (value !== undefined && value.expiresAtMillis > now)
+              credentials[slot] = value.credential;
+          }
+
+          return credentials;
+        }),
+      ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+
+      const accept: NativeCredentials["accept"] = (commands) =>
+        locked(
+          Effect.gen(function* () {
+            const record = yield* readRecord;
+            const credentials = { ...record.credentials };
+
+            for (const command of commands) {
+              if (command._tag === "Clear") delete credentials[command.slot];
+              else
+                credentials[command.slot] = {
+                  credential: command.credential,
+                  expiresAtMillis: command.expiresAtMillis,
+                };
+            }
+            yield* writeRecord({ ...record, credentials });
+          }),
+        ).pipe(Effect.mapError(() => OperationHttpError.make({ reason: "credentials" })));
+
+      return BrowserLogin.Vault.of({
+        read,
+        accept,
+        loadAttempt: locked(readRecord.pipe(Effect.map((record) => record.attempt))),
+        saveAttempt: (attempt) =>
+          locked(
+            Effect.gen(function* () {
+              const record = yield* readRecord;
+
+              yield* writeRecord(
+                attempt === undefined
+                  ? { credentials: record.credentials }
+                  : { ...record, attempt },
+              );
+            }),
+          ),
+      });
+    }),
+  );