@intentic/keyring 0.0.0-stage → 1.338.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,137 @@
-# Temporary Holding Version
+# keyring
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`intentic-keyring`, the password vault on a user's own computer: a process of its own beside
+[intentic-machine](../machine) that types a secret into a window, answers an ssh or sudo prompt, or hands a value to a
+sandbox for one use, without the sandbox's agent ever holding the value.
+
+```mermaid
+flowchart LR
+    sb["Sandbox daemon<br/>signs grants"] -->|"keyring* procedures<br/>over the device link"| m["intentic-machine<br/>relays, reads nothing"]
+    m -->|"local pipe"| k(["intentic-keyring<br/>vault · consent · typing"])
+    k -->|"checks window, types"| app["FortiClient, RDP,<br/>any native app"]
+    k -->|"adb"| phone["Android app"]
+    ssh["ssh · sudo · git"] --> ap["intentic-askpass"] -->|"local pipe"| k
+    k -->|"sealed to the sandbox"| m
+    k <-->|"sealed to each other,<br/>through a sandbox"| k2(["keyring on another<br/>of the owner's computers"])
+```
+
+## Why a process of its own
+
+intentic-machine is the agent's hands on the computer: it runs the agent's `run_command`, reads files, types. A vault
+key kept in its memory would be one bug in its scope checks away from the agent, and it updates itself on a timer at a
+sandbox maintainer's word. The keyring does only what a vault does, updates only when a person says so
+(`intentic-machine keyring upgrade` asks the running keyring, which asks the person), and trusts no caller on its pipe
+for who it is. Every caller is a process of the same user, so the pipe is not the boundary; three things are:
+
+- **A grant the sandbox signed.** A release or a typing for a sandbox carries a grant (`@intentic/sandbox-contract`
+  `schemas/keyring.ts`), Ed25519-signed by that sandbox's own key, which the keyring fetched over TLS from the
+  sandbox's address when the entry was shared (`GET /keyring/keys`), never from whoever relayed the share. A grant
+  names one secret, one target and one nonce, and lives two minutes. The agent's own commands on this computer can
+  reach the pipe but cannot sign one.
+- **A person at this computer.** Anything that changes the vault, takes a value in, hands one to a local program
+  (askpass), or answers an `each-use` share asks: Windows Hello where the computer has it, the keyring's passphrase
+  otherwise. Every prompt says what is asked for, by whom, and where it goes.
+- **The window it lands in.** Typing checks the focused window's program against the entry's list and, for a password,
+  that the focused field is a password field. A value is never typed into a field that would echo it back to a
+  screenshot unless the entry says `anyField`.
+
+What a caller learns with none of these is names and rules, never a value.
+
+## Share modes
+
+Each entry is shared with each sandbox on its own terms:
+
+| Mode | The sandbox gets a value when… | Works with the computer off |
+| --- | --- | --- |
+| `each-use` | the person at this computer says yes, each time | no |
+| `while-here` | the keyring is unlocked: one Hello tap or passphrase opens it for up to the minutes chosen | no |
+| `copy` | always: a copy, sealed to that sandbox, kept there as an ordinary secret and refreshed when the entry changes | yes |
+
+`copy` is the explicit downgrade: the value then lives in the sandbox and its guards are the sandbox's.
+
+## Files
+
+Under `~/.intentic/keyring` (0700, its files 0600):
+
+- `vault.json`: the entries, sealed under the vault key (AES-256-GCM), and the vault key wrapped once per way of
+  unlocking: by a key derived from the passphrase (scrypt), and on Windows by a key derived from a Windows Hello
+  signature over a fixed challenge (KeyCredentialManager signs with an RSA key in the TPM; PKCS#1 v1.5 signatures are
+  deterministic, so the same challenge gives the same key, and only a Hello gesture produces one). The inbox and sync
+  private keys live inside the sealed part.
+- `keys.json`: what the keyring needs while locked: its `seal` key pair (for values sent to it to type) and each
+  sandbox's pinned keys.
+- `audit.jsonl`: one line per decision (who asked, for what, the answer), never a value.
+- `keyring.log`, `keyring.pid`.
+
+## The pipe
+
+A named pipe on Windows (`\\.\pipe\intentic-keyring-<user hash>`), a unix socket in the keyring's directory elsewhere.
+One JSON line in, one out (`src/protocol.ts`). A value sent in from this computer (`intentic-machine keyring add`, the
+desktop app) is sealed to the vault's inbox key first, so a process squatting the pipe holds only ciphertext.
+
+## Typing
+
+On Windows the keyring inspects the foreground window (its process's executable, and through UI Automation whether the
+focused element is a password field) and types with `SendInput` Unicode events, never `SendKeys`: the value goes to a
+PowerShell helper on its standard input, never on a command line another process could read. It checks the
+foreground window again after typing and says so if it changed. On Linux it types with `xdotool type --file -` or
+`wtype -`, value on stdin; X11 cannot say whether a field is a password field, so a password there needs `anyField` or
+a yes at the computer. On an Android phone attached over adb it checks the foreground app and the focused node's
+`password` flag in a uiautomator dump, then types with `input text` through `adb shell` reading its commands from stdin.
+
+## askpass
+
+`intentic-askpass` is the keyring binary under a second name (a hard link beside it). Pointed at by `SSH_ASKPASS`,
+`SUDO_ASKPASS` or `GIT_ASKPASS` (`intentic-machine keyring askpass install` sets them for the user), it sends the
+prompt it was given to the keyring, which finds the entry whose `askpass` matcher fits (`ssh:user@host`,
+`ssh-key:/path`, `sudo`, `git:https://host`, `prompt:<text>`), asks the person, and prints the value for the program
+that asked. It asks every time unless the entry sets `askpassRememberMinutes`; a remembered answer is one any program
+of this user could collect in that window, the agent's own commands included, and `keyring list` says so beside it.
+
+## Password managers
+
+An entry may name where its value is read at each use instead of holding it: 1Password (`op read op://…`, unlocked
+by the 1Password app's own prompt, or a service-account token kept as another entry), Bitwarden (`bw get`, unlocked
+with a master password kept as another entry) or KeePassXC (`keepassxc-cli show`, its database password kept as
+another entry). Secrets reach those programs on standard input or in their environment, never on a command line.
+
+## Two computers, one keyring
+
+Two keyrings are paired once (`intentic-machine keyring sync pair`, or the editor's Pair), at a person's yes on each
+computer, each prompt showing both sync-key fingerprints to compare. After that each change is sealed to the other's
+sync key and left in a sandbox both are linked to, which carries ciphertext only; the other takes it in at its next
+unlock. The newer revision of an entry wins.
+
+## Hardened mode (Windows)
+
+`intentic-machine keyring harden` (one UAC prompt) moves the vault out of the user's reach:
+
+- The vault, its keys and its audit move to `%ProgramData%\Intentic\Keyring\<user SID>`, whose access list names only
+  `LOCAL SERVICE`, SYSTEM and an elevated administrator. No process of the user, the agent's `run_command` included,
+  can read the file or the memory of the process that holds it.
+- That process is the keyring itself, run by a startup task (`\Intentic\Keyring-<SID>`) as `LOCAL SERVICE` from its
+  own copy in `%ProgramData%\Intentic\Keyring\bin`, which only an administrator can replace. A task and not a Windows
+  service because a compiled script cannot answer the service manager's start handshake (`src/service/task.ts`).
+- A pipe the service created would refuse the user's writes, so it listens on loopback and writes its port and a random
+  token to a door file only that user can read (`src/service/door.ts`). The token keeps other users out; it does not keep
+  out the user's own programs, which is why every value still needs a sandbox's grant or a person's yes.
+- The session helper, `intentic-keyring session`, starts at sign-in in place of `serve`. It answers the user's usual pipe
+  by carrying each request through the door, so intentic-machine and intentic-askpass work unchanged, and it is the
+  service's hands: it shows the prompts and does the typing. It proves itself once per sign-in with a Windows Hello
+  signature over the service's challenge (or the passphrase), and every yes it relays afterwards is a Hello signature
+  over a fresh challenge, checked by the service against the Hello key pinned at setup (`src/service/hello-verify.ts`),
+  so a helper the agent started cannot say yes for the person.
+
+What it does not cover: a value being typed passes through the helper, a process of the user, for that moment. Every
+other value, the vault key and the vault itself stay with the service.
+
+## Limits
+
+- Without hardened mode, a process of the same user can read the vault key from the keyring's memory while it is
+  unlocked, and could trick a person into a Hello tap meant for the keyring; `while-here` is for a computer you are at.
+- Windows Hello's own prompt says only "Making sure it's you": the topmost notice beside it is what names the request.
+  A program that raises a Hello prompt of its own gets the same dialog without the notice.
+- A Windows Hello prompt raised by a process with no window can open behind other windows; the keyring shows a
+  topmost notice naming what is asked while it waits.
+- Typing cannot be taken back: if focus moves between the check and the last character, the keyring stops and says
+  where the rest went.

package/dist/address.d.ts

@@ -0,0 +1,14 @@
+export declare const KEYRING_HOME = "keyring";
+export interface KeyringPaths {
+    readonly dir: string;
+    readonly vault: string;
+    readonly keys: string;
+    readonly audit: string;
+    readonly log: string;
+    readonly pid: string;
+    readonly address: string;
+}
+export declare const userTag: () => string;
+export declare const keyringAddress: (dir: string, platform?: NodeJS.Platform) => string;
+export declare const keyringPaths: (dir?: string, platform?: NodeJS.Platform) => KeyringPaths;
+//# sourceMappingURL=address.d.ts.map

package/dist/address.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,YAAY,CAAC;AAEtC,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAGD,eAAO,MAAM,OAAO,QAAO,MAAmG,CAAC;AAE/H,eAAO,MAAM,cAAc,QAAS,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,MACQ,CAAC;AAEpG,eAAO,MAAM,YAAY,SAAS,MAAM,aAA0C,MAAM,CAAC,QAAQ,KAAsB,YAQrH,CAAC"}

package/dist/address.js

@@ -0,0 +1,17 @@
+import { createHash } from "node:crypto";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { agentHome } from "@intentic/local-agent";
+export const KEYRING_HOME = "keyring";
+export const userTag = () => createHash("sha256").update(userInfo().username.toLowerCase()).digest("hex").slice(0, 12);
+export const keyringAddress = (dir, platform = process.platform) => platform === "win32" ? `\\\\.\\pipe\\intentic-keyring-${userTag()}` : join(dir, "keyring.sock");
+export const keyringPaths = (dir = agentHome(KEYRING_HOME).dir, platform = process.platform) => ({
+    dir,
+    vault: join(dir, "vault.json"),
+    keys: join(dir, "keys.json"),
+    audit: join(dir, "audit.jsonl"),
+    log: join(dir, "keyring.log"),
+    pid: join(dir, "keyring.pid"),
+    address: keyringAddress(dir, platform),
+});
+//# sourceMappingURL=address.js.map

package/dist/address.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AAiBtC,MAAM,CAAC,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE/H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAU,EAAE,CAChG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iCAAiC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,GAAW,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAgB,EAAE,CAAC,CAAC;IACpI,GAAG;IACH,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;IAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;CACzC,CAAC,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,3 @@
+import type { CommandContext } from "@stricli/core";
+export declare const app: import("@stricli/core").Application<CommandContext>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA2GpD,eAAO,MAAM,GAAG,qDAKd,CAAC"}

package/dist/app.js

@@ -0,0 +1,100 @@
+import { agentException } from "@intentic/local-agent";
+import { buildApplication, buildCommand, buildRouteMap, text_en } from "@stricli/core";
+import { askpass } from "./askpass/askpass-run.js";
+import { serve } from "./serve.js";
+import { runSession } from "./service/helper.js";
+import { installService, uninstallService } from "./service/install.js";
+import { SID_RE } from "./service/paths.js";
+import { runService } from "./service/service-run.js";
+import { realRunner } from "./run.js";
+import { KEYRING_VERSION } from "./version.js";
+const serveCommand = buildCommand({
+    docs: { brief: "Run the keyring (started at sign-in; there is one per user)" },
+    parameters: {},
+    async func() {
+        const served = await serve();
+        if (!served.ok) {
+            this.process.stderr.write(`${served.reason}\n`);
+            process.exitCode = 1;
+            return;
+        }
+        const stop = () => {
+            void served.stop().then(() => process.exit(0));
+        };
+        process.once("SIGINT", stop);
+        process.once("SIGTERM", stop);
+        await new Promise(() => undefined);
+    },
+});
+const versionCommand = buildCommand({
+    docs: { brief: "Print this keyring's version" },
+    parameters: {},
+    func() {
+        this.process.stdout.write(`${KEYRING_VERSION}\n`);
+    },
+});
+const askpassCommand = buildCommand({
+    docs: { brief: "Answer an ssh, sudo or git password prompt from the keyring (what intentic-askpass runs)" },
+    parameters: { flags: {}, positional: { kind: "array", parameter: { brief: "The prompt the program showed", parse: String } } },
+    async func(_flags, ...prompt) {
+        process.exitCode = await askpass(prompt.join(" "), this.process.stdout, this.process.stderr);
+    },
+});
+const windowsOnly = () => {
+    if (process.platform !== "win32") {
+        process.stderr.write("Hardened mode is Windows-only.\n");
+        process.exitCode = 1;
+        return false;
+    }
+    return true;
+};
+const installCommand = buildCommand({
+    docs: { brief: "Move the vault under the hardened service (run elevated; intentic-machine keyring harden does this)" },
+    parameters: {},
+    async func() {
+        if (windowsOnly()) {
+            const done = await installService(realRunner);
+            this.process.stdout.write(`${JSON.stringify({ ok: true, ...done })}\n`);
+        }
+    },
+});
+const uninstallCommand = buildCommand({
+    docs: { brief: "Put the vault back in your own folder and remove the hardened service (run elevated)" },
+    parameters: {},
+    async func() {
+        if (windowsOnly()) {
+            const done = await uninstallService(realRunner);
+            this.process.stdout.write(`${JSON.stringify({ ok: true, ...done })}\n`);
+        }
+    },
+});
+const runCommand = buildCommand({
+    docs: { brief: "Run the hardened service (what its startup task starts)" },
+    parameters: { flags: { user: { kind: "parsed", parse: String, brief: "The user's security identifier" } } },
+    async func(flags) {
+        if (!SID_RE.test(flags.user)) {
+            this.process.stderr.write("--user takes a security identifier (S-1-5-…).\n");
+            process.exitCode = 1;
+            return;
+        }
+        if (windowsOnly()) {
+            await runService(flags.user);
+        }
+    },
+});
+const sessionCommand = buildCommand({
+    docs: { brief: "Run the session helper of a hardened keyring (started at sign-in)" },
+    parameters: {},
+    async func() {
+        if (windowsOnly()) {
+            await runSession();
+        }
+    },
+});
+export const app = buildApplication(buildRouteMap({ routes: { serve: serveCommand, version: versionCommand, askpass: askpassCommand, service: buildRouteMap({ routes: { install: installCommand, uninstall: uninstallCommand, run: runCommand }, docs: { brief: "Hardened mode (Windows)" } }), session: sessionCommand }, docs: { brief: "The Intentic keyring" } }), {
+    name: "intentic-keyring",
+    versionInfo: { currentVersion: KEYRING_VERSION },
+    scanner: { caseStyle: "allow-kebab-for-camel" },
+    localization: { text: { ...text_en, formatException: agentException, exceptionWhileRunningCommand: (exc) => `error: ${agentException(exc)}` } },
+});
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEvF,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAM/C,MAAM,YAAY,GAAG,YAAY,CAAC;IAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE;IAC9E,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAS,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC/C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;IACtD,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC3G,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9H,KAAK,CAAC,IAAI,CAAuB,MAA6B,EAAE,GAAG,MAAgB;QAC/E,OAAO,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;CACJ,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,GAAY,EAAE;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,qGAAqG,EAAE;IACtH,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,YAAY,CAAC;IAClC,IAAI,EAAE,EAAE,KAAK,EAAE,sFAAsF,EAAE;IACvG,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,YAAY,CAAC;IAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,yDAAyD,EAAE;IAC1E,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,EAAE;IAC3G,KAAK,CAAC,IAAI,CAAuB,KAAgC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE;IACpF,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,EAAE;IACnW,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;IAChD,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;CAClJ,CAAC,CAAC"}

package/dist/askpass/askpass-run.d.ts

@@ -0,0 +1,7 @@
+interface Writable {
+    readonly write: (text: string) => void;
+}
+export declare const askpass: (prompt: string, stdout: Writable, stderr: Writable) => Promise<number>;
+export declare const startedAsAskpass: (argv0?: string, argv1?: string | undefined) => boolean;
+export {};
+//# sourceMappingURL=askpass-run.d.ts.map

package/dist/askpass/askpass-run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass-run.d.ts","sourceRoot":"","sources":["../../src/askpass/askpass-run.ts"],"names":[],"mappings":"AASA,UAAU,QAAQ;IACd,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC1C;AAQD,eAAO,MAAM,OAAO,WAAkB,MAAM,UAAU,QAAQ,UAAU,QAAQ,KAAG,OAAO,CAAC,MAAM,CAchG,CAAC;AAIF,eAAO,MAAM,gBAAgB,WAAW,MAAM,UAA4B,MAAM,GAAG,SAAS,KAAqB,OACK,CAAC"}

package/dist/askpass/askpass-run.js

@@ -0,0 +1,25 @@
+import { keyringPaths } from "../address.js";
+import { askKeyring, KeyringUnavailable } from "../client.js";
+import { basenameOf } from "../policy.js";
+const parentName = () => {
+    const name = process.env["SUDO_COMMAND"] === undefined ? undefined : "sudo";
+    return name ?? (process.env["GIT_ASKPASS"] !== undefined && process.env["GIT_EXEC_PATH"] !== undefined ? "git" : process.env["SSH_ASKPASS"] !== undefined ? "ssh" : undefined);
+};
+export const askpass = async (prompt, stdout, stderr) => {
+    try {
+        const parent = parentName();
+        const answer = await askKeyring({ address: keyringPaths().address }, parent === undefined ? { op: "askpass", prompt } : { op: "askpass", prompt, parent });
+        if (answer.ok) {
+            stdout.write(`${answer.value}\n`);
+            return 0;
+        }
+        stderr.write(`intentic-askpass: ${answer.refusal}\n`);
+        return 1;
+    }
+    catch (error) {
+        stderr.write(`intentic-askpass: ${error instanceof KeyringUnavailable ? error.message : "the keyring could not be asked"}\n`);
+        return 1;
+    }
+};
+export const startedAsAskpass = (argv0 = process.execPath, argv1 = process.argv[1]) => [argv0, argv1].some((path) => path !== undefined && basenameOf(path).toLowerCase().startsWith("intentic-askpass"));
+//# sourceMappingURL=askpass-run.js.map

package/dist/askpass/askpass-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass-run.js","sourceRoot":"","sources":["../../src/askpass/askpass-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAY1C,MAAM,UAAU,GAAG,GAAuB,EAAE;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5E,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACnL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,EAAE,MAAc,EAAE,MAAgB,EAAE,MAAgB,EAAmB,EAAE;IACjG,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3J,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;YAClC,OAAO,CAAC,CAAC;QACb,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,qBAAqB,KAAK,YAAY,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,IAAI,CAAC,CAAC;QAC9H,OAAO,CAAC,CAAC;IACb,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,KAAK,GAAW,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAuB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAW,EAAE,CACvH,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC"}

package/dist/askpass/askpass.d.ts

@@ -0,0 +1,9 @@
+export interface AskpassQuestion {
+    readonly wants: "secret" | "username";
+    readonly matchers: readonly string[];
+    readonly prompt: string;
+}
+export declare const parseAskpassPrompt: (prompt: string) => AskpassQuestion;
+export declare const normalMatcher: (matcher: string) => string;
+export declare const askpassMatch: (question: AskpassQuestion, matchers: readonly string[]) => string | undefined;
+//# sourceMappingURL=askpass.d.ts.map

package/dist/askpass/askpass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass.d.ts","sourceRoot":"","sources":["../../src/askpass/askpass.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,eAAe;IAE5B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,UAAU,CAAC;IAEtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAErC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CAC3B;AAwBD,eAAO,MAAM,kBAAkB,WAAY,MAAM,KAAG,eA0BnD,CAAC;AAIF,eAAO,MAAM,aAAa,YAAa,MAAM,KAAG,MAc/C,CAAC;AAGF,eAAO,MAAM,YAAY,aAAc,eAAe,YAAY,SAAS,MAAM,EAAE,KAAG,MAAM,GAAG,SAS9F,CAAC"}

package/dist/askpass/askpass.js

@@ -0,0 +1,70 @@
+const SSH_PASSWORD = /^(?<user>[^\s@']+)@(?<host>[^\s']+)'s password:\s*$/u;
+const SSH_KEYBOARD = /^\((?<user>[^\s@()]+)@(?<host>[^\s()]+)\) Password:\s*$/iu;
+const SSH_KEY = /^Enter passphrase for key '(?<path>[^']+)':\s*$/u;
+const SUDO = /^\[sudo\] password for (?<user>[^\s:]+):\s*$/u;
+const GIT_PASSWORD = /^Password for '(?<url>[^']+)':\s*$/u;
+const GIT_USERNAME = /^Username for '(?<url>[^']+)':\s*$/u;
+const gitSite = (url) => {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return undefined;
+    }
+    return `${parsed.protocol}//${parsed.host.toLowerCase()}`;
+};
+const lineOf = (prompt) => prompt.replace(/\s+/gu, " ").trim();
+export const parseAskpassPrompt = (prompt) => {
+    const text = prompt.trim();
+    const shown = lineOf(prompt);
+    const ssh = SSH_PASSWORD.exec(text) ?? SSH_KEYBOARD.exec(text);
+    if (ssh?.groups?.["user"] !== undefined && ssh.groups["host"] !== undefined) {
+        return { wants: "secret", matchers: [`ssh:${ssh.groups["user"]}@${ssh.groups["host"].toLowerCase()}`], prompt: shown };
+    }
+    const key = SSH_KEY.exec(text)?.groups?.["path"];
+    if (key !== undefined) {
+        return { wants: "secret", matchers: [`ssh-key:${key}`], prompt: shown };
+    }
+    const sudo = SUDO.exec(text)?.groups?.["user"];
+    if (sudo !== undefined) {
+        return { wants: "secret", matchers: [`sudo:${sudo}`, "sudo"], prompt: shown };
+    }
+    for (const [pattern, wants] of [
+        [GIT_PASSWORD, "secret"],
+        [GIT_USERNAME, "username"],
+    ]) {
+        const url = pattern.exec(text)?.groups?.["url"];
+        const site = url === undefined ? undefined : gitSite(url);
+        if (site !== undefined) {
+            return { wants, matchers: [`git:${site}`], prompt: shown };
+        }
+    }
+    return { wants: "secret", matchers: [`prompt:${shown}`], prompt: shown };
+};
+export const normalMatcher = (matcher) => {
+    const colon = matcher.indexOf(":");
+    const kind = colon === -1 ? matcher : matcher.slice(0, colon);
+    const rest = colon === -1 ? "" : matcher.slice(colon + 1);
+    switch (kind) {
+        case "ssh":
+            return `ssh:${rest.replace(/@(.*)$/u, (_match, host) => `@${host.toLowerCase()}`)}`;
+        case "git":
+            return `git:${gitSite(rest) ?? rest.toLowerCase()}`;
+        case "prompt":
+            return `prompt:${lineOf(rest).replace(/[:?]\s*$/u, "").toLowerCase()}`;
+        default:
+            return matcher;
+    }
+};
+export const askpassMatch = (question, matchers) => {
+    const own = new Map(matchers.map((matcher) => [normalMatcher(matcher), matcher]));
+    for (const wanted of question.matchers) {
+        const found = own.get(normalMatcher(wanted));
+        if (found !== undefined) {
+            return found;
+        }
+    }
+    return undefined;
+};
+//# sourceMappingURL=askpass.js.map

package/dist/askpass/askpass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass.js","sourceRoot":"","sources":["../../src/askpass/askpass.ts"],"names":[],"mappings":"AAcA,MAAM,YAAY,GAAG,sDAAsD,CAAC;AAC5E,MAAM,YAAY,GAAG,2DAA2D,CAAC;AACjF,MAAM,OAAO,GAAG,kDAAkD,CAAC;AACnE,MAAM,IAAI,GAAG,+CAA+C,CAAC;AAC7D,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAI3D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAsB,EAAE;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC9D,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAAmB,EAAE;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,GAAG,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3H,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,WAAW,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAClF,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI;QAC3B,CAAC,YAAY,EAAE,QAAQ,CAAC;QACxB,CAAC,YAAY,EAAE,UAAU,CAAC;KACpB,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC/D,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,UAAU,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAU,EAAE;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC1D,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,KAAK;YACN,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC;QAChG,KAAK,KAAK;YACN,OAAO,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxD,KAAK,QAAQ;YACT,OAAO,UAAU,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3E;YACI,OAAO,OAAO,CAAC;IACvB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAyB,EAAE,QAA2B,EAAsB,EAAE;IACvG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACjB,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC"}

package/dist/askpass-cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=askpass-cli.d.ts.map

package/dist/askpass-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass-cli.d.ts","sourceRoot":"","sources":["../src/askpass-cli.ts"],"names":[],"mappings":""}

package/dist/askpass-cli.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { askpass } from "./askpass/askpass-run.js";
+process.exitCode = await askpass(process.argv.slice(2).join(" "), process.stdout, process.stderr);
+//# sourceMappingURL=askpass-cli.js.map

package/dist/askpass-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"askpass-cli.js","sourceRoot":"","sources":["../src/askpass-cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGnD,OAAO,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC"}

package/dist/audit.d.ts

@@ -0,0 +1,18 @@
+export interface AuditRecord {
+    readonly op: string;
+    readonly outcome: "granted" | "refused" | "done" | "pending";
+    readonly code?: string | undefined;
+    readonly secret?: string | undefined;
+    readonly sandbox?: string | undefined;
+    readonly target?: string | undefined;
+    readonly program?: string | undefined;
+    readonly asked?: boolean | undefined;
+    readonly how?: string | undefined;
+    readonly detail?: string | undefined;
+    readonly conversation?: string | undefined;
+    readonly reason?: string | undefined;
+}
+export type Audit = (record: AuditRecord) => Promise<void>;
+export declare const fileAudit: (path: string, dir: string, now?: () => number) => Audit;
+export declare const noAudit: Audit;
+//# sourceMappingURL=audit.d.ts.map

package/dist/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,QAAQ,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3D,eAAO,MAAM,SAAS,SAAU,MAAM,OAAO,MAAM,QAAO,MAAM,MAAM,KAAc,KAUnF,CAAC;AAGF,eAAO,MAAM,OAAO,EAAE,KAA+B,CAAC"}

package/dist/audit.js

@@ -0,0 +1,14 @@
+import { appendFile, chmod, mkdir } from "node:fs/promises";
+import { serialLock } from "@intentic/base/async";
+import { rotateIfLarge } from "@intentic/local-agent";
+export const fileAudit = (path, dir, now = Date.now) => {
+    const queue = serialLock();
+    return async (record) => await queue(async () => {
+        await mkdir(dir, { recursive: true, mode: 0o700 });
+        await rotateIfLarge(path);
+        await appendFile(path, `${JSON.stringify({ at: new Date(now()).toISOString(), ...record })}\n`, { mode: 0o600 });
+        await chmod(path, 0o600);
+    });
+};
+export const noAudit = () => Promise.resolve();
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AA0BtD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,GAAW,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG,EAAS,EAAE;IACxF,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,CACpB,MAAM,KAAK,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAEjH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACX,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,OAAO,GAAU,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC"}

package/dist/backends.d.ts

@@ -0,0 +1,19 @@
+import type { BackendConfig, BackendRef } from "./protocol.js";
+import { type Runner } from "./run.js";
+export type BackendRead = {
+    readonly ok: true;
+    readonly value: string;
+} | {
+    readonly ok: false;
+    readonly code: "unavailable";
+    readonly reason: string;
+};
+export type SecretOf = (name: string) => Promise<string | undefined>;
+export declare class BackendReader {
+    #private;
+    private readonly runner;
+    constructor(runner: Runner);
+    forget(): void;
+    read(ref: BackendRef, configs: readonly BackendConfig[], secretOf: SecretOf): Promise<BackendRead>;
+}
+//# sourceMappingURL=backends.d.ts.map

package/dist/backends.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends.d.ts","sourceRoot":"","sources":["../src/backends.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAqC,KAAK,MAAM,EAA8B,MAAM,UAAU,CAAC;AAUtG,MAAM,MAAM,WAAW,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGxJ,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;AAkBrE,qBAAa,aAAa;;IAIV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,MAAM,EAAI;IAG/C,MAAM,IAAI,IAAI,CAEb;IAEK,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,aAAa,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBvG;CA+DJ"}