@intentic/keyring 0.0.0-stage → 1.338.0

package/dist/vault.js

@@ -0,0 +1,188 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { isMissing } from "@intentic/base/errors";
+import { writeSecretFile } from "@intentic/local-agent";
+import { KEYRING_KEY_RE, KeyringInboxItemSchema, KeyringPublicKeySchema, KeyringSecretNameSchema, KeyringSourceSchema, KeyringSyncItemSchema, KeyringSyncPeerSchema, SealedBoxSchema, } from "@intentic/sandbox-contract/schemas/keyring";
+import { z } from "zod";
+import { BackendConfigSchema, BackendRefSchema, EntryInfoSchema, EntryRulesSchema, ShareInfoSchema } from "./protocol.js";
+const VAULT_AAD = Buffer.from("intentic-keyring/vault/v1", "utf8");
+const HELLO_INFO = Buffer.from("intentic-keyring/hello/v1", "utf8");
+const wrapAad = (method) => Buffer.from(`intentic-keyring/wrap/v1/${method}`, "utf8");
+export const SCRYPT_COST = { N: 2 ** 17, r: 8, p: 1 };
+const scryptMaxmem = (cost) => 128 * cost.N * cost.r + 64 * 1024 * 1024;
+export const VAULT_KEY_BYTES = 32;
+export const VALUE_MAX_BYTES = 32 * 1024;
+const b64u = z.string().regex(/^[A-Za-z0-9_-]*$/u);
+const BoxSchema = z.object({ iv: b64u, tag: b64u, data: b64u }).strict();
+const PassphraseWrapSchema = BoxSchema.extend({
+    method: z.literal("passphrase"),
+    salt: b64u,
+    N: z.number().int().min(2 ** 10).max(2 ** 20),
+    r: z.number().int().min(1).max(32),
+    p: z.number().int().min(1).max(16),
+}).strict();
+const HelloWrapSchema = BoxSchema.extend({
+    method: z.literal("hello"),
+    credential: z.string().min(1).max(128),
+    challenge: b64u,
+    publicKey: z.string().regex(/^[A-Za-z0-9+/=]+$/u).max(4096).optional(),
+}).strict();
+const DpapiWrapSchema = z
+    .object({
+    method: z.literal("dpapi"),
+    blob: z.string().regex(/^[A-Za-z0-9+/=]+$/u).max(8192),
+})
+    .strict();
+export const WrapSchema = z.discriminatedUnion("method", [PassphraseWrapSchema, HelloWrapSchema, DpapiWrapSchema]);
+export const KeyPairSchema = z.object({ publicKey: z.string().regex(KEYRING_KEY_RE), privateKey: z.string().regex(KEYRING_KEY_RE) }).strict();
+export const SandboxPinSchema = z.object({ sign: KeyringPublicKeySchema, seal: KeyringPublicKeySchema, fetchedAt: z.number() }).strict();
+export const StoredEntrySchema = z
+    .object({
+    name: KeyringSecretNameSchema,
+    rules: EntryRulesSchema,
+    source: KeyringSourceSchema,
+    backend: BackendRefSchema.optional(),
+    value: z.string().optional(),
+    shares: z.array(ShareInfoSchema),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    revision: z.number().int().nonnegative(),
+    deleted: z.boolean().optional(),
+})
+    .strict();
+export const VaultDocumentSchema = z
+    .object({
+    v: z.literal(1),
+    revision: z.number().int().nonnegative(),
+    entries: z.record(KeyringSecretNameSchema, StoredEntrySchema),
+    inbox: KeyPairSchema,
+    sync: KeyPairSchema,
+    peers: z.array(KeyringSyncPeerSchema),
+    backends: z.array(BackendConfigSchema),
+    pins: z.record(z.string(), SandboxPinSchema),
+    syncSent: z.record(KeyringPublicKeySchema, z.number().int().min(-1)).optional(),
+})
+    .strict();
+const CopySchema = z.object({ name: KeyringSecretNameSchema, sealed: SealedBoxSchema, updatedAt: z.number() }).strict();
+export const PendingInboxSchema = z.object({ item: KeyringInboxItemSchema, receivedAt: z.number() }).strict();
+export const PENDING_INBOX_MAX = 32;
+export const PENDING_SYNC_MAX = 128;
+export const OpenPartSchema = z
+    .object({
+    entries: z.array(EntryInfoSchema),
+    backends: z.array(z.enum(["1password", "bitwarden", "keepassxc"])),
+    peers: z.array(KeyringSyncPeerSchema),
+    revision: z.number().int().nonnegative(),
+    copies: z.record(z.string(), z.array(CopySchema)),
+    pendingInbox: z.array(PendingInboxSchema).max(PENDING_INBOX_MAX),
+    pendingSync: z.array(KeyringSyncItemSchema).max(PENDING_SYNC_MAX),
+})
+    .strict();
+export const VaultFileSchema = z
+    .object({
+    v: z.literal(1),
+    wraps: z.array(WrapSchema).min(1),
+    sealed: BoxSchema,
+    open: OpenPartSchema,
+})
+    .strict();
+export class VaultError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "VaultError";
+    }
+}
+export const newVaultKey = () => randomBytes(VAULT_KEY_BYTES);
+const sealBox = (key, plaintext, aad) => {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    cipher.setAAD(aad);
+    const data = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    return { iv: iv.toString("base64url"), tag: cipher.getAuthTag().toString("base64url"), data: data.toString("base64url") };
+};
+const openBox = (key, box, aad) => {
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(box.iv, "base64url"));
+        decipher.setAAD(aad);
+        decipher.setAuthTag(Buffer.from(box.tag, "base64url"));
+        return Buffer.concat([decipher.update(Buffer.from(box.data, "base64url")), decipher.final()]);
+    }
+    catch {
+        return undefined;
+    }
+};
+export const sealDocument = (key, document) => sealBox(key, Buffer.from(JSON.stringify(VaultDocumentSchema.parse(document)), "utf8"), VAULT_AAD);
+export const openDocument = (key, box) => {
+    const plain = openBox(key, box, VAULT_AAD);
+    if (plain === undefined) {
+        throw new VaultError("The vault does not open with this key: the file was changed or belongs to another keyring.");
+    }
+    const parsed = VaultDocumentSchema.safeParse(JSON.parse(plain.toString("utf8")));
+    if (!parsed.success) {
+        throw new VaultError("The vault opened but holds something this keyring does not read: is it a newer version's?");
+    }
+    return parsed.data;
+};
+const deriveFromPassphrase = async (passphrase, salt, cost) => await new Promise((resolve, reject) => {
+    scrypt(passphrase.normalize("NFC"), salt, VAULT_KEY_BYTES, { N: cost.N, r: cost.r, p: cost.p, maxmem: scryptMaxmem(cost) }, (error, derived) => error instanceof Error ? reject(error) : resolve(derived));
+});
+export const wrapWithPassphrase = async (vaultKey, passphrase, cost = SCRYPT_COST) => {
+    const salt = randomBytes(16);
+    const wrapKey = await deriveFromPassphrase(passphrase, salt, cost);
+    return { method: "passphrase", salt: salt.toString("base64url"), N: cost.N, r: cost.r, p: cost.p, ...sealBox(wrapKey, vaultKey, wrapAad("passphrase")) };
+};
+export const unwrapPassphrase = async (wraps, passphrase) => {
+    for (const wrap of wraps) {
+        if (wrap.method === "passphrase") {
+            const wrapKey = await deriveFromPassphrase(passphrase, Buffer.from(wrap.salt, "base64url"), wrap);
+            const key = openBox(wrapKey, wrap, wrapAad("passphrase"));
+            if (key !== undefined) {
+                return key;
+            }
+        }
+    }
+    return undefined;
+};
+export const helloChallenge = () => randomBytes(32).toString("base64url");
+export const helloWrapKey = (signature, challenge) => Buffer.from(hkdfSync("sha256", signature, Buffer.from(challenge, "base64url"), HELLO_INFO, VAULT_KEY_BYTES));
+export const wrapWithHello = (vaultKey, enrolment) => {
+    const wrap = {
+        method: "hello",
+        credential: enrolment.credential,
+        challenge: enrolment.challenge,
+        ...sealBox(helloWrapKey(enrolment.signature, enrolment.challenge), vaultKey, wrapAad("hello")),
+    };
+    return enrolment.publicKey === undefined ? wrap : { ...wrap, publicKey: enrolment.publicKey };
+};
+export const helloWrapOf = (wraps) => wraps.find((wrap) => wrap.method === "hello");
+export const unwrapHello = (wrap, signature) => openBox(helloWrapKey(signature, wrap.challenge), wrap, wrapAad("hello"));
+export const sameKey = (a, b) => a.length === b.length && timingSafeEqual(a, b);
+export const emptyOpenPart = () => ({ entries: [], backends: [], peers: [], revision: 0, copies: {}, pendingInbox: [], pendingSync: [] });
+export const readVaultFile = async (path) => {
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (error) {
+        if (isMissing(error)) {
+            return undefined;
+        }
+        throw error;
+    }
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new VaultError(`${path} is not JSON: restore it from a backup, or move it aside to set up a new keyring.`, { cause: error });
+    }
+    const parsed = VaultFileSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new VaultError(`${path} is not a vault this keyring reads: is it a newer version's? Restore it from a backup, or move it aside to set up a new keyring.`);
+    }
+    return parsed.data;
+};
+export const writeVaultFile = async (path, dir, file) => {
+    await writeSecretFile(path, dir, `${JSON.stringify(VaultFileSchema.parse(file))}\n`);
+};
+//# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACH,cAAc,EACd,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,GAClB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAc1H,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AACnE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;AAItG,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAO/D,MAAM,YAAY,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5F,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAGlC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGzE,MAAM,oBAAoB,GAAG,SAAS,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC/B,IAAI,EAAE,IAAI;IACV,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrC,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAE1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,SAAS,EAAE,IAAI;IAEf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACzE,CAAC,CAAC,MAAM,EAAE,CAAC;AACZ,MAAM,eAAe,GAAG,CAAC;KACpB,MAAM,CAAC;IACJ,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAE1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACzD,CAAC;KACD,MAAM,EAAE,CAAC;AACd,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,oBAAoB,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAInH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAG9I,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGzI,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACJ,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,mBAAmB;IAC3B,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAEpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IAErB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAExC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE,CAAC;AAGd,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACJ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAEf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;IAC7D,KAAK,EAAE,aAAa;IACpB,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC;IAE5C,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClF,CAAC;KACD,MAAM,EAAE,CAAC;AAGd,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGxH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAI9G,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC1B,MAAM,CAAC;IACJ,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAClE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAGd,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC3B,MAAM,CAAC;IACJ,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,MAAM,EAAE,SAAS;IACjB,IAAI,EAAE,cAAc;CACvB,CAAC;KACD,MAAM,EAAE,CAAC;AAGd,MAAM,OAAO,UAAW,SAAQ,KAAK;IACjC,YAAY,OAAe,EAAE,OAAsB;QAC/C,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC7B,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC;AAEtE,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,SAAiB,EAAE,GAAW,EAAO,EAAE;IACjE,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC9H,CAAC,CAAC;AAGF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,GAAQ,EAAE,GAAW,EAAsB,EAAE;IACvE,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACxF,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;QACvD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,QAAuB,EAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;AAE7K,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAW,EAAE,GAAQ,EAAiB,EAAE;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,UAAU,CAAC,4FAA4F,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,2FAA2F,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,KAAK,EAAE,UAAkB,EAAE,IAAY,EAAE,IAAgB,EAAmB,EAAE,CACvG,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAClC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAE3I,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAC5D,CAAC;AACN,CAAC,CAAC,CAAC;AAEP,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,QAAgB,EAAE,UAAkB,EAAE,IAAI,GAAe,WAAW,EAAiB,EAAE;IAC5H,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;AAC7J,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,KAAsB,EAAE,UAAkB,EAA+B,EAAE;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAE/B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;YAC1D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,OAAO,GAAG,CAAC;YACf,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,SAAiB,EAAU,EAAE,CACzE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;AASjH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAgB,EAAE,SAAyB,EAAQ,EAAE;IAC/E,MAAM,IAAI,GAAc;QACpB,MAAM,EAAE,OAAO;QACf,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,GAAG,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;KACjG,CAAC;IACF,OAAO,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC;AAClG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAyB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAe,EAAE,SAAiB,EAAsB,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AAGhK,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAEzG,MAAM,CAAC,MAAM,aAAa,GAAG,GAAa,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AAIpJ,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,IAAY,EAAkC,EAAE;IAChF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,mFAAmF,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACvI,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,IAAI,UAAU,CAAC,GAAG,IAAI,kIAAkI,CAAC,CAAC;IACpK,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAY,EAAE,GAAW,EAAE,IAAe,EAAiB,EAAE;IAC9F,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AACzF,CAAC,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const KEYRING_VERSION: string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAcA,eAAO,MAAM,eAAe,EAAE,MAAkB,CAAC"}

package/dist/version.js

@@ -0,0 +1,10 @@
+const stamped = () => {
+    try {
+        return INTENTIC_AGENT_VERSION ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+};
+export const KEYRING_VERSION = stamped();
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,GAAG,GAAW,EAAE;IACzB,IAAI,CAAC;QACD,OAAO,sBAAsB,IAAI,OAAO,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,OAAO,CAAC;IACnB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAW,OAAO,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,59 @@
 {
   "name": "@intentic/keyring",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.338.0",
+  "description": "intentic-keyring: the password vault on a user's own computer, a process of its own beside intentic-machine, that types and releases secrets for a sandbox's agent without the agent ever holding them",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/intentic/intentic.git",
+    "directory": "_devices/keyring"
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "bin": {
+    "intentic-keyring": "./dist/cli.js",
+    "intentic-askpass": "./dist/askpass-cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "dependencies": {
+    "@intentic/base": "1.338.0",
+    "@intentic/local-agent": "1.338.0",
+    "@intentic/sandbox-contract": "1.338.0",
+    "@stricli/core": "1.3.0",
+    "tslib": "2.8.1",
+    "zod": "4.6.5"
+  },
+  "devDependencies": {
+    "@intentic/constants": "1.338.0",
+    "@intentic/testing": "0.0.0",
+    "@intentic/tsconfig": "0.0.0",
+    "@types/bun": "1.4.2",
+    "@types/node": "24.19.1",
+    "@typescript/native-preview": "7.0.0-dev.20260707.2"
+  },
+  "scripts": {
+    "build": "tsgo",
+    "typecheck": "bun check -p tsconfig.test.json",
+    "watch": "tsgo --build --watch",
+    "test": "suites",
+    "test:watch": "suites --watch"
+  }
 }