@intentic/keyring 0.0.0-stage → 1.338.0

package/dist/core.js

@@ -0,0 +1,882 @@
+import { serialLock } from "@intentic/base/async";
+import { KeyringSandboxKeysSchema, } from "@intentic/sandbox-contract/schemas/keyring";
+import { keyFingerprint, newSealKeyPair, seal, unseal } from "@intentic/sandbox-contract/keyring-seal";
+import { askpassMatch, parseAskpassPrompt } from "./askpass/askpass.js";
+import { pinOf, samePin } from "./keys.js";
+import { acceptGrant, applyPatch, hostOf, isUnlocked, MINUTE_MS, modeNeedsPerson, NonceBook, rememberedFresh, releaseTargetOf, sandboxKey, shareWith, typeTargetOf, typingDecision, wideningOf, } from "./policy.js";
+import { emptyOpenPart, helloChallenge, helloWrapOf, newVaultKey, openDocument, PENDING_INBOX_MAX, PENDING_SYNC_MAX, SCRYPT_COST, sealDocument, StoredEntrySchema, unwrapHello, unwrapPassphrase, VALUE_MAX_BYTES, wrapWithHello, wrapWithPassphrase, } from "./vault.js";
+const RELAYED_OPS = ["shares", "release", "type", "inbox", "copies", "sync-state", "sync-pair", "sync-outbox", "sync-deliver"];
+const RELAYED = new Set(RELAYED_OPS);
+const isRelayed = (request) => RELAYED.has(request.op);
+const refuse = (code, refusal) => ({ ok: false, code, refusal });
+const fromConsent = (answer) => refuse(answer.code, answer.reason);
+const NOT_SET_UP = "The keyring on this computer is not set up yet: `intentic-machine keyring setup` sets it up.";
+const SETUP_UNLOCK_MINUTES = 15;
+const FOCUS_SETTLE_MS = 400;
+const SyncEntrySchema = StoredEntrySchema.omit({ shares: true, revision: true });
+const entryInfoOf = (entry) => {
+    const info = { name: entry.name, ...entry.rules, source: entry.source, shares: entry.shares, createdAt: entry.createdAt, updatedAt: entry.updatedAt };
+    if (entry.backend !== undefined) {
+        info.backend = entry.backend;
+    }
+    return info;
+};
+const syncEntryOf = (entry) => {
+    const sent = { name: entry.name, rules: entry.rules, source: entry.source, createdAt: entry.createdAt, updatedAt: entry.updatedAt };
+    if (entry.backend !== undefined) {
+        sent.backend = entry.backend;
+    }
+    if (entry.value !== undefined) {
+        sent.value = entry.value;
+    }
+    if (entry.deleted === true) {
+        sent.deleted = true;
+    }
+    return sent;
+};
+const pointerOf = (entry, share) => ({
+    name: entry.name,
+    mode: share.mode,
+    kind: entry.kind,
+    programs: entry.programs,
+    packages: entry.packages,
+    hosts: entry.hosts,
+    anyField: entry.anyField,
+    source: entry.source,
+    updatedAt: entry.updatedAt,
+});
+const modeWords = (mode) => mode === "each-use" ? "it asks you each time" : mode === "while-here" ? "it goes unasked while the keyring is unlocked" : "a copy is kept in that sandbox";
+const rulesWords = (rules) => {
+    const programs = rules.programs.length === 0 ? "no program named" : `programs ${rules.programs.join(", ")}`;
+    const field = rules.kind === "password" && !rules.anyField ? "password fields only" : "any field";
+    return `${programs}; ${field}`;
+};
+const withEntry = (doc, entry) => ({ ...doc, entries: { ...doc.entries, [entry.name]: entry } });
+export class Keyring {
+    deps;
+    #file;
+    #keys;
+    #unlocked;
+    #nonces = new NonceBook();
+    #remembered = new Map();
+    #lock = serialLock();
+    #loaded = false;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async #load() {
+        if (!this.#loaded || this.#keys === undefined) {
+            this.#file = await this.deps.vault.read();
+            this.#keys = await this.deps.keys.read();
+            this.#loaded = true;
+        }
+        return this.#keys;
+    }
+    #held() {
+        if (this.#unlocked !== undefined && !isUnlocked(this.#unlocked.until, this.deps.now())) {
+            this.#forget();
+        }
+        return this.#unlocked;
+    }
+    #forget() {
+        this.#unlocked?.key.fill(0);
+        this.#unlocked = undefined;
+        this.#remembered.clear();
+        this.deps.backends.forget();
+    }
+    #opener(file) {
+        const withPassphrase = async (passphrase) => await unwrapPassphrase(file.wraps, passphrase);
+        const hello = helloWrapOf(file.wraps);
+        return hello === undefined
+            ? { withPassphrase }
+            : { withPassphrase, hello: { credential: hello.credential, challenge: hello.challenge, withSignature: (signature) => unwrapHello(hello, signature) } };
+    }
+    async #open(file, request) {
+        const held = this.#held();
+        if (held !== undefined && !request.person) {
+            return { doc: held.doc, key: held.key, asked: false, how: undefined };
+        }
+        const answer = await this.deps.consent.ask({ title: request.title, message: request.message, unlock: held === undefined, opener: this.#opener(file) });
+        if (!answer.ok) {
+            return fromConsent(answer);
+        }
+        if (held !== undefined) {
+            return { doc: held.doc, key: held.key, asked: true, how: answer.how };
+        }
+        if (answer.vaultKey === undefined) {
+            return refuse("locked", "The keyring could not be opened with that answer: unlock it with its passphrase.");
+        }
+        try {
+            return { doc: openDocument(answer.vaultKey, file.sealed), key: answer.vaultKey, asked: true, how: answer.how };
+        }
+        catch (error) {
+            return refuse("unavailable", error instanceof Error ? error.message : "The vault could not be opened.");
+        }
+    }
+    #copiesOf(doc, entries) {
+        const copies = new Map();
+        for (const entry of entries) {
+            for (const share of entry.shares) {
+                const pin = doc.pins[share.sandbox];
+                if (share.mode === "copy" && entry.value !== undefined && pin !== undefined) {
+                    const sealed = seal(pin.seal, entry.value, { kind: "copy", sandbox: share.sandbox, secret: entry.name, updatedAt: entry.updatedAt });
+                    copies.set(share.sandbox, [...(copies.get(share.sandbox) ?? []), { name: entry.name, sealed, updatedAt: entry.updatedAt }]);
+                }
+            }
+        }
+        return Object.fromEntries(copies);
+    }
+    async #commit(opened, pending) {
+        const file = this.#file;
+        if (file === undefined) {
+            throw new Error("committing a vault that was never set up");
+        }
+        const doc = { ...opened.doc, revision: opened.doc.revision + 1 };
+        const entries = Object.values(doc.entries).filter((entry) => entry.deleted !== true);
+        const open = {
+            entries: entries.map(entryInfoOf),
+            backends: doc.backends.map((backend) => backend.backend),
+            peers: doc.peers,
+            revision: doc.revision,
+            copies: this.#copiesOf(doc, entries),
+            pendingInbox: pending?.pendingInbox ?? file.open.pendingInbox,
+            pendingSync: pending?.pendingSync ?? file.open.pendingSync,
+        };
+        const next = { ...file, sealed: sealDocument(opened.key, doc), open };
+        await this.deps.vault.write(next);
+        this.#file = next;
+        const keys = await this.#load();
+        this.#keys = { ...keys, inbox: doc.inbox.publicKey, sync: doc.sync.publicKey, sandboxes: doc.pins };
+        await this.deps.keys.write(this.#keys);
+        if (this.#unlocked !== undefined) {
+            this.#unlocked = { ...this.#unlocked, doc };
+        }
+    }
+    async #writeOpen(open) {
+        const file = this.#file;
+        if (file !== undefined) {
+            const next = { ...file, open };
+            await this.deps.vault.write(next);
+            this.#file = next;
+        }
+    }
+    async #record(record) {
+        try {
+            await this.deps.audit(record);
+        }
+        catch {
+        }
+    }
+    async #valueOf(doc, entry) {
+        if (entry.backend !== undefined) {
+            const read = await this.deps.backends.read(entry.backend, doc.backends, (name) => Promise.resolve(doc.entries[name]?.value));
+            return read.ok ? read : refuse(read.code, read.reason);
+        }
+        return entry.value === undefined ? refuse("unknown", `${entry.name} holds no value.`) : { ok: true, value: entry.value };
+    }
+    async #fetchKeys(sandbox) {
+        try {
+            return KeyringSandboxKeysSchema.parse(await this.deps.fetchKeys(sandbox));
+        }
+        catch (error) {
+            const why = error instanceof Error ? `: ${error.message}` : "";
+            return refuse("unavailable", `${hostOf(sandbox)} did not hand over its keys${why}. Is the sandbox running and reachable from this computer?`);
+        }
+    }
+    #shown(name) {
+        return this.#file?.open.entries.find((entry) => entry.name === name);
+    }
+    async handle(request) {
+        await this.#load();
+        return isRelayed(request) ? await this.#relayed(request) : await this.#local(request);
+    }
+    async #local(request) {
+        switch (request.op) {
+            case "state":
+                return await this.state();
+            case "setup":
+                return await this.#lock(async () => await this.setup(request.passphrase, request.hello));
+            case "unlock":
+                return await this.#lock(async () => await this.unlock(request.minutes));
+            case "lock":
+                this.#forget();
+                await this.#record({ op: "lock", outcome: "done" });
+                return { ok: true };
+            case "list":
+                return this.list();
+            case "add":
+                return await this.#lock(async () => await this.add(request));
+            case "edit":
+                return await this.#lock(async () => await this.edit(request));
+            case "remove":
+                return await this.#lock(async () => await this.remove(request.name));
+            case "share":
+                return await this.#lock(async () => await this.share(request));
+            case "unshare":
+                return await this.#lock(async () => await this.unshare(request.name, request.sandbox));
+            case "backend":
+                return await this.#lock(async () => await this.backend(request.config));
+            case "askpass":
+                return await this.askpass(request.prompt, request.parent);
+            case "consent-upgrade":
+                return await this.consentUpgrade(request.version);
+        }
+    }
+    async #relayed(request) {
+        switch (request.op) {
+            case "shares":
+                return this.shares(request.sandbox);
+            case "release":
+                return await this.release(request.grant);
+            case "type":
+                return await this.type(request.input.grant, request.input.sealed);
+            case "inbox":
+                return await this.#lock(async () => await this.inbox(request.item));
+            case "copies":
+                return { ok: true, copies: this.#file?.open.copies[sandboxKey(request.sandbox)] ?? [] };
+            case "sync-state":
+                return await this.syncState();
+            case "sync-pair":
+                return await this.#lock(async () => await this.syncPair(request.pair));
+            case "sync-outbox":
+                return await this.#lock(async () => await this.syncOutbox());
+            case "sync-deliver":
+                return await this.#lock(async () => await this.syncDeliver(request.deliver.items));
+        }
+    }
+    async state() {
+        const file = this.#file;
+        const keys = await this.#load();
+        const held = this.#held();
+        const hello = this.deps.consent.hello;
+        const helloReady = hello !== undefined && (file === undefined || helloWrapOf(file.wraps) !== undefined) && (await hello.available());
+        const state = {
+            version: this.deps.version,
+            locked: held === undefined,
+            unlock: helloReady ? ["hello", "passphrase"] : ["passphrase"],
+            pendingInbox: file?.open.pendingInbox.length ?? 0,
+        };
+        if (this.#unlocked !== undefined && held !== undefined) {
+            state.unlockedUntil = this.#unlocked.until;
+        }
+        if (file !== undefined && keys.inbox !== undefined) {
+            state.keys = { seal: keys.seal.publicKey, inbox: keys.inbox };
+        }
+        return { ok: true, state, setUp: file !== undefined };
+    }
+    async setup(passphrase, withHello) {
+        if (this.#file !== undefined) {
+            return refuse("declined", "This keyring is set up already. To start over, move ~/.intentic/keyring/vault.json aside first: it is the only copy of what it holds.");
+        }
+        const key = newVaultKey();
+        const doc = { v: 1, revision: 0, entries: {}, inbox: newSealKeyPair(), sync: newSealKeyPair(), peers: [], backends: [], pins: {} };
+        const wraps = [await wrapWithPassphrase(key, passphrase, this.deps.scrypt ?? SCRYPT_COST)];
+        const hello = this.deps.consent.hello;
+        let how = "passphrase";
+        if (withHello && hello !== undefined && (await hello.available())) {
+            const challenge = helloChallenge();
+            const enrolled = await hello.enrol(this.deps.helloCredential, challenge, {
+                title: "Set up the Intentic keyring",
+                message: "Windows Hello will unlock the keyring on this computer. The passphrase you chose still opens it if Hello is ever reset.",
+            });
+            if (enrolled.ok) {
+                wraps.push(wrapWithHello(key, { credential: this.deps.helloCredential, challenge, signature: enrolled.value.signature, publicKey: enrolled.value.publicKey }));
+                how = "hello";
+            }
+        }
+        this.#file = { v: 1, wraps, sealed: sealDocument(key, doc), open: emptyOpenPart() };
+        this.#unlocked = { key, doc, until: this.deps.now() + SETUP_UNLOCK_MINUTES * MINUTE_MS };
+        await this.#commit({ doc, key });
+        await this.#record({ op: "setup", outcome: "done", how });
+        return { ok: true };
+    }
+    async unlock(minutes) {
+        const file = this.#file;
+        if (file === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        const pending = file.open.pendingInbox;
+        const waiting = pending.length === 0 ? "" : ` Waiting to be taken in: ${pending.map((item) => `${item.item.name} from ${hostOf(item.item.sandbox)}`).join(", ")}.`;
+        const opened = await this.#open(file, {
+            title: "Unlock the Intentic keyring",
+            message: `For ${String(minutes)} minutes, entries shared "while you're here" go to their sandboxes without asking.${waiting}`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            await this.#record({ op: "unlock", outcome: "refused", code: opened.code });
+            return opened;
+        }
+        const until = this.deps.now() + minutes * MINUTE_MS;
+        this.#unlocked = { key: opened.key, doc: opened.doc, until };
+        await this.#takeInPending(opened);
+        await this.#record({ op: "unlock", outcome: "done", how: opened.how });
+        return { ok: true, unlockedUntil: until };
+    }
+    async #takeInPending(opened) {
+        const file = this.#file;
+        if (file === undefined || (file.open.pendingInbox.length === 0 && file.open.pendingSync.length === 0)) {
+            return;
+        }
+        let doc = opened.doc;
+        for (const { item } of file.open.pendingInbox) {
+            const taken = await this.#inboxInto(doc, item);
+            if (taken.ok) {
+                doc = taken.doc;
+            }
+            else {
+                await this.#record({ op: "inbox", outcome: "refused", code: taken.refusal.code, secret: item.name, sandbox: item.sandbox, reason: taken.refusal.refusal });
+            }
+        }
+        doc = this.#mergeSync(doc, file.open.pendingSync).doc;
+        await this.#commit({ doc, key: opened.key }, { pendingInbox: [], pendingSync: [] });
+    }
+    list() {
+        const held = this.#held();
+        const open = this.#file?.open;
+        const entries = held === undefined ? (open?.entries ?? []) : Object.values(held.doc.entries).filter((entry) => entry.deleted !== true).map(entryInfoOf);
+        return { ok: true, entries, backends: open?.backends ?? [] };
+    }
+    #sentValue(doc, name, sealed) {
+        let value;
+        try {
+            value = unseal(doc.inbox, sealed, { kind: "inbox", sandbox: "local", secret: name });
+        }
+        catch {
+            return refuse("bad-grant", "The value was not sealed to this keyring's inbox: `intentic-machine keyring status` names the right key.");
+        }
+        return Buffer.byteLength(value, "utf8") > VALUE_MAX_BYTES ? refuse("bad-grant", `A value holds at most ${String(VALUE_MAX_BYTES / 1024)} KiB.`) : { ok: true, value };
+    }
+    #addedEntry(request, before, value, revision) {
+        const now = this.deps.now();
+        const fresh = before === undefined || before.deleted === true;
+        const entry = {
+            name: request.name,
+            rules: request.rules,
+            source: request.backend?.backend ?? "keyring",
+            shares: fresh ? [] : before.shares,
+            createdAt: fresh ? now : before.createdAt,
+            updatedAt: now,
+            revision,
+        };
+        if (request.backend !== undefined) {
+            entry.backend = request.backend;
+        }
+        if (value !== undefined) {
+            entry.value = value;
+        }
+        return entry;
+    }
+    async add(request) {
+        const file = this.#file;
+        if (file === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        if ((request.sealed === undefined) === (request.backend === undefined)) {
+            return refuse("bad-grant", "An entry takes either a value or a password manager to read it from, not both and not neither.");
+        }
+        const existing = this.#shown(request.name);
+        if (existing !== undefined && !request.replace) {
+            return refuse("declined", `The keyring has an entry named ${request.name} already: replace it with --replace, or change it with \`keyring edit\`.`);
+        }
+        const source = request.backend === undefined ? "the value you typed" : `${request.backend.backend} (${request.backend.ref})`;
+        const opened = await this.#open(file, {
+            title: existing === undefined ? `Add ${request.name} to the keyring?` : `Replace ${request.name} in the keyring?`,
+            message: `${request.name}: ${source}. ${rulesWords(request.rules)}.`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const value = request.sealed === undefined ? undefined : this.#sentValue(opened.doc, request.name, request.sealed);
+        if (value !== undefined && !value.ok) {
+            return value;
+        }
+        const entry = this.#addedEntry(request, opened.doc.entries[request.name], value?.value, opened.doc.revision + 1);
+        await this.#commit({ doc: withEntry(opened.doc, entry), key: opened.key });
+        await this.#record({ op: "add", outcome: "done", secret: request.name, asked: opened.asked });
+        return { ok: true };
+    }
+    async edit(request) {
+        const file = this.#file;
+        const shown = this.#shown(request.name);
+        if (file === undefined || shown === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${request.name}.`);
+        }
+        const widening = wideningOf(shown, request.patch, request.sealed !== undefined);
+        const opened = await this.#open(file, {
+            title: `Change ${request.name}?`,
+            message: widening.length === 0 ? `This change only narrows where ${request.name} may go.` : `This change ${widening.join("; ")}.`,
+            person: widening.length > 0,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const entry = opened.doc.entries[request.name];
+        if (entry === undefined || entry.deleted === true) {
+            return refuse("unknown", `The keyring has no entry named ${request.name}.`);
+        }
+        if (!opened.asked && wideningOf(entry.rules, request.patch, request.sealed !== undefined).length > 0) {
+            return refuse("declined", "The entry on file differs from what this change was judged against: ask again.");
+        }
+        const value = request.sealed === undefined ? undefined : this.#sentValue(opened.doc, request.name, request.sealed);
+        if (value !== undefined && !value.ok) {
+            return value;
+        }
+        const changed = { ...entry, rules: applyPatch(entry.rules, request.patch), updatedAt: this.deps.now(), revision: opened.doc.revision + 1 };
+        if (value !== undefined) {
+            changed.value = value.value;
+        }
+        await this.#commit({ doc: withEntry(opened.doc, changed), key: opened.key });
+        await this.#record({ op: "edit", outcome: "done", secret: request.name, asked: opened.asked, reason: widening.join("; ") });
+        return { ok: true };
+    }
+    async remove(name) {
+        const file = this.#file;
+        if (file === undefined || this.#shown(name) === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${name}.`);
+        }
+        const opened = await this.#open(file, { title: `Remove ${name} from the keyring?`, message: "Every sandbox it is shared with loses it, and a paired keyring removes it too.", person: true });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const entry = opened.doc.entries[name];
+        if (entry === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${name}.`);
+        }
+        const tombstone = { name, rules: entry.rules, source: entry.source, shares: [], createdAt: entry.createdAt, updatedAt: this.deps.now(), revision: opened.doc.revision + 1, deleted: true };
+        await this.#commit({ doc: withEntry(opened.doc, tombstone), key: opened.key });
+        await this.#record({ op: "remove", outcome: "done", secret: name });
+        return { ok: true };
+    }
+    async share(asked) {
+        const request = { ...asked, sandbox: sandboxKey(asked.sandbox) };
+        const file = this.#file;
+        const shown = this.#shown(request.name);
+        if (file === undefined || shown === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${request.name}.`);
+        }
+        if (request.mode === "copy" && shown.backend !== undefined) {
+            return refuse("declined", `${request.name} is read from ${shown.backend.backend} at each use, so no copy of it can be kept in a sandbox.`);
+        }
+        const keys = await this.#fetchKeys(request.sandbox);
+        if ("ok" in keys) {
+            return keys;
+        }
+        const fingerprint = keyFingerprint(keys.sign);
+        const known = (await this.#load()).sandboxes[request.sandbox];
+        const changed = known !== undefined && (known.sign !== keys.sign || known.seal !== keys.seal);
+        const warning = changed ? " Its keys have CHANGED since this keyring last saw it: say no unless you know why." : "";
+        const opened = await this.#open(file, {
+            title: `Share ${request.name} with ${hostOf(request.sandbox)}?`,
+            message: `${request.name} goes to the sandbox at ${hostOf(request.sandbox)} (this computer is "${request.machine}" there): ${modeWords(request.mode)}. The sandbox's key is ${fingerprint}.${warning}`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const entry = opened.doc.entries[request.name];
+        if (entry === undefined || entry.deleted === true) {
+            return refuse("unknown", `The keyring has no entry named ${request.name}.`);
+        }
+        const now = this.deps.now();
+        const share = { sandbox: request.sandbox, machine: request.machine, mode: request.mode, sharedAt: now };
+        const shared = { ...entry, shares: [...entry.shares.filter((other) => other.sandbox !== request.sandbox), share], updatedAt: now, revision: opened.doc.revision + 1 };
+        const doc = withEntry({ ...opened.doc, pins: { ...opened.doc.pins, [request.sandbox]: { sign: keys.sign, seal: keys.seal, fetchedAt: now } } }, shared);
+        await this.#commit({ doc, key: opened.key });
+        await this.#record({ op: "share", outcome: "done", secret: request.name, sandbox: request.sandbox, target: request.mode });
+        return { ok: true, fingerprint };
+    }
+    async unshare(name, asked) {
+        const sandbox = sandboxKey(asked);
+        const file = this.#file;
+        if (file === undefined || this.#shown(name) === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${name}.`);
+        }
+        const opened = await this.#open(file, { title: `Stop sharing ${name} with ${hostOf(sandbox)}?`, message: "The sandbox loses it, and a copy kept there is dropped at its next refresh.", person: false });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const entry = opened.doc.entries[name];
+        if (entry === undefined) {
+            return refuse("unknown", `The keyring has no entry named ${name}.`);
+        }
+        const unshared = { ...entry, shares: entry.shares.filter((share) => share.sandbox !== sandbox), revision: opened.doc.revision + 1 };
+        await this.#commit({ doc: withEntry(opened.doc, unshared), key: opened.key });
+        await this.#record({ op: "unshare", outcome: "done", secret: name, sandbox });
+        return { ok: true };
+    }
+    async backend(config) {
+        const file = this.#file;
+        if (file === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        const opened = await this.#open(file, { title: `Read entries from ${config.backend}?`, message: `The keyring will run ${config.cli} to read the entries that name ${config.backend}.`, person: true });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const backends = [...opened.doc.backends.filter((other) => other.backend !== config.backend), config];
+        await this.#commit({ doc: { ...opened.doc, backends }, key: opened.key });
+        await this.#record({ op: "backend", outcome: "done", target: config.backend });
+        return { ok: true };
+    }
+    shares(sandbox) {
+        const entries = this.#file?.open.entries ?? [];
+        const pointers = entries.flatMap((entry) => entry.shares.filter((share) => share.sandbox === sandboxKey(sandbox)).map((share) => pointerOf(entry, share)));
+        return { ok: true, pointers };
+    }
+    async #grantedEntry(grant, prompt, extraPerson) {
+        const file = this.#file;
+        const shownShare = this.#shown(grant.secret)?.shares.find((share) => share.sandbox === sandboxKey(grant.sandbox));
+        if (file === undefined || shownShare === undefined) {
+            return refuse("not-shared", `${grant.secret} is not shared with ${hostOf(grant.sandbox)} here.`);
+        }
+        const unlocked = this.#held() !== undefined;
+        const opened = await this.#open(file, { ...prompt, person: modeNeedsPerson(shownShare.mode, unlocked) || extraPerson });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const entry = opened.doc.entries[grant.secret];
+        const share = shareWith(entry, grant.sandbox);
+        if (entry === undefined || share === undefined) {
+            return refuse("not-shared", `${grant.secret} is not shared with ${hostOf(grant.sandbox)} here.`);
+        }
+        if (!samePin(pinOf(await this.#load(), sandboxKey(grant.sandbox)), opened.doc.pins[sandboxKey(grant.sandbox)])) {
+            return refuse("bad-grant", `The keys on file for ${hostOf(grant.sandbox)} were changed outside the keyring: share ${grant.secret} with it again.`);
+        }
+        if (!opened.asked && modeNeedsPerson(share.mode, unlocked)) {
+            return refuse("declined", "The share on file differs from what this use was judged against: the sandbox asks again.");
+        }
+        return { opened, entry };
+    }
+    async release(signed) {
+        const keys = await this.#load();
+        const accepted = acceptGrant(signed, { pinOf: (sandbox) => pinOf(keys, sandbox), nonces: this.#nonces, now: this.deps.now() });
+        if (!accepted.ok) {
+            await this.#record({ op: "release", outcome: "refused", code: accepted.code, reason: accepted.reason });
+            return refuse(accepted.code, accepted.reason);
+        }
+        const grant = accepted.grant;
+        const target = releaseTargetOf(grant.target);
+        if (!target.ok) {
+            return refuse(target.code, target.reason);
+        }
+        const where = target.target.kind === "relay" ? `to be typed on ${target.target.toMachine}` : `for ${grant.detail}`;
+        const conversation = grant.conversation === undefined ? "" : ` (conversation ${grant.conversation})`;
+        const granted = await this.#grantedEntry(grant, { title: `Release ${grant.secret} to ${hostOf(grant.sandbox)}?`, message: `${hostOf(grant.sandbox)} asks for ${grant.secret} ${where}.${conversation}` }, false);
+        if ("ok" in granted) {
+            await this.#record({ op: "release", outcome: "refused", code: granted.code, secret: grant.secret, sandbox: grant.sandbox, reason: granted.refusal });
+            return granted;
+        }
+        const value = await this.#valueOf(granted.opened.doc, granted.entry);
+        const pin = granted.opened.doc.pins[sandboxKey(grant.sandbox)];
+        if (!value.ok || pin === undefined) {
+            return value.ok ? refuse("not-shared", `${grant.secret} is not shared with ${hostOf(grant.sandbox)} here.`) : value;
+        }
+        const sealed = target.target.kind === "relay"
+            ? seal(target.target.sealTo, value.value, { kind: "type", sandbox: grant.sandbox, secret: grant.secret, nonce: grant.nonce })
+            : seal(pin.seal, value.value, { kind: "release", sandbox: grant.sandbox, secret: grant.secret, nonce: grant.nonce });
+        await this.#record({
+            op: "release",
+            outcome: "granted",
+            secret: grant.secret,
+            sandbox: grant.sandbox,
+            target: target.target.kind === "relay" ? `relay:${target.target.toMachine}` : target.target.lane,
+            asked: granted.opened.asked,
+            how: granted.opened.how,
+            detail: grant.detail,
+            conversation: grant.conversation,
+        });
+        return { ok: true, sealed, asked: granted.opened.asked };
+    }
+    async type(signed, box) {
+        const keys = await this.#load();
+        const accepted = acceptGrant(signed, { pinOf: (sandbox) => pinOf(keys, sandbox), nonces: this.#nonces, now: this.deps.now() });
+        if (!accepted.ok) {
+            await this.#record({ op: "type", outcome: "refused", code: accepted.code, reason: accepted.reason });
+            return refuse(accepted.code, accepted.reason);
+        }
+        const grant = accepted.grant;
+        const target = typeTargetOf(grant.target);
+        if (!target.ok) {
+            return refuse(target.code, target.reason);
+        }
+        const place = target.target.kind === "window" ? { kind: "window" } : { kind: "android", serial: target.target.serial };
+        const countdown = target.target.kind === "window" ? (target.target.countdownSeconds ?? 0) : 0;
+        if (countdown > 0) {
+            await this.deps.sleep(countdown * 1000);
+        }
+        const looked = await this.deps.typist.inspect(place);
+        if (!looked.ok) {
+            return refuse("unavailable", looked.reason);
+        }
+        const typed = box === undefined ? await this.#typeOwn(grant, target.target, place, looked.seen) : await this.#typeSent(grant, target.target, place, looked.seen, box, keys);
+        await this.#record({
+            op: "type",
+            outcome: typed.ok ? "granted" : "refused",
+            secret: grant.secret,
+            sandbox: grant.sandbox,
+            program: looked.seen.focus.program,
+            asked: typed.ok ? typed.asked : undefined,
+            code: typed.ok ? undefined : typed.code,
+            reason: typed.ok ? undefined : typed.refusal,
+            detail: grant.detail,
+            conversation: grant.conversation,
+        });
+        return typed;
+    }
+    async #typeSent(grant, target, place, seen, box, keys) {
+        const verdict = typingDecision({ target, focus: seen.focus });
+        if (verdict.verdict !== "type") {
+            return refuse("guard", verdict.verdict === "refuse" ? verdict.reason : "The sandbox's guard does not cover this window.");
+        }
+        let value;
+        try {
+            value = unseal(keys.seal, box, { kind: "type", sandbox: grant.sandbox, secret: grant.secret, nonce: grant.nonce });
+        }
+        catch {
+            return refuse("bad-grant", "The value was not sealed to this keyring for this grant.");
+        }
+        return await this.#typeInto(place, seen, value, false);
+    }
+    async #typeOwn(grant, target, place, seen) {
+        const shown = this.#shown(grant.secret);
+        if (shown === undefined) {
+            return refuse("not-shared", `${grant.secret} is not shared with ${hostOf(grant.sandbox)} here.`);
+        }
+        const first = typingDecision({ target, focus: seen.focus, rules: shown });
+        if (first.verdict === "refuse") {
+            return refuse(first.code, first.reason);
+        }
+        const reasons = first.verdict === "ask" ? ` It asks because ${first.reasons.join(" and ")}.` : "";
+        const granted = await this.#grantedEntry(grant, { title: `Type ${grant.secret} into ${seen.focus.program}?`, message: `${hostOf(grant.sandbox)} asks to type ${grant.secret} into ${seen.focus.program} (${grant.detail}).${reasons}` }, first.verdict === "ask");
+        if ("ok" in granted) {
+            return granted;
+        }
+        const onFile = typingDecision({ target, focus: seen.focus, rules: granted.entry.rules });
+        if (onFile.verdict === "refuse" || (onFile.verdict === "ask" && !granted.opened.asked)) {
+            return refuse("guard", onFile.verdict === "refuse" ? onFile.reason : "The entry on file differs from what this use was judged against: the sandbox asks again.");
+        }
+        const value = await this.#valueOf(granted.opened.doc, granted.entry);
+        return value.ok ? await this.#typeInto(place, seen, value.value, granted.opened.asked) : value;
+    }
+    async #typeInto(place, seen, value, asked) {
+        let now = seen;
+        if (asked) {
+            await this.deps.sleep(FOCUS_SETTLE_MS);
+            const again = await this.deps.typist.inspect(place);
+            if (!again.ok || again.seen.focus.program !== seen.focus.program || again.seen.handle !== seen.handle) {
+                return refuse("guard", `The focus left ${seen.focus.program} while you answered: put the cursor back where it goes and ask again.`);
+            }
+            now = again.seen;
+        }
+        const typed = await this.deps.typist.type(place, now, value);
+        if (!typed.ok) {
+            return refuse("guard", typed.partly ? `${typed.reason} Part of it was typed: clear that field before trying again.` : typed.reason);
+        }
+        return { ok: true, program: now.focus.program, field: now.focus.field === "password" ? "password" : "text", asked };
+    }
+    async inbox(item) {
+        const file = this.#file;
+        if (file === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        if (this.#held() === undefined) {
+            const others = file.open.pendingInbox.filter((other) => other.item.name !== item.name || other.item.sandbox !== item.sandbox);
+            await this.#writeOpen({ ...file.open, pendingInbox: [...others, { item, receivedAt: this.deps.now() }].slice(-PENDING_INBOX_MAX) });
+            await this.#record({ op: "inbox", outcome: "pending", secret: item.name, sandbox: item.sandbox });
+            return { ok: true, pending: true };
+        }
+        const opened = await this.#open(file, {
+            title: `Keep ${item.name} from ${hostOf(item.sandbox)}?`,
+            message: `${hostOf(item.sandbox)} sends ${item.name} to be kept in this keyring, shared back with it: ${modeWords(item.mode)}.`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const taken = await this.#inboxInto(opened.doc, item);
+        if (!taken.ok) {
+            return taken.refusal;
+        }
+        await this.#commit({ doc: taken.doc, key: opened.key });
+        await this.#record({ op: "inbox", outcome: "done", secret: item.name, sandbox: item.sandbox, asked: true });
+        return { ok: true, pending: false };
+    }
+    async #inboxInto(doc, item) {
+        let value;
+        try {
+            value = unseal(doc.inbox, item.sealed, { kind: "inbox", sandbox: item.sandbox, secret: item.name });
+        }
+        catch {
+            return { ok: false, refusal: refuse("bad-grant", `${item.name} was not sealed to this keyring's inbox.`) };
+        }
+        const now = this.deps.now();
+        const sandbox = sandboxKey(item.sandbox);
+        let pin = doc.pins[sandbox];
+        if (pin === undefined) {
+            const fetched = await this.#fetchKeys(item.sandbox);
+            if ("ok" in fetched) {
+                return { ok: false, refusal: fetched };
+            }
+            pin = { sign: fetched.sign, seal: fetched.seal, fetchedAt: now };
+        }
+        const before = doc.entries[item.name];
+        const kept = before === undefined || before.deleted === true ? [] : before.shares.filter((share) => share.sandbox !== sandbox);
+        const entry = {
+            name: item.name,
+            rules: { kind: item.kind, programs: item.programs, packages: [], hosts: item.hosts, anyField: false, askpass: [], askpassRememberMinutes: 0 },
+            source: "keyring",
+            value,
+            shares: [...kept, { sandbox, machine: hostOf(sandbox), mode: item.mode, sharedAt: now }],
+            createdAt: before === undefined || before.deleted === true ? now : before.createdAt,
+            updatedAt: now,
+            revision: doc.revision + 1,
+        };
+        return { ok: true, doc: withEntry({ ...doc, pins: { ...doc.pins, [sandbox]: pin } }, entry) };
+    }
+    async syncState() {
+        const keys = await this.#load();
+        const file = this.#file;
+        if (file === undefined || keys.sync === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        return { ok: true, sync: { key: keys.sync, peers: file.open.peers, revision: file.open.revision } };
+    }
+    async syncPair(pair) {
+        const file = this.#file;
+        const keys = await this.#load();
+        if (file === undefined || keys.sync === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        const opened = await this.#open(file, {
+            title: `Pair with the keyring on ${pair.peer.device}?`,
+            message: `This keyring (${pair.self}) is ${keyFingerprint(keys.sync)}; the one on ${pair.peer.device} is ${keyFingerprint(pair.peer.key)}. Say yes only if ${pair.peer.device} shows these same two. Paired, each keeps the other's entries in step.`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const peer = { device: pair.peer.device, key: pair.peer.key, pairedAt: this.deps.now() };
+        const peers = [...opened.doc.peers.filter((other) => other.key !== peer.key && other.device !== peer.device), peer];
+        await this.#commit({ doc: { ...opened.doc, peers, syncSent: { ...opened.doc.syncSent, [peer.key]: -1 } }, key: opened.key });
+        await this.#record({ op: "sync-pair", outcome: "done", target: peer.device, asked: true });
+        return { ok: true };
+    }
+    #outboxFor(doc, peer) {
+        const since = doc.syncSent?.[peer.key] ?? -1;
+        return Object.values(doc.entries)
+            .filter((entry) => entry.revision > since)
+            .map((entry) => ({
+            from: doc.sync.publicKey,
+            to: peer.key,
+            revision: entry.revision,
+            sealed: seal(peer.key, JSON.stringify(syncEntryOf(entry)), { kind: "sync", account: doc.sync.publicKey, device: peer.key, revision: entry.revision }),
+        }));
+    }
+    async syncOutbox() {
+        const held = this.#held();
+        if (held === undefined || held.doc.peers.length === 0) {
+            return { ok: true, items: [] };
+        }
+        const items = held.doc.peers.flatMap((peer) => this.#outboxFor(held.doc, peer));
+        if (items.length > 0) {
+            const syncSent = Object.fromEntries(held.doc.peers.map((peer) => [peer.key, held.doc.revision]));
+            await this.#commit({ doc: { ...held.doc, syncSent: { ...held.doc.syncSent, ...syncSent } }, key: held.key });
+        }
+        return { ok: true, items };
+    }
+    async syncDeliver(items) {
+        const file = this.#file;
+        const keys = await this.#load();
+        if (file === undefined || keys.sync === undefined) {
+            return { ok: true, accepted: 0 };
+        }
+        const peers = new Set(file.open.peers.map((peer) => peer.key));
+        const ours = items.filter((item) => item.to === keys.sync && peers.has(item.from));
+        const held = this.#held();
+        if (held === undefined) {
+            await this.#writeOpen({ ...file.open, pendingSync: [...file.open.pendingSync, ...ours].slice(-PENDING_SYNC_MAX) });
+            return { ok: true, accepted: ours.length };
+        }
+        const merged = this.#mergeSync(held.doc, ours);
+        if (merged.accepted > 0) {
+            await this.#commit({ doc: merged.doc, key: held.key });
+        }
+        return { ok: true, accepted: merged.accepted };
+    }
+    #syncedEntry(doc, item) {
+        try {
+            const incoming = SyncEntrySchema.parse(JSON.parse(unseal(doc.sync, item.sealed, { kind: "sync", account: item.from, device: item.to, revision: item.revision })));
+            const local = doc.entries[incoming.name];
+            const shares = incoming.deleted === true ? [] : (local?.shares ?? []);
+            return StoredEntrySchema.parse({ ...incoming, shares, revision: doc.revision + 1 });
+        }
+        catch {
+            return undefined;
+        }
+    }
+    #mergeSync(doc, items) {
+        const peers = new Set(doc.peers.map((peer) => peer.key));
+        const entries = { ...doc.entries };
+        let accepted = 0;
+        for (const item of items) {
+            const incoming = peers.has(item.from) && item.to === doc.sync.publicKey ? this.#syncedEntry(doc, item) : undefined;
+            if (incoming !== undefined) {
+                const local = entries[incoming.name];
+                if (local === undefined || local.updatedAt < incoming.updatedAt) {
+                    entries[incoming.name] = incoming;
+                }
+                accepted++;
+            }
+        }
+        return { doc: { ...doc, entries }, accepted };
+    }
+    async askpass(prompt, parent) {
+        const file = this.#file;
+        if (file === undefined) {
+            return refuse("locked", NOT_SET_UP);
+        }
+        const question = parseAskpassPrompt(prompt);
+        const shown = file.open.entries.find((entry) => askpassMatch(question, entry.askpass) !== undefined);
+        const matcher = shown === undefined ? undefined : askpassMatch(question, shown.askpass);
+        if (shown === undefined || matcher === undefined) {
+            return refuse("unknown", `No keyring entry answers "${question.prompt}": \`intentic-machine keyring edit NAME --askpass ${question.matchers[0] ?? "prompt:…"}\` adds one.`);
+        }
+        if (question.wants === "username") {
+            return shown.username === undefined ? refuse("unknown", `${shown.name} has no user name to answer with.`) : { ok: true, value: shown.username };
+        }
+        const now = this.deps.now();
+        const remembered = this.#held() !== undefined && rememberedFresh(this.#remembered.get(matcher), shown.askpassRememberMinutes, now);
+        const asker = parent ?? "A program";
+        const opened = await this.#open(file, { title: `Answer ${asker}'s prompt?`, message: `${asker} asks: "${question.prompt}". The keyring answers with ${shown.name}.`, person: !remembered });
+        if ("ok" in opened) {
+            await this.#record({ op: "askpass", outcome: "refused", code: opened.code, secret: shown.name, target: matcher });
+            return opened;
+        }
+        const entry = opened.doc.entries[shown.name];
+        if (entry === undefined || entry.deleted === true || askpassMatch(question, entry.rules.askpass) === undefined) {
+            return refuse("unknown", `No keyring entry answers "${question.prompt}".`);
+        }
+        const value = await this.#valueOf(opened.doc, entry);
+        if (!value.ok) {
+            return value;
+        }
+        if (entry.rules.askpassRememberMinutes > 0) {
+            this.#remembered.set(matcher, now);
+        }
+        await this.#record({ op: "askpass", outcome: "granted", secret: entry.name, target: matcher, asked: opened.asked, program: parent });
+        return { ok: true, value: value.value };
+    }
+    async consentUpgrade(version) {
+        const file = this.#file;
+        const answer = await this.deps.consent.ask({
+            title: `Replace the keyring with version ${version}?`,
+            message: `intentic-machine asks to replace the keyring program on this computer with release ${version}. Say yes if you started this update.`,
+            unlock: false,
+            opener: file === undefined ? undefined : this.#opener(file),
+        });
+        await this.#record({ op: "consent-upgrade", outcome: answer.ok ? "done" : "refused", target: version });
+        return answer.ok ? { ok: true } : fromConsent(answer);
+    }
+}
+//# sourceMappingURL=core.js.map