@intentic/keyring 0.0.0-stage → 1.338.0

package/dist/service/door.d.ts

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import type { KeyringRequest } from "../protocol.js";
+import { type InspectedSchema, type SignedSchema, type TypedPassphraseSchema, type TypedSchema } from "./wire.js";
+export declare const DoorFileSchema: z.ZodObject<{
+    port: z.ZodNumber;
+    token: z.ZodString;
+    pid: z.ZodNumber;
+}, z.core.$strict>;
+export type DoorFile = z.infer<typeof DoorFileSchema>;
+export declare const OpeningSchema: z.ZodObject<{
+    door: z.ZodString;
+    as: z.ZodEnum<{
+        helper: "helper";
+        request: "request";
+    }>;
+}, z.core.$strict>;
+export type Opening = z.infer<typeof OpeningSchema>;
+export declare const ChallengeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"hello">;
+    credential: z.ZodString;
+    challenge: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"passphrase">;
+}, z.core.$strict>], "method">;
+export type Challenge = z.infer<typeof ChallengeSchema>;
+export declare const ProofSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"hello">;
+    signature: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"passphrase">;
+    passphrase: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"declined">;
+}, z.core.$strict>], "method">;
+export type Proof = z.infer<typeof ProofSchema>;
+export declare const HelperCallSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    id: z.ZodNumber;
+    call: z.ZodLiteral<"sign">;
+    credential: z.ZodString;
+    challenge: z.ZodString;
+    title: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodNumber;
+    call: z.ZodLiteral<"passphrase">;
+    title: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodNumber;
+    call: z.ZodLiteral<"inspect">;
+    place: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"window">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"android">;
+        serial: z.ZodString;
+    }, z.core.$strip>], "kind">;
+}, z.core.$strict>, z.ZodObject<{
+    id: z.ZodNumber;
+    call: z.ZodLiteral<"type">;
+    place: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"window">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"android">;
+        serial: z.ZodString;
+    }, z.core.$strip>], "kind">;
+    seen: z.ZodObject<{
+        focus: z.ZodObject<{
+            program: z.ZodString;
+            path: z.ZodString;
+            field: z.ZodEnum<{
+                password: "password";
+                text: "text";
+                unknown: "unknown";
+            }>;
+        }, z.core.$strict>;
+        handle: z.ZodString;
+    }, z.core.$strip>;
+    value: z.ZodString;
+}, z.core.$strict>], "call">;
+export type HelperCall = z.infer<typeof HelperCallSchema>;
+export type HelperReply = z.infer<typeof SignedSchema> | z.infer<typeof TypedPassphraseSchema> | z.infer<typeof InspectedSchema> | z.infer<typeof TypedSchema>;
+export type DoorMessage = Opening | KeyringRequest | Challenge | Proof | HelperCall | {
+    readonly id: number;
+    readonly reply: HelperReply;
+} | {
+    readonly ok: boolean;
+    readonly reason?: string;
+};
+//# sourceMappingURL=door.d.ts.map

package/dist/service/door.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"door.d.ts","sourceRoot":"","sources":["../../src/service/door.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAc/H,eAAO,MAAM,cAAc;;;;kBAAqJ,CAAC;AACjL,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,eAAO,MAAM,aAAa;;;;;;kBAA6E,CAAC;AACxG,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAGpD,eAAO,MAAM,eAAe;;;;;;8BAG1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,WAAW;;;;;;;;8BAItB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAGhD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAe3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAG1D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAG/J,MAAM,MAAM,WAAW,GACjB,OAAO,GACP,cAAc,GACd,SAAS,GACT,KAAK,GACL,UAAU,GACV;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/service/door.js

@@ -0,0 +1,28 @@
+import { z } from "zod";
+import { FocusSchema } from "./wire.js";
+export const DoorFileSchema = z.object({ port: z.number().int().min(1).max(65535), token: z.string().regex(/^[A-Za-z0-9_-]{43}$/u), pid: z.number().int().positive() }).strict();
+export const OpeningSchema = z.object({ door: z.string(), as: z.enum(["request", "helper"]) }).strict();
+export const ChallengeSchema = z.discriminatedUnion("method", [
+    z.object({ method: z.literal("hello"), credential: z.string().min(1).max(128), challenge: z.string().min(1).max(200) }).strict(),
+    z.object({ method: z.literal("passphrase") }).strict(),
+]);
+export const ProofSchema = z.discriminatedUnion("method", [
+    z.object({ method: z.literal("hello"), signature: z.string().min(1).max(4096) }).strict(),
+    z.object({ method: z.literal("passphrase"), passphrase: z.string().min(1).max(1024) }).strict(),
+    z.object({ method: z.literal("declined") }).strict(),
+]);
+export const HelperCallSchema = z.discriminatedUnion("call", [
+    z.object({ id: z.number().int(), call: z.literal("sign"), credential: z.string().min(1).max(128), challenge: z.string().min(1).max(200), title: z.string(), message: z.string() }).strict(),
+    z.object({ id: z.number().int(), call: z.literal("passphrase"), title: z.string(), message: z.string() }).strict(),
+    z.object({ id: z.number().int(), call: z.literal("inspect"), place: z.discriminatedUnion("kind", [z.object({ kind: z.literal("window") }), z.object({ kind: z.literal("android"), serial: z.string() })]) }).strict(),
+    z
+        .object({
+        id: z.number().int(),
+        call: z.literal("type"),
+        place: z.discriminatedUnion("kind", [z.object({ kind: z.literal("window") }), z.object({ kind: z.literal("android"), serial: z.string() })]),
+        seen: z.object({ focus: FocusSchema, handle: z.string() }),
+        value: z.string(),
+    })
+        .strict(),
+]);
+//# sourceMappingURL=door.js.map

package/dist/service/door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"door.js","sourceRoot":"","sources":["../../src/service/door.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAyF,MAAM,WAAW,CAAC;AAc/H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGjL,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAIxG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAC1D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAChI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACzD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACtD,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACzF,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC/F,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CACvD,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAEzD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAE3L,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAClH,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrN,CAAC;SACI,MAAM,CAAC;QACJ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5I,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KACpB,CAAC;SACD,MAAM,EAAE;CAChB,CAAC,CAAC"}

package/dist/service/hello-verify.d.ts

@@ -0,0 +1,2 @@
+export declare const helloSigned: (publicKeySpki: string, challenge: string, signature: string) => boolean;
+//# sourceMappingURL=hello-verify.d.ts.map

package/dist/service/hello-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hello-verify.d.ts","sourceRoot":"","sources":["../../src/service/hello-verify.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,WAAW,kBAAmB,MAAM,aAAa,MAAM,aAAa,MAAM,KAAG,OAOzF,CAAC"}

package/dist/service/hello-verify.js

@@ -0,0 +1,10 @@
+import { verify } from "node:crypto";
+export const helloSigned = (publicKeySpki, challenge, signature) => {
+    try {
+        return verify("sha256", Buffer.from(challenge, "base64url"), { key: Buffer.from(publicKeySpki, "base64"), format: "der", type: "spki" }, Buffer.from(signature, "base64"));
+    }
+    catch {
+        return false;
+    }
+};
+//# sourceMappingURL=hello-verify.js.map

package/dist/service/hello-verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hello-verify.js","sourceRoot":"","sources":["../../src/service/hello-verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAMrC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,aAAqB,EAAE,SAAiB,EAAE,SAAiB,EAAW,EAAE;IAChG,IAAI,CAAC;QACD,OAAO,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/K,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC,CAAC"}

package/dist/service/helper.d.ts

@@ -0,0 +1,3 @@
+import { type Runner } from "../run.js";
+export declare const runSession: (runner?: Runner) => Promise<void>;
+//# sourceMappingURL=helper.d.ts.map

package/dist/service/helper.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.d.ts","sourceRoot":"","sources":["../../src/service/helper.ts"],"names":[],"mappings":"AAQA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAkGpD,eAAO,MAAM,UAAU,YAAkB,MAAM,KAAgB,OAAO,CAAC,IAAI,CAiC1E,CAAC"}

package/dist/service/helper.js

@@ -0,0 +1,117 @@
+import { readFile } from "node:fs/promises";
+import { connect } from "node:net";
+import { sleep } from "@intentic/base/async";
+import { claimPidFile } from "@intentic/local-agent";
+import { keyringPaths } from "../address.js";
+import { windowsHello, windowsPassphrasePrompt } from "../consent/consent-windows.js";
+import { KEYRING_RESPONSES } from "../protocol.js";
+import { realRunner } from "../run.js";
+import { serveKeyring } from "../server.js";
+import { platformTypist } from "../typing/index.js";
+import { KEYRING_VERSION } from "../version.js";
+import { ChallengeSchema, DoorFileSchema, HelperCallSchema } from "./door.js";
+import { LineSocket } from "./lines.js";
+import { hardenedPaths } from "./paths.js";
+import { currentSid } from "./sid.js";
+const RETRY_MS = 5_000;
+const REQUEST_DEADLINE_MS = 135_000;
+const readDoor = async (path) => {
+    try {
+        const parsed = DoorFileSchema.safeParse(JSON.parse(await readFile(path, "utf8")));
+        return parsed.success ? parsed.data : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const throughDoor = async (door, request) => {
+    const socket = connect({ host: "127.0.0.1", port: door.port });
+    const lines = new LineSocket(socket);
+    await new Promise((resolve, reject) => {
+        socket.once("connect", resolve);
+        socket.once("error", reject);
+    });
+    lines.send({ door: door.token, as: "request" });
+    lines.send(request);
+    const answer = await lines.nextOf(KEYRING_RESPONSES[request.op], REQUEST_DEADLINE_MS);
+    lines.end();
+    return answer ?? { ok: false, code: "unavailable", refusal: "The hardened keyring did not answer: is its task running? (Task Scheduler, \\Intentic\\)" };
+};
+const answerCall = async (hands, call) => {
+    switch (call.call) {
+        case "sign": {
+            const signed = await hands.hello.sign(call.credential, call.challenge, { title: call.title, message: call.message });
+            return signed.ok ? { ok: true, signature: signed.value.toString("base64") } : { ok: false, cancelled: signed.cancelled, reason: signed.reason };
+        }
+        case "passphrase":
+            return await hands.passphrase({ title: call.title, message: call.message });
+        case "inspect":
+            return await hands.typist.inspect(call.place);
+        case "type":
+            return await hands.typist.type(call.place, call.seen, call.value);
+    }
+};
+const holdTheLine = async (door, hands, log) => {
+    const socket = connect({ host: "127.0.0.1", port: door.port });
+    const lines = new LineSocket(socket);
+    lines.send({ door: door.token, as: "helper" });
+    const challenge = await lines.nextOf(ChallengeSchema, 30_000);
+    if (challenge === undefined) {
+        lines.end();
+        return;
+    }
+    const notice = { title: "Connect the Intentic keyring", message: "The keyring on this computer asks you to confirm it is you, once for this sign-in, before it can ask you anything or type for you." };
+    let proof;
+    if (challenge.method === "hello") {
+        const signed = await hands.hello.sign(challenge.credential, challenge.challenge, notice);
+        proof = signed.ok ? { method: "hello", signature: signed.value.toString("base64") } : { method: "declined" };
+    }
+    else {
+        const typed = await hands.passphrase(notice);
+        proof = typed.kind === "answered" ? { method: "passphrase", passphrase: typed.passphrase } : { method: "declined" };
+    }
+    lines.send(proof);
+    log(`proved this session with ${proof.method}`);
+    for (;;) {
+        const call = await lines.nextOf(HelperCallSchema, 24 * 60 * 60_000);
+        if (call === undefined) {
+            if (lines.closed) {
+                return;
+            }
+            continue;
+        }
+        lines.send({ id: call.id, reply: await answerCall(hands, call) });
+    }
+};
+export const runSession = async (runner = realRunner) => {
+    const own = keyringPaths();
+    const claim = await claimPidFile(own.pid, own.dir, { pid: process.pid, build: KEYRING_VERSION, supervisor: "session" });
+    if (!claim.claimed) {
+        throw new Error(`A keyring is running already (pid ${String(claim.holder.pid)}).`);
+    }
+    const sid = await currentSid(runner);
+    const paths = hardenedPaths(sid);
+    const log = (message) => {
+        process.stderr.write(`${new Date().toISOString()} session: ${message}\n`);
+    };
+    const hands = { hello: windowsHello(runner), passphrase: windowsPassphrasePrompt(runner), typist: platformTypist(runner) };
+    await serveKeyring({
+        handle: async (request) => {
+            const door = await readDoor(paths.door);
+            return door === undefined ? { ok: false, code: "no-keyring", refusal: "The hardened keyring's service is not running yet." } : await throughDoor(door, request);
+        },
+    }, own.address, log);
+    for (;;) {
+        const door = await readDoor(paths.door);
+        if (door !== undefined) {
+            try {
+                await holdTheLine(door, hands, log);
+            }
+            catch (error) {
+                log(`lost the service: ${error instanceof Error ? error.message : "unknown error"}`);
+            }
+        }
+        await sleep(RETRY_MS);
+    }
+};
+//# sourceMappingURL=helper.js.map

package/dist/service/helper.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/service/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAA6D,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAe,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAiB,cAAc,EAAmB,gBAAgB,EAAgC,MAAM,WAAW,CAAC;AAC5I,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAQtC,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;IACnE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,OAAuB,EAAuC,EAAE;IACvG,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACtF,KAAK,CAAC,GAAG,EAAE,CAAC;IACZ,OAAO,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0FAA0F,EAAE,CAAC;AAC7J,CAAC,CAAC;AAQF,MAAM,UAAU,GAAG,KAAK,EAAE,KAAY,EAAE,IAAgB,EAAwB,EAAE;IAC9E,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpJ,CAAC;QACD,KAAK,YAAY;YACb,OAAO,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,KAAK,SAAS;YACV,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,MAAM;YACP,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,KAAY,EAAE,GAA8B,EAAiB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC;IACxM,IAAI,KAAY,CAAC;IACjB,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzF,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACjH,CAAC;SAAM,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO;YACX,CAAC;YACD,SAAS;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAM,GAAW,UAAU,EAAiB,EAAE;IAC3E,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IAClI,MAAM,YAAY,CACd;QACI,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpK,CAAC;KACJ,EACD,GAAG,CAAC,OAAO,EACX,GAAG,CACN,CAAC;IACF,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACD,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACzF,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC,CAAC"}

package/dist/service/install.d.ts

@@ -0,0 +1,10 @@
+import type { Runner } from "../run.js";
+export declare const installService: (runner: Runner, program?: string) => Promise<{
+    readonly sid: string;
+    readonly moved: readonly string[];
+}>;
+export declare const uninstallService: (runner: Runner) => Promise<{
+    readonly sid: string;
+    readonly restored: readonly string[];
+}>;
+//# sourceMappingURL=install.d.ts.map

package/dist/service/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/service/install.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAkCxC,eAAO,MAAM,cAAc,WAAkB,MAAM,YAAW,MAAM,KAAsB,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAoC5J,CAAC;AAEF,eAAO,MAAM,gBAAgB,WAAkB,MAAM,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAe7H,CAAC"}

package/dist/service/install.js

@@ -0,0 +1,77 @@
+import { copyFile, mkdir, readdir, rm, stat } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { writeFileAtomic } from "@intentic/base/fs";
+import { z } from "zod";
+import { keyringPaths } from "../address.js";
+import { runPowerShell } from "../powershell.js";
+import { hardenedAcls, markerAcl } from "./acl.js";
+import { hardenedPaths } from "./paths.js";
+import { currentSid } from "./sid.js";
+import { REGISTER_TASK_SCRIPT, STOP_TASK_SCRIPT, taskInput, UNREGISTER_TASK_SCRIPT } from "./task.js";
+const VAULT_FILES = ["vault.json", "keys.json", "audit.jsonl"];
+const TaskAnswerSchema = z.object({ ok: z.boolean(), error: z.string().optional() });
+const exists = async (path) => await stat(path).then(() => true, () => false);
+const icacls = async (runner, call) => {
+    const answer = await runner({ command: "icacls", args: [call.path, ...call.args], timeoutMs: 30_000 });
+    if (answer.exitCode !== 0) {
+        throw new Error(`icacls ${call.path} failed (exit ${String(answer.exitCode)}): ${answer.stdout.trim() || answer.stderr.trim()}`);
+    }
+};
+const carry = async (from, to) => {
+    if (!(await exists(from))) {
+        return false;
+    }
+    await copyFile(from, to);
+    await rm(from, { force: true });
+    return true;
+};
+export const installService = async (runner, program = process.execPath) => {
+    if (!basename(program).toLowerCase().startsWith("intentic-keyring")) {
+        throw new Error("Hardened mode installs the compiled keyring itself: run it as intentic-keyring.exe.");
+    }
+    const sid = await currentSid(runner);
+    const paths = hardenedPaths(sid);
+    await mkdir(paths.bin, { recursive: true });
+    await mkdir(paths.vaultDir, { recursive: true });
+    for (const call of hardenedAcls(paths)) {
+        await icacls(runner, call);
+    }
+    await runPowerShell(runner, { script: STOP_TASK_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskAnswerSchema);
+    await copyFile(program, paths.exe);
+    const own = keyringPaths();
+    const moved = [];
+    if (!(await exists(join(paths.vaultDir, "vault.json")))) {
+        for (const name of VAULT_FILES) {
+            if (await carry(join(own.dir, name), join(paths.vaultDir, name))) {
+                moved.push(name);
+            }
+        }
+    }
+    if ((await readdir(paths.vaultDir)).length > 0) {
+        await icacls(runner, { path: join(paths.vaultDir, "*"), args: ["/reset"] });
+    }
+    await writeFileAtomic(paths.marker, `${JSON.stringify({ installedAt: new Date().toISOString(), sid })}\n`, 0o644);
+    await icacls(runner, markerAcl(paths.marker));
+    const registered = await runPowerShell(runner, { script: REGISTER_TASK_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskAnswerSchema);
+    if (!registered.ok || !registered.answer.ok) {
+        throw new Error(`The service's task could not be registered: ${registered.ok ? (registered.answer.error ?? "no reason given") : registered.reason}`);
+    }
+    return { sid, moved };
+};
+export const uninstallService = async (runner) => {
+    const sid = await currentSid(runner);
+    const paths = hardenedPaths(sid);
+    await runPowerShell(runner, { script: UNREGISTER_TASK_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskAnswerSchema);
+    const own = keyringPaths();
+    await mkdir(own.dir, { recursive: true });
+    const restored = [];
+    for (const name of VAULT_FILES) {
+        if (!(await exists(join(own.dir, name))) && (await carry(join(paths.vaultDir, name), join(own.dir, name)))) {
+            restored.push(name);
+        }
+    }
+    await rm(paths.marker, { force: true });
+    await rm(paths.door, { force: true });
+    return { sid, restored };
+};
+//# sourceMappingURL=install.js.map

package/dist/service/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../src/service/install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,YAAY,EAAmB,SAAS,EAAE,MAAM,UAAU,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAQtG,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAExG,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,IAAgB,EAAiB,EAAE;IACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,iBAAiB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrI,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAoB,EAAE;IAC/D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAE,OAAO,GAAW,OAAO,CAAC,QAAQ,EAAwE,EAAE;IAC7J,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7H,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACL,CAAC;IACL,CAAC;IAID,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACpJ,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+CAA+C,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACzJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,MAAc,EAA2E,EAAE;IAC9H,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACnI,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC,CAAC"}

package/dist/service/lines.d.ts

@@ -0,0 +1,13 @@
+import type { Socket } from "node:net";
+import type { z } from "zod";
+import type { DoorMessage } from "./door.js";
+export declare class LineSocket {
+    #private;
+    constructor(socket: Socket);
+    get closed(): boolean;
+    next(deadlineMs: number): Promise<string | undefined>;
+    nextOf<T>(schema: z.ZodType<T>, deadlineMs: number): Promise<T | undefined>;
+    send(message: DoorMessage): void;
+    end(): void;
+}
+//# sourceMappingURL=lines.d.ts.map

package/dist/service/lines.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lines.d.ts","sourceRoot":"","sources":["../../src/service/lines.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAK7C,qBAAa,UAAU;;IAOnB,YAAY,MAAM,EAAE,MAAM,EAMzB;IAED,IAAI,MAAM,IAAI,OAAO,CAEpB;IA8BK,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAsB1D;IAGK,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAYhF;IAED,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAI/B;IAED,GAAG,IAAI,IAAI,CAEV;CACJ"}

package/dist/service/lines.js

@@ -0,0 +1,89 @@
+import { KEYRING_LINE_MAX } from "../protocol.js";
+export class LineSocket {
+    #socket;
+    #buffered = "";
+    #lines = [];
+    #waiting = [];
+    #closed = false;
+    constructor(socket) {
+        this.#socket = socket;
+        socket.setEncoding("utf8");
+        socket.on("data", (chunk) => this.#take(chunk));
+        socket.on("close", () => this.#close());
+        socket.on("error", () => this.#close());
+    }
+    get closed() {
+        return this.#closed;
+    }
+    #take(chunk) {
+        this.#buffered += chunk;
+        if (this.#buffered.length > KEYRING_LINE_MAX) {
+            this.#socket.destroy();
+            return;
+        }
+        let end = this.#buffered.indexOf("\n");
+        while (end !== -1) {
+            const line = this.#buffered.slice(0, end);
+            this.#buffered = this.#buffered.slice(end + 1);
+            const waiter = this.#waiting.shift();
+            if (waiter === undefined) {
+                this.#lines.push(line);
+            }
+            else {
+                waiter(line);
+            }
+            end = this.#buffered.indexOf("\n");
+        }
+    }
+    #close() {
+        this.#closed = true;
+        for (const waiter of this.#waiting.splice(0)) {
+            waiter(undefined);
+        }
+    }
+    async next(deadlineMs) {
+        const queued = this.#lines.shift();
+        if (queued !== undefined) {
+            return queued;
+        }
+        if (this.#closed) {
+            return undefined;
+        }
+        return await new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                const index = this.#waiting.indexOf(done);
+                if (index !== -1) {
+                    this.#waiting.splice(index, 1);
+                }
+                resolve(undefined);
+            }, deadlineMs);
+            const done = (line) => {
+                clearTimeout(timer);
+                resolve(line);
+            };
+            this.#waiting.push(done);
+        });
+    }
+    async nextOf(schema, deadlineMs) {
+        const line = await this.next(deadlineMs);
+        if (line === undefined) {
+            return undefined;
+        }
+        try {
+            const parsed = schema.safeParse(JSON.parse(line));
+            return parsed.success ? parsed.data : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    send(message) {
+        if (!this.#closed) {
+            this.#socket.write(`${JSON.stringify(message)}\n`);
+        }
+    }
+    end() {
+        this.#socket.end();
+    }
+}
+//# sourceMappingURL=lines.js.map

package/dist/service/lines.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lines.js","sourceRoot":"","sources":["../../src/service/lines.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAMlD,MAAM,OAAO,UAAU;IACV,OAAO,CAAS;IACzB,SAAS,GAAG,EAAE,CAAC;IACN,MAAM,GAAa,EAAE,CAAC;IACtB,QAAQ,GAA2C,EAAE,CAAC;IAC/D,OAAO,GAAG,KAAK,CAAC;IAEhB,YAAY,MAAc;QACtB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM;QACN,OAAO,IAAI,CAAC,OAAO,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,KAAa;QACf,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YACD,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACL,CAAC;IAED,MAAM;QACF,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,SAAS,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,UAAkB;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnC,CAAC;gBACD,OAAO,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC,EAAE,UAAU,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,CAAC,IAAwB,EAAQ,EAAE;gBAC5C,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;IAGD,KAAK,CAAC,MAAM,CAAI,MAAoB,EAAE,UAAkB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YAEL,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,IAAI,CAAC,OAAoB;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED,GAAG;QACC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;CACJ"}

package/dist/service/paths.d.ts

@@ -0,0 +1,19 @@
+export declare const SID_RE: RegExp;
+export declare const SYSTEM_SID = "S-1-5-18";
+export declare const LOCAL_SERVICE_SID = "S-1-5-19";
+export declare const ADMINISTRATORS_SID = "S-1-5-32-544";
+export declare const USERS_SID = "S-1-5-32-545";
+export interface HardenedPaths {
+    readonly root: string;
+    readonly bin: string;
+    readonly exe: string;
+    readonly vaultDir: string;
+    readonly door: string;
+    readonly marker: string;
+    readonly taskPath: string;
+    readonly taskName: string;
+}
+export declare const hardenedRoot: (env?: NodeJS.ProcessEnv) => string;
+export declare const hardenedPaths: (sid: string, env?: NodeJS.ProcessEnv) => HardenedPaths;
+export declare const isHardened: (sid: string, env?: NodeJS.ProcessEnv) => boolean;
+//# sourceMappingURL=paths.d.ts.map

package/dist/service/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/service/paths.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,MAAM,QAAsB,CAAC;AAG1C,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,SAAS,iBAAiB,CAAC;AAExC,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY,SAAS,MAAM,CAAC,UAAU,KAAiB,MAAoG,CAAC;AAEzK,eAAO,MAAM,aAAa,QAAS,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,aAgBjF,CAAC;AAEF,eAAO,MAAM,UAAU,QAAS,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,OAAqD,CAAC"}

package/dist/service/paths.js

@@ -0,0 +1,27 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+export const SID_RE = /^S-1-\d+(-\d+)+$/u;
+export const SYSTEM_SID = "S-1-5-18";
+export const LOCAL_SERVICE_SID = "S-1-5-19";
+export const ADMINISTRATORS_SID = "S-1-5-32-544";
+export const USERS_SID = "S-1-5-32-545";
+export const hardenedRoot = (env = process.env) => join(env["ProgramData"] ?? env["PROGRAMDATA"] ?? "C:\\ProgramData", "Intentic", "Keyring");
+export const hardenedPaths = (sid, env = process.env) => {
+    if (!SID_RE.test(sid)) {
+        throw new Error(`"${sid}" is not a Windows security identifier`);
+    }
+    const root = hardenedRoot(env);
+    const bin = join(root, "bin");
+    return {
+        root,
+        bin,
+        exe: join(bin, "intentic-keyring.exe"),
+        vaultDir: join(root, sid),
+        door: join(root, `${sid}.door.json`),
+        marker: join(root, `${sid}.hardened`),
+        taskPath: "\\Intentic\\",
+        taskName: `Keyring-${sid}`,
+    };
+};
+export const isHardened = (sid, env = process.env) => existsSync(hardenedPaths(sid, env).marker);
+//# sourceMappingURL=paths.js.map

package/dist/service/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/service/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAUjC,MAAM,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAG1C,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AAcxC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAEzK,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAiB,EAAE;IAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO;QACH,IAAI;QACJ,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,YAAY,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC;QACrC,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,WAAW,GAAG,EAAE;KAC7B,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAW,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/service/remote.d.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+import type { HelloDriver, PassphrasePrompt } from "../consent/consent.js";
+import type { Typist } from "../typing/typist.js";
+import type { HelperCall } from "./door.js";
+import type { LineSocket } from "./lines.js";
+type CallBody<C extends HelperCall> = C extends unknown ? Omit<C, "id"> : never;
+export declare class HelperLink {
+    #private;
+    attach(helper: LineSocket): void;
+    get ready(): boolean;
+    call<T>(body: CallBody<HelperCall>, schema: z.ZodType<T>, deadlineMs: number): Promise<T | undefined>;
+}
+export interface HelloPin {
+    readonly credential: string;
+    readonly publicKey: string;
+}
+export declare const remoteHello: (link: HelperLink, pin: () => Promise<HelloPin | undefined>) => HelloDriver;
+export declare const remotePassphrasePrompt: (link: HelperLink) => PassphrasePrompt;
+export declare const remoteTypist: (link: HelperLink) => Typist;
+export {};
+//# sourceMappingURL=remote.d.ts.map

package/dist/service/remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/service/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAe,gBAAgB,EAAgB,MAAM,uBAAuB,CAAC;AACtG,OAAO,KAAK,EAAoB,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAW7C,KAAK,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;AAEhF,qBAAa,UAAU;;IAMnB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAG/B;IAED,IAAI,KAAK,IAAI,OAAO,CAEnB;IAGK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAoB1G;CACJ;AAID,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAGD,eAAO,MAAM,WAAW,SAAU,UAAU,OAAO,MAAM,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAG,WA4BxF,CAAC;AAGF,eAAO,MAAM,sBAAsB,SACxB,UAAU,KAAG,gBAInB,CAAC;AAEN,eAAO,MAAM,YAAY,SAAU,UAAU,KAAG,MAU9C,CAAC"}