@intentic/keyring 0.0.1-bootstrap.0 → 1.338.0

package/dist/backends.js

@@ -0,0 +1,97 @@
+import { firstLineScrubbed, succeeded } from "./run.js";
+const TIMEOUT_MS = 20_000;
+const valueOf = (answer) => answer.stdout.replace(/\r?\n$/u, "");
+const unavailable = (reason) => ({ ok: false, code: "unavailable", reason });
+const failure = (manager, cli, answer, secrets) => {
+    if (answer.missing) {
+        return unavailable(`${manager}'s CLI (${cli}) is not installed, or not on this keyring's PATH.`);
+    }
+    if (answer.timedOut) {
+        return unavailable(`${manager} did not answer within ${String(TIMEOUT_MS / 1000)} s.`);
+    }
+    const said = firstLineScrubbed(answer.stderr, secrets);
+    return unavailable(`${manager} did not answer${said === "" ? "" : `: ${said}`}`);
+};
+export class BackendReader {
+    runner;
+    #bitwardenSession;
+    constructor(runner) {
+        this.runner = runner;
+    }
+    forget() {
+        this.#bitwardenSession = undefined;
+    }
+    async read(ref, configs, secretOf) {
+        switch (ref.backend) {
+            case "1password":
+                return await this.#onePassword(ref.ref, configs.find((config) => config.backend === "1password"), secretOf);
+            case "bitwarden": {
+                const config = configs.find((candidate) => candidate.backend === "bitwarden");
+                return config?.backend === "bitwarden"
+                    ? await this.#bitwarden(ref.ref, ref.field, config, secretOf)
+                    : unavailable("Bitwarden is not set up in this keyring: `intentic-machine keyring backend bitwarden` names the entry holding its master password.");
+            }
+            case "keepassxc": {
+                const config = configs.find((candidate) => candidate.backend === "keepassxc");
+                return config?.backend === "keepassxc"
+                    ? await this.#keepass(ref.ref, ref.attribute, config, secretOf)
+                    : unavailable("KeePassXC is not set up in this keyring: `intentic-machine keyring backend keepassxc` names its database and the entry holding its password.");
+            }
+        }
+    }
+    async #onePassword(ref, config, secretOf) {
+        const settings = config?.backend === "1password" ? config : undefined;
+        const cli = settings?.cli ?? "op";
+        let token;
+        if (settings?.tokenEntry !== undefined) {
+            token = await secretOf(settings.tokenEntry);
+            if (token === undefined) {
+                return unavailable(`The entry ${settings.tokenEntry}, which holds the 1Password token, is not in this keyring.`);
+            }
+        }
+        const args = [...(settings?.account === undefined ? [] : ["--account", settings.account]), "read", "--no-newline", ref];
+        const request = token === undefined ? { command: cli, args, timeoutMs: TIMEOUT_MS } : { command: cli, args, env: { OP_SERVICE_ACCOUNT_TOKEN: token }, timeoutMs: TIMEOUT_MS };
+        const answer = await this.runner(request);
+        return succeeded(answer) ? { ok: true, value: valueOf(answer) } : failure("1Password", cli, answer, token === undefined ? [] : [token]);
+    }
+    async #bitwarden(ref, field, config, secretOf) {
+        const password = await secretOf(config.passwordEntry);
+        if (password === undefined) {
+            return unavailable(`The entry ${config.passwordEntry}, which holds the Bitwarden master password, is not in this keyring.`);
+        }
+        for (const fresh of [false, true]) {
+            if (fresh || this.#bitwardenSession === undefined) {
+                const unlocked = await this.runner({
+                    command: config.cli,
+                    args: ["unlock", "--passwordenv", "INTENTIC_BW_PASSWORD", "--raw"],
+                    env: { INTENTIC_BW_PASSWORD: password },
+                    timeoutMs: TIMEOUT_MS,
+                });
+                const session = unlocked.stdout.trim();
+                if (!succeeded(unlocked) || session === "") {
+                    return failure("Bitwarden", config.cli, unlocked, [password, session]);
+                }
+                this.#bitwardenSession = session;
+            }
+            const session = this.#bitwardenSession;
+            const answer = await this.runner({ command: config.cli, args: ["get", field, ref], env: { BW_SESSION: session }, timeoutMs: TIMEOUT_MS });
+            if (succeeded(answer)) {
+                return { ok: true, value: valueOf(answer) };
+            }
+            if (fresh || answer.missing || answer.timedOut || !/session|locked|unlock/iu.test(answer.stderr)) {
+                return failure("Bitwarden", config.cli, answer, [password, session]);
+            }
+        }
+        return unavailable("Bitwarden did not answer.");
+    }
+    async #keepass(ref, attribute, config, secretOf) {
+        const password = await secretOf(config.passwordEntry);
+        if (password === undefined) {
+            return unavailable(`The entry ${config.passwordEntry}, which holds the KeePassXC database password, is not in this keyring.`);
+        }
+        const args = ["show", "-q", "-s", "-a", attribute, ...(config.keyFile === undefined ? [] : ["-k", config.keyFile]), config.database, ref];
+        const answer = await this.runner({ command: config.cli, args, input: `${password}\n`, timeoutMs: TIMEOUT_MS });
+        return succeeded(answer) ? { ok: true, value: valueOf(answer) } : failure("KeePassXC", config.cli, answer, [password]);
+    }
+}
+//# sourceMappingURL=backends.js.map

package/dist/backends.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends.js","sourceRoot":"","sources":["../src/backends.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAgD,SAAS,EAAE,MAAM,UAAU,CAAC;AAQtG,MAAM,UAAU,GAAG,MAAM,CAAC;AAQ1B,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AAElG,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,GAAW,EAAE,MAAiB,EAAE,OAA0B,EAAe,EAAE;IACzG,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC,GAAG,OAAO,WAAW,GAAG,oDAAoD,CAAC,CAAC;IACrG,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,WAAW,CAAC,GAAG,OAAO,0BAA0B,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvD,OAAO,WAAW,CAAC,GAAG,OAAO,kBAAkB,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC,CAAC;AAEF,MAAM,OAAO,aAAa;IAIO,MAAM;IAFnC,iBAAiB,CAAqB;IAEtC,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAG/C,MAAM;QACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAe,EAAE,OAAiC,EAAE,QAAkB;QAC7E,QAAQ,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,KAAK,WAAW;gBACZ,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;YAChH,KAAK,WAAW,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;gBAC9E,OAAO,MAAM,EAAE,OAAO,KAAK,WAAW;oBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC;oBAC7D,CAAC,CAAC,WAAW,CAAC,oIAAoI,CAAC,CAAC;YAC5J,CAAC;YACD,KAAK,WAAW,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC;gBAC9E,OAAO,MAAM,EAAE,OAAO,KAAK,WAAW;oBAClC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC;oBAC/D,CAAC,CAAC,WAAW,CAAC,8IAA8I,CAAC,CAAC;YACtK,CAAC;QACL,CAAC;IACL,CAAC;IAGD,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,MAAiC,EAAE,QAAkB;QACjF,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,GAAG,GAAG,QAAQ,EAAE,GAAG,IAAI,IAAI,CAAC;QAClC,IAAI,KAAyB,CAAC;QAC9B,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACrC,KAAK,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,WAAW,CAAC,aAAa,QAAQ,CAAC,UAAU,4DAA4D,CAAC,CAAC;YACrH,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;QACxH,MAAM,OAAO,GACT,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QAClK,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5I,CAAC;IAGD,KAAK,CAAC,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,MAAiE,EAAE,QAAkB;QAC9H,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC,aAAa,MAAM,CAAC,aAAa,sEAAsE,CAAC,CAAC;QAChI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,KAAK,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;oBAC/B,OAAO,EAAE,MAAM,CAAC,GAAG;oBACnB,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,sBAAsB,EAAE,OAAO,CAAC;oBAClE,GAAG,EAAE,EAAE,oBAAoB,EAAE,QAAQ,EAAE;oBACvC,SAAS,EAAE,UAAU;iBACxB,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;oBACzC,OAAO,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC;YACrC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1I,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,CAAC;YAED,IAAI,KAAK,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/F,OAAO,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YACzE,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC,2BAA2B,CAAC,CAAC;IACpD,CAAC;IAGD,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,SAAiB,EAAE,MAAiE,EAAE,QAAkB;QAChI,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,WAAW,CAAC,aAAa,MAAM,CAAC,aAAa,wEAAwE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/G,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3H,CAAC;CACJ"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { run } from "@stricli/core";
+import { app } from "./app.js";
+import { askpass, startedAsAskpass } from "./askpass/askpass-run.js";
+if (startedAsAskpass()) {
+    process.exitCode = await askpass(process.argv.slice(2).join(" "), process.stdout, process.stderr);
+}
+else {
+    await run(app, process.argv.slice(2), { process: process });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGrE,IAAI,gBAAgB,EAAE,EAAE,CAAC;IACrB,OAAO,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACtG,CAAC;KAAM,CAAC;IAEJ,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAyB,EAAE,CAAC,CAAC;AAClF,CAAC"}

package/dist/client.d.ts

@@ -0,0 +1,10 @@
+import { type KeyringRequest, type KeyringResponse } from "./protocol.js";
+export declare class KeyringUnavailable extends Error {
+    constructor(message: string, options?: ErrorOptions);
+}
+export interface KeyringClientOptions {
+    readonly address: string;
+    readonly timeoutMs?: number;
+}
+export declare const askKeyring: <R extends KeyringRequest>(options: KeyringClientOptions, request: R) => Promise<KeyringResponse<R["op"]>>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAuC,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAM/G,qBAAa,kBAAmB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,EAGlD;CACJ;AAED,MAAM,WAAW,oBAAoB;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC/B;AAKD,eAAO,MAAM,UAAU,GAAU,CAAC,SAAS,cAAc,WAAW,oBAAoB,WAAW,CAAC,KAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CA6DjI,CAAC"}

package/dist/client.js

@@ -0,0 +1,59 @@
+import { connect } from "node:net";
+import { KEYRING_LINE_MAX, KEYRING_RESPONSES } from "./protocol.js";
+export class KeyringUnavailable extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KeyringUnavailable";
+    }
+}
+const DEFAULT_TIMEOUT_MS = 130_000;
+export const askKeyring = async (options, request) => new Promise((resolve, reject) => {
+    const socket = connect(options.address);
+    let buffered = "";
+    let settled = false;
+    const finish = (outcome) => {
+        if (!settled) {
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            outcome();
+        }
+    };
+    const timer = setTimeout(() => finish(() => reject(new KeyringUnavailable(`the keyring did not answer within ${String(Math.round((options.timeoutMs ?? DEFAULT_TIMEOUT_MS) / 1000))} s`))), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    socket.setEncoding("utf8");
+    socket.on("connect", () => socket.write(`${JSON.stringify(request)}\n`));
+    socket.on("data", (chunk) => {
+        buffered += chunk;
+        if (buffered.length > KEYRING_LINE_MAX) {
+            finish(() => reject(new KeyringUnavailable("the keyring answered with more than any answer holds")));
+            return;
+        }
+        const end = buffered.indexOf("\n");
+        if (end === -1) {
+            return;
+        }
+        const line = buffered.slice(0, end);
+        finish(() => {
+            const schema = KEYRING_RESPONSES[request.op];
+            let parsed;
+            try {
+                parsed = JSON.parse(line);
+            }
+            catch (error) {
+                reject(new KeyringUnavailable("the keyring answered with something that is not JSON", { cause: error }));
+                return;
+            }
+            const answer = schema.safeParse(parsed);
+            if (!answer.success) {
+                reject(new KeyringUnavailable(`the keyring's answer to ${request.op} is not one this build reads: is it a different version?`));
+                return;
+            }
+            resolve(answer.data);
+        });
+    });
+    socket.on("error", (error) => finish(() => reject(new KeyringUnavailable(error.code === "ENOENT" || error.code === "ECONNREFUSED"
+        ? "no keyring is running on this computer: `intentic-machine keyring setup` installs one"
+        : `the keyring could not be reached: ${error.message}`, { cause: error }))));
+    socket.on("end", () => finish(() => reject(new KeyringUnavailable("the keyring closed the connection without an answer"))));
+});
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAA6C,MAAM,eAAe,CAAC;AAM/G,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzC,YAAY,OAAe,EAAE,OAAsB;QAC/C,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AASD,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAA4B,OAA6B,EAAE,OAAU,EAAqC,EAAE,CACvI,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,CAAC,OAAmB,EAAQ,EAAE;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CACpB,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EACjK,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAC1C,CAAC;IACF,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAChC,QAAQ,IAAI,KAAK,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,sDAAsD,CAAC,CAAC,CAAC,CAAC;YACrG,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACb,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,EAAE;YACR,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,MAAe,CAAC;YACpB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,kBAAkB,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBACzG,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,kBAAkB,CAAC,2BAA2B,OAAO,CAAC,EAAE,0DAA0D,CAAC,CAAC,CAAC;gBAChI,OAAO;YACX,CAAC;YAED,OAAO,CAAC,MAAM,CAAC,IAAgC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,CAChD,MAAM,CAAC,GAAG,EAAE,CACR,MAAM,CACF,IAAI,kBAAkB,CAClB,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QACpD,CAAC,CAAC,uFAAuF;QACzF,CAAC,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,EAC1D,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CACJ,CACJ,CACJ,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,qDAAqD,CAAC,CAAC,CAAC,CAAC,CAAC;AAChI,CAAC,CAAC,CAAC"}

package/dist/consent/consent-posix.d.ts

@@ -0,0 +1,6 @@
+import type { Notice, PassphrasePrompt } from "./consent.js";
+import type { Runner } from "../run.js";
+export declare const linuxPassphrasePrompt: (runner: Runner, env?: NodeJS.ProcessEnv) => PassphrasePrompt;
+export declare const macDialogScript: (notice: Notice) => string;
+export declare const macPassphrasePrompt: (runner: Runner) => PassphrasePrompt;
+//# sourceMappingURL=consent-posix.d.ts.map

package/dist/consent/consent-posix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-posix.d.ts","sourceRoot":"","sources":["../../src/consent/consent-posix.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAgB,MAAM,cAAc,CAAC;AAC3E,OAAO,KAAK,EAAa,MAAM,EAAE,MAAM,WAAW,CAAC;AAuCnD,eAAO,MAAM,qBAAqB,WACrB,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,gBAwBvD,CAAC;AAKN,eAAO,MAAM,eAAe,WAAY,MAAM,KAAG,MAKjC,CAAC;AAEjB,eAAO,MAAM,mBAAmB,WACnB,MAAM,KAAG,gBAWjB,CAAC"}

package/dist/consent/consent-posix.js

@@ -0,0 +1,57 @@
+const PROMPT_SECONDS = 120;
+const PROMPT_TIMEOUT_MS = (PROMPT_SECONDS + 5) * 1000;
+const typed = (answer) => answer.stdout.replace(/\r?\n$/u, "");
+const markupText = (text) => text.replace(/&/gu, "&amp;").replace(/</gu, "&lt;").replace(/>/gu, "&gt;");
+const DIALOGS = [
+    {
+        command: "zenity",
+        args: (notice) => ["--entry", "--hide-text", `--title=${notice.title}`, `--text=${markupText(notice.message)}`, `--timeout=${String(PROMPT_SECONDS)}`],
+        cancelled: [1, 5],
+    },
+    { command: "kdialog", args: (notice) => ["--title", notice.title, "--password", notice.message], cancelled: [1] },
+];
+const ASK_PASSWORD = {
+    command: "systemd-ask-password",
+    args: (notice) => [`--timeout=${String(PROMPT_SECONDS)}`, `${notice.title} ${notice.message}`],
+    cancelled: [1],
+};
+export const linuxPassphrasePrompt = (runner, env = process.env) => async (notice) => {
+    const graphical = (env["DISPLAY"] ?? "") !== "" || (env["WAYLAND_DISPLAY"] ?? "") !== "";
+    const dialogs = graphical ? [...DIALOGS, ASK_PASSWORD] : [ASK_PASSWORD];
+    const tried = [];
+    for (const dialog of dialogs) {
+        const answer = await runner({ command: dialog.command, args: dialog.args(notice), timeoutMs: PROMPT_TIMEOUT_MS });
+        if (answer.missing) {
+            tried.push(`no ${dialog.command}`);
+            continue;
+        }
+        if (answer.exitCode === 0 && !answer.timedOut) {
+            return { kind: "answered", passphrase: typed(answer) };
+        }
+        if (answer.exitCode !== null && dialog.cancelled.includes(answer.exitCode)) {
+            return { kind: "cancelled" };
+        }
+        tried.push(`${dialog.command} could not ask (exit ${String(answer.exitCode ?? "none")})`);
+    }
+    return {
+        kind: "unavailable",
+        reason: `${tried.join(", ")}${graphical ? "" : ", and no display to show a dialog on"}: install zenity or kdialog, or unlock from a desktop session`,
+    };
+};
+const appleScriptText = (text) => `"${text.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`;
+export const macDialogScript = (notice) => [
+    `set answer to display dialog ${appleScriptText(`${notice.message}\n\nThe keyring's passphrase:`)} with title ${appleScriptText(notice.title)} default answer "" with hidden answer buttons {"Cancel", "OK"} default button "OK" giving up after ${String(PROMPT_SECONDS)}`,
+    `if gave up of answer then error number -128`,
+    `return text returned of answer`,
+].join("\n");
+export const macPassphrasePrompt = (runner) => async (notice) => {
+    const answer = await runner({ command: "osascript", args: ["-"], input: macDialogScript(notice), timeoutMs: PROMPT_TIMEOUT_MS });
+    if (answer.missing) {
+        return { kind: "unavailable", reason: "osascript was not found" };
+    }
+    if (answer.exitCode === 0 && !answer.timedOut) {
+        return { kind: "answered", passphrase: typed(answer) };
+    }
+    return /-128/u.test(answer.stderr) ? { kind: "cancelled" } : { kind: "unavailable", reason: "the dialog could not be shown (no desktop session?)" };
+};
+//# sourceMappingURL=consent-posix.js.map

package/dist/consent/consent-posix.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-posix.js","sourceRoot":"","sources":["../../src/consent/consent-posix.ts"],"names":[],"mappings":"AASA,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,iBAAiB,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;AAGtD,MAAM,KAAK,GAAG,CAAC,MAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AAGlF,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AASxH,MAAM,OAAO,GAAsB;IAC/B;QACI,OAAO,EAAE,QAAQ;QACjB,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACtJ,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;KACpB;IACD,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE;CACpH,CAAC;AAEF,MAAM,YAAY,GAAW;IACzB,OAAO,EAAE,sBAAsB;IAC/B,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,MAAM,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,CAAC;CACjB,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAC9B,CAAC,MAAc,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAoB,EAAE,CAC3E,KAAK,EAAE,MAAM,EAAE,EAAE;IACb,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClH,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACnC,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,wBAAwB,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO;QACH,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sCAAsC,+DAA+D;KACvJ,CAAC;AACN,CAAC,CAAC;AAGN,MAAM,eAAe,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;AAE5G,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAU,EAAE,CACtD;IACI,gCAAgC,eAAe,CAAC,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,eAAe,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,sGAAsG,MAAM,CAAC,cAAc,CAAC,EAAE;IAC3Q,6CAA6C;IAC7C,gCAAgC;CACnC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAC5B,CAAC,MAAc,EAAoB,EAAE,CACrC,KAAK,EAAE,MAAM,EAAyB,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACjI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,qDAAqD,EAAE,CAAC;AACxJ,CAAC,CAAC"}

package/dist/consent/consent-windows.d.ts

@@ -0,0 +1,5 @@
+import type { HelloDriver, PassphrasePrompt } from "./consent.js";
+import type { Runner } from "../run.js";
+export declare const windowsHello: (runner: Runner, now?: () => number) => HelloDriver;
+export declare const windowsPassphrasePrompt: (runner: Runner) => PassphrasePrompt;
+//# sourceMappingURL=consent-windows.d.ts.map

package/dist/consent/consent-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-windows.d.ts","sourceRoot":"","sources":["../../src/consent/consent-windows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAuB,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAqNxC,eAAO,MAAM,YAAY,WAAY,MAAM,QAAO,MAAM,MAAM,KAAc,WAyC3E,CAAC;AAEF,eAAO,MAAM,uBAAuB,WACvB,MAAM,KAAG,gBAejB,CAAC"}

package/dist/consent/consent-windows.js

@@ -0,0 +1,244 @@
+import { z } from "zod";
+import { runPowerShell, WINRT_AWAIT } from "../powershell.js";
+const PROMPT_TIMEOUT_MS = 125_000;
+const AVAILABLE_FOR_MS = 5 * 60_000;
+const FORMS = String.raw `
+using System;
+using System.Drawing;
+using System.Threading;
+using System.Windows.Forms;
+
+namespace IntenticKeyring {
+  public class Notice {
+    Form form;
+    readonly ManualResetEvent shown = new ManualResetEvent(false);
+
+    public static Notice Show(string title, string message) {
+      Notice notice = new Notice();
+      Thread thread = new Thread(delegate() { notice.Run(title, message); });
+      thread.SetApartmentState(ApartmentState.STA);
+      thread.IsBackground = true;
+      thread.Start();
+      notice.shown.WaitOne(5000);
+      return notice;
+    }
+
+    void Run(string title, string message) {
+      form = new Form();
+      form.Text = "intentic keyring";
+      form.FormBorderStyle = FormBorderStyle.FixedToolWindow;
+      form.TopMost = true;
+      form.ShowInTaskbar = false;
+      form.StartPosition = FormStartPosition.Manual;
+      form.AutoSize = true;
+      form.AutoSizeMode = AutoSizeMode.GrowAndShrink;
+      form.Padding = new Padding(16);
+      FlowLayoutPanel panel = new FlowLayoutPanel();
+      panel.FlowDirection = FlowDirection.TopDown;
+      panel.AutoSize = true;
+      Label heading = new Label();
+      heading.Text = title;
+      heading.AutoSize = true;
+      heading.MaximumSize = new Size(480, 0);
+      heading.Font = new Font("Segoe UI Semibold", 11f);
+      Label body = new Label();
+      body.Text = message + "\r\n\r\nWindows Hello asks for your gesture to answer it.";
+      body.AutoSize = true;
+      body.MaximumSize = new Size(480, 0);
+      body.Font = new Font("Segoe UI", 9.5f);
+      panel.Controls.Add(heading);
+      panel.Controls.Add(body);
+      form.Controls.Add(panel);
+      form.Shown += delegate(object sender, EventArgs e) {
+        Rectangle area = Screen.PrimaryScreen.WorkingArea;
+        form.Location = new Point(area.X + (area.Width - form.Width) / 2, area.Y + 24);
+        shown.Set();
+      };
+      Application.Run(form);
+    }
+
+    public void Close() {
+      try { if (form != null && form.IsHandleCreated) form.BeginInvoke(new MethodInvoker(form.Close)); } catch (Exception) { } // allow(silent-catch): a notice already gone has nothing left to close
+    }
+  }
+
+  public static class Passphrase {
+    public static string Ask(string title, string message, int seconds) {
+      Application.EnableVisualStyles();
+      Form form = new Form();
+      form.Text = title;
+      form.FormBorderStyle = FormBorderStyle.FixedDialog;
+      form.MinimizeBox = false;
+      form.MaximizeBox = false;
+      form.TopMost = true;
+      form.StartPosition = FormStartPosition.CenterScreen;
+      form.AutoSize = true;
+      form.AutoSizeMode = AutoSizeMode.GrowAndShrink;
+      form.Padding = new Padding(16);
+      FlowLayoutPanel panel = new FlowLayoutPanel();
+      panel.FlowDirection = FlowDirection.TopDown;
+      panel.AutoSize = true;
+      Label body = new Label();
+      body.Text = message + "\r\n\r\nThe keyring's passphrase:";
+      body.AutoSize = true;
+      body.MaximumSize = new Size(480, 0);
+      TextBox box = new TextBox();
+      box.UseSystemPasswordChar = true;
+      box.Width = 320;
+      FlowLayoutPanel buttons = new FlowLayoutPanel();
+      buttons.AutoSize = true;
+      Button ok = new Button();
+      ok.Text = "OK";
+      ok.DialogResult = DialogResult.OK;
+      Button cancel = new Button();
+      cancel.Text = "Cancel";
+      cancel.DialogResult = DialogResult.Cancel;
+      buttons.Controls.Add(ok);
+      buttons.Controls.Add(cancel);
+      panel.Controls.Add(body);
+      panel.Controls.Add(box);
+      panel.Controls.Add(buttons);
+      form.Controls.Add(panel);
+      form.AcceptButton = ok;
+      form.CancelButton = cancel;
+      System.Windows.Forms.Timer timer = new System.Windows.Forms.Timer();
+      timer.Interval = seconds * 1000;
+      timer.Tick += delegate(object sender, EventArgs e) { form.DialogResult = DialogResult.Cancel; form.Close(); };
+      form.Shown += delegate(object sender, EventArgs e) { form.Activate(); box.Focus(); timer.Start(); };
+      DialogResult result = form.ShowDialog();
+      timer.Stop();
+      return result == DialogResult.OK ? box.Text : null;
+    }
+  }
+}
+`;
+const PREAMBLE = `
+$ErrorActionPreference = 'Stop'
+function Answer($o) { [Console]::Out.WriteLine('intentic-keyring>' + ($o | ConvertTo-Json -Compress)) }
+Add-Type -AssemblyName System.Windows.Forms, System.Drawing
+Add-Type -ReferencedAssemblies System.Windows.Forms, System.Drawing -TypeDefinition @'
+${FORMS}
+'@
+`;
+const HELLO_SCRIPT = `${PREAMBLE}
+${WINRT_AWAIT}
+[Windows.Security.Credentials.KeyCredentialManager,Windows.Security.Credentials,ContentType=WindowsRuntime] | Out-Null
+[Windows.Security.Credentials.UI.UserConsentVerifier,Windows.Security.Credentials.UI,ContentType=WindowsRuntime] | Out-Null
+[Windows.Security.Cryptography.Core.CryptographicPublicKeyBlobType,Windows.Security.Cryptography.Core,ContentType=WindowsRuntime] | Out-Null
+$buffers = [System.Runtime.InteropServices.WindowsRuntime.WindowsRuntimeBufferExtensions]
+function SignWith($credential) {
+  $challenge = $buffers::AsBuffer([Convert]::FromBase64String($KeyringInput.challenge))
+  $signed = Await ($credential.RequestSignAsync($challenge)) ([Windows.Security.Credentials.KeyCredentialOperationResult])
+  if ([string]$signed.Status -ne 'Success') { return @{ ok = $false; status = [string]$signed.Status } }
+  return @{ ok = $true; signature = [Convert]::ToBase64String($buffers::ToArray($signed.Result)) }
+}
+try {
+  $op = $KeyringInput.op
+  if ($op -eq 'available') {
+    $supported = Await ([Windows.Security.Credentials.KeyCredentialManager]::IsSupportedAsync()) ([bool])
+    $verifier = Await ([Windows.Security.Credentials.UI.UserConsentVerifier]::CheckAvailabilityAsync()) ([Windows.Security.Credentials.UI.UserConsentVerifierAvailability])
+    Answer @{ ok = $true; supported = [bool]$supported; status = [string]$verifier }
+  } elseif ($op -eq 'verify') {
+    $result = Await ([Windows.Security.Credentials.UI.UserConsentVerifier]::RequestVerificationAsync($KeyringInput.message)) ([Windows.Security.Credentials.UI.UserConsentVerificationResult])
+    Answer @{ ok = ([string]$result -eq 'Verified'); status = [string]$result }
+  } else {
+    $notice = [IntenticKeyring.Notice]::Show($KeyringInput.title, $KeyringInput.message)
+    try {
+      if ($op -eq 'enrol') {
+        $made = Await ([Windows.Security.Credentials.KeyCredentialManager]::RequestCreateAsync($KeyringInput.credential, [Windows.Security.Credentials.KeyCredentialCreationOption]::ReplaceExisting)) ([Windows.Security.Credentials.KeyCredentialRetrievalResult])
+        if ([string]$made.Status -ne 'Success') { Answer @{ ok = $false; status = [string]$made.Status } } else {
+          $answer = SignWith $made.Credential
+          # X.509 SubjectPublicKeyInfo, which hardened mode's service reads with node:crypto to check later signatures.
+          $answer.publicKey = [Convert]::ToBase64String($buffers::ToArray($made.Credential.RetrievePublicKey([Windows.Security.Cryptography.Core.CryptographicPublicKeyBlobType]::X509SubjectPublicKeyInfo)))
+          Answer $answer
+        }
+      } else {
+        $opened = Await ([Windows.Security.Credentials.KeyCredentialManager]::OpenAsync($KeyringInput.credential)) ([Windows.Security.Credentials.KeyCredentialRetrievalResult])
+        if ([string]$opened.Status -ne 'Success') { Answer @{ ok = $false; status = [string]$opened.Status } } else { Answer (SignWith $opened.Credential) }
+      }
+    } finally { $notice.Close() }
+  }
+} catch {
+  Answer @{ ok = $false; error = $_.Exception.Message }
+}
+`;
+const PASSPHRASE_SCRIPT = `${PREAMBLE}
+try {
+  $typed = [IntenticKeyring.Passphrase]::Ask($KeyringInput.title, $KeyringInput.message, [int]$KeyringInput.seconds)
+  if ($typed -eq $null) { Answer @{ ok = $false; cancelled = $true } } else { Answer @{ ok = $true; passphrase = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($typed)) } }
+} catch {
+  Answer @{ ok = $false; error = $_.Exception.Message }
+}
+`;
+const AnswerSchema = z.object({
+    ok: z.boolean(),
+    supported: z.boolean().optional(),
+    status: z.string().optional(),
+    error: z.string().optional(),
+    signature: z.string().optional(),
+    publicKey: z.string().optional(),
+    passphrase: z.string().optional(),
+    cancelled: z.boolean().optional(),
+});
+const CANCELLED = new Set(["UserCanceled", "Canceled"]);
+const failed = (answer) => ({
+    ok: false,
+    cancelled: answer.status !== undefined && CANCELLED.has(answer.status),
+    reason: answer.error ?? `Windows Hello answered ${answer.status ?? "without a status"}`,
+});
+const base64 = (text) => (text === undefined || !/^[A-Za-z0-9+/=]+$/u.test(text) ? undefined : Buffer.from(text, "base64"));
+const standardBase64 = (challenge) => Buffer.from(challenge, "base64url").toString("base64");
+export const windowsHello = (runner, now = Date.now) => {
+    let known;
+    const hello = async (input) => {
+        const ran = await runPowerShell(runner, { script: HELLO_SCRIPT, input, timeoutMs: PROMPT_TIMEOUT_MS }, AnswerSchema);
+        return ran.ok ? { ok: true, value: ran.answer } : { ok: false, cancelled: false, reason: ran.reason };
+    };
+    return {
+        available: async () => {
+            if (known !== undefined && now() - known.at < AVAILABLE_FOR_MS) {
+                return known.available;
+            }
+            const asked = await hello({ op: "available" });
+            const available = asked.ok && asked.value.ok && asked.value.supported === true;
+            known = { at: now(), available };
+            return available;
+        },
+        enrol: async (credential, challenge, notice) => {
+            const asked = await hello({ op: "enrol", credential, challenge: standardBase64(challenge), title: notice.title, message: notice.message });
+            if (!asked.ok) {
+                return asked;
+            }
+            const signature = base64(asked.value.signature);
+            const publicKey = asked.value.publicKey;
+            return asked.value.ok && signature !== undefined && publicKey !== undefined ? { ok: true, value: { signature, publicKey } } : failed(asked.value);
+        },
+        sign: async (credential, challenge, notice) => {
+            const asked = await hello({ op: "sign", credential, challenge: standardBase64(challenge), title: notice.title, message: notice.message });
+            if (!asked.ok) {
+                return asked;
+            }
+            const signature = base64(asked.value.signature);
+            return asked.value.ok && signature !== undefined ? { ok: true, value: signature } : failed(asked.value);
+        },
+        verify: async (notice) => {
+            const asked = await hello({ op: "verify", message: `${notice.title}\n\n${notice.message}` });
+            if (!asked.ok) {
+                return asked;
+            }
+            return asked.value.ok ? { ok: true, value: true } : failed(asked.value);
+        },
+    };
+};
+export const windowsPassphrasePrompt = (runner) => async (notice) => {
+    const ran = await runPowerShell(runner, { script: PASSPHRASE_SCRIPT, input: { title: notice.title, message: notice.message, seconds: String(Math.floor(PROMPT_TIMEOUT_MS / 1000) - 5) }, timeoutMs: PROMPT_TIMEOUT_MS }, AnswerSchema);
+    if (!ran.ok) {
+        return { kind: "unavailable", reason: ran.reason };
+    }
+    if (ran.answer.ok) {
+        const typed = base64(ran.answer.passphrase);
+        return typed === undefined ? { kind: "unavailable", reason: "the passphrase dialog answered with nothing" } : { kind: "answered", passphrase: typed.toString("utf8") };
+    }
+    return ran.answer.cancelled === true ? { kind: "cancelled" } : { kind: "unavailable", reason: ran.answer.error ?? "the passphrase dialog failed" };
+};
+//# sourceMappingURL=consent-windows.js.map

package/dist/consent/consent-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent-windows.js","sourceRoot":"","sources":["../../src/consent/consent-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU9D,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAGpC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6GvB,CAAC;AAEF,MAAM,QAAQ,GAAG;;;;;EAKf,KAAK;;CAEN,CAAC;AAIF,MAAM,YAAY,GAAG,GAAG,QAAQ;EAC9B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCZ,CAAC;AAEF,MAAM,iBAAiB,GAAG,GAAG,QAAQ;;;;;;;CAOpC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAIH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAExD,MAAM,MAAM,GAAG,CAAI,MAAc,EAAkB,EAAE,CAAC,CAAC;IACnD,EAAE,EAAE,KAAK;IACT,SAAS,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;IACtE,MAAM,EAAE,MAAM,CAAC,KAAK,IAAI,0BAA0B,MAAM,CAAC,MAAM,IAAI,kBAAkB,EAAE;CAC1F,CAAC,CAAC;AAEH,MAAM,MAAM,GAAG,CAAC,IAAwB,EAAsB,EAAE,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpK,MAAM,cAAc,GAAG,CAAC,SAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAE7G,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAc,EAAE,GAAG,GAAiB,IAAI,CAAC,GAAG,EAAe,EAAE;IACtF,IAAI,KAAuE,CAAC;IAC5E,MAAM,KAAK,GAAG,KAAK,EAAE,KAAuC,EAAgC,EAAE;QAC1F,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,YAAY,CAAC,CAAC;QACrH,OAAO,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IAC1G,CAAC,CAAC;IACF,OAAO;QACH,SAAS,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAC,SAAS,CAAC;YAC3B,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC;YAC/E,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;YACjC,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAc,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3I,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YACxC,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtJ,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAc,EAAE,EAAE;YAClD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1I,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAChD,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7F,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAChC,CAAC,MAAc,EAAoB,EAAE,CACrC,KAAK,EAAE,MAAM,EAAE,EAAE;IACb,MAAM,GAAG,GAAG,MAAM,aAAa,CAC3B,MAAM,EACN,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAC/K,YAAY,CACf,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3K,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,8BAA8B,EAAE,CAAC;AACvJ,CAAC,CAAC"}

package/dist/consent/consent.d.ts

@@ -0,0 +1,67 @@
+export interface VaultOpener {
+    readonly withPassphrase: (passphrase: string) => Promise<Buffer | undefined>;
+    readonly hello?: HelloOpener;
+}
+export interface HelloOpener {
+    readonly credential: string;
+    readonly challenge: string;
+    readonly withSignature: (signature: Buffer) => Buffer | undefined;
+}
+export interface ConsentRequest {
+    readonly title: string;
+    readonly message: string;
+    readonly unlock: boolean;
+    readonly opener: VaultOpener | undefined;
+    readonly waitMs?: number;
+}
+export type ConsentRefusal = {
+    readonly ok: false;
+    readonly code: "declined" | "busy" | "locked";
+    readonly reason: string;
+};
+export type ConsentAnswer = {
+    readonly ok: true;
+    readonly vaultKey: Buffer | undefined;
+    readonly how: "hello" | "passphrase" | "verified";
+} | ConsentRefusal;
+export type HelloResult<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly cancelled: boolean;
+    readonly reason: string;
+};
+export interface HelloEnrolment {
+    readonly signature: Buffer;
+    readonly publicKey: string;
+}
+export interface HelloDriver {
+    readonly available: () => Promise<boolean>;
+    readonly enrol: (credential: string, challenge: string, notice: Notice) => Promise<HelloResult<HelloEnrolment>>;
+    readonly sign: (credential: string, challenge: string, notice: Notice) => Promise<HelloResult<Buffer>>;
+    readonly verify: (notice: Notice) => Promise<HelloResult<true>>;
+}
+export interface Notice {
+    readonly title: string;
+    readonly message: string;
+}
+export type PromptAnswer = {
+    readonly kind: "answered";
+    readonly passphrase: string;
+} | {
+    readonly kind: "cancelled";
+} | {
+    readonly kind: "unavailable";
+    readonly reason: string;
+};
+export type PassphrasePrompt = (notice: Notice) => Promise<PromptAnswer>;
+export interface Consent {
+    readonly ask: (request: ConsentRequest) => Promise<ConsentAnswer>;
+    readonly hello: HelloDriver | undefined;
+}
+export declare const refusingConsent: (why: string) => Consent;
+export declare const passphraseConsent: (prompt: PassphrasePrompt) => Consent;
+export declare const helloConsent: (hello: HelloDriver, fallback: Consent) => Consent;
+export declare const serialConsent: (inner: Consent, defaultWaitMs?: number) => Consent;
+//# sourceMappingURL=consent.d.ts.map

package/dist/consent/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/consent/consent.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,WAAW;IAExB,QAAQ,CAAC,cAAc,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAE7E,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAChC;AAED,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CACrE;AAED,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IAEzB,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;IAEzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,cAAc,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE5H,MAAM,MAAM,aAAa,GACnB;IACI,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAGlB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,YAAY,GAAG,UAAU,CAAC;CACrD,GACD,cAAc,CAAC;AAErB,MAAM,MAAM,WAAW,CAAC,CAAC,IAAI;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErJ,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAGD,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3C,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAEhH,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IAEvG,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;CACnE;AAED,MAAM,WAAW,MAAM;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,MAAM,YAAY,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAC1D;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAE9B;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGhE,MAAM,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAEzE,MAAM,WAAW,OAAO;IACpB,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;IAElE,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAMD,eAAO,MAAM,eAAe,QAAS,MAAM,KAAG,OAG5C,CAAC;AAOH,eAAO,MAAM,iBAAiB,WAAY,gBAAgB,KAAG,OAuB3D,CAAC;AAIH,eAAO,MAAM,YAAY,UAAW,WAAW,YAAY,OAAO,KAAG,OA0BnE,CAAC;AAIH,eAAO,MAAM,aAAa,UAAW,OAAO,kBAAiB,MAAM,KAA8B,OA8BhG,CAAC"}