@intentic/keyring 0.0.1-bootstrap.0 → 1.338.0

package/dist/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsCxB,eAAO,MAAM,oBAAoB,aAK+G,CAAC;AAiBjJ,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;8BAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;iBAAuB,CAAC;AACrD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;kBAAsC,CAAC;AACpE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAI1D,eAAO,MAAM,WAAW;;;;kBAQX,CAAC;AAEd,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;8BAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0BA+C/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAE7C,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;iBAA0F,CAAC;AACrH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAMpD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuB+B,CAAC;AAE9D,MAAM,MAAM,eAAe,CAAC,CAAC,SAAS,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAG1F,eAAO,MAAM,gBAAgB,QAAa,CAAC"}

package/dist/protocol.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+import { KEYRING_PROGRAMS_MAX, KeyringCopiesSchema, KeyringInboxItemSchema, KeyringInboxResultSchema, KeyringPackageSchema, KeyringProgramSchema, KeyringRefusalCodeSchema, KeyringReleaseResultSchema, KeyringSecretNameSchema, KeyringShareModeSchema, KeyringSourceSchema, KeyringStateSchema, KeyringSyncDeliverResultSchema, KeyringSyncDeliverSchema, KeyringSyncOutboxSchema, KeyringSyncPairResultSchema, KeyringSyncPairSchema, KeyringSyncStateSchema, KeyringTypeInputSchema, KeyringTypeResultSchema, KeyringPointerSchema, SealedBoxSchema, SignedKeyringGrantSchema, } from "@intentic/sandbox-contract/schemas/keyring";
+const sandboxUrl = z.string().url();
+const hostPattern = z.string().min(1).max(253);
+export const AskpassMatcherSchema = z
+    .string()
+    .min(1)
+    .max(300)
+    .regex(/^(ssh|ssh-key|sudo|git|prompt)(:.+)?$/u)
+    .describe("Which askpass prompt it answers: `ssh:user@host`, `ssh-key:/path`, `sudo`, `sudo:user`, `git:https://host`, or `prompt:<text>`.");
+const entryRules = {
+    kind: z.enum(["password", "text"]),
+    programs: z.array(KeyringProgramSchema).max(KEYRING_PROGRAMS_MAX),
+    packages: z.array(KeyringPackageSchema).max(KEYRING_PROGRAMS_MAX),
+    hosts: z.array(hostPattern).max(KEYRING_PROGRAMS_MAX),
+    anyField: z.boolean(),
+    username: z.string().max(256).optional().describe("The user name that goes with it, for an askpass `Username for` prompt. Not a secret."),
+    askpass: z.array(AskpassMatcherSchema).max(KEYRING_PROGRAMS_MAX),
+    askpassRememberMinutes: z.number().int().min(0).max(240),
+    note: z.string().max(500).optional(),
+};
+export const BackendRefSchema = z.discriminatedUnion("backend", [
+    z.object({ backend: z.literal("1password"), ref: z.string().regex(/^op:\/\/.+/u).max(500).describe("A secret reference, `op://Vault/Item/field`.") }),
+    z.object({ backend: z.literal("bitwarden"), ref: z.string().min(1).max(200).describe("The item's id or exact name."), field: z.enum(["password", "username", "totp", "notes"]).default("password") }),
+    z.object({ backend: z.literal("keepassxc"), ref: z.string().min(1).max(500).describe("The entry's path in the database, `Group/Entry`."), attribute: z.string().min(1).max(100).default("Password") }),
+]);
+export const ShareInfoSchema = z.object({
+    sandbox: sandboxUrl,
+    machine: z.string().describe("The device card this computer is known by in that sandbox."),
+    mode: KeyringShareModeSchema,
+    sharedAt: z.number(),
+});
+export const EntryInfoSchema = z.object({
+    name: KeyringSecretNameSchema,
+    ...entryRules,
+    source: KeyringSourceSchema,
+    backend: BackendRefSchema.optional(),
+    shares: z.array(ShareInfoSchema),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+});
+export const EntryRulesSchema = z.object(entryRules);
+export const EntryPatchSchema = EntryRulesSchema.partial().strict();
+export const SetupSchema = z
+    .object({
+    op: z.literal("setup"),
+    passphrase: z.string().min(10).max(1024),
+    hello: z.boolean().describe("Also unlock with Windows Hello. Ignored where Hello is not available."),
+})
+    .strict();
+export const BackendConfigSchema = z.discriminatedUnion("backend", [
+    z.object({ backend: z.literal("1password"), cli: z.string().min(1).max(500).default("op"), account: z.string().max(200).optional(), tokenEntry: KeyringSecretNameSchema.optional().describe("An entry holding a service-account token, for unattended reads. Absent: the 1Password app's own unlock.") }),
+    z.object({ backend: z.literal("bitwarden"), cli: z.string().min(1).max(500).default("bw"), passwordEntry: KeyringSecretNameSchema.describe("The entry holding the Bitwarden master password.") }),
+    z.object({ backend: z.literal("keepassxc"), cli: z.string().min(1).max(500).default("keepassxc-cli"), database: z.string().min(1).max(1000), keyFile: z.string().max(1000).optional(), passwordEntry: KeyringSecretNameSchema }),
+]);
+export const KeyringRequestSchema = z.discriminatedUnion("op", [
+    z.object({ op: z.literal("state") }).strict(),
+    SetupSchema,
+    z.object({ op: z.literal("unlock"), minutes: z.number().int().min(1).max(720).default(60) }).strict(),
+    z.object({ op: z.literal("lock") }).strict(),
+    z.object({ op: z.literal("list") }).strict(),
+    z
+        .object({
+        op: z.literal("add"),
+        name: KeyringSecretNameSchema,
+        sealed: SealedBoxSchema.optional(),
+        backend: BackendRefSchema.optional(),
+        rules: EntryRulesSchema,
+        replace: z.boolean().default(false),
+    })
+        .strict(),
+    z.object({ op: z.literal("edit"), name: KeyringSecretNameSchema, patch: EntryPatchSchema, sealed: SealedBoxSchema.optional() }).strict(),
+    z.object({ op: z.literal("remove"), name: KeyringSecretNameSchema }).strict(),
+    z
+        .object({
+        op: z.literal("share"),
+        name: KeyringSecretNameSchema,
+        sandbox: sandboxUrl,
+        machine: z.string().min(1).max(128),
+        mode: KeyringShareModeSchema,
+    })
+        .strict(),
+    z.object({ op: z.literal("unshare"), name: KeyringSecretNameSchema, sandbox: sandboxUrl }).strict(),
+    z.object({ op: z.literal("backend"), config: BackendConfigSchema }).strict(),
+    z.object({ op: z.literal("shares"), sandbox: sandboxUrl }).strict(),
+    z.object({ op: z.literal("release"), grant: SignedKeyringGrantSchema }).strict(),
+    z.object({ op: z.literal("type"), input: KeyringTypeInputSchema }).strict(),
+    z.object({ op: z.literal("inbox"), item: KeyringInboxItemSchema }).strict(),
+    z.object({ op: z.literal("copies"), sandbox: sandboxUrl }).strict(),
+    z.object({ op: z.literal("sync-state") }).strict(),
+    z.object({ op: z.literal("sync-pair"), pair: KeyringSyncPairSchema }).strict(),
+    z.object({ op: z.literal("sync-outbox") }).strict(),
+    z.object({ op: z.literal("sync-deliver"), deliver: KeyringSyncDeliverSchema }).strict(),
+    z.object({ op: z.literal("askpass"), prompt: z.string().max(1000), parent: z.string().max(300).optional() }).strict(),
+    z.object({ op: z.literal("consent-upgrade"), version: z.string().min(1).max(64) }).strict(),
+]);
+export const RefusalSchema = z.object({ ok: z.literal(false), code: KeyringRefusalCodeSchema, refusal: z.string() });
+const answer = (granted) => z.discriminatedUnion("ok", [granted.extend({ ok: z.literal(true) }), RefusalSchema]);
+const done = answer(z.object({}));
+export const KEYRING_RESPONSES = {
+    state: answer(z.object({ state: KeyringStateSchema, setUp: z.boolean() })),
+    setup: done,
+    unlock: answer(z.object({ unlockedUntil: z.number() })),
+    lock: done,
+    list: answer(z.object({ entries: z.array(EntryInfoSchema), backends: z.array(z.enum(["1password", "bitwarden", "keepassxc"])) })),
+    add: done,
+    edit: done,
+    remove: done,
+    share: answer(z.object({ fingerprint: z.string().describe("The sandbox's signing key's fingerprint, as the prompt showed it.") })),
+    unshare: done,
+    backend: done,
+    shares: answer(z.object({ pointers: z.array(KeyringPointerSchema) })),
+    release: KeyringReleaseResultSchema,
+    type: KeyringTypeResultSchema,
+    inbox: KeyringInboxResultSchema,
+    copies: answer(KeyringCopiesSchema),
+    "sync-state": answer(z.object({ sync: KeyringSyncStateSchema })),
+    "sync-pair": KeyringSyncPairResultSchema,
+    "sync-outbox": answer(KeyringSyncOutboxSchema),
+    "sync-deliver": answer(KeyringSyncDeliverResultSchema),
+    askpass: answer(z.object({ value: z.string() })),
+    "consent-upgrade": done,
+};
+export const KEYRING_LINE_MAX = 256 * 1024;
+//# sourceMappingURL=protocol.js.map

package/dist/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../src/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACH,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EACxB,0BAA0B,EAC1B,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,GAC3B,MAAM,4CAA4C,CAAC;AAQpD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC;AACpC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAI/C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,wCAAwC,CAAC;KAC/C,QAAQ,CAAC,iIAAiI,CAAC,CAAC;AAEjJ,MAAM,UAAU,GAAG;IACf,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACjE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sFAAsF,CAAC;IACzI,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC;IAGhE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC;AAGF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC5D,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,8CAA8C,CAAC,EAAE,CAAC;IACrJ,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,8BAA8B,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IACrM,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,kDAAkD,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;CACzM,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,EAAE,UAAU;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4DAA4D,CAAC;IAC1F,IAAI,EAAE,sBAAsB;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,uBAAuB;IAC7B,GAAG,UAAU;IACb,MAAM,EAAE,mBAAmB;IAC3B,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACpC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAErD,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;AAKpE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACvB,MAAM,CAAC;IACJ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAGtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,uEAAuE,CAAC;CACvG,CAAC;KACD,MAAM,EAAE,CAAC;AAEd,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE;IAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,uBAAuB,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yGAAyG,CAAC,EAAE,CAAC;IACzS,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,uBAAuB,CAAC,QAAQ,CAAC,kDAAkD,CAAC,EAAE,CAAC;IACjM,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC;CACnO,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IAC3D,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7C,WAAW;IACX,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACrG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAE5C,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAG5C,CAAC;SACI,MAAM,CAAC;QACJ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE;QAClC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;QACpC,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC;SACD,MAAM,EAAE;IACb,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,eAAe,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACxI,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7E,CAAC;SACI,MAAM,CAAC;QACJ,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACtB,IAAI,EAAE,uBAAuB;QAC7B,OAAO,EAAE,UAAU;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACnC,IAAI,EAAE,sBAAsB;KAC/B,CAAC;SACD,MAAM,EAAE;IACb,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACnG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE;IAG5E,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACnE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3E,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACnE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAClD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9E,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnD,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE;IAEvF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAErH,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9F,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAGrH,MAAM,MAAM,GAAG,CAAuC,OAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;AAC5K,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAGlC,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1E,KAAK,EAAE,IAAI;IACX,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjI,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC,EAAE,CAAC,CAAC;IAClI,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,0BAA0B;IACnC,IAAI,EAAE,uBAAuB;IAC7B,KAAK,EAAE,wBAAwB;IAC/B,MAAM,EAAE,MAAM,CAAC,mBAAmB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAChE,WAAW,EAAE,2BAA2B;IACxC,aAAa,EAAE,MAAM,CAAC,uBAAuB,CAAC;IAC9C,cAAc,EAAE,MAAM,CAAC,8BAA8B,CAAC;IACtD,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,iBAAiB,EAAE,IAAI;CACkC,CAAC;AAK9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC"}

package/dist/run.d.ts

@@ -0,0 +1,20 @@
+export interface RunRequest {
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly input?: string;
+    readonly env?: Readonly<Record<string, string>>;
+    readonly timeoutMs: number;
+}
+export interface RunAnswer {
+    readonly exitCode: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly timedOut: boolean;
+    readonly missing: boolean;
+    readonly startError: string | undefined;
+}
+export type Runner = (request: RunRequest) => Promise<RunAnswer>;
+export declare const realRunner: Runner;
+export declare const succeeded: (answer: RunAnswer) => boolean;
+export declare const firstLineScrubbed: (text: string, secrets: readonly string[]) => string;
+//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IAEjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;AAKjE,eAAO,MAAM,UAAU,EAAE,MAexB,CAAC;AAGF,eAAO,MAAM,SAAS,WAAY,SAAS,KAAG,OAAuF,CAAC;AAItI,eAAO,MAAM,iBAAiB,SAAU,MAAM,WAAW,SAAS,MAAM,EAAE,KAAG,MAa5E,CAAC"}

package/dist/run.js

@@ -0,0 +1,34 @@
+import { errnoCode } from "@intentic/base/errors";
+import { runBounded } from "@intentic/base/process";
+const MAX_OUTPUT = 1024 * 1024;
+export const realRunner = async (request) => {
+    const result = await runBounded(request.command, request.args, {
+        input: request.input,
+        env: request.env === undefined ? undefined : { ...process.env, ...request.env },
+        timeoutMs: request.timeoutMs,
+        maxOutput: MAX_OUTPUT,
+    });
+    return {
+        exitCode: result.exitCode,
+        stdout: result.stdout.text,
+        stderr: result.stderr.text,
+        timedOut: result.timedOut,
+        missing: result.spawnError !== undefined && errnoCode(result.spawnError) === "ENOENT",
+        startError: result.spawnError?.message,
+    };
+};
+export const succeeded = (answer) => answer.exitCode === 0 && !answer.timedOut && answer.startError === undefined;
+export const firstLineScrubbed = (text, secrets) => {
+    let line = text.split(/\r?\n/u).find((candidate) => candidate.trim() !== "") ?? "";
+    for (const secret of secrets.filter((candidate) => candidate !== "")) {
+        if (line.includes(secret)) {
+            if (secret.length < 4) {
+                return "(its message is not shown: it may hold what it was given)";
+            }
+            line = line.split(secret).join("…");
+        }
+    }
+    line = line.trim();
+    return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+};
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAiCpD,MAAM,UAAU,GAAG,IAAI,GAAG,IAAI,CAAC;AAE/B,MAAM,CAAC,MAAM,UAAU,GAAW,KAAK,EAAE,OAAO,EAAE,EAAE;IAChD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;QAC3D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,GAAG,EAAE,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE;QAC/E,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,UAAU;KACxB,CAAC,CAAC;IACH,OAAO;QACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;QAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,QAAQ;QACrF,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO;KACzC,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAiB,EAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC;AAItI,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,OAA0B,EAAU,EAAE;IAClF,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;IACnF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,EAAE,CAAC;QACnE,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAExB,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,OAAO,2DAA2D,CAAC;YACvE,CAAC;YACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC,CAAC"}

package/dist/seal.d.ts

@@ -0,0 +1,3 @@
+import type { SealedBox } from "@intentic/sandbox-contract/schemas/keyring";
+export declare const sealForKeyring: (inboxKey: string, name: string, value: string) => SealedBox;
+//# sourceMappingURL=seal.d.ts.map

package/dist/seal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.d.ts","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4CAA4C,CAAC;AAM5E,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,SAAS,MAAM,KAAG,SAAqF,CAAC"}

package/dist/seal.js

@@ -0,0 +1,3 @@
+import { seal } from "@intentic/sandbox-contract/keyring-seal";
+export const sealForKeyring = (inboxKey, name, value) => seal(inboxKey, value, { kind: "inbox", sandbox: "local", secret: name });
+//# sourceMappingURL=seal.js.map

package/dist/seal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seal.js","sourceRoot":"","sources":["../src/seal.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,yCAAyC,CAAC;AAK/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAgB,EAAE,IAAY,EAAE,KAAa,EAAa,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC"}

package/dist/serve.d.ts

@@ -0,0 +1,17 @@
+import type { Server } from "node:net";
+import { type KeyringPaths } from "./address.js";
+import { type Consent } from "./consent/consent.js";
+import { Keyring } from "./core.js";
+import { type Runner } from "./run.js";
+export declare const platformConsent: (runner: Runner, platform?: NodeJS.Platform) => Consent;
+export declare const keyringOf: (paths: KeyringPaths, runner?: Runner) => Keyring;
+export type Served = {
+    readonly ok: true;
+    readonly server: Server;
+    readonly stop: () => Promise<void>;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+export declare const serve: (paths?: KeyringPaths) => Promise<Served>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAGvC,OAAO,EAAE,KAAK,YAAY,EAAyB,MAAM,cAAc,CAAC;AAGxE,OAAO,EAAE,KAAK,OAAO,EAAmE,MAAM,sBAAsB,CAAC;AAGrH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AASnD,eAAO,MAAM,eAAe,WAAY,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAW9F,CAAC;AAEF,eAAO,MAAM,SAAS,UAAW,YAAY,WAAU,MAAM,KAAgB,OAavE,CAAC;AAWP,MAAM,MAAM,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1J,eAAO,MAAM,KAAK,WAAiB,YAAY,KAAoB,OAAO,CAAC,MAAM,CAgBhF,CAAC"}

package/dist/serve.js

@@ -0,0 +1,65 @@
+import { appendFile } from "node:fs/promises";
+import { sleep } from "@intentic/base/async";
+import { claimPidFile, releasePidFile, rotateIfLarge } from "@intentic/local-agent";
+import { keyringPaths, userTag } from "./address.js";
+import { fileAudit } from "./audit.js";
+import { BackendReader } from "./backends.js";
+import { helloConsent, passphraseConsent, refusingConsent, serialConsent } from "./consent/consent.js";
+import { linuxPassphrasePrompt, macPassphrasePrompt } from "./consent/consent-posix.js";
+import { windowsHello, windowsPassphrasePrompt } from "./consent/consent-windows.js";
+import { Keyring } from "./core.js";
+import { fetchSandboxKeys } from "./keyring-fetch.js";
+import { loadKeys, saveKeys } from "./keys.js";
+import { realRunner } from "./run.js";
+import { serveKeyring } from "./server.js";
+import { platformTypist } from "./typing/index.js";
+import { readVaultFile, writeVaultFile } from "./vault.js";
+import { KEYRING_VERSION } from "./version.js";
+export const platformConsent = (runner, platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            return serialConsent(helloConsent(windowsHello(runner), passphraseConsent(windowsPassphrasePrompt(runner))));
+        case "linux":
+            return serialConsent(passphraseConsent(linuxPassphrasePrompt(runner)));
+        case "darwin":
+            return serialConsent(passphraseConsent(macPassphrasePrompt(runner)));
+        default:
+            return refusingConsent(`the keyring cannot ask a person on ${platform}.`);
+    }
+};
+export const keyringOf = (paths, runner = realRunner) => new Keyring({
+    vault: { read: async () => await readVaultFile(paths.vault), write: async (file) => await writeVaultFile(paths.vault, paths.dir, file) },
+    keys: { read: async () => await loadKeys(paths.keys, paths.dir), write: async (keys) => await saveKeys(paths.keys, paths.dir, keys) },
+    consent: platformConsent(runner),
+    typist: platformTypist(runner),
+    backends: new BackendReader(runner),
+    fetchKeys: async (sandbox) => await fetchSandboxKeys(sandbox),
+    audit: fileAudit(paths.audit, paths.dir),
+    now: Date.now,
+    sleep: async (ms) => await sleep(ms),
+    version: KEYRING_VERSION,
+    helloCredential: `intentic-keyring-${userTag()}`,
+});
+const logTo = (path) => (message) => {
+    void rotateIfLarge(path)
+        .then(async () => await appendFile(path, `${new Date().toISOString()} ${message}\n`, { mode: 0o600 }))
+        .catch(() => undefined);
+};
+export const serve = async (paths = keyringPaths()) => {
+    const claim = await claimPidFile(paths.pid, paths.dir, { pid: process.pid, build: KEYRING_VERSION });
+    if (!claim.claimed) {
+        return { ok: false, reason: `A keyring is running already (pid ${String(claim.holder.pid)}).` };
+    }
+    const log = logTo(paths.log);
+    const server = await serveKeyring(keyringOf(paths), paths.address, log);
+    log(`keyring ${KEYRING_VERSION} listening`);
+    return {
+        ok: true,
+        server,
+        stop: async () => {
+            await new Promise((resolve) => server.close(() => resolve()));
+            await releasePidFile(paths.pid, process.pid);
+        },
+    };
+};
+//# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAqB,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAgB,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrH,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAe,MAAM,UAAU,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAK/C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAW,EAAE;IACrG,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,OAAO,aAAa,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,KAAK,OAAO;YACR,OAAO,aAAa,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3E,KAAK,QAAQ;YACT,OAAO,aAAa,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzE;YACI,OAAO,eAAe,CAAC,sCAAsC,QAAQ,GAAG,CAAC,CAAC;IAClF,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,MAAM,GAAW,UAAU,EAAW,EAAE,CACnF,IAAI,OAAO,CAAC;IACR,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;IACxI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;IACrI,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC;IAChC,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC;IAC7D,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;IACxC,GAAG,EAAE,IAAI,CAAC,GAAG;IACb,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;IACpC,OAAO,EAAE,eAAe;IACxB,eAAe,EAAE,oBAAoB,OAAO,EAAE,EAAE;CACnD,CAAC,CAAC;AAEP,MAAM,KAAK,GACP,CAAC,IAAY,EAAE,EAAE,CACjB,CAAC,OAAe,EAAQ,EAAE;IACtB,KAAK,aAAa,CAAC,IAAI,CAAC;SACnB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,OAAO,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SAErG,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAChC,CAAC,CAAC;AAIN,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAK,GAAiB,YAAY,EAAE,EAAmB,EAAE;IACjF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxE,GAAG,CAAC,WAAW,eAAe,YAAY,CAAC,CAAC;IAC5C,OAAO;QACH,EAAE,EAAE,IAAI;QACR,MAAM;QACN,IAAI,EAAE,KAAK,IAAI,EAAE;YACb,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpE,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACjD,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,9 @@
+import { type Server } from "node:net";
+import { type KeyringOp, type KeyringRequest, type KeyringResponse } from "./protocol.js";
+export interface KeyringHandler {
+    readonly handle: (request: KeyringRequest) => Promise<KeyringResponse<KeyringOp>>;
+}
+export type ServerLog = (message: string) => void;
+export declare const answerRequestLine: (handler: KeyringHandler, line: string, log: ServerLog) => Promise<string>;
+export declare const serveKeyring: (handler: KeyringHandler, address: string, log: ServerLog, platform?: NodeJS.Platform) => Promise<Server>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAe,MAAM,UAAU,CAAC;AAClE,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,cAAc,EAAwB,KAAK,eAAe,EAAgB,MAAM,eAAe,CAAC;AAMhJ,MAAM,WAAW,cAAc;IAC3B,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;CACrF;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;AA6ClD,eAAO,MAAM,iBAAiB,YAAmB,cAAc,QAAQ,MAAM,OAAO,SAAS,KAAG,OAAO,CAAC,MAAM,CAkB7G,CAAC;AAIF,eAAO,MAAM,YAAY,YAAmB,cAAc,WAAW,MAAM,OAAO,SAAS,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,MAAM,CAgBzJ,CAAC"}

package/dist/server.js

@@ -0,0 +1,77 @@
+import { chmod, rm } from "node:fs/promises";
+import { createServer } from "node:net";
+import { KEYRING_LINE_MAX, KeyringRequestSchema } from "./protocol.js";
+const REQUEST_DEADLINE_MS = 10_000;
+const answerLine = (answer) => `${JSON.stringify(answer)}\n`;
+const failed = (refusal) => answerLine({ ok: false, code: "unavailable", refusal });
+const serveConnection = (handler, socket, log) => {
+    let buffered = "";
+    let answered = false;
+    socket.setEncoding("utf8");
+    const deadline = setTimeout(() => socket.destroy(), REQUEST_DEADLINE_MS);
+    const reply = (line) => {
+        answered = true;
+        clearTimeout(deadline);
+        socket.end(line);
+    };
+    socket.on("data", (chunk) => {
+        if (answered) {
+            return;
+        }
+        buffered += chunk;
+        if (buffered.length > KEYRING_LINE_MAX) {
+            reply(failed("That request is longer than any the keyring reads."));
+            return;
+        }
+        const end = buffered.indexOf("\n");
+        if (end === -1) {
+            return;
+        }
+        clearTimeout(deadline);
+        answered = true;
+        void answerRequestLine(handler, buffered.slice(0, end), log).then((line) => {
+            if (!socket.destroyed) {
+                socket.end(line);
+            }
+        });
+    });
+    socket.on("error", () => socket.destroy());
+};
+export const answerRequestLine = async (handler, line, log) => {
+    let json;
+    try {
+        json = JSON.parse(line);
+    }
+    catch {
+        return answerLine({ ok: false, code: "bad-grant", refusal: "The keyring reads one JSON request per line." });
+    }
+    const request = KeyringRequestSchema.safeParse(json);
+    if (!request.success) {
+        return answerLine({ ok: false, code: "bad-grant", refusal: "That is not a request this keyring reads: is the caller a different version?" });
+    }
+    try {
+        return answerLine(await handler.handle(request.data));
+    }
+    catch (error) {
+        log(`${request.data.op} failed: ${error instanceof Error ? error.message : "unknown error"}`);
+        return failed(`The keyring could not answer ${request.data.op}: see ~/.intentic/keyring/keyring.log.`);
+    }
+};
+export const serveKeyring = async (handler, address, log, platform = process.platform) => {
+    if (platform !== "win32") {
+        await rm(address, { force: true });
+    }
+    const server = createServer((socket) => serveConnection(handler, socket, log));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(address, () => {
+            server.off("error", reject);
+            resolve();
+        });
+    });
+    if (platform !== "win32") {
+        await chmod(address, 0o600);
+    }
+    return server;
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAA4B,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAuC,oBAAoB,EAAsC,MAAM,eAAe,CAAC;AAahJ,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,UAAU,GAAG,CAAC,MAA4C,EAAU,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;AAE3G,MAAM,MAAM,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;AAEpG,MAAM,eAAe,GAAG,CAAC,OAAuB,EAAE,MAAc,EAAE,GAAc,EAAQ,EAAE;IACtF,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,QAAQ,GAAG,IAAI,CAAC;QAChB,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAChC,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO;QACX,CAAC;QACD,QAAQ,IAAI,KAAK,CAAC;QAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACrC,KAAK,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC,CAAC;YACpE,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACb,OAAO;QACX,CAAC;QAED,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACvE,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/C,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,OAAuB,EAAE,IAAY,EAAE,GAAc,EAAmB,EAAE;IAC9G,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,UAAU,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;IACjJ,CAAC;IACD,IAAI,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEb,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAC9F,OAAO,MAAM,CAAC,gCAAgC,OAAO,CAAC,IAAI,CAAC,EAAE,wCAAwC,CAAC,CAAC;IAC3G,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,OAAuB,EAAE,OAAe,EAAE,GAAc,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAmB,EAAE;IAC1J,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/E,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,OAAO,EAAE,CAAC;QACd,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/service/acl.d.ts

@@ -0,0 +1,9 @@
+import { type HardenedPaths } from "./paths.js";
+export interface IcaclsCall {
+    readonly path: string;
+    readonly args: readonly string[];
+}
+export declare const hardenedAcls: (paths: HardenedPaths) => readonly IcaclsCall[];
+export declare const doorAcl: (door: string, userSid: string) => IcaclsCall;
+export declare const markerAcl: (marker: string) => IcaclsCall;
+//# sourceMappingURL=acl.d.ts.map

package/dist/service/acl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../../src/service/acl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,aAAa,EAA4C,MAAM,YAAY,CAAC;AAO9G,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,YAAY,UAAW,aAAa,KAAG,SAAS,UAAU,EAiBtE,CAAC;AAGF,eAAO,MAAM,OAAO,SAAU,MAAM,WAAW,MAAM,KAAG,UAGtD,CAAC;AAGH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,UAGzC,CAAC"}

package/dist/service/acl.js

@@ -0,0 +1,25 @@
+import { ADMINISTRATORS_SID, LOCAL_SERVICE_SID, SYSTEM_SID, USERS_SID } from "./paths.js";
+const grant = (sid, rights) => `*${sid}:${rights}`;
+export const hardenedAcls = (paths) => [
+    {
+        path: paths.root,
+        args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "(OI)(CI)F"), grant(ADMINISTRATORS_SID, "(OI)(CI)F"), grant(LOCAL_SERVICE_SID, "(M)"), grant(USERS_SID, "(RX)")],
+    },
+    {
+        path: paths.bin,
+        args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "(OI)(CI)F"), grant(ADMINISTRATORS_SID, "(OI)(CI)F"), grant(LOCAL_SERVICE_SID, "(OI)(CI)RX"), grant(USERS_SID, "(OI)(CI)RX")],
+    },
+    {
+        path: paths.vaultDir,
+        args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "(OI)(CI)F"), grant(ADMINISTRATORS_SID, "(OI)(CI)F"), grant(LOCAL_SERVICE_SID, "(OI)(CI)F")],
+    },
+];
+export const doorAcl = (door, userSid) => ({
+    path: door,
+    args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "F"), grant(ADMINISTRATORS_SID, "F"), grant(LOCAL_SERVICE_SID, "F"), grant(userSid, "R")],
+});
+export const markerAcl = (marker) => ({
+    path: marker,
+    args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "F"), grant(ADMINISTRATORS_SID, "F"), grant(USERS_SID, "R")],
+});
+//# sourceMappingURL=acl.js.map

package/dist/service/acl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl.js","sourceRoot":"","sources":["../../src/service/acl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAsB,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAK9G,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE,CAAC,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;AAO3E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,KAAoB,EAAyB,EAAE,CAAC;IAGzE;QACI,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;KAC1K;IAED;QACI,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;KACvL;IAED;QACI,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;KACtJ;CACJ,CAAC;AAGF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAAe,EAAc,EAAE,CAAC,CAAC;IACnE,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;CACnJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;CACtH,CAAC,CAAC"}

package/dist/service/channel.d.ts

@@ -0,0 +1,17 @@
+import { type Server } from "node:net";
+import { type KeyringHandler, type ServerLog } from "../server.js";
+import { type Challenge, type Proof } from "./door.js";
+import type { HelperLink } from "./remote.js";
+export interface DoorDeps {
+    readonly handler: KeyringHandler;
+    readonly link: HelperLink;
+    readonly token: string;
+    readonly challenge: () => Promise<Challenge>;
+    readonly proven: (challenge: Challenge, proof: Proof) => Promise<boolean>;
+    readonly log: ServerLog;
+}
+export declare const serveDoor: (deps: DoorDeps) => Promise<{
+    readonly server: Server;
+    readonly port: number;
+}>;
+//# sourceMappingURL=channel.d.ts.map

package/dist/service/channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.d.ts","sourceRoot":"","sources":["../../src/service/channel.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,EAAE,KAAK,SAAS,EAAkC,KAAK,KAAK,EAAe,MAAM,WAAW,CAAC;AAEpG,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAY9C,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;IAE7C,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1E,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;CAC3B;AAuBD,eAAO,MAAM,SAAS,SAAgB,QAAQ,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkC1G,CAAC"}

package/dist/service/channel.js

@@ -0,0 +1,64 @@
+import { timingSafeEqual } from "node:crypto";
+import { createServer } from "node:net";
+import { z } from "zod";
+import { answerRequestLine } from "../server.js";
+import { ChallengeSchema, OpeningSchema, ProofSchema } from "./door.js";
+import { LineSocket } from "./lines.js";
+const OPENING_DEADLINE_MS = 10_000;
+const ListeningSchema = z.object({ port: z.number().int().positive() });
+const PROOF_DEADLINE_MS = 180_000;
+const sameToken = (given, token) => {
+    const a = Buffer.from(given, "utf8");
+    const b = Buffer.from(token, "utf8");
+    return a.length === b.length && timingSafeEqual(a, b);
+};
+const welcomeHelper = async (deps, lines) => {
+    const challenge = ChallengeSchema.parse(await deps.challenge());
+    lines.send(challenge);
+    const proof = await lines.nextOf(ProofSchema, PROOF_DEADLINE_MS);
+    if (proof === undefined || proof.method === "declined" || !(await deps.proven(challenge, proof))) {
+        lines.send({ ok: false, reason: "That did not prove a person at this computer." });
+        lines.end();
+        deps.log("a session helper's proof was refused");
+        return;
+    }
+    lines.send({ ok: true });
+    deps.link.attach(lines);
+    deps.log("a session helper is connected");
+};
+export const serveDoor = async (deps) => {
+    const server = createServer((socket) => {
+        const lines = new LineSocket(socket);
+        void (async () => {
+            const opening = await lines.nextOf(OpeningSchema, OPENING_DEADLINE_MS);
+            if (opening === undefined || !sameToken(opening.door, deps.token)) {
+                socket.destroy();
+                return;
+            }
+            if (opening.as === "helper") {
+                await welcomeHelper(deps, lines);
+                return;
+            }
+            const request = await lines.next(OPENING_DEADLINE_MS);
+            if (request === undefined) {
+                socket.destroy();
+                return;
+            }
+            socket.end(await answerRequestLine(deps.handler, request, deps.log));
+        })();
+    });
+    const port = await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
+            server.off("error", reject);
+            const address = ListeningSchema.safeParse(server.address());
+            if (!address.success) {
+                reject(new Error("the door did not open on a TCP port"));
+                return;
+            }
+            resolve(address.data.port);
+        });
+    });
+    return { server, port };
+};
+//# sourceMappingURL=channel.js.map

package/dist/service/channel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel.js","sourceRoot":"","sources":["../../src/service/channel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAe,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAuC,MAAM,cAAc,CAAC;AACtF,OAAO,EAAkB,eAAe,EAAE,aAAa,EAAc,WAAW,EAAE,MAAM,WAAW,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAOxC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAExE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAalC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,KAAa,EAAW,EAAE;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,IAAc,EAAE,KAAiB,EAAiB,EAAE;IAC7E,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC,CAAC;QACnF,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO;IACX,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;AAC9C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,IAAc,EAA+D,EAAE;IAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,CAAC,KAAK,IAAI,EAAE;YACb,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;YACvE,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACX,CAAC;YACD,IAAI,OAAO,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACjC,OAAO;YACX,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YACtD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,OAAO;YACX,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE;YAChE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC5B,MAAM,OAAO,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;gBACzD,OAAO;YACX,CAAC;YACD,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC,CAAC"}