@intentic/keyring 1.343.0 → 1.345.0

package/README.md

@@ -1,16 +1,17 @@
 # keyring
 
-`intentic-keyring`, the password vault on a user's own computer: a process of its own beside
+`intentic-keyring`, the password vault behind Passwords on a user's own computer: a protected service of its own beside
 [intentic-machine](../machine) that types a secret into a window, answers an ssh or sudo prompt, or hands a value to a
 sandbox for one use, without the sandbox's agent ever holding the value.
 
 ```mermaid
 flowchart LR
     sb["Sandbox daemon<br/>signs grants"] -->|"keyring* procedures<br/>over the device link"| m["intentic-machine<br/>relays, reads nothing"]
-    m -->|"local pipe"| k(["intentic-keyring<br/>vault · consent · typing"])
-    k -->|"checks window, types"| app["FortiClient, RDP,<br/>any native app"]
+    m -->|"local pipe"| h["session helper<br/>prompts · typing · chip"]
+    h -->|"the door"| k(["protected service<br/>vault · consent"])
+    h -->|"checks window, types"| app["FortiClient, RDP,<br/>any native app"]
     k -->|"adb"| phone["Android app"]
-    ssh["ssh · sudo · git"] --> ap["intentic-askpass"] -->|"local pipe"| k
+    ssh["ssh · sudo · git"] --> ap["intentic-askpass"] -->|"local pipe"| h
     k -->|"sealed to the sandbox"| m
     k <-->|"sealed to each other,<br/>through a sandbox"| k2(["keyring on another<br/>of the owner's computers"])
 ```
@@ -21,7 +22,10 @@ intentic-machine is the agent's hands on the computer: it runs the agent's `run_
 key kept in its memory would be one bug in its scope checks away from the agent, and it updates itself on a timer at a
 sandbox maintainer's word. The keyring does only what a vault does, updates only when a person says so
 (`intentic-machine keyring upgrade` asks the running keyring, which asks the person), and trusts no caller on its pipe
-for who it is. Every caller is a process of the same user, so the pipe is not the boundary; three things are:
+for who it is. The vault itself is held by a service running as a system account of its own, so no process of the user,
+the agent's own commands included, can read the vault file or the memory that holds its key (see "The protected
+service" below). Every caller on the pipe is a process of the same user, so the pipe is not the boundary; three things
+are:
 
 - **A grant the sandbox signed.** A release or a typing for a sandbox carries a grant (`@intentic/sandbox-contract`
   `schemas/keyring.ts`), Ed25519-signed by that sandbox's own key, which the keyring fetched over TLS from the
@@ -29,8 +33,9 @@ for who it is. Every caller is a process of the same user, so the pipe is not th
   names one secret, one target and one nonce, and lives two minutes. The agent's own commands on this computer can
   reach the pipe but cannot sign one.
 - **A person at this computer.** Anything that changes the vault, takes a value in, hands one to a local program
-  (askpass), or answers an `each-use` share asks: Windows Hello where the computer has it, the keyring's passphrase
-  otherwise. Every prompt says what is asked for, by whom, and where it goes.
+  (askpass), or answers an `each-use` share asks: a Windows Hello signature checked by the service against the key it
+  pinned at setup on Windows, a polkit check the service runs itself on Linux, and the recovery key where neither can
+  answer. Every prompt says what is asked for, by whom, and where it goes.
 - **The window it lands in.** Typing checks the focused window's program against the entry's list and, for a password,
   that the focused field is a password field. A value is never typed into a field that would echo it back to a
   screenshot unless the entry says `anyField`.
@@ -44,34 +49,39 @@ Each entry is shared with each sandbox on its own terms:
 | Mode | The sandbox gets a value when… | Works with the computer off |
 | --- | --- | --- |
 | `each-use` | the person at this computer says yes, each time | no |
-| `while-here` | the keyring is unlocked: one Hello tap or passphrase opens it for up to the minutes chosen | no |
+| `while-here` | the keyring is unlocked: one Hello tap or polkit yes opens it for up to the minutes chosen | no |
 | `copy` | always: a copy, sealed to that sandbox, kept there as an ordinary secret and refreshed when the entry changes | yes |
 
 `copy` is the explicit downgrade: the value then lives in the sandbox and its guards are the sandbox's.
 
 ## Files
 
-Under `~/.intentic/keyring` (0700, its files 0600):
+In the service's own folder (`%ProgramData%\Intentic\Keyring\<SID>` on Windows, `/var/lib/intentic-keyring/<uid>` on
+Linux), readable by the service's account and an administrator only:
 
 - `vault.json`: the entries, sealed under the vault key (AES-256-GCM), and the vault key wrapped once per way of
-  unlocking: by a key derived from the passphrase (scrypt), and on Windows by a key derived from a Windows Hello
-  signature over a fixed challenge (KeyCredentialManager signs with an RSA key in the TPM; PKCS#1 v1.5 signatures are
-  deterministic, so the same challenge gives the same key, and only a Hello gesture produces one). The inbox and sync
-  private keys live inside the sealed part.
+  unlocking: by a key scrypt derives from the recovery key; on Windows by a key derived from a Windows Hello signature
+  over a fixed challenge (KeyCredentialManager signs with an RSA key in the TPM; PKCS#1 v1.5 signatures are
+  deterministic, so the same challenge gives the same key, and only a Hello gesture produces one); on Linux by the
+  service's own key (`service-key.json`). The inbox and sync private keys live inside the sealed part.
 - `keys.json`: what the keyring needs while locked: its `seal` key pair (for values sent to it to type) and each
   sandbox's pinned keys.
 - `audit.jsonl`: one line per decision (who asked, for what, the answer), never a value.
-- `keyring.log`, `keyring.pid`.
+- `keyring.log`.
+
+`~/.intentic/keyring` (0700) keeps the session helper's pid file and the user's pipe. A vault left there by the per-user
+keyring from before is moved into the service's folder by `service install`, and put back there by `service uninstall`.
 
 ## The pipe
 
-A named pipe on Windows (`\\.\pipe\intentic-keyring-<user hash>`), a unix socket in the keyring's directory elsewhere.
-One JSON line in, one out (`src/protocol.ts`). A value sent in from this computer (`intentic-machine keyring add`, the
+A named pipe on Windows (`\\.\pipe\intentic-keyring-<user hash>`), a unix socket in `~/.intentic/keyring` elsewhere,
+answered by the session helper, which carries each request through the service's door. One JSON line in, one out
+(`src/protocol.ts`). A value sent in from this computer (`intentic-machine keyring add`, the
 desktop app) is sealed to the vault's inbox key first, so a process squatting the pipe holds only ciphertext.
 
 ## Typing
 
-On Windows the keyring inspects the foreground window (its process's executable, and through UI Automation whether the
+Typing is the session helper's, the service's hands in the person's session. On Windows it inspects the foreground window (its process's executable, and through UI Automation whether the
 focused element is a password field) and types with `SendInput` Unicode events, never `SendKeys`: the value goes to a
 PowerShell helper on its standard input, never on a command line another process could read. It checks the
 foreground window again after typing and says so if it changed. On Linux it types with `xdotool type --file -` or
@@ -102,36 +112,122 @@ computer, each prompt showing both sync-key fingerprints to compare. After that
 sync key and left in a sandbox both are linked to, which carries ciphertext only; the other takes it in at its next
 unlock. The newer revision of an entry wins.
 
-## Hardened mode (Windows)
-
-`intentic-machine keyring harden` (one UAC prompt) moves the vault out of the user's reach:
-
-- The vault, its keys and its audit move to `%ProgramData%\Intentic\Keyring\<user SID>`, whose access list names only
-  `LOCAL SERVICE`, SYSTEM and an elevated administrator. No process of the user, the agent's `run_command` included,
-  can read the file or the memory of the process that holds it.
-- That process is the keyring itself, run by a startup task (`\Intentic\Keyring-<SID>`) as `LOCAL SERVICE` from its
-  own copy in `%ProgramData%\Intentic\Keyring\bin`, which only an administrator can replace. A task and not a Windows
-  service because a compiled script cannot answer the service manager's start handshake (`src/service/task.ts`).
-- A pipe the service created would refuse the user's writes, so it listens on loopback and writes its port and a random
-  token to a door file only that user can read (`src/service/door.ts`). The token keeps other users out; it does not keep
-  out the user's own programs, which is why every value still needs a sandbox's grant or a person's yes.
-- The session helper, `intentic-keyring session`, starts at sign-in in place of `serve`. It answers the user's usual pipe
-  by carrying each request through the door, so intentic-machine and intentic-askpass work unchanged, and it is the
-  service's hands: it shows the prompts and does the typing. It proves itself once per sign-in with a Windows Hello
-  signature over the service's challenge (or the passphrase), and every yes it relays afterwards is a Hello signature
-  over a fresh challenge, checked by the service against the Hello key pinned at setup (`src/service/hello-verify.ts`),
-  so a helper the agent started cannot say yes for the person.
-
-What it does not cover: a value being typed passes through the helper, a process of the user, for that moment. Every
-other value, the vault key and the vault itself stay with the service.
+## The protected service
+
+There is one mode (2026-10-19; before it the vault was held by `intentic-keyring serve`, a process of the user, and
+the service below was an optional "hardened mode" on Windows). `intentic-machine keyring setup` asks for an
+administrator's yes once (UAC on Windows, `pkexec` on Linux) to run `intentic-keyring service install`, then starts the
+session helper and sets the vault up. Setup refuses on macOS ("Passwords needs the Intentic desktop app's protected
+service, which is not on macOS yet."), and on a Linux without systemd, polkit or setfacl, saying which.
+
+Two processes share the work (`src/service/`):
+
+- **The service** holds the vault and its key and decides every request (`service run --user <id>`). It cannot reach
+  the person's desktop, so it never shows a prompt or types itself.
+- **The session helper**, `intentic-keyring session`, starts at sign-in from the login entry intentic-machine registers.
+  It answers the user's usual pipe by carrying each request through the service's door (`src/service/door.ts`), so
+  intentic-machine and intentic-askpass work as they did, and it is the service's hands: it shows the prompts and the
+  type-once box and does the typing. It proves a person is at the session once per sign-in before the service sends it
+  anything; before setup there is no vault and nothing to prove with, so it is let in to enrol Windows Hello, and only
+  while no vault exists.
+- **The door** is a loopback port on Windows (a pipe the service created would refuse the user's writes) and a unix
+  socket on Linux, beside a random token in a door file only that user can read. The token keeps other users out; it
+  does not keep out the user's own programs, which is why every value still needs a sandbox's grant or a person's yes.
+
+### Windows
+
+- The vault, its keys and its audit live in `%ProgramData%\Intentic\Keyring\<user SID>`, whose access list names only
+  `LOCAL SERVICE`, SYSTEM and an elevated administrator.
+- The service is the keyring run by a startup task (`\Intentic\Keyring-<SID>`) as `LOCAL SERVICE` from its own copy in
+  `%ProgramData%\Intentic\Keyring\bin`, which only an administrator can replace. A task and not a Windows service
+  because a compiled script cannot answer the service manager's start handshake (`src/service/windows/task-windows.ts`).
+- The helper proves itself with a Windows Hello signature over the service's challenge, and every yes it relays is a
+  Hello signature over a fresh challenge, checked by the service against the Hello key pinned at setup
+  (`src/service/hello-verify.ts`), so a helper the agent started cannot say yes for the person. Unlocking is a Hello
+  tap; the recovery key opens the vault when Hello is reset.
+- The marker `%ProgramData%\Intentic\Keyring\<SID>.hardened` says the service is installed for that user. The name is
+  from hardened mode, kept so a PC set up before still reads as set up.
+
+### Linux
+
+- `service install`, run as root by pkexec for the user pkexec names (`PKEXEC_UID`), makes the `intentic-keyring` system
+  user, copies the program to `/usr/lib/intentic-keyring/intentic-keyring` (root's), writes the templated unit
+  `/etc/systemd/system/intentic-keyring@.service` and the polkit action
+  `/usr/share/polkit-1/actions/dev.intentic.keyring.policy`, moves a per-user vault from before, writes the marker
+  `/var/lib/intentic-keyring/<uid>.installed`, and enables `intentic-keyring@<uid>.service` (`src/service/linux/install-linux.ts`,
+  `unit-linux.ts`).
+- systemd runs the instance as `intentic-keyring` with the vault in `/var/lib/intentic-keyring/<uid>` (StateDirectory,
+  0700) and the door in `/run/intentic-keyring/<uid>` (RuntimeDirectory, 0700), which the service opens to that one uid
+  with setfacl: the folder may be entered, the socket written, the token read (`src/service/linux/service-run-linux.ts`).
+- Node cannot read a unix socket's peer credentials, so the helper names its pid; the service checks that the pid is a
+  live process of that uid (`/proc`) and runs `pkcheck --action-id dev.intentic.keyring.consent --process
+  <pid>,<start time>,<uid> --allow-user-interaction` itself. polkit's agent in that session asks for the person's own
+  password (`auth_self`, never kept), and the answer comes back to the service, not through the helper
+  (`src/service/linux/polkit-linux.ts`). The action's `org.freedesktop.policykit.owner` annotation is what lets the service's
+  user ask about another user's process. Every later yes is the same check, its dialog naming what is asked.
+- A daily unlock is that yes: the vault key is wrapped once more under a random key in `service-key.json`, which only the
+  service's user reads (`src/service/service-key.ts`). A vault moved in from before has no such wrap yet: its first
+  unlock asks its recovery key (or old passphrase) once and adds it. Where polkit cannot ask (no agent in the session,
+  pkcheck missing, a polkit too old for the owner annotation), the recovery key is asked through the helper instead.
+- The helper starts from the login entry intentic-machine registers (a systemd user unit or an XDG autostart entry) and
+  shows its dialogs with zenity or kdialog.
+
+### Undone
+
+`intentic-keyring service uninstall`, run as an administrator by `intentic-machine keyring uninstall` and by the agent's
+`uninstall --purge`: the task or unit is removed and the vault, its keys and its audit go back to `~/.intentic/keyring`.
+Then what the service left goes too (`src/service/windows/leftovers-windows.ts`, `install-linux.ts`): the user's emptied
+folder and, once no other user's marker is left, the service's program, its folders, the Task Scheduler `\Intentic\`
+folder (Windows), and the unit, the polkit action and the system user (Linux). Its JSON answer names them in `swept`,
+and whatever could not go, with why, in `left`.
+
+## The recovery key
+
+Setup makes the recovery key, not the person: six groups of five Crockford base32 characters
+(`XXXXX-XXXXX-XXXXX-XXXXX-XXXXX-XXXXX`, 150 bits, `src/service/recovery.ts`), shown once by `keyring setup` and never
+stored. The vault wraps the vault key under it exactly as it wrapped a passphrase (scrypt), and the setup op still names
+the field `passphrase`. Asked for in the passphrase box ("Type your recovery key"), it is read without regard to case,
+spaces or dashes, with I, L and O read as 1, 1 and 0; anything else is tried as typed, so a passphrase from before
+still opens a vault it made.
+
+## The type-once box
+
+When nothing in the vault answers a prompt (ssh asking for a password nobody saved, a program's password field, an
+agent's need with no match), the service has the helper show its own box asking for the value once, with a "Remember
+it" choice (consent.ts `ValuePrompt`). The answer goes to the service alone. On Linux it is zenity's `--forms` (a hidden
+field and a Yes/No choice), or two kdialog dialogs; the Windows box is `consent-windows.ts`'s.
+
+## The app chip
+
+While the person lets Passwords remember what they type in programs (the vault's `remember.apps`, read through the
+`state` op every minute), the session helper watches which field has the keyboard's focus (`src/watch/`). On Windows a
+long-running PowerShell holds a UI Automation focus-changed handler, reporting whether the focused element is a password
+field, its program's executable and where it is; a small topmost window that never takes focus then shows under the
+field, "Fill with Intentic" when `candidates` has an entry for that program and "Save with Intentic" when not, and goes
+when focus moves or after eight seconds. A click sends `fill-window`. On Linux the watcher is AT-SPI through python3-gi,
+and the chip is a desktop notification with one action, since a Wayland compositor does not let a program place a
+window; without python3's AT-SPI bindings the chip stays off. Nothing reads a field's value or hooks the keyboard.
 
 ## Limits
 
-- Without hardened mode, a process of the same user can read the vault key from the keyring's memory while it is
-  unlocked, and could trick a person into a Hello tap meant for the keyring; `while-here` is for a computer you are at.
-- Windows Hello's own prompt says only "Making sure it's you": the topmost notice beside it is what names the request.
-  A program that raises a Hello prompt of its own gets the same dialog without the notice.
-- A Windows Hello prompt raised by a process with no window can open behind other windows; the keyring shows a
-  topmost notice naming what is asked while it waits.
+- A value being typed passes through the session helper, a process of the user, for that moment, and so does what the
+  person types into the type-once box. Every other value, the vault key and the vault itself stay with the service.
+- The helper is proven by a person's yes at sign-in, not by what program it is: a program of the user that gets the
+  person to approve it is a helper too. The service checks every later yes itself (a Hello signature, a polkit check),
+  so such a helper can show prompts and receive what it is asked to type, but cannot say yes for the person.
+- Before setup, a helper is let in without proof, because there is no vault yet; a program of the user that set the
+  vault up first would hold its recovery key. `keyring setup` sets it up right after installing the service.
+- Windows Hello's own prompt for unlocking says only "Making sure it's you", without naming the request, and one
+  raised by a process with no window can open behind other windows.
+- On X11 every program of the same user can read keystrokes, those typed into the type-once box and those the helper
+  types included; Wayland does not allow that.
 - Typing cannot be taken back: if focus moves between the check and the last character, the keyring stops and says
   where the rest went.
+- Password managers read at each use (`op`, `bw`, `keepassxc-cli`) run inside the service: on Linux its unit hides home
+  folders (ProtectHome), so a manager that keeps its session there cannot be read from.
+
+Not exercised by this package's tests: UAC, Task Scheduler and Windows Hello; systemd, pkexec, polkit's dialog, its
+`$(title)`/`$(message)` substitution and the owner annotation; setfacl; UI Automation's focus events and the chip
+window; AT-SPI and notify-send's action. What is tested is what is pure (paths, the unit and policy text, argv, the
+door's messages, pkcheck's answers, the chip's decisions) and the door, helper and type-once box over real sockets with
+fake hands.

package/dist/address.d.ts

@@ -8,7 +8,6 @@ export interface KeyringPaths {
     readonly pid: string;
     readonly address: string;
 }
-export declare const userTag: () => string;
 export declare const keyringAddress: (dir: string, platform?: NodeJS.Platform) => string;
 export declare const keyringPaths: (dir?: string, platform?: NodeJS.Platform) => KeyringPaths;
 //# sourceMappingURL=address.d.ts.map

package/dist/address.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,YAAY,CAAC;AAEtC,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAGD,eAAO,MAAM,OAAO,QAAO,MAAmG,CAAC;AAE/H,eAAO,MAAM,cAAc,QAAS,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,MACQ,CAAC;AAEpG,eAAO,MAAM,YAAY,SAAS,MAAM,aAA0C,MAAM,CAAC,QAAQ,KAAsB,YAQrH,CAAC"}
+{"version":3,"file":"address.d.ts","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,YAAY,YAAY,CAAC;AAEtC,MAAM,WAAW,YAAY;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAErB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC5B;AAKD,eAAO,MAAM,cAAc,QAAS,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,MACQ,CAAC;AAEpG,eAAO,MAAM,YAAY,SAAS,MAAM,aAA0C,MAAM,CAAC,QAAQ,KAAsB,YAQrH,CAAC"}

package/dist/address.js

@@ -3,7 +3,7 @@ import { userInfo } from "node:os";
 import { join } from "node:path";
 import { agentHome } from "@intentic/local-agent";
 export const KEYRING_HOME = "keyring";
-export const userTag = () => createHash("sha256").update(userInfo().username.toLowerCase()).digest("hex").slice(0, 12);
+const userTag = () => createHash("sha256").update(userInfo().username.toLowerCase()).digest("hex").slice(0, 12);
 export const keyringAddress = (dir, platform = process.platform) => platform === "win32" ? `\\\\.\\pipe\\intentic-keyring-${userTag()}` : join(dir, "keyring.sock");
 export const keyringPaths = (dir = agentHome(KEYRING_HOME).dir, platform = process.platform) => ({
     dir,

package/dist/address.js.map

@@ -1 +1 @@
-{"version":3,"file":"address.js","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AAiBtC,MAAM,CAAC,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAE/H,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAU,EAAE,CAChG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iCAAiC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,GAAW,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAgB,EAAE,CAAC,CAAC;IACpI,GAAG;IACH,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;IAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;CACzC,CAAC,CAAC"}
+{"version":3,"file":"address.js","sourceRoot":"","sources":["../src/address.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAMlD,MAAM,CAAC,MAAM,YAAY,GAAG,SAAS,CAAC;AAiBtC,MAAM,OAAO,GAAG,GAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAExH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAW,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAU,EAAE,CAChG,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,iCAAiC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,GAAG,GAAW,SAAS,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAgB,EAAE,CAAC,CAAC;IACpI,GAAG;IACH,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;IAC5B,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC/B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC;IAC7B,OAAO,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;CACzC,CAAC,CAAC"}

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AA2GpD,eAAO,MAAM,GAAG,qDAKd,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAmHpD,eAAO,MAAM,GAAG,qDAKd,CAAC"}

package/dist/app.js

@@ -1,29 +1,17 @@
+import { errorMessage } from "@intentic/base/errors";
 import { agentException } from "@intentic/local-agent";
-import { buildApplication, buildCommand, buildRouteMap, text_en } from "@stricli/core";
+import { buildApplication, buildChoiceParser, buildCommand, buildRouteMap, text_en } from "@stricli/core";
 import { askpass } from "./askpass/askpass-run.js";
-import { serve } from "./serve.js";
-import { runSession } from "./service/helper.js";
-import { installService, uninstallService } from "./service/install.js";
-import { SID_RE } from "./service/paths.js";
-import { runService } from "./service/service-run.js";
-import { realRunner } from "./run.js";
+import { runGitCredential } from "./git-credential/git-credential.js";
+import { runNativeHost } from "./native-host/native-host.js";
+import { installHere, runServiceHere, runSessionHere, uninstallHere, userIdFits } from "./service/platform.js";
 import { KEYRING_VERSION } from "./version.js";
 const serveCommand = buildCommand({
-    docs: { brief: "Run the keyring (started at sign-in; there is one per user)" },
+    docs: { brief: "Retired: Passwords runs as a protected service now (intentic-machine keyring setup)" },
     parameters: {},
-    async func() {
-        const served = await serve();
-        if (!served.ok) {
-            this.process.stderr.write(`${served.reason}\n`);
-            process.exitCode = 1;
-            return;
-        }
-        const stop = () => {
-            void served.stop().then(() => process.exit(0));
-        };
-        process.once("SIGINT", stop);
-        process.once("SIGTERM", stop);
-        await new Promise(() => undefined);
+    func() {
+        this.process.stderr.write("Passwords runs as a protected service now, not as `serve`: `intentic-machine keyring setup` moves this computer to it.\n");
+        process.exitCode = 1;
     },
 });
 const versionCommand = buildCommand({
@@ -40,58 +28,71 @@ const askpassCommand = buildCommand({
         process.exitCode = await askpass(prompt.join(" "), this.process.stdout, this.process.stderr);
     },
 });
-const windowsOnly = () => {
-    if (process.platform !== "win32") {
-        process.stderr.write("Hardened mode is Windows-only.\n");
+const readAll = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString("utf8");
+};
+const gitCredentialCommand = buildCommand({
+    docs: { brief: "git's credential helper: get, store or erase an https sign-in (git runs this)" },
+    parameters: { flags: {}, positional: { kind: "tuple", parameters: [{ brief: "get, store or erase", parse: buildChoiceParser(["get", "store", "erase"]), placeholder: "get|store|erase" }] } },
+    async func(_flags, action) {
+        const input = await readAll();
+        process.exitCode = await runGitCredential(action, { input, write: (text) => this.process.stdout.write(text), warn: (text) => this.process.stderr.write(text) });
+    },
+});
+const nativeHostCommand = buildCommand({
+    docs: { brief: "The browser extension's native-messaging host (the browser runs this)" },
+    parameters: { flags: {}, positional: { kind: "array", parameter: { brief: "What the browser passes", parse: String } } },
+    async func(_flags, ..._passed) {
+        process.exitCode = await runNativeHost({ input: process.stdin, write: (frame) => process.stdout.write(frame) });
+    },
+});
+const answered = async (stdout, work) => {
+    try {
+        stdout.write(`${JSON.stringify({ ok: true, ...(await work()) })}\n`);
+    }
+    catch (error) {
+        process.stderr.write(`${errorMessage(error)}\n`);
         process.exitCode = 1;
-        return false;
     }
-    return true;
 };
 const installCommand = buildCommand({
-    docs: { brief: "Move the vault under the hardened service (run elevated; intentic-machine keyring harden does this)" },
+    docs: { brief: "Install Passwords' protected service for you, moving a vault from before into it (run as an administrator; intentic-machine keyring setup does this)" },
     parameters: {},
     async func() {
-        if (windowsOnly()) {
-            const done = await installService(realRunner);
-            this.process.stdout.write(`${JSON.stringify({ ok: true, ...done })}\n`);
-        }
+        await answered(this.process.stdout, async () => await installHere());
     },
 });
 const uninstallCommand = buildCommand({
-    docs: { brief: "Put the vault back in your own folder and remove the hardened service (run elevated)" },
+    docs: { brief: "Put the vault back in your own folder and remove Passwords' protected service (run as an administrator)" },
     parameters: {},
     async func() {
-        if (windowsOnly()) {
-            const done = await uninstallService(realRunner);
-            this.process.stdout.write(`${JSON.stringify({ ok: true, ...done })}\n`);
-        }
+        await answered(this.process.stdout, async () => await uninstallHere());
     },
 });
 const runCommand = buildCommand({
-    docs: { brief: "Run the hardened service (what its startup task starts)" },
-    parameters: { flags: { user: { kind: "parsed", parse: String, brief: "The user's security identifier" } } },
+    docs: { brief: "Run Passwords' protected service (what the system starts)" },
+    parameters: { flags: { user: { kind: "parsed", parse: String, brief: "The user it is for: a security identifier (Windows) or a uid (Linux)" } } },
     async func(flags) {
-        if (!SID_RE.test(flags.user)) {
-            this.process.stderr.write("--user takes a security identifier (S-1-5-…).\n");
+        if (!userIdFits(flags.user)) {
+            this.process.stderr.write("--user takes a security identifier (S-1-5-…) on Windows, a numeric uid on Linux.\n");
             process.exitCode = 1;
             return;
         }
-        if (windowsOnly()) {
-            await runService(flags.user);
-        }
+        await runServiceHere(flags.user);
     },
 });
 const sessionCommand = buildCommand({
-    docs: { brief: "Run the session helper of a hardened keyring (started at sign-in)" },
+    docs: { brief: "Run Passwords' session helper (started at sign-in)" },
     parameters: {},
     async func() {
-        if (windowsOnly()) {
-            await runSession();
-        }
+        await runSessionHere();
     },
 });
-export const app = buildApplication(buildRouteMap({ routes: { serve: serveCommand, version: versionCommand, askpass: askpassCommand, service: buildRouteMap({ routes: { install: installCommand, uninstall: uninstallCommand, run: runCommand }, docs: { brief: "Hardened mode (Windows)" } }), session: sessionCommand }, docs: { brief: "The Intentic keyring" } }), {
+export const app = buildApplication(buildRouteMap({ routes: { serve: serveCommand, version: versionCommand, askpass: askpassCommand, "git-credential": gitCredentialCommand, "native-host": nativeHostCommand, service: buildRouteMap({ routes: { install: installCommand, uninstall: uninstallCommand, run: runCommand }, docs: { brief: "Passwords' protected service" } }), session: sessionCommand }, docs: { brief: "The Intentic keyring" } }), {
     name: "intentic-keyring",
     versionInfo: { currentVersion: KEYRING_VERSION },
     scanner: { caseStyle: "allow-kebab-for-camel" },

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEvF,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAM/C,MAAM,YAAY,GAAG,YAAY,CAAC;IAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,6DAA6D,EAAE;IAC9E,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;YAChD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,GAAS,EAAE;YACpB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9B,MAAM,IAAI,OAAO,CAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC/C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;IACtD,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC3G,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9H,KAAK,CAAC,IAAI,CAAuB,MAA6B,EAAE,GAAG,MAAgB;QAC/E,OAAO,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;CACJ,CAAC,CAAC;AAIH,MAAM,WAAW,GAAG,GAAY,EAAE;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,qGAAqG,EAAE;IACtH,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,YAAY,CAAC;IAClC,IAAI,EAAE,EAAE,KAAK,EAAE,sFAAsF,EAAE;IACvG,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,YAAY,CAAC;IAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,yDAAyD,EAAE;IAC1E,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,gCAAgC,EAAE,EAAE,EAAE;IAC3G,KAAK,CAAC,IAAI,CAAuB,KAAgC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,mEAAmE,EAAE;IACpF,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,IAAI,WAAW,EAAE,EAAE,CAAC;YAChB,MAAM,UAAU,EAAE,CAAC;QACvB,CAAC;IACL,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,EAAE;IACnW,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;IAChD,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;CAClJ,CAAC,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,YAAY,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE1G,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAkB,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/G,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAU/C,MAAM,YAAY,GAAG,YAAY,CAAC;IAC9B,IAAI,EAAE,EAAE,KAAK,EAAE,qFAAqF,EAAE;IACtG,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0HAA0H,CAAC,CAAC;QACtJ,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC/C,UAAU,EAAE,EAAE;IACd,IAAI;QACA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,IAAI,CAAC,CAAC;IACtD,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,0FAA0F,EAAE;IAC3G,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;IAC9H,KAAK,CAAC,IAAI,CAAuB,MAA6B,EAAE,GAAG,MAAgB;QAC/E,OAAO,CAAC,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjG,CAAC;CACJ,CAAC,CAAC;AAGH,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;IACxC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,YAAY,CAAC;IACtC,IAAI,EAAE,EAAE,KAAK,EAAE,+EAA+E,EAAE;IAChG,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,EAAE,EAAE;IACtM,KAAK,CAAC,IAAI,CAAuB,MAA6B,EAAE,MAAiB;QAC7E,MAAM,KAAK,GAAG,MAAM,OAAO,EAAE,CAAC;QAC9B,OAAO,CAAC,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpK,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,YAAY,CAAC;IACnC,IAAI,EAAE,EAAE,KAAK,EAAE,uEAAuE,EAAE;IAExF,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;IACxH,KAAK,CAAC,IAAI,CAAuB,MAA6B,EAAE,GAAG,OAAiB;QAChF,OAAO,CAAC,QAAQ,GAAG,MAAM,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpH,CAAC;CACJ,CAAC,CAAC;AAIH,MAAM,QAAQ,GAAG,KAAK,EAAE,MAA2C,EAAE,IAA2B,EAAiB,EAAE;IAC/G,IAAI,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,sJAAsJ,EAAE;IACvK,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IACzE,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,YAAY,CAAC;IAClC,IAAI,EAAE,EAAE,KAAK,EAAE,yGAAyG,EAAE;IAC1H,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,EAAE,CAAC,CAAC;IAC3E,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,YAAY,CAAC;IAC5B,IAAI,EAAE,EAAE,KAAK,EAAE,2DAA2D,EAAE;IAC5E,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sEAAsE,EAAE,EAAE,EAAE;IACjJ,KAAK,CAAC,IAAI,CAAuB,KAAgC;QAC7D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oFAAoF,CAAC,CAAC;YAChH,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACX,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,YAAY,CAAC;IAChC,IAAI,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE;IACrE,UAAU,EAAE,EAAE;IACd,KAAK,CAAC,IAAI;QACN,MAAM,cAAc,EAAE,CAAC;IAC3B,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,CAAC,EAAE;IAClb,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,EAAE,cAAc,EAAE,eAAe,EAAE;IAChD,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,4BAA4B,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE;CAClJ,CAAC,CAAC"}

package/dist/askpass/answer.d.ts

@@ -0,0 +1,12 @@
+import { type Answer, type VaultAccess } from "../passwords/access.js";
+import type { Captures } from "../passwords/capture.js";
+export declare class Askpass {
+    #private;
+    private readonly vault;
+    private readonly captures;
+    constructor(vault: VaultAccess, captures: Captures);
+    forget(): void;
+    askpass(prompt: string, parent: string | undefined): Answer<"askpass">;
+    gitCredential(action: "get" | "erase", url: string, username: string | undefined): Answer<"git-credential">;
+}
+//# sourceMappingURL=answer.d.ts.map

package/dist/askpass/answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer.d.ts","sourceRoot":"","sources":["../../src/askpass/answer.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,MAAM,EAAsB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAC3F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAiDxD,qBAAa,OAAO;;IAQZ,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF7B,YACqB,KAAK,EAAE,WAAW,EAClB,QAAQ,EAAE,QAAQ,EACnC;IAEJ,MAAM,IAAI,IAAI,CAGb;IA0BK,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAyB3E;IA2EK,aAAa,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAYhH;CAuDJ"}