@intentic/keyring 1.343.0 → 1.345.0

package/dist/service/linux/service-run-linux.js

@@ -0,0 +1,52 @@
+import { writeFileAtomic } from "@intentic/base/fs";
+import { passphraseConsent, serialConsent } from "../../consent/consent.js";
+import { succeeded } from "../../run.js";
+import { linuxServicePaths } from "./paths-linux.js";
+import { askPolkit, polkitConsent, subjectOf } from "./polkit-linux.js";
+import { remoteChoicePrompt, remotePassphrasePrompt, remoteValuePrompt } from "../remote.js";
+import { ServiceKey } from "../service-key.js";
+import { doorAclArgs } from "./unit-linux.js";
+export const linuxServiceRun = (uid, runner) => {
+    const paths = linuxServicePaths(uid);
+    const serviceKey = new ServiceKey(paths.serviceKey, paths.vaultDir);
+    let helper;
+    return {
+        vaultDir: paths.vaultDir,
+        place: { kind: "unix", path: paths.socket },
+        consent: (link) => {
+            const recovery = { ...passphraseConsent(remotePassphrasePrompt(link)), askValue: remoteValuePrompt(link), choose: remoteChoicePrompt(link) };
+            return serialConsent(polkitConsent({ runner, helper: () => (link.ready ? helper : undefined), serviceKey, recovery }));
+        },
+        helloCredential: () => Promise.resolve("intentic-keyring"),
+        challenge: () => Promise.resolve({ method: "polkit" }),
+        proven: async (challenge, proof) => {
+            if (challenge.method !== "polkit" || proof.method !== "polkit") {
+                return false;
+            }
+            const subject = await subjectOf(proof.pid, uid);
+            if (subject === undefined) {
+                return false;
+            }
+            const said = await askPolkit(runner, subject, { title: "Connect Passwords", message: "Passwords on this computer asks you to confirm it is you, once for this sign-in." });
+            if (said !== "yes") {
+                return false;
+            }
+            helper = subject;
+            return true;
+        },
+        beforeWrite: async (file) => await serviceKey.merged(file),
+        afterSetup: async (vaultKey) => {
+            await serviceKey.adopt(vaultKey);
+        },
+        publish: async (door, log) => {
+            await writeFileAtomic(paths.door, `${JSON.stringify(door)}\n`, 0o600);
+            for (const args of doorAclArgs(paths)) {
+                const set = await runner({ command: "setfacl", args, timeoutMs: 10_000 });
+                if (!succeeded(set)) {
+                    log(`setfacl ${args.join(" ")} failed (${set.missing ? "setfacl is not installed" : `exit ${String(set.exitCode)}`}): the session helper cannot reach the door`);
+                }
+            }
+        },
+    };
+};
+//# sourceMappingURL=service-run-linux.js.map

package/dist/service/linux/service-run-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-run-linux.js","sourceRoot":"","sources":["../../../src/service/linux/service-run-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAe,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAsB,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC7F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAQ9C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAW,EAAE,MAAc,EAAc,EAAE;IACvE,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpE,IAAI,MAAiC,CAAC;IACtC,OAAO;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE;QAC3C,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACd,MAAM,QAAQ,GAAG,EAAE,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7I,OAAO,aAAa,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC3H,CAAC;QACD,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAAC;QAC1D,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACtD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAC;YACjB,CAAC;YAGD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,kFAAkF,EAAE,CAAC,CAAC;YAC3K,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACjB,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,GAAG,OAAO,CAAC;YACjB,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAC1D,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;YAC3B,MAAM,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtE,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBAClB,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,6CAA6C,CAAC,CAAC;gBACrK,CAAC;YACL,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/service/linux/session-linux.d.ts

@@ -0,0 +1,4 @@
+import type { Runner } from "../../run.js";
+import type { SessionPlatform } from "../helper.js";
+export declare const linuxSession: (runner: Runner) => Promise<SessionPlatform>;
+//# sourceMappingURL=session-linux.d.ts.map

package/dist/service/linux/session-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/session-linux.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOpD,eAAO,MAAM,YAAY,WAAkB,MAAM,KAAG,OAAO,CAAC,eAAe,CAO1E,CAAC"}

package/dist/service/linux/session-linux.js

@@ -0,0 +1,13 @@
+import { linuxChoicePrompt, linuxPassphrasePrompt, linuxValuePrompt } from "../../consent/consent-posix.js";
+import { platformTypist } from "../../typing/index.js";
+import { linuxServicePaths } from "./paths-linux.js";
+import { serviceUserId } from "../user.js";
+export const linuxSession = async (runner) => {
+    const paths = linuxServicePaths(await serviceUserId(runner, "linux"));
+    return {
+        doorFile: paths.door,
+        noService: `Passwords' service is not running: \`systemctl status ${paths.unitName}\` says why.`,
+        hands: { hello: undefined, passphrase: linuxPassphrasePrompt(runner), value: linuxValuePrompt(runner), choose: linuxChoicePrompt(runner), typist: platformTypist(runner) },
+    };
+};
+//# sourceMappingURL=session-linux.js.map

package/dist/service/linux/session-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-linux.js","sourceRoot":"","sources":["../../../src/service/linux/session-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAE5G,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAK3C,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;IAC3E,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtE,OAAO;QACH,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,SAAS,EAAE,yDAAyD,KAAK,CAAC,QAAQ,cAAc;QAChG,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE;KAC7K,CAAC;AACN,CAAC,CAAC"}

package/dist/service/linux/unit-linux.d.ts

@@ -0,0 +1,16 @@
+import { type LinuxServicePaths } from "./paths-linux.js";
+export declare const unitText: (paths: Pick<LinuxServicePaths, "exe">) => string;
+export declare const policyText: () => string;
+export declare const addServiceUserArgs: () => readonly string[];
+export declare const enableArgs: (paths: Pick<LinuxServicePaths, "unitName">) => readonly string[];
+export declare const restartArgs: (paths: Pick<LinuxServicePaths, "unitName">) => readonly string[];
+export declare const disableArgs: (paths: Pick<LinuxServicePaths, "unitName">) => readonly string[];
+export declare const stopArgs: (paths: Pick<LinuxServicePaths, "unitName">) => readonly string[];
+export declare const doorAclArgs: (paths: Pick<LinuxServicePaths, "uid" | "runDir" | "socket" | "door">) => readonly (readonly string[])[];
+export declare const passwdEntry: (line: string) => {
+    readonly uid: number;
+    readonly gid: number;
+    readonly home: string;
+} | undefined;
+export declare const othersInstalledLinux: (rootNames: readonly string[], uid: string) => boolean;
+//# sourceMappingURL=unit-linux.d.ts.map

package/dist/service/linux/unit-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/unit-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAA+B,MAAM,kBAAkB,CAAC;AAQvF,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,KAAG,MA+BhE,CAAC;AAMF,eAAO,MAAM,UAAU,QAAO,MAkB7B,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAO,SAAS,MAAM,EAAkI,CAAC;AAExL,eAAO,MAAM,UAAU,UAAW,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAG,SAAS,MAAM,EAAyC,CAAC;AACjI,eAAO,MAAM,WAAW,UAAW,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAG,SAAS,MAAM,EAAiC,CAAC;AAC1H,eAAO,MAAM,WAAW,UAAW,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAG,SAAS,MAAM,EAA0C,CAAC;AACnI,eAAO,MAAM,QAAQ,UAAW,IAAI,CAAC,iBAAiB,EAAE,UAAU,CAAC,KAAG,SAAS,MAAM,EAA8B,CAAC;AAIpH,eAAO,MAAM,WAAW,UAAW,IAAI,CAAC,iBAAiB,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAC,KAAG,SAAS,CAAC,SAAS,MAAM,EAAE,CAAC,EAI9H,CAAC;AAGF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAIlH,CAAC;AAGF,eAAO,MAAM,oBAAoB,cAAe,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,OAA+F,CAAC"}

package/dist/service/linux/unit-linux.js

@@ -0,0 +1,67 @@
+import { POLKIT_ACTION, SERVICE_USER } from "./paths-linux.js";
+export const unitText = (paths) => `[Unit]
+Description=Passwords for user %i (Intentic)
+Documentation=https://github.com/intentic/intentic/tree/main/_devices/keyring
+After=polkit.service
+
+[Service]
+Type=simple
+User=${SERVICE_USER}
+Group=${SERVICE_USER}
+ExecStart=${paths.exe} service run --user %i
+Restart=always
+RestartSec=5
+StateDirectory=intentic-keyring/%i
+StateDirectoryMode=0700
+RuntimeDirectory=intentic-keyring/%i
+RuntimeDirectoryMode=0700
+UMask=0077
+NoNewPrivileges=yes
+ProtectSystem=strict
+ProtectHome=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+[Install]
+WantedBy=multi-user.target
+`;
+export const policyText = () => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <vendor>Intentic</vendor>
+  <vendor_url>https://intentic.dev</vendor_url>
+  <action id="${POLKIT_ACTION}">
+    <description>Confirm a request to Passwords</description>
+    <message>Passwords asks: $(title). $(message)</message>
+    <defaults>
+      <allow_any>no</allow_any>
+      <allow_inactive>no</allow_inactive>
+      <allow_active>auth_self</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.owner">unix-user:${SERVICE_USER}</annotate>
+  </action>
+</policyconfig>
+`;
+export const addServiceUserArgs = () => ["--system", "--user-group", "--no-create-home", "--home-dir", "/nonexistent", "--shell", "/usr/sbin/nologin", SERVICE_USER];
+export const enableArgs = (paths) => ["enable", "--now", paths.unitName];
+export const restartArgs = (paths) => ["restart", paths.unitName];
+export const disableArgs = (paths) => ["disable", "--now", paths.unitName];
+export const stopArgs = (paths) => ["stop", paths.unitName];
+export const doorAclArgs = (paths) => [
+    ["-m", `u:${paths.uid}:--x`, paths.runDir],
+    ["-m", `u:${paths.uid}:rw-`, paths.socket],
+    ["-m", `u:${paths.uid}:r--`, paths.door],
+];
+export const passwdEntry = (line) => {
+    const fields = line.trim().split(":");
+    const [uid, gid, home] = [Number(fields[2]), Number(fields[3]), fields[5]];
+    return fields.length >= 7 && Number.isInteger(uid) && Number.isInteger(gid) && home !== undefined && home.startsWith("/") ? { uid, gid, home } : undefined;
+};
+export const othersInstalledLinux = (rootNames, uid) => rootNames.some((name) => name.endsWith(".installed") && name !== `${uid}.installed`);
+//# sourceMappingURL=unit-linux.js.map

package/dist/service/linux/unit-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unit-linux.js","sourceRoot":"","sources":["../../../src/service/linux/unit-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAQvF,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAAqC,EAAU,EAAE,CACtE;;;;;;;OAOG,YAAY;QACX,YAAY;YACR,KAAK,CAAC,GAAG;;;;;;;;;;;;;;;;;;;;;CAqBpB,CAAC;AAMF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAW,EAAE,CACnC;;;;;;gBAMY,aAAa;;;;;;;;gEAQmC,YAAY;;;CAG3E,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAsB,EAAE,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,mBAAmB,EAAE,YAAY,CAAC,CAAC;AAExL,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAA0C,EAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACjI,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA0C,EAAqB,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AAC1H,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAA0C,EAAqB,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AACnI,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,KAA0C,EAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;AAIpH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAoE,EAAkC,EAAE,CAAC;IACjI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;IAC1C,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;IAC1C,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;CAC3C,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAqF,EAAE;IAC3H,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/J,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,SAA4B,EAAE,GAAW,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,KAAK,GAAG,GAAG,YAAY,CAAC,CAAC"}

package/dist/service/platform.d.ts

@@ -0,0 +1,7 @@
+import { type Runner } from "../run.js";
+export declare const installHere: (runner?: Runner, platform?: NodeJS.Platform) => Promise<object>;
+export declare const uninstallHere: (runner?: Runner, platform?: NodeJS.Platform) => Promise<object>;
+export declare const userIdFits: (user: string, platform?: NodeJS.Platform) => boolean;
+export declare const runServiceHere: (user: string, runner?: Runner, platform?: NodeJS.Platform) => Promise<never>;
+export declare const runSessionHere: (runner?: Runner, platform?: NodeJS.Platform) => Promise<void>;
+//# sourceMappingURL=platform.d.ts.map

package/dist/service/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/service/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAwBpD,eAAO,MAAM,WAAW,YAAkB,MAAM,aAAyB,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,MAAM,CAS3H,CAAC;AAEF,eAAO,MAAM,aAAa,YAAkB,MAAM,aAAyB,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,MAAM,CAS7H,CAAC;AAGF,eAAO,MAAM,UAAU,SAAU,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAAyE,CAAC;AAElK,eAAO,MAAM,cAAc,SAAgB,MAAM,WAAU,MAAM,aAAyB,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,KAAK,CAS3I,CAAC;AAEF,eAAO,MAAM,cAAc,YAAkB,MAAM,aAAyB,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,IAAI,CAW5H,CAAC"}

package/dist/service/platform.js

@@ -0,0 +1,62 @@
+import { realRunner } from "../run.js";
+import { runSession } from "./helper.js";
+import { installLinuxService, uninstallLinuxService } from "./linux/install-linux.js";
+import { installService, uninstallService } from "./windows/install-windows.js";
+import { UID_RE } from "./linux/paths-linux.js";
+import { SID_RE } from "./windows/paths-windows.js";
+import { runService } from "./service-run.js";
+import { linuxServiceRun } from "./linux/service-run-linux.js";
+import { windowsServiceRun } from "./windows/service-run-windows.js";
+import { linuxSession } from "./linux/session-linux.js";
+import { NOT_ON_MAC } from "./user.js";
+import { windowsSession } from "./windows/session-windows.js";
+class ServiceUnsupported extends Error {
+    constructor(platform) {
+        super(platform === "darwin" ? NOT_ON_MAC : `Passwords' protected service is not built for ${platform}.`);
+        this.name = "ServiceUnsupported";
+    }
+}
+export const installHere = async (runner = realRunner, platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            return await installService(runner);
+        case "linux":
+            return await installLinuxService(runner);
+        default:
+            throw new ServiceUnsupported(platform);
+    }
+};
+export const uninstallHere = async (runner = realRunner, platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            return await uninstallService(runner);
+        case "linux":
+            return await uninstallLinuxService(runner);
+        default:
+            throw new ServiceUnsupported(platform);
+    }
+};
+export const userIdFits = (user, platform = process.platform) => (platform === "win32" ? SID_RE.test(user) : UID_RE.test(user));
+export const runServiceHere = async (user, runner = realRunner, platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            return await runService(windowsServiceRun(user, runner), runner);
+        case "linux":
+            return await runService(linuxServiceRun(user, runner), runner);
+        default:
+            throw new ServiceUnsupported(platform);
+    }
+};
+export const runSessionHere = async (runner = realRunner, platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            await runSession(windowsSession, runner);
+            return;
+        case "linux":
+            await runSession(linuxSession, runner);
+            return;
+        default:
+            throw new ServiceUnsupported(platform);
+    }
+};
+//# sourceMappingURL=platform.js.map

package/dist/service/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/service/platform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAe,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAM9D,MAAM,kBAAmB,SAAQ,KAAK;IAClC,YAAY,QAAyB;QACjC,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iDAAiD,QAAQ,GAAG,CAAC,CAAC;QACzG,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACrC,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,MAAM,GAAW,UAAU,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAmB,EAAE;IAC5H,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,OAAO,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,OAAO;YACR,OAAO,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC7C;YACI,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,MAAM,GAAW,UAAU,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAmB,EAAE;IAC9H,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,OAAO;YACR,OAAO,MAAM,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAC/C;YACI,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAW,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAElK,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAY,EAAE,MAAM,GAAW,UAAU,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAkB,EAAE;IAC5I,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,OAAO,MAAM,UAAU,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACrE,KAAK,OAAO;YACR,OAAO,MAAM,UAAU,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE;YACI,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,MAAM,GAAW,UAAU,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAiB,EAAE;IAC7H,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,MAAM,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO;QACX,KAAK,OAAO;YACR,MAAM,UAAU,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACvC,OAAO;QACX;YACI,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;AACL,CAAC,CAAC"}

package/dist/service/recovery.d.ts

@@ -0,0 +1,3 @@
+export declare const newRecoveryKey: (random?: (size: number) => Buffer) => string;
+export declare const asRecoveryKey: (typed: string) => string;
+//# sourceMappingURL=recovery.d.ts.map

package/dist/service/recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.d.ts","sourceRoot":"","sources":["../../src/service/recovery.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,cAAc,YAAY,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,KAAiB,MAI/E,CAAC;AAOF,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,MAU7C,CAAC"}

package/dist/service/recovery.js

@@ -0,0 +1,22 @@
+import { randomBytes } from "node:crypto";
+const CROCKFORD = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const GROUPS = 6;
+const GROUP_LENGTH = 5;
+const LENGTH = GROUPS * GROUP_LENGTH;
+const grouped = (characters) => Array.from({ length: GROUPS }, (_unused, index) => characters.slice(index * GROUP_LENGTH, (index + 1) * GROUP_LENGTH)).join("-");
+export const newRecoveryKey = (random = randomBytes) => {
+    const bytes = random(LENGTH);
+    return grouped(Array.from(bytes, (byte) => CROCKFORD[byte & 31] ?? "0").join(""));
+};
+export const asRecoveryKey = (typed) => {
+    const bare = typed
+        .toUpperCase()
+        .replace(/[\s-]/gu, "")
+        .replace(/[IL]/gu, "1")
+        .replace(/O/gu, "0");
+    if (bare.length !== LENGTH || [...bare].some((character) => !CROCKFORD.includes(character))) {
+        return typed;
+    }
+    return grouped(bare);
+};
+//# sourceMappingURL=recovery.js.map

package/dist/service/recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery.js","sourceRoot":"","sources":["../../src/service/recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAO1C,MAAM,SAAS,GAAG,kCAAkC,CAAC;AACrD,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,MAAM,GAAG,MAAM,GAAG,YAAY,CAAC;AAErC,MAAM,OAAO,GAAG,CAAC,UAAkB,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,YAAY,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAGjL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAM,GAA6B,WAAW,EAAU,EAAE;IAErF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAa,EAAU,EAAE;IACnD,MAAM,IAAI,GAAG,KAAK;SACb,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC"}

package/dist/service/remote.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import type { HelloDriver, PassphrasePrompt } from "../consent/consent.js";
+import type { ChoicePrompt, HelloDriver, PassphrasePrompt, ValuePrompt } from "../consent/consent.js";
 import type { Typist } from "../typing/typist.js";
 import type { HelperCall } from "./door.js";
 import type { LineSocket } from "./lines.js";
@@ -15,7 +15,10 @@ export interface HelloPin {
     readonly publicKey: string;
 }
 export declare const remoteHello: (link: HelperLink, pin: () => Promise<HelloPin | undefined>) => HelloDriver;
+export declare const RECOVERY_HINT = "Type your recovery key: the one Passwords showed once when it was set up on this computer.";
 export declare const remotePassphrasePrompt: (link: HelperLink) => PassphrasePrompt;
+export declare const remoteValuePrompt: (link: HelperLink) => ValuePrompt;
+export declare const remoteChoicePrompt: (link: HelperLink) => ChoicePrompt;
 export declare const remoteTypist: (link: HelperLink) => Typist;
 export {};
 //# sourceMappingURL=remote.d.ts.map

package/dist/service/remote.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/service/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAe,gBAAgB,EAAgB,MAAM,uBAAuB,CAAC;AACtG,OAAO,KAAK,EAAoB,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAW7C,KAAK,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;AAEhF,qBAAa,UAAU;;IAMnB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAG/B;IAED,IAAI,KAAK,IAAI,OAAO,CAEnB;IAGK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAoB1G;CACJ;AAID,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAGD,eAAO,MAAM,WAAW,SAAU,UAAU,OAAO,MAAM,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAG,WA4BxF,CAAC;AAGF,eAAO,MAAM,sBAAsB,SACxB,UAAU,KAAG,gBAInB,CAAC;AAEN,eAAO,MAAM,YAAY,SAAU,UAAU,KAAG,MAU9C,CAAC"}
+{"version":3,"file":"remote.d.ts","sourceRoot":"","sources":["../../src/service/remote.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAgB,YAAY,EAAE,WAAW,EAAe,gBAAgB,EAA6B,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC5J,OAAO,KAAK,EAAoB,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAc7C,KAAK,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,CAAC,SAAS,OAAO,GAAG,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;AAEhF,qBAAa,UAAU;;IAMnB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAG/B;IAED,IAAI,KAAK,IAAI,OAAO,CAEnB;IAGK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAoB1G;CACJ;AAID,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC9B;AAKD,eAAO,MAAM,WAAW,SAAU,UAAU,OAAO,MAAM,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,KAAG,WA6CxF,CAAC;AAGF,eAAO,MAAM,aAAa,+FAA+F,CAAC;AAI1H,eAAO,MAAM,sBAAsB,SACxB,UAAU,KAAG,gBAOnB,CAAC;AAIN,eAAO,MAAM,iBAAiB,SACnB,UAAU,KAAG,WAQnB,CAAC;AAIN,eAAO,MAAM,kBAAkB,SACpB,UAAU,KAAG,YAInB,CAAC;AAEN,eAAO,MAAM,YAAY,SAAU,UAAU,KAAG,MAU9C,CAAC"}

package/dist/service/remote.js

@@ -2,8 +2,10 @@ import { randomBytes } from "node:crypto";
 import { serialLock } from "@intentic/base/async";
 import { z } from "zod";
 import { helloSigned } from "./hello-verify.js";
-import { InspectedSchema, SignedSchema, TypedPassphraseSchema, TypedSchema } from "./wire.js";
+import { asRecoveryKey } from "./recovery.js";
+import { AvailableSchema, ChosenSchema, EnrolledSchema, InspectedSchema, SignedSchema, TypedPassphraseSchema, TypedSchema, TypedValueSchema } from "./wire.js";
 const PROMPT_DEADLINE_MS = 130_000;
+const AVAILABLE_DEADLINE_MS = 20_000;
 const TYPING_DEADLINE_MS = 70_000;
 export class HelperLink {
     #helper;
@@ -37,7 +39,7 @@ export class HelperLink {
         });
     }
 }
-const NO_SESSION = "nobody is signed in to Windows to ask: the keyring's session helper starts at sign-in";
+const NO_SESSION = "nobody is signed in to ask: Passwords' session helper starts at sign-in";
 export const remoteHello = (link, pin) => {
     const sign = async (credential, challenge, title, message) => {
         const reply = await link.call({ call: "sign", credential, challenge, title, message }, SignedSchema, PROMPT_DEADLINE_MS);
@@ -47,8 +49,25 @@ export const remoteHello = (link, pin) => {
         return reply.ok ? { ok: true, value: Buffer.from(reply.signature, "base64") } : { ok: false, cancelled: reply.cancelled, reason: reply.reason };
     };
     return {
-        available: async () => link.ready && (await pin()) !== undefined,
-        enrol: () => Promise.resolve({ ok: false, cancelled: false, reason: "a hardened keyring keeps the Windows Hello key it was set up with" }),
+        available: async () => {
+            if (!link.ready) {
+                return false;
+            }
+            if ((await pin()) !== undefined) {
+                return true;
+            }
+            return (await link.call({ call: "hello-available" }, AvailableSchema, AVAILABLE_DEADLINE_MS))?.available === true;
+        },
+        enrol: async (credential, challenge, notice) => {
+            if ((await pin()) !== undefined) {
+                return { ok: false, cancelled: false, reason: "Passwords keeps the Windows Hello key it was set up with" };
+            }
+            const reply = await link.call({ call: "enrol", credential, challenge, title: notice.title, message: notice.message }, EnrolledSchema, PROMPT_DEADLINE_MS);
+            if (reply === undefined) {
+                return { ok: false, cancelled: false, reason: link.ready ? "the session helper did not answer" : NO_SESSION };
+            }
+            return reply.ok ? { ok: true, value: { signature: Buffer.from(reply.signature, "base64"), publicKey: reply.publicKey } } : reply;
+        },
         sign: async (credential, challenge, notice) => await sign(credential, challenge, notice.title, notice.message),
         verify: async (notice) => {
             const pinned = await pin();
@@ -66,14 +85,30 @@ export const remoteHello = (link, pin) => {
         },
     };
 };
+export const RECOVERY_HINT = "Type your recovery key: the one Passwords showed once when it was set up on this computer.";
 export const remotePassphrasePrompt = (link) => async (notice) => {
-    const reply = await link.call({ call: "passphrase", title: notice.title, message: notice.message }, TypedPassphraseSchema, PROMPT_DEADLINE_MS);
+    const reply = await link.call({ call: "passphrase", title: notice.title, message: `${notice.message}\n\n${RECOVERY_HINT}` }, TypedPassphraseSchema, PROMPT_DEADLINE_MS);
+    if (reply === undefined) {
+        return { kind: "unavailable", reason: link.ready ? "the session helper did not answer" : NO_SESSION };
+    }
+    return reply.kind === "answered" ? { kind: "answered", passphrase: asRecoveryKey(reply.passphrase) } : reply;
+};
+export const remoteValuePrompt = (link) => async (notice) => {
+    const call = { call: "value", title: notice.title, message: notice.message, remember: notice.remember };
+    if (notice.username !== undefined) {
+        call.username = notice.username.value === undefined ? {} : { value: notice.username.value };
+    }
+    const reply = await link.call(call, TypedValueSchema, PROMPT_DEADLINE_MS);
+    return reply ?? { kind: "unavailable", reason: link.ready ? "the session helper did not answer" : NO_SESSION };
+};
+export const remoteChoicePrompt = (link) => async (notice) => {
+    const reply = await link.call({ call: "choice", title: notice.title, message: notice.message, choices: notice.choices.map(({ id, label }) => ({ id, label })) }, ChosenSchema, PROMPT_DEADLINE_MS);
     return reply ?? { kind: "unavailable", reason: link.ready ? "the session helper did not answer" : NO_SESSION };
 };
 export const remoteTypist = (link) => ({
     inspect: async (place) => {
         const reply = await link.call({ call: "inspect", place }, InspectedSchema, TYPING_DEADLINE_MS);
-        return reply ?? { ok: false, reason: link.ready ? "the session helper did not answer" : "no one is signed in to Windows to type in" };
+        return reply ?? { ok: false, reason: link.ready ? "the session helper did not answer" : "no one is signed in to type in" };
     },
     type: async (place, seen, value) => {
         const reply = await link.call({ call: "type", place, seen, value }, TypedSchema, TYPING_DEADLINE_MS);

package/dist/service/remote.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/service/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAO9F,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAIlC,MAAM,OAAO,UAAU;IACnB,OAAO,CAAyB;IAChC,KAAK,GAAG,CAAC,CAAC;IACD,IAAI,GAAG,UAAU,EAAE,CAAC;IAG7B,MAAM,CAAC,MAAkB;QACrB,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,CAAC;IAGD,KAAK,CAAC,IAAI,CAAI,IAA0B,EAAE,MAAoB,EAAE,UAAkB;QAC9E,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC7B,SAAS,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACrB,CAAC;gBAED,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,KAAK,CAAC;gBACvB,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAED,MAAM,UAAU,GAAG,uFAAuF,CAAC;AAQ3G,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAE,GAAwC,EAAe,EAAE;IACnG,MAAM,IAAI,GAAG,KAAK,EAAE,UAAkB,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAe,EAAgC,EAAE;QACvH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAClH,CAAC;QACD,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACpJ,CAAC,CAAC;IACF,OAAO;QACH,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,SAAS;QAChE,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;QAC1I,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QAE9G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YAC5F,CAAC;YACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAClB,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAC5G,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,sBAAsB,GAC/B,CAAC,IAAgB,EAAoB,EAAE,CACvC,KAAK,EAAE,MAAM,EAAyB,EAAE;IACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IAC/I,OAAO,KAAK,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACnH,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAsB,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC/F,OAAO,KAAK,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,2CAA2C,EAAE,CAAC;IAC1I,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAkB,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAErG,OAAO,KAAK,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3G,CAAC;CACJ,CAAC,CAAC"}
+{"version":3,"file":"remote.js","sourceRoot":"","sources":["../../src/service/remote.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,qBAAqB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAO/J,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAEnC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAIlC,MAAM,OAAO,UAAU;IACnB,OAAO,CAAyB;IAChC,KAAK,GAAG,CAAC,CAAC;IACD,IAAI,GAAG,UAAU,EAAE,CAAC;IAG7B,MAAM,CAAC,MAAkB;QACrB,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,IAAI,KAAK;QACL,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;IAC9D,CAAC;IAGD,KAAK,CAAC,IAAI,CAAI,IAA0B,EAAE,MAAoB,EAAE,UAAkB;QAC9E,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5B,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;YAC7B,SAAS,CAAC;gBACN,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACtB,OAAO,SAAS,CAAC;gBACrB,CAAC;gBAED,IAAI,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;oBAClB,OAAO,KAAK,CAAC,KAAK,CAAC;gBACvB,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC;CACJ;AAED,MAAM,UAAU,GAAG,yEAAyE,CAAC;AAU7F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAgB,EAAE,GAAwC,EAAe,EAAE;IACnG,MAAM,IAAI,GAAG,KAAK,EAAE,UAAkB,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAe,EAAgC,EAAE;QACvH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAClH,CAAC;QACD,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACpJ,CAAC,CAAC;IACF,OAAO;QACH,SAAS,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACd,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,eAAe,EAAE,qBAAqB,CAAC,CAAC,EAAE,SAAS,KAAK,IAAI,CAAC;QACtH,CAAC;QACD,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;YAC/G,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;YAC1J,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAClH,CAAC;YACD,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QACrI,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC;QAE9G,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACrB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;YAC5F,CAAC;YACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC;YAClB,CAAC;YACD,OAAO,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5E,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC3B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAC5G,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,aAAa,GAAG,4FAA4F,CAAC;AAI1H,MAAM,CAAC,MAAM,sBAAsB,GAC/B,CAAC,IAAgB,EAAoB,EAAE,CACvC,KAAK,EAAE,MAAM,EAAyB,EAAE;IACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,OAAO,aAAa,EAAE,EAAE,EAAE,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;IACxK,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IAC1G,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACjH,CAAC,CAAC;AAIN,MAAM,CAAC,MAAM,iBAAiB,GAC1B,CAAC,IAAgB,EAAe,EAAE,CAClC,KAAK,EAAE,MAAM,EAAwB,EAAE;IACnC,MAAM,IAAI,GAAqD,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1J,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;IAC1E,OAAO,KAAK,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACnH,CAAC,CAAC;AAIN,MAAM,CAAC,MAAM,kBAAkB,GAC3B,CAAC,IAAgB,EAAgB,EAAE,CACnC,KAAK,EAAE,MAAM,EAAyB,EAAE;IACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC;IACnM,OAAO,KAAK,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACnH,CAAC,CAAC;AAEN,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,IAAgB,EAAU,EAAE,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAsB,EAAE;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC;QAC/F,OAAO,KAAK,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC;IAC/H,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAkB,EAAE;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAErG,OAAO,KAAK,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iDAAiD,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC3G,CAAC;CACJ,CAAC,CAAC"}

package/dist/service/service-key.d.ts

@@ -0,0 +1,9 @@
+import { type VaultFile } from "../vault.js";
+export declare class ServiceKey {
+    #private;
+    constructor(path: string, dir: string);
+    open(): Promise<Buffer | undefined>;
+    adopt(vaultKey: Buffer): Promise<boolean>;
+    merged(vault: VaultFile): Promise<VaultFile>;
+}
+//# sourceMappingURL=service-key.d.ts.map

package/dist/service/service-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-key.d.ts","sourceRoot":"","sources":["../../src/service/service-key.ts"],"names":[],"mappings":"AAKA,OAAO,EAAoB,KAAK,SAAS,EAA6C,MAAM,aAAa,CAAC;AAiB1G,qBAAa,UAAU;;IAKnB,YAAY,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAGpC;IAuBK,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAGxC;IAGK,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAQ9C;IAGK,MAAM,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAGjD;CACJ"}

package/dist/service/service-key.js

@@ -0,0 +1,55 @@
+import { randomBytes } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { isMissing } from "@intentic/base/errors";
+import { writeSecretFile } from "@intentic/local-agent";
+import { z } from "zod";
+import { unwrapPassphrase, WrapSchema, wrapWithPassphrase } from "../vault.js";
+const SERVICE_COST = { N: 2 ** 10, r: 8, p: 1 };
+const ServiceKeyFileSchema = z.object({ secret: z.string().regex(/^[A-Za-z0-9_-]{43}$/u), wrap: WrapSchema.optional() }).strict();
+const sameWrap = (a, b) => a.method === "passphrase" && b.method === "passphrase" && a.salt === b.salt;
+export class ServiceKey {
+    #path;
+    #dir;
+    #file;
+    constructor(path, dir) {
+        this.#path = path;
+        this.#dir = dir;
+    }
+    async #load() {
+        if (this.#file !== undefined) {
+            return this.#file;
+        }
+        try {
+            this.#file = ServiceKeyFileSchema.parse(JSON.parse(await readFile(this.#path, "utf8")));
+        }
+        catch (error) {
+            if (!isMissing(error)) {
+                throw error;
+            }
+            this.#file = { secret: randomBytes(32).toString("base64url") };
+            await this.#save(this.#file);
+        }
+        return this.#file;
+    }
+    async #save(file) {
+        await writeSecretFile(this.#path, this.#dir, `${JSON.stringify(file)}\n`);
+    }
+    async open() {
+        const file = await this.#load();
+        return file.wrap === undefined ? undefined : await unwrapPassphrase([file.wrap], file.secret);
+    }
+    async adopt(vaultKey) {
+        const file = await this.#load();
+        if (file.wrap !== undefined) {
+            return false;
+        }
+        this.#file = { ...file, wrap: await wrapWithPassphrase(vaultKey, file.secret, SERVICE_COST) };
+        await this.#save(this.#file);
+        return true;
+    }
+    async merged(vault) {
+        const wrap = (await this.#load()).wrap;
+        return wrap === undefined || vault.wraps.some((each) => sameWrap(each, wrap)) ? vault : { ...vault, wraps: [...vault.wraps, wrap] };
+    }
+}
+//# sourceMappingURL=service-key.js.map

package/dist/service/service-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-key.js","sourceRoot":"","sources":["../../src/service/service-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAA6B,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAU1G,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAW,CAAC;AAEzD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAGlI,MAAM,QAAQ,GAAG,CAAC,CAAO,EAAE,CAAO,EAAW,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC;AAE5H,MAAM,OAAO,UAAU;IACV,KAAK,CAAS;IACd,IAAI,CAAS;IACtB,KAAK,CAA6B;IAElC,YAAY,IAAY,EAAE,GAAW;QACjC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,KAAK;QACP,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,KAAK,CAAC;QACtB,CAAC;QACD,IAAI,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAoB;QAC5B,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;IAGD,KAAK,CAAC,IAAI;QACN,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAClG,CAAC;IAGD,KAAK,CAAC,KAAK,CAAC,QAAgB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAGD,KAAK,CAAC,MAAM,CAAC,KAAgB;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;QACvC,OAAO,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;IACxI,CAAC;CACJ"}

package/dist/service/service-run.d.ts

@@ -1,3 +1,21 @@
-import { type Runner } from "../run.js";
-export declare const runService: (sid: string, runner?: Runner) => Promise<void>;
+import { type KeyringPaths } from "../address.js";
+import type { Consent } from "../consent/consent.js";
+import type { Runner } from "../run.js";
+import { type VaultFile } from "../vault.js";
+import { type DoorPlace } from "./channel.js";
+import type { Challenge, DoorFile, Proof } from "./door.js";
+import { HelperLink } from "./remote.js";
+export interface ServiceRun {
+    readonly vaultDir: string;
+    readonly place: DoorPlace;
+    readonly consent: (link: HelperLink, files: KeyringPaths) => Consent;
+    readonly helloCredential: (files: KeyringPaths) => Promise<string>;
+    readonly challenge: (files: KeyringPaths) => Promise<Challenge>;
+    readonly proven: (challenge: Challenge, proof: Proof, files: KeyringPaths) => Promise<boolean>;
+    readonly beforeWrite?: (file: VaultFile) => Promise<VaultFile>;
+    readonly afterSetup?: (vaultKey: Buffer) => Promise<void>;
+    readonly publish: (door: DoorFile, log: (message: string) => void) => Promise<void>;
+}
+export declare const provenBy: (run: Pick<ServiceRun, "proven">, files: KeyringPaths, challenge: Challenge, proof: Proof) => Promise<boolean>;
+export declare const runService: (run: ServiceRun, runner: Runner) => Promise<never>;
 //# sourceMappingURL=service-run.d.ts.map

package/dist/service/service-run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-run.d.ts","sourceRoot":"","sources":["../../src/service/service-run.ts"],"names":[],"mappings":"AAWA,OAAO,EAAc,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAYpD,eAAO,MAAM,UAAU,QAAe,MAAM,WAAU,MAAM,KAAgB,OAAO,CAAC,IAAI,CAyDvF,CAAC"}
+{"version":3,"file":"service-run.d.ts","sourceRoot":"","sources":["../../src/service/service-run.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,YAAY,EAAgB,MAAM,eAAe,CAAC;AAGhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAIrD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAExC,OAAO,EAAmC,KAAK,SAAS,EAAkB,MAAM,aAAa,CAAC;AAE9F,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,cAAc,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAgB,MAAM,aAAa,CAAC;AAOvD,MAAM,WAAW,UAAU;IAEvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IACrE,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnE,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAEhE,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE/F,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF;AAUD,eAAO,MAAM,QAAQ,QAAe,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,SAAS,YAAY,aAAa,SAAS,SAAS,KAAK,KAAG,OAAO,CAAC,OAAO,CAaxI,CAAC;AAsBF,eAAO,MAAM,UAAU,QAAe,UAAU,UAAU,MAAM,KAAG,OAAO,CAAC,KAAK,CAqC/E,CAAC"}