@intentic/keyring 1.343.0 → 1.345.0

package/dist/service/service-run.js

@@ -1,37 +1,62 @@
-import { randomBytes } from "node:crypto";
 import { appendFile } from "node:fs/promises";
+import { randomBytes } from "node:crypto";
 import { sleep } from "@intentic/base/async";
-import { writeFileAtomic } from "@intentic/base/fs";
 import { keyringPaths } from "../address.js";
 import { fileAudit } from "../audit.js";
 import { BackendReader } from "../backends.js";
-import { helloConsent, passphraseConsent, serialConsent } from "../consent/consent.js";
 import { Keyring } from "../core.js";
 import { fetchSandboxKeys } from "../keyring-fetch.js";
 import { loadKeys, saveKeys } from "../keys.js";
-import { realRunner } from "../run.js";
-import { helloWrapOf, readVaultFile, unwrapPassphrase, writeVaultFile } from "../vault.js";
+import { readVaultFile, unwrapPassphrase, writeVaultFile } from "../vault.js";
 import { KEYRING_VERSION } from "../version.js";
-import { doorAcl } from "./acl.js";
 import { serveDoor } from "./channel.js";
-import { helloSigned } from "./hello-verify.js";
-import { hardenedPaths } from "./paths.js";
-import { HelperLink, remoteHello, remotePassphrasePrompt, remoteTypist } from "./remote.js";
-export const runService = async (sid, runner = realRunner) => {
-    const paths = hardenedPaths(sid);
-    const files = keyringPaths(paths.vaultDir, "linux");
+import { HelperLink, remoteTypist } from "./remote.js";
+const recoveryOpens = async (files, passphrase) => {
+    const file = await readVaultFile(files.vault);
+    const key = file === undefined ? undefined : await unwrapPassphrase(file.wraps, passphrase);
+    key?.fill(0);
+    return key !== undefined;
+};
+export const provenBy = async (run, files, challenge, proof) => {
+    switch (proof.method) {
+        case "declined":
+            return false;
+        case "unset":
+            return challenge.method === "unset" && (await readVaultFile(files.vault)) === undefined;
+        case "passphrase":
+            return await recoveryOpens(files, proof.passphrase);
+        default:
+            return await run.proven(challenge, proof, files);
+    }
+};
+const withAfterSetup = (keyring, run, files) => ({
+    handle: async (request) => {
+        const answer = await keyring.handle(request);
+        if (request.op === "setup" && answer.ok && run.afterSetup !== undefined) {
+            const file = await readVaultFile(files.vault);
+            const key = file === undefined ? undefined : await unwrapPassphrase(file.wraps, request.passphrase);
+            if (key !== undefined) {
+                await run.afterSetup(key);
+                key.fill(0);
+                if (file !== undefined && run.beforeWrite !== undefined) {
+                    await writeVaultFile(files.vault, files.dir, await run.beforeWrite(file));
+                }
+            }
+        }
+        return answer;
+    },
+});
+export const runService = async (run, runner) => {
+    const files = keyringPaths(run.vaultDir, "linux");
     const log = (message) => {
         void appendFile(files.log, `${new Date().toISOString()} service: ${message}\n`).catch(() => undefined);
     };
-    const pin = async () => {
-        const wrap = helloWrapOf((await readVaultFile(files.vault))?.wraps ?? []);
-        return wrap?.publicKey === undefined ? undefined : { credential: wrap.credential, publicKey: wrap.publicKey };
-    };
     const link = new HelperLink();
+    const beforeWrite = run.beforeWrite ?? ((file) => Promise.resolve(file));
     const keyring = new Keyring({
-        vault: { read: async () => await readVaultFile(files.vault), write: async (file) => await writeVaultFile(files.vault, files.dir, file) },
+        vault: { read: async () => await readVaultFile(files.vault), write: async (file) => await writeVaultFile(files.vault, files.dir, await beforeWrite(file)) },
         keys: { read: async () => await loadKeys(files.keys, files.dir), write: async (keys) => await saveKeys(files.keys, files.dir, keys) },
-        consent: serialConsent(helloConsent(remoteHello(link, pin), passphraseConsent(remotePassphrasePrompt(link)))),
+        consent: run.consent(link, files),
         typist: remoteTypist(link),
         backends: new BackendReader(runner),
         fetchKeys: async (sandbox) => await fetchSandboxKeys(sandbox),
@@ -39,39 +64,20 @@ export const runService = async (sid, runner = realRunner) => {
         now: Date.now,
         sleep: async (ms) => await sleep(ms),
         version: KEYRING_VERSION,
-        helloCredential: (await pin())?.credential ?? "intentic-keyring",
+        helloCredential: await run.helloCredential(files),
     });
     const token = randomBytes(32).toString("base64url");
     const { port } = await serveDoor({
-        handler: keyring,
+        handler: withAfterSetup(keyring, run, files),
         link,
         token,
-        challenge: async () => {
-            const pinned = await pin();
-            return pinned === undefined ? { method: "passphrase" } : { method: "hello", credential: pinned.credential, challenge: randomBytes(32).toString("base64url") };
-        },
-        proven: async (challenge, proof) => {
-            if (challenge.method === "hello" && proof.method === "hello") {
-                const pinned = await pin();
-                return pinned !== undefined && helloSigned(pinned.publicKey, challenge.challenge, proof.signature);
-            }
-            if (proof.method === "passphrase") {
-                const file = await readVaultFile(files.vault);
-                const key = file === undefined ? undefined : await unwrapPassphrase(file.wraps, proof.passphrase);
-                key?.fill(0);
-                return key !== undefined;
-            }
-            return false;
-        },
+        challenge: async () => ((await readVaultFile(files.vault)) === undefined ? { method: "unset" } : await run.challenge(files)),
+        proven: async (challenge, proof) => await provenBy(run, files, challenge, proof),
         log,
-    });
-    await writeFileAtomic(paths.door, `${JSON.stringify({ port, token, pid: process.pid })}\n`, 0o600);
-    const acl = doorAcl(paths.door, sid);
-    const set = await runner({ command: "icacls", args: [acl.path, ...acl.args], timeoutMs: 20_000 });
-    if (set.exitCode !== 0) {
-        log(`icacls on the door file failed (exit ${String(set.exitCode)}): the session helper cannot read it`);
-    }
-    log(`keyring ${KEYRING_VERSION} listening on 127.0.0.1:${String(port)}`);
-    await new Promise(() => undefined);
+    }, run.place);
+    const door = run.place.kind === "unix" ? { socket: run.place.path, token, pid: process.pid } : { port: port ?? 0, token, pid: process.pid };
+    await run.publish(door, log);
+    log(`keyring ${KEYRING_VERSION} listening on ${run.place.kind === "unix" ? run.place.path : `127.0.0.1:${String(port)}`}`);
+    return await new Promise(() => undefined);
 };
 //# sourceMappingURL=service-run.js.map

package/dist/service/service-run.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-run.js","sourceRoot":"","sources":["../../src/service/service-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,UAAU,EAAe,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAiB,WAAW,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAK3G,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAW,EAAE,MAAM,GAAW,UAAU,EAAiB,EAAE;IACxF,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAElC,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3G,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,IAAmC,EAAE;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAClH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;QACxI,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;QACrI,OAAO,EAAE,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC;QACnC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7D,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;QACxC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,eAAe;QACxB,eAAe,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,UAAU,IAAI,kBAAkB;KACnE,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAAC;QAC7B,OAAO,EAAE,OAAO;QAChB,IAAI;QACJ,KAAK;QACL,SAAS,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;YAC3B,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClK,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC3D,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;gBAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;gBAClG,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBACb,OAAO,GAAG,KAAK,SAAS,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,GAAG;KACN,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnG,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;IAC5G,CAAC;IACD,GAAG,CAAC,WAAW,eAAe,2BAA2B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,OAAO,CAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC9C,CAAC,CAAC"}
+{"version":3,"file":"service-run.js","sourceRoot":"","sources":["../../src/service/service-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAqB,YAAY,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAkB,cAAc,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAkB,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAyBvD,MAAM,aAAa,GAAG,KAAK,EAAE,KAAmB,EAAE,UAAkB,EAAoB,EAAE;IACtF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5F,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO,GAAG,KAAK,SAAS,CAAC;AAC7B,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,GAA+B,EAAE,KAAmB,EAAE,SAAoB,EAAE,KAAY,EAAoB,EAAE;IACzI,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,UAAU;YACX,OAAO,KAAK,CAAC;QAGjB,KAAK,OAAO;YACR,OAAO,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC;QAC5F,KAAK,YAAY;YACb,OAAO,MAAM,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD;YACI,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACzD,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,cAAc,GAAG,CAAC,OAAgB,EAAE,GAAe,EAAE,KAAmB,EAAkB,EAAE,CAAC,CAAC;IAChG,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7C,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACpG,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACpB,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACZ,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;oBACtD,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,GAAe,EAAE,MAAc,EAAkB,EAAE;IAChF,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAElC,KAAK,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3G,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,UAAU,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,CAAC,CAAC,IAAe,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE;QAC3J,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;QACrI,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;QAC1B,QAAQ,EAAE,IAAI,aAAa,CAAC,MAAM,CAAC;QACnC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC;QAC7D,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC;QACxC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,eAAe;QACxB,eAAe,EAAE,MAAM,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC;KACpD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,SAAS,CAC5B;QACI,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC;QAC5C,IAAI;QACJ,KAAK;QACL,SAAS,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC5H,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC;QAChF,GAAG;KACN,EACD,GAAG,CAAC,KAAK,CACZ,CAAC;IACF,MAAM,IAAI,GAAa,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IACtJ,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7B,GAAG,CAAC,WAAW,eAAe,iBAAiB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3H,OAAO,MAAM,IAAI,OAAO,CAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AACrD,CAAC,CAAC"}

package/dist/service/user.d.ts

@@ -0,0 +1,8 @@
+import type { Runner } from "../run.js";
+export declare const NOT_ON_MAC = "Passwords needs the Intentic desktop app's protected service, which is not on macOS yet.";
+export type ServicePlatform = "windows" | "linux" | "darwin";
+export declare const servicePlatform: (platform?: NodeJS.Platform) => ServicePlatform | undefined;
+export declare const serviceUserId: (runner: Runner, platform?: NodeJS.Platform) => Promise<string>;
+export declare const serviceInstalledHere: (runner: Runner, platform?: NodeJS.Platform) => Promise<boolean>;
+export declare const helloHere: (runner: Runner, platform?: NodeJS.Platform) => Promise<boolean>;
+//# sourceMappingURL=user.d.ts.map

package/dist/service/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/service/user.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AASxC,eAAO,MAAM,UAAU,6FAA6F,CAAC;AAErH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7D,eAAO,MAAM,eAAe,cAAc,MAAM,CAAC,QAAQ,KAAsB,eAAe,GAAG,SAWhG,CAAC;AAWF,eAAO,MAAM,aAAa,WAAkB,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,MAAM,CAC/C,CAAC;AAGnE,eAAO,MAAM,oBAAoB,WAAkB,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,OAAO,CAWxH,CAAC;AAGF,eAAO,MAAM,SAAS,WAAkB,MAAM,aAAY,MAAM,CAAC,QAAQ,KAAsB,OAAO,CAAC,OAAO,CAA4E,CAAC"}

package/dist/service/user.js

@@ -0,0 +1,39 @@
+import { windowsHello } from "../consent/consent-windows.js";
+import { linuxServiceInstalled } from "./linux/paths-linux.js";
+import { windowsServiceInstalled } from "./windows/paths-windows.js";
+import { currentSid } from "./windows/sid-windows.js";
+export const NOT_ON_MAC = "Passwords needs the Intentic desktop app's protected service, which is not on macOS yet.";
+export const servicePlatform = (platform = process.platform) => {
+    switch (platform) {
+        case "win32":
+            return "windows";
+        case "linux":
+            return "linux";
+        case "darwin":
+            return "darwin";
+        default:
+            return undefined;
+    }
+};
+const currentUid = () => {
+    const uid = process.getuid?.();
+    if (uid === undefined) {
+        throw new Error("this process has no user id to read");
+    }
+    return String(uid);
+};
+export const serviceUserId = async (runner, platform = process.platform) => platform === "win32" ? await currentSid(runner) : currentUid();
+export const serviceInstalledHere = async (runner, platform = process.platform) => {
+    if (platform !== "win32" && platform !== "linux") {
+        return false;
+    }
+    try {
+        const id = await serviceUserId(runner, platform);
+        return platform === "win32" ? windowsServiceInstalled(id) : linuxServiceInstalled(id);
+    }
+    catch {
+        return false;
+    }
+};
+export const helloHere = async (runner, platform = process.platform) => (platform === "win32" ? await windowsHello(runner).available() : false);
+//# sourceMappingURL=user.js.map

package/dist/service/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/service/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAE7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAMtD,MAAM,CAAC,MAAM,UAAU,GAAG,0FAA0F,CAAC;AAIrH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAA+B,EAAE;IACzG,QAAQ,QAAQ,EAAE,CAAC;QACf,KAAK,OAAO;YACR,OAAO,SAAS,CAAC;QACrB,KAAK,OAAO;YACR,OAAO,OAAO,CAAC;QACnB,KAAK,QAAQ;YACT,OAAO,QAAQ,CAAC;QACpB;YACI,OAAO,SAAS,CAAC;IACzB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,GAAW,EAAE;IAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,MAAc,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAmB,EAAE,CACjH,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AAGnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,MAAc,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAoB,EAAE;IACzH,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjD,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,QAAQ,GAAoB,OAAO,CAAC,QAAQ,EAAoB,EAAE,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC"}

package/dist/service/{acl.d.ts → windows/acl-windows.d.ts}

@@ -1,9 +1,9 @@
-import { type HardenedPaths } from "./paths.js";
+import { type WindowsServicePaths } from "./paths-windows.js";
 export interface IcaclsCall {
     readonly path: string;
     readonly args: readonly string[];
 }
-export declare const hardenedAcls: (paths: HardenedPaths) => readonly IcaclsCall[];
+export declare const windowsServiceAcls: (paths: WindowsServicePaths) => readonly IcaclsCall[];
 export declare const doorAcl: (door: string, userSid: string) => IcaclsCall;
 export declare const markerAcl: (marker: string) => IcaclsCall;
-//# sourceMappingURL=acl.d.ts.map
+//# sourceMappingURL=acl-windows.d.ts.map

package/dist/service/windows/acl-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/acl-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,mBAAmB,EAA4C,MAAM,oBAAoB,CAAC;AAO5H,MAAM,WAAW,UAAU;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,eAAO,MAAM,kBAAkB,UAAW,mBAAmB,KAAG,SAAS,UAAU,EAiBlF,CAAC;AAGF,eAAO,MAAM,OAAO,SAAU,MAAM,WAAW,MAAM,KAAG,UAGtD,CAAC;AAGH,eAAO,MAAM,SAAS,WAAY,MAAM,KAAG,UAGzC,CAAC"}

package/dist/service/{acl.js → windows/acl-windows.js}

@@ -1,6 +1,6 @@
-import { ADMINISTRATORS_SID, LOCAL_SERVICE_SID, SYSTEM_SID, USERS_SID } from "./paths.js";
+import { ADMINISTRATORS_SID, LOCAL_SERVICE_SID, SYSTEM_SID, USERS_SID } from "./paths-windows.js";
 const grant = (sid, rights) => `*${sid}:${rights}`;
-export const hardenedAcls = (paths) => [
+export const windowsServiceAcls = (paths) => [
     {
         path: paths.root,
         args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "(OI)(CI)F"), grant(ADMINISTRATORS_SID, "(OI)(CI)F"), grant(LOCAL_SERVICE_SID, "(M)"), grant(USERS_SID, "(RX)")],
@@ -22,4 +22,4 @@ export const markerAcl = (marker) => ({
     path: marker,
     args: ["/inheritance:r", "/grant:r", grant(SYSTEM_SID, "F"), grant(ADMINISTRATORS_SID, "F"), grant(USERS_SID, "R")],
 });
-//# sourceMappingURL=acl.js.map
+//# sourceMappingURL=acl-windows.js.map

package/dist/service/windows/acl-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-windows.js","sourceRoot":"","sources":["../../../src/service/windows/acl-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA4B,iBAAiB,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK5H,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,MAAc,EAAU,EAAE,CAAC,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;AAO3E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAA0B,EAAyB,EAAE,CAAC;IAGrF;QACI,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;KAC1K;IAED;QACI,IAAI,EAAE,KAAK,CAAC,GAAG;QACf,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;KACvL;IAED;QACI,IAAI,EAAE,KAAK,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;KACtJ;CACJ,CAAC;AAGF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,OAAe,EAAc,EAAE,CAAC,CAAC;IACnE,IAAI,EAAE,IAAI;IACV,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;CACnJ,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAc,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;CACtH,CAAC,CAAC"}

package/dist/service/{install.d.ts → windows/install-windows.d.ts}

@@ -1,4 +1,4 @@
-import type { Runner } from "../run.js";
+import type { Runner } from "../../run.js";
 export declare const installService: (runner: Runner, program?: string) => Promise<{
     readonly sid: string;
     readonly moved: readonly string[];
@@ -6,5 +6,7 @@ export declare const installService: (runner: Runner, program?: string) => Promi
 export declare const uninstallService: (runner: Runner) => Promise<{
     readonly sid: string;
     readonly restored: readonly string[];
+    readonly swept: readonly string[];
+    readonly left: readonly string[];
 }>;
-//# sourceMappingURL=install.d.ts.map
+//# sourceMappingURL=install-windows.d.ts.map

package/dist/service/windows/install-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/install-windows.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAoC3C,eAAO,MAAM,cAAc,WAAkB,MAAM,YAAW,MAAM,KAAsB,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAoC5J,CAAC;AAIF,eAAO,MAAM,gBAAgB,WACjB,MAAM,KACf,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAe7I,CAAC"}

package/dist/service/{install.js → windows/install-windows.js}

@@ -2,12 +2,13 @@ import { copyFile, mkdir, readdir, rm, stat } from "node:fs/promises";
 import { basename, join } from "node:path";
 import { writeFileAtomic } from "@intentic/base/fs";
 import { z } from "zod";
-import { keyringPaths } from "../address.js";
-import { runPowerShell } from "../powershell.js";
-import { hardenedAcls, markerAcl } from "./acl.js";
-import { hardenedPaths } from "./paths.js";
-import { currentSid } from "./sid.js";
-import { REGISTER_TASK_SCRIPT, STOP_TASK_SCRIPT, taskInput, UNREGISTER_TASK_SCRIPT } from "./task.js";
+import { keyringPaths } from "../../address.js";
+import { runPowerShell } from "../../powershell.js";
+import { windowsServiceAcls, markerAcl } from "./acl-windows.js";
+import { sweepWindowsLeftovers } from "./leftovers-windows.js";
+import { windowsServicePaths } from "./paths-windows.js";
+import { currentSid } from "./sid-windows.js";
+import { REGISTER_TASK_SCRIPT, STOP_TASK_SCRIPT, taskInput, UNREGISTER_TASK_SCRIPT } from "./task-windows.js";
 const VAULT_FILES = ["vault.json", "keys.json", "audit.jsonl"];
 const TaskAnswerSchema = z.object({ ok: z.boolean(), error: z.string().optional() });
 const exists = async (path) => await stat(path).then(() => true, () => false);
@@ -27,13 +28,13 @@ const carry = async (from, to) => {
 };
 export const installService = async (runner, program = process.execPath) => {
     if (!basename(program).toLowerCase().startsWith("intentic-keyring")) {
-        throw new Error("Hardened mode installs the compiled keyring itself: run it as intentic-keyring.exe.");
+        throw new Error("The service installs the compiled keyring itself: run it as intentic-keyring.exe.");
     }
     const sid = await currentSid(runner);
-    const paths = hardenedPaths(sid);
+    const paths = windowsServicePaths(sid);
     await mkdir(paths.bin, { recursive: true });
     await mkdir(paths.vaultDir, { recursive: true });
-    for (const call of hardenedAcls(paths)) {
+    for (const call of windowsServiceAcls(paths)) {
         await icacls(runner, call);
     }
     await runPowerShell(runner, { script: STOP_TASK_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskAnswerSchema);
@@ -60,7 +61,7 @@ export const installService = async (runner, program = process.execPath) => {
 };
 export const uninstallService = async (runner) => {
     const sid = await currentSid(runner);
-    const paths = hardenedPaths(sid);
+    const paths = windowsServicePaths(sid);
     await runPowerShell(runner, { script: UNREGISTER_TASK_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskAnswerSchema);
     const own = keyringPaths();
     await mkdir(own.dir, { recursive: true });
@@ -72,6 +73,6 @@ export const uninstallService = async (runner) => {
     }
     await rm(paths.marker, { force: true });
     await rm(paths.door, { force: true });
-    return { sid, restored };
+    return { sid, restored, ...(await sweepWindowsLeftovers(runner, paths, sid)) };
 };
-//# sourceMappingURL=install.js.map
+//# sourceMappingURL=install-windows.js.map

package/dist/service/windows/install-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-windows.js","sourceRoot":"","sources":["../../../src/service/windows/install-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,kBAAkB,EAAmB,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAS9G,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AACxE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAErF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAExG,MAAM,MAAM,GAAG,KAAK,EAAE,MAAc,EAAE,IAAgB,EAAiB,EAAE;IACrE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACvG,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,IAAI,iBAAiB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrI,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAoB,EAAE;IAC/D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAE,OAAO,GAAW,OAAO,CAAC,QAAQ,EAAwE,EAAE;IAC7J,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,KAAK,MAAM,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC7H,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACL,CAAC;IACL,CAAC;IAID,IAAI,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClH,MAAM,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACpJ,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,+CAA+C,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACzJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACjC,MAAc,EAC8H,EAAE;IAC9I,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,sBAAsB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACnI,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,qBAAqB,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC,CAAC"}

package/dist/service/windows/leftovers-windows.d.ts

@@ -0,0 +1,8 @@
+import type { Runner } from "../../run.js";
+import type { WindowsServicePaths } from "./paths-windows.js";
+export declare const othersInstalled: (rootNames: readonly string[], sid: string) => boolean;
+export declare const sweepWindowsLeftovers: (runner: Runner, paths: WindowsServicePaths, sid: string) => Promise<{
+    readonly swept: readonly string[];
+    readonly left: readonly string[];
+}>;
+//# sourceMappingURL=leftovers-windows.d.ts.map

package/dist/service/windows/leftovers-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leftovers-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/leftovers-windows.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAW9D,eAAO,MAAM,eAAe,cAAe,SAAS,MAAM,EAAE,OAAO,MAAM,KAAG,OACoD,CAAC;AAQjI,eAAO,MAAM,qBAAqB,WAAkB,MAAM,SAAS,mBAAmB,OAAO,MAAM,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAiCpL,CAAC"}

package/dist/service/windows/leftovers-windows.js

@@ -0,0 +1,44 @@
+import { readdir, rm, rmdir } from "node:fs/promises";
+import { dirname } from "node:path";
+import { errorMessage } from "@intentic/base/errors";
+import { z } from "zod";
+import { runPowerShell } from "../../powershell.js";
+import { REMOVE_TASK_FOLDER_SCRIPT, taskInput } from "./task-windows.js";
+export const othersInstalled = (rootNames, sid) => rootNames.some((name) => name.toLowerCase().endsWith(".hardened") && name.toLowerCase() !== `${sid}.hardened`.toLowerCase());
+const TaskFolderAnswerSchema = z.object({ ok: z.boolean(), removed: z.boolean().optional(), error: z.string().optional() });
+const removeIfEmpty = async (dir) => await rmdir(dir).then(() => true, () => false);
+export const sweepWindowsLeftovers = async (runner, paths, sid) => {
+    const swept = [];
+    const left = [];
+    if (await removeIfEmpty(paths.vaultDir)) {
+        swept.push(paths.vaultDir);
+    }
+    const names = await readdir(paths.root).catch((error) => {
+        left.push(`${paths.root} (${errorMessage(error)})`);
+        return undefined;
+    });
+    if (names === undefined || othersInstalled(names, sid)) {
+        return { swept, left };
+    }
+    try {
+        await rm(paths.bin, { recursive: true, force: true });
+        swept.push(paths.bin);
+    }
+    catch (error) {
+        left.push(`${paths.bin} (${errorMessage(error)})`);
+    }
+    for (const dir of [paths.root, dirname(paths.root)]) {
+        if (await removeIfEmpty(dir)) {
+            swept.push(dir);
+        }
+    }
+    const folder = await runPowerShell(runner, { script: REMOVE_TASK_FOLDER_SCRIPT, input: taskInput(paths, sid), timeoutMs: 60_000 }, TaskFolderAnswerSchema);
+    if (folder.ok && folder.answer.removed === true) {
+        swept.push(`Task Scheduler ${paths.taskPath}`);
+    }
+    else if (!folder.ok || !folder.answer.ok) {
+        left.push(`Task Scheduler ${paths.taskPath} (${folder.ok ? (folder.answer.error ?? "no reason given") : folder.reason})`);
+    }
+    return { swept, left };
+};
+//# sourceMappingURL=leftovers-windows.js.map

package/dist/service/windows/leftovers-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leftovers-windows.js","sourceRoot":"","sources":["../../../src/service/windows/leftovers-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAUzE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAA4B,EAAE,GAAW,EAAW,EAAE,CAClF,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,GAAG,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;AAEjI,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAG5H,MAAM,aAAa,GAAG,KAAK,EAAE,GAAW,EAAoB,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAG9G,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EAAE,MAAc,EAAE,KAA0B,EAAE,GAAW,EAAoF,EAAE;IACrL,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAY,EAAE,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC;QAED,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAElD,IAAI,MAAM,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;IAC3J,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnD,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9H,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC,CAAC"}

package/dist/service/{paths.d.ts → windows/paths-windows.d.ts}

@@ -3,7 +3,7 @@ export declare const SYSTEM_SID = "S-1-5-18";
 export declare const LOCAL_SERVICE_SID = "S-1-5-19";
 export declare const ADMINISTRATORS_SID = "S-1-5-32-544";
 export declare const USERS_SID = "S-1-5-32-545";
-export interface HardenedPaths {
+export interface WindowsServicePaths {
     readonly root: string;
     readonly bin: string;
     readonly exe: string;
@@ -13,7 +13,6 @@ export interface HardenedPaths {
     readonly taskPath: string;
     readonly taskName: string;
 }
-export declare const hardenedRoot: (env?: NodeJS.ProcessEnv) => string;
-export declare const hardenedPaths: (sid: string, env?: NodeJS.ProcessEnv) => HardenedPaths;
-export declare const isHardened: (sid: string, env?: NodeJS.ProcessEnv) => boolean;
-//# sourceMappingURL=paths.d.ts.map
+export declare const windowsServicePaths: (sid: string, env?: NodeJS.ProcessEnv) => WindowsServicePaths;
+export declare const windowsServiceInstalled: (sid: string, env?: NodeJS.ProcessEnv) => boolean;
+//# sourceMappingURL=paths-windows.d.ts.map

package/dist/service/windows/paths-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/paths-windows.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,MAAM,QAAsB,CAAC;AAG1C,eAAO,MAAM,UAAU,aAAa,CAAC;AACrC,eAAO,MAAM,iBAAiB,aAAa,CAAC;AAC5C,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AACjD,eAAO,MAAM,SAAS,iBAAiB,CAAC;AAExC,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAID,eAAO,MAAM,mBAAmB,QAAS,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,mBAgBvF,CAAC;AAEF,eAAO,MAAM,uBAAuB,QAAS,MAAM,QAAO,MAAM,CAAC,UAAU,KAAiB,OAA2D,CAAC"}

package/dist/service/{paths.js → windows/paths-windows.js}

@@ -5,12 +5,12 @@ export const SYSTEM_SID = "S-1-5-18";
 export const LOCAL_SERVICE_SID = "S-1-5-19";
 export const ADMINISTRATORS_SID = "S-1-5-32-544";
 export const USERS_SID = "S-1-5-32-545";
-export const hardenedRoot = (env = process.env) => join(env["ProgramData"] ?? env["PROGRAMDATA"] ?? "C:\\ProgramData", "Intentic", "Keyring");
-export const hardenedPaths = (sid, env = process.env) => {
+const windowsServiceRoot = (env = process.env) => join(env["ProgramData"] ?? env["PROGRAMDATA"] ?? "C:\\ProgramData", "Intentic", "Keyring");
+export const windowsServicePaths = (sid, env = process.env) => {
     if (!SID_RE.test(sid)) {
         throw new Error(`"${sid}" is not a Windows security identifier`);
     }
-    const root = hardenedRoot(env);
+    const root = windowsServiceRoot(env);
     const bin = join(root, "bin");
     return {
         root,
@@ -23,5 +23,5 @@ export const hardenedPaths = (sid, env = process.env) => {
         taskName: `Keyring-${sid}`,
     };
 };
-export const isHardened = (sid, env = process.env) => existsSync(hardenedPaths(sid, env).marker);
-//# sourceMappingURL=paths.js.map
+export const windowsServiceInstalled = (sid, env = process.env) => existsSync(windowsServicePaths(sid, env).marker);
+//# sourceMappingURL=paths-windows.js.map

package/dist/service/windows/paths-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-windows.js","sourceRoot":"","sources":["../../../src/service/windows/paths-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAYjC,MAAM,CAAC,MAAM,MAAM,GAAG,mBAAmB,CAAC;AAG1C,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,UAAU,CAAC;AAC5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AACjD,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AAcxC,MAAM,kBAAkB,GAAG,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,iBAAiB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;AAExK,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAuB,EAAE;IAC1G,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,wCAAwC,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO;QACH,IAAI;QACJ,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,sBAAsB,CAAC;QACtC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,YAAY,CAAC;QACpC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,WAAW,CAAC;QACrC,QAAQ,EAAE,cAAc;QACxB,QAAQ,EAAE,WAAW,GAAG,EAAE;KAC7B,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAW,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/service/windows/service-run-windows.d.ts

@@ -0,0 +1,4 @@
+import type { Runner } from "../../run.js";
+import type { ServiceRun } from "../service-run.js";
+export declare const windowsServiceRun: (sid: string, runner: Runner) => ServiceRun;
+//# sourceMappingURL=service-run-windows.d.ts.map

package/dist/service/windows/service-run-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-run-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/service-run-windows.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAM3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAWpD,eAAO,MAAM,iBAAiB,QAAS,MAAM,UAAU,MAAM,KAAG,UAmC/D,CAAC"}

package/dist/service/windows/service-run-windows.js

@@ -0,0 +1,46 @@
+import { randomBytes } from "node:crypto";
+import { writeFileAtomic } from "@intentic/base/fs";
+import { helloConsent, passphraseConsent, serialConsent } from "../../consent/consent.js";
+import { helloWrapOf, readVaultFile } from "../../vault.js";
+import { doorAcl } from "./acl-windows.js";
+import { helloSigned } from "../hello-verify.js";
+import { windowsServicePaths } from "./paths-windows.js";
+import { remoteChoicePrompt, remoteHello, remotePassphrasePrompt, remoteValuePrompt } from "../remote.js";
+const SERVICE_CREDENTIAL = "intentic-keyring";
+export const windowsServiceRun = (sid, runner) => {
+    const paths = windowsServicePaths(sid);
+    const pinOf = async (vault) => {
+        const wrap = helloWrapOf((await readVaultFile(vault))?.wraps ?? []);
+        return wrap?.publicKey === undefined ? undefined : { credential: wrap.credential, publicKey: wrap.publicKey };
+    };
+    return {
+        vaultDir: paths.vaultDir,
+        place: { kind: "tcp" },
+        consent: (link, files) => {
+            const recovery = passphraseConsent(remotePassphrasePrompt(link));
+            const withBox = { ...recovery, askValue: remoteValuePrompt(link), choose: remoteChoicePrompt(link) };
+            return serialConsent(helloConsent(remoteHello(link, async () => await pinOf(files.vault)), withBox));
+        },
+        helloCredential: async (files) => (await pinOf(files.vault))?.credential ?? SERVICE_CREDENTIAL,
+        challenge: async (files) => {
+            const pinned = await pinOf(files.vault);
+            return pinned === undefined ? { method: "passphrase" } : { method: "hello", credential: pinned.credential, challenge: randomBytes(32).toString("base64url") };
+        },
+        proven: async (challenge, proof, files) => {
+            if (challenge.method !== "hello" || proof.method !== "hello") {
+                return false;
+            }
+            const pinned = await pinOf(files.vault);
+            return pinned !== undefined && helloSigned(pinned.publicKey, challenge.challenge, proof.signature);
+        },
+        publish: async (door, log) => {
+            await writeFileAtomic(paths.door, `${JSON.stringify(door)}\n`, 0o600);
+            const acl = doorAcl(paths.door, sid);
+            const set = await runner({ command: "icacls", args: [acl.path, ...acl.args], timeoutMs: 20_000 });
+            if (set.exitCode !== 0) {
+                log(`icacls on the door file failed (exit ${String(set.exitCode)}): the session helper cannot read it`);
+            }
+        },
+    };
+};
+//# sourceMappingURL=service-run-windows.js.map

package/dist/service/windows/service-run-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-run-windows.js","sourceRoot":"","sources":["../../../src/service/windows/service-run-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAiB,kBAAkB,EAAE,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAUzH,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAE,MAAc,EAAc,EAAE;IACzE,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,KAAK,EAAE,KAAa,EAAiC,EAAE;QACjE,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,EAAE,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAClH,CAAC,CAAC;IACF,OAAO;QACH,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;QACtB,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACrB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrG,OAAO,aAAa,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACzG,CAAC;QACD,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,IAAI,kBAAkB;QAC9F,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClK,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACtC,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC3D,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACvG,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACzB,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACrC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAClG,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,wCAAwC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,sCAAsC,CAAC,CAAC;YAC5G,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/service/windows/session-windows.d.ts

@@ -0,0 +1,4 @@
+import type { Runner } from "../../run.js";
+import type { SessionPlatform } from "../helper.js";
+export declare const windowsSession: (runner: Runner) => Promise<SessionPlatform>;
+//# sourceMappingURL=session-windows.d.ts.map

package/dist/service/windows/session-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/session-windows.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAOpD,eAAO,MAAM,cAAc,WAAkB,MAAM,KAAG,OAAO,CAAC,eAAe,CAO5E,CAAC"}

package/dist/service/windows/session-windows.js

@@ -0,0 +1,13 @@
+import { windowsChoicePrompt, windowsHello, windowsPassphrasePrompt, windowsValuePrompt } from "../../consent/consent-windows.js";
+import { platformTypist } from "../../typing/index.js";
+import { windowsServicePaths } from "./paths-windows.js";
+import { currentSid } from "./sid-windows.js";
+export const windowsSession = async (runner) => {
+    const paths = windowsServicePaths(await currentSid(runner));
+    return {
+        doorFile: paths.door,
+        noService: "Passwords' service is not running yet: it starts with Windows (Task Scheduler, \\Intentic\\).",
+        hands: { hello: windowsHello(runner), passphrase: windowsPassphrasePrompt(runner), value: windowsValuePrompt(runner), choose: windowsChoicePrompt(runner), typist: platformTypist(runner) },
+    };
+};
+//# sourceMappingURL=session-windows.js.map

package/dist/service/windows/session-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-windows.js","sourceRoot":"","sources":["../../../src/service/windows/session-windows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAElI,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAK9C,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAA4B,EAAE;IAC7E,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D,OAAO;QACH,QAAQ,EAAE,KAAK,CAAC,IAAI;QACpB,SAAS,EAAE,+FAA+F;QAC1G,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE;KAC9L,CAAC;AACN,CAAC,CAAC"}

package/dist/service/windows/sid-windows.d.ts

@@ -0,0 +1,3 @@
+import type { Runner } from "../../run.js";
+export declare const currentSid: (runner: Runner) => Promise<string>;
+//# sourceMappingURL=sid-windows.d.ts.map

package/dist/service/windows/sid-windows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sid-windows.d.ts","sourceRoot":"","sources":["../../../src/service/windows/sid-windows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAK3C,eAAO,MAAM,UAAU,WAAkB,MAAM,KAAG,OAAO,CAAC,MAAM,CAO/D,CAAC"}

package/dist/service/{sid.js → windows/sid-windows.js}

@@ -1,4 +1,4 @@
-import { SID_RE } from "./paths.js";
+import { SID_RE } from "./paths-windows.js";
 export const currentSid = async (runner) => {
     const answer = await runner({ command: "whoami", args: ["/user", "/fo", "csv", "/nh"], timeoutMs: 10_000 });
     const sid = /"(?<sid>S-1-[\d-]+)"/u.exec(answer.stdout)?.groups?.["sid"];
@@ -7,4 +7,4 @@ export const currentSid = async (runner) => {
     }
     return sid;
 };
-//# sourceMappingURL=sid.js.map
+//# sourceMappingURL=sid-windows.js.map

package/dist/service/windows/sid-windows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sid-windows.js","sourceRoot":"","sources":["../../../src/service/windows/sid-windows.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAI5C,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;IACzE,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC"}