@intentic/keyring 1.344.0 → 1.345.0

package/dist/service/helper.js

@@ -3,18 +3,18 @@ import { connect } from "node:net";
 import { sleep } from "@intentic/base/async";
 import { claimPidFile } from "@intentic/local-agent";
 import { keyringPaths } from "../address.js";
-import { windowsHello, windowsPassphrasePrompt } from "../consent/consent-windows.js";
 import { KEYRING_RESPONSES } from "../protocol.js";
 import { realRunner } from "../run.js";
 import { serveKeyring } from "../server.js";
-import { platformTypist } from "../typing/index.js";
 import { KEYRING_VERSION } from "../version.js";
+import { appsWatchFor } from "../watch/apps.js";
 import { ChallengeSchema, DoorFileSchema, HelperCallSchema } from "./door.js";
 import { LineSocket } from "./lines.js";
-import { hardenedPaths } from "./paths.js";
-import { currentSid } from "./sid.js";
+import { asRecoveryKey } from "./recovery.js";
+import { RECOVERY_HINT } from "./remote.js";
 const RETRY_MS = 5_000;
 const REQUEST_DEADLINE_MS = 135_000;
+const REMEMBER_POLL_MS = 60_000;
 const readDoor = async (path) => {
     try {
         const parsed = DoorFileSchema.safeParse(JSON.parse(await readFile(path, "utf8")));
@@ -24,8 +24,9 @@ const readDoor = async (path) => {
         return undefined;
     }
 };
+const dial = (door) => ("port" in door ? connect({ host: "127.0.0.1", port: door.port }) : connect(door.socket));
 const throughDoor = async (door, request) => {
-    const socket = connect({ host: "127.0.0.1", port: door.port });
+    const socket = dial(door);
     const lines = new LineSocket(socket);
     await new Promise((resolve, reject) => {
         socket.once("connect", resolve);
@@ -35,41 +36,64 @@ const throughDoor = async (door, request) => {
     lines.send(request);
     const answer = await lines.nextOf(KEYRING_RESPONSES[request.op], REQUEST_DEADLINE_MS);
     lines.end();
-    return answer ?? { ok: false, code: "unavailable", refusal: "The hardened keyring did not answer: is its task running? (Task Scheduler, \\Intentic\\)" };
+    return answer ?? { ok: false, code: "unavailable", refusal: "Passwords' service did not answer: is it running?" };
 };
-const answerCall = async (hands, call) => {
+const UNAVAILABLE_HELLO = { ok: false, cancelled: false, reason: "Windows Hello is not on this computer" };
+export const answerCall = async (hands, call) => {
     switch (call.call) {
         case "sign": {
-            const signed = await hands.hello.sign(call.credential, call.challenge, { title: call.title, message: call.message });
+            const signed = (await hands.hello?.sign(call.credential, call.challenge, { title: call.title, message: call.message })) ?? UNAVAILABLE_HELLO;
             return signed.ok ? { ok: true, signature: signed.value.toString("base64") } : { ok: false, cancelled: signed.cancelled, reason: signed.reason };
         }
+        case "hello-available":
+            return { available: (await hands.hello?.available()) === true };
+        case "enrol": {
+            const made = (await hands.hello?.enrol(call.credential, call.challenge, { title: call.title, message: call.message })) ?? UNAVAILABLE_HELLO;
+            return made.ok ? { ok: true, signature: made.value.signature.toString("base64"), publicKey: made.value.publicKey } : { ok: false, cancelled: made.cancelled, reason: made.reason };
+        }
         case "passphrase":
             return await hands.passphrase({ title: call.title, message: call.message });
+        case "value":
+            return hands.value === undefined
+                ? { kind: "unavailable", reason: "this session cannot show Passwords' own box" }
+                : await hands.value({ title: call.title, message: call.message, remember: call.remember, username: call.username });
+        case "choice":
+            return hands.choose === undefined ? { kind: "unavailable", reason: "this session cannot show Passwords' choice" } : await hands.choose({ title: call.title, message: call.message, choices: call.choices });
         case "inspect":
             return await hands.typist.inspect(call.place);
         case "type":
             return await hands.typist.type(call.place, call.seen, call.value);
     }
 };
+const PROOF_NOTICE = {
+    title: "Connect Passwords",
+    message: "Passwords on this computer asks you to confirm it is you, once for this sign-in, before it can ask you anything or type for you.",
+};
+export const proofFor = async (challenge, hands, pid = process.pid) => {
+    switch (challenge.method) {
+        case "hello": {
+            const signed = await hands.hello?.sign(challenge.credential, challenge.challenge, PROOF_NOTICE);
+            return signed?.ok === true ? { method: "hello", signature: signed.value.toString("base64") } : { method: "declined" };
+        }
+        case "polkit":
+            return { method: "polkit", pid };
+        case "passphrase": {
+            const typed = await hands.passphrase({ title: PROOF_NOTICE.title, message: `${PROOF_NOTICE.message}\n\n${RECOVERY_HINT}` });
+            return typed.kind === "answered" ? { method: "passphrase", passphrase: asRecoveryKey(typed.passphrase) } : { method: "declined" };
+        }
+        case "unset":
+            return { method: "unset" };
+    }
+};
 const holdTheLine = async (door, hands, log) => {
-    const socket = connect({ host: "127.0.0.1", port: door.port });
-    const lines = new LineSocket(socket);
+    const lines = new LineSocket(dial(door));
     lines.send({ door: door.token, as: "helper" });
     const challenge = await lines.nextOf(ChallengeSchema, 30_000);
     if (challenge === undefined) {
         lines.end();
         return;
     }
-    const notice = { title: "Connect the Intentic keyring", message: "The keyring on this computer asks you to confirm it is you, once for this sign-in, before it can ask you anything or type for you." };
-    let proof;
-    if (challenge.method === "hello") {
-        const signed = await hands.hello.sign(challenge.credential, challenge.challenge, notice);
-        proof = signed.ok ? { method: "hello", signature: signed.value.toString("base64") } : { method: "declined" };
-    }
-    else {
-        const typed = await hands.passphrase(notice);
-        proof = typed.kind === "answered" ? { method: "passphrase", passphrase: typed.passphrase } : { method: "declined" };
-    }
+    const proof = await proofFor(challenge, hands);
     lines.send(proof);
     log(`proved this session with ${proof.method}`);
     for (;;) {
@@ -83,29 +107,45 @@ const holdTheLine = async (door, hands, log) => {
         lines.send({ id: call.id, reply: await answerCall(hands, call) });
     }
 };
-export const runSession = async (runner = realRunner) => {
+const keepAppsWatch = async (ask, watch) => {
+    for (;;) {
+        const state = await ask({ op: "state" });
+        const on = state !== undefined && state.ok && "state" in state && state.state.remember?.apps === true;
+        if (on) {
+            watch?.start();
+        }
+        else {
+            watch?.stop();
+        }
+        await sleep(REMEMBER_POLL_MS);
+    }
+};
+export const runSession = async (platformOf, runner = realRunner) => {
     const own = keyringPaths();
     const claim = await claimPidFile(own.pid, own.dir, { pid: process.pid, build: KEYRING_VERSION, supervisor: "session" });
     if (!claim.claimed) {
         throw new Error(`A keyring is running already (pid ${String(claim.holder.pid)}).`);
     }
-    const sid = await currentSid(runner);
-    const paths = hardenedPaths(sid);
+    const platform = await platformOf(runner);
     const log = (message) => {
         process.stderr.write(`${new Date().toISOString()} session: ${message}\n`);
     };
-    const hands = { hello: windowsHello(runner), passphrase: windowsPassphrasePrompt(runner), typist: platformTypist(runner) };
+    const ask = async (request) => {
+        const door = await readDoor(platform.doorFile);
+        return door === undefined ? undefined : await throughDoor(door, request).catch(() => undefined);
+    };
     await serveKeyring({
         handle: async (request) => {
-            const door = await readDoor(paths.door);
-            return door === undefined ? { ok: false, code: "no-keyring", refusal: "The hardened keyring's service is not running yet." } : await throughDoor(door, request);
+            const door = await readDoor(platform.doorFile);
+            return door === undefined ? { ok: false, code: "no-keyring", refusal: platform.noService } : await throughDoor(door, request);
         },
     }, own.address, log);
+    void keepAppsWatch(ask, appsWatchFor(runner, ask, log));
     for (;;) {
-        const door = await readDoor(paths.door);
+        const door = await readDoor(platform.doorFile);
         if (door !== undefined) {
             try {
-                await holdTheLine(door, hands, log);
+                await holdTheLine(door, platform.hands, log);
             }
             catch (error) {
                 log(`lost the service: ${error instanceof Error ? error.message : "unknown error"}`);

package/dist/service/helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/service/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACtF,OAAO,EAAE,iBAAiB,EAA6D,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAe,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,eAAe,EAAiB,cAAc,EAAmB,gBAAgB,EAAgC,MAAM,WAAW,CAAC;AAC5I,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAQtC,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;IACnE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,OAAuB,EAAuC,EAAE;IACvG,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACtF,KAAK,CAAC,GAAG,EAAE,CAAC;IACZ,OAAO,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,0FAA0F,EAAE,CAAC;AAC7J,CAAC,CAAC;AAQF,MAAM,UAAU,GAAG,KAAK,EAAE,KAAY,EAAE,IAAgB,EAAwB,EAAE;IAC9E,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACrH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpJ,CAAC;QACD,KAAK,YAAY;YACb,OAAO,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,KAAK,SAAS;YACV,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,MAAM;YACP,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,KAAY,EAAE,GAA8B,EAAiB,EAAE;IACtG,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC;IACxM,IAAI,KAAY,CAAC;IACjB,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzF,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACjH,CAAC;SAAM,CAAC;QACJ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACxH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO;YACX,CAAC;YACD,SAAS;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,MAAM,GAAW,UAAU,EAAiB,EAAE;IAC3E,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,KAAK,GAAU,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,uBAAuB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IAClI,MAAM,YAAY,CACd;QACI,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACpK,CAAC;KACJ,EACD,GAAG,CAAC,OAAO,EACX,GAAG,CACN,CAAC;IACF,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACD,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACzF,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC,CAAC"}
+{"version":3,"file":"helper.js","sourceRoot":"","sources":["../../src/service/helper.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,iBAAiB,EAA6D,MAAM,gBAAgB,CAAC;AAC9G,OAAO,EAAE,UAAU,EAAe,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAkB,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAkB,eAAe,EAAiB,cAAc,EAAmB,gBAAgB,EAAgC,MAAM,WAAW,CAAC;AAC5J,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAU5C,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAEpC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAsBhC,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAY,EAAiC,EAAE;IACnE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,IAAc,EAAU,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAGnI,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,OAAuB,EAAuC,EAAE;IACvG,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACtF,KAAK,CAAC,GAAG,EAAE,CAAC;IACZ,OAAO,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;AACtH,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAW,CAAC;AAEpH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,KAAY,EAAE,IAAgB,EAAwB,EAAE;IACrF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAChB,KAAK,MAAM,EAAE,CAAC;YACV,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAC7I,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACpJ,CAAC;QACD,KAAK,iBAAiB;YAClB,OAAO,EAAE,SAAS,EAAE,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACpE,KAAK,OAAO,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,iBAAiB,CAAC;YAC5I,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACvL,CAAC;QACD,KAAK,YAAY;YACb,OAAO,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,KAAK,OAAO;YACR,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,6CAA6C,EAAE;gBAChF,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5H,KAAK,QAAQ;YACT,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAChN,KAAK,SAAS;YACV,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,KAAK,MAAM;YACP,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG;IACjB,KAAK,EAAE,mBAAmB;IAC1B,OAAO,EAAE,kIAAkI;CAC9I,CAAC;AAGF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,SAAoB,EAAE,KAAY,EAAE,GAAG,GAAW,OAAO,CAAC,GAAG,EAAkB,EAAE;IAC5G,QAAQ,SAAS,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,OAAO,EAAE,CAAC;YACX,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAChG,OAAO,MAAM,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC1H,CAAC;QACD,KAAK,QAAQ;YAET,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QACrC,KAAK,YAAY,EAAE,CAAC;YAChB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,OAAO,OAAO,aAAa,EAAE,EAAE,CAAC,CAAC;YAC5H,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACtI,CAAC;QACD,KAAK,OAAO;YACR,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,KAAY,EAAE,GAA8B,EAAiB,EAAE;IACtG,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,KAAK,CAAC,GAAG,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,GAAG,CAAC,4BAA4B,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QACpE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACf,OAAO;YACX,CAAC;YACD,SAAS;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,aAAa,GAAG,KAAK,EAAE,GAAiF,EAAE,KAA4B,EAAkB,EAAE;IAC5J,SAAS,CAAC;QACN,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzC,MAAM,EAAE,GAAG,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;QACtG,IAAI,EAAE,EAAE,CAAC;YACL,KAAK,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACJ,KAAK,EAAE,IAAI,EAAE,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAwD,EAAE,MAAM,GAAW,UAAU,EAAiB,EAAE;IACrI,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;QAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,OAAO,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,EAAE,OAAuB,EAAmD,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpG,CAAC,CAAC;IACF,MAAM,YAAY,CACd;QACI,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACtB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAClI,CAAC;KACJ,EACD,GAAG,CAAC,OAAO,EACX,GAAG,CACN,CAAC;IACF,KAAK,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACxD,SAAS,CAAC;QACN,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC;gBACD,MAAM,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;YACzF,CAAC;QACL,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;AACL,CAAC,CAAC"}

package/dist/service/linux/install-linux.d.ts

@@ -0,0 +1,12 @@
+import { type Runner } from "../../run.js";
+export declare const installLinuxService: (runner: Runner, program?: string, env?: NodeJS.ProcessEnv) => Promise<{
+    readonly uid: string;
+    readonly moved: readonly string[];
+}>;
+export declare const uninstallLinuxService: (runner: Runner, env?: NodeJS.ProcessEnv) => Promise<{
+    readonly uid: string;
+    readonly restored: readonly string[];
+    readonly swept: readonly string[];
+    readonly left: readonly string[];
+}>;
+//# sourceMappingURL=install-linux.d.ts.map

package/dist/service/linux/install-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/install-linux.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,cAAc,CAAC;AAoEtD,eAAO,MAAM,mBAAmB,WAAkB,MAAM,YAAW,MAAM,QAA0B,MAAM,CAAC,UAAU,KAAiB,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA+BvM,CAAC;AA0BF,eAAO,MAAM,qBAAqB,WACtB,MAAM,QACT,MAAM,CAAC,UAAU,KACvB,OAAO,CAAC;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CA2B7I,CAAC"}

package/dist/service/linux/install-linux.js

@@ -0,0 +1,133 @@
+import { chmod, chown, copyFile, mkdir, readdir, rm, rmdir, stat } from "node:fs/promises";
+import { basename, join } from "node:path";
+import { errorMessage } from "@intentic/base/errors";
+import { writeFileAtomic } from "@intentic/base/fs";
+import { agentHomeIn } from "@intentic/local-agent";
+import { KEYRING_HOME } from "../../address.js";
+import { succeeded } from "../../run.js";
+import { linuxServicePaths, SERVICE_USER, UID_RE } from "./paths-linux.js";
+import { addServiceUserArgs, disableArgs, enableArgs, othersInstalledLinux, passwdEntry, policyText, restartArgs, stopArgs, unitText } from "./unit-linux.js";
+const VAULT_FILES = ["vault.json", "keys.json", "audit.jsonl"];
+const exists = async (path) => await stat(path).then(() => true, () => false);
+const must = async (runner, command, args) => {
+    const ran = await runner({ command, args, timeoutMs: 60_000 });
+    if (!succeeded(ran)) {
+        throw new Error(`${command} ${args.join(" ")} failed (${ran.missing ? "not installed" : `exit ${String(ran.exitCode)}`}): ${ran.stderr.trim() || ran.stdout.trim()}`);
+    }
+};
+const invokingUid = (env = process.env) => {
+    const uid = env["PKEXEC_UID"] ?? env["SUDO_UID"];
+    if (process.getuid?.() !== 0 || uid === undefined || !UID_RE.test(uid) || uid === "0") {
+        throw new Error("Passwords' service is installed as root for a user: run this through `intentic-machine keyring setup`, which asks for an administrator's yes.");
+    }
+    return uid;
+};
+const accountOf = async (runner, name) => {
+    const ran = await runner({ command: "getent", args: ["passwd", name], timeoutMs: 10_000 });
+    const entry = succeeded(ran) ? passwdEntry(ran.stdout.split("\n")[0] ?? "") : undefined;
+    if (entry === undefined) {
+        throw new Error(`the system does not know the user ${name}`);
+    }
+    return entry;
+};
+const serviceAccount = async (runner) => {
+    const known = await runner({ command: "getent", args: ["passwd", SERVICE_USER], timeoutMs: 10_000 });
+    if (!succeeded(known)) {
+        await must(runner, "useradd", addServiceUserArgs());
+    }
+    return await accountOf(runner, SERVICE_USER);
+};
+const carry = async (from, to, owner) => {
+    if (!(await exists(from))) {
+        return false;
+    }
+    await copyFile(from, to);
+    await chown(to, owner.uid, owner.gid);
+    await chmod(to, 0o600);
+    await rm(from, { force: true });
+    return true;
+};
+const userKeyringDir = (user) => agentHomeIn(user.home, KEYRING_HOME).dir;
+export const installLinuxService = async (runner, program = process.execPath, env = process.env) => {
+    if (!basename(program).startsWith("intentic-keyring")) {
+        throw new Error("The service installs the compiled keyring itself: run it as intentic-keyring.");
+    }
+    const uid = invokingUid(env);
+    const paths = linuxServicePaths(uid);
+    const user = await accountOf(runner, uid);
+    const service = await serviceAccount(runner);
+    await runner({ command: "systemctl", args: stopArgs(paths), timeoutMs: 60_000 });
+    await mkdir(paths.bin, { recursive: true, mode: 0o755 });
+    await copyFile(program, paths.exe);
+    await chmod(paths.exe, 0o755);
+    await writeFileAtomic(paths.unitFile, unitText(paths), 0o644);
+    await writeFileAtomic(paths.policyFile, policyText(), 0o644);
+    await mkdir(paths.stateRoot, { recursive: true, mode: 0o755 });
+    await mkdir(paths.vaultDir, { recursive: true, mode: 0o700 });
+    await chown(paths.vaultDir, service.uid, service.gid);
+    const moved = [];
+    if (!(await exists(join(paths.vaultDir, "vault.json")))) {
+        for (const name of VAULT_FILES) {
+            if (await carry(join(userKeyringDir(user), name), join(paths.vaultDir, name), service)) {
+                moved.push(name);
+            }
+        }
+    }
+    await writeFileAtomic(paths.marker, `${JSON.stringify({ installedAt: new Date().toISOString(), uid })}\n`, 0o644);
+    await must(runner, "systemctl", ["daemon-reload"]);
+    await must(runner, "systemctl", enableArgs(paths));
+    await must(runner, "systemctl", restartArgs(paths));
+    return { uid, moved };
+};
+const sweepShared = async (runner, paths, swept, left) => {
+    for (const path of [paths.unitFile, paths.policyFile]) {
+        await rm(path, { force: true });
+        swept.push(path);
+    }
+    try {
+        await rm(paths.bin, { recursive: true, force: true });
+        swept.push(paths.bin);
+    }
+    catch (error) {
+        left.push(`${paths.bin} (${errorMessage(error)})`);
+    }
+    await runner({ command: "systemctl", args: ["daemon-reload"], timeoutMs: 60_000 });
+    const removed = await runner({ command: "userdel", args: [SERVICE_USER], timeoutMs: 30_000 });
+    if (succeeded(removed)) {
+        swept.push(`user ${SERVICE_USER}`);
+    }
+    else {
+        left.push(`user ${SERVICE_USER} (${removed.stderr.trim() || "userdel failed"})`);
+    }
+    if (await rmdir(paths.stateRoot).then(() => true, () => false)) {
+        swept.push(paths.stateRoot);
+    }
+};
+export const uninstallLinuxService = async (runner, env = process.env) => {
+    const uid = invokingUid(env);
+    const paths = linuxServicePaths(uid);
+    const user = await accountOf(runner, uid);
+    await runner({ command: "systemctl", args: disableArgs(paths), timeoutMs: 60_000 });
+    const own = userKeyringDir(user);
+    await mkdir(own, { recursive: true, mode: 0o700 });
+    await chown(own, user.uid, user.gid);
+    const restored = [];
+    for (const name of VAULT_FILES) {
+        if (!(await exists(join(own, name))) && (await carry(join(paths.vaultDir, name), join(own, name), user))) {
+            restored.push(name);
+        }
+    }
+    await rm(paths.serviceKey, { force: true });
+    await rm(paths.marker, { force: true });
+    const swept = [];
+    const left = [];
+    if (await rmdir(paths.vaultDir).then(() => true, () => false)) {
+        swept.push(paths.vaultDir);
+    }
+    const names = await readdir(paths.stateRoot).catch(() => []);
+    if (!othersInstalledLinux(names, uid)) {
+        await sweepShared(runner, paths, swept, left);
+    }
+    return { uid, restored, swept, left };
+};
+//# sourceMappingURL=install-linux.js.map

package/dist/service/linux/install-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-linux.js","sourceRoot":"","sources":["../../../src/service/linux/install-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAe,SAAS,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAA0B,iBAAiB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAS9J,MAAM,WAAW,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAU,CAAC;AAExE,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAExG,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,IAAuB,EAAiB,EAAE;IAC3F,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1K,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAU,EAAE;IACjE,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,+IAA+I,CAAC,CAAC;IACrK,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC,CAAC;AAQF,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,IAAY,EAAoB,EAAE;IACvE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;IAC9D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACjD,CAAC,CAAC;AAGF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,EAAU,EAAE,KAAc,EAAoB,EAAE;IAC/E,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACzB,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAa,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC;AAE3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,MAAc,EAAE,OAAO,GAAW,OAAO,CAAC,QAAQ,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAwE,EAAE;IACxM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACjF,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9D,MAAM,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC7B,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACL,CAAC;IACL,CAAC;IACD,MAAM,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClH,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC1B,CAAC,CAAC;AAGF,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAE,KAAwB,EAAE,KAAe,EAAE,IAAc,EAAiB,EAAE;IACnH,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9F,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,QAAQ,YAAY,EAAE,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC,IAAI,CAAC,QAAQ,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACtC,MAAc,EACd,GAAG,GAAsB,OAAO,CAAC,GAAG,EACwG,EAAE;IAC9I,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACvG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACL,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC,CAAC"}

package/dist/service/linux/paths-linux.d.ts

@@ -0,0 +1,21 @@
+export declare const UID_RE: RegExp;
+export declare const SERVICE_USER = "intentic-keyring";
+export declare const POLKIT_ACTION = "dev.intentic.keyring.consent";
+export interface LinuxServicePaths {
+    readonly uid: string;
+    readonly bin: string;
+    readonly exe: string;
+    readonly stateRoot: string;
+    readonly vaultDir: string;
+    readonly serviceKey: string;
+    readonly runDir: string;
+    readonly socket: string;
+    readonly door: string;
+    readonly marker: string;
+    readonly unitFile: string;
+    readonly unitName: string;
+    readonly policyFile: string;
+}
+export declare const linuxServicePaths: (uid: string) => LinuxServicePaths;
+export declare const linuxServiceInstalled: (uid: string) => boolean;
+//# sourceMappingURL=paths-linux.d.ts.map

package/dist/service/linux/paths-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/paths-linux.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,MAAM,QAAgB,CAAC;AAGpC,eAAO,MAAM,YAAY,qBAAqB,CAAC;AAE/C,eAAO,MAAM,aAAa,iCAAiC,CAAC;AAE5D,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,iBAAiB,QAAS,MAAM,KAAG,iBAuB/C,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAS,MAAM,KAAG,OAAoD,CAAC"}

package/dist/service/linux/paths-linux.js

@@ -0,0 +1,31 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+export const UID_RE = /^\d{1,10}$/u;
+export const SERVICE_USER = "intentic-keyring";
+export const POLKIT_ACTION = "dev.intentic.keyring.consent";
+export const linuxServicePaths = (uid) => {
+    if (!UID_RE.test(uid)) {
+        throw new Error(`"${uid}" is not a Linux user id`);
+    }
+    const bin = "/usr/lib/intentic-keyring";
+    const stateRoot = "/var/lib/intentic-keyring";
+    const vaultDir = join(stateRoot, uid);
+    const runDir = join("/run/intentic-keyring", uid);
+    return {
+        uid,
+        bin,
+        exe: join(bin, "intentic-keyring"),
+        stateRoot,
+        vaultDir,
+        serviceKey: join(vaultDir, "service-key.json"),
+        runDir,
+        socket: join(runDir, "door.sock"),
+        door: join(runDir, "door.json"),
+        marker: join(stateRoot, `${uid}.installed`),
+        unitFile: "/etc/systemd/system/intentic-keyring@.service",
+        unitName: `intentic-keyring@${uid}.service`,
+        policyFile: `/usr/share/polkit-1/actions/${POLKIT_ACTION.replace(/\.consent$/u, "")}.policy`,
+    };
+};
+export const linuxServiceInstalled = (uid) => existsSync(linuxServicePaths(uid).marker);
+//# sourceMappingURL=paths-linux.js.map

package/dist/service/linux/paths-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-linux.js","sourceRoot":"","sources":["../../../src/service/linux/paths-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAejC,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;AAGpC,MAAM,CAAC,MAAM,YAAY,GAAG,kBAAkB,CAAC;AAE/C,MAAM,CAAC,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAmB5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAqB,EAAE;IAChE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,IAAI,GAAG,0BAA0B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,2BAA2B,CAAC;IACxC,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO;QACH,GAAG;QACH,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC;QAClC,SAAS;QACT,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QAC9C,MAAM;QACN,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,YAAY,CAAC;QAC3C,QAAQ,EAAE,+CAA+C;QACzD,QAAQ,EAAE,oBAAoB,GAAG,UAAU;QAC3C,UAAU,EAAE,+BAA+B,aAAa,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,SAAS;KAC/F,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/service/linux/polkit-linux.d.ts

@@ -0,0 +1,29 @@
+import type { Consent } from "../../consent/consent.js";
+import type { Runner } from "../../run.js";
+import type { ServiceKey } from "../service-key.js";
+export type PolkitAnswer = "yes" | "no" | "cannot-ask";
+export declare const polkitAnswerOf: (exitCode: number | null, missing: boolean) => PolkitAnswer;
+export interface PolkitSubject {
+    readonly pid: number;
+    readonly start: string;
+    readonly uid: string;
+}
+export declare const startTimeOf: (stat: string) => string | undefined;
+export declare const uidOf: (status: string) => string | undefined;
+export declare const subjectOf: (pid: number, uid: string) => Promise<PolkitSubject | undefined>;
+export declare const pkcheckArgs: (subject: PolkitSubject, notice: {
+    readonly title: string;
+    readonly message: string;
+}) => readonly string[];
+export declare const askPolkit: (runner: Runner, subject: PolkitSubject, notice: {
+    readonly title: string;
+    readonly message: string;
+}) => Promise<PolkitAnswer>;
+export interface PolkitConsentDeps {
+    readonly runner: Runner;
+    readonly helper: () => PolkitSubject | undefined;
+    readonly serviceKey: ServiceKey;
+    readonly recovery: Consent;
+}
+export declare const polkitConsent: (deps: PolkitConsentDeps) => Consent;
+//# sourceMappingURL=polkit-linux.d.ts.map

package/dist/service/linux/polkit-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"polkit-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/polkit-linux.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,0BAA0B,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAepD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,IAAI,GAAG,YAAY,CAAC;AAGvD,eAAO,MAAM,cAAc,aAAc,MAAM,GAAG,IAAI,WAAW,OAAO,KAAG,YAQ1E,CAAC;AAGF,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACxB;AAGD,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAAM,GAAG,SAKnD,CAAC;AAGF,eAAO,MAAM,KAAK,WAAY,MAAM,KAAG,MAAM,GAAG,SAAkE,CAAC;AAGnH,eAAO,MAAM,SAAS,QAAe,MAAM,OAAO,MAAM,KAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAS3F,CAAC;AAMF,eAAO,MAAM,WAAW,YAAa,aAAa,UAAU;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,SAAS,MAAM,EAYjI,CAAC;AAKF,eAAO,MAAM,SAAS,WAAkB,MAAM,WAAW,aAAa,UAAU;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,OAAO,CAAC,YAAY,CAG1J,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,MAAM,EAAE,MAAM,aAAa,GAAG,SAAS,CAAC;IACjD,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC9B;AASD,eAAO,MAAM,aAAa,SAAU,iBAAiB,KAAG,OAmCvD,CAAC"}

package/dist/service/linux/polkit-linux.js

@@ -0,0 +1,89 @@
+import { readFile } from "node:fs/promises";
+import { POLKIT_ACTION } from "./paths-linux.js";
+const AUTHORIZED = 0;
+const NOT_AUTHORIZED = 1;
+const DISMISSED = 3;
+export const polkitAnswerOf = (exitCode, missing) => {
+    if (missing || exitCode === null) {
+        return "cannot-ask";
+    }
+    if (exitCode === AUTHORIZED) {
+        return "yes";
+    }
+    return exitCode === NOT_AUTHORIZED || exitCode === DISMISSED ? "no" : "cannot-ask";
+};
+export const startTimeOf = (stat) => {
+    const fields = stat.slice(stat.lastIndexOf(")") + 2).split(" ");
+    const start = fields[19];
+    return start !== undefined && /^\d+$/u.test(start) ? start : undefined;
+};
+export const uidOf = (status) => /^Uid:\s+(?<uid>\d+)/mu.exec(status)?.groups?.["uid"];
+export const subjectOf = async (pid, uid) => {
+    try {
+        const [stat, status] = await Promise.all([readFile(`/proc/${String(pid)}/stat`, "utf8"), readFile(`/proc/${String(pid)}/status`, "utf8")]);
+        const start = startTimeOf(stat);
+        return start !== undefined && uidOf(status) === uid ? { pid, start, uid } : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const detail = (text) => text.replace(/\s+/gu, " ").slice(0, 300);
+export const pkcheckArgs = (subject, notice) => [
+    "--action-id",
+    POLKIT_ACTION,
+    "--process",
+    `${String(subject.pid)},${subject.start},${subject.uid}`,
+    "--allow-user-interaction",
+    "--detail",
+    "title",
+    detail(notice.title),
+    "--detail",
+    "message",
+    detail(notice.message),
+];
+const POLKIT_TIMEOUT_MS = 125_000;
+export const askPolkit = async (runner, subject, notice) => {
+    const ran = await runner({ command: "pkcheck", args: pkcheckArgs(subject, notice), timeoutMs: POLKIT_TIMEOUT_MS });
+    return ran.timedOut ? "no" : polkitAnswerOf(ran.exitCode, ran.missing);
+};
+const DECLINED = { ok: false, code: "declined", reason: "The person at the computer said no." };
+const nobody = (request) => request.unlock
+    ? { ok: false, code: "locked", reason: "The keyring is locked and nobody is signed in to ask: Passwords' session helper starts at sign-in." }
+    : { ok: false, code: "declined", reason: "Nobody could be asked: Passwords' session helper starts at sign-in." };
+export const polkitConsent = (deps) => {
+    const recover = async (request) => {
+        const answer = await deps.recovery.ask(request);
+        if (answer.ok && answer.vaultKey !== undefined) {
+            await deps.serviceKey.adopt(answer.vaultKey);
+        }
+        return answer;
+    };
+    return {
+        hello: undefined,
+        askValue: deps.recovery.askValue,
+        choose: deps.recovery.choose,
+        ask: async (request) => {
+            if (request.opener === undefined) {
+                return await deps.recovery.ask(request);
+            }
+            const subject = deps.helper();
+            if (subject === undefined) {
+                return nobody(request);
+            }
+            const said = await askPolkit(deps.runner, subject, request);
+            if (said === "no") {
+                return DECLINED;
+            }
+            if (said === "cannot-ask") {
+                return await recover(request);
+            }
+            if (!request.unlock) {
+                return { ok: true, vaultKey: undefined, how: "verified" };
+            }
+            const vaultKey = await deps.serviceKey.open();
+            return vaultKey === undefined ? await recover(request) : { ok: true, vaultKey, how: "verified" };
+        },
+    };
+};
+//# sourceMappingURL=polkit-linux.js.map

package/dist/service/linux/polkit-linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"polkit-linux.js","sourceRoot":"","sources":["../../../src/service/linux/polkit-linux.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAG5C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,SAAS,GAAG,CAAC,CAAC;AAKpB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAuB,EAAE,OAAgB,EAAgB,EAAE;IACtF,IAAI,OAAO,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,YAAY,CAAC;IACxB,CAAC;IACD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;AACvF,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAsB,EAAE;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACzB,OAAO,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,MAAc,EAAsB,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;AAGnH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAW,EAAE,GAAW,EAAsC,EAAE;IAC5F,IAAI,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,SAAS,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3I,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,SAAS,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAElF,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAsB,EAAE,MAA4D,EAAqB,EAAE,CAAC;IACpI,aAAa;IACb,aAAa;IACb,WAAW;IACX,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE;IACxD,0BAA0B;IAC1B,UAAU;IACV,OAAO;IACP,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;IACpB,UAAU;IACV,SAAS;IACT,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;CACzB,CAAC;AAGF,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAE,OAAsB,EAAE,MAA4D,EAAyB,EAAE;IAC3J,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACnH,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AAC3E,CAAC,CAAC;AAWF,MAAM,QAAQ,GAAkB,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;AAE/G,MAAM,MAAM,GAAG,CAAC,OAAuB,EAAiB,EAAE,CACtD,OAAO,CAAC,MAAM;IACV,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,oGAAoG,EAAE;IAC7I,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;AAEzH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAuB,EAAW,EAAE;IAC9D,MAAM,OAAO,GAAG,KAAK,EAAE,OAAuB,EAA0B,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;IACF,OAAO;QACH,KAAK,EAAE,SAAS;QAChB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ;QAChC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC5B,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACnB,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAChB,OAAO,QAAQ,CAAC;YACpB,CAAC;YACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBACxB,OAAO,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBAClB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YAE9C,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;QACrG,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/service/linux/service-run-linux.d.ts

@@ -0,0 +1,4 @@
+import { type Runner } from "../../run.js";
+import type { ServiceRun } from "../service-run.js";
+export declare const linuxServiceRun: (uid: string, runner: Runner) => ServiceRun;
+//# sourceMappingURL=service-run-linux.d.ts.map

package/dist/service/linux/service-run-linux.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-run-linux.d.ts","sourceRoot":"","sources":["../../../src/service/linux/service-run-linux.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,cAAc,CAAC;AAKtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AASpD,eAAO,MAAM,eAAe,QAAS,MAAM,UAAU,MAAM,KAAG,UA4C7D,CAAC"}