@intentic/keyring 1.344.0 → 1.346.0

package/dist/passwords/needs.js

@@ -0,0 +1,232 @@
+import { entriesFor } from "@intentic/sandbox-contract/policy/keyring-origins";
+import { grantNonce } from "@intentic/sandbox-contract/keyring-seal";
+import { KEYRING_GRANT_TTL_MAX_MS, } from "@intentic/sandbox-contract/schemas/keyring";
+import { NOT_SET_UP, refuse } from "./access.js";
+import { applyCapture, openedValue } from "./capture.js";
+import { candidateOf, entryInfoOf, liveEntries, placeWords, titleOf, withEntry } from "./entries.js";
+import { hostOf, sandboxKey } from "../policy.js";
+import { PENDING_NEEDS_MAX } from "../vault.js";
+const NEED_LIFE_MS = 24 * 60 * 60_000;
+const NEED_CHOICES = [
+    { id: "once", label: "Allow once" },
+    { id: "while-here", label: "While I'm here" },
+    { id: "always", label: "Always" },
+    { id: "deny", label: "Deny" },
+];
+const MODE_OF = { once: "each-use", "while-here": "while-here", always: "copy" };
+const RANK = { "each-use": 0, "while-here": 1, copy: 2 };
+const answerOf = (choice) => NEED_CHOICES.find((known) => known.id === choice)?.id ?? "once";
+const NOBODY = new Set(["busy", "locked", "unavailable"]);
+const pointerOf = (entry, mode) => ({
+    name: entry.name,
+    mode,
+    kind: entry.rules.kind,
+    programs: entry.rules.programs,
+    packages: entry.rules.packages,
+    hosts: entry.rules.hosts,
+    anyField: entry.rules.anyField,
+    source: entry.source,
+    updatedAt: entry.updatedAt,
+});
+const whoAsks = (sandbox) => `${hostOf(sandbox)}'s agent`;
+const needWords = (sandbox, need, user) => {
+    const account = user === undefined ? "" : ` as ${user}`;
+    const conversation = need.conversation === undefined ? "" : ` (conversation ${need.conversation})`;
+    return `${whoAsks(sandbox)} wants to sign in to ${placeWords(need.origin)}${account}: ${need.detail}.${conversation}`;
+};
+const pickedFor = (waiting, name, sealed) => {
+    const chosen = name ?? waiting.matches[0];
+    if (chosen !== undefined && !waiting.matches.includes(chosen)) {
+        return refuse("unknown", `${chosen} is not one of the passwords that fit this request.`);
+    }
+    return chosen === undefined && sealed === undefined ? refuse("unknown", "Nothing fits this request: type the password once to answer it.") : { ok: true, name: chosen };
+};
+export class Needs {
+    vault;
+    #pending;
+    constructor(vault) {
+        this.vault = vault;
+    }
+    #list() {
+        const now = this.vault.deps.now();
+        this.#pending = (this.#pending ?? this.vault.file()?.open.pendingNeeds ?? []).filter((need) => now - need.at < NEED_LIFE_MS);
+        return this.#pending;
+    }
+    async #save(pending) {
+        this.#pending = pending.slice(-PENDING_NEEDS_MAX);
+        const file = this.vault.file();
+        if (file !== undefined) {
+            await this.vault.writeOpen({ ...file.open, pendingNeeds: this.#pending });
+        }
+    }
+    #shown() {
+        const held = this.vault.held();
+        return held === undefined ? (this.vault.file()?.open.entries ?? []) : liveEntries(held.doc).map(entryInfoOf);
+    }
+    async need(asked, need) {
+        const file = this.vault.file();
+        if (file === undefined) {
+            return refuse("no-keyring", NOT_SET_UP);
+        }
+        const sandbox = sandboxKey(asked);
+        const matches = entriesFor(this.#shown().map(candidateOf), need.origin, need.username).map((match) => match.name);
+        if (matches.length === 0 && !need.typeOnce) {
+            return refuse("unknown", `Nothing is saved on this computer for ${placeWords(need.origin)}.`);
+        }
+        const waiting = { id: grantNonce(), sandbox, need, matches, at: this.vault.deps.now() };
+        const answered = matches.length > 0 ? this.#askMatch(waiting, matches) : this.#askTypeOnce(waiting);
+        let timer;
+        const late = new Promise((resolve) => {
+            timer = setTimeout(() => resolve("late"), this.vault.deps.needWaitMs ?? KEYRING_GRANT_TTL_MAX_MS);
+            timer.unref?.();
+        });
+        const first = await Promise.race([answered, late]);
+        clearTimeout(timer);
+        if (first !== "late" && !(!first.ok && NOBODY.has(first.code))) {
+            await this.vault.record({ op: "need", outcome: first.ok ? "granted" : "refused", secret: first.ok ? first.pointer.name : undefined, sandbox, code: first.ok ? undefined : first.code, detail: need.detail, asked: true });
+            return first;
+        }
+        await this.#save([...this.#list(), waiting]);
+        if (first === "late") {
+            void answered.then(async (settled) => {
+                if (settled.ok || !NOBODY.has(settled.code)) {
+                    await this.#save(this.#list().filter((other) => other.id !== waiting.id));
+                }
+            });
+        }
+        await this.vault.record({ op: "need", outcome: "pending", sandbox, detail: need.detail });
+        return refuse("pending", `Nobody answered at the computer yet: the request waits in Passwords under Requests.`);
+    }
+    async #askMatch(waiting, matches) {
+        const file = this.vault.file();
+        const shown = this.#shown().find((entry) => entry.name === matches[0]);
+        if (file === undefined || shown === undefined) {
+            return refuse("unknown", `Nothing is saved on this computer for ${placeWords(waiting.need.origin)}.`);
+        }
+        const opened = await this.vault.open(file, { title: `Let ${whoAsks(waiting.sandbox)} sign in?`, message: needWords(waiting.sandbox, waiting.need, shown.username), person: true, choices: NEED_CHOICES });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const answer = answerOf(opened.choice);
+        if (answer === "deny") {
+            return refuse("declined", "The person at the computer said no.");
+        }
+        return await this.#shareAnswer(opened, shown.name, waiting.sandbox, answer, false);
+    }
+    async #askTypeOnce(waiting) {
+        const file = this.vault.file();
+        const box = this.vault.deps.consent.askValue;
+        if (file === undefined || box === undefined) {
+            return refuse("unavailable", "This computer cannot show Passwords' own box to type it once.");
+        }
+        const place = placeWords(waiting.need.origin);
+        const typed = await box({
+            title: `${whoAsks(waiting.sandbox)} needs a password for ${place}`,
+            message: `${whoAsks(waiting.sandbox)} needs a password for ${place} (${waiting.need.detail}): type it once. Passwords keeps it here and shares it with ${hostOf(waiting.sandbox)} as you choose next.`,
+            remember: true,
+            username: { value: waiting.need.username },
+        });
+        if (typed.kind !== "answered") {
+            return typed.kind === "cancelled" ? refuse("declined", "The person at the computer closed the box.") : refuse("unavailable", typed.reason);
+        }
+        const opened = await this.vault.open(file, { title: `Share ${place} with ${hostOf(waiting.sandbox)}?`, message: needWords(waiting.sandbox, waiting.need, typed.username ?? waiting.need.username), person: true, choices: NEED_CHOICES });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const answer = answerOf(opened.choice);
+        const now = this.vault.deps.now();
+        const draft = { origin: waiting.need.origin, username: typed.username ?? waiting.need.username, source: "agent", via: hostOf(waiting.sandbox), kind: "password", at: now };
+        const saved = applyCapture(opened.doc, draft, typed.value, { now, deliberate: true });
+        if (saved.name === undefined) {
+            return refuse("declined", `${place} is on the never-save list.`);
+        }
+        const doc = saved.doc;
+        if (answer === "deny") {
+            await this.vault.commit({ doc, key: opened.key });
+            return refuse("declined", "Saved here, and not shared: the person said no to sharing it.");
+        }
+        return await this.#shareAnswer({ ...opened, doc }, saved.name, waiting.sandbox, answer, true);
+    }
+    async #shareAnswer(opened, name, sandbox, answer, saved) {
+        const shared = await this.#shareInto(opened.doc, name, sandbox, MODE_OF[answer]);
+        if (!shared.ok) {
+            return shared;
+        }
+        await this.vault.commit({ doc: shared.doc, key: opened.key });
+        return { ok: true, pointer: shared.pointer, asked: true, saved };
+    }
+    async #shareInto(doc, name, sandbox, wanted) {
+        const entry = doc.entries[name];
+        if (entry === undefined || entry.deleted === true) {
+            return refuse("unknown", `There is no password named ${name}.`);
+        }
+        let pin = doc.pins[sandbox];
+        const now = this.vault.deps.now();
+        if (pin === undefined) {
+            const keys = await this.vault.fetchKeys(sandbox);
+            if ("ok" in keys) {
+                return keys;
+            }
+            pin = { sign: keys.sign, seal: keys.seal, fetchedAt: now };
+        }
+        const before = entry.shares.find((share) => share.sandbox === sandbox);
+        const asked = wanted === "copy" && entry.backend !== undefined ? "while-here" : wanted;
+        const mode = before !== undefined && RANK[before.mode] > RANK[asked] ? before.mode : asked;
+        const share = { sandbox, machine: before?.machine ?? hostOf(sandbox), mode, sharedAt: now };
+        const shared = { ...entry, shares: [...entry.shares.filter((other) => other.sandbox !== sandbox), share], updatedAt: now, revision: doc.revision + 1 };
+        return { ok: true, doc: withEntry({ ...doc, pins: { ...doc.pins, [sandbox]: pin } }, shared), pointer: pointerOf(shared, mode) };
+    }
+    needs() {
+        return { ok: true, pending: this.#list() };
+    }
+    #typedIn(doc, waiting, sealed, at) {
+        const draft = { origin: waiting.need.origin, username: waiting.need.username, source: "agent", via: "Passwords", kind: "password", at: at ?? waiting.at, sealed };
+        const value = openedValue(doc, draft);
+        if (!value.ok) {
+            return value;
+        }
+        const saved = applyCapture(doc, draft, value.value, { now: this.vault.deps.now(), deliberate: true });
+        return { ok: true, doc: saved.doc, name: saved.name };
+    }
+    async answerNeed(id, answer, name, sealed, at) {
+        const file = this.vault.file();
+        const waiting = this.#list().find((need) => need.id === id);
+        if (file === undefined || waiting === undefined) {
+            return refuse("unknown", "That request is not waiting any more.");
+        }
+        const rest = this.#list().filter((need) => need.id !== id);
+        if (answer === "deny") {
+            await this.#save(rest);
+            await this.vault.record({ op: "answer-need", outcome: "refused", code: "declined", sandbox: waiting.sandbox });
+            return { ok: true };
+        }
+        const picked = pickedFor(waiting, name, sealed);
+        if (!picked.ok) {
+            return picked;
+        }
+        const chosen = picked.name;
+        const shown = this.#shown().find((entry) => entry.name === chosen);
+        const what = shown === undefined ? placeWords(waiting.need.origin) : titleOf(shown);
+        const opened = await this.vault.open(file, { title: `Let ${whoAsks(waiting.sandbox)} use ${what}?`, message: needWords(waiting.sandbox, waiting.need, shown?.username ?? waiting.need.username), person: true });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const typedIn = chosen === undefined && sealed !== undefined ? this.#typedIn(opened.doc, waiting, sealed, at) : { ok: true, doc: opened.doc, name: chosen };
+        if (!typedIn.ok) {
+            return typedIn;
+        }
+        const { doc, name: target } = typedIn;
+        if (target === undefined) {
+            return refuse("declined", `${placeWords(waiting.need.origin)} is on the never-save list.`);
+        }
+        const shared = await this.#shareInto(doc, target, waiting.sandbox, MODE_OF[answer]);
+        if (!shared.ok) {
+            return shared;
+        }
+        await this.vault.commit({ doc: shared.doc, key: opened.key }, { pendingNeeds: rest });
+        this.#pending = rest;
+        await this.vault.record({ op: "answer-need", outcome: "granted", secret: target, sandbox: waiting.sandbox, target: answer, asked: true });
+        return { ok: true };
+    }
+}
+//# sourceMappingURL=needs.js.map

package/dist/passwords/needs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"needs.js","sourceRoot":"","sources":["../../src/passwords/needs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AACrE,OAAO,EACH,wBAAwB,GAO3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAe,UAAU,EAAe,MAAM,EAAoB,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAwC,MAAM,aAAa,CAAC;AAQtF,MAAM,YAAY,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAEtC,MAAM,YAAY,GAAG;IACjB,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE;IACnC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,gBAAgB,EAAE;IAC7C,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;IACjC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;CACyD,CAAC;AAE3F,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAkF,CAAC;AACjK,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAsD,CAAC;AAE7G,MAAM,QAAQ,GAAG,CAAC,MAA0B,EAAqB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,MAAM,CAAC;AAGpI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAE3E,MAAM,SAAS,GAAG,CAAC,KAAkB,EAAE,IAAsB,EAAkB,EAAE,CAAC,CAAC;IAC/E,IAAI,EAAE,KAAK,CAAC,IAAI;IAChB,IAAI;IACJ,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;IACtB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;IAC9B,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;IAC9B,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK;IACxB,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ;IAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS;CAC7B,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,CAAC,OAAe,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;AAE1E,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,IAAiB,EAAE,IAAwB,EAAU,EAAE;IACvF,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,YAAY,GAAG,CAAC;IACnG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,wBAAwB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;AAC1H,CAAC,CAAC;AAKF,MAAM,SAAS,GAAG,CAAC,OAA2B,EAAE,IAAwB,EAAE,MAA6B,EAAsE,EAAE;IAC3K,MAAM,MAAM,GAAG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,SAAS,EAAE,GAAG,MAAM,qDAAqD,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,iEAAiE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC5K,CAAC,CAAC;AAEF,MAAM,OAAO,KAAK;IAGe,KAAK;IAFlC,QAAQ,CAAmC;IAE3C,YAA6B,KAAkB;qBAAlB,KAAK;IAAgB,CAAC;IAGnD,KAAK;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC;QAC7H,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAA6B;QACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;IACL,CAAC;IAED,MAAM;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACjH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,IAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,SAAS,EAAE,yCAAyC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,OAAO,GAAuB,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpG,IAAI,KAAgD,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACzC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC;YAClG,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QACnD,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1N,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAE7C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACnB,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;gBACjC,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC9E,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,SAAS,EAAE,qFAAqF,CAAC,CAAC;IACpH,CAAC;IAGD,KAAK,CAAC,SAAS,CAAC,OAA2B,EAAE,OAA0B;QACnE,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,SAAS,EAAE,yCAAyC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1M,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,OAAO,MAAM,CAAC,UAAU,EAAE,qCAAqC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACvF,CAAC;IAGD,KAAK,CAAC,YAAY,CAAC,OAA2B;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,MAAM,CAAC,aAAa,EAAE,+DAA+D,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC;YACpB,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,KAAK,EAAE;YAClE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,MAAM,+DAA+D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB;YACtM,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE;SAC7C,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,4CAA4C,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,KAAK,SAAS,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC1O,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,EAAW,CAAC;QACpL,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,KAAK,6BAA6B,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;QACtB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YAClD,OAAO,MAAM,CAAC,UAAU,EAAE,+DAA+D,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe,EAAE,MAA0C,EAAE,KAAc;QACxH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAID,KAAK,CAAC,UAAU,CAAC,GAAkB,EAAE,IAAY,EAAE,OAAe,EAAE,MAAwB;QACxF,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,SAAS,EAAE,8BAA8B,IAAI,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAEvE,MAAM,KAAK,GAAqB,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC;QACzG,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;QAC3F,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAgB,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IACrI,CAAC;IAED,KAAK;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/C,CAAC;IAGD,QAAQ,CAAC,GAAkB,EAAE,OAA2B,EAAE,MAAiB,EAAE,EAAsB;QAC/F,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE,MAAM,EAAW,CAAC;QAC3K,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAyB,EAAE,IAAwB,EAAE,MAA6B,EAAE,EAAsB;QACnI,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,IAAI,GAAG,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjN,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrK,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QACtC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,UAAU,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1I,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;CACJ"}

package/dist/passwords/phone.d.ts

@@ -0,0 +1,19 @@
+import { type KeyringPhoneFill, type KeyringPhoneKeys, type SignedKeyringPhoneFill } from "@intentic/sandbox-contract/schemas/keyring";
+import { type Answer, type VaultAccess } from "./access.js";
+import type { Refusal } from "../protocol.js";
+import type { PhonePin } from "../vault.js";
+export declare const presenceFingerprint: (presence: string) => string;
+type Checked = {
+    readonly ok: true;
+    readonly fill: KeyringPhoneFill;
+} | Refusal;
+export declare const checkPhoneFill: (signed: SignedKeyringPhoneFill, pin: PhonePin | undefined, now: number) => Checked;
+export declare class Phones {
+    #private;
+    private readonly vault;
+    constructor(vault: VaultAccess);
+    pair(sandbox: string, phone: KeyringPhoneKeys): Answer<"phone-pair">;
+    fill(sandbox: string, signed: SignedKeyringPhoneFill): Answer<"phone-fill">;
+}
+export {};
+//# sourceMappingURL=phone.d.ts.map

package/dist/passwords/phone.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.d.ts","sourceRoot":"","sources":["../../src/passwords/phone.ts"],"names":[],"mappings":"AAIA,OAAO,EAA4B,KAAK,gBAAgB,EAA0B,KAAK,gBAAgB,EAAE,KAAK,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AACzL,OAAO,EAAE,KAAK,MAAM,EAAsB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGhF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAa5C,eAAO,MAAM,mBAAmB,aAAc,MAAM,KAAG,MAOf,CAAC;AAEzC,KAAK,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE,GAAG,OAAO,CAAC;AAGhF,eAAO,MAAM,cAAc,WAAY,sBAAsB,OAAO,QAAQ,GAAG,SAAS,OAAO,MAAM,KAAG,OAiCvG,CAAC;AAEF,qBAAa,MAAM;;IAGH,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,WAAW,EAAI;IAE7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,CAkBzE;IAGK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAAC,YAAY,CAAC,CAoChF;CACJ"}

package/dist/passwords/phone.js

@@ -0,0 +1,125 @@
+import { createHash, verify } from "node:crypto";
+import { z } from "zod";
+import { entriesFor } from "@intentic/sandbox-contract/policy/keyring-origins";
+import { keyFingerprint, seal } from "@intentic/sandbox-contract/keyring-seal";
+import { KEYRING_GRANT_TTL_MAX_MS, KeyringPhoneFillSchema } from "@intentic/sandbox-contract/schemas/keyring";
+import { NOT_SET_UP, refuse } from "./access.js";
+import { candidateOf, entryInfoOf, liveEntries, placeWords, titleOf, usedEntry, withEntry } from "./entries.js";
+import { hostOf, NonceBook, sandboxKey } from "../policy.js";
+const SKEW_MS = 30_000;
+export const presenceFingerprint = (presence) => createHash("sha256")
+    .update(Buffer.from(presence, "base64"))
+    .digest()
+    .subarray(0, 8)
+    .toString("hex")
+    .toUpperCase()
+    .replace(/(.{4})(?=.)/gu, "$1-");
+export const checkPhoneFill = (signed, pin, now) => {
+    let payload;
+    let json;
+    try {
+        payload = Buffer.from(signed.payload, "base64url");
+        json = JSON.parse(payload.toString("utf8"));
+    }
+    catch {
+        return refuse("bad-grant", "The phone's request could not be read.");
+    }
+    const parsed = KeyringPhoneFillSchema.safeParse(json);
+    if (!parsed.success) {
+        return refuse("bad-grant", "The phone's request is not one this keyring reads.");
+    }
+    const fill = parsed.data;
+    if (pin === undefined || pin.keys.device !== fill.device) {
+        return refuse("not-shared", "This phone is not paired with Passwords on this computer: pair it from the phone first.");
+    }
+    let good = false;
+    try {
+        good = verify("sha256", payload, { key: Buffer.from(pin.keys.presence, "base64"), format: "der", type: "spki" }, Buffer.from(signed.sig, "base64url"));
+    }
+    catch {
+        good = false;
+    }
+    if (!good) {
+        return refuse("bad-grant", "The phone's request was not signed by the key pinned when it was paired.");
+    }
+    if (fill.expiresAt <= fill.issuedAt || fill.expiresAt - fill.issuedAt > KEYRING_GRANT_TTL_MAX_MS || fill.issuedAt > now + SKEW_MS) {
+        return refuse("bad-grant", "The phone's request has times no phone would sign.");
+    }
+    if (fill.expiresAt <= now) {
+        return refuse("expired", "The phone's request has expired: fill again on the phone.");
+    }
+    return { ok: true, fill };
+};
+export class Phones {
+    vault;
+    #nonces = new NonceBook();
+    constructor(vault) {
+        this.vault = vault;
+    }
+    async pair(sandbox, phone) {
+        const file = this.vault.file();
+        if (file === undefined) {
+            return refuse("no-keyring", NOT_SET_UP);
+        }
+        const opened = await this.vault.open(file, {
+            title: `Pair ${phone.label} with Passwords?`,
+            message: `${phone.label} (through ${hostOf(sandbox)}) asks to save passwords to this computer and fill them back after your fingerprint on the phone. The phone's key is ${presenceFingerprint(phone.presence)}: say yes only if the phone shows the same.`,
+            person: true,
+        });
+        if ("ok" in opened) {
+            return opened;
+        }
+        const now = this.vault.deps.now();
+        const phones = { ...opened.doc.phones, [phone.device]: { keys: phone, sandbox: sandboxKey(sandbox), pairedAt: now } };
+        await this.vault.commit({ doc: { ...opened.doc, phones }, key: opened.key });
+        await this.vault.record({ op: "phone-pair", outcome: "done", target: phone.device, sandbox, asked: true });
+        return { ok: true, fingerprint: keyFingerprint(opened.doc.inbox.publicKey) };
+    }
+    async fill(sandbox, signed) {
+        const held = this.vault.held();
+        if (this.vault.file() === undefined) {
+            return refuse("no-keyring", NOT_SET_UP);
+        }
+        if (held === undefined) {
+            return refuse("locked", "Passwords is locked on this computer: unlock it there to fill from the phone.");
+        }
+        const now = this.vault.deps.now();
+        const checked = checkPhoneFill(signed, held.doc.phones?.[decodeDevice(signed)], now);
+        if (!checked.ok) {
+            await this.vault.record({ op: "phone-fill", outcome: "refused", code: checked.code, sandbox });
+            return checked;
+        }
+        const fill = checked.fill;
+        if (!this.#nonces.spend(fill.nonce, fill.expiresAt, now)) {
+            return refuse("replayed", "This request was answered already: fill again on the phone.");
+        }
+        const pin = held.doc.phones?.[fill.device];
+        const match = entriesFor(liveEntries(held.doc).map((entry) => candidateOf(entryInfoOf(entry))), fill.origin, fill.username)[0];
+        const entry = match === undefined ? undefined : held.doc.entries[match.name];
+        if (entry === undefined || pin === undefined) {
+            return refuse("unknown", `Nothing is saved on this computer for ${placeWords(fill.origin)}.`);
+        }
+        const value = await this.vault.valueOf(held.doc, entry);
+        if (!value.ok) {
+            return value;
+        }
+        const sealed = seal(pin.keys.seal, value.value, { kind: "phone", device: fill.device, nonce: fill.nonce });
+        await this.vault.commit({ doc: withEntry(held.doc, usedEntry(entry, now)), key: held.key });
+        await this.vault.record({ op: "phone-fill", outcome: "granted", secret: entry.name, target: fill.device, sandbox, how: "phone" });
+        const answer = { ok: true, sealed, name: entry.name, title: titleOf(entryInfoOf(entry)) };
+        if (entry.rules.username !== undefined) {
+            answer.username = entry.rules.username;
+        }
+        return answer;
+    }
+}
+const decodeDevice = (signed) => {
+    try {
+        const parsed = z.object({ device: z.string() }).safeParse(JSON.parse(Buffer.from(signed.payload, "base64url").toString("utf8")));
+        return parsed.success ? parsed.data.device : "";
+    }
+    catch {
+        return "";
+    }
+};
+//# sourceMappingURL=phone.js.map

package/dist/passwords/phone.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phone.js","sourceRoot":"","sources":["../../src/passwords/phone.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,MAAM,mDAAmD,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAyB,sBAAsB,EAAsD,MAAM,4CAA4C,CAAC;AACzL,OAAO,EAAe,UAAU,EAAE,MAAM,EAAoB,MAAM,aAAa,CAAC;AAChF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAChH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAY7D,MAAM,OAAO,GAAG,MAAM,CAAC;AAGvB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC5D,UAAU,CAAC,QAAQ,CAAC;KACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;KACvC,MAAM,EAAE;KACR,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;KACd,QAAQ,CAAC,KAAK,CAAC;KACf,WAAW,EAAE;KACb,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;AAKzC,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAA8B,EAAE,GAAyB,EAAE,GAAW,EAAW,EAAE;IAC9G,IAAI,OAAe,CAAC;IACpB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC,WAAW,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACvD,OAAO,MAAM,CAAC,YAAY,EAAE,yFAAyF,CAAC,CAAC;IAC3H,CAAC;IACD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,CAAC;QACD,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3J,CAAC;IAAC,MAAM,CAAC;QACL,IAAI,GAAG,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,OAAO,MAAM,CAAC,WAAW,EAAE,0EAA0E,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,wBAAwB,IAAI,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,OAAO,EAAE,CAAC;QAChI,OAAO,MAAM,CAAC,WAAW,EAAE,oDAAoD,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,SAAS,EAAE,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9B,CAAC,CAAC;AAEF,MAAM,OAAO,MAAM;IAGc,KAAK;IAFzB,OAAO,GAAG,IAAI,SAAS,EAAE,CAAC;IAEnC,YAA6B,KAAkB;qBAAlB,KAAK;IAAgB,CAAC;IAEnD,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,KAAuB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;YACvC,KAAK,EAAE,QAAQ,KAAK,CAAC,KAAK,kBAAkB;YAC5C,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,aAAa,MAAM,CAAC,OAAO,CAAC,wHAAwH,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,6CAA6C;YAC3P,MAAM,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,MAAM,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,CAAC;QACtH,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7E,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;IACjF,CAAC;IAGD,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,MAA8B;QACtD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,QAAQ,EAAE,+EAA+E,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/F,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,UAAU,EAAE,6DAA6D,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/H,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7E,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,SAAS,EAAE,yCAAyC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3G,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAClI,MAAM,MAAM,GAAyD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAChJ,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAGD,MAAM,YAAY,GAAG,CAAC,MAA8B,EAAU,EAAE;IAC5D,IAAI,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjI,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QAEL,OAAO,EAAE,CAAC;IACd,CAAC;AACL,CAAC,CAAC"}