@magoz/provision 0.0.0-stage → 0.1.0

package/dist/factory/onboarding.js

@@ -0,0 +1,155 @@
+import { Console, Data, Effect, Option, Redacted, Schema } from 'effect';
+import { Prompt } from 'effect/cli';
+import { capture, inherit } from '../shared/process.js';
+import { credentialSections, opErrorMessage } from './onepassword.js';
+import { parseServiceAccountToken, storeServiceAccountToken } from './op-credential.js';
+/**
+ * One-time factory setup with the operator's own 1Password sign-in: make sure the vault and its
+ * `provision` item exist, then create the factory's read-only service account and store its token.
+ * The operator session lives only in this process and is signed out at the end.
+ */
+export class OnboardingError extends Data.TaggedError('OnboardingError') {
+}
+const failure = (message) => new OnboardingError({ message });
+/** A failure that includes `op`'s own explanation (never secret values). */
+const opFailure = (message, result) => {
+    const reason = opErrorMessage(result.stderr);
+    return failure(reason === undefined ? message : `${message}: ${reason}`);
+};
+const Accounts = Schema.fromJsonString(Schema.Array(Schema.Struct({ url: Schema.String })));
+const ensureAccount = Effect.gen(function* () {
+    const listed = yield* capture('op', ['account', 'list', '--format', 'json']);
+    const accounts = Schema.decodeUnknownOption(Accounts)(listed.stdout.trim() || '[]');
+    if (Option.isSome(accounts) && accounts.value.length > 0)
+        return;
+    yield* Console.log('No 1Password account is configured on this machine; adding yours.');
+    yield* inherit('op', ['account', 'add']);
+});
+/** `op signin` prints `export OP_SESSION_<id>="<token>"` for the shell to evaluate. */
+export const parseSessionExport = (output) => {
+    const match = /export (OP_SESSION_[A-Za-z0-9_]+)="([^"]+)"/.exec(output);
+    return match?.[1] === undefined || match[2] === undefined
+        ? undefined
+        : { name: match[1], token: Redacted.make(match[2]) };
+};
+const signIn = Effect.gen(function* () {
+    yield* ensureAccount;
+    yield* Console.log('Sign in to 1Password (used only for this setup, then signed out):');
+    const result = yield* capture('op', ['signin'], { interactive: true });
+    const session = result.exitCode === 0 ? parseSessionExport(result.stdout) : undefined;
+    if (session === undefined)
+        return yield* failure('1Password sign-in failed');
+    const env = { [session.name]: Redacted.value(session.token) };
+    return env;
+});
+const signOut = (env) => capture('op', ['signout'], { env }).pipe(Effect.ignore);
+/** The operator's 1Password session for the duration of `use`; always signed out afterwards. */
+export const withOperatorSession = (use) => Effect.acquireUseRelease(signIn, use, signOut);
+const confirm = (options, message) => options.assumeYes
+    ? Effect.succeed(true)
+    : Prompt.run(Prompt.Confirm({ message, initial: true })).pipe(Effect.mapError(() => failure('cancelled')));
+const ensureVault = (env, vault, options) => Effect.gen(function* () {
+    const found = yield* capture('op', ['vault', 'get', vault, '--format', 'json'], { env });
+    if (found.exitCode === 0)
+        return;
+    if (!(yield* confirm(options, `Vault ${vault} does not exist. Create it?`))) {
+        return yield* failure(`vault ${vault} is required`);
+    }
+    const created = yield* capture('op', ['vault', 'create', vault], { env });
+    if (created.exitCode !== 0)
+        return yield* opFailure(`could not create vault ${vault}`, created);
+    yield* Console.log(`created vault ${vault}`);
+});
+const secretFields = new Set(['api_key', 'api_token', 'factory_key']);
+/** An empty item with every factory field, ready to be filled in the 1Password app. */
+export const templateFields = [
+    ...credentialSections.map(spec => ({ section: spec.section, labels: spec.required })),
+    { section: 'resend', labels: ['sending_domain'] }
+].flatMap(({ section, labels }) => labels.map(label => ({ section, label, concealed: secretFields.has(label) })));
+/** `op` assignment statements that create each field empty (no values, so nothing secret). */
+const emptyFieldAssignments = (fields) => fields.map(field => `${field.section}.${field.label}[${field.concealed ? 'password' : 'text'}]=`);
+const OpItemFields = Schema.fromJsonString(Schema.Struct({
+    fields: Schema.optional(Schema.Array(Schema.Struct({
+        label: Schema.optional(Schema.String),
+        section: Schema.optional(Schema.Struct({ label: Schema.optional(Schema.String) }))
+    })))
+}));
+/** Template fields an item lacks entirely (empty fields count as present). */
+export const missingTemplateFields = (itemJson) => {
+    const decoded = Schema.decodeUnknownOption(OpItemFields)(itemJson);
+    const present = new Set(Option.match(decoded, { onNone: () => [], onSome: item => item.fields ?? [] }).flatMap(field => {
+        const label = field.label?.trim().toLowerCase();
+        const section = field.section?.label?.trim().toLowerCase();
+        if (label === undefined || label === '')
+            return [];
+        return [section === undefined || section === '' ? label : `${section}.${label}`];
+    }));
+    return templateFields.filter(field => !present.has(`${field.section}.${field.label}`));
+};
+/** Adds the missing fields with empty values; existing fields and values are never touched. */
+const addMissingFields = (env, vault, item, missing) => Effect.gen(function* () {
+    if (missing.length === 0)
+        return;
+    const assignments = emptyFieldAssignments(missing);
+    const edited = yield* capture('op', ['item', 'edit', item, '--vault', vault, ...assignments], {
+        env
+    });
+    if (edited.exitCode !== 0)
+        return yield* opFailure(`could not add fields to item ${item}`, edited);
+    yield* Console.log(`added ${missing.length} empty field(s) to ${item}: ${missing.map(field => `${field.section}.${field.label}`).join(', ')}`);
+});
+/** Ensures the item exists; returns `true` when it was just created (and so is still empty). */
+const ensureItem = (env, vault, item, options) => Effect.gen(function* () {
+    const found = yield* capture('op', ['item', 'get', item, '--vault', vault, '--format', 'json'], {
+        env
+    });
+    if (found.exitCode === 0) {
+        yield* addMissingFields(env, vault, item, missingTemplateFields(found.stdout));
+        return false;
+    }
+    if (!(yield* confirm(options, `Item ${item} does not exist in ${vault}. Create it with empty fields?`))) {
+        return yield* failure(`item ${item} is required`);
+    }
+    const created = yield* capture('op', [
+        'item',
+        'create',
+        '--vault',
+        vault,
+        '--category',
+        'Secure Note',
+        '--title',
+        item,
+        ...emptyFieldAssignments(templateFields)
+    ], { env });
+    if (created.exitCode !== 0) {
+        return yield* opFailure(`could not create item ${item} in ${vault}`, created);
+    }
+    yield* Console.log(`created item ${item} in ${vault}`);
+    return true;
+});
+const createServiceAccount = (env, factory, vault) => Effect.gen(function* () {
+    const name = `provision-${factory}`;
+    yield* Console.log(`creating read-only service account ${name} for ${vault}`);
+    const created = yield* capture('op', ['service-account', 'create', name, '--vault', `${vault}:read_items`, '--raw'], { env });
+    if (created.exitCode !== 0) {
+        return yield* opFailure(`could not create service account ${name} (if it already exists, revoke it under Developer > Service accounts and run this again)`, created);
+    }
+    return yield* parseServiceAccountToken(created.stdout);
+});
+/**
+ * Signs in as the operator and makes sure the item exists with every field: creates it when
+ * missing, adds missing fields (empty) otherwise. Existing fields and values are never touched.
+ */
+export const ensureFactoryItem = (vault, item, options) => withOperatorSession(env => ensureItem(env, vault, item, options));
+/**
+ * Signs in as the operator, ensures the vault and item, then creates and stores the factory's
+ * read-only service account. Returns whether the item was just created (and still needs values).
+ */
+export const onboardFactory = (factory, vault, item, options) => withOperatorSession(env => Effect.gen(function* () {
+    yield* ensureVault(env, vault, options);
+    const createdItem = yield* ensureItem(env, vault, item, options);
+    const token = yield* createServiceAccount(env, factory, vault);
+    const file = yield* storeServiceAccountToken(factory, token);
+    yield* Console.log(`stored the ${factory} service-account token encrypted at ${file}`);
+    return createdItem;
+}));

package/dist/factory/onepassword.js

@@ -0,0 +1,140 @@
+import { Data, Effect, Option, Redacted, Schema } from 'effect';
+import { capture } from '../shared/process.js';
+import { opEnvironment } from './op-credential.js';
+export class CredentialsError extends Data.TaggedError('CredentialsError') {
+}
+const OpField = Schema.Struct({
+    label: Schema.optional(Schema.String),
+    value: Schema.optional(Schema.String),
+    section: Schema.optional(Schema.Struct({ label: Schema.optional(Schema.String) }))
+});
+const OpItem = Schema.fromJsonString(Schema.Struct({ fields: Schema.optional(Schema.Array(OpField)) }));
+/**
+ * The first `[ERROR]` line of `op`'s stderr, without its timestamp. `op` error messages name
+ * items, vaults, and permissions, never secret values.
+ */
+export const opErrorMessage = (stderr) => {
+    const line = stderr
+        // oxlint-disable-next-line no-control-regex
+        .replace(/\u001b\[[0-9;]*m/g, '')
+        .split('\n')
+        .map(candidate => candidate.trim())
+        .find(candidate => candidate.length > 0);
+    return line === undefined
+        ? undefined
+        : line.replace(/^\[ERROR\]\s*\d{4}\/\d{2}\/\d{2} \d{2}:\d{2}:\d{2}\s*/, '').slice(0, 300);
+};
+/**
+ * Reads one factory item as `op` JSON (values revealed; never printed). A failing `op` call
+ * reports only its exit code.
+ */
+export const readItemJson = (entry, auth) => Effect.gen(function* () {
+    const args = ['item', 'get', entry.item, '--vault', entry.vault, '--format', 'json', '--reveal'];
+    if (entry.account !== undefined)
+        args.push('--account', entry.account);
+    const result = yield* capture('op', args, Option.match(opEnvironment(auth), { onNone: () => ({}), onSome: env => ({ env }) })).pipe(Effect.mapError(() => new CredentialsError({ message: '1Password CLI (op) could not be started' })));
+    if (result.exitCode !== 0) {
+        const reason = opErrorMessage(result.stderr);
+        if (reason?.includes("isn't an item") === true) {
+            return yield* new CredentialsError({
+                message: `item ${entry.item} does not exist in vault ${entry.vault}`,
+                notFound: true
+            });
+        }
+        return yield* new CredentialsError({
+            message: `cannot read 1Password item ${entry.item} in vault ${entry.vault} (op exit ${result.exitCode}` +
+                `${reason === undefined ? '' : `: ${reason}`}); ` +
+                (auth.kind === 'session'
+                    ? 'sign in with `eval "$(op signin)"` or store a service-account token with `provision config op-token set`'
+                    : 'check that the service account has read access to this vault')
+        });
+    }
+    return result.stdout;
+});
+/** Reads one factory item's non-empty fields; values stay redacted. */
+export const readItemFields = (entry, auth) => Effect.flatMap(readItemJson(entry, auth), parseItemFields);
+/** Non-empty fields of an `op item get --format json` result. */
+export const parseItemFields = (json) => Effect.gen(function* () {
+    const item = yield* Schema.decodeUnknownEffect(OpItem)(json).pipe(Effect.mapError(() => new CredentialsError({ message: '1Password returned an unexpected item shape' })));
+    const fields = new Map();
+    for (const field of item.fields ?? []) {
+        const label = field.label?.trim();
+        const value = field.value?.trim();
+        if (label === undefined || label === '' || value === undefined || value === '')
+            continue;
+        const section = field.section?.label?.trim();
+        const key = section === undefined || section === '' ? label : `${section}.${label}`;
+        fields.set(key.toLowerCase(), Redacted.make(value));
+    }
+    return fields;
+});
+export const credentialSections = [
+    { section: 'github', required: ['owner'] },
+    { section: 'vercel', required: ['team_id'] },
+    { section: 'neon', required: ['api_key', 'org_id'] },
+    { section: 'cloudflare', required: ['api_token', 'account_id'] },
+    { section: 'upstash', required: ['email', 'api_key'] },
+    { section: 'resend', required: ['api_key'] },
+    { section: 'report_receiver', required: ['url', 'factory_key'] }
+];
+/** Which sections are complete, partial, or absent: reported by `provision config verify`. */
+export const describeSections = (fields) => credentialSections.map(spec => {
+    const present = spec.required.filter(name => fields.has(`${spec.section}.${name}`));
+    return {
+        section: spec.section,
+        status: present.length === spec.required.length
+            ? 'complete'
+            : present.length === 0
+                ? 'absent'
+                : 'partial',
+        missing: spec.required.filter(name => !present.includes(name))
+    };
+});
+export const decodeCredentials = (fields) => Effect.gen(function* () {
+    const partial = describeSections(fields).filter(entry => entry.status === 'partial');
+    if (partial.length > 0) {
+        return yield* new CredentialsError({
+            message: `incomplete factory item sections: ${partial
+                .map(entry => `${entry.section} (missing ${entry.missing.join(', ')})`)
+                .join('; ')}`
+        });
+    }
+    const field = (key) => fields.get(key);
+    const text = (key) => {
+        const value = field(key);
+        return value === undefined ? undefined : Redacted.value(value);
+    };
+    const githubOwner = text('github.owner');
+    const teamId = text('vercel.team_id');
+    if (githubOwner === undefined || teamId === undefined) {
+        return yield* new CredentialsError({
+            message: 'factory item needs github.owner and vercel.team_id'
+        });
+    }
+    if (!/^team_[A-Za-z0-9]+$/.test(teamId)) {
+        return yield* new CredentialsError({
+            message: 'vercel.team_id must be an immutable team_* identifier'
+        });
+    }
+    const neonKey = field('neon.api_key');
+    const neonOrg = text('neon.org_id');
+    const cloudflareToken = field('cloudflare.api_token');
+    const cloudflareAccount = text('cloudflare.account_id');
+    const upstashEmail = text('upstash.email');
+    const upstashKey = field('upstash.api_key');
+    const resendKey = field('resend.api_key');
+    const sendingDomain = text('resend.sending_domain');
+    const receiverUrl = text('report_receiver.url');
+    const receiverKey = field('report_receiver.factory_key');
+    return {
+        githubOwner,
+        vercel: { teamId },
+        neon: neonKey && neonOrg ? { apiKey: neonKey, orgId: neonOrg } : undefined,
+        cloudflare: cloudflareToken && cloudflareAccount
+            ? { apiToken: cloudflareToken, accountId: cloudflareAccount }
+            : undefined,
+        upstash: upstashEmail && upstashKey ? { email: upstashEmail, apiKey: upstashKey } : undefined,
+        resend: resendKey ? { apiKey: resendKey, sendingDomain } : undefined,
+        reportReceiver: receiverUrl && receiverKey ? { url: receiverUrl, factoryKey: receiverKey } : undefined
+    };
+});

package/dist/factory/op-credential.js

@@ -0,0 +1,154 @@
+import { Data, Effect, FileSystem, Option, Redacted } from 'effect';
+import { capture } from '../shared/process.js';
+import { Passphrase } from './passphrase.js';
+import { RegistryLocation } from './registry.js';
+import { seal, unseal } from './sealed.js';
+/**
+ * How `op` authenticates when the CLI reads factory items, in order:
+ *
+ * 1. `OP_SERVICE_ACCOUNT_TOKEN` already in the environment (`op` reads it itself);
+ * 2. the factory's own read-only service-account token, sealed with the operator's provision
+ *    passphrase and then encrypted with `systemd-creds --user` (TPM2-bound where available).
+ *    Every run needs the passphrase, typed by the operator in a terminal: that is the approval.
+ *    One token per factory keeps factories isolated;
+ * 3. whatever `op` is signed in with: a manual `op signin` session or the desktop app.
+ */
+export class OpCredentialError extends Data.TaggedError('OpCredentialError') {
+}
+const credentialName = (factory) => `provision-op-${factory}`;
+const credentialPattern = /^op-service-account\.([a-z][a-z0-9-]{0,31})\.cred$/;
+export const serviceAccountTokenVariable = 'OP_SERVICE_ACCOUNT_TOKEN';
+const registryDirectory = Effect.gen(function* () {
+    const { file } = yield* RegistryLocation;
+    return file.slice(0, file.lastIndexOf('/'));
+});
+export const opCredentialFile = (factory) => Effect.map(registryDirectory, directory => `${directory}/op-service-account.${factory}.cred`);
+/** Factories with a stored token. */
+export const storedTokenFactories = Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const directory = yield* registryDirectory;
+    const entries = yield* fs
+        .readDirectory(directory)
+        .pipe(Effect.orElseSucceed(() => []));
+    return entries.flatMap(entry => {
+        const factory = credentialPattern.exec(entry)?.[1];
+        return factory === undefined ? [] : [factory];
+    });
+});
+/** Service-account tokens are `ops_` followed by an encoded payload. */
+export const parseServiceAccountToken = (value) => {
+    const token = value.trim();
+    return /^ops_[A-Za-z0-9_-]{20,}={0,2}$/.test(token)
+        ? Effect.succeed(Redacted.make(token))
+        : Effect.fail(new OpCredentialError({
+            message: 'not a 1Password service-account token (expected ops_…)'
+        }));
+};
+const unavailable = () => new OpCredentialError({
+    message: 'systemd-creds is unavailable; export OP_SERVICE_ACCOUNT_TOKEN instead, or sign in with op'
+});
+const decryptSealed = (factory, file) => Effect.gen(function* () {
+    const result = yield* capture('systemd-creds', [
+        '--user',
+        'decrypt',
+        `--name=${credentialName(factory)}`,
+        file,
+        '-'
+    ]).pipe(Effect.mapError(unavailable));
+    if (result.exitCode !== 0) {
+        return yield* new OpCredentialError({
+            message: `cannot decrypt ${file} (exit ${result.exitCode}); store the token again with \`provision config op-token set --factory ${factory}\``
+        });
+    }
+    return result.stdout;
+});
+/** Unseals one factory's stored token with the (prompted, cached) passphrase. */
+const openStoredToken = (factory, file) => Effect.gen(function* () {
+    const sealed = yield* decryptSealed(factory, file);
+    const passphrase = yield* (yield* Passphrase).get;
+    const token = yield* unseal(passphrase, sealed, credentialName(factory)).pipe(Effect.mapError(error => error.reason === 'malformed'
+        ? new OpCredentialError({
+            message: `${file} is not passphrase-protected; store the token again with \`provision config op-token set --factory ${factory}\``
+        })
+        : new OpCredentialError({ message: `${error.message} for the ${factory} token` })));
+    return yield* parseServiceAccountToken(Redacted.value(token));
+});
+/**
+ * Seals the token with the provision passphrase, then encrypts it with `systemd-creds --user`
+ * into a `0600` file. The first stored token chooses the passphrase; later ones must use the same
+ * passphrase, proven by opening an existing token.
+ */
+export const storeServiceAccountToken = (factory, token) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const passphrases = yield* Passphrase;
+    const file = yield* opCredentialFile(factory);
+    const others = (yield* storedTokenFactories).filter(other => other !== factory);
+    const existing = others[0];
+    const passphrase = existing === undefined
+        ? yield* passphrases.choose
+        : yield* openStoredToken(existing, yield* opCredentialFile(existing)).pipe(Effect.andThen(passphrases.get), Effect.mapError(error => error instanceof OpCredentialError && error.message.startsWith('wrong passphrase')
+            ? new OpCredentialError({
+                message: `that is not the passphrase protecting the ${existing} token`
+            })
+            : error));
+    const sealed = yield* seal(passphrase, token, credentialName(factory));
+    yield* fs
+        .makeDirectory(file.slice(0, file.lastIndexOf('/')), { recursive: true })
+        .pipe(Effect.mapError(() => new OpCredentialError({ message: `cannot create ${file}` })));
+    const result = yield* capture('systemd-creds', ['--user', 'encrypt', `--name=${credentialName(factory)}`, '-', file], { input: sealed }).pipe(Effect.mapError(unavailable));
+    if (result.exitCode !== 0) {
+        return yield* new OpCredentialError({
+            message: `systemd-creds could not encrypt the token (exit ${result.exitCode})`
+        });
+    }
+    yield* fs
+        .chmod(file, 0o600)
+        .pipe(Effect.mapError(() => new OpCredentialError({ message: `cannot protect ${file}` })));
+    return file;
+});
+export const removeServiceAccountToken = (factory) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    const file = yield* opCredentialFile(factory);
+    const exists = yield* fs.exists(file).pipe(Effect.orElseSucceed(() => false));
+    if (!exists)
+        return false;
+    yield* fs
+        .remove(file)
+        .pipe(Effect.mapError(() => new OpCredentialError({ message: `cannot remove ${file}` })));
+    return true;
+});
+/** Where `op` credentials would come from for a factory, without prompting or decrypting. */
+export const opAuthKind = (factory) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    if ((process.env[serviceAccountTokenVariable] ?? '').trim() !== '') {
+        return 'environment';
+    }
+    const file = yield* opCredentialFile(factory);
+    const exists = yield* fs.exists(file).pipe(Effect.orElseSucceed(() => false));
+    return exists ? 'credential' : 'session';
+});
+export const describeOpAuth = (factory) => Effect.gen(function* () {
+    const kind = yield* opAuthKind(factory);
+    return kind === 'environment'
+        ? 'service account (OP_SERVICE_ACCOUNT_TOKEN)'
+        : kind === 'credential'
+            ? `passphrase-protected service account (${yield* opCredentialFile(factory)})`
+            : 'op session or desktop app';
+});
+/** Resolves how `op` authenticates for one factory; a stored token needs the passphrase. */
+export const resolveOpAuth = (factory) => Effect.gen(function* () {
+    const fs = yield* FileSystem.FileSystem;
+    if ((process.env[serviceAccountTokenVariable] ?? '').trim() !== '') {
+        return { kind: 'environment' };
+    }
+    const file = yield* opCredentialFile(factory);
+    const exists = yield* fs.exists(file).pipe(Effect.orElseSucceed(() => false));
+    if (!exists)
+        return { kind: 'session' };
+    const token = yield* openStoredToken(factory, file);
+    return { kind: 'credential', file, token };
+});
+/** Child-only environment for `op` under a stored service-account token. */
+export const opEnvironment = (source) => source.kind === 'credential'
+    ? Option.some({ [serviceAccountTokenVariable]: Redacted.value(source.token) })
+    : Option.none();

package/dist/factory/passphrase.js

@@ -0,0 +1,145 @@
+import { closeSync, openSync, writeSync } from 'node:fs';
+import { ReadStream } from 'node:tty';
+import { Context, Data, Effect, Layer, Redacted } from 'effect';
+/**
+ * The provision passphrase: the human approval for every run that reads factory credentials.
+ * It is read from the controlling terminal only, never from arguments, environment, or stdin, and
+ * only when this process is attached to a terminal, so agent-launched commands cannot be
+ * answered by the agent. One prompt per process; the value stays in memory for that run only.
+ */
+export class PassphraseError extends Data.TaggedError('PassphraseError') {
+}
+export class Passphrase extends Context.Service()('provision/factory/Passphrase') {
+}
+export const minimumPassphraseLength = 12;
+const notInteractive = () => new PassphraseError({
+    message: 'this needs your provision passphrase: run the command yourself in a terminal (agents cannot approve it)'
+});
+/**
+ * Reads hidden input from `/dev/tty`, line by line, until `next` says a line ends it. Lines may
+ * arrive in one pasted chunk; CR, LF, and CRLF all end a line. Ctrl-C, or Ctrl-D on an empty
+ * line, cancels. `next` can print a confirmation (never the value) after each line.
+ */
+const readHidden = (message, next) => Effect.callback(resume => {
+    if (process.stdin.isTTY !== true && process.stdout.isTTY !== true) {
+        resume(Effect.fail(notInteractive()));
+        return;
+    }
+    let readFd;
+    let writeFd;
+    try {
+        readFd = openSync('/dev/tty', 'r');
+        writeFd = openSync('/dev/tty', 'w');
+    }
+    catch {
+        resume(Effect.fail(notInteractive()));
+        return;
+    }
+    const input = new ReadStream(readFd);
+    const lines = [];
+    let characters = [];
+    let afterCarriageReturn = false;
+    let finished = false;
+    const write = (text) => {
+        try {
+            const buffer = Buffer.from(text);
+            let offset = 0;
+            while (offset < buffer.length) {
+                offset += writeSync(writeFd, buffer, offset);
+            }
+        }
+        catch {
+            // The prompt is cosmetic; reading still works.
+        }
+    };
+    const finish = (outcome) => {
+        finished = true;
+        input.removeListener('data', onData);
+        input.setRawMode(false);
+        input.destroy();
+        write('\n');
+        closeSync(writeFd);
+        resume(outcome === 'done'
+            ? Effect.succeed(lines.map(line => Redacted.make(line)))
+            : Effect.fail(new PassphraseError({ message: 'cancelled' })));
+    };
+    const endLine = () => {
+        lines.push(characters.join(''));
+        characters = [];
+        const { done, note } = next(lines);
+        if (note !== undefined)
+            write(`\n${note}`);
+        if (done)
+            finish('done');
+    };
+    const onData = (chunk) => {
+        for (const character of chunk.toString('utf8')) {
+            if (finished)
+                return;
+            const wasCarriageReturn = afterCarriageReturn;
+            afterCarriageReturn = character === '\r';
+            if (character === '\n' && wasCarriageReturn)
+                continue;
+            if (character === '\r' || character === '\n') {
+                endLine();
+                continue;
+            }
+            if (character === '\u0003' || (character === '\u0004' && characters.length === 0)) {
+                return finish('cancelled');
+            }
+            if (character === '\u007f' || character === '\b')
+                characters.pop();
+            else if (character >= ' ')
+                characters.push(character);
+        }
+    };
+    write(message);
+    input.setRawMode(true);
+    input.on('data', onData);
+    return Effect.sync(() => {
+        if (finished)
+            return;
+        input.removeListener('data', onData);
+        input.setRawMode(false);
+        input.destroy();
+        closeSync(writeFd);
+    });
+});
+/** Reads one hidden line from `/dev/tty`. Ctrl-C or Ctrl-D cancels. */
+export const readHiddenLine = (message) => readHidden(message, () => ({ done: true })).pipe(Effect.map(lines => lines[0] ?? Redacted.make('')));
+/**
+ * Reads hidden lines until an empty line or until `complete` accepts them, so a pasted block
+ * arrives in one go; `note` confirms each line without echoing it.
+ */
+export const readHiddenLines = (message, options) => readHidden(message, lines => {
+    const last = lines.at(-1) ?? '';
+    const note = options.note(last);
+    const done = last.trim() === '' || options.complete(lines);
+    return note === undefined ? { done } : { done, note };
+}).pipe(Effect.map(lines => lines.filter(line => Redacted.value(line).trim() !== '')));
+export const makePassphrase = (read) => {
+    let cached;
+    const remember = (value) => Effect.sync(() => {
+        cached = value;
+        return value;
+    });
+    return Passphrase.of({
+        get: Effect.suspend(() => cached === undefined
+            ? read('provision passphrase: ').pipe(Effect.flatMap(remember))
+            : Effect.succeed(cached)),
+        choose: Effect.gen(function* () {
+            const first = yield* read('new provision passphrase: ');
+            if (Redacted.value(first).length < minimumPassphraseLength) {
+                return yield* new PassphraseError({
+                    message: `the passphrase needs at least ${minimumPassphraseLength} characters`
+                });
+            }
+            const second = yield* read('repeat the passphrase: ');
+            if (Redacted.value(first) !== Redacted.value(second)) {
+                return yield* new PassphraseError({ message: 'the passphrases do not match' });
+            }
+            return yield* remember(first);
+        })
+    });
+};
+export const PassphraseLive = Layer.sync(Passphrase, () => makePassphrase(readHiddenLine));