Release 0.9.0 with generic_password_read

README.md

@@ -87,6 +87,16 @@ TypeScript reader, so `pbpaste | <cli> login --stdin` works in Rust CLIs; a
 regular file must still be owned by you and private, and other descriptor
 kinds are still refused.
 
+Changes in 0.9.0: the Rust sidecar accepts `generic_password_read`, a macOS
+generic-password lookup through `SecItemCopyMatching` that runs under the
+calling binary's own signing identity instead of `/usr/bin/security`. It
+takes exact `service` and `account` selectors, reads at most 4096 bytes, and
+reports `missing`, `denied`, `interaction-not-allowed`, `keychain-error`, or
+`unsupported` (off macOS) instead of a raw Security-framework status. The
+TypeScript wrapper has no fallback for the read: the point is that the
+keychain prompt names your signed binary, so there is no in-process
+substitute.
+
 The Rust crate has the same copy through
 `describe_error(code, &DescribeOptions { .. })` and `CustodyError::describe`;
 `bun run generate:error-copy` writes `rust/src/error-copy.json` from the

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hraness/local-custody",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Owner-only files, atomic private writes, a local JSON control socket, and file-descriptor secret input for Hraness product CLIs.",
   "license": "MIT",
   "type": "module",

portfolio-inventory.json

@@ -8,7 +8,7 @@
       "name": "@hraness/local-custody",
       "path": ".",
       "visibility": "public",
-      "version": "0.8.0"
+      "version": "0.9.0"
     }
   ],
   "dependencies": [],

rust/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "local-custody"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "Owner-only path checks, stable private reads, and atomic private file writes for Rust CLIs."