@bitspark/archon-sdk 0.6.1

package/dist/src/envelope.d.ts

@@ -0,0 +1,27 @@
+/** The first four bytes of every envelope. */
+export declare const ENVELOPE_MAGIC: Uint8Array<ArrayBuffer>;
+/** The envelope format version. */
+export declare const ENVELOPE_VERSION = 1;
+/** The first byte of every signed envelope message. Distinct from the possession `SCHEME_TAG`. */
+export declare const ENVELOPE_SCHEME_TAG = 2;
+/** What `open` returns: the sealing key and the payload, both verified. */
+export interface Opened {
+    /** The public key that sealed the envelope. Trusting it is the caller's decision. */
+    pubkey: Uint8Array;
+    /** The payload, verbatim. */
+    payload: Uint8Array;
+}
+/**
+ * Seal `payload` in `domain` with the key behind `seed`. Throws on an invalid domain (see
+ * `signInDomain`). An empty payload is allowed — the signed message is never empty
+ * because of the scheme tag.
+ */
+export declare function seal(seed: Uint8Array, domain: string, payload: Uint8Array): Uint8Array;
+/**
+ * Open `envelope`, which the caller expects to be sealed in `domain`. Throws — never
+ * returns a payload — when the bytes are not an envelope (magic, version, length), the
+ * envelope claims a different domain, or the signature does not verify.
+ */
+export declare function open(envelope: Uint8Array, domain: string): Opened;
+/** The pinned layout of what gets signed: the scheme tag, then the payload verbatim. */
+export declare function envelopeMessageBytes(payload: Uint8Array): Uint8Array;

package/dist/src/envelope.js

@@ -0,0 +1,91 @@
+// The signed envelope — THESE BYTES, SIGNED BY THIS KEY, IN THIS DOMAIN.
+//
+// A fixed binary container, JWS-shaped and deliberately not JWT-shaped:
+//
+//   "arcn" ‖ 0x01 ‖ u8(len domain) ‖ domain ‖ pubkey[32] ‖ signature[64] ‖ payload
+//
+// where `signature = signInDomain(seed, domain, SCHEME_TAG ‖ payload)`. The domain is
+// bound cryptographically (it is the RFC 8032 context), the public key is bound by
+// verification, and the payload is opaque: the envelope says nothing about what it
+// means. WHAT IS NOT HERE, ON PURPOSE: expiry, issuer, audience, key-id, nonce. Each is
+// either policy — whose clock, whose trust? — or a second spelling of the key, and both
+// belong to the consumer.
+//
+// `open` takes the domain the VERIFIER expects and refuses an envelope that claims
+// another. The verifier chooses the domain; an envelope never gets to choose it for
+// them. Whether to trust the key it names is, again, the verifier's.
+import { getPublicKey, signInDomain, verifyInDomain, MAX_DOMAIN_SIZE, PUBLIC_KEY_SIZE, SIGNATURE_SIZE, } from "@bitspark/archon";
+/** The first four bytes of every envelope. */
+export const ENVELOPE_MAGIC = new Uint8Array([0x61, 0x72, 0x63, 0x6e]); // "arcn"
+/** The envelope format version. */
+export const ENVELOPE_VERSION = 0x01;
+/** The first byte of every signed envelope message. Distinct from the possession `SCHEME_TAG`. */
+export const ENVELOPE_SCHEME_TAG = 0x02;
+/**
+ * Seal `payload` in `domain` with the key behind `seed`. Throws on an invalid domain (see
+ * `signInDomain`). An empty payload is allowed — the signed message is never empty
+ * because of the scheme tag.
+ */
+export function seal(seed, domain, payload) {
+    const signature = signInDomain(seed, domain, envelopeMessageBytes(payload));
+    const pubkey = getPublicKey(seed);
+    const d = new TextEncoder().encode(domain);
+    const out = new Uint8Array(4 + 1 + 1 + d.length + PUBLIC_KEY_SIZE + SIGNATURE_SIZE + payload.length);
+    let at = 0;
+    out.set(ENVELOPE_MAGIC, at);
+    at += 4;
+    out[at++] = ENVELOPE_VERSION;
+    out[at++] = d.length; // ≤ 255: signInDomain has already checked it
+    out.set(d, at);
+    at += d.length;
+    out.set(pubkey, at);
+    at += PUBLIC_KEY_SIZE;
+    out.set(signature, at);
+    at += SIGNATURE_SIZE;
+    out.set(payload, at);
+    return out;
+}
+/**
+ * Open `envelope`, which the caller expects to be sealed in `domain`. Throws — never
+ * returns a payload — when the bytes are not an envelope (magic, version, length), the
+ * envelope claims a different domain, or the signature does not verify.
+ */
+export function open(envelope, domain) {
+    let at = 0;
+    const take = (n) => {
+        if (at + n > envelope.length)
+            throw new Error(`envelope truncated at byte ${envelope.length}`);
+        const s = envelope.subarray(at, at + n);
+        at += n;
+        return s;
+    };
+    const magic = take(4);
+    if (!ENVELOPE_MAGIC.every((b, i) => magic[i] === b))
+        throw new Error("not an envelope: bad magic");
+    const version = take(1)[0];
+    if (version !== ENVELOPE_VERSION)
+        throw new Error(`unsupported envelope version ${version}`);
+    const dlen = take(1)[0];
+    if (dlen === 0 || dlen > MAX_DOMAIN_SIZE)
+        throw new Error(`envelope domain length ${dlen} out of range`);
+    const claimed = take(dlen);
+    const expected = new TextEncoder().encode(domain);
+    if (claimed.length !== expected.length || !expected.every((b, i) => claimed[i] === b)) {
+        throw new Error("envelope claims a different domain");
+    }
+    const pubkey = new Uint8Array(take(PUBLIC_KEY_SIZE));
+    const signature = take(SIGNATURE_SIZE);
+    const payload = new Uint8Array(envelope.subarray(at));
+    if (!verifyInDomain(pubkey, domain, envelopeMessageBytes(payload), signature)) {
+        throw new Error("envelope signature does not verify");
+    }
+    return { pubkey, payload };
+}
+/** The pinned layout of what gets signed: the scheme tag, then the payload verbatim. */
+export function envelopeMessageBytes(payload) {
+    const out = new Uint8Array(1 + payload.length);
+    out[0] = ENVELOPE_SCHEME_TAG;
+    out.set(payload, 1);
+    return out;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/src/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/envelope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,wFAAwF;AACxF,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;AACjF,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAUxC;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,IAAgB,EAAE,MAAc,EAAE,OAAmB;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,eAAe,GAAG,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5B,EAAE,IAAI,CAAC,CAAC;IACR,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC;IAC7B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,6CAA6C;IACnE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpB,EAAE,IAAI,eAAe,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvB,EAAE,IAAI,cAAc,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,QAAoB,EAAE,MAAc;IACvD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,IAAI,GAAG,CAAC,CAAS,EAAc,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,EAAE,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,eAAe,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./possession.js";
+export * from "./envelope.js";
+export * from "./login.js";
+export * from "./login-audience.js";

package/dist/src/index.js

@@ -0,0 +1,19 @@
+// archon-sdk — one layer above the identity floor.
+//
+// @bitspark/archon answers "is this really them?" over bytes. This package answers the
+// two questions every protocol asks next, without knowing the protocol:
+//
+// - possession — can they sign, right now, for this channel? Challenge/response; the
+//   binding is what makes it a proof, so an empty one is refused.
+// - envelope — these bytes, signed by this key, in this domain. JWS, never JWT.
+//
+// The rule that keeps this layer honest: entropy, time and channel binding are
+// ARGUMENTS. This package never sources them. That is what lets every byte it emits be a
+// deterministic function of its inputs and be pinned by vectors/sdk.json across three
+// languages — the same way the floor is pinned. Connection setup is not here and never
+// will be: that is the transport's (ADR 0004).
+export * from "./possession.js";
+export * from "./envelope.js";
+export * from "./login.js";
+export * from "./login-audience.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,uFAAuF;AACvF,wEAAwE;AACxE,EAAE;AACF,qFAAqF;AACrF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,yFAAyF;AACzF,sFAAsF;AACtF,uFAAuF;AACvF,+CAA+C;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}

package/dist/src/login-audience.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The audience the login proof binds and the request id's bytes, from the URL the person was
+ * told to run. Scheme is http/https/ws/wss (case-insensitive; ws → http, wss → https); the
+ * host is an ASCII reg-name or a bracketed IPv6 literal, lowercased; a port is 1..=65535
+ * without a leading zero and is omitted from the audience when it is the folded scheme's
+ * default (80, 443); segments are kept as written (case preserved, percent-escapes never
+ * decoded); the id is lowercase hex of even length and is returned decoded. Throws on any
+ * non-ASCII, whitespace or control character, userinfo, query, fragment, empty segment,
+ * `.`/`..` segment, malformed escape, or a penultimate segment other than `login`.
+ */
+export declare function deriveAudience(url: string): {
+    audience: string;
+    id: Uint8Array;
+};

package/dist/src/login-audience.js

@@ -0,0 +1,138 @@
+// deriveAudience — the invocation URL → { audience, id bytes }, docs/login.md §2.1.
+//
+// Part of the scheme, not of any CLI: three URL parsers normalise three ways (a WHATWG URL
+// drops a default port and userinfo, net/url decodes the path, a hand-rolled split keeps
+// userinfo as the host) and the audience is the first field of the binding, so one URL must
+// yield one audience in every lane. This function accepts exactly the grammar of §2.1 and
+// REFUSES everything else rather than normalising it — deliberately not the WHATWG `URL`
+// class, which is a normaliser.
+//
+//   invocation = scheme "://" host [ ":" port ] *( "/" segment ) "/login/" id
+/**
+ * The audience the login proof binds and the request id's bytes, from the URL the person was
+ * told to run. Scheme is http/https/ws/wss (case-insensitive; ws → http, wss → https); the
+ * host is an ASCII reg-name or a bracketed IPv6 literal, lowercased; a port is 1..=65535
+ * without a leading zero and is omitted from the audience when it is the folded scheme's
+ * default (80, 443); segments are kept as written (case preserved, percent-escapes never
+ * decoded); the id is lowercase hex of even length and is returned decoded. Throws on any
+ * non-ASCII, whitespace or control character, userinfo, query, fragment, empty segment,
+ * `.`/`..` segment, malformed escape, or a penultimate segment other than `login`.
+ */
+export function deriveAudience(url) {
+    for (let i = 0; i < url.length; i++) {
+        const c = url.charCodeAt(i);
+        if (c <= 0x20 || c >= 0x7f) {
+            throw new Error(`login: URL character ${i} is U+${c.toString(16).toUpperCase().padStart(4, "0")} — only printable ASCII is accepted`);
+        }
+    }
+    const sep = url.indexOf("://");
+    if (sep < 0)
+        throw new Error("login: URL has no scheme");
+    const [scheme, defaultPort] = foldScheme(url.slice(0, sep));
+    const rest = url.slice(sep + 3);
+    const slash = rest.indexOf("/");
+    if (slash < 0)
+        throw new Error("login: URL has no path — expected <audience>/login/<id>");
+    const [host, port] = parseAuthority(rest.slice(0, slash));
+    const path = rest.slice(slash);
+    if (path.includes("?") || path.includes("#")) {
+        throw new Error("login: URL carries a query or fragment — expected <audience>/login/<id>");
+    }
+    const segments = path.slice(1).split("/");
+    segments.forEach((seg, i) => checkSegment(seg, i));
+    if (segments.length < 2)
+        throw new Error("login: URL is not <audience>/login/<id>");
+    const penultimate = segments[segments.length - 2];
+    if (penultimate !== "login") {
+        throw new Error(`login: expected <audience>/login/<id>, got ${JSON.stringify(penultimate)} as the penultimate segment`);
+    }
+    const id = decodeId(segments[segments.length - 1]);
+    let audience = `${scheme}://${host}`;
+    if (port !== "" && port !== defaultPort)
+        audience += `:${port}`;
+    for (const seg of segments.slice(0, -2))
+        audience += `/${seg}`;
+    return { audience, id };
+}
+function foldScheme(s) {
+    switch (s.toLowerCase()) {
+        case "http":
+        case "ws":
+            return ["http", "80"];
+        case "https":
+        case "wss":
+            return ["https", "443"];
+        default:
+            throw new Error(`login: unsupported URL scheme ${JSON.stringify(s)} — want http(s) or ws(s)`);
+    }
+}
+function parseAuthority(auth) {
+    if (auth.includes("@"))
+        throw new Error("login: URL carries userinfo — refused");
+    if (auth === "")
+        throw new Error("login: URL has no host");
+    if (auth.startsWith("[")) {
+        const end = auth.indexOf("]");
+        if (end < 0)
+            throw new Error("login: unterminated IPv6 literal");
+        const lit = auth.slice(1, end).toLowerCase();
+        if (lit.length < 2 || !lit.includes(":") || !/^[0-9a-f:.]+$/.test(lit)) {
+            throw new Error("login: malformed IPv6 literal");
+        }
+        const tail = auth.slice(end + 1);
+        if (tail === "")
+            return [`[${lit}]`, ""];
+        if (!tail.startsWith(":"))
+            throw new Error("login: bytes after the IPv6 literal — refused");
+        return [`[${lit}]`, checkPort(tail.slice(1))];
+    }
+    const colon = auth.indexOf(":");
+    const name = colon < 0 ? auth : auth.slice(0, colon);
+    const port = colon < 0 ? "" : checkPort(auth.slice(colon + 1));
+    const host = name.toLowerCase();
+    for (const label of host.split(".")) {
+        if (label === "")
+            throw new Error("login: host has an empty label — refused");
+        if (!/^[a-z0-9-]+$/.test(label)) {
+            throw new Error("login: host has a character outside [a-z0-9-.] — refused (IDNs must be given as punycode)");
+        }
+    }
+    return [host, port];
+}
+function checkPort(p) {
+    if (!/^[0-9]+$/.test(p) || (p.length > 1 && p.startsWith("0")))
+        throw new Error(`login: port ${JSON.stringify(p)} — refused`);
+    const n = Number(p);
+    if (n < 1 || n > 65535)
+        throw new Error(`login: port ${JSON.stringify(p)} is out of range`);
+    return p;
+}
+const SEGMENT_CHAR = /^[A-Za-z0-9\-._~!$&'()*+,;=:@]$/;
+function checkSegment(seg, i) {
+    if (seg === "")
+        throw new Error(`login: path segment ${i}: empty segment (a trailing slash or \`//\`) — refused`);
+    if (seg === "." || seg === "..")
+        throw new Error(`login: path segment ${i}: dot segment — refused`);
+    for (let j = 0; j < seg.length; j++) {
+        const c = seg[j];
+        if (c === "%") {
+            if (j + 2 >= seg.length || !/^[0-9A-Fa-f]{2}$/.test(seg.slice(j + 1, j + 3))) {
+                throw new Error(`login: path segment ${i}: malformed percent-escape — refused`);
+            }
+            j += 2;
+        }
+        else if (!SEGMENT_CHAR.test(c)) {
+            throw new Error(`login: path segment ${i}: ${JSON.stringify(c)} is not allowed in a path segment — refused`);
+        }
+    }
+}
+function decodeId(s) {
+    if (s.length < 2 || s.length % 2 !== 0 || !/^[0-9a-f]+$/.test(s)) {
+        throw new Error(`login: id ${JSON.stringify(s)} is not lowercase hex of even length`);
+    }
+    const out = new Uint8Array(s.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(s.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+//# sourceMappingURL=login-audience.js.map

package/dist/src/login-audience.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-audience.js","sourceRoot":"","sources":["../../src/login-audience.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,EAAE;AACF,2FAA2F;AAC3F,yFAAyF;AACzF,4FAA4F;AAC5F,0FAA0F;AAC1F,yFAAyF;AACzF,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACxI,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACzD,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC1F,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpF,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACnD,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,CAAC;IACpD,IAAI,QAAQ,GAAG,GAAG,MAAM,MAAM,IAAI,EAAE,CAAC;IACrC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,WAAW;QAAE,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC;IAChE,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;IAC/D,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC;QACZ,KAAK,IAAI;YACP,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,OAAO,CAAC;QACb,KAAK,KAAK;YACR,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1B;YACE,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACjF,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7C,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,GAAG,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAC9E,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAC9H,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IAC5F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAEvD,SAAS,YAAY,CAAC,GAAW,EAAE,CAAS;IAC1C,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,wDAAwD,CAAC,CAAC;IAClH,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,yBAAyB,CAAC,CAAC;IACpG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,sCAAsC,CAAC,CAAC;YAClF,CAAC;YACD,CAAC,IAAI,CAAC,CAAC;QACT,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/login.d.ts

@@ -0,0 +1,63 @@
+/** The RFC 8032 context every login-scheme proof is made in. */
+export declare const LOGIN_DOMAIN = "archon-login/1";
+/** The binding's first byte for the person's proof (made by P). */
+export declare const LOGIN_ROLE_LOGIN = 1;
+/** The binding's first byte for the browser's collect proof (made by K). */
+export declare const LOGIN_ROLE_COLLECT = 2;
+/**
+ * The longest audience, id or scope entry, in bytes — the u16 length prefix's bound. It also
+ * bounds the scope entry count and the whole binding (which must fit the possession scheme's
+ * own u16 field).
+ */
+export declare const LOGIN_MAX_FIELD_SIZE = 65535;
+/**
+ * A pending login as the server issued it and the CLI reads it back (docs/login.md §3.1).
+ * The nonce is validated by the possession scheme (≥ 16 bytes) at proof time; the other
+ * fields by `loginBinding`.
+ */
+export interface LoginRequest {
+    /** The server's, opaque, 1..=LOGIN_MAX_FIELD_SIZE bytes. */
+    id: Uint8Array;
+    /** The server's fresh entropy, one per request. */
+    nonce: Uint8Array;
+    /** K's public key, exactly PUBLIC_KEY_SIZE bytes. */
+    browser: Uint8Array;
+    /** Ordered; each 1..=LOGIN_MAX_FIELD_SIZE bytes of UTF-8 with no control characters. */
+    scope: string[];
+    /** The delegation's requested lifetime in seconds, > 0 (a u32). */
+    validFor: number;
+}
+/**
+ * The bytes both proofs are bound to, for `role` over `audience` and `req` (docs/login.md
+ * §3.2):
+ *
+ *   role ‖ u16be(len audience) ‖ audience ‖ browser[32] ‖ u16be(len id) ‖ id
+ *        ‖ u16be(count scope) ‖ ( u16be(len entry) ‖ entry )* ‖ u32be(valid_for)
+ *
+ * Throws on an unknown role, an empty or oversized audience, an audience or scope entry
+ * carrying a control character (U+0000–U+001F, U+007F) or a lone surrogate (not UTF-8), an
+ * empty scope entry, a browser key of the wrong size, an empty or oversized id, a validity
+ * that is not an integer in 1..=2^32-1, or a binding that would not fit the possession
+ * scheme's u16 field.
+ */
+export declare function loginBinding(role: number, audience: string, req: LoginRequest): Uint8Array;
+/**
+ * The person's login proof: possession by the key behind `seed`, in `LOGIN_DOMAIN`, over
+ * `req.nonce` and `loginBinding(LOGIN_ROLE_LOGIN, audience, req)`. Throws for what
+ * `loginBinding` throws, for a short nonce, and for a seed of the wrong size.
+ */
+export declare function proveLogin(seed: Uint8Array, audience: string, req: LoginRequest): Uint8Array;
+/**
+ * Whether `signature` is the login proof by the key behind `pub` for `req` at `audience`.
+ * Total: every shape failure is `false`.
+ */
+export declare function verifyLogin(pub: Uint8Array, audience: string, req: LoginRequest, signature: Uint8Array): boolean;
+/**
+ * The browser's collect proof: possession by the key behind `seed` — which must be the key
+ * `req` names as `browser` — in `LOGIN_DOMAIN`, over `req.nonce` and
+ * `loginBinding(LOGIN_ROLE_COLLECT, audience, req)`. A seed whose public key is not
+ * `req.browser` throws: the proof is only meaningful from the key the request names.
+ */
+export declare function proveCollect(seed: Uint8Array, audience: string, req: LoginRequest): Uint8Array;
+/** Whether `signature` is the collect proof by `req.browser` for `req` at `audience`. Total. */
+export declare function verifyCollect(audience: string, req: LoginRequest, signature: Uint8Array): boolean;

package/dist/src/login.js

@@ -0,0 +1,171 @@
+// The archon login scheme — MAY THIS EPHEMERAL KEY ACT AS ME, HERE, FOR THIS, UNTIL THEN?
+//
+// A browser (any key-less client) holds an ephemeral key K and opens a request at a service;
+// the person's CLI, holding P, proves to that service that P agrees to let K act there for a
+// stated scope and validity. The proof is the possession scheme (./possession.ts) in the
+// domain `LOGIN_DOMAIN`, over the server's nonce and a binding that names everything the
+// person approved: the audience the CLI talks to, K, the request, the scope entries and the
+// validity — see docs/login.md §3.
+//
+// THE AUDIENCE IS DERIVED, NEVER TRANSPORTED: the CLI takes it from the URL it was invoked
+// with and the server from its own configuration (docs/login.md §2). This module takes it as
+// an argument and binds it; it never reads it off a message. Everything this module refuses
+// to source — the nonce, the id, K, clocks, the delegation's contents, custody, sockets — is
+// an argument or another layer's (ADR 0004, ADR 0007).
+//
+// Two proofs share the layout and differ in a role byte: the login proof (0x01) is made by P;
+// the collect proof (0x02) is made by K when the browser collects the answer, so a bystander
+// who saw the request id cannot consume the login.
+import { getPublicKey, PUBLIC_KEY_SIZE, SEED_SIZE } from "@bitspark/archon";
+import { MAX_FIELD_SIZE as POSSESSION_MAX_FIELD_SIZE, provePossession, verifyPossession } from "./possession.js";
+/** The RFC 8032 context every login-scheme proof is made in. */
+export const LOGIN_DOMAIN = "archon-login/1";
+/** The binding's first byte for the person's proof (made by P). */
+export const LOGIN_ROLE_LOGIN = 0x01;
+/** The binding's first byte for the browser's collect proof (made by K). */
+export const LOGIN_ROLE_COLLECT = 0x02;
+/**
+ * The longest audience, id or scope entry, in bytes — the u16 length prefix's bound. It also
+ * bounds the scope entry count and the whole binding (which must fit the possession scheme's
+ * own u16 field).
+ */
+export const LOGIN_MAX_FIELD_SIZE = 0xffff;
+const utf8 = new TextEncoder();
+/**
+ * The bytes both proofs are bound to, for `role` over `audience` and `req` (docs/login.md
+ * §3.2):
+ *
+ *   role ‖ u16be(len audience) ‖ audience ‖ browser[32] ‖ u16be(len id) ‖ id
+ *        ‖ u16be(count scope) ‖ ( u16be(len entry) ‖ entry )* ‖ u32be(valid_for)
+ *
+ * Throws on an unknown role, an empty or oversized audience, an audience or scope entry
+ * carrying a control character (U+0000–U+001F, U+007F) or a lone surrogate (not UTF-8), an
+ * empty scope entry, a browser key of the wrong size, an empty or oversized id, a validity
+ * that is not an integer in 1..=2^32-1, or a binding that would not fit the possession
+ * scheme's u16 field.
+ */
+export function loginBinding(role, audience, req) {
+    if (role !== LOGIN_ROLE_LOGIN && role !== LOGIN_ROLE_COLLECT)
+        throw new Error(`login: unknown role 0x${role.toString(16)}`);
+    const aud = checkText("audience", audience);
+    if (req.browser.length !== PUBLIC_KEY_SIZE) {
+        throw new Error(`login: browser key is ${req.browser.length} bytes, want ${PUBLIC_KEY_SIZE}`);
+    }
+    if (req.id.length === 0 || req.id.length > LOGIN_MAX_FIELD_SIZE) {
+        throw new Error(`login: id is ${req.id.length} bytes, want 1..=${LOGIN_MAX_FIELD_SIZE}`);
+    }
+    if (req.scope.length > LOGIN_MAX_FIELD_SIZE) {
+        throw new Error(`login: ${req.scope.length} scope entries, want at most ${LOGIN_MAX_FIELD_SIZE}`);
+    }
+    const entries = req.scope.map((entry, i) => checkText(`scope[${i}]`, entry));
+    if (!Number.isInteger(req.validFor) || req.validFor < 1 || req.validFor > 0xffffffff) {
+        throw new Error(`login: valid_for is ${req.validFor}, want an integer in 1..=4294967295`);
+    }
+    let size = 1 + 2 + aud.length + PUBLIC_KEY_SIZE + 2 + req.id.length + 2 + 4;
+    for (const e of entries)
+        size += 2 + e.length;
+    if (size > POSSESSION_MAX_FIELD_SIZE) {
+        throw new Error(`login: binding is ${size} bytes, over the possession scheme's ${POSSESSION_MAX_FIELD_SIZE}`);
+    }
+    const out = new Uint8Array(size);
+    let at = 0;
+    out[at++] = role;
+    at = putField(out, at, aud);
+    out.set(req.browser, at);
+    at += PUBLIC_KEY_SIZE;
+    at = putField(out, at, req.id);
+    out[at++] = (entries.length >> 8) & 0xff;
+    out[at++] = entries.length & 0xff;
+    for (const e of entries)
+        at = putField(out, at, e);
+    out[at++] = (req.validFor >>> 24) & 0xff;
+    out[at++] = (req.validFor >>> 16) & 0xff;
+    out[at++] = (req.validFor >>> 8) & 0xff;
+    out[at++] = req.validFor & 0xff;
+    return out;
+}
+/**
+ * The person's login proof: possession by the key behind `seed`, in `LOGIN_DOMAIN`, over
+ * `req.nonce` and `loginBinding(LOGIN_ROLE_LOGIN, audience, req)`. Throws for what
+ * `loginBinding` throws, for a short nonce, and for a seed of the wrong size.
+ */
+export function proveLogin(seed, audience, req) {
+    if (seed.length !== SEED_SIZE)
+        throw new Error(`login: seed is ${seed.length} bytes, want ${SEED_SIZE}`);
+    return provePossession(seed, LOGIN_DOMAIN, req.nonce, loginBinding(LOGIN_ROLE_LOGIN, audience, req));
+}
+/**
+ * Whether `signature` is the login proof by the key behind `pub` for `req` at `audience`.
+ * Total: every shape failure is `false`.
+ */
+export function verifyLogin(pub, audience, req, signature) {
+    let binding;
+    try {
+        binding = loginBinding(LOGIN_ROLE_LOGIN, audience, req);
+    }
+    catch {
+        return false;
+    }
+    return verifyPossession(pub, LOGIN_DOMAIN, req.nonce, binding, signature);
+}
+/**
+ * The browser's collect proof: possession by the key behind `seed` — which must be the key
+ * `req` names as `browser` — in `LOGIN_DOMAIN`, over `req.nonce` and
+ * `loginBinding(LOGIN_ROLE_COLLECT, audience, req)`. A seed whose public key is not
+ * `req.browser` throws: the proof is only meaningful from the key the request names.
+ */
+export function proveCollect(seed, audience, req) {
+    if (seed.length !== SEED_SIZE)
+        throw new Error(`login: seed is ${seed.length} bytes, want ${SEED_SIZE}`);
+    const pub = getPublicKey(seed);
+    if (pub.length !== req.browser.length || !pub.every((b, i) => b === req.browser[i])) {
+        throw new Error("login: seed is not the browser key the request names");
+    }
+    return provePossession(seed, LOGIN_DOMAIN, req.nonce, loginBinding(LOGIN_ROLE_COLLECT, audience, req));
+}
+/** Whether `signature` is the collect proof by `req.browser` for `req` at `audience`. Total. */
+export function verifyCollect(audience, req, signature) {
+    let binding;
+    try {
+        binding = loginBinding(LOGIN_ROLE_COLLECT, audience, req);
+    }
+    catch {
+        return false;
+    }
+    return verifyPossession(req.browser, LOGIN_DOMAIN, req.nonce, binding, signature);
+}
+/**
+ * The rule shared by the audience and every scope entry: 1..=LOGIN_MAX_FIELD_SIZE bytes of
+ * well-formed UTF-8 with no control character (U+0000–U+001F, U+007F). These bytes are
+ * displayed verbatim by the CLI before signing; a control character could make the display
+ * lie about what is bound. Returns the UTF-8 bytes.
+ */
+function checkText(what, s) {
+    if (!isWellFormed(s))
+        throw new Error(`login: ${what} is not well-formed UTF-16 (a lone surrogate is not UTF-8)`);
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp < 0x20 || cp === 0x7f) {
+            throw new Error(`login: ${what} carries a control character U+${cp.toString(16).toUpperCase().padStart(4, "0")}`);
+        }
+    }
+    const bytes = utf8.encode(s);
+    if (bytes.length === 0 || bytes.length > LOGIN_MAX_FIELD_SIZE) {
+        throw new Error(`login: ${what} is ${bytes.length} bytes, want 1..=${LOGIN_MAX_FIELD_SIZE}`);
+    }
+    return bytes;
+}
+function isWellFormed(s) {
+    const native = s.isWellFormed;
+    if (typeof native === "function")
+        return native.call(s);
+    return !/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(s);
+}
+/** Writes u16be(len field) ‖ field at `at`; returns the new offset. */
+function putField(out, at, field) {
+    out[at++] = (field.length >> 8) & 0xff;
+    out[at++] = field.length & 0xff;
+    out.set(field, at);
+    return at + field.length;
+}
+//# sourceMappingURL=login.js.map

package/dist/src/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/login.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,4FAA4F;AAC5F,mCAAmC;AACnC,EAAE;AACF,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,6FAA6F;AAC7F,uDAAuD;AACvD,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,cAAc,IAAI,yBAAyB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAoB3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAiB;IAC5E,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,CAAC,MAAM,gBAAgB,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,gCAAgC,oBAAoB,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,QAAQ,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wCAAwC,yBAAyB,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACjB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzB,EAAE,IAAI,eAAe,CAAC;IACtB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACrG,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACtF,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,CAAS;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,4DAA4D,CAAC,CAAC;IAClH,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAI,CAAiD,CAAC,YAAY,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAU,EAAE,KAAiB;IAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;AAC3B,CAAC"}

package/dist/src/possession.d.ts

@@ -0,0 +1,20 @@
+/** The first byte of every possession message. Distinct from the envelope's `SCHEME_TAG`. */
+export declare const POSSESSION_SCHEME_TAG = 1;
+/** The shortest nonce accepted, in bytes. Below this a proof is guessable, so it is refused. */
+export declare const MIN_NONCE_SIZE = 16;
+/** The longest nonce or binding, in bytes — the u16 length prefix's bound. */
+export declare const MAX_FIELD_SIZE = 65535;
+/**
+ * Prove possession of the key behind `seed` to a challenger who supplied `nonce` and
+ * `binding`, in `domain`. Throws on an invalid domain (see `signInDomain`), a nonce
+ * shorter than `MIN_NONCE_SIZE`, an empty binding, or either field over `MAX_FIELD_SIZE`.
+ */
+export declare function provePossession(seed: Uint8Array, domain: string, nonce: Uint8Array, binding: Uint8Array): Uint8Array;
+/**
+ * Verify a possession proof: `signature` was made by the key behind `pub` over this
+ * `nonce` and `binding` in `domain`. Total: every shape failure — bad domain, short
+ * nonce, empty binding, wrong-sized key or signature — is `false`.
+ */
+export declare function verifyPossession(pub: Uint8Array, domain: string, nonce: Uint8Array, binding: Uint8Array, signature: Uint8Array): boolean;
+/** The pinned layout of what gets signed. Exported so a consumer can pin it too. */
+export declare function possessionMessageBytes(nonce: Uint8Array, binding: Uint8Array): Uint8Array;

package/dist/src/possession.js

@@ -0,0 +1,71 @@
+// Proof of possession — CAN THEY SIGN, RIGHT NOW, FOR THIS CHANNEL?
+//
+// The challenger picks a `nonce` (fresh entropy, ≥ 16 bytes — its own, never this
+// package's) and a `binding` (something only this channel has: a session key, a TLS
+// exporter, the server's identity — the transport's, never this package's). The prover
+// signs a fixed layout of both in the protocol's domain; the challenger verifies with the
+// prover's public key.
+//
+// THE BINDING IS WHAT MAKES THIS A PROOF. A signed nonce alone is relayable: an attacker
+// facing the server as the victim forwards the server's nonce to the victim under some
+// pretext, gets it signed, and presents the signature. Bound to the channel, the
+// signature is worthless anywhere else. So an empty binding is refused outright — the
+// thing it would produce looks like a proof and is not one.
+//
+// The signed bytes are `SCHEME_TAG ‖ u16be(len nonce) ‖ nonce ‖ u16be(len binding) ‖
+// binding`, signed with `signInDomain` in the caller's domain. The tag keeps a
+// possession message and an envelope payload in the same domain from ever being the
+// same bytes.
+import { signInDomain, verifyInDomain } from "@bitspark/archon";
+/** The first byte of every possession message. Distinct from the envelope's `SCHEME_TAG`. */
+export const POSSESSION_SCHEME_TAG = 0x01;
+/** The shortest nonce accepted, in bytes. Below this a proof is guessable, so it is refused. */
+export const MIN_NONCE_SIZE = 16;
+/** The longest nonce or binding, in bytes — the u16 length prefix's bound. */
+export const MAX_FIELD_SIZE = 0xffff;
+/**
+ * Prove possession of the key behind `seed` to a challenger who supplied `nonce` and
+ * `binding`, in `domain`. Throws on an invalid domain (see `signInDomain`), a nonce
+ * shorter than `MIN_NONCE_SIZE`, an empty binding, or either field over `MAX_FIELD_SIZE`.
+ */
+export function provePossession(seed, domain, nonce, binding) {
+    return signInDomain(seed, domain, possessionMessageBytes(nonce, binding));
+}
+/**
+ * Verify a possession proof: `signature` was made by the key behind `pub` over this
+ * `nonce` and `binding` in `domain`. Total: every shape failure — bad domain, short
+ * nonce, empty binding, wrong-sized key or signature — is `false`.
+ */
+export function verifyPossession(pub, domain, nonce, binding, signature) {
+    let message;
+    try {
+        message = possessionMessageBytes(nonce, binding);
+    }
+    catch {
+        return false;
+    }
+    return verifyInDomain(pub, domain, message, signature);
+}
+/** The pinned layout of what gets signed. Exported so a consumer can pin it too. */
+export function possessionMessageBytes(nonce, binding) {
+    if (nonce.length < MIN_NONCE_SIZE)
+        throw new Error(`nonce is ${nonce.length} bytes, min ${MIN_NONCE_SIZE}`);
+    if (nonce.length > MAX_FIELD_SIZE)
+        throw new Error(`nonce is ${nonce.length} bytes, max ${MAX_FIELD_SIZE}`);
+    if (binding.length === 0)
+        throw new Error("binding is empty — an unbound proof is not a proof");
+    if (binding.length > MAX_FIELD_SIZE)
+        throw new Error(`binding is ${binding.length} bytes, max ${MAX_FIELD_SIZE}`);
+    const out = new Uint8Array(1 + 2 + nonce.length + 2 + binding.length);
+    let at = 0;
+    out[at++] = POSSESSION_SCHEME_TAG;
+    out[at++] = nonce.length >> 8;
+    out[at++] = nonce.length & 0xff;
+    out.set(nonce, at);
+    at += nonce.length;
+    out[at++] = binding.length >> 8;
+    out[at++] = binding.length & 0xff;
+    out.set(binding, at);
+    return out;
+}
+//# sourceMappingURL=possession.js.map

package/dist/src/possession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"possession.js","sourceRoot":"","sources":["../../src/possession.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,0FAA0F;AAC1F,uBAAuB;AACvB,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,iFAAiF;AACjF,sFAAsF;AACtF,4DAA4D;AAC5D,EAAE;AACF,qFAAqF;AACrF,+EAA+E;AAC/E,oFAAoF;AACpF,cAAc;AACd,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEhE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAgB,EAChB,MAAc,EACd,KAAiB,EACjB,OAAmB;IAEnB,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAe,EACf,MAAc,EACd,KAAiB,EACjB,OAAmB,EACnB,SAAqB;IAErB,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,OAAmB;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC;IAClC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/package.json

@@ -0,0 +1,30 @@
+{
+  "name": "@bitspark/archon-sdk",
+  "version": "0.6.1",
+  "description": "archon-sdk: proof of possession and the signed envelope, one layer above the identity floor. Deterministic given its inputs; no RNG, no clock, no socket.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Bitspark/archon"
+  },
+  "type": "module",
+  "main": "dist/src/index.js",
+  "types": "dist/src/index.d.ts",
+  "files": [
+    "dist/src"
+  ],
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "tsc -p tsconfig.json && node --test dist/test/*.test.js"
+  },
+  "dependencies": {
+    "@bitspark/archon": "^0.6.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22",
+    "typescript": "^5.7"
+  }
+}