@bitspark/archon-sdk 0.8.2 → 0.10.0

package/dist/src/enroll.d.ts

@@ -0,0 +1,49 @@
+import { type Signer, type SigningRequest } from "./signer.js";
+/** The RFC 8032 context every enrollment proof is made in. */
+export declare const ENROLL_DOMAIN = "archon-enroll/1";
+/** The first byte of every enrollment binding. */
+export declare const ENROLL_VERSION = 1;
+/** The longest purpose, in bytes. */
+export declare const ENROLL_MAX_PURPOSE_SIZE = 255;
+/** The longest transaction id, in bytes. */
+export declare const ENROLL_MAX_TRANSACTION_SIZE = 255;
+/** The intent digest's length: a SHA-256. */
+export declare const ENROLL_DIGEST_SIZE = 32;
+/** A pending enrollment as the service recorded it. */
+export interface EnrollRequest {
+    /** The server's fresh entropy, at least the possession scheme's 16 bytes. */
+    nonce: Uint8Array;
+    /** The pending transaction's id, 1..=255 bytes, opaque. */
+    transaction: Uint8Array;
+    /** "add-key", "rotate", "recover", …: 1..=255 bytes of UTF-8, no control characters. */
+    purpose: string;
+    /** The public key being enrolled, exactly PUBLIC_KEY_SIZE bytes. */
+    newKey: Uint8Array;
+    /** SHA-256 of the service's immutable intent bytes, exactly ENROLL_DIGEST_SIZE bytes. */
+    intentDigest: Uint8Array;
+}
+/**
+ * The bytes an enrollment proof is bound to, for `req` at `audience`. Throws on a purpose that
+ * is empty, over 255 bytes, not UTF-8 or carrying a control character (U+0000–U+001F, U+007F);
+ * an audience that is empty, not UTF-8 or carrying a control character; a transaction id that
+ * is empty or over 255 bytes; a new key or intent digest of the wrong size; or a binding that
+ * would not fit the possession scheme's u16 field.
+ */
+export declare function enrollBinding(audience: string, req: EnrollRequest): Uint8Array;
+/**
+ * The enrollment proof: possession by the key behind `seed` — which must be `req.newKey` — in
+ * ENROLL_DOMAIN, over `req.nonce` and `enrollBinding(audience, req)`. Throws for what the binding
+ * throws, for a short nonce, for a seed of the wrong size, and for a seed that is not the new
+ * key: only the key being enrolled can prove it holds itself.
+ */
+export declare function proveEnroll(seed: Uint8Array, audience: string, req: EnrollRequest): Uint8Array;
+/** Whether `signature` is the enrollment proof by `req.newKey` for `req` at `audience`. Total. */
+export declare function verifyEnroll(audience: string, req: EnrollRequest, signature: Uint8Array): boolean;
+/**
+ * The signing request the enrollment proof needs (ADR 0009 §4). Pure. The expected key is
+ * `req.newKey`, so only that key's signer can complete it — `proveEnroll`'s refusal of any other
+ * seed, carried into the request itself. Complete it with `completePossession`.
+ */
+export declare function prepareEnroll(audience: string, req: EnrollRequest): SigningRequest;
+/** `proveEnroll` through a signer instead of a seed. A signer for any other key is refused. */
+export declare function proveEnrollWith(signer: Signer, audience: string, req: EnrollRequest, signal?: AbortSignal): Promise<Uint8Array>;

package/dist/src/enroll.js

@@ -0,0 +1,140 @@
+// Key enrollment — THIS NEW KEY BELONGS TO THIS ACCOUNT (ADR 0010 §7; docs/request.md §6,
+// version 1, fixed by ADR 0010's status note of 4 October 2026).
+//
+// Login has a person approve a browser key. Enrollment is a different statement: a NEW key
+// proves its own possession, while a separate authority — a session, or a bootstrap credential
+// — says whose key it becomes. That authority lives in the service's pending transaction
+// record, never in this proof: the service creates the record only after validating the
+// authority, and the verifier rebuilds the binding from that record and its configured
+// audience. A completion request names the transaction and carries the proof, nothing more.
+//
+// The proof is the possession scheme with the server's fresh nonce, in ENROLL_DOMAIN, over
+//
+//   version ‖ u16be(len purpose) ‖ purpose ‖ u16be(len audience) ‖ audience
+//           ‖ u16be(len transaction) ‖ transaction ‖ new_key[32] ‖ intent_digest[32]
+//
+// The intent digest is the service's SHA-256 of its immutable enrollment intent; archon binds
+// the 32 bytes and never reads what they digest. Enrollment shows that an account and a key are
+// associated — not that the key is non-exportable, lives on one device, or is used by one
+// process.
+import { getPublicKey, PUBLIC_KEY_SIZE, SEED_SIZE } from "@bitspark/archon";
+import { completePossession, MAX_FIELD_SIZE as POSSESSION_MAX_FIELD_SIZE, preparePossession, provePossession, verifyPossession, } from "./possession.js";
+import { signWith } from "./signer.js";
+/** The RFC 8032 context every enrollment proof is made in. */
+export const ENROLL_DOMAIN = "archon-enroll/1";
+/** The first byte of every enrollment binding. */
+export const ENROLL_VERSION = 0x01;
+/** The longest purpose, in bytes. */
+export const ENROLL_MAX_PURPOSE_SIZE = 255;
+/** The longest transaction id, in bytes. */
+export const ENROLL_MAX_TRANSACTION_SIZE = 255;
+/** The intent digest's length: a SHA-256. */
+export const ENROLL_DIGEST_SIZE = 32;
+const utf8 = new TextEncoder();
+/**
+ * The bytes an enrollment proof is bound to, for `req` at `audience`. Throws on a purpose that
+ * is empty, over 255 bytes, not UTF-8 or carrying a control character (U+0000–U+001F, U+007F);
+ * an audience that is empty, not UTF-8 or carrying a control character; a transaction id that
+ * is empty or over 255 bytes; a new key or intent digest of the wrong size; or a binding that
+ * would not fit the possession scheme's u16 field.
+ */
+export function enrollBinding(audience, req) {
+    const purpose = checkText("purpose", req.purpose);
+    if (purpose.length > ENROLL_MAX_PURPOSE_SIZE) {
+        throw new Error(`enroll: purpose is ${purpose.length} bytes, want 1..=${ENROLL_MAX_PURPOSE_SIZE}`);
+    }
+    const aud = checkText("audience", audience);
+    if (req.transaction.length === 0 || req.transaction.length > ENROLL_MAX_TRANSACTION_SIZE) {
+        throw new Error(`enroll: transaction is ${req.transaction.length} bytes, want 1..=${ENROLL_MAX_TRANSACTION_SIZE}`);
+    }
+    if (req.newKey.length !== PUBLIC_KEY_SIZE) {
+        throw new Error(`enroll: new key is ${req.newKey.length} bytes, want ${PUBLIC_KEY_SIZE}`);
+    }
+    if (req.intentDigest.length !== ENROLL_DIGEST_SIZE) {
+        throw new Error(`enroll: intent digest is ${req.intentDigest.length} bytes, want ${ENROLL_DIGEST_SIZE}`);
+    }
+    const size = 1 + 2 + purpose.length + 2 + aud.length + 2 + req.transaction.length + PUBLIC_KEY_SIZE + ENROLL_DIGEST_SIZE;
+    if (size > POSSESSION_MAX_FIELD_SIZE) {
+        throw new Error(`enroll: binding is ${size} bytes, over the possession scheme's ${POSSESSION_MAX_FIELD_SIZE}`);
+    }
+    const out = new Uint8Array(size);
+    let at = 0;
+    out[at++] = ENROLL_VERSION;
+    at = putField(out, at, purpose);
+    at = putField(out, at, aud);
+    at = putField(out, at, req.transaction);
+    out.set(req.newKey, at);
+    at += PUBLIC_KEY_SIZE;
+    out.set(req.intentDigest, at);
+    return out;
+}
+/**
+ * The enrollment proof: possession by the key behind `seed` — which must be `req.newKey` — in
+ * ENROLL_DOMAIN, over `req.nonce` and `enrollBinding(audience, req)`. Throws for what the binding
+ * throws, for a short nonce, for a seed of the wrong size, and for a seed that is not the new
+ * key: only the key being enrolled can prove it holds itself.
+ */
+export function proveEnroll(seed, audience, req) {
+    if (seed.length !== SEED_SIZE)
+        throw new Error(`enroll: seed is ${seed.length} bytes, want ${SEED_SIZE}`);
+    const pub = getPublicKey(seed);
+    if (pub.length !== req.newKey.length || !pub.every((b, i) => b === req.newKey[i])) {
+        throw new Error("enroll: seed is not the new key the request names");
+    }
+    return provePossession(seed, ENROLL_DOMAIN, req.nonce, enrollBinding(audience, req));
+}
+/** Whether `signature` is the enrollment proof by `req.newKey` for `req` at `audience`. Total. */
+export function verifyEnroll(audience, req, signature) {
+    let binding;
+    try {
+        binding = enrollBinding(audience, req);
+    }
+    catch {
+        return false;
+    }
+    return verifyPossession(req.newKey, ENROLL_DOMAIN, req.nonce, binding, signature);
+}
+/**
+ * The signing request the enrollment proof needs (ADR 0009 §4). Pure. The expected key is
+ * `req.newKey`, so only that key's signer can complete it — `proveEnroll`'s refusal of any other
+ * seed, carried into the request itself. Complete it with `completePossession`.
+ */
+export function prepareEnroll(audience, req) {
+    return preparePossession(req.newKey, ENROLL_DOMAIN, req.nonce, enrollBinding(audience, req));
+}
+/** `proveEnroll` through a signer instead of a seed. A signer for any other key is refused. */
+export async function proveEnrollWith(signer, audience, req, signal) {
+    const request = prepareEnroll(audience, req);
+    return completePossession(request, await signWith(signer, request, signal));
+}
+/** Throws unless `s` is non-empty, well-formed UTF-8 (no lone surrogate) with no control
+ *  character; returns its UTF-8 bytes. */
+function checkText(what, s) {
+    if (!isWellFormed(s))
+        throw new Error(`enroll: ${what} is not well-formed UTF-16 (a lone surrogate is not UTF-8)`);
+    for (const ch of s) {
+        const cp = ch.codePointAt(0);
+        if (cp < 0x20 || cp === 0x7f) {
+            throw new Error(`enroll: ${what} carries a control character U+${cp.toString(16).toUpperCase().padStart(4, "0")}`);
+        }
+    }
+    const bytes = utf8.encode(s);
+    if (bytes.length === 0 || bytes.length > POSSESSION_MAX_FIELD_SIZE) {
+        throw new Error(`enroll: ${what} is ${bytes.length} bytes, want 1..=${POSSESSION_MAX_FIELD_SIZE}`);
+    }
+    return bytes;
+}
+function isWellFormed(s) {
+    const native = s.isWellFormed;
+    if (typeof native === "function")
+        return native.call(s);
+    return !/[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/.test(s);
+}
+/** Writes u16be(len field) ‖ field at `at`; returns the new offset. */
+function putField(out, at, field) {
+    out[at++] = (field.length >> 8) & 0xff;
+    out[at++] = field.length & 0xff;
+    out.set(field, at);
+    return at + field.length;
+}
+//# sourceMappingURL=enroll.js.map

package/dist/src/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../../src/enroll.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,iEAAiE;AACjE,EAAE;AACF,2FAA2F;AAC3F,+FAA+F;AAC/F,yFAAyF;AACzF,wFAAwF;AACxF,uFAAuF;AACvF,4FAA4F;AAC5F,EAAE;AACF,2FAA2F;AAC3F,EAAE;AACF,4EAA4E;AAC5E,qFAAqF;AACrF,EAAE;AACF,8FAA8F;AAC9F,gGAAgG;AAChG,0FAA0F;AAC1F,WAAW;AACX,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,cAAc,IAAI,yBAAyB,EAC3C,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAoC,MAAM,aAAa,CAAC;AAEzE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAE/C,kDAAkD;AAClD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,qCAAqC;AACrC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAE/C,6CAA6C;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAgBrC,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAkB;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,oBAAoB,uBAAuB,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,WAAW,CAAC,MAAM,oBAAoB,2BAA2B,EAAE,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,CAAC,MAAM,gBAAgB,eAAe,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,YAAY,CAAC,MAAM,gBAAgB,kBAAkB,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,eAAe,GAAG,kBAAkB,CAAC;IACzH,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,wCAAwC,yBAAyB,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,cAAc,CAAC;IAC3B,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChC,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;IACxC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,IAAI,eAAe,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAkB;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IAC1G,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,GAAkB,EAAE,SAAqB;IACtF,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAkB;IAChE,OAAO,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,QAAgB,EAChB,GAAkB,EAClB,MAAoB;IAEpB,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;0CAC0C;AAC1C,SAAS,SAAS,CAAC,IAAY,EAAE,CAAS;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,4DAA4D,CAAC,CAAC;IACnH,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,OAAO,KAAK,CAAC,MAAM,oBAAoB,yBAAyB,EAAE,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAI,CAAiD,CAAC,YAAY,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAU,EAAE,KAAiB;IAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;AAC3B,CAAC"}

package/dist/src/envelope.d.ts

@@ -1,3 +1,4 @@
+import { type Signer, type SigningRequest } from "./signer.js";
 /** The first four bytes of every envelope. */
 export declare const ENVELOPE_MAGIC: Uint8Array<ArrayBuffer>;
 /** The envelope format version. */
@@ -17,6 +18,20 @@ export interface Opened {
  * because of the scheme tag.
  */
 export declare function seal(seed: Uint8Array, domain: string, payload: Uint8Array): Uint8Array;
+/**
+ * The signing request sealing `payload` in `domain` needs, for a signer whose key is
+ * `publicKey` (ADR 0009 §4). Pure; throws on an invalid domain. The message is
+ * `envelopeMessageBytes(payload)`, so an envelope made through it is the same bytes.
+ */
+export declare function prepareSeal(publicKey: Uint8Array, domain: string, payload: Uint8Array): SigningRequest;
+/**
+ * The envelope, from a signature over a prepared seal request: the signature is checked
+ * against the request, then the envelope is assembled from the request's own key, domain and
+ * payload. Pure.
+ */
+export declare function completeSeal(request: SigningRequest, signature: Uint8Array): Uint8Array;
+/** `seal` through a signer instead of a seed. */
+export declare function sealWith(signer: Signer, domain: string, payload: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
 /**
  * Open `envelope`, which the caller expects to be sealed in `domain`. Throws — never
  * returns a payload — when the bytes are not an envelope (magic, version, length), the

package/dist/src/envelope.js

@@ -15,6 +15,7 @@
 // another. The verifier chooses the domain; an envelope never gets to choose it for
 // them. Whether to trust the key it names is, again, the verifier's.
 import { getPublicKey, signInDomain, verifyInDomain, MAX_DOMAIN_SIZE, PUBLIC_KEY_SIZE, SIGNATURE_SIZE, } from "@bitspark/archon";
+import { checkSignature, signWith, validateSigningRequest } from "./signer.js";
 /** The first four bytes of every envelope. */
 export const ENVELOPE_MAGIC = new Uint8Array([0x61, 0x72, 0x63, 0x6e]); // "arcn"
 /** The envelope format version. */
@@ -28,7 +29,41 @@ export const ENVELOPE_SCHEME_TAG = 0x02;
  */
 export function seal(seed, domain, payload) {
     const signature = signInDomain(seed, domain, envelopeMessageBytes(payload));
-    const pubkey = getPublicKey(seed);
+    return pack(domain, getPublicKey(seed), signature, payload);
+}
+/**
+ * The signing request sealing `payload` in `domain` needs, for a signer whose key is
+ * `publicKey` (ADR 0009 §4). Pure; throws on an invalid domain. The message is
+ * `envelopeMessageBytes(payload)`, so an envelope made through it is the same bytes.
+ */
+export function prepareSeal(publicKey, domain, payload) {
+    const request = {
+        expectedPublicKey: publicKey,
+        scheme: { kind: "ed25519ph-context", domain },
+        message: envelopeMessageBytes(payload),
+    };
+    validateSigningRequest(request);
+    return request;
+}
+/**
+ * The envelope, from a signature over a prepared seal request: the signature is checked
+ * against the request, then the envelope is assembled from the request's own key, domain and
+ * payload. Pure.
+ */
+export function completeSeal(request, signature) {
+    if (request.scheme.kind !== "ed25519ph-context" || request.message[0] !== ENVELOPE_SCHEME_TAG) {
+        throw new Error("not a seal request");
+    }
+    checkSignature(request, signature);
+    return pack(request.scheme.domain, request.expectedPublicKey, signature, request.message.subarray(1));
+}
+/** `seal` through a signer instead of a seed. */
+export async function sealWith(signer, domain, payload, signal) {
+    const request = prepareSeal(signer.publicKey, domain, payload);
+    return completeSeal(request, await signWith(signer, request, signal));
+}
+/** The container layout, from parts already checked: the domain fits a u8 (≤ 255 bytes). */
+function pack(domain, pubkey, signature, payload) {
     const d = new TextEncoder().encode(domain);
     const out = new Uint8Array(4 + 1 + 1 + d.length + PUBLIC_KEY_SIZE + SIGNATURE_SIZE + payload.length);
     let at = 0;

package/dist/src/envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/envelope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,wFAAwF;AACxF,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;AACjF,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAUxC;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,IAAgB,EAAE,MAAc,EAAE,OAAmB;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,eAAe,GAAG,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5B,EAAE,IAAI,CAAC,CAAC;IACR,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC;IAC7B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,6CAA6C;IACnE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpB,EAAE,IAAI,eAAe,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvB,EAAE,IAAI,cAAc,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,QAAoB,EAAE,MAAc;IACvD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,IAAI,GAAG,CAAC,CAAS,EAAc,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,EAAE,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,eAAe,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/envelope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,mFAAmF;AACnF,EAAE;AACF,sFAAsF;AACtF,mFAAmF;AACnF,mFAAmF;AACnF,wFAAwF;AACxF,wFAAwF;AACxF,0BAA0B;AAC1B,EAAE;AACF,mFAAmF;AACnF,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,eAAe,EACf,eAAe,EACf,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,sBAAsB,EAAoC,MAAM,aAAa,CAAC;AAEjH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;AACjF,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,kGAAkG;AAClG,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAUxC;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,IAAgB,EAAE,MAAc,EAAE,OAAmB;IACxE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,SAAqB,EAAE,MAAc,EAAE,OAAmB;IACpF,MAAM,OAAO,GAAmB;QAC9B,iBAAiB,EAAE,SAAS;QAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE;QAC7C,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC;KACvC,CAAC;IACF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,SAAqB;IACzE,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,MAAc,EACd,OAAmB,EACnB,MAAoB;IAEpB,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,YAAY,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,4FAA4F;AAC5F,SAAS,IAAI,CAAC,MAAc,EAAE,MAAkB,EAAE,SAAqB,EAAE,OAAmB;IAC1F,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,eAAe,GAAG,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrG,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IAC5B,EAAE,IAAI,CAAC,CAAC;IACR,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,gBAAgB,CAAC;IAC7B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,6CAA6C;IACnE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpB,EAAE,IAAI,eAAe,CAAC;IACtB,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACvB,EAAE,IAAI,cAAc,CAAC;IACrB,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,IAAI,CAAC,QAAoB,EAAE,MAAc;IACvD,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,MAAM,IAAI,GAAG,CAAC,CAAS,EAAc,EAAE;QACrC,IAAI,EAAE,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,EAAE,IAAI,CAAC,CAAC;QACR,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACnG,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,gBAAgB;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,IAAI,IAAI,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,eAAe,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAmB;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC;IAC7B,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/index.d.ts

@@ -1,4 +1,7 @@
+export * from "./signer.js";
 export * from "./possession.js";
 export * from "./envelope.js";
 export * from "./login.js";
 export * from "./login-audience.js";
+export * from "./enroll.js";
+export * from "./request.js";

package/dist/src/index.js

@@ -7,13 +7,20 @@
 //   binding is what makes it a proof, so an empty one is refused.
 // - envelope — these bytes, signed by this key, in this domain. JWS, never JWT.
 //
+// Each signing helper takes a seed, or — through its prepare / complete pair and its `…With`
+// form — a Signer (ADR 0009 §4): signing capability rather than the key, for keys that do not
+// live in this process.
+//
 // The rule that keeps this layer honest: entropy, time and channel binding are
 // ARGUMENTS. This package never sources them. That is what lets every byte it emits be a
 // deterministic function of its inputs and be pinned by vectors/sdk.json across three
 // languages — the same way the floor is pinned. Connection setup is not here and never
 // will be: that is the transport's (ADR 0004).
+export * from "./signer.js";
 export * from "./possession.js";
 export * from "./envelope.js";
 export * from "./login.js";
 export * from "./login-audience.js";
+export * from "./enroll.js";
+export * from "./request.js";
 //# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,uFAAuF;AACvF,wEAAwE;AACxE,EAAE;AACF,qFAAqF;AACrF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,yFAAyF;AACzF,sFAAsF;AACtF,uFAAuF;AACvF,+CAA+C;AAC/C,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,EAAE;AACF,uFAAuF;AACvF,wEAAwE;AACxE,EAAE;AACF,qFAAqF;AACrF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,6FAA6F;AAC7F,8FAA8F;AAC9F,wBAAwB;AACxB,EAAE;AACF,+EAA+E;AAC/E,yFAAyF;AACzF,sFAAsF;AACtF,uFAAuF;AACvF,+CAA+C;AAC/C,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,cAAc,qBAAqB,CAAC;AACpC,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}

package/dist/src/login.d.ts

@@ -1,3 +1,4 @@
+import { type Signer, type SigningRequest } from "./signer.js";
 /** The RFC 8032 context every login-scheme proof is made in. */
 export declare const LOGIN_DOMAIN = "archon-login/1";
 /** The binding's first byte for the person's proof (made by P). */
@@ -59,5 +60,21 @@ export declare function verifyLogin(pub: Uint8Array, audience: string, req: Logi
  * `req.browser` throws: the proof is only meaningful from the key the request names.
  */
 export declare function proveCollect(seed: Uint8Array, audience: string, req: LoginRequest): Uint8Array;
+/**
+ * The signing request the person's login proof needs, for a signer whose key is `publicKey`
+ * (ADR 0009 §4). Pure; throws for what `proveLogin` throws about the request. Complete it
+ * with `completePossession`: a login proof is a possession proof.
+ */
+export declare function prepareLogin(publicKey: Uint8Array, audience: string, req: LoginRequest): SigningRequest;
+/** `proveLogin` through a signer instead of a seed. */
+export declare function proveLoginWith(signer: Signer, audience: string, req: LoginRequest, signal?: AbortSignal): Promise<Uint8Array>;
+/**
+ * The signing request the browser's collect proof needs. Pure. The expected key is the
+ * browser key `req` names, so only that key's signer can complete it — `proveCollect`'s
+ * refusal of any other seed, carried into the request itself.
+ */
+export declare function prepareCollect(audience: string, req: LoginRequest): SigningRequest;
+/** `proveCollect` through a signer instead of a seed. A signer for any other key is refused. */
+export declare function proveCollectWith(signer: Signer, audience: string, req: LoginRequest, signal?: AbortSignal): Promise<Uint8Array>;
 /** Whether `signature` is the collect proof by `req.browser` for `req` at `audience`. Total. */
 export declare function verifyCollect(audience: string, req: LoginRequest, signature: Uint8Array): boolean;

package/dist/src/login.js

@@ -17,7 +17,8 @@
 // the collect proof (0x02) is made by K when the browser collects the answer, so a bystander
 // who saw the request id cannot consume the login.
 import { getPublicKey, PUBLIC_KEY_SIZE, SEED_SIZE } from "@bitspark/archon";
-import { MAX_FIELD_SIZE as POSSESSION_MAX_FIELD_SIZE, provePossession, verifyPossession } from "./possession.js";
+import { completePossession, MAX_FIELD_SIZE as POSSESSION_MAX_FIELD_SIZE, preparePossession, provePossession, verifyPossession, } from "./possession.js";
+import { signWith } from "./signer.js";
 /** The RFC 8032 context every login-scheme proof is made in. */
 export const LOGIN_DOMAIN = "archon-login/1";
 /** The binding's first byte for the person's proof (made by P). */
@@ -123,6 +124,32 @@ export function proveCollect(seed, audience, req) {
     }
     return provePossession(seed, LOGIN_DOMAIN, req.nonce, loginBinding(LOGIN_ROLE_COLLECT, audience, req));
 }
+/**
+ * The signing request the person's login proof needs, for a signer whose key is `publicKey`
+ * (ADR 0009 §4). Pure; throws for what `proveLogin` throws about the request. Complete it
+ * with `completePossession`: a login proof is a possession proof.
+ */
+export function prepareLogin(publicKey, audience, req) {
+    return preparePossession(publicKey, LOGIN_DOMAIN, req.nonce, loginBinding(LOGIN_ROLE_LOGIN, audience, req));
+}
+/** `proveLogin` through a signer instead of a seed. */
+export async function proveLoginWith(signer, audience, req, signal) {
+    const request = prepareLogin(signer.publicKey, audience, req);
+    return completePossession(request, await signWith(signer, request, signal));
+}
+/**
+ * The signing request the browser's collect proof needs. Pure. The expected key is the
+ * browser key `req` names, so only that key's signer can complete it — `proveCollect`'s
+ * refusal of any other seed, carried into the request itself.
+ */
+export function prepareCollect(audience, req) {
+    return preparePossession(req.browser, LOGIN_DOMAIN, req.nonce, loginBinding(LOGIN_ROLE_COLLECT, audience, req));
+}
+/** `proveCollect` through a signer instead of a seed. A signer for any other key is refused. */
+export async function proveCollectWith(signer, audience, req, signal) {
+    const request = prepareCollect(audience, req);
+    return completePossession(request, await signWith(signer, request, signal));
+}
 /** Whether `signature` is the collect proof by `req.browser` for `req` at `audience`. Total. */
 export function verifyCollect(audience, req, signature) {
     let binding;

package/dist/src/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/login.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,4FAA4F;AAC5F,mCAAmC;AACnC,EAAE;AACF,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,6FAA6F;AAC7F,uDAAuD;AACvD,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EAAE,cAAc,IAAI,yBAAyB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEjH,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAoB3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAiB;IAC5E,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,CAAC,MAAM,gBAAgB,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,gCAAgC,oBAAoB,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,QAAQ,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wCAAwC,yBAAyB,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACjB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzB,EAAE,IAAI,eAAe,CAAC;IACtB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACrG,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACtF,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,CAAS;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,4DAA4D,CAAC,CAAC;IAClH,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAI,CAAiD,CAAC,YAAY,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAU,EAAE,KAAiB;IAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/login.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,6FAA6F;AAC7F,6FAA6F;AAC7F,yFAAyF;AACzF,yFAAyF;AACzF,4FAA4F;AAC5F,mCAAmC;AACnC,EAAE;AACF,2FAA2F;AAC3F,6FAA6F;AAC7F,4FAA4F;AAC5F,6FAA6F;AAC7F,uDAAuD;AACvD,EAAE;AACF,8FAA8F;AAC9F,6FAA6F;AAC7F,mDAAmD;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE5E,OAAO,EACL,kBAAkB,EAClB,cAAc,IAAI,yBAAyB,EAC3C,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,QAAQ,EAAoC,MAAM,aAAa,CAAC;AAEzE,gEAAgE;AAChE,MAAM,CAAC,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE7C,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAErC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAoB3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAiB;IAC5E,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,OAAO,CAAC,MAAM,gBAAgB,eAAe,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,MAAM,gCAAgC,oBAAoB,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,UAAU,EAAE,CAAC;QACrF,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,CAAC,QAAQ,qCAAqC,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,IAAI,GAAG,yBAAyB,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,wCAAwC,yBAAyB,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC;IACjB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACzB,EAAE,IAAI,eAAe,CAAC;IACtB,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC;IACzC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC;IACxC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;IAChC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACvG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAe,EAAE,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACrG,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,QAAgB,EAAE,GAAiB;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IACzG,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,SAAqB,EAAE,QAAgB,EAAE,GAAiB;IACrF,OAAO,iBAAiB,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED,uDAAuD;AACvD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,QAAgB,EAChB,GAAiB,EACjB,MAAoB;IAEpB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,GAAiB;IAChE,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAc,EACd,QAAgB,EAChB,GAAiB,EACjB,MAAoB;IAEpB,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC9C,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,GAAiB,EAAE,SAAqB;IACtF,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,kBAAkB,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACpF,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,CAAS;IACxC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,4DAA4D,CAAC,CAAC;IAClH,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,IAAI,EAAE,GAAG,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,kCAAkC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,OAAO,KAAK,CAAC,MAAM,oBAAoB,oBAAoB,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAI,CAAiD,CAAC,YAAY,CAAC;IAC/E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,CAAC,wEAAwE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,GAAe,EAAE,EAAU,EAAE,KAAiB;IAC9D,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IACvC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;AAC3B,CAAC"}

package/dist/src/possession.d.ts

@@ -1,3 +1,4 @@
+import { type Signer, type SigningRequest } from "./signer.js";
 /** The first byte of every possession message. Distinct from the envelope's `SCHEME_TAG`. */
 export declare const POSSESSION_SCHEME_TAG = 1;
 /** The shortest nonce accepted, in bytes. Below this a proof is guessable, so it is refused. */
@@ -16,5 +17,15 @@ export declare function provePossession(seed: Uint8Array, domain: string, nonce:
  * nonce, empty binding, wrong-sized key or signature — is `false`.
  */
 export declare function verifyPossession(pub: Uint8Array, domain: string, nonce: Uint8Array, binding: Uint8Array, signature: Uint8Array): boolean;
+/**
+ * The signing request a possession proof needs, for a signer whose key is `publicKey`
+ * (ADR 0009 §4). Pure, and throws for what `provePossession` throws. The message is
+ * `possessionMessageBytes(nonce, binding)`, so a proof made through it is the same bytes.
+ */
+export declare function preparePossession(publicKey: Uint8Array, domain: string, nonce: Uint8Array, binding: Uint8Array): SigningRequest;
+/** The proof, from a signature over a prepared request: checked, then returned. Pure. */
+export declare function completePossession(request: SigningRequest, signature: Uint8Array): Uint8Array;
+/** `provePossession` through a signer instead of a seed. */
+export declare function provePossessionWith(signer: Signer, domain: string, nonce: Uint8Array, binding: Uint8Array, signal?: AbortSignal): Promise<Uint8Array>;
 /** The pinned layout of what gets signed. Exported so a consumer can pin it too. */
 export declare function possessionMessageBytes(nonce: Uint8Array, binding: Uint8Array): Uint8Array;

package/dist/src/possession.js

@@ -17,6 +17,7 @@
 // possession message and an envelope payload in the same domain from ever being the
 // same bytes.
 import { signInDomain, verifyInDomain } from "@bitspark/archon";
+import { checkSignature, signWith, validateSigningRequest } from "./signer.js";
 /** The first byte of every possession message. Distinct from the envelope's `SCHEME_TAG`. */
 export const POSSESSION_SCHEME_TAG = 0x01;
 /** The shortest nonce accepted, in bytes. Below this a proof is guessable, so it is refused. */
@@ -46,6 +47,30 @@ export function verifyPossession(pub, domain, nonce, binding, signature) {
     }
     return verifyInDomain(pub, domain, message, signature);
 }
+/**
+ * The signing request a possession proof needs, for a signer whose key is `publicKey`
+ * (ADR 0009 §4). Pure, and throws for what `provePossession` throws. The message is
+ * `possessionMessageBytes(nonce, binding)`, so a proof made through it is the same bytes.
+ */
+export function preparePossession(publicKey, domain, nonce, binding) {
+    const request = {
+        expectedPublicKey: publicKey,
+        scheme: { kind: "ed25519ph-context", domain },
+        message: possessionMessageBytes(nonce, binding),
+    };
+    validateSigningRequest(request);
+    return request;
+}
+/** The proof, from a signature over a prepared request: checked, then returned. Pure. */
+export function completePossession(request, signature) {
+    checkSignature(request, signature);
+    return new Uint8Array(signature);
+}
+/** `provePossession` through a signer instead of a seed. */
+export async function provePossessionWith(signer, domain, nonce, binding, signal) {
+    const request = preparePossession(signer.publicKey, domain, nonce, binding);
+    return completePossession(request, await signWith(signer, request, signal));
+}
 /** The pinned layout of what gets signed. Exported so a consumer can pin it too. */
 export function possessionMessageBytes(nonce, binding) {
     if (nonce.length < MIN_NONCE_SIZE)

package/dist/src/possession.js.map

@@ -1 +1 @@
-{"version":3,"file":"possession.js","sourceRoot":"","sources":["../../src/possession.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,0FAA0F;AAC1F,uBAAuB;AACvB,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,iFAAiF;AACjF,sFAAsF;AACtF,4DAA4D;AAC5D,EAAE;AACF,qFAAqF;AACrF,+EAA+E;AAC/E,oFAAoF;AACpF,cAAc;AACd,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEhE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAgB,EAChB,MAAc,EACd,KAAiB,EACjB,OAAmB;IAEnB,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAe,EACf,MAAc,EACd,KAAiB,EACjB,OAAmB,EACnB,SAAqB;IAErB,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,OAAmB;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC;IAClC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"possession.js","sourceRoot":"","sources":["../../src/possession.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kFAAkF;AAClF,oFAAoF;AACpF,uFAAuF;AACvF,0FAA0F;AAC1F,uBAAuB;AACvB,EAAE;AACF,yFAAyF;AACzF,uFAAuF;AACvF,iFAAiF;AACjF,sFAAsF;AACtF,4DAA4D;AAC5D,EAAE;AACF,qFAAqF;AACrF,+EAA+E;AAC/E,oFAAoF;AACpF,cAAc;AACd,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,sBAAsB,EAAoC,MAAM,aAAa,CAAC;AAEjH,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,gGAAgG;AAChG,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAgB,EAChB,MAAc,EACd,KAAiB,EACjB,OAAmB;IAEnB,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAe,EACf,MAAc,EACd,KAAiB,EACjB,OAAmB,EACnB,SAAqB;IAErB,IAAI,OAAmB,CAAC;IACxB,IAAI,CAAC;QACH,OAAO,GAAG,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAqB,EACrB,MAAc,EACd,KAAiB,EACjB,OAAmB;IAEnB,MAAM,OAAO,GAAmB;QAC9B,iBAAiB,EAAE,SAAS;QAC5B,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE;QAC7C,OAAO,EAAE,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;KAChD,CAAC;IACF,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,OAAuB,EAAE,SAAqB;IAC/E,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAc,EACd,KAAiB,EACjB,OAAmB,EACnB,MAAoB;IAEpB,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5E,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,OAAmB;IAC3E,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAC5G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,MAAM,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,CAAC,MAAM,eAAe,cAAc,EAAE,CAAC,CAAC;IAClH,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC;IAClC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAC9B,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACnB,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAChC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAClC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/request.d.ts

@@ -0,0 +1,95 @@
+import { type Signer, type SigningRequest } from "./signer.js";
+/** The RFC 8032 context every request signature is made in. */
+export declare const REQUEST_DOMAIN = "archon-request/1";
+/** The `tag` signature parameter; a verifier accepts only this. */
+export declare const REQUEST_TAG = "archon-request/1";
+/** The one dictionary member in Signature-Input and Signature. */
+export declare const REQUEST_LABEL = "archon";
+/** The nonce's least and greatest size, in bytes. */
+export declare const REQUEST_MIN_NONCE_SIZE = 16;
+export declare const REQUEST_MAX_NONCE_SIZE = 64;
+/** The longest request-target, and the longest covered value, in bytes. */
+export declare const REQUEST_MAX_TARGET_SIZE = 8192;
+export declare const REQUEST_MAX_VALUE_SIZE = 8192;
+/** The largest integer the profile spells: 15 digits. */
+export declare const REQUEST_MAX_INT = 999999999999999;
+/** What a client signs. `declared` holds the product-declared headers the request carries, in
+ *  the product's declared order, names in lowercase. */
+export interface RequestToSign {
+    method: string;
+    audience: string;
+    requestTarget: string;
+    body: Uint8Array;
+    contentType?: string | undefined;
+    declared: ReadonlyArray<readonly [string, string]>;
+    created: number;
+    expires: number;
+    nonce: Uint8Array;
+}
+/** The four headers archon adds to a request, named in lowercase. */
+export interface RequestHeaders {
+    "archon-audience": string;
+    "content-digest": string;
+    "signature-input": string;
+    signature: string;
+}
+/** A request prepared for a signer: the base it will sign, and the signing request. */
+export interface PreparedRequest {
+    base: string;
+    signing: SigningRequest;
+    headers: Omit<RequestHeaders, "signature">;
+}
+/** What a verifier is configured with. */
+export interface RequestPolicy {
+    audience: string;
+    declared: readonly string[];
+    /** W: the longest acceptable `expires − created`, in seconds. */
+    maxLifetime: number;
+    /** δ: the clock tolerance, in seconds. */
+    skew: number;
+}
+/** A request as the server received it: the method, the raw request-target, every header field
+ *  in the order received (names in any case), and the body after transfer framing. */
+export interface ReceivedRequest {
+    method: string;
+    requestTarget: string;
+    headers: ReadonlyArray<readonly [string, string]>;
+    body: Uint8Array;
+}
+/** A proof that checked out under the policy at `now`. Not yet replay-checked. */
+export interface VerifiedRequest {
+    principal: Uint8Array;
+    keyText: string;
+    created: number;
+    expires: number;
+    nonce: Uint8Array;
+    method: string;
+    targetUri: string;
+    /** Every covered field, in coverage order, with the value that was verified. */
+    covered: Array<[string, string]>;
+    contentDigest: Uint8Array;
+}
+/** The origin of an audience, or a throw: docs/request.md §3.1. */
+export declare function requestOrigin(audience: string): string;
+/** The RFC 9421 signature base: one `"<name>": <value>` line per covered component, then
+ *  `"@signature-params": <inner list>` with no trailing line feed (docs/request.md §4). */
+export declare function requestSignatureBase(components: ReadonlyArray<readonly [string, string]>, innerList: string): string;
+/** The base and headers for `input`, for a signer whose key is `publicKey`. Pure; throws on any
+ *  value outside docs/request.md §3.1. */
+export declare function prepareRequest(publicKey: Uint8Array, input: RequestToSign): PreparedRequest;
+/** The headers, from a signature over a prepared request: checked against it first. Pure. */
+export declare function completeRequest(prepared: PreparedRequest, signature: Uint8Array): RequestHeaders;
+/** Sign `input` with the key behind `seed`: the base, and the four headers to send. */
+export declare function signRequest(seed: Uint8Array, input: RequestToSign): {
+    base: string;
+    headers: RequestHeaders;
+};
+/** `signRequest` through a signer instead of a seed. */
+export declare function signRequestWith(signer: Signer, input: RequestToSign, signal?: AbortSignal): Promise<RequestHeaders>;
+/**
+ * Verify `received` under `policy` at `now` (seconds since the epoch): docs/request.md §7 steps
+ * 1–7. Throws on any refusal; returns what was verified. It does not check replay: a server
+ * adapter must insert (REQUEST_TAG, audience, principal, nonce) into its replay store before the
+ * request reaches an application.
+ */
+export declare function verifyRequest(policy: RequestPolicy, now: number, received: ReceivedRequest): VerifiedRequest;

package/dist/src/request.js

@@ -0,0 +1,305 @@
+// Request authentication — THIS KEY MADE THIS HTTP REQUEST (ADR 0010 §2–§6; docs/request.md
+// §3–§5 and §7, version 1, fixed by ADR 0010's status note of 4 October 2026).
+//
+// archon's RFC 9421 application profile: the client signs the RFC 9421 signature base directly,
+// in domain REQUEST_DOMAIN, with archon's construction (Ed25519ph with the domain as the RFC 8032
+// context), and `alg` is never sent — the registered `ed25519` is pure Ed25519. The coverage is
+// fixed: the method, the full target URI, the configured audience as a CHECKED ECHO, a SHA-256
+// Content-Digest, Content-Type if present, and every product-declared header the request carries.
+//
+// This file is the sdk's part (ADR 0010 §1): the transcript, the strict parsing, the coverage
+// rule and pure verification. Time is an argument, as everywhere in this package. What it does
+// NOT do is remember: one-use enforcement (the replay store) and the HTTP extraction belong to the
+// server adapters, so a VerifiedRequest is a proof that checked out, not yet a request that may
+// reach an application.
+import { sha256 } from "@noble/hashes/sha2.js";
+import { decodeKey, encodeKey, getPublicKey, signInDomain, verifyInDomain, PUBLIC_KEY_SIZE } from "@bitspark/archon";
+import { checkSignature, signWith } from "./signer.js";
+/** The RFC 8032 context every request signature is made in. */
+export const REQUEST_DOMAIN = "archon-request/1";
+/** The `tag` signature parameter; a verifier accepts only this. */
+export const REQUEST_TAG = "archon-request/1";
+/** The one dictionary member in Signature-Input and Signature. */
+export const REQUEST_LABEL = "archon";
+/** The nonce's least and greatest size, in bytes. */
+export const REQUEST_MIN_NONCE_SIZE = 16;
+export const REQUEST_MAX_NONCE_SIZE = 64;
+/** The longest request-target, and the longest covered value, in bytes. */
+export const REQUEST_MAX_TARGET_SIZE = 8192;
+export const REQUEST_MAX_VALUE_SIZE = 8192;
+/** The largest integer the profile spells: 15 digits. */
+export const REQUEST_MAX_INT = 999_999_999_999_999;
+const utf8 = new TextEncoder();
+const TCHAR = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+const VISIBLE = /^[\x21-\x7e]+$/;
+const RESERVED = new Set(["archon-audience", "content-digest", "content-type", "signature-input", "signature"]);
+/** The origin of an audience, or a throw: docs/request.md §3.1. */
+export function requestOrigin(audience) {
+    if (!VISIBLE.test(audience))
+        throw new Error("request: the audience is not visible ASCII");
+    const m = /^(https?:\/\/)([^/]*)(\/.*)?$/.exec(audience);
+    if (m === null)
+        throw new Error("request: the audience is not an http or https URL");
+    const authority = m[2];
+    if (authority === "" || authority.includes("@"))
+        throw new Error("request: the audience's authority is empty or carries userinfo");
+    if (/[?#]/.test(audience))
+        throw new Error("request: the audience carries a query or a fragment");
+    if (audience.endsWith("/"))
+        throw new Error("request: the audience ends in /");
+    return m[1] + authority;
+}
+function checkMethod(method) {
+    if (!TCHAR.test(method))
+        throw new Error("request: the method is not a token");
+}
+function checkTarget(target) {
+    if (target.length === 0 || target.length > REQUEST_MAX_TARGET_SIZE)
+        throw new Error("request: the request-target's length");
+    if (!target.startsWith("/") || !VISIBLE.test(target) || target.includes("#")) {
+        throw new Error("request: the request-target is not origin form");
+    }
+}
+/** A covered value, trimmed of leading and trailing SP and HTAB, or a throw. */
+function coveredValue(value) {
+    const v = value.replace(/^[ \t]+|[ \t]+$/g, "");
+    if (v.length === 0 || v.length > REQUEST_MAX_VALUE_SIZE || !/^[\t\x20-\x7e]+$/.test(v)) {
+        throw new Error("request: a covered value is empty, too long, or not visible ASCII, SP and HTAB");
+    }
+    return v;
+}
+function checkDeclaredName(name) {
+    if (!/^[a-z0-9-]+$/.test(name) || RESERVED.has(name))
+        throw new Error(`request: ${JSON.stringify(name)} cannot be a declared header`);
+}
+function checkInt(n, what) {
+    if (!Number.isInteger(n) || n < 0 || n > REQUEST_MAX_INT)
+        throw new Error(`request: ${what} is not an integer in 0..=${REQUEST_MAX_INT}`);
+}
+function checkNonce(nonce) {
+    if (nonce.length < REQUEST_MIN_NONCE_SIZE || nonce.length > REQUEST_MAX_NONCE_SIZE) {
+        throw new Error(`request: the nonce is ${nonce.length} bytes, want ${REQUEST_MIN_NONCE_SIZE}..=${REQUEST_MAX_NONCE_SIZE}`);
+    }
+}
+/** The RFC 9421 signature base: one `"<name>": <value>` line per covered component, then
+ *  `"@signature-params": <inner list>` with no trailing line feed (docs/request.md §4). */
+export function requestSignatureBase(components, innerList) {
+    return components.map(([n, v]) => `"${n}": ${v}\n`).join("") + `"@signature-params": ${innerList}`;
+}
+function contentDigestHeader(body) {
+    return `sha-256=:${b64Encode(sha256(body), B64, true)}:`;
+}
+/** The base and headers for `input`, for a signer whose key is `publicKey`. Pure; throws on any
+ *  value outside docs/request.md §3.1. */
+export function prepareRequest(publicKey, input) {
+    if (publicKey.length !== PUBLIC_KEY_SIZE)
+        throw new Error("request: the public key is not 32 bytes");
+    checkMethod(input.method);
+    const origin = requestOrigin(input.audience);
+    checkTarget(input.requestTarget);
+    checkInt(input.created, "created");
+    checkInt(input.expires, "expires");
+    if (input.created >= input.expires)
+        throw new Error("request: created must be before expires");
+    checkNonce(input.nonce);
+    const digest = contentDigestHeader(input.body);
+    const components = [
+        ["@method", input.method],
+        ["@target-uri", origin + input.requestTarget],
+        ["archon-audience", input.audience],
+        ["content-digest", digest],
+    ];
+    if (input.contentType !== undefined)
+        components.push(["content-type", coveredValue(input.contentType)]);
+    const seen = new Set();
+    for (const [name, value] of input.declared) {
+        checkDeclaredName(name);
+        if (seen.has(name))
+            throw new Error(`request: ${name} is declared twice`);
+        seen.add(name);
+        components.push([name, coveredValue(value)]);
+    }
+    const keyText = encodeKey(publicKey);
+    const inner = `(${components.map(([n]) => `"${n}"`).join(" ")});created=${input.created};expires=${input.expires}` +
+        `;nonce="${b64Encode(input.nonce, B64URL, false)}";keyid="${keyText}";tag="${REQUEST_TAG}"`;
+    const base = requestSignatureBase(components, inner);
+    return {
+        base,
+        signing: { expectedPublicKey: publicKey, scheme: { kind: "ed25519ph-context", domain: REQUEST_DOMAIN }, message: utf8.encode(base) },
+        headers: { "archon-audience": input.audience, "content-digest": digest, "signature-input": `${REQUEST_LABEL}=${inner}` },
+    };
+}
+/** The headers, from a signature over a prepared request: checked against it first. Pure. */
+export function completeRequest(prepared, signature) {
+    checkSignature(prepared.signing, signature);
+    return { ...prepared.headers, signature: `${REQUEST_LABEL}=:${b64Encode(signature, B64, true)}:` };
+}
+/** Sign `input` with the key behind `seed`: the base, and the four headers to send. */
+export function signRequest(seed, input) {
+    const prepared = prepareRequest(getPublicKey(seed), input);
+    const signature = signInDomain(seed, REQUEST_DOMAIN, prepared.signing.message);
+    return { base: prepared.base, headers: completeRequest(prepared, signature) };
+}
+/** `signRequest` through a signer instead of a seed. */
+export async function signRequestWith(signer, input, signal) {
+    const prepared = prepareRequest(signer.publicKey, input);
+    return completeRequest(prepared, await signWith(signer, prepared.signing, signal));
+}
+const SIGNATURE_INPUT = /^archon=\(("[^"]*"(?: "[^"]*")*)\);created=(0|[1-9][0-9]{0,14});expires=(0|[1-9][0-9]{0,14});nonce="([A-Za-z0-9_-]+)";keyid="([^"\\]*)";tag="archon-request\/1"$/;
+const SIGNATURE = /^archon=:([A-Za-z0-9+/=]+):$/;
+const CONTENT_DIGEST = /^sha-256=:([A-Za-z0-9+/=]+):$/;
+/**
+ * Verify `received` under `policy` at `now` (seconds since the epoch): docs/request.md §7 steps
+ * 1–7. Throws on any refusal; returns what was verified. It does not check replay: a server
+ * adapter must insert (REQUEST_TAG, audience, principal, nonce) into its replay store before the
+ * request reaches an application.
+ */
+export function verifyRequest(policy, now, received) {
+    const origin = requestOrigin(policy.audience);
+    const declared = new Set();
+    for (const d of policy.declared) {
+        checkDeclaredName(d);
+        if (declared.has(d))
+            throw new Error(`request: ${d} is declared twice`);
+        declared.add(d);
+    }
+    checkInt(policy.maxLifetime, "max_lifetime");
+    if (policy.maxLifetime < 1)
+        throw new Error("request: max_lifetime must be at least 1");
+    checkInt(policy.skew, "skew");
+    checkInt(now, "now");
+    const fields = new Map();
+    for (const [name, value] of received.headers) {
+        // ASCII case folding only: HTTP field names are tokens, and Unicode folding would turn
+        // U+212A KELVIN SIGN into `k` — a different header in a lane that folds ASCII only.
+        const key = name.replace(/[A-Z]/g, (ch) => ch.toLowerCase());
+        const list = fields.get(key) ?? [];
+        list.push(value.replace(/^[ \t]+|[ \t]+$/g, ""));
+        fields.set(key, list);
+    }
+    const once = (name) => {
+        const list = fields.get(name);
+        if (list === undefined || list.length !== 1)
+            throw new Error(`request: ${name} must appear exactly once`);
+        return list[0];
+    };
+    // 1. The two proof fields parse, in their one spelling.
+    const si = SIGNATURE_INPUT.exec(once("signature-input"));
+    if (si === null)
+        throw new Error("request: Signature-Input is not the profile's spelling");
+    const sigText = SIGNATURE.exec(once("signature"));
+    if (sigText === null)
+        throw new Error("request: Signature is not the profile's spelling");
+    const signature = b64Decode(sigText[1], B64, true);
+    if (signature.length !== 64)
+        throw new Error("request: the signature is not 64 bytes");
+    const names = si[1].split(" ").map((q) => q.slice(1, -1));
+    const created = Number(si[2]);
+    const expires = Number(si[3]);
+    const nonce = b64Decode(si[4], B64URL, false);
+    checkNonce(nonce);
+    // 2. keyid is a canonical principal (the tag was matched by the grammar).
+    const keyText = si[5];
+    let principal;
+    try {
+        principal = decodeKey(keyText);
+    }
+    catch {
+        throw new Error("request: keyid is not a principal");
+    }
+    if (encodeKey(principal) !== keyText)
+        throw new Error("request: keyid is not the canonical key text");
+    // 3. The coverage is exactly §3.1's, for what this request carries.
+    const expected = ["@method", "@target-uri", "archon-audience", "content-digest"];
+    if (fields.has("content-type"))
+        expected.push("content-type");
+    for (const d of policy.declared)
+        if (fields.has(d))
+            expected.push(d);
+    if (names.length !== expected.length || names.some((n, i) => n !== expected[i])) {
+        throw new Error("request: the coverage is not the profile's for this request");
+    }
+    checkMethod(received.method);
+    checkTarget(received.requestTarget);
+    const components = [];
+    for (const n of names) {
+        if (n === "@method")
+            components.push([n, received.method]);
+        else if (n === "@target-uri")
+            components.push([n, origin + received.requestTarget]);
+        else
+            components.push([n, coveredValue(once(n))]);
+    }
+    // 4. The audience echo is the configured audience, byte for byte.
+    if (once("archon-audience") !== policy.audience)
+        throw new Error("request: Archon-Audience is not the configured audience");
+    // 5. The digest is the received content's.
+    const cd = CONTENT_DIGEST.exec(once("content-digest"));
+    if (cd === null)
+        throw new Error("request: Content-Digest is not the profile's spelling");
+    const contentDigest = b64Decode(cd[1], B64, true);
+    const actual = sha256(received.body);
+    if (contentDigest.length !== actual.length || contentDigest.some((b, i) => b !== actual[i])) {
+        throw new Error("request: Content-Digest does not match the content");
+    }
+    // 6. Freshness: 0 < e − c ≤ W and c − δ ≤ now < e + δ.
+    if (!(created < expires && expires - created <= policy.maxLifetime))
+        throw new Error("request: the lifetime is out of bounds");
+    if (!(created - policy.skew <= now && now < expires + policy.skew))
+        throw new Error("request: not fresh at now");
+    // 7. The signature, over the base built from what was received and configured.
+    const base = requestSignatureBase(components, si[0].slice(REQUEST_LABEL.length + 1));
+    if (!verifyInDomain(principal, REQUEST_DOMAIN, utf8.encode(base), signature))
+        throw new Error("request: the signature does not verify");
+    return {
+        principal,
+        keyText,
+        created,
+        expires,
+        nonce,
+        method: received.method,
+        targetUri: origin + received.requestTarget,
+        covered: components.filter(([n]) => !n.startsWith("@")),
+        contentDigest,
+    };
+}
+// ---------------------------------------------------------------------------------------------
+// base64, both alphabets, accepted only in their one canonical spelling (docs/request.md §3.1):
+// decoding and re-encoding must give back the same text.
+// ---------------------------------------------------------------------------------------------
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const B64URL = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function b64Encode(bytes, alphabet, pad) {
+    let out = "";
+    for (let i = 0; i < bytes.length; i += 3) {
+        const n = (bytes[i] << 16) | ((bytes[i + 1] ?? 0) << 8) | (bytes[i + 2] ?? 0);
+        const chars = Math.min(4, Math.ceil(((bytes.length - i) * 8) / 6));
+        for (let j = 0; j < chars; j++)
+            out += alphabet[(n >> (18 - 6 * j)) & 63];
+        if (pad)
+            out += "=".repeat(4 - chars);
+    }
+    return out;
+}
+function b64Decode(text, alphabet, pad) {
+    const body = pad ? text.replace(/=+$/, "") : text;
+    const bytes = [];
+    let acc = 0;
+    let bits = 0;
+    for (const ch of body) {
+        const v = alphabet.indexOf(ch);
+        if (v < 0)
+            throw new Error("request: not base64");
+        acc = (acc << 6) | v;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((acc >> bits) & 0xff);
+        }
+    }
+    const out = new Uint8Array(bytes);
+    if (b64Encode(out, alphabet, pad) !== text)
+        throw new Error("request: not the canonical base64 spelling");
+    return out;
+}
+//# sourceMappingURL=request.js.map

package/dist/src/request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/request.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,+EAA+E;AAC/E,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,EAAE;AACF,8FAA8F;AAC9F,+FAA+F;AAC/F,mGAAmG;AACnG,gGAAgG;AAChG,wBAAwB;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAErH,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAoC,MAAM,aAAa,CAAC;AAEzF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AACjD,mEAAmE;AACnE,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,QAAQ,CAAC;AACtC,qDAAqD;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,mBAAmB,CAAC;AAgEnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAC/B,MAAM,KAAK,GAAG,gCAAgC,CAAC;AAC/C,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhH,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACxB,IAAI,SAAS,KAAK,EAAE,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACnI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAClG,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,CAAC,CAAE,GAAG,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC5H,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,sBAAsB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;AACxI,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS,EAAE,IAAY;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,6BAA6B,eAAe,EAAE,CAAC,CAAC;AAC5I,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,MAAM,gBAAgB,sBAAsB,MAAM,sBAAsB,EAAE,CAAC,CAAC;IAC7H,CAAC;AACH,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,oBAAoB,CAAC,UAAoD,EAAE,SAAiB;IAC1G,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,wBAAwB,SAAS,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAgB;IAC3C,OAAO,YAAY,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;AAC3D,CAAC;AAED;0CAC0C;AAC1C,MAAM,UAAU,cAAc,CAAC,SAAqB,EAAE,KAAoB;IACxE,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACrG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC/F,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAA4B;QAC1C,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;QACzB,CAAC,aAAa,EAAE,MAAM,GAAG,KAAK,CAAC,aAAa,CAAC;QAC7C,CAAC,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC;QACnC,CAAC,gBAAgB,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3C,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,oBAAoB,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,KAAK,GACT,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,OAAO,EAAE;QACpG,WAAW,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,OAAO,UAAU,WAAW,GAAG,CAAC;IAC9F,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACpI,OAAO,EAAE,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,aAAa,IAAI,KAAK,EAAE,EAAE;KACzH,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,eAAe,CAAC,QAAyB,EAAE,SAAqB;IAC9E,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,aAAa,KAAK,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;AACrG,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,KAAoB;IAChE,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,KAAoB,EAAE,MAAoB;IAC9F,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACzD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,eAAe,GACnB,kKAAkK,CAAC;AACrK,MAAM,SAAS,GAAG,8BAA8B,CAAC;AACjD,MAAM,cAAc,GAAG,+BAA+B,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAqB,EAAE,GAAW,EAAE,QAAyB;IACzF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,oBAAoB,CAAC,CAAC;QACxE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,MAAM,CAAC,WAAW,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxF,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAErB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7C,uFAAuF;QACvF,oFAAoF;QACpF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,2BAA2B,CAAC,CAAC;QAC1G,OAAO,IAAI,CAAC,CAAC,CAAE,CAAC;IAClB,CAAC,CAAC;IAEF,wDAAwD;IACxD,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,UAAU,CAAC,KAAK,CAAC,CAAC;IAElB,0EAA0E;IAC1E,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC;IACvB,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEtG,oEAAoE;IACpE,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACpC,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,SAAS;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;aACtD,IAAI,CAAC,KAAK,aAAa;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;;YAC/E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAE5H,2CAA2C;IAC3C,MAAM,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvD,IAAI,EAAE,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO,IAAI,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC/H,IAAI,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAEjH,+EAA+E;IAC/E,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrF,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAExI,OAAO;QACL,SAAS;QACT,OAAO;QACP,OAAO;QACP,OAAO;QACP,KAAK;QACL,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,SAAS,EAAE,MAAM,GAAG,QAAQ,CAAC,aAAa;QAC1C,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvD,aAAa;KACd,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,gGAAgG;AAChG,yDAAyD;AACzD,gGAAgG;AAEhG,MAAM,GAAG,GAAG,kEAAkE,CAAC;AAC/E,MAAM,MAAM,GAAG,kEAAkE,CAAC;AAElF,SAAS,SAAS,CAAC,KAAiB,EAAE,QAAgB,EAAE,GAAY;IAClE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE;YAAE,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,IAAI,GAAG;YAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB,EAAE,GAAY;IAC7D,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClD,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAC1G,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/src/signer.d.ts

@@ -0,0 +1,54 @@
+/** Raw Ed25519 over the message, or Ed25519ph with the domain as the RFC 8032 context. */
+export type SigningScheme = {
+    readonly kind: "ed25519-raw";
+} | {
+    readonly kind: "ed25519ph-context";
+    readonly domain: string;
+};
+/** What a signer is asked to sign. `message` is always the original bytes. */
+export interface SigningRequest {
+    readonly expectedPublicKey: Uint8Array;
+    readonly scheme: SigningScheme;
+    readonly message: Uint8Array;
+}
+/** What a signer can do. `domains`, when present, is the only set it will sign in. */
+export interface SignerCapabilities {
+    readonly schemes: readonly SigningScheme["kind"][];
+    readonly domains?: readonly string[];
+}
+/**
+ * A source of signatures. `sign` may prompt, call a subprocess or wait on a device; it is
+ * given the abort signal, and a signature it returns after the signal fired is discarded,
+ * never packaged.
+ */
+export interface Signer {
+    readonly publicKey: Uint8Array;
+    readonly capabilities: SignerCapabilities;
+    sign(request: SigningRequest, signal?: AbortSignal): Promise<Uint8Array>;
+}
+/**
+ * Throws unless `request` is in range: a 32-byte expected key, a known scheme, and — for
+ * Ed25519ph — a domain the floor accepts. The domain is checked by the floor's own rule (it
+ * signs nothing with a throwaway key), so no copy of ADR 0008 §2 lives here to drift.
+ */
+export declare function validateSigningRequest(request: SigningRequest): void;
+/**
+ * Throws unless `signature` verifies for exactly what was REQUESTED: its key, scheme, domain
+ * and original bytes.
+ */
+export declare function checkSignature(request: SigningRequest, signature: Uint8Array): void;
+/**
+ * Throws unless `signer` claims to be able to sign `request`: its key is the expected one,
+ * and the scheme and domain are among its capabilities. Called before it is invoked.
+ */
+export declare function checkCapability(signer: Signer, request: SigningRequest): void;
+/**
+ * Validates, checks the signer's capabilities, invokes it, and returns the signature only
+ * if the call was not aborted and the signature verifies for what was requested.
+ */
+export declare function signWith(signer: Signer, request: SigningRequest, signal?: AbortSignal): Promise<Uint8Array>;
+/**
+ * The software signer: a seed held in this process, both schemes, any domain the floor
+ * accepts, deterministic by the floor's construction. The seed is copied.
+ */
+export declare function seedSigner(seed: Uint8Array): Signer;

package/dist/src/signer.js

@@ -0,0 +1,116 @@
+// The signer contract — SIGNING CAPABILITY, NOT SEEDS (ADR 0009 §2–4).
+//
+// Every helper in this package can take a seed, which is right for a key held in software
+// and wrong for one that is not: a stored key behind `archon sign --key`, or any backend a
+// caller wires in. So each signing helper also comes in three parts — a PURE prepare (the
+// exact request it needs signed), the signer's own work, and a PURE complete (the checked
+// signature, then packaging) — with a convenience that runs the signer between them. The
+// seed functions are unchanged and stay synchronous.
+//
+// A request is three things, and the scheme is a discriminated value, never a scheme name
+// plus an optional domain: the public key the caller expects, raw Ed25519 or Ed25519ph with
+// the domain as the RFC 8032 context, and the ORIGINAL message bytes — never a digest; a
+// backend that wants a prehash computes it inside its own adapter.
+//
+// Three rules, all enforced here rather than trusted to a signer:
+//
+// - A request is validated BEFORE the signer is invoked: a wrong-length key or a domain the
+//   floor refuses never reaches it.
+// - A signer REPORTS what it can do, and a request outside that is refused before it is
+//   invoked. A signer that cannot carry a context declares raw only; it must never sign an
+//   Ed25519ph request with an empty context instead, and if it does anyway, the check below
+//   catches it.
+// - Every returned signature is VERIFIED against the requested key, scheme, domain and bytes
+//   — never against values the signer echoes back. That catches a wrong key, a dropped
+//   context, raw substituted for ph, and a wrong prehash adaptation. It does not prove that a
+//   signer signs deterministically (ADR 0008 §1.7 requires it); that is a property of the
+//   backend, tested against the `domain_sign` vectors, not something one signature can show.
+//
+// Domain separation is not authorization: whoever may ask for signatures in a domain gets
+// any signature in that domain. Consent belongs to the caller that knows what the bytes mean.
+import { getPublicKey, sign, signInDomain, verify, verifyInDomain, PUBLIC_KEY_SIZE, SEED_SIZE, SIGNATURE_SIZE, } from "@bitspark/archon";
+const sameBytes = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
+/**
+ * Throws unless `request` is in range: a 32-byte expected key, a known scheme, and — for
+ * Ed25519ph — a domain the floor accepts. The domain is checked by the floor's own rule (it
+ * signs nothing with a throwaway key), so no copy of ADR 0008 §2 lives here to drift.
+ */
+export function validateSigningRequest(request) {
+    if (!(request.expectedPublicKey instanceof Uint8Array) || request.expectedPublicKey.length !== PUBLIC_KEY_SIZE) {
+        throw new Error(`signer: the expected public key must be ${PUBLIC_KEY_SIZE} bytes`);
+    }
+    if (!(request.message instanceof Uint8Array))
+        throw new Error("signer: the message must be bytes");
+    const scheme = request.scheme;
+    if (scheme.kind === "ed25519-raw") {
+        if ("domain" in scheme)
+            throw new Error("signer: a raw request carries no domain");
+        return;
+    }
+    if (scheme.kind !== "ed25519ph-context")
+        throw new Error(`signer: unknown scheme ${JSON.stringify(scheme.kind)}`);
+    if (typeof scheme.domain !== "string")
+        throw new Error("signer: an ed25519ph-context request needs a domain");
+    signInDomain(new Uint8Array(SEED_SIZE), scheme.domain, new Uint8Array(0));
+}
+/**
+ * Throws unless `signature` verifies for exactly what was REQUESTED: its key, scheme, domain
+ * and original bytes.
+ */
+export function checkSignature(request, signature) {
+    validateSigningRequest(request);
+    const ok = signature instanceof Uint8Array &&
+        signature.length === SIGNATURE_SIZE &&
+        (request.scheme.kind === "ed25519-raw"
+            ? verify(signature, request.message, request.expectedPublicKey)
+            : verifyInDomain(request.expectedPublicKey, request.scheme.domain, request.message, signature));
+    if (!ok) {
+        throw new Error("signer: the signature does not verify for the requested key, scheme and message");
+    }
+}
+/**
+ * Throws unless `signer` claims to be able to sign `request`: its key is the expected one,
+ * and the scheme and domain are among its capabilities. Called before it is invoked.
+ */
+export function checkCapability(signer, request) {
+    if (!sameBytes(signer.publicKey, request.expectedPublicKey)) {
+        throw new Error("signer: this signer's key is not the expected key");
+    }
+    const caps = signer.capabilities;
+    if (!caps.schemes.includes(request.scheme.kind)) {
+        throw new Error(`signer: this signer cannot produce ${request.scheme.kind}`);
+    }
+    if (request.scheme.kind === "ed25519ph-context" && caps.domains !== undefined && !caps.domains.includes(request.scheme.domain)) {
+        throw new Error(`signer: this signer does not sign in domain ${JSON.stringify(request.scheme.domain)}`);
+    }
+}
+/**
+ * Validates, checks the signer's capabilities, invokes it, and returns the signature only
+ * if the call was not aborted and the signature verifies for what was requested.
+ */
+export async function signWith(signer, request, signal) {
+    validateSigningRequest(request);
+    checkCapability(signer, request);
+    signal?.throwIfAborted();
+    const signature = await signer.sign(request, signal);
+    signal?.throwIfAborted();
+    checkSignature(request, signature);
+    return new Uint8Array(signature);
+}
+/**
+ * The software signer: a seed held in this process, both schemes, any domain the floor
+ * accepts, deterministic by the floor's construction. The seed is copied.
+ */
+export function seedSigner(seed) {
+    if (seed.length !== SEED_SIZE)
+        throw new Error(`signer: seed is ${seed.length} bytes, want ${SEED_SIZE}`);
+    const held = new Uint8Array(seed);
+    return {
+        publicKey: getPublicKey(held),
+        capabilities: { schemes: ["ed25519-raw", "ed25519ph-context"] },
+        sign: (request) => Promise.resolve(request.scheme.kind === "ed25519-raw"
+            ? sign(request.message, held)
+            : signInDomain(held, request.scheme.domain, request.message)),
+    };
+}
+//# sourceMappingURL=signer.js.map

package/dist/src/signer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.js","sourceRoot":"","sources":["../../src/signer.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,EAAE;AACF,0FAA0F;AAC1F,2FAA2F;AAC3F,0FAA0F;AAC1F,0FAA0F;AAC1F,yFAAyF;AACzF,qDAAqD;AACrD,EAAE;AACF,0FAA0F;AAC1F,4FAA4F;AAC5F,yFAAyF;AACzF,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,4FAA4F;AAC5F,oCAAoC;AACpC,wFAAwF;AACxF,2FAA2F;AAC3F,4FAA4F;AAC5F,gBAAgB;AAChB,6FAA6F;AAC7F,uFAAuF;AACvF,8FAA8F;AAC9F,0FAA0F;AAC1F,6FAA6F;AAC7F,EAAE;AACF,0FAA0F;AAC1F,8FAA8F;AAC9F,OAAO,EACL,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,cAAc,EACd,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,kBAAkB,CAAC;AA+B1B,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,CAAa,EAAW,EAAE,CAC1D,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,CAAC,OAAO,CAAC,iBAAiB,YAAY,UAAU,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/G,MAAM,IAAI,KAAK,CAAC,2CAA2C,eAAe,QAAQ,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,YAAY,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnG,MAAM,MAAM,GAAG,OAAO,CAAC,MAA8C,CAAC;IACtE,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAClC,IAAI,QAAQ,IAAI,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,mBAAmB;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClH,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IAC9G,YAAY,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB,EAAE,SAAqB;IAC3E,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,EAAE,GACN,SAAS,YAAY,UAAU;QAC/B,SAAS,CAAC,MAAM,KAAK,cAAc;QACnC,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;YACpC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC;YAC/D,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,OAAuB;IACrE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;IACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sCAAsC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,mBAAmB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/H,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAuB,EAAE,MAAoB;IAC1F,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,MAAM,gBAAgB,SAAS,EAAE,CAAC,CAAC;IAC1G,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IAClC,OAAO;QACL,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC;QAC7B,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,aAAa,EAAE,mBAAmB,CAAC,EAAE;QAC/D,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAChB,OAAO,CAAC,OAAO,CACb,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;YACnC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;YAC7B,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAC/D;KACJ,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitspark/archon-sdk",
-  "version": "0.8.2",
+  "version": "0.10.0",
   "description": "archon-sdk: proof of possession and the signed envelope, one layer above the identity floor. Deterministic given its inputs; no RNG, no clock, no socket.",
   "license": "Apache-2.0",
   "repository": {
@@ -22,7 +22,8 @@
     "test": "tsc -p tsconfig.json && node --test dist/test/*.test.js"
   },
   "dependencies": {
-    "@bitspark/archon": "^0.8.2"
+    "@bitspark/archon": "^0.10.0",
+    "@noble/hashes": "^2.2.0"
   },
   "devDependencies": {
     "@types/node": "^26",