@bkazemi/verily 0.1.0 → 0.2.0

package/README.md

@@ -145,7 +145,7 @@ import { init } from '@bkazemi/verily'; // also registers <verily-badge>
 const client = init({ backendUrl: '/api/verily' });
 ```
 
-Without one, serve `node_modules/@bkazemi/verily/dist/verily.js` yourself, or load it from a CDN such as `https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.1.0/dist/verily.js`. The script defines a global `Verily`.
+Without one, serve `node_modules/@bkazemi/verily/dist/verily.js` yourself, or load it from a CDN such as `https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.2.0/dist/verily.js`. The script defines a global `Verily`.
 
 Then place the badge wherever the account appears:
 
@@ -207,18 +207,18 @@ import {
 } from '@bkazemi/verily';
 ```
 
-| Provider               | The user proves it by                                                                 | Setup                                   |
-| ---------------------- | ------------------------------------------------------------------------------------- | --------------------------------------- |
-| `githubProvider()`     | signing in with GitHub.                                                               | A GitHub OAuth app.                     |
-| `discordProvider()`    | signing in with Discord.                                                              | A Discord application.                  |
-| `youtubeProvider()`    | signing in with Google and choosing their YouTube channel.                            | A Google OAuth client.                  |
-| `githubGistProvider()` | publishing a public gist containing a line Verily gives them.                         | None.                                   |
-| `linkProvider()`       | adding a `rel="me"` link to their profile on a page they control.                     | The local account needs a `profileUrl`. |
-| `githubLinkProvider()` | putting their profile URL in the website field of their GitHub profile.               | The local account needs a `profileUrl`. |
-| `pgpProvider()`        | signing a line Verily gives them with their OpenPGP key, then pasting it and the key. | None.                                   |
-| `emailProvider()`      | entering a code Verily mails to their address.                                        | A function that sends one message.      |
+| Provider               | The user proves it by                                                                                        | Setup                                   |
+| ---------------------- | ------------------------------------------------------------------------------------------------------------ | --------------------------------------- |
+| `githubProvider()`     | signing in with GitHub.                                                                                      | A GitHub OAuth app.                     |
+| `discordProvider()`    | signing in with Discord.                                                                                     | A Discord application.                  |
+| `youtubeProvider()`    | signing in with Google and choosing their YouTube channel.                                                   | A Google OAuth client.                  |
+| `githubGistProvider()` | publishing a public gist containing a line Verily gives them.                                                | None.                                   |
+| `linkProvider()`       | adding a `rel="me"` link to their profile on a page they control.                                            | The local account needs a `profileUrl`. |
+| `githubLinkProvider()` | putting their profile URL in the website field of their GitHub profile, then entering their GitHub username. | The local account needs a `profileUrl`. |
+| `pgpProvider()`        | signing a line Verily gives them with their OpenPGP key, then pasting it and the key.                        | None.                                   |
+| `emailProvider()`      | entering a code Verily mails to their address.                                                               | A function that sends one message.      |
 
-All methods except the sign-ins and the mailed code let the user publish the proof in their own time and come back. Gists and link-backs can be taken down later, so Verily re-reads them on a schedule. A PGP signature is kept by Verily and published at `<baseUrl>/connections/<id>/proof`.
+All methods except the sign-ins and the mailed code let the user publish the proof in their own time and come back. A proof that does not check out can be put right and handed back on the same step, up to five times, so a mistyped address never means publishing or signing again. Gists and link-backs can be taken down later, so Verily re-reads them on a schedule. A PGP signature is kept by Verily and published at `<baseUrl>/connections/<id>/proof`.
 
 **Several at once.** List more than one, and `/verify` offers each method as its own button:
 
@@ -228,8 +228,16 @@ providers: [githubProvider({ clientId, clientSecret }), githubLinkProvider()],
 
 Proving the same account a second way adds that proof to the existing record instead of creating another.
 
+**Approval only where there is something to decide.** A new connection always ends with the user choosing who can read it and confirming. Renewing a connection, or proving an account already linked a second way, does not: the account has been checked against the record and the record keeps its visibility, so it is recorded as soon as the proof checks out. This applies to flows started from your own pages, which is every flow the dialog and Verily's forms start. A flow entered by following a link to `GET <baseUrl>/sessions` still ends on an approval, because any site can send a browser down a link.
+
+**A link-back found at sign-in.** With `githubProvider()` and `githubLinkProvider()` both listed, signing in with GitHub also reads the profile that signed in. If its website field already links to the user's `profileUrl`, the approval step says so, and confirming records the link-back beside the sign-in. The user never picks the second method or types a username. A link with `http://` in place of `https://` counts; a different host, port or path does not.
+
 **Link-backs.** Many people already have one, since GitHub and Mastodon mark profile links `rel="me"`. By default the page may be on any public host, and the account is named by the page's address. This mode needs Node, because Verily checks every connection it makes to stop the page's address from pointing inside your network. Pass `hosts` to read only certain hosts (required on Cloudflare Workers), and `profile` to name the account by handle, as `githubLinkProvider()` does for github.com. If you pass your own `fetch`, it replaces that network check, so it must enforce the same rule itself. Only real `<a>` and `<link>` elements in HTML pages, or a `Link:` header, count; [`src/server/link.ts`](src/server/link.ts) has the exact rules.
 
+**Your own method.** A provider is an object, and [`src/core/index.ts`](src/core/index.ts) documents each shape. An artifact provider may also set `field` and `input` to name what it asks for, `resolve` to turn something short such as a username into the address to read, and `known` to say where to look for an account already on record, which is what lets a proof be found without asking. A sign-in provider's `authorizationUrl` is passed `account` on a renewal or visibility change, so it can ask for that account by name.
+
+If you start flows by calling `service.start()` yourself, pass `true` as its last argument only where you have shown the request came from the user's own page, as a same-origin POST does. Without it the flow reads nothing at its start and always ends on an approval.
+
 **OpenPGP.** The key's fingerprint is the identity. An email address is shown only when the key signed it **and** either keys.openpgp.org has confirmed it or the address's domain publishes the key in its [web key directory](https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/). The key must be valid when the proof is checked (not expired or revoked), SHA-1 signatures are refused, and a signing subkey must be properly bound to its key.
 
 **Email.** Verily sends no mail itself. Give `emailProvider()` a `send` function and it hands that one message per flow, written as both HTML and plain text, through whatever already sends your mail:
@@ -256,7 +264,7 @@ emailProvider({
 
 The HTML loads nothing from anywhere, so nothing in it is blocked and it tells nobody it was opened. Its one image, the Verily logo, is attached to the message; a sender that drops `images` still sends a whole message, with the word in the logo's place.
 
-The user types an address and Verily mails it a button to press, with an eight-character code beneath it as the other way in. The button opens a page on your backend, in whatever browser the mail is read in, and pressing **Confirm** there proves the mailbox; the page the user started on then carries on to the approval. Opening the link alone confirms nothing, so a mail scanner that follows links cannot answer for anyone. Both the link and the code last the flow's ten minutes, and the code gets five tries. The address is the account's name on the record, so a public link shows it to everyone; the user is told before the code is sent. It proves somebody could read that mailbox on the day, like a sign-in, and nothing is published or re-read later.
+The user types an address and Verily mails it a button to press, with an eight-character code beneath it as the other way in. The button opens a page on your backend, in whatever browser the mail is read in. In the browser that started the flow, opening it proves the mailbox, with nothing more to press. In any other browser the page asks for one press of **Confirm**, because there opening the link alone must confirm nothing: a mail scanner that follows links cannot then answer for anyone. Either way the page the user started on carries on by itself. Both the link and the code last the flow's ten minutes, and the code gets five tries. The address is the account's name on the record, so a public link shows it to everyone; the user is told before the code is sent. It proves somebody could read that mailbox on the day, like a sign-in, and nothing is published or re-read later.
 
 A visitor chooses where the message goes, so Verily counts what it sends: at most 100 messages in any twenty-four hours, and at most 5 to any one address. Past either, the flow fails and tells the user to try again tomorrow. Set `sendLimits: { day, address }` beside `providers` to change them, or `Infinity` to lift one. The day's count is shared, so one visitor can still spend it; rate limit `POST <baseUrl>/sessions` and `POST <baseUrl>/flows/*/submit` as well.
 
@@ -280,7 +288,7 @@ A static site only needs the script and the badge markup; the backend runs somew
 4. Add the script and the badge to your site:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.1.0/dist/verily.js" defer></script>
+<script src="https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.2.0/dist/verily.js" defer></script>
 <verily-badge
   backend-url="https://your-backend.example/api/verily"
   connection-id="CONNECTION_ID"

package/dist/browser/connect-dialog.d.ts

@@ -30,6 +30,12 @@ export interface FlowView {
     instructions?: Instruction[];
     artifact?: 'location' | 'document';
     field?: string;
+    /** How a `location` is asked for. Absent, from an older backend, means an address. */
+    input?: 'url' | 'text';
+    /** What to offer in the field, where a record of the holder's already says. */
+    suggested?: string;
+    /** Said where what was last handed back was refused and the flow still waits for it. */
+    refused?: string;
     note?: string;
     /**
      * A mailed code: what to ask the holder for, and once a code has gone, where it went,
@@ -47,6 +53,8 @@ export interface FlowView {
     joined?: {
         visibility: 'public' | 'unlisted';
     };
+    /** Said where the method used found another proof standing, which confirming records too. */
+    standingNote?: string;
     /** What the holder may choose. Absent, from an older backend, means either. */
     visibilities?: ('public' | 'unlisted')[];
     /** Said beside the public choice, where the backend signs its public records. */

package/dist/browser/connect-dialog.js

@@ -331,9 +331,14 @@ provider) {
     function publish(flow) {
         const input = flow.artifact === 'document'
             ? node('textarea')
-            : Object.assign(node('input'), { type: 'url' });
+            : Object.assign(node('input'), {
+                type: flow.input ?? 'url',
+                autocapitalize: 'none',
+                spellcheck: false,
+            });
         input.name = 'artifact';
         input.required = true;
+        input.value = flow.suggested ?? '';
         if (input instanceof HTMLTextAreaElement)
             input.rows = 10;
         const label = node('label', flow.field ?? 'Your proof');
@@ -352,7 +357,7 @@ provider) {
             ? node('p', part)
             : Array.isArray(part)
                 ? paragraph(part)
-                : codeBlock(part.code)), label, row(back, check), ...(flow.note ? [node('p', flow.note, 'muted')] : []));
+                : codeBlock(part.code)), ...(flow.refused ? [node('p', flow.refused, 'error')] : []), label, row(back, check), ...(flow.note ? [node('p', flow.note, 'muted')] : []));
     }
     /**
      * A mailed code, in two steps on the one flow: the holder names an address, then enters
@@ -445,6 +450,8 @@ provider) {
             }
             parts.push(choice);
         }
+        if (flow.standingNote)
+            parts.push(node('p', flow.standingNote));
         if (methods)
             parts.push(node('p', `${methods.siteName} receives the result. Verified via ${methods.verifierName}.`, 'muted'));
         const confirm = button(flow.joined ? 'Add to connection' : 'Confirm connection', true);
@@ -479,12 +486,10 @@ provider) {
         cancel.onclick = () => void decide(cancel, true);
         content.replaceChildren(...parts, row(cancel, confirm));
     }
+    /** The result is on the page behind the dialog, so there is nothing left to say here. */
     function done() {
         settle();
-        const finish = button('Done', true);
-        finish.onclick = () => dialog.close();
-        content.replaceChildren(node('p', 'The connection is recorded.', 'state'), row(finish));
-        finish.focus();
+        dialog.close();
     }
     close.addEventListener('click', () => dialog.close());
     dialog.addEventListener('click', (event) => {

package/dist/core/index.d.ts

@@ -127,8 +127,30 @@ export interface Flow {
      * unguessable and per-flow, so an artifact made for one flow cannot complete another.
      */
     expect?: string;
-    /** What the holder handed back: an address to read, or the proof itself. */
+    /**
+     * What the holder handed back: an address to read, or the proof itself. On a flow still
+     * waiting it is what they last handed back and had refused, kept so they can put it right.
+     */
     artifact?: string;
+    /** How many times what the holder handed back has been refused. */
+    tries?: number;
+    /**
+     * Whether the flow was started by a request shown to come from the holder's own page,
+     * and not by an address anyone could have sent their browser to. Only such a flow may
+     * be recorded without an approval, which is otherwise the one step a link cannot press.
+     */
+    attended?: boolean;
+    /**
+     * What the holder is offered to hand back, where a record of theirs already names the
+     * account. Only an offer: what is verified is whatever they then submit.
+     */
+    suggested?: string;
+    /**
+     * Proofs found already standing when another method named the account, such as a link
+     * back on the profile of an account that just signed in. Recorded with the method that
+     * found them once the holder approves.
+     */
+    standing?: Attestation[];
     /**
      * A message on its way to the address the holder named, carrying a link to press and a
      * code to type. The account is only a claim until one of them comes back, which is why
@@ -224,6 +246,11 @@ export interface RedirectProvider {
         state: string;
         challenge: string;
         redirectUri: string;
+        /**
+         * The account the flow must show, on a flow the holder of its record started. There is
+         * no account to choose then, so the provider need not be made to offer the choice.
+         */
+        account?: ExternalAccount;
     }): string;
     authenticate(input: {
         code: string;
@@ -261,6 +288,25 @@ export interface ArtifactProvider {
      * character, and prose that reflows is prose a holder cannot safely copy.
      */
     instructions(expect: string): Instruction[];
+    /**
+     * What the holder is asked to hand back, where the method takes something a holder knows
+     * by a better name than "an address". `input` says how to ask for it: `text` where it
+     * need not be an address at all, such as a username.
+     */
+    field?: string;
+    input?: 'url' | 'text';
+    /**
+     * Turns what the holder typed into the address to read, for a method that takes something
+     * shorter. What it returns is what is verified and kept as the proof's location, so it
+     * must be the whole address. Anything it does not recognise is returned as it came.
+     */
+    resolve?(artifact: string): string;
+    /**
+     * What to hand back for an account the subject is already linked to, where the account
+     * alone says so: a profile that carries the link is at the account's own address. The
+     * holder is offered it instead of being asked, and may still hand back something else.
+     */
+    known?(account: ExternalAccount): string | undefined;
     /**
      * Reads what the holder handed back and returns whose it is. Must confirm it contains
      * `expect`. A `location` provider must also refuse any address outside itself, since

package/dist/server/copy.d.ts

@@ -6,3 +6,9 @@
  * Served as a file because these pages allow no inline scripts.
  */
 export declare const copyScript = "for (const block of document.querySelectorAll('pre')) {\n  const code = block.querySelector('code');\n\n  if (!code) continue;\n\n  const button = document.createElement('button');\n\n  button.type = 'button';\n  button.className = 'copy';\n  button.textContent = 'Copy';\n  button.setAttribute('aria-live', 'polite');\n\n  button.addEventListener('click', async () => {\n    try {\n      await navigator.clipboard.writeText(code.textContent);\n      button.textContent = 'Copied';\n    } catch {\n      // No clipboard permission, or an insecure origin. Select it instead, which leaves\n      // the holder one keystroke away rather than telling them it worked when it did not.\n      // The label stays short so the button never grows over the line it sits on.\n      const range = document.createRange();\n      const selection = getSelection();\n\n      range.selectNodeContents(code);\n      selection.removeAllRanges();\n      selection.addRange(range);\n      button.textContent = 'Selected';\n    }\n\n    setTimeout(() => (button.textContent = 'Copy'), 2000);\n  });\n\n  block.prepend(button);\n}\n";
+/**
+ * Moves a page that is waiting on a mailed link along once the link has been pressed,
+ * wherever it was pressed. Nothing is redrawn until then, so a code half typed is left
+ * alone. Without this the page still has its own link to press.
+ */
+export declare const waitScript = "const timer = setInterval(async () => {\n  try {\n    const response = await fetch(location.pathname + '/phase', { credentials: 'same-origin' });\n\n    // Still exchanging means the link was pressed and is being recorded: the page that\n    // loaded now would show neither the step before nor the one after.\n    if (response.ok && !['pending', 'exchanging'].includes((await response.json()).phase)) {\n      clearInterval(timer);\n      location.reload();\n    }\n  } catch {\n    // A read that fails says nothing about the flow, which the next one may.\n  }\n}, 2000);\n";

package/dist/server/copy.js

@@ -40,3 +40,23 @@ export const copyScript = `for (const block of document.querySelectorAll('pre'))
   block.prepend(button);
 }
 `;
+/**
+ * Moves a page that is waiting on a mailed link along once the link has been pressed,
+ * wherever it was pressed. Nothing is redrawn until then, so a code half typed is left
+ * alone. Without this the page still has its own link to press.
+ */
+export const waitScript = `const timer = setInterval(async () => {
+  try {
+    const response = await fetch(location.pathname + '/phase', { credentials: 'same-origin' });
+
+    // Still exchanging means the link was pressed and is being recorded: the page that
+    // loaded now would show neither the step before nor the one after.
+    if (response.ok && !['pending', 'exchanging'].includes((await response.json()).phase)) {
+      clearInterval(timer);
+      location.reload();
+    }
+  } catch {
+    // A read that fails says nothing about the flow, which the next one may.
+  }
+}, 2000);
+`;

package/dist/server/discord.js

@@ -10,7 +10,9 @@ export function discordProvider(options) {
         authorizationUrl({ state, challenge, redirectUri }) {
             const url = new URL('https://discord.com/oauth2/authorize');
             // Discord has no account chooser. Forcing the consent screen at least shows the holder
-            // which account they are signed in as before it is linked.
+            // which account they are signed in as before it is linked. It is forced on a flow on
+            // a record too: the holder may have withdrawn the grant since, and asking silently
+            // for one that is gone fails with no way for them to give it again.
             url.search = new URLSearchParams({
                 response_type: 'code',
                 client_id: options.clientId,

package/dist/server/github.js

@@ -7,8 +7,10 @@ export function githubProvider(options) {
         id: 'github',
         name: 'GitHub',
         method: 'oauth',
-        authorizationUrl({ state, challenge, redirectUri }) {
+        authorizationUrl({ state, challenge, redirectUri, account }) {
             const url = new URL('https://github.com/login/oauth/authorize');
+            // A new link is to whichever account the holder picks. A flow on a record already
+            // names its account, so GitHub is asked for that one and not made to offer a choice.
             url.search = new URLSearchParams({
                 client_id: options.clientId,
                 redirect_uri: redirectUri,
@@ -16,7 +18,7 @@ export function githubProvider(options) {
                 code_challenge: challenge,
                 code_challenge_method: 'S256',
                 scope: '',
-                prompt: 'select_account',
+                ...(account ? { login: account.handle } : { prompt: 'select_account' }),
             }).toString();
             return url.href;
         },

package/dist/server/index.js

@@ -1,6 +1,6 @@
 import { attestationLabel, externalLink, externalName, isArtifactProvider, isCodeProvider, isRedirectProvider, localSide, proofTitle, providerMethod, statusLabel, signedBy, } from '../core/index.js';
-import { codeAttempts, VerilyService, Unavailable } from './service.js';
-import { copyScript } from './copy.js';
+import { artifactAttempts, codeAttempts, VerilyService, Unavailable, } from './service.js';
+import { copyScript, waitScript } from './copy.js';
 import { escape } from './escape.js';
 import { logo } from '../logo.js';
 import { stylesheet, styleVersion } from './style.js';
@@ -26,7 +26,7 @@ const headers = {
     'Referrer-Policy': 'same-origin',
     'X-Robots-Tag': 'noindex, nofollow',
     'X-Content-Type-Options': 'nosniff',
-    'Content-Security-Policy': "default-src 'none'; script-src 'self'; style-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
+    'Content-Security-Policy': "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'",
 };
 const html = (body, status = 200) => new Response(body, {
     status,
@@ -105,12 +105,33 @@ function methodAction(provider) {
 }
 /** What the holder hands back for an artifact method, named for what it is. */
 function artifactField(provider) {
+    if (provider.field)
+        return provider.field;
     if (provider.artifact === 'document')
         return 'Your proof';
     return provider.method === 'backlink'
         ? 'Address of the page carrying your link'
         : 'Address of your published proof';
 }
+/**
+ * Said before the holder approves, where the method they used found another proof already
+ * standing: it goes on the record with this one, and they did not ask for it by name.
+ */
+function standingNote(flow, site) {
+    return flow.standing?.some((a) => a.method === 'backlink')
+        ? `This account already links back to ${site}. Confirming records that too.`
+        : undefined;
+}
+/**
+ * Said above a proof that was handed back and refused, while the flow still waits for it:
+ * why, where the provider said why in words meant for the holder, and how many tries remain.
+ */
+function refusedNote(flow) {
+    if (!flow.tries)
+        return undefined;
+    const left = artifactAttempts - flow.tries;
+    return `${flow.reason ? `That did not check out: ${flow.reason}.` : 'That could not be checked.'} ${left === 1 ? 'One try is' : `${left} tries are`} left.`;
+}
 /** Said beside every artifact method: what the holder publishes is public by design. */
 function artifactNote(provider) {
     return provider.method === 'backlink'
@@ -424,16 +445,23 @@ export function createVerily(options) {
                 instructions: provider.instructions(flow.expect),
                 artifact: provider.artifact,
                 field: artifactField(provider),
+                input: provider.input ?? 'url',
+                ...((flow.artifact ?? flow.suggested)
+                    ? { suggested: flow.artifact ?? flow.suggested }
+                    : {}),
+                ...(flow.tries ? { refused: refusedNote(flow) } : {}),
                 note: artifactNote(provider),
             });
         if (flow.phase === 'pending' && isCodeProvider(provider))
             Object.assign(view, { code: codeStep(provider, flow), note: codeNote });
         if (flow.phase === 'approval') {
             const joined = await service.joining(flow);
+            const found = standingNote(flow, service.siteOf(flow.local));
             Object.assign(view, {
                 local: subject(flow.local),
                 external: flow.external,
                 ...(joined ? { joined: { visibility: joined.visibility } } : {}),
+                ...(found ? { standingNote: found } : {}),
                 visibilities: visibilities(flow.local),
                 ...(signs ? { signedNote } : {}),
             });
@@ -451,6 +479,14 @@ export function createVerily(options) {
             throw new Unavailable();
         return flow;
     }
+    /**
+     * What the tab a confirmation was pressed in says. It is the end of that tab's part: the
+     * page that asked is waiting on the flow and carries on from there, so this one offers
+     * nowhere to go.
+     */
+    const confirmed = (flow) => html(page(prefix, flow.phase === 'failed' ? 'Address not confirmed' : 'Address confirmed', flow.phase === 'failed'
+        ? `<p>${escape(flow.reason ?? 'This address could not be confirmed')}.</p>`
+        : '<p>You can close this tab now.</p>'));
     async function handle(request) {
         const url = new URL(request.url);
         if (url.origin !== base.origin ||
@@ -481,6 +517,14 @@ export function createVerily(options) {
                     return new Response(copyScript, {
                         headers: { ...headers, 'Content-Type': 'text/javascript' },
                     });
+                if (path === '/wait.js')
+                    return new Response(waitScript, {
+                        headers: { ...headers, 'Content-Type': 'text/javascript' },
+                    });
+                const phase = path.match(/^\/flows\/([^/]+)\/phase$/);
+                // All a waiting page needs to know, and only the browser that started the flow.
+                if (phase)
+                    return json({ phase: (await service.flow(phase[1], binding(request))).phase });
                 if (path === '/result.js')
                     return new Response(`const e=document.getElementById('verily-result');if(window.opener&&e){window.opener.postMessage({type:'verily-result',outcome:e.dataset.outcome,connectionId:e.dataset.id},location.origin);window.close()}`, { headers: { ...headers, 'Content-Type': 'text/javascript' } });
                 if (path === '/verify' ||
@@ -564,10 +608,11 @@ export function createVerily(options) {
                             if ((await local(request)).id !== flow.local?.id)
                                 throw new Unavailable();
                         return html(page(prefix, `Verify with ${provider.name}`, `${instructions(provider.instructions(flow.expect))}
+            ${flow.tries ? `<p>${escape(refusedNote(flow))}</p>` : ''}
             <form method="post" action="${escape(prefix)}/flows/${escape(flow.id)}/submit">
             <label>${escape(artifactField(provider))} ${provider.artifact === 'document'
-                            ? '<textarea name="artifact" rows="14" cols="72" required></textarea>'
-                            : '<input name="artifact" type="url" required>'}</label>
+                            ? `<textarea name="artifact" rows="14" cols="72" required>${escape(flow.artifact ?? '')}</textarea>`
+                            : `<input name="artifact" type="${provider.input ?? 'url'}" value="${escape(flow.artifact ?? flow.suggested ?? '')}" autocapitalize="none" spellcheck="false" required>`}</label>
             <button>Check my proof</button></form>
             <p class="fine">${escape(artifactNote(provider))}</p>
             <script src="${escape(prefix)}/copy.js" defer></script>`));
@@ -580,7 +625,7 @@ export function createVerily(options) {
                         const step = codeStep(provider, flow);
                         return html(page(prefix, `Verify with ${provider.name}`, `${step.sentTo === undefined
                             ? ''
-                            : `<p>A message was sent to ${escape(step.sentTo)}. Press the button in it, then come back to this page.</p><p><a href="${escape(prefix)}/flows/${escape(flow.id)}">I pressed the button</a></p><p>Or enter the code from the message here.</p>${step.wrong
+                            : `<p>A message was sent to ${escape(step.sentTo)}. Press the button in it, and this page carries on.</p><noscript><p><a href="${escape(prefix)}/flows/${escape(flow.id)}">I pressed the button</a></p></noscript><p>Or enter the code from the message here.</p>${step.wrong
                                 ? `<p>That code did not match. ${step.triesLeft === 1 ? 'One try is' : `${step.triesLeft} tries are`} left.</p>`
                                 : ''}`}
             <form method="post" action="${escape(prefix)}/flows/${escape(flow.id)}/submit">
@@ -588,7 +633,7 @@ export function createVerily(options) {
                             ? `<input name="artifact" type="${step.input}" autocomplete="${step.input}" required>`
                             : '<input name="artifact" autocomplete="one-time-code" autocapitalize="characters" spellcheck="false" required>'}</label>
             <button>${step.sentTo === undefined ? `Send the ${escape(provider.name.toLowerCase())}` : 'Check my code'}</button></form>
-            ${step.sentTo === undefined ? `<p class="fine">${escape(codeNote)}</p>` : ''}`));
+            ${step.sentTo === undefined ? `<p class="fine">${escape(codeNote)}</p>` : `<script src="${escape(prefix)}/wait.js" defer></script>`}`));
                     }
                     if (flow.phase !== 'approval')
                         return await ended(flow);
@@ -599,6 +644,7 @@ export function createVerily(options) {
                     // visibility was chosen when it was made and is not the holder's to rechoose here.
                     const joined = await service.joining(flow);
                     const kept = ['revoke', 'share-revoke', 'renew'].includes(flow.kind) || joined;
+                    const found = standingNote(flow, service.siteOf(flow.local));
                     return html(page(prefix, ['revoke', 'share-revoke'].includes(flow.kind)
                         ? 'Remove connection'
                         : flow.kind === 'renew'
@@ -609,6 +655,7 @@ export function createVerily(options) {
             ${card(subject(flow.local).heading, subject(flow.local).value, flow.local.profileUrl)}
             ${card(provider.name, externalName(flow.external), externalLink(flow.external), flow.external.kind === 'mailbox' ? undefined : flow.external.id)}
             ${joined ? `<p>This account is already linked here. Confirming adds this method to that connection, beneath the one it was first shown by, and it stays ${escape(joined.visibility)}.</p>` : ''}
+            ${found ? `<p>${escape(found)}</p>` : ''}
             <p class="fine">${escape(service.siteOf(flow.local))} receives the result. Verified via ${escape(options.verifierName)}.</p>
             <form method="post" action="${escape(prefix)}/flows/${escape(flow.id)}/approve">
             ${kept ? '<input type="hidden" name="visibility" value="unlisted">' : visibilityChoice(flow.local, visibilities(flow.local), signs)}
@@ -617,11 +664,16 @@ export function createVerily(options) {
                 }
                 const confirmation = path.match(/^\/confirm\/([^/]+)$/);
                 // Where the button in a message leads, in whatever browser the holder reads mail
-                // in. Arriving confirms nothing: a scanner that opens every link in a message gets
-                // this page and stops, and the holder is shown what they are confirming first.
+                // in. In the browser that started the flow, arriving is the confirmation: its
+                // cookie shows the one who asked is the one who opened the message. Anywhere else
+                // arriving confirms nothing: a scanner that opens every link in a message carries
+                // no cookie, gets this page and stops, and a holder on another device is shown
+                // what they are confirming first.
                 if (confirmation) {
                     const token = url.searchParams.get('token') ?? '';
                     const asked = await service.confirming(confirmation[1], token);
+                    if (await service.flow(confirmation[1], binding(request)).catch(() => undefined))
+                        return confirmed(await service.confirm(confirmation[1], token));
                     const next = {
                         connect: `link it to this ${subjectNoun(asked.local?.kind) ?? 'site'}`,
                         renew: 'renew its link',
@@ -720,22 +772,16 @@ export function createVerily(options) {
                     const flow = await service.start(user, data.connectionId || undefined, kind, await choose(user, data.connectionId || undefined, {
                         provider: data.provider || undefined,
                         method: data.method || undefined,
-                    }), await context(request, kind));
+                    }), await context(request, kind), 
+                    // Posted from this origin, which the check on every POST has already held it to.
+                    true);
                     if (asJson && kind === 'connect')
                         return json(await flowView(await service.flow(flow.flowId, flow.binding), flow.authorizationUrl), flowCookie(flow.binding));
                     return redirect(entry(flow), flowCookie(flow.binding));
                 }
                 const confirmation = path.match(/^\/confirm\/([^/]+)$/);
                 if (confirmation) {
-                    const flow = await service.confirm(confirmation[1], data.token ?? '');
-                    // The flow is still the browser's that started it. This one may be that browser,
-                    // and then it can carry on from here; any other is sent back to where it began.
-                    const here = await service.flow(flow.id, binding(request)).catch(() => undefined);
-                    return html(page(prefix, flow.phase === 'failed' ? 'Address not confirmed' : 'Address confirmed', flow.phase === 'failed'
-                        ? `<p>${escape(flow.reason ?? 'This address could not be confirmed')}.</p>`
-                        : `<p>Go back to the page where you started. It carries on from here.</p>${here
-                            ? `<p><a href="${escape(prefix)}/flows/${escape(flow.id)}">Or carry on in this window</a></p>`
-                            : '<p>You can close this window.</p>'}`));
+                    return confirmed(await service.confirm(confirmation[1], data.token ?? ''));
                 }
                 const submission = path.match(/^\/flows\/([^/]+)\/submit$/);
                 if (submission) {

package/dist/server/link.js

@@ -86,6 +86,9 @@ export function linkProvider(options) {
             }
             return account(page, profile);
         },
+        // A page that carries the link is at the address it is named by, so a record of one
+        // already says where to look.
+        known: (account) => account.profileUrl,
     };
 }
 /**
@@ -216,18 +219,32 @@ export function githubLinkProvider(options = {}) {
         id: 'github',
         name: 'GitHub',
         hosts: ['github.com'],
-        // GitHub's own rule: alphanumerics and single hyphens, never leading or trailing, 39 max.
-        profile: /^\/([A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38})$/,
+        profile: new RegExp(`^/(${username})$`),
     });
+    // A profile is at its username, so the username is all the holder needs to give. A
+    // leading @ is how one is written, and is not part of it.
+    const named = new RegExp(`^@?(${username})$`);
     return {
         ...provider,
         // GitHub writes the rel="me" itself, so the holder only fills in one field.
         instructions: (expect) => [
-            'Put this address in the website field of your GitHub profile, then paste your profile’s address below.',
+            'Put this address in the website field of your GitHub profile, then enter your GitHub username below.',
             { code: expect },
         ],
+        field: 'Your GitHub username',
+        input: 'text',
+        resolve(artifact) {
+            const name = named.exec(artifact.trim())?.[1];
+            return name ? `https://github.com/${name}` : artifact;
+        },
+        // Only an account has a username. The handle of anything else is not one.
+        known: (account) => (account.kind ?? 'account') === 'account' && named.test(account.handle)
+            ? account.handle.replace(/^@/, '')
+            : undefined,
     };
 }
+/** GitHub's own rule: alphanumerics and single hyphens, never leading or trailing, 39 max. */
+const username = '[A-Za-z0-9](?:[A-Za-z0-9]|-(?=[A-Za-z0-9])){0,38}';
 /**
  * Whether a link points at the subject. Every key in the subject's query must carry the
  * same values in the same order on the link, since a site whose profiles differ only by a
@@ -244,7 +261,10 @@ function points(href, base, subject) {
     }
     // A subject with a fragment is one of the views a hash-routed page serves, so the
     // fragment names it and must match. A fragment on the link alone is a spot on the page.
-    if (target.protocol !== subject.protocol ||
+    // A site reached over http is the same site as over https, and a profile field given a
+    // bare domain is often written as the former. Any other scheme is some other resource.
+    const scheme = target.protocol === 'http:' && subject.protocol === 'https:' ? 'https:' : target.protocol;
+    if (scheme !== subject.protocol ||
         target.host.toLowerCase() !== subject.host.toLowerCase() ||
         trim(target.pathname) !== trim(subject.pathname) ||
         (subject.hash !== '' && target.hash !== subject.hash))

package/dist/server/service.d.ts

@@ -84,7 +84,13 @@ export declare class VerilyService {
     start(local?: LocalAccount, connectionId?: string, kind?: Flow['kind'], choice?: {
         provider?: string;
         method?: string;
-    }, context?: Record<string, string>): Promise<{
+    }, context?: Record<string, string>, 
+    /**
+     * Whether the caller has shown the holder asked for this themselves, as a form posted
+     * from their own page shows and following a link does not. Without it the flow reads
+     * nothing at its start and ends on an approval, however little there is to approve.
+     */
+    attended?: boolean): Promise<{
         flowId: string;
         binding: string;
         expect: string;
@@ -103,6 +109,19 @@ export declare class VerilyService {
         instructions?: undefined;
         authorizationUrl?: undefined;
     }>;
+    /**
+     * What a new flow can offer the holder to hand back: the one account this subject has
+     * already shown some other way, which is the record the flow would join. With several,
+     * which one they mean is theirs to say.
+     */
+    private known;
+    /**
+     * Reads the proof at the account a record already names, before the holder is asked for
+     * anything. Found, the flow goes straight to approval, as if they had handed it back.
+     * Not found is no failure: they have not been told what to publish yet, so the flow
+     * stays where it was and tells them.
+     */
+    private offered;
     /**
      * Which method a flow runs. A flow on an existing record stays in that record's
      * namespace, and without a choice it uses the method the record was first shown by.
@@ -119,6 +138,13 @@ export declare class VerilyService {
      * code that arrived there.
      */
     submit(id: string, binding: string, artifact: string): Promise<string>;
+    /**
+     * Takes a refused proof as something the holder can put right, and leaves the flow
+     * waiting for it. What they must publish is minted per flow, so a flow ended here would
+     * have them publish or sign all over again for a mistyped address. The tries are counted
+     * all the same: each one is a fetch somewhere the holder chose.
+     */
+    private refused;
     /**
      * One step of a mailed code. The first answer is an address: a code is minted, sent
      * there, and only its hash kept. The second is the code, which the holder could only
@@ -168,8 +194,18 @@ export declare class VerilyService {
      */
     private established;
     /**
-     * A failed check leaves the flow dead rather than retryable in place. Only a `Refused`
-     * reason is kept: any other error may describe this backend rather than the proof.
+     * The proofs already standing for the account a flow just showed, by the other methods
+     * configured for its provider that can tell where to look from the account alone. One
+     * that is not there, or cannot be read, is simply not found: the holder asked for none
+     * of them, so none of them can fail the flow.
+     */
+    private standing;
+    /** Adds the proofs a flow found standing beneath the method the record was first shown by. */
+    private recordStanding;
+    /**
+     * A sign-in or a mailed code that fails leaves the flow dead: there is nothing in it to
+     * put right, and starting again costs the holder nothing. Only a `Refused` reason is
+     * kept: any other error may describe this backend rather than the proof.
      */
     private failed;
     approve(id: string, binding: string, local: LocalAccount | undefined, visibility: Visibility, cancel?: boolean, 
@@ -179,6 +215,15 @@ export declare class VerilyService {
      * this approval makes a record or joins one, so no change in between gets past it.
      */
     allowed?: Visibility[]): Promise<string | undefined>;
+    /**
+     * Whether approving a flow would decide anything. A renewal, or another way of showing
+     * an account the subject is already linked to, changes neither who is linked nor who
+     * can read it: the holder asked for exactly this and the account has been checked
+     * against the record, so it is recorded without asking them to say so again.
+     */
+    private settled;
+    /** Records what an approved flow does, and ends it. The caller has checked who approves. */
+    private conclude;
     /**
      * Ends a flow and records how, inside the transaction that ends it: the connection as it
      * stands now, since whatever later reports this result must not read a record that has
@@ -309,3 +354,5 @@ export declare class VerilyService {
 }
 /** How many wrong codes a flow takes before it is dead. */
 export declare const codeAttempts = 5;
+/** How many times a published proof may be refused before its flow is dead. */
+export declare const artifactAttempts = 5;

package/dist/server/service.js

@@ -135,7 +135,13 @@ export class VerilyService {
             ? this.providers[0]
             : this.resolve(flow.provider, flow.method);
     }
-    async start(local, connectionId, kind = 'connect', choice = {}, context) {
+    async start(local, connectionId, kind = 'connect', choice = {}, context, 
+    /**
+     * Whether the caller has shown the holder asked for this themselves, as a form posted
+     * from their own page shows and following a link does not. Without it the flow reads
+     * nothing at its start and ends on an approval, however little there is to approve.
+     */
+    attended = false) {
         if (kind === 'connect' && !local)
             throw new Unavailable();
         if (context !== undefined &&
@@ -157,10 +163,15 @@ export class VerilyService {
             connectionId,
             phase: 'pending',
             expiresAt: this.now() + (this.options.flowTtlMs ?? 600000),
+            ...(attended ? { attended } : {}),
         };
         // Removal from the external side answers to nobody local, so nothing local rides on it.
         if (context && !['revoke', 'share-revoke'].includes(kind))
             flow.context = { ...context };
+        // The account a sign-in is asked for by name. Only where the local holder of the record
+        // started the flow: removal from the external side is started by anyone, and is told
+        // nothing about the account it would have to show.
+        let account;
         const provider = await this.transaction(async (tx) => {
             // Whose link this is. A flow against an existing connection may carry no local
             // subject of its own, and the record is the authority on it in any case.
@@ -174,6 +185,8 @@ export class VerilyService {
                     (['visibility', 'renew'].includes(kind) && connection.local.id !== local?.id))
                     throw new Unavailable();
                 subject = connection.local;
+                if (['renew', 'visibility'].includes(kind))
+                    account = connection.external;
             }
             const provider = this.chosen(kind, choice, connection);
             flow.provider = provider.id;
@@ -189,10 +202,23 @@ export class VerilyService {
                 flow.expect = artifact.expect
                     ? artifact.expect(subject)
                     : `Verily proof for ${this.siteOf(subject)}: ${secret()}`;
+            // These kinds are all started by the local holder, whose own record this is. Removal
+            // from the external side is started by anyone, and is told nothing.
+            if (artifact?.known && ['connect', 'renew', 'visibility'].includes(kind)) {
+                const suggested = connection
+                    ? artifact.known(connection.external)
+                    : await this.known(tx, subject, artifact);
+                if (suggested)
+                    flow.suggested = suggested;
+            }
             await tx.put('flows', flow.id, flow);
             return provider;
         });
         const artifact = isArtifactProvider(provider) ? provider : undefined;
+        // Where a record already says whose account this is, there is nothing to ask the
+        // holder: the proof is either there to be read or it is not.
+        if (artifact && flow.suggested && attended)
+            await this.offered(flow.id, binding, artifact, flow.expect, flow.suggested);
         // A redirect provider hands the holder to its own site; an artifact provider tells
         // them what to publish and waits for them to say where they put it; a code provider
         // has nothing to say until the holder names the address to send to.
@@ -211,10 +237,53 @@ export class VerilyService {
                         state,
                         challenge: hash(verifier),
                         redirectUri: `${this.baseUrl}/callback`,
+                        ...(account ? { account } : {}),
                     }),
                 }
                 : { flowId: flow.id, binding };
     }
+    /**
+     * What a new flow can offer the holder to hand back: the one account this subject has
+     * already shown some other way, which is the record the flow would join. With several,
+     * which one they mean is theirs to say.
+     */
+    async known(tx, local, provider) {
+        const offers = (await tx.list('connections'))
+            .filter((c) => c.revokedAt === undefined &&
+            c.local.id === local.id &&
+            c.provider === provider.id &&
+            (c.attestations?.external[0].method ?? 'oauth') !== provider.method)
+            .map((c) => provider.known(c.external))
+            .filter((offer) => offer !== undefined);
+        return new Set(offers.map((offer) => offer.toLowerCase())).size === 1 ? offers[0] : undefined;
+    }
+    /**
+     * Reads the proof at the account a record already names, before the holder is asked for
+     * anything. Found, the flow goes straight to approval, as if they had handed it back.
+     * Not found is no failure: they have not been told what to publish yet, so the flow
+     * stays where it was and tells them.
+     */
+    async offered(id, binding, provider, expect, suggested) {
+        try {
+            const handed = provider.resolve?.(suggested) ?? suggested;
+            const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+            await this.transaction(async (tx) => {
+                const flow = await this.bound(tx, id, binding);
+                flow.phase = 'exchanging';
+                await tx.put('flows', id, flow);
+            });
+            await this.established(id, binding, external, handed);
+        }
+        catch {
+            await this.transaction(async (tx) => {
+                const flow = await tx.get('flows', id);
+                if (flow?.phase === 'exchanging') {
+                    flow.phase = 'pending';
+                    await tx.put('flows', id, flow);
+                }
+            });
+        }
+    }
     /**
      * Which method a flow runs. A flow on an existing record stays in that record's
      * namespace, and without a choice it uses the method the record was first shown by.
@@ -263,14 +332,40 @@ export class VerilyService {
             return { provider, expect: flow.expect };
         });
         try {
-            const external = await provider.verify({ artifact, expect });
-            await this.established(id, binding, external, artifact);
+            // Kept as the address that was read, never as the shorthand that named it: it is
+            // where a reader is sent, and what is read again later.
+            const handed = provider.resolve?.(artifact) ?? artifact;
+            const external = await provider.verify({ artifact: handed, expect });
+            await this.established(id, binding, external, handed);
         }
         catch (error) {
-            await this.failed(id, error);
+            await this.refused(id, error, artifact);
         }
         return id;
     }
+    /**
+     * Takes a refused proof as something the holder can put right, and leaves the flow
+     * waiting for it. What they must publish is minted per flow, so a flow ended here would
+     * have them publish or sign all over again for a mistyped address. The tries are counted
+     * all the same: each one is a fetch somewhere the holder chose.
+     */
+    async refused(id, error, artifact) {
+        await this.transaction(async (tx) => {
+            const flow = await tx.get('flows', id);
+            if (flow?.phase !== 'exchanging')
+                return;
+            flow.tries = (flow.tries ?? 0) + 1;
+            // Only a `Refused` reason is kept: any other error may describe this backend.
+            flow.reason = error instanceof Refused ? error.message : undefined;
+            if (flow.tries >= artifactAttempts)
+                await this.ended(tx, flow, 'failed');
+            else {
+                flow.phase = 'pending';
+                flow.artifact = artifact;
+            }
+            await tx.put('flows', id, flow);
+        });
+    }
     /**
      * One step of a mailed code. The first answer is an address: a code is minted, sent
      * there, and only its hash kept. The second is the code, which the holder could only
@@ -484,7 +579,9 @@ export class VerilyService {
             // A mailbox has no page to point at, so its own address stands in for one.
             new URL(external.profileUrl).protocol !== (external.kind === 'mailbox' ? 'mailto:' : 'https:'))
             throw new Unavailable();
-        await this.transaction(async (tx) => {
+        // The flow as it stands once this account is accepted for it, or a refusal. Asked
+        // twice, because what it is checked against can change while proofs are being read.
+        const accepted = async (tx) => {
             const flow = binding === undefined ? await tx.get('flows', id) : await this.bound(tx, id, binding);
             if (flow?.phase !== 'exchanging')
                 throw new Unavailable();
@@ -499,15 +596,91 @@ export class VerilyService {
                 flow.local = connection.local;
             }
             flow.external = external;
+            return flow;
+        };
+        // The account is named now, so a proof that needs nothing but its name can be read
+        // without the holder choosing that method or handing anything back. Read while the
+        // flow is still exchanging: approval is shown once, and must show all it will record.
+        const shown = await this.transaction(accepted);
+        const standing = ['connect', 'renew'].includes(shown.kind) ? await this.standing(shown) : [];
+        await this.transaction(async (tx) => {
+            const flow = await accepted(tx);
             flow.artifact = artifact;
+            flow.reason = undefined;
             flow.authenticatedAt = this.now();
+            if (standing.length)
+                flow.standing = standing;
             flow.phase = 'approval';
-            await tx.put('flows', id, flow);
+            // Nothing for the holder to decide, so nothing to ask them. The visibility passed is
+            // never read: both of these keep the record's own.
+            if (await this.settled(tx, flow))
+                await this.conclude(tx, flow, 'unlisted');
+            else
+                await tx.put('flows', id, flow);
         });
     }
     /**
-     * A failed check leaves the flow dead rather than retryable in place. Only a `Refused`
-     * reason is kept: any other error may describe this backend rather than the proof.
+     * The proofs already standing for the account a flow just showed, by the other methods
+     * configured for its provider that can tell where to look from the account alone. One
+     * that is not there, or cannot be read, is simply not found: the holder asked for none
+     * of them, so none of them can fail the flow.
+     */
+    async standing(flow) {
+        const shownBy = this.providerOf(flow);
+        const found = [];
+        for (const provider of this.providers) {
+            if (!isArtifactProvider(provider) ||
+                provider.id !== shownBy.id ||
+                provider.method === providerMethod(shownBy) ||
+                provider.artifact !== 'location' ||
+                !provider.expect ||
+                !provider.known)
+                continue;
+            try {
+                const expect = provider.expect(flow.local);
+                const known = provider.known(flow.external);
+                if (!known)
+                    continue;
+                const handed = provider.resolve?.(known) ?? known;
+                const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+                if (!sameAccount(flow.external, external))
+                    continue;
+                found.push({
+                    by: 'provider',
+                    method: provider.method,
+                    confirmedAt: this.now(),
+                    artifactUrl: handed,
+                    expect,
+                });
+            }
+            catch {
+                continue;
+            }
+        }
+        return found;
+    }
+    /** Adds the proofs a flow found standing beneath the method the record was first shown by. */
+    recordStanding(connection, flow) {
+        if (!flow.standing?.length || !connection.attestations)
+            return;
+        const [main, ...rest] = connection.attestations.external;
+        for (const attestation of flow.standing) {
+            // The main method is reread against the id it named, so it is only ever replaced
+            // by a flow that ran it.
+            if (attestation.method === main.method)
+                continue;
+            const at = rest.findIndex((a) => a.method === attestation.method);
+            if (at < 0)
+                rest.push(attestation);
+            else
+                rest[at] = attestation;
+        }
+        connection.attestations = { ...connection.attestations, external: [main, ...rest] };
+    }
+    /**
+     * A sign-in or a mailed code that fails leaves the flow dead: there is nothing in it to
+     * put right, and starting again costs the holder nothing. Only a `Refused` reason is
+     * kept: any other error may describe this backend rather than the proof.
      */
     async failed(id, error) {
         await this.transaction(async (tx) => {
@@ -542,6 +715,26 @@ export class VerilyService {
                 await tx.put('flows', id, flow);
                 return undefined;
             }
+            return this.conclude(tx, flow, visibility, allowed);
+        });
+    }
+    /**
+     * Whether approving a flow would decide anything. A renewal, or another way of showing
+     * an account the subject is already linked to, changes neither who is linked nor who
+     * can read it: the holder asked for exactly this and the account has been checked
+     * against the record, so it is recorded without asking them to say so again.
+     */
+    async settled(tx, flow) {
+        // A flow anyone could have sent the holder's browser into is theirs only once they
+        // approve it, and the approval is a form that only their own page can post.
+        if (!flow.attended)
+            return false;
+        return flow.kind === 'renew' || (flow.kind === 'connect' && !!(await this.joins(tx, flow)));
+    }
+    /** Records what an approved flow does, and ends it. The caller has checked who approves. */
+    async conclude(tx, flow, visibility, allowed) {
+        const id = flow.id;
+        {
             let connection;
             const provider = this.providerOf(flow);
             const joined = flow.kind === 'connect' ? await this.joins(tx, flow) : undefined;
@@ -603,13 +796,15 @@ export class VerilyService {
                     connection.visibilityApprovedAt = this.now();
                 }
             }
+            if (['connect', 'renew'].includes(flow.kind))
+                this.recordStanding(connection, flow);
             await tx.put('connections', connection.id, connection);
             await this.audit(tx, connection.id, flow.kind, ['revoke', 'share-revoke'].includes(flow.kind) ? 'external' : 'local', id, connection.visibility);
             flow.resultId = connection.id;
             await this.ended(tx, flow, 'complete', connection);
             await tx.put('flows', id, flow);
             return connection.id;
-        });
+        }
     }
     /**
      * Ends a flow and records how, inside the transaction that ends it: the connection as it
@@ -1149,6 +1344,8 @@ function profile(url) {
 const dayMs = 86400000;
 /** How many wrong codes a flow takes before it is dead. */
 export const codeAttempts = 5;
+/** How many times a published proof may be refused before its flow is dead. */
+export const artifactAttempts = 5;
 /** Crockford's base 32: no I, L, O or U, so no letter is mistaken for a digit when typed. */
 const codeAlphabet = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
 /**

package/dist/server/youtube.js

@@ -15,7 +15,9 @@ export function youtubeProvider(options) {
         authorizationUrl({ state, challenge, redirectUri }) {
             const url = new URL('https://accounts.google.com/o/oauth2/v2/auth');
             // select_account lets a holder with several Google accounts, or a channel under a
-            // brand account, pick the one they mean rather than whichever is signed in.
+            // brand account, pick the one they mean rather than whichever is signed in. A flow on
+            // a record asks too: a channel is not a Google account, so nothing here can name the
+            // one to use, and the wrong one signed in silently would be refused with no way round.
             url.search = new URLSearchParams({
                 response_type: 'code',
                 client_id: options.clientId,

package/dist/verily.js

@@ -10396,7 +10396,7 @@ ${claims(evidence)}`;
   }
 
   // src/version.ts
-  var version = "v0.1.0";
+  var version = "v0.2.0";
 
   // src/browser/evidence-dialog.ts
   var openDialogs = /* @__PURE__ */ new WeakMap();
@@ -11107,9 +11107,14 @@ ${claims(evidence)}`;
       }, 1e3);
     }
     function publish(flow) {
-      const input = flow.artifact === "document" ? node("textarea") : Object.assign(node("input"), { type: "url" });
+      const input = flow.artifact === "document" ? node("textarea") : Object.assign(node("input"), {
+        type: flow.input ?? "url",
+        autocapitalize: "none",
+        spellcheck: false
+      });
       input.name = "artifact";
       input.required = true;
+      input.value = flow.suggested ?? "";
       if (input instanceof HTMLTextAreaElement) input.rows = 10;
       const label = node("label", flow.field ?? "Your proof");
       label.append(input);
@@ -11127,6 +11132,7 @@ ${claims(evidence)}`;
         ...flow.instructions.map(
           (part) => typeof part === "string" ? node("p", part) : Array.isArray(part) ? paragraph(part) : codeBlock(part.code)
         ),
+        ...flow.refused ? [node("p", flow.refused, "error")] : [],
         label,
         row(back2, check2),
         ...flow.note ? [node("p", flow.note, "muted")] : []
@@ -11234,6 +11240,7 @@ ${claims(evidence)}`;
         }
         parts.push(choice);
       }
+      if (flow.standingNote) parts.push(node("p", flow.standingNote));
       if (methods)
         parts.push(
           node(
@@ -11274,10 +11281,7 @@ ${claims(evidence)}`;
     }
     function done() {
       settle();
-      const finish = button("Done", true);
-      finish.onclick = () => dialog.close();
-      content.replaceChildren(node("p", "The connection is recorded.", "state"), row(finish));
-      finish.focus();
+      dialog.close();
     }
     close.addEventListener("click", () => dialog.close());
     dialog.addEventListener("click", (event) => {

package/dist/version.d.ts

@@ -7,4 +7,4 @@
  * output stays what tsc emitted and nothing has to be substituted into it. A version bump
  * changes this line with package.json.
  */
-export declare const version = "v0.1.0";
+export declare const version = "v0.2.0";

package/dist/version.js

@@ -7,4 +7,4 @@
  * output stays what tsc emitted and nothing has to be substituted into it. A version bump
  * changes this line with package.json.
  */
-export const version = 'v0.1.0';
+export const version = 'v0.2.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bkazemi/verily",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Self-hosted account-to-account verification for Node.js",
   "type": "module",
   "license": "MIT",