@bkazemi/verily 0.3.0 → 0.5.0

package/dist/verily.js

@@ -9575,6 +9575,9 @@ var Verily = (() => {
   __export(browser_exports, {
     Refused: () => Refused,
     attestationLabel: () => attestationLabel,
+    dialogPath: () => dialogPath,
+    dialogRoute: () => dialogRoute,
+    externalId: () => externalId,
     externalLink: () => externalLink,
     externalName: () => externalName,
     fresh: () => fresh,
@@ -9588,6 +9591,9 @@ var Verily = (() => {
     presentConnections: () => presentConnections,
     proofTitle: () => proofTitle,
     providerMethod: () => providerMethod,
+    routeOf: () => routeOf,
+    routePath: () => routePath,
+    routes: () => routes,
     signedBy: () => signedBy,
     status: () => status,
     statusLabel: () => statusLabel,
@@ -9660,6 +9666,50 @@ var Verily = (() => {
     return void 0;
   }
 
+  // src/core/routes.ts
+  var routes = {
+    methods: { method: "GET", path: "/methods" },
+    start: { method: "POST", path: "/sessions" },
+    flow: { method: "GET", path: "/flows/:id", format: "json" },
+    submit: { method: "POST", path: "/flows/:id/submit" },
+    approve: { method: "POST", path: "/flows/:id/approve" },
+    disconnect: { method: "POST", path: "/connections/:id/disconnect", manages: true },
+    mark: { method: "POST", path: "/connections/:id/mark", manages: true },
+    share: { method: "POST", path: "/connections/:id/share", manages: true, dialog: false },
+    shareRevoke: {
+      method: "POST",
+      path: "/connections/:id/share-revoke",
+      manages: true,
+      dialog: false
+    }
+  };
+  var names = Object.keys(routes);
+  function matches(route, path) {
+    const want = route.path.split("/");
+    const got = path.split("/");
+    return want.length === got.length && want.every((part, at2) => part === ":id" ? got[at2] !== "" : part === got[at2]);
+  }
+  function routePath(name, id) {
+    const route = routes[name];
+    const path = route.path.replace(":id", encodeURIComponent(id ?? ""));
+    return route.format ? `${path}?format=${route.format}` : path;
+  }
+  function routeOf(method, path) {
+    return names.find((name) => routes[name].method === method && matches(routes[name], path));
+  }
+  function dialogRoute(method, path, query) {
+    const name = routeOf(method, path);
+    const route = name && routes[name];
+    if (!route || route.dialog === false) return void 0;
+    return !route.format || query.get("format") === route.format ? name : void 0;
+  }
+  function dialogPath(path) {
+    return names.some((name) => {
+      const route = routes[name];
+      return route.dialog !== false && matches(route, path);
+    });
+  }
+
   // src/core/index.ts
   var Refused = class extends Error {
   };
@@ -9709,16 +9759,23 @@ var Verily = (() => {
   function externalName(external) {
     return external.kind === void 0 || external.kind === "account" ? `@${external.handle.replace(/^@/, "")}` : external.handle;
   }
-  function attestationLabel(method, names) {
+  function attestationLabel(method, names2, proof = {}) {
+    const dnssec = proof.dnssec ? ", validated by DNSSEC" : "";
     return {
-      declared: `Stated by ${names.site}`,
-      oauth: `Signed in with ${names.provider}`,
-      gist: `Published a proof on ${names.provider}`,
-      backlink: `Linked back to ${names.site}`,
+      // A site's word carries a proof only where its own DNS was read naming this verifier.
+      declared: proof.artifactUrl ? `Stated by ${names2.site}, whose DNS names this verifier${dnssec}` : `Stated by ${names2.site}`,
+      oauth: `Signed in with ${names2.provider}`,
+      gist: `Published a proof on ${names2.provider}`,
+      backlink: `Linked back to ${names2.site}`,
+      dns: `Published a proof in its DNS${dnssec}`,
+      wellknown: "Published a proof in a file it serves",
       signature: "Proved with a signature",
       code: "Entered a code sent to this address"
     }[method];
   }
+  function externalId(external) {
+    return external.kind === "mailbox" || external.kind === "domain" ? void 0 : external.id;
+  }
   function externalLink(external) {
     return external.kind === "mailbox" ? void 0 : external.profileUrl;
   }
@@ -9882,7 +9939,7 @@ var Verily = (() => {
       openpgp: key,
       email: envelope
     };
-    return marks2[provider]?.() ?? (method === "backlink" ? globe() : void 0);
+    return marks2[provider]?.() ?? (["backlink", "dns", "wellknown"].includes(method ?? "") ? globe() : void 0);
   }
 
   // src/browser/badge.ts
@@ -10428,7 +10485,7 @@ ${claims(evidence)}`;
   }
 
   // src/version.ts
-  var version = "v0.3.0";
+  var version = "v0.5.0";
 
   // src/browser/evidence-dialog.ts
   function stampLink() {
@@ -10529,8 +10586,8 @@ ${claims(evidence)}`;
     }
     return svg;
   }
-  function attestationNote(attestation, names, additional = false) {
-    const label = attestationLabel(attestation.method, names);
+  function attestationNote(attestation, names2, additional = false) {
+    const label = attestationLabel(attestation.method, names2, attestation);
     if (!label) return [];
     const note = node("div", additional ? "+ " : "", `muted ${additional ? "additional" : "method"}`);
     if (!attestation.artifactUrl) {
@@ -10730,21 +10787,21 @@ ${claims(evidence)}`;
     for (const [label, time] of dateRows) {
       dates.append(node("dt", label), node("dd", moment(time)));
     }
-    const names = { site: evidence.siteName, provider };
+    const names2 = { site: evidence.siteName, provider };
     const logo2 = providerMark(evidence.provider, evidence.attestations.external[0].method);
     const card = accountCard(
       // The mark and the name, or just the name. A mark that falls back to writing the name
       // would print it twice here, since this heading writes it either way.
       logo2 ? [logo2, document.createTextNode(provider)] : [document.createTextNode(provider)],
       externalName(evidence.external),
-      // A mailbox's address is its name already, so there is no second identifier.
-      evidence.external.kind === "mailbox" ? void 0 : evidence.external.id,
+      // A mailbox's address or a domain is its name already, so there is no second identifier.
+      externalId(evidence.external),
       externalLink(evidence.external),
       // Status first, then how it was shown, then when. The proof explains the state
       // above it, so it cannot sit before that state has been given.
       summary,
-      ...attestationNote(main, names),
-      ...evidence.attestations.external.slice(1).flatMap((a2) => attestationNote(a2, names, true)),
+      ...attestationNote(main, names2),
+      ...evidence.attestations.external.slice(1).flatMap((a2) => attestationNote(a2, names2, true)),
       ...evidence.status === "revoked" || retired ? [] : evidence.mark === "preferred" ? [node("div", "Preferred", "listing preferred")] : evidence.mark === "unused" ? [node("div", "No longer used", "listing")] : [],
       dates,
       ...manage && removable(evidence).length ? [manageRow(evidence, manage)] : []
@@ -11353,7 +11410,7 @@ ${claims(evidence)}`;
       const external = accountCard(
         logo2 ? [logo2, document.createTextNode(flow.provider.name)] : [document.createTextNode(flow.provider.name)],
         externalName(flow.external),
-        flow.external.kind === "mailbox" ? void 0 : flow.external.id,
+        externalId(flow.external),
         externalLink(flow.external)
       );
       const parts = [subjectCard(flow.local), linkMark(), external];
@@ -11588,7 +11645,7 @@ ${claims(evidence)}`;
   function init({ backendUrl, handoffUrl }) {
     const base = new URL(backendUrl, location.href);
     if (!["https:", "http:"].includes(base.protocol)) throw new Error("Invalid backend URL");
-    base.pathname = base.pathname.replace(/\/$/, "");
+    const root = base.href.replace(/\/$/, "");
     const remote = base.origin !== location.origin;
     const bindings = /* @__PURE__ */ new Map();
     let session;
@@ -11601,7 +11658,7 @@ ${claims(evidence)}`;
       const vouched = handed.ok ? await handed.json() : void 0;
       if (!record(vouched) || typeof vouched.token !== "string")
         throw new Error("Verily request unavailable");
-      const traded = await fetch(`${base.href}/site/session`, {
+      const traded = await fetch(`${root}/site/session`, {
         method: "POST",
         credentials: "omit",
         cache: "no-store",
@@ -11616,11 +11673,12 @@ ${claims(evidence)}`;
     async function ask(path, data, flow) {
       if (!remote) return request(path, data);
       const binding = flow && bindings.get(flow);
-      const response = await fetch(`${base.href}${path}`, {
+      const response = await fetch(`${root}${path}`, {
         credentials: "omit",
         cache: "no-store",
         method: data ? "POST" : "GET",
         headers: {
+          Accept: "application/json",
           Authorization: `Bearer ${await (session ??= openSession())}`,
           ...binding ? { "X-Verily-Flow": binding } : {},
           ...data ? { "Content-Type": "application/json" } : {}
@@ -11634,21 +11692,23 @@ ${claims(evidence)}`;
       return answer;
     }
     async function request(path, data) {
-      const response = await fetch(`${base.href}${path}`, {
+      const response = await fetch(`${root}${path}`, {
         credentials: "same-origin",
         cache: "no-store",
-        ...data ? {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify(data)
-        } : {}
+        // Says what is wanted back, whatever is sent. A header any page may send to another
+        // origin without asking first, so a badge on a static site reads as it did.
+        headers: {
+          Accept: "application/json",
+          ...data ? { "Content-Type": "application/json" } : {}
+        },
+        ...data ? { method: "POST", body: JSON.stringify(data) } : {}
       });
       if (!response.ok) throw new Error("Verily request unavailable");
       return response.json();
     }
     const flows = {
       async methods() {
-        const data = await ask("/methods");
+        const data = await ask(routePath("methods"));
         if (!record(data) || !record(data.local) || !Array.isArray(data.methods))
           throw new Error("Invalid methods response");
         if (typeof data.local.profileUrl === "string") safeUrl(data.local.profileUrl);
@@ -11656,15 +11716,15 @@ ${claims(evidence)}`;
       },
       start: async (provider, method, renew) => flowView(
         await ask(
-          "/sessions",
+          routePath("start"),
           renew ? { kind: "renew", connectionId: renew, provider, method } : { kind: "connect", provider, method }
         )
       ),
-      read: async (id) => flowView(await ask(`/flows/${encodeURIComponent(id)}?format=json`, void 0, id)),
-      submit: async (id, artifact) => flowView(await ask(`/flows/${encodeURIComponent(id)}/submit`, { artifact }, id)),
+      read: async (id) => flowView(await ask(routePath("flow", id), void 0, id)),
+      submit: async (id, artifact) => flowView(await ask(routePath("submit", id), { artifact }, id)),
       async approve(id, visibility, cancel) {
         const data = await ask(
-          `/flows/${encodeURIComponent(id)}/approve`,
+          routePath("approve", id),
           { action: cancel ? "cancel" : "approve", visibility },
           id
         );
@@ -11694,7 +11754,7 @@ ${claims(evidence)}`;
             );
           };
           window.addEventListener("message", receive);
-          popup.location.href = `${base.href}/site/enter`;
+          popup.location.href = `${root}/site/enter`;
         }
       } : {}
     };
@@ -11718,7 +11778,7 @@ ${claims(evidence)}`;
         pill.setAttribute("aria-haspopup", "dialog");
         pill.onclick = async () => {
           if (typeof HTMLDialogElement === "undefined" && !remote) {
-            location.href = `${base.href}/verify`;
+            location.href = `${root}/verify`;
             return;
           }
           const result = await client.openConnect(element);
@@ -11833,7 +11893,7 @@ ${claims(evidence)}`;
       },
       disconnect(id) {
         if (remote) session = void 0;
-        return ask(`/connections/${encodeURIComponent(id)}/disconnect`, {});
+        return ask(routePath("disconnect", id), {});
       },
       /**
        * Says how the holder would have an account listed, or retires it. Names one record
@@ -11841,10 +11901,10 @@ ${claims(evidence)}`;
        */
       mark(id, as2) {
         if (remote) session = void 0;
-        return ask(`/connections/${encodeURIComponent(id)}/mark`, { as: as2 });
+        return ask(routePath("mark", id), { as: as2 });
       },
-      issueShare: (id) => request(`/connections/${encodeURIComponent(id)}/share`, {}),
-      revokeShare: (id) => request(`/connections/${encodeURIComponent(id)}/share-revoke`, {})
+      issueShare: (id) => request(routePath("share", id), {}),
+      revokeShare: (id) => request(routePath("shareRevoke", id), {})
     };
     return client;
   }
@@ -11893,7 +11953,7 @@ ${claims(evidence)}`;
   }
   function validAttestation(attestation) {
     if (!record(attestation)) return false;
-    return ["backend", "provider"].includes(String(attestation.by)) && typeof attestation.method === "string" && typeof attestation.confirmedAt === "number" && Number.isFinite(attestation.confirmedAt) && (attestation.expect === void 0 || typeof attestation.expect === "string") && // Rendered as a link later, so only http(s) may ever reach an href.
+    return ["backend", "provider"].includes(String(attestation.by)) && typeof attestation.method === "string" && typeof attestation.confirmedAt === "number" && Number.isFinite(attestation.confirmedAt) && (attestation.expect === void 0 || typeof attestation.expect === "string") && (attestation.dnssec === void 0 || typeof attestation.dnssec === "boolean") && // Rendered as a link later, so only http(s) may ever reach an href.
     (attestation.artifactUrl === void 0 || httpUrl2(attestation.artifactUrl));
   }
   function httpUrl2(value) {
@@ -11914,7 +11974,7 @@ ${claims(evidence)}`;
       (k2) => typeof value.external[k2] === "string"
     ) && (value.local.profileUrl === void 0 || typeof value.local.profileUrl === "string") && // A signed record lives beside the record it was made from and nowhere else, since the
     // keys it is checked against are read from where the record lives.
-    (value.signedUrl === void 0 || value.signedUrl === `${value.evidenceUrl}?format=signed`) && validAttestations(value.attestations) && (value.local.kind === void 0 || typeof value.local.kind === "string") && (value.external.kind === void 0 || ["account", "key", "page", "mailbox"].includes(String(value.external.kind))) && (value.revokedAt === void 0 || typeof value.revokedAt === "number" && Number.isFinite(value.revokedAt)) && ["verified", "unconfirmed", "expired", "retired", "revoked"].includes(String(value.status)) && // A retired record stands on its dates, so one that does not say when is not one.
+    (value.signedUrl === void 0 || value.signedUrl === `${value.evidenceUrl}?format=signed`) && validAttestations(value.attestations) && (value.local.kind === void 0 || typeof value.local.kind === "string") && (value.external.kind === void 0 || ["account", "key", "page", "mailbox", "domain"].includes(String(value.external.kind))) && (value.revokedAt === void 0 || typeof value.revokedAt === "number" && Number.isFinite(value.revokedAt)) && ["verified", "unconfirmed", "expired", "retired", "revoked"].includes(String(value.status)) && // A retired record stands on its dates, so one that does not say when is not one.
     (value.status === "retired" ? typeof value.retiredAt === "number" && Number.isFinite(value.retiredAt) : value.retiredAt === void 0) && (value.mark === void 0 || ["preferred", "unused"].includes(String(value.mark))) && ["public", "unlisted"].includes(String(value.visibility)) && (value.connectedAt === void 0 || typeof value.connectedAt === "number" && Number.isFinite(value.connectedAt)) && ["authenticatedAt", "approvedAt", "expiresAt"].every(
       (k2) => typeof value[k2] === "number" && Number.isFinite(value[k2])
     );

package/dist/version.d.ts

@@ -7,4 +7,4 @@
  * output stays what tsc emitted and nothing has to be substituted into it. A version bump
  * changes this line with package.json.
  */
-export declare const version = "v0.3.0";
+export declare const version = "v0.5.0";

package/dist/version.js

@@ -7,4 +7,4 @@
  * output stays what tsc emitted and nothing has to be substituted into it. A version bump
  * changes this line with package.json.
  */
-export const version = 'v0.3.0';
+export const version = 'v0.5.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bkazemi/verily",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Self-hosted account-to-account verification for Node.js",
   "type": "module",
   "license": "MIT",