@bkazemi/verily 0.4.0 → 0.6.0

package/dist/browser/index.js

@@ -1,6 +1,8 @@
+import { accountsOf } from '../core/index.js';
+import { routePath } from '../core/routes.js';
 import { badgeShown, quietBadge, renderBadge, renderBadgeMessage, renderBadgePending, renderConnectPill, } from './badge.js';
 import { openConnectDialog, } from './connect-dialog.js';
-import { openEvidenceDialog } from './evidence-dialog.js';
+import { openEvidenceDialog, subjectUrl, } from './evidence-dialog.js';
 import { drawSignedWith, standing, watchSigned } from './signed.js';
 /**
  * What each host's dialog opens on and how it reads again, kept apart from the pill: the
@@ -90,15 +92,17 @@ function details(element) {
                         throw error;
                 }
             }
-        }, latestGroup.get(element), accounts, managers.get(element));
+        }, latestGroup.get(element), accounts, managers.get(element), openHosts.has(element));
     }
 }
 /**
- * Hosts whose pill is stacked, and hosts whose pill opens no panel, where the page asked
- * for either. Kept here so every later refresh of the host draws it the same way.
+ * Hosts whose pill is stacked, hosts whose pill opens no panel, and hosts whose dialog
+ * starts with its details open, where the page asked for any of them. Kept here so every
+ * later refresh of the host draws it the same way.
  */
 const stackedHosts = new WeakSet();
 const quietHosts = new WeakSet();
+const openHosts = new WeakSet();
 /**
  * How many accounts a pill names before it counts the rest. A stacked pill pays for each
  * row in the page's height. A panel floats over the page and pays nothing, but it cannot
@@ -107,7 +111,11 @@ const quietHosts = new WeakSet();
 const stackedAccounts = 4;
 const peekedAccounts = 8;
 /** Records how a host's pill is arranged, from what the page last said. */
-function arrange(element, { stacked, peek }) {
+function arrange(element, { stacked, peek, detailsOpen }) {
+    if (detailsOpen)
+        openHosts.add(element);
+    else
+        openHosts.delete(element);
     if (stacked)
         stackedHosts.add(element);
     else
@@ -132,45 +140,16 @@ const live = (evidence) => evidence.status === 'verified' && evidence.expiresAt
  * Each entry names every record of the account not yet revoked, shown or not, so removing
  * the account removes them all. One left behind, lapsed or unconfirmed, could be confirmed
  * again later and bring the account back without its holder approving anything.
- *
- * A record from a backend older than `connectedAt` is placed by when it was approved.
  */
 function accounts(records) {
-    const when = (e) => e.connectedAt ?? e.approvedAt;
-    const byAccount = new Map();
-    for (const record of records) {
-        const key = JSON.stringify([record.provider, record.external.id]);
-        byAccount.set(key, [...(byAccount.get(key) ?? []), record]);
-    }
-    return [...byAccount.values()]
-        .map((held) => {
-        const sorted = [...held].sort((a, b) => when(a) - when(b));
-        const verified = sorted.filter(live);
-        const base = verified[0] ?? sorted.reduce((a, b) => (b.approvedAt > a.approvedAt ? b : a));
-        const external = [...base.attestations.external];
-        for (const other of verified.slice(1))
-            for (const attestation of other.attestations.external)
-                if (!external.some((shown) => shown.method === attestation.method))
-                    external.push(attestation);
-        return {
-            ...base,
-            connectedAt: when(sorted[0]),
-            attestations: { ...base.attestations, external },
-            links: sorted.filter((e) => e.status !== 'revoked').map((e) => e.id),
-            // Every record the card speaks for, so its signature mark answers for all of them.
-            sources: verified.length ? verified : [base],
-        };
-    })
-        .sort((a, b) => place(a) - place(b) || a.connectedAt - b.connectedAt);
-}
-/**
- * Where an account is listed among a subject's others, before the order they were
- * connected in. This is all there is to preferring an account: there is no separate pin.
- */
-function place(account) {
-    if (account.status === 'retired')
-        return 3;
-    return account.mark === 'preferred' ? 0 : account.mark === 'unused' ? 2 : 1;
+    return accountsOf(records, Date.now()).map(({ lead, held, verified, external, connectedAt }) => ({
+        ...lead,
+        connectedAt,
+        attestations: { ...lead.attestations, external },
+        links: held.filter((e) => e.status !== 'revoked').map((e) => e.id),
+        // Every record the card speaks for, so its signature mark answers for all of them.
+        sources: verified.length ? verified : [lead],
+    }));
 }
 /**
  * One subject's accounts as a single pill: the first of them, then how many more stand
@@ -197,6 +176,8 @@ function presentGroup(element, records, load) {
     const badge = renderBadge(element, lead, {
         more: Math.max(verified.length - 1, 0),
         linked: lead.visibility === 'public',
+        // A modified click follows the link, and must reach what a plain one shows: every account.
+        ...(ordered.length > 1 ? { href: subjectUrl(lead) } : {}),
         rows: stacked
             ? verified.slice(1, stackedAccounts)
             : peek
@@ -249,7 +230,10 @@ export function init({ backendUrl, handoffUrl }) {
     const base = new URL(backendUrl, location.href);
     if (!['https:', 'http:'].includes(base.protocol))
         throw new Error('Invalid backend URL');
-    base.pathname = base.pathname.replace(/\/$/, '');
+    // Where the backend's routes begin, with no slash to end it: a backend mounted at the
+    // root of its origin has a path of `/` however it is written, and its routes are not
+    // under `//`.
+    const root = base.href.replace(/\/$/, '');
     /**
      * A backend on another origin: an instance this site is registered with. Its cookies
      * are another site's on this page, so the dialog carries what they would have. The
@@ -268,7 +252,7 @@ export function init({ backendUrl, handoffUrl }) {
         const vouched = handed.ok ? await handed.json() : undefined;
         if (!record(vouched) || typeof vouched.token !== 'string')
             throw new Error('Verily request unavailable');
-        const traded = await fetch(`${base.href}/site/session`, {
+        const traded = await fetch(`${root}/site/session`, {
             method: 'POST',
             credentials: 'omit',
             cache: 'no-store',
@@ -285,11 +269,12 @@ export function init({ backendUrl, handoffUrl }) {
         if (!remote)
             return request(path, data);
         const binding = flow && bindings.get(flow);
-        const response = await fetch(`${base.href}${path}`, {
+        const response = await fetch(`${root}${path}`, {
             credentials: 'omit',
             cache: 'no-store',
             method: data ? 'POST' : 'GET',
             headers: {
+                Accept: 'application/json',
                 Authorization: `Bearer ${await (session ??= openSession())}`,
                 ...(binding ? { 'X-Verily-Flow': binding } : {}),
                 ...(data ? { 'Content-Type': 'application/json' } : {}),
@@ -306,16 +291,16 @@ export function init({ backendUrl, handoffUrl }) {
         return answer;
     }
     async function request(path, data) {
-        const response = await fetch(`${base.href}${path}`, {
+        const response = await fetch(`${root}${path}`, {
             credentials: 'same-origin',
             cache: 'no-store',
-            ...(data
-                ? {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify(data),
-                }
-                : {}),
+            // Says what is wanted back, whatever is sent. A header any page may send to another
+            // origin without asking first, so a badge on a static site reads as it did.
+            headers: {
+                Accept: 'application/json',
+                ...(data ? { 'Content-Type': 'application/json' } : {}),
+            },
+            ...(data ? { method: 'POST', body: JSON.stringify(data) } : {}),
         });
         if (!response.ok)
             throw new Error('Verily request unavailable');
@@ -324,20 +309,20 @@ export function init({ backendUrl, handoffUrl }) {
     /** The connect flow as the dialog drives it, every answer checked before it is drawn. */
     const flows = {
         async methods() {
-            const data = await ask('/methods');
+            const data = await ask(routePath('methods'));
             if (!record(data) || !record(data.local) || !Array.isArray(data.methods))
                 throw new Error('Invalid methods response');
             if (typeof data.local.profileUrl === 'string')
                 safeUrl(data.local.profileUrl);
             return data;
         },
-        start: async (provider, method, renew) => flowView(await ask('/sessions', renew
+        start: async (provider, method, renew) => flowView(await ask(routePath('start'), renew
             ? { kind: 'renew', connectionId: renew, provider, method }
             : { kind: 'connect', provider, method })),
-        read: async (id) => flowView(await ask(`/flows/${encodeURIComponent(id)}?format=json`, undefined, id)),
-        submit: async (id, artifact) => flowView(await ask(`/flows/${encodeURIComponent(id)}/submit`, { artifact }, id)),
+        read: async (id) => flowView(await ask(routePath('flow', id), undefined, id)),
+        submit: async (id, artifact) => flowView(await ask(routePath('submit', id), { artifact }, id)),
         async approve(id, visibility, cancel) {
-            const data = await ask(`/flows/${encodeURIComponent(id)}/approve`, { action: cancel ? 'cancel' : 'approve', visibility }, id);
+            const data = await ask(routePath('approve', id), { action: cancel ? 'cancel' : 'approve', visibility }, id);
             if (!record(data))
                 throw new Error('Invalid approval response');
             return data.outcome === 'complete' && typeof data.connectionId === 'string'
@@ -368,7 +353,7 @@ export function init({ backendUrl, handoffUrl }) {
                         }, base.origin);
                     };
                     window.addEventListener('message', receive);
-                    popup.location.href = `${base.href}/site/enter`;
+                    popup.location.href = `${root}/site/enter`;
                 },
             }
             : {}),
@@ -396,7 +381,7 @@ export function init({ backendUrl, handoffUrl }) {
             pill.setAttribute('aria-haspopup', 'dialog');
             pill.onclick = async () => {
                 if (typeof HTMLDialogElement === 'undefined' && !remote) {
-                    location.href = `${base.href}/verify`;
+                    location.href = `${root}/verify`;
                     return;
                 }
                 const result = await client.openConnect(element);
@@ -546,7 +531,7 @@ export function init({ backendUrl, handoffUrl }) {
             // On another origin this is vouched for afresh, as each opening of the dialog is.
             if (remote)
                 session = undefined;
-            return ask(`/connections/${encodeURIComponent(id)}/disconnect`, {});
+            return ask(routePath('disconnect', id), {});
         },
         /**
          * Says how the holder would have an account listed, or retires it. Names one record
@@ -555,10 +540,10 @@ export function init({ backendUrl, handoffUrl }) {
         mark(id, as) {
             if (remote)
                 session = undefined;
-            return ask(`/connections/${encodeURIComponent(id)}/mark`, { as });
+            return ask(routePath('mark', id), { as });
         },
-        issueShare: (id) => request(`/connections/${encodeURIComponent(id)}/share`, {}),
-        revokeShare: (id) => request(`/connections/${encodeURIComponent(id)}/share-revoke`, {}),
+        issueShare: (id) => request(routePath('share', id), {}),
+        revokeShare: (id) => request(routePath('shareRevoke', id), {}),
     };
     return client;
 }
@@ -643,6 +628,7 @@ function validAttestation(attestation) {
         typeof attestation.confirmedAt === 'number' &&
         Number.isFinite(attestation.confirmedAt) &&
         (attestation.expect === undefined || typeof attestation.expect === 'string') &&
+        (attestation.dnssec === undefined || typeof attestation.dnssec === 'boolean') &&
         // Rendered as a link later, so only http(s) may ever reach an href.
         (attestation.artifactUrl === undefined || httpUrl(attestation.artifactUrl)));
 }
@@ -723,6 +709,7 @@ if (typeof customElements !== 'undefined' && !customElements.get('verily-badge')
             'connect',
             'stacked',
             'peek',
+            'details-open',
         ];
         handed;
         /**
@@ -782,6 +769,7 @@ if (typeof customElements !== 'undefined' && !customElements.get('verily-badge')
             const arrangement = {
                 stacked: this.getAttribute('stacked') !== null,
                 peek: this.getAttribute('peek') !== 'off',
+                detailsOpen: this.getAttribute('details-open') !== null,
             };
             // The holder's own badge, where the page says so: its dialog connects another
             // account, renews one and removes one, through the backend named. The host hears

package/dist/core/index.d.ts

@@ -76,9 +76,24 @@ export interface Attestation {
     hosted?: boolean;
     /** What a reader should expect to find at artifactUrl, such as a challenge token. */
     expect?: string;
+    /**
+     * Set where the method publishes something of the subject's, as its address, and this
+     * subject had nothing for it to publish: `expect` is then a string minted for the holder
+     * and names nobody. Such a proof holds whatever the subject's address becomes, where one
+     * that published an address is a proof of that address alone.
+     */
+    minted?: boolean;
+    /**
+     * Set where the proof was read from DNS and the resolver said it had validated the answer
+     * with DNSSEC. Without it the answer is only as good as the resolver's own lookup, which
+     * somebody on the path between it and the domain's name servers could have answered.
+     */
+    dnssec?: boolean;
     /**
      * When this side was last confirmed. For `declared` and `oauth` that is the moment it
      * was established; artifact methods drift out of date and are reconfirmed on a schedule.
+     * A `declared` side that carries a proof is the site's own DNS naming this verifier, and
+     * is reconfirmed like any other.
      */
     confirmedAt: number;
 }
@@ -143,6 +158,15 @@ export interface Flow {
      * unguessable and per-flow, so an artifact made for one flow cannot complete another.
      */
     expect?: string;
+    /** Whether `expect` was minted for a method that had nothing of the subject's to state. */
+    minted?: boolean;
+    /** Whether the proof was read from a DNS answer the resolver validated with DNSSEC. */
+    dnssec?: boolean;
+    /**
+     * How the local side is recorded once the flow is approved, where the site's own DNS was
+     * found to name this verifier. Absent means the site's word alone.
+     */
+    stated?: Attestation;
     /**
      * What the holder handed back: an address to read, or the proof itself. On a flow still
      * waiting it is what they last handed back and had refused, kept so they can put it right.
@@ -232,12 +256,26 @@ export interface Limit {
     count: number;
     expiresAt: number;
 }
+/**
+ * When a site's DNS was last asked whether it names this verifier, by the maintenance run
+ * and nothing else. It is what orders the sites in a run, so it is kept for as long as the
+ * site has a record here and never expires by itself: an order that could lapse would
+ * start again from the same few sites.
+ */
+export interface SiteRead {
+    /** The site's domain. */
+    id: string;
+    readAt: number;
+    /** Whether that read got an answer. One that did not is asked again sooner. */
+    answered: boolean;
+}
 export interface Records {
     connections: Connection;
     flows: Flow;
     shares: Share;
     audit: Audit;
     limits: Limit;
+    sites: SiteRead;
 }
 export interface Transaction {
     get<K extends keyof Records>(kind: K, id: string): Promise<Records[K] | undefined>;
@@ -288,9 +326,18 @@ export interface ArtifactProvider {
      * says the far side points at this exact subject, so the subject's own address is the
      * whole of what is proved and a per-flow token could not be part of it. Absent means the
      * backend mints an unguessable string instead, which is what a method wants when any
-     * fresh artifact will do. Throw when the subject cannot be proved this way at all.
+     * fresh artifact will do. So does returning nothing, for a subject that gives the method
+     * nothing to state: one with no address has no address to point at. Throw when the
+     * subject cannot be proved this way at all.
      */
-    expect?(local: LocalAccount): string;
+    expect?(local: LocalAccount): string | undefined;
+    /**
+     * Words the string the backend mints, given its unguessable part. The default names the
+     * site, so the holder can see what they are agreeing to before they publish. A method
+     * that publishes where anyone can look without being told where, as DNS is, may not want
+     * the site said there at all.
+     */
+    mint?(secret: string): string;
     /**
      * Where the proof lives. `location` means the holder publishes it somewhere only they
      * can write and hands back an address, so the address is half of what is proved.
@@ -333,6 +380,14 @@ export interface ArtifactProvider {
         artifact: string;
         expect: string;
     }): Promise<ExternalAccount>;
+    /**
+     * The same check, for a method that learns more than whose the proof is. Where a method
+     * has one, this is what the backend calls, and `verify` gives the account it found.
+     */
+    prove?(input: {
+        artifact: string;
+        expect: string;
+    }): Promise<Proved>;
     /**
      * Whether the holder has since withdrawn the identity itself, wherever such a statement
      * is published. This revokes the connection, so it must be something the holder stated
@@ -340,6 +395,12 @@ export interface ArtifactProvider {
      */
     withdrawn?(account: ExternalAccount, artifact: string): Promise<boolean>;
 }
+/** Whose a proof is, with what the method learned of how far the read can be trusted. */
+export interface Proved {
+    account: ExternalAccount;
+    /** Whether the DNS answer the proof was read from was validated with DNSSEC. */
+    dnssec?: boolean;
+}
 /**
  * Proves control by sending a message somewhere only the holder can read and having them
  * answer it: by pressing the link it carries, or by reading its code back. It is
@@ -457,6 +518,7 @@ export interface Evidence {
     signedUrl?: string;
 }
 export * from './signed.js';
+export * from './routes.js';
 /**
  * How long a published proof stays good without being read again. An artifact method is
  * only true while the artifact is still there, and the holder can delete it without
@@ -485,6 +547,29 @@ export declare function lastProved(evidence: Pick<Evidence, 'authenticatedAt' |
  * that has run out since reads as expired whatever status it was issued with.
  */
 export declare function statusLabel(evidence: Pick<Evidence, 'status' | 'expiresAt'>, now: number): string;
+/**
+ * Where an account is listed among a subject's others, before the order they were
+ * connected in. This is all there is to preferring an account: there is no separate pin.
+ */
+export declare function place(account: Pick<Evidence, 'status' | 'mark'>): number;
+/**
+ * One subject's records as its accounts, in the order they are listed everywhere: the
+ * preferred one, then the rest as first connected, then those unused, then those retired.
+ * Records are not accounts: the same account can stand on several. `held` is every record
+ * of the account, earliest first, and `verified` those of them that stand now. `lead`
+ * speaks for the account: the earliest that stands, or else the latest approved, which
+ * says what became of it. `external` is how the account was shown: the lead's methods,
+ * then any other its standing records add.
+ *
+ * A record from a backend older than `connectedAt` is placed by when it was approved.
+ */
+export declare function accountsOf(records: Evidence[], now: number): {
+    lead: Evidence;
+    held: Evidence[];
+    verified: Evidence[];
+    external: Attestations['external'];
+    connectedAt: number;
+}[];
 /**
  * What to call a link's local side, and what to write as its value. When the site itself is
  * what was linked there is no subject on it to name, so the site is the value rather than a
@@ -510,17 +595,23 @@ export declare function externalName(external: ExternalAccount): string;
  * judgement, which is the reason for publishing it rather than a verdict about it.
  *
  * An unrecognised method returns nothing, so a renderer omits the line instead of
- * describing a proof it does not understand.
+ * describing a proof it does not understand. Given the attestation, the words also say
+ * what its proof adds: that a DNS answer was validated, or that a site's DNS was read.
  */
 export declare function attestationLabel(method: string, names: {
     site: string;
     provider: string;
-}): string | undefined;
+}, proof?: Pick<Attestation, 'artifactUrl' | 'dnssec'>): string | undefined;
 /**
  * A subject's second identifier, shown beneath its name, or nothing where the name is
  * already all of it: a mailbox's address and a domain are each their own id.
  */
 export declare function externalId(external: ExternalAccount): string | undefined;
+/**
+ * A key's fingerprint in groups of four, as gpg prints it, so a renderer can break the line
+ * between groups. Nothing for any other subject, whose id is written as it stands.
+ */
+export declare function externalIdGroups(external: ExternalAccount): string[] | undefined;
 /**
  * Where a subject's name may link, or nothing where it has no page of its own. A mailbox's
  * address is `mailto:`, which opens a message to it and shows a reader nothing.

package/dist/core/index.js

@@ -21,6 +21,7 @@ export function providerMethod(provider) {
     return provider.method ?? 'oauth';
 }
 export * from './signed.js';
+export * from './routes.js';
 /**
  * How long a published proof stays good without being read again. An artifact method is
  * only true while the artifact is still there, and the holder can delete it without
@@ -78,6 +79,47 @@ export function statusLabel(evidence, now) {
         return 'Expired';
     return evidence.status === 'unconfirmed' ? 'Unconfirmed' : 'Verified';
 }
+/**
+ * Where an account is listed among a subject's others, before the order they were
+ * connected in. This is all there is to preferring an account: there is no separate pin.
+ */
+export function place(account) {
+    if (account.status === 'retired')
+        return 3;
+    return account.mark === 'preferred' ? 0 : account.mark === 'unused' ? 2 : 1;
+}
+/**
+ * One subject's records as its accounts, in the order they are listed everywhere: the
+ * preferred one, then the rest as first connected, then those unused, then those retired.
+ * Records are not accounts: the same account can stand on several. `held` is every record
+ * of the account, earliest first, and `verified` those of them that stand now. `lead`
+ * speaks for the account: the earliest that stands, or else the latest approved, which
+ * says what became of it. `external` is how the account was shown: the lead's methods,
+ * then any other its standing records add.
+ *
+ * A record from a backend older than `connectedAt` is placed by when it was approved.
+ */
+export function accountsOf(records, now) {
+    const when = (e) => e.connectedAt ?? e.approvedAt;
+    const byAccount = new Map();
+    for (const record of records) {
+        const key = JSON.stringify([record.provider, record.external.id]);
+        byAccount.set(key, [...(byAccount.get(key) ?? []), record]);
+    }
+    return [...byAccount.values()]
+        .map((unsorted) => {
+        const held = [...unsorted].sort((a, b) => when(a) - when(b));
+        const verified = held.filter((e) => e.status === 'verified' && e.expiresAt > now);
+        const lead = verified[0] ?? held.reduce((a, b) => (b.approvedAt > a.approvedAt ? b : a));
+        const external = [...lead.attestations.external];
+        for (const other of verified.slice(1))
+            for (const attestation of other.attestations.external)
+                if (!external.some((shown) => shown.method === attestation.method))
+                    external.push(attestation);
+        return { lead, held, verified, external, connectedAt: when(held[0]) };
+    })
+        .sort((a, b) => place(a.lead) - place(b.lead) || a.connectedAt - b.connectedAt);
+}
 /**
  * What to call a link's local side, and what to write as its value. When the site itself is
  * what was linked there is no subject on it to name, so the site is the value rather than a
@@ -113,16 +155,21 @@ export function externalName(external) {
  * judgement, which is the reason for publishing it rather than a verdict about it.
  *
  * An unrecognised method returns nothing, so a renderer omits the line instead of
- * describing a proof it does not understand.
+ * describing a proof it does not understand. Given the attestation, the words also say
+ * what its proof adds: that a DNS answer was validated, or that a site's DNS was read.
  */
-export function attestationLabel(method, names) {
+export function attestationLabel(method, names, proof = {}) {
+    const dnssec = proof.dnssec ? ', validated by DNSSEC' : '';
     return {
-        declared: `Stated by ${names.site}`,
+        // A site's word carries a proof only where its own DNS was read naming this verifier.
+        declared: proof.artifactUrl
+            ? `Stated by ${names.site}, whose DNS names this verifier${dnssec}`
+            : `Stated by ${names.site}`,
         oauth: `Signed in with ${names.provider}`,
         gist: `Published a proof on ${names.provider}`,
         backlink: `Linked back to ${names.site}`,
-        dns: `Named ${names.site} in a DNS record`,
-        wellknown: `Named ${names.site} in a file it serves`,
+        dns: `Published a proof in its DNS${dnssec}`,
+        wellknown: 'Published a proof in a file it serves',
         signature: 'Proved with a signature',
         code: 'Entered a code sent to this address',
     }[method];
@@ -134,6 +181,13 @@ export function attestationLabel(method, names) {
 export function externalId(external) {
     return external.kind === 'mailbox' || external.kind === 'domain' ? undefined : external.id;
 }
+/**
+ * A key's fingerprint in groups of four, as gpg prints it, so a renderer can break the line
+ * between groups. Nothing for any other subject, whose id is written as it stands.
+ */
+export function externalIdGroups(external) {
+    return external.kind === 'key' ? (external.id.match(/.{1,4}/g) ?? undefined) : undefined;
+}
 /**
  * Where a subject's name may link, or nothing where it has no page of its own. A mailbox's
  * address is `mailto:`, which opens a message to it and shows a reader nothing.

package/dist/core/routes.d.ts

@@ -0,0 +1,57 @@
+export declare const routes: {
+    readonly methods: {
+        readonly method: "GET";
+        readonly path: "/methods";
+    };
+    readonly start: {
+        readonly method: "POST";
+        readonly path: "/sessions";
+    };
+    readonly flow: {
+        readonly method: "GET";
+        readonly path: "/flows/:id";
+        readonly format: "json";
+    };
+    readonly submit: {
+        readonly method: "POST";
+        readonly path: "/flows/:id/submit";
+    };
+    readonly approve: {
+        readonly method: "POST";
+        readonly path: "/flows/:id/approve";
+    };
+    readonly disconnect: {
+        readonly method: "POST";
+        readonly path: "/connections/:id/disconnect";
+        readonly manages: true;
+    };
+    readonly mark: {
+        readonly method: "POST";
+        readonly path: "/connections/:id/mark";
+        readonly manages: true;
+    };
+    readonly share: {
+        readonly method: "POST";
+        readonly path: "/connections/:id/share";
+        readonly manages: true;
+        readonly dialog: false;
+    };
+    readonly shareRevoke: {
+        readonly method: "POST";
+        readonly path: "/connections/:id/share-revoke";
+        readonly manages: true;
+        readonly dialog: false;
+    };
+};
+export type RouteName = keyof typeof routes;
+/** The address of a route, for the record or flow it acts on where it names one. */
+export declare function routePath(name: RouteName, id?: string): string;
+/** The route a request is for, by its method and its path beneath the mount. */
+export declare function routeOf(method: string, path: string): RouteName | undefined;
+/**
+ * The route a dialog's request is for, or nothing where it is not one a dialog makes: a
+ * route no dialog calls, or a page asked for without the query that makes it JSON.
+ */
+export declare function dialogRoute(method: string, path: string, query: URLSearchParams): RouteName | undefined;
+/** Whether any dialog route is at a path, whatever the method: what a preflight asks about. */
+export declare function dialogPath(path: string): boolean;

package/dist/core/routes.js

@@ -0,0 +1,52 @@
+export const routes = {
+    methods: { method: 'GET', path: '/methods' },
+    start: { method: 'POST', path: '/sessions' },
+    flow: { method: 'GET', path: '/flows/:id', format: 'json' },
+    submit: { method: 'POST', path: '/flows/:id/submit' },
+    approve: { method: 'POST', path: '/flows/:id/approve' },
+    disconnect: { method: 'POST', path: '/connections/:id/disconnect', manages: true },
+    mark: { method: 'POST', path: '/connections/:id/mark', manages: true },
+    share: { method: 'POST', path: '/connections/:id/share', manages: true, dialog: false },
+    shareRevoke: {
+        method: 'POST',
+        path: '/connections/:id/share-revoke',
+        manages: true,
+        dialog: false,
+    },
+};
+const names = Object.keys(routes);
+/** Whether a path is a route's, with any one segment where the route has `:id`. */
+function matches(route, path) {
+    const want = route.path.split('/');
+    const got = path.split('/');
+    return (want.length === got.length &&
+        want.every((part, at) => (part === ':id' ? got[at] !== '' : part === got[at])));
+}
+/** The address of a route, for the record or flow it acts on where it names one. */
+export function routePath(name, id) {
+    const route = routes[name];
+    const path = route.path.replace(':id', encodeURIComponent(id ?? ''));
+    return route.format ? `${path}?format=${route.format}` : path;
+}
+/** The route a request is for, by its method and its path beneath the mount. */
+export function routeOf(method, path) {
+    return names.find((name) => routes[name].method === method && matches(routes[name], path));
+}
+/**
+ * The route a dialog's request is for, or nothing where it is not one a dialog makes: a
+ * route no dialog calls, or a page asked for without the query that makes it JSON.
+ */
+export function dialogRoute(method, path, query) {
+    const name = routeOf(method, path);
+    const route = name && routes[name];
+    if (!route || route.dialog === false)
+        return undefined;
+    return !route.format || query.get('format') === route.format ? name : undefined;
+}
+/** Whether any dialog route is at a path, whatever the method: what a preflight asks about. */
+export function dialogPath(path) {
+    return names.some((name) => {
+        const route = routes[name];
+        return route.dialog !== false && matches(route, path);
+    });
+}