@bkazemi/verily 0.4.0 → 0.6.0

package/dist/server/service.js

@@ -1,5 +1,6 @@
 import { createHash, randomBytes } from 'node:crypto';
 import { fresh, freshnessMs, isArtifactProvider, isCodeProvider, isRedirectProvider, providerMethod, Refused, status, verifySigned, } from '../core/index.js';
+import { domainOf, keyRecord, namedKeys, namedVerifiers, published, } from './domain.js';
 import { signer } from './signing.js';
 export const secret = () => randomBytes(32).toString('base64url');
 export const hash = (value) => createHash('sha256').update(value).digest('base64url');
@@ -64,6 +65,78 @@ export class VerilyService {
         const current = await this.signer();
         return [...(current ? [current.key] : []), ...(this.options.retiredKeys ?? [])];
     }
+    /**
+     * What this verifier's domain publishes to name its keys: one TXT record for each, all
+     * under the one name. Nothing where it signs nothing, or is not on a domain at all.
+     */
+    async keyRecords() {
+        const domain = domainOf(this.baseUrl);
+        const keys = await this.keys();
+        return domain && keys.length
+            ? { name: `_verily.${domain}`, values: keys.map((key) => keyRecord(key.id)) }
+            : undefined;
+    }
+    /**
+     * Where a reader can see this verifier's domain name a key, if it was read doing so, and
+     * which domain that was. It is always the domain this instance is on now: a record it
+     * signed while on another names that one, and nothing here was asked about it. The
+     * answer is kept for ten minutes, so a page that asks on every view costs one lookup.
+     */
+    async keyNamed(id) {
+        const domain = domainOf(this.baseUrl);
+        const found = domain && this.options.dns ? await this.lookedUp(domain, 600000) : undefined;
+        // Read as `dnsKeys()` reads it, so a fingerprint published in lower case counts here too.
+        return found && namedKeys(found.values).includes(id.toUpperCase())
+            ? { domain: domain, lookup: found.lookup, dnssec: found.dnssec }
+            : undefined;
+    }
+    /** What each domain was last read publishing, and when. Nothing found is a failed read. */
+    lookups = new Map();
+    /**
+     * What a domain publishes for Verily, read again once the last read is older than
+     * `maxAgeMs`. Nothing where it could not be read, which is never the same as nothing
+     * published.
+     */
+    async lookedUp(domain, maxAgeMs) {
+        const held = this.lookups.get(domain);
+        if (held && this.now() - held.at < maxAgeMs)
+            return held.found;
+        const found = await this.deadline(published(domain, this.options.dns === true ? {} : this.options.dns || {})).catch(() => undefined);
+        this.lookups.set(domain, { at: this.now(), found });
+        return found;
+    }
+    /**
+     * The domain whose DNS can say a subject's site chose this verifier, or nothing where
+     * there is nothing to ask: no address, or a site this verifier shares a domain with,
+     * since whoever holds a domain already holds every name beneath it.
+     */
+    siteDomain(local) {
+        const site = this.options.dns && local.profileUrl ? domainOf(local.profileUrl) : undefined;
+        const own = new URL(this.baseUrl).hostname.toLowerCase();
+        return site && site !== own && !own.endsWith(`.${site}`) && !site.endsWith(`.${own}`)
+            ? site
+            : undefined;
+    }
+    /**
+     * The local side as a site's DNS bears it out: the site's word, with the lookup that
+     * found the site naming this verifier. Nothing where it does not, or could not be read.
+     */
+    stated(found) {
+        const own = new URL(this.baseUrl).host.toLowerCase();
+        // Read as `dnsVerifiers()` reads it: a host is the same host in any case. What is kept
+        // is the record as published, since that is what a reader finds at the lookup.
+        const named = found && namedVerifiers(found.values).find(({ host }) => host === own);
+        return found && named
+            ? {
+                by: 'backend',
+                method: 'declared',
+                confirmedAt: this.now(),
+                artifactUrl: found.lookup,
+                expect: named.record,
+                ...(found.dnssec ? { dnssec: true } : {}),
+            }
+            : undefined;
+    }
     /** The same keys as one armored text, which is what `gpg --import` takes. */
     async armoredKeys() {
         return (await this.keys()).map((key) => key.publicKey.trim()).join('\n\n') + '\n';
@@ -208,10 +281,28 @@ export class VerilyService {
             // freedom: the subject's address is the whole claim, so that method states it here
             // and gives up per-flow uniqueness for a standing link that is read again on a
             // schedule instead.
-            if (artifact)
-                flow.expect = artifact.expect
-                    ? artifact.expect(subject)
-                    : `Verily proof for ${this.siteOf(subject)}: ${secret()}`;
+            //
+            // Where such a method has nothing of the subject's to state, it publishes a minted
+            // string like any other, and then keeps the one it has: a flow the local holder runs
+            // on their own record asks for the string already standing, as it would ask for the
+            // same address, and not for a new record in DNS every time the link is renewed.
+            //
+            // Only a minted string is kept this way. A record that published an address the
+            // subject no longer has is a proof of that address, and is not asked for again.
+            if (artifact) {
+                const stated = artifact.expect?.(subject);
+                const standing = artifact.expect && connection && ['renew', 'visibility'].includes(kind)
+                    ? connection.attestations?.external.find((a) => a.method === artifact.method && a.minted)?.expect
+                    : undefined;
+                flow.expect =
+                    stated ??
+                        standing ??
+                        (artifact.mint
+                            ? artifact.mint(secret())
+                            : `Verily proof for ${this.siteOf(subject)}: ${secret()}`);
+                if (artifact.expect && stated === undefined)
+                    flow.minted = true;
+            }
             // These kinds are all started by the local holder, whose own record this is. Removal
             // from the external side is started by anyone, and is told nothing.
             if (artifact?.known && ['connect', 'renew', 'visibility'].includes(kind)) {
@@ -277,13 +368,13 @@ export class VerilyService {
     async offered(id, binding, provider, expect, suggested) {
         try {
             const handed = provider.resolve?.(suggested) ?? suggested;
-            const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+            const found = await this.deadline(read(provider, { artifact: handed, expect }));
             await this.transaction(async (tx) => {
                 const flow = await this.bound(tx, id, binding);
                 flow.phase = 'exchanging';
                 await tx.put('flows', id, flow);
             });
-            await this.established(id, binding, external, handed);
+            await this.established(id, binding, found.account, handed, found.dnssec);
         }
         catch {
             await this.transaction(async (tx) => {
@@ -352,8 +443,8 @@ export class VerilyService {
             // Kept as the address that was read, never as the shorthand that named it: it is
             // where a reader is sent, and what is read again later.
             const handed = provider.resolve?.(artifact) ?? artifact;
-            const external = await provider.verify({ artifact: handed, expect });
-            await this.established(id, binding, external, handed);
+            const found = await read(provider, { artifact: handed, expect });
+            await this.established(id, binding, found.account, handed, found.dnssec);
         }
         catch (error) {
             await this.refused(id, error, artifact);
@@ -587,7 +678,7 @@ export class VerilyService {
      * existing connection must still be the same account on the same provider. No binding
      * means a confirmation link got here, which is held to the link and not to a browser.
      */
-    async established(id, binding, external, artifact) {
+    async established(id, binding, external, artifact, dnssec = false) {
         if (typeof external.id !== 'string' ||
             !external.id ||
             typeof external.handle !== 'string' ||
@@ -619,12 +710,19 @@ export class VerilyService {
         // without the holder choosing that method or handing anything back. Read while the
         // flow is still exchanging: approval is shown once, and must show all it will record.
         const shown = await this.transaction(accepted);
-        const standing = ['connect', 'renew'].includes(shown.kind) ? await this.standing(shown) : [];
+        const recorded = ['connect', 'renew'].includes(shown.kind);
+        const standing = recorded ? await this.standing(shown) : [];
+        // The site's own DNS is read here for the same reason: outside a transaction, and
+        // before the approval that records what it said. A read a few minutes old will do.
+        const site = recorded ? this.siteDomain(shown.local) : undefined;
+        const stated = site ? this.stated(await this.lookedUp(site, 300000)) : undefined;
         await this.transaction(async (tx) => {
             const flow = await accepted(tx);
             flow.artifact = artifact;
             flow.reason = undefined;
             flow.authenticatedAt = this.now();
+            flow.dnssec = dnssec || undefined;
+            flow.stated = stated;
             if (standing.length)
                 flow.standing = standing;
             flow.phase = 'approval';
@@ -656,10 +754,11 @@ export class VerilyService {
             try {
                 const expect = provider.expect(flow.local);
                 const known = provider.known(flow.external);
-                if (!known)
+                // A minted string is found nowhere the holder was not asked to put it.
+                if (!known || expect === undefined)
                     continue;
                 const handed = provider.resolve?.(known) ?? known;
-                const external = await this.deadline(provider.verify({ artifact: handed, expect }));
+                const { account: external, dnssec } = await this.deadline(read(provider, { artifact: handed, expect }));
                 if (!sameAccount(flow.external, external))
                     continue;
                 found.push({
@@ -668,6 +767,7 @@ export class VerilyService {
                     confirmedAt: this.now(),
                     artifactUrl: handed,
                     expect,
+                    ...(dnssec ? { dnssec } : {}),
                 });
             }
             catch {
@@ -780,7 +880,7 @@ export class VerilyService {
                     connectedAt: this.now(),
                     expiresAt: this.now() + (this.options.validityMs ?? 30 * 86400000),
                     attestations: {
-                        local: this.declared(),
+                        local: this.declared(flow),
                         external: [this.attestation(flow, provider, connectionId)],
                     },
                     proof: hosted(provider) ? flow.artifact : undefined,
@@ -876,8 +976,12 @@ export class VerilyService {
         const [main, ...rest] = connection.attestations.external;
         // A retired record is as it stood when it was retired, and nothing is read after that.
         const at = connection.retiredAt ?? this.now();
+        const { local } = connection.attestations;
         return {
-            ...connection.attestations,
+            // A site's DNS that has gone unread no longer bears its word out, and the word stands.
+            local: fresh(local, at, this.freshness)
+                ? local
+                : { by: local.by, method: local.method, confirmedAt: local.confirmedAt },
             external: [main, ...rest.filter((a) => fresh(a, at, this.freshness))],
         };
     }
@@ -967,7 +1071,7 @@ export class VerilyService {
             // about the new proof and compares ids exactly, and an address read with different
             // case names the same profile under a different id.
             connection.external = flow.external;
-            connection.attestations = { local: this.declared(), external: [attestation, ...rest] };
+            connection.attestations = { local: this.declared(flow), external: [attestation, ...rest] };
         }
         else {
             // A proof that named the subject's old address proves nothing about its new one,
@@ -979,7 +1083,7 @@ export class VerilyService {
                 others.push(attestation);
             else
                 others[at] = attestation;
-            connection.attestations = { local: this.declared(), external: [main, ...others] };
+            connection.attestations = { local: this.declared(flow), external: [main, ...others] };
         }
         if (hosted(provider))
             connection.proof = flow.artifact;
@@ -994,8 +1098,10 @@ export class VerilyService {
         const provider = this.providers.find((p) => p.id === connection.provider && providerMethod(p) === attestation.method);
         if (attestation.expect === undefined || !provider || !isArtifactProvider(provider))
             return true;
-        if (!provider.expect)
+        if (!provider.expect || attestation.minted)
             return true;
+        // A subject with nothing to state gives nothing back, which no published address
+        // equals: a proof of the address it used to have does not name it now.
         try {
             return provider.expect(local) === attestation.expect;
         }
@@ -1003,9 +1109,12 @@ export class VerilyService {
             return false;
         }
     }
-    /** The site is the only authority on its own namespace, so it declares the local subject. */
-    declared() {
-        return { by: 'backend', method: 'declared', confirmedAt: this.now() };
+    /**
+     * The site is the only authority on its own namespace, so it declares the local subject.
+     * Where the flow read the site's DNS naming this verifier, that goes with it.
+     */
+    declared(flow) {
+        return flow.stated ?? { by: 'backend', method: 'declared', confirmedAt: this.now() };
     }
     /** How the provider established the external account, by whatever method the flow ran. */
     attestation(flow, provider, connectionId) {
@@ -1024,6 +1133,10 @@ export class VerilyService {
                 ? `${this.baseUrl}/connections/${connectionId}/proof`
                 : flow.artifact;
             external.expect = flow.expect;
+            if (flow.minted)
+                external.minted = true;
+            if (flow.dnssec)
+                external.dnssec = true;
             if (hosted)
                 external.hosted = true;
         }
@@ -1061,11 +1174,33 @@ export class VerilyService {
      * hardcoding an id that dies whenever one is revoked and replaced. Unlisted records are
      * never included: they must not appear in any directory listing.
      */
-    async published() {
+    async published(subject) {
+        return (await this.listed(subject)).filter((e) => e.status === 'verified');
+    }
+    /**
+     * Every public record a badge could show, for the page a person reads: one that has lapsed
+     * or been retired is there to be marked, and one removed is not. `subject` narrows it to
+     * one site or one subject, named by what its records already publish. Earliest connected first.
+     */
+    async listed(subject) {
         return this.transaction(async (tx) => (await tx.list('connections'))
-            .filter((c) => c.visibility === 'public')
+            .filter((c) => c.visibility === 'public' &&
+            (!subject ||
+                (this.siteOf(c.local) === subject.site &&
+                    (subject.reference === undefined || c.local.reference === subject.reference))))
             .map((c) => this.evidence(c))
-            .filter((e) => e.status === 'verified'));
+            .filter((e) => e.status !== 'revoked')
+            .sort((a, b) => a.connectedAt - b.connectedAt));
+    }
+    /**
+     * Every record this instance holds, public and unlisted, for whoever runs it. No route
+     * of the library serves this: a deployment that shows it must first know the reader is
+     * its operator, who can read the storage it comes from anyway. Earliest connected first.
+     */
+    async all() {
+        return this.transaction(async (tx) => (await tx.list('connections'))
+            .map((c) => this.evidence(c))
+            .sort((a, b) => a.connectedAt - b.connectedAt));
     }
     async mine(local) {
         return this.transaction(async (tx) => (await tx.list('connections'))
@@ -1253,8 +1388,72 @@ export class VerilyService {
         // open across a fetch would stall every other request behind the slowest provider.
         for (const item of due)
             confirmed += await this.reread(item);
+        await this.restate(budget);
         return confirmed;
     }
+    /**
+     * Asks each site's DNS again whether it names this verifier, and writes the answer to
+     * every record of that site. One lookup answers for all of a site's records, and
+     * `budget` bounds the sites asked in a run, longest unread first. A site that could not
+     * be read is left as it was: its records lose the proof only once it has gone unread
+     * past `freshnessMs`, or once an answer comes back without the statement.
+     *
+     * When each site was last asked is kept in storage, as a record of its own that `prune()`
+     * removes only with the site's last record. It is apart from the lookups a flow makes
+     * and from anything that expires: an instance restarted or pruned between runs must not
+     * start again from the same few sites, and a site whose holders connect often must
+     * still have its older records rewritten.
+     */
+    async restate(budget) {
+        if (!this.options.dns)
+            return;
+        const interval = this.options.recheckMs ?? 86400000;
+        const now = this.now();
+        const live = (c) => !!c?.attestations &&
+            c.revokedAt === undefined &&
+            c.retiredAt === undefined &&
+            c.expiresAt > this.now();
+        const due = await this.transaction(async (tx) => {
+            const sites = new Set((await tx.list('connections'))
+                .filter(live)
+                .map((c) => this.siteDomain(c.local))
+                .filter((site) => site !== undefined));
+            const reads = new Map((await tx.list('sites')).map((read) => [read.id, read]));
+            // A site never asked about goes first, then the rest by how long ago they were. A
+            // site that gave no answer is due again sooner, and still waits behind every site
+            // asked before it, so a zone that never answers cannot hold up the others.
+            const at = (site) => reads.get(site)?.readAt ?? -Infinity;
+            const wait = (site) => reads.get(site)?.answered === false ? Math.ceil(interval / 4) : interval;
+            return [...sites]
+                .filter((site) => at(site) + wait(site) <= now)
+                .sort((a, b) => at(a) - at(b))
+                .slice(0, budget);
+        });
+        for (const site of due) {
+            // Always asked afresh: a read some flow made says nothing of the records before it.
+            const found = await this.lookedUp(site, 0);
+            await this.transaction((tx) => tx.put('sites', site, { id: site, readAt: this.now(), answered: !!found }));
+            if (!found)
+                continue;
+            const stated = this.stated(found);
+            await this.transaction(async (tx) => {
+                for (const connection of await tx.list('connections')) {
+                    if (!live(connection) || this.siteDomain(connection.local) !== site)
+                        continue;
+                    const { local } = connection.attestations;
+                    // Nothing was stated before and nothing is now, so there is nothing to write.
+                    if (!stated && !local.artifactUrl)
+                        continue;
+                    connection.attestations.local = stated ?? {
+                        by: local.by,
+                        method: local.method,
+                        confirmedAt: local.confirmedAt,
+                    };
+                    await tx.put('connections', connection.id, connection);
+                }
+            });
+        }
+    }
     /**
      * The configured method that can ask again about one attestation, or nothing when there
      * is nothing to ask: no published proof, a method this instance no longer runs, or a
@@ -1275,11 +1474,14 @@ export class VerilyService {
         const { artifactUrl, expect, method } = attestation;
         const main = attestation === connection.attestations.external[0];
         let withdrawn = false;
+        let dnssec = false;
         try {
             if (provider.artifact === 'document')
                 withdrawn = await this.deadline(provider.withdrawn(connection.external, connection.proof));
             else {
-                const external = await this.deadline(provider.verify({ artifact: artifactUrl, expect: expect }));
+                const found = await this.deadline(read(provider, { artifact: artifactUrl, expect: expect }));
+                const external = found.account;
+                dnssec = found.dnssec === true;
                 // The proof must still be the same holder's. An account that changed hands has
                 // not reproved anything, whatever is published at the old address.
                 if (main
@@ -1314,6 +1516,11 @@ export class VerilyService {
                 return 0;
             }
             held.confirmedAt = this.now();
+            // A zone can start or stop being signed, so the flag is as the last read found it.
+            if (dnssec)
+                held.dnssec = true;
+            else
+                delete held.dnssec;
             await tx.put('connections', connection.id, current);
             return 1;
         });
@@ -1345,14 +1552,20 @@ export class VerilyService {
                 if (limit.expiresAt <= now)
                     await tx.delete('limits', limit.id);
             const audit = await tx.list('audit');
+            // The sites that still have a record here, whose place in the recheck order is kept.
+            const sites = new Set();
             for (const connection of await tx.list('connections')) {
                 const ended = connection.revokedAt ??
                     (connection.retiredAt === undefined ? connection.expiresAt : Infinity);
                 if (ended + retentionMs <= now) {
                     await tx.delete('connections', connection.id);
                     await tx.delete('shares', connection.id);
+                    continue;
                 }
-                else if (connection.connectedAt === undefined) {
+                const site = this.siteDomain(connection.local);
+                if (site)
+                    sites.add(site);
+                if (connection.connectedAt === undefined) {
                     // A record from before its first connection was kept. The audit trail still has
                     // the moment, for as long as it retains it, and that is the answer. Only past
                     // that is the earliest time left on the record used, which is a guess: a sign-in
@@ -1365,6 +1578,11 @@ export class VerilyService {
                     await tx.put('connections', connection.id, connection);
                 }
             }
+            // When a site was last asked goes only with its last record, never by age: it is
+            // what orders the sites `recheck()` asks, and losing it would put the site first again.
+            for (const read of await tx.list('sites'))
+                if (!sites.has(read.id))
+                    await tx.delete('sites', read.id);
             for (const event of audit)
                 if (event.at + retentionMs <= now)
                     await tx.delete('audit', event.id);
@@ -1408,6 +1626,11 @@ function revives(connection, provider) {
     return (connection.retiredAt === undefined ||
         (connection.attestations?.external[0].method ?? 'oauth') === providerMethod(provider));
 }
+/** One proof waiting to be read again, and the method that reads it. */
+/** Whose a proof is and what else its method learned, whichever of the two it offers. */
+async function read(provider, input) {
+    return provider.prove ? provider.prove(input) : { account: await provider.verify(input) };
+}
 /**
  * Whether two methods named the same account. Where both carry an id their provider
  * issued, that id settles it. A method that learns only an address, as a link back does,

package/dist/server/style.d.ts

@@ -8,7 +8,7 @@
  * leaves. So the styling does the two things that helps with, a measured column and a
  * legible hierarchy, and nothing that would make a record look like a product.
  */
-export declare const stylesheet = ":root {\n  --ink: #23312b;\n  --muted: #6b786f;\n  --line: #dce2de;\n  --surface: #fff;\n  --raised: #f7f9f7;\n  --accent: #245f43;\n  color-scheme: light dark;\n  accent-color: var(--accent);\n}\n\n@media (prefers-color-scheme: dark) {\n  :root {\n    --ink: #dde5e0;\n    --muted: #96a39b;\n    --line: #2f3b35;\n    --surface: #161a18;\n    --raised: #1d2220;\n    --accent: #7fc4a2;\n  }\n}\n\n* { box-sizing: border-box; }\n\nbody {\n  margin: 0;\n  padding: 0 1rem 4rem;\n  background: var(--surface);\n  color: var(--ink);\n  font: 16px/1.65 system-ui, -apple-system, 'Segoe UI', sans-serif;\n  text-rendering: optimizeLegibility;\n}\n\nmain {\n  max-width: 34rem;\n  margin: 0 auto;\n  padding-top: 3rem;\n}\n\n/*\n * The logotype, above the page's own heading, on its own dark plate. Sized so the word is\n * the height it was without the plate, whose margin makes the box that much taller. The\n * word is white in either scheme: the plate is what it is read against, not the page.\n */\n.logo {\n  display: block;\n  height: 2.5rem;\n  margin-bottom: 1.5rem;\n}\n\nh1 {\n  margin: 0 0 1.75rem;\n  padding-bottom: 1rem;\n  border-bottom: 1px solid var(--line);\n  font-size: 1.5rem;\n  font-weight: 620;\n  letter-spacing: -.02em;\n  line-height: 1.25;\n}\n\n/*\n * A page holding one thing needs no rule under its heading. The rule divides a heading\n * from the record beneath it, and a page that only asks for a key has no record to divide.\n */\nmain.single h1 { margin-bottom: 1.25rem; padding-bottom: 0; border-bottom: none; }\n\nh2 { margin: 2rem 0 .75rem; font-size: 1.125rem; font-weight: 620; letter-spacing: -.01em; }\n\nh3 { margin: 0 0 .5rem; font-size: 1rem; font-weight: 620; }\n\np { margin: 0 0 1rem; overflow-wrap: break-word; }\n\na { color: var(--accent); text-underline-offset: 3px; overflow-wrap: anywhere; }\n\na:hover { text-decoration-thickness: 2px; }\n\n/*\n * Something to be run or published exactly as written. Its own line breaks are kept and a\n * long line is soft-wrapped rather than cut off: a soft wrap is drawn, not inserted, so\n * what is copied is still character for character what was written. Selecting inside the\n * block takes all of it, since half a command is worse than none.\n */\npre {\n  position: relative;\n  margin: 0 0 1rem;\n  /* Room along the top line for the copy button, which sits over the block rather than in it. */\n  padding: .75rem 5.25rem .75rem .875rem;\n  border: 1px solid var(--line);\n  border-radius: 6px;\n  background: var(--raised);\n  white-space: pre-wrap;\n  overflow-wrap: anywhere;\n  user-select: all;\n}\n\ncode { font: .8125rem/1.6 ui-monospace, SFMono-Regular, Menlo, monospace; }\n\n/* Made by a script, so it exists only where it works. Quiet: the block is the point. */\n.copy {\n  position: absolute;\n  top: .5rem;\n  right: .5rem;\n  padding: .1875rem .5rem;\n  border: 1px solid var(--line);\n  border-radius: 5px;\n  background: var(--surface);\n  color: var(--muted);\n  font: 500 .75rem/1.5 system-ui, sans-serif;\n  user-select: none;\n}\n\n.copy:hover { color: var(--ink); border-color: var(--muted); }\n\n/*\n * The two sides of the link, which is what a reader came to read. Each fact about a side\n * gets its own line: what it is, what it is called, the identifier behind that, and how it\n * was shown. Everything else on the page qualifies the pair, so it is set quieter.\n */\n.side {\n  margin-bottom: .75rem;\n  padding: .875rem 1rem;\n  border: 1px solid var(--line);\n  border-radius: 8px;\n  background: var(--raised);\n}\n\n.who {\n  margin: 0 0 .125rem;\n  color: var(--muted);\n  font-size: .75rem;\n  font-weight: 550;\n  letter-spacing: .02em;\n}\n\n.name { margin: 0; font-size: 1.0625rem; font-weight: 620; letter-spacing: -.01em; }\n\n/* The name is the card's subject before it is a link, so the rule is drawn on hover. */\n.name a { text-decoration: none; }\n\n.name a:hover { text-decoration: underline; }\n\n.reference, .how { margin: 0; color: var(--muted); font-size: .8125rem; line-height: 1.5; }\n\n.name + .how, .reference + .how { margin-top: .5rem; }\n.how.additional { padding-left: .75rem; }\n\n.fine { color: var(--muted); font-size: .8125rem; line-height: 1.55; margin-bottom: .625rem; }\n\n/* That the record is signed is a fact about it, so it is set as one and not as fine print. */\n.signed { font-size: .875rem; line-height: 1.55; margin-bottom: .875rem; }\n/* Arrived at from a badge's \"signed\" link, so the reader is shown where they landed. */\n.signed:target { margin-inline: -.75rem; padding: .625rem .75rem; border-radius: 8px; background: var(--raised); }\n\n/* Every time on the record in one column, so they can be compared rather than hunted for. */\ndl {\n  display: grid;\n  grid-template-columns: auto 1fr;\n  gap: .3rem 1.5rem;\n  margin: 1.25rem 0;\n  padding-top: 1rem;\n  border-top: 1px solid var(--line);\n  font-size: .8125rem;\n}\n\ndt { color: var(--muted); }\n\ndd { margin: 0; font-variant-numeric: tabular-nums; }\n\n/* Inside a card the rule above it is the card's own edge, so the list needs none. */\nsection dl { margin: .5rem 0 1rem; padding-top: 0; border-top: 0; }\n\nsection {\n  margin: 0 0 1.25rem;\n  padding: 1.25rem 1.375rem;\n  border: 1px solid var(--line);\n  border-radius: 10px;\n}\n\nsection > :last-child { margin-bottom: 0; }\n\nform { margin: 0 0 1.5rem; }\n\nlabel { display: block; margin: 0 0 .75rem; color: var(--muted); font-size: .8125rem; }\n\ninput, textarea {\n  display: block;\n  width: 100%;\n  margin-top: .375rem;\n  padding: .5rem .625rem;\n  border: 1px solid var(--line);\n  border-radius: 6px;\n  background: var(--surface);\n  color: var(--ink);\n  font: .875rem/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;\n}\n\n/* Height comes from the rows attribute, which differs per box. */\ntextarea { resize: vertical; }\n\ninput:focus-visible, textarea:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }\n\nbutton {\n  padding: .5rem 1rem;\n  border: 1px solid var(--accent);\n  border-radius: 6px;\n  background: var(--accent);\n  color: var(--surface);\n  font: 500 .9375rem/1.4 inherit;\n  cursor: pointer;\n}\n\nbutton + button { margin-left: .5rem; border-color: var(--line); background: none; color: var(--ink); }\n\nfieldset { margin: 0 0 1.25rem; padding: 1rem 1.125rem .25rem; border: 1px solid var(--line); border-radius: 8px; }\n\nlegend { padding: 0 .375rem; color: var(--muted); font-size: .8125rem; }\n\nfieldset label { display: flex; align-items: baseline; gap: .5rem; color: var(--ink); font-size: .9375rem; }\n\nfieldset input { width: auto; margin: 0; }\n\nfieldset p { margin: .25rem 0 .875rem 1.5rem; color: var(--muted); font-size: .8125rem; }\n";
+export declare const stylesheet = ":root {\n  --ink: #23312b;\n  --muted: #6b786f;\n  --line: #dce2de;\n  --surface: #fff;\n  --raised: #f7f9f7;\n  --accent: #245f43;\n  color-scheme: light dark;\n  accent-color: var(--accent);\n}\n\n@media (prefers-color-scheme: dark) {\n  :root {\n    --ink: #dde5e0;\n    --muted: #96a39b;\n    --line: #2f3b35;\n    --surface: #161a18;\n    --raised: #1d2220;\n    --accent: #7fc4a2;\n  }\n}\n\n* { box-sizing: border-box; }\n\nbody {\n  margin: 0;\n  padding: 0 1rem 4rem;\n  background: var(--surface);\n  color: var(--ink);\n  font: 16px/1.65 system-ui, -apple-system, 'Segoe UI', sans-serif;\n  text-rendering: optimizeLegibility;\n}\n\nmain {\n  max-width: 34rem;\n  margin: 0 auto;\n  padding-top: 3rem;\n}\n\n/*\n * The logotype, above the page's own heading, on its own dark plate. Sized so the word is\n * the height it was without the plate, whose margin makes the box that much taller. The\n * word is white in either scheme: the plate is what it is read against, not the page.\n */\n.logo {\n  display: block;\n  height: 2.5rem;\n  margin-bottom: 1.5rem;\n}\n\nh1 {\n  margin: 0 0 1.75rem;\n  padding-bottom: 1rem;\n  border-bottom: 1px solid var(--line);\n  font-size: 1.5rem;\n  font-weight: 620;\n  letter-spacing: -.02em;\n  line-height: 1.25;\n}\n\n/*\n * A page holding one thing needs no rule under its heading. The rule divides a heading\n * from the record beneath it, and a page that only asks for a key has no record to divide.\n */\nmain.single h1 { margin-bottom: 1.25rem; padding-bottom: 0; border-bottom: none; }\n\nh2 { margin: 2rem 0 .75rem; font-size: 1.125rem; font-weight: 620; letter-spacing: -.01em; }\n\nh3 { margin: 0 0 .5rem; font-size: 1rem; font-weight: 620; }\n\np { margin: 0 0 1rem; overflow-wrap: break-word; }\n\na { color: var(--accent); text-underline-offset: 3px; overflow-wrap: anywhere; }\n\na:hover { text-decoration-thickness: 2px; }\n\n/*\n * Something to be run or published exactly as written. Its own line breaks are kept and a\n * long line is soft-wrapped rather than cut off: a soft wrap is drawn, not inserted, so\n * what is copied is still character for character what was written. Selecting inside the\n * block takes all of it, since half a command is worse than none.\n */\npre {\n  position: relative;\n  margin: 0 0 1rem;\n  /* Room along the top line for the copy button, which sits over the block rather than in it. */\n  padding: .75rem 5.25rem .75rem .875rem;\n  border: 1px solid var(--line);\n  border-radius: 6px;\n  background: var(--raised);\n  white-space: pre-wrap;\n  overflow-wrap: anywhere;\n  user-select: all;\n}\n\ncode { font: .8125rem/1.6 ui-monospace, SFMono-Regular, Menlo, monospace; }\n\n/* Made by a script, so it exists only where it works. Quiet: the block is the point. */\n.copy {\n  position: absolute;\n  top: .5rem;\n  right: .5rem;\n  padding: .1875rem .5rem;\n  border: 1px solid var(--line);\n  border-radius: 5px;\n  background: var(--surface);\n  color: var(--muted);\n  font: 500 .75rem/1.5 system-ui, sans-serif;\n  user-select: none;\n}\n\n.copy:hover { color: var(--ink); border-color: var(--muted); }\n\n/*\n * The two sides of the link, which is what a reader came to read. Each fact about a side\n * gets its own line: what it is, what it is called, the identifier behind that, and how it\n * was shown. Everything else on the page qualifies the pair, so it is set quieter.\n */\n.side {\n  margin-bottom: .75rem;\n  padding: .875rem 1rem;\n  border: 1px solid var(--line);\n  border-radius: 8px;\n  background: var(--raised);\n}\n\n/*\n * A subject's accounts are peers, so where there is room they sit two across. The page\n * that lists them is wider for it, and a narrow one keeps them in a single column.\n */\nmain:has(.accounts) { max-width: 54rem; }\n\n.accounts {\n  display: grid;\n  grid-template-columns: repeat(auto-fit, minmax(min(22rem, 100%), 1fr));\n  gap: .75rem;\n  margin-bottom: .75rem;\n}\n\n.accounts .side { position: relative; display: flex; flex-direction: column; margin-bottom: 0; }\n\n/* How the holder lists the account, in the card's corner and out of the lines below. */\n.listing {\n  position: absolute;\n  top: .75rem;\n  right: .875rem;\n  padding: .0625rem .5rem;\n  border: 1px solid var(--line);\n  border-radius: 999px;\n  color: var(--muted);\n  font-size: .6875rem;\n  font-weight: 550;\n}\n\n.listing.preferred { border-color: var(--accent); color: var(--accent); }\n\n/* The times sit at the foot of the card, so they line up along a row of uneven cards. */\n.accounts .side dl { margin-top: auto; }\n.accounts .side p:last-of-type { margin-bottom: .625rem; }\n\n/* Between a subject and its accounts on the page that lists them. */\n.joiner { display: block; width: 1.25rem; height: 1.25rem; margin: 0 auto .75rem; color: var(--muted); }\n\n.who {\n  margin: 0 0 .125rem;\n  color: var(--muted);\n  font-size: .75rem;\n  font-weight: 550;\n  letter-spacing: .02em;\n}\n\n.name { margin: 0; font-size: 1.0625rem; font-weight: 620; letter-spacing: -.01em; }\n\n/* The name is the card's subject before it is a link, so the rule is drawn on hover. */\n.name a { text-decoration: none; }\n\n.name a:hover { text-decoration: underline; }\n\n.reference, .how { margin: 0; color: var(--muted); font-size: .8125rem; line-height: 1.5; }\n\n.name + .how, .reference + .how { margin-top: .5rem; }\n.fingerprint { font-family: ui-monospace, monospace; text-wrap: balance; }\n.fingerprint span { display: inline-block; margin-right: .5ch; }\n.how.additional { padding-left: .75rem; }\n\n.fine { color: var(--muted); font-size: .8125rem; line-height: 1.55; margin-bottom: .625rem; }\n\n/* That the record is signed is a fact about it, so it is set as one and not as fine print. */\n.signed { font-size: .875rem; line-height: 1.55; margin-bottom: .875rem; }\n/* Arrived at from a badge's \"signed\" link, so the reader is shown where they landed. */\n.signed:target { margin-inline: -.75rem; padding: .625rem .75rem; border-radius: 8px; background: var(--raised); }\n\n/* Every time on the record in one column, so they can be compared rather than hunted for. */\ndl {\n  display: grid;\n  grid-template-columns: auto 1fr;\n  gap: .3rem 1.5rem;\n  margin: 1.25rem 0;\n  padding-top: 1rem;\n  border-top: 1px solid var(--line);\n  font-size: .8125rem;\n}\n\ndt { color: var(--muted); }\n\ndd { margin: 0; font-variant-numeric: tabular-nums; }\n\n/* Inside a card the rule above it is the card's own edge, so the list needs none. */\nsection dl { margin: .5rem 0 1rem; padding-top: 0; border-top: 0; }\n.side dl { margin: .625rem 0 0; padding-top: .625rem; }\n\nsection {\n  margin: 0 0 1.25rem;\n  padding: 1.25rem 1.375rem;\n  border: 1px solid var(--line);\n  border-radius: 10px;\n}\n\nsection > :last-child { margin-bottom: 0; }\n\nform { margin: 0 0 1.5rem; }\n\nlabel { display: block; margin: 0 0 .75rem; color: var(--muted); font-size: .8125rem; }\n\ninput, textarea {\n  display: block;\n  width: 100%;\n  margin-top: .375rem;\n  padding: .5rem .625rem;\n  border: 1px solid var(--line);\n  border-radius: 6px;\n  background: var(--surface);\n  color: var(--ink);\n  font: .875rem/1.5 ui-monospace, SFMono-Regular, Menlo, monospace;\n}\n\n/* Height comes from the rows attribute, which differs per box. */\ntextarea { resize: vertical; }\n\ninput:focus-visible, textarea:focus-visible { outline: 2px solid var(--accent); outline-offset: 1px; }\n\nbutton {\n  padding: .5rem 1rem;\n  border: 1px solid var(--accent);\n  border-radius: 6px;\n  background: var(--accent);\n  color: var(--surface);\n  font: 500 .9375rem/1.4 inherit;\n  cursor: pointer;\n}\n\nbutton + button { margin-left: .5rem; border-color: var(--line); background: none; color: var(--ink); }\n\nfieldset { margin: 0 0 1.25rem; padding: 1rem 1.125rem .25rem; border: 1px solid var(--line); border-radius: 8px; }\n\nlegend { padding: 0 .375rem; color: var(--muted); font-size: .8125rem; }\n\nfieldset label { display: flex; align-items: baseline; gap: .5rem; color: var(--ink); font-size: .9375rem; }\n\nfieldset input { width: auto; margin: 0; }\n\nfieldset p { margin: .25rem 0 .875rem 1.5rem; color: var(--muted); font-size: .8125rem; }\n";
 /**
  * A short digest of the sheet above, put in the link's query so a release that changes the
  * styling changes its address. Without that the only safe cache is no cache: a reader who

package/dist/server/style.js

@@ -134,6 +134,43 @@ code { font: .8125rem/1.6 ui-monospace, SFMono-Regular, Menlo, monospace; }
   background: var(--raised);
 }
 
+/*
+ * A subject's accounts are peers, so where there is room they sit two across. The page
+ * that lists them is wider for it, and a narrow one keeps them in a single column.
+ */
+main:has(.accounts) { max-width: 54rem; }
+
+.accounts {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(min(22rem, 100%), 1fr));
+  gap: .75rem;
+  margin-bottom: .75rem;
+}
+
+.accounts .side { position: relative; display: flex; flex-direction: column; margin-bottom: 0; }
+
+/* How the holder lists the account, in the card's corner and out of the lines below. */
+.listing {
+  position: absolute;
+  top: .75rem;
+  right: .875rem;
+  padding: .0625rem .5rem;
+  border: 1px solid var(--line);
+  border-radius: 999px;
+  color: var(--muted);
+  font-size: .6875rem;
+  font-weight: 550;
+}
+
+.listing.preferred { border-color: var(--accent); color: var(--accent); }
+
+/* The times sit at the foot of the card, so they line up along a row of uneven cards. */
+.accounts .side dl { margin-top: auto; }
+.accounts .side p:last-of-type { margin-bottom: .625rem; }
+
+/* Between a subject and its accounts on the page that lists them. */
+.joiner { display: block; width: 1.25rem; height: 1.25rem; margin: 0 auto .75rem; color: var(--muted); }
+
 .who {
   margin: 0 0 .125rem;
   color: var(--muted);
@@ -152,6 +189,8 @@ code { font: .8125rem/1.6 ui-monospace, SFMono-Regular, Menlo, monospace; }
 .reference, .how { margin: 0; color: var(--muted); font-size: .8125rem; line-height: 1.5; }
 
 .name + .how, .reference + .how { margin-top: .5rem; }
+.fingerprint { font-family: ui-monospace, monospace; text-wrap: balance; }
+.fingerprint span { display: inline-block; margin-right: .5ch; }
 .how.additional { padding-left: .75rem; }
 
 .fine { color: var(--muted); font-size: .8125rem; line-height: 1.55; margin-bottom: .625rem; }
@@ -178,6 +217,7 @@ dd { margin: 0; font-variant-numeric: tabular-nums; }
 
 /* Inside a card the rule above it is the card's own edge, so the list needs none. */
 section dl { margin: .5rem 0 1rem; padding-top: 0; border-top: 0; }
+.side dl { margin: .625rem 0 0; padding-top: .625rem; }
 
 section {
   margin: 0 0 1.25rem;

package/dist/site/index.js

@@ -78,7 +78,7 @@ export function createSiteClient(options) {
          * have. The instance sends them on to this site's authorize endpoint with a `state`.
          */
         beginUrl(purpose = 'connect') {
-            return `${instance.origin}/begin?${new URLSearchParams({ site: options.site, purpose })}`;
+            return `${instance.origin}/handoff/request?${new URLSearchParams({ site: options.site, purpose })}`;
         },
         /**
          * For the authorize endpoint: where to redirect a signed-in user, with a handoff that
@@ -98,7 +98,7 @@ export function createSiteClient(options) {
                 // Under the five minutes the instance allows, so a slow clock does not overrun it.
                 exp: seconds() + 240,
             });
-            return { url: `${instance.origin}/start?${new URLSearchParams({ token })}`, txn };
+            return { url: `${instance.origin}/handoff/accept?${new URLSearchParams({ token })}`, txn };
         },
         /**
          * For a page that shows the connect pill with `handoff-url`: a token that vouches for