@bkazemi/verily 0.6.0 → 0.7.0

package/README.md

@@ -145,7 +145,7 @@ import { init } from '@bkazemi/verily'; // also registers <verily-badge>
 const client = init({ backendUrl: '/api/verily' });
 ```
 
-Without one, serve `node_modules/@bkazemi/verily/dist/verily.js` yourself, or load it from a CDN such as `https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.6.0/dist/verily.js`. The script defines a global `Verily`.
+Without one, serve `node_modules/@bkazemi/verily/dist/verily.js` yourself, or load it from a CDN such as `https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.7.0/dist/verily.js`. The script defines a global `Verily`.
 
 Then place the badge wherever the account appears:
 
@@ -231,6 +231,8 @@ import {
 
 All methods except the sign-ins and the mailed code let the user publish the proof in their own time and come back. A proof that does not check out can be put right and handed back on the same step, up to five times, so a mistyped address never means publishing or signing again. Gists, link-backs, DNS records and files can be taken down later, so Verily re-reads them on a schedule. A PGP signature is kept by Verily and published at `<baseUrl>/connections/<id>/proof`.
 
+**How old an account is.** A link shows who controls an account, not how long it has existed. Signing in with GitHub, Discord or YouTube also reads when the account was made: GitHub's `created_at`, the time inside a Discord id, and a YouTube channel's `publishedAt`. It is kept on the record as `external.createdAt`, in milliseconds, shown as "Joined" beside the account's name on evidence and in the badge's dialog, and covered by a signed record. The other methods read an address or a proof and learn no date, so a record first shown by one of them has none until its holder also signs in. A provider of your own sets it by returning `createdAt` from `authenticate()`.
+
 **Several at once.** List more than one, and `/verify` offers each method as its own button:
 
 ```ts
@@ -301,7 +303,7 @@ A static site only needs the script and the badge markup; the backend runs somew
 4. Add the script and the badge to your site:
 
 ```html
-<script src="https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.6.0/dist/verily.js" defer></script>
+<script src="https://cdn.jsdelivr.net/npm/@bkazemi/verily@0.7.0/dist/verily.js" defer></script>
 <verily-badge
   backend-url="https://your-backend.example"
   connection-id="CONNECTION_ID"
@@ -393,7 +395,7 @@ To show them, hand the records to the badge. It draws them as given and fetches
 
 From script, set the property instead: `badge.connections = records`. Send a page only the records its reader may see: whatever is in the page, the reader has. Several records become one badge, as under [Show the badge](#show-the-badge), and an unlisted one opens its details without linking anywhere.
 
-Each record has the provider, the external account's handle and profile address, the visibility and the expiry. Unlisted records are included, and only your site can read them, so you can show a link to your own users without making it public. `connections()` takes any number of ids, so read a whole page of users in one call. Pass `cacheMs` to the client to reuse an answer for that long, and `{ fresh: true }` to a call that must not.
+Each record has the provider, the external account's handle and profile address, the visibility and the expiry. Unlisted records are included, and only your site can read them, so you can show a link to your own users without making it public. `connections()` takes any number of ids, so read a whole page of users in one call. Every call reads the instance, so a removed or expired link stops showing on the next page load. Passing `cacheMs` to the client reuses an answer for that long, and a connection revoked in that time still shows as verified until it runs out, so leave it unset or keep it to a few seconds. `{ fresh: true }` makes one call read anyway.
 
 If you would rather your user ids never left your site, give the client a secret:
 
@@ -445,7 +447,7 @@ With a key set:
 - **`GET <baseUrl>/connections/<id>?format=signed`** returns the signed file for a public record that is currently verified: the record as JSON under an OpenPGP cleartext signature. It is signed when asked for, so it says the record stood at that moment. An unlisted, revoked or expired record has no signed form. A public retired record has one, signed as `version: 2` with `status: "retired"` and `retiredAt`, so a reader that knows only version 1 refuses it and never takes it for a record that stood.
 - **`GET <baseUrl>/keys.asc`** is the public key as `gpg --import` reads it. **`GET <baseUrl>/keys`** lists the same keys as JSON, each with its fingerprint. The Cloudflare Worker also serves that list at `/.well-known/verily-keys.json`.
 - **`<baseUrl>/check`** is a page where a saved file can be pasted and read back.
-- The evidence page says the record is signed and links to the signed record. The badge's dialog checks the signature in the browser with OpenPGP.js, which it starts only when a record is signed, marks the record `signed ✓`, and links to that page. A record whose signature fails is shown as unconfirmed.
+- The evidence page says the record is signed and links to the signed record. The badge's dialog checks the signature in the browser with OpenPGP.js, which it starts only when a record is signed, marks the record with a `signed` pill after its verifier, and links to that page. A record whose signature fails is shown as unconfirmed, with `bad signature` in the pill's place.
 - The approval step tells the holder that a saved signed record outlives removal.
 
 To check a file yourself:
@@ -509,6 +511,8 @@ The Cloudflare Worker sets `dns: true`.
 
 ## Operations
 
+DNS setup is saved for seven days from its first attempt. If propagation takes longer than a flow’s ten minutes, sign in and choose DNS again to restore the same TXT value and the last domain entered (or restart the same renewal). Each return creates a fresh flow and reads the proof again; the saved setup grants no verification on its own. Only the most recent domain entered is remembered for that operation. Keep the TXT record after verification for ongoing checks. A proof covers the exact domain entered; verify parent domains and subdomains separately.
+
 Verification lasts 30 days, flows 10 minutes, and sharing links 7 days. Change them with `validityMs`, `flowTtlMs` and `shareTtlMs`. Evidence is never cached.
 
 Run the upkeep on a schedule, for example hourly:
@@ -527,8 +531,21 @@ setInterval(
 );
 ```
 
-- **`prune()`** deletes expired flows, and deletes expired or revoked records after 90 days. A retired record is kept until it is removed.
-- **`recheck()`** re-reads gists, link-backs, DNS records and files that are due, up to 5 per run (its `budget` argument). Each proof is re-read every 24 hours (`recheckMs`) and stays current for 7 days after its last successful read (`freshnessMs`); after that it shows as unconfirmed until a read succeeds. A failed read changes nothing. For PGP, it asks the keyserver whether the key has been revoked, and revokes the connection if so.
+- **`prune()`** deletes expired flows and DNS drafts, and deletes expired or revoked records after 90 days. A retired record is kept until it is removed.
+- **`recheck()`** re-reads gists, link-backs, DNS records and files that are due, up to 5 per provider per run (its `budget` argument). Each proof is re-read every 24 hours (`recheckMs`). A read that finds the proof gone, such as a deleted gist, a page without the link or a DNS answer without the record, makes the connection unconfirmed at once. A read that fails, such as a timeout or a server error, changes nothing, and the proof stays current for 7 days after its last successful read (`freshnessMs`). Either way the proof is read again after a quarter of `recheckMs`, and the connection is verified again as soon as a read finds the proof. A provider of your own says a proof is gone by throwing `Absent` from `verify`; any other error is a failed read. For PGP, it asks the keyserver whether the key has been revoked, and revokes the connection if so.
+
+- **`onChange`** is an option, not a call. Set it to hear when a record's status, visibility, expiry or mark changes, so your site can update its own copy without polling:
+
+  ```ts
+  createVerily({
+    // ...
+    onChange: async ({ evidence, local, revision }) => {
+      await db.saveConnectionIfNewer(local.id, evidence, revision);
+    },
+  });
+  ```
+
+  `evidence` is the record as it stands now, `local` is your subject with its private id, `previous` is the status, visibility, expiry and mark last confirmed as delivered, and `revision` counts the deliveries of that record. Keep the `revision` you last applied for each record and ignore a change that is not higher: a call that timed out is not cancelled and can finish after a newer one. A change made by a request is delivered before that request returns, and the call is awaited, so keep it quick. A record that expires or goes unconfirmed changes with time alone, so those are delivered by `recheck()`, or by `service.announce()` if you do not recheck. Delivery is at least once: a call that throws is made again on the next run, after the records that have not failed, and turning the option on reports every existing record once, 50 per run. A record removed by `prune()` is not reported.
 
 **If you never call `recheck()`, set `freshnessMs: Infinity`.** Otherwise connections proved by gist, link-back or PGP lapse after a week.
 

package/dist/browser/connect-dialog.js

@@ -1,5 +1,4 @@
-import { externalId, externalIdGroups, externalLink, externalName } from '../core/index.js';
-import { accountCard, backMark, closeMark, linkMark, node, outward, stampLink, styles, } from './evidence-dialog.js';
+import { accountCard, backMark, closeMark, linkMark, node, namedCard, outward, stampLink, styles, } from './evidence-dialog.js';
 import { providerMark } from './provider-mark.js';
 import { version } from '../version.js';
 const connectStyles = `
@@ -435,9 +434,9 @@ renew) {
     }
     function approve(flow) {
         const logo = providerMark(flow.provider.id, flow.provider.method);
-        const external = accountCard(logo
+        const external = namedCard(logo
             ? [logo, document.createTextNode(flow.provider.name)]
-            : [document.createTextNode(flow.provider.name)], externalName(flow.external), externalIdGroups(flow.external) ?? externalId(flow.external), externalLink(flow.external));
+            : [document.createTextNode(flow.provider.name)], flow.external);
         const parts = [subjectCard(flow.local), linkMark(), external];
         const choice = node('fieldset');
         const visibilityText = {

package/dist/browser/evidence-dialog.d.ts

@@ -1,7 +1,7 @@
-import { type Evidence } from '../core/index.js';
+import { type Evidence, type ExternalAccount } from '../core/index.js';
 /** The logotype as a link to the project, as both dialogs carry it in their footer. */
 export declare function stampLink(): HTMLAnchorElement;
-export declare const styles = "\n  * { box-sizing: border-box; }\n  dialog { width: min(460px, calc(100vw - 32px)); max-height: calc(100dvh - 40px); margin: auto; padding: 24px; border: 1px solid #dce2de; border-radius: 16px; background: #fff; color: #23312b; box-shadow: 0 24px 90px #10201935; font: 13px/1.6 system-ui, sans-serif; }\n  dialog::backdrop { background: #15271f66; }\n  header { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px; }\n  h2 { margin: 0; font-size: 18px; font-weight: 650; letter-spacing: -.3px; }\n  button { width: 32px; height: 32px; border: 1px solid #dce2de; border-radius: 8px; background: #fff; color: #52645a; font: 20px system-ui, sans-serif; cursor: pointer; }\n  button:hover { background: #f2f5f1; }\n  .icon { display: grid; place-items: center; padding: 0; }\n  .icon svg { width: 16px; height: 16px; }\n  .title { display: flex; align-items: center; gap: 6px; min-width: 0; }\n  .all { display: grid; place-items: center; width: 28px; height: 28px; border-radius: 8px; color: #52645a; }\n  .all:hover { background: #f2f5f1; }\n  .all svg { width: 16px; height: 16px; }\n  a { color: #245f43; text-underline-offset: 3px; overflow-wrap: anywhere; }\n  a:focus-visible, button:focus-visible, summary:focus-visible { outline: 2px solid #357ce5; outline-offset: 3px; }\n  /* An element given its own display would otherwise go on showing while hidden. */\n  [hidden] { display: none !important; }\n  .summary { display: flex; align-items: center; gap: 8px; margin-top: 16px; }\n  .mark { width: 36px; height: 36px; flex-shrink: 0; }\n  .provider { width: 14px; height: 14px; }\n  .state { font-size: 14px; font-weight: 650; line-height: 1.4; }\n  .muted { color: #6b786f; font-size: 12px; }\n  .account { position: relative; }\n  .veiled > :not(.checking) { filter: blur(4px); opacity: .55; user-select: none; }\n  .checking { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; gap: 8px; color: #23312b; font-size: 13px; font-weight: 600; }\n  .spinner { width: 14px; height: 14px; border: 2px solid currentColor; border-right-color: transparent; border-radius: 50%; animation: spin .7s linear infinite; }\n  @keyframes spin { to { transform: rotate(360deg); } }\n  @media (prefers-reduced-motion: reduce) { .spinner { animation: none; } }\n  .caution { display: inline-block; margin-left: 4px; color: #a15c00; cursor: help; vertical-align: -1.5px; }\n  .caution svg { display: block; width: 12px; height: 12px; }\n  .bad { color: #b3261e; font-weight: 650; text-decoration: underline dotted; text-underline-offset: 3px; cursor: help; }\n  .account { padding: 14px 16px; border: 1px solid #e0e6df; border-radius: 10px; margin-top: 12px; }\n  .account h3 { display: flex; align-items: center; gap: 6px; margin: 0 0 3px; color: #6b786f; font-size: 11px; font-weight: 550; }\n  .account a, .account strong { font-weight: 650; font-size: 14px; }\n  /* The account's own name carries that weight; a link inside a line of prose does not. */\n  .summary a, .method a, .additional a { font: inherit; }\n  .reference { margin-top: 2px; }\n  /* A fingerprint in fours: it breaks between groups, and copies as one unbroken word. */\n  .fingerprint { font-family: ui-monospace, monospace; text-wrap: balance; }\n  .fingerprint span { display: inline-block; margin-right: .5ch; }\n  .method { margin-top: 8px; }\n  /* In the corner the heading leaves empty, apart from everything that was checked. */\n  .listing { position: absolute; top: 12px; right: 14px; padding: 1px 8px; border: 1px solid #e0e6df; border-radius: 999px; color: #6b786f; font-size: 11px; font-weight: 550; }\n  .listing.preferred { border-color: #245f43; color: #245f43; }\n  /* Quiet, as its pill is: the surface and the name step back, and the controls do not. */\n  .account.retired { background: #f6f8f5; }\n  .account.retired > a, .account.retired > strong { color: #6b786f; }\n  .account.retired .mark { opacity: .45; }\n  .group { margin: 20px 0 0; color: #6b786f; font-size: 11px; font-weight: 550; }\n  summary.group { display: flex; align-items: center; gap: 4px; width: fit-content; border-radius: 4px; list-style: none; cursor: pointer; }\n  summary::-webkit-details-marker { display: none; }\n  .fold { display: flex; align-items: center; gap: 4px; width: auto; height: auto; padding: 2px 8px 2px 4px; margin-left: -4px; border: 0; background: none; font: 550 12px/1.6 system-ui, sans-serif; }\n  .fold svg, summary svg { width: 12px; height: 12px; }\n  .fold[aria-expanded=\"true\"] svg, details[open] > summary svg { transform: rotate(90deg); }\n  @media (prefers-reduced-motion: no-preference) { .fold svg, summary svg { transition: transform .15s; } }\n  /* The fold and what the holder may do share a line, until a question needs the whole of it. */\n  .bar { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; margin-top: 10px; }\n  .account .bar .row { margin: 0 0 0 auto; }\n  .additional { margin-top: 2px; padding-left: 12px; }\n  .joiner { display: block; width: 20px; height: 20px; margin: 8px auto -4px; color: #90a096; }\n  dl { margin: 16px 0 0; padding-top: 12px; border-top: 1px solid #e5e9e3; display: grid; grid-template-columns: auto 1fr; gap: 5px 16px; font-size: 11px; }\n  dt { color: #6b786f; }\n  dd { margin: 0; text-align: right; overflow-wrap: anywhere; }\n  .explanation { margin-top: 16px; }\n  .action { width: auto; height: auto; padding: 9px 14px; font: 600 13px/1.3 system-ui, sans-serif; color: #23312b; text-align: left; }\n  .action.primary { border-color: #245f43; background: #245f43; color: #fff; }\n  .action.primary:hover { background: #1d4f37; }\n  .action:disabled { opacity: .6; cursor: progress; }\n  .action.danger:hover { border-color: #b3261e; background: #fdecea; color: #b3261e; }\n  .row { display: flex; justify-content: end; gap: 8px; margin-top: 16px; }\n  .account .row { align-items: center; justify-content: start; flex-wrap: wrap; margin-top: 12px; }\n  .account .action { padding: 5px 10px; font-size: 12px; }\n  .account .action.dots { display: grid; place-items: center; align-self: stretch; width: 30px; padding: 0; }\n  .dots svg { width: 16px; height: 16px; }\n  /* Placed under its button each time it opens, above the dialog and clipped by none of it. */\n  .menu { position: fixed; inset: auto; margin: 0; min-width: 170px; padding: 6px; border: 1px solid #dce2de; border-radius: 10px; background: #fff; color: #23312b; box-shadow: 0 12px 40px #10201930; }\n  .menu:popover-open { display: grid; }\n  .account .menu .action { border: 0; border-radius: 6px; padding: 6px 10px; font-weight: 550; }\n  .menu .danger { color: #b3261e; }\n  .menu hr { width: 100%; margin: 4px 0; border: 0; border-top: 1px solid #e5e9e3; }\n  footer { display: flex; align-items: center; justify-content: start; gap: 6px; margin: 20px 0 -8px; color: #9aa9a0; font-size: 11px; }\n  footer a { display: flex; color: inherit; }\n  .logo { display: block; height: 13px; }\n  \n  @media (prefers-reduced-motion: no-preference) {\n    .mark.current path:last-child { animation: verily-draw .8s cubic-bezier(.65, 0, .35, 1) .1s backwards; }\n  }\n  @keyframes verily-draw { from { stroke-dasharray: 0 176; } to { stroke-dasharray: 108 176; } }\n\n";
+export declare const styles = "\n  * { box-sizing: border-box; }\n  dialog { width: min(460px, calc(100vw - 32px)); max-height: calc(100dvh - 40px); margin: auto; padding: 24px; border: 1px solid #dce2de; border-radius: 16px; background: #fff; color: #23312b; box-shadow: 0 24px 90px #10201935; font: 13px/1.6 system-ui, sans-serif; }\n  dialog::backdrop { background: #15271f66; }\n  header { display: flex; align-items: center; justify-content: space-between; gap: 16px; margin-bottom: 20px; }\n  h2 { margin: 0; font-size: 18px; font-weight: 650; letter-spacing: -.3px; }\n  button { width: 32px; height: 32px; border: 1px solid #dce2de; border-radius: 8px; background: #fff; color: #52645a; font: 20px system-ui, sans-serif; cursor: pointer; }\n  button:hover { background: #f2f5f1; }\n  .icon { display: grid; place-items: center; padding: 0; }\n  .icon svg { width: 16px; height: 16px; }\n  .title { display: flex; align-items: center; gap: 6px; min-width: 0; }\n  .all { display: grid; place-items: center; width: 28px; height: 28px; border-radius: 8px; color: #52645a; }\n  .all:hover { background: #f2f5f1; }\n  .all svg { width: 16px; height: 16px; }\n  a { color: #245f43; text-underline-offset: 3px; overflow-wrap: anywhere; }\n  a:focus-visible, button:focus-visible, summary:focus-visible { outline: 2px solid #357ce5; outline-offset: 3px; }\n  /* An element given its own display would otherwise go on showing while hidden. */\n  [hidden] { display: none !important; }\n  .summary { display: flex; align-items: center; gap: 8px; margin-top: 16px; }\n  .mark { width: 36px; height: 36px; flex-shrink: 0; }\n  .provider { width: 14px; height: 14px; }\n  .state { font-size: 14px; font-weight: 650; line-height: 1.4; }\n  .muted { color: #6b786f; font-size: 12px; }\n  .account { position: relative; }\n  .veiled > :not(.checking) { filter: blur(4px); opacity: .55; user-select: none; }\n  .checking { position: absolute; inset: 0; display: flex; align-items: center; justify-content: center; gap: 8px; color: #23312b; font-size: 13px; font-weight: 600; }\n  .spinner { width: 14px; height: 14px; border: 2px solid currentColor; border-right-color: transparent; border-radius: 50%; animation: spin .7s linear infinite; }\n  @keyframes spin { to { transform: rotate(360deg); } }\n  @media (prefers-reduced-motion: reduce) { .spinner { animation: none; } }\n  /* The \"signed\" pill after the verifier's name, one size smaller than the line it sits on. */\n  .summary .signed { display: inline-block; margin-left: 5px; padding: 0 6px; border: 1px solid #cfdcd3; border-radius: 999px; font-size: 10px; font-weight: 550; line-height: 1.3; text-decoration: none; vertical-align: 1px; }\n  .summary a.signed:hover { background: #f2f5f1; }\n  .summary .signed.bad { border-color: #b3261e; color: #b3261e; font-weight: 650; cursor: help; }\n  .caution { display: inline-block; margin-left: 3px; color: #a15c00; vertical-align: -1.5px; }\n  .caution svg { display: block; width: 10px; height: 10px; }\n  .account { padding: 14px 16px; border: 1px solid #e0e6df; border-radius: 10px; margin-top: 12px; }\n  .account h3 { display: flex; align-items: center; gap: 6px; margin: 0 0 3px; color: #6b786f; font-size: 11px; font-weight: 550; }\n  .account a, .account strong { font-weight: 650; font-size: 14px; }\n  /* The account's own name carries that weight; a link inside a line of prose does not. */\n  .summary a, .method a, .additional a { font: inherit; }\n  .reference { margin-top: 2px; }\n  /* A fingerprint in fours: it breaks between groups, and copies as one unbroken word. */\n  .fingerprint { font-family: ui-monospace, monospace; text-wrap: balance; }\n  .fingerprint span { display: inline-block; margin-right: .5ch; }\n  .method { margin-top: 8px; }\n  /* In the corner the heading leaves empty, apart from everything that was checked. */\n  .listing { position: absolute; top: 12px; right: 14px; padding: 1px 8px; border: 1px solid #e0e6df; border-radius: 999px; color: #6b786f; font-size: 11px; font-weight: 550; }\n  .listing.preferred { border-color: #245f43; color: #245f43; }\n  /* Quiet, as its pill is: the surface and the name step back, and the controls do not. */\n  .account.retired { background: #f6f8f5; }\n  .account.retired > a, .account.retired > strong, .account.retired > .named > a, .account.retired > .named > strong { color: #6b786f; }\n  /* The name, then a dot and the account's creation date. The date wraps under a long name. */\n  /* Clipped 4px left of the text, which hides the dot when the date wraps to a new line. */\n  .named { display: flex; flex-wrap: wrap; align-items: baseline; gap: 0 14px; margin-left: -4px; padding-left: 4px; overflow-x: clip; }\n  .since { position: relative; white-space: nowrap; }\n  /* The dot sits in the gap before the date. */\n  .since::before { content: \"\u00B7\"; position: absolute; left: -7px; transform: translateX(-50%); }\n  .account.retired .mark { opacity: .45; }\n  .group { margin: 20px 0 0; color: #6b786f; font-size: 11px; font-weight: 550; }\n  summary.group { display: flex; align-items: center; gap: 4px; width: fit-content; border-radius: 4px; list-style: none; cursor: pointer; }\n  summary::-webkit-details-marker { display: none; }\n  .fold { display: flex; align-items: center; gap: 4px; width: auto; height: auto; padding: 2px 8px 2px 4px; margin-left: -4px; border: 0; background: none; font: 550 12px/1.6 system-ui, sans-serif; }\n  .fold svg, summary svg { width: 12px; height: 12px; }\n  .fold[aria-expanded=\"true\"] svg, details[open] > summary svg { transform: rotate(90deg); }\n  @media (prefers-reduced-motion: no-preference) { .fold svg, summary svg { transition: transform .15s; } }\n  /* The fold and what the holder may do share a line, until a question needs the whole of it. */\n  .bar { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; margin-top: 10px; }\n  .account .bar .row { margin: 0 0 0 auto; }\n  .additional { margin-top: 2px; padding-left: 12px; }\n  .joiner { display: block; width: 20px; height: 20px; margin: 8px auto -4px; color: #90a096; }\n  dl { margin: 16px 0 0; padding-top: 12px; border-top: 1px solid #e5e9e3; display: grid; grid-template-columns: auto 1fr; gap: 5px 16px; font-size: 11px; }\n  dt { color: #6b786f; }\n  dd { margin: 0; text-align: right; overflow-wrap: anywhere; }\n  .explanation { margin-top: 16px; }\n  .action { width: auto; height: auto; padding: 9px 14px; font: 600 13px/1.3 system-ui, sans-serif; color: #23312b; text-align: left; }\n  .action.primary { border-color: #245f43; background: #245f43; color: #fff; }\n  .action.primary:hover { background: #1d4f37; }\n  .action:disabled { opacity: .6; cursor: progress; }\n  .action.danger:hover { border-color: #b3261e; background: #fdecea; color: #b3261e; }\n  .row { display: flex; justify-content: end; gap: 8px; margin-top: 16px; }\n  .account .row { align-items: center; justify-content: start; flex-wrap: wrap; margin-top: 12px; }\n  .account .action { padding: 5px 10px; font-size: 12px; }\n  .account .action.dots { display: grid; place-items: center; align-self: stretch; width: 30px; padding: 0; }\n  .dots svg { width: 16px; height: 16px; }\n  /* Placed under its button each time it opens, above the dialog and clipped by none of it. */\n  .menu { position: fixed; inset: auto; margin: 0; min-width: 170px; padding: 6px; border: 1px solid #dce2de; border-radius: 10px; background: #fff; color: #23312b; box-shadow: 0 12px 40px #10201930; }\n  .menu:popover-open { display: grid; }\n  .account .menu .action { border: 0; border-radius: 6px; padding: 6px 10px; font-weight: 550; }\n  .menu .danger { color: #b3261e; }\n  .menu hr { width: 100%; margin: 4px 0; border: 0; border-top: 1px solid #e5e9e3; }\n  footer { display: flex; align-items: center; justify-content: start; gap: 6px; margin: 20px 0 -8px; color: #9aa9a0; font-size: 11px; }\n  footer a { display: flex; color: inherit; }\n  .logo { display: block; height: 13px; }\n  \n  @media (prefers-reduced-motion: no-preference) {\n    .mark.current path:last-child { animation: verily-draw .8s cubic-bezier(.65, 0, .35, 1) .1s backwards; }\n  }\n  @keyframes verily-draw { from { stroke-dasharray: 0 176; } to { stroke-dasharray: 108 176; } }\n\n";
 export declare function node<K extends keyof HTMLElementTagNameMap>(tag: K, text?: string, className?: string): HTMLElementTagNameMap[K];
 /**
  * Points an anchor out of the dialog. Every link here opens in a new tab: the dialog is
@@ -26,6 +26,11 @@ export declare function linkMark(): SVGSVGElement;
  * expires on its own terms, and a second provider on the same subject would differ.
  */
 export declare function accountCard(heading: Node[], name: string, reference: string | string[] | undefined, url?: string, ...extra: HTMLElement[]): HTMLElement;
+/**
+ * The card for an external account: its name, link and id, with the "Joined <date>" text
+ * on the name's line when the creation date is known.
+ */
+export declare function namedCard(heading: Node[], external: ExternalAccount, ...extra: HTMLElement[]): HTMLElement;
 /**
  * A record as a card shows it. Where the card speaks for several records of one account,
  * `links` names every one not yet revoked, whether or not it is shown, so removing the

package/dist/browser/evidence-dialog.js

@@ -1,4 +1,4 @@
-import { attestationLabel, externalId, externalIdGroups, externalLink, externalName, lastProved, localSide, proofTitle, statusLabel, } from '../core/index.js';
+import { attestationLabel, externalId, externalIdGroups, externalLink, externalName, externalSince, lastProved, localSide, proofTitle, statusLabel, } from '../core/index.js';
 import { markStyles, verificationMark } from './mark.js';
 import { providerMark } from './provider-mark.js';
 import { onSignatureResult, signature, standing } from './signed.js';
@@ -40,9 +40,12 @@ export const styles = `
   .spinner { width: 14px; height: 14px; border: 2px solid currentColor; border-right-color: transparent; border-radius: 50%; animation: spin .7s linear infinite; }
   @keyframes spin { to { transform: rotate(360deg); } }
   @media (prefers-reduced-motion: reduce) { .spinner { animation: none; } }
-  .caution { display: inline-block; margin-left: 4px; color: #a15c00; cursor: help; vertical-align: -1.5px; }
-  .caution svg { display: block; width: 12px; height: 12px; }
-  .bad { color: #b3261e; font-weight: 650; text-decoration: underline dotted; text-underline-offset: 3px; cursor: help; }
+  /* The "signed" pill after the verifier's name, one size smaller than the line it sits on. */
+  .summary .signed { display: inline-block; margin-left: 5px; padding: 0 6px; border: 1px solid #cfdcd3; border-radius: 999px; font-size: 10px; font-weight: 550; line-height: 1.3; text-decoration: none; vertical-align: 1px; }
+  .summary a.signed:hover { background: #f2f5f1; }
+  .summary .signed.bad { border-color: #b3261e; color: #b3261e; font-weight: 650; cursor: help; }
+  .caution { display: inline-block; margin-left: 3px; color: #a15c00; vertical-align: -1.5px; }
+  .caution svg { display: block; width: 10px; height: 10px; }
   .account { padding: 14px 16px; border: 1px solid #e0e6df; border-radius: 10px; margin-top: 12px; }
   .account h3 { display: flex; align-items: center; gap: 6px; margin: 0 0 3px; color: #6b786f; font-size: 11px; font-weight: 550; }
   .account a, .account strong { font-weight: 650; font-size: 14px; }
@@ -58,7 +61,13 @@ export const styles = `
   .listing.preferred { border-color: #245f43; color: #245f43; }
   /* Quiet, as its pill is: the surface and the name step back, and the controls do not. */
   .account.retired { background: #f6f8f5; }
-  .account.retired > a, .account.retired > strong { color: #6b786f; }
+  .account.retired > a, .account.retired > strong, .account.retired > .named > a, .account.retired > .named > strong { color: #6b786f; }
+  /* The name, then a dot and the account's creation date. The date wraps under a long name. */
+  /* Clipped 4px left of the text, which hides the dot when the date wraps to a new line. */
+  .named { display: flex; flex-wrap: wrap; align-items: baseline; gap: 0 14px; margin-left: -4px; padding-left: 4px; overflow-x: clip; }
+  .since { position: relative; white-space: nowrap; }
+  /* The dot sits in the gap before the date. */
+  .since::before { content: "·"; position: absolute; left: -7px; transform: translateX(-50%); }
   .account.retired .mark { opacity: .45; }
   .group { margin: 20px 0 0; color: #6b786f; font-size: 11px; font-weight: 550; }
   summary.group { display: flex; align-items: center; gap: 4px; width: fit-content; border-radius: 4px; list-style: none; cursor: pointer; }
@@ -232,13 +241,34 @@ function moment(time) {
  * expires on its own terms, and a second provider on the same subject would differ.
  */
 export function accountCard(heading, name, reference, url, ...extra) {
+    return side(heading, name, reference, url, undefined, extra);
+}
+/**
+ * The card for an external account: its name, link and id, with the "Joined <date>" text
+ * on the name's line when the creation date is known.
+ */
+export function namedCard(heading, external, ...extra) {
+    return side(heading, externalName(external), 
+    // A mailbox's address or a domain is its name already, so there is no second identifier.
+    externalIdGroups(external) ?? externalId(external), externalLink(external), 
+    // In UTC, so the day matches the one the verifier's own pages print.
+    externalSince(external, (time) => new Date(time).toLocaleDateString(undefined, { dateStyle: 'medium', timeZone: 'UTC' })), extra);
+}
+function side(heading, name, reference, url, since, extra) {
     const card = node('section', '', 'account');
     const title = node('h3');
     const value = node(url ? 'a' : 'strong', name);
     title.append(...heading);
     if (value instanceof HTMLAnchorElement)
         outward(value, url);
-    card.append(title, value);
+    if (since) {
+        // The name and the date share a line, and the date wraps under a long name.
+        const named = node('div', '', 'named');
+        named.append(value, node('span', since, 'muted since'));
+        card.append(title, named);
+    }
+    else
+        card.append(title, value);
     if (typeof reference === 'string')
         card.append(node('div', reference, 'muted reference'));
     else if (reference) {
@@ -420,38 +450,45 @@ function signatures(evidence) {
         : signature(source)));
 }
 /**
- * Says a record is signed, in a word beside its verifier. The word opens the verifier's
- * own page for the record at what it says of the signature, where the signed record is to be
- * had: nothing is downloaded from the card. The signed record is checked here against the
- * verifier's keys: a tick once it has checked, and a warning in the word's place if it
- * fails, the one thing on a card that is a warning. `warned` is told each time that warning
- * is drawn, on the first check or on a later one, so whatever folds the card away opens.
+ * The "signed" pill shown after the verifier's name. It links to the signature section of
+ * the verifier's evidence page, where the signed record can be downloaded.
+ *
+ * The signature is checked here against the verifier's keys:
+ * - valid: the pill says "signed"
+ * - not yet checked: the pill carries a warning sign
+ * - invalid: a warning replaces the pill
+ *
+ * `warned` is called every time the invalid warning is drawn, so a folded card can open.
  */
 function signedMark(evidence, later, warned) {
     const mark = node('span');
-    const link = outward(node('a', 'signed'), `${evidence.evidenceUrl}#signed`);
+    const link = outward(node('a', 'signed', 'signed'), `${evidence.evidenceUrl}#signed`);
     const see = 'See the signature (opens in a new tab)';
     const settle = (results) => {
         const first = results[0];
         if (results.some((result) => result.state === 'invalid')) {
-            const warning = node('span', 'invalid signature', 'bad');
+            // Not a link: the page it would open is the one this record failed to match.
+            const warning = node('span', 'bad signature', 'signed bad');
             warning.setAttribute('role', 'alert');
             // What it means, for a reader who has never met a signature, kept off the card.
             warning.title = `This record does not match the signature ${evidence.verifierName} put on it, so it may have been altered. Do not rely on it.`;
-            mark.replaceChildren(document.createTextNode(' · '), warning);
+            mark.replaceChildren(warning);
             warned();
             return;
         }
         if (first?.state === 'valid' && results.every((result) => result.state === 'valid')) {
-            link.textContent = 'signed ✓';
-            // Names where the keys came from, which is what the tick answers for.
+            // No tick: a signature that checks out is what a reader expects, and the pill is
+            // marked only when it did not. Setting the word again clears a warning sign left in it.
+            link.textContent = 'signed';
+            // Names where the keys came from, which is what the check answers for.
             link.title = `Signature checked in this browser against the keys ${new URL(evidence.evidenceUrl).host} publishes (key ${first.keyId}). ${see}`;
-            mark.replaceChildren(document.createTextNode(' · '), link);
+            mark.replaceChildren(link);
             return;
         }
-        // No verdict was reached. The record is signed and says so, with a warning beside the
-        // word in place of a tick, and why is said on hover. A check that only ran out of time
-        // or could not read what it needed is made again when the dialog next reads.
+        // No verdict was reached. The record is signed and says so, with a warning sign in the
+        // pill, which is all that tells it from one that checked out, and why is said on hover.
+        // A check that only ran out of time or could not read what it needed is made again when
+        // the dialog next reads.
         const why = results.find((result) => result.state === 'unchecked');
         const reason = why?.state === 'unchecked' && why.why === 'timeout'
             ? 'Signature check timed out, retrying.'
@@ -462,8 +499,9 @@ function signedMark(evidence, later, warned) {
         caution.setAttribute('aria-label', reason);
         caution.append(cautionMark());
         link.textContent = 'signed';
+        link.append(caution);
         link.title = `${reason} ${see}`;
-        mark.replaceChildren(document.createTextNode(' · '), link, caution);
+        mark.replaceChildren(link);
         if (why)
             later(() => void signatures(evidence).then(settle));
     };
@@ -585,12 +623,10 @@ function externalCard(evidence, manage, later = () => { }, fold, warned = () =>
     if (fold)
         bar.append(foldToggle([...methods, dates], fold), ...row);
     const logo = providerMark(evidence.provider, evidence.attestations.external[0].method);
-    const card = accountCard(
+    const card = namedCard(
     // The mark and the name, or just the name. A mark that falls back to writing the name
     // would print it twice here, since this heading writes it either way.
-    logo ? [logo, document.createTextNode(provider)] : [document.createTextNode(provider)], externalName(evidence.external), 
-    // A mailbox's address or a domain is its name already, so there is no second identifier.
-    externalIdGroups(evidence.external) ?? externalId(evidence.external), externalLink(evidence.external), 
+    logo ? [logo, document.createTextNode(provider)] : [document.createTextNode(provider)], evidence.external, 
     // Status first, then how it was shown, then when. The proof explains the state
     // above it, so it cannot sit before that state has been given.
     summary, ...(fold ? [] : methods), 

package/dist/browser/index.js

@@ -649,6 +649,9 @@ function validEvidence(value) {
         ['label', 'reference'].every((k) => typeof value.local[k] === 'string') &&
         ['id', 'handle', 'profileUrl'].every((k) => typeof value.external[k] === 'string') &&
         (value.local.profileUrl === undefined || typeof value.local.profileUrl === 'string') &&
+        (value.external.createdAt === undefined ||
+            (typeof value.external.createdAt === 'number' &&
+                Number.isFinite(value.external.createdAt))) &&
         // A signed record lives beside the record it was made from and nowhere else, since the
         // keys it is checked against are read from where the record lives.
         (value.signedUrl === undefined || value.signedUrl === `${value.evidenceUrl}?format=signed`) &&

package/dist/core/index.d.ts

@@ -45,6 +45,12 @@ export interface ExternalAccount {
     handle: string;
     /** Where a reader goes to see the subject. For a mailbox, its `mailto:` address. */
     profileUrl: string;
+    /**
+     * When the account was created, in milliseconds, as reported by the provider. It lets a
+     * reader tell an old account from one opened just to be linked. Only sign-in providers
+     * set it. Once a record has it, later proofs by other methods keep it.
+     */
+    createdAt?: number;
 }
 /**
  * How control of one side was shown. A provider is who an account belongs to; a method is
@@ -96,6 +102,13 @@ export interface Attestation {
      * is reconfirmed like any other.
      */
     confirmedAt: number;
+    /** When `recheck()` last tried to read the proof, whether or not the read worked. */
+    readAt?: number;
+    /**
+     * When a recheck first read the proof and found it missing. The proof does not count
+     * while this is set. Cleared by the next read that finds it.
+     */
+    absentAt?: number;
 }
 /** Each side of a link is attested separately, by different parties under different methods. */
 export interface Attestations {
@@ -137,9 +150,44 @@ export interface Connection {
      * last proof: never renewed by another method, never reread, never verified.
      */
     retiredAt?: number;
+    /** The state last delivered to `onChange`. Absent until the first delivery. */
+    reported?: Reported;
+    /**
+     * When the last delivery to `onChange` started, while it has not been confirmed. Set when
+     * a delivery starts and cleared when it succeeds, so a record with it set is delivered
+     * again even if its state matches `reported`.
+     */
+    reportTriedAt?: number;
+    /** The revision given to the last delivery. Each delivery of the record adds one. */
+    reportRevision?: number;
+}
+/** The parts of a record that `onChange` reports a change in. */
+export interface Reported {
+    status: Status;
+    visibility: Visibility;
+    expiresAt: number;
+    mark?: Mark;
+}
+/** One record whose status, visibility, expiry or mark changed, as `onChange` receives it. */
+export interface Change {
+    /** The record as it stands now. */
+    evidence: Evidence;
+    /** The subject the record belongs to, with its private id. */
+    local: LocalAccount;
+    /** What the last confirmed delivery reported. Absent until one is confirmed. */
+    previous?: Reported;
+    /**
+     * Counts the deliveries of this record, starting at 1. A higher revision always carries
+     * a state read later, across processes too. Keep the last one applied for each record
+     * and ignore a change whose revision is not higher: a slow or repeated delivery can
+     * arrive after a newer one.
+     */
+    revision: number;
 }
 export interface Flow {
     id: string;
+    /** Saved DNS setup; grants no authority to finish a flow. */
+    dnsDraftId?: string;
     stateHash: string;
     bindingHash: string;
     verifier?: string;
@@ -155,7 +203,8 @@ export interface Flow {
     reason?: string;
     /**
      * The string an artifact must contain. Public by design: the holder publishes it. It is
-     * unguessable and per-flow, so an artifact made for one flow cannot complete another.
+     * normally unguessable and per-flow. DNS setup can retain the same value across
+     * fresh flows for the same subject and operation while propagation is pending.
      */
     expect?: string;
     /** Whether `expect` was minted for a method that had nothing of the subject's to state. */
@@ -269,7 +318,16 @@ export interface SiteRead {
     /** Whether that read got an answer. One that did not is asked again sooner. */
     answered: boolean;
 }
+/** DNS setup retained across short-lived, authenticated flows for seven days. */
+export interface DnsDraft {
+    id: string;
+    flowId: string;
+    expect: string;
+    artifact?: string;
+    expiresAt: number;
+}
 export interface Records {
+    dnsDrafts: DnsDraft;
     connections: Connection;
     flows: Flow;
     shares: Share;
@@ -349,8 +407,9 @@ export interface ArtifactProvider {
      * Told to the holder verbatim. Must name what they are publishing and where. Returned in
      * pieces so a renderer can set a command as one: a command is copied character for
      * character, and prose that reflows is prose a holder cannot safely copy.
+     * `artifact` is the last submitted or suggested location, when one is known.
      */
-    instructions(expect: string): Instruction[];
+    instructions(expect: string, artifact?: string): Instruction[];
     /**
      * What the holder is asked to hand back, where the method takes something a holder knows
      * by a better name than "an address". `input` says how to ask for it: `text` where it
@@ -451,6 +510,14 @@ export interface CodeProvider {
  */
 export declare class Refused extends Error {
 }
+/**
+ * A proof that was read and is not there: the page, file, gist or DNS answer came back and
+ * the expected value was missing. Thrown by `verify` or `prove`. On a recheck it makes the
+ * proof unconfirmed at once. Any other error means the read itself failed, and the proof
+ * keeps counting until `freshnessMs` runs out.
+ */
+export declare class Absent extends Refused {
+}
 /**
  * A piece of what the holder is told: a paragraph, a paragraph with links in it, or
  * something they run or publish as is.
@@ -525,6 +592,10 @@ export * from './routes.js';
  * telling anyone, so a confirmation is a heartbeat rather than a permanent fact.
  */
 export declare const freshnessMs: number;
+/** Whether a record has reached its deadline, including the exact expiry instant. */
+export declare function expired(record: {
+    expiresAt: number;
+}, now: number): boolean;
 /**
  * `freshness` bounds how stale a published proof may be before it stops counting. A
  * backend that never rechecks must leave it unbounded, since an unread proof going stale
@@ -612,6 +683,11 @@ export declare function externalId(external: ExternalAccount): string | undefine
  * between groups. Nothing for any other subject, whose id is written as it stands.
  */
 export declare function externalIdGroups(external: ExternalAccount): string[] | undefined;
+/**
+ * The text for an account's creation date, such as "Joined 2014-03-02", or undefined if
+ * the date is unknown. `day` formats the date, to the day.
+ */
+export declare function externalSince(external: ExternalAccount, day: (time: number) => string): string | undefined;
 /**
  * Where a subject's name may link, or nothing where it has no page of its own. A mailbox's
  * address is `mailto:`, which opens a message to it and shows a reader nothing.

package/dist/core/index.js

@@ -4,6 +4,14 @@
  */
 export class Refused extends Error {
 }
+/**
+ * A proof that was read and is not there: the page, file, gist or DNS answer came back and
+ * the expected value was missing. Thrown by `verify` or `prove`. On a recheck it makes the
+ * proof unconfirmed at once. Any other error means the read itself failed, and the proof
+ * keeps counting until `freshnessMs` runs out.
+ */
+export class Absent extends Refused {
+}
 /** Only an artifact provider is holder-paced, and only it needs a url handed back. */
 export function isArtifactProvider(provider) {
     return 'verify' in provider;
@@ -28,6 +36,10 @@ export * from './routes.js';
  * telling anyone, so a confirmation is a heartbeat rather than a permanent fact.
  */
 export const freshnessMs = 7 * 86400000;
+/** Whether a record has reached its deadline, including the exact expiry instant. */
+export function expired(record, now) {
+    return record.expiresAt <= now;
+}
 /**
  * `freshness` bounds how stale a published proof may be before it stops counting. A
  * backend that never rechecks must leave it unbounded, since an unread proof going stale
@@ -39,7 +51,7 @@ export function status(connection, now, freshness = freshnessMs) {
     // Frozen at its last proof, so neither its expiry nor its freshness is read again.
     if (connection.retiredAt !== undefined)
         return 'retired';
-    if (now >= connection.expiresAt)
+    if (expired(connection, now))
         return 'expired';
     const main = connection.attestations?.external[0];
     if (main && !fresh(main, now, freshness))
@@ -52,6 +64,9 @@ export function status(connection, now, freshness = freshnessMs) {
  * reverses the moment it reads again.
  */
 export function fresh(attestation, now, freshness = freshnessMs) {
+    // Read and found missing, which is not the same as not having been read lately.
+    if (attestation.absentAt !== undefined)
+        return false;
     return (!attestation.artifactUrl ||
         attestation.hosted === true ||
         freshness === Infinity ||
@@ -75,7 +90,7 @@ export function statusLabel(evidence, now) {
     // Before expiry: a retired record's approval has long run out, and that is not its state.
     if (evidence.status === 'retired')
         return 'Retired';
-    if (evidence.status === 'expired' || evidence.expiresAt <= now)
+    if (evidence.status === 'expired' || expired(evidence, now))
         return 'Expired';
     return evidence.status === 'unconfirmed' ? 'Unconfirmed' : 'Verified';
 }
@@ -188,6 +203,15 @@ export function externalId(external) {
 export function externalIdGroups(external) {
     return external.kind === 'key' ? (external.id.match(/.{1,4}/g) ?? undefined) : undefined;
 }
+/**
+ * The text for an account's creation date, such as "Joined 2014-03-02", or undefined if
+ * the date is unknown. `day` formats the date, to the day.
+ */
+export function externalSince(external, day) {
+    return typeof external.createdAt === 'number' && Number.isFinite(external.createdAt)
+        ? `Joined ${day(external.createdAt)}`
+        : undefined;
+}
 /**
  * Where a subject's name may link, or nothing where it has no page of its own. A mailbox's
  * address is `mailto:`, which opens a message to it and shows a reader nothing.

package/dist/server/discord.js

@@ -62,6 +62,9 @@ export function discordProvider(options) {
                 id: user.id,
                 handle: user.username,
                 profileUrl: `https://discord.com/users/${user.id}`,
+                // A Discord id encodes its creation time: the bits above the low 22 are
+                // milliseconds since 2015-01-01 UTC.
+                createdAt: Number(BigInt(user.id) >> 22n) + 1420070400000,
             };
         },
     };

package/dist/server/domain.js

@@ -1,5 +1,5 @@
 import { MIMEType } from 'node:util';
-import { Refused, } from '../core/index.js';
+import { Absent, Refused, } from '../core/index.js';
 import { discard, readBounded } from './body.js';
 import { transport } from './public-fetch.js';
 /**
@@ -47,18 +47,39 @@ export function dnsProvider(options = {}) {
         const domain = looked(artifact);
         const { values, dnssec } = await published(domain, options);
         if (!values.includes(expect))
-            throw new Refused(`No TXT record at ${label}.${domain} has this value`);
+            throw new Absent(`No TXT record at ${label}.${domain} has this value`);
         return { account: account(domain), ...(dnssec ? { dnssec } : {}) };
     };
     return {
         ...shared(options),
         method: 'dns',
-        instructions: (expect) => [
-            'Add a TXT record to your domain’s DNS with this name and value, then enter the domain below.',
-            { code: label },
-            { code: expect },
-            'A new record can take a few minutes to be seen.',
-        ],
+        instructions(expect, artifact) {
+            let domain = artifact ? named(artifact) : undefined;
+            if (!domain && artifact) {
+                try {
+                    domain = looked(artifact);
+                }
+                catch {
+                    /* An invalid input is never a command. */
+                }
+            }
+            const record = domain ? `${label}.${domain}` : `${label}.YOUR-DOMAIN`;
+            return [
+                domain
+                    ? 'Add a TXT record with this name and value.'
+                    : 'Add a TXT record with this name and value. Replace YOUR-DOMAIN with the exact domain you enter below.',
+                { code: record },
+                'If your DNS host adds the domain automatically, enter only _verily for the root domain. For a subdomain such as www.example.com in the example.com zone, enter _verily.www.',
+                { code: expect },
+                domain
+                    ? `Proves control of ${domain} only. Parent domains and subdomains must be verified separately.`
+                    : 'Proves control of the exact domain you enter. Parent domains and subdomains must be verified separately.',
+                'DNS changes can take up to 72 hours to appear. Check the published record with:',
+                { code: `dig TXT ${record} +short` },
+                ...(domain ? [[{ text: 'Look up this TXT record', href: lookup(domain) }]] : []),
+                'Keep the TXT record in place after verification so Verily can check it again.',
+            ];
+        },
         resolve(artifact) {
             const domain = named(artifact);
             return domain ? lookup(domain) : artifact;
@@ -223,6 +244,9 @@ export function wellKnownProvider(options = {}) {
                 // The holder named this domain, so a redirect would take the check somewhere else.
                 if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400))
                     throw new Refused('File redirects, and a redirect is not followed');
+                // The file is gone. Any other failure is a failed read.
+                if (response.status === 404 || response.status === 410)
+                    throw new Absent('File unavailable');
                 if (!response.ok)
                     throw new Refused('File unavailable');
                 if (mediaType(response.headers.get('content-type')) !== 'text/plain')
@@ -232,8 +256,11 @@ export function wellKnownProvider(options = {}) {
                 // The last line of a file cut short may be the start of some longer address.
                 if (truncated)
                     lines.pop();
-                if (!lines.some((line) => line.trim() === expect))
-                    throw new Refused(truncated ? 'File is too large to read' : 'File has no line with this value');
+                if (!lines.some((line) => line.trim() === expect)) {
+                    if (truncated)
+                        throw new Refused('File is too large to read');
+                    throw new Absent('File has no line with this value');
+                }
             }
             finally {
                 await discard(response);