@bkazemi/verily 0.6.0 → 0.8.0

package/dist/marks.js

@@ -0,0 +1,98 @@
+/** GitHub mark from Primer Octicons (MIT); license in docs/licenses/octicons.txt. */
+const github = {
+    viewBox: '0 0 16 16',
+    paths: [
+        'M6.766 11.328c-2.063-.25-3.516-1.734-3.516-3.656 0-.781.281-1.625.75-2.188-.203-.515-.172-1.609.063-2.062.625-.078 1.468.25 1.968.703.594-.187 1.219-.281 1.985-.281.765 0 1.39.094 1.953.265.484-.437 1.344-.765 1.969-.687.218.422.25 1.515.046 2.047.5.593.766 1.39.766 2.203 0 1.922-1.453 3.375-3.547 3.64.531.344.89 1.094.89 1.954v1.625c0 .468.391.734.86.547C13.781 14.359 16 11.53 16 8.03 16 3.61 12.406 0 7.984 0 3.563 0 0 3.61 0 8.031a7.88 7.88 0 0 0 5.172 7.422c.422.156.828-.125.828-.547v-1.25c-.219.094-.5.156-.75.156-1.031 0-1.64-.562-2.078-1.609-.172-.422-.36-.672-.719-.719-.187-.015-.25-.093-.25-.187 0-.188.313-.328.625-.328.453 0 .844.281 1.25.86.313.452.64.655 1.031.655s.641-.14 1-.5c.266-.265.47-.5.657-.656',
+    ],
+};
+/**
+ * Discord mark from Simple Icons (CC0); notice in docs/licenses/simple-icons.txt. The mark
+ * itself is Discord's trademark, used here only to say an account is a Discord account.
+ */
+const discord = {
+    viewBox: '0 0 24 24',
+    paths: [
+        'M20.317 4.3698a19.7913 19.7913 0 00-4.8851-1.5152.0741.0741 0 00-.0785.0371c-.211.3753-.4447.8648-.6083 1.2495-1.8447-.2762-3.68-.2762-5.4868 0-.1636-.3933-.4058-.8742-.6177-1.2495a.077.077 0 00-.0785-.037 19.7363 19.7363 0 00-4.8852 1.515.0699.0699 0 00-.0321.0277C.5334 9.0458-.319 13.5799.0992 18.0578a.0824.0824 0 00.0312.0561c2.0528 1.5076 4.0413 2.4228 5.9929 3.0294a.0777.0777 0 00.0842-.0276c.4616-.6304.8731-1.2952 1.226-1.9942a.076.076 0 00-.0416-.1057c-.6528-.2476-1.2743-.5495-1.8722-.8923a.077.077 0 01-.0076-.1277c.1258-.0943.2517-.1923.3718-.2914a.0743.0743 0 01.0776-.0105c3.9278 1.7933 8.18 1.7933 12.0614 0a.0739.0739 0 01.0785.0095c.1202.099.246.1981.3728.2924a.077.077 0 01-.0066.1276 12.2986 12.2986 0 01-1.873.8914.0766.0766 0 00-.0407.1067c.3604.698.7719 1.3628 1.225 1.9932a.076.076 0 00.0842.0286c1.961-.6067 3.9495-1.5219 6.0023-3.0294a.077.077 0 00.0313-.0552c.5004-5.177-.8382-9.6739-3.5485-13.6604a.061.061 0 00-.0312-.0286zM8.02 15.3312c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9555-2.4189 2.157-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.9555 2.4189-2.1569 2.4189zm7.9748 0c-1.1825 0-2.1569-1.0857-2.1569-2.419 0-1.3332.9554-2.4189 2.1569-2.4189 1.2108 0 2.1757 1.0952 2.1568 2.419 0 1.3332-.946 2.4189-2.1568 2.4189Z',
+    ],
+};
+/** YouTube mark from Simple Icons (CC0); notice in docs/licenses/simple-icons.txt. */
+const youtube = {
+    viewBox: '0 0 24 24',
+    paths: [
+        'M23.498 6.186a3.016 3.016 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.017 3.017 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.016 3.016 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.015 3.015 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814zM9.545 15.568V8.432L15.818 12l-6.273 3.568z',
+    ],
+};
+/**
+ * A key, drawn here rather than taken from anywhere. It is not the OpenPGP logo: that mark
+ * is somebody's to license and this repository does not ship artwork it cannot account for.
+ * A key is also the truer picture, since what was proved is control of one, not membership
+ * of an organisation.
+ */
+const key = {
+    viewBox: '0 0 16 16',
+    stroke: true,
+    paths: [
+        'M7.4 8.6a3.3 3.3 0 1 0-4.7 4.7 3.3 3.3 0 0 0 4.7-4.7Z',
+        'M7.4 8.6 14 2',
+        'M11.2 4.8l1.6 1.6',
+        'M9.4 6.6l1.6 1.6',
+    ],
+};
+/** A globe, drawn here like the key, for a page or a domain on the open web. */
+const globe = {
+    viewBox: '0 0 16 16',
+    stroke: true,
+    paths: [
+        'M8 1.5a6.5 6.5 0 1 0 0 13 6.5 6.5 0 0 0 0-13Z',
+        'M1.5 8h13',
+        'M8 1.5C6.1 3.3 5.1 5.5 5.1 8s1 4.7 2.9 6.5',
+        'M8 1.5c1.9 1.8 2.9 4 2.9 6.5s-1 4.7-2.9 6.5',
+    ],
+};
+/** An envelope, drawn here like the key, for a mailbox that read a code sent to it. */
+const envelope = {
+    viewBox: '0 0 16 16',
+    stroke: true,
+    paths: ['M2 3.5h12v9H2z', 'M2.4 4l5.6 4.6L13.6 4'],
+};
+const marks = { github, discord, youtube, openpgp: key, email: envelope };
+/**
+ * The mark for a provider, or nothing where there is none. Returning nothing rather than
+ * the provider's name keeps this to one job: a caller that also writes the name would
+ * otherwise print it twice, and only the caller knows where the name belongs.
+ */
+export function markOf(provider, method) {
+    // A site names its own link-back providers, so those fall back on the method's mark,
+    // which a domain shown by its DNS or by a file shares.
+    return (marks[provider] ?? (['backlink', 'dns', 'wellknown'].includes(method ?? '') ? globe : undefined));
+}
+/** The attributes every path of a mark gets, as name and value pairs. */
+export const pathAttributes = (mark) => mark.stroke
+    ? [
+        ['stroke', 'currentColor'],
+        ['stroke-width', '1.6'],
+        ['stroke-linecap', 'round'],
+        ['stroke-linejoin', 'round'],
+    ]
+    : [];
+/** The V's two strokes in each tone: the V, then the check drawn inside it. */
+export const tones = {
+    current: ['#D3444C', '#149766'],
+    inactive: ['#149766', '#D3444C'],
+    pending: ['currentColor', 'currentColor'],
+};
+/** The tone a record's mark is drawn in. A retired account claims nothing, not a failure. */
+export function toneOf(evidence, now) {
+    if (evidence.status === 'verified' && evidence.expiresAt > now)
+        return 'current';
+    return evidence.status === 'retired' ? 'pending' : 'inactive';
+}
+/** V2: the green check fills its section of the symmetric red V. */
+export const verification = {
+    viewBox: '-4 -4 264 264',
+    /** The box around the strokes alone: the arms' squared ends and the mitred foot. */
+    strokes: '25.6 29.1 204.8 228',
+    path: 'M40 36 128 220 216 36',
+    /** The check's stretch of the V, as a dash along a path measured as 176 long. */
+    check: { pathLength: '176', 'stroke-dasharray': '108 176', 'stroke-dashoffset': '-54' },
+};

package/dist/server/discord.js

@@ -62,6 +62,9 @@ export function discordProvider(options) {
                 id: user.id,
                 handle: user.username,
                 profileUrl: `https://discord.com/users/${user.id}`,
+                // A Discord id encodes its creation time: the bits above the low 22 are
+                // milliseconds since 2015-01-01 UTC.
+                createdAt: Number(BigInt(user.id) >> 22n) + 1420070400000,
             };
         },
     };

package/dist/server/domain.js

@@ -1,5 +1,5 @@
 import { MIMEType } from 'node:util';
-import { Refused, } from '../core/index.js';
+import { Absent, Refused, } from '../core/index.js';
 import { discard, readBounded } from './body.js';
 import { transport } from './public-fetch.js';
 /**
@@ -47,18 +47,39 @@ export function dnsProvider(options = {}) {
         const domain = looked(artifact);
         const { values, dnssec } = await published(domain, options);
         if (!values.includes(expect))
-            throw new Refused(`No TXT record at ${label}.${domain} has this value`);
+            throw new Absent(`No TXT record at ${label}.${domain} has this value`);
         return { account: account(domain), ...(dnssec ? { dnssec } : {}) };
     };
     return {
         ...shared(options),
         method: 'dns',
-        instructions: (expect) => [
-            'Add a TXT record to your domain’s DNS with this name and value, then enter the domain below.',
-            { code: label },
-            { code: expect },
-            'A new record can take a few minutes to be seen.',
-        ],
+        instructions(expect, artifact) {
+            let domain = artifact ? named(artifact) : undefined;
+            if (!domain && artifact) {
+                try {
+                    domain = looked(artifact);
+                }
+                catch {
+                    /* An invalid input is never a command. */
+                }
+            }
+            const record = domain ? `${label}.${domain}` : `${label}.YOUR-DOMAIN`;
+            return [
+                domain
+                    ? 'Add a TXT record with this name and value.'
+                    : 'Add a TXT record with this name and value. Replace YOUR-DOMAIN with the exact domain you enter below.',
+                { code: record },
+                'If your DNS host adds the domain automatically, enter only _verily for the root domain. For a subdomain such as www.example.com in the example.com zone, enter _verily.www.',
+                { code: expect },
+                domain
+                    ? `Proves control of ${domain} only. Parent domains and subdomains must be verified separately.`
+                    : 'Proves control of the exact domain you enter. Parent domains and subdomains must be verified separately.',
+                'DNS changes can take up to 72 hours to appear. Check the published record with:',
+                { code: `dig TXT ${record} +short` },
+                ...(domain ? [[{ text: 'Look up this TXT record', href: lookup(domain) }]] : []),
+                'Keep the TXT record in place after verification so Verily can check it again.',
+            ];
+        },
         resolve(artifact) {
             const domain = named(artifact);
             return domain ? lookup(domain) : artifact;
@@ -223,6 +244,9 @@ export function wellKnownProvider(options = {}) {
                 // The holder named this domain, so a redirect would take the check somewhere else.
                 if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400))
                     throw new Refused('File redirects, and a redirect is not followed');
+                // The file is gone. Any other failure is a failed read.
+                if (response.status === 404 || response.status === 410)
+                    throw new Absent('File unavailable');
                 if (!response.ok)
                     throw new Refused('File unavailable');
                 if (mediaType(response.headers.get('content-type')) !== 'text/plain')
@@ -232,8 +256,11 @@ export function wellKnownProvider(options = {}) {
                 // The last line of a file cut short may be the start of some longer address.
                 if (truncated)
                     lines.pop();
-                if (!lines.some((line) => line.trim() === expect))
-                    throw new Refused(truncated ? 'File is too large to read' : 'File has no line with this value');
+                if (!lines.some((line) => line.trim() === expect)) {
+                    if (truncated)
+                        throw new Refused('File is too large to read');
+                    throw new Absent('File has no line with this value');
+                }
             }
             finally {
                 await discard(response);

package/dist/server/github-gist.js

@@ -1,4 +1,4 @@
-import { Refused } from '../core/index.js';
+import { Absent, Refused } from '../core/index.js';
 /**
  * Proves control of a GitHub account by having its holder publish a given line in a public
  * gist. No app registration, no client secret, and no token: the proof is a public document
@@ -34,11 +34,14 @@ export function githubGistProvider(options = {}) {
                 signal: AbortSignal.timeout(15000),
             });
             const gist = await response.json();
+            // GitHub answers 404 for a gist that was deleted. Any other failure is a failed read.
+            if (response.status === 404)
+                throw new Absent('Gist unavailable');
             if (!response.ok || !isRecord(gist))
                 throw new Refused('Gist unavailable');
             // A secret gist proves nothing a reader could check for themselves.
             if (gist.public !== true)
-                throw new Refused('Gist is not public');
+                throw new Absent('Gist is not public');
             const owner = gist.owner;
             if (!isRecord(owner) ||
                 !Number.isSafeInteger(owner.id) ||
@@ -46,8 +49,13 @@ export function githubGistProvider(options = {}) {
                 typeof owner.login !== 'string' ||
                 !/^[a-zA-Z0-9-]+$/.test(owner.login))
                 throw new Refused('Invalid gist owner');
-            if (!isRecord(gist.files) || !contains(gist.files, expect))
-                throw new Refused('Gist does not contain the expected line');
+            if (!isRecord(gist.files) || !contains(gist.files, expect)) {
+                // Part of the gist was left out of the answer, and the line may be in that part.
+                // That is a failed read, so the proof keeps counting.
+                if (!isRecord(gist.files) || gist.truncated === true || partial(gist.files))
+                    throw new Refused('Gist is too large to read');
+                throw new Absent('Gist does not contain the expected line');
+            }
             return {
                 id: String(owner.id),
                 handle: owner.login,
@@ -63,6 +71,10 @@ function contains(files, expect) {
         typeof file.content === 'string' &&
         file.content.includes(expect));
 }
+/** Whether any file came back cut short or without its content. */
+function partial(files) {
+    return Object.values(files).some((file) => !isRecord(file) || file.truncated === true || typeof file.content !== 'string');
+}
 function isRecord(value) {
     return value !== null && typeof value === 'object';
 }

package/dist/server/github.js

@@ -54,10 +54,13 @@ export function githubProvider(options) {
                 typeof user.login !== 'string' ||
                 !/^[a-zA-Z0-9-]+$/.test(user.login))
                 throw new Error('Invalid provider identity');
+            // Optional: a missing or unparseable date is left off and the sign-in still succeeds.
+            const createdAt = typeof user.created_at === 'string' ? Date.parse(user.created_at) : NaN;
             return {
                 id: String(user.id),
                 handle: user.login,
                 profileUrl: `https://github.com/${user.login}`,
+                ...(Number.isFinite(createdAt) ? { createdAt } : {}),
             };
         },
     };

package/dist/server/index.js

@@ -1,8 +1,9 @@
-import { attestationLabel, externalId, externalIdGroups, externalLink, externalName, isArtifactProvider, isCodeProvider, isRedirectProvider, lastProved, accountsOf, localSide, proofTitle, providerMethod, statusLabel, signedBy, } from '../core/index.js';
+import { attestationLabel, externalName, isArtifactProvider, isCodeProvider, isRedirectProvider, lastProved, accountsOf, localSide, proofTitle, providerMethod, statusLabel, signedBy, } from '../core/index.js';
 import { artifactAttempts, codeAttempts, VerilyService, Unavailable, } from './service.js';
 import { copyScript, waitScript } from './copy.js';
 import { escape } from './escape.js';
-import { logo } from '../logo.js';
+import { card, externalCard, marked, moment, page, safeUrl, times, verdict } from './render.js';
+import { toneOf } from '../marks.js';
 import { stylesheet, styleVersion } from './style.js';
 export { VerilyService, Unavailable } from './service.js';
 export { githubProvider } from './github.js';
@@ -22,7 +23,6 @@ export { resendSender } from './resend.js';
  * one runs to tens of kilobytes. Still small enough that the size itself costs nothing.
  */
 const maxBodyBytes = 65536;
-const page = (prefix, title, body) => `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escape(title)} · Verily</title><link rel="stylesheet" href="${escape(prefix)}/style.css?v=${styleVersion}"><body><main>${logo}<h1>${escape(title)}</h1>${body}</main></body></html>`;
 const headers = {
     'Cache-Control': 'no-store',
     'Referrer-Policy': 'same-origin',
@@ -76,21 +76,6 @@ const redirect = (url, cookie) => new Response(null, {
     status: 303,
     headers: { ...headers, Location: url, ...(cookie ? { 'Set-Cookie': cookie } : {}) },
 });
-/**
- * One side of a link, with each thing known about it on its own line. A name, the
- * identifier behind it and how it was shown are three separate claims, and a reader
- * running them together in one sentence is the way to misread which was established.
- *
- * Both sides render as the same card, so the pair reads as a pair.
- */
-function card(heading, name, url, reference, ...extra) {
-    const profile = url && safeUrl(url);
-    return `<div class="side"><p class="who">${escape(heading)}</p><p class="name">${profile ? `<a href="${escape(profile)}" rel="noreferrer">${escape(name)}</a>` : escape(name)}</p>${typeof reference === 'string'
-        ? `<p class="reference">${escape(reference)}</p>`
-        : reference
-            ? `<p class="reference fingerprint">${reference.map((group) => `<span>${escape(group)}</span>`).join('')}</p>`
-            : ''}${extra.join('')}</div>`;
-}
 /**
  * Names how one side was established, inside that side's card. Where the method published
  * a proof the name is the link to it, which is what lets the reader check the claim
@@ -216,17 +201,16 @@ function heldNames(providers) {
     const names = [...new Set(providers.map(held))];
     return names.length > 1 ? `${names.slice(0, -1).join(', ')} or ${names.at(-1)}` : names[0];
 }
-/** Seconds are the finest thing a record measured in days can mean; milliseconds are noise. */
-const moment = (time) => new Date(time).toISOString().replace(/\.\d{3}Z$/, 'Z');
-/**
- * Every time on the page in one list. A date inside a sentence is a date a reader has to
- * find; the times of a record belong together, where they can be compared at a glance.
- */
-function times(rows) {
-    return `<dl>${rows
-        .filter(([, time]) => time !== undefined)
-        .map(([label, time]) => `<dt>${escape(label)}</dt><dd>${escape(moment(time))}</dd>`)
-        .join('')}</dl>`;
+/** Provider setup with the flow’s return instructions, shared by HTML and the dialog. */
+function proofInstructions(provider, flow) {
+    return [
+        ...provider.instructions(flow.expect, flow.artifact ?? flow.suggested),
+        ...(flow.dnsDraftId
+            ? [
+                'Your DNS setup is saved for seven days from when you started. To continue later, sign in and choose the DNS method again. For a renewal, reopen the same connection’s renewal. The proof must pass a fresh check; keep this TXT value while you wait.',
+            ]
+            : []),
+    ];
 }
 /**
  * What the holder is told, as the provider wrote it. A command is set as a block and never
@@ -250,15 +234,6 @@ function inline(piece) {
         ? `<a href="${escape(href)}" rel="noreferrer" target="_blank">${escape(piece.text)}</a>`
         : escape(piece.text);
 }
-function safeUrl(value) {
-    try {
-        const url = new URL(value);
-        return ['https:', 'http:'].includes(url.protocol) ? url.href : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
 /**
  * The holder's choice of who may read the record, or the one visibility there is when the
  * subject has no choice. A subject from another site is told what each means there: that
@@ -297,9 +272,7 @@ function evidencePage(e, base, report, keyId, named) {
     // site's own reference would be a third line saying the same thing. The provider's
     // identifier stays: that one is the provider's word, not the site's own wording.
     card(local.heading, local.value, e.local.profileUrl, undefined, attestationNote(e.attestations.local, names)) +
-        card(names.provider, externalName(e.external), externalLink(e.external), 
-        // A mailbox's address or a domain is its name already, so there is no second identifier.
-        externalIdGroups(e.external) ?? externalId(e.external), externalNotes(e.attestations, names)) +
+        externalCard(marked(names.provider, e.provider, e.attestations.external[0].method), e.external, externalNotes(e.attestations, names)) +
         times(e.status === 'retired'
             ? [
                 ['Approved', e.approvedAt],
@@ -331,7 +304,7 @@ function evidencePage(e, base, report, keyId, named) {
     <p class="fine">This connection does not establish legal identity, trustworthiness, content authorship, or permanent ownership.</p>
     <p class="fine"><a href="${escape(base)}/external-revoke/${escape(e.id)}">Remove this connection using your external account</a></p>
     ${e.visibility === 'unlisted' ? `<p class="fine"><a href="${escape(base)}/external-share-revoke/${escape(e.id)}">Revoke only this sharing link using your external account</a></p>` : ''}
-    <p class="fine"><a href="${escape(report)}" rel="noreferrer">Report an incorrect record</a></p>`);
+    <p class="fine"><a href="${escape(report)}" rel="noreferrer">Report an incorrect record</a></p>`, '', '', verdict(toneOf(e, Date.now())));
 }
 /** Joins a subject's card to its accounts: the link itself, drawn as the dialog draws it. */
 const joiner = '<svg class="joiner" viewBox="0 0 24 24" fill="none" aria-hidden="true" focusable="false">' +
@@ -350,7 +323,7 @@ const joiner = '<svg class="joiner" viewBox="0 0 24 24" fill="none" aria-hidden=
 function accountCard(e, external, now) {
     const retired = e.status === 'retired';
     const record = escape(safeUrl(e.evidenceUrl));
-    return card(e.providerName, externalName(e.external), externalLink(e.external), externalIdGroups(e.external) ?? externalId(e.external), `<p class="how">${escape(statusLabel(e, now))} · via: <a href="${record}">${escape(e.verifierName)}</a>${e.signedUrl ? ` · <a href="${record}#signed">signed</a>` : ''}</p>`, externalNotes({ ...e.attestations, external }, { site: e.siteName, provider: e.providerName }), times(retired
+    return externalCard(marked(e.providerName, e.provider, e.attestations.external[0].method), e.external, `<p class="how">${verdict(toneOf(e, now))}${escape(statusLabel(e, now))} · via: <a href="${record}">${escape(e.verifierName)}</a>${e.signedUrl ? `<a class="signed-mark" href="${record}#signed">signed</a>` : ''}</p>`, externalNotes({ ...e.attestations, external }, { site: e.siteName, provider: e.providerName }), times(retired
         ? [
             ['Approved', e.approvedAt],
             ['Last verified', lastProved(e)],
@@ -419,7 +392,7 @@ function checkedPage(d, keyId, base, named) {
     const retired = d.version === 2;
     return page(base, retired ? 'Retired connection' : 'Signed record', `<p>${escape(d.verifierName)} signed this record. It shows what stood when it was signed, not what stands now.</p>` +
         card(local.heading, local.value, d.local.profileUrl, undefined, attestationNote(d.attestations.local, names)) +
-        card(names.provider, externalName(d.external), externalLink(d.external), externalIdGroups(d.external) ?? externalId(d.external), externalNotes(d.attestations, names)) +
+        externalCard(marked(names.provider, d.provider, d.attestations.external[0].method), d.external, externalNotes(d.attestations, names)) +
         times(retired
             ? [
                 ['Signed', d.issuedAt],
@@ -602,7 +575,7 @@ export function createVerily(options) {
             view.authorizationUrl = authorizationUrl;
         if (flow.phase === 'pending' && flow.expect && isArtifactProvider(provider))
             Object.assign(view, {
-                instructions: provider.instructions(flow.expect),
+                instructions: proofInstructions(provider, flow),
                 artifact: provider.artifact,
                 field: artifactField(provider),
                 input: provider.input ?? 'url',
@@ -766,7 +739,7 @@ export function createVerily(options) {
                         if (!['revoke', 'share-revoke'].includes(flow.kind))
                             if ((await local(request)).id !== flow.local?.id)
                                 throw new Unavailable();
-                        return html(page(prefix, `Verify with ${provider.name}`, `${instructions(provider.instructions(flow.expect))}
+                        return html(page(prefix, `Verify with ${provider.name}`, `${instructions(proofInstructions(provider, flow))}
             ${flow.tries ? `<p>${escape(refusedNote(flow))}</p>` : ''}
             <form method="post" action="${escape(prefix)}/flows/${escape(flow.id)}/submit">
             <label>${escape(artifactField(provider))} ${provider.artifact === 'document'
@@ -812,7 +785,7 @@ export function createVerily(options) {
                                 ? 'Add to connection'
                                 : 'Confirm connection', `
             ${card(subject(flow.local).heading, subject(flow.local).value, flow.local.profileUrl)}
-            ${card(provider.name, externalName(flow.external), externalLink(flow.external), externalIdGroups(flow.external) ?? externalId(flow.external))}
+            ${externalCard(marked(provider.name, provider.id, providerMethod(provider)), flow.external)}
             ${joined ? `<p>This account is already linked here. Confirming adds this method to that connection, beneath the one it was first shown by, and it stays ${escape(joined.visibility)}.</p>` : ''}
             ${found ? `<p>${escape(found)}</p>` : ''}
             <p class="fine">${escape(service.siteOf(flow.local))} receives the result. Verified via ${escape(options.verifierName)}.</p>

package/dist/server/link.js

@@ -1,8 +1,8 @@
 import { legacyHookDecode } from '@exodus/bytes/encoding.js';
 import htmlEncodingSniffer from 'html-encoding-sniffer';
-import { MIMEType } from 'node:util';
+import { isDeepStrictEqual, MIMEType } from 'node:util';
 import { html, parse } from 'parse5';
-import { Refused, } from '../core/index.js';
+import { Absent, Refused, } from '../core/index.js';
 import { discard, readBounded } from './body.js';
 import { transport } from './public-fetch.js';
 /**
@@ -99,6 +99,9 @@ async function backlinked(response, page, subject, maxBytes) {
     // The holder named this address, so a redirect would take the check somewhere else.
     if (response.type === 'opaqueredirect' || (response.status >= 300 && response.status < 400))
         throw new Refused('Page redirects, and a redirect is not followed');
+    // The page is gone. Any other failure is a failed read.
+    if (response.status === 404 || response.status === 410)
+        throw new Absent('Page unavailable');
     if (!response.ok)
         throw new Refused('Page unavailable');
     // A link relation is a link relation wherever it is declared, and a page with no
@@ -132,7 +135,9 @@ async function backlinked(response, page, subject, maxBytes) {
             return;
     }
     // Not finding it in part of a page is not the same as it not being there.
-    throw new Refused(truncated ? 'Page is too large to read' : 'Page has no rel="me" link to this subject');
+    if (truncated)
+        throw new Refused('Page is too large to read');
+    throw new Absent('Page has no rel="me" link to this subject');
 }
 /**
  * The address the holder handed back, once it is one this may fetch. They choose it, so
@@ -259,7 +264,7 @@ function points(href, base, subject) {
     for (const key of new Set(subject.searchParams.keys())) {
         const wanted = subject.searchParams.getAll(key);
         const found = target.searchParams.getAll(key);
-        if (found.length !== wanted.length || found.some((value, at) => value !== wanted[at]))
+        if (!isDeepStrictEqual(found, wanted))
             return false;
     }
     return true;

package/dist/server/render.d.ts

@@ -0,0 +1,49 @@
+import { type ExternalAccount } from '../core/index.js';
+import { type MarkTone } from '../marks.js';
+/**
+ * The shell every Verily page shares: the stylesheet, the logotype and the heading. `variant`
+ * is a class on the page's `main`, such as `single` for a page with one thing on it.
+ * `script` is the path of one script the page runs. `mark` is drawn before the heading.
+ */
+export declare const page: (prefix: string, title: string, body: string, variant?: string, script?: string, mark?: string) => string;
+/**
+ * The V the badge draws for a record, in the tone that says how the record stands.
+ * `cropped` fits the box to the strokes, for a V that has to meet the edges around it.
+ */
+export declare function verdict(tone: MarkTone, cropped?: boolean): string;
+/** A card's heading: its text, and the provider's mark before it where there is one. */
+export type Heading = string | {
+    text: string;
+    mark: string;
+};
+/** A provider's name with its mark, for a card's heading. */
+export declare function marked(text: string, provider: string, method?: string): Heading;
+/**
+ * One side of a link, with each thing known about it on its own line. A name, the
+ * identifier behind it and how it was shown are three separate claims, and a reader
+ * running them together in one sentence is the way to misread which was established.
+ *
+ * Both sides render as the same card, so the pair reads as a pair.
+ */
+export declare function card(heading: Heading, name: string, url: string | undefined, reference?: string | string[], ...extra: string[]): string;
+/**
+ * The card for an external account: its name, link and id, with the "Joined <date>" text
+ * on the name's line when the creation date is known.
+ */
+export declare function externalCard(heading: Heading, external: ExternalAccount, ...extra: string[]): string;
+export declare function side(heading: Heading, name: string, url: string | undefined, reference: string | string[] | undefined, since: string | undefined, extra: string[]): string;
+/** A day, as the date alone. */
+export declare const day: (time: number) => string;
+/** A day as it is said, such as "Jan 11, 2027". In UTC, as every other time here is. */
+export declare const date: (time: number) => string;
+/** How far off a time is in whole days, such as "in 90 days" or "12 days ago". */
+export declare function distance(time: number, now: number): string;
+/** Seconds are the finest thing a record measured in days can mean; milliseconds are noise. */
+export declare const moment: (time: number) => string;
+/**
+ * Every time on the page in one list. A date inside a sentence is a date a reader has to
+ * find; the times of a record belong together, where they can be compared at a glance.
+ */
+export declare function times(rows: [string, number | undefined][]): string;
+/** A URL as written if it is http(s), and nothing otherwise. */
+export declare function safeUrl(value: string): string | undefined;

package/dist/server/render.js

@@ -0,0 +1,104 @@
+import { externalId, externalIdGroups, externalLink, externalName, externalSince, } from '../core/index.js';
+import { logo } from '../logo.js';
+import { markOf, pathAttributes, tones, verification } from '../marks.js';
+import { escape } from './escape.js';
+import { styleVersion } from './style.js';
+/**
+ * The shell every Verily page shares: the stylesheet, the logotype and the heading. `variant`
+ * is a class on the page's `main`, such as `single` for a page with one thing on it.
+ * `script` is the path of one script the page runs. `mark` is drawn before the heading.
+ */
+export const page = (prefix, title, body, variant = '', script = '', mark = '') => `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escape(title)} · Verily</title><link rel="stylesheet" href="${escape(prefix)}/style.css?v=${styleVersion}"><body><main${variant && ` class="${variant}"`}>${logo}<h1>${mark}${escape(title)}</h1>${body}</main>${script && `<script src="${escape(script)}" defer></script>`}</body></html>`;
+/**
+ * The V the badge draws for a record, in the tone that says how the record stands.
+ * `cropped` fits the box to the strokes, for a V that has to meet the edges around it.
+ */
+export function verdict(tone, cropped = false) {
+    const [first, second] = tones[tone];
+    const stroke = 'stroke-width="32" stroke-linejoin="miter"';
+    const check = Object.entries(verification.check)
+        .map(([name, value]) => ` ${name}="${value}"`)
+        .join('');
+    return `<svg class="verdict ${tone}" viewBox="${cropped ? verification.strokes : verification.viewBox}" fill="none" aria-hidden="true" focusable="false"><path d="${verification.path}" ${stroke} stroke="${first}"/><path d="${verification.path}" ${stroke}${check} stroke="${second}"/></svg>`;
+}
+/** A provider's name with its mark, for a card's heading. */
+export function marked(text, provider, method) {
+    const mark = markOf(provider, method);
+    if (!mark)
+        return text;
+    const attributes = pathAttributes(mark)
+        .map(([name, value]) => ` ${name}="${value}"`)
+        .join('');
+    return {
+        text,
+        mark: `<svg class="provider" viewBox="${mark.viewBox}" fill="${mark.stroke ? 'none' : 'currentColor'}" aria-hidden="true" focusable="false">${mark.paths
+            .map((d) => `<path d="${escape(d)}"${attributes}/>`)
+            .join('')}</svg>`,
+    };
+}
+/**
+ * One side of a link, with each thing known about it on its own line. A name, the
+ * identifier behind it and how it was shown are three separate claims, and a reader
+ * running them together in one sentence is the way to misread which was established.
+ *
+ * Both sides render as the same card, so the pair reads as a pair.
+ */
+export function card(heading, name, url, reference, ...extra) {
+    return side(heading, name, url, reference, undefined, extra);
+}
+/**
+ * The card for an external account: its name, link and id, with the "Joined <date>" text
+ * on the name's line when the creation date is known.
+ */
+export function externalCard(heading, external, ...extra) {
+    return side(heading, externalName(external), externalLink(external), 
+    // A mailbox's address or a domain is its name already, so there is no second identifier.
+    externalIdGroups(external) ?? externalId(external), externalSince(external, day), extra);
+}
+export function side(heading, name, url, reference, since, extra) {
+    const profile = url && safeUrl(url);
+    return `<div class="side"><p class="who">${typeof heading === 'string' ? escape(heading) : `${heading.mark}${escape(heading.text)}`}</p><p class="name">${profile ? `<a href="${escape(profile)}" rel="noreferrer">${escape(name)}</a>` : escape(name)}${since ? `<span class="since">${escape(since)}</span>` : ''}</p>${typeof reference === 'string'
+        ? `<p class="reference">${escape(reference)}</p>`
+        : reference
+            ? `<p class="reference fingerprint">${reference.map((group) => `<span>${escape(group)}</span>`).join('')}</p>`
+            : ''}${extra.join('')}</div>`;
+}
+/** A day, as the date alone. */
+export const day = (time) => new Date(time).toISOString().slice(0, 10);
+/** A day as it is said, such as "Jan 11, 2027". In UTC, as every other time here is. */
+export const date = (time) => new Date(time).toLocaleDateString('en-US', {
+    year: 'numeric',
+    month: 'short',
+    day: 'numeric',
+    timeZone: 'UTC',
+});
+/** How far off a time is in whole days, such as "in 90 days" or "12 days ago". */
+export function distance(time, now) {
+    const days = Math.round((time - now) / 86400000);
+    if (days === 0)
+        return 'today';
+    const count = `${Math.abs(days)} day${Math.abs(days) === 1 ? '' : 's'}`;
+    return days > 0 ? `in ${count}` : `${count} ago`;
+}
+/** Seconds are the finest thing a record measured in days can mean; milliseconds are noise. */
+export const moment = (time) => new Date(time).toISOString().replace(/\.\d{3}Z$/, 'Z');
+/**
+ * Every time on the page in one list. A date inside a sentence is a date a reader has to
+ * find; the times of a record belong together, where they can be compared at a glance.
+ */
+export function times(rows) {
+    return `<dl>${rows
+        .filter(([, time]) => time !== undefined)
+        .map(([label, time]) => `<dt>${escape(label)}</dt><dd>${escape(moment(time))}</dd>`)
+        .join('')}</dl>`;
+}
+/** A URL as written if it is http(s), and nothing otherwise. */
+export function safeUrl(value) {
+    try {
+        const url = new URL(value);
+        return ['https:', 'http:'].includes(url.protocol) ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}