@cygnuxlabs/tracekit 1.3.0 → 1.4.1

package/dist/verify/jcs.d.ts

@@ -4,6 +4,8 @@
  * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
  * MAX_DEPTH. No node: imports: browsers load this too.
  */
+/** A string as Python's repr() writes it, as the reference verifier's messages quote names and keys. */
+export declare function repr(s: string): string;
 /** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
 export declare class StrictJSONError extends Error {
     readonly code: string;

package/dist/verify/jcs.js

@@ -4,6 +4,14 @@
  * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
  * MAX_DEPTH. No node: imports: browsers load this too.
  */
+/** A string as Python's repr() writes it, as the reference verifier's messages quote names and keys. */
+export function repr(s) {
+    const q = s.includes("'") && !s.includes('"') ? '"' : "'";
+    const named = { "\\": "\\\\", "\n": "\\n", "\r": "\\r", "\t": "\\t", [q]: "\\" + q };
+    // lean: control characters only; Python also escapes other code points it can't print (U+0080..U+009F, U+2028...)
+    return q + s.replace(/[\\'"\x00-\x1f\x7f]/g, (c) => named[c] ?? (c === "'" || c === '"' ? c
+        : "\\x" + c.charCodeAt(0).toString(16).padStart(2, "0"))) + q;
+}
 /** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
 export class StrictJSONError extends Error {
     code;
@@ -62,7 +70,7 @@ export function strictParse(text, floats) {
         match(WS);
         const c = text[i];
         if ((c === "{" || c === "[") && depth === MAX_DEPTH)
-            fail("depth", `nesting deeper than ${MAX_DEPTH} at ${i}`);
+            fail("depth", `nesting deeper than ${MAX_DEPTH}`);
         if (c === "{") {
             i++;
             const o = {};
@@ -73,7 +81,7 @@ export function strictParse(text, floats) {
                 match(WS);
                 const k = str();
                 if (Object.hasOwn(o, k))
-                    fail("duplicate_key", JSON.stringify(k));
+                    fail("duplicate_key", repr(k));
                 expect(":");
                 Object.defineProperty(o, k, { value: value(depth + 1), enumerable: true, writable: true, configurable: true }); // "__proto__" too
                 mark(o, k);

package/dist/verify/primitives.d.ts

@@ -47,8 +47,9 @@ export type Note = {
 /**
  * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
  * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ * `anchored` false (no trust config, so `logKeys` is empty): no log signature is required.
  */
-export declare function openNote(data: Uint8Array, logKeys: string[], witnessKeys: string[]): Promise<Note>;
+export declare function openNote(data: Uint8Array, logKeys: string[], witnessKeys: string[], anchored?: boolean): Promise<Note>;
 export declare const LEAF_TYPES: string[];
 export declare const SIGNER_LEAVES: string[];
 export declare const registryOrigin: (logOrigin: string, tsalt: Uint8Array) => Promise<string>;

package/dist/verify/primitives.js

@@ -194,8 +194,9 @@ export async function parseVkey(text) {
 /**
  * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
  * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ * `anchored` false (no trust config, so `logKeys` is empty): no log signature is required.
  */
-export async function openNote(data, logKeys, witnessKeys) {
+export async function openNote(data, logKeys, witnessKeys, anchored = true) {
     if (data.length > MAX_NOTE)
         throw new NoteError("note too large");
     let note;
@@ -279,7 +280,7 @@ export async function openNote(data, logKeys, witnessKeys) {
             cosigs.push([k, ts]);
         }
     }
-    if (!logged)
+    if (!logged && anchored)
         throw new NoteError(`no signature from a pinned log key for origin ${origin}`);
     if (hybrids.size)
         throw new NoteError(`no SLH-DSA signature from the pinned hybrid key for origin ${origin}`);

package/dist/verify/schema.d.ts

@@ -1,8 +1,8 @@
 /**
  * The JSON Schema 2020-12 subset tracekit.event.v2.json uses (docs/format-v2.md §3): type, const, enum, required,
- * properties, additionalProperties, items, oneOf, allOf, if/then, $ref to #/$defs, pattern (full match, ASCII),
- * minimum, maximum, minLength, maxLength (code points), minItems, maxItems. "integer" excludes number tokens written with a
- * fraction or exponent. Any other keyword throws, so the schema can't silently lose a check.
+ * properties, additionalProperties, propertyNames, items, oneOf, allOf, if/then, $ref to #/$defs, pattern (full match,
+ * ASCII), minimum, maximum, minLength, maxLength (code points), minItems, maxItems. "integer" excludes number tokens
+ * written with a fraction or exponent. Any other keyword throws, so the schema can't silently lose a check.
  */
 import type { Floats } from "./jcs.js";
 /** JSON equality with numbers and booleans compared as numbers, as the reference's Python does. */

package/dist/verify/schema.js

@@ -1,7 +1,7 @@
 import SCHEMA from "./tracekit.event.v2.json" with { type: "json" };
-const KEYWORDS = new Set(["type", "const", "enum", "required", "properties", "additionalProperties", "items", "oneOf",
-    "allOf", "if", "then", "$ref", "pattern", "minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems", "$schema", "$id",
-    "$defs", "title", "description"]);
+const KEYWORDS = new Set(["type", "const", "enum", "required", "properties", "additionalProperties", "propertyNames",
+    "items", "oneOf", "allOf", "if", "then", "$ref", "pattern", "minimum", "maximum", "minLength", "maxLength", "minItems",
+    "maxItems", "$schema", "$id", "$defs", "title", "description"]);
 const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
 const isNumber = (v) => typeof v === "number";
 const PATTERNS = new Map();
@@ -68,6 +68,8 @@ function check(v, s, path, errs, float, floats) {
                 errs.push(`${path}: unexpected field '${k}'`);
             else if (isObject(ap))
                 check(x, ap, `${path}.${k}`, errs, f, floats);
+            if ("propertyNames" in s)
+                check(k, s.propertyNames, `${path}.${k}`, errs, false, floats);
         }
     }
     if (Array.isArray(v) && "items" in s)

package/dist/verify/tracekit.event.v2.json

@@ -142,7 +142,9 @@
                 "incident.resolved",
                 "incident.response",
                 "identity.suspension",
-                "effect.observed"
+                "effect.observed",
+                "constraint.added",
+                "ext"
             ]
         },
         "data": {
@@ -284,6 +286,13 @@
             "maxLength": 128,
             "pattern": "^[A-Za-z0-9._-]+@[A-Za-z0-9._+-]+$",
             "description": "Policy engine id@version."
+        },
+        "ext": {
+            "type": "object",
+            "propertyNames": {
+                "$ref": "#/$defs/ext_name"
+            },
+            "description": "Non-critical fields (format 1.4), on any record: {name: any strict JSON value}. A verifier that does not interpret a name still checks the record's signature, chain and inclusion, and says it did not interpret the name (docs/format-v2.md section 9)."
         }
     },
     "allOf": [
@@ -1162,7 +1171,46 @@
             "then": {
                 "properties": {
                     "data": {
-                        "$ref": "#/$defs/effect_observed"
+                        "oneOf": [
+                            {
+                                "$ref": "#/$defs/effect_observed"
+                            },
+                            {
+                                "$ref": "#/$defs/sensor_effect"
+                            }
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "if": {
+                "properties": {
+                    "type": {
+                        "const": "constraint.added"
+                    }
+                }
+            },
+            "then": {
+                "properties": {
+                    "data": {
+                        "$ref": "#/$defs/constraint_added"
+                    }
+                }
+            }
+        },
+        {
+            "if": {
+                "properties": {
+                    "type": {
+                        "const": "ext"
+                    }
+                }
+            },
+            "then": {
+                "properties": {
+                    "data": {
+                        "$ref": "#/$defs/ext"
                     }
                 }
             }
@@ -2007,6 +2055,29 @@
                 },
                 "verdict": {
                     "type": "object"
+                },
+                "cites": {
+                    "type": "array",
+                    "maxItems": 256,
+                    "items": {
+                        "type": "object",
+                        "additionalProperties": false,
+                        "required": [
+                            "run_seq",
+                            "hash"
+                        ],
+                        "properties": {
+                            "run_seq": {
+                                "type": "integer",
+                                "minimum": 0,
+                                "maximum": 9007199254740991
+                            },
+                            "hash": {
+                                "$ref": "#/$defs/hash"
+                            }
+                        }
+                    },
+                    "description": "A signed finding (format 1.4; review_finding), in a findings run: the records of the analysed run it rests on, by run_seq and record hash. A review without cites (a migrated v1 judge verdict) is imported, not checked."
                 }
             }
         },
@@ -2139,7 +2210,8 @@
                         "held_call_unresolved",
                         "observer_lost",
                         "effect_outside_run",
-                        "result_unchecked"
+                        "result_unchecked",
+                        "constraint_refused"
                     ],
                     "description": "Gap and tamper kinds (signer-written only)."
                 },
@@ -2153,6 +2225,14 @@
                         "null"
                     ],
                     "maxLength": 4096
+                },
+                "sensor": {
+                    "enum": [
+                        "tetragon",
+                        "falco",
+                        "openshell"
+                    ],
+                    "description": "format 1.4: the sensor (a kernel sensor, or OpenShell) whose import an observer_lost gap is about"
                 }
             }
         },
@@ -2340,6 +2420,10 @@
                     },
                     "maxItems": 1024
                 },
+                "said_only": {
+                    "const": true,
+                    "description": "format 1.4: a response recorded with what the model said and without the calls it asked for (a harness whose hooks name no call); reconciliation reads no call from it"
+                },
                 "tool_results_sent": {
                     "type": "array",
                     "items": {
@@ -4526,6 +4610,117 @@
                 }
             }
         },
+        "sensor_effect": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "observer",
+                "sensor",
+                "kind",
+                "ts",
+                "pid",
+                "binary",
+                "attribution"
+            ],
+            "description": "format 1.4: what a kernel sensor (Tetragon, Falco) reported a process of the run did, or what OpenShell reported of its sandbox (its connections allowed and blocked, its entrypoint's start), imported under the import's own signer identity (an observer's assertion); signer-written",
+            "properties": {
+                "observer": {
+                    "type": "string",
+                    "maxLength": 256,
+                    "description": "the import's signer identity (scheme:subject)"
+                },
+                "sensor": {
+                    "enum": [
+                        "tetragon",
+                        "falco",
+                        "openshell"
+                    ]
+                },
+                "kind": {
+                    "enum": [
+                        "exec",
+                        "exit",
+                        "connect",
+                        "file"
+                    ],
+                    "description": "exec: the process started; exit: it ended; connect: it connected to host:port; file: the sensor's policy selected a file event of it (a write outside the workspace, in the shipped samples)"
+                },
+                "ts": {
+                    "type": "string",
+                    "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d{6}Z$",
+                    "maxLength": 27
+                },
+                "pid": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 4294967295
+                },
+                "binary": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096
+                },
+                "exec_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "the sensor's id of the process (Tetragon's exec_id)"
+                },
+                "parent_exec_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 256,
+                    "description": "exec: the sensor's id of the process that started this one (Tetragon's parent_exec_id)"
+                },
+                "args_commitment": {
+                    "$ref": "#/$defs/commitment",
+                    "description": "commitment to sha256 of the arguments string as the sensor reported it"
+                },
+                "salt_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the signer's salt id for this record's commitments (salt label <type>:<salt_id>)"
+                },
+                "status": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 4294967295
+                },
+                "signal": {
+                    "type": "string",
+                    "maxLength": 32
+                },
+                "host": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 253
+                },
+                "port": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 65535
+                },
+                "path": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 4096
+                },
+                "tool_call_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the tool call id the process's environment carried (CODEX_TOOL_CALL_ID): the agent's claim, recorded as it came and checked by no signer (TK-X206 checks it)"
+                },
+                "denied": {
+                    "const": true,
+                    "description": "the sensor (OpenShell's network policy) blocked it"
+                },
+                "attribution": {
+                    "enum": [
+                        "token",
+                        "identity"
+                    ],
+                    "description": "identity: the import mapped the process to the run's owner and the signer picked that owner's latest open run"
+                }
+            }
+        },
         "reconcile_effect": {
             "type": "object",
             "additionalProperties": false,
@@ -4606,6 +4801,52 @@
                     "description": "the status rests on the operator's posture (signer.yaml), not on anything the signer measured"
                 }
             }
+        },
+        "constraint_added": {
+            "type": "object",
+            "additionalProperties": false,
+            "required": [
+                "kind"
+            ],
+            "description": "format 1.4: a live constraint of the run (constraint_add): what the person's request said not to do in the rest of it, as its client reported it (the Claude Code hook, at UserPromptSubmit). From then on the signer raises a call that breaks it to an ask (rule TK-CONSTRAINT) and never lowers a decision, so a made-up constraint can only hold more calls",
+            "properties": {
+                "kind": {
+                    "enum": [
+                        "keep_away",
+                        "only_change",
+                        "read_only",
+                        "no_push",
+                        "no_network"
+                    ],
+                    "description": "keep_away: writes of the file; only_change: writes of any other file; read_only: any write; no_push: a git push; no_network: a call that reaches the network"
+                },
+                "object_commitment": {
+                    "$ref": "#/$defs/commitment",
+                    "description": "keep_away and only_change: commitment to sha256 of the file's lower-cased basename; never the name"
+                },
+                "salt_id": {
+                    "$ref": "#/$defs/id",
+                    "description": "the signer's salt id for this record's commitment (salt label <type>:<salt_id>)"
+                }
+            }
+        },
+        "ext_name": {
+            "type": "string",
+            "pattern": "^[a-z][a-z0-9_.-]*$",
+            "maxLength": 64,
+            "description": "The name of a non-critical field or record (format 1.4)."
+        },
+        "ext": {
+            "type": "object",
+            "required": [
+                "name"
+            ],
+            "properties": {
+                "name": {
+                    "$ref": "#/$defs/ext_name"
+                }
+            },
+            "description": "A non-critical record (format 1.4): its name and any other strict JSON fields, checked as the ext field is."
         }
     }
 }

package/dist/verify/web.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/verify/web.js

@@ -0,0 +1,215 @@
+/**
+ * The browser verifier: verify.html, which scripts/verify-page.mjs builds from this module, the verifier it imports and
+ * page.html. The bundle and trust config a person chooses are read and verified in the page, whose Content Security
+ * Policy lets it load and send nothing, so neither file leaves the browser. It reports what the TypeScript CLI does: a
+ * bundle that relies on a check this verifier doesn't implement is UNVERIFIABLE, never VERIFIED. Without a trust config
+ * it checks what needs no pinned key (verify's `trust` null). explain.ts says what the report means.
+ *
+ * The verification runs in a worker started from this same script (a blob: URL, which inherits the page's policy), so a
+ * large bundle doesn't freeze the page; in the page itself where the browser refuses the worker.
+ */
+import { MEANING, asJson, asText, cliExit, nextSteps, sh, summarize, verdict } from "./explain.js";
+import { VERSION, clean, readZip, verify } from "./index.js";
+/** The report, and a summary of the runs when nothing failed (what a failed bundle says can't be relied on). */
+async function work(job) {
+    const { report, code } = await verify(job.bundle, job.trust, job.names);
+    const summary = !report.failures.length && report.checks.some((c) => c.check === "signatures")
+        ? summarize(await readZip(job.bundle), report) : [];
+    return { report, code, summary };
+}
+if (typeof document === "undefined") // this script, as the page's worker: a report, or the error that stopped it
+    addEventListener("message", async (e) => {
+        try {
+            postMessage(await work(e.data));
+        }
+        catch (err) {
+            postMessage({ error: String(err?.message ?? err) });
+        }
+    });
+else
+    page();
+function page() {
+    const $ = (id) => document.getElementById(id);
+    const el = (tag, text = "", cls = "") => {
+        const e = document.createElement(tag);
+        if (text)
+            e.textContent = text;
+        if (cls)
+            e.className = cls;
+        return e;
+    };
+    let bundle = null, trust = null, turn = 0, worker = null, workers = true, url = "";
+    let last = { text: "", json: "", name: "" };
+    $("version").textContent = VERSION;
+    /** `job` verified in a fresh worker (a newer job ends the one before it), else in the page. */
+    function run(job) {
+        worker?.terminate();
+        if (workers)
+            try {
+                // this page's own script, by id: a browser extension may add a script element of its own first
+                url ||= URL.createObjectURL(new Blob([$("verifier").textContent], { type: "text/javascript" }));
+                const w = worker = new Worker(url); // classic: Chrome refuses module workers to file:// pages
+                return new Promise((resolve, reject) => {
+                    w.onmessage = (e) => {
+                        w.terminate();
+                        if (e.data.error)
+                            reject(new Error(e.data.error));
+                        else
+                            resolve(e.data);
+                    };
+                    w.onerror = (e) => {
+                        e.preventDefault();
+                        workers = false;
+                        resolve(work(job));
+                    };
+                    w.postMessage(job);
+                });
+            }
+            catch {
+                workers = false;
+            }
+        // lean: in the page, a bundle of 100k records holds the main thread for seconds; chunk the verifier if browsers
+        // without blob: workers matter
+        return work(job);
+    }
+    const read = async (f) => ({ name: f.name, bytes: new Uint8Array(await f.arrayBuffer()) });
+    const unb64 = (s) => Uint8Array.from(atob(s), (c) => c.charCodeAt(0));
+    const sampleTrust = { name: "sample.trust.json", bytes: unb64(SAMPLES["sample.trust.json"]) };
+    async function choose(files) {
+        if (trust === sampleTrust)
+            trust = null; // the samples' signer is not the one behind the person's own bundle
+        for (const f of [...files ?? []]) {
+            if (/\.json$/i.test(f.name))
+                trust = await read(f);
+            else
+                bundle = await read(f);
+        }
+        await show();
+    }
+    function command(text) {
+        const row = el("div", "", "cmd"), copy = el("button", "copy");
+        copy.setAttribute("type", "button");
+        copy.setAttribute("aria-label", `Copy: ${text}`);
+        copy.addEventListener("click", () => navigator.clipboard?.writeText(text));
+        row.append(el("code", text), copy);
+        return row;
+    }
+    async function show() {
+        $("bundle-name").textContent = bundle?.name ?? "none chosen";
+        $("trust-name").textContent = trust?.name ?? "none";
+        $("clear-trust").hidden = !trust;
+        if (!bundle)
+            return;
+        const mine = ++turn, names = { bundle: bundle.name, trust: trust?.name ?? null };
+        $("result").hidden = true; // the last bundle's verdict never stands under this one's name
+        document.body.dataset.state = "verifying";
+        $("busy").textContent = "Verifying...";
+        $("busy").hidden = false;
+        let result;
+        try {
+            result = await run({ bundle: bundle.bytes, trust: trust?.bytes ?? null,
+                names: { bundle: names.bundle, trust: names.trust ?? "TRUST.json" } });
+        }
+        catch (err) { // never left at "Verifying...": say what stopped it and where else to check
+            if (mine !== turn)
+                return;
+            $("result").hidden = true;
+            $("busy").textContent = `Couldn't check this file: ${clean(String(err?.message ?? err))}. The `
+                + `command-line verifier may say more: npx -y @cygnuxlabs/tracekit@latest verify ${sh(names.bundle)}`;
+            document.body.dataset.state = "error";
+            return;
+        }
+        if (mine !== turn)
+            return; // a later choice of files: its report wins
+        const { report, code, summary } = result;
+        const v = verdict(report, code);
+        $("banner").className = `banner ${{ VERIFIED: "ok", FAILED: "bad", UNVERIFIABLE: "warn" }[v.word]}`;
+        $("verdict-word").textContent = v.word;
+        $("verdict-means").textContent = v.means;
+        $("verdict-not").textContent = v.notMeans;
+        const steps = nextSteps(report, code, names);
+        $("next").hidden = !steps.length;
+        $("steps").replaceChildren(...steps.map((s) => {
+            const li = el("li", s.text);
+            if (s.command)
+                li.append(command(s.command));
+            return li;
+        }));
+        $("summary-box").hidden = !summary.length;
+        $("summary-title").textContent = code === 0 ? "what the bundle holds"
+            : "what the bundle says it holds (not verified: see above)";
+        $("summary").replaceChildren(...summary.flatMap(([k, val]) => [el("dt", k), el("dd", val)]));
+        $("checks").replaceChildren(...report.checks.map((c) => {
+            const d = el("details"), s = el("summary"), line = el("span", "", "line");
+            const tone = { pass: "ok", warn: "warn", fail: "bad" }[c.status];
+            line.append(el("span", `[${c.status.toUpperCase()}]`, `status ${tone}`), ` ${c.check}` + (c.detail ? ` — ${clean(c.detail)}` : ""));
+            s.append(line);
+            d.append(s);
+            for (const p of c.problems)
+                d.append(el("div", clean(p), "problem")); // one by one: a spread overflows the stack
+            d.append(el("p", `What this means: ${MEANING[c.check] ?? "see docs/verdicts.md."}`, "means"));
+            d.open = c.status !== "pass" && c.problems.length > 0;
+            return d;
+        }));
+        $("integrity").textContent = `Integrity: ${clean(report.integrity)}.`;
+        $("assurance").textContent = `Assurance: ${clean(report.assurance)}.`;
+        last = { text: asText(report, code), json: JSON.stringify(asJson(report, code), null, 2) + "\n", name: bundle.name };
+        $("exit").textContent = last.text.trim().split("\n").at(-1) + cliExit(report);
+        $("report").textContent = last.text;
+        $("copied").textContent = "";
+        $("result").hidden = false;
+        $("busy").hidden = true;
+        $("banner").scrollIntoView?.({ block: "nearest" });
+        document.body.dataset.state = "done";
+    }
+    $("bundle").addEventListener("change", () => choose($("bundle").files));
+    $("trust").addEventListener("change", async () => {
+        const f = $("trust").files?.[0];
+        if (f)
+            trust = await read(f);
+        await show();
+    });
+    $("clear-trust").addEventListener("click", () => {
+        trust = null;
+        $("trust").value = "";
+        return show();
+    });
+    for (const [id, file] of [["sample-clean", "sample.tkb"], ["sample-tampered", "sample-tampered.tkb"]])
+        $(id).addEventListener("click", () => {
+            bundle = { name: file, bytes: unb64(SAMPLES[file]) };
+            trust = sampleTrust;
+            return show();
+        });
+    $("copy").addEventListener("click", async () => {
+        try {
+            await navigator.clipboard.writeText(last.text);
+            $("copied").textContent = "Copied.";
+        }
+        catch {
+            $("report").parentElement.open = true;
+            getSelection()?.selectAllChildren($("report"));
+            $("copied").textContent = "Selected: press Ctrl+C (Cmd+C on a Mac) to copy.";
+        }
+    });
+    $("download").addEventListener("click", () => {
+        const a = el("a");
+        a.href = URL.createObjectURL(new Blob([last.json], { type: "application/json" }));
+        a.download = `${last.name.replace(/\.[^.]*$/, "")}.verify.json`;
+        a.click();
+        setTimeout(() => URL.revokeObjectURL(a.href), 1000);
+    });
+    const drop = $("drop");
+    for (const t of ["dragenter", "dragover"])
+        drop.addEventListener(t, (e) => {
+            e.preventDefault();
+            drop.classList.add("over");
+        });
+    drop.addEventListener("dragleave", () => drop.classList.remove("over"));
+    drop.addEventListener("drop", (e) => {
+        e.preventDefault();
+        drop.classList.remove("over");
+        return choose(e.dataTransfer?.files);
+    });
+    for (const t of ["dragover", "drop"]) // a file dropped beside the zone isn't opened in place of the page
+        document.addEventListener(t, (e) => e.preventDefault());
+}

package/dist/verify/zip.d.ts

@@ -1,8 +1,3 @@
-/**
- * The zip reader of docs/format-v2.md §9: one canonical layout, stored and deflated entries (Web Crypto's sibling
- * DecompressionStream), no zip64, under the bundle limits. Names that could escape a directory, symlinks and duplicate
- * entries are refused.
- */
 export declare const MAX_ENTRIES = 10000;
 export declare const MAX_ENTRY: number;
 export declare const MAX_TOTAL: number;