@joe-broadhead/messaging 0.0.0-stage → 0.7.0

package/dist/lib/testing-jelly-id.js

@@ -0,0 +1,1219 @@
+/**
+ * A Jelly ID issuer double, for tests only: the issuing side of Jelly's resource-token contract v1.1
+ * (`jelly-resource-token-contract-v1.1.md` §3-§5, §9-§11; design `docs/design/people-and-consent.md` §2.2, §3.7,
+ * §3.10, §11), with Jelly's change of 2026-11-05: an unbindable `cnf_jwk` is
+ * `400 {error: "invalid_target", detail: "invalid_cnf_jwk"}`, and a plain `invalid_target` (no `detail`) still
+ * means "no such resource".
+ *
+ * The directory tests (`packages/relay/test/directory/`) and the end-to-end suites (`test/e2e/`) import it by
+ * relative path; other repositories' tests import `@joe-broadhead/messaging/testing/jelly-id`, which carries it as tsc
+ * builds it (`test/doubles/tsconfig.json`). Production code never imports it. It loads only Node built-ins
+ * (`node:crypto`, `node:http`).
+ *
+ * What it serves, in process (`mint`, `events`, `jwks`, …) and over HTTP once `JellyIdDouble.start()` listens:
+ *
+ * | Route | Contract |
+ * |---|---|
+ * | `GET /.well-known/oauth-authorization-server` | §2: `jelly_resources`, `jelly_account_events` |
+ * | `GET /.well-known/jwks.json` | §4-§5: the current public keys; a key leaves `jwksDropMs` after a rotation |
+ * | `GET /.well-known/jwks-history.json` | §11: every key ever published, with `nbf`, `retired_at`, `revoked_at` |
+ * | `POST /hosts/<hostId>/resource-tokens` | §3: the mint, with a host's RFC 7523 assertion and an optional `cnf_jwk` |
+ * | `POST /resource/accounts/events` | §10: the deletion feed, with a service's assertion (§9) and a cursor |
+ * | `POST /resource/device/code` | v1.2 §12.1: a device client asks for a code (only while a resource has `device_sign_in`) |
+ * | `POST /resource/device/token` | v1.2 §12.3: the device polls for its `src: "device"` token |
+ * | `POST /hosts/<hostId>/wake` | Jelly's A5 (hey-jelly#36, 7 Nov): a service wakes a sleeping host with its `jelly-wake+jwt`, once per `jti` |
+ *
+ * Device sign-in (§12) behaves as Jelly's contract v1.2 §12 is built in hey-jelly
+ * (`backend/control/src/broker/resource-device-routes.ts` and `protocol/contracts/src/jelly-id-device-sign-in.ts`, at
+ * the commit `jelly-device-sign-in.md` beside this file cites): the same answers, in the same order of checks, and
+ * never a `verification_uri_complete`. The consent page of §12.2 is in process: `consentPage(code, {account})` and
+ * `decide(code, {account}, "approve" | "deny")` (or `approve(code, account)`), as the person signed in at Jelly ID,
+ * having typed the code. `jelly-id-device.test.ts` checks the double against that excerpt's tables.
+ *
+ * Time comes from `options.now` (milliseconds), so a test can rotate a key, age a cursor past retention or let a
+ * token expire without waiting: `manualClock()` gives one.
+ *
+ * Test-only powers a real issuer does not have, for adversarial cases: `sign()` signs any header and claims with
+ * any key the double ever held (a "stolen" retired key), `mint()` takes `iat` and `kid` overrides, and `fail()`
+ * makes a route answer an error. `requests` records method, path and status of every HTTP request, never a body
+ * or a header (the bodies carry assertions and tokens).
+ */
+import { createHash, createPublicKey, generateKeyPairSync, randomBytes, sign as edSign, verify as edVerify } from "node:crypto";
+import { createServer } from "node:http";
+// ---------------------------------------------------------------------------------------------
+// constants of the contract
+export const RESOURCE_TOKEN_TYP = "jelly-resource+jwt";
+export const JWT_BEARER = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer";
+/** §4: `exp = iat + 600`. */
+export const TOKEN_TTL_S = 600;
+/** §3: more than 120 tokens for one host in an hour is `429 slow_down`. */
+export const MINTS_PER_HOUR = 120;
+/** §9: a service assertion lives at most 300 s; times hold with 60 s of leeway. */
+export const ASSERTION_MAX_S = 300;
+export const LEEWAY_S = 60;
+/** §10: an event is served once it is 60 s old; events and cursors are kept 90 days; at most 100 an answer. */
+export const FEED_DELAY_MS = 60_000;
+export const FEED_RETENTION_MS = 90 * 24 * 3_600_000;
+export const FEED_PAGE = 100;
+/** §11: `jwks.json` drops a key about ten minutes after a rotation. */
+export const JWKS_DROP_MS = 10 * 60_000;
+/** Jelly's contract v1.2 §12 (`jelly-device-sign-in.md` beside this file): a service's device signs in through the browser. */
+export const DEVICE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+/** §12.1, §12.6: a code lives 600 s; the device polls every 5 s, and each `slow_down` adds 5 s to the code's interval. */
+export const DEVICE_CODE_TTL_S = 600;
+export const DEVICE_INTERVAL_S = 5;
+export const SLOW_DOWN_STEP_S = 5;
+/** §12.6: the limits. Approvals are counted per account and resource (Jelly's `approve:<account>:<resource>` window). */
+export const DEVICE_CODES_PER_ADDRESS_HOUR = 10;
+export const DEVICE_CODES_WAITING_PER_CLIENT = 1_000;
+export const DEVICE_APPROVALS_PER_ACCOUNT_RESOURCE_DAY = 5;
+/** §12.2: the page and the decision need a Jelly ID sign-in of the last 15 minutes. */
+export const RECENT_SIGN_IN_MS = 15 * 60_000;
+export const LINK_ATTEMPTS = 10;
+export const LINK_WINDOW_MS = 15 * 60_000;
+/** §12.1: Jelly's pairing-code alphabet, ten symbols grouped 5-5. */
+const USER_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+const USER_CODE = /^[A-HJ-NP-Z2-9]{10}$/;
+const LABEL = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const DEVICE_KINDS = new Set(["laptop", "server", "other"]);
+/** §9: a service's `jwks_uri` is believed for an hour, refetched for an unknown `kid` at most once a minute. */
+export const SERVICE_JWKS_TTL_MS = 3_600_000;
+export const SERVICE_JWKS_REFETCH_MS = 60_000;
+const SUB = /^acc_[A-Za-z0-9._:-]{1,123}$/;
+const HST = /^hst_[A-Za-z0-9._:-]{1,123}$/;
+const NAME = /^[a-z][a-z0-9-]{0,31}$/;
+const B64U = /^[A-Za-z0-9_-]*$/;
+// ---------------------------------------------------------------------------------------------
+// small helpers
+export const b64u = (bytes) => Buffer.from(bytes).toString("base64url");
+const fromB64u = (text) => Buffer.from(text, "base64url");
+const rand = (bytes) => b64u(randomBytes(bytes));
+const seconds = (ms) => Math.floor(ms / 1000);
+export function manualClock(start = Date.UTC(2026, 10, 6, 9, 0, 0)) {
+    let now = start;
+    const clock = (() => now);
+    clock.advance = (ms) => (now += ms);
+    clock.set = (ms) => (now = ms);
+    return clock;
+}
+export function ed25519() {
+    const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+    const x = publicKey.export({ format: "jwk" }).x;
+    return { privateKey, publicKey, x };
+}
+/** The `cnf_jwk` for a device's raw public key (base64url), as the plugin passes it to `token(name, {cnf})`. */
+export const cnfOf = (x) => ({ kty: "OKP", crv: "Ed25519", x });
+/** RFC 7638 thumbprint of an OKP key. */
+export function thumbprint(jwk) {
+    return b64u(createHash("sha256").update(`{"crv":"${jwk.crv}","kty":"${jwk.kty}","x":"${jwk.x}"}`).digest());
+}
+/**
+ * §12.3: a key's fingerprint as the consent page shows it: the first six bytes of its RFC 7638 thumbprint, in
+ * lower-case hex, in three groups of four (`3fa9-1c07-e2b4`).
+ */
+export function keyFingerprint(x) {
+    const hex = Buffer.from(thumbprint(cnfOf(x)), "base64url").subarray(0, 6).toString("hex");
+    return `${hex.slice(0, 4)}-${hex.slice(4, 8)}-${hex.slice(8, 12)}`;
+}
+/** A compact JWS signed with Ed25519 over `b64u(header).b64u(payload)`. */
+export function signJwt(header, claims, key) {
+    const input = `${b64u(JSON.stringify(header))}.${b64u(JSON.stringify(claims))}`;
+    return `${input}.${b64u(edSign(null, Buffer.from(input), key))}`;
+}
+/** Splits a compact JWS. Returns undefined for anything that is not three base64url segments of JSON objects. */
+export function decodeJwt(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts.every((p) => p.length > 0 && B64U.test(p)))
+        return undefined;
+    try {
+        const header = JSON.parse(fromB64u(parts[0]).toString("utf8"));
+        const claims = JSON.parse(fromB64u(parts[1]).toString("utf8"));
+        if (!isObject(header) || !isObject(claims))
+            return undefined;
+        return { header, claims, input: `${parts[0]}.${parts[1]}`, signature: fromB64u(parts[2]) };
+    }
+    catch {
+        return undefined;
+    }
+}
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+function publicKeyOf(x) {
+    return createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x }, format: "jwk" });
+}
+// ---------------------------------------------------------------------------------------------
+// Ed25519 point checks (§3: `x` decodes to a canonical point, on the curve, not of small order)
+const P = 2n ** 255n - 19n;
+const mod = (a) => ((a % P) + P) % P;
+function pow(base, exp) {
+    let result = 1n;
+    let b = mod(base);
+    let e = exp;
+    while (e > 0n) {
+        if (e & 1n)
+            result = mod(result * b);
+        b = mod(b * b);
+        e >>= 1n;
+    }
+    return result;
+}
+const inv = (a) => pow(a, P - 2n);
+const D = mod(-121665n * inv(121666n));
+const SQRT_M1 = pow(2n, (P - 1n) / 4n);
+/** Why 32 bytes are not a bindable Ed25519 public key, or undefined when they are. */
+export function pointProblem(bytes) {
+    if (bytes.length !== 32)
+        return "not 32 bytes";
+    let y = 0n;
+    for (let i = 31; i >= 0; i--)
+        y = (y << 8n) | BigInt(bytes[i]);
+    const sign = y >> 255n;
+    y &= (1n << 255n) - 1n;
+    if (y >= P)
+        return "y is not canonical";
+    const y2 = mod(y * y);
+    const u = mod(y2 - 1n);
+    const v = mod(D * y2 + 1n);
+    let x = mod(u * pow(v, 3n) * pow(u * pow(v, 7n), (P - 5n) / 8n));
+    const vx2 = mod(v * x * x);
+    if (vx2 === u) {
+        // x is a root
+    }
+    else if (vx2 === mod(-u)) {
+        x = mod(x * SQRT_M1);
+    }
+    else {
+        return "not on the curve";
+    }
+    if (x === 0n && sign === 1n)
+        return "x = 0 written with its sign bit";
+    if ((x & 1n) !== sign)
+        x = P - x;
+    // [8]P by three doublings in extended coordinates (a = -1); small order when it is the identity.
+    let X = x;
+    let Y = y;
+    let Z = 1n;
+    for (let i = 0; i < 3; i++) {
+        const A = mod(X * X);
+        const B = mod(Y * Y);
+        const C = mod(2n * Z * Z);
+        const H = mod(A + B);
+        const E = mod(H - mod((X + Y) * (X + Y)));
+        const G = mod(A - B);
+        const F = mod(C + G);
+        X = mod(E * F);
+        Y = mod(G * H);
+        Z = mod(F * G);
+    }
+    if (X === 0n && Y === Z)
+        return "small order";
+    return undefined;
+}
+/** Why a `cnf_jwk` is not bindable (§3), or undefined when it is. Takes the form value (JSON text) or an object. */
+export function cnfProblem(value) {
+    let jwk = value;
+    if (typeof value === "string") {
+        try {
+            jwk = JSON.parse(value);
+        }
+        catch {
+            return "not JSON";
+        }
+    }
+    if (!isObject(jwk))
+        return "not an object";
+    const keys = Object.keys(jwk).sort();
+    if (keys.join(",") !== "crv,kty,x")
+        return `members are ${keys.join(",") || "none"}, not exactly kty, crv, x`;
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519")
+        return "not an OKP Ed25519 key";
+    if (typeof jwk.x !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(jwk.x))
+        return "x is not 43 base64url characters";
+    const last = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".indexOf(jwk.x[42]);
+    if ((last & 3) !== 0)
+        return "x has non-zero spare bits";
+    return pointProblem(fromB64u(jwk.x));
+}
+/** Jelly's A5: a `jelly-wake+jwt` lives at most seven days; a host is woken at most 6 times an hour and 48 a day. */
+export const WAKE_TICKET_MAX_S = 7 * 86_400;
+export const WAKES_PER_HOUR = 6;
+export const WAKES_PER_DAY = 48;
+const NO_STORE = { "cache-control": "no-store" };
+export class JellyIdDouble {
+    issuer;
+    resources;
+    now;
+    keys = [];
+    accounts = new Map();
+    hosts = new Map();
+    events = [];
+    /** HTTP requests seen: method, path (no query) and status only. */
+    requests = [];
+    /** resource → sub → first mint (ms): the scope of the deletion feed (§3, §10). */
+    minted = new Map();
+    /** Every token the mint issued, for tests that must check a log never shows one. */
+    issued = [];
+    /** Hosts woken (A5): which, when (ms), and the ticket's `jti`. */
+    wakes = [];
+    #wakeJtis = new Set();
+    #mints = new Map();
+    #jtis = new Set();
+    #cursors = new Map();
+    #faults = new Map();
+    #serviceKeys = new Map();
+    /** §12: every code asked for, by `device_code`. */
+    deviceCodes = new Map();
+    /** §12.6: fixed windows, as Jelly's store counts them: codes asked per client address, approvals per account and resource. */
+    #windows = new Map();
+    /** §12.2: wrong codes typed per consent session (ms). */
+    #misses = new Map();
+    #options;
+    #seq = 0;
+    #server;
+    constructor(options = {}) {
+        this.issuer = options.issuer ?? "https://id.jelly.test";
+        this.resources = [...(options.resources ?? [])];
+        this.now = options.now ?? Date.now;
+        this.#options = {
+            mintsPerHour: options.mintsPerHour ?? MINTS_PER_HOUR,
+            feedPage: options.feedPage ?? FEED_PAGE,
+            feedDelayMs: options.feedDelayMs ?? FEED_DELAY_MS,
+            feedRetentionMs: options.feedRetentionMs ?? FEED_RETENTION_MS,
+            jwksDropMs: options.jwksDropMs ?? JWKS_DROP_MS,
+            deviceIntervalS: options.deviceIntervalS ?? DEVICE_INTERVAL_S,
+            deviceCodeTtlS: options.deviceCodeTtlS ?? DEVICE_CODE_TTL_S,
+        };
+        for (const entry of this.resources) {
+            if (!NAME.test(entry.name))
+                throw new Error(`resource name ${entry.name} does not match ${NAME}`);
+            if (entry.jwks && entry.jwks_uri)
+                throw new Error(`resource ${entry.name}: jwks and jwks_uri are exclusive`);
+        }
+        if (!options.noKeys)
+            this.addKey();
+    }
+    /** Listens on 127.0.0.1 (a free port unless given); the issuer is the origin unless `options.issuer` is set. */
+    static async start(options = {}, port = 0) {
+        const double = new JellyIdDouble(options);
+        const server = createServer((req, res) => void double.#handle(req, res));
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(port, "127.0.0.1", () => resolve());
+        });
+        double.#server = server;
+        if (options.issuer === undefined)
+            double.issuer = double.origin;
+        return double;
+    }
+    get origin() {
+        const address = this.#server?.address();
+        if (!address)
+            throw new Error("the Jelly ID double is not listening");
+        return `http://127.0.0.1:${address.port}`;
+    }
+    get jwksUri() {
+        return `${this.issuer}/.well-known/jwks.json`;
+    }
+    get historyUri() {
+        return `${this.issuer}/.well-known/jwks-history.json`;
+    }
+    get eventsUri() {
+        return `${this.issuer}/resource/accounts/events`;
+    }
+    /** v1.2 §12: the routes of §12.1 and §12.3, and the consent page of §12.2. */
+    get deviceCodeUri() {
+        return `${this.issuer}/resource/device/code`;
+    }
+    get deviceTokenUri() {
+        return `${this.issuer}/resource/device/token`;
+    }
+    get linkUri() {
+        return `${this.issuer}/link`;
+    }
+    async close() {
+        const server = this.#server;
+        if (!server)
+            return;
+        this.#server = undefined;
+        server.closeAllConnections();
+        await new Promise((resolve) => server.close(() => resolve()));
+    }
+    // ---- keys (§4, §11) ----
+    /** The key that signs now: the newest one not dropped or revoked. */
+    get signer() {
+        return [...this.keys].reverse().find((k) => k.rotatedAt === undefined && k.droppedAt === undefined && k.revokedAt === undefined);
+    }
+    addKey(kid = `k-${seconds(this.now())}-${rand(3)}`) {
+        if (this.keys.some((k) => k.kid === kid))
+            throw new Error(`kid ${kid} exists`);
+        const key = { kid, key: ed25519(), nbf: seconds(this.now()) };
+        this.keys.push(key);
+        return key;
+    }
+    /** A new key takes over signing; the old one stays in `jwks.json` for `jwksDropMs`, then only in the history. */
+    rotate(kid) {
+        const old = this.signer;
+        const fresh = this.addKey(kid);
+        if (old)
+            old.rotatedAt = this.now();
+        return fresh;
+    }
+    /** Drops a key from `jwks.json` now: its `retired_at` is now. */
+    retire(kid) {
+        const key = this.#key(kid);
+        key.rotatedAt ??= this.now();
+        key.droppedAt = this.now();
+    }
+    /** An operator revokes a key (`JELLY_ID_REVOKED_KEYS`): `revoked_at` in the history, gone from `jwks.json`. */
+    revoke(kid, atSeconds = seconds(this.now())) {
+        const key = this.#key(kid);
+        key.revokedAt = atSeconds;
+        key.droppedAt ??= this.now();
+    }
+    #key(kid) {
+        const key = this.keys.find((k) => k.kid === kid);
+        if (!key)
+            throw new Error(`no key ${kid}`);
+        return key;
+    }
+    /** Ms when the key left (or leaves) `jwks.json`, if it does. */
+    #dropTime(key) {
+        if (key.droppedAt !== undefined)
+            return key.droppedAt;
+        if (key.rotatedAt !== undefined)
+            return key.rotatedAt + this.#options.jwksDropMs;
+        return undefined;
+    }
+    #publicJwk(key) {
+        return { kty: "OKP", crv: "Ed25519", x: key.key.x, kid: key.kid, alg: "EdDSA", use: "sig" };
+    }
+    /** `jwks.json`: the published keys, newest (the signer) first. Never a private member. */
+    jwks() {
+        const now = this.now();
+        return {
+            keys: [...this.keys]
+                .reverse()
+                .filter((k) => {
+                const drop = this.#dropTime(k);
+                return drop === undefined || now < drop;
+            })
+                .map((k) => this.#publicJwk(k)),
+        };
+    }
+    /** `jwks-history.json` (§11): every key ever published, oldest first; it never shrinks. */
+    history() {
+        const now = this.now();
+        return {
+            keys: this.keys.map((k) => {
+                const drop = this.#dropTime(k);
+                const retired = drop !== undefined && now >= drop ? seconds(drop) : null;
+                return { ...this.#publicJwk(k), nbf: k.nbf, retired_at: retired, ...(k.revokedAt !== undefined ? { revoked_at: k.revokedAt } : {}) };
+            }),
+        };
+    }
+    /**
+     * The RFC 8414 metadata. Like Jelly ID's in production, it names `device_authorization_endpoint`: the route that
+     * enrols *hosts* with a host's assertion (`/device/code`), which a service's device must not take for §12. The
+     * double does not serve it. §12's own two members appear only when a resource has `device_sign_in` (v1.2 §2).
+     */
+    discovery() {
+        const resources = this.resources.map(({ name, resource, url }) => ({ name, resource, url }));
+        const deviceSignIn = this.resources.some((r) => r.device_sign_in === true);
+        return {
+            issuer: this.issuer,
+            authorization_endpoint: `${this.issuer}/authorize`,
+            token_endpoint: `${this.issuer}/token`,
+            device_authorization_endpoint: `${this.issuer}/device/code`,
+            jwks_uri: this.jwksUri,
+            grant_types_supported: ["authorization_code", "refresh_token", DEVICE_GRANT],
+            ...(resources.length > 0 ? { jelly_resources: resources, jelly_account_events: this.eventsUri } : {}),
+            ...(deviceSignIn ? { jelly_resource_device_authorization_endpoint: this.deviceCodeUri, jelly_resource_device_token_endpoint: this.deviceTokenUri } : {}),
+        };
+    }
+    /** Test-only: signs anything with any key the double holds or held (a stolen key, a backdated token). */
+    sign(header, claims, kid = this.signer?.kid) {
+        if (kid === undefined)
+            throw new Error("no signing key");
+        return signJwt(header, claims, this.#key(kid).key.privateKey);
+    }
+    // ---- accounts and hosts ----
+    account(opts = {}) {
+        const sub = opts.sub ?? `acc_${rand(9)}`;
+        if (!SUB.test(sub))
+            throw new Error(`sub ${sub} does not match ${SUB}`);
+        const emailVerified = opts.email !== undefined && opts.emailVerified !== false;
+        const account = { sub, email: opts.email, emailVerified, name: opts.name, state: "active" };
+        this.accounts.set(sub, account);
+        return account;
+    }
+    /** Enrols a host owned by `account`, with its own Ed25519 key for its client assertions. */
+    host(account, id = `hst_${rand(9)}`) {
+        if (!HST.test(id))
+            throw new Error(`host id ${id} does not match ${HST}`);
+        const host = { id, account, key: ed25519(), removed: false };
+        this.hosts.set(id, host);
+        return host;
+    }
+    /** The host's RFC 7523 client assertion (`iss = sub = hostId`, `aud` = the issuer). */
+    hostAssertion(host, opts = {}) {
+        const iat = opts.iat ?? seconds(this.now());
+        return signJwt({ alg: "EdDSA", typ: "JWT", kid: host.id }, { iss: host.id, sub: host.id, aud: opts.aud ?? this.issuer, iat, exp: iat + (opts.ttl ?? 60), jti: opts.jti ?? rand(16) }, opts.key ?? host.key.privateKey);
+    }
+    /**
+     * The host's wake ticket (Jelly's A5): a `jelly-wake+jwt` signed with its enrolled key, `iss` and `sub` the host, `aud`
+     * its wake URL, `svc` the service, a fresh `jti`, valid `ttl` seconds (default a day; Jelly allows seven).
+     */
+    wakeTicket(host, opts = {}) {
+        const iat = opts.iat ?? seconds(this.now());
+        return signJwt({ alg: "EdDSA", typ: opts.typ ?? "jelly-wake+jwt", kid: host.id }, { iss: host.id, sub: host.id, aud: opts.aud ?? this.wakeUrl(host), svc: opts.svc ?? "messaging", iat, exp: iat + (opts.ttl ?? 86_400), jti: opts.jti ?? rand(16) }, opts.key ?? host.key.privateKey);
+    }
+    /** `<issuer>/hosts/<id>/wake`. */
+    wakeUrl(host) {
+        return `${this.issuer}/hosts/${typeof host === "string" ? host : host.id}/wake`;
+    }
+    /**
+     * `POST /hosts/<hostId>/wake` as Jelly ID answers it (A5): `202` wakes the host and spends the ticket's `jti`; `401`
+     * for a ticket that is not this host's, has expired or was spent; `404` for no such host; `429` with `Retry-After`
+     * past the host's budget (6 an hour, 48 a day); `503` (by `fail("wake")`) spends nothing.
+     */
+    wake(hostId, form) {
+        const fault = this.#fault("wake");
+        if (fault)
+            return fault;
+        const host = this.hosts.get(hostId);
+        if (!host || host.removed)
+            return this.#error(404, "not_found");
+        if (form.get("client_assertion_type") !== "urn:jelly:wake" || duplicated(form, "ticket"))
+            return this.#error(400, "invalid_request");
+        const decoded = decodeJwt(form.get("ticket") ?? "");
+        const now = seconds(this.now());
+        const claims = decoded?.claims;
+        const good = decoded !== undefined &&
+            decoded.header.alg === "EdDSA" &&
+            decoded.header.typ === "jelly-wake+jwt" &&
+            edVerify(null, Buffer.from(decoded.input), host.key.publicKey, decoded.signature) &&
+            claims.iss === host.id &&
+            claims.sub === host.id &&
+            claims.aud === this.wakeUrl(host) &&
+            typeof claims.iat === "number" &&
+            typeof claims.exp === "number" &&
+            claims.iat <= now + LEEWAY_S &&
+            claims.exp > now &&
+            claims.exp - claims.iat <= WAKE_TICKET_MAX_S &&
+            typeof claims.jti === "string" &&
+            !this.#wakeJtis.has(claims.jti);
+        if (!good)
+            return this.#error(401, "invalid_client");
+        const at = this.now();
+        const mine = this.wakes.filter((w) => w.host === host.id);
+        const hour = mine.filter((w) => w.at > at - 3_600_000);
+        const day = mine.filter((w) => w.at > at - 86_400_000);
+        if (hour.length >= WAKES_PER_HOUR || day.length >= WAKES_PER_DAY) {
+            const oldest = (hour.length >= WAKES_PER_HOUR ? hour[0].at + 3_600_000 : day[0].at + 86_400_000) - at;
+            return { status: 429, body: { error: "slow_down" }, headers: { ...NO_STORE, "retry-after": String(Math.max(1, Math.ceil(oldest / 1000))) } };
+        }
+        this.#wakeJtis.add(claims.jti);
+        this.wakes.push({ host: host.id, at, jti: claims.jti });
+        return { status: 202, body: {}, headers: { ...NO_STORE } };
+    }
+    disable(account) {
+        account.state = "disabled";
+    }
+    /** The person asks to delete: no more tokens (§10, "From the request on…"). No event yet. */
+    requestDeletion(account) {
+        account.state = "deleting";
+    }
+    /** The grace period ends: `account.deleted` for every service the account was minted a token for (§10). */
+    purge(account) {
+        account.state = "purged";
+        const written = [];
+        for (const [resource, subs] of this.minted)
+            if (subs.has(account.sub))
+                written.push(this.emit({ sub: account.sub, resource }));
+        return written;
+    }
+    /** Test-only: writes any event (an unknown kind, an unknown person) into one service's feed. */
+    emit({ sub, resource, event = "account.deleted", atMs = this.now() }) {
+        const written = { id: `evt_${randomBytes(16).toString("hex")}`, sub, event, at: new Date(atMs).toISOString(), resource, seq: ++this.#seq, atMs };
+        this.events.push(written);
+        return written;
+    }
+    // ---- service keys (§9) ----
+    /** A service key pair and its public JWK (with `kid`), for `ResourceEntry.jwks` and `serviceAssertion`. */
+    static serviceKey(kid = `svc-${rand(4)}`) {
+        const pair = ed25519();
+        return { kid, pair, jwk: { kty: "OKP", crv: "Ed25519", x: pair.x, kid } };
+    }
+    /** A service's RFC 7523 assertion (§9): `iss = sub = name`, `aud` = the issuer. */
+    serviceAssertion(name, key, opts = {}) {
+        const iat = opts.iat ?? seconds(this.now());
+        return signJwt({ alg: "EdDSA", typ: "JWT", kid: key.kid }, { iss: opts.iss ?? name, sub: opts.sub ?? name, aud: opts.aud ?? this.issuer, iat, exp: iat + (opts.ttl ?? 120), jti: opts.jti ?? rand(16) }, key.pair.privateKey);
+    }
+    // ---- faults ----
+    /** The next `times` requests to `route` answer `status` with `body` (default a `temporarily_unavailable`). */
+    fail(route, status = 503, body = { error: "temporarily_unavailable" }, times = 1) {
+        this.#faults.set(route, { status, body, times });
+    }
+    #fault(route) {
+        const fault = this.#faults.get(route);
+        if (!fault)
+            return undefined;
+        if (--fault.times <= 0)
+            this.#faults.delete(route);
+        return { status: fault.status, body: fault.body, headers: { ...NO_STORE } };
+    }
+    // ---- the mint (§3, §4) ----
+    /**
+     * The mint as the HTTP route answers it, with the host's assertion checked (§3). `mint()` skips the assertion;
+     * use this to test `invalid_client`.
+     */
+    mintWithAssertion(hostId, form) {
+        const fault = this.#fault("mint");
+        if (fault)
+            return fault;
+        const unavailable = this.#unavailable();
+        if (unavailable)
+            return unavailable;
+        const host = this.hosts.get(hostId);
+        if (!host || host.removed || !this.#assertion(form, (claims, decoded) => claims.iss === host.id && claims.sub === host.id && edVerify(null, Buffer.from(decoded.input), host.key.publicKey, decoded.signature), "host")) {
+            return this.#error(401, "invalid_client");
+        }
+        if (duplicated(form, "resource") || duplicated(form, "cnf_jwk"))
+            return this.#error(400, "invalid_request");
+        const cnf = form.get("cnf_jwk");
+        return this.#mint({ host, resource: form.get("resource") ?? "", ...(cnf !== null ? { cnf } : {}) });
+    }
+    /** Mints as an enrolled, owned host asked for it (the assertion is assumed good). */
+    mint(args) {
+        const fault = this.#fault("mint");
+        if (fault)
+            return fault;
+        const unavailable = this.#unavailable();
+        if (unavailable)
+            return unavailable;
+        const host = typeof args.host === "string" ? this.hosts.get(args.host) : args.host;
+        if (!host || host.removed)
+            return this.#error(401, "invalid_client");
+        return this.#mint({ ...args, host });
+    }
+    /** `mint()` that returns the token or throws with the error code (and detail). */
+    token(args) {
+        const answer = this.mint(args);
+        if (answer.status !== 200)
+            throw Object.assign(new Error(`mint: ${answer.status} ${String(answer.body.error)}`), { code: answer.body.error, detail: answer.body.detail, status: answer.status });
+        return answer.body.access_token;
+    }
+    #unavailable() {
+        return this.signer === undefined || this.resources.length === 0 ? this.#error(503, "temporarily_unavailable") : undefined;
+    }
+    #mint(args) {
+        const { host } = args;
+        const entry = this.resources.find((r) => r.resource === args.resource);
+        if (!entry)
+            return this.#error(400, "invalid_target");
+        let cnf;
+        if (args.cnf !== undefined) {
+            const text = typeof args.cnf === "string" ? args.cnf : JSON.stringify(args.cnf);
+            if (cnfProblem(text) !== undefined)
+                return this.#error(400, "invalid_target", { detail: "invalid_cnf_jwk" });
+            const parsed = JSON.parse(text);
+            cnf = { kty: parsed.kty, crv: parsed.crv, x: parsed.x };
+        }
+        const account = host.account;
+        if (account.state !== "active")
+            return this.#error(403, "access_denied");
+        const now = this.now();
+        const recent = (this.#mints.get(host.id) ?? []).filter((t) => t > now - 3_600_000);
+        if (recent.length >= this.#options.mintsPerHour) {
+            this.#mints.set(host.id, recent);
+            return this.#error(429, "slow_down");
+        }
+        recent.push(now);
+        this.#mints.set(host.id, recent);
+        const key = args.kid !== undefined ? this.#key(args.kid) : this.signer;
+        const iat = args.iat ?? seconds(now);
+        const claims = {
+            iss: this.issuer,
+            aud: entry.resource,
+            sub: account.sub,
+            ...(account.emailVerified && account.email !== undefined ? { email: account.email, email_verified: true } : {}),
+            ...(account.name !== undefined ? { name: account.name } : {}),
+            hst: host.id,
+            ...(cnf ? { cnf: { jwk: cnf } } : {}),
+            iat,
+            exp: iat + TOKEN_TTL_S,
+            jti: rand(16),
+        };
+        const token = signJwt({ alg: "EdDSA", typ: RESOURCE_TOKEN_TYP, kid: key.kid }, claims, key.key.privateKey);
+        this.issued.push(token);
+        const subs = this.minted.get(entry.resource) ?? new Map();
+        if (!subs.has(account.sub))
+            subs.set(account.sub, now);
+        this.minted.set(entry.resource, subs);
+        return { status: 200, body: { access_token: token, token_type: "Bearer", expires_in: TOKEN_TTL_S, resource: entry.resource }, headers: { ...NO_STORE } };
+    }
+    #error(status, error, extra = {}) {
+        return { status, body: { error, ...extra }, headers: { ...NO_STORE } };
+    }
+    /**
+     * Checks an RFC 7523 assertion in `form`: the assertion type, `alg: EdDSA`, `aud` = the issuer, `exp - iat` ≤
+     * 300, the times with 60 s of leeway, a `jti` of at most 128 characters never seen under `prefix`, and `accept`
+     * (the issuer-specific `iss`/`sub` and signature check). The `jti` is spent only when everything else holds.
+     */
+    #assertion(form, accept, prefix) {
+        if (duplicated(form, "client_assertion") || duplicated(form, "client_assertion_type"))
+            return false;
+        if (form.get("client_assertion_type") !== JWT_BEARER)
+            return false;
+        const decoded = decodeJwt(form.get("client_assertion") ?? "");
+        if (!decoded || decoded.header.alg !== "EdDSA")
+            return false;
+        const { claims } = decoded;
+        const now = seconds(this.now());
+        const { iat, exp, jti } = claims;
+        if (claims.aud !== this.issuer)
+            return false;
+        if (typeof iat !== "number" || typeof exp !== "number" || exp - iat > ASSERTION_MAX_S || exp - iat <= 0)
+            return false;
+        if (iat > now + LEEWAY_S || exp < now - LEEWAY_S)
+            return false;
+        if (typeof jti !== "string" || jti.length === 0 || jti.length > 128 || this.#jtis.has(`${prefix}:${jti}`))
+            return false;
+        let ok = false;
+        try {
+            ok = accept(claims, decoded);
+        }
+        catch {
+            ok = false;
+        }
+        if (ok)
+            this.#jtis.add(`${prefix}:${jti}`);
+        return ok;
+    }
+    // ---- the deletion feed (§9, §10) ----
+    async #serviceKeysOf(entry, kid) {
+        if (entry.jwks)
+            return entry.jwks.keys;
+        if (!entry.jwks_uri)
+            return [];
+        const now = this.now();
+        const cached = this.#serviceKeys.get(entry.name);
+        const fresh = cached && now - cached.fetchedAt < SERVICE_JWKS_TTL_MS;
+        const knows = cached?.keys.some((k) => k.kid === kid);
+        if (cached && fresh && (knows || now - cached.lastRefetch < SERVICE_JWKS_REFETCH_MS))
+            return cached.keys;
+        try {
+            const response = await fetch(entry.jwks_uri, { redirect: "error", signal: AbortSignal.timeout(5_000) });
+            if (!response.ok)
+                return cached?.keys ?? [];
+            const body = (await response.json());
+            const keys = Array.isArray(body.keys) ? body.keys : [];
+            this.#serviceKeys.set(entry.name, { keys, fetchedAt: now, lastRefetch: now });
+            return keys;
+        }
+        catch {
+            return cached?.keys ?? [];
+        }
+    }
+    /** The deletion feed as the HTTP route answers it (§10). */
+    async accountEvents(form) {
+        const fault = this.#fault("events");
+        if (fault)
+            return fault;
+        if (this.resources.length === 0)
+            return this.#error(503, "temporarily_unavailable");
+        const decoded = decodeJwt(form.get("client_assertion") ?? "");
+        const name = decoded?.claims.iss;
+        const entry = typeof name === "string" ? this.resources.find((r) => r.name === name) : undefined;
+        const kid = decoded?.header.kid;
+        const keys = entry && typeof kid === "string" ? await this.#serviceKeysOf(entry, kid) : [];
+        const proven = entry !== undefined && this.#assertion(form, (claims, d) => {
+            if (claims.iss !== entry.name || claims.sub !== entry.name)
+                return false;
+            const jwk = keys.find((k) => k.kid === d.header.kid);
+            return jwk !== undefined && jwk.kty === "OKP" && jwk.crv === "Ed25519" && edVerify(null, Buffer.from(d.input), publicKeyOf(jwk.x), d.signature);
+        }, "service");
+        if (!proven)
+            return this.#error(401, "invalid_client");
+        if (duplicated(form, "cursor"))
+            return this.#error(400, "invalid_request");
+        const now = this.now();
+        const retention = this.#options.feedRetentionMs;
+        const bound = now - this.#options.feedDelayMs;
+        let from = { seq: 0, bound: 0 };
+        const cursor = form.get("cursor");
+        if (cursor !== null) {
+            const known = this.#cursors.get(cursor);
+            if (!known)
+                return this.#error(400, "invalid_request");
+            if (known.bound < now - retention)
+                return this.#error(410, "cursor_expired");
+            from = known;
+        }
+        // Retention: events older than 90 days are gone.
+        for (let i = this.events.length - 1; i >= 0; i--)
+            if (this.events[i].atMs < now - retention)
+                this.events.splice(i, 1);
+        const eligible = this.events.filter((e) => e.resource === entry.resource && e.seq > from.seq && e.atMs <= bound);
+        const page = eligible.slice(0, this.#options.feedPage);
+        const more = eligible.length > page.length;
+        const last = page.at(-1);
+        const next = more ? { seq: last.seq, bound: last.atMs } : { seq: last?.seq ?? from.seq, bound };
+        const id = `cur_${rand(12)}`;
+        this.#cursors.set(id, next);
+        return {
+            status: 200,
+            body: { events: page.map(({ id: eventId, sub, event, at }) => ({ id: eventId, sub, event, at })), cursor: id, more },
+            headers: { ...NO_STORE },
+        };
+    }
+    // ---- signing a device in through the browser (Jelly's contract v1.2 §12, as built) ----
+    /** §12.1: the device client of `clientId`, when it is a resource name with device sign-in on. */
+    #deviceClient(clientId) {
+        return this.resources.find((r) => r.name === clientId && r.device_sign_in === true);
+    }
+    /** Keeps the times within `windowMs` of now in `map[key]`, and says whether `limit` of them are already there. */
+    #over(map, key, windowMs, limit) {
+        const now = this.now();
+        const recent = (map.get(key) ?? []).filter((t) => t > now - windowMs);
+        map.set(key, recent);
+        return recent.length >= limit;
+    }
+    /**
+     * Counts one use against the window `key`, if it has room (Jelly's `takeDeviceSignInWindow`): a window starts at its
+     * first use and lasts `windowMs`; a use over `limit` in it is refused and not counted.
+     */
+    #take(key, limit, windowMs) {
+        const now = this.now();
+        const window = this.#windows.get(key);
+        if (!window || window.until <= now) {
+            this.#windows.set(key, { used: 1, until: now + windowMs });
+            return true;
+        }
+        if (window.used >= limit)
+            return false;
+        window.used += 1;
+        return true;
+    }
+    #userCode() {
+        for (;;) {
+            const bytes = randomBytes(10);
+            const code = [...bytes].map((b) => USER_CODE_ALPHABET[b % 32]).join("");
+            if (![...this.deviceCodes.values()].some((c) => c.userCode === code))
+                return code;
+        }
+    }
+    /**
+     * `POST /resource/device/code` (§12.1) as Jelly's route answers it, in its order of checks: every field present
+     * (a repeated one is missing), the client, the resource, the key, the label and kind, then the per-address and
+     * per-client limits. `address` is the client's address, for the per-address limit. Never `verification_uri_complete`.
+     */
+    deviceAuthorize(form, address = "127.0.0.1") {
+        const fault = this.#fault("device-code");
+        if (fault)
+            return fault;
+        const unavailable = this.#unavailable();
+        if (unavailable)
+            return unavailable;
+        const [clientId, resource, cnfText, label, kind] = ["client_id", "resource", "cnf_jwk", "label", "kind"].map((name) => field(form, name));
+        if ([clientId, resource, cnfText, label, kind].some((value) => value === undefined))
+            return this.#error(400, "invalid_request");
+        const client = this.#deviceClient(clientId);
+        if (!client)
+            return this.#error(401, "invalid_client");
+        if (resource !== client.resource)
+            return this.#error(400, "invalid_target");
+        if (cnfProblem(cnfText) !== undefined)
+            return this.#error(400, "invalid_target", { detail: "invalid_cnf_jwk" });
+        if (!LABEL.test(label) || !DEVICE_KINDS.has(kind))
+            return this.#error(400, "invalid_request");
+        const parsed = JSON.parse(cnfText);
+        const now = this.now();
+        if (!this.#take(`code:${address}`, DEVICE_CODES_PER_ADDRESS_HOUR, 3_600_000))
+            return this.#error(429, "slow_down");
+        const waiting = [...this.deviceCodes.values()].filter((c) => c.clientId === client.name && c.decision === undefined && c.expiresAt > now);
+        if (waiting.length >= DEVICE_CODES_WAITING_PER_CLIENT)
+            return this.#error(429, "slow_down");
+        const deviceCode = rand(32);
+        const userCode = this.#userCode();
+        this.deviceCodes.set(deviceCode, {
+            deviceCode,
+            userCode,
+            clientId: client.name,
+            resource: client.resource,
+            cnf: { kty: parsed.kty, crv: parsed.crv, x: parsed.x },
+            label: label,
+            kind: kind,
+            address,
+            createdAt: now,
+            expiresAt: now + this.#options.deviceCodeTtlS * 1000,
+            interval: this.#options.deviceIntervalS,
+            consumed: false,
+        });
+        return {
+            status: 200,
+            body: {
+                device_code: deviceCode,
+                user_code: `${userCode.slice(0, 5)}-${userCode.slice(5)}`,
+                verification_uri: this.linkUri,
+                expires_in: this.#options.deviceCodeTtlS,
+                interval: this.#options.deviceIntervalS,
+            },
+            headers: { ...NO_STORE },
+        };
+    }
+    /** The waiting code a person typed (any grouping or case), or undefined. */
+    #pending(code) {
+        const normal = code.toUpperCase().replace(/[\s-]+/g, "");
+        if (!USER_CODE.test(normal))
+            return undefined;
+        const now = this.now();
+        return [...this.deviceCodes.values()].find((c) => c.userCode === normal && c.decision === undefined && c.expiresAt > now);
+    }
+    /** §12.5: the account must be active, and not disabled or marked for deletion. */
+    #live(account) {
+        return this.accounts.get(account.sub) === account && account.state === "active";
+    }
+    /**
+     * The consent page of §12.2 for the person signed in as `account` (in `session`, signed in at `signedInAt`, default
+     * now), who typed `code` (`from: "typed"`, the default) or arrived with it from `/link?code=` (`from: "link"`). Errors:
+     * `account_inactive` (the live check), `type_the_code` (a code from a link is asked for again: "A sign-in code for a
+     * device cannot come from a link"), `sign_in_again` (a sign-in older than 15 minutes), `too_many_codes` (10 wrong
+     * codes in 15 minutes), `code_invalid` (unknown, decided or expired: "That code didn't work").
+     */
+    consentPage(code, as) {
+        if (!this.#live(as.account))
+            return { status: 403, error: "account_inactive" };
+        if (as.from === "link")
+            return { status: 400, error: "type_the_code" };
+        if (as.signedInAt !== undefined && this.now() - as.signedInAt > RECENT_SIGN_IN_MS)
+            return { status: 401, error: "sign_in_again" };
+        const session = as.session ?? as.account.sub;
+        if (this.#over(this.#misses, session, LINK_WINDOW_MS, LINK_ATTEMPTS))
+            return { status: 429, error: "too_many_codes" };
+        const row = this.#pending(code);
+        if (!row) {
+            this.#misses.get(session).push(this.now());
+            return { status: 400, error: "code_invalid" };
+        }
+        const entry = this.resources.find((r) => r.name === row.clientId);
+        return {
+            status: 200,
+            page: {
+                service: { name: entry.name, url: entry.url },
+                device: { label: row.label, kind: row.kind },
+                fingerprint: keyFingerprint(row.cnf.x),
+                userCode: `${row.userCode.slice(0, 5)}-${row.userCode.slice(5)}`,
+                account: as.account.email ?? as.account.name ?? as.account.sub,
+                asked: { at: new Date(row.createdAt).toISOString(), address: row.address },
+                says: "Check that the device shows this same code and fingerprint. If you did not start this yourself, on that device, just now, choose Deny.",
+            },
+        };
+    }
+    /**
+     * The person's decision on the consent page (`POST /link/device`, §12.2): `approve` or `deny`, once per code. Errors
+     * as `consentPage`, and `too_many_sign_ins` when the account approved 5 sign-ins to this resource in the day's window
+     * (§12.6): nothing is decided then, and the code waits on until it expires.
+     */
+    decide(code, as, decision) {
+        const page = this.consentPage(code, as);
+        if (page.status !== 200)
+            return page;
+        const row = this.#pending(code);
+        if (decision === "deny") {
+            row.decision = { approved: false };
+            return { status: 200, decided: "denied" };
+        }
+        if (!this.#take(`approve:${as.account.sub}:${row.resource}`, DEVICE_APPROVALS_PER_ACCOUNT_RESOURCE_DAY, 24 * 3_600_000))
+            return { status: 429, error: "too_many_sign_ins" };
+        row.decision = { approved: true, account: as.account };
+        return { status: 200, decided: "approved" };
+    }
+    /** The person approves the code a device shows (test shorthand); throws on a refusal. */
+    approve(code, account) {
+        const done = this.decide(code, { account }, "approve");
+        if (done.status !== 200)
+            throw Object.assign(new Error(`approve: ${done.error}`), { code: done.error });
+    }
+    /**
+     * A whole sign-in through the browser in process (§12.1-§12.3): a code for `cnf` from `client` (the resource's
+     * name), approved by `account`, exchanged once. Returns the `src: "device"` token, or throws with the error code.
+     */
+    signInToken(args) {
+        const resource = this.resources.find((r) => r.name === (args.client ?? "messaging"));
+        if (!resource?.device_sign_in)
+            throw Object.assign(new Error("signInToken: the resource has no device_sign_in"), { code: "invalid_client" });
+        const code = this.deviceAuthorize(new URLSearchParams({ client_id: resource.name, resource: resource.resource, cnf_jwk: JSON.stringify(args.cnf), label: args.label ?? "device", kind: args.kind ?? "laptop" }));
+        const body = code.body;
+        if (code.status !== 200)
+            throw Object.assign(new Error(`signInToken: ${body.error}`), { code: body.error });
+        this.approve(body.user_code, args.account);
+        const answer = this.deviceToken(new URLSearchParams({ grant_type: DEVICE_GRANT, device_code: body.device_code, client_id: resource.name }));
+        const token = answer.body;
+        if (answer.status !== 200)
+            throw Object.assign(new Error(`signInToken: ${token.error}`), { code: token.error });
+        return token.access_token;
+    }
+    /**
+     * `POST /resource/device/token` (§12.3) as Jelly's route answers it, in its order of checks: the grant type, the
+     * client, the code (recording the poll: one sooner than the code's interval grows it by 5 s), the code's client,
+     * spent, denied, expired (decided or not), undecided (`slow_down` when early, else `authorization_pending`), then
+     * the approval is spent and the account checked live. A repeated field is a missing one.
+     */
+    deviceToken(form) {
+        const fault = this.#fault("device-token");
+        if (fault)
+            return fault;
+        const unavailable = this.#unavailable();
+        if (unavailable)
+            return unavailable;
+        if (field(form, "grant_type") !== DEVICE_GRANT)
+            return this.#error(400, "unsupported_grant_type");
+        const client = this.#deviceClient(field(form, "client_id"));
+        if (!client)
+            return this.#error(401, "invalid_client");
+        const row = this.deviceCodes.get(field(form, "device_code") ?? "");
+        if (!row)
+            return this.#error(400, "invalid_grant");
+        const now = this.now();
+        const early = row.lastPoll !== undefined && now - row.lastPoll < row.interval * 1000;
+        row.lastPoll = now;
+        if (early)
+            row.interval += SLOW_DOWN_STEP_S;
+        if (row.clientId !== client.name || row.resource !== client.resource)
+            return this.#error(400, "invalid_grant");
+        if (row.consumed)
+            return this.#error(400, "invalid_grant");
+        if (row.decision?.approved === false)
+            return this.#error(400, "access_denied");
+        if (row.expiresAt <= now)
+            return this.#error(400, "expired_token");
+        if (row.decision === undefined)
+            return this.#error(400, early ? "slow_down" : "authorization_pending");
+        // §12.5: spent before the live check, so an approval is used once whatever it answers.
+        row.consumed = true;
+        const account = row.decision.account;
+        if (!this.#live(account))
+            return this.#error(400, "access_denied");
+        const key = this.signer;
+        const iat = seconds(now);
+        const claims = {
+            iss: this.issuer,
+            aud: row.resource,
+            sub: account.sub,
+            ...(account.emailVerified && account.email !== undefined ? { email: account.email, email_verified: true } : {}),
+            ...(account.name !== undefined ? { name: account.name } : {}),
+            cnf: { jwk: row.cnf },
+            src: "device",
+            iat,
+            exp: iat + TOKEN_TTL_S,
+            jti: rand(16),
+        };
+        const token = signJwt({ alg: "EdDSA", typ: RESOURCE_TOKEN_TYP, kid: key.kid }, claims, key.key.privateKey);
+        this.issued.push(token);
+        const subs = this.minted.get(row.resource) ?? new Map();
+        if (!subs.has(account.sub))
+            subs.set(account.sub, now);
+        this.minted.set(row.resource, subs);
+        return { status: 200, body: { access_token: token, token_type: "Bearer", expires_in: TOKEN_TTL_S, resource: row.resource }, headers: { ...NO_STORE } };
+    }
+    /** The waiting or decided code whose `user_code` (as shown) is `shown`. */
+    codeOf(shown) {
+        const normal = shown.toUpperCase().replace(/[\s-]+/g, "");
+        return [...this.deviceCodes.values()].find((c) => c.userCode === normal);
+    }
+    // ---- HTTP ----
+    async #handle(req, res) {
+        const url = new URL(req.url ?? "/", "http://double");
+        const path = url.pathname;
+        let answer;
+        try {
+            answer = await this.#route(req, path);
+        }
+        catch {
+            answer = this.#error(500, "server_error");
+        }
+        this.requests.push({ method: req.method ?? "", path, status: answer.status });
+        res.writeHead(answer.status, { "content-type": "application/json", ...answer.headers });
+        res.end(JSON.stringify(answer.body));
+    }
+    async #route(req, path) {
+        const get = req.method === "GET";
+        const post = req.method === "POST";
+        const json = (body, cache) => ({ status: 200, body, headers: { "cache-control": cache } });
+        if (get && path === "/.well-known/oauth-authorization-server")
+            return this.#fault("discovery") ?? json(this.discovery(), "public, max-age=300");
+        if (get && path === "/.well-known/jwks.json")
+            return this.#fault("jwks") ?? json(this.jwks(), "public, max-age=600");
+        if (get && path === "/.well-known/jwks-history.json")
+            return this.#fault("history") ?? json(this.history(), "public, max-age=300");
+        const mint = /^\/hosts\/([^/]+)\/resource-tokens$/.exec(path);
+        if (post && mint) {
+            const form = await readForm(req);
+            if (!form)
+                return this.#error(400, "invalid_request");
+            return this.mintWithAssertion(decodeURIComponent(mint[1]), form);
+        }
+        const wake = /^\/hosts\/([^/]+)\/wake$/.exec(path);
+        if (post && wake) {
+            const form = await readForm(req);
+            if (!form)
+                return this.#error(400, "invalid_request");
+            return this.wake(decodeURIComponent(wake[1]), form);
+        }
+        if (post && path === "/resource/accounts/events") {
+            const form = await readForm(req);
+            if (!form)
+                return this.#error(400, "invalid_request");
+            return this.accountEvents(form);
+        }
+        // §12's routes answer whatever the configuration, as Jelly's do: with no device client, a code is
+        // `401 invalid_client`. Only discovery hides them. A body that is not a form has no fields.
+        if (post && path === "/resource/device/code")
+            return this.deviceAuthorize((await readForm(req)) ?? new URLSearchParams(), req.socket.remoteAddress ?? "unknown");
+        if (post && path === "/resource/device/token")
+            return this.deviceToken((await readForm(req)) ?? new URLSearchParams());
+        return { status: 404, body: { error: "not_found" }, headers: {} };
+    }
+}
+function duplicated(form, name) {
+    return form.getAll(name).length > 1;
+}
+/** A form's field as Jelly's `formFields` reads it: a repeated field is a missing one. */
+function field(form, name) {
+    const values = form.getAll(name);
+    return values.length === 1 ? values[0] : undefined;
+}
+async function readForm(req) {
+    if (!(req.headers["content-type"] ?? "").startsWith("application/x-www-form-urlencoded"))
+        return undefined;
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > 64 * 1024)
+            return undefined;
+        chunks.push(chunk);
+    }
+    return new URLSearchParams(Buffer.concat(chunks).toString("utf8"));
+}
+// ---------------------------------------------------------------------------------------------
+// HTTP clients of the double (what a host and a service send)
+/** `POST <issuer>/hosts/<hostId>/resource-tokens` as a host sends it (§3). */
+export async function requestToken(double, host, resource, cnf, assertion = double.hostAssertion(host)) {
+    const form = new URLSearchParams({ client_assertion_type: JWT_BEARER, client_assertion: assertion, resource });
+    if (cnf !== undefined)
+        form.set("cnf_jwk", typeof cnf === "string" ? cnf : JSON.stringify(cnf));
+    const response = await fetch(`${double.origin}/hosts/${encodeURIComponent(host.id)}/resource-tokens`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: form,
+    });
+    return { status: response.status, body: (await response.json()), cacheControl: response.headers.get("cache-control") };
+}
+/** `POST <issuer>/resource/accounts/events` as a service sends it (§10). */
+export async function requestEvents(double, assertion, cursor) {
+    const form = new URLSearchParams({ client_assertion_type: JWT_BEARER, client_assertion: assertion });
+    if (cursor !== undefined)
+        form.set("cursor", cursor);
+    const response = await fetch(`${double.origin}/resource/accounts/events`, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: form,
+    });
+    return { status: response.status, body: (await response.json()), cacheControl: response.headers.get("cache-control") };
+}
+/** A form POST to the double, as a device client sends it (§12.2, §12.4). Each field is sent once unless an array. */
+async function postForm(url, fields) {
+    const form = new URLSearchParams();
+    for (const [name, value] of Object.entries(fields))
+        for (const one of Array.isArray(value) ? value : [value])
+            form.append(name, one);
+    const response = await fetch(url, { method: "POST", headers: { "content-type": "application/x-www-form-urlencoded" }, body: form });
+    return { status: response.status, body: (await response.json()), cacheControl: response.headers.get("cache-control") };
+}
+/** `POST <issuer>/resource/device/code` (§12.2). */
+export function requestDeviceCode(double, fields) {
+    return postForm(`${double.origin}/resource/device/code`, fields);
+}
+/** `POST <issuer>/resource/device/token` (§12.4). */
+export function requestDeviceToken(double, fields) {
+    return postForm(`${double.origin}/resource/device/token`, fields);
+}
+/**
+ * The accessor as Jelly's core plugin offers it on `host` (§6): tokens cached until 60 s before `exp`, single-flight
+ * per resource and bound key (RFC 7638 thumbprint, or none), and a token bound to one key never handed out for
+ * another key or for none. Rejections carry `code` (and, for an unbindable key, `detail: "invalid_cnf_jwk"`).
+ * `install()` puts it on `globalThis[Symbol.for("jelly.identity")]` and returns the undo.
+ */
+export function identityAccessor(double, host) {
+    const cache = new Map();
+    const flights = new Map();
+    const reject = (code, detail) => {
+        throw Object.assign(new Error(`jelly.identity: ${code}${detail ? ` (${detail})` : ""}`), { code, ...(detail ? { detail } : {}) });
+    };
+    const accessor = {
+        mints: 0,
+        resources: () => double.resources.map(({ name, resource, url }) => ({ name, resource, url })),
+        async token(name, options) {
+            if (!host)
+                return reject("not_enrolled");
+            if (options !== undefined) {
+                const keys = Object.keys(options);
+                if (keys.length !== 1 || keys[0] !== "cnf")
+                    return reject("invalid_request");
+                const keysOfCnf = isObject(options.cnf) ? Object.keys(options.cnf).sort().join(",") : "";
+                if (keysOfCnf !== "crv,kty,x")
+                    return reject("invalid_request");
+            }
+            const entry = double.resources.find((r) => r.name === name);
+            if (!entry)
+                return reject("invalid_target");
+            const slot = `${entry.resource} ${options?.cnf ? thumbprint(options.cnf) : "-"}`;
+            const cached = cache.get(slot);
+            if (cached && double.now() < cached.expiresAt - 60_000)
+                return cached;
+            const flying = flights.get(slot);
+            if (flying)
+                return flying;
+            const flight = (async () => {
+                await Promise.resolve();
+                accessor.mints++;
+                const answer = double.mint({ host, resource: entry.resource, ...(options?.cnf ? { cnf: options.cnf } : {}) });
+                if (answer.status !== 200) {
+                    const error = String(answer.body.error);
+                    if (error === "access_denied")
+                        return reject("access_denied");
+                    if (error === "invalid_target")
+                        return reject("invalid_target", answer.body.detail);
+                    if (error === "invalid_client")
+                        return reject("not_enrolled");
+                    return reject("unavailable");
+                }
+                const token = { accessToken: answer.body.access_token, expiresAt: double.now() + TOKEN_TTL_S * 1000 };
+                cache.set(slot, token);
+                return token;
+            })();
+            flights.set(slot, flight);
+            try {
+                return await flight;
+            }
+            finally {
+                flights.delete(slot);
+            }
+        },
+        install() {
+            const symbol = Symbol.for("jelly.identity");
+            const g = globalThis;
+            const had = Object.hasOwn(g, symbol);
+            const previous = g[symbol];
+            g[symbol] = Object.freeze({ resources: accessor.resources, token: accessor.token });
+            return () => {
+                if (had)
+                    g[symbol] = previous;
+                else
+                    delete g[symbol];
+            };
+        },
+    };
+    return accessor;
+}