cloving 1.2.0 → 1.4.0

package/dist/src/relay/decision-envelopes.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+import { operationalDecision } from "../decision-visibility.js";
+import { plaintextBytes, } from "./envelope.js";
+const previewBytes = 2048;
+const fullBytes = 65_535;
+export function promptDigest(prompt) {
+    return `sha256:${createHash("sha256").update(prompt).digest("hex")}`;
+}
+function prefix(text, bytes) {
+    let used = 0;
+    let end = 0;
+    for (const character of text) {
+        const size = Buffer.byteLength(character);
+        if (used + size > bytes)
+            break;
+        used += size;
+        end += character.length;
+    }
+    return text.slice(0, end);
+}
+function fitted(prompt, sizing) {
+    let shown = prompt;
+    let envelope = sizing.build(shown);
+    while (plaintextBytes(envelope) > sizing.limit && shown !== "") {
+        const excess = plaintextBytes(envelope) - sizing.limit;
+        shown = prefix(shown, Buffer.byteLength(shown) - excess);
+        envelope = sizing.build(shown);
+    }
+    return envelope;
+}
+function envelopeOf(source, content) {
+    return { version: 1, ...source.target, ...content };
+}
+export function receiptEnvelope(source) {
+    return {
+        version: 1,
+        ...source.target,
+        kind: "receipt",
+        body: source.receipt,
+    };
+}
+export function closedEnvelope(source) {
+    return {
+        version: 1,
+        ...source.target,
+        kind: "closed",
+        body: source.ending,
+    };
+}
+export function previewEnvelope(source) {
+    const { decision, workflowId } = source;
+    const prompt = String(operationalDecision(decision, workflowId)["prompt"]);
+    return fitted(prompt, {
+        limit: previewBytes,
+        build: (shown) => envelopeOf(source, {
+            kind: "preview",
+            body: {
+                decisionId: decision["decisionId"],
+                label: decision["label"] ?? null,
+                type: decision["type"],
+                workflowId,
+                expiresAt: decision["expiresAt"] ?? null,
+                prompt: shown,
+                truncated: shown.length < prompt.length,
+            },
+        }),
+    });
+}
+export function fullEnvelope(source) {
+    const { decision, workflowId } = source;
+    const prompt = String(decision["prompt"]);
+    return fitted(prompt, {
+        limit: fullBytes,
+        build: (shown) => envelopeOf(source, {
+            kind: "full",
+            body: {
+                decisionId: decision["decisionId"],
+                label: decision["label"] ?? null,
+                type: decision["type"],
+                runId: decision["runId"],
+                workflowId,
+                prompt: shown,
+                allowed: decision["allowed"],
+                revision: decision["revision"],
+                generation: decision["generation"],
+                subjectDigest: decision["subjectDigest"],
+                promptDigest: promptDigest(prompt),
+                expiresAt: decision["expiresAt"] ?? null,
+                truncated: shown.length < prompt.length,
+            },
+        }),
+    });
+}

package/dist/src/relay/decision-watch.d.ts

@@ -0,0 +1,14 @@
+import { type CheckContext } from "./decision-check.ts";
+export interface WatchTiming {
+    readonly pollMilliseconds: number;
+    readonly reconnectMilliseconds: number;
+}
+export declare const watchTiming: WatchTiming;
+export interface WatchContext extends CheckContext {
+    readonly runtimeDirectory: string;
+}
+export interface DecisionWatch {
+    readonly wake: () => void;
+    readonly close: () => Promise<void>;
+}
+export declare function watchDecisions(context: WatchContext, timing: WatchTiming): DecisionWatch;

package/dist/src/relay/decision-watch.js

@@ -0,0 +1,68 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { checkDecisions } from "./decision-check.js";
+import { relayEvents } from "./relay-control.js";
+export const watchTiming = {
+    pollMilliseconds: 60_000,
+    reconnectMilliseconds: 5000,
+};
+const gateEvents = new Set([
+    "gate.opened",
+    "gate.decided",
+    "gate.expired",
+]);
+function pause(milliseconds, signal) {
+    return delay(milliseconds, undefined, { signal }).catch(() => undefined);
+}
+async function followGates(context, stream) {
+    const page = await context.control({
+        operation: "events",
+        parameters: { after: 0, limit: 1 },
+    });
+    const latest = page.kind === "result" ? page.result["latestSequence"] : null;
+    if (typeof latest !== "number")
+        return;
+    stream.wake();
+    await relayEvents(context.runtimeDirectory, {
+        after: latest,
+        onEvent: (event) => {
+            if (gateEvents.has(String(event["type"])))
+                stream.wake();
+        },
+        stopped: stream.stopped,
+    });
+}
+export function watchDecisions(context, timing) {
+    const stop = new AbortController();
+    const stopped = new Promise((settle) => {
+        stop.signal.addEventListener("abort", () => {
+            settle();
+        });
+    });
+    const waking = { controller: new AbortController() };
+    const wake = () => {
+        waking.controller.abort();
+    };
+    const checking = (async () => {
+        while (!stop.signal.aborted) {
+            const current = waking.controller;
+            await checkDecisions(context).catch(() => undefined);
+            await pause(timing.pollMilliseconds, AbortSignal.any([stop.signal, current.signal]));
+            if (current.signal.aborted)
+                waking.controller = new AbortController();
+        }
+    })();
+    const following = (async () => {
+        while (!stop.signal.aborted) {
+            await followGates(context, { wake, stopped }).catch(() => undefined);
+            wake();
+            await pause(timing.reconnectMilliseconds, stop.signal);
+        }
+    })();
+    return {
+        wake,
+        close: async () => {
+            stop.abort();
+            await Promise.all([checking, following]);
+        },
+    };
+}

package/dist/src/relay/envelope-post.d.ts

@@ -0,0 +1,8 @@
+import type { JsonObject } from "solid-objects";
+import type { PostedEnvelope, PostOutcome } from "./phone-delivery.ts";
+export interface PostContext {
+    readonly phoneDirectory: string;
+    readonly now: () => number;
+}
+export declare function envelopesBody(deviceId: string, envelopes: readonly PostedEnvelope[]): Readonly<Record<string, unknown>>;
+export declare function postEnvelopes(context: PostContext, request: JsonObject): Promise<PostOutcome>;

package/dist/src/relay/envelope-post.js

@@ -0,0 +1,71 @@
+import { record } from "../protocol.js";
+import { relayRequest } from "./relay-http.js";
+import { readLink } from "./relay-registration.js";
+const textFields = [
+    "envelopeId",
+    "kind",
+    "ciphertext",
+    "expiresAt",
+    "push",
+];
+function postedEnvelope(value) {
+    const fields = record(value);
+    if (fields === undefined)
+        return undefined;
+    if (!textFields.every((name) => typeof fields[name] === "string"))
+        return undefined;
+    const collapseId = fields["collapseId"] ?? null;
+    if (collapseId !== null && typeof collapseId !== "string")
+        return undefined;
+    return {
+        envelopeId: String(fields["envelopeId"]),
+        kind: String(fields["kind"]),
+        ciphertext: String(fields["ciphertext"]),
+        expiresAt: String(fields["expiresAt"]),
+        push: String(fields["push"]),
+        collapseId,
+    };
+}
+function postedEnvelopes(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const parsed = value.flatMap((item) => {
+        const envelope = postedEnvelope(item);
+        return envelope === undefined ? [] : [envelope];
+    });
+    return parsed.length === value.length ? parsed : undefined;
+}
+export function envelopesBody(deviceId, envelopes) {
+    return {
+        envelopes: envelopes.map((envelope) => ({
+            device_id: deviceId,
+            envelope_id: envelope.envelopeId,
+            kind: envelope.kind,
+            ciphertext: envelope.ciphertext,
+            expires_at: envelope.expiresAt,
+            push: envelope.push,
+            collapse_id: envelope.collapseId,
+        })),
+    };
+}
+export async function postEnvelopes(context, request) {
+    const at = context.now();
+    const deviceId = request["deviceId"];
+    const envelopes = postedEnvelopes(request["envelopes"]);
+    if (typeof deviceId !== "string" || envelopes === undefined)
+        return { at, failure: "relay-request-invalid" };
+    const link = await readLink(context.phoneDirectory).catch(() => undefined);
+    if (link === undefined)
+        return { at, failure: "relay-unregistered" };
+    const reply = await relayRequest(link.origin, {
+        method: "POST",
+        path: "/api/v1/relay/envelopes",
+        token: link.token,
+        body: envelopesBody(deviceId, envelopes),
+    }).catch(() => undefined);
+    if (reply === undefined)
+        return { at, failure: "relay-unreachable" };
+    if (reply.status !== 201)
+        return { at, failure: `relay-status-${String(reply.status)}` };
+    return { at, failure: null };
+}

package/dist/src/relay/envelope.d.ts

@@ -0,0 +1,28 @@
+import type { Fields } from "../protocol.ts";
+import type { DaemonKeys } from "./daemon-keys.ts";
+export type EnvelopeKind = "preview" | "full" | "closed" | "receipt";
+export interface Envelope {
+    readonly version: 1;
+    readonly kind: EnvelopeKind;
+    readonly daemonId: string;
+    readonly deviceId: string;
+    readonly sequence: number;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly body: Fields;
+}
+export declare const relayInfo: Buffer<ArrayBuffer>;
+export declare function envelopeAad(binding: {
+    readonly daemonId: string;
+    readonly deviceId: string;
+    readonly kind: string;
+}): Buffer;
+export declare function collapseId(keys: DaemonKeys, decisionId: string): string;
+export declare function plaintextBytes(envelope: Envelope): number;
+export declare function signedPlaintext(keys: DaemonKeys, envelope: Envelope): Buffer;
+export declare function padPlaintext(plaintext: Buffer): Buffer;
+export declare function unpadPlaintext(padded: Buffer): Buffer;
+export declare function sealEnvelope(keys: DaemonKeys, sealing: {
+    readonly envelope: Envelope;
+    readonly agreementPublicKey: string;
+}): Buffer;

package/dist/src/relay/envelope.js

@@ -0,0 +1,53 @@
+import { createHmac } from "node:crypto";
+import { canonicalJson } from "../phone/canonical-json.js";
+import { sealTo } from "./hpke.js";
+import { signedBy } from "./pairing-checks.js";
+export const relayInfo = Buffer.from("cloving-relay-v1");
+const paddedSizes = [1024, 4096, 16_384, 65_536];
+const marker = 0x80;
+const signatureCharacters = 86;
+export function envelopeAad(binding) {
+    return Buffer.from(`cloving-relay-v1|${binding.daemonId}|${binding.deviceId}|${binding.kind}`);
+}
+export function collapseId(keys, decisionId) {
+    const key = createHmac("sha256", Buffer.from(keys.signingPrivateKey, "base64url"))
+        .update("cloving-collapse-key")
+        .digest();
+    return createHmac("sha256", key)
+        .update(decisionId)
+        .digest()
+        .subarray(0, 16)
+        .toString("base64url");
+}
+export function plaintextBytes(envelope) {
+    return Buffer.byteLength(canonicalJson({
+        payload: canonicalJson(envelope),
+        signature: "A".repeat(signatureCharacters),
+    }));
+}
+export function signedPlaintext(keys, envelope) {
+    return Buffer.from(canonicalJson(signedBy(keys, canonicalJson(envelope))));
+}
+export function padPlaintext(plaintext) {
+    const size = paddedSizes.find((bytes) => plaintext.length < bytes);
+    if (size === undefined)
+        throw new Error(`envelope-too-large: A sealed envelope has at most ${String(paddedSizes.at(-1))} bytes.`);
+    const padded = Buffer.alloc(size);
+    plaintext.copy(padded);
+    padded[plaintext.length] = marker;
+    return padded;
+}
+export function unpadPlaintext(padded) {
+    const end = padded.findLastIndex((byte) => byte !== 0);
+    if (end === -1 || padded[end] !== marker)
+        throw new Error("envelope-padding-invalid: The envelope has no end mark.");
+    return padded.subarray(0, end);
+}
+export function sealEnvelope(keys, sealing) {
+    const { envelope } = sealing;
+    return sealTo(sealing.agreementPublicKey, {
+        info: relayInfo,
+        aad: envelopeAad(envelope),
+        plaintext: padPlaintext(signedPlaintext(keys, envelope)),
+    });
+}

package/dist/src/relay/hpke.d.ts

@@ -0,0 +1,25 @@
+export interface HpkeSchedule {
+    readonly key: Buffer;
+    readonly baseNonce: Buffer;
+}
+export interface SealedMessage {
+    readonly info: Buffer;
+    readonly aad: Buffer;
+}
+export declare function keySchedule(sharedSecret: Buffer, info: Buffer): HpkeSchedule;
+export declare function sealAt(schedule: HpkeSchedule, message: {
+    readonly sequence: number;
+    readonly aad: Buffer;
+    readonly plaintext: Buffer;
+}): Buffer;
+export declare function openAt(schedule: HpkeSchedule, message: {
+    readonly sequence: number;
+    readonly aad: Buffer;
+    readonly ciphertext: Buffer;
+}): Buffer;
+export declare function sealTo(publicKey: string, message: SealedMessage & {
+    readonly plaintext: Buffer;
+}): Buffer;
+export declare function openFrom(privateKey: string, message: SealedMessage & {
+    readonly sealed: Buffer;
+}): Buffer;

package/dist/src/relay/hpke.js

@@ -0,0 +1,108 @@
+import { createCipheriv, createDecipheriv, createHmac, createPrivateKey, decapsulate, encapsulate, } from "node:crypto";
+import { publicKeyObject } from "./pairing-checks.js";
+const suite = Buffer.concat([
+    Buffer.from("HPKE"),
+    Buffer.from([0x00, 0x10, 0x00, 0x01, 0x00, 0x02]),
+]);
+const version = Buffer.from("HPKE-v1");
+const encapsulatedBytes = 65;
+const tagBytes = 16;
+function labeledExtract(salt, input) {
+    return createHmac("sha256", salt.length === 0 ? Buffer.alloc(32) : salt)
+        .update(Buffer.concat([version, suite, Buffer.from(input.label), input.material]))
+        .digest();
+}
+function labeledExpand(secret, input) {
+    const length = Buffer.alloc(2);
+    length.writeUInt16BE(input.length);
+    return createHmac("sha256", secret)
+        .update(Buffer.concat([
+        length,
+        version,
+        suite,
+        Buffer.from(input.label),
+        input.context,
+        Buffer.from([1]),
+    ]))
+        .digest()
+        .subarray(0, input.length);
+}
+export function keySchedule(sharedSecret, info) {
+    const empty = Buffer.alloc(0);
+    const context = Buffer.concat([
+        Buffer.from([0]),
+        labeledExtract(empty, { label: "psk_id_hash", material: empty }),
+        labeledExtract(empty, { label: "info_hash", material: info }),
+    ]);
+    const secret = labeledExtract(sharedSecret, {
+        label: "secret",
+        material: empty,
+    });
+    return {
+        key: labeledExpand(secret, { label: "key", context, length: 32 }),
+        baseNonce: labeledExpand(secret, {
+            label: "base_nonce",
+            context,
+            length: 12,
+        }),
+    };
+}
+function nonce(schedule, sequence) {
+    const value = Buffer.alloc(12);
+    value.writeUIntBE(sequence, 6, 6);
+    for (const [index, byte] of schedule.baseNonce.entries())
+        value.writeUInt8(byte ^ value.readUInt8(index), index);
+    return value;
+}
+export function sealAt(schedule, message) {
+    const cipher = createCipheriv("aes-256-gcm", schedule.key, nonce(schedule, message.sequence));
+    cipher.setAAD(message.aad);
+    return Buffer.concat([
+        cipher.update(message.plaintext),
+        cipher.final(),
+        cipher.getAuthTag(),
+    ]);
+}
+export function openAt(schedule, message) {
+    const { ciphertext } = message;
+    if (ciphertext.length < tagBytes)
+        throw new Error("hpke-open-failed: The sealed text is too short.");
+    const decipher = createDecipheriv("aes-256-gcm", schedule.key, nonce(schedule, message.sequence));
+    decipher.setAAD(message.aad);
+    decipher.setAuthTag(ciphertext.subarray(ciphertext.length - tagBytes));
+    return Buffer.concat([
+        decipher.update(ciphertext.subarray(0, ciphertext.length - tagBytes)),
+        decipher.final(),
+    ]);
+}
+export function sealTo(publicKey, message) {
+    const recipient = publicKeyObject(publicKey);
+    if (recipient === undefined)
+        throw new Error("hpke-seal-failed: The public key is not a P-256 point.");
+    const { sharedKey, ciphertext } = encapsulate(recipient);
+    const schedule = keySchedule(sharedKey, message.info);
+    return Buffer.concat([
+        ciphertext,
+        sealAt(schedule, {
+            sequence: 0,
+            aad: message.aad,
+            plaintext: message.plaintext,
+        }),
+    ]);
+}
+export function openFrom(privateKey, message) {
+    const { sealed } = message;
+    if (sealed.length < encapsulatedBytes + tagBytes)
+        throw new Error("hpke-open-failed: The sealed text is too short.");
+    const key = createPrivateKey({
+        key: Buffer.from(privateKey, "base64url"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const sharedSecret = decapsulate(key, sealed.subarray(0, encapsulatedBytes));
+    return openAt(keySchedule(sharedSecret, message.info), {
+        sequence: 0,
+        aad: message.aad,
+        ciphertext: sealed.subarray(encapsulatedBytes),
+    });
+}

package/dist/src/relay/pairing-checks.d.ts

@@ -0,0 +1,42 @@
+import { type KeyObject } from "node:crypto";
+import type { DaemonKeys } from "./daemon-keys.ts";
+export interface PairingRequest {
+    readonly deviceId: string;
+    readonly name: string;
+    readonly platform: string;
+    readonly agreementPublicKey: string;
+    readonly answerPublicKey: string;
+    readonly approvalPublicKey: string;
+    readonly code: string;
+}
+export type RequestCheck = {
+    readonly kind: "valid";
+    readonly request: PairingRequest;
+} | {
+    readonly kind: "refused";
+    readonly code: string;
+};
+export interface SignedMessage {
+    readonly payload: string;
+    readonly signature: string;
+}
+export declare function publicKeyObject(point: string): KeyObject | undefined;
+export declare function pairingCode(secret: Buffer, canonical: string): string;
+export declare function checkedRequest(secret: Buffer, body: unknown): RequestCheck;
+export declare function signedReceipt(keys: DaemonKeys, values: {
+    readonly daemonId: string;
+    readonly deviceId: string;
+    readonly pairedAt: string;
+}): {
+    readonly receipt: SignedMessage;
+    readonly nonce: string;
+};
+export declare function signedBy(keys: DaemonKeys, payload: string): SignedMessage;
+export interface ExpectedCheck {
+    readonly daemonId: string;
+    readonly deviceId: string;
+    readonly nonce: string;
+    readonly answerPublicKey: string;
+    readonly now: number;
+}
+export declare function checkValid(check: unknown, expected: ExpectedCheck): boolean;

package/dist/src/relay/pairing-checks.js

@@ -0,0 +1,172 @@
+import { createHash, createHmac, createPrivateKey, createPublicKey, randomBytes, sign, timingSafeEqual, verify, } from "node:crypto";
+import { canonicalJson } from "../phone/canonical-json.js";
+const requestFields = [
+    "agreement_public_key",
+    "answer_public_key",
+    "approval_public_key",
+    "device_id",
+    "name",
+    "platform",
+];
+function text(value, name) {
+    const field = typeof value === "object" && value !== null
+        ? Reflect.get(value, name)
+        : undefined;
+    return typeof field === "string" ? field : undefined;
+}
+export function publicKeyObject(point) {
+    const raw = Buffer.from(point, "base64url");
+    if (raw.length !== 65 || raw[0] !== 4 || raw.toString("base64url") !== point)
+        return undefined;
+    try {
+        return createPublicKey({
+            key: {
+                kty: "EC",
+                crv: "P-256",
+                x: raw.subarray(1, 33).toString("base64url"),
+                y: raw.subarray(33).toString("base64url"),
+            },
+            format: "jwk",
+        });
+    }
+    catch {
+        return undefined;
+    }
+}
+function requestFieldsOf(body) {
+    const agreement = text(body, "agreement_public_key");
+    const answer = text(body, "answer_public_key");
+    const approval = text(body, "approval_public_key");
+    const deviceId = text(body, "device_id");
+    const name = text(body, "name");
+    const platform = text(body, "platform");
+    const mac = text(body, "mac");
+    if (agreement === undefined ||
+        answer === undefined ||
+        approval === undefined ||
+        deviceId === undefined ||
+        name === undefined ||
+        platform === undefined ||
+        mac === undefined)
+        return undefined;
+    return {
+        agreement_public_key: agreement,
+        answer_public_key: answer,
+        approval_public_key: approval,
+        device_id: deviceId,
+        name,
+        platform,
+        mac,
+    };
+}
+export function pairingCode(secret, canonical) {
+    const digest = createHash("sha256").update(canonical).digest();
+    const tag = createHmac("sha256", secret)
+        .update("cloving-pair-code|")
+        .update(digest)
+        .digest();
+    const number = BigInt(`0x${tag.toString("hex")}`) % 1000000n;
+    return String(number).padStart(6, "0");
+}
+function macValid(secret, given) {
+    const canonical = canonicalJson(Object.fromEntries(requestFields.map((name) => [name, given[name]])));
+    const expected = createHmac("sha256", secret).update(canonical).digest();
+    const mac = Buffer.from(given.mac, "base64url");
+    const valid = mac.length === expected.length && timingSafeEqual(mac, expected);
+    return valid ? canonical : "";
+}
+function wellFormed(given) {
+    return (/^[A-Za-z0-9_-]{1,64}$/.test(given.device_id) &&
+        Array.from(given.name).length <= 64 &&
+        ["ios", "android"].includes(given.platform));
+}
+export function checkedRequest(secret, body) {
+    const given = requestFieldsOf(body);
+    if (given === undefined)
+        return { kind: "refused", code: "pairing-request-invalid" };
+    const canonical = macValid(secret, given);
+    if (canonical === "")
+        return { kind: "refused", code: "pairing-mac-invalid" };
+    const keys = [
+        given.agreement_public_key,
+        given.answer_public_key,
+        given.approval_public_key,
+    ];
+    if (keys.some((key) => publicKeyObject(key) === undefined))
+        return { kind: "refused", code: "pairing-key-invalid" };
+    if (!wellFormed(given))
+        return { kind: "refused", code: "pairing-request-invalid" };
+    return {
+        kind: "valid",
+        request: {
+            deviceId: given.device_id,
+            name: given.name,
+            platform: given.platform,
+            agreementPublicKey: given.agreement_public_key,
+            answerPublicKey: given.answer_public_key,
+            approvalPublicKey: given.approval_public_key,
+            code: pairingCode(secret, canonical),
+        },
+    };
+}
+export function signedReceipt(keys, values) {
+    const nonce = randomBytes(16).toString("base64url");
+    const payload = canonicalJson({
+        daemonId: values.daemonId,
+        deviceId: values.deviceId,
+        kind: "pairing-receipt",
+        nonce,
+        pairedAt: values.pairedAt,
+        version: 1,
+    });
+    return { receipt: signedBy(keys, payload), nonce };
+}
+export function signedBy(keys, payload) {
+    const key = createPrivateKey({
+        key: Buffer.from(keys.signingPrivateKey, "base64url"),
+        format: "der",
+        type: "pkcs8",
+    });
+    const signature = sign("sha256", Buffer.from(payload), {
+        key,
+        dsaEncoding: "ieee-p1363",
+    });
+    return { payload, signature: signature.toString("base64url") };
+}
+function signatureValid(message, publicKey) {
+    const key = publicKeyObject(publicKey);
+    return (key !== undefined &&
+        verify("sha256", Buffer.from(message.payload), { key, dsaEncoding: "ieee-p1363" }, Buffer.from(message.signature, "base64url")));
+}
+function checkFields(payload) {
+    try {
+        const value = JSON.parse(payload);
+        if (typeof value !== "object" || value === null)
+            return {};
+        return canonicalJson(value) === payload ? { ...value } : {};
+    }
+    catch {
+        return {};
+    }
+}
+export function checkValid(check, expected) {
+    const payload = text(check, "payload");
+    const signature = text(check, "signature");
+    if (payload === undefined || signature === undefined)
+        return false;
+    if (!signatureValid({ payload, signature }, expected.answerPublicKey))
+        return false;
+    const fields = checkFields(payload);
+    const wanted = {
+        daemonId: expected.daemonId,
+        deviceId: expected.deviceId,
+        kind: "pairing-check",
+        nonce: expected.nonce,
+        signedAt: fields["signedAt"],
+        version: 1,
+    };
+    const signedAt = Date.parse(String(fields["signedAt"]));
+    return (typeof fields["signedAt"] === "string" &&
+        canonicalJson(wanted) === payload &&
+        Math.abs(signedAt - expected.now) <= 600_000);
+}