provared 0.1.0 → 0.2.0

package/CHANGELOG.md

@@ -1,8 +1,212 @@
 # Changelog
 
-## Unreleased
+## 0.2.0 (8 October 2026)
 
-Draft version 0 of the format. Nothing is published or frozen.
+- 2026-10-08: version 0.2.0, for the npm package and, for the first
+  time, the Python package `provared` on the Python Package Index. Both
+  give the same answers, as the shared test files in `test-vectors/`
+  show. The version rises from 0.1.0 because the format's rules changed:
+  the exact rule for a page address in a slip, weak Ed25519 keys and
+  signatures refused, and strict keys in a time-stamp service's
+  certificate. Version 0.1.0 accepts a forged time-stamp where the
+  person checking names as trusted a service whose certificate has an RSA
+  public number of 1; 0.2.0 refuses it. The entries below say what
+  changed.
+- 2026-10-08: fixes from an independent review of `record_function`, the
+  examples and the wording for a proposed action. None made a book read
+  as intact, or within its slip, when it was not.
+  - Python: a whole number in a tool's arguments that JavaScript cannot
+    hold exactly (beyond 2^53 - 1, unless a float holds it exactly) is
+    refused. Before, `2**60 + 1` and `2**60` left the same fingerprint in
+    their stubs, though the tool was handed the exact number. JSON is now
+    read as JavaScript reads it here too: a whole number beyond 2^53 - 1
+    is the nearest float.
+  - Python: a number of a class built on int or float (an Enum of whole
+    numbers, say) is written as its value, so its fingerprint is that of
+    the same arguments kept as JSON. Before, it was written as its name,
+    which is not JSON.
+  - A generator function is refused as a tool (`recordTools` and
+    `record_tools`) and by `record_function`: calling one does not run
+    its body, so its stub was written for an action not yet taken.
+  - Python: a dict in a tool's arguments whose names are not all text is
+    refused. Before, `{101: 2, "101": 5}` reached the tool as `{"101": 5}`.
+  - Python: `record_function` refuses, when it is handed the function, a
+    parameter whose type can never be plain data (a class of its own,
+    such as a model or a date, a tuple or a set), an object whose
+    `__call__` is defined with `async def`, and a function whose name is
+    not text, each in words of its own. A call whose arguments are not
+    plain data names the argument.
+  - Python: the README and the docstring say that the function is run
+    with a copy of its arguments, and what the record leaves out (an
+    argument bound into a `functools.partial` in place).
+  - The check before acting says "the action gives no amount", not "the
+    stub gives no amount". The shared file `check-before.json` now holds
+    a case for each of the words for a proposed action.
+  - Examples: `offline()` also refuses the other kinds of name look-up,
+    messages sent without a connection, starting another program, a
+    connection made by Python's event loop on Windows (which raises no
+    audit event), and a connection to a port on this computer that the
+    same program does not hold, such as a proxy's. The tests check that
+    nothing was refused while each example ran. Its README says exactly
+    what it refuses.
+- 2026-10-08: examples for three widely used Python agent frameworks, in
+  `python/examples/`, the one folder that names them. Each records an
+  agent's tools with `record_function`, runs the agent with the
+  framework's own stand-in model (no AI service is called; tracing is
+  switched off; any connection outside the program is refused while it
+  runs), and checks the book. Each is tested
+  (`python/examples/test_examples.py`). The library itself still names no
+  product.
+- 2026-10-08: the check before acting speaks of an action that is only
+  proposed: "With this action the total would be 280 GBP", not "With this
+  stub the total is", since no stub exists for an action that is not
+  taken. Likewise for a count and a period. The codes are unchanged; the
+  checker's words for a stub are unchanged.
+- 2026-10-08: the Python version gains `record_function`, which puts one
+  ordinary function behind the stub writer and keeps its name, its
+  parameters and its description, so that an agent framework describes
+  the recorded function to its model as it would the function. Python
+  only: a JavaScript tool takes its arguments as one object. Tested
+  (`python/tests/test_record_function.py`).
+- 2026-10-08: `test-vectors/README.md` says what each shared file holds
+  and what must match: Provared's own libraries give every answer
+  exactly, words included; another implementation needs to match the
+  codes and the shape of each answer. The Python package is made ready
+  for the Python Package Index (version 0.1.0, both licence files); it is
+  not yet published there.
+- 2026-10-08: faults found by a second independent review, of the
+  Python stub writer and of the changes above. In 1,183 random
+  scenarios (about 79,500 steps) played in both languages, and 140 runs
+  with several threads at once, no action was taken after the person's
+  cancellation was handed over, and the writer's view of its book always
+  equalled a whole check. Each fault is fixed and each is now a test
+  (`python/tests/test_review2.py`).
+  - **An Ed25519 signature whose first half (R) is a point of small
+    order is refused**, in both languages, whatever the key. The holder
+    of an honest key could make one for any message; Node.js refused it
+    and the OpenSSL beneath the Python version accepted it, so one
+    record had two answers (format description, section 3.8).
+  - A copy of what the stub writer is handed is refused if it nests more
+    than 64 levels deep, in both languages. Before, the JavaScript
+    library's limit depended on how much of the stack was in use. The
+    depth is measured on the copy, so the caller's value is still read
+    once.
+  - Python: a cancellation handed to `add` beside a member whose name is
+    a number, None or something stranger, or in a read-only mapping, is
+    read, and stops the writer, as in JavaScript. An error from the other
+    side that is not an `Exception` (such as `SystemExit`) leaves a
+    one-sided stub, as any other failure does. `snapshot()` hands back
+    the book and the cancellations the writer holds, read together, so
+    that another thread's call cannot fall between the two. A number too
+    large for a float is no time; options holding objects that cannot be
+    copied are kept as they are, as the JavaScript library keeps them;
+    the record writers take a datetime with a time zone, as the
+    JavaScript ones take a Date.
+- 2026-10-08: faults found by an independent review of the Python
+  version, which also changed the JavaScript library.
+  - **Weak Ed25519 keys are refused.** Under one of the eight Ed25519
+    keys of small order, anyone can make a signature that checks.
+    Node.js refused such signatures; the OpenSSL beneath the Python
+    version accepted them, so with such a key trusted, a slip made by
+    someone holding no private key read as sound there. RFC 8032 does
+    not say to refuse these keys and libraries differ, so now the
+    checker refuses them itself, with any key written in more than one
+    way (y not below p): `bad-key` for a key in a record,
+    `stamp-invalid` for a time-stamp service's key.
+  - **The page address in a slip follows an exact rule.** The checker
+    used the URL Standard's own reader of addresses, which for a name
+    beginning `xn--` rests on tables of Unicode that differ from one
+    version of Node.js to the next, so two checkers could disagree. Now
+    `issuer.origin` must be written as a browser writes it, by a rule
+    that needs no such tables: `https://` (or `http://localhost`), a
+    host of lower-case letters, digits and hyphens in labels, a port
+    only where it is not the scheme's own, and nothing more (format
+    description, section 4.1). Some addresses the URL Standard allows
+    are now refused: underscores and other signs in a host, port 0,
+    addresses of numbers.
+  - A time-stamp service's key of another kind, or on another curve, is
+    refused in words that say so, not as a signature that "does not
+    fit".
+  - A time is read only from a number of milliseconds or a Date. Text,
+    true or a list were read by rules that differ from one device to
+    another (text with no time zone was taken as local time).
+  - `withoutMethods` that is not a list is set aside when a slip is
+    checked, as everywhere else. Before, it made the slip's check fail.
+- 2026-10-08: the Python version gains the stub writer beside an agent
+  (`open_recorder`) and the connector for an agent's tools
+  (`record_tools`, `arguments_fingerprint`, `NotTaken`). So it now does
+  everything the JavaScript library does.
+  - They are ported one to one and give the same answers: two new
+    shared files, `test-vectors/recorder-scenarios.json` (32 scenarios,
+    about 1,000 steps) and `test-vectors/tool-scenarios.json` (8
+    scenarios), each a world of records made beforehand and a list of
+    steps (actions, records, cancellations in every form the writer
+    takes, time-stamps, acknowledgements, a clock that fails, writers
+    opened again, tools called), with the transcript of what happened.
+    The two libraries play each scenario (`test/helpers/scenarios.mjs`
+    and `python/tests/scenarios.py`) and must write the same transcript,
+    down to the words of every message and how many times the clock was
+    read.
+  - In Python every call is an ordinary function. The writer's calls
+    wait for one another across threads. A call to the writer from
+    inside an action it is taking, or from the other side while it
+    countersigns, is refused at once, as in Node.js. The other side is
+    asked in a thread of its own and given 30 seconds, as before. A
+    function handed over that gives a coroutine is refused.
+  - `key_set_from_seeds` and `key_set_seeds`: an agent's keys kept
+    between runs as their two 32-byte seeds.
+  - The Python reading of base64url and the copy of a check's options
+    are faster; they give the same answers (a value shared many times in
+    the options is now copied once, as the JavaScript library copies it).
+  - `test/helpers/world.mjs` can be given the agent's and the service's
+    key sets, so that a scenario can hand the same keys to Python.
+- 2026-10-08: two faults in the check of a time-stamp from a service,
+  found while writing the Python version.
+  - An RSA key with the public number 1 in a service's certificate was
+    accepted. Under it, anyone can make a signature that checks, so a
+    time-stamp could be made without the service's private key. It
+    counted only where the person checking had named that certificate as
+    trusted. An even public number was accepted too. Now the public
+    number must be odd, from 3 to 2^32 - 1 (`stamp-invalid`).
+  - The public key inside a certificate was read loosely: a compressed or
+    "hybrid" point, RSA numbers with needless or missing sign bytes,
+    bytes after the key, any parameters, and unused bits all loaded. Now
+    the key must be written exactly as its own standard sets out
+    (`stamp-bad-data`), as the rest of a time-stamp already must be, so
+    that two checkers cannot disagree about whether it can be read.
+  - Each is a shared test (`test-vectors/stamps-strict-keys.json`).
+- 2026-10-08: shared test files, and the start of a Python version.
+  - `test-vectors/` holds records and values, each with the answer this
+    library gives: the canonical form, base64url, times, keys, a
+    passkey's signature, the envelope of a record, the content of a stub
+    and of a countersignature, page addresses and 170 slips, sound and
+    faulty. `tools/make-vectors.mjs` writes them;
+    `test/vectors.test.mjs` checks that this library still gives every
+    answer. Any other implementation of the format can be tested against
+    them.
+  - `python/` holds a Python version, built in stages against the same
+    files. It is not yet published. It now checks everything the
+    JavaScript library checks: slips, stubs, countersignatures, limits,
+    approvals, refusals and terms, passes, cancellations and
+    acknowledgements, vouching records, seals and their time-stamps,
+    block time-stamps, the tree and its proofs, Shows, the chain of
+    block headers, and the check before acting. It gives the same answer
+    in every one of the 63 shared files, and in 6,091 random books
+    compared on this computer. One difference is stated: "cryptography",
+    the one package it needs, has no SLH-DSA yet, so a seal's third
+    signature is reported as not checked on this device and never as a
+    pass. The stub writer and the connector for an agent's tools are
+    still to come.
+  - A slip whose page address cannot be read, and one whose address is
+    not in its plain form, are now refused with the same words. The code
+    (`bad-field`) is unchanged.
+- 2026-10-07: the README links to the individual Internet-Draft
+  `draft-izmaylov-agent-permission-receipts`, which describes the core of
+  the format.
+
+## 0.1.0 (6 October 2026)
+
+Draft version 0 of the format, published and not frozen.
 
 - 2026-10-05: `provared-headers` is marked as experimental, in the
   README and in what the command prints.

package/README.md

@@ -7,10 +7,15 @@ keys. People decide what it means.
 
 ## Status
 
-**Version 0.1.0, a draft.** Published as it is, by one author in their
+**Version 0.2.0, a draft.** Published as it is, by one author in their
 own time; fixes as time allows. The format may still change, so do not
 rely on a draft record staying checkable.
 
+The core of the format is also written as an individual Internet-Draft
+at the IETF:
+[draft-izmaylov-agent-permission-receipts](https://datatracker.ietf.org/doc/draft-izmaylov-agent-permission-receipts/).
+An Internet-Draft is a working document, not a standard.
+
 ## The four parts
 
 | Part | What it is | In this draft |
@@ -32,12 +37,15 @@ rely on a draft record staying checkable.
 | `page/` | The checking page and the demonstration page |
 | `demo/` | The demonstration: an invented office agent works under a permission and goes outside it four times |
 | `samples/` | A sample record, written once, that the tests keep checking |
-| `tools/` | Two small tools: one wrote the sample record, one writes the checking page as a single file |
+| `tools/` | Three small tools: one wrote the sample record, one writes the checking page as a single file, one writes the shared test files |
 | `test/` | The tests |
+| `test-vectors/` | Shared test files: records and values, each with the answer this library gives. Another implementation of the format can be tested against them |
+| `python/` | The Python version, `pip install provared`, which gives the same answers. See its own [README](python/README.md), and its examples with three agent frameworks in `python/examples/` |
 
 The npm package holds `src/`, `bin/`, `net/`, `spec/`, `docs/`,
-`samples/` and the checking page. The tests, the demonstration and the tools are in the
-repository only.
+`samples/` and the checking page. The tests, the shared test files, the
+demonstration, the tools and the Python version are in the repository
+only.
 
 ## Install
 
@@ -103,10 +111,10 @@ checker and the sample record in one file, copied in unchanged. Open it
 in a browser straight from the disk; it needs no server. The file allows
 itself no request of any kind: its content security policy lets nothing
 be loaded from anywhere. The tool prints the file's SHA-256 fingerprint,
-so that a copy can be compared with it. (Tried on 4 October 2026 in the
+so that a copy can be compared with it. (Tried on 8 October 2026 in the
 three browser builds this repository is tested with.) The file for
-version 0.1.0 is attached to the release on GitHub. Its SHA-256
-fingerprint is `ca4a15f820c9c715907952c2e7577717ffca92d87bcf633cc9a92f6dd5242746`.
+version 0.2.0 is attached to the release on GitHub. Its SHA-256
+fingerprint is `7e142fa119458ce00c5fdd6e1cafc75cb3bb4672624157a0a0ef4624f92812ae`.
 
 **Run the demonstration in a browser.**
 

package/docs/threat-model.md

@@ -568,6 +568,18 @@ person checking gives.
   not fail, only the one certificate it names is tried, and an RSA key
   must have a small public number, so that a small file cannot cost much
   work.
+- **A key under which anyone can sign.** An RSA key with the public
+  number 1 lets anyone make a signature that checks. Such a key, and one
+  with an even public number, is refused, even in a certificate the
+  person named as trusted. So is an Ed25519 key of small order, there and
+  in every record (a passkey, an agent, a service, a recorder, an
+  organisation): libraries differ in whether they accept signatures under
+  such a key, so the checker refuses the key itself. For the same reason
+  it refuses an Ed25519 signature whose point R is of small order, under
+  any key: the key's own holder could make one for any message, which one
+  library accepts and another refuses. The key in a
+  certificate must be written exactly as its standard sets out, so that
+  two checkers cannot disagree about whether it can be read.
 
 **Knowing that a block is part of the chain.** The person checking can
 name the blocks they trust, or hand the checker a chain of block headers

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "provared",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Proof of what an AI agent was allowed to do, and what it then did. Evidence, not a verdict.",
   "author": "Pavel Izmaylov",
   "license": "Apache-2.0 AND CC-BY-4.0",

package/spec/provared-format.md

@@ -197,6 +197,15 @@ one of these shapes, with no other member:
 | Issuer's passkey | `{"alg":"RS256","e":"AQAB","kty":"RSA","n":"…"}` (RFC 7518, section 6.3; `n` is 2,048 to 8,192 bits) |
 | Issuer's passkey | `{"alg":"Ed25519","crv":"Ed25519","kty":"OKP","x":"…"}` |
 
+An Ed25519 key, wherever it stands, MUST NOT be one of the eight points
+of small order, under which anyone can make a signature that checks, and
+the number y it holds MUST be less than p = 2^255 - 19, so that it is
+written in only one way. RFC 8032 does not say to refuse such keys, and
+libraries differ in whether they do; a checker refuses them itself
+(`bad-key`), so that two checkers cannot disagree. For the same reason,
+an Ed25519 signature whose first 32 bytes (the point R) are such a point,
+or hold a y not less than p, is invalid, whatever the key.
+
 A key is named for people by its **thumbprint**: the JSON Web Key
 Thumbprint with SHA-256 (RFC 7638; for ML-DSA keys, RFC 9964 section 6).
 
@@ -262,7 +271,15 @@ is the address of the page the slip was signed on, for example
 `https://sign.example.org`. The host in `origin` MUST be `rpId` or end
 with a full stop and `rpId`. `origin` MUST use `https`, or be
 `http://localhost` with or without a port number. It holds nothing after
-the host and the port.
+the host and the port. It is written exactly as a browser writes a
+page's address, so that a checker needs no reader of web addresses and
+no tables of Unicode: the scheme, `://`, the host, and a port only where
+it is not the scheme's own (443 for `https`, 80 for `http`), written in
+digits with no leading zero, from 1 to 65535. The host is one or more
+labels, separated by full stops, each of 1 to 63 lower-case letters,
+digits and hyphens, neither beginning nor ending with a hyphen; the last
+label is not all digits. A name in another script stands in its `xn--`
+form, which the rule takes as it is.
 
 A **name** is text of 1 to 200 characters. It is a label chosen by
 whoever wrote the slip. It is not checked against anything, unless a
@@ -1002,7 +1019,13 @@ otherwise report a problem:
    does not otherwise use: a whole number or an object identifier that is
    not in its shortest form, a part that does not fill what holds it, or a
    part the standards do not allow in that place, is refused. The signed
-   data is of version 3, with exactly one signer.
+   data is of version 3, with exactly one signer. The public key in the
+   certificate that signed is written exactly as its own standard sets
+   out, with no unused bits: RSA as RFC 3279, section 2.3.1 (the
+   parameters present and NULL, two positive whole numbers in strict DER
+   and nothing after them), ECDSA as RFC 5480, section 2.2 (an
+   uncompressed point), Ed25519 as RFC 8410, section 4 (no parameters,
+   32 bytes).
 2. What it stamps is this seal's fingerprint (`stamp-wrong-data`).
 3. Its signed attributes name a time-stamp statement, hold the
    fingerprint of the statement, and name the certificate that signed, by
@@ -1015,8 +1038,14 @@ otherwise report a problem:
    signer names (RFC 5652, section 5.4): SHA-256, SHA-384 or SHA-512. A
    signing method that names another one is refused (`stamp-invalid`).
    The signing methods are RSA (PKCS #1 version 1.5; keys of 2,048 to
-   8,192 bits, with a public number of at most 32 bits), ECDSA on the
-   curves P-256 and P-384, and Ed25519.
+   8,192 bits, with an odd public number from 3 to 2^32 - 1: never 1,
+   under which anyone can make a signature that checks), ECDSA on the
+   curves P-256 and P-384, and Ed25519 (not a key of small order, as
+   section 3.8 sets out). A key of any other kind, or on another curve,
+   is refused (`stamp-invalid`). The checker does not try to find out
+   whether an RSA modulus can be factored: a service's key is the
+   service's business, and a checker trusts a service only by the
+   fingerprint of its certificate.
 5. The time it states lies within the time that certificate is in force
    (`stamp-invalid`).
 6. It does not say that its time is exact to no better than more than 300

package/src/compare.js

@@ -63,10 +63,13 @@ function periodWords(seconds) {
 
 const allowedIn = (limit) => BigInt(Object.hasOwn(limit, 'count') ? limit.count : limit.max);
 
-function overPeriod(limit, total, W) {
+// "proposed": an action that is only proposed (a check before acting), of
+// which no stub exists yet.
+function overPeriod(limit, total, W, proposed = false) {
+  const [With, are, is] = proposed ? ['With this action', 'there would be', 'would be'] : ['With this stub', 'there are', 'is'];
   const message = Object.hasOwn(limit, 'count')
-    ? `With this stub there are ${total} such actions in ${periodWords(limit.per)}. ${W} allows ${limit.count}.`
-    : `With this stub the total in ${periodWords(limit.per)} is ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}.`;
+    ? `${With} ${are} ${total} such actions in ${periodWords(limit.per)}. ${W} allows ${limit.count}.`
+    : `${With} the total in ${periodWords(limit.per)} ${is} ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}.`;
   return { code: 'over-period-limit', message };
 }
 
@@ -175,7 +178,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
       return;
     }
     const worst = periodWith(items, when, limit.per * 1000, value);
-    if (worst > allowedIn(limit)) breaches.push(overPeriod(limit, worst, W));
+    if (worst > allowedIn(limit)) breaches.push(overPeriod(limit, worst, W, true));
   };
 
   if (!s.actions.includes(c.action)) {
@@ -209,7 +212,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
   const amountIn = (unit) => {
     if (c.amount && c.amount.unit === unit) return true;
     if (!missing) {
-      breaches.push({ code: 'amount-missing', message: `${W} sets a limit or a condition in "${unit}" for this action, and the stub gives no amount in that unit.` });
+      breaches.push({ code: 'amount-missing', message: `${W} sets a limit or a condition in "${unit}" for this action, and the ${commit ? 'stub' : 'action'} gives no amount in that unit.` });
       missing = true;
     }
     return false;
@@ -225,7 +228,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
         const n = (tally.counts.get(i) ?? 0) + 1;
         if (commit) tally.counts.set(i, n);
         if (n > limit.count) {
-          breaches.push({ code: 'over-count-limit', message: `This is action number ${n} of this kind under ${w}. ${W} allows ${limit.count}.` });
+          breaches.push({ code: 'over-count-limit', message: `${commit ? 'This is' : 'This would be'} action number ${n} of this kind under ${w}. ${W} allows ${limit.count}.` });
         }
       } else {
         inPeriod(i, limit, 1n);
@@ -246,7 +249,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
         if (total > BigInt(limit.max)) {
           breaches.push({
             code: 'over-limit',
-            message: `With this stub the total is ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}: over by ${total - BigInt(limit.max)}.`,
+            message: `${commit ? 'With this stub the total is' : 'With this action the total would be'} ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}: over by ${total - BigInt(limit.max)}.`,
           });
         }
       } else if (value > BigInt(limit.max)) {

package/src/encoding.js

@@ -275,8 +275,16 @@ export function parseTime(text) {
   return formatTime(ms) === text ? ms : NaN;
 }
 
-/** @param {number|Date} when @returns {string} */
+/**
+ * A time, written in the one accepted form. Only a number of milliseconds
+ * or a Date is read: text, true or a list would be read by rules that
+ * differ from one device to another (text with no time zone is taken as
+ * local time), so they are refused.
+ * @param {number|Date} when
+ * @returns {string}
+ */
 export function formatTime(when) {
+  if (typeof when !== 'number' && !(when instanceof Date)) throw new RangeError('Invalid time value');
   return new Date(when).toISOString().slice(0, 19) + 'Z';
 }
 

package/src/keys.js

@@ -25,6 +25,27 @@ const SHAPES = {
   RS256: ['alg', 'e', 'kty', 'n'],
 };
 
+// The Ed25519 public keys under which anyone can make a signature that
+// checks: the eight points of small order. RFC 8032 does not say to refuse
+// them, and libraries differ, so a checker refuses them itself, with any
+// key whose number y is not below p (written in more than one way), so
+// that two checkers cannot disagree.
+const P = 2n ** 255n - 19n;
+const ORDER_8_Y = 0x7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7n;
+const SMALL_ORDER_Y = new Set([0n, 1n, P - 1n, ORDER_8_Y, P - ORDER_8_Y]);
+
+/**
+ * Whether 32 bytes are an Ed25519 public key under which anyone can sign,
+ * or one written in more than one way.
+ * @param {Uint8Array} bytes
+ * @returns {boolean}
+ */
+export function weakEd25519(bytes) {
+  let y = 0n;
+  for (let i = 31; i >= 0; i--) y = (y << 8n) | BigInt(i === 31 ? bytes[i] & 0x7f : bytes[i]);
+  return y >= P || SMALL_ORDER_Y.has(y);
+}
+
 function bad(where, why) {
   return new Refusal('bad-key', `${where}: ${why}`);
 }
@@ -60,7 +81,9 @@ export function checkKey(jwk, allowed, where) {
   }
   if (alg === 'Ed25519') {
     if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') throw bad(where, 'an Ed25519 key has kty OKP and crv Ed25519.');
-    if (bytesOf(jwk, 'x', where).length !== 32) throw bad(where, 'an Ed25519 public key is 32 bytes.');
+    const x = bytesOf(jwk, 'x', where);
+    if (x.length !== 32) throw bad(where, 'an Ed25519 public key is 32 bytes.');
+    if (weakEd25519(x)) throw bad(where, 'this Ed25519 public key is one under which anyone can sign, and is not accepted.');
   } else if (alg === 'ML-DSA-87') {
     if (jwk.kty !== 'AKP') throw bad(where, 'an ML-DSA-87 key has kty AKP.');
     // FIPS 204, table 2: an ML-DSA-87 public key is 2,592 bytes.

package/src/recorder.js

@@ -68,10 +68,38 @@ function within(promise, ms) {
 
 const notWritten = (why) => new Refusal('record-not-sound', why);
 
+// A time handed in: a number of milliseconds, or a Date. Text, true or a
+// list would be read by rules that differ from one device to another (text
+// with no time zone is taken as local time), so they are refused.
+function timeOf(when) {
+  if (typeof when === 'number') return new Date(when).getTime();
+  if (when instanceof Date) return when.getTime();
+  throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
+}
+
+// A copy that nothing else holds, as structuredClone makes one, refused if
+// it nests more than MAX_COPY_DEPTH levels deep: far more than a record
+// holds. structuredClone's own limit depends on how much of the stack is in
+// use, so without this two runs could give two answers. The depth is
+// measured on the copy, so the caller's value is read once.
+function clone(value) {
+  const copy = structuredClone(value);
+  const seen = new Set();
+  const stack = [[copy, 0]];
+  while (stack.length) {
+    const [v, depth] = stack.pop();
+    if (v === null || typeof v !== 'object' || seen.has(v)) continue;
+    seen.add(v);
+    if (depth > MAX_COPY_DEPTH) throw new TypeError('the value nests too deeply');
+    for (const item of Object.values(v)) stack.push([item, depth + 1]);
+  }
+  return copy;
+}
+
 // A copy that nothing else holds.
 function plain(value, what) {
   try {
-    return structuredClone(value);
+    return clone(value);
   } catch {
     throw new Refusal('bad-field', `${what} must be plain data: text, numbers, lists and objects.`);
   }
@@ -373,7 +401,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
     if (more === null || typeof more !== 'object') more = {};
     const call = {
       request: plain(request, 'The request'),
-      when: more.when === undefined || more.when === null ? undefined : new Date(more.when).getTime(),
+      when: more.when === undefined || more.when === null ? undefined : timeOf(more.when),
       terms: more.terms,
       countersign: more.countersign,
       hasApproval: more.approval !== undefined && more.approval !== null,
@@ -381,7 +409,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
     };
     if (call.hasApproval) {
       try {
-        call.approval = structuredClone(more.approval.record);
+        call.approval = clone(more.approval.record);
       } catch {
         call.approval = undefined; // not a record: refused when the stub is written
       }
@@ -479,7 +507,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
         // What it hands back is copied at once. The copy is what is checked, and what joins the stub.
         let kept;
         try {
-          kept = structuredClone(given);
+          kept = clone(given);
         } catch {
           throw new Refusal('countersignature-invalid', 'What the other side handed back is not a signed record.');
         }

package/src/signatures.js

@@ -13,7 +13,7 @@
 // this file still loads in a browser. In a browser the method is reported as
 // not built in, which is never a pass.
 
-import { importPublicKey } from './keys.js';
+import { importPublicKey, weakEd25519 } from './keys.js';
 
 const SLH = 'SLH-DSA-SHA2-256s';
 const nodeCrypto = globalThis.process && typeof globalThis.process.getBuiltinModule === 'function' ? globalThis.process.getBuiltinModule('node:crypto') : null;
@@ -91,6 +91,10 @@ export async function verifySignature(jwk, signature, data, without = []) {
   if (!Object.hasOwn(VERIFY_PARAMS, jwk.alg)) return 'invalid';
   const params = VERIFY_PARAMS[jwk.alg];
   if (without.includes(jwk.alg) || !(await methodAvailable(jwk.alg))) return 'unavailable';
+  // An Ed25519 signature whose first half is a point of small order is
+  // refused here, whatever the device's own library would say: libraries
+  // differ on it (format description, section 3.8).
+  if (jwk.alg === 'Ed25519' && (signature.length !== 64 || weakEd25519(signature.subarray(0, 32)))) return 'invalid';
   try {
     const key = await importPublicKey(jwk);
     return (await globalThis.crypto.subtle.verify(params, key, signature, data)) ? 'valid' : 'invalid';

package/src/slip.js

@@ -14,28 +14,40 @@ const LIMIT_KINDS = ['count', 'each', 'max'];
 /** The longest period a limit may name: 366 days. */
 const MAX_PERIOD_SECONDS = 366 * 86400;
 
+// The address of the page a slip was signed on, by an exact rule that any
+// checker can follow without a reader of web addresses or tables of
+// Unicode: "https://" (or "http://" for localhost), a host, a port only if
+// it is not the scheme's own, and nothing more. A host is labels of
+// lower-case letters, digits and hyphens, separated by full stops; no label
+// begins or ends with a hyphen, and the last is not all digits. A browser
+// writes a page's address in exactly this form, with a name in another
+// script written in its "xn--" form, which the rule takes as it is.
+const ORIGIN = /^(https|http):\/\/([a-z0-9.-]{1,253})(?::([1-9][0-9]{0,4}))?$/;
+const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+
 function checkOrigin(origin, rpId) {
   f.text(origin, 1, 300, 'issuer.origin');
   if (typeof rpId !== 'string' || !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/.test(rpId)) {
     throw f.fail('issuer.rpId', 'must be a website name in lower case, such as example.org.');
   }
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    throw f.fail('issuer.origin', 'must be the address of a page, such as https://sign.example.org.');
+  const m = ORIGIN.exec(origin);
+  const labels = m ? m[2].split('.') : [];
+  const port = m && m[3] !== undefined ? Number(m[3]) : null;
+  if (!m || !labels.every((l) => LABEL.test(l)) || /^[0-9]+$/.test(labels[labels.length - 1]) || (port !== null && (port > 65535 || port === (m[1] === 'https' ? 443 : 80)))) {
+    throw f.fail('issuer.origin', 'must be the address of a page: https://, a website name in lower case, a port only if it is needed, and nothing more, such as https://sign.example.org.');
   }
-  // url.origin has no path and no default port, so this also refuses
-  // anything after the host.
-  if (url.origin !== origin) throw f.fail('issuer.origin', 'must be a bare address with no path, such as https://sign.example.org.');
-  if (!(url.protocol === 'https:' || (url.protocol === 'http:' && url.hostname === 'localhost'))) {
+  const [, scheme, host] = m;
+  if (!(scheme === 'https' || (scheme === 'http' && host === 'localhost'))) {
     throw f.fail('issuer.origin', 'must begin https://, or http://localhost.');
   }
-  if (!(url.hostname === rpId || url.hostname.endsWith('.' + rpId))) {
+  if (!(host === rpId || host.endsWith('.' + rpId))) {
     throw f.fail('issuer.origin', 'must be on the website that issuer.rpId names.');
   }
 }
 
+/** Not part of the public interface: for the shared test files. */
+export const checkOriginForTests = checkOrigin;
+
 /**
  * Confirm a list of limits against the actions it may name (format
  * description, section 4.1). A slip and a pass share it.
@@ -324,7 +336,8 @@ export async function checkSlip(record, options = {}, disclosures) {
     result.issuerKey = await thumbprint(issuer.key);
 
     result.signature.state = 'invalid';
-    result.signature.state = await checkPasskeySignature(parsed, issuer, options.withoutMethods);
+    // As everywhere else, only a list counts as a list of methods to treat as not built in.
+    result.signature.state = await checkPasskeySignature(parsed, issuer, Array.isArray(options.withoutMethods) ? options.withoutMethods : []);
     if (result.signature.state === 'unavailable') {
       result.notes.push(`This device cannot check the passkey's signing method (${issuer.key.alg}).`);
     }

package/src/timestamp.js

@@ -11,6 +11,7 @@
 
 import { TAG, badStamp, children, contentOf, ecdsaToRaw, expect, hexOf, readElement, timeOf, validateDer, wholeOf } from './der.js';
 import { Refusal, equalBytes, formatTime, sha256, toBase64url } from './encoding.js';
+import { weakEd25519 } from './keys.js';
 
 /** The largest time-stamp, in bytes. */
 export const MAX_STAMP_BYTES = 12288;
@@ -107,21 +108,53 @@ function readStatement(bytes) {
   return { hash, stamped, time, accuracySeconds, critical };
 }
 
-// The size of an RSA key in a certificate: 2,048 to 8,192 bits, with a
-// small public number, so that checking a signature cannot be made slow.
-function checkRsaKey(bytes, keyBits) {
-  const inner = bytes.subarray(keyBits.start + 1, keyBits.end);
-  const key = expect(readElement(inner, 0), TAG.SEQUENCE, 'an RSA key');
-  const [n, e] = children(inner, key, 2);
-  expect(n, TAG.INTEGER, 'an RSA key');
-  expect(e, TAG.INTEGER, 'an RSA key');
+// The public key of a certificate, written exactly as its standard sets
+// out, so that two checkers cannot disagree about whether it can be read:
+// RSA as RFC 3279 section 2.3.1 sets out (the method's parameters empty,
+// the key two positive whole numbers in strict DER, nothing after them);
+// ECDSA as RFC 5480 section 2.2 (an uncompressed point of the named
+// curve); Ed25519 as RFC 8410 section 4 (no parameters, 32 bytes). In each,
+// the string of bits has no unused bits.
+//
+// An RSA key is 2,048 to 8,192 bits, with an odd public number from 3 to
+// 2^32 - 1: a small number, so that checking a signature cannot be made
+// slow, and never 1, under which anyone can make a signature that checks.
+function checkKeyEncoding(bytes, certificate, method, size) {
+  const why = 'the public key of a certificate is not written as its standard sets out.';
+  const bits = certificate.keyBits;
+  if (bits.end - bits.start < 1 || bytes[bits.start] !== 0) throw badStamp(why);
+  const inner = bytes.subarray(bits.start + 1, bits.end);
+  const parameters = certificate.keyParameters;
+  if (method === 'ECDSA') {
+    if (inner.length !== 1 + 2 * size || inner[0] !== 0x04) throw badStamp(why);
+    return;
+  }
+  if (method === 'Ed25519') {
+    if (parameters !== null || inner.length !== 32) throw badStamp(why);
+    if (weakEd25519(inner)) throw invalid('A time-stamp was signed with an Ed25519 key under which anyone can sign, which is not accepted.');
+    return;
+  }
+  if (parameters === null || parameters.tag !== TAG.NULL) throw badStamp(why);
+  let n;
+  let e;
+  try {
+    const key = readElement(inner, 0);
+    if (key.tag !== TAG.SEQUENCE || key.end !== inner.length) throw new Error();
+    validateDer(inner, key);
+    const parts = children(inner, key, 3);
+    [n, e] = parts;
+    if (parts.length !== 2 || n.tag !== TAG.INTEGER || e.tag !== TAG.INTEGER || inner[n.start] & 0x80 || inner[e.start] & 0x80) throw new Error();
+  } catch {
+    throw badStamp(why);
+  }
   let modulus = contentOf(inner, n);
   if (modulus[0] === 0) modulus = modulus.subarray(1);
-  const bits = modulus.length === 0 ? 0 : (modulus.length - 1) * 8 + (32 - Math.clz32(modulus[0]));
+  const length = modulus.length === 0 ? 0 : (modulus.length - 1) * 8 + (32 - Math.clz32(modulus[0]));
   let exponent = contentOf(inner, e);
   if (exponent[0] === 0) exponent = exponent.subarray(1);
-  if (bits < 2048 || bits > 8192 || exponent.length === 0 || exponent.length > 4) {
-    throw invalid('A time-stamp was signed with an RSA key of a size that is not accepted.');
+  const odd = exponent.length > 0 && (exponent[exponent.length - 1] & 1) === 1;
+  if (length < 2048 || length > 8192 || exponent.length === 0 || exponent.length > 4 || !odd || (exponent.length === 1 && exponent[0] < 3)) {
+    throw invalid('A time-stamp was signed with an RSA key whose size or public number is not accepted.');
   }
 }
 
@@ -148,6 +181,7 @@ function readCertificate(bytes, element) {
     notAfter: timeOf(bytes, validity[1]),
     spki: wholeOf(bytes, keyInfo),
     keyOid: keyAlgorithm.oid,
+    keyParameters: keyAlgorithm.parameters ?? null,
     keyBits: expect(keyParts[1], TAG.BIT_STRING, 'the public key of a certificate'),
     curveOid: keyAlgorithm.parameters && keyAlgorithm.parameters.tag === TAG.OID ? hexOf(bytes, keyAlgorithm.parameters) : null,
   };
@@ -169,11 +203,14 @@ function signingCertificateOf(bytes, value, v2) {
   return { hash, value: contentOf(bytes, expect(first[at], TAG.OCTET_STRING, 'the signing certificate attribute')) };
 }
 
+const KIND_NOT_ACCEPTED = 'A time-stamp was signed with a kind of key that is not accepted: RSA, ECDSA on the curves P-256 and P-384, and Ed25519 are.';
+
 // Check the service's signature with the public key of its certificate.
 // Returns "valid", "invalid", or "unavailable" where this device has no
 // built-in support for the method. The fingerprint method is the one the
 // signer names (RFC 5652 section 5.4); a signing method that names another
-// is refused.
+// is refused; a key of a kind that is not accepted is refused in words that
+// say so.
 async function verifyWith(certificate, bytes, signatureOid, digestName, signature, signed, without) {
   const subtle = globalThis.crypto.subtle;
   let importParams;
@@ -182,13 +219,15 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
   let raw = signature;
   if (certificate.keyOid === OID.rsaEncryption) {
     if (signatureOid !== OID.rsaEncryption && RSA_WITH[signatureOid] !== digestName) return 'invalid';
-    checkRsaKey(bytes, certificate.keyBits);
+    checkKeyEncoding(bytes, certificate, 'RSA');
     method = 'RSA';
     importParams = { name: 'RSASSA-PKCS1-v1_5', hash: digestName };
     verifyParams = { name: 'RSASSA-PKCS1-v1_5' };
   } else if (certificate.keyOid === OID.ecPublicKey) {
     const curve = certificate.curveOid === OID.p256 ? ['P-256', 32] : certificate.curveOid === OID.p384 ? ['P-384', 48] : null;
-    if (ECDSA_WITH[signatureOid] !== digestName || !curve) return 'invalid';
+    if (!curve) throw invalid(KIND_NOT_ACCEPTED);
+    if (ECDSA_WITH[signatureOid] !== digestName) return 'invalid';
+    checkKeyEncoding(bytes, certificate, 'ECDSA', curve[1]);
     method = 'ECDSA';
     importParams = { name: 'ECDSA', namedCurve: curve[0] };
     verifyParams = { name: 'ECDSA', hash: digestName };
@@ -197,12 +236,14 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
     } catch {
       return 'invalid';
     }
-  } else if (certificate.keyOid === OID.ed25519 && signatureOid === OID.ed25519) {
+  } else if (certificate.keyOid === OID.ed25519) {
+    if (signatureOid !== OID.ed25519) return 'invalid';
+    checkKeyEncoding(bytes, certificate, 'Ed25519');
     method = 'Ed25519';
     importParams = { name: 'Ed25519' };
     verifyParams = { name: 'Ed25519' };
   } else {
-    return 'invalid';
+    throw invalid(KIND_NOT_ACCEPTED);
   }
   if (without.includes(method)) return 'unavailable';
   let key;
@@ -212,6 +253,8 @@ async function verifyWith(certificate, bytes, signatureOid, digestName, signatur
     // A device with no Ed25519 says so when the key is loaded.
     return method === 'Ed25519' && e && e.name === 'NotSupportedError' ? 'unavailable' : 'invalid';
   }
+  // An Ed25519 signature whose first half is a point of small order is refused, as everywhere (format description, section 3.8).
+  if (method === 'Ed25519' && (raw.length !== 64 || weakEd25519(raw.subarray(0, 32)))) return 'invalid';
   try {
     return (await subtle.verify(verifyParams, key, raw, signed)) ? 'valid' : 'invalid';
   } catch {

package/src/tools.js

@@ -18,6 +18,11 @@ import * as f from './fields.js';
 /** How deep the arguments of a call may nest. */
 const MAX_ARGUMENT_DEPTH = 64;
 
+// Calling a generator function does not run its body, so its stub would be
+// written for an action not yet taken.
+const GENERATORS = new Set(['[object GeneratorFunction]', '[object AsyncGeneratorFunction]']);
+const NOT_A_GENERATOR = 'must not be a generator function: calling one does not run its body, so its stub would be written for an action not yet taken.';
+
 /**
  * A call through a recorded tool that was not run: the check before acting
  * did not allow it, or the record so far has a problem. "answer" is what
@@ -108,7 +113,7 @@ const needsOnlyApproval = (answer) => answer.problems.length === 0 && answer.bre
  * @param {object} recorder the stub writer (openRecorder)
  * @param {Record<string, object>} tools by name. For each tool:
  *   - "action": the action name the slip uses for what this tool does;
- *   - "run": the tool itself, a function of the arguments. It must not call the stub writer;
+ *   - "run": the tool itself, a function of the arguments, not a generator function. It must not call the stub writer;
  *   Each function is called by itself, without "this". "amount" and "with" must give their value at once, not a promise.
  *   - "with" (optional): the id of the service the tool deals with, as the slip names it, or a function of the arguments that gives it;
  *   - "amount" (optional): {unit, value}, or a function of the arguments that gives it;
@@ -143,6 +148,7 @@ export function recordTools(recorder, tools, options = {}) {
     // Each member is read once: what is checked is what is fixed.
     const fixed = { action: spec.action, run: spec.run, details: spec.details, countersign: spec.countersign, approve: spec.approve, amount: spec.amount, with: spec.with };
     if (typeof fixed.run !== 'function') throw f.fail(`tools.${name}.run`, 'must be a function.');
+    if (GENERATORS.has(Object.prototype.toString.call(fixed.run))) throw f.fail(`tools.${name}.run`, NOT_A_GENERATOR);
     f.actionName(fixed.action, `tools.${name}.action`);
     for (const member of ['countersign', 'approve']) {
       if (fixed[member] !== undefined && typeof fixed[member] !== 'function') throw f.fail(`tools.${name}.${member}`, 'must be a function.');