provared 0.1.0 → 0.3.0

package/docs/threat-model.md

@@ -568,6 +568,18 @@ person checking gives.
   not fail, only the one certificate it names is tried, and an RSA key
   must have a small public number, so that a small file cannot cost much
   work.
+- **A key under which anyone can sign.** An RSA key with the public
+  number 1 lets anyone make a signature that checks. Such a key, and one
+  with an even public number, is refused, even in a certificate the
+  person named as trusted. So is an Ed25519 key of small order, there and
+  in every record (a passkey, an agent, a service, a recorder, an
+  organisation): libraries differ in whether they accept signatures under
+  such a key, so the checker refuses the key itself. For the same reason
+  it refuses an Ed25519 signature whose point R is of small order, under
+  any key: the key's own holder could make one for any message, which one
+  library accepts and another refuses. The key in a
+  certificate must be written exactly as its standard sets out, so that
+  two checkers cannot disagree about whether it can be read.
 
 **Knowing that a block is part of the chain.** The person checking can
 name the blocks they trust, or hand the checker a chain of block headers

package/package.json

@@ -1,13 +1,32 @@
 {
   "name": "provared",
-  "version": "0.1.0",
-  "description": "Proof of what an AI agent was allowed to do, and what it then did. Evidence, not a verdict.",
+  "version": "0.3.0",
+  "description": "Proof of what an AI agent was allowed to do, and what it then did. A passkey-signed permission with limits a machine can check, a signed receipt for each action, and a free checker. Evidence, not a verdict.",
   "author": "Pavel Izmaylov",
   "license": "Apache-2.0 AND CC-BY-4.0",
+  "homepage": "https://prova.red",
+  "bugs": "https://github.com/provared/provared/issues",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/provared/provared.git"
   },
+  "keywords": [
+    "ai-agent",
+    "agent",
+    "audit-trail",
+    "permission",
+    "authorization",
+    "receipt",
+    "tamper-evident",
+    "passkey",
+    "webauthn",
+    "jws",
+    "ed25519",
+    "ml-dsa",
+    "post-quantum",
+    "evidence",
+    "langchain"
+  ],
   "files": [
     "src/",
     "bin/",
@@ -38,6 +57,10 @@
       "types": "./src/passkey-browser.d.ts",
       "default": "./src/passkey-browser.js"
     },
+    "./dev": {
+      "types": "./src/dev.d.ts",
+      "default": "./src/dev.js"
+    },
     "./package.json": "./package.json"
   },
   "bin": {

package/spec/provared-format.md

@@ -197,6 +197,15 @@ one of these shapes, with no other member:
 | Issuer's passkey | `{"alg":"RS256","e":"AQAB","kty":"RSA","n":"…"}` (RFC 7518, section 6.3; `n` is 2,048 to 8,192 bits) |
 | Issuer's passkey | `{"alg":"Ed25519","crv":"Ed25519","kty":"OKP","x":"…"}` |
 
+An Ed25519 key, wherever it stands, MUST NOT be one of the eight points
+of small order, under which anyone can make a signature that checks, and
+the number y it holds MUST be less than p = 2^255 - 19, so that it is
+written in only one way. RFC 8032 does not say to refuse such keys, and
+libraries differ in whether they do; a checker refuses them itself
+(`bad-key`), so that two checkers cannot disagree. For the same reason,
+an Ed25519 signature whose first 32 bytes (the point R) are such a point,
+or hold a y not less than p, is invalid, whatever the key.
+
 A key is named for people by its **thumbprint**: the JSON Web Key
 Thumbprint with SHA-256 (RFC 7638; for ML-DSA keys, RFC 9964 section 6).
 
@@ -262,7 +271,15 @@ is the address of the page the slip was signed on, for example
 `https://sign.example.org`. The host in `origin` MUST be `rpId` or end
 with a full stop and `rpId`. `origin` MUST use `https`, or be
 `http://localhost` with or without a port number. It holds nothing after
-the host and the port.
+the host and the port. It is written exactly as a browser writes a
+page's address, so that a checker needs no reader of web addresses and
+no tables of Unicode: the scheme, `://`, the host, and a port only where
+it is not the scheme's own (443 for `https`, 80 for `http`), written in
+digits with no leading zero, from 1 to 65535. The host is one or more
+labels, separated by full stops, each of 1 to 63 lower-case letters,
+digits and hyphens, neither beginning nor ending with a hyphen; the last
+label is not all digits. A name in another script stands in its `xn--`
+form, which the rule takes as it is.
 
 A **name** is text of 1 to 200 characters. It is a label chosen by
 whoever wrote the slip. It is not checked against anything, unless a
@@ -1002,7 +1019,13 @@ otherwise report a problem:
    does not otherwise use: a whole number or an object identifier that is
    not in its shortest form, a part that does not fill what holds it, or a
    part the standards do not allow in that place, is refused. The signed
-   data is of version 3, with exactly one signer.
+   data is of version 3, with exactly one signer. The public key in the
+   certificate that signed is written exactly as its own standard sets
+   out, with no unused bits: RSA as RFC 3279, section 2.3.1 (the
+   parameters present and NULL, two positive whole numbers in strict DER
+   and nothing after them), ECDSA as RFC 5480, section 2.2 (an
+   uncompressed point), Ed25519 as RFC 8410, section 4 (no parameters,
+   32 bytes).
 2. What it stamps is this seal's fingerprint (`stamp-wrong-data`).
 3. Its signed attributes name a time-stamp statement, hold the
    fingerprint of the statement, and name the certificate that signed, by
@@ -1015,8 +1038,14 @@ otherwise report a problem:
    signer names (RFC 5652, section 5.4): SHA-256, SHA-384 or SHA-512. A
    signing method that names another one is refused (`stamp-invalid`).
    The signing methods are RSA (PKCS #1 version 1.5; keys of 2,048 to
-   8,192 bits, with a public number of at most 32 bits), ECDSA on the
-   curves P-256 and P-384, and Ed25519.
+   8,192 bits, with an odd public number from 3 to 2^32 - 1: never 1,
+   under which anyone can make a signature that checks), ECDSA on the
+   curves P-256 and P-384, and Ed25519 (not a key of small order, as
+   section 3.8 sets out). A key of any other kind, or on another curve,
+   is refused (`stamp-invalid`). The checker does not try to find out
+   whether an RSA modulus can be factored: a service's key is the
+   service's business, and a checker trusts a service only by the
+   fingerprint of its certificate.
 5. The time it states lies within the time that certificate is in force
    (`stamp-invalid`).
 6. It does not say that its time is exact to no better than more than 300

package/src/compare.js

@@ -63,10 +63,13 @@ function periodWords(seconds) {
 
 const allowedIn = (limit) => BigInt(Object.hasOwn(limit, 'count') ? limit.count : limit.max);
 
-function overPeriod(limit, total, W) {
+// "proposed": an action that is only proposed (a check before acting), of
+// which no stub exists yet.
+function overPeriod(limit, total, W, proposed = false) {
+  const [With, are, is] = proposed ? ['With this action', 'there would be', 'would be'] : ['With this stub', 'there are', 'is'];
   const message = Object.hasOwn(limit, 'count')
-    ? `With this stub there are ${total} such actions in ${periodWords(limit.per)}. ${W} allows ${limit.count}.`
-    : `With this stub the total in ${periodWords(limit.per)} is ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}.`;
+    ? `${With} ${are} ${total} such actions in ${periodWords(limit.per)}. ${W} allows ${limit.count}.`
+    : `${With} the total in ${periodWords(limit.per)} ${is} ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}.`;
   return { code: 'over-period-limit', message };
 }
 
@@ -175,7 +178,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
       return;
     }
     const worst = periodWith(items, when, limit.per * 1000, value);
-    if (worst > allowedIn(limit)) breaches.push(overPeriod(limit, worst, W));
+    if (worst > allowedIn(limit)) breaches.push(overPeriod(limit, worst, W, true));
   };
 
   if (!s.actions.includes(c.action)) {
@@ -209,7 +212,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
   const amountIn = (unit) => {
     if (c.amount && c.amount.unit === unit) return true;
     if (!missing) {
-      breaches.push({ code: 'amount-missing', message: `${W} sets a limit or a condition in "${unit}" for this action, and the stub gives no amount in that unit.` });
+      breaches.push({ code: 'amount-missing', message: `${W} sets a limit or a condition in "${unit}" for this action, and the ${commit ? 'stub' : 'action'} gives no amount in that unit.` });
       missing = true;
     }
     return false;
@@ -225,7 +228,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
         const n = (tally.counts.get(i) ?? 0) + 1;
         if (commit) tally.counts.set(i, n);
         if (n > limit.count) {
-          breaches.push({ code: 'over-count-limit', message: `This is action number ${n} of this kind under ${w}. ${W} allows ${limit.count}.` });
+          breaches.push({ code: 'over-count-limit', message: `${commit ? 'This is' : 'This would be'} action number ${n} of this kind under ${w}. ${W} allows ${limit.count}.` });
         }
       } else {
         inPeriod(i, limit, 1n);
@@ -246,7 +249,7 @@ export function compareWithSlip(s, tally, c, facts, commit = true) {
         if (total > BigInt(limit.max)) {
           breaches.push({
             code: 'over-limit',
-            message: `With this stub the total is ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}: over by ${total - BigInt(limit.max)}.`,
+            message: `${commit ? 'With this stub the total is' : 'With this action the total would be'} ${total} ${limit.unit}. ${W}'s limit is ${limit.max} ${limit.unit}: over by ${total - BigInt(limit.max)}.`,
           });
         }
       } else if (value > BigInt(limit.max)) {

package/src/dev.d.ts

@@ -0,0 +1,54 @@
+// Type declarations for "provared/dev": a development stand-in for a
+// passkey. It is not a passkey, and no person confirms anything through
+// it. Every slip it signs carries " (development)" in its issuer's name.
+
+import type { Assertion, KeySet, Limit, Recorder, CheckOptions, Es256Key, Fingerprint, SignedRecord, SlipFields } from './types.js';
+
+/** The words every development slip carries in its issuer's name: "(development)". */
+export const DEVELOPMENT_MARK: string;
+
+export interface DevelopmentPasskey {
+  key: Es256Key;
+  rpId: 'localhost';
+  origin: 'http://localhost';
+  /** The three values a passkey returns, for a challenge from prepareSlip, prepareApproval or prepareCancellation. */
+  sign(challenge: Uint8Array): Promise<Assertion>;
+}
+
+/** A development stand-in for a passkey (ES256), signing for http://localhost. */
+export function developmentPasskey(): Promise<DevelopmentPasskey>;
+
+export interface DevelopmentSlip {
+  slip: SignedRecord;
+  slipFingerprint: Fingerprint;
+  /** A book holding the slip alone: what openRecorder takes. */
+  book: string;
+  /** The thumbprint of the stand-in passkey, to hand to a checker as the passkey you trust. */
+  issuerKeys: string[];
+  agent: { keys: KeySet; privateKeys: CryptoKey[] };
+  passkey: DevelopmentPasskey;
+}
+
+/**
+ * The members of a development slip: as for prepareSlip, except that the
+ * issuer's key and page address, and the agent's keys, are filled in.
+ */
+export type DevelopmentSlipFields = Omit<SlipFields, 'issuer' | 'agent' | 'validFrom' | 'validUntil' | 'purpose' | 'with' | 'limits'> & {
+  issuer?: { name?: string };
+  agent?: { name?: string; software?: SlipFields['agent']['software'] };
+  /** Defaults to an empty list. */
+  limits?: Limit[];
+  validFrom?: string;
+  validUntil?: string;
+  purpose?: string;
+  with?: SlipFields['with'];
+};
+
+/** A slip signed with a development stand-in for a passkey, with new keys for the agent. */
+export function developmentSlip(fields: DevelopmentSlipFields): Promise<DevelopmentSlip>;
+
+/** The stub writer opened under a development slip, in one call. */
+export function developmentRecorder(
+  fields: DevelopmentSlipFields,
+  more?: { options?: CheckOptions; now?: () => number; countersignWithin?: number },
+): Promise<Omit<DevelopmentSlip, 'book'> & { recorder: Recorder }>;

package/src/dev.js

@@ -0,0 +1,123 @@
+// A development stand-in for a passkey, and a stub writer opened under a
+// slip it signed: for trying the library in an evening, and for tests.
+//
+// It is NOT a passkey. Its private key is an ordinary key made in this
+// process's memory, and no person confirmed anything. It returns the same
+// three values a passkey returns (the authenticator data, the client data,
+// the signature), in the forms the W3C Web Authentication standard sets
+// out, so that every record it signs passes the checker exactly as a real
+// one would. To keep such a record from being mistaken for a person's, the
+// name of the issuer in every slip it signs ends with " (development)",
+// and the checker prints that name beside the slip.
+//
+// A real slip is signed by the person, in a browser, with a real passkey:
+// see passkey-browser.js and the checking page. Nothing in this file is
+// part of the library's checker, and nothing here reaches the network.
+
+import { concatBytes, fingerprint, formatTime, fromBase64url, sha256, toBase64url, utf8 } from './encoding.js';
+import { thumbprint } from './keys.js';
+import { openRecorder } from './recorder.js';
+import { generateKeySet } from './signatures.js';
+import { assembleSlip, prepareSlip } from './slip.js';
+import { writeBook } from './book.js';
+
+const subtle = globalThis.crypto.subtle;
+
+/** The words every development slip carries in its issuer's name. */
+export const DEVELOPMENT_MARK = '(development)';
+
+// Two numbers of 32 bytes each, side by side, to the ASN.1 DER form a
+// passkey returns for an ECDSA signature.
+function ecdsaRawToDer(raw) {
+  const part = (bytes) => {
+    let start = 0;
+    while (start < bytes.length - 1 && bytes[start] === 0) start++;
+    let digits = bytes.subarray(start);
+    if (digits[0] & 0x80) digits = concatBytes(new Uint8Array([0]), digits);
+    return concatBytes(new Uint8Array([0x02, digits.length]), digits);
+  };
+  const body = concatBytes(part(raw.subarray(0, 32)), part(raw.subarray(32)));
+  return concatBytes(new Uint8Array([0x30, body.length]), body);
+}
+
+/**
+ * A development stand-in for a passkey (ES256, the method most passkeys
+ * use). It signs on this computer, for the page address http://localhost,
+ * which the format allows for development only.
+ *
+ * @returns {Promise<{key: object, rpId: string, origin: string, sign: (challenge: Uint8Array) => Promise<{authenticatorData: Uint8Array, clientDataJSON: Uint8Array, signature: Uint8Array}>}>}
+ */
+export async function developmentPasskey() {
+  const rpId = 'localhost';
+  const origin = 'http://localhost';
+  const pair = await subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);
+  const j = await subtle.exportKey('jwk', pair.publicKey);
+  const key = { alg: 'ES256', crv: 'P-256', kty: 'EC', x: j.x, y: j.y };
+  return {
+    key,
+    rpId,
+    origin,
+    async sign(challenge) {
+      const clientDataJSON = utf8(JSON.stringify({ type: 'webauthn.get', challenge: toBase64url(challenge), origin, crossOrigin: false }));
+      // Flags 0x05: "user present" and "user verified". Nobody was: this is a stand-in.
+      const authenticatorData = concatBytes(await sha256(utf8(rpId)), new Uint8Array([0x05, 0, 0, 0, 1]));
+      const signed = concatBytes(authenticatorData, await sha256(clientDataJSON));
+      const signature = ecdsaRawToDer(new Uint8Array(await subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, pair.privateKey, signed)));
+      return { authenticatorData, clientDataJSON, signature };
+    },
+  };
+}
+
+// The issuer's name always ends with the development mark, whatever name is given.
+function markedName(name) {
+  const given = typeof name === 'string' && name.trim() ? name.trim() : 'Development passkey';
+  return given.endsWith(DEVELOPMENT_MARK) ? given : `${given} ${DEVELOPMENT_MARK}`;
+}
+
+/**
+ * A slip signed with a development stand-in for a passkey, and new keys for
+ * the agent. Give the slip's actions, limits, conditions and the rest as for
+ * prepareSlip; "issuer" and "agent.keys" are filled in, and the issuer's
+ * name is made to end with " (development)". By default the slip runs from
+ * a minute ago for one day, and its purpose says that it is for development.
+ *
+ * @param {object} fields the members of the slip; "actions" is required
+ * @returns {Promise<{slip: object, slipFingerprint: string, book: string, issuerKeys: string[], agent: {keys: object[], privateKeys: CryptoKey[]}, passkey: object}>}
+ */
+export async function developmentSlip(fields = {}) {
+  if (!fields || typeof fields !== 'object' || Array.isArray(fields)) throw new TypeError('developmentSlip: give the members of the slip as an object, with at least "actions".');
+  const passkey = await developmentPasskey();
+  const agent = await generateKeySet();
+  const now = Date.now();
+  const issuer = fields.issuer && typeof fields.issuer === 'object' ? fields.issuer : {};
+  const agentGiven = fields.agent && typeof fields.agent === 'object' ? fields.agent : {};
+  const prepared = await prepareSlip({
+    validFrom: formatTime(now - 60 * 1000),
+    validUntil: formatTime(now + 24 * 3600 * 1000),
+    purpose: 'For development: a record made with a stand-in for a passkey, which no person signed.',
+    limits: [],
+    with: [],
+    ...fields,
+    issuer: { name: markedName(issuer.name), key: passkey.key, rpId: passkey.rpId, origin: passkey.origin },
+    agent: { name: typeof agentGiven.name === 'string' ? agentGiven.name : 'Development agent', ...agentGiven, keys: agent.keys },
+  });
+  const slip = assembleSlip(prepared, await passkey.sign(prepared.challenge));
+  const slipFingerprint = await fingerprint(fromBase64url(slip.payload));
+  return { slip, slipFingerprint, book: writeBook([{ slip }]), issuerKeys: [await thumbprint(passkey.key)], agent, passkey };
+}
+
+/**
+ * The stub writer, opened under a development slip, in one call: the
+ * shortest way to a first record. The same as developmentSlip followed by
+ * openRecorder; "more" is passed to openRecorder (options, now,
+ * countersignWithin).
+ *
+ * @param {object} fields the members of the slip; "actions" is required
+ * @param {object} [more]
+ * @returns {Promise<{recorder: object, slip: object, slipFingerprint: string, issuerKeys: string[], agent: {keys: object[], privateKeys: CryptoKey[]}, passkey: object}>}
+ */
+export async function developmentRecorder(fields = {}, more = {}) {
+  const made = await developmentSlip(fields);
+  const recorder = await openRecorder({ book: made.book, slip: made.slipFingerprint, privateKeys: made.agent.privateKeys, issuerKeys: made.issuerKeys, ...more });
+  return { recorder, slip: made.slip, slipFingerprint: made.slipFingerprint, issuerKeys: made.issuerKeys, agent: made.agent, passkey: made.passkey };
+}

package/src/encoding.js

@@ -275,8 +275,16 @@ export function parseTime(text) {
   return formatTime(ms) === text ? ms : NaN;
 }
 
-/** @param {number|Date} when @returns {string} */
+/**
+ * A time, written in the one accepted form. Only a number of milliseconds
+ * or a Date is read: text, true or a list would be read by rules that
+ * differ from one device to another (text with no time zone is taken as
+ * local time), so they are refused.
+ * @param {number|Date} when
+ * @returns {string}
+ */
 export function formatTime(when) {
+  if (typeof when !== 'number' && !(when instanceof Date)) throw new RangeError('Invalid time value');
   return new Date(when).toISOString().slice(0, 19) + 'Z';
 }
 

package/src/keys.js

@@ -25,6 +25,27 @@ const SHAPES = {
   RS256: ['alg', 'e', 'kty', 'n'],
 };
 
+// The Ed25519 public keys under which anyone can make a signature that
+// checks: the eight points of small order. RFC 8032 does not say to refuse
+// them, and libraries differ, so a checker refuses them itself, with any
+// key whose number y is not below p (written in more than one way), so
+// that two checkers cannot disagree.
+const P = 2n ** 255n - 19n;
+const ORDER_8_Y = 0x7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7n;
+const SMALL_ORDER_Y = new Set([0n, 1n, P - 1n, ORDER_8_Y, P - ORDER_8_Y]);
+
+/**
+ * Whether 32 bytes are an Ed25519 public key under which anyone can sign,
+ * or one written in more than one way.
+ * @param {Uint8Array} bytes
+ * @returns {boolean}
+ */
+export function weakEd25519(bytes) {
+  let y = 0n;
+  for (let i = 31; i >= 0; i--) y = (y << 8n) | BigInt(i === 31 ? bytes[i] & 0x7f : bytes[i]);
+  return y >= P || SMALL_ORDER_Y.has(y);
+}
+
 function bad(where, why) {
   return new Refusal('bad-key', `${where}: ${why}`);
 }
@@ -60,7 +81,9 @@ export function checkKey(jwk, allowed, where) {
   }
   if (alg === 'Ed25519') {
     if (jwk.kty !== 'OKP' || jwk.crv !== 'Ed25519') throw bad(where, 'an Ed25519 key has kty OKP and crv Ed25519.');
-    if (bytesOf(jwk, 'x', where).length !== 32) throw bad(where, 'an Ed25519 public key is 32 bytes.');
+    const x = bytesOf(jwk, 'x', where);
+    if (x.length !== 32) throw bad(where, 'an Ed25519 public key is 32 bytes.');
+    if (weakEd25519(x)) throw bad(where, 'this Ed25519 public key is one under which anyone can sign, and is not accepted.');
   } else if (alg === 'ML-DSA-87') {
     if (jwk.kty !== 'AKP') throw bad(where, 'an ML-DSA-87 key has kty AKP.');
     // FIPS 204, table 2: an ML-DSA-87 public key is 2,592 bytes.

package/src/recorder.js

@@ -68,10 +68,38 @@ function within(promise, ms) {
 
 const notWritten = (why) => new Refusal('record-not-sound', why);
 
+// A time handed in: a number of milliseconds, or a Date. Text, true or a
+// list would be read by rules that differ from one device to another (text
+// with no time zone is taken as local time), so they are refused.
+function timeOf(when) {
+  if (typeof when === 'number') return new Date(when).getTime();
+  if (when instanceof Date) return when.getTime();
+  throw new Refusal('bad-field', 'when: must be a number of milliseconds, or a Date.');
+}
+
+// A copy that nothing else holds, as structuredClone makes one, refused if
+// it nests more than MAX_COPY_DEPTH levels deep: far more than a record
+// holds. structuredClone's own limit depends on how much of the stack is in
+// use, so without this two runs could give two answers. The depth is
+// measured on the copy, so the caller's value is read once.
+function clone(value) {
+  const copy = structuredClone(value);
+  const seen = new Set();
+  const stack = [[copy, 0]];
+  while (stack.length) {
+    const [v, depth] = stack.pop();
+    if (v === null || typeof v !== 'object' || seen.has(v)) continue;
+    seen.add(v);
+    if (depth > MAX_COPY_DEPTH) throw new TypeError('the value nests too deeply');
+    for (const item of Object.values(v)) stack.push([item, depth + 1]);
+  }
+  return copy;
+}
+
 // A copy that nothing else holds.
 function plain(value, what) {
   try {
-    return structuredClone(value);
+    return clone(value);
   } catch {
     throw new Refusal('bad-field', `${what} must be plain data: text, numbers, lists and objects.`);
   }
@@ -373,7 +401,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
     if (more === null || typeof more !== 'object') more = {};
     const call = {
       request: plain(request, 'The request'),
-      when: more.when === undefined || more.when === null ? undefined : new Date(more.when).getTime(),
+      when: more.when === undefined || more.when === null ? undefined : timeOf(more.when),
       terms: more.terms,
       countersign: more.countersign,
       hasApproval: more.approval !== undefined && more.approval !== null,
@@ -381,7 +409,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
     };
     if (call.hasApproval) {
       try {
-        call.approval = structuredClone(more.approval.record);
+        call.approval = clone(more.approval.record);
       } catch {
         call.approval = undefined; // not a record: refused when the stub is written
       }
@@ -479,7 +507,7 @@ export async function openRecorder({ book, slip, privateKeys, issuerKeys, pass,
         // What it hands back is copied at once. The copy is what is checked, and what joins the stub.
         let kept;
         try {
-          kept = structuredClone(given);
+          kept = clone(given);
         } catch {
           throw new Refusal('countersignature-invalid', 'What the other side handed back is not a signed record.');
         }

package/src/signatures.js

@@ -13,7 +13,7 @@
 // this file still loads in a browser. In a browser the method is reported as
 // not built in, which is never a pass.
 
-import { importPublicKey } from './keys.js';
+import { importPublicKey, weakEd25519 } from './keys.js';
 
 const SLH = 'SLH-DSA-SHA2-256s';
 const nodeCrypto = globalThis.process && typeof globalThis.process.getBuiltinModule === 'function' ? globalThis.process.getBuiltinModule('node:crypto') : null;
@@ -91,6 +91,10 @@ export async function verifySignature(jwk, signature, data, without = []) {
   if (!Object.hasOwn(VERIFY_PARAMS, jwk.alg)) return 'invalid';
   const params = VERIFY_PARAMS[jwk.alg];
   if (without.includes(jwk.alg) || !(await methodAvailable(jwk.alg))) return 'unavailable';
+  // An Ed25519 signature whose first half is a point of small order is
+  // refused here, whatever the device's own library would say: libraries
+  // differ on it (format description, section 3.8).
+  if (jwk.alg === 'Ed25519' && (signature.length !== 64 || weakEd25519(signature.subarray(0, 32)))) return 'invalid';
   try {
     const key = await importPublicKey(jwk);
     return (await globalThis.crypto.subtle.verify(params, key, signature, data)) ? 'valid' : 'invalid';

package/src/slip.js

@@ -14,28 +14,40 @@ const LIMIT_KINDS = ['count', 'each', 'max'];
 /** The longest period a limit may name: 366 days. */
 const MAX_PERIOD_SECONDS = 366 * 86400;
 
+// The address of the page a slip was signed on, by an exact rule that any
+// checker can follow without a reader of web addresses or tables of
+// Unicode: "https://" (or "http://" for localhost), a host, a port only if
+// it is not the scheme's own, and nothing more. A host is labels of
+// lower-case letters, digits and hyphens, separated by full stops; no label
+// begins or ends with a hyphen, and the last is not all digits. A browser
+// writes a page's address in exactly this form, with a name in another
+// script written in its "xn--" form, which the rule takes as it is.
+const ORIGIN = /^(https|http):\/\/([a-z0-9.-]{1,253})(?::([1-9][0-9]{0,4}))?$/;
+const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+
 function checkOrigin(origin, rpId) {
   f.text(origin, 1, 300, 'issuer.origin');
   if (typeof rpId !== 'string' || !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/.test(rpId)) {
     throw f.fail('issuer.rpId', 'must be a website name in lower case, such as example.org.');
   }
-  let url;
-  try {
-    url = new URL(origin);
-  } catch {
-    throw f.fail('issuer.origin', 'must be the address of a page, such as https://sign.example.org.');
+  const m = ORIGIN.exec(origin);
+  const labels = m ? m[2].split('.') : [];
+  const port = m && m[3] !== undefined ? Number(m[3]) : null;
+  if (!m || !labels.every((l) => LABEL.test(l)) || /^[0-9]+$/.test(labels[labels.length - 1]) || (port !== null && (port > 65535 || port === (m[1] === 'https' ? 443 : 80)))) {
+    throw f.fail('issuer.origin', 'must be the address of a page: https://, a website name in lower case, a port only if it is needed, and nothing more, such as https://sign.example.org.');
   }
-  // url.origin has no path and no default port, so this also refuses
-  // anything after the host.
-  if (url.origin !== origin) throw f.fail('issuer.origin', 'must be a bare address with no path, such as https://sign.example.org.');
-  if (!(url.protocol === 'https:' || (url.protocol === 'http:' && url.hostname === 'localhost'))) {
+  const [, scheme, host] = m;
+  if (!(scheme === 'https' || (scheme === 'http' && host === 'localhost'))) {
     throw f.fail('issuer.origin', 'must begin https://, or http://localhost.');
   }
-  if (!(url.hostname === rpId || url.hostname.endsWith('.' + rpId))) {
+  if (!(host === rpId || host.endsWith('.' + rpId))) {
     throw f.fail('issuer.origin', 'must be on the website that issuer.rpId names.');
   }
 }
 
+/** Not part of the public interface: for the shared test files. */
+export const checkOriginForTests = checkOrigin;
+
 /**
  * Confirm a list of limits against the actions it may name (format
  * description, section 4.1). A slip and a pass share it.
@@ -324,7 +336,8 @@ export async function checkSlip(record, options = {}, disclosures) {
     result.issuerKey = await thumbprint(issuer.key);
 
     result.signature.state = 'invalid';
-    result.signature.state = await checkPasskeySignature(parsed, issuer, options.withoutMethods);
+    // As everywhere else, only a list counts as a list of methods to treat as not built in.
+    result.signature.state = await checkPasskeySignature(parsed, issuer, Array.isArray(options.withoutMethods) ? options.withoutMethods : []);
     if (result.signature.state === 'unavailable') {
       result.notes.push(`This device cannot check the passkey's signing method (${issuer.key.alg}).`);
     }