provared 0.6.0 → 0.8.0

package/spec/provared-format.md

@@ -439,6 +439,39 @@ it MUST also confirm that `issuer.key` is one of them. If it was given
 none, it MUST say that the issuer's key was not compared with a known
 key.
 
+If the checker was given the addresses of the pages at which it expects
+slips to have been signed (`issuerOrigins`), it MUST confirm that
+`issuer.origin` is one of them, written exactly the same, and refuse the
+slip otherwise (`issuer-origin-not-expected`). It MAY say, on a slip it
+accepts, that the address is one the reader named. Each address given
+MUST be in the form section 4.1 requires of `issuer.origin`; what is
+given is otherwise a problem with the whole check (`bad-field`), never
+set aside: an address with a capital letter or a path would match
+nothing, and every slip would then read as signed elsewhere. At most 64
+addresses may be given. An approval (section 17) and a cancellation
+(section 22) are signed with the slip's passkey, and step 4 holds each to
+the slip's `issuer.origin`, so the slip's address is the one compared.
+Where no address was given, nothing is compared and nothing is said.
+
+Why a reader names an address. A passkey signs whatever challenge a page
+under its relying party (`issuer.rpId`) hands it: the browser lets any
+page whose website name is that relying party, or a name under it, ask
+the passkey to sign (W3C Web Authentication Level 3, sections 5.1.3 and
+5.1.4). The challenge for a slip, an approval or a cancellation is a
+fingerprint, which the person cannot read on the device's prompt. So a
+page served under that relying party, or a script running on one, can
+have the passkey sign a record it wrote, by presenting the record's
+fingerprint as an ordinary sign-in challenge: the client data then names
+that page's address, the record written by the same party names the
+same address, and steps 2 to 7 all pass. A passkey used to sign records
+SHOULD therefore be made for a relying party name that serves nothing
+but the signing page (such as `sign.example.org`, never `example.org`),
+the signing page SHOULD show the record before it asks the passkey, and
+a reader who knows where the person signs SHOULD name that address, so
+that a slip signed under the same passkey anywhere else is refused. The
+list of threats (`docs/threat-model.md`, section 3) states what this
+closes and what it does not.
+
 The signature counter in the authenticator data is not used: an offline
 checker keeps no state.
 
@@ -2106,8 +2139,9 @@ can then work out the fingerprint again and match the two records,
 without either side's help. Only an identifier is meant to pick out one
 call. A stub may also name fingerprints of some of what was sent and
 received (the arguments; an HTTP request's method, address and body; an
-answer's status and body); those show that the content matches, not
-that it was the same call.
+answer's status and body; the name of the tool that was called, and its
+result); those show that the content matches, not that it was the same
+call.
 
 So document names (section 5.1) that begin `provared.` are reserved. A
 document name that begins `provared.` and is not in this list MUST be
@@ -2130,9 +2164,33 @@ exactly this text, in UTF-8:
 | `provared.request-id` | An identifier that the agent's side chose and sent with the call, exactly as sent |
 | `provared.event-id` | An identifier that the platform gave for the call, exactly as it gave it |
 | `provared.error` | The error text that the agent's software was given, exactly as given |
-
-An identifier or an error text MUST be one character or more, and
-well-formed Unicode.
+| `provared.tool-name` | The name of the tool, exactly as the agent's software called it: the name the tool server, the framework or the model knows it by, which is not the action name of the slip (several tools may be one action) |
+| `provared.tool-call-id` | The identifier that the model gave the tool call, exactly as the agent's software received it (such as the `id` of a tool call in the model's answer) |
+| `provared.tool-result` | The tool's result, written in the one form of RFC 8785, as the arguments are: the whole value the tool gave back to the agent's software. Never the result itself |
+
+An identifier, an error text or a tool's name MUST be one character or
+more, and well-formed Unicode. A result that cannot be written in the
+one form of RFC 8785 (a value that is not JSON, text that is not
+well-formed Unicode, a whole number that form cannot write exactly) has
+no fingerprint,
+and the stub then names no result; whoever writes the stub MAY say so
+under `provared.error`.
+
+**The tool's name, the model's identifier and the result.** These three
+names were added after version 0.6.0 of the libraries. A stub's `action`
+is a name from the slip's own vocabulary; `provared.tool-name` binds the
+stub to the tool that was called under it, which is the name that the
+tool server's or the framework's own log shows. `provared.tool-call-id`
+binds the stub to the model's request for the call: the identifier that
+the model's provider wrote into its answer, and so into the record of
+the conversation that the provider or the agent's software keeps. It is
+the model's identifier, not the platform's (`provared.event-id`) and not
+one the agent's side chose and sent (`provared.request-id`): where the
+agent's software calls the tool twice for one request of the model (a
+retry), two stubs name one identifier. `provared.tool-result` binds the
+stub to what came back, as `provared.arguments` binds it to what was
+asked; an investigator who holds the result can work the fingerprint out
+again. Each of the three MUST appear at most once in a record.
 
 **How a request or an answer is written.** As the signature base of RFC
 9421 (HTTP Message Signatures), section 2.5, with no signature
@@ -2187,21 +2245,33 @@ with the body `{"hello": "world"}` is written as these four lines:
   identifier shows that the two records speak of one call, not that the
   call did what either says.
 - Only `provared.trace-id`, `provared.request-id` and `provared.event-id`
-  are meant to pick out one call. `provared.arguments`,
-  `provared.http-request`, `provared.http-response` and `provared.error`
-  show only that the content matches: identical requests, and identical
-  answers (many a `200` with the body `{}`), share one fingerprint, so a
-  match with one of them does not show that it was the same call.
-- A fingerprint of an identifier, or of arguments, that is short or easy
-  to guess can be guessed: it hides nothing from someone who can try
-  the likely values.
+  are meant to pick out one call; `provared.tool-call-id` picks out one
+  request of the model, which may be carried out more than once.
+  `provared.arguments`, `provared.http-request`,
+  `provared.http-response`, `provared.error`, `provared.tool-name` and
+  `provared.tool-result` show only that the content matches: identical
+  requests, and identical answers (many a `200` with the body `{}`, many
+  a result `"ok"`), share one fingerprint, and every call of one tool
+  shares its name's fingerprint, so a match with one of them does not
+  show that it was the same call.
+- A fingerprint of an identifier, of arguments, of a tool's name or of a
+  result that is short or easy to guess can be guessed: it hides nothing
+  from someone who can try the likely values. A tool's name is the most
+  guessable (a reader tries the names of the framework's or the server's
+  tools), and a short result (`"ok"`, `{}`, `true`) is little better; so
+  "never the result itself" keeps the result out of the record, and does
+  not hide it.
 - A checker cannot see whether a fingerprint was made from the text this
   section names: only someone who holds that text can work it out again.
 - Records written before this section was added may use names that
-  begin `provared.` that are not in the list, or name one of the four
+  begin `provared.` that are not in the list, or name one of the
   once-only names twice; such records are refused, so a book that holds
   one no longer passes its check. A checker that does not know this
-  section reads a reserved name as a label.
+  section reads a reserved name as a label. A checker that knows the
+  first seven names only (versions 0.5.0 and 0.6.0 of the libraries)
+  refuses a record that names `provared.tool-name`,
+  `provared.tool-call-id` or `provared.tool-result`, as it refuses any
+  name it does not know.
 
 ## 28. The denial
 
@@ -2233,7 +2303,7 @@ Content:
 | `rule` | A rule of the software around the agent, outside the slip. |
 
 The format's own list of finding codes, from which `codes` is drawn, is
-every code a checker or the check before acting gives: `not-json`, `bad-envelope`, `bad-base64url`, `too-large`, `unknown-type`, `bad-signatures-layout`, `payload-not-canonical`, `payload-type-mismatch`, `bad-field`, `bad-key`, `signature-invalid`, `passkey-wrong-type`, `passkey-challenge-mismatch`, `passkey-origin-mismatch`, `passkey-rpid-mismatch`, `passkey-user-not-present`, `passkey-user-not-verified`, `passkey-bad-data`, `issuer-not-expected`, `slip-missing`, `slip-unusable`, `chain-broken`, `time-went-backwards`, `duplicate-id`, `duplicate-slip`, `countersignature-invalid`, `countersignature-wrong-stub`, `countersignature-not-possible`, `line-not-canonical`, `unknown-entry`, `approval-mismatch`, `approval-reused`, `approval-invalid`, `approval-not-found`, `approval-dated-after-stub`, `terms-not-found`, `terms-unusable`, `terms-mismatch`, `pass-missing`, `pass-mismatch`, `pass-too-deep`, `cover-invalid`, `cancellation-invalid`, `cancellation-not-found`, `acknowledgement-mismatch`, `vouching-missing`, `seal-mismatch`, `seal-chain-broken`, `sealer-not-expected`, `book-cut-short`, `seal-not-in-book`, `witness-invalid`, `dated-after-stamp`, `stamp-bad-data`, `stamp-wrong-data`, `stamp-invalid`, `headers-invalid`, `record-not-sound`, `proof-invalid`, `root-mismatch`, `check-failed`, `action-not-allowed`, `party-not-allowed`, `outside-valid-time`, `amount-missing`, `over-limit`, `over-each-limit`, `over-count-limit`, `over-period-limit`, `countersignature-missing`, `approval-missing`, `prohibited`, `pass-not-allowed`, `pass-wider`, `after-cancellation`, `outside-terms`.
+every code a checker or the check before acting gives: `not-json`, `bad-envelope`, `bad-base64url`, `too-large`, `unknown-type`, `bad-signatures-layout`, `payload-not-canonical`, `payload-type-mismatch`, `bad-field`, `bad-key`, `signature-invalid`, `passkey-wrong-type`, `passkey-challenge-mismatch`, `passkey-origin-mismatch`, `passkey-rpid-mismatch`, `passkey-user-not-present`, `passkey-user-not-verified`, `passkey-bad-data`, `issuer-not-expected`, `issuer-origin-not-expected`, `slip-missing`, `slip-unusable`, `chain-broken`, `time-went-backwards`, `duplicate-id`, `duplicate-slip`, `countersignature-invalid`, `countersignature-wrong-stub`, `countersignature-not-possible`, `line-not-canonical`, `unknown-entry`, `approval-mismatch`, `approval-reused`, `approval-invalid`, `approval-not-found`, `approval-dated-after-stub`, `terms-not-found`, `terms-unusable`, `terms-mismatch`, `pass-missing`, `pass-mismatch`, `pass-too-deep`, `cover-invalid`, `cancellation-invalid`, `cancellation-not-found`, `acknowledgement-mismatch`, `vouching-missing`, `seal-mismatch`, `seal-chain-broken`, `sealer-not-expected`, `book-cut-short`, `seal-not-in-book`, `witness-invalid`, `dated-after-stamp`, `stamp-bad-data`, `stamp-wrong-data`, `stamp-invalid`, `headers-invalid`, `record-not-sound`, `proof-invalid`, `root-mismatch`, `check-failed`, `action-not-allowed`, `party-not-allowed`, `outside-valid-time`, `amount-missing`, `over-limit`, `over-each-limit`, `over-count-limit`, `over-period-limit`, `countersignature-missing`, `approval-missing`, `prohibited`, `pass-not-allowed`, `pass-wider`, `after-cancellation`, `outside-terms`.
 A code not on this list MUST be refused (`bad-field`), as MUST `codes`
 where `source` is not `check`, and its absence where it is.
 

package/src/book.js

@@ -23,7 +23,7 @@ import { MAX_WITNESSES, validateWitnessContent } from './witness.js';
 import { requestOf, validateApprovalContent } from './approval.js';
 import { compareWithSlip, newTally, settlePeriods } from './compare.js';
 import { validateRefusalContent, validateTermsContent } from './service.js';
-import { checkPasskeySignature, checkSlip } from './slip.js';
+import { checkOriginsOption, checkPasskeySignature, checkSlip } from './slip.js';
 import { validateCountersignatureContent, validateStubContent } from './stub.js';
 import { checkStamp } from './timestamp.js';
 import { inclusionPath, treeBuilder, treeRoot, verifyInclusion } from './tree.js';
@@ -456,7 +456,7 @@ function forkReader(reader, whole = false) {
 // worked out when it is asked for.
 // The fixed copies made so far. Nothing changes one once it is made.
 const FIXED = new WeakSet();
-const OPTION_NAMES = ['issuerKeys', 'sealKeys', 'stampServices', 'blocks', 'vouchers', 'witnesses', 'disclosures', 'cancellations', 'seals', 'expectedRoot', 'expectedSize', 'withoutMethods'];
+const OPTION_NAMES = ['issuerKeys', 'issuerOrigins', 'sealKeys', 'stampServices', 'blocks', 'vouchers', 'witnesses', 'disclosures', 'cancellations', 'seals', 'expectedRoot', 'expectedSize', 'withoutMethods'];
 
 /**
  * The options of a check, fixed: read once and copied, so that nothing done
@@ -2359,6 +2359,8 @@ function compareTrusted(result, options) {
  * @param {string} text the book
  * @param {object} [options]
  * @param {string[]} [options.issuerKeys] thumbprints of the issuer keys the checker expects
+ * @param {string[]} [options.issuerOrigins] the addresses of the pages at which the checker expects every slip to have been signed,
+ *   each in the form of section 4.1 (https://, a website name in lower case, a port only if needed). At most 64
  * @param {string} [options.expectedRoot] the top fingerprint the checker already trusts
  * @param {number} [options.expectedSize] the number of entries the checker already trusts
  * @param {string[]} [options.stampServices] the certificate fingerprints of the time-stamp services the checker trusts
@@ -2422,6 +2424,7 @@ export function startCarried(options = {}) {
   try {
     lookIntoOptions(options);
     checkBlocksOption(options);
+    checkOriginsOption(options);
     // Every line is read with this option, so one that cannot be read is a
     // problem with the whole check, found before any line is read.
     Array.isArray(options.withoutMethods);
@@ -2644,6 +2647,7 @@ export async function checkShow(show, options = {}) {
     }
     lookIntoOptions(options);
     checkBlocksOption(options);
+    checkOriginsOption(options);
     f.members(show, ['pages', 'root', 'size', 'type'], ['seal'], 'show');
     if (show.type !== 'provared.show.v0') throw f.fail('show.type', 'must be provared.show.v0.');
     f.wholeNumber(show.size, 'show.size');

package/src/check.d.ts

@@ -5,6 +5,7 @@ export {
   checkShow,
   openChecker,
   checkSlip,
+  isPageAddress,
   methodAvailable,
   thumbprint,
   keySetFingerprint,

package/src/check.js

@@ -8,7 +8,7 @@ export { checkBook, checkShow, openChecker, LIMITS } from './book.js';
 export { limitWords, conditionWords, neverWords } from './compare.js';
 export { REFUSAL_REASONS } from './service.js';
 export { DENIAL_SOURCES } from './denial.js';
-export { checkSlip } from './slip.js';
+export { checkSlip, isPageAddress } from './slip.js';
 export { keySetFingerprint } from './seal.js';
 export { blockFingerprint } from './blockstamp.js';
 export { checkHeaderChain, blocksInChain, MIN_BLOCKS_AFTER } from './headers.js';

package/src/denial.js

@@ -26,7 +26,7 @@ export const FINDING_CODES = Object.freeze([
   'not-json', 'bad-envelope', 'bad-base64url', 'too-large', 'unknown-type', 'bad-signatures-layout', 'payload-not-canonical',
   'payload-type-mismatch', 'bad-field', 'bad-key', 'signature-invalid', 'passkey-wrong-type', 'passkey-challenge-mismatch',
   'passkey-origin-mismatch', 'passkey-rpid-mismatch', 'passkey-user-not-present', 'passkey-user-not-verified', 'passkey-bad-data',
-  'issuer-not-expected', 'slip-missing', 'slip-unusable', 'chain-broken', 'time-went-backwards', 'duplicate-id', 'duplicate-slip',
+  'issuer-not-expected', 'issuer-origin-not-expected', 'slip-missing', 'slip-unusable', 'chain-broken', 'time-went-backwards', 'duplicate-id', 'duplicate-slip',
   'countersignature-invalid', 'countersignature-wrong-stub', 'countersignature-not-possible', 'line-not-canonical', 'unknown-entry',
   'approval-mismatch', 'approval-reused', 'approval-invalid', 'approval-not-found', 'approval-dated-after-stub', 'terms-not-found',
   'terms-unusable', 'terms-mismatch', 'pass-missing', 'pass-mismatch', 'pass-too-deep', 'cover-invalid', 'cancellation-invalid',

package/src/der.js

@@ -130,6 +130,7 @@ export function timeOf(bytes, element) {
     m = /^(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)Z$/.exec(text);
     if (m) m[1] = (Number(m[1]) < 50 ? '20' : '19') + m[1];
   } else if (element.tag === TAG.GENERALIZED_TIME) {
+    // eslint-disable-next-line security/detect-unsafe-regex -- no repetition inside repetition can match the same text two ways (fixed-length digits and one bounded fraction), so matching takes time in proportion to the input.
     m = /^(\d{4})(\d\d)(\d\d)(\d\d)(\d\d)(\d\d)(?:\.(\d{1,9}))?Z$/.exec(text);
     // DER allows no trailing zero in the fraction.
     if (m && m[7] && m[7].endsWith('0')) m = null;

package/src/documents.js

@@ -6,8 +6,8 @@
 // are reserved: each one on the list below says exactly which text its
 // fingerprint is made from, so that an investigator who holds that text
 // (the call's arguments, the HTTP request, the identifier a platform's own
-// log shows for the call) can work the fingerprint out again and match
-// the stub to it, without either side's help.
+// log shows for the call, the tool's name and result) can work the
+// fingerprint out again and match the stub to it, without either side's help.
 
 import { Refusal, fingerprint, sha256, toBase64url, utf8 } from './encoding.js';
 
@@ -23,6 +23,9 @@ export const DOCUMENT_NAMES = Object.freeze({
   'provared.request-id': "An identifier that the agent's side chose and sent with the call, exactly as sent.",
   'provared.event-id': 'An identifier that the platform gave for the call, exactly as it gave it.',
   'provared.error': "The error text that the agent's software was given, exactly as given.",
+  'provared.tool-name': "The name of the tool, exactly as the agent's software called it.",
+  'provared.tool-call-id': "The identifier that the model gave the tool call, exactly as the agent's software received it.",
+  'provared.tool-result': "The tool's result, written in the one form of RFC 8785.",
 });
 
 /**
@@ -135,7 +138,9 @@ export async function httpResponseFingerprint(r) {
 /**
  * The fingerprint of an identifier or of an error text, exactly as given:
  * SHA-256 of its UTF-8 bytes. For "provared.trace-id", "provared.request-id",
- * "provared.event-id" and "provared.error".
+ * "provared.event-id", "provared.error", "provared.tool-name" and
+ * "provared.tool-call-id". A tool's result ("provared.tool-result") is
+ * fingerprinted as the arguments are, with argumentsFingerprint.
  * @param {string} id
  * @returns {Promise<string>}
  * @throws {Refusal} "bad-field" if it is not text, is empty, or is not well-formed Unicode

package/src/passkey-browser.d.ts

@@ -17,4 +17,6 @@ export function signSlipWithPasskey(fields: Omit<SlipFields, 'issuer'>, passkey:
 export function approveWithPasskey(request: Request & { slip: Fingerprint; when?: number | Date }, passkey: StoredPasskey): Promise<SignedRecord>;
 export function cancelWithPasskey(request: { slip: Fingerprint; when?: number | Date; id?: Base64url }, passkey: StoredPasskey): Promise<SignedRecord>;
 /** Sign the challenge of anything prepared for a passkey; hand the result to the matching assemble function. */
-export function signChallengeWithPasskey(challenge: Uint8Array, passkey: StoredPasskey): Promise<Assertion>;
+export function signChallengeWithPasskey(challenge: Uint8Array, passkey: StoredPasskey): Promise<Assertion & { credentialId: string }>;
+/** Sign a challenge with a passkey the person chooses from those the device holds for the website; check the answer against the key you expect before relying on it. */
+export function signChallengeWithChosenPasskey(challenge: Uint8Array, rpId: string): Promise<Assertion & { credentialId: string }>;

package/src/passkey-browser.js

@@ -87,15 +87,24 @@ export async function createPasskey({ name, site }) {
 }
 
 // Ask the passkey to sign a challenge: the device asks the person first.
-async function signedBy(passkey, challenge, refused) {
+// Only where the caller asks for it ("choose"), and names no identifier (a
+// passkey this browser has forgotten), the device offers every passkey it
+// holds for the website and the person chooses; the answer then says which
+// was chosen, and the caller must check it against the key it expects
+// before it relies on it. Everywhere else a passkey with no identifier is
+// refused, so that no caller is offered a choice it did not ask for.
+async function signedBy(passkey, challenge, refused, { choose = false } = {}) {
   const container = credentials();
+  if (!choose && (!passkey || typeof passkey.credentialId !== 'string' || !passkey.credentialId)) {
+    throw new PasskeyError('cancelled', 'No passkey was named, so nothing was signed.');
+  }
   let assertion;
   try {
     assertion = await container.get({
       publicKey: {
         challenge,
         rpId: passkey.rpId,
-        allowCredentials: [{ type: 'public-key', id: fromBase64url(passkey.credentialId) }],
+        ...(!choose ? { allowCredentials: [{ type: 'public-key', id: fromBase64url(passkey.credentialId) }] } : {}),
         userVerification: 'required',
       },
     });
@@ -107,6 +116,7 @@ async function signedBy(passkey, challenge, refused) {
     authenticatorData: new Uint8Array(r.authenticatorData),
     clientDataJSON: new Uint8Array(r.clientDataJSON),
     signature: new Uint8Array(r.signature),
+    credentialId: toBase64url(new Uint8Array(assertion.rawId)),
   };
 }
 
@@ -169,3 +179,22 @@ export async function signChallengeWithPasskey(challenge, passkey) {
   credentials();
   return signedBy(passkey, challenge, 'Nothing was signed. The request was cancelled or the device refused it.');
 }
+
+/**
+ * Sign a challenge with a passkey the person chooses, where this browser
+ * has forgotten which passkey it should ask (a passkey made on another
+ * device, or this browser's storage cleared). The device offers every
+ * passkey it holds for the website, and the person chooses one; nothing
+ * new is made. What comes back names the passkey chosen by its identifier,
+ * but not its public key: the caller must put the answer into the record
+ * and check it with the library's checker against the key it expects, and
+ * only then remember the identifier beside that key.
+ *
+ * @param {Uint8Array} challenge the "challenge" of what was prepared
+ * @param {string} rpId the website the passkey belongs to (this page's hostname)
+ * @returns {Promise<{authenticatorData: Uint8Array, clientDataJSON: Uint8Array, signature: Uint8Array, credentialId: string}>}
+ */
+export async function signChallengeWithChosenPasskey(challenge, rpId) {
+  credentials();
+  return signedBy({ rpId }, challenge, 'Nothing was signed. The request was cancelled, or this device holds no passkey for this website.', { choose: true });
+}

package/src/signatures.js

@@ -181,7 +181,12 @@ const signerShape = (alg) =>
 function writtenSlhKey(item, where) {
   let made;
   try {
-    made = nodeCrypto.createPrivateKey(item);
+    // A Web Crypto CryptoKey of another method is refused here, without
+    // handing it to Node.js: createPrivateKey would turn it into a KeyObject
+    // of that method, refused below all the same, but handing it a CryptoKey
+    // is deprecated (DEP0203) and prints a warning.
+    if (typeof globalThis.CryptoKey === 'function' && item instanceof globalThis.CryptoKey && item.algorithm.name !== SLH) made = null;
+    else made = nodeCrypto.createPrivateKey(item);
   } catch {
     made = null; // not a private key Node.js can read, or no Node.js here
   }

package/src/slip.js

@@ -22,21 +22,52 @@ const MAX_PERIOD_SECONDS = 366 * 86400;
 // begins or ends with a hyphen, and the last is not all digits. A browser
 // writes a page's address in exactly this form, with a name in another
 // script written in its "xn--" form, which the rule takes as it is.
+// eslint-disable-next-line security/detect-unsafe-regex -- each part has a bounded length, and a full stop or colon separates the parts.
 const ORIGIN = /^(https|http):\/\/([a-z0-9.-]{1,253})(?::([1-9][0-9]{0,4}))?$/;
+// eslint-disable-next-line security/detect-unsafe-regex -- a label has at most 63 characters.
 const LABEL = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
 
+// The scheme and the host of a text in the form above, or null where the
+// text is not in that form.
+function pageAddressParts(text) {
+  if (typeof text !== 'string') return null;
+  const m = ORIGIN.exec(text);
+  if (!m) return null;
+  const labels = m[2].split('.');
+  const port = m[3] !== undefined ? Number(m[3]) : null;
+  if (!labels.every((l) => LABEL.test(l)) || /^[0-9]+$/.test(labels[labels.length - 1]) || (port !== null && (port > 65535 || port === (m[1] === 'https' ? 443 : 80)))) {
+    return null;
+  }
+  return { scheme: m[1], host: m[2] };
+}
+
+/**
+ * Whether a text is the address of a page in the one form the format
+ * allows for a slip's "issuer.origin" (format description, section 4.1):
+ * "https://" (or "http://localhost"), a website name in lower case, a port
+ * only where it is needed, and nothing more. The addresses a reader names
+ * as the ones a permission must have been signed at (the option
+ * "issuerOrigins") must be in this form too, so that an address with a
+ * capital letter or a path is refused, and does not quietly match nothing.
+ * @param {unknown} text
+ * @returns {boolean}
+ */
+export function isPageAddress(text) {
+  const parts = pageAddressParts(text);
+  return parts !== null && (parts.scheme === 'https' || (parts.scheme === 'http' && parts.host === 'localhost'));
+}
+
 function checkOrigin(origin, rpId) {
   f.text(origin, 1, 300, 'issuer.origin');
+  // eslint-disable-next-line security/detect-unsafe-regex -- a name has at most 253 characters.
   if (typeof rpId !== 'string' || !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/.test(rpId)) {
     throw f.fail('issuer.rpId', 'must be a website name in lower case, such as example.org.');
   }
-  const m = ORIGIN.exec(origin);
-  const labels = m ? m[2].split('.') : [];
-  const port = m && m[3] !== undefined ? Number(m[3]) : null;
-  if (!m || !labels.every((l) => LABEL.test(l)) || /^[0-9]+$/.test(labels[labels.length - 1]) || (port !== null && (port > 65535 || port === (m[1] === 'https' ? 443 : 80)))) {
+  const parts = pageAddressParts(origin);
+  if (parts === null) {
     throw f.fail('issuer.origin', 'must be the address of a page: https://, a website name in lower case, a port only if it is needed, and nothing more, such as https://sign.example.org.');
   }
-  const [, scheme, host] = m;
+  const { scheme, host } = parts;
   if (!(scheme === 'https' || (scheme === 'http' && host === 'localhost'))) {
     throw f.fail('issuer.origin', 'must begin https://, or http://localhost.');
   }
@@ -48,6 +79,29 @@ function checkOrigin(origin, rpId) {
 /** Not part of the public interface: for the shared test files. */
 export const checkOriginForTests = checkOrigin;
 
+/** The most addresses a reader may name as the ones a permission must have been signed at. */
+export const MAX_ISSUER_ORIGINS = 64;
+
+/**
+ * The addresses a reader names as the ones a permission must have been
+ * signed at (the option "issuerOrigins"; format description, section 4.4):
+ * a list of at most 64, each in the form isPageAddress accepts. Anything
+ * else is refused, never set aside: an address with a capital letter or a
+ * path would match nothing, and every permission would then read as signed
+ * elsewhere. Every place in the list is read by its number, a gap included.
+ * @param {object} options the checker's options
+ * @throws {Refusal} "bad-field"
+ */
+export function checkOriginsOption(options) {
+  const { issuerOrigins } = options;
+  if (issuerOrigins === undefined) return;
+  let sound = Array.isArray(issuerOrigins) && issuerOrigins.length <= MAX_ISSUER_ORIGINS;
+  for (let i = 0; sound && i < issuerOrigins.length; i++) sound = isPageAddress(issuerOrigins[i]);
+  if (!sound) {
+    throw f.fail('issuerOrigins', 'must be a list of at most 64 page addresses, each https://, a website name in lower case, a port only if it is needed, and nothing more, such as https://sign.example.org.');
+  }
+}
+
 /**
  * Confirm a list of limits against the actions it may name (format
  * description, section 4.1). A slip and a pass share it.
@@ -279,6 +333,7 @@ export async function preparePasskeyRecord(kind, content) {
  * @param {any} record the slip as a JavaScript object
  * @param {object} [options]
  * @param {string[]} [options.issuerKeys] thumbprints of the issuer keys the checker expects
+ * @param {string[]} [options.issuerOrigins] the addresses of the pages at which the checker expects the slip to have been signed, each in the form of section 4.1 (see isPageAddress)
  * @param {string[]} [options.withoutMethods] see verifySignature
  * @param {Record<string, string[]>} [options.disclosures] for covered fields: the disclosures handed over, by the fingerprint of the record they belong to
  * @param {string[]} [disclosures] the disclosures for this slip, where they come with it (a page of a Show)
@@ -349,6 +404,18 @@ export async function checkSlip(record, options = {}, disclosures) {
     } else {
       result.notes.push('The issuer\'s key was not compared with a key you already trust. The name on the slip is only a label.');
     }
+
+    // The address the slip was signed at, compared with the ones the reader
+    // named, where they named any (section 4.4). An approval and a
+    // cancellation are signed with the same passkey, and the passkey check
+    // holds each to the slip's address, so the slip's is the one compared.
+    if (options.issuerOrigins !== undefined) {
+      checkOriginsOption(options);
+      let named = false;
+      for (let i = 0; i < options.issuerOrigins.length; i++) if (options.issuerOrigins[i] === issuer.origin) named = true;
+      if (!named) throw new Refusal('issuer-origin-not-expected', 'The slip was signed at a page address other than the ones expected.');
+      result.notes.push(`This slip was signed at ${issuer.origin}, an address you named.`);
+    }
   } catch (e) {
     result.problems.push(problemFrom(e));
   }

package/src/types.d.ts

@@ -420,6 +420,13 @@ export interface CheckResult {
 export interface CheckOptions {
   /** The thumbprints of the issuer keys the checker expects. */
   issuerKeys?: string[];
+  /**
+   * The addresses of the pages at which the checker expects every slip to
+   * have been signed, each in the form of the format description's section
+   * 4.1 (https://, a website name in lower case, a port only if needed). At
+   * most 64. A slip signed at any other address is refused.
+   */
+  issuerOrigins?: string[];
   /** The key set fingerprints of the recorders the checker expects. */
   sealKeys?: Fingerprint[];
   /** The certificate fingerprints of the time-stamp services the checker trusts. */
@@ -481,7 +488,13 @@ export interface Checker {
 /** The options are fixed when the checker is opened. The book so far may be empty. */
 export function openChecker(text?: string, options?: CheckOptions): Promise<Checker>;
 export function checkShow(show: Show | string, options?: CheckOptions): Promise<CheckResult>;
-export function checkSlip(record: SignedRecord, options?: Pick<CheckOptions, 'issuerKeys' | 'withoutMethods' | 'disclosures'>, disclosures?: string[]): Promise<SlipCheck>;
+export function checkSlip(record: SignedRecord, options?: Pick<CheckOptions, 'issuerKeys' | 'issuerOrigins' | 'withoutMethods' | 'disclosures'>, disclosures?: string[]): Promise<SlipCheck>;
+/**
+ * Whether a text is the address of a page in the one form the format allows for a slip's "issuer.origin" (format
+ * description, section 4.1), which is also the form each address in "issuerOrigins" must have: https:// (or
+ * http://localhost), a website name in lower case, a port only where it is needed, and nothing more.
+ */
+export function isPageAddress(text: unknown): boolean;
 export function methodAvailable(alg: string): Promise<boolean>;
 export function thumbprint(key: PublicKey): Promise<string>;
 export function keySetFingerprint(keys: KeySet | SealKeySet): Promise<Fingerprint>;
@@ -915,7 +928,7 @@ export const DOCUMENT_NAMES: Readonly<Record<string, string>>;
 export function httpRequestFingerprint(r: { method: string; url: string; body?: Uint8Array }): Promise<Fingerprint>;
 /** For "provared.http-response": the status code, and the body's bytes where there is a body. */
 export function httpResponseFingerprint(r: { status: number; body?: Uint8Array }): Promise<Fingerprint>;
-/** For "provared.trace-id", "provared.request-id", "provared.event-id" and "provared.error": SHA-256 of the text's UTF-8 bytes, exactly as given. */
+/** For "provared.trace-id", "provared.request-id", "provared.event-id", "provared.error", "provared.tool-name" and "provared.tool-call-id": SHA-256 of the text's UTF-8 bytes, exactly as given. A tool's result ("provared.tool-result") is fingerprinted with argumentsFingerprint. */
 export function identifierFingerprint(id: string): Promise<Fingerprint>;
 export const ACTION_KINDS: Record<string, string>;
 export const SHARED_ACTIONS: Record<string, [kind: string, meaning: string]>;