qredential 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 George Veras Valentim
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,307 @@
+# qredential
+
+[![ci](https://github.com/george-veras/qredential/actions/workflows/ci.yml/badge.svg)](https://github.com/george-veras/qredential/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/qredential)](https://www.npmjs.com/package/qredential)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/george-veras/qredential/badge)](https://scorecard.dev/viewer/?uri=github.com/george-veras/qredential)
+
+[English](https://qredential.js.org/) · [Português](https://qredential.js.org/pt/) · [Español](https://qredential.js.org/es/) · [Français](https://qredential.js.org/fr/) · [Deutsch](https://qredential.js.org/de/) · [日本語](https://qredential.js.org/ja/) · [한국어](https://qredential.js.org/ko/) · [简体中文](https://qredential.js.org/zh-Hans/) · [繁體中文](https://qredential.js.org/zh-Hant/)
+
+Verify a digital credential from a QR code with **no network connection**.
+
+```ts
+import { verify } from 'qredential'
+
+const result = await verify(scannedText, { trust })
+// result.ok === true, result.claims.given_name === 'Ana'
+```
+
+No server call. No lookup. No account. The proof travels inside the QR code itself.
+
+---
+
+## Why this exists
+
+I built the eCNH, Brazil's digital driver's licence, used by more than 40 million people. The part
+that taught me the most was not the app. It was the roadside: a police officer scanning a licence on
+a highway with one bar of signal, or none, and needing a yes or no in under a second.
+
+Everything you actually need for that answer can fit in the QR code. The signature proves the
+issuer. The claims are right there. The only thing you need from the outside world is the issuer's
+public key, and that changes so rarely that you can ship it and refresh it once a week.
+
+The libraries for this exist, but they are enterprise SDKs: heavy, tied to one country's profile,
+and documented as if you already work in the identity industry. I wanted the version that a normal
+product engineer can add on a Tuesday.
+
+## Install
+
+```sh
+npm i qredential
+```
+
+Runs on Node 20+, browsers, and React Native. It uses WebCrypto and nothing Node specific, because
+the verifier is usually a phone. The suite runs on Node 20, 22 and 24 across Linux, macOS and
+Windows, and in Chromium, Firefox and WebKit, on every commit.
+
+**One caveat on React Native:** it has no `CompressionStream`. Issuing, presenting and verifying all
+work without it, the envelope just stays uncompressed. Offline revocation does not, because reading
+a status list means inflating a bitstring, so polyfill `DecompressionStream` if you need it. A
+verifier that cannot inflate a cached list refuses rather than treating it as clean. A test runs the
+whole flow with both globals deleted, so this is checked rather than assumed.
+
+## Proving the holder, not just the credential
+
+Selective disclosure proves the issuer signed these claims. On its own it does not prove the person
+presenting them is the subject, and the gap is not theoretical: a photograph of someone else's code
+carries the same signature.
+
+Key binding closes it. The issuer binds the holder's public key; at scan time the wallet signs the
+verifier's fresh challenge with the matching private key. A picture cannot do that.
+
+```ts
+const { credential } = await issue({ ..., holderKey: holderPublicJwk })
+
+const presentation = await present(credential, {
+  disclose: ['over_18'],
+  keyBinding: { key: holderPrivateJwk, audience: 'https://bar.example/door', nonce: challenge },
+})
+
+const result = await verify(scanned, { trust, nonce: challenge, audience: 'https://bar.example/door' })
+result.holderVerified   // true
+```
+
+The proof commits to the nonce (stops replay), the audience (stops reuse at another verifier), the
+bound key, and a hash of the exact disclosure set (stops a relay adding or stripping one). It
+expires after five minutes by default.
+
+**A printed card cannot do this**, and that is a real situation rather than a mistake. Pass
+`acceptWithoutHolderProof: true` to accept one, and the result still reports
+`holderVerified: false`, so the fact never disappears. Without the flag, a presentation with no
+proof is refused: the dangerous case is someone building a door scanner, never hearing of key
+binding, and shipping something a screenshot defeats.
+
+## The 2026 problem it solves
+
+Age verification laws are arriving faster than the tooling. The usual implementation asks the user
+to upload a photo of their ID to a third party, which is a privacy disaster and a breach waiting to
+happen.
+
+Selective disclosure does it properly. The issuer signs every claim once. The holder chooses which
+ones to reveal, and the signature still checks out on what is left:
+
+```ts
+// The credential contains name, address, birth date, document number.
+// The bar only gets to see one thing.
+const presentation = await present(credential, { disclose: ['over_18'] })
+
+const result = await verify(presentation, { trust })
+result.claims          // { over_18: true }
+result.claims.address  // undefined, and it was never transmitted
+```
+
+The verifier cannot learn the birth date even if it wants to. That property is cryptographic, not a
+promise in a privacy policy.
+
+## What is actually inside
+
+Boring, published standards, not an invention of mine:
+
+- **SD-JWT** ([RFC 9901](https://www.rfc-editor.org/rfc/rfc9901.html)) for selective disclosure and
+  key binding, including nested, array element and recursive disclosure, checked against the
+  specification's own test vectors and against an independent implementation
+- **SD-JWT VC** for the credential shape
+- **Token Status List** for revocation that works from a cached copy
+- **base45 plus deflate** for the QR envelope, the same envelope trick the EU covid certificate
+  used, chosen for scanner compatibility rather than for raw density
+
+If you already speak these, `qredential` is a small ergonomic layer over them. If you do not, you
+should not have to learn them to check whether a ticket is real.
+
+## Size, because this is where naive implementations die
+
+A QR code holds about 4300 alphanumeric characters at the largest version, but a code that big is
+unreadable on a cracked phone screen in the sun. The real budget is a QR version around 20 or below.
+
+`qredential` compresses before encoding and tells you what you spent:
+
+```ts
+const { qr, bytes } = await issue({ ... })
+bytes // 738
+```
+
+Here is what a realistic driving licence actually costs. Eight claims, a five year expiry, a status
+list pointer, measured by `examples/sizes.mjs`:
+
+| credential | characters | QR version |
+|---|---|---|
+| everything visible, nothing withheld | ~740 | 18, scans fine |
+| all eight claims made disclosable | ~1590 | 27, too dense |
+| presenting only `over_18` from that credential | ~1115 | 22, still dense |
+
+The uncomfortable row is the middle one, and I would rather you learn it here than after printing
+cards. Selective disclosure roughly doubles the credential, because every disclosable claim costs a
+128 bit salt plus a digest the issuer has to sign, and the digests stay in the payload whether the
+holder reveals the claim or not. That last part is the whole point, since a digest count that
+changed with what you reveal would leak what you withheld, but it does mean the savings at
+presentation time are smaller than people expect: 30% here, not 80%.
+
+The practical advice, which is why `fits()` exists: make disclosable only the claims that a verifier
+might genuinely need to see alone. Two or three, not all of them.
+
+```ts
+fits(qr).advice
+// 'Fits QR version 18 at level M, with 78 characters to spare.'
+```
+
+## Offline revocation
+
+Revocation is the part everyone skips, and then a stolen credential works forever.
+
+A status list is a compressed bitstring: one bit per credential, hundreds of thousands of
+credentials in a few kilobytes. Fetch it when you have signal, check it when you do not.
+
+```ts
+const result = await verify(scanned, {
+  trust,
+  status: cachedStatusList,
+  maxStatusAge: '7d'   // refuse to answer from a list older than this
+})
+```
+
+If the cached list is too old, you get `result.ok === false` with
+`result.reason === 'status_list_stale'` rather than a false yes. Deciding what to do when you cannot
+be sure is your call, and the library refuses to make it quietly for you.
+
+## API
+
+Four functions. That is the whole surface.
+
+| function | who calls it |
+|---|---|
+| `issue()` | the issuer, once per credential |
+| `present()` | the holder's wallet, at scan time |
+| `verify()` | the verifier |
+| `fits()` | you, while designing the credential |
+
+## What this is not
+
+- Not a wallet. It has no UI and no storage.
+- Not a key management system. You bring your own keys and your own trust list distribution.
+- Not ISO 18013-5 mDL yet. That is CBOR and COSE rather than JWT, and it is on the roadmap, but
+  claiming half of a compliance standard is worse than not claiming it.
+- Not audited. It is new. Read the code before you put it between a person and a right they hold.
+
+## Website
+
+[**qredential.js.org**](https://qredential.js.org/)
+
+- [Documentation](https://qredential.js.org/guide/), including the full API and
+  every rejection reason
+- [Playground](https://qredential.js.org/playground/), which runs the whole library
+  in your browser. The part worth your time is the attack bench: eight things an attacker would
+  actually try, each printing the rejection code it expects, so you can check the library against
+  its own claims rather than taking my word for it.
+
+The site is built from `docs/` by `npm run build:site` and deployed by GitHub Actions on every push
+to main.
+
+## Errors
+
+Two contracts, and that is the whole model:
+
+1. **`verify()` never throws.** For any input at all. It returns a discriminated union, and a
+   failure carries a typed `reason`.
+2. **Everything else throws only `QredentialError`**, which carries a stable `code`.
+
+Both are held to by property based tests that generate random strings, malformed keys, corrupt
+envelopes and hostile options and assert that nothing else escapes: no `SyntaxError` from a JSON
+parse, no `DOMException` from WebCrypto, no `RangeError` from an allocation.
+
+```ts
+import { verify, assertVerified, isQredentialError } from 'qredential'
+
+// Style 1: look at the result.
+const result = await verify(scanned, { trust })
+if (!result.ok) return refuse(result.reason)
+
+// Style 2: let it throw, if that suits your codebase better.
+try {
+  const credential = assertVerified(await verify(scanned, { trust }))
+} catch (error) {
+  if (isQredentialError(error)) refuse(error.reason ?? error.code)
+}
+```
+
+Codes and reasons are covered by semver; message text is not. Branch on the code, print the
+message. The full tables are in the
+[error handling guide](https://qredential.js.org/guide/#errors).
+
+## Security
+
+Report vulnerabilities privately through the Security tab. Scope, response times and an honest
+account of what this library has not had are in [SECURITY.md](SECURITY.md).
+
+## Translations
+
+The whole site is in nine languages: the landing page, the guide and the playground, including the
+live demo, which answers in the language of the page it is on. Most translations have **not been
+read by a native speaker**, and each guide page says so at the top rather than pretending
+otherwise.
+
+| Language | Code | Status |
+|---|---|---|
+| [English](https://qredential.js.org/guide/) | `en` | source |
+| [Português](https://qredential.js.org/pt/guide/) | `pt` | **needs a reviewer** |
+| [Español](https://qredential.js.org/es/guide/) | `es` | **needs a reviewer** |
+| [Français](https://qredential.js.org/fr/guide/) | `fr` | **needs a reviewer** |
+| [Deutsch](https://qredential.js.org/de/guide/) | `de` | **needs a reviewer** |
+| [日本語](https://qredential.js.org/ja/guide/) | `ja` | **needs a reviewer** |
+| [한국어](https://qredential.js.org/ko/guide/) | `ko` | **needs a reviewer** |
+| [简体中文](https://qredential.js.org/zh-Hans/guide/) | `zh-Hans` | **needs a reviewer** |
+| [繁體中文](https://qredential.js.org/zh-Hant/guide/) | `zh-Hant` | **needs a reviewer** |
+
+If you speak one of the languages marked as needing a reviewer, you know something I cannot. Reading
+one page and saying whether it is sound is the most useful thing a speaker of that language can do
+here, and there is an
+[issue template](https://github.com/george-veras/qredential/issues/new/choose) for reporting a
+sentence that is wrong, awkward, or uses a term nobody actually uses. Rough reports are welcome; you
+do not need to propose the fix.
+
+Anyone who reviews a language is credited on the page and in the release notes, and that language
+stops being marked unreviewed.
+
+Translations live in `content/`: the guide as Markdown in `guide/<code>.md`, the landing and the
+playground as key catalogues in `landing/<code>.json` and `playground/<code>.json`. Each guide
+translation records the hash of the English it was made from, so when the English moves and a
+translation does not, the build says so, the page shows a warning, and CI reports it. A catalogue
+missing a key fails the build outright, because a page half in one language is worse than one that
+is simply not translated. Nothing rots quietly.
+
+## Contributing
+
+The most useful thing you can do is point this library at a credential from somewhere else and tell
+me what happened. Every test here verifies something this library itself produced, so none of them
+can find a place where it is self-consistent and still wrong. Your credential can, and there is an
+[issue template](https://github.com/george-veras/qredential/issues/new/choose) for exactly that.
+
+Setup is `npm install && npm test`, with no services, no environment variables and no runtime
+dependencies. [CONTRIBUTING.md](CONTRIBUTING.md) has the architecture map, the two invariants the
+design rests on, what changes to the verification path need, and a section called **what this
+project will say no to**, which is there so a no reaches you before you build something rather than
+after.
+
+There are [good first issues](https://github.com/george-veras/qredential/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)
+open, each one written with enough context to start without asking me anything: what to change,
+which file, how to know it worked, and which section of the RFC settles the question.
+
+Questions go in [Discussions](https://github.com/george-veras/qredential/discussions) and are not a
+bother. A question the documentation cannot answer is a documentation bug.
+
+## Status
+
+Early. The API above is implemented and tested, the shape may still move before 1.0, and I would
+rather hear that a design is wrong now than after people depend on it. Issues welcome.
+
+## License
+
+MIT

package/dist/base45.d.ts

@@ -0,0 +1,11 @@
+/**
+ * base45, RFC 9285.
+ *
+ * The reason this exists instead of base64: QR codes have a dedicated alphanumeric mode that packs
+ * 2 characters into 11 bits, but its alphabet is only 45 characters and does not include lowercase.
+ * base64 forces the encoder into byte mode, which costs 8 bits per character. Encoding the same
+ * payload as base45 and letting the QR encoder use alphanumeric mode is meaningfully smaller in
+ * practice, which is why the EU covid certificate used it.
+ */
+export declare function encodeBase45(bytes: Uint8Array): string;
+export declare function decodeBase45(text: string): Uint8Array;

package/dist/base45.js

@@ -0,0 +1,62 @@
+/**
+ * base45, RFC 9285.
+ *
+ * The reason this exists instead of base64: QR codes have a dedicated alphanumeric mode that packs
+ * 2 characters into 11 bits, but its alphabet is only 45 characters and does not include lowercase.
+ * base64 forces the encoder into byte mode, which costs 8 bits per character. Encoding the same
+ * payload as base45 and letting the QR encoder use alphanumeric mode is meaningfully smaller in
+ * practice, which is why the EU covid certificate used it.
+ */
+import { QredentialError } from './errors.js';
+const ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:';
+const REVERSE = {};
+for (let i = 0; i < ALPHABET.length; i++)
+    REVERSE[ALPHABET[i]] = i;
+export function encodeBase45(bytes) {
+    let out = '';
+    let i = 0;
+    for (; i + 1 < bytes.length; i += 2) {
+        // Two bytes become a number below 65536, which always fits in three base45 digits.
+        const n = bytes[i] * 256 + bytes[i + 1];
+        out += ALPHABET[n % 45];
+        out += ALPHABET[Math.floor(n / 45) % 45];
+        out += ALPHABET[Math.floor(n / 2025)];
+    }
+    if (i < bytes.length) {
+        // A single trailing byte is below 256 and takes two digits.
+        const n = bytes[i];
+        out += ALPHABET[n % 45];
+        out += ALPHABET[Math.floor(n / 45)];
+    }
+    return out;
+}
+export function decodeBase45(text) {
+    const values = [];
+    for (const ch of text) {
+        const v = REVERSE[ch];
+        if (v === undefined) {
+            throw new QredentialError('invalid_encoding', `invalid base45 character: ${JSON.stringify(ch)}`);
+        }
+        values.push(v);
+    }
+    const remainder = values.length % 3;
+    if (remainder === 1)
+        throw new QredentialError('invalid_encoding', 'invalid base45 length');
+    const out = [];
+    let i = 0;
+    for (; i + 2 < values.length; i += 3) {
+        const n = values[i] + values[i + 1] * 45 + values[i + 2] * 2025;
+        if (n > 0xffff) {
+            throw new QredentialError('invalid_encoding', 'invalid base45 triplet: value exceeds two bytes');
+        }
+        out.push(n >> 8, n & 0xff);
+    }
+    if (remainder === 2) {
+        const n = values[i] + values[i + 1] * 45;
+        if (n > 0xff) {
+            throw new QredentialError('invalid_encoding', 'invalid base45 pair: value exceeds one byte');
+        }
+        out.push(n);
+    }
+    return new Uint8Array(out);
+}

package/dist/bytes.d.ts

@@ -0,0 +1,10 @@
+/** Encoding helpers. Everything here is platform neutral: no Buffer, no Node imports. */
+export declare function utf8(s: string): Uint8Array;
+export declare function fromUtf8(b: Uint8Array): string;
+export declare function b64url(bytes: Uint8Array): string;
+export declare function unb64url(s: string): Uint8Array;
+/** JSON in, base64url out. Used for JWT segments and SD-JWT disclosures. */
+export declare function b64urlJson(value: unknown): string;
+export declare function unb64urlJson<T = unknown>(s: string): T;
+export declare function randomBytes(n: number): Uint8Array;
+export declare function concat(...parts: Uint8Array[]): Uint8Array;

package/dist/bytes.js

@@ -0,0 +1,73 @@
+/** Encoding helpers. Everything here is platform neutral: no Buffer, no Node imports. */
+import { QredentialError } from './errors.js';
+const B64URL = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+export function utf8(s) {
+    return new TextEncoder().encode(s);
+}
+export function fromUtf8(b) {
+    return new TextDecoder().decode(b);
+}
+export function b64url(bytes) {
+    let out = '';
+    for (let i = 0; i < bytes.length; i += 3) {
+        const a = bytes[i];
+        const b = bytes[i + 1];
+        const c = bytes[i + 2];
+        out += B64URL[a >> 2];
+        out += B64URL[((a & 3) << 4) | ((b ?? 0) >> 4)];
+        if (b === undefined)
+            break;
+        out += B64URL[((b & 15) << 2) | ((c ?? 0) >> 6)];
+        if (c === undefined)
+            break;
+        out += B64URL[c & 63];
+    }
+    return out;
+}
+export function unb64url(s) {
+    const out = new Uint8Array(Math.floor((s.length * 3) / 4));
+    let acc = 0;
+    let bits = 0;
+    let n = 0;
+    for (const ch of s) {
+        const v = B64URL.indexOf(ch);
+        if (v < 0)
+            throw new QredentialError('invalid_encoding', `invalid base64url character: ${ch}`);
+        acc = (acc << 6) | v;
+        bits += 6;
+        if (bits >= 8) {
+            bits -= 8;
+            out[n++] = (acc >> bits) & 0xff;
+        }
+    }
+    return out.subarray(0, n);
+}
+/** JSON in, base64url out. Used for JWT segments and SD-JWT disclosures. */
+export function b64urlJson(value) {
+    return b64url(utf8(JSON.stringify(value)));
+}
+export function unb64urlJson(s) {
+    const text = fromUtf8(unb64url(s));
+    try {
+        return JSON.parse(text);
+    }
+    catch (error) {
+        // JSON.parse throws SyntaxError, which is not this library's error and is documented nowhere.
+        throw new QredentialError('invalid_encoding', 'segment is not valid JSON', { cause: error });
+    }
+}
+export function randomBytes(n) {
+    const b = new Uint8Array(n);
+    crypto.getRandomValues(b);
+    return b;
+}
+export function concat(...parts) {
+    const total = parts.reduce((s, p) => s + p.length, 0);
+    const out = new Uint8Array(total);
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+}

package/dist/compress.d.ts

@@ -0,0 +1,8 @@
+export declare function hasCompression(): boolean;
+export declare function deflate(bytes: Uint8Array, format?: CompressionFormat): Promise<Uint8Array>;
+export declare function inflate(bytes: Uint8Array, format?: CompressionFormat): Promise<Uint8Array>;
+/**
+ * Status list publishers are inconsistent about whether the bitstring carries a zlib header, so
+ * try both rather than failing on a credential that is actually fine.
+ */
+export declare function inflateEither(bytes: Uint8Array): Promise<Uint8Array>;

package/dist/compress.js

@@ -0,0 +1,56 @@
+import { concat } from './bytes.js';
+export function hasCompression() {
+    return typeof CompressionStream !== 'undefined' && typeof DecompressionStream !== 'undefined';
+}
+async function drain(stream) {
+    const chunks = [];
+    const reader = stream.getReader();
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        if (value)
+            chunks.push(value);
+    }
+    return concat(...chunks);
+}
+/**
+ * Feed a transform stream and collect what comes out.
+ *
+ * The subtlety is the writable side. When the stream errors on malformed input, the write and close
+ * promises reject too. Leaving them floating turns hostile input into an unhandled rejection, which
+ * modern Node treats as fatal: a verifier that takes the process down with it is worse than one
+ * that returns false. They are settled here, while the real error still surfaces through the
+ * readable side, where the caller is waiting for it.
+ */
+async function run(transform, bytes) {
+    const writer = transform.writable.getWriter();
+    const pumped = writer
+        .write(bytes)
+        .then(() => writer.close())
+        .catch(() => undefined);
+    try {
+        return await drain(transform.readable);
+    }
+    finally {
+        await pumped;
+    }
+}
+export async function deflate(bytes, format = 'deflate-raw') {
+    return run(new CompressionStream(format), bytes);
+}
+export async function inflate(bytes, format = 'deflate-raw') {
+    return run(new DecompressionStream(format), bytes);
+}
+/**
+ * Status list publishers are inconsistent about whether the bitstring carries a zlib header, so
+ * try both rather than failing on a credential that is actually fine.
+ */
+export async function inflateEither(bytes) {
+    try {
+        return await inflate(bytes, 'deflate');
+    }
+    catch {
+        return await inflate(bytes, 'deflate-raw');
+    }
+}

package/dist/crypto.d.ts

@@ -0,0 +1,13 @@
+import type { Alg, Jwk } from './types.js';
+export declare function importPrivateKey(jwk: Jwk, alg: Alg): Promise<CryptoKey>;
+export declare function importPublicKey(jwk: Jwk, alg: Alg): Promise<CryptoKey>;
+export declare function sign(data: string, key: CryptoKey, alg: Alg): Promise<Uint8Array>;
+export declare function verifySignature(data: string, signature: string, key: CryptoKey, alg: Alg): Promise<boolean>;
+/**
+ * Work out which algorithm a key is for.
+ *
+ * The JWK's own `alg` wins when it is there. Otherwise the curve decides, because a P-256 key can
+ * only be used one way here and guessing wrong fails loudly at import rather than quietly.
+ */
+export declare function algForJwk(jwk: Jwk): Alg;
+export declare function sha256(data: Uint8Array): Promise<Uint8Array>;

package/dist/crypto.js

@@ -0,0 +1,72 @@
+import { unb64url, utf8 } from './bytes.js';
+import { QredentialError, asCryptoFailure } from './errors.js';
+function params(alg) {
+    switch (alg) {
+        case 'ES256':
+            return {
+                import: { name: 'ECDSA', namedCurve: 'P-256' },
+                sign: { name: 'ECDSA', hash: 'SHA-256' },
+            };
+        case 'EdDSA':
+            return { import: { name: 'Ed25519' }, sign: { name: 'Ed25519' } };
+        default: {
+            const never = alg;
+            throw new QredentialError('unsupported_alg', `unsupported algorithm: ${String(never)}`);
+        }
+    }
+}
+export async function importPrivateKey(jwk, alg) {
+    try {
+        return await crypto.subtle.importKey('jwk', jwk, params(alg).import, false, ['sign']);
+    }
+    catch (error) {
+        throw asCryptoFailure(`could not import the ${alg} private key`, error);
+    }
+}
+export async function importPublicKey(jwk, alg) {
+    const pub = { ...jwk };
+    delete pub.d;
+    pub.key_ops = ['verify'];
+    try {
+        return await crypto.subtle.importKey('jwk', pub, params(alg).import, false, ['verify']);
+    }
+    catch (error) {
+        throw asCryptoFailure(`could not import the ${alg} public key`, error);
+    }
+}
+export async function sign(data, key, alg) {
+    try {
+        const sig = await crypto.subtle.sign(params(alg).sign, key, utf8(data));
+        return new Uint8Array(sig);
+    }
+    catch (error) {
+        throw asCryptoFailure(`could not sign with ${alg}`, error);
+    }
+}
+export async function verifySignature(data, signature, key, alg) {
+    try {
+        return await crypto.subtle.verify(params(alg).sign, key, unb64url(signature), utf8(data));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Work out which algorithm a key is for.
+ *
+ * The JWK's own `alg` wins when it is there. Otherwise the curve decides, because a P-256 key can
+ * only be used one way here and guessing wrong fails loudly at import rather than quietly.
+ */
+export function algForJwk(jwk) {
+    if (jwk.alg === 'ES256' || jwk.alg === 'EdDSA')
+        return jwk.alg;
+    if (jwk.crv === 'P-256')
+        return 'ES256';
+    if (jwk.crv === 'Ed25519')
+        return 'EdDSA';
+    throw new QredentialError('unsupported_alg', `cannot tell which algorithm this key is for: kty ${String(jwk.kty)}, crv ${String(jwk.crv)}`);
+}
+export async function sha256(data) {
+    const buf = await crypto.subtle.digest('SHA-256', data);
+    return new Uint8Array(buf);
+}

package/dist/duration.d.ts

@@ -0,0 +1,3 @@
+/** Accepts seconds as a number, or a short form like '30d', '12h', '90s'. */
+export declare function seconds(value: number | string): number;
+export declare function nowSeconds(): number;

package/dist/duration.js

@@ -0,0 +1,24 @@
+import { QredentialError } from './errors.js';
+const UNITS = {
+    s: 1,
+    m: 60,
+    h: 3600,
+    d: 86400,
+    w: 604800,
+    y: 31557600,
+};
+/** Accepts seconds as a number, or a short form like '30d', '12h', '90s'. */
+export function seconds(value) {
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new QredentialError('invalid_option', `invalid duration: ${value}`);
+        return Math.floor(value);
+    }
+    const match = /^(\d+(?:\.\d+)?)\s*(s|m|h|d|w|y)$/.exec(value.trim());
+    if (!match)
+        throw new QredentialError('invalid_option', `invalid duration: ${JSON.stringify(value)}`);
+    return Math.floor(Number(match[1]) * UNITS[match[2]]);
+}
+export function nowSeconds() {
+    return Math.floor(Date.now() / 1000);
+}