rootcard 0.0.0-stage → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,15 @@
+# Changelog: rootcard (npm)
+
+All notable changes to this package are recorded here.
+
+## Unreleased
+
+## 0.1.0 - 2026-11-04
+
+- First release of the JavaScript implementation of format version 1, byte for byte equal to the Rust crate on every
+  shared vector. Zero dependencies; WebCrypto for Ed25519, X25519, SHA-256, HKDF and AES-GCM; its own BLAKE2b and
+  Argon2id (RFC 9106).
+- `rootcard`: verification (JSON, encodings, keys, recovery keys, identities, logs, vault and profile checks,
+  messages, proofs, account files, cards). `rootcard/vault`: password locks, vault encryption, registration, password
+  change, new instances and rotation. `rootcard/testing`: the deterministic stream of the vectors.
+- `keytool.html`: the standalone key tool page, works from `file://`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Hexagon and the rootcard contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,24 @@
-# Temporary Holding Version
+# rootcard (npm)
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+[rootcard](https://github.com/Hexagon/rootcard) in plain ES modules: a portable, self-certifying identity for online
+logins. Zero dependencies, no build step, WebCrypto only; runs in browsers and Node 20 or later. It produces and checks
+exactly the bytes of the Rust crate `rootcard`; both are tested against the shared vectors of the specification.
+
+```js
+import { verifyLog, verifyProof } from "rootcard";             // verification: hosts, relying parties, clients
+import { register, unlockVault, changePassword } from "rootcard/vault"; // passwords, Argon2id, vault encryption
+
+const state = await verifyLog(events, { realms: ["global"], now: Math.floor(Date.now() / 1000) });
+```
+
+- `rootcard` is the verification core: canonical JSON, keys, recovery keys, identities and handles, logs
+  (`verifyLog`, `extendLog`, `compareLogs`), vault and profile checks, login and fetch messages, proofs, account files
+  and recovery cards.
+- `rootcard/vault` adds password locks (Argon2id implemented in this package, the only primitive not taken from
+  WebCrypto), vault encryption and the high-level flows: registration, password change, new instances and rotation.
+  A server bundle that does not import it never loads it.
+- `keytool.html` is the standalone key tool page: open it from your own disk (`file://`). It talks only to the hosts you
+  enter. It is generated from these modules by `npm run build`.
+
+Functions that need randomness take `random(n)`; pass `systemRandom` (WebCrypto `getRandomValues`). Errors are
+`RootcardError` with the stable `code` of SPEC §20.