rootcard 0.2.1 → 0.3.1

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to this package are recorded here.
 
 ## Unreleased
 
+## 0.3.1 - 2026-11-05
+
+- The package metadata (`homepage`, `repository`, `bugs`) and the README links point to `github.com/rootcard/rootcard`,
+  the repository it is built and published from, so npm provenance matches.
+
+## 0.3.0 - 2026-11-05
+
+- `keytool.html` is redesigned in the rootcard.org theme, with the same operations and checks. It has tabs (open,
+  create, verify a proof). An opened identity is shown as a card with its host, and each action says whether it
+  works offline, sends to the primary host or to a host you enter. Actions the identity cannot do yet are disabled,
+  with the reason: a card-only identity (no instance) can show its card and make root proofs, and "Start at a host"
+  puts it on one. Before, reset, revoke, rotate and retire failed with a script error for such an identity. Host
+  addresses are checked as you type and show what will be contacted. `https://` is added when no scheme is given
+  (`http://` for `localhost`, `127.0.0.1` and `[::1]`), and a trailing `/v0` is refused with an explanation
+  ([HST-22]). Creating an identity offers "At a host" or "Only on this computer", and asks for a password only
+  for a host. "Could not reach the host" replaces the browser's bare fetch error.
+- **Breaking:** every function that creates a password lock enforces the password rules of SPEC [LCK-8]
+  (`weak_password`), not only `register`: `newPasswordLock` (and so `addSlot`, `instanceVault`, `newInstance`) and
+  `changePassword`. Slots (`{ label, password, kdf }`) need `username`, and `changePassword` has a new parameter
+  `username` after `password`. `newInstance` refuses a slot whose `username` is not the identity's (`bad_field`).
+- **Breaking:** `checkBaseUrl` ([HST-22]) refuses dot segments and anything but unreserved characters in the path
+  (no percent-encoding), as in the Rust crate. `keytool.html` is rebuilt with both changes.
+- Fixed: in Safari (WebKit), about 1 in 256 X25519 secrets failed with a `DataError`: WebKit's WebCrypto rejects a
+  secret whose first byte is zero. Creating locks, wrapping the vault key and unlocking could fail at random, and a
+  password whose box secret started with a zero byte could never unlock there. X25519 secrets are now given to
+  WebCrypto with a zero first byte as 1 and a zero last byte as 0x40, the same scalar after clamping (RFC 7748 §5),
+  so no key, result or vector changes. New vectors in `spec/vectors/primitives.json` cover secrets and seeds with a
+  zero byte at either end. `keytool.html` is rebuilt.
+- Ed25519 seeds whose first byte is zero (SPEC [CRY-9], [IMP-6]): WebKit cannot import them at all.
+  - New keys never use one: `register` and `newInstance` draw the account seed again, `newPasswordLock`,
+    `changePassword` and `addSlot` draw the salt again, and **breaking:** `register` and `rotateRecovery` refuse a
+    recovery key whose signing seed is unusable (`bad_key`). The new `newRecoveryKey(realm, username, random)`
+    generates a usable one; `checkNewRecoveryKey` and `usableSeed` are exported. Draws change only when a first draw
+    is unusable, with vectors for each case.
+  - Older such keys keep working: `checkRecoveryKey`, `unlockVault` and `prove` check a seed against its public key on
+    record with the new `ed25519PublicIs`, and signing with that seed then imports it as a JWK with that key where
+    the platform refuses it. A key on record that is not the seed's is refused.
+- `keytool.html`: generates recovery keys with `newRecoveryKey`, and no longer reports "Done." while a rotation is
+  still being sent (the status stays "Working…" until it ends).
+
 ## 0.2.1 - 2026-11-05
 
 - **Fixed:** `keytool.html` 0.2.0 refused every host address ("not a host base URL"), because the page did not include

package/README.md

@@ -1,10 +1,10 @@
 # rootcard (npm)
 
-[rootcard](https://github.com/Hexagon/rootcard) in plain ES modules: a portable, self-certifying identity for online
+[rootcard](https://github.com/rootcard/rootcard) in plain ES modules: a portable, self-certifying identity for online
 logins. Zero dependencies, no build step, WebCrypto only; runs in browsers and Node 20 or later. It produces and checks
 exactly the bytes of the Rust crate `rootcard`; both are tested against the shared vectors of the specification.
 
-> **New to rootcard?** Start with the [project README](https://github.com/Hexagon/rootcard#readme): what rootcard is,
+> **New to rootcard?** Start with the [project README](https://github.com/rootcard/rootcard#readme): what rootcard is,
 > the two ways to use it (a safer username-and-password login for your own service, or an ID card across services),
 > how it compares with other login methods, and the roadmap.
 
@@ -24,8 +24,10 @@ const state = await verifyLog(events, { realms: ["global"], now: Math.floor(Date
 - `keytool.html` is the standalone key tool page: open it from your own disk (`file://`). It talks only to the hosts you
   enter. It is generated from these modules by `npm run build`.
 
-Functions that need randomness take `random(n)`; pass `systemRandom` (WebCrypto `getRandomValues`). Errors are
-`RootcardError` with the stable `code` of SPEC §20.
+Functions that need randomness take `random(n)`; pass `systemRandom` (WebCrypto `getRandomValues`). Make a new
+recovery key with `newRecoveryKey(realm, username, systemRandom)`, not with 32 bytes of your own: `register` refuses
+the rare key whose signing key some browsers cannot use (SPEC [CRY-9]). Errors are `RootcardError` with the stable
+`code` of SPEC §20.
 
 ## HTTP binding