waterplane 0.1.16 → 0.1.18

package/node_modules/@waterplane/shared/dist/pairing.d.ts

@@ -9,6 +9,12 @@
  * the APK); the installed app is reached through the DEEP LINK
  * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
  *
+ * The deep link may also carry, each additive so a shipped page reads `u` and `c` and ignores them:
+ * `s=1` (pair by PAKE only, `pake.ts`; never fall back to a plain redeem), `k=<32 hex>` (`pairCommit`:
+ * what the seal must match, so someone who has the code still cannot be this desktop) and
+ * `l=<plain LAN base>` (so a phone with no tailnet need not type the address). `u` stays plain, and
+ * TLS facts ride only inside the seal: a shipped APK could not reach a TLS address.
+ *
  * The base goes through `normalizeHostBase`, so a scanned or pasted link can
  * never aim the app at a `javascript:` or `data:` base.
  */
@@ -32,8 +38,28 @@ export declare function formatPairCode(code: string): string;
 export interface PairTarget {
     base: string;
     code: string;
+    /** `s=1`: this link pairs by PAKE or not at all. Absent: nobody asked for that. */
+    secure?: boolean;
+    /** `k=`: what the seal must match (`pairCommit`). */
+    commit?: string;
+    /** `l=`: the plain LAN base. */
+    lan?: string;
 }
-export declare function pairDeepLink(base: string, code: string): string;
+/** What a deep link adds to `u` and `c`. */
+export type PairLinkFacts = Pick<PairTarget, "secure" | "commit" | "lan">;
+export declare function pairDeepLink(base: string, code: string, facts?: PairLinkFacts): string;
+/**
+ * `k=`: the first 32 hex digits (128 bits) of SHA-256(DER ‖ PIN), lowercase, where DER is the update key's SPKI
+ * DER (the base64 of `updateKey`, decoded) and PIN the 32 bytes of the TLS pin (the hex of `tls.spki`,
+ * decoded). A desktop with no TLS listener has no PIN, so the hash covers the DER alone. Null when
+ * either input is malformed, so a phone reads that as a mismatch and never as a pass. 128 bits because
+ * the value is the same for every code of a desktop and a link is shared as text: a shorter one could
+ * be ground offline once and reused against any later code.
+ */
+export declare function pairCommit(updateKey: unknown, spki?: unknown): Promise<string | null>;
+/** The update key's fingerprint (8a): lowercase hex SHA-256 of the SPKI DER. What the desktop prints
+ *  beside the code, so the native dialog has something to compare against. */
+export declare function updateKeyFingerprint(updateKey: unknown): Promise<string | null>;
 export declare function pairLandingUrl(base: string, code: string): string;
 /** Parse `<scheme>://pair?u=<base>&c=<code>` (current or a legacy scheme), or `null`. */
 export declare function parsePairDeepLink(raw: unknown): PairTarget | null;
@@ -79,8 +105,18 @@ export interface PairMintResponse {
     landingUrl: string;
     deepLink: string;
     base: string;
-    /** Plain-HTTP LAN base, when the host has a LAN interface bound. */
+    /** Plain-HTTP LAN base, when the host has a LAN interface bound. Equal to `base` on a desktop with
+     *  no tailnet, and then `landingUrl` is a plain address: opening it burns the code. */
     lanBase?: string;
+    /** The deep link says `s=1`. Absent with no password set, because PAKE refuses every attempt then. */
+    secure?: boolean;
+    /** The deep link's `k=`. */
+    commit?: string;
+    /** Lowercase hex SHA-256 of the update key's DER, printed beside the code. */
+    updateKeyFingerprint?: string;
+    /** The same link with `u=` the LAN address, for a shipped APK that ignores `l=`. Only when `base`
+     *  is another address. */
+    lanDeepLink?: string;
 }
 /** `POST /api/pair/redeem` */
 export interface PairRedeemRequest {
@@ -117,4 +153,62 @@ export type PairRedeemResponse = {
     error: PairRedeemError;
     message: string;
 };
+/** `POST /api/pair/pake/start`. Carries no `Authorization`. */
+export interface PakeStartRequest {
+    sidP: string;
+    ya: string;
+}
+/** `POST /api/pair/pake/finish`, also with no `Authorization`. `confirm[i]` and `box[i]` answer
+ *  `yb[i]`; the phone cannot know which code it holds, so it answers all of them. */
+export interface PakeFinishRequest {
+    sidP: string;
+    confirm: string[];
+    box: string[];
+}
+/** What a `box` holds. `presented` is the old token a re-pair retires, sealed so a relay never sees
+ *  it, and so it can never ride in a header on these routes. */
+export interface PakeBoxBody {
+    deviceName: string;
+    presented?: string;
+}
+/**
+ * Why a PAKE route refused. `closed`, `no-password` and `no-codes` come from a host that DOES speak
+ * PAKE, so a phone never answers them with a plain redeem. `unknown` is a miss; `no-session` is a
+ * `finish` with nothing to finish, its 60 seconds up or its one try spent. None of them is a 404,
+ * which stays what a host with no PAKE at all may answer.
+ */
+export type PakeError = PairRedeemError | "closed" | "no-codes" | "no-session";
+export type PakeRefusal = {
+    ok: false;
+    error: PakeError;
+    message: string;
+};
+export type PakeStartResponse = {
+    ok: true;
+    nh: string;
+    yb: string[];
+} | PakeRefusal;
+export type PakeFinishResponse = {
+    ok: true;
+    seal: string;
+} | PakeRefusal;
+/** Inside the seal: `redeemPair`'s answer and what only a sealed reply may carry. The seal opening
+ *  proves the host knew the code, which is why the LAN identity may go to a LAN redeemer here. */
+export type PakeSealedReply = Extract<PairRedeemResponse, {
+    ok: true;
+}> & {
+    hostId: string;
+    /** Absent with no TLS listener. `spki` is lowercase hex. */
+    tls?: {
+        port: number;
+        spki: string;
+    };
+    /** Base64 SPKI DER (8a). */
+    updateKey?: string;
+    lanIdentity: {
+        hostId: string;
+        secret: string;
+    };
+};
+export declare function pakeErrorText(error: PakeError): string;
 export declare function pairRedeemErrorText(error: PairRedeemError): string;

package/node_modules/@waterplane/shared/dist/pairing.js

@@ -9,6 +9,12 @@
  * the APK); the installed app is reached through the DEEP LINK
  * (`<scheme>://pair?u=<base>&c=<code>`). Both parse to the same `{base, code}`.
  *
+ * The deep link may also carry, each additive so a shipped page reads `u` and `c` and ignores them:
+ * `s=1` (pair by PAKE only, `pake.ts`; never fall back to a plain redeem), `k=<32 hex>` (`pairCommit`:
+ * what the seal must match, so someone who has the code still cannot be this desktop) and
+ * `l=<plain LAN base>` (so a phone with no tailnet need not type the address). `u` stays plain, and
+ * TLS facts ride only inside the seal: a shipped APK could not reach a TLS address.
+ *
  * The base goes through `normalizeHostBase`, so a scanned or pasted link can
  * never aim the app at a `javascript:` or `data:` base.
  */
@@ -16,6 +22,7 @@ import { normalizeHostBase } from "./hosturl.js";
 import { BRAND, LEGACY } from "./brand.js";
 import { randomFromAlphabet, defaultRandomBytes } from "./hosts.js";
 import { trimEndChars } from "./lineartrim.js";
+import { pakeDecode, sha256 } from "./pake.js";
 /** 32 characters (a power of two: uniform from a byte), no 0, O, 1 or I. */
 export const PAIR_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
 export const PAIR_CODE_LEN = 8;
@@ -46,8 +53,44 @@ export function normalizePairCode(raw) {
 export function formatPairCode(code) {
     return code.length === PAIR_CODE_LEN ? `${code.slice(0, 4)}-${code.slice(4)}` : code;
 }
-export function pairDeepLink(base, code) {
-    return `${PAIR_SCHEME}://pair?u=${encodeURIComponent(base)}&c=${encodeURIComponent(code)}`;
+const PAIR_COMMIT_HEX = 32;
+export function pairDeepLink(base, code, facts = {}) {
+    const extra = [
+        facts.secure ? "&s=1" : "",
+        facts.commit ? `&k=${facts.commit}` : "",
+        facts.lan ? `&l=${encodeURIComponent(facts.lan)}` : "",
+    ].join("");
+    return `${PAIR_SCHEME}://pair?u=${encodeURIComponent(base)}&c=${encodeURIComponent(code)}${extra}`;
+}
+const hex = (b) => Array.from(b, (c) => c.toString(16).padStart(2, "0")).join("");
+function hexBytes(s) {
+    if (s.length % 2 !== 0 || !/^[0-9a-f]*$/.test(s))
+        return null;
+    return Uint8Array.from(s.match(/../g) ?? [], (x) => parseInt(x, 16));
+}
+/**
+ * `k=`: the first 32 hex digits (128 bits) of SHA-256(DER ‖ PIN), lowercase, where DER is the update key's SPKI
+ * DER (the base64 of `updateKey`, decoded) and PIN the 32 bytes of the TLS pin (the hex of `tls.spki`,
+ * decoded). A desktop with no TLS listener has no PIN, so the hash covers the DER alone. Null when
+ * either input is malformed, so a phone reads that as a mismatch and never as a pass. 128 bits because
+ * the value is the same for every code of a desktop and a link is shared as text: a shorter one could
+ * be ground offline once and reused against any later code.
+ */
+export async function pairCommit(updateKey, spki) {
+    const der = pakeDecode(updateKey);
+    const pin = spki === undefined ? new Uint8Array(0) : typeof spki === "string" ? hexBytes(spki) : null;
+    if (!der || der.length === 0 || !pin || (spki !== undefined && pin.length !== 32))
+        return null;
+    const both = new Uint8Array(der.length + pin.length);
+    both.set(der);
+    both.set(pin, der.length);
+    return hex(await sha256(both)).slice(0, PAIR_COMMIT_HEX);
+}
+/** The update key's fingerprint (8a): lowercase hex SHA-256 of the SPKI DER. What the desktop prints
+ *  beside the code, so the native dialog has something to compare against. */
+export async function updateKeyFingerprint(updateKey) {
+    const der = pakeDecode(updateKey);
+    return der && der.length > 0 ? hex(await sha256(der)) : null;
 }
 export function pairLandingUrl(base, code) {
     return `${trimEndChars(base, "/")}/pair/${code}`;
@@ -69,7 +112,20 @@ export function parsePairDeepLink(raw) {
     }
     const base = normalizeHostBase(params.get("u") ?? "");
     const code = normalizePairCode(params.get("c"));
-    return base && code ? { base, code } : null;
+    if (!base || !code)
+        return null;
+    // A commitment that cannot be read is refused rather than dropped: dropped, it would pass as a
+    // link that made no promise.
+    const commit = params.get("k");
+    if (commit !== null && !new RegExp(`^[0-9a-f]{${PAIR_COMMIT_HEX}}$`).test(commit))
+        return null;
+    const lan = normalizeHostBase(params.get("l") ?? "");
+    return {
+        base, code,
+        ...(params.get("s") === "1" ? { secure: true } : {}),
+        ...(commit !== null ? { commit } : {}),
+        ...(lan ? { lan } : {}),
+    };
 }
 /** The code in a landing path: `/pair/<code>` (page) or `/pair/<code>/apk`. */
 export function pairPathCode(pathname) {
@@ -112,6 +168,18 @@ export function parsePairInput(raw) {
 export function pairExpired(expiresAt, now) {
     return now >= expiresAt;
 }
+export function pakeErrorText(error) {
+    switch (error) {
+        case "closed":
+            return "Too many wrong attempts closed encrypted pairing for this code. Show a new code on the desktop.";
+        case "no-codes":
+            return "The desktop has no pairing code showing. Show a new code and try again.";
+        case "no-session":
+            return "That pairing attempt ran out of time. Try again.";
+        default:
+            return pairRedeemErrorText(error);
+    }
+}
 export function pairRedeemErrorText(error) {
     switch (error) {
         case "bad-request":

package/node_modules/@waterplane/shared/dist/pairing.js.map

@@ -1 +1 @@
-{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;AAC5C;4BAC4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CAAC,OAAoB,kBAAkB;IAChE,OAAO,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAOD,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,OAAO,GAAG,WAAW,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,OAAO,oBAAoB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAW;IACxD,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AA6ED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,0DAA0D,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,kEAAkE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,gEAAgE,CAAC;QAC1E,KAAK,cAAc;YACjB,OAAO,iDAAiD,CAAC;QAC3D,KAAK,aAAa;YAChB,OAAO,sGAAsG,CAAC;QAChH,uEAAuE;QACvE,mCAAmC;QACnC;YACE,OAAO,uGAAuG,CAAC;IACnH,CAAC;AACH,CAAC"}
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../src/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAoB,MAAM,YAAY,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAE/C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,aAAa,GAAG,kCAAkC,CAAC;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAC/B,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAC1C,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;AAC5C;4BAC4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AAEtF,MAAM,UAAU,WAAW,CAAC,OAAoB,kBAAkB;IAChE,OAAO,kBAAkB,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC;AAED;;;8CAG8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAgBD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,QAAuB,EAAE;IAChF,MAAM,KAAK,GAAG;QACZ,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QAC1B,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QACxC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;KACvD,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,OAAO,GAAG,WAAW,aAAa,kBAAkB,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,CAAa,EAAU,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEtG,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,SAAkB,EAAE,IAAc;IACjE,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3D,CAAC;AAED;8EAC8E;AAC9E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAkB;IAC3D,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IAClC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,GAAG,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,OAAO,OAAO,oBAAoB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,+FAA+F;IAC/F,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,MAAM,CAAC,aAAa,eAAe,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxB,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,CAAC,GAAG,8BAA8B,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9C,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,iBAAiB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,GAAW;IACxD,OAAO,GAAG,IAAI,SAAS,CAAC;AAC1B,CAAC;AAuID,MAAM,UAAU,aAAa,CAAC,KAAgB;IAC5C,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,iGAAiG,CAAC;QAC3G,KAAK,UAAU;YACb,OAAO,yEAAyE,CAAC;QACnF,KAAK,YAAY;YACf,OAAO,kDAAkD,CAAC;QAC5D;YACE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,aAAa;YAChB,OAAO,0DAA0D,CAAC;QACpE,KAAK,SAAS;YACZ,OAAO,kEAAkE,CAAC;QAC5E,KAAK,SAAS;YACZ,OAAO,kFAAkF,CAAC;QAC5F,KAAK,MAAM;YACT,OAAO,gEAAgE,CAAC;QAC1E,KAAK,cAAc;YACjB,OAAO,iDAAiD,CAAC;QAC3D,KAAK,aAAa;YAChB,OAAO,sGAAsG,CAAC;QAChH,uEAAuE;QACvE,mCAAmC;QACnC;YACE,OAAO,uGAAuG,CAAC;IACnH,CAAC;AACH,CAAC"}

package/node_modules/@waterplane/shared/dist/pake.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Pairing a phone over a network nobody trusts: CPace over ristretto255, keyed by the 8-character
+ * pairing code. The phone and the host both run THIS file, so there is one reading of every byte.
+ *
+ *   phone                                              host
+ *   sidP (16 random bytes), a
+ *   g  = H2C(lp(S), lp(sidP))                          S = SHA-256(utf8(code)), see below
+ *   Ya = a·g               ── start {sidP, ya} ──▶     for each code i it may offer (at most 5):
+ *                                                        b_i, Yb_i = b_i·g_i
+ *                          ◀── {nh, yb: [Yb_i]} ──
+ *   TH_i = SHA-512(lp(DST), lp(sidP), lp(nh), lp(Ya), lp(Yb_i))
+ *   Z_i  = a·Yb_i = b_i·Ya
+ *   K_phone, K_box, K_seal = HKDF-SHA256(ikm Z_i, salt TH_i, info = the label, 32 bytes each)
+ *   confirm_i = HMAC-SHA256(K_phone_i, TH_i)
+ *   box_i     = nonce96 ‖ AES-256-GCM(K_box_i, json, aad TH_i)
+ *                    ── finish {sidP, confirm, box} ──▶  one confirm of one code, or a miss
+ *                          ◀── {seal} ──                 nonce96 ‖ AES-256-GCM(K_seal, json, aad TH)
+ *
+ * The phone proves first, so a wrong guess is detected and counted by the host; the seal opening is
+ * what authenticates the host. A relay gets one online guess per attempt and learns nothing it can
+ * test offline: without the code it cannot compute g.
+ *
+ * **`S`, not the code itself.** The host keeps a code only as its SHA-256 (`PairStore`: no live
+ * credential sits in its memory as typed) and the generator depends on the phone's fresh `sidP`, so
+ * it cannot be worked out at mint time. Both ends therefore hash first. `S` is one-to-one with the
+ * code, so the password space and the guess count are the same as hashing the code directly.
+ *
+ * **Encodings.** `lp(x)` is a 4-byte big-endian length, then `x`. A code goes in as its normalized
+ * form (`normalizePairCode`). Every binary field on the wire is standard padded base64, decoded
+ * strictly (`pakeDecode`), so one value has one spelling.
+ *
+ * `@noble/curves` is loaded by dynamic import, so the phone's main chunk never carries it and it
+ * costs nothing until somebody pairs. HKDF, HMAC, AES-GCM and the hashes are WebCrypto, which node
+ * and the APK's WebView both have; a plain-http browser page does not, and `PakeFailure` says so.
+ */
+import { type RandomBytes } from "./hosts.js";
+/** The domain separator: frozen, and not the brand, because both ends of a pairing must agree on it
+ *  across a rename. */
+export declare const PAKE_DST = "waterplane-cpace-v1";
+/** The most codes a host offers, and the most shares a phone will answer. */
+export declare const PAKE_MAX_OFFERS = 5;
+export declare const PAKE_SID_BYTES = 16;
+export declare const PAKE_NONCE_BYTES = 16;
+export declare const PAKE_POINT_BYTES = 32;
+export declare const PAKE_CONFIRM_BYTES = 32;
+export declare const PAKE_TH_BYTES = 64;
+/** A value that cannot be used: a bad point, a malformed field, no WebCrypto. Never a wrong code. */
+export declare class PakeFailure extends Error {
+}
+/** `x` with its 4-byte big-endian length in front. */
+export declare function lp(x: Uint8Array): Uint8Array;
+/** Standard padded base64. */
+export declare function pakeEncode(b: Uint8Array): string;
+/** Strict base64: only the one spelling `pakeEncode` writes, optionally of exactly `len` bytes. */
+export declare function pakeDecode(raw: unknown, len?: number): Uint8Array | null;
+export declare function sha256(b: Uint8Array): Promise<Uint8Array>;
+/** Whether `b` is a share `decodeShare` accepts. */
+export declare function pakeShareOk(b: Uint8Array): Promise<boolean>;
+/** What goes in for the code: SHA-256 of its normalized form (the header says why). */
+export declare function pakeSecret(code: string): Promise<Uint8Array>;
+/** A fresh scalar and its share on the generator for `secret` and `sidP`. */
+export declare function pakeShare(secret: Uint8Array, sidP: Uint8Array, rand?: RandomBytes): Promise<{
+    scalar: bigint;
+    share: Uint8Array;
+}>;
+/** `TH`: everything both ends must have seen alike. */
+export declare function pakeTranscript(sidP: Uint8Array, nh: Uint8Array, ya: Uint8Array, yb: Uint8Array): Promise<Uint8Array>;
+/** `Z`: my scalar on the peer's share. Throws on a bad share, and on an identity result. */
+export declare function pakeSharedPoint(scalar: bigint, peerShare: Uint8Array): Promise<Uint8Array>;
+export type PakeLabel = "K_phone" | "K_box" | "K_seal";
+export interface PakeKeys {
+    kPhone: Uint8Array;
+    kBox: Uint8Array;
+    kSeal: Uint8Array;
+}
+export declare function pakeKeys(z: Uint8Array, th: Uint8Array): Promise<PakeKeys>;
+/** `HMAC-SHA256(K_phone, TH)`: the phone's proof that it holds the code. */
+export declare function pakeConfirm(kPhone: Uint8Array, th: Uint8Array): Promise<Uint8Array>;
+/** The phone's words to the host: `{deviceName, presented}`, under `K_box`. */
+export declare const pakeBox: (kBox: Uint8Array, th: Uint8Array, value: unknown, rand?: RandomBytes) => Promise<string>;
+export declare const pakeOpenBox: (kBox: Uint8Array, th: Uint8Array, raw: unknown) => Promise<unknown>;
+/** The host's reply, under `K_seal`. A random 96-bit nonce, `TH` as the additional data. */
+export declare const pakeSeal: (kSeal: Uint8Array, th: Uint8Array, value: unknown, rand?: RandomBytes) => Promise<string>;
+export declare const pakeOpenSeal: (kSeal: Uint8Array, th: Uint8Array, raw: unknown) => Promise<unknown>;
+/** One code offered to one attempt: what `finish` needs, and no way back to the code. */
+export interface PakeOffer {
+    yb: Uint8Array;
+    th: Uint8Array;
+    confirm: Uint8Array;
+    kBox: Uint8Array;
+    kSeal: Uint8Array;
+}
+/** `secret`'s answer to a `start`. Throws `PakeFailure` on a bad `ya`. */
+export declare function pakeHostOffer(secret: Uint8Array, sidP: Uint8Array, ya: Uint8Array, nh: Uint8Array, rand?: RandomBytes): Promise<PakeOffer>;
+export interface PakePhoneState {
+    sidP: Uint8Array;
+    ya: Uint8Array;
+    scalar: bigint;
+}
+/** `code` is normalized (`normalizePairCode`). The state stays on the phone. */
+export declare function pakePhoneStart(code: string, rand?: RandomBytes): Promise<{
+    state: PakePhoneState;
+    request: {
+        sidP: string;
+        ya: string;
+    };
+}>;
+/** What opens the seal: one candidate per share, because only the host knows which code hit. */
+export interface PakeCandidate {
+    kSeal: Uint8Array;
+    th: Uint8Array;
+}
+/**
+ * Answer a `start` reply. Throws `PakeFailure` on more shares than a host may offer, on none, and on
+ * any bad share, because a host that sends one is not worth a guess. `box` is the words the host
+ * needs (`PakeBoxBody`), one copy per candidate.
+ */
+export declare function pakePhoneFinish(state: PakePhoneState, reply: {
+    nh: unknown;
+    yb: unknown;
+}, box: unknown, rand?: RandomBytes): Promise<{
+    request: {
+        sidP: string;
+        confirm: string[];
+        box: string[];
+    };
+    candidates: PakeCandidate[];
+}>;
+/** Open a seal against every candidate. Null: no candidate opens it, so this was not the host that
+ *  knew the code, and nothing in it may be believed. */
+export declare function pakePhoneOpen(candidates: readonly PakeCandidate[], seal: unknown): Promise<unknown>;

package/node_modules/@waterplane/shared/dist/pake.js

@@ -0,0 +1,272 @@
+/**
+ * Pairing a phone over a network nobody trusts: CPace over ristretto255, keyed by the 8-character
+ * pairing code. The phone and the host both run THIS file, so there is one reading of every byte.
+ *
+ *   phone                                              host
+ *   sidP (16 random bytes), a
+ *   g  = H2C(lp(S), lp(sidP))                          S = SHA-256(utf8(code)), see below
+ *   Ya = a·g               ── start {sidP, ya} ──▶     for each code i it may offer (at most 5):
+ *                                                        b_i, Yb_i = b_i·g_i
+ *                          ◀── {nh, yb: [Yb_i]} ──
+ *   TH_i = SHA-512(lp(DST), lp(sidP), lp(nh), lp(Ya), lp(Yb_i))
+ *   Z_i  = a·Yb_i = b_i·Ya
+ *   K_phone, K_box, K_seal = HKDF-SHA256(ikm Z_i, salt TH_i, info = the label, 32 bytes each)
+ *   confirm_i = HMAC-SHA256(K_phone_i, TH_i)
+ *   box_i     = nonce96 ‖ AES-256-GCM(K_box_i, json, aad TH_i)
+ *                    ── finish {sidP, confirm, box} ──▶  one confirm of one code, or a miss
+ *                          ◀── {seal} ──                 nonce96 ‖ AES-256-GCM(K_seal, json, aad TH)
+ *
+ * The phone proves first, so a wrong guess is detected and counted by the host; the seal opening is
+ * what authenticates the host. A relay gets one online guess per attempt and learns nothing it can
+ * test offline: without the code it cannot compute g.
+ *
+ * **`S`, not the code itself.** The host keeps a code only as its SHA-256 (`PairStore`: no live
+ * credential sits in its memory as typed) and the generator depends on the phone's fresh `sidP`, so
+ * it cannot be worked out at mint time. Both ends therefore hash first. `S` is one-to-one with the
+ * code, so the password space and the guess count are the same as hashing the code directly.
+ *
+ * **Encodings.** `lp(x)` is a 4-byte big-endian length, then `x`. A code goes in as its normalized
+ * form (`normalizePairCode`). Every binary field on the wire is standard padded base64, decoded
+ * strictly (`pakeDecode`), so one value has one spelling.
+ *
+ * `@noble/curves` is loaded by dynamic import, so the phone's main chunk never carries it and it
+ * costs nothing until somebody pairs. HKDF, HMAC, AES-GCM and the hashes are WebCrypto, which node
+ * and the APK's WebView both have; a plain-http browser page does not, and `PakeFailure` says so.
+ */
+import { defaultRandomBytes } from "./hosts.js";
+/** The domain separator: frozen, and not the brand, because both ends of a pairing must agree on it
+ *  across a rename. */
+// eslint-disable-next-line local/no-brand-literal -- a wire constant, frozen across any rename
+export const PAKE_DST = "waterplane-cpace-v1";
+/** The most codes a host offers, and the most shares a phone will answer. */
+export const PAKE_MAX_OFFERS = 5;
+export const PAKE_SID_BYTES = 16;
+export const PAKE_NONCE_BYTES = 16;
+export const PAKE_POINT_BYTES = 32;
+export const PAKE_CONFIRM_BYTES = 32;
+export const PAKE_TH_BYTES = 64;
+const GCM_NONCE_BYTES = 12;
+const KEY_BYTES = 32;
+/** A value that cannot be used: a bad point, a malformed field, no WebCrypto. Never a wrong code. */
+export class PakeFailure extends Error {
+}
+const text = new TextEncoder();
+function subtle() {
+    const s = globalThis.crypto?.subtle;
+    if (!s)
+        throw new PakeFailure("This page has no WebCrypto, so it cannot pair securely. Open it over https or use the app.");
+    return s;
+}
+const own = (b) => new Uint8Array(b);
+/** `x` with its 4-byte big-endian length in front. */
+export function lp(x) {
+    const out = new Uint8Array(4 + x.length);
+    new DataView(out.buffer).setUint32(0, x.length);
+    out.set(x, 4);
+    return out;
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts) {
+        out.set(p, at);
+        at += p.length;
+    }
+    return out;
+}
+/** Standard padded base64. */
+export function pakeEncode(b) {
+    let s = "";
+    for (const c of b)
+        s += String.fromCharCode(c);
+    return btoa(s);
+}
+/** Strict base64: only the one spelling `pakeEncode` writes, optionally of exactly `len` bytes. */
+export function pakeDecode(raw, len) {
+    if (typeof raw !== "string" || !/^[A-Za-z0-9+/]*={0,2}$/.test(raw))
+        return null;
+    let bin;
+    try {
+        bin = atob(raw);
+    }
+    catch {
+        return null;
+    }
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    if (pakeEncode(out) !== raw)
+        return null;
+    return len === undefined || out.length === len ? out : null;
+}
+export async function sha256(b) {
+    return new Uint8Array(await subtle().digest("SHA-256", own(b)));
+}
+async function sha512(b) {
+    return new Uint8Array(await subtle().digest("SHA-512", own(b)));
+}
+let group = null;
+function ristretto() {
+    group ??= import("@noble/curves/ed25519.js").then(({ ristretto255, ristretto255_hasher }) => ({
+        fromBytes: (b) => ristretto255.Point.fromBytes(b),
+        hash: (msg) => ristretto255_hasher.hashToCurve(msg, { DST: text.encode(PAKE_DST) }),
+        order: ristretto255.Point.Fn.ORDER,
+    }));
+    return group;
+}
+/** A share off the wire: 32 bytes, a canonical encoding, never the identity. */
+async function decodeShare(b) {
+    if (b.length !== PAKE_POINT_BYTES)
+        throw new PakeFailure("A key share is the wrong length.");
+    const g = await ristretto();
+    let p;
+    try {
+        p = g.fromBytes(b);
+    }
+    catch {
+        throw new PakeFailure("A key share is not a canonical group element.");
+    }
+    if (p.is0())
+        throw new PakeFailure("A key share is the identity element.");
+    return p;
+}
+/** Whether `b` is a share `decodeShare` accepts. */
+export async function pakeShareOk(b) {
+    try {
+        await decodeShare(b);
+        return true;
+    }
+    catch (e) {
+        if (e instanceof PakeFailure)
+            return false;
+        throw e;
+    }
+}
+/** What goes in for the code: SHA-256 of its normalized form (the header says why). */
+export function pakeSecret(code) {
+    return sha256(text.encode(code));
+}
+async function randomScalar(rand) {
+    const { order } = await ristretto();
+    for (;;) {
+        // 512 bits reduced mod a 253-bit order: no bias worth naming.
+        let n = 0n;
+        for (const c of rand(64))
+            n = (n << 8n) | BigInt(c);
+        const s = n % order;
+        if (s !== 0n)
+            return s;
+    }
+}
+/** A fresh scalar and its share on the generator for `secret` and `sidP`. */
+export async function pakeShare(secret, sidP, rand = defaultRandomBytes) {
+    const g = await ristretto();
+    const scalar = await randomScalar(rand);
+    return { scalar, share: g.hash(concat(lp(secret), lp(sidP))).multiply(scalar).toBytes() };
+}
+/** `TH`: everything both ends must have seen alike. */
+export function pakeTranscript(sidP, nh, ya, yb) {
+    return sha512(concat(lp(text.encode(PAKE_DST)), lp(sidP), lp(nh), lp(ya), lp(yb)));
+}
+/** `Z`: my scalar on the peer's share. Throws on a bad share, and on an identity result. */
+export async function pakeSharedPoint(scalar, peerShare) {
+    const z = (await decodeShare(peerShare)).multiply(scalar);
+    if (z.is0())
+        throw new PakeFailure("The shared point is the identity element.");
+    return z.toBytes();
+}
+async function hkdf(z, th, label) {
+    const s = subtle();
+    const key = await s.importKey("raw", own(z), "HKDF", false, ["deriveBits"]);
+    return new Uint8Array(await s.deriveBits({ name: "HKDF", hash: "SHA-256", salt: own(th), info: text.encode(label) }, key, KEY_BYTES * 8));
+}
+export async function pakeKeys(z, th) {
+    const [kPhone, kBox, kSeal] = await Promise.all([hkdf(z, th, "K_phone"), hkdf(z, th, "K_box"), hkdf(z, th, "K_seal")]);
+    return { kPhone, kBox, kSeal };
+}
+/** `HMAC-SHA256(K_phone, TH)`: the phone's proof that it holds the code. */
+export async function pakeConfirm(kPhone, th) {
+    const s = subtle();
+    const key = await s.importKey("raw", own(kPhone), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await s.sign("HMAC", key, own(th)));
+}
+async function encryptJson(k, th, value, rand) {
+    const s = subtle();
+    const key = await s.importKey("raw", own(k), "AES-GCM", false, ["encrypt"]);
+    const iv = own(rand(GCM_NONCE_BYTES));
+    const ct = await s.encrypt({ name: "AES-GCM", iv, additionalData: own(th) }, key, own(text.encode(JSON.stringify(value))));
+    return pakeEncode(concat(iv, new Uint8Array(ct)));
+}
+/** The JSON inside, or null for anything that does not authenticate. */
+async function decryptJson(k, th, raw) {
+    const b = pakeDecode(raw);
+    if (!b || b.length <= GCM_NONCE_BYTES)
+        return null;
+    const s = subtle();
+    const key = await s.importKey("raw", own(k), "AES-GCM", false, ["decrypt"]);
+    try {
+        const pt = await s.decrypt({ name: "AES-GCM", iv: own(b.subarray(0, GCM_NONCE_BYTES)), additionalData: own(th) }, key, own(b.subarray(GCM_NONCE_BYTES)));
+        return JSON.parse(new TextDecoder().decode(pt));
+    }
+    catch {
+        return null;
+    }
+}
+/** The phone's words to the host: `{deviceName, presented}`, under `K_box`. */
+export const pakeBox = (kBox, th, value, rand = defaultRandomBytes) => encryptJson(kBox, th, value, rand);
+export const pakeOpenBox = (kBox, th, raw) => decryptJson(kBox, th, raw);
+/** The host's reply, under `K_seal`. A random 96-bit nonce, `TH` as the additional data. */
+export const pakeSeal = (kSeal, th, value, rand = defaultRandomBytes) => encryptJson(kSeal, th, value, rand);
+export const pakeOpenSeal = (kSeal, th, raw) => decryptJson(kSeal, th, raw);
+/** `secret`'s answer to a `start`. Throws `PakeFailure` on a bad `ya`. */
+export async function pakeHostOffer(secret, sidP, ya, nh, rand = defaultRandomBytes) {
+    const { scalar, share: yb } = await pakeShare(secret, sidP, rand);
+    const z = await pakeSharedPoint(scalar, ya);
+    const th = await pakeTranscript(sidP, nh, ya, yb);
+    const { kPhone, kBox, kSeal } = await pakeKeys(z, th);
+    return { yb, th, confirm: await pakeConfirm(kPhone, th), kBox, kSeal };
+}
+/** `code` is normalized (`normalizePairCode`). The state stays on the phone. */
+export async function pakePhoneStart(code, rand = defaultRandomBytes) {
+    const sidP = rand(PAKE_SID_BYTES);
+    const { scalar, share: ya } = await pakeShare(await pakeSecret(code), sidP, rand);
+    return { state: { sidP, ya, scalar }, request: { sidP: pakeEncode(sidP), ya: pakeEncode(ya) } };
+}
+/**
+ * Answer a `start` reply. Throws `PakeFailure` on more shares than a host may offer, on none, and on
+ * any bad share, because a host that sends one is not worth a guess. `box` is the words the host
+ * needs (`PakeBoxBody`), one copy per candidate.
+ */
+export async function pakePhoneFinish(state, reply, box, rand = defaultRandomBytes) {
+    const nh = pakeDecode(reply.nh, PAKE_NONCE_BYTES);
+    if (!nh)
+        throw new PakeFailure("The desktop's reply is malformed.");
+    if (!Array.isArray(reply.yb) || reply.yb.length === 0 || reply.yb.length > PAKE_MAX_OFFERS)
+        throw new PakeFailure("The desktop offered the wrong number of key shares.");
+    const confirm = [];
+    const boxes = [];
+    const candidates = [];
+    for (const raw of reply.yb) {
+        const yb = pakeDecode(raw, PAKE_POINT_BYTES);
+        if (!yb)
+            throw new PakeFailure("A key share is malformed.");
+        const z = await pakeSharedPoint(state.scalar, yb);
+        const th = await pakeTranscript(state.sidP, nh, state.ya, yb);
+        const { kPhone, kBox, kSeal } = await pakeKeys(z, th);
+        confirm.push(pakeEncode(await pakeConfirm(kPhone, th)));
+        boxes.push(await pakeBox(kBox, th, box, rand));
+        candidates.push({ kSeal, th });
+    }
+    return { request: { sidP: pakeEncode(state.sidP), confirm, box: boxes }, candidates };
+}
+/** Open a seal against every candidate. Null: no candidate opens it, so this was not the host that
+ *  knew the code, and nothing in it may be believed. */
+export async function pakePhoneOpen(candidates, seal) {
+    for (const c of candidates) {
+        const v = await pakeOpenSeal(c.kSeal, c.th, seal);
+        if (v !== null)
+            return v;
+    }
+    return null;
+}
+//# sourceMappingURL=pake.js.map