wire-mesh-core 4.1.2 → 4.1.3

package/dist/adapters/node-identity.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_ed25519_identity_key = require("../domain/ed25519-identity-key.cjs");
 const require_ports_identity = require("../ports/identity.cjs");
 let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
@@ -38,6 +39,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = require_domain_ed25519_identity_key.ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -54,7 +59,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -75,6 +80,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !require_domain_ed25519_identity_key.ed25519SignatureIsStrict(signature)) return false;
 	return node_crypto.webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.mjs

@@ -1,3 +1,4 @@
+import { ed25519KeyFault, ed25519SignatureIsStrict } from "../domain/ed25519-identity-key.mjs";
 import { IdentityKeyError } from "../ports/identity.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
@@ -37,6 +38,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -53,7 +58,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -74,6 +79,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !ed25519SignatureIsStrict(signature)) return false;
 	return webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/ed25519-identity-key.cjs

@@ -0,0 +1,152 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/ed25519-identity-key.ts
+/**
+* What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+*
+* A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+*/
+const BITS_PER_BYTE = 8;
+const THREE = 3;
+const FOUR = 4;
+const EIGHT = 8;
+const FIELD_BITS = 255;
+const PRIME_OFFSET = 19;
+const ORDER_BITS = 252;
+const PUBLIC_KEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+const BYTE_BITS = BigInt(BITS_PER_BYTE);
+const SIGN_BIT_BYTE = 31;
+const SIGN_BIT_MASK = 127;
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+/** The field prime, 2^255 - 19. */
+const FIELD_PRIME = (ONE << BigInt(FIELD_BITS)) - BigInt(PRIME_OFFSET);
+/** The order of the prime-order subgroup. */
+const GROUP_ORDER = (ONE << BigInt(ORDER_BITS)) + BigInt("27742317777372353535851937790883648493");
+/** The curve constant d = -121665 / 121666, as a field element. */
+const CURVE_D = BigInt("37095705934669439343138083508754565189542113879843219016388785533085940283555");
+/**
+* The y coordinates of the eight small-order points: 0 (two points of order 4), 1 (the identity element), -1 (order 2) and the two pairs of order 8. Both signs of x share each y, so a key is small-order exactly when its y is one of these, whatever its sign bit.
+*/
+const SMALL_ORDER_Y = new Set([
+	"0",
+	"1",
+	"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
+	"5fc536d880238b13933c6d305acdfd5f098eff289f4c345b027b2c28f95e826",
+	"7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7"
+].map((hex) => BigInt(`0x${hex}`)));
+function littleEndian(bytes) {
+	let value = ZERO;
+	for (let index = bytes.length - 1; index >= 0; index -= 1) value = value << BYTE_BITS | BigInt(bytes[index] ?? 0);
+	return value;
+}
+/** The y coordinate an encoding carries: the 255 low bits, with the sign bit of x cleared. */
+function encodedY(encoding) {
+	const bytes = Uint8Array.from(encoding);
+	bytes[SIGN_BIT_BYTE] = (bytes[SIGN_BIT_BYTE] ?? 0) & SIGN_BIT_MASK;
+	return littleEndian(bytes);
+}
+function modPow(base, exponent) {
+	let result = ONE;
+	let factor = base % FIELD_PRIME;
+	let remaining = exponent;
+	while (remaining > ZERO) {
+		if ((remaining & ONE) === ONE) result = result * factor % FIELD_PRIME;
+		factor = factor * factor % FIELD_PRIME;
+		remaining >>= ONE;
+	}
+	return result;
+}
+function mod(value) {
+	const reduced = value % FIELD_PRIME;
+	return reduced >= ZERO ? reduced : reduced + FIELD_PRIME;
+}
+/** sqrt(-1) modulo the prime: 2^((p - 1) / 4). */
+const SQRT_MINUS_ONE = modPow(TWO, (FIELD_PRIME - ONE) / BigInt(FOUR));
+/** A point with the given y, with either sign of x (negating a point preserves its order, so the sign does not matter to a subgroup test), or `undefined` when no point has that y. */
+function pointWithY(y) {
+	const ySquared = mod(y * y);
+	const target = mod(mod(ySquared - ONE) * modPow(mod(CURVE_D * ySquared + ONE), FIELD_PRIME - TWO));
+	const candidate = modPow(target, (FIELD_PRIME + BigInt(THREE)) / BigInt(EIGHT));
+	for (const x of [candidate, mod(candidate * SQRT_MINUS_ONE)]) if (mod(x * x) === target) return {
+		x,
+		y,
+		z: ONE,
+		t: mod(x * y)
+	};
+}
+/** The sum of two points: the unified, complete addition of Hisil, Wong, Carter and Dawson for a = -1, which doubles as the doubling. */
+function addPoints(p, q) {
+	const a = mod((p.y - p.x) * (q.y - q.x));
+	const b = mod((p.y + p.x) * (q.y + q.x));
+	const c = mod(p.t * TWO * CURVE_D * q.t);
+	const d = mod(p.z * TWO * q.z);
+	const e = b - a;
+	const f = d - c;
+	const g = d + c;
+	const h = b + a;
+	return {
+		x: mod(e * f),
+		y: mod(g * h),
+		z: mod(f * g),
+		t: mod(e * h)
+	};
+}
+const IDENTITY_POINT = {
+	x: ZERO,
+	y: ONE,
+	z: ONE,
+	t: ZERO
+};
+/** Whether the point is in the prime-order subgroup: multiplying it by the group order gives the identity element. The point and the order are public, so the double-and-add loop leaks nothing. It costs one doubling per bit of the order below the top (252) and one addition per set bit below the top (72), each a handful of field multiplications, once per distinct key. */
+function isTorsionFree(point) {
+	let result = IDENTITY_POINT;
+	for (let bit = ORDER_BITS; bit >= 0; bit -= 1) {
+		result = addPoints(result, result);
+		if ((GROUP_ORDER >> BigInt(bit) & ONE) === ONE) result = addPoints(result, point);
+	}
+	return result.x === ZERO && result.y === result.z;
+}
+/** How many key verdicts are remembered, so a key that signs many messages is checked for torsion once and a flood of distinct keys cannot grow the memory without bound. */
+const VERDICT_CAPACITY = 1024;
+const verdicts = /* @__PURE__ */ new Map();
+function keyFaultUncached(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const y = encodedY(publicKey);
+	if (y >= FIELD_PRIME) return "non_canonical";
+	const point = pointWithY(y);
+	if (point === void 0) return "not_a_point";
+	if (SMALL_ORDER_Y.has(y)) return "small_order";
+	return isTorsionFree(point) ? void 0 : "mixed_order";
+}
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+function ed25519KeyFault(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const id = require_domain_device_id.bytesToHex(publicKey);
+	if (verdicts.has(id)) {
+		const held = verdicts.get(id);
+		verdicts.delete(id);
+		verdicts.set(id, held);
+		return held;
+	}
+	const fault = keyFaultUncached(publicKey);
+	verdicts.set(id, fault);
+	for (const oldest of verdicts.keys()) {
+		if (verdicts.size <= VERDICT_CAPACITY) break;
+		verdicts.delete(oldest);
+	}
+	return fault;
+}
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+function ed25519SignatureIsStrict(signature) {
+	if (signature.length !== SIGNATURE_BYTES) return false;
+	const r = signature.subarray(0, PUBLIC_KEY_BYTES);
+	const s = signature.subarray(PUBLIC_KEY_BYTES);
+	const rY = encodedY(r);
+	return littleEndian(s) < GROUP_ORDER && rY < FIELD_PRIME && !SMALL_ORDER_Y.has(rY);
+}
+//#endregion
+exports.ed25519KeyFault = ed25519KeyFault;
+exports.ed25519SignatureIsStrict = ed25519SignatureIsStrict;

package/dist/domain/ed25519-identity-key.d.cts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion

package/dist/domain/ed25519-identity-key.d.mts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion

package/dist/domain/ed25519-identity-key.mjs

@@ -0,0 +1,150 @@
+import { bytesToHex } from "./device-id.mjs";
+//#region src/domain/ed25519-identity-key.ts
+/**
+* What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+*
+* A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+*/
+const BITS_PER_BYTE = 8;
+const THREE = 3;
+const FOUR = 4;
+const EIGHT = 8;
+const FIELD_BITS = 255;
+const PRIME_OFFSET = 19;
+const ORDER_BITS = 252;
+const PUBLIC_KEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+const BYTE_BITS = BigInt(BITS_PER_BYTE);
+const SIGN_BIT_BYTE = 31;
+const SIGN_BIT_MASK = 127;
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+/** The field prime, 2^255 - 19. */
+const FIELD_PRIME = (ONE << BigInt(FIELD_BITS)) - BigInt(PRIME_OFFSET);
+/** The order of the prime-order subgroup. */
+const GROUP_ORDER = (ONE << BigInt(ORDER_BITS)) + BigInt("27742317777372353535851937790883648493");
+/** The curve constant d = -121665 / 121666, as a field element. */
+const CURVE_D = BigInt("37095705934669439343138083508754565189542113879843219016388785533085940283555");
+/**
+* The y coordinates of the eight small-order points: 0 (two points of order 4), 1 (the identity element), -1 (order 2) and the two pairs of order 8. Both signs of x share each y, so a key is small-order exactly when its y is one of these, whatever its sign bit.
+*/
+const SMALL_ORDER_Y = new Set([
+	"0",
+	"1",
+	"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
+	"5fc536d880238b13933c6d305acdfd5f098eff289f4c345b027b2c28f95e826",
+	"7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7"
+].map((hex) => BigInt(`0x${hex}`)));
+function littleEndian(bytes) {
+	let value = ZERO;
+	for (let index = bytes.length - 1; index >= 0; index -= 1) value = value << BYTE_BITS | BigInt(bytes[index] ?? 0);
+	return value;
+}
+/** The y coordinate an encoding carries: the 255 low bits, with the sign bit of x cleared. */
+function encodedY(encoding) {
+	const bytes = Uint8Array.from(encoding);
+	bytes[SIGN_BIT_BYTE] = (bytes[SIGN_BIT_BYTE] ?? 0) & SIGN_BIT_MASK;
+	return littleEndian(bytes);
+}
+function modPow(base, exponent) {
+	let result = ONE;
+	let factor = base % FIELD_PRIME;
+	let remaining = exponent;
+	while (remaining > ZERO) {
+		if ((remaining & ONE) === ONE) result = result * factor % FIELD_PRIME;
+		factor = factor * factor % FIELD_PRIME;
+		remaining >>= ONE;
+	}
+	return result;
+}
+function mod(value) {
+	const reduced = value % FIELD_PRIME;
+	return reduced >= ZERO ? reduced : reduced + FIELD_PRIME;
+}
+/** sqrt(-1) modulo the prime: 2^((p - 1) / 4). */
+const SQRT_MINUS_ONE = modPow(TWO, (FIELD_PRIME - ONE) / BigInt(FOUR));
+/** A point with the given y, with either sign of x (negating a point preserves its order, so the sign does not matter to a subgroup test), or `undefined` when no point has that y. */
+function pointWithY(y) {
+	const ySquared = mod(y * y);
+	const target = mod(mod(ySquared - ONE) * modPow(mod(CURVE_D * ySquared + ONE), FIELD_PRIME - TWO));
+	const candidate = modPow(target, (FIELD_PRIME + BigInt(THREE)) / BigInt(EIGHT));
+	for (const x of [candidate, mod(candidate * SQRT_MINUS_ONE)]) if (mod(x * x) === target) return {
+		x,
+		y,
+		z: ONE,
+		t: mod(x * y)
+	};
+}
+/** The sum of two points: the unified, complete addition of Hisil, Wong, Carter and Dawson for a = -1, which doubles as the doubling. */
+function addPoints(p, q) {
+	const a = mod((p.y - p.x) * (q.y - q.x));
+	const b = mod((p.y + p.x) * (q.y + q.x));
+	const c = mod(p.t * TWO * CURVE_D * q.t);
+	const d = mod(p.z * TWO * q.z);
+	const e = b - a;
+	const f = d - c;
+	const g = d + c;
+	const h = b + a;
+	return {
+		x: mod(e * f),
+		y: mod(g * h),
+		z: mod(f * g),
+		t: mod(e * h)
+	};
+}
+const IDENTITY_POINT = {
+	x: ZERO,
+	y: ONE,
+	z: ONE,
+	t: ZERO
+};
+/** Whether the point is in the prime-order subgroup: multiplying it by the group order gives the identity element. The point and the order are public, so the double-and-add loop leaks nothing. It costs one doubling per bit of the order below the top (252) and one addition per set bit below the top (72), each a handful of field multiplications, once per distinct key. */
+function isTorsionFree(point) {
+	let result = IDENTITY_POINT;
+	for (let bit = ORDER_BITS; bit >= 0; bit -= 1) {
+		result = addPoints(result, result);
+		if ((GROUP_ORDER >> BigInt(bit) & ONE) === ONE) result = addPoints(result, point);
+	}
+	return result.x === ZERO && result.y === result.z;
+}
+/** How many key verdicts are remembered, so a key that signs many messages is checked for torsion once and a flood of distinct keys cannot grow the memory without bound. */
+const VERDICT_CAPACITY = 1024;
+const verdicts = /* @__PURE__ */ new Map();
+function keyFaultUncached(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const y = encodedY(publicKey);
+	if (y >= FIELD_PRIME) return "non_canonical";
+	const point = pointWithY(y);
+	if (point === void 0) return "not_a_point";
+	if (SMALL_ORDER_Y.has(y)) return "small_order";
+	return isTorsionFree(point) ? void 0 : "mixed_order";
+}
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+function ed25519KeyFault(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const id = bytesToHex(publicKey);
+	if (verdicts.has(id)) {
+		const held = verdicts.get(id);
+		verdicts.delete(id);
+		verdicts.set(id, held);
+		return held;
+	}
+	const fault = keyFaultUncached(publicKey);
+	verdicts.set(id, fault);
+	for (const oldest of verdicts.keys()) {
+		if (verdicts.size <= VERDICT_CAPACITY) break;
+		verdicts.delete(oldest);
+	}
+	return fault;
+}
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+function ed25519SignatureIsStrict(signature) {
+	if (signature.length !== SIGNATURE_BYTES) return false;
+	const r = signature.subarray(0, PUBLIC_KEY_BYTES);
+	const s = signature.subarray(PUBLIC_KEY_BYTES);
+	const rY = encodedY(r);
+	return littleEndian(s) < GROUP_ORDER && rY < FIELD_PRIME && !SMALL_ORDER_Y.has(rY);
+}
+//#endregion
+export { ed25519KeyFault, ed25519SignatureIsStrict };

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
-const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.mjs

@@ -1,6 +1,6 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
-import { IdentityKeyError } from "../ports/identity.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";

package/dist/domain/notice-board.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";

package/dist/domain/notice-board.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/room-rekey.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/room-rekey.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/room.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_group_key = require("./group-key.cjs");
 const require_domain_room_token_verification = require("./room-token-verification.cjs");
 let cbor2 = require("cbor2");
@@ -79,7 +80,7 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "wrong_room"
 	};
-	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/room.d.cts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";

package/dist/domain/room.d.mts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";

package/dist/domain/room.mjs

@@ -1,4 +1,5 @@
 import { roomNoticeClaimsSchema } from "../generated/protocol.mjs";
+import { verifiesOrRefuses } from "../ports/identity.mjs";
 import { isEncryptedContentType } from "./group-key.mjs";
 import { verifyRoomToken } from "./room-token-verification.mjs";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
@@ -78,7 +79,7 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "wrong_room"
 	};
-	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/tokens.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_sequential = require("../sequential-CtQVlW8M.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_domain_token_predicates = require("./token-predicates.cjs");
@@ -118,7 +119,7 @@ async function verifyTokenChain(token, options, { subjectClaims, depth, seen } =
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};
@@ -299,7 +300,7 @@ async function verifyRevocationEntry(entry, options) {
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/tokens.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-lg4TtUxm.cjs";
 import { PredicateNode } from "trilean";

package/dist/domain/tokens.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-CrieP1WI.mjs";
 import { PredicateNode } from "trilean";

package/dist/domain/tokens.mjs

@@ -1,5 +1,6 @@
 import { capabilityTokenSchema, capabilityVerbSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { verifiesOrRefuses } from "../ports/identity.mjs";
 import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
 import { conditionsListSchema, evaluateConditions, evaluateNarrowing } from "./token-predicates.mjs";
@@ -117,7 +118,7 @@ async function verifyTokenChain(token, options, { subjectClaims, depth, seen } =
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};
@@ -298,7 +299,7 @@ async function verifyRevocationEntry(entry, options) {
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/{identity-C5jq53NV.d.cts → identity-CthkHRzB.d.cts}

@@ -9,6 +9,8 @@ declare class IdentityKeyError extends Error {
     cause: unknown;
   }>);
 }
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+declare function verifiesOrRefuses(identity: Readonly<Pick<IdentityPort, "verify">>, key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -25,4 +27,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };
+export { verifiesOrRefuses as i, IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/{identity-BioGOV9M.d.mts → identity-zLL5kQGJ.d.mts}

@@ -9,6 +9,8 @@ declare class IdentityKeyError extends Error {
     cause: unknown;
   }>);
 }
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+declare function verifiesOrRefuses(identity: Readonly<Pick<IdentityPort, "verify">>, key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -25,4 +27,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };
+export { verifiesOrRefuses as i, IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/ports/identity.cjs

@@ -9,5 +9,15 @@ var IdentityKeyError = class extends Error {
 		this.fault = fault;
 	}
 };
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+async function verifiesOrRefuses(identity, key, message, signature) {
+	try {
+		return await identity.verify(key, message, signature);
+	} catch (error) {
+		if (error instanceof IdentityKeyError) return false;
+		throw error;
+	}
+}
 //#endregion
 exports.IdentityKeyError = IdentityKeyError;
+exports.verifiesOrRefuses = verifiesOrRefuses;

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-C5jq53NV.cjs";
-export { IdentityKeyError, IdentityKeyFault, IdentityPort };
+import { i as verifiesOrRefuses, n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-CthkHRzB.cjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort, verifiesOrRefuses };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-BioGOV9M.mjs";
-export { IdentityKeyError, IdentityKeyFault, IdentityPort };
+import { i as verifiesOrRefuses, n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-zLL5kQGJ.mjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort, verifiesOrRefuses };

package/dist/ports/identity.mjs

@@ -8,5 +8,14 @@ var IdentityKeyError = class extends Error {
 		this.fault = fault;
 	}
 };
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+async function verifiesOrRefuses(identity, key, message, signature) {
+	try {
+		return await identity.verify(key, message, signature);
+	} catch (error) {
+		if (error instanceof IdentityKeyError) return false;
+		throw error;
+	}
+}
 //#endregion
-export { IdentityKeyError };
+export { IdentityKeyError, verifiesOrRefuses };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -106,6 +106,10 @@
       "import": "./dist/domain/direct-manage-request.mjs",
       "require": "./dist/domain/direct-manage-request.cjs"
     },
+    "./domain/ed25519-identity-key": {
+      "import": "./dist/domain/ed25519-identity-key.mjs",
+      "require": "./dist/domain/ed25519-identity-key.cjs"
+    },
     "./domain/erasure-coding": {
       "import": "./dist/domain/erasure-coding.mjs",
       "require": "./dist/domain/erasure-coding.cjs"