[interaction-code] New @aauth/interaction-code package

[dickhardt]

Purpose

Create a new @aauth/interaction-code package that implements the AAuth interaction code format as specified in draft-hardt-oauth-aauth-protocol §interaction-code-format.

Spec Requirements

• Alphabet: Crockford base32 — 0123456789ABCDEFGHJKMNPQRSTVWXYZ (omits visually ambiguous I, L, O, U)
• Entropy: ≥ 40 bits (≥ 8 symbols from a cryptographically secure source)
• Presentation: codes SHOULD be displayed with a grouping hyphen (e.g. A1B2-C3D4) for readability
• Comparison: case-insensitive; decode aliases I/L → 1, O → 0; strip hyphens before comparing

API

import { generate, match } from '@aauth/interaction-code'

// Generate a new code — returns uppercase Crockford32 with a presentational hyphen
const code = generate()  // e.g. "A1B2-C3D4"

// Compare a generated code against human-provided input — returns boolean
// Normalizes: strips hyphens, uppercases, folds I/L→1 and O→0
const ok = match(code, userInput)  // true even if user types "a1b2c3d4" or "A1B2C3O4"

Implementation Notes

• generate(): uses crypto.randomBytes(5) (40 bits), extracts 8 × 5-bit symbols, inserts one hyphen at position 4 for display (e.g. XXXX-XXXX)
• match(stored, provided): normalizes both sides with the Crockford aliases before strict equality — normalize(stored) === normalize(provided)
• Zero runtime dependencies
• ESM + CJS dual build, TypeScript types

Why a Package?

The Wallet server currently generates interaction codes with an incorrect alphabet (mixed-case, non-compliant). The agent SDK, resource SDK, and any future Person Server implementation all need the same logic. A shared package ensures spec compliance is implemented once.

Related

• AAuth spec §interaction-code-format
• AAuth issue #47 — act claim uses agent not sub
• Wallet issue: pending.js generateCode() needs to switch to this package