@interop/http-digest-header 2.3.2 → 3.1.0

package/README.md

@@ -1,8 +1,10 @@
 # HTTP Digest Header Library _(@interop/http-digest-header)_
 
-[![Node.js CI](https://github.com/interop-alliance/http-digest-header/actions/workflows/main.yml/badge.svg)](https://github.com/interop-alliance/http-digest-header/actions/workflows/main.yml)
+[![Node.js CI](https://github.com/interop-alliance/http-digest-header/workflows/CI/badge.svg)](https://github.com/interop-alliance/http-digest-header/actions?query=workflow%3A%22CI%22)
+[![CI](https://github.com/interop-alliance/http-digest-header/actions/workflows/ci.yml/badge.svg)](https://github.com/interop-alliance/http-digest-header/actions/workflows/ci.yml)
 
-> JavaScript library (Node.js, browser and React Native) for creating and verifying Digest headers for HTTP Signatures
+> JavaScript library (Node.js, browser and React Native) for creating and
+> verifying Digest headers for HTTP Signatures
 
 ## Table of Contents
 
@@ -16,12 +18,14 @@
 ## Background
 
 **FORKED FROM**: https://github.com/digitalbazaar/http-digest-header to provide
-support for React Native, and add TypeScript types.
+support for React Native and add TypeScript types.
 
-* For React Native use: Peer dependency `crypto-expo` is required. 
+- For React Native use: the `expo-crypto` peer dependency is required (see
+  [Usage in React Native](#usage-in-react-native)).
 
 Originally, this library was implemented based on the `Digest` header as
-mentioned in **[HTTP Signatures IETF draft](https://tools.ietf.org/html/draft-cavage-http-signatures)**.
+mentioned in
+**[HTTP Signatures IETF draft](https://tools.ietf.org/html/draft-cavage-http-signatures)**.
 
 Since then, the `Digest` header got its own standards-track spec, at
 https://tools.ietf.org/html/draft-ietf-httpbis-digest-headers.
@@ -34,7 +38,7 @@ with Node.js).
 
 ## Install
 
-- Browsers and Node.js 22+ supported.
+- Browsers and Node.js 24+ supported.
 - [Web Crypto API][] required. Older browsers and Node.js 14 must use a
   polyfill.
 
@@ -49,29 +53,55 @@ To install locally (for development):
 ```
 git clone https://github.com/interop-alliance/http-digest-header.git
 cd http-digest-header
-npm install
+pnpm install
 ```
 
 ## Usage
 
 ```js
-import * as httpDigest from '@interop/http-digest-header';
+import * as httpDigest from '@interop/http-digest-header'
 
-const data = `{"hello": "world"}`;
+const data = `{"hello": "world"}`
 
-const headerValue = await httpDigest.
-    createHeaderValue({data, algorithm: 'sha256', useMultihash: false});
+const headerValue = await httpDigest.createHeaderValue({
+  data,
+  algorithm: 'sha256',
+  useMultihash: false
+})
 // -> SHA-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE=
 
-const dataToVerify1 = `{"hello": "world"}`;
-const dataToVerify2 = `{"hello": "planet earth"}`;
+const dataToVerify1 = `{"hello": "world"}`
+const dataToVerify2 = `{"hello": "planet earth"}`
 
-const verifyResult = await httpDigest.verifyHeaderValue({data: dataToVerify1, headerValue});
+const verifyResult = await httpDigest.verifyHeaderValue({
+  data: dataToVerify1,
+  headerValue
+})
 // -> { verified: true }
-const verifyResult = await httpDigest.verifyHeaderValue({data: dataToVerify2, headerValue});
+const verifyResult = await httpDigest.verifyHeaderValue({
+  data: dataToVerify2,
+  headerValue
+})
 // -> { verified: false }
 ```
 
+### Usage in React Native
+
+In React Native, this library's `react-native` export resolves the digest
+implementation to one backed by
+[`expo-crypto`](https://docs.expo.dev/versions/latest/sdk/crypto/) (it imports
+`expo-crypto` directly -- no `crypto.subtle` polyfill or global shim required).
+
+`expo-crypto` is declared as an (optional) peer dependency, so just make sure it
+is installed in your app:
+
+```
+npx expo install expo-crypto
+```
+
+If `expo-crypto` is missing, `createHeaderValue` / `verifyHeaderValue` will fail
+to resolve their digest dependency at bundle time.
+
 ## Contribute
 
 Please follow the existing code style.
@@ -83,11 +113,12 @@ If editing the Readme, please conform to the
 
 ## Commercial Support
 
-Commercial support for this library is available upon request from
-Digital Bazaar: support@digitalbazaar.com
+Commercial support for this library is available upon request from Digital
+Bazaar: support@digitalbazaar.com
 
 ## License
 
 [BSD-3-Clause](LICENSE.md) © 2019-2025 Digital Bazaar
 
-[Web Crypto API]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API
+[Web Crypto API]:
+  https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API

package/dist/digest-reactnative.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256(data: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+//# sourceMappingURL=digest-reactnative.d.ts.map

package/dist/digest-reactnative.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-reactnative.d.ts","sourceRoot":"","sources":["../src/digest-reactnative.ts"],"names":[],"mappings":"AAKA,wBAAsB,MAAM,CAC1B,IAAI,EAAE,UAAU,GAAG,WAAW,GAC7B,OAAO,CAAC,UAAU,CAAC,CAOrB"}

package/{lib → dist}/digest-reactnative.js

@@ -2,8 +2,7 @@
  * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
  */
 import * as Crypto from 'expo-crypto';
-
 export async function sha256(data) {
-  return new Uint8Array(
-    await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, data));
+    return new Uint8Array(await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, data));
 }
+//# sourceMappingURL=digest-reactnative.js.map

package/dist/digest-reactnative.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest-reactnative.js","sourceRoot":"","sources":["../src/digest-reactnative.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAErC,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAA8B;IAE9B,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CACjB,MAAM,CAAC,qBAAqB,CAAC,MAAM,EACnC,IAAoB,CACrB,CACF,CAAA;AACH,CAAC"}

package/dist/digest.d.ts

@@ -0,0 +1,2 @@
+export declare function sha256(data: Uint8Array | ArrayBuffer): Promise<Uint8Array>;
+//# sourceMappingURL=digest.d.ts.map

package/dist/digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAKA,wBAAsB,MAAM,CAC1B,IAAI,EAAE,UAAU,GAAG,WAAW,GAC7B,OAAO,CAAC,UAAU,CAAC,CAIrB"}

package/dist/digest.js

@@ -0,0 +1,8 @@
+/*!
+ * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+const { crypto } = globalThis;
+export async function sha256(data) {
+    return new Uint8Array(await crypto.subtle.digest({ name: 'SHA-256' }, data));
+}
+//# sourceMappingURL=digest.js.map

package/dist/digest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"digest.js","sourceRoot":"","sources":["../src/digest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,EAAE,MAAM,EAAE,GAAG,UAAU,CAAA;AAE7B,MAAM,CAAC,KAAK,UAAU,MAAM,CAC1B,IAA8B;IAE9B,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAoB,CAAC,CACtE,CAAA;AACH,CAAC"}

package/dist/httpDigest.d.ts

@@ -0,0 +1,58 @@
+type DigestData = string | object | Blob | Uint8Array;
+/**
+ * Creates a value suitable for the HTTP `Digest` header.
+ *
+ * @param options - The options to use.
+ * @param options.data - The data to be hashed (a request or response body).
+ * @param options.algorithm - Hash algorithm to use (e.g. 'sha256').
+ * @param options.useMultihash - Whether to encode via multihash; if false, the
+ *   hash will be base64-encoded (non-url).
+ *
+ * @returns Resolves to `Digest` header value.
+ */
+export declare function createHeaderValue({ data, algorithm, useMultihash }?: {
+    data?: DigestData;
+    algorithm?: string;
+    useMultihash?: boolean;
+}): Promise<string>;
+/**
+ * Verifies the HTTP `Digest` header value against the given HTTP body `data`.
+ *
+ * @param options - The options to use.
+ * @param options.data - The data to be verified (a request or response body).
+ * @param options.headerValue - The digest header value to verify the data
+ *   against.
+ *
+ * @returns Resolves to the verification result.
+ */
+export declare function verifyHeaderValue({ data, headerValue }: {
+    data: DigestData;
+    headerValue: string;
+}): Promise<{
+    verified: boolean;
+    error?: Error;
+}>;
+/**
+ * Verifies an already-computed body digest against an HTTP `Digest` header
+ * value. For callers that hash a body incrementally (e.g. while streaming it)
+ * and hold only the resulting raw digest bytes rather than the body itself --
+ * `verifyHeaderValue` covers the have-the-body case. Supports the same header
+ * forms as the rest of this library: the multihash form (`mh=u...`) and the
+ * base64 `SHA-256=...` form (optionally colon-wrapped per RFC 9651).
+ *
+ * @param options - The options to use.
+ * @param options.digest - The raw digest bytes (a 32-byte SHA-256 digest).
+ * @param options.headerValue - The digest header value to verify against.
+ *
+ * @returns The verification result; `error` is set when the header is
+ *   malformed or uses an unsupported algorithm.
+ */
+export declare function verifyDigest({ digest, headerValue }: {
+    digest: Uint8Array;
+    headerValue: string;
+}): {
+    verified: boolean;
+    error?: Error;
+};
+export {};
+//# sourceMappingURL=httpDigest.d.ts.map

package/dist/httpDigest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpDigest.d.ts","sourceRoot":"","sources":["../src/httpDigest.ts"],"names":[],"mappings":"AAMA,KAAK,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA;AAErD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,SAAoB,EACpB,YAAmB,EACpB,GAAE;IACD,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,OAAO,CAAA;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAOvB;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,IAAI,EACJ,WAAW,EACZ,EAAE;IACD,IAAI,EAAE,UAAU,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,CAahD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,YAAY,CAAC,EAC3B,MAAM,EACN,WAAW,EACZ,EAAE;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAE,CASvC"}

package/dist/httpDigest.js

@@ -0,0 +1,145 @@
+/*!
+ * Copyright (c) 2019-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+import { base64Encode, base64urlEncode } from './util.js';
+import { sha256 } from './digest.js';
+/**
+ * Creates a value suitable for the HTTP `Digest` header.
+ *
+ * @param options - The options to use.
+ * @param options.data - The data to be hashed (a request or response body).
+ * @param options.algorithm - Hash algorithm to use (e.g. 'sha256').
+ * @param options.useMultihash - Whether to encode via multihash; if false, the
+ *   hash will be base64-encoded (non-url).
+ *
+ * @returns Resolves to `Digest` header value.
+ */
+export async function createHeaderValue({ data, algorithm = 'sha256', useMultihash = true } = {}) {
+    const { key, encodedDigest } = await _createHeaderValueComponents({
+        data,
+        algorithm,
+        useMultihash
+    });
+    return `${key}=${encodedDigest}`;
+}
+/**
+ * Verifies the HTTP `Digest` header value against the given HTTP body `data`.
+ *
+ * @param options - The options to use.
+ * @param options.data - The data to be verified (a request or response body).
+ * @param options.headerValue - The digest header value to verify the data
+ *   against.
+ *
+ * @returns Resolves to the verification result.
+ */
+export async function verifyHeaderValue({ data, headerValue }) {
+    try {
+        const { key, algorithm, encodedDigest } = _parseHeaderValue(headerValue);
+        const { encodedDigest: expectedDigest } = await _createHeaderValueComponents({
+            data,
+            algorithm,
+            useMultihash: key === 'mh'
+        });
+        return { verified: encodedDigest === expectedDigest };
+    }
+    catch (error) {
+        return { verified: false, error: error };
+    }
+}
+/**
+ * Verifies an already-computed body digest against an HTTP `Digest` header
+ * value. For callers that hash a body incrementally (e.g. while streaming it)
+ * and hold only the resulting raw digest bytes rather than the body itself --
+ * `verifyHeaderValue` covers the have-the-body case. Supports the same header
+ * forms as the rest of this library: the multihash form (`mh=u...`) and the
+ * base64 `SHA-256=...` form (optionally colon-wrapped per RFC 9651).
+ *
+ * @param options - The options to use.
+ * @param options.digest - The raw digest bytes (a 32-byte SHA-256 digest).
+ * @param options.headerValue - The digest header value to verify against.
+ *
+ * @returns The verification result; `error` is set when the header is
+ *   malformed or uses an unsupported algorithm.
+ */
+export function verifyDigest({ digest, headerValue }) {
+    try {
+        const { key, encodedDigest } = _parseHeaderValue(headerValue);
+        const expectedDigest = key === 'mh' ? _createMultihash({ digest }) : base64Encode(digest);
+        return { verified: encodedDigest === expectedDigest };
+    }
+    catch (error) {
+        return { verified: false, error: error };
+    }
+}
+async function _createHeaderValueComponents({ data, algorithm = 'sha256', useMultihash = true }) {
+    if (algorithm !== 'sha256') {
+        throw new Error(`Algorithm "${algorithm}" is not supported.`);
+    }
+    const digest = await _getDigest({ data, algorithm });
+    if (useMultihash) {
+        return { key: 'mh', encodedDigest: _createMultihash({ digest }) };
+    }
+    return { key: 'SHA-256', encodedDigest: base64Encode(digest) };
+}
+function _createMultihash({ digest }) {
+    // format as multihash digest
+    // sha2-256: 0x12, length: 32 (0x20), digest value
+    const mh = new Uint8Array(34);
+    mh[0] = 0x12;
+    mh[1] = 0x20;
+    mh.set(digest, 2);
+    // encode multihash using multibase, base64url: `u`
+    return `u${base64urlEncode(mh)}`;
+}
+function _parseHeaderValue(headerValue) {
+    // `String.prototype.split` always yields at least the part before the first
+    // `=` at index 0, so `key` is always a string; `digestValue` may be absent.
+    const [key = '', digestValue] = headerValue.split(/=(.+)/);
+    let encodedDigest;
+    let algorithm;
+    if (key === 'mh') {
+        if (digestValue === undefined) {
+            throw new Error(`Only base64url-encoded, sha-256 multihash is supported.`);
+        }
+        encodedDigest = digestValue;
+        // if `encodedDigest` starts with `uEi`, then it is a base64url-encoded
+        // sha-256 multihash
+        if (encodedDigest.startsWith('uEi')) {
+            algorithm = 'sha256';
+        }
+        else {
+            throw new Error(`Only base64url-encoded, sha-256 multihash is supported.`);
+        }
+    }
+    else {
+        // per RFC 9651, the digest value could be a structured field value,
+        // expressed as a base64-encoded byte array wrapped in colons
+        encodedDigest = digestValue?.replace(/^:(.*):$/, '$1');
+        algorithm = key.replace('-', '').toLowerCase();
+        if (algorithm !== 'sha256') {
+            throw new Error(`Algorithm "${algorithm}" is not supported.`);
+        }
+    }
+    return { key, algorithm, encodedDigest };
+}
+async function _getDigest({ data, algorithm }) {
+    const normalized = await _normalizeData(data);
+    if (algorithm === 'sha256') {
+        return sha256(normalized);
+    }
+    throw new Error(`Algorithm "${algorithm}" is not unsupported.`);
+}
+// normalize all inputs to a `Uint8Array` for hashing
+async function _normalizeData(data) {
+    if (data instanceof Uint8Array) {
+        return data;
+    }
+    if (data instanceof Blob) {
+        // `Blob.bytes()` is only available in node.js 22+;
+        // fallback to `Blob.arrayBuffer()`
+        return data.bytes?.() ?? data.arrayBuffer();
+    }
+    const str = typeof data === 'string' ? data : JSON.stringify(data);
+    return new TextEncoder().encode(str);
+}
+//# sourceMappingURL=httpDigest.js.map

package/dist/httpDigest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpDigest.js","sourceRoot":"","sources":["../src/httpDigest.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,SAAS,GAAG,QAAQ,EACpB,YAAY,GAAG,IAAI,KAKjB,EAAE;IACJ,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,MAAM,4BAA4B,CAAC;QAChE,IAAI;QACJ,SAAS;QACT,YAAY;KACb,CAAC,CAAA;IACF,OAAO,GAAG,GAAG,IAAI,aAAa,EAAE,CAAA;AAClC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,IAAI,EACJ,WAAW,EAIZ;IACC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACxE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GACrC,MAAM,4BAA4B,CAAC;YACjC,IAAI;YACJ,SAAS;YACT,YAAY,EAAE,GAAG,KAAK,IAAI;SAC3B,CAAC,CAAA;QACJ,OAAO,EAAE,QAAQ,EAAE,aAAa,KAAK,cAAc,EAAE,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAc,EAAE,CAAA;IACnD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,EAC3B,MAAM,EACN,WAAW,EAIZ;IACC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;QAC7D,MAAM,cAAc,GAClB,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;QACpE,OAAO,EAAE,QAAQ,EAAE,aAAa,KAAK,cAAc,EAAE,CAAA;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,KAAc,EAAE,CAAA;IACnD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,EAC1C,IAAI,EACJ,SAAS,GAAG,QAAQ,EACpB,YAAY,GAAG,IAAI,EAKpB;IACC,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,qBAAqB,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAA;IACnE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,CAAA;AAChE,CAAC;AAED,SAAS,gBAAgB,CAAC,EAAE,MAAM,EAA0B;IAC1D,6BAA6B;IAC7B,kDAAkD;IAClD,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC7B,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACZ,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;IACZ,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACjB,mDAAmD;IACnD,OAAO,IAAI,eAAe,CAAC,EAAE,CAAC,EAAE,CAAA;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAK5C,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,GAAG,GAAG,EAAE,EAAE,WAAW,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAE1D,IAAI,aAAiC,CAAA;IACrC,IAAI,SAAiB,CAAA;IACrB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC5E,CAAC;QACD,aAAa,GAAG,WAAW,CAAA;QAE3B,uEAAuE;QACvE,oBAAoB;QACpB,IAAI,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,SAAS,GAAG,QAAQ,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAA;QAC5E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,oEAAoE;QACpE,6DAA6D;QAC7D,aAAa,GAAG,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAEtD,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC9C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,qBAAqB,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EACxB,IAAI,EACJ,SAAS,EAIV;IACC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC,UAAU,CAAC,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,cAAc,SAAS,uBAAuB,CAAC,CAAA;AACjE,CAAC;AAED,qDAAqD;AACrD,KAAK,UAAU,cAAc,CAC3B,IAAiB;IAEjB,IAAI,IAAI,YAAY,UAAU,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,IAAI,YAAY,IAAI,EAAE,CAAC;QACzB,mDAAmD;QACnD,mCAAmC;QACnC,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAC,WAAW,EAAE,CAAA;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAClE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AACtC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+/*!
+ * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
+ */
+export { createHeaderValue, verifyDigest, verifyHeaderValue } from './httpDigest.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EAClB,MAAM,iBAAiB,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+/*!
+ * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
+ */
+export { createHeaderValue, verifyDigest, verifyHeaderValue } from './httpDigest.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EAClB,MAAM,iBAAiB,CAAA"}

package/dist/util-browser.d.ts

@@ -0,0 +1,6 @@
+/*!
+ * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+export declare function base64Encode(bytes: Uint8Array): string;
+export declare function base64urlEncode(bytes: Uint8Array): string;
+//# sourceMappingURL=util-browser.d.ts.map

package/dist/util-browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util-browser.d.ts","sourceRoot":"","sources":["../src/util-browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMtD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CASzD"}

package/dist/util-browser.js

@@ -0,0 +1,21 @@
+/*!
+ * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+export function base64Encode(bytes) {
+    const maybe = bytes;
+    if (maybe.toBase64) {
+        return maybe.toBase64();
+    }
+    return btoa(Array.from(bytes, b => String.fromCodePoint(b)).join(''));
+}
+export function base64urlEncode(bytes) {
+    const maybe = bytes;
+    if (maybe.toBase64) {
+        return maybe.toBase64({ alphabet: 'base64url', omitPadding: true });
+    }
+    return base64Encode(bytes)
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replaceAll('=', '');
+}
+//# sourceMappingURL=util-browser.js.map

package/dist/util-browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util-browser.js","sourceRoot":"","sources":["../src/util-browser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,MAAM,KAAK,GAAG,KAAsB,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAA;IACzB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACvE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,MAAM,KAAK,GAAG,KAAsB,CAAA;IACpC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AACxB,CAAC"}

package/dist/util.d.ts

@@ -0,0 +1,6 @@
+/*!
+ * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+export declare function base64Encode(bytes: Uint8Array): string;
+export declare function base64urlEncode(bytes: Uint8Array): string;
+//# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD"}

package/dist/util.js

@@ -0,0 +1,10 @@
+/*!
+ * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
+ */
+export function base64Encode(bytes) {
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('base64');
+}
+export function base64urlEncode(bytes) {
+    return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString('base64url');
+}
+//# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC3E,QAAQ,CACT,CAAA;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,QAAQ,CAC3E,WAAW,CACZ,CAAA;AACH,CAAC"}

package/package.json

@@ -1,31 +1,44 @@
 {
   "name": "@interop/http-digest-header",
-  "version": "2.3.2",
+  "version": "3.1.0",
   "description": "Minimal isomorphic library (Node.js and browser) for creating and verifying Digest headers for HTTP Signatures",
   "license": "BSD-3-Clause",
   "scripts": {
-    "test": "npm run test-node",
-    "test-node": "cross-env NODE_ENV=test mocha --preserve-symlinks -t 10000 --require test/test-mocha.js test/**/*.spec.js",
-    "test-karma": "karma start test/karma.conf.cjs",
-    "coverage": "cross-env NODE_ENV=test c8 npm test",
-    "coverage-ci": "cross-env NODE_ENV=test c8 --reporter=lcovonly --reporter=text-summary --reporter=text npm test",
-    "coverage-report": "c8 report",
-    "build": "tsc",
-    "lint": "eslint ."
+    "build": "pnpm run clear && tsc",
+    "clear": "rimraf dist/*",
+    "dev": "vite",
+    "fix": "eslint --fix src test && pnpm run format",
+    "format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\" \"*.md\"",
+    "lint": "eslint src test",
+    "prepare": "pnpm run build",
+    "rebuild": "pnpm run clear && pnpm run build",
+    "test": "pnpm run fix && pnpm run lint && pnpm run test:node && pnpm run test:browser",
+    "test:browser": "playwright test",
+    "test:node": "vitest run",
+    "test:coverage": "vitest run --coverage"
   },
   "type": "module",
-  "exports": "./lib/index.js",
-  "types": "./types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "sideEffects": false,
   "browser": {
-    "./lib/util.js": "./lib/util-browser.js"
+    "./dist/util.js": "./dist/util-browser.js"
   },
   "react-native": {
-    "./lib/util.js": "./lib/util-browser.js",
-    "./lib/digest.js": "./lib/digest-reactnative.js"
+    "./dist/util.js": "./dist/util-browser.js",
+    "./dist/digest.js": "./dist/digest-reactnative.js"
   },
   "files": [
-    "lib/**/*.js",
-    "types/**/*.d.ts"
+    "dist",
+    "README.md",
+    "LICENSE.md"
   ],
   "peerDependencies": {
     "expo-crypto": ">=13"
@@ -36,24 +49,19 @@
     }
   },
   "devDependencies": {
-    "c8": "^10.1.3",
-    "chai": "^4.3.6",
-    "cross-env": "^10.1.0",
-    "eslint": "^8.57.1",
-    "eslint-config-digitalbazaar": "^5.2.0",
-    "eslint-plugin-jsdoc": "^50.8.0",
-    "eslint-plugin-unicorn": "^56.0.1",
-    "karma": "^6.3.20",
-    "karma-chai": "^0.1.0",
-    "karma-chrome-launcher": "^3.1.1",
-    "karma-mocha": "^2.0.1",
-    "karma-mocha-reporter": "^2.2.5",
-    "karma-sourcemap-loader": "^0.3.8",
-    "karma-webpack": "^5.0.0",
-    "mocha": "^11.7.4",
-    "mocha-lcov-reporter": "^1.3.0",
-    "typescript": "^6.0.3",
-    "webpack": "^5.73.0"
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.60.0",
+    "@types/node": "^25.9.3",
+    "@vitest/coverage-v8": "^4.1.8",
+    "eslint": "^10.5.0",
+    "eslint-config-prettier": "^10.1.8",
+    "globals": "^17.6.0",
+    "prettier": "^3.8.4",
+    "rimraf": "^6.1.3",
+    "typescript": "^5.9.3",
+    "typescript-eslint": "^8.61.0",
+    "vite": "^8.0.16",
+    "vitest": "^4.1.8"
   },
   "repository": {
     "type": "git",
@@ -70,17 +78,15 @@
     "url": "https://digitalbazaar.com/"
   },
   "bugs": {
-    "url": "https://github.com/digitalbazaar/http-digest-header/issues"
+    "url": "https://github.com/interop-alliance/http-digest-header/issues"
+  },
+  "homepage": "https://github.com/interop-alliance/http-digest-header",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   },
-  "homepage": "https://github.com/digitalbazaar/http-digest-header",
   "engines": {
-    "node": ">=20"
+    "node": ">=24.0"
   },
-  "c8": {
-    "reporter": [
-      "lcov",
-      "text-summary",
-      "text"
-    ]
-  }
+  "packageManager": "pnpm@11.5.0"
 }

package/lib/digest.js

@@ -1,8 +0,0 @@
-/*!
- * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
- */
-const {crypto} = globalThis;
-
-export async function sha256(data) {
-  return new Uint8Array(await crypto.subtle.digest({name: 'SHA-256'}, data));
-}

package/lib/httpDigest.js

@@ -1,127 +0,0 @@
-/*!
- * Copyright (c) 2019-2025 Digital Bazaar, Inc. All rights reserved.
- */
-import {base64Encode, base64urlEncode} from './util.js';
-import {sha256} from './digest.js';
-
-/**
- * Creates a value suitable for the HTTP `Digest` header.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} [options.data] - The data to be
- *   hashed (a request or response body).
- * @param {string} [options.algorithm] - Hash algorithm to use.
- *   (e.g. 'sha256').
- * @param {boolean} [options.useMultihash=true] - Whether to encode via
- *   multihash; if false, the hash will be base64-encoded (non-url).
- *
- * @returns {Promise<string>} Resolves to `Digest` header value.
- */
-export async function createHeaderValue({
-  data, algorithm = 'sha256', useMultihash = true
-} = {}) {
-  const {key, encodedDigest} = await _createHeaderValueComponents({
-    data, algorithm, useMultihash
-  });
-  return `${key}=${encodedDigest}`;
-}
-
-/**
- * Verifies the HTTP `Digest` header value against the given HTTP body `data`.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} options.data - The data to be
- *   verified (a request or response body).
- * @param {string} options.headerValue - The digest header value to verify
- *   the data against.
- *
- * @returns {Promise<{verified: boolean, error?: Error}>}
- */
-export async function verifyHeaderValue({data, headerValue}) {
-  try {
-    const {key, algorithm, encodedDigest} = _parseHeaderValue(headerValue);
-    const {encodedDigest: expectedDigest} = await _createHeaderValueComponents({
-      data, algorithm, useMultihash: key === 'mh'
-    });
-    return {verified: encodedDigest === expectedDigest};
-  } catch(error) {
-    return {verified: false, error};
-  }
-}
-
-async function _createHeaderValueComponents({
-  data, algorithm = 'sha256', useMultihash = true
-}) {
-  if(algorithm !== 'sha256') {
-    throw new Error(`Algorithm "${algorithm}" is not supported.`);
-  }
-  const digest = await _getDigest({data, algorithm});
-  if(useMultihash) {
-    return {key: 'mh', encodedDigest: _createMultihash({digest})};
-  }
-  return {key: 'SHA-256', encodedDigest: base64Encode(digest)};
-}
-
-function _createMultihash({digest}) {
-  // format as multihash digest
-  // sha2-256: 0x12, length: 32 (0x20), digest value
-  const mh = new Uint8Array(34);
-  mh[0] = 0x12;
-  mh[1] = 0x20;
-  mh.set(digest, 2);
-  // encode multihash using multibase, base64url: `u`
-  return `u${base64urlEncode(mh)}`;
-}
-
-function _parseHeaderValue(headerValue) {
-  const [key, digestValue] = headerValue.split(/=(.+)/);
-
-  let encodedDigest;
-  let algorithm;
-  if(key === 'mh') {
-    encodedDigest = digestValue;
-
-    // if `encodedDigest` starts with `uEi`, then it is a base64url-encoded
-    // sha-256 multihash
-    if(encodedDigest.startsWith('uEi')) {
-      algorithm = 'sha256';
-    } else {
-      throw new Error(
-        `Only base64url-encoded, sha-256 multihash is supported.`);
-    }
-  } else {
-    // per RFC 9651, the digest value could be a structured field value,
-    // expressed as a base64-encoded byte array wrapped in colons
-    encodedDigest = digestValue?.replace(/^:(.*):$/, '$1');
-
-    algorithm = key.replace('-', '').toLowerCase();
-    if(algorithm !== 'sha256') {
-      throw new Error(`Algorithm "${algorithm}" is not supported.`);
-    }
-  }
-  return {key, algorithm, encodedDigest};
-}
-
-async function _getDigest({data, algorithm}) {
-  data = await _normalizeData(data);
-  if(algorithm === 'sha256') {
-    return sha256(data);
-  }
-  throw new Error(`Algorithm "${algorithm}" is not unsupported.`);
-}
-
-// normalize all inputs to a `Uint8Array` for hashing
-async function _normalizeData(data) {
-  if(data instanceof Uint8Array) {
-    return data;
-  }
-  if(data instanceof Blob) {
-    // `Blob.bytes()` is only available in node.js 22+;
-    // fallback to `Blob.arrayBuffer()`
-    return data?.bytes?.() ?? data.arrayBuffer();
-  }
-  if(typeof data !== 'string') {
-    data = JSON.stringify(data);
-  }
-  return (new TextEncoder()).encode(data);
-}

package/lib/index.js

@@ -1,4 +0,0 @@
-/*!
- * Copyright (c) 2019-2020 Digital Bazaar, Inc. All rights reserved.
- */
-export {createHeaderValue, verifyHeaderValue} from './httpDigest.js';

package/lib/util-browser.js

@@ -1,19 +0,0 @@
-/*!
- * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
- */
-export function base64Encode(bytes) {
-  if(bytes.toBase64) {
-    return bytes.toBase64();
-  }
-  return btoa(Array.from(bytes, b => String.fromCodePoint(b)).join(''));
-}
-
-export function base64urlEncode(bytes) {
-  if(bytes.toBase64) {
-    return bytes.toBase64({alphabet: 'base64url', omitPadding: true});
-  }
-  return base64Encode(bytes)
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_')
-    .replaceAll('=', '');
-}

package/lib/util.js

@@ -1,12 +0,0 @@
-/*!
- * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
- */
-export function base64Encode(bytes) {
-  return Buffer.from(bytes.buffer, bytes.offset, bytes.length)
-    .toString('base64');
-}
-
-export function base64urlEncode(bytes) {
-  return Buffer.from(bytes.buffer, bytes.offset, bytes.length)
-    .toString('base64url');
-}

package/types/httpDigest.d.ts

@@ -1,36 +0,0 @@
-/**
- * Creates a value suitable for the HTTP `Digest` header.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} [options.data] - The data to be
- *   hashed (a request or response body).
- * @param {string} [options.algorithm] - Hash algorithm to use.
- *   (e.g. 'sha256').
- * @param {boolean} [options.useMultihash=true] - Whether to encode via
- *   multihash; if false, the hash will be base64-encoded (non-url).
- *
- * @returns {Promise<string>} Resolves to `Digest` header value.
- */
-export function createHeaderValue({ data, algorithm, useMultihash }?: {
-    data?: string | object | Blob | Uint8Array;
-    algorithm?: string;
-    useMultihash?: boolean;
-}): Promise<string>;
-/**
- * Verifies the HTTP `Digest` header value against the given HTTP body `data`.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} options.data - The data to be
- *   verified (a request or response body).
- * @param {string} options.headerValue - The digest header value to verify
- *   the data against.
- *
- * @returns {Promise<{verified: boolean, error?: Error}>}
- */
-export function verifyHeaderValue({ data, headerValue }: {
-    data: string | object | Blob | Uint8Array;
-    headerValue: string;
-}): Promise<{
-    verified: boolean;
-    error?: Error;
-}>;

package/types/index.d.ts

@@ -1 +0,0 @@
-export { createHeaderValue, verifyHeaderValue } from "./httpDigest.js";

package/types/lib/httpDigest.d.ts

@@ -1,36 +0,0 @@
-/**
- * Creates a value suitable for the HTTP `Digest` header.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} [options.data] - The data to be
- *   hashed (a request or response body).
- * @param {string} [options.algorithm] - Hash algorithm to use.
- *   (e.g. 'sha256').
- * @param {boolean} [options.useMultihash=true] - Whether to encode via
- *   multihash; if false, the hash will be base64-encoded (non-url).
- *
- * @returns {Promise<string>} Resolves to `Digest` header value.
- */
-export function createHeaderValue({ data, algorithm, useMultihash }?: {
-    data?: string | object | Blob | Uint8Array;
-    algorithm?: string;
-    useMultihash?: boolean;
-}): Promise<string>;
-/**
- * Verifies the HTTP `Digest` header value against the given HTTP body `data`.
- *
- * @param {object} options - The options to use.
- * @param {string|object|Blob|Uint8Array} options.data - The data to be
- *   verified (a request or response body).
- * @param {string} options.headerValue - The digest header value to verify
- *   the data against.
- *
- * @returns {Promise<{verified: boolean, error?: Error}>}
- */
-export function verifyHeaderValue({ data, headerValue }: {
-    data: string | object | Blob | Uint8Array;
-    headerValue: string;
-}): Promise<{
-    verified: boolean;
-    error?: Error;
-}>;

package/types/lib/index.d.ts

@@ -1 +0,0 @@
-export { createHeaderValue, verifyHeaderValue } from "./httpDigest.js";

package/types/lib/util.d.ts

@@ -1,5 +0,0 @@
-/*!
- * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
- */
-export function base64Encode(bytes: any): any;
-export function base64urlEncode(bytes: any): any;

package/types/util.d.ts

@@ -1,5 +0,0 @@
-/*!
- * Copyright (c) 2021-2025 Digital Bazaar, Inc. All rights reserved.
- */
-export function base64Encode(bytes: any): any;
-export function base64urlEncode(bytes: any): any;