@kagal/taistamp 0.0.4 → 0.0.5

package/README.md

@@ -15,14 +15,14 @@ pnpm add @kagal/taistamp
 ## Handler
 
 ```typescript
-import { newTaistampHandler, TAI64N_PATH } from '@kagal/taistamp';
+import { newTaistampHandler, TAISTAMP_PATH } from '@kagal/taistamp';
 
 const taistamp = newTaistampHandler();
 
 // Worker fetch handler
 export default {
   async fetch(request: Request): Promise<Response> {
-    if (new URL(request.url).pathname === TAI64N_PATH) {
+    if (new URL(request.url).pathname === TAISTAMP_PATH) {
       return taistamp(request);
     }
     // ...
@@ -30,7 +30,7 @@ export default {
 };
 
 // Hono route
-app.get(TAI64N_PATH, (c) => taistamp(c.req.raw));
+app.get(TAISTAMP_PATH, (c) => taistamp(c.req.raw));
 ```
 
 `newTaistampHandler()` returns an
@@ -305,7 +305,7 @@ history.
 
 | Name | Value |
 |------|-------|
-| `TAI64N_PATH` | `/.well-known/taistamp` |
+| `TAISTAMP_PATH` | `/.well-known/taistamp` |
 | `TAI64N_CONTENT_TYPE` | `application/tai64n` |
 | `TAI64N_CONTENT_LENGTH` | `25` |
 | `TAI64N_HEADER_KEY_SELECTOR` | `TAI-Key-Selector` |

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { Signer } from '@kagal/ed25519-secret';
-export { Signer, newSigner as newEd25519Signer } from '@kagal/ed25519-secret';
-
+import { Signer, Signer as Signer$1, newSigner as newEd25519Signer } from "@kagal/ed25519-secret";
+declare const TAISTAMP_PATH = "/.well-known/taistamp";
+/** @deprecated Renamed to {@link TAISTAMP_PATH}. */
 declare const TAI64N_PATH = "/.well-known/taistamp";
 declare const TAI64N_CONTENT_TYPE = "application/tai64n";
 declare const TAI64N_CONTENT_LENGTH: number;
@@ -9,7 +9,6 @@ declare const TAI64N_HEADER_LEAP_SECONDS = "TAI-Leap-Seconds";
 declare const TAI64N_HEADER_NONCE = "TAI-Nonce";
 declare const TAI64N_HEADER_SIGNATURE = "TAI-Signature";
 declare const TAI64_EPOCH_HI = 1073741824;
-
 /**
  * Upper bound for `leapSeconds` in the taistamp signed
  * payload. The framing encodes the value as a 4-byte
@@ -29,7 +28,7 @@ declare const LeapSecondsBrand: unique symbol;
  * the signing path.
  */
 type LeapSeconds = number & {
-    readonly [LeapSecondsBrand]: never;
+  readonly [LeapSecondsBrand]: never;
 };
 /**
  * Coerce a `number` to a {@link LeapSeconds}. Returns
@@ -59,7 +58,6 @@ declare const TAI_LEAP_SECONDS: LeapSeconds;
  * collapsed into one verdict.
  */
 declare const extractLeapSeconds: (headers: Headers) => LeapSeconds | undefined;
-
 declare const NonceBrand: unique symbol;
 /**
  * `string` that has been confirmed to satisfy the
@@ -71,7 +69,7 @@ declare const NonceBrand: unique symbol;
  * signing path.
  */
 type Nonce = string & {
-    readonly [NonceBrand]: never;
+  readonly [NonceBrand]: never;
 };
 /**
  * Brand `value` as a {@link Nonce} when it satisfies
@@ -82,7 +80,6 @@ type Nonce = string & {
  * verdict.
  */
 declare const asNonce: (value: string) => Nonce | undefined;
-
 /**
  * Compose the byte sequence covered by a TAI-Signature.
  *
@@ -129,46 +126,46 @@ declare const composeSignaturePayload: (label: string, leapSeconds: LeapSeconds,
  * selector without a signer is a misconfiguration.
  */
 interface TaistampHandlerConfig {
-    /**
-     * Key selector advertised in the `TAI-Key-Selector`
-     * response header and bound into the signed payload.
-     * Verifiers look up the public key at
-     * `<selector>._taistamp.<host>` in DNS.
-     *
-     * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single
-     * DNS label starting with a letter, using
-     * DKIM-compatible characters and a valid sf-token);
-     * rotate by changing the selector and publishing a
-     * new TXT record.
-     */
-    selector?: string;
-    /**
-     * {@link Signer} that produces `TAI-Signature` over
-     * the framed payload from {@link composeSignaturePayload}.
-     * Without a signer the nonce is still echoed but the
-     * response is unsigned.
-     */
-    signer?: Signer;
-    /**
-     * CORS origin policy. Defaults to `'*'`; pass `false`
-     * to disable CORS entirely, or a specific origin
-     * (e.g. `'https://example.com'`) to scope the policy.
-     *
-     * Every response (`GET` / `HEAD` / `OPTIONS` / `405`)
-     * gains `Access-Control-Allow-Origin`; pre-flight
-     * `OPTIONS` also carries `-Allow-Methods`,
-     * `-Allow-Headers`, `-Expose-Headers`, and
-     * `-Max-Age: 600` per spec §4.2; success
-     * `GET` / `HEAD` carry `-Expose-Headers` so browser
-     * JS can read the `TAI-*` response headers. A
-     * non-`'*'` value adds `Vary: Origin` so caches can
-     * keep per-origin variants distinct.
-     *
-     * Disabling CORS does not affect method discovery:
-     * `OPTIONS` is still answered with `200` and
-     * `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.
-     */
-    cors?: false | string;
+  /**
+   * Key selector advertised in the `TAI-Key-Selector`
+   * response header and bound into the signed payload.
+   * Verifiers look up the public key at
+   * `<selector>._taistamp.<host>` in DNS.
+   *
+   * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single
+   * DNS label starting with a letter, using
+   * DKIM-compatible characters and a valid sf-token);
+   * rotate by changing the selector and publishing a
+   * new TXT record.
+   */
+  selector?: string;
+  /**
+   * {@link Signer} that produces `TAI-Signature` over
+   * the framed payload from {@link composeSignaturePayload}.
+   * Without a signer the nonce is still echoed but the
+   * response is unsigned.
+   */
+  signer?: Signer$1;
+  /**
+   * CORS origin policy. Defaults to `'*'`; pass `false`
+   * to disable CORS entirely, or a specific origin
+   * (e.g. `'https://example.com'`) to scope the policy.
+   *
+   * Every response (`GET` / `HEAD` / `OPTIONS` / `405`)
+   * gains `Access-Control-Allow-Origin`; pre-flight
+   * `OPTIONS` also carries `-Allow-Methods`,
+   * `-Allow-Headers`, `-Expose-Headers`, and
+   * `-Max-Age: 600` per spec §4.2; success
+   * `GET` / `HEAD` carry `-Expose-Headers` so browser
+   * JS can read the `TAI-*` response headers. A
+   * non-`'*'` value adds `Vary: Origin` so caches can
+   * keep per-origin variants distinct.
+   *
+   * Disabling CORS does not affect method discovery:
+   * `OPTIONS` is still answered with `200` and
+   * `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.
+   */
+  cors?: false | string;
 }
 /**
  * Build a handler for `/.well-known/taistamp`.
@@ -226,19 +223,16 @@ interface TaistampHandlerConfig {
  *   TAI64N format
  */
 declare const newTaistampHandler: (config?: TaistampHandlerConfig) => ((request: Request) => Promise<Response>);
-
 type timestamp = {
-    nano: number;
-    sec: number;
-    offset?: number;
+  nano: number;
+  sec: number;
+  offset?: number;
 };
 declare const fromUTC: (utc: number) => timestamp;
 declare const now: () => timestamp;
 declare const tai64nLabel: (value?: timestamp) => string;
 declare const tai64nLabelFromUTC: (utc: number) => string;
-
 /** Package version from package.json. */
 declare const VERSION: string;
-
-export { TAI64N_CONTENT_LENGTH, TAI64N_CONTENT_TYPE, TAI64N_HEADER_KEY_SELECTOR, TAI64N_HEADER_LEAP_SECONDS, TAI64N_HEADER_NONCE, TAI64N_HEADER_SIGNATURE, TAI64N_PATH, TAI64_EPOCH_HI, TAI_LEAP_SECONDS, TAI_LEAP_SECONDS_MAX, VERSION, asLeapSeconds, asNonce, composeSignaturePayload, extractLeapSeconds, fromUTC, newTaistampHandler, now, tai64nLabel, tai64nLabelFromUTC };
-export type { LeapSeconds, Nonce, TaistampHandlerConfig };
+export { type LeapSeconds, type Nonce, type Signer, TAI64N_CONTENT_LENGTH, TAI64N_CONTENT_TYPE, TAI64N_HEADER_KEY_SELECTOR, TAI64N_HEADER_LEAP_SECONDS, TAI64N_HEADER_NONCE, TAI64N_HEADER_SIGNATURE, TAI64N_PATH, TAI64_EPOCH_HI, TAISTAMP_PATH, TAI_LEAP_SECONDS, TAI_LEAP_SECONDS_MAX, type TaistampHandlerConfig, VERSION, asLeapSeconds, asNonce, composeSignaturePayload, extractLeapSeconds, fromUTC, newEd25519Signer, newTaistampHandler, now, tai64nLabel, tai64nLabelFromUTC };
+//# sourceMappingURL=index.d.mts.map

package/dist/index.mjs

@@ -1,216 +1,180 @@
-import { assertValidSelector } from '@kagal/ed25519-secret';
-export { newSigner as newEd25519Signer } from '@kagal/ed25519-secret';
-
-const version = "0.0.4";
-const pkg = {
-	version: version};
-
-const TAI64N_PATH = "/.well-known/taistamp";
+import { assertValidSelector, newSigner as newEd25519Signer } from "@kagal/ed25519-secret";
+var version = "0.0.5";
+const TAISTAMP_PATH = "/.well-known/taistamp";
+const TAI64N_PATH = TAISTAMP_PATH;
 const TAI64N_CONTENT_TYPE = "application/tai64n";
-const TAI64N_CONTENT_LENGTH = 1 + 16 + 8;
+const TAI64N_CONTENT_LENGTH = 25;
 const TAI64N_HEADER_KEY_SELECTOR = "TAI-Key-Selector";
 const TAI64N_HEADER_LEAP_SECONDS = "TAI-Leap-Seconds";
 const TAI64N_HEADER_NONCE = "TAI-Nonce";
 const TAI64N_HEADER_SIGNATURE = "TAI-Signature";
 const TAI64_EPOCH_HI = 1073741824;
-
 const CORS_ALLOW_METHODS = "GET, HEAD";
 const CORS_ALLOW_HEADERS = TAI64N_HEADER_NONCE;
 const CORS_EXPOSE_HEADERS = [
-  TAI64N_HEADER_LEAP_SECONDS,
-  TAI64N_HEADER_NONCE,
-  TAI64N_HEADER_KEY_SELECTOR,
-  TAI64N_HEADER_SIGNATURE
+	TAI64N_HEADER_LEAP_SECONDS,
+	TAI64N_HEADER_NONCE,
+	TAI64N_HEADER_KEY_SELECTOR,
+	TAI64N_HEADER_SIGNATURE
 ].join(", ");
 const CORS_MAX_AGE = "600";
 const buildCORSHeaders = (cors) => {
-  if (cors === false) {
-    return { error: {}, preflight: {}, response: {} };
-  }
-  const origin = cors || "*";
-  const vary = origin === "*" ? {} : { vary: "Origin" };
-  return {
-    error: {
-      "access-control-allow-origin": origin,
-      ...vary
-    },
-    preflight: {
-      "access-control-allow-origin": origin,
-      "access-control-allow-methods": CORS_ALLOW_METHODS,
-      "access-control-allow-headers": CORS_ALLOW_HEADERS,
-      "access-control-expose-headers": CORS_EXPOSE_HEADERS,
-      "access-control-max-age": CORS_MAX_AGE,
-      ...vary
-    },
-    response: {
-      "access-control-allow-origin": origin,
-      "access-control-expose-headers": CORS_EXPOSE_HEADERS,
-      ...vary
-    }
-  };
+	if (cors === false) return {
+		error: {},
+		preflight: {},
+		response: {}
+	};
+	const origin = cors || "*";
+	const vary = origin === "*" ? {} : { vary: "Origin" };
+	return {
+		error: {
+			"access-control-allow-origin": origin,
+			...vary
+		},
+		preflight: {
+			"access-control-allow-origin": origin,
+			"access-control-allow-methods": CORS_ALLOW_METHODS,
+			"access-control-allow-headers": CORS_ALLOW_HEADERS,
+			"access-control-expose-headers": CORS_EXPOSE_HEADERS,
+			"access-control-max-age": CORS_MAX_AGE,
+			...vary
+		},
+		response: {
+			"access-control-allow-origin": origin,
+			"access-control-expose-headers": CORS_EXPOSE_HEADERS,
+			...vary
+		}
+	};
 };
-
 const TAI_LEAP_SECONDS_MAX = 4294967295;
 const asLeapSeconds = (value) => {
-  if (!Number.isInteger(value) || value < 0 || value > TAI_LEAP_SECONDS_MAX) return void 0;
-  return value;
+	if (!Number.isInteger(value) || value < 0 || value > 4294967295) return void 0;
+	return value;
 };
 const TAI_LEAP_SECONDS = 37;
 const DECIMAL_INTEGER = /^(?:0|[1-9]\d*)$/;
 const extractLeapSeconds = (headers) => {
-  const raw = headers.get(TAI64N_HEADER_LEAP_SECONDS);
-  if (!raw || !DECIMAL_INTEGER.test(raw)) return void 0;
-  return asLeapSeconds(Number(raw));
+	const raw = headers.get(TAI64N_HEADER_LEAP_SECONDS);
+	if (!raw || !DECIMAL_INTEGER.test(raw)) return void 0;
+	return asLeapSeconds(Number(raw));
 };
-
-const NONCE_MIN_OCTETS = 14;
-const NONCE_MAX_OCTETS = 174;
 const SF_BINARY_PATTERN = /^:(?:[\d+/A-Za-z]{4})*(?:[\d+/A-Za-z]{4}|[\d+/A-Za-z]{3}=|[\d+/A-Za-z]{2}==):$/;
 const asNonce = (value) => {
-  if (!value || value.length < NONCE_MIN_OCTETS || value.length > NONCE_MAX_OCTETS || !SF_BINARY_PATTERN.test(value)) return void 0;
-  return value;
+	if (!value || value.length < 14 || value.length > 174 || !SF_BINARY_PATTERN.test(value)) return void 0;
+	return value;
 };
 const extractNonce = (headers) => {
-  const value = headers.get(TAI64N_HEADER_NONCE);
-  return value === null ? void 0 : asNonce(value);
+	const value = headers.get(TAI64N_HEADER_NONCE);
+	return value === null ? void 0 : asNonce(value);
 };
-
 const fromUTC = (utc) => {
-  const sec = Math.floor(utc / 1e3) + TAI_LEAP_SECONDS;
-  const nano = utc % 1e3 * 1e6;
-  return { sec, nano, offset: TAI_LEAP_SECONDS };
+	return {
+		sec: Math.floor(utc / 1e3) + 37,
+		nano: utc % 1e3 * 1e6,
+		offset: 37
+	};
 };
 const now = () => {
-  const utc = Date.now();
-  return fromUTC(utc);
+	return fromUTC(Date.now());
 };
 const tai64nLabel = (value) => {
-  const { sec, nano } = value ?? now();
-  const secHi = Math.trunc(sec / u32Range) + TAI64_EPOCH_HI;
-  const secLo = sec % u32Range;
-  const secHiHex = secHi.toString(16).padStart(8, "0");
-  const secLoHex = secLo.toString(16).padStart(8, "0");
-  const nanoHex = nano.toString(16).padStart(8, "0");
-  return `@${secHiHex}${secLoHex}${nanoHex}`;
+	const { sec, nano } = value ?? now();
+	const secHi = Math.trunc(sec / u32Range) + TAI64_EPOCH_HI;
+	const secLo = sec % u32Range;
+	return `@${secHi.toString(16).padStart(8, "0")}${secLo.toString(16).padStart(8, "0")}${nano.toString(16).padStart(8, "0")}`;
 };
 const tai64nLabelFromUTC = (utc) => tai64nLabel(fromUTC(utc));
 const u32Range = 4294967296;
-
 const ALLOW_HEADER = "GET, HEAD, OPTIONS";
 const textEncoder = new TextEncoder();
 const DOMAIN_SEPARATOR = textEncoder.encode("taistamp-v1\0");
 const asBytes = (source) => {
-  if (source instanceof Uint8Array) {
-    return source;
-  }
-  if (ArrayBuffer.isView(source)) {
-    return new Uint8Array(
-      source.buffer,
-      source.byteOffset,
-      source.byteLength
-    );
-  }
-  return new Uint8Array(source);
+	if (source instanceof Uint8Array) return source;
+	if (ArrayBuffer.isView(source)) return new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+	return new Uint8Array(source);
 };
 const encodeStructuredBinary = (source) => {
-  const bytes = asBytes(source);
-  const standard = btoa(String.fromCodePoint(...bytes));
-  return `:${standard}:`;
+	const bytes = asBytes(source);
+	return `:${btoa(String.fromCodePoint(...bytes))}:`;
 };
 const composeSignaturePayload = (label, leapSeconds, selector, nonce) => {
-  const labelBytes = textEncoder.encode(label);
-  const selectorBytes = textEncoder.encode(selector);
-  const nonceBytes = textEncoder.encode(nonce);
-  const buffer = new ArrayBuffer(
-    DOMAIN_SEPARATOR.length + labelBytes.length + 4 + 1 + selectorBytes.length + nonceBytes.length
-  );
-  const view = new Uint8Array(buffer);
-  let offset = 0;
-  view.set(DOMAIN_SEPARATOR, offset);
-  offset += DOMAIN_SEPARATOR.length;
-  view.set(labelBytes, offset);
-  offset += labelBytes.length;
-  new DataView(buffer).setUint32(offset, leapSeconds, false);
-  offset += 4;
-  view[offset] = selectorBytes.length;
-  offset += 1;
-  view.set(selectorBytes, offset);
-  offset += selectorBytes.length;
-  view.set(nonceBytes, offset);
-  return buffer;
+	const labelBytes = textEncoder.encode(label);
+	const selectorBytes = textEncoder.encode(selector);
+	const nonceBytes = textEncoder.encode(nonce);
+	const buffer = new ArrayBuffer(DOMAIN_SEPARATOR.length + labelBytes.length + 4 + 1 + selectorBytes.length + nonceBytes.length);
+	const view = new Uint8Array(buffer);
+	let offset = 0;
+	view.set(DOMAIN_SEPARATOR, offset);
+	offset += DOMAIN_SEPARATOR.length;
+	view.set(labelBytes, offset);
+	offset += labelBytes.length;
+	new DataView(buffer).setUint32(offset, leapSeconds, false);
+	offset += 4;
+	view[offset] = selectorBytes.length;
+	offset += 1;
+	view.set(selectorBytes, offset);
+	offset += selectorBytes.length;
+	view.set(nonceBytes, offset);
+	return buffer;
 };
 const validateHandlerConfig = (config) => {
-  const { cors, selector, signer } = config;
-  if (signer === void 0 !== (selector === void 0)) {
-    throw new TypeError(
-      "newTaistampHandler: signer and selector must be set together"
-    );
-  }
-  if (cors !== void 0 && cors !== false && typeof cors !== "string") {
-    throw new TypeError(
-      "newTaistampHandler: cors must be false or a string origin"
-    );
-  }
-  if (selector !== void 0) {
-    assertValidSelector(selector, "newTaistampHandler");
-  }
-  return config;
+	const { cors, selector, signer } = config;
+	if (signer === void 0 !== (selector === void 0)) throw new TypeError("newTaistampHandler: signer and selector must be set together");
+	if (cors !== void 0 && cors !== false && typeof cors !== "string") throw new TypeError("newTaistampHandler: cors must be false or a string origin");
+	if (selector !== void 0) assertValidSelector(selector, "newTaistampHandler");
+	return config;
 };
 const fromHandlerConfig = (config) => {
-  const { cors, selector, signer } = validateHandlerConfig(config);
-  const corsHeaders = buildCORSHeaders(cors);
-  const addSignature = selector !== void 0 && signer !== void 0 ? async (headers, label, nonce) => {
-    const payload = composeSignaturePayload(
-      label,
-      TAI_LEAP_SECONDS,
-      selector,
-      nonce
-    );
-    const signature = await signer.sign(payload);
-    headers.set(TAI64N_HEADER_KEY_SELECTOR, selector);
-    headers.set(
-      TAI64N_HEADER_SIGNATURE,
-      encodeStructuredBinary(signature)
-    );
-  } : void 0;
-  return { addSignature, corsHeaders };
+	const { cors, selector, signer } = validateHandlerConfig(config);
+	const corsHeaders = buildCORSHeaders(cors);
+	return {
+		addSignature: selector !== void 0 && signer !== void 0 ? async (headers, label, nonce) => {
+			const payload = composeSignaturePayload(label, 37, selector, nonce);
+			const signature = await signer.sign(payload);
+			headers.set(TAI64N_HEADER_KEY_SELECTOR, selector);
+			headers.set(TAI64N_HEADER_SIGNATURE, encodeStructuredBinary(signature));
+		} : void 0,
+		corsHeaders
+	};
 };
 const newTaistampHandler = (config = {}) => {
-  const { addSignature, corsHeaders } = fromHandlerConfig(config);
-  return async (request) => {
-    if (request.method === "OPTIONS") {
-      return new Response(void 0, {
-        status: 200,
-        headers: { allow: ALLOW_HEADER, ...corsHeaders.preflight }
-      });
-    }
-    if (request.method !== "GET" && request.method !== "HEAD") {
-      return new Response(void 0, {
-        status: 405,
-        headers: { allow: ALLOW_HEADER, ...corsHeaders.error }
-      });
-    }
-    const nonce = extractNonce(request.headers);
-    const label = tai64nLabel();
-    const headers = new Headers({
-      "cache-control": "no-store",
-      "content-length": String(TAI64N_CONTENT_LENGTH),
-      "content-type": TAI64N_CONTENT_TYPE,
-      [TAI64N_HEADER_LEAP_SECONDS]: String(TAI_LEAP_SECONDS),
-      ...corsHeaders.response
-    });
-    if (nonce && request.method === "GET") {
-      headers.set(TAI64N_HEADER_NONCE, nonce);
-      if (addSignature) {
-        await addSignature(headers, label, nonce);
-      }
-    }
-    const body = request.method === "HEAD" ? void 0 : label;
-    return new Response(body, { status: 200, headers });
-  };
+	const { addSignature, corsHeaders } = fromHandlerConfig(config);
+	return async (request) => {
+		if (request.method === "OPTIONS") return new Response(void 0, {
+			status: 200,
+			headers: {
+				allow: ALLOW_HEADER,
+				...corsHeaders.preflight
+			}
+		});
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response(void 0, {
+			status: 405,
+			headers: {
+				allow: ALLOW_HEADER,
+				...corsHeaders.error
+			}
+		});
+		const nonce = extractNonce(request.headers);
+		const label = tai64nLabel();
+		const headers = new Headers({
+			"cache-control": "no-store",
+			"content-length": String(25),
+			"content-type": TAI64N_CONTENT_TYPE,
+			[TAI64N_HEADER_LEAP_SECONDS]: String(37),
+			...corsHeaders.response
+		});
+		if (nonce && request.method === "GET") {
+			headers.set(TAI64N_HEADER_NONCE, nonce);
+			if (addSignature) await addSignature(headers, label, nonce);
+		}
+		const body = request.method === "HEAD" ? void 0 : label;
+		return new Response(body, {
+			status: 200,
+			headers
+		});
+	};
 };
+const VERSION = version;
+export { TAI64N_CONTENT_LENGTH, TAI64N_CONTENT_TYPE, TAI64N_HEADER_KEY_SELECTOR, TAI64N_HEADER_LEAP_SECONDS, TAI64N_HEADER_NONCE, TAI64N_HEADER_SIGNATURE, TAI64N_PATH, TAI64_EPOCH_HI, TAISTAMP_PATH, TAI_LEAP_SECONDS, TAI_LEAP_SECONDS_MAX, VERSION, asLeapSeconds, asNonce, composeSignaturePayload, extractLeapSeconds, fromUTC, newEd25519Signer, newTaistampHandler, now, tai64nLabel, tai64nLabelFromUTC };
 
-const VERSION = pkg.version;
-
-export { TAI64N_CONTENT_LENGTH, TAI64N_CONTENT_TYPE, TAI64N_HEADER_KEY_SELECTOR, TAI64N_HEADER_LEAP_SECONDS, TAI64N_HEADER_NONCE, TAI64N_HEADER_SIGNATURE, TAI64N_PATH, TAI64_EPOCH_HI, TAI_LEAP_SECONDS, TAI_LEAP_SECONDS_MAX, VERSION, asLeapSeconds, asNonce, composeSignaturePayload, extractLeapSeconds, fromUTC, newTaistampHandler, now, tai64nLabel, tai64nLabelFromUTC };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../src/const.ts","../src/cors.ts","../src/leap-seconds.ts","../src/nonce.ts","../src/utils.ts","../src/handler.ts","../src/index.ts"],"sourcesContent":["export const TAI64N_PATH = '/.well-known/taistamp';\n\nexport const TAI64N_CONTENT_TYPE = 'application/tai64n';\nexport const TAI64N_CONTENT_LENGTH = 1 + 16 + 8; // '@' + sec (16 hex chars) + nano (8 hex chars)\n\nexport const TAI64N_HEADER_KEY_SELECTOR = 'TAI-Key-Selector';\nexport const TAI64N_HEADER_LEAP_SECONDS = 'TAI-Leap-Seconds';\nexport const TAI64N_HEADER_NONCE = 'TAI-Nonce';\nexport const TAI64N_HEADER_SIGNATURE = 'TAI-Signature';\n\nexport const TAI64_EPOCH_HI = 0x40_00_00_00;\n","import {\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_SIGNATURE,\n} from './const';\n\n// `Access-Control-Allow-Methods` (Fetch) is the list\n// of methods JS would ever preflight, so `OPTIONS` is\n// omitted. This is intentionally narrower than the\n// `Allow` header (RFC 9110 §9.3.7 method discovery,\n// `GET, HEAD, OPTIONS`) the handler itself emits.\nconst CORS_ALLOW_METHODS = 'GET, HEAD';\nconst CORS_ALLOW_HEADERS = TAI64N_HEADER_NONCE;\nconst CORS_EXPOSE_HEADERS = [\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_SIGNATURE,\n].join(', ');\n// Spec §4.2 SHOULDs at least 600s; 10 minutes is the\n// floor the spec example uses and keeps high-traffic\n// cross-origin clients off a pre-flight per fetch.\nconst CORS_MAX_AGE = '600';\n\n/**\n * The three CORS header maps the handler splices into\n * responses, keyed by response kind.\n *\n * - `preflight` — added to `OPTIONS 200` replies.\n * - `response` — added to successful `GET` / `HEAD`\n *   replies; carries `Access-Control-Expose-Headers`\n *   so browser JS can read the `TAI-*` headers.\n * - `error` — added to `405` replies; just the origin\n *   header (and `Vary` when scoped).\n */\nexport type CORSHeaderSets = {\n  error: Record<string, string>\n  preflight: Record<string, string>\n  response: Record<string, string>\n};\n\n/**\n * Pre-bake the three CORS header maps the handler\n * splices into responses, keyed by response kind.\n * `cors === false` collapses every map to `{}` so the\n * spread is a no-op; missing or empty input falls back\n * to `'*'`; `cors === '*'` skips `Vary: Origin` (a\n * wildcard does not vary by origin); a scoped origin\n * adds `Vary: Origin` so caches can keep per-origin\n * variants distinct.\n */\nexport const buildCORSHeaders = (\n  cors: false | string | undefined,\n): CORSHeaderSets => {\n  if (cors === false) {\n    return { error: {}, preflight: {}, response: {} };\n  }\n  const origin = cors || '*';\n  const vary: Record<string, string> =\n    origin === '*' ? {} : { vary: 'Origin' };\n  return {\n    error: {\n      'access-control-allow-origin': origin,\n      ...vary,\n    },\n    preflight: {\n      'access-control-allow-origin': origin,\n      'access-control-allow-methods': CORS_ALLOW_METHODS,\n      'access-control-allow-headers': CORS_ALLOW_HEADERS,\n      'access-control-expose-headers': CORS_EXPOSE_HEADERS,\n      'access-control-max-age': CORS_MAX_AGE,\n      ...vary,\n    },\n    response: {\n      'access-control-allow-origin': origin,\n      'access-control-expose-headers': CORS_EXPOSE_HEADERS,\n      ...vary,\n    },\n  };\n};\n","// cspell:words IERS\n\nimport { TAI64N_HEADER_LEAP_SECONDS } from './const';\n\n/**\n * Upper bound for `leapSeconds` in the taistamp signed\n * payload. The framing encodes the value as a 4-byte\n * big-endian unsigned integer, so any input outside\n * `[0, 2^32-1]` cannot be represented. Verifiers MUST\n * treat an out-of-range `TAI-Leap-Seconds` response\n * header as unsigned, per spec §5.1.\n */\nexport const TAI_LEAP_SECONDS_MAX = 0xFF_FF_FF_FF;\n\ndeclare const LeapSecondsBrand: unique symbol;\n\n/**\n * `number` that has been confirmed to fit the\n * `[0, TAI_LEAP_SECONDS_MAX]` u32be range required by\n * the taistamp signed-payload framing. Construct only\n * via {@link extractLeapSeconds} or {@link asLeapSeconds};\n * the brand prevents an arbitrary number from reaching\n * the signing path.\n */\nexport type LeapSeconds = number & { readonly [LeapSecondsBrand]: never };\n\n/**\n * Coerce a `number` to a {@link LeapSeconds}. Returns\n * `undefined` when `value` is non-integer, negative,\n * or exceeds {@link TAI_LEAP_SECONDS_MAX}.\n */\nexport const asLeapSeconds = (\n  value: number,\n): LeapSeconds | undefined => {\n  if (\n    !Number.isInteger(value) ||\n    value < 0 ||\n    value > TAI_LEAP_SECONDS_MAX\n  ) return undefined;\n  return value as LeapSeconds;\n};\n\n/**\n * Current TAI − UTC offset in whole seconds, used by\n * `fromUTC()` and emitted in the `TAI-Leap-Seconds`\n * response header. The value 37 has been in force\n * since 2017-01-01; update on the next IERS leap-second\n * announcement.\n *\n * @remarks\n * Stays a single `LeapSeconds` until a leap-seconds\n * table is added so the offset can be computed for any\n * TAI second; this constant becomes redundant then.\n */\nexport const TAI_LEAP_SECONDS: LeapSeconds = 37 as LeapSeconds;\n\n/**\n * Strict decimal integer: a single `0` or a non-zero\n * leading digit followed by digits. Rejects hex\n * (`0x25`), float-style integers (`37.0`), signs,\n * whitespace, exponential notation, and leading zeros\n * — every input `Number()` would silently coerce to\n * an integer despite not being a canonical decimal.\n */\nconst DECIMAL_INTEGER = /^(?:0|[1-9]\\d*)$/;\n\n/**\n * Extract a usable leap-seconds count from response\n * headers. Returns `undefined` when the\n * `TAI-Leap-Seconds` field is missing, empty,\n * non-numeric, non-integer, negative, or out-of-range\n * — every \"treat as unsigned\" case in spec §5.1\n * collapsed into one verdict.\n */\nexport const extractLeapSeconds = (\n  headers: Headers,\n): LeapSeconds | undefined => {\n  const raw = headers.get(TAI64N_HEADER_LEAP_SECONDS);\n  if (!raw || !DECIMAL_INTEGER.test(raw)) return undefined;\n  return asLeapSeconds(Number(raw));\n};\n","import { TAI64N_HEADER_NONCE } from './const';\n\n/**\n * Lower bound on `TAI-Nonce` field-value octets. A\n * field shorter than this is treated as absent (spec\n * §5.2). sf-binary is ASCII-only — the string length\n * equals the octet count.\n */\nexport const NONCE_MIN_OCTETS = 14;\n\n/**\n * Upper bound on `TAI-Nonce` field-value octets. A\n * field longer than this is treated as absent (spec\n * §5.2).\n */\nexport const NONCE_MAX_OCTETS = 174;\n\n/**\n * sf-binary item per RFC 9651 §3.3.5: standard base64\n * with `=` padding, wrapped in a leading and trailing\n * colon. The empty payload (`::`) is excluded — a\n * zero-length nonce is treated as absent per spec\n * §5.2. The alphabet contains no `,`, so a duplicated\n * field (joined by the Web `Headers` API with `,`)\n * fails the same check.\n */\nconst SF_BINARY_PATTERN =\n  /^:(?:[\\d+/A-Za-z]{4})*(?:[\\d+/A-Za-z]{4}|[\\d+/A-Za-z]{3}=|[\\d+/A-Za-z]{2}==):$/;\n\ndeclare const NonceBrand: unique symbol;\n\n/**\n * `string` that has been confirmed to satisfy the\n * sf-binary syntax of RFC 9651 §3.3.5 and the\n * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` length range\n * required by spec §5.2. Construct only via\n * {@link asNonce} or {@link extractNonce}; the brand\n * prevents arbitrary strings from reaching the\n * signing path.\n */\nexport type Nonce = string & { readonly [NonceBrand]: never };\n\n/**\n * Brand `value` as a {@link Nonce} when it satisfies\n * sf-binary syntax (RFC 9651 §3.3.5) and falls inside\n * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]`. Returns\n * `undefined` for anything else — every \"treat as\n * absent\" case in spec §5.2 collapsed into one\n * verdict.\n */\nexport const asNonce = (value: string): Nonce | undefined => {\n  if (\n    !value ||\n    value.length < NONCE_MIN_OCTETS ||\n    value.length > NONCE_MAX_OCTETS ||\n    !SF_BINARY_PATTERN.test(value)\n  ) return undefined;\n  return value as Nonce;\n};\n\n/**\n * Extract a usable `TAI-Nonce` from request headers.\n * Returns `undefined` when the field is missing or\n * fails {@link asNonce} validation.\n */\nexport const extractNonce = (headers: Headers): Nonce | undefined => {\n  const value = headers.get(TAI64N_HEADER_NONCE);\n  return value === null ? undefined : asNonce(value);\n};\n","import { TAI64_EPOCH_HI } from './const';\nimport { TAI_LEAP_SECONDS } from './leap-seconds';\n\ntype timestamp = {\n  nano: number\n  sec: number\n\n  offset?: number\n};\n\nexport const fromUTC = (utc: number): timestamp => {\n  // TODO: leap seconds table\n  const sec = Math.floor(utc / 1000) + TAI_LEAP_SECONDS;\n  const nano = (utc % 1000) * 1e6;\n  return { sec, nano, offset: TAI_LEAP_SECONDS };\n};\n\nexport const now = (): timestamp => {\n  const utc = Date.now();\n  return fromUTC(utc);\n};\n\nexport const tai64nLabel = (value?: timestamp): string => {\n  const { sec, nano } = value ?? now();\n\n  const secHi = Math.trunc(sec / u32Range) + TAI64_EPOCH_HI;\n  const secLo = sec % u32Range;\n\n  const secHiHex = secHi.toString(16).padStart(8, '0');\n  const secLoHex = secLo.toString(16).padStart(8, '0');\n  const nanoHex = nano.toString(16).padStart(8, '0');\n\n  return `@${secHiHex}${secLoHex}${nanoHex}`;\n};\n\nexport const tai64nLabelFromUTC = (utc: number): string => tai64nLabel(fromUTC(utc));\n\nconst u32Range = 0x1_00_00_00_00;\n","import { assertValidSelector, type Signer } from '@kagal/ed25519-secret';\n\nimport {\n  TAI64N_CONTENT_LENGTH,\n  TAI64N_CONTENT_TYPE,\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_SIGNATURE,\n} from './const';\nimport { buildCORSHeaders } from './cors';\nimport { type LeapSeconds, TAI_LEAP_SECONDS } from './leap-seconds';\nimport { extractNonce, type Nonce } from './nonce';\nimport { tai64nLabel } from './utils';\n\nconst ALLOW_HEADER = 'GET, HEAD, OPTIONS';\n\nconst textEncoder = new TextEncoder();\n\n/**\n * Domain-separation tag prepended to every signed\n * payload. Versioned so a v2 protocol can use the same\n * key without colliding with v1 signatures, and\n * NUL-terminated so the boundary between tag and\n * label is unambiguous.\n */\nconst DOMAIN_SEPARATOR = textEncoder.encode('taistamp-v1\\0');\n\nconst asBytes = (source: BufferSource): Uint8Array => {\n  if (source instanceof Uint8Array) {\n    return source;\n  }\n  if (ArrayBuffer.isView(source)) {\n    return new Uint8Array(\n      source.buffer,\n      source.byteOffset,\n      source.byteLength,\n    );\n  }\n  return new Uint8Array(source);\n};\n\n/**\n * Encode `source` as a Structured Field Value sf-binary\n * item per [RFC 9651 §3.3.5]: standard base64 with `=`\n * padding, wrapped in a leading and trailing colon.\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc9651#name-byte-sequences}\n */\nconst encodeStructuredBinary = (source: BufferSource): string => {\n  // Spread is safe for the 64-byte signatures handled\n  // here; revisit if larger payloads ever land.\n  const bytes = asBytes(source);\n  const standard = btoa(String.fromCodePoint(...bytes));\n  return `:${standard}:`;\n};\n\n/**\n * Compose the byte sequence covered by a TAI-Signature.\n *\n * @param label - the 25-byte TAI64N label string the\n *   server is returning\n * @param leapSeconds - the leap-seconds count the server\n *   advertises in `TAI-Leap-Seconds`\n * @param selector - the key selector the server\n *   advertises in `TAI-Key-Selector`; verifiers use\n *   this to look up the public key in DNS at\n *   `<selector>._taistamp.<host>`\n * @param nonce - the client-supplied nonce, echoed\n *   verbatim in `TAI-Nonce`; brand a verifier-side\n *   string with {@link asNonce} before passing it in\n * @returns the byte sequence verifiers reconstruct\n *   from the response and pass to their public-key\n *   verify routine. The framing is the\n *   domain-separation tag (`taistamp-v1` plus a\n *   trailing NUL byte), then the label bytes, then\n *   the leap-seconds count as a 4-byte big-endian\n *   unsigned integer, then a 1-byte selector length,\n *   then the selector bytes, then the nonce bytes.\n *\n * @remarks\n * Binding the selector into the signed payload stops a\n * downgrade attacker from rewriting `TAI-Key-Selector`\n * to point at a compromised or weaker key — the\n * signature would no longer verify under that key.\n * `leapSeconds` is encoded as a 4-byte big-endian\n * unsigned integer; the selector is length-prefixed by\n * a single byte (selectors are ≤ 63 chars per\n * {@link newTaistampHandler}'s validation).\n */\nexport const composeSignaturePayload = (\n  label: string,\n  leapSeconds: LeapSeconds,\n  selector: string,\n  nonce: Nonce,\n): ArrayBuffer => {\n  const labelBytes = textEncoder.encode(label);\n  const selectorBytes = textEncoder.encode(selector);\n  const nonceBytes = textEncoder.encode(nonce);\n\n  const buffer = new ArrayBuffer(\n    DOMAIN_SEPARATOR.length +\n    labelBytes.length +\n    4 +\n    1 +\n    selectorBytes.length +\n    nonceBytes.length,\n  );\n  const view = new Uint8Array(buffer);\n\n  let offset = 0;\n  view.set(DOMAIN_SEPARATOR, offset);\n  offset += DOMAIN_SEPARATOR.length;\n  view.set(labelBytes, offset);\n  offset += labelBytes.length;\n  new DataView(buffer).setUint32(offset, leapSeconds, false);\n  offset += 4;\n  view[offset] = selectorBytes.length;\n  offset += 1;\n  view.set(selectorBytes, offset);\n  offset += selectorBytes.length;\n  view.set(nonceBytes, offset);\n\n  return buffer;\n};\n\n/**\n * Configuration for {@link newTaistampHandler}.\n *\n * @remarks\n * `signer` and `selector` are co-required: pass both\n * to enable authenticated responses, or neither for\n * an unsigned handler. Passing only one is rejected\n * at construction time — without the selector\n * verifiers cannot find the key in DNS, and a\n * selector without a signer is a misconfiguration.\n */\nexport interface TaistampHandlerConfig {\n  /**\n   * Key selector advertised in the `TAI-Key-Selector`\n   * response header and bound into the signed payload.\n   * Verifiers look up the public key at\n   * `<selector>._taistamp.<host>` in DNS.\n   *\n   * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single\n   * DNS label starting with a letter, using\n   * DKIM-compatible characters and a valid sf-token);\n   * rotate by changing the selector and publishing a\n   * new TXT record.\n   */\n  selector?: string\n\n  /**\n   * {@link Signer} that produces `TAI-Signature` over\n   * the framed payload from {@link composeSignaturePayload}.\n   * Without a signer the nonce is still echoed but the\n   * response is unsigned.\n   */\n  signer?: Signer\n\n  /**\n   * CORS origin policy. Defaults to `'*'`; pass `false`\n   * to disable CORS entirely, or a specific origin\n   * (e.g. `'https://example.com'`) to scope the policy.\n   *\n   * Every response (`GET` / `HEAD` / `OPTIONS` / `405`)\n   * gains `Access-Control-Allow-Origin`; pre-flight\n   * `OPTIONS` also carries `-Allow-Methods`,\n   * `-Allow-Headers`, `-Expose-Headers`, and\n   * `-Max-Age: 600` per spec §4.2; success\n   * `GET` / `HEAD` carry `-Expose-Headers` so browser\n   * JS can read the `TAI-*` response headers. A\n   * non-`'*'` value adds `Vary: Origin` so caches can\n   * keep per-origin variants distinct.\n   *\n   * Disabling CORS does not affect method discovery:\n   * `OPTIONS` is still answered with `200` and\n   * `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.\n   */\n  cors?: false | string\n}\n\n/**\n * Validate a {@link TaistampHandlerConfig} and return\n * it unchanged when every field is well-formed.\n * Throws `TypeError` otherwise so misconfiguration\n * surfaces at handler construction rather than on the\n * first request.\n *\n * @throws TypeError if `signer` and `selector` are not\n *   both set or both unset, or if `selector` does not\n *   match `[A-Za-z][A-Za-z0-9_-]{0,62}`.\n */\nconst validateHandlerConfig = (\n  config: TaistampHandlerConfig,\n): TaistampHandlerConfig => {\n  const { cors, selector, signer } = config;\n\n  if ((signer === undefined) !== (selector === undefined)) {\n    throw new TypeError(\n      'newTaistampHandler: signer and selector must be set together',\n    );\n  }\n  if (cors !== undefined && cors !== false && typeof cors !== 'string') {\n    throw new TypeError(\n      'newTaistampHandler: cors must be false or a string origin',\n    );\n  }\n  if (selector !== undefined) {\n    assertValidSelector(selector, 'newTaistampHandler');\n  }\n\n  return config;\n};\n\n/**\n * Validate a {@link TaistampHandlerConfig} and derive\n * the construction-time state the handler closure\n * captures: the pre-baked CORS header maps and an\n * `addSignature` helper that mutates a response\n * `Headers` to carry `TAI-Key-Selector` and\n * `TAI-Signature` over the framed payload, present\n * only when both `signer` and `selector` are\n * configured. Validation is delegated to\n * {@link validateHandlerConfig}.\n *\n * @throws TypeError per {@link validateHandlerConfig}.\n */\nconst fromHandlerConfig = (config: TaistampHandlerConfig) => {\n  const { cors, selector, signer } = validateHandlerConfig(config);\n\n  const corsHeaders = buildCORSHeaders(cors);\n\n  const addSignature = selector !== undefined && signer !== undefined ?\n    async (\n      headers: Headers,\n      label: string,\n      nonce: Nonce,\n    ): Promise<void> => {\n      const payload = composeSignaturePayload(\n        label, TAI_LEAP_SECONDS, selector, nonce,\n      );\n      const signature = await signer.sign(payload);\n      headers.set(TAI64N_HEADER_KEY_SELECTOR, selector);\n      headers.set(\n        TAI64N_HEADER_SIGNATURE,\n        encodeStructuredBinary(signature),\n      );\n    } :\n    undefined;\n\n  return { addSignature, corsHeaders };\n};\n\n/**\n * Build a handler for `/.well-known/taistamp`.\n *\n * @param config - optional {@link TaistampHandlerConfig}\n * @returns an `async (request) => Response` callable\n *   directly as a Web `fetch` handler or as a Hono\n *   route handler.\n *\n * @throws TypeError if `signer` and `selector` are not\n *   both set or both unset, or if `selector` does not\n *   match `[A-Za-z][A-Za-z0-9_-]{0,62}`.\n *\n * @remarks\n * Behaviour:\n *\n * - `GET` / `HEAD` — body is a fresh 25-byte TAI64N\n *   label (`HEAD` omits the body). Response headers:\n *   Content-Type `application/tai64n`, Content-Length\n *   `25`, Cache-Control `no-store`, plus\n *   `TAI-Leap-Seconds` carrying the current count.\n * - `OPTIONS` — `200` with `Allow: GET, HEAD, OPTIONS`.\n *   When CORS is enabled (the default) the response\n *   also carries `Access-Control-Allow-*` and\n *   `-Expose-Headers` per\n *   {@link TaistampHandlerConfig.cors}. `OPTIONS` is\n *   never signed.\n * - Any other method — `405 Method Not Allowed` with\n *   `Allow: GET, HEAD, OPTIONS`.\n * - Request `TAI-Nonce` — on `GET`, the value is echoed\n *   verbatim in the response. A missing, empty,\n *   duplicated, structurally malformed, or out-of-range\n *   (14..174 octets) field is treated as absent (no\n *   echo, no signature) per spec §5.2 — see\n *   {@link extractNonce}. `HEAD`, `OPTIONS`, and `405`\n *   responses never carry `TAI-Nonce` per spec §4.1.\n * - Request `TAI-Nonce` *and* `signer` configured *and*\n *   the request method is `GET` — adds\n *   `TAI-Key-Selector` and `TAI-Signature` (sf-binary)\n *   over the bytes produced by\n *   {@link composeSignaturePayload}. The\n *   domain-separation tag means the same key cannot\n *   be tricked into producing valid signatures for\n *   other protocols. `HEAD`, `OPTIONS`, and `405`\n *   responses are never signed.\n *\n * The corresponding public key is expected to be\n * published out-of-band as a DNS TXT record at\n * `<selector>._taistamp.<host>` — verifiers fetch the\n * key by selector so the operator can rotate keys by\n * publishing a new selector while the old one is\n * still cached.\n *\n * @see {@link https://cr.yp.to/libtai/tai64.html} for\n *   TAI64N format\n */\nexport const newTaistampHandler = (\n  config: TaistampHandlerConfig = {},\n): ((request: Request) => Promise<Response>) => {\n  const { addSignature, corsHeaders } = fromHandlerConfig(config);\n\n  return async (request) => {\n    if (request.method === 'OPTIONS') {\n      return new Response(undefined, {\n        status: 200,\n        headers: { allow: ALLOW_HEADER, ...corsHeaders.preflight },\n      });\n    }\n\n    if (request.method !== 'GET' && request.method !== 'HEAD') {\n      return new Response(undefined, {\n        status: 405,\n        headers: { allow: ALLOW_HEADER, ...corsHeaders.error },\n      });\n    }\n\n    const nonce = extractNonce(request.headers);\n    const label = tai64nLabel();\n\n    const headers = new Headers({\n      'cache-control': 'no-store',\n      'content-length': String(TAI64N_CONTENT_LENGTH),\n      'content-type': TAI64N_CONTENT_TYPE,\n      [TAI64N_HEADER_LEAP_SECONDS]: String(TAI_LEAP_SECONDS),\n      ...corsHeaders.response,\n    });\n\n    if (nonce && request.method === 'GET') {\n      headers.set(TAI64N_HEADER_NONCE, nonce);\n      if (addSignature) {\n        await addSignature(headers, label, nonce);\n      }\n    }\n\n    const body = request.method === 'HEAD' ? undefined : label;\n    return new Response(body, { status: 200, headers });\n  };\n};\n","import pkg from '../package.json' with { type: 'json' };\n\n/** Package version from package.json. */\nexport const VERSION: string = pkg.version;\n\nexport {\n  newSigner as newEd25519Signer,\n  type Signer,\n} from '@kagal/ed25519-secret';\n\nexport * from './const';\nexport {\n  composeSignaturePayload,\n  newTaistampHandler,\n  type TaistampHandlerConfig,\n} from './handler';\nexport {\n  asLeapSeconds,\n  extractLeapSeconds,\n  type LeapSeconds,\n  TAI_LEAP_SECONDS,\n  TAI_LEAP_SECONDS_MAX,\n} from './leap-seconds';\nexport {\n  asNonce,\n  type Nonce,\n} from './nonce';\nexport {\n  fromUTC,\n  now,\n  tai64nLabel,\n  tai64nLabelFromUTC,\n} from './utils';\n"],"names":[],"mappings":";;;;;;;AAAO,MAAM,WAAA,GAAc;AAEpB,MAAM,mBAAA,GAAsB;AAC5B,MAAM,qBAAA,GAAwB,IAAI,EAAA,GAAK;AAEvC,MAAM,0BAAA,GAA6B;AACnC,MAAM,0BAAA,GAA6B;AACnC,MAAM,mBAAA,GAAsB;AAC5B,MAAM,uBAAA,GAA0B;AAEhC,MAAM,cAAA,GAAiB;;ACE9B,MAAM,kBAAA,GAAqB,WAAA;AAC3B,MAAM,kBAAA,GAAqB,mBAAA;AAC3B,MAAM,mBAAA,GAAsB;AAAA,EAC1B,0BAAA;AAAA,EACA,mBAAA;AAAA,EACA,0BAAA;AAAA,EACA;AACF,CAAA,CAAE,KAAK,IAAI,CAAA;AAIX,MAAM,YAAA,GAAe,KAAA;AA6Bd,MAAM,gBAAA,GAAmB,CAC9B,IAAA,KACmB;AACnB,EAAA,IAAI,SAAS,KAAA,EAAO;AAClB,IAAA,OAAO,EAAE,OAAO,EAAC,EAAG,WAAW,EAAC,EAAG,QAAA,EAAU,EAAC,EAAE;AAAA,EAClD;AACA,EAAA,MAAM,SAAS,IAAA,IAAQ,GAAA;AACvB,EAAA,MAAM,OACJ,MAAA,KAAW,GAAA,GAAM,EAAC,GAAI,EAAE,MAAM,QAAA,EAAS;AACzC,EAAA,OAAO;AAAA,IACL,KAAA,EAAO;AAAA,MACL,6BAAA,EAA+B,MAAA;AAAA,MAC/B,GAAG;AAAA,KACL;AAAA,IACA,SAAA,EAAW;AAAA,MACT,6BAAA,EAA+B,MAAA;AAAA,MAC/B,8BAAA,EAAgC,kBAAA;AAAA,MAChC,8BAAA,EAAgC,kBAAA;AAAA,MAChC,+BAAA,EAAiC,mBAAA;AAAA,MACjC,wBAAA,EAA0B,YAAA;AAAA,MAC1B,GAAG;AAAA,KACL;AAAA,IACA,QAAA,EAAU;AAAA,MACR,6BAAA,EAA+B,MAAA;AAAA,MAC/B,+BAAA,EAAiC,mBAAA;AAAA,MACjC,GAAG;AAAA;AACL,GACF;AACF,CAAA;;ACpEO,MAAM,oBAAA,GAAuB;AAmB7B,MAAM,aAAA,GAAgB,CAC3B,KAAA,KAC4B;AAC5B,EAAA,IACE,CAAC,OAAO,SAAA,CAAU,KAAK,KACvB,KAAA,GAAQ,CAAA,IACR,KAAA,GAAQ,oBAAA,EACR,OAAO,MAAA;AACT,EAAA,OAAO,KAAA;AACT;AAcO,MAAM,gBAAA,GAAgC;AAU7C,MAAM,eAAA,GAAkB,kBAAA;AAUjB,MAAM,kBAAA,GAAqB,CAChC,OAAA,KAC4B;AAC5B,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,0BAA0B,CAAA;AAClD,EAAA,IAAI,CAAC,GAAA,IAAO,CAAC,gBAAgB,IAAA,CAAK,GAAG,GAAG,OAAO,MAAA;AAC/C,EAAA,OAAO,aAAA,CAAc,MAAA,CAAO,GAAG,CAAC,CAAA;AAClC;;ACxEO,MAAM,gBAAA,GAAmB,EAAA;AAOzB,MAAM,gBAAA,GAAmB,GAAA;AAWhC,MAAM,iBAAA,GACJ,gFAAA;AAuBK,MAAM,OAAA,GAAU,CAAC,KAAA,KAAqC;AAC3D,EAAA,IACE,CAAC,KAAA,IACD,KAAA,CAAM,MAAA,GAAS,gBAAA,IACf,KAAA,CAAM,MAAA,GAAS,gBAAA,IACf,CAAC,iBAAA,CAAkB,IAAA,CAAK,KAAK,GAC7B,OAAO,MAAA;AACT,EAAA,OAAO,KAAA;AACT;AAOO,MAAM,YAAA,GAAe,CAAC,OAAA,KAAwC;AACnE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,GAAA,CAAI,mBAAmB,CAAA;AAC7C,EAAA,OAAO,KAAA,KAAU,IAAA,GAAO,MAAA,GAAY,OAAA,CAAQ,KAAK,CAAA;AACnD,CAAA;;AC1DO,MAAM,OAAA,GAAU,CAAC,GAAA,KAA2B;AAEjD,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,GAAI,CAAA,GAAI,gBAAA;AACrC,EAAA,MAAM,IAAA,GAAQ,MAAM,GAAA,GAAQ,GAAA;AAC5B,EAAA,OAAO,EAAE,GAAA,EAAK,IAAA,EAAM,MAAA,EAAQ,gBAAA,EAAiB;AAC/C;AAEO,MAAM,MAAM,MAAiB;AAClC,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,OAAO,QAAQ,GAAG,CAAA;AACpB;AAEO,MAAM,WAAA,GAAc,CAAC,KAAA,KAA8B;AACxD,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,SAAS,GAAA,EAAI;AAEnC,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,GAAA,GAAM,QAAQ,CAAA,GAAI,cAAA;AAC3C,EAAA,MAAM,QAAQ,GAAA,GAAM,QAAA;AAEpB,EAAA,MAAM,WAAW,KAAA,CAAM,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AACnD,EAAA,MAAM,WAAW,KAAA,CAAM,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AACnD,EAAA,MAAM,UAAU,IAAA,CAAK,QAAA,CAAS,EAAE,CAAA,CAAE,QAAA,CAAS,GAAG,GAAG,CAAA;AAEjD,EAAA,OAAO,CAAA,CAAA,EAAI,QAAQ,CAAA,EAAG,QAAQ,GAAG,OAAO,CAAA,CAAA;AAC1C;AAEO,MAAM,qBAAqB,CAAC,GAAA,KAAwB,WAAA,CAAY,OAAA,CAAQ,GAAG,CAAC;AAEnF,MAAM,QAAA,GAAW,UAAA;;ACtBjB,MAAM,YAAA,GAAe,oBAAA;AAErB,MAAM,WAAA,GAAc,IAAI,WAAA,EAAY;AASpC,MAAM,gBAAA,GAAmB,WAAA,CAAY,MAAA,CAAO,eAAe,CAAA;AAE3D,MAAM,OAAA,GAAU,CAAC,MAAA,KAAqC;AACpD,EAAA,IAAI,kBAAkB,UAAA,EAAY;AAChC,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,IAAI,WAAA,CAAY,MAAA,CAAO,MAAM,CAAA,EAAG;AAC9B,IAAA,OAAO,IAAI,UAAA;AAAA,MACT,MAAA,CAAO,MAAA;AAAA,MACP,MAAA,CAAO,UAAA;AAAA,MACP,MAAA,CAAO;AAAA,KACT;AAAA,EACF;AACA,EAAA,OAAO,IAAI,WAAW,MAAM,CAAA;AAC9B,CAAA;AASA,MAAM,sBAAA,GAAyB,CAAC,MAAA,KAAiC;AAG/D,EAAA,MAAM,KAAA,GAAQ,QAAQ,MAAM,CAAA;AAC5B,EAAA,MAAM,WAAW,IAAA,CAAK,MAAA,CAAO,aAAA,CAAc,GAAG,KAAK,CAAC,CAAA;AACpD,EAAA,OAAO,IAAI,QAAQ,CAAA,CAAA,CAAA;AACrB,CAAA;AAmCO,MAAM,uBAAA,GAA0B,CACrC,KAAA,EACA,WAAA,EACA,UACA,KAAA,KACgB;AAChB,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,MAAA,CAAO,KAAK,CAAA;AAC3C,EAAA,MAAM,aAAA,GAAgB,WAAA,CAAY,MAAA,CAAO,QAAQ,CAAA;AACjD,EAAA,MAAM,UAAA,GAAa,WAAA,CAAY,MAAA,CAAO,KAAK,CAAA;AAE3C,EAAA,MAAM,SAAS,IAAI,WAAA;AAAA,IACjB,gBAAA,CAAiB,SACjB,UAAA,CAAW,MAAA,GACX,IACA,CAAA,GACA,aAAA,CAAc,SACd,UAAA,CAAW;AAAA,GACb;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,MAAM,CAAA;AAElC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,IAAA,CAAK,GAAA,CAAI,kBAAkB,MAAM,CAAA;AACjC,EAAA,MAAA,IAAU,gBAAA,CAAiB,MAAA;AAC3B,EAAA,IAAA,CAAK,GAAA,CAAI,YAAY,MAAM,CAAA;AAC3B,EAAA,MAAA,IAAU,UAAA,CAAW,MAAA;AACrB,EAAA,IAAI,SAAS,MAAM,CAAA,CAAE,SAAA,CAAU,MAAA,EAAQ,aAAa,KAAK,CAAA;AACzD,EAAA,MAAA,IAAU,CAAA;AACV,EAAA,IAAA,CAAK,MAAM,IAAI,aAAA,CAAc,MAAA;AAC7B,EAAA,MAAA,IAAU,CAAA;AACV,EAAA,IAAA,CAAK,GAAA,CAAI,eAAe,MAAM,CAAA;AAC9B,EAAA,MAAA,IAAU,aAAA,CAAc,MAAA;AACxB,EAAA,IAAA,CAAK,GAAA,CAAI,YAAY,MAAM,CAAA;AAE3B,EAAA,OAAO,MAAA;AACT;AAqEA,MAAM,qBAAA,GAAwB,CAC5B,MAAA,KAC0B;AAC1B,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAO,GAAI,MAAA;AAEnC,EAAA,IAAK,MAAA,KAAW,MAAA,MAAgB,QAAA,KAAa,MAAA,CAAA,EAAY;AACvD,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,SAAS,MAAA,IAAa,IAAA,KAAS,KAAA,IAAS,OAAO,SAAS,QAAA,EAAU;AACpE,IAAA,MAAM,IAAI,SAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,mBAAA,CAAoB,UAAU,oBAAoB,CAAA;AAAA,EACpD;AAEA,EAAA,OAAO,MAAA;AACT,CAAA;AAeA,MAAM,iBAAA,GAAoB,CAAC,MAAA,KAAkC;AAC3D,EAAA,MAAM,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAO,GAAI,sBAAsB,MAAM,CAAA;AAE/D,EAAA,MAAM,WAAA,GAAc,iBAAiB,IAAI,CAAA;AAEzC,EAAA,MAAM,YAAA,GAAe,aAAa,MAAA,IAAa,MAAA,KAAW,SACxD,OACE,OAAA,EACA,OACA,KAAA,KACkB;AAClB,IAAA,MAAM,OAAA,GAAU,uBAAA;AAAA,MACd,KAAA;AAAA,MAAO,gBAAA;AAAA,MAAkB,QAAA;AAAA,MAAU;AAAA,KACrC;AACA,IAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAC3C,IAAA,OAAA,CAAQ,GAAA,CAAI,4BAA4B,QAAQ,CAAA;AAChD,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN,uBAAA;AAAA,MACA,uBAAuB,SAAS;AAAA,KAClC;AAAA,EACF,CAAA,GACA,MAAA;AAEF,EAAA,OAAO,EAAE,cAAc,WAAA,EAAY;AACrC,CAAA;AAyDO,MAAM,kBAAA,GAAqB,CAChC,MAAA,GAAgC,EAAC,KACa;AAC9C,EAAA,MAAM,EAAE,YAAA,EAAc,WAAA,EAAY,GAAI,kBAAkB,MAAM,CAAA;AAE9D,EAAA,OAAO,OAAO,OAAA,KAAY;AACxB,IAAA,IAAI,OAAA,CAAQ,WAAW,SAAA,EAAW;AAChC,MAAA,OAAO,IAAI,SAAS,MAAA,EAAW;AAAA,QAC7B,MAAA,EAAQ,GAAA;AAAA,QACR,SAAS,EAAE,KAAA,EAAO,YAAA,EAAc,GAAG,YAAY,SAAA;AAAU,OAC1D,CAAA;AAAA,IACH;AAEA,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,KAAA,IAAS,OAAA,CAAQ,WAAW,MAAA,EAAQ;AACzD,MAAA,OAAO,IAAI,SAAS,MAAA,EAAW;AAAA,QAC7B,MAAA,EAAQ,GAAA;AAAA,QACR,SAAS,EAAE,KAAA,EAAO,YAAA,EAAc,GAAG,YAAY,KAAA;AAAM,OACtD,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAA;AAC1C,IAAA,MAAM,QAAQ,WAAA,EAAY;AAE1B,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ;AAAA,MAC1B,eAAA,EAAiB,UAAA;AAAA,MACjB,gBAAA,EAAkB,OAAO,qBAAqB,CAAA;AAAA,MAC9C,cAAA,EAAgB,mBAAA;AAAA,MAChB,CAAC,0BAA0B,GAAG,MAAA,CAAO,gBAAgB,CAAA;AAAA,MACrD,GAAG,WAAA,CAAY;AAAA,KAChB,CAAA;AAED,IAAA,IAAI,KAAA,IAAS,OAAA,CAAQ,MAAA,KAAW,KAAA,EAAO;AACrC,MAAA,OAAA,CAAQ,GAAA,CAAI,qBAAqB,KAAK,CAAA;AACtC,MAAA,IAAI,YAAA,EAAc;AAChB,QAAA,MAAM,YAAA,CAAa,OAAA,EAAS,KAAA,EAAO,KAAK,CAAA;AAAA,MAC1C;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAS,MAAA,GAAY,KAAA;AACrD,IAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,EAAK,SAAS,CAAA;AAAA,EACpD,CAAA;AACF;;AC3VO,MAAM,UAAkB,GAAA,CAAI;;;;"}
+{"version":3,"file":"index.mjs","names":["pkg.version"],"sources":["../package.json","../src/const.ts","../src/cors.ts","../src/leap-seconds.ts","../src/nonce.ts","../src/utils.ts","../src/handler.ts","../src/index.ts"],"sourcesContent":["","export const TAISTAMP_PATH = '/.well-known/taistamp';\n\n/** @deprecated Renamed to {@link TAISTAMP_PATH}. */\nexport const TAI64N_PATH = TAISTAMP_PATH;\n\nexport const TAI64N_CONTENT_TYPE = 'application/tai64n';\nexport const TAI64N_CONTENT_LENGTH = 1 + 16 + 8; // '@' + sec (16 hex chars) + nano (8 hex chars)\n\nexport const TAI64N_HEADER_KEY_SELECTOR = 'TAI-Key-Selector';\nexport const TAI64N_HEADER_LEAP_SECONDS = 'TAI-Leap-Seconds';\nexport const TAI64N_HEADER_NONCE = 'TAI-Nonce';\nexport const TAI64N_HEADER_SIGNATURE = 'TAI-Signature';\n\nexport const TAI64_EPOCH_HI = 0x40_00_00_00;\n","import {\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_SIGNATURE,\n} from './const';\n\n// `Access-Control-Allow-Methods` (Fetch) is the list\n// of methods JS would ever preflight, so `OPTIONS` is\n// omitted. This is intentionally narrower than the\n// `Allow` header (RFC 9110 §9.3.7 method discovery,\n// `GET, HEAD, OPTIONS`) the handler itself emits.\nconst CORS_ALLOW_METHODS = 'GET, HEAD';\nconst CORS_ALLOW_HEADERS = TAI64N_HEADER_NONCE;\nconst CORS_EXPOSE_HEADERS = [\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_SIGNATURE,\n].join(', ');\n// Spec §4.2 SHOULDs at least 600s; 10 minutes is the\n// floor the spec example uses and keeps high-traffic\n// cross-origin clients off a pre-flight per fetch.\nconst CORS_MAX_AGE = '600';\n\n/**\n * The three CORS header maps the handler splices into\n * responses, keyed by response kind.\n *\n * - `preflight` — added to `OPTIONS 200` replies.\n * - `response` — added to successful `GET` / `HEAD`\n *   replies; carries `Access-Control-Expose-Headers`\n *   so browser JS can read the `TAI-*` headers.\n * - `error` — added to `405` replies; just the origin\n *   header (and `Vary` when scoped).\n */\nexport type CORSHeaderSets = {\n  error: Record<string, string>\n  preflight: Record<string, string>\n  response: Record<string, string>\n};\n\n/**\n * Pre-bake the three CORS header maps the handler\n * splices into responses, keyed by response kind.\n * `cors === false` collapses every map to `{}` so the\n * spread is a no-op; missing or empty input falls back\n * to `'*'`; `cors === '*'` skips `Vary: Origin` (a\n * wildcard does not vary by origin); a scoped origin\n * adds `Vary: Origin` so caches can keep per-origin\n * variants distinct.\n */\nexport const buildCORSHeaders = (\n  cors: false | string | undefined,\n): CORSHeaderSets => {\n  if (cors === false) {\n    return { error: {}, preflight: {}, response: {} };\n  }\n  const origin = cors || '*';\n  const vary: Record<string, string> =\n    origin === '*' ? {} : { vary: 'Origin' };\n  return {\n    error: {\n      'access-control-allow-origin': origin,\n      ...vary,\n    },\n    preflight: {\n      'access-control-allow-origin': origin,\n      'access-control-allow-methods': CORS_ALLOW_METHODS,\n      'access-control-allow-headers': CORS_ALLOW_HEADERS,\n      'access-control-expose-headers': CORS_EXPOSE_HEADERS,\n      'access-control-max-age': CORS_MAX_AGE,\n      ...vary,\n    },\n    response: {\n      'access-control-allow-origin': origin,\n      'access-control-expose-headers': CORS_EXPOSE_HEADERS,\n      ...vary,\n    },\n  };\n};\n","// cspell:words IERS\n\nimport { TAI64N_HEADER_LEAP_SECONDS } from './const';\n\n/**\n * Upper bound for `leapSeconds` in the taistamp signed\n * payload. The framing encodes the value as a 4-byte\n * big-endian unsigned integer, so any input outside\n * `[0, 2^32-1]` cannot be represented. Verifiers MUST\n * treat an out-of-range `TAI-Leap-Seconds` response\n * header as unsigned, per spec §5.1.\n */\nexport const TAI_LEAP_SECONDS_MAX = 0xFF_FF_FF_FF;\n\ndeclare const LeapSecondsBrand: unique symbol;\n\n/**\n * `number` that has been confirmed to fit the\n * `[0, TAI_LEAP_SECONDS_MAX]` u32be range required by\n * the taistamp signed-payload framing. Construct only\n * via {@link extractLeapSeconds} or {@link asLeapSeconds};\n * the brand prevents an arbitrary number from reaching\n * the signing path.\n */\nexport type LeapSeconds = number & { readonly [LeapSecondsBrand]: never };\n\n/**\n * Coerce a `number` to a {@link LeapSeconds}. Returns\n * `undefined` when `value` is non-integer, negative,\n * or exceeds {@link TAI_LEAP_SECONDS_MAX}.\n */\nexport const asLeapSeconds = (\n  value: number,\n): LeapSeconds | undefined => {\n  if (\n    !Number.isInteger(value) ||\n    value < 0 ||\n    value > TAI_LEAP_SECONDS_MAX\n  ) return undefined;\n  return value as LeapSeconds;\n};\n\n/**\n * Current TAI − UTC offset in whole seconds, used by\n * `fromUTC()` and emitted in the `TAI-Leap-Seconds`\n * response header. The value 37 has been in force\n * since 2017-01-01; update on the next IERS leap-second\n * announcement.\n *\n * @remarks\n * Stays a single `LeapSeconds` until a leap-seconds\n * table is added so the offset can be computed for any\n * TAI second; this constant becomes redundant then.\n */\nexport const TAI_LEAP_SECONDS: LeapSeconds = 37 as LeapSeconds;\n\n/**\n * Strict decimal integer: a single `0` or a non-zero\n * leading digit followed by digits. Rejects hex\n * (`0x25`), float-style integers (`37.0`), signs,\n * whitespace, exponential notation, and leading zeros\n * — every input `Number()` would silently coerce to\n * an integer despite not being a canonical decimal.\n */\nconst DECIMAL_INTEGER = /^(?:0|[1-9]\\d*)$/;\n\n/**\n * Extract a usable leap-seconds count from response\n * headers. Returns `undefined` when the\n * `TAI-Leap-Seconds` field is missing, empty,\n * non-numeric, non-integer, negative, or out-of-range\n * — every \"treat as unsigned\" case in spec §5.1\n * collapsed into one verdict.\n */\nexport const extractLeapSeconds = (\n  headers: Headers,\n): LeapSeconds | undefined => {\n  const raw = headers.get(TAI64N_HEADER_LEAP_SECONDS);\n  if (!raw || !DECIMAL_INTEGER.test(raw)) return undefined;\n  return asLeapSeconds(Number(raw));\n};\n","import { TAI64N_HEADER_NONCE } from './const';\n\n/**\n * Lower bound on `TAI-Nonce` field-value octets. A\n * field shorter than this is treated as absent (spec\n * §5.2). sf-binary is ASCII-only — the string length\n * equals the octet count.\n */\nexport const NONCE_MIN_OCTETS = 14;\n\n/**\n * Upper bound on `TAI-Nonce` field-value octets. A\n * field longer than this is treated as absent (spec\n * §5.2).\n */\nexport const NONCE_MAX_OCTETS = 174;\n\n/**\n * sf-binary item per RFC 9651 §3.3.5: standard base64\n * with `=` padding, wrapped in a leading and trailing\n * colon. The empty payload (`::`) is excluded — a\n * zero-length nonce is treated as absent per spec\n * §5.2. The alphabet contains no `,`, so a duplicated\n * field (joined by the Web `Headers` API with `,`)\n * fails the same check.\n */\nconst SF_BINARY_PATTERN =\n  /^:(?:[\\d+/A-Za-z]{4})*(?:[\\d+/A-Za-z]{4}|[\\d+/A-Za-z]{3}=|[\\d+/A-Za-z]{2}==):$/;\n\ndeclare const NonceBrand: unique symbol;\n\n/**\n * `string` that has been confirmed to satisfy the\n * sf-binary syntax of RFC 9651 §3.3.5 and the\n * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` length range\n * required by spec §5.2. Construct only via\n * {@link asNonce} or {@link extractNonce}; the brand\n * prevents arbitrary strings from reaching the\n * signing path.\n */\nexport type Nonce = string & { readonly [NonceBrand]: never };\n\n/**\n * Brand `value` as a {@link Nonce} when it satisfies\n * sf-binary syntax (RFC 9651 §3.3.5) and falls inside\n * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]`. Returns\n * `undefined` for anything else — every \"treat as\n * absent\" case in spec §5.2 collapsed into one\n * verdict.\n */\nexport const asNonce = (value: string): Nonce | undefined => {\n  if (\n    !value ||\n    value.length < NONCE_MIN_OCTETS ||\n    value.length > NONCE_MAX_OCTETS ||\n    !SF_BINARY_PATTERN.test(value)\n  ) return undefined;\n  return value as Nonce;\n};\n\n/**\n * Extract a usable `TAI-Nonce` from request headers.\n * Returns `undefined` when the field is missing or\n * fails {@link asNonce} validation.\n */\nexport const extractNonce = (headers: Headers): Nonce | undefined => {\n  const value = headers.get(TAI64N_HEADER_NONCE);\n  return value === null ? undefined : asNonce(value);\n};\n","import { TAI64_EPOCH_HI } from './const';\nimport { TAI_LEAP_SECONDS } from './leap-seconds';\n\ntype timestamp = {\n  nano: number\n  sec: number\n\n  offset?: number\n};\n\nexport const fromUTC = (utc: number): timestamp => {\n  // TODO: leap seconds table\n  const sec = Math.floor(utc / 1000) + TAI_LEAP_SECONDS;\n  const nano = (utc % 1000) * 1e6;\n  return { sec, nano, offset: TAI_LEAP_SECONDS };\n};\n\nexport const now = (): timestamp => {\n  const utc = Date.now();\n  return fromUTC(utc);\n};\n\nexport const tai64nLabel = (value?: timestamp): string => {\n  const { sec, nano } = value ?? now();\n\n  const secHi = Math.trunc(sec / u32Range) + TAI64_EPOCH_HI;\n  const secLo = sec % u32Range;\n\n  const secHiHex = secHi.toString(16).padStart(8, '0');\n  const secLoHex = secLo.toString(16).padStart(8, '0');\n  const nanoHex = nano.toString(16).padStart(8, '0');\n\n  return `@${secHiHex}${secLoHex}${nanoHex}`;\n};\n\nexport const tai64nLabelFromUTC = (utc: number): string => tai64nLabel(fromUTC(utc));\n\nconst u32Range = 0x1_00_00_00_00;\n","import { assertValidSelector, type Signer } from '@kagal/ed25519-secret';\n\nimport {\n  TAI64N_CONTENT_LENGTH,\n  TAI64N_CONTENT_TYPE,\n  TAI64N_HEADER_KEY_SELECTOR,\n  TAI64N_HEADER_LEAP_SECONDS,\n  TAI64N_HEADER_NONCE,\n  TAI64N_HEADER_SIGNATURE,\n} from './const';\nimport { buildCORSHeaders } from './cors';\nimport { type LeapSeconds, TAI_LEAP_SECONDS } from './leap-seconds';\nimport { extractNonce, type Nonce } from './nonce';\nimport { tai64nLabel } from './utils';\n\nconst ALLOW_HEADER = 'GET, HEAD, OPTIONS';\n\nconst textEncoder = new TextEncoder();\n\n/**\n * Domain-separation tag prepended to every signed\n * payload. Versioned so a v2 protocol can use the same\n * key without colliding with v1 signatures, and\n * NUL-terminated so the boundary between tag and\n * label is unambiguous.\n */\nconst DOMAIN_SEPARATOR = textEncoder.encode('taistamp-v1\\0');\n\nconst asBytes = (source: BufferSource): Uint8Array => {\n  if (source instanceof Uint8Array) {\n    return source;\n  }\n  if (ArrayBuffer.isView(source)) {\n    return new Uint8Array(\n      source.buffer,\n      source.byteOffset,\n      source.byteLength,\n    );\n  }\n  return new Uint8Array(source);\n};\n\n/**\n * Encode `source` as a Structured Field Value sf-binary\n * item per [RFC 9651 §3.3.5]: standard base64 with `=`\n * padding, wrapped in a leading and trailing colon.\n *\n * @see {@link https://www.rfc-editor.org/rfc/rfc9651#name-byte-sequences}\n */\nconst encodeStructuredBinary = (source: BufferSource): string => {\n  // Spread is safe for the 64-byte signatures handled\n  // here; revisit if larger payloads ever land.\n  const bytes = asBytes(source);\n  const standard = btoa(String.fromCodePoint(...bytes));\n  return `:${standard}:`;\n};\n\n/**\n * Compose the byte sequence covered by a TAI-Signature.\n *\n * @param label - the 25-byte TAI64N label string the\n *   server is returning\n * @param leapSeconds - the leap-seconds count the server\n *   advertises in `TAI-Leap-Seconds`\n * @param selector - the key selector the server\n *   advertises in `TAI-Key-Selector`; verifiers use\n *   this to look up the public key in DNS at\n *   `<selector>._taistamp.<host>`\n * @param nonce - the client-supplied nonce, echoed\n *   verbatim in `TAI-Nonce`; brand a verifier-side\n *   string with {@link asNonce} before passing it in\n * @returns the byte sequence verifiers reconstruct\n *   from the response and pass to their public-key\n *   verify routine. The framing is the\n *   domain-separation tag (`taistamp-v1` plus a\n *   trailing NUL byte), then the label bytes, then\n *   the leap-seconds count as a 4-byte big-endian\n *   unsigned integer, then a 1-byte selector length,\n *   then the selector bytes, then the nonce bytes.\n *\n * @remarks\n * Binding the selector into the signed payload stops a\n * downgrade attacker from rewriting `TAI-Key-Selector`\n * to point at a compromised or weaker key — the\n * signature would no longer verify under that key.\n * `leapSeconds` is encoded as a 4-byte big-endian\n * unsigned integer; the selector is length-prefixed by\n * a single byte (selectors are ≤ 63 chars per\n * {@link newTaistampHandler}'s validation).\n */\nexport const composeSignaturePayload = (\n  label: string,\n  leapSeconds: LeapSeconds,\n  selector: string,\n  nonce: Nonce,\n): ArrayBuffer => {\n  const labelBytes = textEncoder.encode(label);\n  const selectorBytes = textEncoder.encode(selector);\n  const nonceBytes = textEncoder.encode(nonce);\n\n  const buffer = new ArrayBuffer(\n    DOMAIN_SEPARATOR.length +\n    labelBytes.length +\n    4 +\n    1 +\n    selectorBytes.length +\n    nonceBytes.length,\n  );\n  const view = new Uint8Array(buffer);\n\n  let offset = 0;\n  view.set(DOMAIN_SEPARATOR, offset);\n  offset += DOMAIN_SEPARATOR.length;\n  view.set(labelBytes, offset);\n  offset += labelBytes.length;\n  new DataView(buffer).setUint32(offset, leapSeconds, false);\n  offset += 4;\n  view[offset] = selectorBytes.length;\n  offset += 1;\n  view.set(selectorBytes, offset);\n  offset += selectorBytes.length;\n  view.set(nonceBytes, offset);\n\n  return buffer;\n};\n\n/**\n * Configuration for {@link newTaistampHandler}.\n *\n * @remarks\n * `signer` and `selector` are co-required: pass both\n * to enable authenticated responses, or neither for\n * an unsigned handler. Passing only one is rejected\n * at construction time — without the selector\n * verifiers cannot find the key in DNS, and a\n * selector without a signer is a misconfiguration.\n */\nexport interface TaistampHandlerConfig {\n  /**\n   * Key selector advertised in the `TAI-Key-Selector`\n   * response header and bound into the signed payload.\n   * Verifiers look up the public key at\n   * `<selector>._taistamp.<host>` in DNS.\n   *\n   * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single\n   * DNS label starting with a letter, using\n   * DKIM-compatible characters and a valid sf-token);\n   * rotate by changing the selector and publishing a\n   * new TXT record.\n   */\n  selector?: string\n\n  /**\n   * {@link Signer} that produces `TAI-Signature` over\n   * the framed payload from {@link composeSignaturePayload}.\n   * Without a signer the nonce is still echoed but the\n   * response is unsigned.\n   */\n  signer?: Signer\n\n  /**\n   * CORS origin policy. Defaults to `'*'`; pass `false`\n   * to disable CORS entirely, or a specific origin\n   * (e.g. `'https://example.com'`) to scope the policy.\n   *\n   * Every response (`GET` / `HEAD` / `OPTIONS` / `405`)\n   * gains `Access-Control-Allow-Origin`; pre-flight\n   * `OPTIONS` also carries `-Allow-Methods`,\n   * `-Allow-Headers`, `-Expose-Headers`, and\n   * `-Max-Age: 600` per spec §4.2; success\n   * `GET` / `HEAD` carry `-Expose-Headers` so browser\n   * JS can read the `TAI-*` response headers. A\n   * non-`'*'` value adds `Vary: Origin` so caches can\n   * keep per-origin variants distinct.\n   *\n   * Disabling CORS does not affect method discovery:\n   * `OPTIONS` is still answered with `200` and\n   * `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.\n   */\n  cors?: false | string\n}\n\n/**\n * Validate a {@link TaistampHandlerConfig} and return\n * it unchanged when every field is well-formed.\n * Throws `TypeError` otherwise so misconfiguration\n * surfaces at handler construction rather than on the\n * first request.\n *\n * @throws TypeError if `signer` and `selector` are not\n *   both set or both unset, or if `selector` does not\n *   match `[A-Za-z][A-Za-z0-9_-]{0,62}`.\n */\nconst validateHandlerConfig = (\n  config: TaistampHandlerConfig,\n): TaistampHandlerConfig => {\n  const { cors, selector, signer } = config;\n\n  if ((signer === undefined) !== (selector === undefined)) {\n    throw new TypeError(\n      'newTaistampHandler: signer and selector must be set together',\n    );\n  }\n  if (cors !== undefined && cors !== false && typeof cors !== 'string') {\n    throw new TypeError(\n      'newTaistampHandler: cors must be false or a string origin',\n    );\n  }\n  if (selector !== undefined) {\n    assertValidSelector(selector, 'newTaistampHandler');\n  }\n\n  return config;\n};\n\n/**\n * Validate a {@link TaistampHandlerConfig} and derive\n * the construction-time state the handler closure\n * captures: the pre-baked CORS header maps and an\n * `addSignature` helper that mutates a response\n * `Headers` to carry `TAI-Key-Selector` and\n * `TAI-Signature` over the framed payload, present\n * only when both `signer` and `selector` are\n * configured. Validation is delegated to\n * {@link validateHandlerConfig}.\n *\n * @throws TypeError per {@link validateHandlerConfig}.\n */\nconst fromHandlerConfig = (config: TaistampHandlerConfig) => {\n  const { cors, selector, signer } = validateHandlerConfig(config);\n\n  const corsHeaders = buildCORSHeaders(cors);\n\n  const addSignature = selector !== undefined && signer !== undefined ?\n    async (\n      headers: Headers,\n      label: string,\n      nonce: Nonce,\n    ): Promise<void> => {\n      const payload = composeSignaturePayload(\n        label, TAI_LEAP_SECONDS, selector, nonce,\n      );\n      const signature = await signer.sign(payload);\n      headers.set(TAI64N_HEADER_KEY_SELECTOR, selector);\n      headers.set(\n        TAI64N_HEADER_SIGNATURE,\n        encodeStructuredBinary(signature),\n      );\n    } :\n    undefined;\n\n  return { addSignature, corsHeaders };\n};\n\n/**\n * Build a handler for `/.well-known/taistamp`.\n *\n * @param config - optional {@link TaistampHandlerConfig}\n * @returns an `async (request) => Response` callable\n *   directly as a Web `fetch` handler or as a Hono\n *   route handler.\n *\n * @throws TypeError if `signer` and `selector` are not\n *   both set or both unset, or if `selector` does not\n *   match `[A-Za-z][A-Za-z0-9_-]{0,62}`.\n *\n * @remarks\n * Behaviour:\n *\n * - `GET` / `HEAD` — body is a fresh 25-byte TAI64N\n *   label (`HEAD` omits the body). Response headers:\n *   Content-Type `application/tai64n`, Content-Length\n *   `25`, Cache-Control `no-store`, plus\n *   `TAI-Leap-Seconds` carrying the current count.\n * - `OPTIONS` — `200` with `Allow: GET, HEAD, OPTIONS`.\n *   When CORS is enabled (the default) the response\n *   also carries `Access-Control-Allow-*` and\n *   `-Expose-Headers` per\n *   {@link TaistampHandlerConfig.cors}. `OPTIONS` is\n *   never signed.\n * - Any other method — `405 Method Not Allowed` with\n *   `Allow: GET, HEAD, OPTIONS`.\n * - Request `TAI-Nonce` — on `GET`, the value is echoed\n *   verbatim in the response. A missing, empty,\n *   duplicated, structurally malformed, or out-of-range\n *   (14..174 octets) field is treated as absent (no\n *   echo, no signature) per spec §5.2 — see\n *   {@link extractNonce}. `HEAD`, `OPTIONS`, and `405`\n *   responses never carry `TAI-Nonce` per spec §4.1.\n * - Request `TAI-Nonce` *and* `signer` configured *and*\n *   the request method is `GET` — adds\n *   `TAI-Key-Selector` and `TAI-Signature` (sf-binary)\n *   over the bytes produced by\n *   {@link composeSignaturePayload}. The\n *   domain-separation tag means the same key cannot\n *   be tricked into producing valid signatures for\n *   other protocols. `HEAD`, `OPTIONS`, and `405`\n *   responses are never signed.\n *\n * The corresponding public key is expected to be\n * published out-of-band as a DNS TXT record at\n * `<selector>._taistamp.<host>` — verifiers fetch the\n * key by selector so the operator can rotate keys by\n * publishing a new selector while the old one is\n * still cached.\n *\n * @see {@link https://cr.yp.to/libtai/tai64.html} for\n *   TAI64N format\n */\nexport const newTaistampHandler = (\n  config: TaistampHandlerConfig = {},\n): ((request: Request) => Promise<Response>) => {\n  const { addSignature, corsHeaders } = fromHandlerConfig(config);\n\n  return async (request) => {\n    if (request.method === 'OPTIONS') {\n      return new Response(undefined, {\n        status: 200,\n        headers: { allow: ALLOW_HEADER, ...corsHeaders.preflight },\n      });\n    }\n\n    if (request.method !== 'GET' && request.method !== 'HEAD') {\n      return new Response(undefined, {\n        status: 405,\n        headers: { allow: ALLOW_HEADER, ...corsHeaders.error },\n      });\n    }\n\n    const nonce = extractNonce(request.headers);\n    const label = tai64nLabel();\n\n    const headers = new Headers({\n      'cache-control': 'no-store',\n      'content-length': String(TAI64N_CONTENT_LENGTH),\n      'content-type': TAI64N_CONTENT_TYPE,\n      [TAI64N_HEADER_LEAP_SECONDS]: String(TAI_LEAP_SECONDS),\n      ...corsHeaders.response,\n    });\n\n    if (nonce && request.method === 'GET') {\n      headers.set(TAI64N_HEADER_NONCE, nonce);\n      if (addSignature) {\n        await addSignature(headers, label, nonce);\n      }\n    }\n\n    const body = request.method === 'HEAD' ? undefined : label;\n    return new Response(body, { status: 200, headers });\n  };\n};\n","import pkg from '../package.json' with { type: 'json' };\n\n/** Package version from package.json. */\nexport const VERSION: string = pkg.version;\n\nexport {\n  newSigner as newEd25519Signer,\n  type Signer,\n} from '@kagal/ed25519-secret';\n\nexport * from './const';\nexport {\n  composeSignaturePayload,\n  newTaistampHandler,\n  type TaistampHandlerConfig,\n} from './handler';\nexport {\n  asLeapSeconds,\n  extractLeapSeconds,\n  type LeapSeconds,\n  TAI_LEAP_SECONDS,\n  TAI_LEAP_SECONDS_MAX,\n} from './leap-seconds';\nexport {\n  asNonce,\n  type Nonce,\n} from './nonce';\nexport {\n  fromUTC,\n  now,\n  tai64nLabel,\n  tai64nLabelFromUTC,\n} from './utils';\n"],"mappings":";;ACAA,MAAa,gBAAgB;AAG7B,MAAa,cAAc;AAE3B,MAAa,sBAAsB;AACnC,MAAa,wBAAwB;AAErC,MAAa,6BAA6B;AAC1C,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,0BAA0B;AAEvC,MAAa,iBAAiB;ACD9B,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;CAC1B;CACA;CACA;CACA;AACF,EAAE,KAAK,IAAI;AAIX,MAAM,eAAe;;;;;;;;;;EA6BrB,OAAa;GAGX,+BACS;GAAE,GAAA;EAAW;EAAe,WAAW;GAAE,+BAAA;GAElD,gCAAuB;GACvB,gCACoB;GACpB,iCAAO;GACL,0BAAO;GACL,GAAA;;EAEF,UAAA;GACA,+BAAW;GACT,iCAA+B;GAC/B,GAAA;;;;MAMF,uBAAU;MAER,iBAAA,UAAA;KACA,CAAG,OAAA,UAAA,KAAA,KAAA,QAAA,KAAA,QAAA,YAAA,OAAA,KAAA;QACL;;;;;;;;;AC/CJ,MAAa,oBACX;MAOA,WAAO,UAAA;CACT,IAAA,CAAA,SAAA,MAAA,SAAA,MAAA,MAAA,SAAA,OAAA,CAAA,kBAAA,KAAA,KAAA,GAAA,OAAA,KAAA;;;;;;;;;;;EAcA,QAAa;;;;;;;;;CAUb,MAAM,QAAA,MAAA;;;;;;;AAUN,MAAa,mBAAA,YACX,OAC4B,eAAA;MAC5B,WAAY,WAAY;CACxB,IAAI,kBAAS,YAAqB,OAAM;CACxC,IAAA,YAAO,OAAc,MAAO,GAAI,OAAA,IAAA,WAAA,OAAA,QAAA,OAAA,YAAA,OAAA,UAAA;CAClC,OAAA,IAAA,WAAA,MAAA;;;;;;ACxEA,MAAa,2BAAmB,OAAA,aAAA,UAAA,UAAA;;;;;;CAOhC,IAAA,SAAa;;;;;;;;;;CAWb,UAAM,cAAA;;;;;;;;CAwBN,IAAA,aAAwB,KAAA,GAAA,oBAAqC,UAAA,oBAAA;CAC3D,OACG;;;;;;;GAaL,MAAa,UAAA,wBAAwD,OAAA,IAAA,UAAA,KAAA;GACnE,MAAM,YAAQ,MAAY,OAAA,KAAA,OAAmB;GAC7C,QAAO,IAAA,4BAAqC,QAAK;GACnD,QAAA,IAAA,yBAAA,uBAAA,SAAA,CAAA;;EC1DA;CAIE;;MAAoB,sBAAA,SAAA,CAAA,MAAA;CAAyB,MAAA,EAAA,cAAA,gBAAA,kBAAA,MAAA;CAC/C,OAAA,OAAA,YAAA;EAEA,IAAa,QAAA,WAAuB,WAAA,OAAA,IAAA,SAAA,KAAA,GAAA;GAElC,QAAO;GACT,SAAA;IAEA,OAAa;IACX,GAAM,YAAO;GAEb;EACA,CAAA;EAMA,IAAA,QAJiB,WAAM,SAAa,QAAS,WAC5B,QAAM,OAAW,IAAE,SAAY,KAGnB,GAFb;GAGlB,QAAA;GAEA,SAAa;IAEb,OAAM;;GCtBN;EAEA,CAAA;;;;;;;;GASA,GAAM,YAAA;EAEN,CAAA;EACE,IAAI,SAAA,QAAkB,WAAA,OACpB;GAEF,QAAI,IAAA,qBACF,KAAO;GAMT,IAAA,cAAW,MAAW,aAAM,SAAA,OAAA,KAAA;EAC9B;;;;;;;;MAcE,UADiB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kagal/taistamp",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "type": "module",
   "description": "Signed TAI64N timestamps over HTTP",
   "author": "Apptly Software Ltd <oss@apptly.co>",
@@ -31,37 +31,37 @@
     "dist"
   ],
   "dependencies": {
-    "@kagal/ed25519-secret": "^0.1.1"
+    "@kagal/ed25519-secret": "^0.1.2"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.13.1",
-    "@cloudflare/workers-types": "^4.20260317.1",
-    "@kagal/build-tsdoc": "~0.1.0",
-    "@kagal/cross-test": "~0.1.3",
+    "@cloudflare/workers-types": "^4.20260514.1",
+    "@kagal/cross-test": "^0.1.3",
     "@noble/ed25519": "^3.1.0",
-    "@poupe/eslint-config": "~0.9.1",
-    "@types/node": "^20.19.39",
-    "@vitest/coverage-istanbul": "^4.1.5",
+    "@poupe/eslint-config": "^0.9.1",
+    "@types/node": "^20.19.41",
+    "@vitest/coverage-istanbul": "^4.1.6",
     "eslint": "^9.39.4",
     "npm-run-all2": "^8.0.4",
-    "publint": "~0.3.18",
+    "obuild": "^0.4.34",
+    "publint": "^0.3.21",
     "rimraf": "^6.1.3",
-    "typescript": "~5.9.3",
-    "unbuild": "3.6.1",
-    "vitest": "^4.1.5"
+    "typescript": "^6.0.3",
+    "vitest": "^4.1.6"
   },
   "engines": {
     "node": ">= 20.20.1",
     "pnpm": ">= 10.33.2"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "scripts": {
-    "build": "unbuild",
+    "build": "obuild",
     "clean": "rimraf dist node_modules",
     "dev": "vitest",
-    "dev:prepare": "unbuild --stub",
+    "dev:prepare": "obuild --stub",
     "lint": "eslint --fix .",
     "lint:_pkg-pr-new": "eslint --fix package.json",
     "lint:check": "eslint .",

package/dist/index.d.ts

@@ -1,244 +0,0 @@
-import { Signer } from '@kagal/ed25519-secret';
-export { Signer, newSigner as newEd25519Signer } from '@kagal/ed25519-secret';
-
-declare const TAI64N_PATH = "/.well-known/taistamp";
-declare const TAI64N_CONTENT_TYPE = "application/tai64n";
-declare const TAI64N_CONTENT_LENGTH: number;
-declare const TAI64N_HEADER_KEY_SELECTOR = "TAI-Key-Selector";
-declare const TAI64N_HEADER_LEAP_SECONDS = "TAI-Leap-Seconds";
-declare const TAI64N_HEADER_NONCE = "TAI-Nonce";
-declare const TAI64N_HEADER_SIGNATURE = "TAI-Signature";
-declare const TAI64_EPOCH_HI = 1073741824;
-
-/**
- * Upper bound for `leapSeconds` in the taistamp signed
- * payload. The framing encodes the value as a 4-byte
- * big-endian unsigned integer, so any input outside
- * `[0, 2^32-1]` cannot be represented. Verifiers MUST
- * treat an out-of-range `TAI-Leap-Seconds` response
- * header as unsigned, per spec §5.1.
- */
-declare const TAI_LEAP_SECONDS_MAX = 4294967295;
-declare const LeapSecondsBrand: unique symbol;
-/**
- * `number` that has been confirmed to fit the
- * `[0, TAI_LEAP_SECONDS_MAX]` u32be range required by
- * the taistamp signed-payload framing. Construct only
- * via {@link extractLeapSeconds} or {@link asLeapSeconds};
- * the brand prevents an arbitrary number from reaching
- * the signing path.
- */
-type LeapSeconds = number & {
-    readonly [LeapSecondsBrand]: never;
-};
-/**
- * Coerce a `number` to a {@link LeapSeconds}. Returns
- * `undefined` when `value` is non-integer, negative,
- * or exceeds {@link TAI_LEAP_SECONDS_MAX}.
- */
-declare const asLeapSeconds: (value: number) => LeapSeconds | undefined;
-/**
- * Current TAI − UTC offset in whole seconds, used by
- * `fromUTC()` and emitted in the `TAI-Leap-Seconds`
- * response header. The value 37 has been in force
- * since 2017-01-01; update on the next IERS leap-second
- * announcement.
- *
- * @remarks
- * Stays a single `LeapSeconds` until a leap-seconds
- * table is added so the offset can be computed for any
- * TAI second; this constant becomes redundant then.
- */
-declare const TAI_LEAP_SECONDS: LeapSeconds;
-/**
- * Extract a usable leap-seconds count from response
- * headers. Returns `undefined` when the
- * `TAI-Leap-Seconds` field is missing, empty,
- * non-numeric, non-integer, negative, or out-of-range
- * — every "treat as unsigned" case in spec §5.1
- * collapsed into one verdict.
- */
-declare const extractLeapSeconds: (headers: Headers) => LeapSeconds | undefined;
-
-declare const NonceBrand: unique symbol;
-/**
- * `string` that has been confirmed to satisfy the
- * sf-binary syntax of RFC 9651 §3.3.5 and the
- * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` length range
- * required by spec §5.2. Construct only via
- * {@link asNonce} or {@link extractNonce}; the brand
- * prevents arbitrary strings from reaching the
- * signing path.
- */
-type Nonce = string & {
-    readonly [NonceBrand]: never;
-};
-/**
- * Brand `value` as a {@link Nonce} when it satisfies
- * sf-binary syntax (RFC 9651 §3.3.5) and falls inside
- * `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]`. Returns
- * `undefined` for anything else — every "treat as
- * absent" case in spec §5.2 collapsed into one
- * verdict.
- */
-declare const asNonce: (value: string) => Nonce | undefined;
-
-/**
- * Compose the byte sequence covered by a TAI-Signature.
- *
- * @param label - the 25-byte TAI64N label string the
- *   server is returning
- * @param leapSeconds - the leap-seconds count the server
- *   advertises in `TAI-Leap-Seconds`
- * @param selector - the key selector the server
- *   advertises in `TAI-Key-Selector`; verifiers use
- *   this to look up the public key in DNS at
- *   `<selector>._taistamp.<host>`
- * @param nonce - the client-supplied nonce, echoed
- *   verbatim in `TAI-Nonce`; brand a verifier-side
- *   string with {@link asNonce} before passing it in
- * @returns the byte sequence verifiers reconstruct
- *   from the response and pass to their public-key
- *   verify routine. The framing is the
- *   domain-separation tag (`taistamp-v1` plus a
- *   trailing NUL byte), then the label bytes, then
- *   the leap-seconds count as a 4-byte big-endian
- *   unsigned integer, then a 1-byte selector length,
- *   then the selector bytes, then the nonce bytes.
- *
- * @remarks
- * Binding the selector into the signed payload stops a
- * downgrade attacker from rewriting `TAI-Key-Selector`
- * to point at a compromised or weaker key — the
- * signature would no longer verify under that key.
- * `leapSeconds` is encoded as a 4-byte big-endian
- * unsigned integer; the selector is length-prefixed by
- * a single byte (selectors are ≤ 63 chars per
- * {@link newTaistampHandler}'s validation).
- */
-declare const composeSignaturePayload: (label: string, leapSeconds: LeapSeconds, selector: string, nonce: Nonce) => ArrayBuffer;
-/**
- * Configuration for {@link newTaistampHandler}.
- *
- * @remarks
- * `signer` and `selector` are co-required: pass both
- * to enable authenticated responses, or neither for
- * an unsigned handler. Passing only one is rejected
- * at construction time — without the selector
- * verifiers cannot find the key in DNS, and a
- * selector without a signer is a misconfiguration.
- */
-interface TaistampHandlerConfig {
-    /**
-     * Key selector advertised in the `TAI-Key-Selector`
-     * response header and bound into the signed payload.
-     * Verifiers look up the public key at
-     * `<selector>._taistamp.<host>` in DNS.
-     *
-     * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single
-     * DNS label starting with a letter, using
-     * DKIM-compatible characters and a valid sf-token);
-     * rotate by changing the selector and publishing a
-     * new TXT record.
-     */
-    selector?: string;
-    /**
-     * {@link Signer} that produces `TAI-Signature` over
-     * the framed payload from {@link composeSignaturePayload}.
-     * Without a signer the nonce is still echoed but the
-     * response is unsigned.
-     */
-    signer?: Signer;
-    /**
-     * CORS origin policy. Defaults to `'*'`; pass `false`
-     * to disable CORS entirely, or a specific origin
-     * (e.g. `'https://example.com'`) to scope the policy.
-     *
-     * Every response (`GET` / `HEAD` / `OPTIONS` / `405`)
-     * gains `Access-Control-Allow-Origin`; pre-flight
-     * `OPTIONS` also carries `-Allow-Methods`,
-     * `-Allow-Headers`, `-Expose-Headers`, and
-     * `-Max-Age: 600` per spec §4.2; success
-     * `GET` / `HEAD` carry `-Expose-Headers` so browser
-     * JS can read the `TAI-*` response headers. A
-     * non-`'*'` value adds `Vary: Origin` so caches can
-     * keep per-origin variants distinct.
-     *
-     * Disabling CORS does not affect method discovery:
-     * `OPTIONS` is still answered with `200` and
-     * `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.
-     */
-    cors?: false | string;
-}
-/**
- * Build a handler for `/.well-known/taistamp`.
- *
- * @param config - optional {@link TaistampHandlerConfig}
- * @returns an `async (request) => Response` callable
- *   directly as a Web `fetch` handler or as a Hono
- *   route handler.
- *
- * @throws TypeError if `signer` and `selector` are not
- *   both set or both unset, or if `selector` does not
- *   match `[A-Za-z][A-Za-z0-9_-]{0,62}`.
- *
- * @remarks
- * Behaviour:
- *
- * - `GET` / `HEAD` — body is a fresh 25-byte TAI64N
- *   label (`HEAD` omits the body). Response headers:
- *   Content-Type `application/tai64n`, Content-Length
- *   `25`, Cache-Control `no-store`, plus
- *   `TAI-Leap-Seconds` carrying the current count.
- * - `OPTIONS` — `200` with `Allow: GET, HEAD, OPTIONS`.
- *   When CORS is enabled (the default) the response
- *   also carries `Access-Control-Allow-*` and
- *   `-Expose-Headers` per
- *   {@link TaistampHandlerConfig.cors}. `OPTIONS` is
- *   never signed.
- * - Any other method — `405 Method Not Allowed` with
- *   `Allow: GET, HEAD, OPTIONS`.
- * - Request `TAI-Nonce` — on `GET`, the value is echoed
- *   verbatim in the response. A missing, empty,
- *   duplicated, structurally malformed, or out-of-range
- *   (14..174 octets) field is treated as absent (no
- *   echo, no signature) per spec §5.2 — see
- *   {@link extractNonce}. `HEAD`, `OPTIONS`, and `405`
- *   responses never carry `TAI-Nonce` per spec §4.1.
- * - Request `TAI-Nonce` *and* `signer` configured *and*
- *   the request method is `GET` — adds
- *   `TAI-Key-Selector` and `TAI-Signature` (sf-binary)
- *   over the bytes produced by
- *   {@link composeSignaturePayload}. The
- *   domain-separation tag means the same key cannot
- *   be tricked into producing valid signatures for
- *   other protocols. `HEAD`, `OPTIONS`, and `405`
- *   responses are never signed.
- *
- * The corresponding public key is expected to be
- * published out-of-band as a DNS TXT record at
- * `<selector>._taistamp.<host>` — verifiers fetch the
- * key by selector so the operator can rotate keys by
- * publishing a new selector while the old one is
- * still cached.
- *
- * @see {@link https://cr.yp.to/libtai/tai64.html} for
- *   TAI64N format
- */
-declare const newTaistampHandler: (config?: TaistampHandlerConfig) => ((request: Request) => Promise<Response>);
-
-type timestamp = {
-    nano: number;
-    sec: number;
-    offset?: number;
-};
-declare const fromUTC: (utc: number) => timestamp;
-declare const now: () => timestamp;
-declare const tai64nLabel: (value?: timestamp) => string;
-declare const tai64nLabelFromUTC: (utc: number) => string;
-
-/** Package version from package.json. */
-declare const VERSION: string;
-
-export { TAI64N_CONTENT_LENGTH, TAI64N_CONTENT_TYPE, TAI64N_HEADER_KEY_SELECTOR, TAI64N_HEADER_LEAP_SECONDS, TAI64N_HEADER_NONCE, TAI64N_HEADER_SIGNATURE, TAI64N_PATH, TAI64_EPOCH_HI, TAI_LEAP_SECONDS, TAI_LEAP_SECONDS_MAX, VERSION, asLeapSeconds, asNonce, composeSignaturePayload, extractLeapSeconds, fromUTC, newTaistampHandler, now, tai64nLabel, tai64nLabelFromUTC };
-export type { LeapSeconds, Nonce, TaistampHandlerConfig };