@kagal/taistamp 0.1.2 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/README.md +214 -53
  2. package/dist/_chunks/time.d.mts +144 -0
  3. package/dist/_chunks/time.mjs +68 -0
  4. package/dist/_chunks/time.mjs.map +1 -0
  5. package/dist/index.api.json +2094 -1546
  6. package/dist/index.d.mts +66 -83
  7. package/dist/index.d.ts +66 -83
  8. package/dist/index.mjs +52 -72
  9. package/dist/index.mjs.map +1 -1
  10. package/dist/utils.api.json +825 -0
  11. package/dist/utils.d.mts +29 -0
  12. package/dist/utils.d.ts +29 -0
  13. package/dist/utils.mjs +2 -0
  14. package/package.json +9 -5
package/dist/index.api.json CHANGED
@@ -1,1546 +1,2094 @@
1
- {
2
- "metadata": {
3
- "toolPackage": "@microsoft/api-extractor",
4
- "toolVersion": "7.58.7",
5
- "schemaVersion": 1011,
6
- "oldestForwardsCompatibleVersion": 1001,
7
- "tsdocConfig": {
8
- "$schema": "https://developer.microsoft.com/json-schemas/tsdoc/v0/tsdoc.schema.json",
9
- "noStandardTags": true,
10
- "tagDefinitions": [
11
- {
12
- "tagName": "@alpha",
13
- "syntaxKind": "modifier"
14
- },
15
- {
16
- "tagName": "@beta",
17
- "syntaxKind": "modifier"
18
- },
19
- {
20
- "tagName": "@defaultValue",
21
- "syntaxKind": "block"
22
- },
23
- {
24
- "tagName": "@decorator",
25
- "syntaxKind": "block",
26
- "allowMultiple": true
27
- },
28
- {
29
- "tagName": "@deprecated",
30
- "syntaxKind": "block"
31
- },
32
- {
33
- "tagName": "@eventProperty",
34
- "syntaxKind": "modifier"
35
- },
36
- {
37
- "tagName": "@example",
38
- "syntaxKind": "block",
39
- "allowMultiple": true
40
- },
41
- {
42
- "tagName": "@experimental",
43
- "syntaxKind": "modifier"
44
- },
45
- {
46
- "tagName": "@inheritDoc",
47
- "syntaxKind": "inline"
48
- },
49
- {
50
- "tagName": "@internal",
51
- "syntaxKind": "modifier"
52
- },
53
- {
54
- "tagName": "@label",
55
- "syntaxKind": "inline"
56
- },
57
- {
58
- "tagName": "@link",
59
- "syntaxKind": "inline",
60
- "allowMultiple": true
61
- },
62
- {
63
- "tagName": "@override",
64
- "syntaxKind": "modifier"
65
- },
66
- {
67
- "tagName": "@packageDocumentation",
68
- "syntaxKind": "modifier"
69
- },
70
- {
71
- "tagName": "@param",
72
- "syntaxKind": "block",
73
- "allowMultiple": true
74
- },
75
- {
76
- "tagName": "@privateRemarks",
77
- "syntaxKind": "block"
78
- },
79
- {
80
- "tagName": "@public",
81
- "syntaxKind": "modifier"
82
- },
83
- {
84
- "tagName": "@readonly",
85
- "syntaxKind": "modifier"
86
- },
87
- {
88
- "tagName": "@remarks",
89
- "syntaxKind": "block"
90
- },
91
- {
92
- "tagName": "@returns",
93
- "syntaxKind": "block"
94
- },
95
- {
96
- "tagName": "@sealed",
97
- "syntaxKind": "modifier"
98
- },
99
- {
100
- "tagName": "@see",
101
- "syntaxKind": "block"
102
- },
103
- {
104
- "tagName": "@throws",
105
- "syntaxKind": "block",
106
- "allowMultiple": true
107
- },
108
- {
109
- "tagName": "@typeParam",
110
- "syntaxKind": "block",
111
- "allowMultiple": true
112
- },
113
- {
114
- "tagName": "@virtual",
115
- "syntaxKind": "modifier"
116
- },
117
- {
118
- "tagName": "@jsx",
119
- "syntaxKind": "block"
120
- },
121
- {
122
- "tagName": "@jsxRuntime",
123
- "syntaxKind": "block"
124
- },
125
- {
126
- "tagName": "@jsxFrag",
127
- "syntaxKind": "block"
128
- },
129
- {
130
- "tagName": "@jsxImportSource",
131
- "syntaxKind": "block"
132
- },
133
- {
134
- "tagName": "@betaDocumentation",
135
- "syntaxKind": "modifier"
136
- },
137
- {
138
- "tagName": "@internalRemarks",
139
- "syntaxKind": "block"
140
- },
141
- {
142
- "tagName": "@preapproved",
143
- "syntaxKind": "modifier"
144
- }
145
- ],
146
- "supportForTags": {
147
- "@alpha": true,
148
- "@beta": true,
149
- "@defaultValue": true,
150
- "@decorator": true,
151
- "@deprecated": true,
152
- "@eventProperty": true,
153
- "@example": true,
154
- "@experimental": true,
155
- "@inheritDoc": true,
156
- "@internal": true,
157
- "@label": true,
158
- "@link": true,
159
- "@override": true,
160
- "@packageDocumentation": true,
161
- "@param": true,
162
- "@privateRemarks": true,
163
- "@public": true,
164
- "@readonly": true,
165
- "@remarks": true,
166
- "@returns": true,
167
- "@sealed": true,
168
- "@see": true,
169
- "@throws": true,
170
- "@typeParam": true,
171
- "@virtual": true,
172
- "@betaDocumentation": true,
173
- "@internalRemarks": true,
174
- "@preapproved": true
175
- },
176
- "reportUnsupportedHtmlElements": false
177
- }
178
- },
179
- "kind": "Package",
180
- "canonicalReference": "@kagal/taistamp!",
181
- "docComment": "",
182
- "name": "@kagal/taistamp",
183
- "preserveMemberOrder": false,
184
- "members": [
185
- {
186
- "kind": "EntryPoint",
187
- "canonicalReference": "@kagal/taistamp!",
188
- "name": "",
189
- "preserveMemberOrder": false,
190
- "members": [
191
- {
192
- "kind": "Function",
193
- "canonicalReference": "@kagal/taistamp!asLeapSeconds:function(1)",
194
- "docComment": "/**\n * Coerce a `number` to a {@link LeapSeconds}. Returns `undefined` when `value` is non-integer, negative, or exceeds {@link TAI_LEAP_SECONDS_MAX}.\n */\n",
195
- "excerptTokens": [
196
- {
197
- "kind": "Content",
198
- "text": "asLeapSeconds: (value: "
199
- },
200
- {
201
- "kind": "Content",
202
- "text": "number"
203
- },
204
- {
205
- "kind": "Content",
206
- "text": ") => "
207
- },
208
- {
209
- "kind": "Reference",
210
- "text": "LeapSeconds",
211
- "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
212
- },
213
- {
214
- "kind": "Content",
215
- "text": " | undefined"
216
- }
217
- ],
218
- "fileUrlPath": "dist/index.d.mts",
219
- "returnTypeTokenRange": {
220
- "startIndex": 3,
221
- "endIndex": 5
222
- },
223
- "releaseTag": "Public",
224
- "overloadIndex": 1,
225
- "parameters": [
226
- {
227
- "parameterName": "value",
228
- "parameterTypeTokenRange": {
229
- "startIndex": 1,
230
- "endIndex": 2
231
- },
232
- "isOptional": false
233
- }
234
- ],
235
- "name": "asLeapSeconds"
236
- },
237
- {
238
- "kind": "Function",
239
- "canonicalReference": "@kagal/taistamp!asNonce:function(1)",
240
- "docComment": "/**\n * Brand `value` as a {@link Nonce} when it satisfies sf-binary syntax (RFC 9651 §3.3.5) and falls inside `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` — the wire range equivalent to spec §5.4's normative decoded-length bound of 7..129 octets. Returns `undefined` for anything else — every \"treat as absent\" case in spec §5.4 collapsed into one verdict.\n */\n",
241
- "excerptTokens": [
242
- {
243
- "kind": "Content",
244
- "text": "asNonce: (value: "
245
- },
246
- {
247
- "kind": "Content",
248
- "text": "string"
249
- },
250
- {
251
- "kind": "Content",
252
- "text": ") => "
253
- },
254
- {
255
- "kind": "Reference",
256
- "text": "Nonce",
257
- "canonicalReference": "@kagal/taistamp!Nonce:type"
258
- },
259
- {
260
- "kind": "Content",
261
- "text": " | undefined"
262
- }
263
- ],
264
- "fileUrlPath": "dist/index.d.mts",
265
- "returnTypeTokenRange": {
266
- "startIndex": 3,
267
- "endIndex": 5
268
- },
269
- "releaseTag": "Public",
270
- "overloadIndex": 1,
271
- "parameters": [
272
- {
273
- "parameterName": "value",
274
- "parameterTypeTokenRange": {
275
- "startIndex": 1,
276
- "endIndex": 2
277
- },
278
- "isOptional": false
279
- }
280
- ],
281
- "name": "asNonce"
282
- },
283
- {
284
- "kind": "Function",
285
- "canonicalReference": "@kagal/taistamp!composeSignaturePayload:function(1)",
286
- "docComment": "/**\n * Compose the byte sequence covered by a TAI-Signature.\n *\n * @remarks\n *\n * Binding the selector into the signed payload stops a downgrade attacker from rewriting `TAI-Key-Selector` to point at a compromised or weaker key — the signature would no longer verify under that key. `leapSeconds` is encoded as a 4-byte big-endian unsigned integer; the selector is length-prefixed by a single byte (selectors are ≤ 63 chars per {@link newTaistampHandler}'s validation).\n *\n * @param label - the 25-byte TAI64N label string the server is returning\n *\n * @param leapSeconds - the leap-seconds count the server advertises in `TAI-Leap-Seconds`\n *\n * @param selector - the key selector the server advertises in `TAI-Key-Selector`; verifiers use this to look up the public key in DNS at `<selector>._taistamp.<host>`\n *\n * @param nonce - the client-supplied nonce, echoed verbatim in `TAI-Nonce`; brand a verifier-side string with {@link asNonce} before passing it in\n *\n * @returns the byte sequence verifiers reconstruct from the response and pass to their public-key verify routine. The framing is the domain-separation tag (`taistamp-v1` plus a trailing NUL byte), then the label bytes, then the leap-seconds count as a 4-byte big-endian unsigned integer, then a 1-byte selector length, then the selector bytes, then the decoded sf-binary octets of the nonce (spec §6.1 — the wire `:base64:` framing is not signed).\n */\n",
287
- "excerptTokens": [
288
- {
289
- "kind": "Content",
290
- "text": "composeSignaturePayload: (label: "
291
- },
292
- {
293
- "kind": "Content",
294
- "text": "string"
295
- },
296
- {
297
- "kind": "Content",
298
- "text": ", leapSeconds: "
299
- },
300
- {
301
- "kind": "Reference",
302
- "text": "LeapSeconds",
303
- "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
304
- },
305
- {
306
- "kind": "Content",
307
- "text": ", selector: "
308
- },
309
- {
310
- "kind": "Content",
311
- "text": "string"
312
- },
313
- {
314
- "kind": "Content",
315
- "text": ", nonce: "
316
- },
317
- {
318
- "kind": "Reference",
319
- "text": "Nonce",
320
- "canonicalReference": "@kagal/taistamp!Nonce:type"
321
- },
322
- {
323
- "kind": "Content",
324
- "text": ") => "
325
- },
326
- {
327
- "kind": "Reference",
328
- "text": "ArrayBuffer",
329
- "canonicalReference": "!ArrayBuffer:interface"
330
- }
331
- ],
332
- "fileUrlPath": "dist/index.d.mts",
333
- "returnTypeTokenRange": {
334
- "startIndex": 9,
335
- "endIndex": 10
336
- },
337
- "releaseTag": "Public",
338
- "overloadIndex": 1,
339
- "parameters": [
340
- {
341
- "parameterName": "label",
342
- "parameterTypeTokenRange": {
343
- "startIndex": 1,
344
- "endIndex": 2
345
- },
346
- "isOptional": false
347
- },
348
- {
349
- "parameterName": "leapSeconds",
350
- "parameterTypeTokenRange": {
351
- "startIndex": 3,
352
- "endIndex": 4
353
- },
354
- "isOptional": false
355
- },
356
- {
357
- "parameterName": "selector",
358
- "parameterTypeTokenRange": {
359
- "startIndex": 5,
360
- "endIndex": 6
361
- },
362
- "isOptional": false
363
- },
364
- {
365
- "parameterName": "nonce",
366
- "parameterTypeTokenRange": {
367
- "startIndex": 7,
368
- "endIndex": 8
369
- },
370
- "isOptional": false
371
- }
372
- ],
373
- "name": "composeSignaturePayload"
374
- },
375
- {
376
- "kind": "Function",
377
- "canonicalReference": "@kagal/taistamp!extractLeapSeconds:function(1)",
378
- "docComment": "/**\n * Extract a usable leap-seconds count from response headers. Returns `undefined` when the `TAI-Leap-Seconds` field is missing, empty, non-numeric, non-integer, negative, or out-of-range — every \"treat as unsigned\" case in spec §5.3 collapsed into one verdict.\n */\n",
379
- "excerptTokens": [
380
- {
381
- "kind": "Content",
382
- "text": "extractLeapSeconds: (headers: "
383
- },
384
- {
385
- "kind": "Reference",
386
- "text": "Headers",
387
- "canonicalReference": "!Headers:interface"
388
- },
389
- {
390
- "kind": "Content",
391
- "text": ") => "
392
- },
393
- {
394
- "kind": "Reference",
395
- "text": "LeapSeconds",
396
- "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
397
- },
398
- {
399
- "kind": "Content",
400
- "text": " | undefined"
401
- }
402
- ],
403
- "fileUrlPath": "dist/index.d.mts",
404
- "returnTypeTokenRange": {
405
- "startIndex": 3,
406
- "endIndex": 5
407
- },
408
- "releaseTag": "Public",
409
- "overloadIndex": 1,
410
- "parameters": [
411
- {
412
- "parameterName": "headers",
413
- "parameterTypeTokenRange": {
414
- "startIndex": 1,
415
- "endIndex": 2
416
- },
417
- "isOptional": false
418
- }
419
- ],
420
- "name": "extractLeapSeconds"
421
- },
422
- {
423
- "kind": "Function",
424
- "canonicalReference": "@kagal/taistamp!fromUTC:function(1)",
425
- "docComment": "",
426
- "excerptTokens": [
427
- {
428
- "kind": "Content",
429
- "text": "fromUTC: (utc: "
430
- },
431
- {
432
- "kind": "Content",
433
- "text": "number"
434
- },
435
- {
436
- "kind": "Content",
437
- "text": ") => "
438
- },
439
- {
440
- "kind": "Reference",
441
- "text": "timestamp",
442
- "canonicalReference": "@kagal/taistamp!~timestamp:type"
443
- }
444
- ],
445
- "fileUrlPath": "dist/index.d.mts",
446
- "returnTypeTokenRange": {
447
- "startIndex": 3,
448
- "endIndex": 4
449
- },
450
- "releaseTag": "Public",
451
- "overloadIndex": 1,
452
- "parameters": [
453
- {
454
- "parameterName": "utc",
455
- "parameterTypeTokenRange": {
456
- "startIndex": 1,
457
- "endIndex": 2
458
- },
459
- "isOptional": false
460
- }
461
- ],
462
- "name": "fromUTC"
463
- },
464
- {
465
- "kind": "TypeAlias",
466
- "canonicalReference": "@kagal/taistamp!LeapSeconds:type",
467
- "docComment": "/**\n * `number` that has been confirmed to fit the `[0, TAI_LEAP_SECONDS_MAX]` u32be range required by the taistamp signed-payload framing. Construct only via {@link extractLeapSeconds} or {@link asLeapSeconds}; the brand prevents an arbitrary number from reaching the signing path.\n */\n",
468
- "excerptTokens": [
469
- {
470
- "kind": "Content",
471
- "text": "type LeapSeconds = "
472
- },
473
- {
474
- "kind": "Content",
475
- "text": "number & {\n readonly ["
476
- },
477
- {
478
- "kind": "Reference",
479
- "text": "LeapSecondsBrand",
480
- "canonicalReference": "@kagal/taistamp!~LeapSecondsBrand:var"
481
- },
482
- {
483
- "kind": "Content",
484
- "text": "]: never;\n}"
485
- },
486
- {
487
- "kind": "Content",
488
- "text": ";"
489
- }
490
- ],
491
- "fileUrlPath": "dist/index.d.mts",
492
- "releaseTag": "Public",
493
- "name": "LeapSeconds",
494
- "typeTokenRange": {
495
- "startIndex": 1,
496
- "endIndex": 4
497
- }
498
- },
499
- {
500
- "kind": "Variable",
501
- "canonicalReference": "@kagal/taistamp!newEd25519Signer:var",
502
- "docComment": "/**\n * Build a {@link Signer} backed by a WebCrypto Ed25519 private `CryptoKey`.\n *\n * @param key - Ed25519 private `CryptoKey` with `'sign'` in `key.usages`\n *\n * @param context - optional prefix prepended to error messages, typically the calling function's name\n *\n * @returns a {@link Signer} producing 64-byte raw signatures (R ‖ s) per {@link https://datatracker.ietf.org/doc/html/rfc8032 | RFC 8032}\n *\n * @throws\n *\n * `TypeError` when `key.algorithm.name` is not a supported algorithm or `'sign'` is missing from `key.usages`\n */\n",
503
- "excerptTokens": [
504
- {
505
- "kind": "Content",
506
- "text": "newSigner = "
507
- },
508
- {
509
- "kind": "Content",
510
- "text": "(\n key: "
511
- },
512
- {
513
- "kind": "Reference",
514
- "text": "CryptoKey",
515
- "canonicalReference": "!CryptoKey:interface"
516
- },
517
- {
518
- "kind": "Content",
519
- "text": ",\n context?: string,\n): "
520
- },
521
- {
522
- "kind": "Reference",
523
- "text": "Signer",
524
- "canonicalReference": "@kagal/taistamp!Signer:interface"
525
- },
526
- {
527
- "kind": "Content",
528
- "text": " => {\n const prefix = "
529
- },
530
- {
531
- "kind": "Reference",
532
- "text": "context",
533
- "canonicalReference": "@kagal/taistamp!context"
534
- },
535
- {
536
- "kind": "Content",
537
- "text": " ? `${"
538
- },
539
- {
540
- "kind": "Reference",
541
- "text": "context",
542
- "canonicalReference": "@kagal/taistamp!context"
543
- },
544
- {
545
- "kind": "Content",
546
- "text": "}: ` : '';\n const algorithm = "
547
- },
548
- {
549
- "kind": "Reference",
550
- "text": "key.algorithm.name",
551
- "canonicalReference": "!KeyAlgorithm#name"
552
- },
553
- {
554
- "kind": "Content",
555
- "text": ";\n const meta = "
556
- },
557
- {
558
- "kind": "Reference",
559
- "text": "SUPPORTED_ALGORITHMS.get",
560
- "canonicalReference": "!ReadonlyMap#get"
561
- },
562
- {
563
- "kind": "Content",
564
- "text": "("
565
- },
566
- {
567
- "kind": "Reference",
568
- "text": "algorithm.toLowerCase",
569
- "canonicalReference": "!String#toLowerCase"
570
- },
571
- {
572
- "kind": "Content",
573
- "text": "());\n if ("
574
- },
575
- {
576
- "kind": "Reference",
577
- "text": "meta",
578
- "canonicalReference": "@kagal/taistamp!meta"
579
- },
580
- {
581
- "kind": "Content",
582
- "text": " === "
583
- },
584
- {
585
- "kind": "Reference",
586
- "text": "undefined",
587
- "canonicalReference": "!undefined"
588
- },
589
- {
590
- "kind": "Content",
591
- "text": ") {\n throw new "
592
- },
593
- {
594
- "kind": "Reference",
595
- "text": "TypeError",
596
- "canonicalReference": "!TypeError:interface"
597
- },
598
- {
599
- "kind": "Content",
600
- "text": "(\n `${"
601
- },
602
- {
603
- "kind": "Reference",
604
- "text": "prefix",
605
- "canonicalReference": "@kagal/taistamp!prefix"
606
- },
607
- {
608
- "kind": "Content",
609
- "text": "}unsupported algorithm: ${"
610
- },
611
- {
612
- "kind": "Reference",
613
- "text": "algorithm",
614
- "canonicalReference": "@kagal/taistamp!algorithm"
615
- },
616
- {
617
- "kind": "Content",
618
- "text": "}`,\n );\n }\n if (!"
619
- },
620
- {
621
- "kind": "Reference",
622
- "text": "key.usages.includes",
623
- "canonicalReference": "!Array#includes"
624
- },
625
- {
626
- "kind": "Content",
627
- "text": "('sign')) {\n throw new "
628
- },
629
- {
630
- "kind": "Reference",
631
- "text": "TypeError",
632
- "canonicalReference": "!TypeError:interface"
633
- },
634
- {
635
- "kind": "Content",
636
- "text": "(\n `${"
637
- },
638
- {
639
- "kind": "Reference",
640
- "text": "prefix",
641
- "canonicalReference": "@kagal/taistamp!prefix"
642
- },
643
- {
644
- "kind": "Content",
645
- "text": "}expected sign usage, got [${"
646
- },
647
- {
648
- "kind": "Reference",
649
- "text": "key.usages.join",
650
- "canonicalReference": "!Array#join"
651
- },
652
- {
653
- "kind": "Content",
654
- "text": "(', ')}]`,\n );\n }\n return {\n "
655
- },
656
- {
657
- "kind": "Reference",
658
- "text": "sign",
659
- "canonicalReference": "@kagal/taistamp!__object#sign"
660
- },
661
- {
662
- "kind": "Content",
663
- "text": ": async (message) =>\n "
664
- },
665
- {
666
- "kind": "Reference",
667
- "text": "crypto.subtle.sign",
668
- "canonicalReference": "!SubtleCrypto#sign"
669
- },
670
- {
671
- "kind": "Content",
672
- "text": "("
673
- },
674
- {
675
- "kind": "Reference",
676
- "text": "meta.name",
677
- "canonicalReference": "@kagal/taistamp!AlgorithmMeta#name"
678
- },
679
- {
680
- "kind": "Content",
681
- "text": ", "
682
- },
683
- {
684
- "kind": "Reference",
685
- "text": "key",
686
- "canonicalReference": "@kagal/taistamp!key"
687
- },
688
- {
689
- "kind": "Content",
690
- "text": ", "
691
- },
692
- {
693
- "kind": "Reference",
694
- "text": "asMessageBytes",
695
- "canonicalReference": "@kagal/taistamp!asMessageBytes"
696
- },
697
- {
698
- "kind": "Content",
699
- "text": "("
700
- },
701
- {
702
- "kind": "Reference",
703
- "text": "message",
704
- "canonicalReference": "@kagal/taistamp!message"
705
- },
706
- {
707
- "kind": "Content",
708
- "text": ")),\n };\n}"
709
- }
710
- ],
711
- "fileUrlPath": "../@kagal-ed25519-secret/src/signer.ts",
712
- "initializerTokenRange": {
713
- "startIndex": 1,
714
- "endIndex": 46
715
- },
716
- "isReadonly": true,
717
- "releaseTag": "Public",
718
- "name": "newEd25519Signer",
719
- "variableTypeTokenRange": {
720
- "startIndex": 0,
721
- "endIndex": 0
722
- }
723
- },
724
- {
725
- "kind": "Function",
726
- "canonicalReference": "@kagal/taistamp!newTaistampHandler:function(1)",
727
- "docComment": "/**\n * Build a handler for `/.well-known/taistamp`.\n *\n * @remarks\n *\n * Behaviour:\n *\n * - `GET` / `HEAD` — body is a fresh 25-byte TAI64N label (`HEAD` omits the body). Response headers: Content-Type `application/tai64n`, Content-Length `25`, Cache-Control `no-store`, plus `TAI-Leap-Seconds` carrying the current count. - `OPTIONS` — `200` with `Allow: GET, HEAD, OPTIONS`. When CORS is enabled (the default) the response also carries `Access-Control-Allow-*` and `-Expose-Headers` per {@link TaistampHandlerConfig.cors}. `OPTIONS` is never signed. - Any other method — `405 Method Not Allowed` with `Allow: GET, HEAD, OPTIONS`. - Request `TAI-Nonce` — on `GET`, the value is echoed verbatim in the response. A missing, empty, duplicated, structurally malformed, or length-out-of-range field is treated as absent (no echo, no signature) per spec §5.4 — see {@link extractNonce}. `HEAD`, `OPTIONS`, and `405` responses never carry `TAI-Nonce` per spec §5.1. - Request `TAI-Nonce` *and* `signer` configured *and* the request method is `GET` — adds `TAI-Key-Selector` and `TAI-Signature` (sf-binary) over the bytes produced by {@link composeSignaturePayload}. The domain-separation tag means the same key cannot be tricked into producing valid signatures for other protocols. `HEAD`, `OPTIONS`, and `405` responses are never signed.\n *\n * The corresponding public key is expected to be published out-of-band as a DNS TXT record at `<selector>._taistamp.<host>` — verifiers fetch the key by selector so the operator can rotate keys by publishing a new selector while the old one is still cached.\n *\n * @param config - optional {@link TaistampHandlerConfig}\n *\n * @returns an `async (request) => Response` callable directly as a Web `fetch` handler or as a Hono route handler.\n *\n * @throws\n *\n * TypeError if `signer` and `selector` are not both set or both unset, or if `selector` does not match `[A-Za-z][A-Za-z0-9_-]{0,62}`.\n *\n * @see\n *\n * {@link https://cr.yp.to/libtai/tai64.html} for TAI64N format\n */\n",
728
- "excerptTokens": [
729
- {
730
- "kind": "Content",
731
- "text": "newTaistampHandler: (config?: "
732
- },
733
- {
734
- "kind": "Reference",
735
- "text": "TaistampHandlerConfig",
736
- "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig:interface"
737
- },
738
- {
739
- "kind": "Content",
740
- "text": ") => "
741
- },
742
- {
743
- "kind": "Content",
744
- "text": "((request: "
745
- },
746
- {
747
- "kind": "Reference",
748
- "text": "Request",
749
- "canonicalReference": "!Request:interface"
750
- },
751
- {
752
- "kind": "Content",
753
- "text": ") => "
754
- },
755
- {
756
- "kind": "Reference",
757
- "text": "Promise",
758
- "canonicalReference": "!Promise:interface"
759
- },
760
- {
761
- "kind": "Content",
762
- "text": "<"
763
- },
764
- {
765
- "kind": "Reference",
766
- "text": "Response",
767
- "canonicalReference": "!Response:interface"
768
- },
769
- {
770
- "kind": "Content",
771
- "text": ">)"
772
- }
773
- ],
774
- "fileUrlPath": "dist/index.d.mts",
775
- "returnTypeTokenRange": {
776
- "startIndex": 3,
777
- "endIndex": 10
778
- },
779
- "releaseTag": "Public",
780
- "overloadIndex": 1,
781
- "parameters": [
782
- {
783
- "parameterName": "config",
784
- "parameterTypeTokenRange": {
785
- "startIndex": 1,
786
- "endIndex": 2
787
- },
788
- "isOptional": true
789
- }
790
- ],
791
- "name": "newTaistampHandler"
792
- },
793
- {
794
- "kind": "TypeAlias",
795
- "canonicalReference": "@kagal/taistamp!Nonce:type",
796
- "docComment": "/**\n * `string` that has been confirmed to satisfy the sf-binary syntax of RFC 9651 §3.3.5 and to fall inside the wire-form length range `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` — the pre-decode form of spec §5.4's normative decoded-length bound of 7..129 octets. Construct only via {@link asNonce} or {@link extractNonce}; the brand prevents arbitrary strings from reaching the signing path.\n */\n",
797
- "excerptTokens": [
798
- {
799
- "kind": "Content",
800
- "text": "type Nonce = "
801
- },
802
- {
803
- "kind": "Content",
804
- "text": "string & {\n readonly ["
805
- },
806
- {
807
- "kind": "Reference",
808
- "text": "NonceBrand",
809
- "canonicalReference": "@kagal/taistamp!~NonceBrand:var"
810
- },
811
- {
812
- "kind": "Content",
813
- "text": "]: never;\n}"
814
- },
815
- {
816
- "kind": "Content",
817
- "text": ";"
818
- }
819
- ],
820
- "fileUrlPath": "dist/index.d.mts",
821
- "releaseTag": "Public",
822
- "name": "Nonce",
823
- "typeTokenRange": {
824
- "startIndex": 1,
825
- "endIndex": 4
826
- }
827
- },
828
- {
829
- "kind": "Function",
830
- "canonicalReference": "@kagal/taistamp!now:function(1)",
831
- "docComment": "",
832
- "excerptTokens": [
833
- {
834
- "kind": "Content",
835
- "text": "now: () => "
836
- },
837
- {
838
- "kind": "Reference",
839
- "text": "timestamp",
840
- "canonicalReference": "@kagal/taistamp!~timestamp:type"
841
- }
842
- ],
843
- "fileUrlPath": "dist/index.d.mts",
844
- "returnTypeTokenRange": {
845
- "startIndex": 1,
846
- "endIndex": 2
847
- },
848
- "releaseTag": "Public",
849
- "overloadIndex": 1,
850
- "parameters": [],
851
- "name": "now"
852
- },
853
- {
854
- "kind": "Function",
855
- "canonicalReference": "@kagal/taistamp!readASCII:function(1)",
856
- "docComment": "/**\n * Read a response body as a 7-bit ASCII string.\n *\n * `application/tai64n` is an octet-typed media type, not text: the TAI64N label is a fixed sequence of ASCII bytes. Reading it with `Response.text()` would route the body through UTF-8 decoding and silently mangle any non-ASCII octet, so this reads the raw bytes and decodes them one code point per byte instead.\n *\n * Throws `TypeError` on any byte ≥ `0x80`, surfacing a malformed body rather than masking it; pass `context` to prefix that error message. Consumes the response body, which can only be read once.\n *\n * Use {@link readLabel} when the body is meant to be a TAI64N label and its length should be validated too.\n */\n",
857
- "excerptTokens": [
858
- {
859
- "kind": "Content",
860
- "text": "readASCII: (response: "
861
- },
862
- {
863
- "kind": "Reference",
864
- "text": "Response",
865
- "canonicalReference": "!Response:interface"
866
- },
867
- {
868
- "kind": "Content",
869
- "text": ", context?: "
870
- },
871
- {
872
- "kind": "Content",
873
- "text": "string"
874
- },
875
- {
876
- "kind": "Content",
877
- "text": ") => "
878
- },
879
- {
880
- "kind": "Reference",
881
- "text": "Promise",
882
- "canonicalReference": "!Promise:interface"
883
- },
884
- {
885
- "kind": "Content",
886
- "text": "<string>"
887
- }
888
- ],
889
- "fileUrlPath": "dist/index.d.mts",
890
- "returnTypeTokenRange": {
891
- "startIndex": 5,
892
- "endIndex": 7
893
- },
894
- "releaseTag": "Public",
895
- "overloadIndex": 1,
896
- "parameters": [
897
- {
898
- "parameterName": "response",
899
- "parameterTypeTokenRange": {
900
- "startIndex": 1,
901
- "endIndex": 2
902
- },
903
- "isOptional": false
904
- },
905
- {
906
- "parameterName": "context",
907
- "parameterTypeTokenRange": {
908
- "startIndex": 3,
909
- "endIndex": 4
910
- },
911
- "isOptional": true
912
- }
913
- ],
914
- "name": "readASCII"
915
- },
916
- {
917
- "kind": "Function",
918
- "canonicalReference": "@kagal/taistamp!readLabel:function(1)",
919
- "docComment": "/**\n * Read and return the TAI64N label from a response body.\n *\n * Builds on {@link readASCII}, adding the structural invariant every label satisfies: the body is exactly `TAI64N_CONTENT_LENGTH` octets. Throws `TypeError` if the length differs or the body carries a non-ASCII octet; pass `context` to prefix that error message. Consumes the response body.\n */\n",
920
- "excerptTokens": [
921
- {
922
- "kind": "Content",
923
- "text": "readLabel: (response: "
924
- },
925
- {
926
- "kind": "Reference",
927
- "text": "Response",
928
- "canonicalReference": "!Response:interface"
929
- },
930
- {
931
- "kind": "Content",
932
- "text": ", context?: "
933
- },
934
- {
935
- "kind": "Content",
936
- "text": "string"
937
- },
938
- {
939
- "kind": "Content",
940
- "text": ") => "
941
- },
942
- {
943
- "kind": "Reference",
944
- "text": "Promise",
945
- "canonicalReference": "!Promise:interface"
946
- },
947
- {
948
- "kind": "Content",
949
- "text": "<string>"
950
- }
951
- ],
952
- "fileUrlPath": "dist/index.d.mts",
953
- "returnTypeTokenRange": {
954
- "startIndex": 5,
955
- "endIndex": 7
956
- },
957
- "releaseTag": "Public",
958
- "overloadIndex": 1,
959
- "parameters": [
960
- {
961
- "parameterName": "response",
962
- "parameterTypeTokenRange": {
963
- "startIndex": 1,
964
- "endIndex": 2
965
- },
966
- "isOptional": false
967
- },
968
- {
969
- "parameterName": "context",
970
- "parameterTypeTokenRange": {
971
- "startIndex": 3,
972
- "endIndex": 4
973
- },
974
- "isOptional": true
975
- }
976
- ],
977
- "name": "readLabel"
978
- },
979
- {
980
- "kind": "Interface",
981
- "canonicalReference": "@kagal/taistamp!Signer:interface",
982
- "docComment": "/**\n * Pluggable abstraction over a private signing key. Implementations sign caller-provided bytes and return the raw signature bytes; the algorithm and key store are implementation details.\n */\n",
983
- "excerptTokens": [
984
- {
985
- "kind": "Content",
986
- "text": "export interface Signer "
987
- }
988
- ],
989
- "fileUrlPath": "../@kagal-ed25519-secret/src/signer.ts",
990
- "releaseTag": "Public",
991
- "name": "Signer",
992
- "preserveMemberOrder": false,
993
- "members": [
994
- {
995
- "kind": "PropertySignature",
996
- "canonicalReference": "@kagal/taistamp!Signer#sign:member",
997
- "docComment": "/**\n * Produce a signature over `message`.\n *\n * @param message - message to sign, either bytes or a string (encoded as UTF-8); the caller is responsible for any framing or domain separation\n *\n * @returns the raw signature bytes (algorithm-defined length and encoding)\n */\n",
998
- "excerptTokens": [
999
- {
1000
- "kind": "Content",
1001
- "text": "sign: "
1002
- },
1003
- {
1004
- "kind": "Content",
1005
- "text": "(message: "
1006
- },
1007
- {
1008
- "kind": "Reference",
1009
- "text": "BufferSource",
1010
- "canonicalReference": "!BufferSource:type"
1011
- },
1012
- {
1013
- "kind": "Content",
1014
- "text": " | string) => "
1015
- },
1016
- {
1017
- "kind": "Reference",
1018
- "text": "Promise",
1019
- "canonicalReference": "!Promise:interface"
1020
- },
1021
- {
1022
- "kind": "Content",
1023
- "text": "<"
1024
- },
1025
- {
1026
- "kind": "Reference",
1027
- "text": "ArrayBuffer",
1028
- "canonicalReference": "!ArrayBuffer:interface"
1029
- },
1030
- {
1031
- "kind": "Content",
1032
- "text": ">"
1033
- }
1034
- ],
1035
- "isReadonly": false,
1036
- "isOptional": false,
1037
- "releaseTag": "Public",
1038
- "name": "sign",
1039
- "propertyTypeTokenRange": {
1040
- "startIndex": 1,
1041
- "endIndex": 8
1042
- }
1043
- }
1044
- ],
1045
- "extendsTokenRanges": []
1046
- },
1047
- {
1048
- "kind": "Variable",
1049
- "canonicalReference": "@kagal/taistamp!TAI_LEAP_SECONDS_MAX:var",
1050
- "docComment": "/**\n * Upper bound for `leapSeconds` in the taistamp signed payload. The framing encodes the value as a 4-byte big-endian unsigned integer, so any input outside `[0, 2^32-1]` cannot be represented. Verifiers MUST treat an out-of-range `TAI-Leap-Seconds` response header as unsigned, per spec §5.3.\n */\n",
1051
- "excerptTokens": [
1052
- {
1053
- "kind": "Content",
1054
- "text": "TAI_LEAP_SECONDS_MAX = "
1055
- },
1056
- {
1057
- "kind": "Content",
1058
- "text": "4294967295"
1059
- }
1060
- ],
1061
- "fileUrlPath": "dist/index.d.mts",
1062
- "initializerTokenRange": {
1063
- "startIndex": 1,
1064
- "endIndex": 2
1065
- },
1066
- "isReadonly": true,
1067
- "releaseTag": "Public",
1068
- "name": "TAI_LEAP_SECONDS_MAX",
1069
- "variableTypeTokenRange": {
1070
- "startIndex": 0,
1071
- "endIndex": 0
1072
- }
1073
- },
1074
- {
1075
- "kind": "Variable",
1076
- "canonicalReference": "@kagal/taistamp!TAI_LEAP_SECONDS:var",
1077
- "docComment": "/**\n * Current TAI − UTC offset in whole seconds, used by `fromUTC()` and emitted in the `TAI-Leap-Seconds` response header. The value 37 has been in force since 2017-01-01; update on the next IERS leap-second announcement.\n *\n * @remarks\n *\n * Stays a single `LeapSeconds` until a leap-seconds table is added so the offset can be computed for any TAI second; this constant becomes redundant then.\n */\n",
1078
- "excerptTokens": [
1079
- {
1080
- "kind": "Content",
1081
- "text": "TAI_LEAP_SECONDS: "
1082
- },
1083
- {
1084
- "kind": "Reference",
1085
- "text": "LeapSeconds",
1086
- "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
1087
- }
1088
- ],
1089
- "fileUrlPath": "dist/index.d.mts",
1090
- "isReadonly": true,
1091
- "releaseTag": "Public",
1092
- "name": "TAI_LEAP_SECONDS",
1093
- "variableTypeTokenRange": {
1094
- "startIndex": 1,
1095
- "endIndex": 2
1096
- }
1097
- },
1098
- {
1099
- "kind": "Variable",
1100
- "canonicalReference": "@kagal/taistamp!TAI64_EPOCH_HI:var",
1101
- "docComment": "",
1102
- "excerptTokens": [
1103
- {
1104
- "kind": "Content",
1105
- "text": "TAI64_EPOCH_HI = "
1106
- },
1107
- {
1108
- "kind": "Content",
1109
- "text": "1073741824"
1110
- }
1111
- ],
1112
- "fileUrlPath": "dist/index.d.mts",
1113
- "initializerTokenRange": {
1114
- "startIndex": 1,
1115
- "endIndex": 2
1116
- },
1117
- "isReadonly": true,
1118
- "releaseTag": "Public",
1119
- "name": "TAI64_EPOCH_HI",
1120
- "variableTypeTokenRange": {
1121
- "startIndex": 0,
1122
- "endIndex": 0
1123
- }
1124
- },
1125
- {
1126
- "kind": "Variable",
1127
- "canonicalReference": "@kagal/taistamp!TAI64N_CONTENT_LENGTH:var",
1128
- "docComment": "",
1129
- "excerptTokens": [
1130
- {
1131
- "kind": "Content",
1132
- "text": "TAI64N_CONTENT_LENGTH: "
1133
- },
1134
- {
1135
- "kind": "Content",
1136
- "text": "number"
1137
- }
1138
- ],
1139
- "fileUrlPath": "dist/index.d.mts",
1140
- "isReadonly": true,
1141
- "releaseTag": "Public",
1142
- "name": "TAI64N_CONTENT_LENGTH",
1143
- "variableTypeTokenRange": {
1144
- "startIndex": 1,
1145
- "endIndex": 2
1146
- }
1147
- },
1148
- {
1149
- "kind": "Variable",
1150
- "canonicalReference": "@kagal/taistamp!TAI64N_CONTENT_TYPE:var",
1151
- "docComment": "",
1152
- "excerptTokens": [
1153
- {
1154
- "kind": "Content",
1155
- "text": "TAI64N_CONTENT_TYPE = "
1156
- },
1157
- {
1158
- "kind": "Content",
1159
- "text": "\"application/tai64n\""
1160
- }
1161
- ],
1162
- "fileUrlPath": "dist/index.d.mts",
1163
- "initializerTokenRange": {
1164
- "startIndex": 1,
1165
- "endIndex": 2
1166
- },
1167
- "isReadonly": true,
1168
- "releaseTag": "Public",
1169
- "name": "TAI64N_CONTENT_TYPE",
1170
- "variableTypeTokenRange": {
1171
- "startIndex": 0,
1172
- "endIndex": 0
1173
- }
1174
- },
1175
- {
1176
- "kind": "Variable",
1177
- "canonicalReference": "@kagal/taistamp!TAI64N_HEADER_KEY_SELECTOR:var",
1178
- "docComment": "",
1179
- "excerptTokens": [
1180
- {
1181
- "kind": "Content",
1182
- "text": "TAI64N_HEADER_KEY_SELECTOR = "
1183
- },
1184
- {
1185
- "kind": "Content",
1186
- "text": "\"TAI-Key-Selector\""
1187
- }
1188
- ],
1189
- "fileUrlPath": "dist/index.d.mts",
1190
- "initializerTokenRange": {
1191
- "startIndex": 1,
1192
- "endIndex": 2
1193
- },
1194
- "isReadonly": true,
1195
- "releaseTag": "Public",
1196
- "name": "TAI64N_HEADER_KEY_SELECTOR",
1197
- "variableTypeTokenRange": {
1198
- "startIndex": 0,
1199
- "endIndex": 0
1200
- }
1201
- },
1202
- {
1203
- "kind": "Variable",
1204
- "canonicalReference": "@kagal/taistamp!TAI64N_HEADER_LEAP_SECONDS:var",
1205
- "docComment": "",
1206
- "excerptTokens": [
1207
- {
1208
- "kind": "Content",
1209
- "text": "TAI64N_HEADER_LEAP_SECONDS = "
1210
- },
1211
- {
1212
- "kind": "Content",
1213
- "text": "\"TAI-Leap-Seconds\""
1214
- }
1215
- ],
1216
- "fileUrlPath": "dist/index.d.mts",
1217
- "initializerTokenRange": {
1218
- "startIndex": 1,
1219
- "endIndex": 2
1220
- },
1221
- "isReadonly": true,
1222
- "releaseTag": "Public",
1223
- "name": "TAI64N_HEADER_LEAP_SECONDS",
1224
- "variableTypeTokenRange": {
1225
- "startIndex": 0,
1226
- "endIndex": 0
1227
- }
1228
- },
1229
- {
1230
- "kind": "Variable",
1231
- "canonicalReference": "@kagal/taistamp!TAI64N_HEADER_NONCE:var",
1232
- "docComment": "",
1233
- "excerptTokens": [
1234
- {
1235
- "kind": "Content",
1236
- "text": "TAI64N_HEADER_NONCE = "
1237
- },
1238
- {
1239
- "kind": "Content",
1240
- "text": "\"TAI-Nonce\""
1241
- }
1242
- ],
1243
- "fileUrlPath": "dist/index.d.mts",
1244
- "initializerTokenRange": {
1245
- "startIndex": 1,
1246
- "endIndex": 2
1247
- },
1248
- "isReadonly": true,
1249
- "releaseTag": "Public",
1250
- "name": "TAI64N_HEADER_NONCE",
1251
- "variableTypeTokenRange": {
1252
- "startIndex": 0,
1253
- "endIndex": 0
1254
- }
1255
- },
1256
- {
1257
- "kind": "Variable",
1258
- "canonicalReference": "@kagal/taistamp!TAI64N_HEADER_SIGNATURE:var",
1259
- "docComment": "",
1260
- "excerptTokens": [
1261
- {
1262
- "kind": "Content",
1263
- "text": "TAI64N_HEADER_SIGNATURE = "
1264
- },
1265
- {
1266
- "kind": "Content",
1267
- "text": "\"TAI-Signature\""
1268
- }
1269
- ],
1270
- "fileUrlPath": "dist/index.d.mts",
1271
- "initializerTokenRange": {
1272
- "startIndex": 1,
1273
- "endIndex": 2
1274
- },
1275
- "isReadonly": true,
1276
- "releaseTag": "Public",
1277
- "name": "TAI64N_HEADER_SIGNATURE",
1278
- "variableTypeTokenRange": {
1279
- "startIndex": 0,
1280
- "endIndex": 0
1281
- }
1282
- },
1283
- {
1284
- "kind": "Variable",
1285
- "canonicalReference": "@kagal/taistamp!TAI64N_PATH:var",
1286
- "docComment": "/**\n * @deprecated\n *\n * Renamed to {@link TAISTAMP_PATH}.\n */\n",
1287
- "excerptTokens": [
1288
- {
1289
- "kind": "Content",
1290
- "text": "TAI64N_PATH = "
1291
- },
1292
- {
1293
- "kind": "Content",
1294
- "text": "\"/.well-known/taistamp\""
1295
- }
1296
- ],
1297
- "fileUrlPath": "dist/index.d.mts",
1298
- "initializerTokenRange": {
1299
- "startIndex": 1,
1300
- "endIndex": 2
1301
- },
1302
- "isReadonly": true,
1303
- "releaseTag": "Public",
1304
- "name": "TAI64N_PATH",
1305
- "variableTypeTokenRange": {
1306
- "startIndex": 0,
1307
- "endIndex": 0
1308
- }
1309
- },
1310
- {
1311
- "kind": "Function",
1312
- "canonicalReference": "@kagal/taistamp!tai64nLabel:function(1)",
1313
- "docComment": "",
1314
- "excerptTokens": [
1315
- {
1316
- "kind": "Content",
1317
- "text": "tai64nLabel: (value?: "
1318
- },
1319
- {
1320
- "kind": "Reference",
1321
- "text": "timestamp",
1322
- "canonicalReference": "@kagal/taistamp!~timestamp:type"
1323
- },
1324
- {
1325
- "kind": "Content",
1326
- "text": ") => "
1327
- },
1328
- {
1329
- "kind": "Content",
1330
- "text": "string"
1331
- }
1332
- ],
1333
- "fileUrlPath": "dist/index.d.mts",
1334
- "returnTypeTokenRange": {
1335
- "startIndex": 3,
1336
- "endIndex": 4
1337
- },
1338
- "releaseTag": "Public",
1339
- "overloadIndex": 1,
1340
- "parameters": [
1341
- {
1342
- "parameterName": "value",
1343
- "parameterTypeTokenRange": {
1344
- "startIndex": 1,
1345
- "endIndex": 2
1346
- },
1347
- "isOptional": true
1348
- }
1349
- ],
1350
- "name": "tai64nLabel"
1351
- },
1352
- {
1353
- "kind": "Function",
1354
- "canonicalReference": "@kagal/taistamp!tai64nLabelFromUTC:function(1)",
1355
- "docComment": "",
1356
- "excerptTokens": [
1357
- {
1358
- "kind": "Content",
1359
- "text": "tai64nLabelFromUTC: (utc: "
1360
- },
1361
- {
1362
- "kind": "Content",
1363
- "text": "number"
1364
- },
1365
- {
1366
- "kind": "Content",
1367
- "text": ") => "
1368
- },
1369
- {
1370
- "kind": "Content",
1371
- "text": "string"
1372
- }
1373
- ],
1374
- "fileUrlPath": "dist/index.d.mts",
1375
- "returnTypeTokenRange": {
1376
- "startIndex": 3,
1377
- "endIndex": 4
1378
- },
1379
- "releaseTag": "Public",
1380
- "overloadIndex": 1,
1381
- "parameters": [
1382
- {
1383
- "parameterName": "utc",
1384
- "parameterTypeTokenRange": {
1385
- "startIndex": 1,
1386
- "endIndex": 2
1387
- },
1388
- "isOptional": false
1389
- }
1390
- ],
1391
- "name": "tai64nLabelFromUTC"
1392
- },
1393
- {
1394
- "kind": "Variable",
1395
- "canonicalReference": "@kagal/taistamp!TAISTAMP_PATH:var",
1396
- "docComment": "",
1397
- "excerptTokens": [
1398
- {
1399
- "kind": "Content",
1400
- "text": "TAISTAMP_PATH = "
1401
- },
1402
- {
1403
- "kind": "Content",
1404
- "text": "\"/.well-known/taistamp\""
1405
- }
1406
- ],
1407
- "fileUrlPath": "dist/index.d.mts",
1408
- "initializerTokenRange": {
1409
- "startIndex": 1,
1410
- "endIndex": 2
1411
- },
1412
- "isReadonly": true,
1413
- "releaseTag": "Public",
1414
- "name": "TAISTAMP_PATH",
1415
- "variableTypeTokenRange": {
1416
- "startIndex": 0,
1417
- "endIndex": 0
1418
- }
1419
- },
1420
- {
1421
- "kind": "Interface",
1422
- "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig:interface",
1423
- "docComment": "/**\n * Configuration for {@link newTaistampHandler}.\n *\n * @remarks\n *\n * `signer` and `selector` are co-required: pass both to enable authenticated responses, or neither for an unsigned handler. Passing only one is rejected at construction time — without the selector verifiers cannot find the key in DNS, and a selector without a signer is a misconfiguration.\n */\n",
1424
- "excerptTokens": [
1425
- {
1426
- "kind": "Content",
1427
- "text": "interface TaistampHandlerConfig "
1428
- }
1429
- ],
1430
- "fileUrlPath": "dist/index.d.mts",
1431
- "releaseTag": "Public",
1432
- "name": "TaistampHandlerConfig",
1433
- "preserveMemberOrder": false,
1434
- "members": [
1435
- {
1436
- "kind": "PropertySignature",
1437
- "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#cors:member",
1438
- "docComment": "/**\n * CORS origin policy. Defaults to `'*'`; pass `false` to disable CORS entirely, or a specific origin (e.g. `'https://example.com'`) to scope the policy.\n *\n * Every response (`GET` / `HEAD` / `OPTIONS` / `405`) gains `Access-Control-Allow-Origin`; pre-flight `OPTIONS` also carries `-Allow-Methods`, `-Allow-Headers`, `-Expose-Headers`, and `-Max-Age: 600` per spec §5.2; success `GET` / `HEAD` carry `-Expose-Headers` so browser JS can read the `TAI-*` response headers. A non-`'*'` value adds `Vary: Origin` so caches can keep per-origin variants distinct.\n *\n * Disabling CORS does not affect method discovery: `OPTIONS` is still answered with `200` and `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.\n */\n",
1439
- "excerptTokens": [
1440
- {
1441
- "kind": "Content",
1442
- "text": "cors?: "
1443
- },
1444
- {
1445
- "kind": "Content",
1446
- "text": "false | string"
1447
- },
1448
- {
1449
- "kind": "Content",
1450
- "text": ";"
1451
- }
1452
- ],
1453
- "isReadonly": false,
1454
- "isOptional": true,
1455
- "releaseTag": "Public",
1456
- "name": "cors",
1457
- "propertyTypeTokenRange": {
1458
- "startIndex": 1,
1459
- "endIndex": 2
1460
- }
1461
- },
1462
- {
1463
- "kind": "PropertySignature",
1464
- "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#selector:member",
1465
- "docComment": "/**\n * Key selector advertised in the `TAI-Key-Selector` response header and bound into the signed payload. Verifiers look up the public key at `<selector>._taistamp.<host>` in DNS.\n *\n * Must match `[A-Za-z][A-Za-z0-9_-]{0,62}` (a single DNS label starting with a letter, using DKIM-compatible characters and a valid sf-token); rotate by changing the selector and publishing a new TXT record.\n */\n",
1466
- "excerptTokens": [
1467
- {
1468
- "kind": "Content",
1469
- "text": "selector?: "
1470
- },
1471
- {
1472
- "kind": "Content",
1473
- "text": "string"
1474
- },
1475
- {
1476
- "kind": "Content",
1477
- "text": ";"
1478
- }
1479
- ],
1480
- "isReadonly": false,
1481
- "isOptional": true,
1482
- "releaseTag": "Public",
1483
- "name": "selector",
1484
- "propertyTypeTokenRange": {
1485
- "startIndex": 1,
1486
- "endIndex": 2
1487
- }
1488
- },
1489
- {
1490
- "kind": "PropertySignature",
1491
- "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#signer:member",
1492
- "docComment": "/**\n * {@link Signer} that produces `TAI-Signature` over the framed payload from {@link composeSignaturePayload}. Without a signer the nonce is still echoed but the response is unsigned.\n */\n",
1493
- "excerptTokens": [
1494
- {
1495
- "kind": "Content",
1496
- "text": "signer?: "
1497
- },
1498
- {
1499
- "kind": "Reference",
1500
- "text": "Signer$1",
1501
- "canonicalReference": "@kagal/taistamp!Signer:interface"
1502
- },
1503
- {
1504
- "kind": "Content",
1505
- "text": ";"
1506
- }
1507
- ],
1508
- "isReadonly": false,
1509
- "isOptional": true,
1510
- "releaseTag": "Public",
1511
- "name": "signer",
1512
- "propertyTypeTokenRange": {
1513
- "startIndex": 1,
1514
- "endIndex": 2
1515
- }
1516
- }
1517
- ],
1518
- "extendsTokenRanges": []
1519
- },
1520
- {
1521
- "kind": "Variable",
1522
- "canonicalReference": "@kagal/taistamp!VERSION:var",
1523
- "docComment": "/**\n * Package version from package.json.\n */\n",
1524
- "excerptTokens": [
1525
- {
1526
- "kind": "Content",
1527
- "text": "VERSION: "
1528
- },
1529
- {
1530
- "kind": "Content",
1531
- "text": "string"
1532
- }
1533
- ],
1534
- "fileUrlPath": "dist/index.d.mts",
1535
- "isReadonly": true,
1536
- "releaseTag": "Public",
1537
- "name": "VERSION",
1538
- "variableTypeTokenRange": {
1539
- "startIndex": 1,
1540
- "endIndex": 2
1541
- }
1542
- }
1543
- ]
1544
- }
1545
- ]
1546
- }
1
+ {
2
+ "metadata": {
3
+ "toolPackage": "@microsoft/api-extractor",
4
+ "toolVersion": "7.58.9",
5
+ "schemaVersion": 1011,
6
+ "oldestForwardsCompatibleVersion": 1001,
7
+ "tsdocConfig": {
8
+ "$schema": "https://developer.microsoft.com/json-schemas/tsdoc/v0/tsdoc.schema.json",
9
+ "noStandardTags": true,
10
+ "tagDefinitions": [
11
+ {
12
+ "tagName": "@alpha",
13
+ "syntaxKind": "modifier"
14
+ },
15
+ {
16
+ "tagName": "@beta",
17
+ "syntaxKind": "modifier"
18
+ },
19
+ {
20
+ "tagName": "@defaultValue",
21
+ "syntaxKind": "block"
22
+ },
23
+ {
24
+ "tagName": "@decorator",
25
+ "syntaxKind": "block",
26
+ "allowMultiple": true
27
+ },
28
+ {
29
+ "tagName": "@deprecated",
30
+ "syntaxKind": "block"
31
+ },
32
+ {
33
+ "tagName": "@eventProperty",
34
+ "syntaxKind": "modifier"
35
+ },
36
+ {
37
+ "tagName": "@example",
38
+ "syntaxKind": "block",
39
+ "allowMultiple": true
40
+ },
41
+ {
42
+ "tagName": "@experimental",
43
+ "syntaxKind": "modifier"
44
+ },
45
+ {
46
+ "tagName": "@inheritDoc",
47
+ "syntaxKind": "inline"
48
+ },
49
+ {
50
+ "tagName": "@internal",
51
+ "syntaxKind": "modifier"
52
+ },
53
+ {
54
+ "tagName": "@label",
55
+ "syntaxKind": "inline"
56
+ },
57
+ {
58
+ "tagName": "@link",
59
+ "syntaxKind": "inline",
60
+ "allowMultiple": true
61
+ },
62
+ {
63
+ "tagName": "@override",
64
+ "syntaxKind": "modifier"
65
+ },
66
+ {
67
+ "tagName": "@packageDocumentation",
68
+ "syntaxKind": "modifier"
69
+ },
70
+ {
71
+ "tagName": "@param",
72
+ "syntaxKind": "block",
73
+ "allowMultiple": true
74
+ },
75
+ {
76
+ "tagName": "@privateRemarks",
77
+ "syntaxKind": "block"
78
+ },
79
+ {
80
+ "tagName": "@public",
81
+ "syntaxKind": "modifier"
82
+ },
83
+ {
84
+ "tagName": "@readonly",
85
+ "syntaxKind": "modifier"
86
+ },
87
+ {
88
+ "tagName": "@remarks",
89
+ "syntaxKind": "block"
90
+ },
91
+ {
92
+ "tagName": "@returns",
93
+ "syntaxKind": "block"
94
+ },
95
+ {
96
+ "tagName": "@sealed",
97
+ "syntaxKind": "modifier"
98
+ },
99
+ {
100
+ "tagName": "@see",
101
+ "syntaxKind": "block"
102
+ },
103
+ {
104
+ "tagName": "@throws",
105
+ "syntaxKind": "block",
106
+ "allowMultiple": true
107
+ },
108
+ {
109
+ "tagName": "@typeParam",
110
+ "syntaxKind": "block",
111
+ "allowMultiple": true
112
+ },
113
+ {
114
+ "tagName": "@virtual",
115
+ "syntaxKind": "modifier"
116
+ },
117
+ {
118
+ "tagName": "@jsx",
119
+ "syntaxKind": "block"
120
+ },
121
+ {
122
+ "tagName": "@jsxRuntime",
123
+ "syntaxKind": "block"
124
+ },
125
+ {
126
+ "tagName": "@jsxFrag",
127
+ "syntaxKind": "block"
128
+ },
129
+ {
130
+ "tagName": "@jsxImportSource",
131
+ "syntaxKind": "block"
132
+ },
133
+ {
134
+ "tagName": "@betaDocumentation",
135
+ "syntaxKind": "modifier"
136
+ },
137
+ {
138
+ "tagName": "@internalRemarks",
139
+ "syntaxKind": "block"
140
+ },
141
+ {
142
+ "tagName": "@preapproved",
143
+ "syntaxKind": "modifier"
144
+ }
145
+ ],
146
+ "supportForTags": {
147
+ "@alpha": true,
148
+ "@beta": true,
149
+ "@defaultValue": true,
150
+ "@decorator": true,
151
+ "@deprecated": true,
152
+ "@eventProperty": true,
153
+ "@example": true,
154
+ "@experimental": true,
155
+ "@inheritDoc": true,
156
+ "@internal": true,
157
+ "@label": true,
158
+ "@link": true,
159
+ "@override": true,
160
+ "@packageDocumentation": true,
161
+ "@param": true,
162
+ "@privateRemarks": true,
163
+ "@public": true,
164
+ "@readonly": true,
165
+ "@remarks": true,
166
+ "@returns": true,
167
+ "@sealed": true,
168
+ "@see": true,
169
+ "@throws": true,
170
+ "@typeParam": true,
171
+ "@virtual": true,
172
+ "@betaDocumentation": true,
173
+ "@internalRemarks": true,
174
+ "@preapproved": true
175
+ },
176
+ "reportUnsupportedHtmlElements": false
177
+ }
178
+ },
179
+ "kind": "Package",
180
+ "canonicalReference": "@kagal/taistamp!",
181
+ "docComment": "",
182
+ "name": "@kagal/taistamp",
183
+ "preserveMemberOrder": false,
184
+ "members": [
185
+ {
186
+ "kind": "EntryPoint",
187
+ "canonicalReference": "@kagal/taistamp!",
188
+ "name": "",
189
+ "preserveMemberOrder": false,
190
+ "members": [
191
+ {
192
+ "kind": "Function",
193
+ "canonicalReference": "@kagal/taistamp!asLeapSeconds:function(1)",
194
+ "docComment": "/**\n * Coerce a `number` to a {@link LeapSeconds}. Returns `undefined` when `value` is absent, non-integer, negative, or exceeds {@link TAI_LEAP_SECONDS_MAX}.\n */\n",
195
+ "excerptTokens": [
196
+ {
197
+ "kind": "Content",
198
+ "text": "asLeapSeconds: (value: "
199
+ },
200
+ {
201
+ "kind": "Content",
202
+ "text": "number | undefined"
203
+ },
204
+ {
205
+ "kind": "Content",
206
+ "text": ") => "
207
+ },
208
+ {
209
+ "kind": "Reference",
210
+ "text": "LeapSeconds",
211
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
212
+ },
213
+ {
214
+ "kind": "Content",
215
+ "text": " | undefined"
216
+ }
217
+ ],
218
+ "fileUrlPath": "dist/_chunks/time.d.mts",
219
+ "returnTypeTokenRange": {
220
+ "startIndex": 3,
221
+ "endIndex": 5
222
+ },
223
+ "releaseTag": "Public",
224
+ "overloadIndex": 1,
225
+ "parameters": [
226
+ {
227
+ "parameterName": "value",
228
+ "parameterTypeTokenRange": {
229
+ "startIndex": 1,
230
+ "endIndex": 2
231
+ },
232
+ "isOptional": false
233
+ }
234
+ ],
235
+ "name": "asLeapSeconds"
236
+ },
237
+ {
238
+ "kind": "Function",
239
+ "canonicalReference": "@kagal/taistamp!asNonce:function(1)",
240
+ "docComment": "/**\n * Brand `value` as a {@link Nonce} when it satisfies sf-binary syntax (RFC 9651 §3.3.5) and falls inside `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` — the wire range equivalent to spec §5.4's normative decoded-length bound of 7..129 octets. Returns `undefined` for anything else — every \"treat as absent\" case in spec §5.4 collapsed into one verdict.\n */\n",
241
+ "excerptTokens": [
242
+ {
243
+ "kind": "Content",
244
+ "text": "asNonce: (value: "
245
+ },
246
+ {
247
+ "kind": "Content",
248
+ "text": "string"
249
+ },
250
+ {
251
+ "kind": "Content",
252
+ "text": ") => "
253
+ },
254
+ {
255
+ "kind": "Reference",
256
+ "text": "Nonce",
257
+ "canonicalReference": "@kagal/taistamp!Nonce:type"
258
+ },
259
+ {
260
+ "kind": "Content",
261
+ "text": " | undefined"
262
+ }
263
+ ],
264
+ "fileUrlPath": "dist/index.d.mts",
265
+ "returnTypeTokenRange": {
266
+ "startIndex": 3,
267
+ "endIndex": 5
268
+ },
269
+ "releaseTag": "Public",
270
+ "overloadIndex": 1,
271
+ "parameters": [
272
+ {
273
+ "parameterName": "value",
274
+ "parameterTypeTokenRange": {
275
+ "startIndex": 1,
276
+ "endIndex": 2
277
+ },
278
+ "isOptional": false
279
+ }
280
+ ],
281
+ "name": "asNonce"
282
+ },
283
+ {
284
+ "kind": "Function",
285
+ "canonicalReference": "@kagal/taistamp!asSignature:function(1)",
286
+ "docComment": "/**\n * Decode a `TAI-Signature` wire value into the raw Ed25519 signature bytes. Returns `undefined` when `value` fails sf-binary syntax (RFC 9651 §3.3.5) or does not decode to exactly `SIGNATURE_BYTES` octets — a malformed field is equivalent to a missing one. This validates form only; semantics involving other fields (nonce echo, selector, verification) stay with the caller.\n */\n",
287
+ "excerptTokens": [
288
+ {
289
+ "kind": "Content",
290
+ "text": "asSignature: (value: "
291
+ },
292
+ {
293
+ "kind": "Content",
294
+ "text": "string"
295
+ },
296
+ {
297
+ "kind": "Content",
298
+ "text": ") => "
299
+ },
300
+ {
301
+ "kind": "Reference",
302
+ "text": "Bytes",
303
+ "canonicalReference": "@kagal/taistamp!Bytes:type"
304
+ },
305
+ {
306
+ "kind": "Content",
307
+ "text": " | undefined"
308
+ }
309
+ ],
310
+ "fileUrlPath": "dist/index.d.mts",
311
+ "returnTypeTokenRange": {
312
+ "startIndex": 3,
313
+ "endIndex": 5
314
+ },
315
+ "releaseTag": "Public",
316
+ "overloadIndex": 1,
317
+ "parameters": [
318
+ {
319
+ "parameterName": "value",
320
+ "parameterTypeTokenRange": {
321
+ "startIndex": 1,
322
+ "endIndex": 2
323
+ },
324
+ "isOptional": false
325
+ }
326
+ ],
327
+ "name": "asSignature"
328
+ },
329
+ {
330
+ "kind": "Function",
331
+ "canonicalReference": "@kagal/taistamp!composeSignaturePayload:function(1)",
332
+ "docComment": "/**\n * Compose the byte sequence covered by a TAI-Signature.\n *\n * @remarks\n *\n * Binding the selector into the signed payload stops a downgrade attacker from rewriting `TAI-Key-Selector` to point at a compromised or weaker key — the signature would no longer verify under that key. `leapSeconds` is encoded as a 4-byte big-endian unsigned integer; the selector is length-prefixed by a single byte (selectors are ≤ 63 chars per {@link newTaistampHandler}'s validation).\n *\n * @param label - the 25-byte TAI64N label string the server is returning\n *\n * @param leapSeconds - the leap-seconds count the server advertises in `TAI-Leap-Seconds`\n *\n * @param selector - the key selector the server advertises in `TAI-Key-Selector`; verifiers use this to look up the public key in DNS at `<selector>._taistamp.<host>`\n *\n * @param nonce - the client-supplied nonce, echoed verbatim in `TAI-Nonce`; brand a verifier-side string with {@link asNonce} before passing it in\n *\n * @returns the byte sequence verifiers reconstruct from the response and pass to their public-key verify routine. The framing is the domain-separation tag (`taistamp-v1` plus a trailing NUL byte), then the label bytes, then the leap-seconds count as a 4-byte big-endian unsigned integer, then a 1-byte selector length, then the selector bytes, then the decoded sf-binary octets of the nonce (spec §6.1 — the wire `:base64:` framing is not signed).\n */\n",
333
+ "excerptTokens": [
334
+ {
335
+ "kind": "Content",
336
+ "text": "composeSignaturePayload: (label: "
337
+ },
338
+ {
339
+ "kind": "Content",
340
+ "text": "string"
341
+ },
342
+ {
343
+ "kind": "Content",
344
+ "text": ", leapSeconds: "
345
+ },
346
+ {
347
+ "kind": "Reference",
348
+ "text": "LeapSeconds",
349
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
350
+ },
351
+ {
352
+ "kind": "Content",
353
+ "text": ", selector: "
354
+ },
355
+ {
356
+ "kind": "Content",
357
+ "text": "string"
358
+ },
359
+ {
360
+ "kind": "Content",
361
+ "text": ", nonce: "
362
+ },
363
+ {
364
+ "kind": "Reference",
365
+ "text": "Nonce",
366
+ "canonicalReference": "@kagal/taistamp!Nonce:type"
367
+ },
368
+ {
369
+ "kind": "Content",
370
+ "text": ") => "
371
+ },
372
+ {
373
+ "kind": "Reference",
374
+ "text": "ArrayBuffer",
375
+ "canonicalReference": "!ArrayBuffer:interface"
376
+ }
377
+ ],
378
+ "fileUrlPath": "dist/index.d.mts",
379
+ "returnTypeTokenRange": {
380
+ "startIndex": 9,
381
+ "endIndex": 10
382
+ },
383
+ "releaseTag": "Public",
384
+ "overloadIndex": 1,
385
+ "parameters": [
386
+ {
387
+ "parameterName": "label",
388
+ "parameterTypeTokenRange": {
389
+ "startIndex": 1,
390
+ "endIndex": 2
391
+ },
392
+ "isOptional": false
393
+ },
394
+ {
395
+ "parameterName": "leapSeconds",
396
+ "parameterTypeTokenRange": {
397
+ "startIndex": 3,
398
+ "endIndex": 4
399
+ },
400
+ "isOptional": false
401
+ },
402
+ {
403
+ "parameterName": "selector",
404
+ "parameterTypeTokenRange": {
405
+ "startIndex": 5,
406
+ "endIndex": 6
407
+ },
408
+ "isOptional": false
409
+ },
410
+ {
411
+ "parameterName": "nonce",
412
+ "parameterTypeTokenRange": {
413
+ "startIndex": 7,
414
+ "endIndex": 8
415
+ },
416
+ "isOptional": false
417
+ }
418
+ ],
419
+ "name": "composeSignaturePayload"
420
+ },
421
+ {
422
+ "kind": "Function",
423
+ "canonicalReference": "@kagal/taistamp!extractLeapSeconds:function(1)",
424
+ "docComment": "/**\n * Extract a usable leap-seconds count from response headers. Returns `undefined` when the `TAI-Leap-Seconds` field is missing, empty, non-numeric, non-integer, negative, or out-of-range — every \"treat as unsigned\" case in spec §5.3 collapsed into one verdict.\n */\n",
425
+ "excerptTokens": [
426
+ {
427
+ "kind": "Content",
428
+ "text": "extractLeapSeconds: (headers: "
429
+ },
430
+ {
431
+ "kind": "Reference",
432
+ "text": "Headers",
433
+ "canonicalReference": "!Headers:interface"
434
+ },
435
+ {
436
+ "kind": "Content",
437
+ "text": ") => "
438
+ },
439
+ {
440
+ "kind": "Reference",
441
+ "text": "LeapSeconds",
442
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
443
+ },
444
+ {
445
+ "kind": "Content",
446
+ "text": " | undefined"
447
+ }
448
+ ],
449
+ "fileUrlPath": "dist/_chunks/time.d.mts",
450
+ "returnTypeTokenRange": {
451
+ "startIndex": 3,
452
+ "endIndex": 5
453
+ },
454
+ "releaseTag": "Public",
455
+ "overloadIndex": 1,
456
+ "parameters": [
457
+ {
458
+ "parameterName": "headers",
459
+ "parameterTypeTokenRange": {
460
+ "startIndex": 1,
461
+ "endIndex": 2
462
+ },
463
+ "isOptional": false
464
+ }
465
+ ],
466
+ "name": "extractLeapSeconds"
467
+ },
468
+ {
469
+ "kind": "Function",
470
+ "canonicalReference": "@kagal/taistamp!extractNonce:function(1)",
471
+ "docComment": "/**\n * Extract a usable `TAI-Nonce` from headers — the request on the serving side, the response's nonce echo on the verifying side. Returns `undefined` when the field is missing or fails {@link asNonce} validation.\n */\n",
472
+ "excerptTokens": [
473
+ {
474
+ "kind": "Content",
475
+ "text": "extractNonce: (headers: "
476
+ },
477
+ {
478
+ "kind": "Reference",
479
+ "text": "Headers",
480
+ "canonicalReference": "!Headers:interface"
481
+ },
482
+ {
483
+ "kind": "Content",
484
+ "text": ") => "
485
+ },
486
+ {
487
+ "kind": "Reference",
488
+ "text": "Nonce",
489
+ "canonicalReference": "@kagal/taistamp!Nonce:type"
490
+ },
491
+ {
492
+ "kind": "Content",
493
+ "text": " | undefined"
494
+ }
495
+ ],
496
+ "fileUrlPath": "dist/index.d.mts",
497
+ "returnTypeTokenRange": {
498
+ "startIndex": 3,
499
+ "endIndex": 5
500
+ },
501
+ "releaseTag": "Public",
502
+ "overloadIndex": 1,
503
+ "parameters": [
504
+ {
505
+ "parameterName": "headers",
506
+ "parameterTypeTokenRange": {
507
+ "startIndex": 1,
508
+ "endIndex": 2
509
+ },
510
+ "isOptional": false
511
+ }
512
+ ],
513
+ "name": "extractNonce"
514
+ },
515
+ {
516
+ "kind": "Function",
517
+ "canonicalReference": "@kagal/taistamp!extractSignature:function(1)",
518
+ "docComment": "/**\n * Extract the raw Ed25519 signature from response headers. Returns `undefined` when the `TAI-Signature` field is missing or fails {@link asSignature} validation.\n */\n",
519
+ "excerptTokens": [
520
+ {
521
+ "kind": "Content",
522
+ "text": "extractSignature: (headers: "
523
+ },
524
+ {
525
+ "kind": "Reference",
526
+ "text": "Headers",
527
+ "canonicalReference": "!Headers:interface"
528
+ },
529
+ {
530
+ "kind": "Content",
531
+ "text": ") => "
532
+ },
533
+ {
534
+ "kind": "Reference",
535
+ "text": "Bytes",
536
+ "canonicalReference": "@kagal/taistamp!Bytes:type"
537
+ },
538
+ {
539
+ "kind": "Content",
540
+ "text": " | undefined"
541
+ }
542
+ ],
543
+ "fileUrlPath": "dist/index.d.mts",
544
+ "returnTypeTokenRange": {
545
+ "startIndex": 3,
546
+ "endIndex": 5
547
+ },
548
+ "releaseTag": "Public",
549
+ "overloadIndex": 1,
550
+ "parameters": [
551
+ {
552
+ "parameterName": "headers",
553
+ "parameterTypeTokenRange": {
554
+ "startIndex": 1,
555
+ "endIndex": 2
556
+ },
557
+ "isOptional": false
558
+ }
559
+ ],
560
+ "name": "extractSignature"
561
+ },
562
+ {
563
+ "kind": "Interface",
564
+ "canonicalReference": "@kagal/taistamp!KeyConfig:interface",
565
+ "docComment": "/**\n * Parsed `selector:base64` secret. Extends {@link KeyContext} with the parsed `selector` and pre-built {@link Signer} / {@link Verifier}; the inherited {@link KeyContext.publicJWK} carries the selector as its `kid`.\n */\n",
566
+ "excerptTokens": [
567
+ {
568
+ "kind": "Content",
569
+ "text": "interface KeyConfig extends "
570
+ },
571
+ {
572
+ "kind": "Reference",
573
+ "text": "KeyContext",
574
+ "canonicalReference": "@kagal/taistamp!KeyContext:interface"
575
+ },
576
+ {
577
+ "kind": "Content",
578
+ "text": " "
579
+ }
580
+ ],
581
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
582
+ "releaseTag": "Public",
583
+ "name": "KeyConfig",
584
+ "preserveMemberOrder": false,
585
+ "members": [
586
+ {
587
+ "kind": "PropertySignature",
588
+ "canonicalReference": "@kagal/taistamp!KeyConfig#selector:member",
589
+ "docComment": "/**\n * Selector portion of the parsed secret, validated against {@link SELECTOR_PATTERN}. Pinned onto {@link KeyContext.publicJWK} as its `kid`, so a JWKS endpoint and a DNS-style channel can both index the same key under the same identifier.\n */\n",
590
+ "excerptTokens": [
591
+ {
592
+ "kind": "Content",
593
+ "text": "selector: "
594
+ },
595
+ {
596
+ "kind": "Content",
597
+ "text": "string"
598
+ },
599
+ {
600
+ "kind": "Content",
601
+ "text": ";"
602
+ }
603
+ ],
604
+ "isReadonly": false,
605
+ "isOptional": false,
606
+ "releaseTag": "Public",
607
+ "name": "selector",
608
+ "propertyTypeTokenRange": {
609
+ "startIndex": 1,
610
+ "endIndex": 2
611
+ }
612
+ },
613
+ {
614
+ "kind": "PropertySignature",
615
+ "canonicalReference": "@kagal/taistamp!KeyConfig#signer:member",
616
+ "docComment": "/**\n * {@link Signer} backed by {@link KeyContext.signKey}. Calls `crypto.subtle.sign('Ed25519', signKey, message)` and returns the raw 64-byte RFC 8032 signature.\n */\n",
617
+ "excerptTokens": [
618
+ {
619
+ "kind": "Content",
620
+ "text": "signer: "
621
+ },
622
+ {
623
+ "kind": "Reference",
624
+ "text": "Signer",
625
+ "canonicalReference": "@kagal/taistamp!Signer:interface"
626
+ },
627
+ {
628
+ "kind": "Content",
629
+ "text": ";"
630
+ }
631
+ ],
632
+ "isReadonly": false,
633
+ "isOptional": false,
634
+ "releaseTag": "Public",
635
+ "name": "signer",
636
+ "propertyTypeTokenRange": {
637
+ "startIndex": 1,
638
+ "endIndex": 2
639
+ }
640
+ },
641
+ {
642
+ "kind": "PropertySignature",
643
+ "canonicalReference": "@kagal/taistamp!KeyConfig#verifier:member",
644
+ "docComment": "/**\n * {@link Verifier} backed by {@link KeyContext.publicKey}. Calls `crypto.subtle.verify('Ed25519', publicKey, signature, message)` and returns the boolean result.\n */\n",
645
+ "excerptTokens": [
646
+ {
647
+ "kind": "Content",
648
+ "text": "verifier: "
649
+ },
650
+ {
651
+ "kind": "Reference",
652
+ "text": "Verifier",
653
+ "canonicalReference": "@kagal/taistamp!Verifier:interface"
654
+ },
655
+ {
656
+ "kind": "Content",
657
+ "text": ";"
658
+ }
659
+ ],
660
+ "isReadonly": false,
661
+ "isOptional": false,
662
+ "releaseTag": "Public",
663
+ "name": "verifier",
664
+ "propertyTypeTokenRange": {
665
+ "startIndex": 1,
666
+ "endIndex": 2
667
+ }
668
+ }
669
+ ],
670
+ "extendsTokenRanges": [
671
+ {
672
+ "startIndex": 1,
673
+ "endIndex": 2
674
+ }
675
+ ]
676
+ },
677
+ {
678
+ "kind": "Interface",
679
+ "canonicalReference": "@kagal/taistamp!KeyRecord:interface",
680
+ "docComment": "/**\n * DKIM-style tag-list key record (RFC 6376 §3.2 syntax, §3.6.1 `p=` semantics) for publishing and consuming public verification keys via DNS TXT records.\n *\n * `P` tracks the form in use for the `p` field: `Uint8Array` for raw key bytes (parse direction; the shape a DNS-record decoder returns); `string` for base64-encoded key bytes (publish direction; the wire shape of `p=`); `CryptoKey` for the verify-only key (post-import); `Verifier` for that key wrapped as a verifier (post-wrap).\n *\n * Additional DKIM tags (e.g. `h`, `s`, `t`, `n`, `g`) appear as own properties under their tag name and are reached via the index signature. Consumers needing typed access to a specific tag set extend this interface — e.g. a parser produces `interface DKIMKeyRecord extends KeyRecord<Uint8Array>` with the declared tags, narrowing those keys to `string` while arbitrary extras remain reachable via the signature.\n *\n * Tag names and values are case-sensitive per RFC 6376 §3.2. Empty values are distinct from omitted tags: an absent `v=` leaves `v === undefined`, an explicitly empty `v=` sets `v === ''`. The `p=` material follows §3.6.1: an empty value (`p: undefined` here) signals key revocation; an absent `p=` is not a key record at all and a parser rejects the input rather than returning `undefined`.\n */\n",
681
+ "excerptTokens": [
682
+ {
683
+ "kind": "Content",
684
+ "text": "interface KeyRecord<P = "
685
+ },
686
+ {
687
+ "kind": "Reference",
688
+ "text": "Uint8Array",
689
+ "canonicalReference": "!Uint8Array:interface"
690
+ },
691
+ {
692
+ "kind": "Content",
693
+ "text": "> "
694
+ }
695
+ ],
696
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
697
+ "releaseTag": "Public",
698
+ "typeParameters": [
699
+ {
700
+ "typeParameterName": "P",
701
+ "constraintTokenRange": {
702
+ "startIndex": 0,
703
+ "endIndex": 0
704
+ },
705
+ "defaultTypeTokenRange": {
706
+ "startIndex": 1,
707
+ "endIndex": 2
708
+ }
709
+ }
710
+ ],
711
+ "name": "KeyRecord",
712
+ "preserveMemberOrder": false,
713
+ "members": [
714
+ {
715
+ "kind": "IndexSignature",
716
+ "canonicalReference": "@kagal/taistamp!KeyRecord:index(1)",
717
+ "docComment": "",
718
+ "excerptTokens": [
719
+ {
720
+ "kind": "Content",
721
+ "text": "[tag: "
722
+ },
723
+ {
724
+ "kind": "Content",
725
+ "text": "string"
726
+ },
727
+ {
728
+ "kind": "Content",
729
+ "text": "]: "
730
+ },
731
+ {
732
+ "kind": "Content",
733
+ "text": "P | string | undefined"
734
+ },
735
+ {
736
+ "kind": "Content",
737
+ "text": ";"
738
+ }
739
+ ],
740
+ "isReadonly": false,
741
+ "returnTypeTokenRange": {
742
+ "startIndex": 3,
743
+ "endIndex": 4
744
+ },
745
+ "releaseTag": "Public",
746
+ "overloadIndex": 1,
747
+ "parameters": [
748
+ {
749
+ "parameterName": "tag",
750
+ "parameterTypeTokenRange": {
751
+ "startIndex": 1,
752
+ "endIndex": 2
753
+ },
754
+ "isOptional": false
755
+ }
756
+ ]
757
+ },
758
+ {
759
+ "kind": "PropertySignature",
760
+ "canonicalReference": "@kagal/taistamp!KeyRecord#k:member",
761
+ "docComment": "",
762
+ "excerptTokens": [
763
+ {
764
+ "kind": "Content",
765
+ "text": "k?: "
766
+ },
767
+ {
768
+ "kind": "Content",
769
+ "text": "string"
770
+ },
771
+ {
772
+ "kind": "Content",
773
+ "text": ";"
774
+ }
775
+ ],
776
+ "isReadonly": false,
777
+ "isOptional": true,
778
+ "releaseTag": "Public",
779
+ "name": "k",
780
+ "propertyTypeTokenRange": {
781
+ "startIndex": 1,
782
+ "endIndex": 2
783
+ }
784
+ },
785
+ {
786
+ "kind": "PropertySignature",
787
+ "canonicalReference": "@kagal/taistamp!KeyRecord#p:member",
788
+ "docComment": "",
789
+ "excerptTokens": [
790
+ {
791
+ "kind": "Content",
792
+ "text": "p: "
793
+ },
794
+ {
795
+ "kind": "Content",
796
+ "text": "P | undefined"
797
+ },
798
+ {
799
+ "kind": "Content",
800
+ "text": ";"
801
+ }
802
+ ],
803
+ "isReadonly": false,
804
+ "isOptional": false,
805
+ "releaseTag": "Public",
806
+ "name": "p",
807
+ "propertyTypeTokenRange": {
808
+ "startIndex": 1,
809
+ "endIndex": 2
810
+ }
811
+ },
812
+ {
813
+ "kind": "PropertySignature",
814
+ "canonicalReference": "@kagal/taistamp!KeyRecord#v:member",
815
+ "docComment": "",
816
+ "excerptTokens": [
817
+ {
818
+ "kind": "Content",
819
+ "text": "v?: "
820
+ },
821
+ {
822
+ "kind": "Content",
823
+ "text": "string"
824
+ },
825
+ {
826
+ "kind": "Content",
827
+ "text": ";"
828
+ }
829
+ ],
830
+ "isReadonly": false,
831
+ "isOptional": true,
832
+ "releaseTag": "Public",
833
+ "name": "v",
834
+ "propertyTypeTokenRange": {
835
+ "startIndex": 1,
836
+ "endIndex": 2
837
+ }
838
+ }
839
+ ],
840
+ "extendsTokenRanges": []
841
+ },
842
+ {
843
+ "kind": "TypeAlias",
844
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type",
845
+ "docComment": "/**\n * `number` that has been confirmed to fit the `[0, TAI_LEAP_SECONDS_MAX]` u32be range required by the taistamp signed-payload framing. Construct only via {@link extractLeapSeconds} or {@link asLeapSeconds}; the brand prevents an arbitrary number from reaching the signing path.\n */\n",
846
+ "excerptTokens": [
847
+ {
848
+ "kind": "Content",
849
+ "text": "type LeapSeconds = "
850
+ },
851
+ {
852
+ "kind": "Content",
853
+ "text": "number & {\n readonly ["
854
+ },
855
+ {
856
+ "kind": "Reference",
857
+ "text": "LeapSecondsBrand",
858
+ "canonicalReference": "@kagal/taistamp!~LeapSecondsBrand:var"
859
+ },
860
+ {
861
+ "kind": "Content",
862
+ "text": "]: never;\n}"
863
+ },
864
+ {
865
+ "kind": "Content",
866
+ "text": ";"
867
+ }
868
+ ],
869
+ "fileUrlPath": "dist/_chunks/time.d.mts",
870
+ "releaseTag": "Public",
871
+ "name": "LeapSeconds",
872
+ "typeTokenRange": {
873
+ "startIndex": 1,
874
+ "endIndex": 4
875
+ }
876
+ },
877
+ {
878
+ "kind": "Function",
879
+ "canonicalReference": "@kagal/taistamp!newEd25519Signer:function(1)",
880
+ "docComment": "/**\n * Build a {@link Signer} backed by a WebCrypto Ed25519 private `CryptoKey`.\n *\n * @param key - Ed25519 private `CryptoKey` with `'sign'` in `key.usages`\n *\n * @param context - optional prefix prepended to error messages, typically the calling function's name\n *\n * @returns a {@link Signer} producing 64-byte raw signatures (R ‖ s) per {@link https://datatracker.ietf.org/doc/html/rfc8032 | RFC 8032}\n *\n * @throws\n *\n * `TypeError` when `key.algorithm.name` is not a supported algorithm or `'sign'` is missing from `key.usages`\n */\n",
881
+ "excerptTokens": [
882
+ {
883
+ "kind": "Content",
884
+ "text": "newSigner: (key: "
885
+ },
886
+ {
887
+ "kind": "Reference",
888
+ "text": "CryptoKey",
889
+ "canonicalReference": "!CryptoKey:interface"
890
+ },
891
+ {
892
+ "kind": "Content",
893
+ "text": ", context?: "
894
+ },
895
+ {
896
+ "kind": "Content",
897
+ "text": "string"
898
+ },
899
+ {
900
+ "kind": "Content",
901
+ "text": ") => "
902
+ },
903
+ {
904
+ "kind": "Reference",
905
+ "text": "Signer",
906
+ "canonicalReference": "@kagal/taistamp!Signer:interface"
907
+ }
908
+ ],
909
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
910
+ "returnTypeTokenRange": {
911
+ "startIndex": 5,
912
+ "endIndex": 6
913
+ },
914
+ "releaseTag": "Public",
915
+ "overloadIndex": 1,
916
+ "parameters": [
917
+ {
918
+ "parameterName": "key",
919
+ "parameterTypeTokenRange": {
920
+ "startIndex": 1,
921
+ "endIndex": 2
922
+ },
923
+ "isOptional": false
924
+ },
925
+ {
926
+ "parameterName": "context",
927
+ "parameterTypeTokenRange": {
928
+ "startIndex": 3,
929
+ "endIndex": 4
930
+ },
931
+ "isOptional": true
932
+ }
933
+ ],
934
+ "name": "newEd25519Signer"
935
+ },
936
+ {
937
+ "kind": "Function",
938
+ "canonicalReference": "@kagal/taistamp!newNonce:function(1)",
939
+ "docComment": "/**\n * Mint a fresh client `TAI-Nonce`: `byteLength` random bytes framed as an sf-binary item, branded directly — the result is conformant by construction. `byteLength` must be an integer within `[NONCE_MIN_BYTES, NONCE_MAX_BYTES]` — spec §5.4's decoded-length bound; anything else throws `TypeError`. `context` (default `'newNonce'`) prefixes the thrown error.\n */\n",
940
+ "excerptTokens": [
941
+ {
942
+ "kind": "Content",
943
+ "text": "newNonce: (byteLength?: "
944
+ },
945
+ {
946
+ "kind": "Content",
947
+ "text": "number"
948
+ },
949
+ {
950
+ "kind": "Content",
951
+ "text": ", context?: "
952
+ },
953
+ {
954
+ "kind": "Content",
955
+ "text": "string"
956
+ },
957
+ {
958
+ "kind": "Content",
959
+ "text": ") => "
960
+ },
961
+ {
962
+ "kind": "Reference",
963
+ "text": "Nonce",
964
+ "canonicalReference": "@kagal/taistamp!Nonce:type"
965
+ }
966
+ ],
967
+ "fileUrlPath": "dist/index.d.mts",
968
+ "returnTypeTokenRange": {
969
+ "startIndex": 5,
970
+ "endIndex": 6
971
+ },
972
+ "releaseTag": "Public",
973
+ "overloadIndex": 1,
974
+ "parameters": [
975
+ {
976
+ "parameterName": "byteLength",
977
+ "parameterTypeTokenRange": {
978
+ "startIndex": 1,
979
+ "endIndex": 2
980
+ },
981
+ "isOptional": true
982
+ },
983
+ {
984
+ "parameterName": "context",
985
+ "parameterTypeTokenRange": {
986
+ "startIndex": 3,
987
+ "endIndex": 4
988
+ },
989
+ "isOptional": true
990
+ }
991
+ ],
992
+ "name": "newNonce"
993
+ },
994
+ {
995
+ "kind": "Function",
996
+ "canonicalReference": "@kagal/taistamp!newTaistampHandler:function(1)",
997
+ "docComment": "/**\n * Build a handler for `/.well-known/taistamp`.\n *\n * @remarks\n *\n * Behaviour:\n *\n * - `GET` / `HEAD` — body is a fresh 25-byte TAI64N label (`HEAD` omits the body). Response headers: Content-Type `application/tai64n`, Content-Disposition `inline` (so a browser renders the label in place rather than offering it as a download), Content-Length `25`, Cache-Control `no-store`, plus `TAI-Leap-Seconds` carrying the current count. - `OPTIONS` — `200` with `Allow: GET, HEAD, OPTIONS`. When CORS is enabled (the default) the response also carries `Access-Control-Allow-*` and `-Expose-Headers` per {@link TaistampHandlerConfig.cors}. `OPTIONS` is never signed. - Any other method — `405 Method Not Allowed` with `Allow: GET, HEAD, OPTIONS`. - Request `TAI-Nonce` — on `GET`, the value is echoed verbatim in the response. A missing, empty, duplicated, structurally malformed, or length-out-of-range field is treated as absent (no echo, no signature) per spec §5.4 — see {@link extractNonce}. `HEAD`, `OPTIONS`, and `405` responses never carry `TAI-Nonce` per spec §5.1. - Request `TAI-Nonce` *and* `signer` configured *and* the request method is `GET` — adds `TAI-Key-Selector` and `TAI-Signature` (sf-binary) over the bytes produced by {@link composeSignaturePayload}. The domain-separation tag means the same key cannot be tricked into producing valid signatures for other protocols. `HEAD`, `OPTIONS`, and `405` responses are never signed.\n *\n * The corresponding public key is expected to be published out-of-band as a DNS TXT record at `<selector>._taistamp.<host>` — verifiers fetch the key by selector so the operator can rotate keys by publishing a new selector while the old one is still cached.\n *\n * @param config - optional {@link TaistampHandlerConfig}\n *\n * @returns an `async (request) => Response` callable directly as a Web `fetch` handler or as a Hono route handler.\n *\n * @throws\n *\n * TypeError if `signer` and `selector` are not both set or both unset, if `selector` does not match `[A-Za-z]([A-Za-z0-9_-]{0,61}[A-Za-z0-9])?`, or if `corsMaxAge` is not a non-negative integer.\n *\n * @see\n *\n * {@link https://cr.yp.to/libtai/tai64.html} for TAI64N format\n */\n",
998
+ "excerptTokens": [
999
+ {
1000
+ "kind": "Content",
1001
+ "text": "newTaistampHandler: (config?: "
1002
+ },
1003
+ {
1004
+ "kind": "Reference",
1005
+ "text": "TaistampHandlerConfig",
1006
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig:interface"
1007
+ },
1008
+ {
1009
+ "kind": "Content",
1010
+ "text": ") => "
1011
+ },
1012
+ {
1013
+ "kind": "Content",
1014
+ "text": "((request: "
1015
+ },
1016
+ {
1017
+ "kind": "Reference",
1018
+ "text": "Request",
1019
+ "canonicalReference": "!Request:interface"
1020
+ },
1021
+ {
1022
+ "kind": "Content",
1023
+ "text": ") => "
1024
+ },
1025
+ {
1026
+ "kind": "Reference",
1027
+ "text": "Promise",
1028
+ "canonicalReference": "!Promise:interface"
1029
+ },
1030
+ {
1031
+ "kind": "Content",
1032
+ "text": "<"
1033
+ },
1034
+ {
1035
+ "kind": "Reference",
1036
+ "text": "Response",
1037
+ "canonicalReference": "!Response:interface"
1038
+ },
1039
+ {
1040
+ "kind": "Content",
1041
+ "text": ">)"
1042
+ }
1043
+ ],
1044
+ "fileUrlPath": "dist/index.d.mts",
1045
+ "returnTypeTokenRange": {
1046
+ "startIndex": 3,
1047
+ "endIndex": 10
1048
+ },
1049
+ "releaseTag": "Public",
1050
+ "overloadIndex": 1,
1051
+ "parameters": [
1052
+ {
1053
+ "parameterName": "config",
1054
+ "parameterTypeTokenRange": {
1055
+ "startIndex": 1,
1056
+ "endIndex": 2
1057
+ },
1058
+ "isOptional": true
1059
+ }
1060
+ ],
1061
+ "name": "newTaistampHandler"
1062
+ },
1063
+ {
1064
+ "kind": "TypeAlias",
1065
+ "canonicalReference": "@kagal/taistamp!Nonce:type",
1066
+ "docComment": "/**\n * `string` that has been confirmed to satisfy the sf-binary syntax of RFC 9651 §3.3.5 and to fall inside the wire-form length range `[NONCE_MIN_OCTETS, NONCE_MAX_OCTETS]` — the pre-decode form of spec §5.4's normative decoded-length bound of 7..129 octets. Construct only via {@link asNonce}, {@link extractNonce}, or {@link newNonce}; the brand prevents arbitrary strings from reaching the signing path.\n */\n",
1067
+ "excerptTokens": [
1068
+ {
1069
+ "kind": "Content",
1070
+ "text": "type Nonce = "
1071
+ },
1072
+ {
1073
+ "kind": "Content",
1074
+ "text": "string & {\n readonly ["
1075
+ },
1076
+ {
1077
+ "kind": "Reference",
1078
+ "text": "NonceBrand",
1079
+ "canonicalReference": "@kagal/taistamp!~NonceBrand:var"
1080
+ },
1081
+ {
1082
+ "kind": "Content",
1083
+ "text": "]: never;\n}"
1084
+ },
1085
+ {
1086
+ "kind": "Content",
1087
+ "text": ";"
1088
+ }
1089
+ ],
1090
+ "fileUrlPath": "dist/index.d.mts",
1091
+ "releaseTag": "Public",
1092
+ "name": "Nonce",
1093
+ "typeTokenRange": {
1094
+ "startIndex": 1,
1095
+ "endIndex": 4
1096
+ }
1097
+ },
1098
+ {
1099
+ "kind": "Function",
1100
+ "canonicalReference": "@kagal/taistamp!parseRecordToVerifier:function(1)",
1101
+ "docComment": "/**\n * Parse a DNS TXT-record value into a {@link KeyRecord} whose `p` field is a ready-to-use {@link Verifier} over the record's published key.\n *\n * A revoked record (empty `p=`, RFC 6376 §3.6.1) carries through as `p: undefined` with no verifier built. `v`, `k`, and any unknown tags pass through unchanged.\n *\n * @param input - TXT record value: raw string, DoH-JSON-quoted string, or array of pre-extracted character-strings (see {@link parseKeyRecord})\n *\n * @param context - prefix prepended to thrown error messages; defaults to `'parseRecordToVerifier'`\n *\n * @returns a {@link KeyRecord} carrying the {@link Verifier} in `p`, or `p: undefined` for a revoked record\n *\n * @throws\n *\n * `TypeError` for malformed record syntax, an unsupported algorithm, or a wrong-length key\n */\n",
1102
+ "excerptTokens": [
1103
+ {
1104
+ "kind": "Content",
1105
+ "text": "parseRecordToVerifier: (input: "
1106
+ },
1107
+ {
1108
+ "kind": "Content",
1109
+ "text": "readonly string[] | string"
1110
+ },
1111
+ {
1112
+ "kind": "Content",
1113
+ "text": ", context?: "
1114
+ },
1115
+ {
1116
+ "kind": "Content",
1117
+ "text": "string"
1118
+ },
1119
+ {
1120
+ "kind": "Content",
1121
+ "text": ") => "
1122
+ },
1123
+ {
1124
+ "kind": "Reference",
1125
+ "text": "Promise",
1126
+ "canonicalReference": "!Promise:interface"
1127
+ },
1128
+ {
1129
+ "kind": "Content",
1130
+ "text": "<"
1131
+ },
1132
+ {
1133
+ "kind": "Reference",
1134
+ "text": "KeyRecord",
1135
+ "canonicalReference": "@kagal/taistamp!KeyRecord:interface"
1136
+ },
1137
+ {
1138
+ "kind": "Content",
1139
+ "text": "<"
1140
+ },
1141
+ {
1142
+ "kind": "Reference",
1143
+ "text": "Verifier",
1144
+ "canonicalReference": "@kagal/taistamp!Verifier:interface"
1145
+ },
1146
+ {
1147
+ "kind": "Content",
1148
+ "text": ">>"
1149
+ }
1150
+ ],
1151
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
1152
+ "returnTypeTokenRange": {
1153
+ "startIndex": 5,
1154
+ "endIndex": 11
1155
+ },
1156
+ "releaseTag": "Public",
1157
+ "overloadIndex": 1,
1158
+ "parameters": [
1159
+ {
1160
+ "parameterName": "input",
1161
+ "parameterTypeTokenRange": {
1162
+ "startIndex": 1,
1163
+ "endIndex": 2
1164
+ },
1165
+ "isOptional": false
1166
+ },
1167
+ {
1168
+ "parameterName": "context",
1169
+ "parameterTypeTokenRange": {
1170
+ "startIndex": 3,
1171
+ "endIndex": 4
1172
+ },
1173
+ "isOptional": true
1174
+ }
1175
+ ],
1176
+ "name": "parseRecordToVerifier"
1177
+ },
1178
+ {
1179
+ "kind": "Function",
1180
+ "canonicalReference": "@kagal/taistamp!parseSecretsToKeys:function(1)",
1181
+ "docComment": "/**\n * Parse a string containing multiple `selector:base64` secrets into an array of {@link KeyConfig}s. Splits on any character outside the `selector:base64` alphabet (alphanumerics, `:`, `+`, `/`, `=`, `_`, `-`) — so whitespace, commas, semicolons, pipes, and other punctuation all work as delimiters. Empty fragments (from leading, trailing, or consecutive delimiters) are dropped before any decode is attempted.\n *\n * Returned entries preserve input order; in lenient mode that's the order among entries that parsed.\n *\n * @param secrets - one or more `selector:base64` secrets separated by whitespace or punctuation\n *\n * @param strict - when `true` (default), a malformed entry rejects the whole call; when `false`, malformed entries are silently skipped and the returned array contains only the entries that parsed\n *\n * @param context - prefix prepended to per-entry error messages; only visible in strict mode (lenient mode swallows the errors); defaults to `'parseSecretsToKeys'`\n *\n * @returns array of {@link KeyConfig}s, one per successfully-parsed secret; empty when `secrets` yields no usable tokens\n *\n * @throws\n *\n * TypeError (in strict mode) — the message identifies the 1-based index of the offending entry: `<context>: secret N: <inner error>`\n */\n",
1182
+ "excerptTokens": [
1183
+ {
1184
+ "kind": "Content",
1185
+ "text": "parseSecretsToKeys: (secrets: "
1186
+ },
1187
+ {
1188
+ "kind": "Content",
1189
+ "text": "string"
1190
+ },
1191
+ {
1192
+ "kind": "Content",
1193
+ "text": ", strict?: "
1194
+ },
1195
+ {
1196
+ "kind": "Content",
1197
+ "text": "boolean"
1198
+ },
1199
+ {
1200
+ "kind": "Content",
1201
+ "text": ", context?: "
1202
+ },
1203
+ {
1204
+ "kind": "Content",
1205
+ "text": "string"
1206
+ },
1207
+ {
1208
+ "kind": "Content",
1209
+ "text": ") => "
1210
+ },
1211
+ {
1212
+ "kind": "Reference",
1213
+ "text": "Promise",
1214
+ "canonicalReference": "!Promise:interface"
1215
+ },
1216
+ {
1217
+ "kind": "Content",
1218
+ "text": "<"
1219
+ },
1220
+ {
1221
+ "kind": "Reference",
1222
+ "text": "KeyConfig",
1223
+ "canonicalReference": "@kagal/taistamp!KeyConfig:interface"
1224
+ },
1225
+ {
1226
+ "kind": "Content",
1227
+ "text": "[]>"
1228
+ }
1229
+ ],
1230
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
1231
+ "returnTypeTokenRange": {
1232
+ "startIndex": 7,
1233
+ "endIndex": 11
1234
+ },
1235
+ "releaseTag": "Public",
1236
+ "overloadIndex": 1,
1237
+ "parameters": [
1238
+ {
1239
+ "parameterName": "secrets",
1240
+ "parameterTypeTokenRange": {
1241
+ "startIndex": 1,
1242
+ "endIndex": 2
1243
+ },
1244
+ "isOptional": false
1245
+ },
1246
+ {
1247
+ "parameterName": "strict",
1248
+ "parameterTypeTokenRange": {
1249
+ "startIndex": 3,
1250
+ "endIndex": 4
1251
+ },
1252
+ "isOptional": true
1253
+ },
1254
+ {
1255
+ "parameterName": "context",
1256
+ "parameterTypeTokenRange": {
1257
+ "startIndex": 5,
1258
+ "endIndex": 6
1259
+ },
1260
+ "isOptional": true
1261
+ }
1262
+ ],
1263
+ "name": "parseSecretsToKeys"
1264
+ },
1265
+ {
1266
+ "kind": "Function",
1267
+ "canonicalReference": "@kagal/taistamp!parseSecretToKey:function(1)",
1268
+ "docComment": "/**\n * Parse a `selector:base64` secret into a {@link KeyConfig}. The base64 portion is a raw 32-byte Ed25519 private seed in standard or URL-safe encoding; the selector is validated against {@link SELECTOR_PATTERN}.\n *\n * @param secretString - secret of the form `selector:base64`\n *\n * @param context - prefix prepended to the thrown error message; defaults to `'parseSecretToKey'`\n *\n * @returns a {@link KeyConfig} — a {@link KeyContext} (carrying the raw seed, the public / sign-only `CryptoKey`s, and a `publicJWK` with `kid` set to the parsed selector) plus the `selector` itself and ready-to-use {@link Signer} / {@link Verifier}\n *\n * @throws\n *\n * TypeError if `secretString` is not in `selector:base64` form, if the selector fails {@link SELECTOR_PATTERN}, or if the base64 fails to decode to a 32-byte seed\n *\n * @see\n *\n * {@link https://datatracker.ietf.org/doc/html/rfc8410}\n */\n",
1269
+ "excerptTokens": [
1270
+ {
1271
+ "kind": "Content",
1272
+ "text": "parseSecretToKey: (secretString: "
1273
+ },
1274
+ {
1275
+ "kind": "Content",
1276
+ "text": "string"
1277
+ },
1278
+ {
1279
+ "kind": "Content",
1280
+ "text": ", context?: "
1281
+ },
1282
+ {
1283
+ "kind": "Content",
1284
+ "text": "string"
1285
+ },
1286
+ {
1287
+ "kind": "Content",
1288
+ "text": ") => "
1289
+ },
1290
+ {
1291
+ "kind": "Reference",
1292
+ "text": "Promise",
1293
+ "canonicalReference": "!Promise:interface"
1294
+ },
1295
+ {
1296
+ "kind": "Content",
1297
+ "text": "<"
1298
+ },
1299
+ {
1300
+ "kind": "Reference",
1301
+ "text": "KeyConfig",
1302
+ "canonicalReference": "@kagal/taistamp!KeyConfig:interface"
1303
+ },
1304
+ {
1305
+ "kind": "Content",
1306
+ "text": ">"
1307
+ }
1308
+ ],
1309
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
1310
+ "returnTypeTokenRange": {
1311
+ "startIndex": 5,
1312
+ "endIndex": 9
1313
+ },
1314
+ "releaseTag": "Public",
1315
+ "overloadIndex": 1,
1316
+ "parameters": [
1317
+ {
1318
+ "parameterName": "secretString",
1319
+ "parameterTypeTokenRange": {
1320
+ "startIndex": 1,
1321
+ "endIndex": 2
1322
+ },
1323
+ "isOptional": false
1324
+ },
1325
+ {
1326
+ "parameterName": "context",
1327
+ "parameterTypeTokenRange": {
1328
+ "startIndex": 3,
1329
+ "endIndex": 4
1330
+ },
1331
+ "isOptional": true
1332
+ }
1333
+ ],
1334
+ "name": "parseSecretToKey"
1335
+ },
1336
+ {
1337
+ "kind": "Function",
1338
+ "canonicalReference": "@kagal/taistamp!readASCII:function(1)",
1339
+ "docComment": "/**\n * Read a response body as a 7-bit ASCII string.\n *\n * `application/tai64n` is an octet-typed media type, not text: the TAI64N label is a fixed sequence of ASCII bytes. Reading it with `Response.text()` would route the body through UTF-8 decoding and silently mangle any non-ASCII octet, so this reads the raw bytes and decodes them one code point per byte instead.\n *\n * Throws `TypeError` on any byte ≥ `0x80`, surfacing a malformed body rather than masking it; pass `context` to prefix that error message. Consumes the response body, which can only be read once.\n *\n * Use {@link readLabel} when the body is meant to be a TAI64N label and its length should be validated too.\n */\n",
1340
+ "excerptTokens": [
1341
+ {
1342
+ "kind": "Content",
1343
+ "text": "readASCII: (response: "
1344
+ },
1345
+ {
1346
+ "kind": "Reference",
1347
+ "text": "Response",
1348
+ "canonicalReference": "!Response:interface"
1349
+ },
1350
+ {
1351
+ "kind": "Content",
1352
+ "text": ", context?: "
1353
+ },
1354
+ {
1355
+ "kind": "Content",
1356
+ "text": "string"
1357
+ },
1358
+ {
1359
+ "kind": "Content",
1360
+ "text": ") => "
1361
+ },
1362
+ {
1363
+ "kind": "Reference",
1364
+ "text": "Promise",
1365
+ "canonicalReference": "!Promise:interface"
1366
+ },
1367
+ {
1368
+ "kind": "Content",
1369
+ "text": "<string>"
1370
+ }
1371
+ ],
1372
+ "fileUrlPath": "dist/index.d.mts",
1373
+ "returnTypeTokenRange": {
1374
+ "startIndex": 5,
1375
+ "endIndex": 7
1376
+ },
1377
+ "releaseTag": "Public",
1378
+ "overloadIndex": 1,
1379
+ "parameters": [
1380
+ {
1381
+ "parameterName": "response",
1382
+ "parameterTypeTokenRange": {
1383
+ "startIndex": 1,
1384
+ "endIndex": 2
1385
+ },
1386
+ "isOptional": false
1387
+ },
1388
+ {
1389
+ "parameterName": "context",
1390
+ "parameterTypeTokenRange": {
1391
+ "startIndex": 3,
1392
+ "endIndex": 4
1393
+ },
1394
+ "isOptional": true
1395
+ }
1396
+ ],
1397
+ "name": "readASCII"
1398
+ },
1399
+ {
1400
+ "kind": "Function",
1401
+ "canonicalReference": "@kagal/taistamp!readLabel:function(1)",
1402
+ "docComment": "/**\n * Read and return the TAI64N label from a response body.\n *\n * Builds on {@link readASCII}, adding the structural invariant every label satisfies: the body is exactly `TAI64N_LABEL_LENGTH` octets. Throws `TypeError` if the length differs or the body carries a non-ASCII octet; pass `context` to prefix that error message. Consumes the response body.\n */\n",
1403
+ "excerptTokens": [
1404
+ {
1405
+ "kind": "Content",
1406
+ "text": "readLabel: (response: "
1407
+ },
1408
+ {
1409
+ "kind": "Reference",
1410
+ "text": "Response",
1411
+ "canonicalReference": "!Response:interface"
1412
+ },
1413
+ {
1414
+ "kind": "Content",
1415
+ "text": ", context?: "
1416
+ },
1417
+ {
1418
+ "kind": "Content",
1419
+ "text": "string"
1420
+ },
1421
+ {
1422
+ "kind": "Content",
1423
+ "text": ") => "
1424
+ },
1425
+ {
1426
+ "kind": "Reference",
1427
+ "text": "Promise",
1428
+ "canonicalReference": "!Promise:interface"
1429
+ },
1430
+ {
1431
+ "kind": "Content",
1432
+ "text": "<string>"
1433
+ }
1434
+ ],
1435
+ "fileUrlPath": "dist/index.d.mts",
1436
+ "returnTypeTokenRange": {
1437
+ "startIndex": 5,
1438
+ "endIndex": 7
1439
+ },
1440
+ "releaseTag": "Public",
1441
+ "overloadIndex": 1,
1442
+ "parameters": [
1443
+ {
1444
+ "parameterName": "response",
1445
+ "parameterTypeTokenRange": {
1446
+ "startIndex": 1,
1447
+ "endIndex": 2
1448
+ },
1449
+ "isOptional": false
1450
+ },
1451
+ {
1452
+ "parameterName": "context",
1453
+ "parameterTypeTokenRange": {
1454
+ "startIndex": 3,
1455
+ "endIndex": 4
1456
+ },
1457
+ "isOptional": true
1458
+ }
1459
+ ],
1460
+ "name": "readLabel"
1461
+ },
1462
+ {
1463
+ "kind": "Interface",
1464
+ "canonicalReference": "@kagal/taistamp!Signer:interface",
1465
+ "docComment": "/**\n * Pluggable abstraction over a private signing key. Implementations sign caller-provided bytes and return the raw signature bytes; the algorithm and key store are implementation details.\n */\n",
1466
+ "excerptTokens": [
1467
+ {
1468
+ "kind": "Content",
1469
+ "text": "interface Signer "
1470
+ }
1471
+ ],
1472
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
1473
+ "releaseTag": "Public",
1474
+ "name": "Signer",
1475
+ "preserveMemberOrder": false,
1476
+ "members": [
1477
+ {
1478
+ "kind": "PropertySignature",
1479
+ "canonicalReference": "@kagal/taistamp!Signer#sign:member",
1480
+ "docComment": "/**\n * Produce a signature over `message`.\n *\n * @param message - message to sign, either bytes or a string (encoded as UTF-8); the caller is responsible for any framing or domain separation\n *\n * @returns the raw signature bytes (algorithm-defined length and encoding)\n */\n",
1481
+ "excerptTokens": [
1482
+ {
1483
+ "kind": "Content",
1484
+ "text": "sign: "
1485
+ },
1486
+ {
1487
+ "kind": "Content",
1488
+ "text": "(message: "
1489
+ },
1490
+ {
1491
+ "kind": "Reference",
1492
+ "text": "BufferSource",
1493
+ "canonicalReference": "!BufferSource:type"
1494
+ },
1495
+ {
1496
+ "kind": "Content",
1497
+ "text": " | string) => "
1498
+ },
1499
+ {
1500
+ "kind": "Reference",
1501
+ "text": "Promise",
1502
+ "canonicalReference": "!Promise:interface"
1503
+ },
1504
+ {
1505
+ "kind": "Content",
1506
+ "text": "<"
1507
+ },
1508
+ {
1509
+ "kind": "Reference",
1510
+ "text": "ArrayBuffer",
1511
+ "canonicalReference": "!ArrayBuffer:interface"
1512
+ },
1513
+ {
1514
+ "kind": "Content",
1515
+ "text": ">"
1516
+ },
1517
+ {
1518
+ "kind": "Content",
1519
+ "text": ";"
1520
+ }
1521
+ ],
1522
+ "isReadonly": false,
1523
+ "isOptional": false,
1524
+ "releaseTag": "Public",
1525
+ "name": "sign",
1526
+ "propertyTypeTokenRange": {
1527
+ "startIndex": 1,
1528
+ "endIndex": 8
1529
+ }
1530
+ }
1531
+ ],
1532
+ "extendsTokenRanges": []
1533
+ },
1534
+ {
1535
+ "kind": "Variable",
1536
+ "canonicalReference": "@kagal/taistamp!TAI_LEAP_SECONDS_MAX:var",
1537
+ "docComment": "/**\n * Upper bound for `leapSeconds` in the taistamp signed payload. The framing encodes the value as a 4-byte big-endian unsigned integer, so any input outside `[0, 2^32-1]` cannot be represented. Verifiers MUST treat an out-of-range `TAI-Leap-Seconds` response header as unsigned, per spec §5.3.\n */\n",
1538
+ "excerptTokens": [
1539
+ {
1540
+ "kind": "Content",
1541
+ "text": "TAI_LEAP_SECONDS_MAX = "
1542
+ },
1543
+ {
1544
+ "kind": "Content",
1545
+ "text": "4294967295"
1546
+ }
1547
+ ],
1548
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1549
+ "initializerTokenRange": {
1550
+ "startIndex": 1,
1551
+ "endIndex": 2
1552
+ },
1553
+ "isReadonly": true,
1554
+ "releaseTag": "Public",
1555
+ "name": "TAI_LEAP_SECONDS_MAX",
1556
+ "variableTypeTokenRange": {
1557
+ "startIndex": 0,
1558
+ "endIndex": 0
1559
+ }
1560
+ },
1561
+ {
1562
+ "kind": "Variable",
1563
+ "canonicalReference": "@kagal/taistamp!TAI_LEAP_SECONDS:var",
1564
+ "docComment": "/**\n * Current TAI − UTC offset in whole seconds, used by `fromUTC()` and emitted in the `TAI-Leap-Seconds` response header. The value 37 has been in force since 2017-01-01; update on the next IERS leap-second announcement.\n *\n * @remarks\n *\n * Stays a single `LeapSeconds` until a leap-seconds table is added so the offset can be computed for any TAI second; this constant becomes redundant then.\n */\n",
1565
+ "excerptTokens": [
1566
+ {
1567
+ "kind": "Content",
1568
+ "text": "TAI_LEAP_SECONDS: "
1569
+ },
1570
+ {
1571
+ "kind": "Reference",
1572
+ "text": "LeapSeconds",
1573
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
1574
+ }
1575
+ ],
1576
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1577
+ "isReadonly": true,
1578
+ "releaseTag": "Public",
1579
+ "name": "TAI_LEAP_SECONDS",
1580
+ "variableTypeTokenRange": {
1581
+ "startIndex": 1,
1582
+ "endIndex": 2
1583
+ }
1584
+ },
1585
+ {
1586
+ "kind": "Function",
1587
+ "canonicalReference": "@kagal/taistamp!tai64nLabelFromUTC:function(1)",
1588
+ "docComment": "/**\n * The 25-byte TAI64N label for a UTC timestamp in milliseconds — shorthand for `tai64nLabel(fromUTC(utc))`.\n *\n * Labels are fixed-width hex, so they order lexicographically: a verifier can bounds-check a received label between the labels of `Date.now() - skew` and `Date.now() + skew` without decoding it.\n */\n",
1589
+ "excerptTokens": [
1590
+ {
1591
+ "kind": "Content",
1592
+ "text": "tai64nLabelFromUTC: (utc: "
1593
+ },
1594
+ {
1595
+ "kind": "Content",
1596
+ "text": "number"
1597
+ },
1598
+ {
1599
+ "kind": "Content",
1600
+ "text": ") => "
1601
+ },
1602
+ {
1603
+ "kind": "Content",
1604
+ "text": "string"
1605
+ }
1606
+ ],
1607
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1608
+ "returnTypeTokenRange": {
1609
+ "startIndex": 3,
1610
+ "endIndex": 4
1611
+ },
1612
+ "releaseTag": "Public",
1613
+ "overloadIndex": 1,
1614
+ "parameters": [
1615
+ {
1616
+ "parameterName": "utc",
1617
+ "parameterTypeTokenRange": {
1618
+ "startIndex": 1,
1619
+ "endIndex": 2
1620
+ },
1621
+ "isOptional": false
1622
+ }
1623
+ ],
1624
+ "name": "tai64nLabelFromUTC"
1625
+ },
1626
+ {
1627
+ "kind": "Function",
1628
+ "canonicalReference": "@kagal/taistamp!tai64nLabelToUTC:function(1)",
1629
+ "docComment": "/**\n * Recover a UTC timestamp in milliseconds (the `Date.now()` shape) from a TAI64N label — the inverse of {@link tai64nLabelFromUTC}. A label minted from a millisecond value round-trips back to it exactly; a `Date` is one `new Date(ms)` away.\n *\n * Returns `undefined` for any value that is not `@` followed by 24 hex digits (either case) — the verify-side \"malformed is absent\" collapse shared with `asSignature` and `asNonce`, so it drops straight into a gate pipeline.\n *\n * `leapSeconds` is the TAI − UTC offset removed when mapping TAI back to UTC; it defaults to the current {@link TAI_LEAP_SECONDS}, mirroring {@link fromUTC}. Pass a response's `extractLeapSeconds(headers)` to honour a server that declared a different count — an absent or malformed header yields `undefined` there and falls through to the default, while a genuine `0` is honoured.\n */\n",
1630
+ "excerptTokens": [
1631
+ {
1632
+ "kind": "Content",
1633
+ "text": "tai64nLabelToUTC: (label: "
1634
+ },
1635
+ {
1636
+ "kind": "Content",
1637
+ "text": "string"
1638
+ },
1639
+ {
1640
+ "kind": "Content",
1641
+ "text": ", leapSeconds?: "
1642
+ },
1643
+ {
1644
+ "kind": "Reference",
1645
+ "text": "LeapSeconds",
1646
+ "canonicalReference": "@kagal/taistamp!LeapSeconds:type"
1647
+ },
1648
+ {
1649
+ "kind": "Content",
1650
+ "text": ") => "
1651
+ },
1652
+ {
1653
+ "kind": "Content",
1654
+ "text": "number | undefined"
1655
+ }
1656
+ ],
1657
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1658
+ "returnTypeTokenRange": {
1659
+ "startIndex": 5,
1660
+ "endIndex": 6
1661
+ },
1662
+ "releaseTag": "Public",
1663
+ "overloadIndex": 1,
1664
+ "parameters": [
1665
+ {
1666
+ "parameterName": "label",
1667
+ "parameterTypeTokenRange": {
1668
+ "startIndex": 1,
1669
+ "endIndex": 2
1670
+ },
1671
+ "isOptional": false
1672
+ },
1673
+ {
1674
+ "parameterName": "leapSeconds",
1675
+ "parameterTypeTokenRange": {
1676
+ "startIndex": 3,
1677
+ "endIndex": 4
1678
+ },
1679
+ "isOptional": true
1680
+ }
1681
+ ],
1682
+ "name": "tai64nLabelToUTC"
1683
+ },
1684
+ {
1685
+ "kind": "Variable",
1686
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_CONTENT_LENGTH:var",
1687
+ "docComment": "/**\n * The taistamp response `Content-Length`.\n */\n",
1688
+ "excerptTokens": [
1689
+ {
1690
+ "kind": "Content",
1691
+ "text": "TAISTAMP_CONTENT_LENGTH: "
1692
+ },
1693
+ {
1694
+ "kind": "Content",
1695
+ "text": "number"
1696
+ }
1697
+ ],
1698
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1699
+ "isReadonly": true,
1700
+ "releaseTag": "Public",
1701
+ "name": "TAISTAMP_CONTENT_LENGTH",
1702
+ "variableTypeTokenRange": {
1703
+ "startIndex": 1,
1704
+ "endIndex": 2
1705
+ }
1706
+ },
1707
+ {
1708
+ "kind": "Variable",
1709
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_CONTENT_TYPE:var",
1710
+ "docComment": "/**\n * The taistamp response `Content-Type`.\n */\n",
1711
+ "excerptTokens": [
1712
+ {
1713
+ "kind": "Content",
1714
+ "text": "TAISTAMP_CONTENT_TYPE = "
1715
+ },
1716
+ {
1717
+ "kind": "Content",
1718
+ "text": "\"application/tai64n\""
1719
+ }
1720
+ ],
1721
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1722
+ "initializerTokenRange": {
1723
+ "startIndex": 1,
1724
+ "endIndex": 2
1725
+ },
1726
+ "isReadonly": true,
1727
+ "releaseTag": "Public",
1728
+ "name": "TAISTAMP_CONTENT_TYPE",
1729
+ "variableTypeTokenRange": {
1730
+ "startIndex": 0,
1731
+ "endIndex": 0
1732
+ }
1733
+ },
1734
+ {
1735
+ "kind": "Variable",
1736
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_HEADER_KEY_SELECTOR:var",
1737
+ "docComment": "",
1738
+ "excerptTokens": [
1739
+ {
1740
+ "kind": "Content",
1741
+ "text": "TAISTAMP_HEADER_KEY_SELECTOR = "
1742
+ },
1743
+ {
1744
+ "kind": "Content",
1745
+ "text": "\"TAI-Key-Selector\""
1746
+ }
1747
+ ],
1748
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1749
+ "initializerTokenRange": {
1750
+ "startIndex": 1,
1751
+ "endIndex": 2
1752
+ },
1753
+ "isReadonly": true,
1754
+ "releaseTag": "Public",
1755
+ "name": "TAISTAMP_HEADER_KEY_SELECTOR",
1756
+ "variableTypeTokenRange": {
1757
+ "startIndex": 0,
1758
+ "endIndex": 0
1759
+ }
1760
+ },
1761
+ {
1762
+ "kind": "Variable",
1763
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_HEADER_LEAP_SECONDS:var",
1764
+ "docComment": "",
1765
+ "excerptTokens": [
1766
+ {
1767
+ "kind": "Content",
1768
+ "text": "TAISTAMP_HEADER_LEAP_SECONDS = "
1769
+ },
1770
+ {
1771
+ "kind": "Content",
1772
+ "text": "\"TAI-Leap-Seconds\""
1773
+ }
1774
+ ],
1775
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1776
+ "initializerTokenRange": {
1777
+ "startIndex": 1,
1778
+ "endIndex": 2
1779
+ },
1780
+ "isReadonly": true,
1781
+ "releaseTag": "Public",
1782
+ "name": "TAISTAMP_HEADER_LEAP_SECONDS",
1783
+ "variableTypeTokenRange": {
1784
+ "startIndex": 0,
1785
+ "endIndex": 0
1786
+ }
1787
+ },
1788
+ {
1789
+ "kind": "Variable",
1790
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_HEADER_NONCE:var",
1791
+ "docComment": "",
1792
+ "excerptTokens": [
1793
+ {
1794
+ "kind": "Content",
1795
+ "text": "TAISTAMP_HEADER_NONCE = "
1796
+ },
1797
+ {
1798
+ "kind": "Content",
1799
+ "text": "\"TAI-Nonce\""
1800
+ }
1801
+ ],
1802
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1803
+ "initializerTokenRange": {
1804
+ "startIndex": 1,
1805
+ "endIndex": 2
1806
+ },
1807
+ "isReadonly": true,
1808
+ "releaseTag": "Public",
1809
+ "name": "TAISTAMP_HEADER_NONCE",
1810
+ "variableTypeTokenRange": {
1811
+ "startIndex": 0,
1812
+ "endIndex": 0
1813
+ }
1814
+ },
1815
+ {
1816
+ "kind": "Variable",
1817
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_HEADER_SIGNATURE:var",
1818
+ "docComment": "",
1819
+ "excerptTokens": [
1820
+ {
1821
+ "kind": "Content",
1822
+ "text": "TAISTAMP_HEADER_SIGNATURE = "
1823
+ },
1824
+ {
1825
+ "kind": "Content",
1826
+ "text": "\"TAI-Signature\""
1827
+ }
1828
+ ],
1829
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1830
+ "initializerTokenRange": {
1831
+ "startIndex": 1,
1832
+ "endIndex": 2
1833
+ },
1834
+ "isReadonly": true,
1835
+ "releaseTag": "Public",
1836
+ "name": "TAISTAMP_HEADER_SIGNATURE",
1837
+ "variableTypeTokenRange": {
1838
+ "startIndex": 0,
1839
+ "endIndex": 0
1840
+ }
1841
+ },
1842
+ {
1843
+ "kind": "Variable",
1844
+ "canonicalReference": "@kagal/taistamp!TAISTAMP_PATH:var",
1845
+ "docComment": "",
1846
+ "excerptTokens": [
1847
+ {
1848
+ "kind": "Content",
1849
+ "text": "TAISTAMP_PATH = "
1850
+ },
1851
+ {
1852
+ "kind": "Content",
1853
+ "text": "\"/.well-known/taistamp\""
1854
+ }
1855
+ ],
1856
+ "fileUrlPath": "dist/_chunks/time.d.mts",
1857
+ "initializerTokenRange": {
1858
+ "startIndex": 1,
1859
+ "endIndex": 2
1860
+ },
1861
+ "isReadonly": true,
1862
+ "releaseTag": "Public",
1863
+ "name": "TAISTAMP_PATH",
1864
+ "variableTypeTokenRange": {
1865
+ "startIndex": 0,
1866
+ "endIndex": 0
1867
+ }
1868
+ },
1869
+ {
1870
+ "kind": "Interface",
1871
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig:interface",
1872
+ "docComment": "/**\n * Configuration for {@link newTaistampHandler}.\n *\n * @remarks\n *\n * `signer` and `selector` are co-required: pass both to enable authenticated responses, or neither for an unsigned handler. Passing only one is rejected at construction time — without the selector verifiers cannot find the key in DNS, and a selector without a signer is a misconfiguration.\n */\n",
1873
+ "excerptTokens": [
1874
+ {
1875
+ "kind": "Content",
1876
+ "text": "interface TaistampHandlerConfig "
1877
+ }
1878
+ ],
1879
+ "fileUrlPath": "dist/index.d.mts",
1880
+ "releaseTag": "Public",
1881
+ "name": "TaistampHandlerConfig",
1882
+ "preserveMemberOrder": false,
1883
+ "members": [
1884
+ {
1885
+ "kind": "PropertySignature",
1886
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#cors:member",
1887
+ "docComment": "/**\n * CORS origin policy. Defaults to `'*'`; pass `false` to disable CORS entirely, or a specific origin (e.g. `'https://example.com'`) to scope the policy.\n *\n * Every response (`GET` / `HEAD` / `OPTIONS` / `405`) gains `Access-Control-Allow-Origin`; pre-flight `OPTIONS` also carries `-Allow-Methods`, `-Allow-Headers`, `-Expose-Headers`, and `-Max-Age` (default 600s, see {@link corsMaxAge}) per spec §5.2; success `GET` / `HEAD` carry `-Expose-Headers` so browser JS can read the `TAI-*` response headers. A non-`'*'` value adds `Vary: Origin` so caches can keep per-origin variants distinct.\n *\n * Disabling CORS does not affect method discovery: `OPTIONS` is still answered with `200` and `Allow: GET, HEAD, OPTIONS` per RFC 9110 §9.3.7.\n */\n",
1888
+ "excerptTokens": [
1889
+ {
1890
+ "kind": "Content",
1891
+ "text": "cors?: "
1892
+ },
1893
+ {
1894
+ "kind": "Content",
1895
+ "text": "false | string"
1896
+ },
1897
+ {
1898
+ "kind": "Content",
1899
+ "text": ";"
1900
+ }
1901
+ ],
1902
+ "isReadonly": false,
1903
+ "isOptional": true,
1904
+ "releaseTag": "Public",
1905
+ "name": "cors",
1906
+ "propertyTypeTokenRange": {
1907
+ "startIndex": 1,
1908
+ "endIndex": 2
1909
+ }
1910
+ },
1911
+ {
1912
+ "kind": "PropertySignature",
1913
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#corsMaxAge:member",
1914
+ "docComment": "/**\n * `Access-Control-Max-Age` for pre-flight `OPTIONS` responses, in seconds. Defaults to 600 (10 minutes, the spec §5.2 floor); a value below 600 clamps up to it so the pre-flight stays spec-compliant. Ignored when `cors` is `false`. Must be a non-negative integer.\n */\n",
1915
+ "excerptTokens": [
1916
+ {
1917
+ "kind": "Content",
1918
+ "text": "corsMaxAge?: "
1919
+ },
1920
+ {
1921
+ "kind": "Content",
1922
+ "text": "number"
1923
+ },
1924
+ {
1925
+ "kind": "Content",
1926
+ "text": ";"
1927
+ }
1928
+ ],
1929
+ "isReadonly": false,
1930
+ "isOptional": true,
1931
+ "releaseTag": "Public",
1932
+ "name": "corsMaxAge",
1933
+ "propertyTypeTokenRange": {
1934
+ "startIndex": 1,
1935
+ "endIndex": 2
1936
+ }
1937
+ },
1938
+ {
1939
+ "kind": "PropertySignature",
1940
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#selector:member",
1941
+ "docComment": "/**\n * Key selector advertised in the `TAI-Key-Selector` response header and bound into the signed payload. Verifiers look up the public key at `<selector>._taistamp.<host>` in DNS.\n *\n * Must match `[A-Za-z]([A-Za-z0-9_-]{0,61}[A-Za-z0-9])?` — a single DNS-safe label that starts with a letter, ends with a letter or digit, and is also a valid Structured Field token; rotate by changing the selector and publishing a new TXT record.\n */\n",
1942
+ "excerptTokens": [
1943
+ {
1944
+ "kind": "Content",
1945
+ "text": "selector?: "
1946
+ },
1947
+ {
1948
+ "kind": "Content",
1949
+ "text": "string"
1950
+ },
1951
+ {
1952
+ "kind": "Content",
1953
+ "text": ";"
1954
+ }
1955
+ ],
1956
+ "isReadonly": false,
1957
+ "isOptional": true,
1958
+ "releaseTag": "Public",
1959
+ "name": "selector",
1960
+ "propertyTypeTokenRange": {
1961
+ "startIndex": 1,
1962
+ "endIndex": 2
1963
+ }
1964
+ },
1965
+ {
1966
+ "kind": "PropertySignature",
1967
+ "canonicalReference": "@kagal/taistamp!TaistampHandlerConfig#signer:member",
1968
+ "docComment": "/**\n * {@link Signer} that produces `TAI-Signature` over the framed payload from {@link composeSignaturePayload}. Without a signer the nonce is still echoed but the response is unsigned.\n */\n",
1969
+ "excerptTokens": [
1970
+ {
1971
+ "kind": "Content",
1972
+ "text": "signer?: "
1973
+ },
1974
+ {
1975
+ "kind": "Reference",
1976
+ "text": "Signer$1",
1977
+ "canonicalReference": "@kagal/taistamp!Signer:interface"
1978
+ },
1979
+ {
1980
+ "kind": "Content",
1981
+ "text": ";"
1982
+ }
1983
+ ],
1984
+ "isReadonly": false,
1985
+ "isOptional": true,
1986
+ "releaseTag": "Public",
1987
+ "name": "signer",
1988
+ "propertyTypeTokenRange": {
1989
+ "startIndex": 1,
1990
+ "endIndex": 2
1991
+ }
1992
+ }
1993
+ ],
1994
+ "extendsTokenRanges": []
1995
+ },
1996
+ {
1997
+ "kind": "Interface",
1998
+ "canonicalReference": "@kagal/taistamp!Verifier:interface",
1999
+ "docComment": "/**\n * Pluggable abstraction over a public verifying key. Implementations check a candidate signature against a message and report the result as a boolean; the algorithm and key store are implementation details.\n */\n",
2000
+ "excerptTokens": [
2001
+ {
2002
+ "kind": "Content",
2003
+ "text": "interface Verifier "
2004
+ }
2005
+ ],
2006
+ "fileUrlPath": "../@kagal-ed25519-secret/dist/index.d.mts",
2007
+ "releaseTag": "Public",
2008
+ "name": "Verifier",
2009
+ "preserveMemberOrder": false,
2010
+ "members": [
2011
+ {
2012
+ "kind": "PropertySignature",
2013
+ "canonicalReference": "@kagal/taistamp!Verifier#verify:member",
2014
+ "docComment": "/**\n * Check `signature` against `message`.\n *\n * @param signature - bytes claimed as a signature over `message` (algorithm-defined length and encoding)\n *\n * @param message - message the signature is claimed to cover, either bytes or a string (encoded as UTF-8); the caller is responsible for any framing or domain separation\n *\n * @returns `true` when the signature verifies under the underlying key, `false` otherwise\n */\n",
2015
+ "excerptTokens": [
2016
+ {
2017
+ "kind": "Content",
2018
+ "text": "verify: "
2019
+ },
2020
+ {
2021
+ "kind": "Content",
2022
+ "text": "(signature: "
2023
+ },
2024
+ {
2025
+ "kind": "Reference",
2026
+ "text": "BufferSource",
2027
+ "canonicalReference": "!BufferSource:type"
2028
+ },
2029
+ {
2030
+ "kind": "Content",
2031
+ "text": ", message: "
2032
+ },
2033
+ {
2034
+ "kind": "Reference",
2035
+ "text": "BufferSource",
2036
+ "canonicalReference": "!BufferSource:type"
2037
+ },
2038
+ {
2039
+ "kind": "Content",
2040
+ "text": " | string) => "
2041
+ },
2042
+ {
2043
+ "kind": "Reference",
2044
+ "text": "Promise",
2045
+ "canonicalReference": "!Promise:interface"
2046
+ },
2047
+ {
2048
+ "kind": "Content",
2049
+ "text": "<boolean>"
2050
+ },
2051
+ {
2052
+ "kind": "Content",
2053
+ "text": ";"
2054
+ }
2055
+ ],
2056
+ "isReadonly": false,
2057
+ "isOptional": false,
2058
+ "releaseTag": "Public",
2059
+ "name": "verify",
2060
+ "propertyTypeTokenRange": {
2061
+ "startIndex": 1,
2062
+ "endIndex": 8
2063
+ }
2064
+ }
2065
+ ],
2066
+ "extendsTokenRanges": []
2067
+ },
2068
+ {
2069
+ "kind": "Variable",
2070
+ "canonicalReference": "@kagal/taistamp!VERSION:var",
2071
+ "docComment": "/**\n * Package version from package.json.\n */\n",
2072
+ "excerptTokens": [
2073
+ {
2074
+ "kind": "Content",
2075
+ "text": "VERSION: "
2076
+ },
2077
+ {
2078
+ "kind": "Content",
2079
+ "text": "string"
2080
+ }
2081
+ ],
2082
+ "fileUrlPath": "dist/index.d.mts",
2083
+ "isReadonly": true,
2084
+ "releaseTag": "Public",
2085
+ "name": "VERSION",
2086
+ "variableTypeTokenRange": {
2087
+ "startIndex": 1,
2088
+ "endIndex": 2
2089
+ }
2090
+ }
2091
+ ]
2092
+ }
2093
+ ]
2094
+ }