@open-charging-cloud/chargy-core 0.14.1 → 0.14.3

package/CHANGELOG.md

@@ -7,6 +7,26 @@ While the version number is below 1.0.0, breaking changes are released in minor
 versions and are always listed first below.
 
 
+## [0.14.3] - 2026-09-05
+
+### Added
+
+- **An https transport can state the HTTP headers to send with it.**
+  `TransportHTTPS.customHeaders` names them - an API key the operator's endpoint
+  expects, a tenant selector - and a value is either the literal string to send
+  or an object naming a `valueProvider` that computes it per request, because a
+  one-time password would be stale the moment it was written into a document.
+  Version 1.0 defines that shape, not the providers: what `"TOTP"` means needs
+  an external profile, the same way the TOTP configuration does, and ChargyCore
+  computes no values.
+
+  Like `refresh`, the headers belong to `https` alone and are validated only
+  there; on the other two transports the property is unknown like any other.
+  `isCustomHeaders()`, `isCustomHeaderValue()` and
+  `isCustomHeaderValueProvider()` are exported for point-of-use filtering. What
+  HTTP itself requires of a name and a value is the sending client's business:
+  a document says what it wants sent, it does not get to write the request.
+
 ## [0.14.0] - 2026-08-30
 
 ### Added

package/README.md

@@ -140,28 +140,6 @@ Keeping these paths separate has several advantages:
 When adding runtime-sensitive dependencies, avoid branching on runtime inside shared source code if that would make bundlers see both implementations. Prefer a small adapter under `src/` and let the build or conditional exports select the runtime-specific implementation.
 
 
-### PDF.js Version Pin
-
-> **`pdfjs-dist` is pinned to an exact version, currently `6.2.108`. Always run the PDF/A-3 test when raising it.**
-
-It is the only dependency in `package.json` without a `^`, because PDF.js has shipped a silently breaking attachment API change within a minor release. Going from `6.0.227` to `6.2.108` changed `getDocument().getAttachments()` in two ways:
-
-1. It resolves to a **`Map`** instead of a plain object. Reading the result with `Object.values()` yields an empty array for a `Map`, so every attachment is dropped.
-2. Entries no longer carry the file bytes eagerly. `content` is only set when it happens to be loaded already, otherwise the payload has to be fetched via the new `getAttachmentContent(id)`.
-
-Both are handled in `src/chargy.ts`, which iterates the `Map` and falls back to `getAttachmentContent()` whenever an entry has no inline `content`.
-
-What makes this class of change dangerous is that it fails silently: nothing throws, so the `try`/`catch` around the call never fires. The embedded record simply disappears and verification then reports `InvalidSessionFormat` with *"No charge transparency records found!"*. `npm run typecheck` and `npm run lint` both stay green; only `tests/SAFE.tests.ts` ("SAFE Testdata 02 with XML namespace via PDF/A-3") detects it, by extracting a real embedded XML file from `tests/fixtures/SAFE/SAFE-Testdata-02_withXMLNamespace.pdf`.
-
-So before changing the pin, always run:
-
-```bash
-npm run test:node -- tests/SAFE.tests.ts
-```
-
-Staying on an old version is not a safe default either — `6.0.227` was affected by [GHSA-hq66-cqwq-w95j](https://github.com/advisories/GHSA-hq66-cqwq-w95j) (high severity, arbitrary JavaScript execution when opening a malicious PDF), which is fixed in `6.2.108`.
-
-
 ## Development
 
 ```bash
@@ -207,7 +185,7 @@ npx playwright install chromium
 ## Publishing
 
 ```bash
-npm version 0.14.1 --no-git-tag-version
+npm version 0.14.3 --no-git-tag-version
 npm run verify
 npm pack --dry-run
 npm pack

package/dist/browser/index.js

@@ -12059,6 +12059,9 @@ __export(IChargeTransparencyLiveLink_exports, {
   ChargeTransparencyLiveLinkContext: () => ChargeTransparencyLiveLinkContext,
   IsAChargeTransparencyLiveLink: () => IsAChargeTransparencyLiveLink,
   isConnector: () => isConnector,
+  isCustomHeaderValue: () => isCustomHeaderValue,
+  isCustomHeaderValueProvider: () => isCustomHeaderValueProvider,
+  isCustomHeaders: () => isCustomHeaders,
   isTransport: () => isTransport
 });
 var ChargeTransparencyLiveLinkContext = "https://open.charging.cloud/contexts/chargeTransparency/live/link/1.0";
@@ -12072,6 +12075,15 @@ function isTransportURL(data) {
     return data.trim() !== "";
   return isObject(data) && typeof data["url"] === "string" && (data["priority"] === void 0 || typeof data["priority"] === "number") && (data["weight"] === void 0 || typeof data["weight"] === "number");
 }
+function isCustomHeaderValueProvider(data) {
+  return isMandatoryJSONObject(data) && typeof data["valueProvider"] === "string" && (data["parameters"] === void 0 || isMandatoryJSONObject(data["parameters"]));
+}
+function isCustomHeaderValue(data) {
+  return typeof data === "string" || isCustomHeaderValueProvider(data);
+}
+function isCustomHeaders(data) {
+  return isMandatoryJSONObject(data) && Object.values(data).every(isCustomHeaderValue);
+}
 function isTransport(data) {
   if (!isObject(data))
     return false;
@@ -12082,6 +12094,9 @@ function isTransport(data) {
   if (type === "https" && data["refresh"] !== void 0 && typeof data["refresh"] !== "number") {
     return false;
   }
+  if (type === "https" && data["customHeaders"] !== void 0 && !isCustomHeaders(data["customHeaders"])) {
+    return false;
+  }
   return (data["url"] === void 0 || typeof data["url"] === "string") && (data["urls"] === void 0 || Array.isArray(data["urls"]) && data["urls"].every(isTransportURL)) && (data["totp"] === void 0 || isTOTPConfig(data["totp"]));
 }
 function IsAChargeTransparencyLiveLink(data) {
@@ -14119,6 +14134,6 @@ buffer/index.js:
    *)
 */
 
-export { ACrypt, Alfen, AlfenCrypt01, BSMCrypt01, CanonicalJSONError, ChargeIT, ChargePoint, ChargePointCrypt01, IChargeTransparencyLiveLink_exports as ChargeTransparencyLiveLink, ChargeTransparencyLiveLinkContext, IChargeTransparencyRecord_exports as ChargeTransparencyRecord, Chargy, chargyInterfaces_exports as ChargyInterfaces, Clone, CloneCTR, ConcatenateBuffers, CreateDiv, CreateDiv2, CreateError, CreateWarning, CryptoAlgorithms, CryptoHashAlgorithms, DayOfWeek, DisplayPrefixes, EDL40, EDL40Crypt01, EDL40ValidationError, EDL40_OBIS, EDL40_SESSION_CONTEXT, EDL40_SIGNATURE_CONTEXT, EMHCrypt01, ErrorLevel, GDFCrypt01, IECCurves, IEncoding, InformationRelevance, InformationRelevanceToString, IsAChargeTransparencyLiveLink, IsAChargeTransparencyRecord, IsAPublicKey, IsAPublicKeyLookup, IsAPublicKeySignature, IsAPublicKeyXY, IsASessionCryptoResult, IsAURL, IsNullOrEmpty, IsValidURL, JSONSignatureVerificationStatus, MENNEKES_EDL40_OBIS, MENNEKES_EDL40_XMLNS, Mennekes, MennekesCrypt01, OBIS2Hex, OBIS2MeasurementName, OBIS_RegExpr, OCMF, OCMFBonnTariffParseError, OCMFTransactionTypes, OCMF_SIGNATURE_ALGORITHMS, OCMFv1_x, OCPI, OIDInfo, PCDF, PCDFCrypt01, PCDFParseError, PCDFValidationError, PCDF_FIELD_ORDER, PCDF_PREFIX, PTB, ParseJSON_LD, PublicKeyFormats, IPublicKeyInfo_exports as PublicKeyInfo, SAFEXML, SessionVerificationResult, SetHex, SetInt8, SetText, SetText_withLength, SetTimestamp, SetTimestamp32, SetUInt32, SetUInt32_withCode, SetUInt64, SetUInt64D, SignMessage, SignatureFormats, IURL_exports as SimpleURL, TimeStatusTypes, URLContext, UTC2human, VerificationResult, VerifyJSONMessageSignatures, WarningLevel, WhenNullOrEmpty, XMLContainer, asJSONArray, asJSONObject, asNumber, asString, base64ToBytes, buf2hex, buildEDL40Signature, buildIsaSignature, buildMennekesSignatureData, bytesToBase64, bytesToHex, canParseEDL40, canonicalJSONBytes, canonicalJSONStringify, cleanHex, closeFullscreen, collectDocumentPublicKeys, createCompatibleCurve, createHexString, createLegacyP192Curve, dateToMennekesLocalEpochSeconds, decodeSmlMessages, extractMennekesChargingProcesses, findEntryByObis, findGetListRes, firstKey, firstValue, generateSignatureKeyPair, getArrayElement, getArrayLikeElement, getDirectChildByLocalName, getDirectChildrenByLocalName, getElementsByLocalName, getFirstArrayElement, getInt16Bytes, getInt32Bytes, getInt64Bytes, getInt8Bytes, getLastArrayElement, getOCMFSignatureDisplay, getSignatureSuite, getTrimmedTextContent, hashFile, hex2bin, hex32, hexToArrayBuffer, hexToBytes, intFromBytes, isEncodedValue, isGeoLocation, isI18NString, isICryptoResult, isIFileInfo, isISessionCryptoResult1, isISessionCryptoResult2, isJSONLDObject, isMandatoryArrayOfStrings, isMandatoryBoolean, isMandatoryDecimal, isMandatoryJSONArray, isMandatoryJSONObject, isMandatoryNumber, isMandatoryString, isMandatoryURL, isOIDInfo, isObject, isOptionalArrayOfStrings, isOptionalDecimal, isOptionalJSONArray, isOptionalJSONArrayError, isOptionalJSONArrayOk, isOptionalJSONObject, isOptionalNumber, isOptionalString, isOptionalStringArray, isOptionalStringOrOIDInfo, isOptionalURL, isPCDFText, isPublicKeySubject, isString, isStringArray, isStringOrOIDInfo, isStringOrStringArray, isaListNameContext, jsonPrettyPrinter, measurementName2human, meterTimeZone, normalizePCDFPublicKeyHex, normalizeXMLText, ocmfBonnTariffToChargingTariff, openFullscreen, pad, parseAndVerifyJSONSignatures, parseDescription, parseEDL40, parseHexString, parseMennekesXMLDocument, parseNumber, parseOBIS, parseOCMFBonnTariffText, parsePCDFDocument, parsePCDFPublicKey, parsePCDFSignature, parseSmlTime, parseUTC, readQRCodeTextFromImage, readQRCodeTextFromImageData, readTLV, secp224k1, setUILocale, sha256, sha256____, sha384, sha384____, sha512, sha512____, signJSONMessage, signMessage, stripPCDFControlCharacters, stripTransport, time2human, timeZoneOffsetMinutes, toArrayBuffer, toSessionVerificationResults, toUint8Array, transformEDL40Status, tryParseOCMFBonnTariffText, unquotePCDFText, validatePCDFFields, verifyDocumentSignatures, verifyEDL40Document, verifyJSONMessageSignatureResults, verifyJSONMessageSignatures, verifyJSONSignature, verifyJSONSignatureResult, verifyPCDFDocument };
+export { ACrypt, Alfen, AlfenCrypt01, BSMCrypt01, CanonicalJSONError, ChargeIT, ChargePoint, ChargePointCrypt01, IChargeTransparencyLiveLink_exports as ChargeTransparencyLiveLink, ChargeTransparencyLiveLinkContext, IChargeTransparencyRecord_exports as ChargeTransparencyRecord, Chargy, chargyInterfaces_exports as ChargyInterfaces, Clone, CloneCTR, ConcatenateBuffers, CreateDiv, CreateDiv2, CreateError, CreateWarning, CryptoAlgorithms, CryptoHashAlgorithms, DayOfWeek, DisplayPrefixes, EDL40, EDL40Crypt01, EDL40ValidationError, EDL40_OBIS, EDL40_SESSION_CONTEXT, EDL40_SIGNATURE_CONTEXT, EMHCrypt01, ErrorLevel, GDFCrypt01, IECCurves, IEncoding, InformationRelevance, InformationRelevanceToString, IsAChargeTransparencyLiveLink, IsAChargeTransparencyRecord, IsAPublicKey, IsAPublicKeyLookup, IsAPublicKeySignature, IsAPublicKeyXY, IsASessionCryptoResult, IsAURL, IsNullOrEmpty, IsValidURL, JSONSignatureVerificationStatus, MENNEKES_EDL40_OBIS, MENNEKES_EDL40_XMLNS, Mennekes, MennekesCrypt01, OBIS2Hex, OBIS2MeasurementName, OBIS_RegExpr, OCMF, OCMFBonnTariffParseError, OCMFTransactionTypes, OCMF_SIGNATURE_ALGORITHMS, OCMFv1_x, OCPI, OIDInfo, PCDF, PCDFCrypt01, PCDFParseError, PCDFValidationError, PCDF_FIELD_ORDER, PCDF_PREFIX, PTB, ParseJSON_LD, PublicKeyFormats, IPublicKeyInfo_exports as PublicKeyInfo, SAFEXML, SessionVerificationResult, SetHex, SetInt8, SetText, SetText_withLength, SetTimestamp, SetTimestamp32, SetUInt32, SetUInt32_withCode, SetUInt64, SetUInt64D, SignMessage, SignatureFormats, IURL_exports as SimpleURL, TimeStatusTypes, URLContext, UTC2human, VerificationResult, VerifyJSONMessageSignatures, WarningLevel, WhenNullOrEmpty, XMLContainer, asJSONArray, asJSONObject, asNumber, asString, base64ToBytes, buf2hex, buildEDL40Signature, buildIsaSignature, buildMennekesSignatureData, bytesToBase64, bytesToHex, canParseEDL40, canonicalJSONBytes, canonicalJSONStringify, cleanHex, closeFullscreen, collectDocumentPublicKeys, createCompatibleCurve, createHexString, createLegacyP192Curve, dateToMennekesLocalEpochSeconds, decodeSmlMessages, extractMennekesChargingProcesses, findEntryByObis, findGetListRes, firstKey, firstValue, generateSignatureKeyPair, getArrayElement, getArrayLikeElement, getDirectChildByLocalName, getDirectChildrenByLocalName, getElementsByLocalName, getFirstArrayElement, getInt16Bytes, getInt32Bytes, getInt64Bytes, getInt8Bytes, getLastArrayElement, getOCMFSignatureDisplay, getSignatureSuite, getTrimmedTextContent, hashFile, hex2bin, hex32, hexToArrayBuffer, hexToBytes, intFromBytes, isCustomHeaderValue, isCustomHeaderValueProvider, isCustomHeaders, isEncodedValue, isGeoLocation, isI18NString, isICryptoResult, isIFileInfo, isISessionCryptoResult1, isISessionCryptoResult2, isJSONLDObject, isMandatoryArrayOfStrings, isMandatoryBoolean, isMandatoryDecimal, isMandatoryJSONArray, isMandatoryJSONObject, isMandatoryNumber, isMandatoryString, isMandatoryURL, isOIDInfo, isObject, isOptionalArrayOfStrings, isOptionalDecimal, isOptionalJSONArray, isOptionalJSONArrayError, isOptionalJSONArrayOk, isOptionalJSONObject, isOptionalNumber, isOptionalString, isOptionalStringArray, isOptionalStringOrOIDInfo, isOptionalURL, isPCDFText, isPublicKeySubject, isString, isStringArray, isStringOrOIDInfo, isStringOrStringArray, isaListNameContext, jsonPrettyPrinter, measurementName2human, meterTimeZone, normalizePCDFPublicKeyHex, normalizeXMLText, ocmfBonnTariffToChargingTariff, openFullscreen, pad, parseAndVerifyJSONSignatures, parseDescription, parseEDL40, parseHexString, parseMennekesXMLDocument, parseNumber, parseOBIS, parseOCMFBonnTariffText, parsePCDFDocument, parsePCDFPublicKey, parsePCDFSignature, parseSmlTime, parseUTC, readQRCodeTextFromImage, readQRCodeTextFromImageData, readTLV, secp224k1, setUILocale, sha256, sha256____, sha384, sha384____, sha512, sha512____, signJSONMessage, signMessage, stripPCDFControlCharacters, stripTransport, time2human, timeZoneOffsetMinutes, toArrayBuffer, toSessionVerificationResults, toUint8Array, transformEDL40Status, tryParseOCMFBonnTariffText, unquotePCDFText, validatePCDFFields, verifyDocumentSignatures, verifyEDL40Document, verifyJSONMessageSignatureResults, verifyJSONMessageSignatures, verifyJSONSignature, verifyJSONSignatureResult, verifyPCDFDocument };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map