@peac/mappings-ucp 0.15.1 → 0.15.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +56 -6
- package/dist/bundle.d.ts +5 -0
- package/dist/bundle.d.ts.map +1 -1
- package/dist/bundle.js +5 -0
- package/dist/bundle.js.map +1 -1
- package/dist/errors.d.ts +10 -0
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +28 -0
- package/dist/errors.js.map +1 -1
- package/dist/evidence.d.ts +0 -1
- package/dist/evidence.d.ts.map +1 -1
- package/dist/evidence.js +5 -6
- package/dist/evidence.js.map +1 -1
- package/dist/http-signature.d.ts +52 -0
- package/dist/http-signature.d.ts.map +1 -0
- package/dist/http-signature.js +592 -0
- package/dist/http-signature.js.map +1 -0
- package/dist/index.d.ts +35 -18
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +36 -18
- package/dist/index.js.map +1 -1
- package/dist/mapper.d.ts +4 -2
- package/dist/mapper.d.ts.map +1 -1
- package/dist/mapper.js +4 -2
- package/dist/mapper.js.map +1 -1
- package/dist/types.d.ts +108 -2
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js +9 -2
- package/dist/types.js.map +1 -1
- package/dist/util.d.ts +4 -13
- package/dist/util.d.ts.map +1 -1
- package/dist/util.js +4 -85
- package/dist/util.js.map +1 -1
- package/dist/verify.d.ts +17 -2
- package/dist/verify.d.ts.map +1 -1
- package/dist/verify.js +30 -5
- package/dist/verify.js.map +1 -1
- package/package.json +7 -5
package/README.md
CHANGED
|
@@ -10,7 +10,7 @@ pnpm add @peac/mappings-ucp
|
|
|
10
10
|
|
|
11
11
|
## What It Does
|
|
12
12
|
|
|
13
|
-
`@peac/mappings-ucp` maps UCP order data to PEAC receipt claims, verifies UCP webhook signatures
|
|
13
|
+
`@peac/mappings-ucp` maps UCP order data to PEAC receipt claims, verifies UCP request and webhook signatures, and generates structured dispute evidence bundles. The current UCP signing model is RFC 9421 HTTP Message Signatures (`Signature-Input` / `Signature` with an RFC 9530 `Content-Digest` over the raw body bytes), verified by `verifyUcpHttpSignature`. The earlier `Request-Signature` detached JWS (RFC 7797) path remains available for backward compatibility, deprecated, via `verifyUcpWebhookSignature`; the two schemes never silently fall back to each other. Order state is kept distinct from payment state: the `payment_state_source` field marks whether payment status was explicitly provided or derived from order fulfillment, so downstream consumers can distinguish observed payment evidence from inferred status.
|
|
14
14
|
|
|
15
15
|
## How Do I Use It?
|
|
16
16
|
|
|
@@ -18,6 +18,7 @@ pnpm add @peac/mappings-ucp
|
|
|
18
18
|
|
|
19
19
|
```typescript
|
|
20
20
|
import { mapUcpOrderToReceipt } from '@peac/mappings-ucp';
|
|
21
|
+
import { sign } from '@peac/crypto';
|
|
21
22
|
|
|
22
23
|
const claims = mapUcpOrderToReceipt({
|
|
23
24
|
order: ucpOrder,
|
|
@@ -26,15 +27,64 @@ const claims = mapUcpOrderToReceipt({
|
|
|
26
27
|
currency: 'USD',
|
|
27
28
|
});
|
|
28
29
|
|
|
29
|
-
// Sign
|
|
30
|
-
const
|
|
30
|
+
// Sign the mapped claims into a JWS receipt (Ed25519 private key + kid)
|
|
31
|
+
const receiptJws = await sign(claims, privateKey, kid);
|
|
31
32
|
```
|
|
32
33
|
|
|
33
|
-
### Verify a UCP webhook signature
|
|
34
|
+
### Verify a UCP request or webhook signature (RFC 9421)
|
|
35
|
+
|
|
36
|
+
`verifyUcpHttpSignature` is the current signing model. It verifies the RFC 9421
|
|
37
|
+
`Signature-Input` / `Signature` and, when a body is present, an RFC 9530
|
|
38
|
+
`Content-Digest` over the raw request body bytes. The algorithm (ES256 for P-256,
|
|
39
|
+
ES384 for P-384) is resolved from the signing key's curve; UCP does not put `alg`
|
|
40
|
+
in `Signature-Input`. The UCP party profile is resolved by the caller (SSRF-safe,
|
|
41
|
+
host-allowlisted) and passed in; this function performs no network I/O.
|
|
42
|
+
|
|
43
|
+
The verifier parses a signed `UCP-Agent` header and returns its profile as
|
|
44
|
+
`signer_profile_url`. When you supply `expected_profile_url`, it also binds that
|
|
45
|
+
signed profile to the expected signer: the `UCP-Agent` component MUST be signed
|
|
46
|
+
and its profile MUST equal the expected URL, or verification fails. An unsigned
|
|
47
|
+
component is never trusted.
|
|
48
|
+
|
|
49
|
+
```typescript
|
|
50
|
+
import { verifyUcpHttpSignature } from '@peac/mappings-ucp';
|
|
51
|
+
|
|
52
|
+
const result = await verifyUcpHttpSignature({
|
|
53
|
+
signature_input: req.headers['signature-input'],
|
|
54
|
+
signature: req.headers['signature'],
|
|
55
|
+
method: 'POST',
|
|
56
|
+
url: 'https://platform.example.com/webhooks/ucp/orders',
|
|
57
|
+
headers: {
|
|
58
|
+
'content-type': req.headers['content-type'],
|
|
59
|
+
'content-digest': req.headers['content-digest'],
|
|
60
|
+
'idempotency-key': req.headers['idempotency-key'],
|
|
61
|
+
'ucp-agent': req.headers['ucp-agent'],
|
|
62
|
+
},
|
|
63
|
+
body_bytes: rawBody,
|
|
64
|
+
profile: ucpProfile, // the /.well-known/ucp document, resolved by the caller
|
|
65
|
+
expected_profile_url: 'https://business.example.com/.well-known/ucp', // bind the signer
|
|
66
|
+
});
|
|
67
|
+
|
|
68
|
+
if (result.valid) {
|
|
69
|
+
// Signature verified and Content-Digest bound the raw body; proceed with mapping.
|
|
70
|
+
// result.signer_profile_url is the bound UCP-Agent profile.
|
|
71
|
+
}
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
This verifier covers request-shaped UCP signatures; UCP response signatures use
|
|
75
|
+
`@status` and are a separate component model, out of scope here.
|
|
76
|
+
|
|
77
|
+
### Legacy: verify a Request-Signature detached JWS (deprecated)
|
|
78
|
+
|
|
79
|
+
Earlier UCP integrations used a `Request-Signature` detached JWS (RFC 7797). That
|
|
80
|
+
path remains exported as `verifyUcpWebhookSignature` for backward compatibility
|
|
81
|
+
and is deprecated; new integrations should use `verifyUcpHttpSignature`. There is
|
|
82
|
+
no silent fallback between the two schemes: the caller selects one explicitly.
|
|
34
83
|
|
|
35
84
|
```typescript
|
|
36
85
|
import { verifyUcpWebhookSignature } from '@peac/mappings-ucp';
|
|
37
86
|
|
|
87
|
+
// Deprecated: legacy Request-Signature / RFC 7797 path.
|
|
38
88
|
const result = await verifyUcpWebhookSignature({
|
|
39
89
|
signature_header: req.headers['request-signature'],
|
|
40
90
|
body_bytes: rawBody,
|
|
@@ -85,14 +135,14 @@ const extracted = adapter.extract(webhookPayload);
|
|
|
85
135
|
|
|
86
136
|
- `@peac/kernel` (Layer 0): Evidence carrier types and constants
|
|
87
137
|
- `@peac/schema` (Layer 1): Receipt schemas and carrier validation
|
|
88
|
-
- `@peac/
|
|
138
|
+
- `@peac/crypto` (Layer 2): Sign mapped receipt claims into JWS receipts with `sign()`
|
|
89
139
|
|
|
90
140
|
## For Agent Developers
|
|
91
141
|
|
|
92
142
|
If you are building an AI agent that interacts with UCP-based commerce platforms:
|
|
93
143
|
|
|
94
144
|
- Use `mapUcpOrderToReceipt()` to produce signed evidence of order observations
|
|
95
|
-
- Use `
|
|
145
|
+
- Use `verifyUcpHttpSignature()` to verify the RFC 9421 signature on incoming UCP requests and webhooks before mapping (the legacy `verifyUcpWebhookSignature()` covers the deprecated `Request-Signature` path)
|
|
96
146
|
- Order status reflects fulfillment state; payment status requires explicit `payment_state` when the upstream source provides it
|
|
97
147
|
- See the [llms.txt](https://github.com/peacprotocol/peac/blob/main/llms.txt) for a concise protocol overview
|
|
98
148
|
|
package/dist/bundle.d.ts
CHANGED
|
@@ -6,6 +6,11 @@
|
|
|
6
6
|
*
|
|
7
7
|
* Evidence is stored in policy/policy.yaml with a hardened schema
|
|
8
8
|
* that cannot be misinterpreted as executable policy.
|
|
9
|
+
*
|
|
10
|
+
* Note: these helpers verify the legacy `Request-Signature` detached JWS
|
|
11
|
+
* (RFC 7797) path via `verifyUcpWebhookSignature`. The current UCP signing model
|
|
12
|
+
* is RFC 9421 HTTP Message Signatures (`verifyUcpHttpSignature`); a request-shaped
|
|
13
|
+
* dispute-evidence helper for that path is not yet provided here.
|
|
9
14
|
*/
|
|
10
15
|
import type { UcpWebhookEvidence, UcpProfile, VerifyUcpWebhookResult, LinkedReceipt, WebhookEventMeta } from './types.js';
|
|
11
16
|
/**
|
package/dist/bundle.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,UAAU,EAEV,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAUpB;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,6BAA6B;IAC7B,UAAU,EAAE,UAAU,CAAC;IAEvB,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,+EAA+E;IAC/E,WAAW,EAAE,MAAM,CAAC;IAEpB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IAEpB,8EAA8E;IAC9E,kBAAkB,EAAE,MAAM,CAAC;IAE3B,kDAAkD;IAClD,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,qCAAqC;IACrC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;IAElC,0EAA0E;IAC1E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAEjC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,8BAA8B;IAC7C,0CAA0C;IAC1C,eAAe,EAAE,OAAO,CAAC;IAEzB,kCAAkC;IAClC,YAAY,EAAE,sBAAsB,CAAC;IAErC,yEAAyE;IACzE,aAAa,EAAE,MAAM,CAAC;IAEtB,iCAAiC;IACjC,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,8BAA8B,CAAC,CAiGzC;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,UAAU,GAAG,gBAAgB,GAAG,SAAS,CAsBrF;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAW7F"}
|
package/dist/bundle.js
CHANGED
|
@@ -6,6 +6,11 @@
|
|
|
6
6
|
*
|
|
7
7
|
* Evidence is stored in policy/policy.yaml with a hardened schema
|
|
8
8
|
* that cannot be misinterpreted as executable policy.
|
|
9
|
+
*
|
|
10
|
+
* Note: these helpers verify the legacy `Request-Signature` detached JWS
|
|
11
|
+
* (RFC 7797) path via `verifyUcpWebhookSignature`. The current UCP signing model
|
|
12
|
+
* is RFC 9421 HTTP Message Signatures (`verifyUcpHttpSignature`); a request-shaped
|
|
13
|
+
* dispute-evidence helper for that path is not yet provided here.
|
|
9
14
|
*/
|
|
10
15
|
import { createUcpWebhookEvidence, serializeEvidenceYaml, createPayloadEvidence, createSignatureEvidence, createProfileSnapshot, } from './evidence.js';
|
|
11
16
|
import { verifyUcpWebhookSignature, parseDetachedJws } from './verify.js';
|
package/dist/bundle.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAUH,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AA4D1E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAwC;IAExC,MAAM,EACJ,gBAAgB,EAChB,UAAU,EACV,MAAM,EACN,IAAI,EACJ,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,OAAO,EAAE,eAAe,EACxB,KAAK,EACL,eAAe,EACf,uBAAuB,EACvB,gBAAgB,GAAG,KAAK,GACzB,GAAG,OAAO,CAAC;IAEZ,+BAA+B;IAC/B,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC;QACnD,gBAAgB;QAChB,UAAU;QACV,WAAW;QACX,OAAO,EAAE,eAAe;QACxB,UAAU,EAAE,kBAAkB;QAC9B,uBAAuB;KACxB,CAAC,CAAC;IAEH,yDAAyD;IACzD,IAAI,OAAmB,CAAC;IACxB,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,GAAG,eAAe,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,6BAA6B;QAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAe,CAAC;IAClD,CAAC;IAED,0CAA0C;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;IAElD,0BAA0B;IAC1B,MAAM,eAAe,GAAG,qBAAqB,CAAC,UAAU,EAAE;QACxD,oBAAoB,EAAE,uBAAuB;QAC7C,cAAc,EAAE,gBAAgB;KACjC,CAAC,CAAC;IAEH,4BAA4B;IAC5B,MAAM,iBAAiB,GAAG,uBAAuB,CAC/C,gBAAgB,EAChB;QACE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACtB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;QACtB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;KACzB,EACD,YAAY,CAAC,KAAK,EAClB,YAAY,CAAC,QAAQ,EACrB,YAAY,CAAC,SAAS,CACvB,CAAC;IAEF,8BAA8B;IAC9B,MAAM,OAAO,GAAG,YAAY,CAAC,GAAgC,CAAC;IAE9D,0BAA0B;IAC1B,MAAM,eAAe,GAAG,OAAO;QAC7B,CAAC,CAAC,qBAAqB,CACnB,WAAW,EACX,OAA6C,EAC7C,OAAO,EACP,kBAAkB,CACnB;QACH,CAAC,CAAC;YACE,GAAG,EAAE,WAAW;YAChB,UAAU,EAAE,kBAAkB;YAC9B,sBAAsB,EAAE,EAAE,EAAE,6BAA6B;SAC1D,CAAC;IAEN,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,MAAM;QACN,IAAI;QACJ,WAAW;QACX,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,iBAAiB;QAC5B,OAAO,EAAE,eAAe;QACxB,KAAK;QACL,eAAe;KAChB,CAAC,CAAC;IAEH,oBAAoB;IACpB,MAAM,aAAa,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IAEtD,OAAO;QACL,eAAe,EAAE,YAAY,CAAC,KAAK;QACnC,YAAY;QACZ,aAAa;QACb,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAqB;IACrD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA4B,CAAC;QAEhE,+CAA+C;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,UAAgC,CAAC;QAC3D,MAAM,OAAO,GAAI,OAAO,CAAC,KAAiC,EAAE,EAAwB,CAAC;QACrF,MAAM,SAAS,GAAG,OAAO,CAAC,SAA+B,CAAC;QAE1D,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO;YACL,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,OAAO;YACpB,SAAS;SACV,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACtC,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3E,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,OAAO,kBAAkB,CAAC,CAAC,UAAU;AACvC,CAAC"}
|
package/dist/errors.d.ts
CHANGED
|
@@ -12,6 +12,16 @@ export declare const ErrorCodes: {
|
|
|
12
12
|
readonly SIGNATURE_MALFORMED: "E_UCP_SIGNATURE_MALFORMED";
|
|
13
13
|
readonly SIGNATURE_ALGORITHM_UNSUPPORTED: "E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED";
|
|
14
14
|
readonly SIGNATURE_B64_INVALID: "E_UCP_SIGNATURE_B64_INVALID";
|
|
15
|
+
readonly HTTP_SIGNATURE_INPUT_MISSING: "E_UCP_HTTP_SIGNATURE_INPUT_MISSING";
|
|
16
|
+
readonly HTTP_SIGNATURE_MISSING: "E_UCP_HTTP_SIGNATURE_MISSING";
|
|
17
|
+
readonly HTTP_SIGNATURE_MALFORMED: "E_UCP_HTTP_SIGNATURE_MALFORMED";
|
|
18
|
+
readonly HTTP_SIGNATURE_COMPONENT_MISSING: "E_UCP_HTTP_SIGNATURE_COMPONENT_MISSING";
|
|
19
|
+
readonly CONTENT_DIGEST_MISSING: "E_UCP_CONTENT_DIGEST_MISSING";
|
|
20
|
+
readonly CONTENT_DIGEST_MALFORMED: "E_UCP_CONTENT_DIGEST_MALFORMED";
|
|
21
|
+
readonly CONTENT_DIGEST_UNSUPPORTED: "E_UCP_CONTENT_DIGEST_UNSUPPORTED";
|
|
22
|
+
readonly CONTENT_DIGEST_MISMATCH: "E_UCP_CONTENT_DIGEST_MISMATCH";
|
|
23
|
+
readonly BODY_REQUIRED: "E_UCP_BODY_REQUIRED";
|
|
24
|
+
readonly AGENT_MISMATCH: "E_UCP_AGENT_MISMATCH";
|
|
15
25
|
readonly KEY_NOT_FOUND: "E_UCP_KEY_NOT_FOUND";
|
|
16
26
|
readonly KEY_ALGORITHM_MISMATCH: "E_UCP_KEY_ALGORITHM_MISMATCH";
|
|
17
27
|
readonly KEY_CURVE_MISMATCH: "E_UCP_KEY_CURVE_MISMATCH";
|
package/dist/errors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU
|
|
1
|
+
{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoDb,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;AAErE;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CA0CrD,CAAC;AAEF;;GAEG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE/B,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAQ/E,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC;AAED;;GAEG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,QAAQ,CAEV"}
|
package/dist/errors.js
CHANGED
|
@@ -13,6 +13,20 @@ export const ErrorCodes = {
|
|
|
13
13
|
SIGNATURE_MALFORMED: 'E_UCP_SIGNATURE_MALFORMED',
|
|
14
14
|
SIGNATURE_ALGORITHM_UNSUPPORTED: 'E_UCP_SIGNATURE_ALGORITHM_UNSUPPORTED',
|
|
15
15
|
SIGNATURE_B64_INVALID: 'E_UCP_SIGNATURE_B64_INVALID',
|
|
16
|
+
// RFC 9421 HTTP Message Signature errors (400 - malformed)
|
|
17
|
+
HTTP_SIGNATURE_INPUT_MISSING: 'E_UCP_HTTP_SIGNATURE_INPUT_MISSING',
|
|
18
|
+
HTTP_SIGNATURE_MISSING: 'E_UCP_HTTP_SIGNATURE_MISSING',
|
|
19
|
+
HTTP_SIGNATURE_MALFORMED: 'E_UCP_HTTP_SIGNATURE_MALFORMED',
|
|
20
|
+
HTTP_SIGNATURE_COMPONENT_MISSING: 'E_UCP_HTTP_SIGNATURE_COMPONENT_MISSING',
|
|
21
|
+
// RFC 9530 Content-Digest errors (all 400: malformed request / integrity)
|
|
22
|
+
CONTENT_DIGEST_MISSING: 'E_UCP_CONTENT_DIGEST_MISSING',
|
|
23
|
+
CONTENT_DIGEST_MALFORMED: 'E_UCP_CONTENT_DIGEST_MALFORMED',
|
|
24
|
+
CONTENT_DIGEST_UNSUPPORTED: 'E_UCP_CONTENT_DIGEST_UNSUPPORTED',
|
|
25
|
+
CONTENT_DIGEST_MISMATCH: 'E_UCP_CONTENT_DIGEST_MISMATCH',
|
|
26
|
+
// Body required to verify a digest-covered request (400 - malformed)
|
|
27
|
+
BODY_REQUIRED: 'E_UCP_BODY_REQUIRED',
|
|
28
|
+
// Signer identity binding (401 - auth failure)
|
|
29
|
+
AGENT_MISMATCH: 'E_UCP_AGENT_MISMATCH',
|
|
16
30
|
// Key errors (401 - auth failure)
|
|
17
31
|
KEY_NOT_FOUND: 'E_UCP_KEY_NOT_FOUND',
|
|
18
32
|
KEY_ALGORITHM_MISMATCH: 'E_UCP_KEY_ALGORITHM_MISMATCH',
|
|
@@ -45,6 +59,15 @@ export const ErrorHttpStatus = {
|
|
|
45
59
|
[ErrorCodes.SIGNATURE_MALFORMED]: 400,
|
|
46
60
|
[ErrorCodes.SIGNATURE_ALGORITHM_UNSUPPORTED]: 400,
|
|
47
61
|
[ErrorCodes.SIGNATURE_B64_INVALID]: 400,
|
|
62
|
+
// UCP maps a malformed/incomplete signed request to 400.
|
|
63
|
+
[ErrorCodes.HTTP_SIGNATURE_MALFORMED]: 400,
|
|
64
|
+
[ErrorCodes.HTTP_SIGNATURE_COMPONENT_MISSING]: 400,
|
|
65
|
+
[ErrorCodes.CONTENT_DIGEST_MISSING]: 400,
|
|
66
|
+
[ErrorCodes.CONTENT_DIGEST_MALFORMED]: 400,
|
|
67
|
+
[ErrorCodes.CONTENT_DIGEST_UNSUPPORTED]: 400,
|
|
68
|
+
// UCP: digest_mismatch is a request-integrity (400) error, not 401.
|
|
69
|
+
[ErrorCodes.CONTENT_DIGEST_MISMATCH]: 400,
|
|
70
|
+
[ErrorCodes.BODY_REQUIRED]: 400,
|
|
48
71
|
[ErrorCodes.PAYLOAD_EMPTY]: 400,
|
|
49
72
|
[ErrorCodes.PAYLOAD_NOT_JSON]: 400,
|
|
50
73
|
[ErrorCodes.PAYLOAD_TOO_LARGE]: 400,
|
|
@@ -53,11 +76,16 @@ export const ErrorHttpStatus = {
|
|
|
53
76
|
[ErrorCodes.ORDER_MISSING_LINE_ITEMS]: 400,
|
|
54
77
|
[ErrorCodes.ORDER_MISSING_TOTALS]: 400,
|
|
55
78
|
// 401 - Unauthorized (auth failure)
|
|
79
|
+
// UCP maps signature_missing to 401 (missing credentials), so the RFC 9421
|
|
80
|
+
// missing-header codes are 401, not 400.
|
|
81
|
+
[ErrorCodes.HTTP_SIGNATURE_INPUT_MISSING]: 401,
|
|
82
|
+
[ErrorCodes.HTTP_SIGNATURE_MISSING]: 401,
|
|
56
83
|
[ErrorCodes.KEY_NOT_FOUND]: 401,
|
|
57
84
|
[ErrorCodes.KEY_ALGORITHM_MISMATCH]: 401,
|
|
58
85
|
[ErrorCodes.KEY_CURVE_MISMATCH]: 401,
|
|
59
86
|
[ErrorCodes.SIGNATURE_INVALID]: 401,
|
|
60
87
|
[ErrorCodes.VERIFICATION_FAILED]: 401,
|
|
88
|
+
[ErrorCodes.AGENT_MISMATCH]: 401,
|
|
61
89
|
// 500 - Internal Server Error
|
|
62
90
|
[ErrorCodes.EVIDENCE_SERIALIZATION_FAILED]: 500,
|
|
63
91
|
// 502 - Bad Gateway (upstream failure)
|
package/dist/errors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kDAAkD;IAClD,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAChD,+BAA+B,EAAE,uCAAuC;IACxE,qBAAqB,EAAE,6BAA6B;IAEpD,kCAAkC;IAClC,aAAa,EAAE,qBAAqB;IACpC,sBAAsB,EAAE,8BAA8B;IACtD,kBAAkB,EAAE,0BAA0B;IAE9C,2CAA2C;IAC3C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAEhD,0CAA0C;IAC1C,oBAAoB,EAAE,4BAA4B;IAClD,eAAe,EAAE,uBAAuB;IACxC,uBAAuB,EAAE,+BAA+B;IAExD,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,iBAAiB,EAAE,yBAAyB;IAE5C,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,wBAAwB,EAAE,gCAAgC;IAC1D,oBAAoB,EAAE,4BAA4B;IAElD,mCAAmC;IACnC,6BAA6B,EAAE,qCAAqC;CAC5D,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,gCAAgC;IAChC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;IACrC,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,GAAG;IACjD,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,GAAG;IACvC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC1C,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,GAAG;IAEtC,oCAAoC;IACpC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,GAAG;IACxC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,GAAG;IACpC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;
|
|
1
|
+
{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kDAAkD;IAClD,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAChD,+BAA+B,EAAE,uCAAuC;IACxE,qBAAqB,EAAE,6BAA6B;IAEpD,2DAA2D;IAC3D,4BAA4B,EAAE,oCAAoC;IAClE,sBAAsB,EAAE,8BAA8B;IACtD,wBAAwB,EAAE,gCAAgC;IAC1D,gCAAgC,EAAE,wCAAwC;IAE1E,0EAA0E;IAC1E,sBAAsB,EAAE,8BAA8B;IACtD,wBAAwB,EAAE,gCAAgC;IAC1D,0BAA0B,EAAE,kCAAkC;IAC9D,uBAAuB,EAAE,+BAA+B;IAExD,qEAAqE;IACrE,aAAa,EAAE,qBAAqB;IAEpC,+CAA+C;IAC/C,cAAc,EAAE,sBAAsB;IAEtC,kCAAkC;IAClC,aAAa,EAAE,qBAAqB;IACpC,sBAAsB,EAAE,8BAA8B;IACtD,kBAAkB,EAAE,0BAA0B;IAE9C,2CAA2C;IAC3C,iBAAiB,EAAE,yBAAyB;IAC5C,mBAAmB,EAAE,2BAA2B;IAEhD,0CAA0C;IAC1C,oBAAoB,EAAE,4BAA4B;IAClD,eAAe,EAAE,uBAAuB;IACxC,uBAAuB,EAAE,+BAA+B;IAExD,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,iBAAiB,EAAE,yBAAyB;IAE5C,mCAAmC;IACnC,aAAa,EAAE,qBAAqB;IACpC,gBAAgB,EAAE,wBAAwB;IAC1C,wBAAwB,EAAE,gCAAgC;IAC1D,oBAAoB,EAAE,4BAA4B;IAElD,mCAAmC;IACnC,6BAA6B,EAAE,qCAAqC;CAC5D,CAAC;AAIX;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAA8B;IACxD,gCAAgC;IAChC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;IACrC,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAAE,GAAG;IACjD,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,GAAG;IACvC,yDAAyD;IACzD,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC1C,CAAC,UAAU,CAAC,gCAAgC,CAAC,EAAE,GAAG;IAClD,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,GAAG;IACxC,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC1C,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,GAAG;IAC5C,oEAAoE;IACpE,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,GAAG;IACzC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,GAAG;IAClC,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,GAAG;IAC1C,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,GAAG;IAEtC,oCAAoC;IACpC,2EAA2E;IAC3E,yCAAyC;IACzC,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,GAAG;IAC9C,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,GAAG;IACxC,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,GAAG;IAC/B,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,GAAG;IACxC,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,GAAG;IACpC,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,GAAG;IACnC,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,GAAG;IACrC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,GAAG;IAEhC,8BAA8B;IAC9B,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,GAAG;IAE/C,uCAAuC;IACvC,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,GAAG;IACtC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,GAAG;IACjC,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,GAAG;CAC1C,CAAC;AAEF;;GAEG;AACH,MAAM,OAAO,QAAS,SAAQ,KAAK;IACxB,IAAI,CAAY;IAChB,UAAU,CAAS;IACnB,OAAO,CAA2B;IAE3C,YAAY,IAAe,EAAE,OAAe,EAAE,OAAiC;QAC7E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;SAC/C,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAe,EACf,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC"}
|
package/dist/evidence.d.ts
CHANGED
|
@@ -65,5 +65,4 @@ export declare function createSignatureEvidence(headerValue: string, header: {
|
|
|
65
65
|
* Create profile snapshot from fetched profile.
|
|
66
66
|
*/
|
|
67
67
|
export declare function createProfileSnapshot(url: string, profile: Record<string, unknown>, keyUsed: UcpSigningKey, fetchedAt: string): ProfileSnapshot;
|
|
68
|
-
export { sha256Hex, sha256Bytes, base64urlEncode, jcsCanonicalizeSync } from './util.js';
|
|
69
68
|
//# sourceMappingURL=evidence.d.ts.map
|
package/dist/evidence.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACd,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,mBAAmB,EACnB,aAAa,EACd,MAAM,YAAY,CAAC;AAUpB;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IAEpB,uBAAuB;IACvB,OAAO,EAAE,eAAe,CAAC;IAEzB,yBAAyB;IACzB,SAAS,EAAE,iBAAiB,CAAC;IAE7B,uBAAuB;IACvB,OAAO,EAAE,eAAe,CAAC;IAEzB,gCAAgC;IAChC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,iCAAiC;IACjC,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,qBAAqB,GAAG,kBAAkB,CAmB3F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,MAAM,CAwH1E;AAcD;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,UAAU,EACrB,OAAO,GAAE;IACP,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,OAAO,CAAC;CACrB,GACL,eAAe,CAyCjB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,EACpE,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,mBAAmB,EAAE,EAC/B,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GACvB,iBAAiB,CAWnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,eAAe,CAuBjB"}
|
package/dist/evidence.js
CHANGED
|
@@ -12,7 +12,8 @@
|
|
|
12
12
|
* 5. Timestamps are injected, not generated, for deterministic fixtures
|
|
13
13
|
*/
|
|
14
14
|
import { UCP_EVIDENCE_VERSION } from './types.js';
|
|
15
|
-
import {
|
|
15
|
+
import { base64urlEncode, canonicalize } from '@peac/crypto';
|
|
16
|
+
import { sha256Hex, sha256Bytes } from './util.js';
|
|
16
17
|
/**
|
|
17
18
|
* Maximum body size to include as base64url in evidence (256KB).
|
|
18
19
|
*/
|
|
@@ -189,7 +190,7 @@ export function createPayloadEvidence(bodyBytes, options = {}) {
|
|
|
189
190
|
const parsed = JSON.parse(bodyText);
|
|
190
191
|
jsonParseable = true;
|
|
191
192
|
// JCS canonicalize
|
|
192
|
-
const canonicalized =
|
|
193
|
+
const canonicalized = canonicalize(parsed);
|
|
193
194
|
jcsSha256Hex = sha256Hex(new TextEncoder().encode(canonicalized));
|
|
194
195
|
if (includeJcsText) {
|
|
195
196
|
jcsText = canonicalized;
|
|
@@ -226,7 +227,7 @@ export function createSignatureEvidence(headerValue, header, verified, attempts,
|
|
|
226
227
|
*/
|
|
227
228
|
export function createProfileSnapshot(url, profile, keyUsed, fetchedAt) {
|
|
228
229
|
// JCS canonicalize the profile
|
|
229
|
-
const canonicalized =
|
|
230
|
+
const canonicalized = canonicalize(profile);
|
|
230
231
|
const profileJcsSha256Hex = sha256Hex(new TextEncoder().encode(canonicalized));
|
|
231
232
|
// Compute JWK thumbprint (SHA-256 of JCS-canonicalized required members)
|
|
232
233
|
const thumbprintInput = {
|
|
@@ -235,7 +236,7 @@ export function createProfileSnapshot(url, profile, keyUsed, fetchedAt) {
|
|
|
235
236
|
x: keyUsed.x,
|
|
236
237
|
y: keyUsed.y,
|
|
237
238
|
};
|
|
238
|
-
const thumbprint = base64urlEncode(sha256Bytes(new TextEncoder().encode(
|
|
239
|
+
const thumbprint = base64urlEncode(sha256Bytes(new TextEncoder().encode(canonicalize(thumbprintInput))));
|
|
239
240
|
return {
|
|
240
241
|
url,
|
|
241
242
|
fetched_at: fetchedAt,
|
|
@@ -244,6 +245,4 @@ export function createProfileSnapshot(url, profile, keyUsed, fetchedAt) {
|
|
|
244
245
|
key_jwk: keyUsed,
|
|
245
246
|
};
|
|
246
247
|
}
|
|
247
|
-
// Re-export utilities for backwards compatibility
|
|
248
|
-
export { sha256Hex, sha256Bytes, base64urlEncode, jcsCanonicalizeSync } from './util.js';
|
|
249
248
|
//# sourceMappingURL=evidence.js.map
|
package/dist/evidence.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,
|
|
1
|
+
{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAEnD;;GAEG;AACH,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AA+BnD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA8B;IACrE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,GACtF,OAAO,CAAC;IAEV,OAAO;QACL,4BAA4B,EAAE,oBAAoB;QAClD,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE;YACP,MAAM;YACN,IAAI;YACJ,WAAW;SACZ;QACD,OAAO;QACP,SAAS;QACT,GAAG,CAAC,KAAK,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO;QACP,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA4B;IAChE,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,iBAAiB;IACjB,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,4DAA4D;IAC5D,KAAK,CAAC,IAAI,CAAC,kCAAkC,QAAQ,CAAC,4BAA4B,GAAG,CAAC,CAAC;IACvF,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACrD,KAAK,CAAC,IAAI,CAAC,YAAY,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACrE,IAAI,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,wBAAwB,QAAQ,CAAC,OAAO,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,oBAAoB,gBAAgB,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACrF,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1F,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,SAAS,CAAC,sBAAsB,GAAG,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,yBAAyB,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,2BAA2B;IAC3B,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,YAAY,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,8BAA8B,QAAQ,CAAC,OAAO,CAAC,sBAAsB,GAAG,CAAC,CAAC;IACrF,IAAI,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,sBAAsB,QAAQ,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,WAAW,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACrD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,6BAA6B;IAC7B,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,UAAU,GAAG,CAAC,CAAC;YACjD,KAAK,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1D,KAAK,CAAC,GAAG,EAAE,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,CAAS;IACjC,OAAO,CAAC;SACL,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAqB,EACrB,UAGI,EAAE;IAEN,MAAM,EAAE,oBAAoB,GAAG,+BAA+B,EAAE,cAAc,GAAG,KAAK,EAAE,GACtF,OAAO,CAAC;IAEV,mBAAmB;IACnB,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAE1C,wCAAwC;IACxC,IAAI,cAAkC,CAAC;IACvC,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC7C,cAAc,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,4CAA4C;IAC5C,IAAI,YAAgC,CAAC;IACrC,IAAI,OAA2B,CAAC;IAChC,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,aAAa,GAAG,IAAI,CAAC;QAErB,mBAAmB;QACnB,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3C,YAAY,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;QAElE,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,GAAG,aAAa,CAAC;QAC1B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,OAAO;QACL,cAAc,EAAE,YAAY;QAC5B,GAAG,CAAC,cAAc,IAAI,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;QAC3D,GAAG,CAAC,YAAY,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,cAAc,EAAE,aAAa;KAC9B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,WAAmB,EACnB,MAAoE,EACpE,QAAiB,EACjB,QAA+B,EAC/B,QAAwB;IAExB,OAAO;QACL,YAAY,EAAE,WAAW;QACzB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAA+B;QAC3C,GAAG,EAAE,MAAM,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;QACjD,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACnE,QAAQ;QACR,GAAG,CAAC,QAAQ,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,CAAC;QACrD,qBAAqB,EAAE,QAAQ;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAW,EACX,OAAgC,EAChC,OAAsB,EACtB,SAAiB;IAEjB,+BAA+B;IAC/B,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAE/E,yEAAyE;IACzE,MAAM,eAAe,GAAG;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,CAAC,EAAE,OAAO,CAAC,CAAC;KACb,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,CAChC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CACrE,CAAC;IAEF,OAAO;QACL,GAAG;QACH,UAAU,EAAE,SAAS;QACrB,sBAAsB,EAAE,mBAAmB;QAC3C,cAAc,EAAE,UAAU;QAC1B,OAAO,EAAE,OAAO;KACjB,CAAC;AACJ,CAAC"}
|
|
@@ -0,0 +1,52 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @peac/mappings-ucp - RFC 9421 HTTP Message Signature verification
|
|
3
|
+
*
|
|
4
|
+
* Verifies UCP request and webhook signatures using the current UCP signing
|
|
5
|
+
* model: RFC 9421 HTTP Message Signatures (`Signature-Input` / `Signature`)
|
|
6
|
+
* with an RFC 9530 `Content-Digest` computed over the raw body bytes.
|
|
7
|
+
*
|
|
8
|
+
* This is distinct from the legacy `Request-Signature` detached-JWS path in
|
|
9
|
+
* `verify.ts` (`verifyUcpWebhookSignature`). The two schemes do NOT silently
|
|
10
|
+
* fall back to each other: the caller selects which one to verify, and a
|
|
11
|
+
* failure for the selected scheme is surfaced, never quietly downgraded.
|
|
12
|
+
*
|
|
13
|
+
* This verifier covers request-shaped UCP signatures (method / authority / path
|
|
14
|
+
* / headers / body). UCP response signatures use `@status` instead of `@method`
|
|
15
|
+
* and are a separate component model, out of scope here.
|
|
16
|
+
*
|
|
17
|
+
* UCP specifics enforced here (per https://ucp.dev/specification/signatures/):
|
|
18
|
+
* - The algorithm is RESOLVED from the signing key's `crv` (P-256 -> ES256,
|
|
19
|
+
* P-384 -> ES384). UCP does not include a JOSE/JWA `alg` in `Signature-Input`;
|
|
20
|
+
* if a signer includes an `alg` parameter anyway it is treated as advisory and
|
|
21
|
+
* accepted only when it is consistent with the key curve.
|
|
22
|
+
* - `created` is OPTIONAL (UCP handles replay at the business layer through
|
|
23
|
+
* idempotency keys), so the signature is parsed leniently.
|
|
24
|
+
* - The required signed-component set is enforced (see UcpComponentPolicy):
|
|
25
|
+
* `@method`, `@authority`, `@path`; `@query` when the URL has a query;
|
|
26
|
+
* `ucp-agent` when that header is present; `idempotency-key` for
|
|
27
|
+
* state-changing methods; `content-digest` + `content-type` when a body is
|
|
28
|
+
* present.
|
|
29
|
+
* - Signatures are fixed-width raw `r||s` (IEEE P1363): 64 bytes for P-256, 96
|
|
30
|
+
* for P-384. DER is rejected by an explicit length check.
|
|
31
|
+
*
|
|
32
|
+
* Implementation notes:
|
|
33
|
+
* - ECDSA verification uses WebCrypto (`crypto.subtle`), which expects raw
|
|
34
|
+
* `r||s`, so no new external dependency is introduced for ES256/ES384.
|
|
35
|
+
* - RFC 9421 header parsing and signature-base construction are reused from
|
|
36
|
+
* `@peac/http-signatures`. The signature base is built with
|
|
37
|
+
* `preferSerializedParams: true` so the `@signature-params` line is the exact
|
|
38
|
+
* serialized `Signature-Input` value that was signed (RFC 9421 Section 2.5),
|
|
39
|
+
* not a reconstructed one. That package's Ed25519-only `verifySignature` is
|
|
40
|
+
* intentionally not used.
|
|
41
|
+
* - `Content-Digest` is verified over the raw request body bytes with no JSON
|
|
42
|
+
* canonicalization (UCP binds raw bytes). JCS is only relevant to the separate
|
|
43
|
+
* AP2 mandate layer, which is out of scope here.
|
|
44
|
+
*/
|
|
45
|
+
import type { VerifyUcpHttpSignatureOptions, VerifyUcpHttpSignatureResult } from './types.js';
|
|
46
|
+
/**
|
|
47
|
+
* Verify a UCP RFC 9421 HTTP Message Signature.
|
|
48
|
+
*
|
|
49
|
+
* Never falls back to the legacy `Request-Signature` / RFC 7797 path.
|
|
50
|
+
*/
|
|
51
|
+
export declare function verifyUcpHttpSignature(options: VerifyUcpHttpSignatureOptions): Promise<VerifyUcpHttpSignatureResult>;
|
|
52
|
+
//# sourceMappingURL=http-signature.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"http-signature.d.ts","sourceRoot":"","sources":["../src/http-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAUH,OAAO,KAAK,EAEV,6BAA6B,EAC7B,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAyYpB;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,4BAA4B,CAAC,CAoSvC"}
|