@peac/mappings-ucp 0.15.1 → 0.15.3

package/dist/index.d.ts

@@ -1,27 +1,43 @@
 /**
  * @peac/mappings-ucp
  *
- * Google Universal Commerce Protocol (UCP) mapping to PEAC receipts
- * and dispute evidence.
+ * Universal Commerce Protocol (UCP) mapping to PEAC receipts and dispute
+ * evidence.
  *
- * Features:
- * - Webhook signature verification (raw-first, JCS fallback)
- * - UCP order to PEAC receipt mapping
- * - Dispute evidence generation for @peac/audit bundles
+ * Signature verification:
+ * - `verifyUcpHttpSignature` verifies the current UCP signing model:
+ *   request-shaped RFC 9421 HTTP Message Signatures (ES256/ES384) with an
+ *   RFC 9530 Content-Digest over raw body bytes. Response signatures (which use
+ *   `@status`) are out of scope.
+ * - `verifyUcpWebhookSignature` remains for the legacy `Request-Signature`
+ *   detached-JWS (RFC 7797) compatibility path; the two never silently fall back
+ *   to each other.
+ *
+ * Also: UCP order to PEAC receipt mapping and dispute evidence generation for
+ * @peac/audit bundles.
  *
  * @example
  * ```ts
- * import {
- *   verifyUcpWebhookSignature,
- *   mapUcpOrderToReceipt,
- *   createUcpDisputeEvidence,
- * } from '@peac/mappings-ucp';
+ * import { verifyUcpHttpSignature, mapUcpOrderToReceipt } from '@peac/mappings-ucp';
+ * import { sign } from '@peac/crypto';
  *
- * // Verify webhook signature
- * const result = await verifyUcpWebhookSignature({
- *   signature_header: req.headers['request-signature'],
+ * // Verify the current UCP signing model (RFC 9421 HTTP Message Signature).
+ * // The /.well-known/ucp profile is resolved by the caller (SSRF-safe) and
+ * // passed in; this function performs no network I/O.
+ * const result = await verifyUcpHttpSignature({
+ *   signature_input: req.headers['signature-input'],
+ *   signature: req.headers['signature'],
+ *   method: 'POST',
+ *   url: 'https://platform.example.com/webhooks/ucp/orders',
+ *   headers: {
+ *     'content-type': req.headers['content-type'],
+ *     'content-digest': req.headers['content-digest'],
+ *     'idempotency-key': req.headers['idempotency-key'],
+ *     'ucp-agent': req.headers['ucp-agent'],
+ *   },
  *   body_bytes: rawBody,
- *   profile_url: 'https://business.example.com/.well-known/ucp',
+ *   profile: ucpProfile,
+ *   expected_profile_url: 'https://business.example.com/.well-known/ucp', // bind the signer
  * });
  *
  * if (result.valid) {
@@ -33,18 +49,19 @@
  *     currency: 'USD',
  *   });
  *
- *   // Sign with @peac/protocol
- *   const receipt = await issue(claims, privateKey, kid);
+ *   // Sign the mapped claims into a JWS receipt
+ *   const receiptJws = await sign(claims, privateKey, kid);
  * }
  * ```
  */
 export type { UcpWebhookPayload, UcpExtractResult, UcpExtractAsyncResult } from './carrier.js';
 export { UCP_MAX_CARRIER_SIZE, UCP_LEGACY_EXTENSION_KEY, attachCarrierToWebhookPayload, extractCarrierFromWebhookPayload, extractCarrierFromWebhookPayloadAsync, UcpCarrierAdapter, } from './carrier.js';
-export type { UcpSignatureAlgorithm, MinorUnits, VerificationMode, B64Mode, UcpJwsHeader, ParsedDetachedJws, UcpSigningKey, UcpProfile, UcpCapability, VerificationAttempt, PayloadEvidence, SignatureEvidence, ProfileSnapshot, WebhookEventMeta, UcpWebhookEvidence, LinkedReceipt, VerifyUcpWebhookOptions, VerifyUcpWebhookResult, UcpLineItem, UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, UcpOrderState, UcpPaymentState, } from './types.js';
+export type { UcpSignatureAlgorithm, MinorUnits, VerificationMode, B64Mode, UcpJwsHeader, ParsedDetachedJws, UcpSigningKey, UcpProfile, UcpCapability, VerificationAttempt, PayloadEvidence, SignatureEvidence, ProfileSnapshot, WebhookEventMeta, UcpWebhookEvidence, LinkedReceipt, VerifyUcpWebhookOptions, VerifyUcpWebhookResult, UcpHttpSignatureAlgorithm, UcpComponentPolicy, VerifyUcpHttpSignatureOptions, VerifyUcpHttpSignatureResult, UcpLineItem, UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, UcpOrderState, UcpPaymentState, } from './types.js';
 export { UCP_EVIDENCE_VERSION } from './types.js';
 export { ErrorCodes, ErrorHttpStatus, UcpError, ucpError } from './errors.js';
 export type { ErrorCode } from './errors.js';
 export { verifyUcpWebhookSignature, parseDetachedJws, findSigningKey } from './verify.js';
+export { verifyUcpHttpSignature } from './http-signature.js';
 export { mapUcpOrderToReceipt, extractLineItemSummary, calculateOrderStats } from './mapper.js';
 export { createUcpWebhookEvidence, serializeEvidenceYaml, createPayloadEvidence, createSignatureEvidence, createProfileSnapshot, } from './evidence.js';
 export type { CreateEvidenceOptions } from './evidence.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE/F,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAEV,qBAAqB,EACrB,UAAU,EACV,gBAAgB,EAChB,OAAO,EAEP,YAAY,EACZ,iBAAiB,EAEjB,aAAa,EACb,UAAU,EACV,aAAa,EAEb,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EAEb,uBAAuB,EACvB,sBAAsB,EAEtB,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EAEnB,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1F,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGhG,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAGH,YAAY,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAE/F,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAGtB,YAAY,EAEV,qBAAqB,EACrB,UAAU,EACV,gBAAgB,EAChB,OAAO,EAEP,YAAY,EACZ,iBAAiB,EAEjB,aAAa,EACb,UAAU,EACV,aAAa,EAEb,mBAAmB,EACnB,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EAEb,uBAAuB,EACvB,sBAAsB,EAEtB,yBAAyB,EACzB,kBAAkB,EAClB,6BAA6B,EAC7B,4BAA4B,EAE5B,WAAW,EACX,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EAEnB,aAAa,EACb,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAGlD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAGhG,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAG3D,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC;AAErB,YAAY,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,27 +1,43 @@
 /**
  * @peac/mappings-ucp
  *
- * Google Universal Commerce Protocol (UCP) mapping to PEAC receipts
- * and dispute evidence.
+ * Universal Commerce Protocol (UCP) mapping to PEAC receipts and dispute
+ * evidence.
  *
- * Features:
- * - Webhook signature verification (raw-first, JCS fallback)
- * - UCP order to PEAC receipt mapping
- * - Dispute evidence generation for @peac/audit bundles
+ * Signature verification:
+ * - `verifyUcpHttpSignature` verifies the current UCP signing model:
+ *   request-shaped RFC 9421 HTTP Message Signatures (ES256/ES384) with an
+ *   RFC 9530 Content-Digest over raw body bytes. Response signatures (which use
+ *   `@status`) are out of scope.
+ * - `verifyUcpWebhookSignature` remains for the legacy `Request-Signature`
+ *   detached-JWS (RFC 7797) compatibility path; the two never silently fall back
+ *   to each other.
+ *
+ * Also: UCP order to PEAC receipt mapping and dispute evidence generation for
+ * @peac/audit bundles.
  *
  * @example
  * ```ts
- * import {
- *   verifyUcpWebhookSignature,
- *   mapUcpOrderToReceipt,
- *   createUcpDisputeEvidence,
- * } from '@peac/mappings-ucp';
+ * import { verifyUcpHttpSignature, mapUcpOrderToReceipt } from '@peac/mappings-ucp';
+ * import { sign } from '@peac/crypto';
  *
- * // Verify webhook signature
- * const result = await verifyUcpWebhookSignature({
- *   signature_header: req.headers['request-signature'],
+ * // Verify the current UCP signing model (RFC 9421 HTTP Message Signature).
+ * // The /.well-known/ucp profile is resolved by the caller (SSRF-safe) and
+ * // passed in; this function performs no network I/O.
+ * const result = await verifyUcpHttpSignature({
+ *   signature_input: req.headers['signature-input'],
+ *   signature: req.headers['signature'],
+ *   method: 'POST',
+ *   url: 'https://platform.example.com/webhooks/ucp/orders',
+ *   headers: {
+ *     'content-type': req.headers['content-type'],
+ *     'content-digest': req.headers['content-digest'],
+ *     'idempotency-key': req.headers['idempotency-key'],
+ *     'ucp-agent': req.headers['ucp-agent'],
+ *   },
  *   body_bytes: rawBody,
- *   profile_url: 'https://business.example.com/.well-known/ucp',
+ *   profile: ucpProfile,
+ *   expected_profile_url: 'https://business.example.com/.well-known/ucp', // bind the signer
  * });
  *
  * if (result.valid) {
@@ -33,8 +49,8 @@
  *     currency: 'USD',
  *   });
  *
- *   // Sign with @peac/protocol
- *   const receipt = await issue(claims, privateKey, kid);
+ *   // Sign the mapped claims into a JWS receipt
+ *   const receiptJws = await sign(claims, privateKey, kid);
  * }
  * ```
  */
@@ -42,8 +58,10 @@ export { UCP_MAX_CARRIER_SIZE, UCP_LEGACY_EXTENSION_KEY, attachCarrierToWebhookP
 export { UCP_EVIDENCE_VERSION } from './types.js';
 // Errors
 export { ErrorCodes, ErrorHttpStatus, UcpError, ucpError } from './errors.js';
-// Verification
+// Verification (legacy Request-Signature / RFC 7797 detached JWS)
 export { verifyUcpWebhookSignature, parseDetachedJws, findSigningKey } from './verify.js';
+// Verification (current UCP model: RFC 9421 HTTP Message Signatures)
+export { verifyUcpHttpSignature } from './http-signature.js';
 // Mapping
 export { mapUcpOrderToReceipt, extractLineItemSummary, calculateOrderStats } from './mapper.js';
 // Evidence

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,iBAAiB,GAClB,MAAM,cAAc,CAAC;AAqCtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG9E,eAAe;AACf,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1F,UAAU;AACV,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhG,WAAW;AACX,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAIvB,iBAAiB;AACjB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAKH,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,6BAA6B,EAC7B,gCAAgC,EAChC,qCAAqC,EACrC,iBAAiB,GAClB,MAAM,cAAc,CAAC;AA0CtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,SAAS;AACT,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG9E,kEAAkE;AAClE,OAAO,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE1F,qEAAqE;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,UAAU;AACV,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhG,WAAW;AACX,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAIvB,iBAAiB;AACjB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,GAC7B,MAAM,aAAa,CAAC"}

package/dist/mapper.d.ts

@@ -13,6 +13,8 @@ import type { UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, MinorUnits } fr
  *
  * @example
  * ```ts
+ * import { sign } from '@peac/crypto';
+ *
  * const claims = mapUcpOrderToReceipt({
  *   order: ucpOrder,
  *   issuer: 'https://merchant.example.com',
@@ -20,8 +22,8 @@ import type { UcpOrder, MapUcpOrderOptions, MappedReceiptClaims, MinorUnits } fr
  *   currency: 'USD',
  * });
  *
- * // Sign with @peac/protocol
- * const receipt = await issue(claims, privateKey, kid);
+ * // Sign the mapped claims into a JWS receipt (Ed25519 private key + kid)
+ * const receiptJws = await sign(claims, privateKey, kid);
  * ```
  */
 export declare function mapUcpOrderToReceipt(options: MapUcpOrderOptions): MappedReceiptClaims;

package/dist/mapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.d.ts","sourceRoot":"","sources":["../src/mapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EAEX,MAAM,YAAY,CAAC;AAkGpB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CA0DrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAQD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,GAAG;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CA0BA"}
+{"version":3,"file":"mapper.d.ts","sourceRoot":"","sources":["../src/mapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EACnB,UAAU,EAEX,MAAM,YAAY,CAAC;AAkGpB;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,mBAAmB,CA0DrF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,KAAK,CAAC;IAC7D,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC,CAQD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,GAAG;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CA0BA"}

package/dist/mapper.js

@@ -92,6 +92,8 @@ function paymentStateToStatus(state) {
  *
  * @example
  * ```ts
+ * import { sign } from '@peac/crypto';
+ *
  * const claims = mapUcpOrderToReceipt({
  *   order: ucpOrder,
  *   issuer: 'https://merchant.example.com',
@@ -99,8 +101,8 @@ function paymentStateToStatus(state) {
  *   currency: 'USD',
  * });
  *
- * // Sign with @peac/protocol
- * const receipt = await issue(claims, privateKey, kid);
+ * // Sign the mapped claims into a JWS receipt (Ed25519 private key + kid)
+ * const receiptJws = await sign(claims, privateKey, kid);
  * ```
  */
 export function mapUcpOrderToReceipt(options) {

package/dist/mapper.js.map

@@ -1 +1 @@
-{"version":3,"file":"mapper.js","sourceRoot":"","sources":["../src/mapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,QAAQ,SAAS,IAAI,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAe;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IAEnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAClC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,CAC7D,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAe;IACpC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,GAAG,CAAC;YACd,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,aAAa;YACrB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,CAAC,UAAU,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IAClF,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,WAAW,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE5E,iBAAiB;IACjB,aAAa,CAAC,KAAK,CAAC,CAAC;IAErB,wCAAwC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,8DAA8D;IAC9D,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE7C,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,aAAa,GAA4B,OAAO,CAAC,aAAa;QAClE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,WAAW,KAAK,YAAY;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC;IAElB,qBAAqB;IACrB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAEpC,uBAAuB;IACvB,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,UAAU,IAAI,iBAAiB,EAAE;QACtC,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,SAAS;YACZ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,QAAQ;YACR,MAAM;YACN,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC5D,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;gBACnC,MAAM;gBACN,qDAAqD;gBACrD,WAAW,EAAE,WAAW;gBACxB,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;gBACtE,oBAAoB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,wBAAwB;aACpF;SACF;QACD,GAAG,EAAE;YACH,kBAAkB,EAAE,KAAK,CAAC,EAAE;YAC5B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACtE,sBAAsB,EAAE,WAAW;YACnC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,uBAAuB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SACzE;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe;IAOpD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK;QAC3B,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,MAAM,EAAE,EAAE,CAAC,MAAM;KAClB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe;IAOjD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,UAAU,EAAE,CAAC;QACb,aAAa,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,iBAAiB,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAE3C,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9B,cAAc,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,aAAa;QAC7B,kBAAkB,EAAE,iBAAiB;KACtC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mapper.js","sourceRoot":"","sources":["../src/mapper.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;GAGG;AACH,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,OAAO,QAAQ,SAAS,IAAI,MAAM,EAAE,CAAC;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,KAAe;IACxC,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IAEnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;IACxE,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAClC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,WAAW,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,CAC7D,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAe;IACpC,MAAM,MAAM,GAA+B,EAAE,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,IACE,OAAO,GAAG,KAAK,QAAQ;YACvB,GAAG,CAAC,MAAM,GAAG,CAAC;YACd,GAAG,KAAK,WAAW;YACnB,GAAG,KAAK,aAAa;YACrB,GAAG,KAAK,WAAW,EACnB,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAe;IACpC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,QAAQ,CAAC,UAAU,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,CAAC,UAAU,CAAC,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;IAC1F,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,MAAM,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;IAClF,CAAC;IAED,wBAAwB;IACxB,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,QAAQ,CAAC,UAAU,CAAC,oBAAoB,EAAE,2CAA2C,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,oBAAoB,CAAC,KAAsB;IAClD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,WAAW,CAAC;IACpE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA2B;IAC9D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE5E,iBAAiB;IACjB,aAAa,CAAC,KAAK,CAAC,CAAC;IAErB,wCAAwC;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAE,CAAC;IACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAEjC,8DAA8D;IAC9D,MAAM,WAAW,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAE7C,oEAAoE;IACpE,+DAA+D;IAC/D,MAAM,aAAa,GAA4B,OAAO,CAAC,aAAa;QAClE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,CAAC,CAAC,WAAW,KAAK,YAAY;YAC5B,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC;IAElB,qBAAqB;IACrB,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAEpC,uBAAuB;IACvB,MAAM,MAAM,GAAwB;QAClC,GAAG,EAAE,UAAU,IAAI,iBAAiB,EAAE;QACtC,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,SAAS;YACZ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACjC,OAAO,EAAE;YACP,IAAI,EAAE,KAAK;YACX,QAAQ;YACR,MAAM;YACN,MAAM,EAAE,aAAa;YACrB,QAAQ,EAAE;gBACR,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC5D,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM;gBACnC,MAAM;gBACN,qDAAqD;gBACrD,WAAW,EAAE,WAAW;gBACxB,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;gBACtE,oBAAoB,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,wBAAwB;aACpF;SACF;QACD,GAAG,EAAE;YACH,kBAAkB,EAAE,KAAK,CAAC,EAAE;YAC5B,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,qBAAqB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YACtE,sBAAsB,EAAE,WAAW;YACnC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,uBAAuB,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,mBAAmB,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;SACzE;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAe;IAOpD,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnC,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK;QAC3B,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK;QACpB,MAAM,EAAE,EAAE,CAAC,MAAM;KAClB,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe;IAOjD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QAClC,UAAU,EAAE,CAAC;QACb,aAAa,IAAI,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACnC,iBAAiB,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC;QAE3C,IAAI,EAAE,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9B,cAAc,EAAE,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,YAAY,EAAE,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,WAAW,EAAE,UAAU;QACvB,eAAe,EAAE,cAAc;QAC/B,aAAa,EAAE,YAAY;QAC3B,cAAc,EAAE,aAAa;QAC7B,kBAAkB,EAAE,iBAAiB;KACtC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -1,8 +1,15 @@
 /**
  * @peac/mappings-ucp - Type definitions
  *
- * Google Universal Commerce Protocol (UCP) types and evidence schema.
- * UCP webhooks use detached JWS (RFC 7797) with ES256/ES384/ES512.
+ * Universal Commerce Protocol (UCP) types and evidence schema.
+ *
+ * The current UCP signing model is RFC 9421 HTTP Message Signatures
+ * (`Signature-Input` / `Signature` with an RFC 9530 `Content-Digest` over the
+ * raw body bytes; ES256 for P-256, ES384 for P-384), modeled by the
+ * `VerifyUcpHttpSignature*` types and verified by `verifyUcpHttpSignature`.
+ * The detached JWS (RFC 7797) `Request-Signature` types below model the legacy,
+ * deprecated `verifyUcpWebhookSignature` path; the two never silently fall back
+ * to each other.
  */
 /**
  * UCP Evidence schema version.
@@ -262,6 +269,105 @@ export interface VerifyUcpWebhookResult {
     /** Error message (if invalid) */
     error_message?: string;
 }
+/**
+ * HTTP Message Signature algorithm (RFC 9421) supported for UCP.
+ *
+ * UCP requires ES256 (P-256); ES384 (P-384) is OPTIONAL. Ed25519 is not used
+ * at the UCP wire layer, so it is intentionally excluded here.
+ *
+ * This is the algorithm RESOLVED from the signing key's curve (P-256 -> ES256,
+ * P-384 -> ES384), not a value read from the `Signature-Input` `alg` parameter:
+ * UCP does not include `alg` in `Signature-Input`.
+ */
+export type UcpHttpSignatureAlgorithm = 'ES256' | 'ES384';
+/**
+ * Required signed-component policy for UCP HTTP Message Signature verification.
+ *
+ * - `ucp-request` (default): the full UCP request policy. Always requires
+ *   `@method`, `@authority`, `@path`; `@query` when the URL has a query string;
+ *   `ucp-agent` when a `UCP-Agent` header is present; `idempotency-key` for
+ *   state-changing methods (POST/PUT/DELETE/PATCH); and `content-digest` +
+ *   `content-type` when a body is present. This also applies to webhook
+ *   deliveries: UCP does not define a separate webhook component set, and
+ *   webhook POSTs are not exempt from the idempotency-key requirement.
+ * - `signature-only`: low-level mode. Verifies the signature and, when a body is
+ *   present and covered, the Content-Digest, but does NOT enforce the required
+ *   component set. Use only when the caller enforces component coverage itself.
+ *
+ * Note: UCP response signatures use `@status` instead of `@method` and are a
+ * separate component model; this verifier covers request-shaped signatures only.
+ */
+export type UcpComponentPolicy = 'ucp-request' | 'signature-only';
+/**
+ * Options for verifying a UCP request/webhook RFC 9421 HTTP Message Signature.
+ *
+ * This is the current UCP signing model (`Signature-Input` / `Signature` /
+ * `Content-Digest` over raw body bytes), distinct from the legacy
+ * `Request-Signature` detached-JWS path verified by `verifyUcpWebhookSignature`.
+ * There is no silent fallback between the two: the caller selects the scheme.
+ */
+export interface VerifyUcpHttpSignatureOptions {
+    /** RFC 9421 `Signature-Input` header value. */
+    signature_input: string;
+    /** RFC 9421 `Signature` header value. */
+    signature: string;
+    /** HTTP method (e.g. 'POST'). */
+    method: string;
+    /** Absolute request URL (used for `@authority` / `@path` / `@query` derived components). */
+    url: string;
+    /** Request headers (case-insensitive lookup; e.g. `content-digest`, `ucp-agent`). */
+    headers: Record<string, string>;
+    /**
+     * Raw request body bytes. Required (and bound via `content-digest`) whenever a
+     * body is present; never JSON-canonicalized before digesting (UCP binds raw bytes).
+     */
+    body_bytes?: Uint8Array;
+    /**
+     * Pre-resolved UCP party profile (the `/.well-known/ucp` document). Resolving it
+     * is the caller's responsibility (SSRF-safe, host-allowlisted); tests pass a fixture.
+     * No network I/O happens inside this function.
+     */
+    profile: UcpProfile;
+    /** Optional specific signature label to verify (defaults to the first in `Signature-Input`). */
+    label?: string;
+    /**
+     * Required signed-component policy. Defaults to `'ucp-request'` (strict). Use
+     * `'signature-only'` for low-level verification without component enforcement.
+     */
+    component_policy?: UcpComponentPolicy;
+    /**
+     * Optional expected signer profile URL to bind. When provided, the `ucp-agent`
+     * component MUST be signed, the `UCP-Agent` header MUST be present and parse as
+     * an RFC 8941 dictionary with a quoted HTTPS `profile` member, and that profile
+     * URL MUST equal this value; otherwise verification fails. An unsigned component
+     * is never trusted. This verifier never fetches the profile URL (SSRF stays out).
+     */
+    expected_profile_url?: string;
+}
+/**
+ * Result of verifying a UCP RFC 9421 HTTP Message Signature.
+ */
+export interface VerifyUcpHttpSignatureResult {
+    /** Whether the signature (and `Content-Digest`, when present) verified. */
+    valid: boolean;
+    /** Algorithm resolved from the signing key's curve (P-256 -> ES256, P-384 -> ES384). */
+    alg?: UcpHttpSignatureAlgorithm;
+    /** `keyid` from `Signature-Input`, matched against `signing_keys[].kid`. */
+    keyid?: string;
+    /** Covered components from `Signature-Input` (for evidence capture). */
+    covered_components?: string[];
+    /** Whether a `Content-Digest` was present and verified over the raw body bytes. */
+    content_digest_verified?: boolean;
+    /**
+     * The signer profile URL parsed from a signed `UCP-Agent` header, when one was
+     * present and validated (evidence for the caller; never fetched here).
+     */
+    signer_profile_url?: string;
+    /** Error code (`E_UCP_*`) when invalid. */
+    error_code?: string;
+    /** Error message when invalid. */
+    error_message?: string;
+}
 /**
  * UCP order line item for receipt mapping.
  */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AAExE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,GAAG,EAAE,qBAAqB,CAAC;IAE3B,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IAEZ,+BAA+B;IAC/B,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,8BAA8B;IAC9B,MAAM,EAAE,YAAY,CAAC;IAErB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,sCAAsC;IACtC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,IAAI,CAAC;IAEV,kCAAkC;IAClC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAEjC,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,+BAA+B;IAC/B,CAAC,EAAE,MAAM,CAAC;IAEV,+BAA+B;IAC/B,CAAC,EAAE,MAAM,CAAC;IAEV,gBAAgB;IAChB,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAE5B,cAAc;IACd,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,EAAE,MAAM,CAAC;IAEpB,4CAA4C;IAC5C,YAAY,EAAE,aAAa,EAAE,CAAC;IAE9B,6BAA6B;IAC7B,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,qBAAqB;IACrB,IAAI,EAAE,gBAAgB,CAAC;IAEvB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IAEjB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IAEvB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qCAAqC;IACrC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IAErB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,GAAG,EAAE,qBAAqB,CAAC;IAE3B,gDAAgD;IAChD,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IAEpB,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAElB,wCAAwC;IACxC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAE1C,gDAAgD;IAChD,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB;IAClB,GAAG,EAAE,MAAM,CAAC;IAEZ,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IAEnB,sDAAsD;IACtD,sBAAsB,EAAE,MAAM,CAAC;IAE/B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IAEb,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,4BAA4B,EAAE,OAAO,oBAAoB,CAAC;IAE1D,kDAAkD;IAClD,IAAI,EAAE,qBAAqB,CAAC;IAE5B,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,+BAA+B;IAC/B,OAAO,EAAE;QACP,kBAAkB;QAClB,MAAM,EAAE,MAAM,CAAC;QAEf,mBAAmB;QACnB,IAAI,EAAE,MAAM,CAAC;QAEb,qEAAqE;QACrE,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,6DAA6D;IAC7D,OAAO,EAAE,eAAe,CAAC;IAEzB,yBAAyB;IACzB,SAAS,EAAE,iBAAiB,CAAC;IAE7B,kCAAkC;IAClC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,gCAAgC;IAChC,OAAO,EAAE,eAAe,CAAC;IAEzB,4CAA4C;IAC5C,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IAEnB,wCAAwC;IACxC,YAAY,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,6BAA6B;IAC7B,UAAU,EAAE,UAAU,CAAC;IAEvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IAEpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,mDAAmD;IACnD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAE7B,yBAAyB;IACzB,MAAM,EAAE,YAAY,CAAC;IAErB,gCAAgC;IAChC,GAAG,CAAC,EAAE,aAAa,CAAC;IAEpB,mEAAmE;IACnE,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gCAAgC;IAChC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAEhC,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,iCAAiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,UAAU,CAAC;KACnB,CAAC;IAEF,iBAAiB;IACjB,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,aAAa;IACb,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IAEX,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,iBAAiB;IACjB,UAAU,EAAE,WAAW,EAAE,CAAC;IAE1B,mBAAmB;IACnB,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC;KACpB,CAAC,CAAC;IAEH,uBAAuB;IACvB,WAAW,CAAC,EAAE;QACZ,YAAY,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,OAAO,EAAE,CAAC;KACnB,CAAC;IAEF,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAMD,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnE,uEAAuE;AACvE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AAEf;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,KAAK,EAAE,QAAQ,CAAC;IAEhB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IAEf,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAEhB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IAEjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IAEZ,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IAEZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,OAAO,EAAE;QACP,IAAI,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;QAChC,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnC,kEAAkE;YAClE,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,mDAAmD;YACnD,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,kDAAkD;YAClD,oBAAoB,CAAC,EAAE,UAAU,GAAG,wBAAwB,CAAC;SAC9D,CAAC;KACH,CAAC;IAEF,8BAA8B;IAC9B,GAAG,EAAE;QACH,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,mDAAmD;QACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAG,0BAAmC,CAAC;AAExE;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAEhE;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC;AAEhC;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,CAAC;AAE7C;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG,KAAK,GAAG,SAAS,CAAC;AAE/C;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,GAAG,EAAE,qBAAqB,CAAC;IAE3B,qDAAqD;IACrD,GAAG,EAAE,MAAM,CAAC;IAEZ,+BAA+B;IAC/B,GAAG,CAAC,EAAE,OAAO,CAAC;IAEd,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,8BAA8B;IAC9B,MAAM,EAAE,YAAY,CAAC;IAErB,yCAAyC;IACzC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,kCAAkC;IAClC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,sCAAsC;IACtC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,GAAG,EAAE,IAAI,CAAC;IAEV,kCAAkC;IAClC,GAAG,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;IAEjC,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,+BAA+B;IAC/B,CAAC,EAAE,MAAM,CAAC;IAEV,+BAA+B;IAC/B,CAAC,EAAE,MAAM,CAAC;IAEV,gBAAgB;IAChB,GAAG,CAAC,EAAE,qBAAqB,CAAC;IAE5B,cAAc;IACd,GAAG,CAAC,EAAE,KAAK,CAAC;CACb;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,sBAAsB;IACtB,OAAO,EAAE,MAAM,CAAC;IAEhB,kBAAkB;IAClB,WAAW,EAAE,MAAM,CAAC;IAEpB,4CAA4C;IAC5C,YAAY,EAAE,aAAa,EAAE,CAAC;IAE9B,6BAA6B;IAC7B,YAAY,CAAC,EAAE,aAAa,EAAE,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,qBAAqB;IACrB,IAAI,EAAE,gBAAgB,CAAC;IAEvB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAC;IAEjB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IAEvB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qCAAqC;IACrC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IAErB,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,GAAG,EAAE,qBAAqB,CAAC;IAE3B,gDAAgD;IAChD,GAAG,EAAE,OAAO,GAAG,IAAI,CAAC;IAEpB,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,qCAAqC;IACrC,QAAQ,EAAE,OAAO,CAAC;IAElB,wCAAwC;IACxC,sBAAsB,CAAC,EAAE,gBAAgB,CAAC;IAE1C,gDAAgD;IAChD,qBAAqB,EAAE,mBAAmB,EAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kBAAkB;IAClB,GAAG,EAAE,MAAM,CAAC;IAEZ,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC;IAEnB,sDAAsD;IACtD,sBAAsB,EAAE,MAAM,CAAC;IAE/B,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,+CAA+C;IAC/C,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IAEb,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,4BAA4B,EAAE,OAAO,oBAAoB,CAAC;IAE1D,kDAAkD;IAClD,IAAI,EAAE,qBAAqB,CAAC;IAE5B,qBAAqB;IACrB,KAAK,EAAE,aAAa,CAAC;IAErB,+BAA+B;IAC/B,OAAO,EAAE;QACP,kBAAkB;QAClB,MAAM,EAAE,MAAM,CAAC;QAEf,mBAAmB;QACnB,IAAI,EAAE,MAAM,CAAC;QAEb,qEAAqE;QACrE,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,6DAA6D;IAC7D,OAAO,EAAE,eAAe,CAAC;IAEzB,yBAAyB;IACzB,SAAS,EAAE,iBAAiB,CAAC;IAE7B,kCAAkC;IAClC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAEzB,gCAAgC;IAChC,OAAO,EAAE,eAAe,CAAC;IAEzB,4CAA4C;IAC5C,eAAe,CAAC,EAAE,aAAa,EAAE,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IAEnB,wCAAwC;IACxC,YAAY,EAAE,kBAAkB,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;CACpF;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,qCAAqC;IACrC,gBAAgB,EAAE,MAAM,CAAC;IAEzB,6BAA6B;IAC7B,UAAU,EAAE,UAAU,CAAC;IAEvB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IAEpB,kDAAkD;IAClD,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,yEAAyE;IACzE,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,iCAAiC;IACjC,KAAK,EAAE,OAAO,CAAC;IAEf,mDAAmD;IACnD,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAE7B,yBAAyB;IACzB,MAAM,EAAE,YAAY,CAAC;IAErB,gCAAgC;IAChC,GAAG,CAAC,EAAE,aAAa,CAAC;IAEpB,mEAAmE;IACnE,OAAO,CAAC,EAAE,UAAU,CAAC;IAErB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gCAAgC;IAChC,QAAQ,EAAE,mBAAmB,EAAE,CAAC;IAEhC,8BAA8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,iCAAiC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,yBAAyB,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,gBAAgB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,WAAW,6BAA6B;IAC5C,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IAExB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAElB,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IAEf,4FAA4F;IAC5F,GAAG,EAAE,MAAM,CAAC;IAEZ,qFAAqF;IACrF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEhC;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IAExB;;;;OAIG;IACH,OAAO,EAAE,UAAU,CAAC;IAEpB,gGAAgG;IAChG,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IAEtC;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,2EAA2E;IAC3E,KAAK,EAAE,OAAO,CAAC;IAEf,wFAAwF;IACxF,GAAG,CAAC,EAAE,yBAAyB,CAAC;IAEhC,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAE9B,mFAAmF;IACnF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAElC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,kCAAkC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,mBAAmB;IACnB,EAAE,EAAE,MAAM,CAAC;IAEX,mBAAmB;IACnB,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,UAAU,CAAC;KACnB,CAAC;IAEF,iBAAiB;IACjB,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,aAAa;IACb,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,eAAe;IACf,EAAE,EAAE,MAAM,CAAC;IAEX,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,iBAAiB;IACjB,UAAU,EAAE,WAAW,EAAE,CAAC;IAE1B,mBAAmB;IACnB,MAAM,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC;QACzD,MAAM,EAAE,UAAU,CAAC;KACpB,CAAC,CAAC;IAEH,uBAAuB;IACvB,WAAW,CAAC,EAAE;QACZ,YAAY,EAAE,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,OAAO,EAAE,CAAC;KACnB,CAAC;IAEF,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;CACzB;AAMD,8DAA8D;AAC9D,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,CAAC;AAEnE,uEAAuE;AACvE,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,YAAY,GACZ,UAAU,GACV,SAAS,GACT,QAAQ,GACR,UAAU,CAAC;AAEf;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,KAAK,EAAE,QAAQ,CAAC;IAEhB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IAEf,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAEhB,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IAEjB,sDAAsD;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iBAAiB;IACjB,GAAG,EAAE,MAAM,CAAC;IAEZ,aAAa;IACb,GAAG,EAAE,MAAM,CAAC;IAEZ,cAAc;IACd,GAAG,EAAE,MAAM,CAAC;IAEZ,iCAAiC;IACjC,GAAG,EAAE,MAAM,CAAC;IAEZ,uBAAuB;IACvB,OAAO,EAAE;QACP,IAAI,EAAE,KAAK,CAAC;QACZ,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,UAAU,CAAC;QACnB,MAAM,EAAE,WAAW,GAAG,SAAS,CAAC;QAChC,QAAQ,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,UAAU,EAAE,MAAM,CAAC;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACnC,kEAAkE;YAClE,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,mDAAmD;YACnD,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,kDAAkD;YAClD,oBAAoB,CAAC,EAAE,UAAU,GAAG,wBAAwB,CAAC;SAC9D,CAAC;KACH,CAAC;IAEF,8BAA8B;IAC9B,GAAG,EAAE;QACH,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;QAC/B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,mDAAmD;QACnD,uBAAuB,CAAC,EAAE,MAAM,CAAC;QACjC,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH"}

package/dist/types.js

@@ -1,8 +1,15 @@
 /**
  * @peac/mappings-ucp - Type definitions
  *
- * Google Universal Commerce Protocol (UCP) types and evidence schema.
- * UCP webhooks use detached JWS (RFC 7797) with ES256/ES384/ES512.
+ * Universal Commerce Protocol (UCP) types and evidence schema.
+ *
+ * The current UCP signing model is RFC 9421 HTTP Message Signatures
+ * (`Signature-Input` / `Signature` with an RFC 9530 `Content-Digest` over the
+ * raw body bytes; ES256 for P-256, ES384 for P-384), modeled by the
+ * `VerifyUcpHttpSignature*` types and verified by `verifyUcpHttpSignature`.
+ * The detached JWS (RFC 7797) `Request-Signature` types below model the legacy,
+ * deprecated `verifyUcpWebhookSignature` path; the two never silently fall back
+ * to each other.
  */
 /**
  * UCP Evidence schema version.

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAAmC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAAmC,CAAC"}

package/dist/util.d.ts

@@ -1,8 +1,10 @@
 /**
  * @peac/mappings-ucp - Shared utilities
  *
- * Crypto and encoding helpers used by both verification and evidence generation.
- * Extracted to prevent architectural coupling between modules.
+ * SHA-256 helpers used by verification and evidence generation. base64url
+ * encoding and JCS canonicalization are reused from @peac/crypto directly at
+ * the call sites (verify.ts / evidence.ts); these SHA-256 helpers stay local
+ * and synchronous (node:crypto) pending the H3 sha256 sync/async consolidation.
  */
 /**
  * SHA-256 hash as hex string.
@@ -12,15 +14,4 @@ export declare function sha256Hex(data: Uint8Array): string;
  * SHA-256 hash as Uint8Array.
  */
 export declare function sha256Bytes(data: Uint8Array): Uint8Array;
-/**
- * Base64url encode without padding.
- * Uses standard base64 + manual conversion for maximum portability.
- * Works with Node.js 12+ (does not require 'base64url' encoding from Node 15.7.0+).
- */
-export declare function base64urlEncode(data: Uint8Array): string;
-/**
- * JCS canonicalize (RFC 8785) - synchronous.
- * Produces deterministic JSON with sorted keys and no whitespace.
- */
-export declare function jcsCanonicalizeSync(obj: unknown): string;
 //# sourceMappingURL=util.d.ts.map

package/dist/util.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAElD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAExD;AA4BD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAwBxD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CA8BxD"}
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;GAEG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAElD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,CAExD"}

package/dist/util.js

@@ -1,11 +1,12 @@
 /**
  * @peac/mappings-ucp - Shared utilities
  *
- * Crypto and encoding helpers used by both verification and evidence generation.
- * Extracted to prevent architectural coupling between modules.
+ * SHA-256 helpers used by verification and evidence generation. base64url
+ * encoding and JCS canonicalization are reused from @peac/crypto directly at
+ * the call sites (verify.ts / evidence.ts); these SHA-256 helpers stay local
+ * and synchronous (node:crypto) pending the H3 sha256 sync/async consolidation.
  */
 import { createHash } from 'node:crypto';
-import { ErrorCodes, ucpError } from './errors.js';
 /**
  * SHA-256 hash as hex string.
  */
@@ -18,86 +19,4 @@ export function sha256Hex(data) {
 export function sha256Bytes(data) {
     return new Uint8Array(createHash('sha256').update(data).digest());
 }
-/**
- * Convert base64 to base64url by replacing chars.
- */
-function base64ToBase64url(base64) {
-    let result = '';
-    for (let i = 0; i < base64.length; i++) {
-        const c = base64.charCodeAt(i);
-        if (c === 43) {
-            // '+' -> '-'
-            result += '-';
-        }
-        else if (c === 47) {
-            // '/' -> '_'
-            result += '_';
-        }
-        else if (c === 61) {
-            // '=' padding - skip
-            break;
-        }
-        else {
-            result += base64.charAt(i);
-        }
-    }
-    return result;
-}
-// Maximum size for base64url encoding (16MB - reasonable limit for webhook payloads)
-const MAX_ENCODE_SIZE = 16 * 1024 * 1024;
-/**
- * Base64url encode without padding.
- * Uses standard base64 + manual conversion for maximum portability.
- * Works with Node.js 12+ (does not require 'base64url' encoding from Node 15.7.0+).
- */
-export function base64urlEncode(data) {
-    // Safety check for unreasonably large input
-    if (data.length > MAX_ENCODE_SIZE) {
-        throw ucpError(ErrorCodes.SIGNATURE_MALFORMED, `Input too large for base64url encoding: ${data.length} bytes`);
-    }
-    // Use Buffer in Node.js, then convert base64 to base64url
-    if (typeof Buffer !== 'undefined' && typeof Buffer.from === 'function') {
-        const base64 = Buffer.from(data).toString('base64');
-        return base64ToBase64url(base64);
-    }
-    // Fallback for non-Node environments (browsers)
-    // Build binary string with bounded iteration
-    const len = data.length;
-    let binary = '';
-    for (let i = 0; i < len; i++) {
-        binary += String.fromCharCode(data[i]);
-    }
-    const base64 = btoa(binary);
-    return base64ToBase64url(base64);
-}
-/**
- * JCS canonicalize (RFC 8785) - synchronous.
- * Produces deterministic JSON with sorted keys and no whitespace.
- */
-export function jcsCanonicalizeSync(obj) {
-    if (obj === null)
-        return 'null';
-    if (typeof obj === 'boolean')
-        return obj ? 'true' : 'false';
-    if (typeof obj === 'number') {
-        if (!Number.isFinite(obj)) {
-            throw ucpError(ErrorCodes.EVIDENCE_SERIALIZATION_FAILED, 'JCS does not support NaN or Infinity');
-        }
-        // Use ES6 number serialization (matches JSON.stringify for finite numbers)
-        return Object.is(obj, -0) ? '0' : String(obj);
-    }
-    if (typeof obj === 'string')
-        return JSON.stringify(obj);
-    if (Array.isArray(obj)) {
-        return '[' + obj.map(jcsCanonicalizeSync).join(',') + ']';
-    }
-    if (typeof obj === 'object') {
-        const keys = Object.keys(obj).sort();
-        const pairs = keys
-            .filter((k) => obj[k] !== undefined)
-            .map((k) => JSON.stringify(k) + ':' + jcsCanonicalizeSync(obj[k]));
-        return '{' + pairs.join(',') + '}';
-    }
-    throw ucpError(ErrorCodes.EVIDENCE_SERIALIZATION_FAILED, `Cannot canonicalize type: ${typeof obj}`);
-}
 //# sourceMappingURL=util.js.map

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,MAAc;IACvC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,aAAa;YACb,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,aAAa;YACb,MAAM,IAAI,GAAG,CAAC;QAChB,CAAC;aAAM,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;YACpB,qBAAqB;YACrB,MAAM;QACR,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAgB;IAC9C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,QAAQ,CACZ,UAAU,CAAC,mBAAmB,EAC9B,2CAA2C,IAAI,CAAC,MAAM,QAAQ,CAC/D,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,gDAAgD;IAChD,6CAA6C;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;IACxB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5D,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,QAAQ,CACZ,UAAU,CAAC,6BAA6B,EACxC,sCAAsC,CACvC,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,KAAK,GAAG,IAAI;aACf,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,GAA+B,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;aAChE,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,mBAAmB,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;QACJ,OAAO,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrC,CAAC;IACD,MAAM,QAAQ,CACZ,UAAU,CAAC,6BAA6B,EACxC,6BAA6B,OAAO,GAAG,EAAE,CAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACpE,CAAC"}

package/dist/verify.d.ts

@@ -1,5 +1,11 @@
 /**
- * @peac/mappings-ucp - Webhook signature verification
+ * @peac/mappings-ucp - Legacy webhook signature verification (deprecated)
+ *
+ * This module verifies the legacy UCP `Request-Signature` detached JWS (RFC 7797)
+ * scheme. The current UCP signing model is RFC 9421 HTTP Message Signatures; use
+ * `verifyUcpHttpSignature` from `./http-signature.js` for new integrations. These
+ * exports remain for backward compatibility and never silently fall back to (or
+ * from) the RFC 9421 path.
  *
  * Verifies UCP webhook signatures using detached JWS (RFC 7797).
  * Supports ES256, ES384, ES512 algorithms with ECDSA keys.
@@ -17,6 +23,10 @@ import type { UcpProfile, UcpSigningKey, ParsedDetachedJws, VerifyUcpWebhookOpti
 /**
  * Parse a detached JWS from the Request-Signature header.
  * Format: <protected>..<signature> (empty payload section)
+ *
+ * @deprecated Part of the legacy UCP `Request-Signature` (RFC 7797) path. The
+ * current UCP signing model is RFC 9421 HTTP Message Signatures; prefer
+ * `verifyUcpHttpSignature`. Retained for backward compatibility.
  */
 export declare function parseDetachedJws(headerValue: string): ParsedDetachedJws;
 /**
@@ -24,7 +34,12 @@ export declare function parseDetachedJws(headerValue: string): ParsedDetachedJws
  */
 export declare function findSigningKey(profile: UcpProfile, kid: string): UcpSigningKey | undefined;
 /**
- * Verify a UCP webhook signature.
+ * Verify a UCP webhook signature (legacy `Request-Signature` / RFC 7797 path).
+ *
+ * @deprecated The current UCP signing model is RFC 9421 HTTP Message Signatures;
+ * use `verifyUcpHttpSignature` for new integrations. This legacy detached-JWS
+ * path remains exported for backward compatibility and never silently falls back
+ * to (or from) the RFC 9421 path.
  *
  * Strategy: raw-first, JCS fallback
  * 1. Parse the detached JWS from Request-Signature header

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAEb,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EAGvB,MAAM,YAAY,CAAC;AAmBpB;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAiIvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1F;AA4ED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAkKjC"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EAEb,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EAGvB,MAAM,YAAY,CAAC;AAmBpB;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,CAiIvE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE1F;AA2FD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAkKjC"}