@request-seal/core 0.2.0 → 0.3.0

package/dist/verify.js

@@ -10,7 +10,7 @@ import { isPublicKey } from "./public_key.js";
 import { isKeyIdentity, KeyIdentity } from "./key_identity.js";
 import { build } from "./signature-base/index.js";
 import { digestField, checkDigest, isDigestState } from "./digest.js";
-import { label, dictionaries, validInner, parameters, identities, ensure, fail, bounded, } from "./signature-fields.js";
+import { label, dictionaries, validInner, parameters, identities, ensure, fail, bounded, envelope, } from "./signature-fields.js";
 import { completed, } from "./verification.js";
 import { createClaim, retainUntil as retention } from "./replay/claim.js";
 import { createReceipt } from "./replay/receipt.js";
@@ -371,17 +371,44 @@ export async function verifyLabel(message, policy, options, observeIdentity, par
             profile, content: contentResult.value, freshness: fresh,
             replay: replayFacts, principal: "unattributed", authorization: "not_evaluated",
         });
-        if (result.ok && identity)
-            observeIdentity(identity);
+        if (result.ok && identity) {
+            // An extension pipeline step is a caller callback: its fault keeps the
+            // profile's deliberate invalid_policy classification, like a failing
+            // signer keeps signer_failed.
+            try {
+                observeIdentity(identity);
+            }
+            catch {
+                fail("invalid_policy", "input");
+            }
+        }
         return result;
     }
     catch (e) {
         if (isRequestSealError(e) && e.kind === "custody" && e.reason === "deadline_exceeded")
             return err(e);
-        return err(bounded(e, typeof profile.name === "string" ? "invalid_options" : "invalid_policy", "input"));
+        return err(envelope(e));
     }
 }
-/** Verify one HTTP signature under an explicit branded policy. */
+/**
+ * Verify one HTTP signature under an explicit branded policy.
+ *
+ * Checks exactly the named label; it never tries other labels. Success means the
+ * cryptography, coverage, freshness, content, and replay layers all passed. It does not
+ * authorize: the Verification records `authorization: "not_evaluated"`.
+ *
+ * @param message - A branded Message carrying the signature.
+ * @param policy - A branded Policy from `Policy.create`.
+ * @param options - `{label, context?, representation?, digestState?}`. `representation` is a
+ *   complete retained Body and needs a `"representation"` content policy. `digestState` is a
+ *   DigestState of the policy's content kind that you fed with a streamed body; verify finishes
+ *   it. The two are mutually exclusive.
+ * @returns `ok(verification)`, or a bounded error such as `core` `crypto.invalid_signature`,
+ *   `freshness.expired`, `content.digest_mismatch`, `key.unknown_key`, or `replay.replayed`.
+ * @see [Signing and verifying guide](https://github.com/baselabs/request-seal-typescript/blob/main/docs/guides/signing-and-verifying.md),
+ *   [reference](https://github.com/baselabs/request-seal-typescript/blob/main/docs/reference/sign-and-verify.md), and the
+ *   [error reasons](https://github.com/baselabs/request-seal-typescript/blob/main/docs/reference/errors.md).
+ */
 export function verify(message, policy, options) {
     return verifyLabel(message, policy, options);
 }

package/dist/web-bot-auth/verify.js

@@ -10,7 +10,7 @@ import { isDiscoverySource, sourceOrigin, thumbprintId, } from "../discovery/sou
 import { isKeySet, isResolution } from "../discovery/body.js";
 import { isPublicKey } from "../public_key.js";
 import { coreError, isRequestSealError, } from "../errors/types.js";
-import { dictionaries, validInner, parameters, identities, ensure, fail, bounded, } from "../signature-fields.js";
+import { dictionaries, validInner, parameters, identities, ensure, fail, envelope, } from "../signature-fields.js";
 import { CLOCK_MAX_SECONDS } from "../constants.js";
 import { retentionEnd } from "../replay/claim.js";
 import { agents, identifier, originAgent, component, required, nested, schemas, } from "./support.js";
@@ -336,7 +336,7 @@ export async function verifyWebBotAuth(message, policy, options = {}) {
     catch (e) {
         if (isRequestSealError(e))
             return err(e);
-        return err(bounded(e, "invalid_options", "input"));
+        return err(envelope(e));
     }
     finally {
         if (owned)

package/package.json

@@ -1,9 +1,21 @@
 {
   "name": "@request-seal/core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Standards-based HTTP message signatures and JOSE for web-standard runtimes.",
   "type": "module",
   "license": "Apache-2.0",
+  "keywords": [
+    "http-message-signatures",
+    "rfc9421",
+    "rfc9530",
+    "content-digest",
+    "web-bot-auth",
+    "jose",
+    "jws",
+    "jwe",
+    "webcrypto",
+    "replay-protection"
+  ],
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {