agentic-payments 0.1.14 → 0.1.16

package/dist/visa-tap/quic-transport.js

@@ -1,7 +1,18 @@
 /**
  * QUIC Transport Integration for Visa TAP
  *
- * Bridges agentic-payments with agentic-flow QUIC transport
+ * Bridges agentic-payments with the agentic-flow QUIC transport.
+ *
+ * No published agentic-flow release ships a working QUIC transport:
+ * `agentic-flow/transport/quic` is a placeholder whose `send()` discards the
+ * data. This transport therefore refuses to connect unless agentic-flow
+ * reports QUIC as available (`getQuicStatus()`), and never reports a payment
+ * as sent unless a real response comes back.
+ *
+ * It deliberately does not fall back to agentic-flow's WebSocket transport:
+ * no Visa TAP endpoint speaks that framing, its `send()` has no
+ * application-level acknowledgement, and plain `ws://` would carry mandates
+ * in cleartext. Failing closed is the only safe behaviour for payments.
  */
 // Dynamic import to handle optional dependency gracefully
 let QuicTransport = null;
@@ -38,16 +49,102 @@ export async function loadQuicTransport() {
     QuicTransport = mod.QuicTransport;
     return QuicTransport;
 }
+/** Error code carried by {@link QuicTransportUnavailableError}. */
+export const QUIC_UNAVAILABLE = 'QUIC_UNAVAILABLE';
+/** Error code carried by {@link PaymentNotDeliveredError}. */
+export const PAYMENT_NOT_DELIVERED = 'PAYMENT_NOT_DELIVERED';
+/**
+ * Thrown by {@link VisaTapQuicTransport.connect} when no working QUIC
+ * transport is available, so nothing could be delivered.
+ */
+export class QuicTransportUnavailableError extends Error {
+    reason;
+    code = QUIC_UNAVAILABLE;
+    constructor(reason) {
+        super(`Visa TAP QUIC transport is unavailable: ${reason} No payment data can be sent over it; submit the mandate over HTTPS instead.`);
+        this.reason = reason;
+        this.name = 'QuicTransportUnavailableError';
+    }
+}
+/**
+ * Thrown when a send did not produce a confirmed response, so the caller must
+ * treat the payment message as not delivered.
+ */
+export class PaymentNotDeliveredError extends Error {
+    code = PAYMENT_NOT_DELIVERED;
+    constructor(message) {
+        super(message);
+        this.name = 'PaymentNotDeliveredError';
+    }
+}
+const NO_PROBE_REASON = 'the installed agentic-flow has no getQuicStatus()/isQuicAvailable() probe, and its ' +
+    'agentic-flow/transport/quic QuicTransport is a placeholder that sends no bytes.';
+/**
+ * Ask agentic-flow whether its QUIC transport can actually move data.
+ *
+ * Fails closed: QUIC counts as available only when agentic-flow exports a
+ * probe and that probe says so. Older agentic-flow releases have no probe,
+ * and their QuicTransport is the same placeholder, so they are unavailable.
+ */
+export async function getQuicTransportStatus(mod) {
+    if (!mod) {
+        try {
+            // @ts-ignore - Dynamic import of optional peer dependency
+            mod = await import(AGENTIC_FLOW_QUIC_MODULE);
+        }
+        catch {
+            return {
+                available: false,
+                reason: `agentic-flow is not installed (npm install agentic-flow@"${AGENTIC_FLOW_PEER_RANGE}").`,
+            };
+        }
+    }
+    try {
+        if (typeof mod?.getQuicStatus === 'function') {
+            const status = await mod.getQuicStatus();
+            if (status?.available === true)
+                return { available: true };
+            return {
+                available: false,
+                reason: String(status?.reason || 'agentic-flow reports QUIC as unavailable.'),
+            };
+        }
+        if (typeof mod?.isQuicAvailable === 'function') {
+            if ((await mod.isQuicAvailable()) === true)
+                return { available: true };
+            return { available: false, reason: 'agentic-flow reports QUIC as unavailable.' };
+        }
+    }
+    catch (error) {
+        return { available: false, reason: `agentic-flow QUIC probe failed: ${String(error)}` };
+    }
+    return { available: false, reason: NO_PROBE_REASON };
+}
 /**
  * Visa TAP QUIC Transport
  *
- * Provides high-performance QUIC transport for Visa TAP payments
- * with 0-RTT connection resumption and multiplexed streams.
+ * QUIC transport for Visa TAP payments, backed by agentic-flow.
+ *
+ * `connect()` rejects with {@link QuicTransportUnavailableError} unless
+ * agentic-flow reports a working QUIC transport. With every agentic-flow
+ * release published so far it rejects. Use {@link VisaTapQuicTransport.create}
+ * to construct and check in one step.
  */
 export class VisaTapQuicTransport {
     quic = null;
     config;
     connected = false;
+    /**
+     * Construct a transport and connect it, failing fast when QUIC is
+     * unavailable.
+     *
+     * @throws QuicTransportUnavailableError when no working QUIC transport exists
+     */
+    static async create(config) {
+        const transport = new VisaTapQuicTransport(config);
+        await transport.connect();
+        return transport;
+    }
     constructor(config) {
         this.config = {
             timeout: 30000,
@@ -57,12 +154,18 @@ export class VisaTapQuicTransport {
         };
     }
     /**
-     * Connect to QUIC server
+     * Connect to the QUIC server.
      *
-     * Supports 0-RTT connection resumption for sub-millisecond reconnection
+     * @throws Error with install instructions when agentic-flow is not installed
+     * @throws QuicTransportUnavailableError when agentic-flow has no working QUIC
      */
     async connect() {
         const QuicClient = await loadQuicTransport();
+        // @ts-ignore - Dynamic import of optional peer dependency (cached by loadQuicTransport)
+        const status = await getQuicTransportStatus(await import(AGENTIC_FLOW_QUIC_MODULE));
+        if (!status.available) {
+            throw new QuicTransportUnavailableError(status.reason ?? 'unknown reason.');
+        }
         this.quic = new QuicClient({
             host: this.config.host,
             port: this.config.port,
@@ -75,7 +178,8 @@ export class VisaTapQuicTransport {
      * Send payment request over QUIC
      *
      * @param signedMandate - Cryptographically signed Active Mandate
-     * @returns Payment response
+     * @returns Payment response returned by the server
+     * @throws PaymentNotDeliveredError when no response with a transactionId came back
      */
     async sendPayment(signedMandate) {
         if (!this.connected) {
@@ -92,13 +196,19 @@ export class VisaTapQuicTransport {
      * Send raw payment data
      *
      * @param data - Payment data object
-     * @returns Response data
+     * @returns Response data returned by the server
+     * @throws PaymentNotDeliveredError when the transport returned no response
      */
     async send(data) {
         if (!this.connected) {
             throw new Error('Not connected. Call connect() first.');
         }
-        return await this.quic.send(data);
+        const response = await this.quic.send(data);
+        if (response === undefined || response === null) {
+            throw new PaymentNotDeliveredError('The QUIC transport returned no response, so delivery is unconfirmed. ' +
+                'Treat the message as not sent.');
+        }
+        return response;
     }
     /**
      * Get connection statistics
@@ -137,23 +247,21 @@ export class VisaTapQuicTransport {
         }
     }
     /**
-     * Parse payment response from QUIC
+     * Validate a payment response from the server.
+     *
+     * Never synthesises a response: a missing response, or one without a
+     * transactionId and a known status, means the payment was not confirmed.
      */
     parsePaymentResponse(raw) {
-        // agentic-flow 2.x/3.x QuicTransport.send() resolves to undefined
-        const response = raw ?? {};
-        // Handle different response formats
-        if (response.transactionId) {
-            return response;
+        const transactionId = raw?.transactionId;
+        if (raw === undefined || raw === null || typeof transactionId !== 'string' || !transactionId) {
+            throw new PaymentNotDeliveredError('The QUIC transport returned no payment response with a transactionId, so the ' +
+                'payment was not confirmed. Treat it as not sent.');
         }
-        // Default response format
-        return {
-            transactionId: response.id || crypto.randomUUID(),
-            status: response.status || 'pending',
-            amount: response.amount || 0,
-            currency: response.currency || 'USD',
-            timestamp: new Date().toISOString(),
-        };
+        if (!['approved', 'declined', 'pending'].includes(raw.status)) {
+            throw new PaymentNotDeliveredError(`The payment response has an unknown status (${String(raw.status)}); treat it as not confirmed.`);
+        }
+        return raw;
     }
 }
 /**

package/dist/visa-tap/quic-transport.js.map

@@ -1 +1 @@
-{"version":3,"file":"quic-transport.js","sourceRoot":"","sources":["../../src/visa-tap/quic-transport.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,0DAA0D;AAC1D,IAAI,aAAa,GAAQ,IAAI,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAEtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,0DAA0D;QAC1D,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6EAA6E,uBAAuB,GAAG,EACvG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,aAAa,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iEAAiE,wBAAwB,IAAI;YAC3F,0DAA0D,uBAAuB,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAQ,IAAI,CAAC;IACjB,MAAM,CAAa;IACnB,SAAS,GAAY,KAAK,CAAC;IAEnC,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,IAAI;YAChB,oBAAoB,EAAE,GAAG;YACzB,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAE7C,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;SACvD,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,aAAkC;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,IAAS;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;YACvC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,GAAQ;QACnC,kEAAkE;QAClE,MAAM,QAAQ,GAAG,GAAG,IAAI,EAAE,CAAC;QAE3B,oCAAoC;QACpC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,QAA2B,CAAC;QACrC,CAAC;QAED,0BAA0B;QAC1B,OAAO;YACL,aAAa,EAAE,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;YACjD,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,SAAS;YACpC,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC;YAC5B,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,KAAK;YACpC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAe,IAAI;IAEnB,OAAO,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"quic-transport.js","sourceRoot":"","sources":["../../src/visa-tap/quic-transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,0DAA0D;AAC1D,IAAI,aAAa,GAAQ,IAAI,CAAC;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAEtE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IAExC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,0DAA0D;QAC1D,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6EAA6E,uBAAuB,GAAG,EACvG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,GAAG,EAAE,aAAa,KAAK,UAAU,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,iEAAiE,wBAAwB,IAAI;YAC3F,0DAA0D,uBAAuB,GAAG,CACvF,CAAC;IACJ,CAAC;IAED,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAClC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAE7D;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IAEjC;IADZ,IAAI,GAAG,gBAAgB,CAAC;IACjC,YAAqB,MAAc;QACjC,KAAK,CACH,2CAA2C,MAAM,8EAA8E,CAChI,CAAC;QAHiB,WAAM,GAAN,MAAM,CAAQ;QAIjC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,qBAAqB,CAAC;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAQD,MAAM,eAAe,GACnB,qFAAqF;IACrF,iFAAiF,CAAC;AAEpF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAS;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,IAAI,CAAC;YACH,0DAA0D;YAC1D,GAAG,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,4DAA4D,uBAAuB,KAAK;aACjG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,IAAI,OAAO,GAAG,EAAE,aAAa,KAAK,UAAU,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC;YACzC,IAAI,MAAM,EAAE,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAC3D,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,2CAA2C,CAAC;aAC9E,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,GAAG,EAAE,eAAe,KAAK,UAAU,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,GAAG,CAAC,eAAe,EAAE,CAAC,KAAK,IAAI;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACvE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;QACnF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,OAAO,oBAAoB;IACvB,IAAI,GAAQ,IAAI,CAAC;IACjB,MAAM,CAAa;IACnB,SAAS,GAAY,KAAK,CAAC;IAEnC;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAkB;QACpC,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC;QAC1B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,IAAI;YAChB,oBAAoB,EAAE,GAAG;YACzB,GAAG,MAAM;SACV,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,UAAU,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAE7C,wFAAwF;QACxF,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,6BAA6B,CAAC,MAAM,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAC;QAC9E,CAAC;QAED,IAAI,CAAC,IAAI,GAAG,IAAI,UAAU,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,oBAAoB;SACvD,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,aAAkC;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,IAAI,CAAC,IAAS;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,wBAAwB,CAChC,uEAAuE;gBACrE,gCAAgC,CACnC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,QAAQ;QACN,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnC,OAAO;YACL,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC;YACnB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;YAC/B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;YACvC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,oBAAoB,CAAC,GAAQ;QACnC,MAAM,aAAa,GAAG,GAAG,EAAE,aAAa,CAAC;QACzC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,EAAE,CAAC;YAC7F,MAAM,IAAI,wBAAwB,CAChC,+EAA+E;gBAC7E,kDAAkD,CACrD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,wBAAwB,CAChC,+CAA+C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,+BAA+B,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,GAAsB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,OAAe,IAAI;IAEnB,OAAO,IAAI,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC"}

package/dist/visa-tap/rfc9421-fields.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Strict parsing and serialization of the RFC 9421 `Signature-Input` and
+ * `Signature` fields (RFC 8941 structured-field dictionaries).
+ *
+ * Only the subset RFC 9421 needs is accepted: dictionary members whose value
+ * is an inner list of component identifiers (Signature-Input) or a byte
+ * sequence (Signature). Anything else is rejected rather than guessed at.
+ */
+/** A signature parameter value (RFC 9421 §2.3). */
+export type SignatureParamValue = number | string;
+/** A parsed Signature-Input member. */
+export interface ParsedSignatureInput {
+    label: string;
+    /** Covered component identifiers, in the order they were listed. */
+    components: string[];
+    /** Signature parameters, in the order they were listed. */
+    params: Array<[string, SignatureParamValue]>;
+}
+/** Parse every member of a Signature-Input field. Throws on malformed input. */
+export declare function parseSignatureInputField(field: string): Map<string, ParsedSignatureInput>;
+/** Parse every member of a Signature field. Throws on malformed input. */
+export declare function parseSignatureField(field: string): Map<string, Uint8Array>;
+/** Serialize a string as an RFC 8941 sf-string. */
+export declare function serializeString(value: string): string;
+/** Serialize the inner list + parameters, i.e. the `@signature-params` value. */
+export declare function serializeSignatureParams(components: readonly string[], params: ReadonlyArray<readonly [string, SignatureParamValue]>): string;
+/** Validate a dictionary key (signature label). */
+export declare function assertLabel(label: string): void;
+//# sourceMappingURL=rfc9421-fields.d.ts.map

package/dist/visa-tap/rfc9421-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc9421-fields.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mDAAmD;AACnD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC9C;AAoJD,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAKzF;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAE1E;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAC5D,MAAM,CAaR;AAED,mDAAmD;AACnD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/C"}

package/dist/visa-tap/rfc9421-fields.js

@@ -0,0 +1,207 @@
+/**
+ * Strict parsing and serialization of the RFC 9421 `Signature-Input` and
+ * `Signature` fields (RFC 8941 structured-field dictionaries).
+ *
+ * Only the subset RFC 9421 needs is accepted: dictionary members whose value
+ * is an inner list of component identifiers (Signature-Input) or a byte
+ * sequence (Signature). Anything else is rejected rather than guessed at.
+ */
+/** Parameters RFC 9421 §2.3 defines, and the type each must have. */
+const PARAM_TYPES = {
+    created: 'integer',
+    expires: 'integer',
+    nonce: 'string',
+    alg: 'string',
+    keyid: 'string',
+    tag: 'string',
+};
+const KEY_RE = /^[a-z*][a-z0-9_\-.*]*$/;
+const MAX_INTEGER = 999_999_999_999_999;
+class Cursor {
+    src;
+    pos = 0;
+    constructor(src) {
+        this.src = src;
+    }
+    peek() {
+        return this.src[this.pos];
+    }
+    eof() {
+        return this.pos >= this.src.length;
+    }
+    skipSP() {
+        while (this.src[this.pos] === ' ')
+            this.pos++;
+    }
+    skipOWS() {
+        while (this.src[this.pos] === ' ' || this.src[this.pos] === '\t')
+            this.pos++;
+    }
+    expect(ch) {
+        if (this.src[this.pos] !== ch) {
+            throw new Error(`expected "${ch}" at offset ${this.pos}`);
+        }
+        this.pos++;
+    }
+}
+function parseKey(c) {
+    const start = c.pos;
+    while (!c.eof() && /[a-z0-9_\-.*]/.test(c.peek()))
+        c.pos++;
+    const key = c.src.slice(start, c.pos);
+    if (!KEY_RE.test(key))
+        throw new Error(`invalid key at offset ${start}`);
+    return key;
+}
+function parseString(c) {
+    c.expect('"');
+    let out = '';
+    for (;;) {
+        const ch = c.peek();
+        if (ch === undefined)
+            throw new Error('unterminated string');
+        c.pos++;
+        if (ch === '"')
+            return out;
+        if (ch === '\\') {
+            const next = c.peek();
+            if (next !== '"' && next !== '\\')
+                throw new Error('invalid string escape');
+            out += next;
+            c.pos++;
+            continue;
+        }
+        const code = ch.charCodeAt(0);
+        if (code < 0x20 || code > 0x7e)
+            throw new Error('invalid character in string');
+        out += ch;
+    }
+}
+function parseInteger(c) {
+    const start = c.pos;
+    if (c.peek() === '-')
+        c.pos++;
+    const digitsStart = c.pos;
+    while (!c.eof() && /[0-9]/.test(c.peek()))
+        c.pos++;
+    const digits = c.pos - digitsStart;
+    if (digits === 0 || digits > 15)
+        throw new Error(`invalid integer at offset ${start}`);
+    if (c.peek() === '.')
+        throw new Error('decimals are not allowed here');
+    return Number(c.src.slice(start, c.pos));
+}
+function parseParams(c) {
+    const params = [];
+    const seen = new Set();
+    while (c.peek() === ';') {
+        c.pos++;
+        c.skipSP();
+        const key = parseKey(c);
+        if (seen.has(key))
+            throw new Error(`duplicate parameter "${key}"`);
+        seen.add(key);
+        const type = PARAM_TYPES[key];
+        if (!type)
+            throw new Error(`unsupported signature parameter "${key}"`);
+        c.expect('=');
+        const value = type === 'integer' ? parseInteger(c) : parseString(c);
+        params.push([key, value]);
+    }
+    return params;
+}
+/** Split a structured-field dictionary into raw `[key, valueText]` members. */
+function parseDictionary(field, parseValue) {
+    const c = new Cursor(field.trim());
+    const out = new Map();
+    if (c.eof())
+        throw new Error('empty dictionary');
+    for (;;) {
+        const key = parseKey(c);
+        if (out.has(key))
+            throw new Error(`duplicate dictionary member "${key}"`);
+        c.expect('=');
+        out.set(key, parseValue(c));
+        c.skipOWS();
+        if (c.eof())
+            return out;
+        c.expect(',');
+        c.skipOWS();
+        if (c.eof())
+            throw new Error('trailing comma in dictionary');
+    }
+}
+function parseInnerList(c) {
+    c.expect('(');
+    const components = [];
+    c.skipSP();
+    while (c.peek() !== ')') {
+        if (c.eof())
+            throw new Error('unterminated inner list');
+        components.push(parseString(c));
+        if (c.peek() === ';')
+            throw new Error('component parameters are not supported');
+        const before = c.pos;
+        c.skipSP();
+        if (c.peek() !== ')' && c.pos === before) {
+            throw new Error('inner list items must be separated by a space');
+        }
+    }
+    c.pos++;
+    return { components, params: parseParams(c) };
+}
+function parseByteSequence(c) {
+    c.expect(':');
+    const start = c.pos;
+    while (!c.eof() && c.peek() !== ':')
+        c.pos++;
+    const b64 = c.src.slice(start, c.pos);
+    c.expect(':');
+    if (c.peek() === ';')
+        throw new Error('signature parameters are not supported');
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0) {
+        throw new Error('invalid base64 in byte sequence');
+    }
+    return new Uint8Array(Buffer.from(b64, 'base64'));
+}
+/** Parse every member of a Signature-Input field. Throws on malformed input. */
+export function parseSignatureInputField(field) {
+    const raw = parseDictionary(field, parseInnerList);
+    const out = new Map();
+    for (const [label, value] of raw)
+        out.set(label, { label, ...value });
+    return out;
+}
+/** Parse every member of a Signature field. Throws on malformed input. */
+export function parseSignatureField(field) {
+    return parseDictionary(field, parseByteSequence);
+}
+/** Serialize a string as an RFC 8941 sf-string. */
+export function serializeString(value) {
+    if (!/^[\x20-\x7e]*$/.test(value)) {
+        throw new Error('structured-field strings must be printable ASCII');
+    }
+    return `"${value.replace(/[\\"]/g, (m) => `\\${m}`)}"`;
+}
+/** Serialize the inner list + parameters, i.e. the `@signature-params` value. */
+export function serializeSignatureParams(components, params) {
+    const list = `(${components.map(serializeString).join(' ')})`;
+    const rendered = params.map(([key, value]) => {
+        if (!KEY_RE.test(key))
+            throw new Error(`invalid parameter name "${key}"`);
+        if (typeof value === 'number') {
+            if (!Number.isInteger(value) || Math.abs(value) > MAX_INTEGER) {
+                throw new Error(`parameter "${key}" must be an integer`);
+            }
+            return `;${key}=${value}`;
+        }
+        return `;${key}=${serializeString(value)}`;
+    });
+    return list + rendered.join('');
+}
+/** Validate a dictionary key (signature label). */
+export function assertLabel(label) {
+    if (!KEY_RE.test(label))
+        throw new Error(`invalid signature label "${label}"`);
+}
+//# sourceMappingURL=rfc9421-fields.js.map

package/dist/visa-tap/rfc9421-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc9421-fields.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,qEAAqE;AACrE,MAAM,WAAW,GAAyC;IACxD,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,MAAM;IAEW;IADrB,GAAG,GAAG,CAAC,CAAC;IACR,YAAqB,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IACpC,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,GAAG;QACD,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IACrC,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,EAAU;QACf,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACb,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAY,CAAC;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC,CAAC,GAAG,EAAE,CAAC;QACR,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC5E,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,CAAC,GAAG,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/E,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAY,CAAC;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC;IACnC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,EAAE,CAAC;QACR,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CACtB,KAAa,EACb,UAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,IAAI,CAAC,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC;IACX,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,CAAC,CAAC,GAAG,EAAE,CAAC;IACR,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChF,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,eAAe,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CACtC,UAA6B,EAC7B,MAA6D;IAE7D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,sBAAsB,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/visa-tap/rfc9421.d.ts

@@ -1,19 +1,37 @@
 /**
- * RFC 9421 HTTP Message Signatures
+ * RFC 9421 HTTP Message Signatures (Ed25519)
  *
- * Implements cryptographic signing and verification of HTTP requests per RFC 9421
+ * The signer lists every component it signs, in signing order, in the
+ * `Signature-Input` field, and the `@signature-params` line of the signature
+ * base is byte-identical to that field's value, so any RFC 9421 verifier can
+ * rebuild the same base. The verifier is driven by the received
+ * `Signature-Input`: it rebuilds the base in the listed order, refuses
+ * components the caller relies on but the signer did not cover, and checks
+ * `created`, `expires` and `alg`.
  */
-import type { SignatureComponents, SignedHttpMessage } from './types.js';
+import type { SignatureComponents, SignedHttpMessage, SignHttpMessageOptions, VerifiableHttpSignature, VerifyHttpSignatureOptions } from './types.js';
 /**
- * Sign HTTP message per RFC 9421
+ * Sign an HTTP request per RFC 9421 with Ed25519.
+ *
+ * Covers `@method`, `@authority`, `@path`, then `content-digest` when
+ * `contentDigest` is given, then every entry of `headers` in insertion order.
+ * All of them are listed, in that order, in `Signature-Input`.
  */
-export declare function signHttpMessage(components: SignatureComponents, privateKeyHex: string, keyId: string): Promise<SignedHttpMessage>;
+export declare function signHttpMessage(components: SignatureComponents, privateKeyHex: string, keyId: string, options?: SignHttpMessageOptions): Promise<SignedHttpMessage>;
 /**
- * Verify RFC 9421 HTTP signature
+ * Verify an RFC 9421 Ed25519 signature on an HTTP request.
+ *
+ * `components` is the verifier's view of the received request. The signature
+ * base is rebuilt from the received `Signature-Input` (its order, its
+ * parameters). Verification fails unless every supplied component, including
+ * `contentDigest` and every entry of `headers`, is covered, `created` is
+ * present and no older than `maxAgeSeconds` (and not in the future beyond the
+ * clock skew), `expires` (if present) has not passed, and `alg` (if present)
+ * is `ed25519`. Never throws; returns false on any failure.
  *
- * @param maxAgeSeconds - Maximum age of signature in seconds (default: 300 = 5 minutes)
+ * @param maxAgeSeconds - Maximum age of the signature in seconds (default 300)
  */
-export declare function verifyHttpSignature(components: SignatureComponents, signed: SignedHttpMessage, publicKeyHex: string, maxAgeSeconds?: number): Promise<boolean>;
+export declare function verifyHttpSignature(components: SignatureComponents, signed: VerifiableHttpSignature, publicKeyHex: string, maxAgeSeconds?: number, options?: VerifyHttpSignatureOptions): Promise<boolean>;
 /**
  * Compute content digest (SHA-256)
  */

package/dist/visa-tap/rfc9421.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEzE;;GAEG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CA2C5B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,iBAAiB,EACzB,YAAY,EAAE,MAAM,EACpB,aAAa,GAAE,MAAY,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAI7D"}
+{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AA4EpB;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAqED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,EAAE,MAAM,EACpB,aAAa,GAAE,MAAY,EAC3B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAwBlB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAI7D"}