agentic-payments 0.1.15 → 0.1.16

package/README.md

@@ -653,10 +653,18 @@ const signed = await signHttpMessage(
   'did:agent:shopping-bot'
 );
 
-// Send with your HTTPS client, carrying signed.signature / signed.signatureInput
-// headers, and treat the payment as submitted only when the merchant confirms it.
+// Send with your HTTPS client, carrying the Content-Digest header plus
+// Signature: signed.signature and Signature-Input: signed.signatureInput, and
+// treat the payment as submitted only when the merchant confirms it.
 ```
 
+`Signature-Input` lists every signed component in signing order (`@method`,
+`@authority`, `@path`, then `content-digest` and any `headers`) with
+`created`, `expires` (default 5 minutes), `nonce`, `keyid` and `alg="ed25519"`,
+so any RFC 9421 verifier can check it. The package is tested against the
+independent `http-message-signatures` implementation and the RFC 9421
+Appendix B.2.6 Ed25519 test vector.
+
 There is no working QUIC transport: see [Visa TAP transport](#visa-tap-quic-transport).
 
 ### Agent Fleet Management
@@ -1022,12 +1030,25 @@ Production deployment guidelines for secure payment authorization:
 
 ### Signature Validation
 
-**RFC 9421 Timestamp Checks**:
+**RFC 9421 Verification**:
 ```typescript
-// verifyHttpSignature includes timestamp validation (default: 5 minutes)
-const isValid = await verifyHttpSignature(components, signed, publicKey, 300);
+// components: your view of the received request. Every component you pass,
+// including contentDigest and each entry of headers, must be covered by the
+// received Signature-Input or verification fails.
+const isValid = await verifyHttpSignature(
+  components,
+  { signatureInput: req.headers['signature-input'], signature: req.headers['signature'] },
+  publicKeyHex,
+  300, // max age of created, in seconds
+  { expectedKeyId: 'did:agent:shopping-bot' }
+);
 ```
 
+The signature base is rebuilt from the received `Signature-Input`, in its
+order. Verification fails when `created` is missing, older than the max age or
+in the future (30 s skew), when `expires` has passed, when `alg` is not
+`ed25519`, or when a covered component is unsupported or unavailable.
+
 **Replay Protection**:
 - Nonce-based replay prevention (16-byte cryptographic nonces)
 - Timestamp validation (configurable max age, default 300 seconds)

package/dist/index.d.ts

@@ -51,6 +51,7 @@ export type { IntentMandateData, CartMandateData, PaymentMandateData, CartItem,
 export { PaymentError, PaymentErrorCode, isRecoverable, getErrorCode, formatError, AgenticPaymentError, CryptoError, ValidationError, ConsensusError, SystemError, WasmInitError, ErrorCode, } from './errors.js';
 export { VisaTapQuicTransport, createQuicTransport, getQuicTransportStatus, QuicTransportUnavailableError, PaymentNotDeliveredError, } from './visa-tap/index.js';
 export { signHttpMessage, verifyHttpSignature, computeContentDigest } from './visa-tap/index.js';
+export type { SignatureComponents, SignedHttpMessage, VerifiableHttpSignature, SignHttpMessageOptions, VerifyHttpSignatureOptions, } from './visa-tap/index.js';
 export { TAP_VERSION, DEFAULT_QUIC_PORT, MAX_MANDATE_LIFETIME_SECS } from './visa-tap/index.js';
 export declare const VERSION = "1.0.0";
 /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1E,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW,EAEX,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGhG,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,OAAO,IAAI;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAeA;;;;;AAGD,wBAGE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEvD,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1E,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,QAAQ,EACR,gBAAgB,GACjB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW,EAEX,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,aAAa,CAAC;AAIrB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjG,YAAY,EACV,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAGhG,eAAO,MAAM,OAAO,UAAU,CAAC;AAE/B;;;;GAIG;AACH,wBAAgB,OAAO,IAAI;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAeA;;;;;AAGD,wBAGE"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,eAAe;AACf,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAS1E,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW;AACX,iBAAiB;AACjB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,mFAAmF;AACnF,kFAAkF;AAClF,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,sBAAsB;AACtB,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,OAAO;IAKrB,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,cAAc,EAAE,mBAAmB;QACnC,QAAQ,EAAE;YACR,oBAAoB;YACpB,uBAAuB;YACvB,2BAA2B;YAC3B,iBAAiB;YACjB,eAAe;YACf,kBAAkB;YAClB,yBAAyB;YACzB,iBAAiB;SAClB;KACF,CAAC;AACJ,CAAC;AAED,iBAAiB;AACjB,eAAe;IACb,OAAO;IACP,OAAO;CACR,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,eAAe;AACf,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAS1E,gBAAgB;AAChB,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,WAAW;AACX,iBAAiB;AACjB,mBAAmB,EACnB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,EACX,aAAa,EACb,SAAS,GACV,MAAM,aAAa,CAAC;AAErB,mFAAmF;AACnF,kFAAkF;AAClF,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAQjG,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAEhG,sBAAsB;AACtB,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B;;;;GAIG;AACH,MAAM,UAAU,OAAO;IAKrB,OAAO;QACL,OAAO,EAAE,OAAO;QAChB,cAAc,EAAE,mBAAmB;QACnC,QAAQ,EAAE;YACR,oBAAoB;YACpB,uBAAuB;YACvB,2BAA2B;YAC3B,iBAAiB;YACjB,eAAe;YACf,kBAAkB;YAClB,yBAAyB;YACzB,iBAAiB;SAClB;KACF,CAAC;AACJ,CAAC;AAED,iBAAiB;AACjB,eAAe;IACb,OAAO;IACP,OAAO;CACR,CAAC"}

package/dist/visa-tap/index.d.ts

@@ -23,7 +23,7 @@
 export { validateAndVerify, guardExecution, revoke, isRevoked, getAllRevocations, type SignedMandate, type VerificationResult, type ExecutionGuard, type RevocationRecord, } from '../active-mandate/index.js';
 export { VisaTapQuicTransport, createQuicTransport, loadQuicTransport, getQuicTransportStatus, QuicTransportUnavailableError, PaymentNotDeliveredError, QUIC_UNAVAILABLE, PAYMENT_NOT_DELIVERED, AGENTIC_FLOW_PEER_RANGE, type QuicTransportStatus, } from './quic-transport.js';
 export { signHttpMessage, verifyHttpSignature, computeContentDigest, } from './rfc9421.js';
-export type { Period, MandateKind, ActiveMandatePayload, SignedActiveMandate, SignatureComponents, SignedHttpMessage, QuicConfig, QuicStats, PaymentResponse, } from './types.js';
+export type { Period, MandateKind, ActiveMandatePayload, SignedActiveMandate, SignatureComponents, SignedHttpMessage, VerifiableHttpSignature, SignHttpMessageOptions, VerifyHttpSignatureOptions, QuicConfig, QuicStats, PaymentResponse, } from './types.js';
 /**
  * Visa TAP protocol version
  */

package/dist/visa-tap/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/visa-tap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,SAAS,EACT,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,MAAM,EACN,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,eAAO,MAAM,WAAW,QAAQ,CAAC;AAEjC;;GAEG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/visa-tap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,SAAS,EACT,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAGtB,YAAY,EACV,MAAM,EACN,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,sBAAsB,EACtB,0BAA0B,EAC1B,UAAU,EACV,SAAS,EACT,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,eAAO,MAAM,WAAW,QAAQ,CAAC;AAEjC;;GAEG;AACH,eAAO,MAAM,iBAAiB,OAAO,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAmB,CAAC"}

package/dist/visa-tap/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/visa-tap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,kDAAkD;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,SAAS,EACT,iBAAiB,GAKlB,MAAM,4BAA4B,CAAC;AAEpC,wBAAwB;AACxB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAetB;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAEjC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/visa-tap/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,kDAAkD;AAClD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,SAAS,EACT,iBAAiB,GAKlB,MAAM,4BAA4B,CAAC;AAEpC,wBAAwB;AACxB,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AAkBtB;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAEjC;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAEtC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC"}

package/dist/visa-tap/rfc9421-fields.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Strict parsing and serialization of the RFC 9421 `Signature-Input` and
+ * `Signature` fields (RFC 8941 structured-field dictionaries).
+ *
+ * Only the subset RFC 9421 needs is accepted: dictionary members whose value
+ * is an inner list of component identifiers (Signature-Input) or a byte
+ * sequence (Signature). Anything else is rejected rather than guessed at.
+ */
+/** A signature parameter value (RFC 9421 §2.3). */
+export type SignatureParamValue = number | string;
+/** A parsed Signature-Input member. */
+export interface ParsedSignatureInput {
+    label: string;
+    /** Covered component identifiers, in the order they were listed. */
+    components: string[];
+    /** Signature parameters, in the order they were listed. */
+    params: Array<[string, SignatureParamValue]>;
+}
+/** Parse every member of a Signature-Input field. Throws on malformed input. */
+export declare function parseSignatureInputField(field: string): Map<string, ParsedSignatureInput>;
+/** Parse every member of a Signature field. Throws on malformed input. */
+export declare function parseSignatureField(field: string): Map<string, Uint8Array>;
+/** Serialize a string as an RFC 8941 sf-string. */
+export declare function serializeString(value: string): string;
+/** Serialize the inner list + parameters, i.e. the `@signature-params` value. */
+export declare function serializeSignatureParams(components: readonly string[], params: ReadonlyArray<readonly [string, SignatureParamValue]>): string;
+/** Validate a dictionary key (signature label). */
+export declare function assertLabel(label: string): void;
+//# sourceMappingURL=rfc9421-fields.d.ts.map

package/dist/visa-tap/rfc9421-fields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc9421-fields.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,mDAAmD;AACnD,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAC;AAElD,uCAAuC;AACvC,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;CAC9C;AAoJD,gFAAgF;AAChF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAKzF;AAED,0EAA0E;AAC1E,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAE1E;AAED,mDAAmD;AACnD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,iFAAiF;AACjF,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,GAC5D,MAAM,CAaR;AAED,mDAAmD;AACnD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAE/C"}

package/dist/visa-tap/rfc9421-fields.js

@@ -0,0 +1,207 @@
+/**
+ * Strict parsing and serialization of the RFC 9421 `Signature-Input` and
+ * `Signature` fields (RFC 8941 structured-field dictionaries).
+ *
+ * Only the subset RFC 9421 needs is accepted: dictionary members whose value
+ * is an inner list of component identifiers (Signature-Input) or a byte
+ * sequence (Signature). Anything else is rejected rather than guessed at.
+ */
+/** Parameters RFC 9421 §2.3 defines, and the type each must have. */
+const PARAM_TYPES = {
+    created: 'integer',
+    expires: 'integer',
+    nonce: 'string',
+    alg: 'string',
+    keyid: 'string',
+    tag: 'string',
+};
+const KEY_RE = /^[a-z*][a-z0-9_\-.*]*$/;
+const MAX_INTEGER = 999_999_999_999_999;
+class Cursor {
+    src;
+    pos = 0;
+    constructor(src) {
+        this.src = src;
+    }
+    peek() {
+        return this.src[this.pos];
+    }
+    eof() {
+        return this.pos >= this.src.length;
+    }
+    skipSP() {
+        while (this.src[this.pos] === ' ')
+            this.pos++;
+    }
+    skipOWS() {
+        while (this.src[this.pos] === ' ' || this.src[this.pos] === '\t')
+            this.pos++;
+    }
+    expect(ch) {
+        if (this.src[this.pos] !== ch) {
+            throw new Error(`expected "${ch}" at offset ${this.pos}`);
+        }
+        this.pos++;
+    }
+}
+function parseKey(c) {
+    const start = c.pos;
+    while (!c.eof() && /[a-z0-9_\-.*]/.test(c.peek()))
+        c.pos++;
+    const key = c.src.slice(start, c.pos);
+    if (!KEY_RE.test(key))
+        throw new Error(`invalid key at offset ${start}`);
+    return key;
+}
+function parseString(c) {
+    c.expect('"');
+    let out = '';
+    for (;;) {
+        const ch = c.peek();
+        if (ch === undefined)
+            throw new Error('unterminated string');
+        c.pos++;
+        if (ch === '"')
+            return out;
+        if (ch === '\\') {
+            const next = c.peek();
+            if (next !== '"' && next !== '\\')
+                throw new Error('invalid string escape');
+            out += next;
+            c.pos++;
+            continue;
+        }
+        const code = ch.charCodeAt(0);
+        if (code < 0x20 || code > 0x7e)
+            throw new Error('invalid character in string');
+        out += ch;
+    }
+}
+function parseInteger(c) {
+    const start = c.pos;
+    if (c.peek() === '-')
+        c.pos++;
+    const digitsStart = c.pos;
+    while (!c.eof() && /[0-9]/.test(c.peek()))
+        c.pos++;
+    const digits = c.pos - digitsStart;
+    if (digits === 0 || digits > 15)
+        throw new Error(`invalid integer at offset ${start}`);
+    if (c.peek() === '.')
+        throw new Error('decimals are not allowed here');
+    return Number(c.src.slice(start, c.pos));
+}
+function parseParams(c) {
+    const params = [];
+    const seen = new Set();
+    while (c.peek() === ';') {
+        c.pos++;
+        c.skipSP();
+        const key = parseKey(c);
+        if (seen.has(key))
+            throw new Error(`duplicate parameter "${key}"`);
+        seen.add(key);
+        const type = PARAM_TYPES[key];
+        if (!type)
+            throw new Error(`unsupported signature parameter "${key}"`);
+        c.expect('=');
+        const value = type === 'integer' ? parseInteger(c) : parseString(c);
+        params.push([key, value]);
+    }
+    return params;
+}
+/** Split a structured-field dictionary into raw `[key, valueText]` members. */
+function parseDictionary(field, parseValue) {
+    const c = new Cursor(field.trim());
+    const out = new Map();
+    if (c.eof())
+        throw new Error('empty dictionary');
+    for (;;) {
+        const key = parseKey(c);
+        if (out.has(key))
+            throw new Error(`duplicate dictionary member "${key}"`);
+        c.expect('=');
+        out.set(key, parseValue(c));
+        c.skipOWS();
+        if (c.eof())
+            return out;
+        c.expect(',');
+        c.skipOWS();
+        if (c.eof())
+            throw new Error('trailing comma in dictionary');
+    }
+}
+function parseInnerList(c) {
+    c.expect('(');
+    const components = [];
+    c.skipSP();
+    while (c.peek() !== ')') {
+        if (c.eof())
+            throw new Error('unterminated inner list');
+        components.push(parseString(c));
+        if (c.peek() === ';')
+            throw new Error('component parameters are not supported');
+        const before = c.pos;
+        c.skipSP();
+        if (c.peek() !== ')' && c.pos === before) {
+            throw new Error('inner list items must be separated by a space');
+        }
+    }
+    c.pos++;
+    return { components, params: parseParams(c) };
+}
+function parseByteSequence(c) {
+    c.expect(':');
+    const start = c.pos;
+    while (!c.eof() && c.peek() !== ':')
+        c.pos++;
+    const b64 = c.src.slice(start, c.pos);
+    c.expect(':');
+    if (c.peek() === ';')
+        throw new Error('signature parameters are not supported');
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0) {
+        throw new Error('invalid base64 in byte sequence');
+    }
+    return new Uint8Array(Buffer.from(b64, 'base64'));
+}
+/** Parse every member of a Signature-Input field. Throws on malformed input. */
+export function parseSignatureInputField(field) {
+    const raw = parseDictionary(field, parseInnerList);
+    const out = new Map();
+    for (const [label, value] of raw)
+        out.set(label, { label, ...value });
+    return out;
+}
+/** Parse every member of a Signature field. Throws on malformed input. */
+export function parseSignatureField(field) {
+    return parseDictionary(field, parseByteSequence);
+}
+/** Serialize a string as an RFC 8941 sf-string. */
+export function serializeString(value) {
+    if (!/^[\x20-\x7e]*$/.test(value)) {
+        throw new Error('structured-field strings must be printable ASCII');
+    }
+    return `"${value.replace(/[\\"]/g, (m) => `\\${m}`)}"`;
+}
+/** Serialize the inner list + parameters, i.e. the `@signature-params` value. */
+export function serializeSignatureParams(components, params) {
+    const list = `(${components.map(serializeString).join(' ')})`;
+    const rendered = params.map(([key, value]) => {
+        if (!KEY_RE.test(key))
+            throw new Error(`invalid parameter name "${key}"`);
+        if (typeof value === 'number') {
+            if (!Number.isInteger(value) || Math.abs(value) > MAX_INTEGER) {
+                throw new Error(`parameter "${key}" must be an integer`);
+            }
+            return `;${key}=${value}`;
+        }
+        return `;${key}=${serializeString(value)}`;
+    });
+    return list + rendered.join('');
+}
+/** Validate a dictionary key (signature label). */
+export function assertLabel(label) {
+    if (!KEY_RE.test(label))
+        throw new Error(`invalid signature label "${label}"`);
+}
+//# sourceMappingURL=rfc9421-fields.js.map

package/dist/visa-tap/rfc9421-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc9421-fields.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421-fields.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,qEAAqE;AACrE,MAAM,WAAW,GAAyC;IACxD,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAExC,MAAM,MAAM;IAEW;IADrB,GAAG,GAAG,CAAC,CAAC;IACR,YAAqB,GAAW;QAAX,QAAG,GAAH,GAAG,CAAQ;IAAG,CAAC;IACpC,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,GAAG;QACD,OAAO,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;IACrC,CAAC;IACD,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAChD,CAAC;IACD,OAAO;QACL,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,EAAU;QACf,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,aAAa,EAAE,eAAe,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,CAAC;IACb,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAY,CAAC;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC7D,CAAC,CAAC,GAAG,EAAE,CAAC;QACR,IAAI,EAAE,KAAK,GAAG;YAAE,OAAO,GAAG,CAAC;QAC3B,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;YAC5E,GAAG,IAAI,IAAI,CAAC;YACZ,CAAC,CAAC,GAAG,EAAE,CAAC;YACR,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC/E,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC;IAC1B,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAY,CAAC;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC;IACnC,IAAI,MAAM,KAAK,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,EAAE,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC,CAAC,GAAG,EAAE,CAAC;QACR,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,GAAG,CAAC,CAAC;QACvE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,KAAK,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+EAA+E;AAC/E,SAAS,eAAe,CACtB,KAAa,EACb,UAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAa,CAAC;IACjC,IAAI,CAAC,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACjD,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;QAC1E,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,OAAO,GAAG,CAAC;QACxB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,CAAC,CAAC,MAAM,EAAE,CAAC;IACX,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACxD,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,CAAC,CAAC,GAAG,EAAE,CAAC;IACR,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS;IAClC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC;IACpB,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACd,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChF,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,wBAAwB,CAAC,KAAa;IACpD,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgC,CAAC;IACpD,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,eAAe,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;AACnD,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;AACzD,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,wBAAwB,CACtC,UAA6B,EAC7B,MAA6D;IAE7D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAC;QAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,sBAAsB,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/visa-tap/rfc9421.d.ts

@@ -1,19 +1,37 @@
 /**
- * RFC 9421 HTTP Message Signatures
+ * RFC 9421 HTTP Message Signatures (Ed25519)
  *
- * Implements cryptographic signing and verification of HTTP requests per RFC 9421
+ * The signer lists every component it signs, in signing order, in the
+ * `Signature-Input` field, and the `@signature-params` line of the signature
+ * base is byte-identical to that field's value, so any RFC 9421 verifier can
+ * rebuild the same base. The verifier is driven by the received
+ * `Signature-Input`: it rebuilds the base in the listed order, refuses
+ * components the caller relies on but the signer did not cover, and checks
+ * `created`, `expires` and `alg`.
  */
-import type { SignatureComponents, SignedHttpMessage } from './types.js';
+import type { SignatureComponents, SignedHttpMessage, SignHttpMessageOptions, VerifiableHttpSignature, VerifyHttpSignatureOptions } from './types.js';
 /**
- * Sign HTTP message per RFC 9421
+ * Sign an HTTP request per RFC 9421 with Ed25519.
+ *
+ * Covers `@method`, `@authority`, `@path`, then `content-digest` when
+ * `contentDigest` is given, then every entry of `headers` in insertion order.
+ * All of them are listed, in that order, in `Signature-Input`.
  */
-export declare function signHttpMessage(components: SignatureComponents, privateKeyHex: string, keyId: string): Promise<SignedHttpMessage>;
+export declare function signHttpMessage(components: SignatureComponents, privateKeyHex: string, keyId: string, options?: SignHttpMessageOptions): Promise<SignedHttpMessage>;
 /**
- * Verify RFC 9421 HTTP signature
+ * Verify an RFC 9421 Ed25519 signature on an HTTP request.
+ *
+ * `components` is the verifier's view of the received request. The signature
+ * base is rebuilt from the received `Signature-Input` (its order, its
+ * parameters). Verification fails unless every supplied component, including
+ * `contentDigest` and every entry of `headers`, is covered, `created` is
+ * present and no older than `maxAgeSeconds` (and not in the future beyond the
+ * clock skew), `expires` (if present) has not passed, and `alg` (if present)
+ * is `ed25519`. Never throws; returns false on any failure.
  *
- * @param maxAgeSeconds - Maximum age of signature in seconds (default: 300 = 5 minutes)
+ * @param maxAgeSeconds - Maximum age of the signature in seconds (default 300)
  */
-export declare function verifyHttpSignature(components: SignatureComponents, signed: SignedHttpMessage, publicKeyHex: string, maxAgeSeconds?: number): Promise<boolean>;
+export declare function verifyHttpSignature(components: SignatureComponents, signed: VerifiableHttpSignature, publicKeyHex: string, maxAgeSeconds?: number, options?: VerifyHttpSignatureOptions): Promise<boolean>;
 /**
  * Compute content digest (SHA-256)
  */

package/dist/visa-tap/rfc9421.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEzE;;GAEG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CA2C5B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,iBAAiB,EACzB,YAAY,EAAE,MAAM,EACpB,aAAa,GAAE,MAAY,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAI7D"}
+{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EACV,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,0BAA0B,EAC3B,MAAM,YAAY,CAAC;AA4EpB;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,iBAAiB,CAAC,CAkC5B;AAqED;;;;;;;;;;;;GAYG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,uBAAuB,EAC/B,YAAY,EAAE,MAAM,EACpB,aAAa,GAAE,MAAY,EAC3B,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,OAAO,CAAC,CAwBlB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAI7D"}

package/dist/visa-tap/rfc9421.js

@@ -1,95 +1,212 @@
 /**
- * RFC 9421 HTTP Message Signatures
+ * RFC 9421 HTTP Message Signatures (Ed25519)
  *
- * Implements cryptographic signing and verification of HTTP requests per RFC 9421
+ * The signer lists every component it signs, in signing order, in the
+ * `Signature-Input` field, and the `@signature-params` line of the signature
+ * base is byte-identical to that field's value, so any RFC 9421 verifier can
+ * rebuild the same base. The verifier is driven by the received
+ * `Signature-Input`: it rebuilds the base in the listed order, refuses
+ * components the caller relies on but the signer did not cover, and checks
+ * `created`, `expires` and `alg`.
  */
 import { sha256 } from '@noble/hashes/sha256';
+import { sha512 } from '@noble/hashes/sha512';
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
 import * as ed25519 from '@noble/ed25519';
+import { assertLabel, parseSignatureField, parseSignatureInputField, serializeSignatureParams, serializeString, } from './rfc9421-fields.js';
+ed25519.etc.sha512Sync = (...m) => sha512(ed25519.etc.concatBytes(...m));
+const ALG = 'ed25519';
+const DEFAULT_LABEL = 'sig1';
+const DEFAULT_EXPIRES_IN = 300;
+const DEFAULT_CLOCK_SKEW = 30;
+/** Derived components this implementation can resolve, in signing order. */
+const DERIVED = ['@method', '@authority', '@path'];
+const FIELD_NAME_RE = /^[a-z0-9!#$%&'*+.^_`|~-]+$/;
+function assertFieldValue(name, value) {
+    if (/[\r\n\0]/.test(value)) {
+        throw new Error(`component "${name}" contains CR, LF or NUL`);
+    }
+    return value.trim();
+}
 /**
- * Sign HTTP message per RFC 9421
+ * Resolve the caller's view of the message into canonical component values.
+ * Field names are lowercased; a name supplied twice (in any case) is an error.
  */
-export async function signHttpMessage(components, privateKeyHex, keyId) {
-    const nonce = generateNonce();
-    const created = Math.floor(Date.now() / 1000);
-    // Build signature base
-    const baseParts = [
-        `"@method": ${components.method}`,
-        `"@authority": ${components.authority}`,
-        `"@path": ${components.path}`,
-    ];
-    if (components.contentDigest) {
-        baseParts.push(`"content-digest": ${components.contentDigest}`);
+function resolveComponents(components) {
+    const values = new Map();
+    const method = assertFieldValue('@method', components.method);
+    const authority = assertFieldValue('@authority', components.authority).toLowerCase();
+    let path = assertFieldValue('@path', components.path);
+    if (path === '')
+        path = '/';
+    if (!method || !authority)
+        throw new Error('@method and @authority must be non-empty');
+    if (!path.startsWith('/') || path.includes('?')) {
+        throw new Error('@path must be an absolute path without a query');
     }
-    if (components.headers) {
-        for (const [name, value] of Object.entries(components.headers)) {
-            baseParts.push(`"${name.toLowerCase()}": ${value}`);
-        }
+    values.set('@method', method);
+    values.set('@authority', authority);
+    values.set('@path', path);
+    if (components.contentDigest !== undefined) {
+        values.set('content-digest', assertFieldValue('content-digest', components.contentDigest));
+    }
+    for (const [rawName, rawValue] of Object.entries(components.headers ?? {})) {
+        const name = rawName.toLowerCase();
+        if (!FIELD_NAME_RE.test(name))
+            throw new Error(`invalid header name "${rawName}"`);
+        if (values.has(name))
+            throw new Error(`header "${name}" is supplied more than once`);
+        values.set(name, assertFieldValue(name, rawValue));
+    }
+    return values;
+}
+function buildSignatureBase(covered, values, signatureParams) {
+    const lines = covered.map((name) => {
+        const value = values.get(name);
+        if (value === undefined)
+            throw new Error(`covered component "${name}" is not available`);
+        return `${serializeString(name)}: ${value}`;
+    });
+    lines.push(`"@signature-params": ${signatureParams}`);
+    return lines.join('\n');
+}
+/**
+ * Sign an HTTP request per RFC 9421 with Ed25519.
+ *
+ * Covers `@method`, `@authority`, `@path`, then `content-digest` when
+ * `contentDigest` is given, then every entry of `headers` in insertion order.
+ * All of them are listed, in that order, in `Signature-Input`.
+ */
+export async function signHttpMessage(components, privateKeyHex, keyId, options = {}) {
+    const label = options.label ?? DEFAULT_LABEL;
+    assertLabel(label);
+    const values = resolveComponents(components);
+    const covered = [...values.keys()];
+    const created = options.created ?? Math.floor(Date.now() / 1000);
+    const expiresIn = options.expiresInSeconds ?? DEFAULT_EXPIRES_IN;
+    if (!Number.isInteger(created) || created < 0)
+        throw new Error('created must be a non-negative integer');
+    if (!Number.isInteger(expiresIn) || expiresIn < 0) {
+        throw new Error('expiresInSeconds must be a non-negative integer');
     }
-    // Add signature parameters
-    baseParts.push(`"@signature-params": ("@method" "@authority" "@path");created=${created};nonce="${nonce}";keyid="${keyId}"`);
-    const signatureBase = baseParts.join('\n');
-    // Sign with Ed25519
-    const privateKey = hexToBytes(privateKeyHex);
-    const messageBytes = new TextEncoder().encode(signatureBase);
-    const signatureBytes = await ed25519.sign(messageBytes, privateKey);
+    const expires = expiresIn > 0 ? created + expiresIn : undefined;
+    const nonce = options.nonce ?? generateNonce();
+    const params = [['created', created]];
+    if (expires !== undefined)
+        params.push(['expires', expires]);
+    params.push(['nonce', nonce], ['keyid', keyId], ['alg', ALG]);
+    if (options.tag !== undefined)
+        params.push(['tag', options.tag]);
+    const signatureParams = serializeSignatureParams(covered, params);
+    const signatureBase = buildSignatureBase(covered, values, signatureParams);
+    const signatureBytes = ed25519.sign(new TextEncoder().encode(signatureBase), hexToBytes(privateKeyHex));
     const signatureB64 = Buffer.from(signatureBytes).toString('base64');
-    // Build Signature-Input header
-    const signatureInput = `sig1=("@method" "@authority" "@path");created=${created};nonce="${nonce}";keyid="${keyId}";alg="ed25519"`;
     return {
-        signatureInput,
-        signature: `sig1=:${signatureB64}:`,
+        signatureInput: `${label}=${signatureParams}`,
+        signature: `${label}=:${signatureB64}:`,
         nonce,
         created,
+        ...(expires !== undefined ? { expires } : {}),
+        coveredComponents: covered,
     };
 }
+function selectMember(members, label, field) {
+    if (label !== undefined) {
+        const value = members.get(label);
+        if (value === undefined)
+            throw new Error(`${field} has no member "${label}"`);
+        return [label, value];
+    }
+    if (members.size !== 1)
+        throw new Error(`${field} has ${members.size} members; pass options.label`);
+    return [...members.entries()][0];
+}
+function checkParams(input, signed, maxAgeSeconds, options) {
+    const params = new Map(input.params);
+    const created = params.get('created');
+    const expires = params.get('expires');
+    const alg = params.get('alg');
+    const now = options.now ?? Math.floor(Date.now() / 1000);
+    const skew = options.clockSkewSeconds ?? DEFAULT_CLOCK_SKEW;
+    if (typeof created !== 'number')
+        throw new Error('signature has no created parameter');
+    if (created > now + skew)
+        throw new Error('signature created in the future');
+    if (now - created > maxAgeSeconds)
+        throw new Error('signature is older than maxAgeSeconds');
+    if (expires !== undefined) {
+        if (typeof expires !== 'number' || expires < created)
+            throw new Error('invalid expires parameter');
+        if (now > expires + skew)
+            throw new Error('signature has expired');
+    }
+    else if (options.requireExpires) {
+        throw new Error('signature has no expires parameter');
+    }
+    if (alg !== undefined && alg !== ALG)
+        throw new Error(`unsupported alg "${String(alg)}"`);
+    if (options.expectedKeyId !== undefined && params.get('keyid') !== options.expectedKeyId) {
+        throw new Error('keyid does not match the expected key');
+    }
+    if (signed.created !== undefined && signed.created !== created) {
+        throw new Error('created does not match Signature-Input');
+    }
+    if (signed.nonce !== undefined && signed.nonce !== params.get('nonce')) {
+        throw new Error('nonce does not match Signature-Input');
+    }
+}
+function checkCoverage(covered, values, options) {
+    const seen = new Set();
+    for (const name of covered) {
+        if (seen.has(name))
+            throw new Error(`component "${name}" is listed twice`);
+        seen.add(name);
+        if (name.startsWith('@') && !DERIVED.includes(name)) {
+            throw new Error(`unsupported derived component "${name}"`);
+        }
+        if (!name.startsWith('@') && !FIELD_NAME_RE.test(name)) {
+            throw new Error(`invalid component name "${name}"`);
+        }
+    }
+    // Everything the caller relies on must be covered; nothing unlisted is trusted.
+    const required = [...values.keys(), ...(options.requiredComponents ?? []).map((n) => n.toLowerCase())];
+    for (const name of required) {
+        if (!seen.has(name))
+            throw new Error(`component "${name}" is not covered by the signature`);
+    }
+}
 /**
- * Verify RFC 9421 HTTP signature
+ * Verify an RFC 9421 Ed25519 signature on an HTTP request.
+ *
+ * `components` is the verifier's view of the received request. The signature
+ * base is rebuilt from the received `Signature-Input` (its order, its
+ * parameters). Verification fails unless every supplied component, including
+ * `contentDigest` and every entry of `headers`, is covered, `created` is
+ * present and no older than `maxAgeSeconds` (and not in the future beyond the
+ * clock skew), `expires` (if present) has not passed, and `alg` (if present)
+ * is `ed25519`. Never throws; returns false on any failure.
  *
- * @param maxAgeSeconds - Maximum age of signature in seconds (default: 300 = 5 minutes)
+ * @param maxAgeSeconds - Maximum age of the signature in seconds (default 300)
  */
-export async function verifyHttpSignature(components, signed, publicKeyHex, maxAgeSeconds = 300) {
+export async function verifyHttpSignature(components, signed, publicKeyHex, maxAgeSeconds = 300, options = {}) {
     try {
-        // Validate timestamp to prevent replay attacks
-        const now = Math.floor(Date.now() / 1000);
-        const age = Math.abs(now - signed.created);
-        if (age > maxAgeSeconds) {
-            console.error(`Signature expired: age=${age}s, max=${maxAgeSeconds}s`);
-            return false;
-        }
-        // Reconstruct signature base
-        const baseParts = [
-            `"@method": ${components.method}`,
-            `"@authority": ${components.authority}`,
-            `"@path": ${components.path}`,
-        ];
-        if (components.contentDigest) {
-            baseParts.push(`"content-digest": ${components.contentDigest}`);
-        }
-        if (components.headers) {
-            for (const [name, value] of Object.entries(components.headers)) {
-                baseParts.push(`"${name.toLowerCase()}": ${value}`);
-            }
-        }
-        // Extract keyid from signature input
-        const keyId = extractKeyId(signed.signatureInput);
-        // Add signature parameters
-        baseParts.push(`"@signature-params": ("@method" "@authority" "@path");created=${signed.created};nonce="${signed.nonce}";keyid="${keyId}"`);
-        const signatureBase = baseParts.join('\n');
-        // Extract signature bytes
-        const sigMatch = signed.signature.match(/^sig1=:(.+):$/);
-        if (!sigMatch || !sigMatch[1]) {
-            throw new Error('Invalid signature format');
-        }
-        const signatureB64 = sigMatch[1];
-        const signatureBytes = Buffer.from(signatureB64, 'base64');
-        // Verify with Ed25519
-        const publicKey = hexToBytes(publicKeyHex);
-        const messageBytes = new TextEncoder().encode(signatureBase);
-        return await ed25519.verify(signatureBytes, messageBytes, publicKey);
+        const [label, input] = selectMember(parseSignatureInputField(signed.signatureInput), options.label, 'Signature-Input');
+        const signatures = parseSignatureField(signed.signature);
+        const signatureBytes = signatures.get(label);
+        if (!signatureBytes)
+            throw new Error(`Signature has no member "${label}"`);
+        if (signatureBytes.length !== 64)
+            throw new Error('Ed25519 signatures are 64 bytes');
+        const values = resolveComponents(components);
+        checkCoverage(input.components, values, options);
+        checkParams(input, signed, maxAgeSeconds, options);
+        const signatureParams = serializeSignatureParams(input.components, input.params);
+        const signatureBase = buildSignatureBase(input.components, values, signatureParams);
+        return ed25519.verify(signatureBytes, new TextEncoder().encode(signatureBase), hexToBytes(publicKeyHex), {
+            zip215: false,
+        });
     }
-    catch (error) {
-        console.error('Signature verification failed:', error);
+    catch {
         return false;
     }
 }
@@ -109,14 +226,4 @@ function generateNonce() {
     crypto.getRandomValues(bytes);
     return bytesToHex(bytes);
 }
-/**
- * Extract keyid from Signature-Input header
- */
-function extractKeyId(signatureInput) {
-    const match = signatureInput.match(/keyid="([^"]+)"/);
-    if (!match || !match[1]) {
-        throw new Error('Missing keyid in signature-input');
-    }
-    return match[1];
-}
 //# sourceMappingURL=rfc9421.js.map

package/dist/visa-tap/rfc9421.js.map

@@ -1 +1 @@
-{"version":3,"file":"rfc9421.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA+B,EAC/B,aAAqB,EACrB,KAAa;IAEb,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,uBAAuB;IACvB,MAAM,SAAS,GAAa;QAC1B,cAAc,UAAU,CAAC,MAAM,EAAE;QACjC,iBAAiB,UAAU,CAAC,SAAS,EAAE;QACvC,YAAY,UAAU,CAAC,IAAI,EAAE;KAC9B,CAAC;IAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,SAAS,CAAC,IAAI,CACZ,iEAAiE,OAAO,WAAW,KAAK,YAAY,KAAK,GAAG,CAC7G,CAAC;IAEF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,iDAAiD,OAAO,WAAW,KAAK,YAAY,KAAK,iBAAiB,CAAC;IAElI,OAAO;QACL,cAAc;QACd,SAAS,EAAE,SAAS,YAAY,GAAG;QACnC,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,YAAoB,EACpB,gBAAwB,GAAG;IAE3B,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,UAAU,aAAa,GAAG,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAa;YAC1B,cAAc,UAAU,CAAC,MAAM,EAAE;YACjC,iBAAiB,UAAU,CAAC,SAAS,EAAE;YACvC,YAAY,UAAU,CAAC,IAAI,EAAE;SAC9B,CAAC;QAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElD,2BAA2B;QAC3B,SAAS,CAAC,IAAI,CACZ,iEAAiE,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,KAAK,YAAY,KAAK,GAAG,CAC3H,CAAC;QAEF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3C,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE3D,sBAAsB;QACtB,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7D,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,YAAY,OAAO,GAAG,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,cAAsB;IAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
+{"version":3,"file":"rfc9421.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAQ1C,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,eAAe,GAGhB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEzE,MAAM,GAAG,GAAG,SAAS,CAAC;AACtB,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAU,CAAC;AAC5D,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAKnD,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAa;IACnD,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,0BAA0B,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,UAA+B;IACxD,MAAM,MAAM,GAAoB,IAAI,GAAG,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IACrF,IAAI,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,IAAI,KAAK,EAAE;QAAE,IAAI,GAAG,GAAG,CAAC;IAC5B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAE1B,IAAI,UAAU,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,GAAG,CAAC,CAAC;QACnF,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,8BAA8B,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CACzB,OAA0B,EAC1B,MAAuB,EACvB,eAAuB;IAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;QACzF,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,wBAAwB,eAAe,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA+B,EAC/B,aAAqB,EACrB,KAAa,EACb,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC;IAC7C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAEnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IACjE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,CAAC;IAE/C,MAAM,MAAM,GAAyC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAEjE,MAAM,eAAe,GAAG,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IAE3E,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;IACxG,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,OAAO;QACL,cAAc,EAAE,GAAG,KAAK,IAAI,eAAe,EAAE;QAC7C,SAAS,EAAE,GAAG,KAAK,KAAK,YAAY,GAAG;QACvC,KAAK;QACL,OAAO;QACP,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,iBAAiB,EAAE,OAAO;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAI,OAAuB,EAAE,KAAyB,EAAE,KAAa;IACxF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mBAAmB,KAAK,GAAG,CAAC,CAAC;QAC9E,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,QAAQ,OAAO,CAAC,IAAI,8BAA8B,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAgB,CAAC;AAClD,CAAC;AAED,SAAS,WAAW,CAClB,KAA2B,EAC3B,MAA+B,EAC/B,aAAqB,EACrB,OAAmC;IAEnC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,gBAAgB,IAAI,kBAAkB,CAAC;IAE5D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACvF,IAAI,OAAO,GAAG,GAAG,GAAG,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7E,IAAI,GAAG,GAAG,OAAO,GAAG,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC5F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACnG,IAAI,GAAG,GAAG,OAAO,GAAG,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;SAAM,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;QACzF,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,OAA0B,EAC1B,MAAuB,EACvB,OAAmC;IAEnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,mBAAmB,CAAC,CAAC;QAC3E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAE,OAA6B,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,GAAG,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IACvG,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,mCAAmC,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAA+B,EAC/B,YAAoB,EACpB,gBAAwB,GAAG,EAC3B,UAAsC,EAAE;IAExC,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,YAAY,CACjC,wBAAwB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC/C,OAAO,CAAC,KAAK,EACb,iBAAiB,CAClB,CAAC;QACF,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,cAAc;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,GAAG,CAAC,CAAC;QAC3E,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAErF,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC7C,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACjD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAEnD,MAAM,eAAe,GAAG,wBAAwB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjF,MAAM,aAAa,GAAG,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACpF,OAAO,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE;YACvG,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,YAAY,OAAO,GAAG,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC"}

package/dist/visa-tap/types.d.ts

@@ -61,10 +61,10 @@ export interface SignatureComponents {
     headers?: Record<string, string>;
 }
 /**
- * RFC 9421 Signed HTTP Message
+ * RFC 9421 Signed HTTP Message, as returned by signHttpMessage
  */
 export interface SignedHttpMessage {
-    /** Signature-Input header value */
+    /** Signature-Input header value; lists every covered component, in order */
     signatureInput: string;
     /** Signature header value */
     signature: string;
@@ -72,6 +72,56 @@ export interface SignedHttpMessage {
     nonce: string;
     /** Creation timestamp (Unix seconds) */
     created: number;
+    /** Expiry timestamp (Unix seconds), when one was set */
+    expires?: number;
+    /** Covered component identifiers, in signing order */
+    coveredComponents: string[];
+}
+/**
+ * A received RFC 9421 signature to verify. Only the two header values are
+ * required; `created` and `nonce`, when given, must match Signature-Input.
+ */
+export interface VerifiableHttpSignature {
+    /** Signature-Input header value */
+    signatureInput: string;
+    /** Signature header value */
+    signature: string;
+    /** Expected nonce (must equal the signed nonce parameter) */
+    nonce?: string;
+    /** Expected created time (must equal the signed created parameter) */
+    created?: number;
+}
+/**
+ * Options for signHttpMessage
+ */
+export interface SignHttpMessageOptions {
+    /** Signature label (default "sig1") */
+    label?: string;
+    /** Creation time in Unix seconds (default: now) */
+    created?: number;
+    /** Lifetime written to the expires parameter (default 300; 0 omits expires) */
+    expiresInSeconds?: number;
+    /** Nonce (default: 16 random bytes, hex) */
+    nonce?: string;
+    /** Optional tag parameter */
+    tag?: string;
+}
+/**
+ * Options for verifyHttpSignature
+ */
+export interface VerifyHttpSignatureOptions {
+    /** Label to verify; required when Signature-Input has several members */
+    label?: string;
+    /** Current time in Unix seconds (default: now) */
+    now?: number;
+    /** Allowed clock skew for created/expires in seconds (default 30) */
+    clockSkewSeconds?: number;
+    /** Reject unless the keyid parameter equals this value */
+    expectedKeyId?: string;
+    /** Extra component identifiers that must be covered */
+    requiredComponents?: string[];
+    /** Reject signatures that carry no expires parameter */
+    requireExpires?: boolean;
 }
 /**
  * QUIC Transport Configuration

package/dist/visa-tap/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/visa-tap/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iCAAiC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa;IACb,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/visa-tap/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE5C;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,WAAW,CAAC;IAClB,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,iCAAiC;IACjC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,cAAc;IACd,OAAO,EAAE,oBAAoB,CAAC;IAC9B,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,mCAAmC;IACnC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,wDAAwD;IACxD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,kBAAkB;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,iCAAiC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,sCAAsC;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,uBAAuB;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa;IACb,MAAM,EAAE,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC;IAC5C,uBAAuB;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-payments",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Dual-protocol payment infrastructure for autonomous AI commerce (AP2 + ACP)",
   "type": "module",
   "main": "./dist/index.js",
@@ -12,20 +12,6 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
-    "./wasm": {
-      "types": "./dist/wasm/index.d.ts",
-      "import": "./dist/wasm/index.js",
-      "browser": "./dist/wasm/browser.js",
-      "node": "./dist/wasm/node.js"
-    },
-    "./ap2": {
-      "types": "./dist/ap2/index.d.ts",
-      "import": "./dist/ap2/index.js"
-    },
-    "./acp": {
-      "types": "./dist/acp/index.d.ts",
-      "import": "./dist/acp/index.js"
-    },
     "./visa-tap": {
       "types": "./dist/visa-tap/index.d.ts",
       "import": "./dist/visa-tap/index.js"
@@ -96,15 +82,7 @@
   ],
   "author": "rUv <ruv@ruv.io>",
   "license": "(MIT OR Apache-2.0)",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/agentic-catalog/agentic-payments.git",
-    "directory": "crates/agentic-payments"
-  },
-  "bugs": {
-    "url": "https://github.com/agentic-catalog/agentic-payments/issues"
-  },
-  "homepage": "https://github.com/agentic-catalog/agentic-payments#readme",
+  "homepage": "https://www.npmjs.com/package/agentic-payments",
   "engines": {
     "node": ">=18.0.0",
     "npm": ">=8.0.0"
@@ -140,6 +118,7 @@
     "eslint-config-prettier": "^9.1.0",
     "eslint-plugin-import": "^2.29.1",
     "eventsource": "^4.0.0",
+    "http-message-signatures": "^1.0.6",
     "node-fetch": "^3.3.2",
     "prettier": "^3.2.4",
     "size-limit": "^11.0.1",