agentic-payments 0.1.5 → 0.1.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +83 -0
- package/bin/mcp.js +30 -0
- package/dist/mcp/tools/mandate.d.ts +17 -0
- package/dist/mcp/tools/mandate.d.ts.map +1 -1
- package/dist/mcp/tools/mandate.js +17 -0
- package/dist/mcp/tools/mandate.js.map +1 -1
- package/dist/visa-tap/rfc9421.d.ts +3 -1
- package/dist/visa-tap/rfc9421.d.ts.map +1 -1
- package/dist/visa-tap/rfc9421.js +10 -1
- package/dist/visa-tap/rfc9421.js.map +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -1034,6 +1034,89 @@ agentic-payments/
|
|
|
1034
1034
|
└── dist/ # Compiled output
|
|
1035
1035
|
```
|
|
1036
1036
|
|
|
1037
|
+
## 🔒 Security Best Practices
|
|
1038
|
+
|
|
1039
|
+
Production deployment guidelines for secure payment authorization:
|
|
1040
|
+
|
|
1041
|
+
### Key Management
|
|
1042
|
+
|
|
1043
|
+
**Development vs Production**:
|
|
1044
|
+
- ⚠️ **MCP `sign_mandate` tool**: Development/testing ONLY. Never use in production.
|
|
1045
|
+
- ✅ **Production**: Use Hardware Security Modules (HSM) or Key Management Services
|
|
1046
|
+
- AWS KMS, Azure Key Vault, Google Cloud KMS
|
|
1047
|
+
- Sign mandates in secure enclaves
|
|
1048
|
+
- Never transmit private keys over network
|
|
1049
|
+
|
|
1050
|
+
**Key Rotation**:
|
|
1051
|
+
- Rotate agent signing keys quarterly
|
|
1052
|
+
- Maintain key version metadata in mandate records
|
|
1053
|
+
- Support multiple active keys during rotation periods
|
|
1054
|
+
- Revoke old mandates when rotating keys
|
|
1055
|
+
|
|
1056
|
+
### Signature Validation
|
|
1057
|
+
|
|
1058
|
+
**RFC 9421 Timestamp Checks**:
|
|
1059
|
+
```typescript
|
|
1060
|
+
// verifyHttpSignature includes timestamp validation (default: 5 minutes)
|
|
1061
|
+
const isValid = await verifyHttpSignature(components, signed, publicKey, 300);
|
|
1062
|
+
```
|
|
1063
|
+
|
|
1064
|
+
**Replay Protection**:
|
|
1065
|
+
- Nonce-based replay prevention (16-byte cryptographic nonces)
|
|
1066
|
+
- Timestamp validation (configurable max age, default 300 seconds)
|
|
1067
|
+
- Store processed nonces to prevent replay attacks
|
|
1068
|
+
|
|
1069
|
+
### Rate Limiting
|
|
1070
|
+
|
|
1071
|
+
Implement application-level rate limiting:
|
|
1072
|
+
```typescript
|
|
1073
|
+
// Example: Limit verification attempts per IP
|
|
1074
|
+
const limiter = rateLimit({
|
|
1075
|
+
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
1076
|
+
max: 100, // 100 requests per window
|
|
1077
|
+
handler: (req, res) => res.status(429).send('Too many requests')
|
|
1078
|
+
});
|
|
1079
|
+
|
|
1080
|
+
app.post('/verify', limiter, verifyHandler);
|
|
1081
|
+
```
|
|
1082
|
+
|
|
1083
|
+
### Network Security
|
|
1084
|
+
|
|
1085
|
+
**QUIC Transport**:
|
|
1086
|
+
- TLS 1.3 encryption by default (no configuration needed)
|
|
1087
|
+
- Certificate pinning for merchant endpoints
|
|
1088
|
+
- Monitor connection statistics for anomalies
|
|
1089
|
+
|
|
1090
|
+
**MCP Server**:
|
|
1091
|
+
- Use stdio transport for local development only
|
|
1092
|
+
- HTTP transport requires reverse proxy with TLS in production
|
|
1093
|
+
- Implement authentication middleware for HTTP endpoints
|
|
1094
|
+
|
|
1095
|
+
### Logging and Monitoring
|
|
1096
|
+
|
|
1097
|
+
**Structured Logging**:
|
|
1098
|
+
```typescript
|
|
1099
|
+
// Don't log sensitive data
|
|
1100
|
+
logger.info('Payment authorized', {
|
|
1101
|
+
mandateId: mandate.mandate_id,
|
|
1102
|
+
amount: mandate.cap.amount,
|
|
1103
|
+
// DO NOT log: private keys, signatures, personal data
|
|
1104
|
+
});
|
|
1105
|
+
```
|
|
1106
|
+
|
|
1107
|
+
**Security Monitoring**:
|
|
1108
|
+
- Alert on repeated verification failures (potential attack)
|
|
1109
|
+
- Monitor for unusual spending patterns
|
|
1110
|
+
- Track revocation requests for anomalies
|
|
1111
|
+
- Log all mandate creation with agent identities
|
|
1112
|
+
|
|
1113
|
+
### Compliance
|
|
1114
|
+
|
|
1115
|
+
- **PCI DSS**: agentic-payments handles authorization only, not card data
|
|
1116
|
+
- **GDPR**: Minimize personal data in mandate metadata
|
|
1117
|
+
- **Audit Trail**: All mandates are cryptographically signed and immutable
|
|
1118
|
+
- **Data Retention**: Implement mandate expiration and cleanup policies
|
|
1119
|
+
|
|
1037
1120
|
## 📊 Performance
|
|
1038
1121
|
|
|
1039
1122
|
Optimized for low-latency payment authorization with minimal bundle impact:
|
package/bin/mcp.js
CHANGED
|
@@ -4,6 +4,36 @@
|
|
|
4
4
|
* Launches the Agentic Payments MCP server
|
|
5
5
|
*/
|
|
6
6
|
|
|
7
|
+
// Clean up npx cache on startup to prevent ENOTEMPTY errors
|
|
8
|
+
if (process.env.npm_execpath && process.env.npm_execpath.includes('npx')) {
|
|
9
|
+
try {
|
|
10
|
+
const { existsSync, rmSync, readdirSync } = await import('fs');
|
|
11
|
+
const { homedir } = await import('os');
|
|
12
|
+
const { join } = await import('path');
|
|
13
|
+
|
|
14
|
+
const npmHome = process.env.NPM_CONFIG_CACHE || join(homedir(), '.npm');
|
|
15
|
+
const npxCacheDir = join(npmHome, '_npx');
|
|
16
|
+
|
|
17
|
+
if (existsSync(npxCacheDir)) {
|
|
18
|
+
const cacheEntries = readdirSync(npxCacheDir);
|
|
19
|
+
|
|
20
|
+
// Find and remove stale agentic-payments cache
|
|
21
|
+
for (const entry of cacheEntries) {
|
|
22
|
+
const pkgPath = join(npxCacheDir, entry, 'node_modules', 'agentic-payments');
|
|
23
|
+
if (existsSync(pkgPath)) {
|
|
24
|
+
try {
|
|
25
|
+
rmSync(join(npxCacheDir, entry), { recursive: true, force: true, maxRetries: 3 });
|
|
26
|
+
} catch (e) {
|
|
27
|
+
// Ignore cleanup errors
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
}
|
|
31
|
+
}
|
|
32
|
+
} catch (error) {
|
|
33
|
+
// Silently fail - don't block server startup
|
|
34
|
+
}
|
|
35
|
+
}
|
|
36
|
+
|
|
7
37
|
import('../dist/mcp/index.js').catch(err => {
|
|
8
38
|
console.error('[MCP] Failed to start server:', err);
|
|
9
39
|
process.exit(1);
|
|
@@ -8,6 +8,23 @@ import type { ToolResult, CreateActiveMandateArgs, SignMandateArgs, VerifyMandat
|
|
|
8
8
|
export declare function createActiveMandateTool(args: CreateActiveMandateArgs): Promise<ToolResult>;
|
|
9
9
|
/**
|
|
10
10
|
* Sign a mandate with Ed25519 private key
|
|
11
|
+
*
|
|
12
|
+
* ⚠️ SECURITY WARNING: This tool accepts private keys as arguments.
|
|
13
|
+
* Only use this in development/testing environments.
|
|
14
|
+
*
|
|
15
|
+
* For production deployments:
|
|
16
|
+
* - Use Hardware Security Modules (HSM) or Key Management Services (KMS)
|
|
17
|
+
* - Sign mandates in secure enclaves (AWS KMS, Azure Key Vault, Google Cloud KMS)
|
|
18
|
+
* - Never transmit private keys over network connections
|
|
19
|
+
* - Never log or store private keys in plaintext
|
|
20
|
+
* - Implement proper key rotation policies
|
|
21
|
+
*
|
|
22
|
+
* The MCP protocol may log tool arguments. Private keys transmitted through
|
|
23
|
+
* this tool could be exposed in:
|
|
24
|
+
* - MCP server logs
|
|
25
|
+
* - Network traffic (stdio/HTTP transport)
|
|
26
|
+
* - Client-side history
|
|
27
|
+
* - Debug output
|
|
11
28
|
*/
|
|
12
29
|
export declare function signMandateTool(args: SignMandateArgs): Promise<ToolResult>;
|
|
13
30
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/mandate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED
|
|
1
|
+
{"version":3,"file":"mandate.d.ts","sourceRoot":"","sources":["../../../src/mcp/tools/mandate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EACV,UAAU,EACV,uBAAuB,EACvB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,UAAU,CAAC,CA4BrB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,UAAU,CAAC,CAmCrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAmCrB;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,UAAU,CAAC,CAerB;AAED;;GAEG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,UAAU,CAAC,CAe/D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuCtB"}
|
|
@@ -36,6 +36,23 @@ export async function createActiveMandateTool(args) {
|
|
|
36
36
|
}
|
|
37
37
|
/**
|
|
38
38
|
* Sign a mandate with Ed25519 private key
|
|
39
|
+
*
|
|
40
|
+
* ⚠️ SECURITY WARNING: This tool accepts private keys as arguments.
|
|
41
|
+
* Only use this in development/testing environments.
|
|
42
|
+
*
|
|
43
|
+
* For production deployments:
|
|
44
|
+
* - Use Hardware Security Modules (HSM) or Key Management Services (KMS)
|
|
45
|
+
* - Sign mandates in secure enclaves (AWS KMS, Azure Key Vault, Google Cloud KMS)
|
|
46
|
+
* - Never transmit private keys over network connections
|
|
47
|
+
* - Never log or store private keys in plaintext
|
|
48
|
+
* - Implement proper key rotation policies
|
|
49
|
+
*
|
|
50
|
+
* The MCP protocol may log tool arguments. Private keys transmitted through
|
|
51
|
+
* this tool could be exposed in:
|
|
52
|
+
* - MCP server logs
|
|
53
|
+
* - Network traffic (stdio/HTTP transport)
|
|
54
|
+
* - Client-side history
|
|
55
|
+
* - Debug output
|
|
39
56
|
*/
|
|
40
57
|
export async function signMandateTool(args) {
|
|
41
58
|
try {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"mandate.js","sourceRoot":"","sources":["../../../src/mcp/tools/mandate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAUvC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAgB;YAC3B,UAAU,EAAE,WAAW,MAAM,EAAE,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE;gBACH,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;YAClE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;SACpE,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"mandate.js","sourceRoot":"","sources":["../../../src/mcp/tools/mandate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,+BAA+B,CAAC;AAUvC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAA6B;IAE7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAgB;YAC3B,UAAU,EAAE,WAAW,MAAM,EAAE,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,GAAG,EAAE;gBACH,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB;YACD,UAAU,EACR,IAAI,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,WAAW,EAAE;YAClE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;SACpE,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO;SACR,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB;IAErB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC;QAEtC,6BAA6B;QAC7B,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9C,MAAM,eAAe,GAAG,IAAI,UAAU,CACpC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CACnE,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QAED,eAAe;QACf,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAEtD,MAAM,aAAa,GAAkB;YACnC,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,SAAS;YACjB,SAAS;YACT,OAAO,EAAE,OAAO;SACjB,CAAC;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,cAAc,EAAE,aAAa;SAC9B,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,YAAY,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAErD,mBAAmB;QACnB,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAEjD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,KAAK,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI;YACX,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,KAAK,CAAC,OAAO;YAChC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAE,KAAa,CAAC,MAAM;YACzD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO;SAChC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE9C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;QAExC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,WAAW;SACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAExC;IACC,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;QAE5B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,UAAU;YACV,KAAK,EAAE,6DAA6D;YACpE,OAAO,EAAE;;;;;;;;;;;;;;;EAeb;YACI,YAAY,EAAE,WAAW;YACzB,eAAe,EAAE;gBACf,oBAAoB;gBACpB,iBAAiB;gBACjB,sBAAsB;gBACtB,wBAAwB;gBACxB,uBAAuB;aACxB;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;SAChE,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -10,8 +10,10 @@ import type { SignatureComponents, SignedHttpMessage } from './types.js';
|
|
|
10
10
|
export declare function signHttpMessage(components: SignatureComponents, privateKeyHex: string, keyId: string): Promise<SignedHttpMessage>;
|
|
11
11
|
/**
|
|
12
12
|
* Verify RFC 9421 HTTP signature
|
|
13
|
+
*
|
|
14
|
+
* @param maxAgeSeconds - Maximum age of signature in seconds (default: 300 = 5 minutes)
|
|
13
15
|
*/
|
|
14
|
-
export declare function verifyHttpSignature(components: SignatureComponents, signed: SignedHttpMessage, publicKeyHex: string): Promise<boolean>;
|
|
16
|
+
export declare function verifyHttpSignature(components: SignatureComponents, signed: SignedHttpMessage, publicKeyHex: string, maxAgeSeconds?: number): Promise<boolean>;
|
|
15
17
|
/**
|
|
16
18
|
* Compute content digest (SHA-256)
|
|
17
19
|
*/
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEzE;;GAEG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CA2C5B;AAED
|
|
1
|
+
{"version":3,"file":"rfc9421.d.ts","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEzE;;GAEG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,mBAAmB,EAC/B,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,iBAAiB,CAAC,CA2C5B;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,mBAAmB,EAC/B,MAAM,EAAE,iBAAiB,EACzB,YAAY,EAAE,MAAM,EACpB,aAAa,GAAE,MAAY,GAC1B,OAAO,CAAC,OAAO,CAAC,CAwDlB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAI7D"}
|
package/dist/visa-tap/rfc9421.js
CHANGED
|
@@ -45,9 +45,18 @@ export async function signHttpMessage(components, privateKeyHex, keyId) {
|
|
|
45
45
|
}
|
|
46
46
|
/**
|
|
47
47
|
* Verify RFC 9421 HTTP signature
|
|
48
|
+
*
|
|
49
|
+
* @param maxAgeSeconds - Maximum age of signature in seconds (default: 300 = 5 minutes)
|
|
48
50
|
*/
|
|
49
|
-
export async function verifyHttpSignature(components, signed, publicKeyHex) {
|
|
51
|
+
export async function verifyHttpSignature(components, signed, publicKeyHex, maxAgeSeconds = 300) {
|
|
50
52
|
try {
|
|
53
|
+
// Validate timestamp to prevent replay attacks
|
|
54
|
+
const now = Math.floor(Date.now() / 1000);
|
|
55
|
+
const age = Math.abs(now - signed.created);
|
|
56
|
+
if (age > maxAgeSeconds) {
|
|
57
|
+
console.error(`Signature expired: age=${age}s, max=${maxAgeSeconds}s`);
|
|
58
|
+
return false;
|
|
59
|
+
}
|
|
51
60
|
// Reconstruct signature base
|
|
52
61
|
const baseParts = [
|
|
53
62
|
`"@method": ${components.method}`,
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"rfc9421.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA+B,EAC/B,aAAqB,EACrB,KAAa;IAEb,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,uBAAuB;IACvB,MAAM,SAAS,GAAa;QAC1B,cAAc,UAAU,CAAC,MAAM,EAAE;QACjC,iBAAiB,UAAU,CAAC,SAAS,EAAE;QACvC,YAAY,UAAU,CAAC,IAAI,EAAE;KAC9B,CAAC;IAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,SAAS,CAAC,IAAI,CACZ,iEAAiE,OAAO,WAAW,KAAK,YAAY,KAAK,GAAG,CAC7G,CAAC;IAEF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,iDAAiD,OAAO,WAAW,KAAK,YAAY,KAAK,iBAAiB,CAAC;IAElI,OAAO;QACL,cAAc;QACd,SAAS,EAAE,SAAS,YAAY,GAAG;QACnC,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"rfc9421.js","sourceRoot":"","sources":["../../src/visa-tap/rfc9421.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAG1C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAA+B,EAC/B,aAAqB,EACrB,KAAa;IAEb,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE9C,uBAAuB;IACvB,MAAM,SAAS,GAAa;QAC1B,cAAc,UAAU,CAAC,MAAM,EAAE;QACjC,iBAAiB,UAAU,CAAC,SAAS,EAAE;QACvC,YAAY,UAAU,CAAC,IAAI,EAAE;KAC9B,CAAC;IAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;QAC7B,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,SAAS,CAAC,IAAI,CACZ,iEAAiE,OAAO,WAAW,KAAK,YAAY,KAAK,GAAG,CAC7G,CAAC;IAEF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3C,oBAAoB;IACpB,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,+BAA+B;IAC/B,MAAM,cAAc,GAAG,iDAAiD,OAAO,WAAW,KAAK,YAAY,KAAK,iBAAiB,CAAC;IAElI,OAAO;QACL,cAAc;QACd,SAAS,EAAE,SAAS,YAAY,GAAG;QACnC,KAAK;QACL,OAAO;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,UAA+B,EAC/B,MAAyB,EACzB,YAAoB,EACpB,gBAAwB,GAAG;IAE3B,IAAI,CAAC;QACH,+CAA+C;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,IAAI,GAAG,GAAG,aAAa,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CAAC,0BAA0B,GAAG,UAAU,aAAa,GAAG,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6BAA6B;QAC7B,MAAM,SAAS,GAAa;YAC1B,cAAc,UAAU,CAAC,MAAM,EAAE;YACjC,iBAAiB,UAAU,CAAC,SAAS,EAAE;YACvC,YAAY,UAAU,CAAC,IAAI,EAAE;SAC9B,CAAC;QAEF,IAAI,UAAU,CAAC,aAAa,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,qBAAqB,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAED,qCAAqC;QACrC,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAElD,2BAA2B;QAC3B,SAAS,CAAC,IAAI,CACZ,iEAAiE,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,KAAK,YAAY,KAAK,GAAG,CAC3H,CAAC;QAEF,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE3C,0BAA0B;QAC1B,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAE3D,sBAAsB;QACtB,MAAM,SAAS,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE7D,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAgB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,OAAO,YAAY,OAAO,GAAG,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,cAAsB;IAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "agentic-payments",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.7",
|
|
4
4
|
"description": "Dual-protocol payment infrastructure for autonomous AI commerce (AP2 + ACP)",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -45,6 +45,7 @@
|
|
|
45
45
|
"LICENSE-APACHE"
|
|
46
46
|
],
|
|
47
47
|
"scripts": {
|
|
48
|
+
"preinstall": "node scripts/cleanup-npx-cache.js || true",
|
|
48
49
|
"prebuild": "npm run clean",
|
|
49
50
|
"build": "npm run build:ts",
|
|
50
51
|
"build:wasm": "echo 'WASM build skipped - using native TypeScript implementation'",
|