kxco-post-quantum 1.7.8 → 1.7.9

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.7.9
+
+verifyDelivery reads each header only as a string. A header that arrives as an
+array, as some frameworks deliver a repeated header, counts as missing, so the
+result reports the failed check where an array signature header used to throw.
+
 ## 1.7.8
 
 verifyDelivery accepts an X-KXCO-Timestamp header only as decimal digits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kxco-post-quantum",
-  "version": "1.7.8",
+  "version": "1.7.9",
   "description": "NIST post-quantum cryptography for Node.js and browsers: ML-DSA, ML-KEM and SLH-DSA (FIPS 203, 204, 205). 1,793 NIST ACVP vectors passed, 0 failed. OpenSSL 3.5 native on Node 24+, the CNSA 2.0 parameter sets, reproducible builds with provenance.",
   "keywords": [
     "post-quantum",

package/src/webhook.d.ts

@@ -89,8 +89,11 @@ export interface SignDeliveryHeaders {
 export function signDelivery(args: SignDeliveryArgs): SignDeliveryHeaders
 
 export interface VerifyDeliveryArgs {
-  /** HTTP headers with LOWERCASE keys */
-  headers: Record<string, string | undefined>
+  /**
+   * HTTP headers with LOWERCASE keys. Each KXCO header is read only as a
+   * string; a header that arrives as an array counts as missing.
+   */
+  headers: Record<string, string | string[] | undefined>
   /** The EXACT request body bytes as received */
   rawBody: string | Buffer
   /** Optional: enable HMAC verification by providing the shared secret */

package/src/webhook.js

@@ -41,6 +41,9 @@ function constTimeEqualStrings(a, b) {
   for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i)
   return diff === 0
 }
+function headerString(value) {
+  return typeof value === 'string' ? value : undefined
+}
 
 /**
  * Build the canonical signed envelope: timestamp + "." + raw body string.
@@ -113,10 +116,13 @@ export function signDelivery({ rawBody, hmacSecret, pqSecretKey, pqKid, event, d
  * Verify a webhook delivery on the receiving side.
  */
 export function verifyDelivery({ headers, rawBody, hmacSecret, pqPublicKey, pinnedKid, windowSeconds = 300 }) {
-  const ts      = headers['x-kxco-timestamp']
-  const sigHmac = headers['x-kxco-signature']
-  const sigPq   = headers['x-kxco-pq-signature']
-  const kid     = headers['x-kxco-pq-kid']
+  // Each header is read only as a string. Some frameworks hand a repeated
+  // header over as an array; that counts as missing rather than being coerced,
+  // so a header of any other type fails its check instead of throwing.
+  const ts      = headerString(headers['x-kxco-timestamp'])
+  const sigHmac = headerString(headers['x-kxco-signature'])
+  const sigPq   = headerString(headers['x-kxco-pq-signature'])
+  const kid     = headerString(headers['x-kxco-pq-kid'])
 
   // Both signatures cover the header exactly as it arrives, so it is read
   // only as the decimal digits it is specified to be. parseInt alone would