{"_id":"@algovoi/key-credential-binding","_rev":"4-a01bd2228d257c043f77f438579bd805","name":"@algovoi/key-credential-binding","dist-tags":{"latest":"0.1.2"},"versions":{"0.1.0":{"name":"@algovoi/key-credential-binding","version":"0.1.0","keywords":["rfc9421","http-signatures","agent-credential","key-binding","conformance-vectors","ed25519"],"author":{"name":"AlgoVoi","email":"chopmob@gmail.com"},"license":"Apache-2.0","_id":"@algovoi/key-credential-binding@0.1.0","maintainers":[{"name":"algovoi","email":"chopmob@gmail.com"}],"dist":{"shasum":"494cb50eb255c6d99aa4735b33b4db9c080a1b17","tarball":"https://registry.npmjs.org/@algovoi/key-credential-binding/-/key-credential-binding-0.1.0.tgz","fileCount":4,"integrity":"sha512-q9J0h6/hgzLQxDFjjV6NJVyayOj7JQ8KZ316idPq4P/HOMLPJppap/m12s1BhGdIALNWdB23muB4ci/D4mcZcg==","signatures":[{"sig":"MEUCIQCoClzx/hdlzCK48gcwSIZWTGPnmrGeg5VwsDfc0qtifQIgNAGZLKWEkAACcjCH6GdSfkuw0sSyptnZeqsY/4K01Po=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":20384},"main":"./dist/src/binding-verifier.js","type":"module","types":"./dist/src/binding-verifier.d.ts","engines":{"node":">=18"},"gitHead":"657d70ad73cacf62833b645c1a2b57f5aace268a","scripts":{"test":"tsc && node --test dist/test/vectors.test.js","build":"tsc","conformance":"tsc && node dist/run-conformance.js"},"_npmUser":{"name":"algovoi","email":"chopmob@gmail.com"},"deprecated":"CWE-863 scope-bypass: path-prefix scope matching admits sibling resources (e.g. /v1/binding-receipts-evil under scope /v1/binding-receipts). Upgrade to >=0.1.1.","_npmVersion":"11.6.2","description":"Reference verifier and conformance vectors for binding an RFC 9421 signature key to an issued agent credential (key_anchored, scope_valid, credential_valid on top of raw signature verification)","directories":{},"_nodeVersion":"24.12.0","dependencies":{"@algovoi/rfc9421-verifier":"^0.3.2"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.4.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/key-credential-binding_0.1.0_1785509449854_0.42983687955072125","host":"s3://npm-registry-packages-npm-production"}},"0.1.1":{"name":"@algovoi/key-credential-binding","version":"0.1.1","keywords":["rfc9421","http-signatures","agent-credential","key-binding","conformance-vectors","ed25519"],"author":{"name":"AlgoVoi","email":"chopmob@gmail.com"},"license":"Apache-2.0","_id":"@algovoi/key-credential-binding@0.1.1","maintainers":[{"name":"algovoi","email":"chopmob@gmail.com"}],"dist":{"shasum":"732b6ec56f50ca7f23c7916cbecc4be37e5895ee","tarball":"https://registry.npmjs.org/@algovoi/key-credential-binding/-/key-credential-binding-0.1.1.tgz","fileCount":4,"integrity":"sha512-voqWHsYg1wYnaFlalypJJmTpLP4fGBbLFNYB5oVREHVo7BH1jxKac7zDx3KihC898xYHT43KelC2nY6Oy74XVg==","signatures":[{"sig":"MEYCIQDP+hJzlYThKwGW9X42hHfh3kzTWIRglyLjMeViMZji/QIhAMvw/uLBsQoop96sv+JW0ElvjOQpjTQOO4xG3o/MNZjv","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":20729},"main":"./dist/src/binding-verifier.js","type":"module","_from":"file:algovoi-key-credential-binding-0.1.1.tgz","types":"./dist/src/binding-verifier.d.ts","engines":{"node":">=18"},"scripts":{"test":"tsc && node --test dist/test/vectors.test.js","build":"tsc","conformance":"tsc && node dist/run-conformance.js"},"_npmUser":{"name":"algovoi","email":"chopmob@gmail.com"},"_resolved":"C:\\algo\\platform\\algovoi-key-credential-binding\\typescript\\algovoi-key-credential-binding-0.1.1.tgz","_integrity":"sha512-voqWHsYg1wYnaFlalypJJmTpLP4fGBbLFNYB5oVREHVo7BH1jxKac7zDx3KihC898xYHT43KelC2nY6Oy74XVg==","_npmVersion":"11.6.2","description":"Reference verifier and conformance vectors for binding an RFC 9421 signature key to an issued agent credential (key_anchored, scope_valid, credential_valid on top of raw signature verification)","directories":{},"_nodeVersion":"24.12.0","dependencies":{"@algovoi/rfc9421-verifier":"^0.3.2"},"_hasShrinkwrap":false,"devDependencies":{"typescript":"^5.4.0","@types/node":"^20.0.0"},"_npmOperationalInternal":{"tmp":"tmp/key-credential-binding_0.1.1_1785683523367_0.8516952433431231","host":"s3://npm-registry-packages-npm-production"}},"0.1.2":{"name":"@algovoi/key-credential-binding","version":"0.1.2","description":"Reference verifier and conformance vectors for binding an RFC 9421 signature key to an issued agent credential (key_anchored, scope_valid, credential_valid on top of raw signature verification)","keywords":["rfc9421","http-signatures","agent-credential","key-binding","conformance-vectors","ed25519"],"license":"Apache-2.0","author":{"name":"AlgoVoi","email":"chopmob@gmail.com"},"homepage":"https://github.com/chopmob-cloud/algovoi-key-credential-binding#readme","repository":{"type":"git","url":"git+https://github.com/chopmob-cloud/algovoi-key-credential-binding.git","directory":"typescript"},"bugs":{"url":"https://github.com/chopmob-cloud/algovoi-key-credential-binding/issues"},"type":"module","main":"./dist/src/binding-verifier.js","types":"./dist/src/binding-verifier.d.ts","scripts":{"build":"tsc","test":"tsc && node --test dist/test/","conformance":"tsc && node dist/run-conformance.js"},"dependencies":{"@algovoi/rfc9421-verifier":"^0.3.2"},"devDependencies":{"typescript":"^5.4.0","@types/node":"^20.0.0"},"engines":{"node":">=18"},"gitHead":"744ad9c2f1a09c8de950e98a7668c612fe1ec452","_id":"@algovoi/key-credential-binding@0.1.2","_nodeVersion":"24.12.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-MK1OmyBr8Hxkcyno+dhMJbuUtHhibdAD3hrzAFoV0ggDrfAzmr8nr8pXhcMDxb9DcmdJ+NYChn3GDoLrcOLX3A==","shasum":"81ac781143c792023e8c3774eab2f6a29e8c95d5","tarball":"https://registry.npmjs.org/@algovoi/key-credential-binding/-/key-credential-binding-0.1.2.tgz","fileCount":5,"unpackedSize":22753,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIAM0WVcx6TfzDso2ZHA42dZu504DE+VQjTUyGfLGvAHXAiEAj7Zc/koKGqB9jab2fhQV156n5MA7OERo+Jd+WxA0KDk="}]},"_npmUser":{"name":"algovoi","email":"chopmob@gmail.com"},"directories":{},"maintainers":[{"name":"algovoi","email":"chopmob@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/key-credential-binding_0.1.2_1786196567275_0.9397551012874488"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-31T14:50:49.704Z","modified":"2026-08-08T13:42:47.554Z","0.1.0":"2026-07-31T14:50:49.991Z","0.1.1":"2026-08-02T15:12:03.532Z","0.1.2":"2026-08-08T13:42:47.412Z"},"author":{"name":"AlgoVoi","email":"chopmob@gmail.com"},"license":"Apache-2.0","keywords":["rfc9421","http-signatures","agent-credential","key-binding","conformance-vectors","ed25519"],"description":"Reference verifier and conformance vectors for binding an RFC 9421 signature key to an issued agent credential (key_anchored, scope_valid, credential_valid on top of raw signature verification)","maintainers":[{"name":"algovoi","email":"chopmob@gmail.com"}],"readme":"# @algovoi/key-credential-binding\n\nTypeScript reference verifier for binding an RFC 9421 HTTP Message Signature\nkey to an issued agent credential. Behavioral parity with the Python\n[`algovoi-key-credential-binding`](https://pypi.org/project/algovoi-key-credential-binding/),\nover the same conformance vectors.\n\nRFC 9421 proves a request was signed by the holder of a key. It does not prove\nwhich credential that key belongs to, nor that the request is within the\ncredential's scope. This package adds that layer on top of\n[`@algovoi/rfc9421-verifier`](https://www.npmjs.com/package/@algovoi/rfc9421-verifier)\nand evaluates four independent checks: `key_anchored`, `signature_valid`,\n`scope_valid`, `credential_valid`. The public key is resolved from the\ncredential (keyed by `keyid`), never from the request artifact.\n\nSee the\n[repository](https://github.com/chopmob-cloud/algovoi-key-credential-binding)\nfor `SPEC.md` and the language-neutral vector set, and\n[algovoi.co.uk](https://algovoi.co.uk) / [docs.algovoi.co.uk](https://docs.algovoi.co.uk)\nfor the wider agent-payments and verifiable-compliance estate this is part of.\n\n## Install\n\n```\nnpm install @algovoi/key-credential-binding\n```\n\n## Usage\n\n```ts\nimport { verifyBoundRequest, type Credential } from \"@algovoi/key-credential-binding\";\n\nconst credential: Credential = {\n  credential_id: \"cred_001\",\n  enrolled_keys: [\n    { keyid: \"did:web:api.example#key-1\", alg: \"ed25519\", public_key_hex: \"700e2ce7...\" },\n  ],\n  scope: { methods: [\"POST\"], path_prefixes: [\"/v1/binding-receipts\"] },\n  not_before: 1740000000,\n  not_after: 1760000000,\n  status: \"active\",\n};\n\nconst request = {\n  method: \"POST\",\n  authority: \"api.example\",\n  path: \"/v1/binding-receipts\",\n  headers: {\n    \"content-digest\": \"sha-256=:...:\",\n    \"signature-input\": 'sig=(...);created=...;keyid=\"did:web:api.example#key-1\";alg=\"ed25519\"',\n    \"signature\": \"sig=:...:\",\n  },\n  body: Buffer.from(\"...\"),\n};\n\nconst result = await verifyBoundRequest(request, credential);\n// result.valid, result.key_anchored, result.signature_valid,\n// result.scope_valid, result.credential_valid, result.errors\n```\n\nNode >= 18. On Node 18 a small WebCrypto shim supplies `globalThis.crypto`\n(provided natively on Node 20+).\n\n## License\n\nApache-2.0.\n","readmeFilename":"README.md","homepage":"https://github.com/chopmob-cloud/algovoi-key-credential-binding#readme","repository":{"type":"git","url":"git+https://github.com/chopmob-cloud/algovoi-key-credential-binding.git","directory":"typescript"},"bugs":{"url":"https://github.com/chopmob-cloud/algovoi-key-credential-binding/issues"}}