{"_id":"http-message-sig","_rev":"7-8864b232d6a17805211da8bb57edefe5","name":"http-message-sig","dist-tags":{"latest":"0.3.0"},"versions":{"0.0.1":{"name":"http-message-sig","version":"0.0.1","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.0.1","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"1952f093f52f73d384d6796bd804944a001b1fda","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.0.1.tgz","fileCount":15,"integrity":"sha512-ext1oqXin53XCv5O5qtK31zdnFMyq7z948Lp1GDuZFktL+RCKE6kFiM+omJV9thIfEFxYxrsQYxhCOUluD6Lrw==","signatures":[{"sig":"MEUCIE9zWTYrhvJhZUe5QzEQyL6tg/2N0dPyxE56rmlALU7PAiEA9VADj9CDTdlM5U/wYf01puGrt0q/Kch0mJaBQfUcjbQ=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":37591},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"496aaed2da9bef3db5b5a6de9581fc7784bbb066","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.9.0","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"23.3.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.0.1_1744645135459_0.3901511708832459","host":"s3://npm-registry-packages-npm-production"}},"0.0.3":{"name":"http-message-sig","version":"0.0.3","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.0.3","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"f076593d95ba4bba02d564e609aa3a10c4b0b436","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.0.3.tgz","fileCount":15,"integrity":"sha512-eJ+f/T/Iq/EZ90aH4KrHZoT99QqF6zjrobmEVbuG4U/8te46sy5EwrVkzkqWvDRM02jEUobivJ9/Fu42dT1Gyw==","signatures":[{"sig":"MEUCIQD9Mi6iJoA7fckqulZ5CfNYNlnqhyW98cGOK7/YN698dwIgbeuTXmGH+W5N3w1DjFE+J0eJg2GysXJQrVFnptXVzO4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":38584},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"4fb87ae64cdb791b2f9d180d9368fa8939d56250","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.9.0","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"23.3.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.0.3_1744707238070_0.885687859853914","host":"s3://npm-registry-packages-npm-production"}},"0.0.7":{"name":"http-message-sig","version":"0.0.7","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.0.7","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"c9f2f630e6a69677a8daaaa17856ddaa9d3b69f0","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.0.7.tgz","fileCount":15,"integrity":"sha512-E6Jkc0ekzwJDJASMK05kZU5lpJbJdBFpYgH3E9pjdd/05Schlrol4U1OCoDSCQ7XHFWTXpYiWPOVRPbo4DGZbg==","signatures":[{"sig":"MEUCIQDDIVc0hIllDXyizGwCE1d3kULu08PiSOwzknzd7VPiJwIgE1BDMSEtx0Pe5OG/tz9+93oAKK1hd5B/0kjS8Yi2TPw=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":39480},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"a488f7694c8581b6ddc20ed838d493f1aa10aae6","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.9.0","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"23.3.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.0.7_1746613343398_0.639743559903301","host":"s3://npm-registry-packages-npm-production"}},"0.0.9":{"name":"http-message-sig","version":"0.0.9","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.0.9","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"1a86593f8e1986e49584bbb6e48f2178136b57b5","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.0.9.tgz","fileCount":7,"integrity":"sha512-eNxR0qQ4Bxh4Hs8tLkl4hvhjLxT+ufl8v/knV5kgZV+80DIu/HlaFE24A1PPF3MOi6x5CVZTe92BVvHO4Rq/SA==","signatures":[{"sig":"MEYCIQDYQhrpYhN9cu9mpaqvusuov6z4kK88oBuMZtDWddNy1QIhAPQgMgoAedGEYQvlLkgMrGAZRY49LAv0ccIC4xY8YY/t","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":30817},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"daa224e58cc7193019fb886be729f324d5c3bbfb","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.8.2","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"22.8.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.0.9_1748464034422_0.3506857292375787","host":"s3://npm-registry-packages-npm-production"}},"0.1.0":{"name":"http-message-sig","version":"0.1.0","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.1.0","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"83fcaa343825755592f437c0dd950ee0f6931b6a","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.1.0.tgz","fileCount":7,"integrity":"sha512-F3ZRFxqgmo7RhftIr0mMi3yPJfqs7U0VHRlfq45pSbxHEXnh35c2BQoMSPp9Wxy4b5L8OvCNgUlb/pzdNeLM3Q==","signatures":[{"sig":"MEYCIQCvFPchXalcic/2ZObhqBLlBc56UWedB0kCqNV6BPwsIQIhAO/C/CPCbJFLewWVoji+k5o9lfpJ1dNiBF22dEtkD3iz","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":34619},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"d72fdec0bc57b02c8754fedc70d475512711850a","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","actor":{"name":"thibmeu","type":"user","email":"mail@thibaultmeunier.com"},"email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.7.0","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"22.1.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.1.0_1750149102264_0.8558664904850999","host":"s3://npm-registry-packages-npm-production"}},"0.2.0":{"name":"http-message-sig","version":"0.2.0","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"license":"Apache-2.0","_id":"http-message-sig@0.2.0","maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"},{"name":"Akshat Mahajan"}],"homepage":"https://github.com/cloudflareresearch/web-bot-auth#readme","bugs":{"url":"https://github.com/cloudflareresearch/web-bot-auth/issues"},"dist":{"shasum":"926e138f358e1e2bbab428544001b3bf8815abe9","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.2.0.tgz","fileCount":7,"integrity":"sha512-9fXSmxsdWDuMgk6Rd5Jc8Fa/wEblmRXZyO89KPkRrGsdeAwYlUkvS5oSOw6aOKKK/qKHNTq3jCHHTRCEid6RaQ==","signatures":[{"sig":"MEQCIA6c9TKaxjZXyMcw1IeUXRFVcUCyiSC8WJPhh5AbE9JcAiAX22hCpDVvbQoGEMDb7UqS2yKQrfZr4O8nhrT2w8jiOw==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":38575},"main":"./dist/index.js","types":"./dist/index.d.ts","module":"./dist/index.mjs","exports":{".":{"types":"./dist/index.d.ts","import":"./dist/index.mjs","require":"./dist/index.js"}},"gitHead":"a93fcb31de838574f6b482938e2a3195c647fa44","scripts":{"test":"vitest","build":"tsup src/index.ts --format cjs,esm --dts --clean","watch":"npm run build -- --watch src","prepublishOnly":"npm run build"},"_npmUser":{"name":"thibmeu","email":"mail@thibaultmeunier.com"},"repository":{"url":"git+https://github.com/cloudflareresearch/web-bot-auth.git","type":"git","directory":"packages/http-message-sig"},"_npmVersion":"10.8.2","description":"HTTP Message Signatures defined by RFC 9421","directories":{},"_nodeVersion":"22.8.0","dependencies":{"structured-headers":"2.0.2"},"_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/http-message-sig_0.2.0_1768380241239_0.23172450381084797","host":"s3://npm-registry-packages-npm-production"}},"0.3.0":{"name":"http-message-sig","version":"0.3.0","description":"HTTP Message Signatures defined by RFC 9421","main":"./dist/index.cjs","module":"./dist/index.mjs","types":"./dist/index.d.mts","exports":{".":{"import":{"types":"./dist/index.d.mts","default":"./dist/index.mjs"},"require":{"types":"./dist/index.d.cts","default":"./dist/index.cjs"}}},"scripts":{"build":"tsdown src/index.ts --format esm,cjs --target es2021","prepublishOnly":"npm run build","test":"vitest","watch":"npm run build -- --watch src"},"repository":{"type":"git","url":"git+https://github.com/cloudflare/web-bot-auth.git","directory":"packages/http-message-sig"},"keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"},{"name":"Akshat Mahajan"}],"license":"Apache-2.0","bugs":{"url":"https://github.com/cloudflare/web-bot-auth/issues"},"homepage":"https://github.com/cloudflare/web-bot-auth#readme","dependencies":{"structured-headers":"2.0.3"},"gitHead":"6a8ece9bd2a64d83fc7bf3d7f9fd7886900a7355","_id":"http-message-sig@0.3.0","_nodeVersion":"24.19.0","_npmVersion":"11.17.0","dist":{"integrity":"sha512-ossX5ZDDCRD+YtMzryp3gCg+5wqLFes1RVChEFmEE9Bzbd49Ts2IIIvFnTst/mYWx0ivrxrTTPsIIKKJ07s7+w==","shasum":"7bf6c0d460c3fc81f6cb386ab147f7ff3098dfdf","tarball":"https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.3.0.tgz","fileCount":7,"unpackedSize":75832,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/http-message-sig@0.3.0","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQDXY+nwhXIxdmqWVFbZUAMRiF+6gFwF1zdq1rVFHX4rzwIhAOEeKoEXTWtczzc+n76eRnd7COpjAOjD19EIdkXWsi2V"}]},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:4d576542-bceb-4f33-ad9a-447e76eed384"}},"directories":{},"maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/http-message-sig_0.3.0_1788184682318_0.5909394823566303"},"_hasShrinkwrap":false}},"time":{"created":"2025-04-14T15:38:55.458Z","modified":"2026-08-31T13:58:02.835Z","0.0.1":"2025-04-14T15:38:55.659Z","0.0.3":"2025-04-15T08:53:58.231Z","0.0.7":"2025-05-07T10:22:23.630Z","0.0.9":"2025-05-28T20:27:14.617Z","0.1.0":"2025-06-17T08:31:42.436Z","0.2.0":"2026-01-14T08:44:01.369Z","0.3.0":"2026-08-31T13:58:02.473Z"},"bugs":{"url":"https://github.com/cloudflare/web-bot-auth/issues"},"license":"Apache-2.0","homepage":"https://github.com/cloudflare/web-bot-auth#readme","keywords":["http-message-sig","rfc9421","cryptography","http-message-signatures","typescript"],"repository":{"type":"git","url":"git+https://github.com/cloudflare/web-bot-auth.git","directory":"packages/http-message-sig"},"description":"HTTP Message Signatures defined by RFC 9421","contributors":[{"name":"Daniel Hensby"},{"name":"LTO Network"},{"name":"Thibault Meunier"},{"name":"Akshat Mahajan"}],"maintainers":[{"name":"thibmeu","email":"mail@thibaultmeunier.com"}],"readme":"# http-message-sig\n\nCore [RFC 9421](https://www.rfc-editor.org/rfc/rfc9421.html) HTTP Message\nSignatures for TypeScript.\n\n## Capabilities\n\n| Capability                                 | Support                                                                                            |\n| ------------------------------------------ | -------------------------------------------------------------------------------------------------- |\n| Native `Request` and `Response`            | Yes, using Fetch-observable values                                                                 |\n| Final request/response descriptors         | Yes, with ordered field occurrences and optional trailers                                          |\n| Related request components (`req`)         | Yes, on response descriptors                                                                       |\n| Ordinary field components                  | Yes                                                                                                |\n| Structured Field dictionary member (`key`) | Yes, strict RFC 8941 parsing                                                                       |\n| Derived components                         | `@method`, `@target-uri`, `@authority`, `@scheme`, `@request-target`, `@path`, `@query`, `@status` |\n| Multiple signatures                        | Yes                                                                                                |\n| Async signing and verification             | Yes                                                                                                |\n| Synchronous signing                        | Yes                                                                                                |\n| Explicit verification policy               | Required                                                                                           |\n| WebCrypto providers                        | Ed25519 and RSA-PSS with SHA-512                                                                   |\n\n## Signing\n\n```typescript\nimport { appendSignature, createSignature } from \"http-message-sig\";\n\nconst fields = await createSignature(request, {\n  label: \"sig1\",\n  components: [\"@method\", \"@authority\", \"@path\", \"content-digest\"],\n  parameters: { created: 1_700_000_000, alg: signer.algorithm, keyid: \"key-1\" },\n  signer,\n});\n\nconst headers = appendSignature(request.headers, fields);\n```\n\nSigners consume UTF-8 signature-base bytes and expose `readonly algorithm`.\n`appendSignature` accepts `Headers` only, returns a clone, and atomically parses\nand merges both signature dictionaries.\n\nUse `component(\"example-dict\", { key: \"member\" })` for parameterized\ncomponents. `componentIdentity` returns the exact serialized component\nidentifier.\n\n## Verification\n\n```typescript\nimport { verifySignature } from \"http-message-sig\";\n\nconst verified = await verifySignature(request, {\n  policy: {\n    algorithms: [\"ed25519\"],\n    requiredComponents: [\"@method\", \"@authority\", \"@path\"],\n    requiredParameters: [\"created\", \"keyid\"],\n    maxAge: 300,\n    clockSkew: 5,\n  },\n  resolveVerifier(untrustedCandidate, context) {\n    return lookupVerifier(untrustedCandidate.parameters.keyid, context);\n  },\n});\n```\n\nThe resolver candidate is untrusted until cryptographic verification succeeds.\nThe optional policy `validate` callback receives authenticated data and runs\nonly after successful cryptographic verification.\n\n## Limitations\n\n- `sf`, `bs`, `tr`, `@query-param`, and unknown derived components are rejected\n  with `UnsupportedFeature`.\n- RFC 9651 dates and display strings are rejected in signature fields. Signature\n  metadata is limited to RFC 8941 bare items.\n- Fetch does not expose raw field occurrences or trailers. Use descriptors when\n  those values matter.\n- `Response` has no related request. Use a response descriptor for `req`.\n- Cryptographic algorithms and key discovery are supplied by the caller.\n- The former directory helpers and draft-era `signatureHeaders`, `verify`, and\n  `RequestLike` APIs were removed. Directory behavior belongs in the consuming\n  package and must migrate to `createSignature` plus `appendSignature`.\n\n## Errors\n\nLibrary validation failures use `SignatureError`, stable `SignatureErrorCode`\nvalues, and `isSignatureError`.\n\n## Security\n\nThis software has not been audited. Applications must define policy appropriate\nto their protocol, including algorithm, component, parameter, and freshness\nrequirements.\n\n## License\n\nApache-2.0.\n","readmeFilename":"README.md"}