@hellocoop/email-verification@2.2.1

What's Changed

• ci: make lint pass, so tests actually run by @dickhardt in #67

Full Changelog: https://github.com/hellocoop/packages-js/compare/@hellocoop/httpsig@2.0.0-alpha.2...@hellocoop/email-verification@2.2.1

@hellocoop/httpsig@2.0.0-alpha.2

Tracks draft-hardt-httpbis-signature-key-08, published to the IETF datatracker on 2026-08-05.

Published under the alpha dist-tag — npm install @hellocoop/httpsig still gives you 1.x.

npm install @hellocoop/httpsig@alpha

145 tests. See MIGRATING-2.0.md.

Since 2.0.0-alpha.1

Discovery metadata must carry a matching issuer. The document at {id}/.well-known/{dwk} must contain an issuer equal to id, compared by byte equality with no normalization. New issuer_missing and issuer_mismatch error codes.

This is a real security fix. 1.x followed jwks_uri wherever the metadata pointed, so a subdomain takeover or shared-hosting misconfiguration could get requests attributed to an identity that never signed them. It is the check RFC 8414 Section 3.3 requires of authorization server metadata. Documents conforming to RFC 8414 or OpenID Connect Discovery already carry issuer; a hand-rolled .well-known that omits it will now be rejected.

supportedAlgorithms lets a verifier declare which algorithms it accepts. A key outside the set is rejected with unsupported_algorithm, and the set comes back as acceptSignatureAlg for an Accept-Signature-Alg response header — deliberately not inside SignatureError, whose supported_algorithms member -08 removed. Defaults to everything the library implements, exported as SUPPORTED_ALGORITHMS.

Unusable keys elsewhere in a JWKS are skipped. Already the behaviour; now specified and tested, including an unparseable ML-DSA key placed before and after the usable one. Without this rule no issuer could ever add a post-quantum key alongside a classical one.

The alg signature parameter is ignored, and proven so — tests sign by hand with a misleading alg to confirm the key decides which operation runs.

Corrected the tracked revision to -08. alpha.0 and alpha.1 said -07, which was published on 2026-07-05 and was editorial. The hwk alg parameter was forbidden in -06 and -07 and becomes required in -08.

Known gaps

• jwks, self-jwt, x509 not implemented — additive, not breaking
• Assertion caching deliberately omitted; the draft calls it a straw man
• RFC 9421 and Go interop vectors predate this specification and do not cover signature-key, so they now assert rejection. Replacement coverage: dickhardt/signature-key#25

@hellocoop/httpsig@1.7.1

Security fix for the JWKS cache.

The JWKS cache was an unbounded Map with TTL checks on read and no eviction. Its key is a URL built from the request being verified — ${id}/.well-known/${dwk} and the jwks_uri discovered from it — so an unauthenticated signer chose the key by varying the id and dwk it presented, and could grow the map until the process ran out of memory. There was no work factor: each entry cost one request.

It is now a bounded LRU cache holding at most 100 entries. Eviction prefers an already-expired entry over a live one, so ordinary traffic keeps its working set while an attacker's entries are displaced first.

The cache is internal — nothing in the public API changes, and this is a drop-in upgrade from 1.7.0.

This release is cut from the new 1.x maintenance branch.

@hellocoop/httpsig@2.0.0-alpha.1

Corrects the tracked draft revision. This package tracks draft-hardt-httpbis-signature-key-08, not -07.

-07 was published to the IETF datatracker on 2026-07-05 and was editorial — a paragraph in the Introduction citing AAuth and Email Verification. All the normative work this package implements lands in -08. 2.0.0-alpha.0 said -07 throughout, including in its bundled README and migration guide.

In particular the hwk alg parameter was forbidden in -06 and -07, and becomes required in -08. The break this package straddles is -07 → -08.

No functional change from 2.0.0-alpha.0 — 132 tests, same behaviour. Documentation and comments only.

Published under the alpha dist-tag; npm install @hellocoop/httpsig still gives you 1.x.

npm install @hellocoop/httpsig@alpha

See MIGRATING-2.0.md.

@hellocoop/httpsig@2.0.0-alpha.0

First prerelease of the 2.x line, tracking draft-hardt-httpbis-signature-key-07.

Published under the alpha dist-tag. npm install @hellocoop/httpsig continues to give you 1.x. To try this:

npm install @hellocoop/httpsig@alpha

Not wire compatible with 1.x in either direction, and the protocol has no version negotiation, so both ends of a deployment must move together. The draft is not adopted and -07 is not final — expect further breaking changes before 2.0.0.

See MIGRATING-2.0.md for the full story.

Highlights

Algorithm determination is inverted. The algorithm comes from the JWK alg member and is never derived from kty/crv — those underdetermine it, since an RSA key has no crv and leaves padding and hash free, and an EC curve does not fix the hash. alg must be fully specified per RFC 9864, so polymorphic EdDSA is rejected in favour of Ed25519/Ed448. A key whose kty or crv disagrees with its alg is rejected rather than resolved in favour of either reading.

RSA is newly supported — PS256/384/512, RS256/384/512. Symmetric material (oct, HS*) is rejected outright. ML-DSA and the AKP key type are declined as unsupported_algorithm rather than treated as malformed.

hwk carries alg and rejects kid. -06 forbade the alg parameter and -07 requires it, so headers from the two are mutually unintelligible.

sigkey is replaced by the Accept-Signature-Scheme and Accept-Signature-Alg header fields. supported_algorithms is removed from Signature-Error; unsupported_scheme is added.

signature-key coverage is always enforced — the strictAAuth option is gone. The jwt scheme validates exp, which it previously ignored entirely.

Errors are typed — SignatureVerificationError carries the Signature-Error code directly.

Known gaps

• The jwks, self-jwt, and x509 schemes are not implemented.
• Assertion caching is deliberately not implemented; the draft calls it a straw man.
• RFC 9421 and Go interop vectors no longer verify — they predate this specification and do not cover signature-key. Replacement coverage is tracked in dickhardt/signature-key#25.

---

Superseded by 2.0.0-alpha.1. This release says -07 throughout, including in its bundled README and migration guide. The correct revision is -08 — -07 was published on 2026-07-05 and was editorial. The hwk alg parameter was forbidden in -06 and -07, and becomes required in -08.

@hellocoop/api@2.6.0

What's Changed

• chore: bump GitHub Actions to Node-24-compatible majors by @dickhardt in #64

Full Changelog: https://github.com/hellocoop/packages-js/compare/httpsig-v1.6.0...@hellocoop/api@2.6.0

httpsig v1.6.0

@hellocoop/httpsig 1.6.0

Added

• returnSent fetch option — when passed returnSent: true, fetch() returns { response, sent }, exposing the signed request that actually went on the wire (method, url, headers including Signature/Signature-Input/Content-Digest, body) for logging and audit.

This is a non-breaking, additive change. The option defaults to false; existing callers continue to receive a plain Response with no behavioral change. TypeScript overloads now return more precise types per option (dryRun → { headers }, returnSent → { response, sent }, neither → Response).

httpsig v1.5.1

@hellocoop/httpsig v1.5.1

• Add RSA JWK thumbprint support (RFC 7638) to calculateThumbprint
• Canonical form uses {e, kty, n} members in lexicographic order per the spec
• Prevents crashes when computing thumbprints against JWKS containing mixed key types (e.g. EdDSA + RSA)

httpsig v1.5.0

Export calculateThumbprint (RFC 7638 JWK thumbprint) as public API.

v1.4.0

@hellocoop/httpsig v1.4.0

New Features

• Browser support: Accept CryptoKey handle for signing via signingCryptoKey option when JWK has no private key material
• generateKeyPair() utility: Generate Ed25519 or ES256 key pairs with configurable extractable option
• Browser-safe base64: Replaced Node.js Buffer with btoa/atob for full browser compatibility

Backwards Compatible

Existing code passing a private JWK works exactly as before.