chore: deprecate enveloped-signature after a canonicalization

[cjbarth]

Fixes #648. Refs #647.

A Reference that lists enveloped-signature after a canonicalization, such as [exc-c14n, enveloped-signature], signs and verifies, and the README says the reference processing model requires that. XMLDSig §6.6.4 applies the transform only to "a node-set from its parent XML document". After a canonicalization the library gives it a document parsed from octets, which isn't that.

I signed <root><x>1</x></root> with master in both orders:

Verifier	[enveloped-signature, exc-c14n]	[exc-c14n, enveloped-signature]
xml-crypto master	valid	valid
.NET System.Security.Cryptography.Xml 6.0.1	valid	valid
JDK 21 javax.xml.crypto.dsig	valid	invalid: the reference digest doesn't match
xmlsec	not run	not run; its source rejects it

This PR deprecates the order so that 7.0 can reject it (#647):

• Warning: applying enveloped-signature after octets were parsed prints the DeprecationWarning XML_CRYPTO_ENVELOPED_SIGNATURE_AFTER_CANONICALIZATION. It fires in computeSignature(), checkSignature() and getCanonXml(), once per process. The order still signs and verifies, with the same output.
• README: the section on transforms that follow a canonicalization says to list enveloped-signature first, and that the other order is deprecated and will throw in 7.0.

The warning has no test, like the other deprecations. The existing tests of this order stay until 7.0 removes it, and they print the warning once in the test output.

Checks

• npm run build && npm test && npm run lint pass (550 tests).
• The warning fires once for [exc-c14n, enveloped-signature] when signing and when verifying, and not for [enveloped-signature, exc-c14n].

This is for 6.4, so it should merge after #642.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 38 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fe42da66-34dc-40f3-af12-4564da5d3180

📥 Commits

Reviewing files that changed from the base of the PR and between fe2d091 and 3b9e80f.

📒 Files selected for processing (2)

• README.md
• src/signed-xml.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.42%. Comparing base (fe2d091) to head (3b9e80f).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #649      +/-   ##
==========================================
+ Coverage   86.36%   86.42%   +0.06%     
==========================================
  Files           9        9              
  Lines        1283     1289       +6     
  Branches      335      337       +2     
==========================================
+ Hits         1108     1114       +6     
  Misses        100      100              
  Partials       75       75              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.