Checks a Visa TAP-shaped nonce for format, freshness against the created/expires window, and an optional caller-supplied seen-nonce record. Zero network, caller-supplied inputs only.
Visa TAPRFC 9421Web Bot AuthZero PIIClient-side only
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
Scope
Checks nonce format (minimum entropy, base64url), the created/expires spread against TAP's 8-minute limit, freshness against a caller-supplied now_unix, and (optionally) whether the caller's own seen-nonce record already contains this nonce. Feeds the signatures-directory validator (art-130) in the visa-tap-agent-verification chain.
⚠ Stateless-replay disclosure
Replay prevention depends on the caller supplying an accurate seen-nonce record from its own storage. This verifier is stateless and cannot detect replay on its own. Every kernel on AINumbers is a pure function invoked fresh per call with zero persistent storage; there is nowhere for this tool to remember a nonce between runs. The seen_nonces / nonce_already_used inputs below are trusted as given. A stale or empty seen-nonce set from the caller means this check cannot catch a replay, no matter how the tool is configured.
Presets
Result
Execution Hash & §4 Artifact
SHA-256 execution hash (JCS canonical, RFC 8785):
Chain Handoff → art-130
Pass the execution_hash above as parent_hashes[0] when calling validate_signature_directory (art-130) to continue the visa-tap-agent-verification chain.