npm - @openmobilehub/attestomcp-gate - Versions diffs - 0.1.0 - Mend

@openmobilehub/attestomcp-gate 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (79) hide show

package/LICENSE +201 -0
package/README.md +172 -0
package/dist/ceremony/cartMandate.d.ts +61 -0
package/dist/ceremony/cartMandate.js +76 -0
package/dist/ceremony/challengeToken.d.ts +5 -0
package/dist/ceremony/challengeToken.js +43 -0
package/dist/ceremony/checkout-page.d.ts +85 -0
package/dist/ceremony/checkout-page.js +269 -0
package/dist/ceremony/completion.d.ts +41 -0
package/dist/ceremony/completion.js +90 -0
package/dist/ceremony/credential-gate/dcql.d.ts +10 -0
package/dist/ceremony/credential-gate/dcql.js +12 -0
package/dist/ceremony/credential-gate/doc-spec.d.ts +3 -0
package/dist/ceremony/credential-gate/doc-spec.js +16 -0
package/dist/ceremony/credential-gate/mdoc-verify.d.ts +15 -0
package/dist/ceremony/credential-gate/mdoc-verify.js +29 -0
package/dist/ceremony/credential-gate/page.d.ts +20 -0
package/dist/ceremony/credential-gate/page.js +136 -0
package/dist/ceremony/credential-gate/request.d.ts +15 -0
package/dist/ceremony/credential-gate/request.js +43 -0
package/dist/ceremony/credential-gate/routes.d.ts +2 -0
package/dist/ceremony/credential-gate/routes.js +200 -0
package/dist/ceremony/credential-gate/verify.d.ts +51 -0
package/dist/ceremony/credential-gate/verify.js +146 -0
package/dist/ceremony/dc-payment/dcql.d.ts +5 -0
package/dist/ceremony/dc-payment/dcql.js +23 -0
package/dist/ceremony/dc-payment/page.d.ts +18 -0
package/dist/ceremony/dc-payment/page.js +195 -0
package/dist/ceremony/dc-payment/request.d.ts +17 -0
package/dist/ceremony/dc-payment/request.js +50 -0
package/dist/ceremony/dc-payment/routes.d.ts +2 -0
package/dist/ceremony/dc-payment/routes.js +147 -0
package/dist/ceremony/dc-payment/txData.d.ts +19 -0
package/dist/ceremony/dc-payment/txData.js +34 -0
package/dist/ceremony/dc-payment/verify.d.ts +108 -0
package/dist/ceremony/dc-payment/verify.js +208 -0
package/dist/ceremony/mandate.d.ts +71 -0
package/dist/ceremony/mandate.js +116 -0
package/dist/ceremony/mdoc/mdoc-iso.d.ts +44 -0
package/dist/ceremony/mdoc/mdoc-iso.js +260 -0
package/dist/ceremony/mdoc/mdoc.d.ts +17 -0
package/dist/ceremony/mdoc/mdoc.js +94 -0
package/dist/ceremony/mdoc/reader.d.ts +10 -0
package/dist/ceremony/mdoc/reader.js +43 -0
package/dist/ceremony/mdoc/readerContext.d.ts +8 -0
package/dist/ceremony/mdoc/readerContext.js +29 -0
package/dist/ceremony/mount.d.ts +57 -0
package/dist/ceremony/mount.js +96 -0
package/dist/ceremony/origin.d.ts +10 -0
package/dist/ceremony/origin.js +9 -0
package/dist/ceremony/passkey/page.d.ts +6 -0
package/dist/ceremony/passkey/page.js +136 -0
package/dist/ceremony/passkey/routes.d.ts +2 -0
package/dist/ceremony/passkey/routes.js +170 -0
package/dist/ceremony/passkey/verify.d.ts +15 -0
package/dist/ceremony/passkey/verify.js +56 -0
package/dist/ceremony/reconciliation.d.ts +34 -0
package/dist/ceremony/reconciliation.js +21 -0
package/dist/ceremony/theme.d.ts +63 -0
package/dist/ceremony/theme.js +285 -0
package/dist/ceremony/types.d.ts +95 -0
package/dist/ceremony/types.js +1 -0
package/dist/client.d.ts +39 -0
package/dist/client.js +84 -0
package/dist/credentials.d.ts +48 -0
package/dist/credentials.js +127 -0
package/dist/envelope.d.ts +62 -0
package/dist/envelope.js +72 -0
package/dist/gated.d.ts +39 -0
package/dist/gated.js +41 -0
package/dist/index.d.ts +18 -0
package/dist/index.js +49 -0
package/dist/manifest.d.ts +28 -0
package/dist/manifest.js +76 -0
package/dist/store.d.ts +7 -0
package/dist/store.js +16 -0
package/dist/types.d.ts +146 -0
package/dist/types.js +7 -0
package/package.json +62 -0

package/dist/ceremony/passkey/page.js ADDED Viewed

@@ -0,0 +1,136 @@
+import { pageHead, brandHeader, progressRail, orderSummaryCard, trustFooter, settlingBar, completionHandoffBanner } from "../theme.js";
+function money(amount, currency) {
+    return new Intl.NumberFormat("en-US", { style: "currency", currency }).format(amount);
+}
+export function renderPasskeyPage(args) {
+    const { order, crossDevice = false } = args;
+    // Where the completed receipt links back to — the checkout hub, which then renders
+    // the paid state (a forward, fresh GET — so the buyer never browser-backs onto a
+    // stale, re-payable checkout). Defaults to this server's `/checkout?order=<id>`.
+    const returnUrl = args.returnUrl ?? `/checkout?order=${encodeURIComponent(order.id)}`;
+    const total = money(order.total, order.currency);
+    // The shared order summary card (line items + bold Total) — same chrome as the hub.
+    const summary = orderSummaryCard({
+        lines: order.lines.map((l) => ({ name: l.name ?? l.id, quantity: l.quantity, lineTotal: l.lineTotal, currency: l.currency ?? order.currency })),
+        total: order.total,
+        currency: order.currency,
+        caption: `Order ${order.id}`,
+    });
+    // Pay is the current (final) step; the upstream gates are done by the time payment runs.
+    const rail = progressRail([{ label: "Age", done: true }, { label: "Membership", done: true }, { label: "Pay" }], 2);
+    const tagline = crossDevice ? "Approve on your phone (scan a QR)" : "Authorize with this device";
+    // crossDevice pins the registration to a roaming authenticator, so the browser
+    // skips local Touch ID and shows the QR for a phone (caBLE). The toggle link flips
+    // the mode by adding/removing the xdev param on the same gate URL.
+    const optionsUrl = crossDevice ? "/attestomcp/passkey/options?xdev=1" : "/attestomcp/passkey/options";
+    const toggleHref = crossDevice ? `/attestomcp/passkey?order=${encodeURIComponent(order.id)}` : `/attestomcp/passkey?order=${encodeURIComponent(order.id)}&xdev=1`;
+    const toggleText = crossDevice ? "← Use this device instead" : "Use my phone instead (scan a QR) →";
+    // Page-local chrome over the shared design system: the verify-progress rows reuse
+    // `.step`; the receipt gate rows + the QR toggle link are page-specific.
+    const extraCss = `
+  #receipt { display: none; margin-top: 16px; }
+  .gate { font-size: .82rem; padding: 3px 0; }
+  .gate.pass { color: var(--success); } .gate.fail { color: var(--danger); }
+  .toggle { display: block; text-align: center; margin-top: 12px; font-size: .85rem; color: var(--accent); text-decoration: none; }
+  .toggle:hover { text-decoration: underline; }`;
+    return `<!doctype html>
+<html lang="en">
+${pageHead(`Authorize payment · ${order.id}`, extraCss)}
+<body>
+  <div class="wrap">
+  ${brandHeader({ h1: "Authorize payment", tagline })}
+  ${rail}
+  ${summary}
+  <div class="card">
+    <p class="lede">An agent prepared this order — confirm the exact amount with your device's secure element (Touch ID, Windows Hello, or a phone via cross-device sign-in). Once authorized, payment settles on-chain via the <strong>x402</strong> protocol — on a <strong>test network</strong>, no real money, a tiny token amount (a fixed demo rate, not the dollar total).</p>
+    <button id="go" class="btn btn-primary">Authorize ${total}</button>
+    <a class="toggle" href="${toggleHref}">${toggleText}</a>
+    <div id="log"></div>
+    ${settlingBar()}
+    <div id="receipt"></div>
+  </div>
+  ${trustFooter()}
+  <script type="module">
+    import { startRegistration } from "/attestomcp/lib/sw/index.js";
+    const ORDER_ID = ${JSON.stringify(order.id)};
+    const OPTIONS_URL = ${JSON.stringify(optionsUrl)};
+    const RETURN_URL = ${JSON.stringify(returnUrl)};
+    const DONE_BANNER = ${JSON.stringify(completionHandoffBanner(returnUrl))};
+    const log = document.getElementById("log");
+    const btn = document.getElementById("go");
+    const settling = document.getElementById("settling");
+    const step = (t, c = "") => { const d = document.createElement("div"); d.className = "step " + c; d.textContent = t; log.appendChild(d); };
+    const esc = (s) => String(s).replace(/[&<>"']/g, (c) => "&#" + c.charCodeAt(0) + ";");
+    btn.addEventListener("click", async () => {
+      btn.disabled = true;
+      try {
+        step("→ GET options");
+        const { options, challengeToken } = await fetch(OPTIONS_URL).then((r) => r.json());
+        step("→ Touch ID / passkey prompt");
+        const response = await startRegistration({ optionsJSON: options });
+        step("→ verify · Settling via x402 on Hedera testnet (if configured)… can take ~10s");
+        settling.classList.add("on");
+        const out = await fetch("/attestomcp/passkey/verify", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({ response, challengeToken, order: ORDER_ID }),
+        }).then((r) => r.json()).finally(() => settling.classList.remove("on"));
+        if (!out.mandate) throw new Error(out.error || "authorization failed");
+        step("✓ authorized · mandate built (" + out.trust_level + ")", "ok");
+        renderReceipt(out);
+        if (out.settlementError) { step("✗ settlement failed — authorized, not settled (retry below)", "err"); btn.disabled = false; }
+        else if (!out.completed) btn.disabled = false;
+      } catch (err) {
+        step("✗ " + (err?.message ?? String(err)), "err");
+        btn.disabled = false;
+      }
+    });
+    function renderReceipt(out) {
+      const el = document.getElementById("receipt");
+      const passCount = out.gates.filter((g) => g.pass).length;
+      const allPass = passCount === out.gates.length;
+      const gateLines = out.gates.map((g) => '<div class="gate ' + (g.pass ? "pass" : "fail") + '">' + (g.pass ? "✓" : "✗") + " " + esc(g.gate) + " — " + esc(g.detail) + "</div>").join("");
+      // The x402 on-chain settlement receipt — same .settle card the dc-payment rail
+      // renders: the tinybar amount, payer/merchant, speed, tx, and a PROMINENT
+      // tappable HashScan link (the buyer is on their phone; one tap to the live
+      // explorer is the third-party proof). A configured-but-failed settle is the
+      // calm "authorized, not settled" line (FR-013) — never an alarming wall.
+      const s = out.settlement;
+      const settlement = s
+        ? '<div class="settle"><div class="settle-head">✓ Settled via x402 on Hedera testnet</div>' +
+          '<dl class="kv">' +
+          "<dt>Amount</dt><dd>" + (s.amountTinybar / 1e8) + ' ℏ <span class="dim">(' + esc(s.fxRate) + ")</span></dd>" +
+          "<dt>From</dt><dd>" + esc(s.payer.accountId) + ' <span class="dim">' +
+          (s.payer.kind === "session-wallet"
+            ? "wallet created for this order, " + (s.walletAgeMs / 1000).toFixed(1) + "s old when it paid"
+            : "demo customer") + "</span></dd>" +
+          "<dt>To</dt><dd>" + esc(s.payTo) + ' <span class="dim">merchant</span></dd>' +
+          "<dt>Speed</dt><dd>settled in " + (s.settledInMs / 1000).toFixed(1) + "s</dd>" +
+          '<dt>Tx</dt><dd><span class="mono">' + esc(s.txId) + "</span></dd>" +
+          "</dl>" +
+          '<a class="hashscan" href="' + esc(s.hashscanUrl) + '" target="_blank" rel="noopener">View on HashScan ›</a>' +
+          "</div>"
+        : out.settlementError
+          ? '<div class="settle-failed">✗ Settlement failed — authorized, not settled: ' + esc(out.settlementError) + "</div>"
+          : "";
+      // Every gate + payment is done ⇒ the order is COMPLETE. Lead with the prominent
+      // handoff: close this window and continue in the agent (the MCP host polls
+      // order-status and resumes). No auto-redirect — we don't yank the buyer off the
+      // "you're done" message; the on-chain proof + a secondary return link stay below.
+      const done = out.completed ? DONE_BANNER : "";
+      const gates = '<div class="gate ' + (allPass ? "pass" : "fail") + '">' +
+        (allPass ? "✓ All " + out.gates.length + " authorization gates passed" : "✗ " + (out.gates.length - passCount) + " of " + out.gates.length + " failed") + "</div>" + gateLines;
+      el.innerHTML = done + '<div class="row-ok">✓ Payment Mandate authorized (amount-bound)</div>' +
+        '<div class="small" style="margin:4px 0 8px;">' + esc(out.mandate.id) + "</div>" + gates + settlement;
+      el.style.display = "block";
+      if (out.completed) {
+        btn.disabled = true;
+        btn.textContent = "Authorized ✓";
+      }
+    }
+  </script>
+  </div>
+</body>
+</html>`;
+}

package/dist/ceremony/passkey/routes.d.ts ADDED Viewed

	@@ -0,0 +1,2 @@
1	+ import { type RailRegistrar } from "../mount.js";
2	+ export declare const registerPasskeyGate: RailRegistrar;

package/dist/ceremony/passkey/routes.js ADDED Viewed

@@ -0,0 +1,170 @@
+// The passkey payment rail (US2) — same-device (Touch ID / Windows Hello) and
+// cross-device (FIDO caBLE). Registers its routes onto the host app through the
+// Foundational mount() seam:
+//   GET  /attestomcp/passkey?order=<id>[&xdev=1]   → the authorize page (xdev toggle)
+//   GET  /attestomcp/passkey/options[?xdev=1]      → WebAuthn options + signed challenge token
+//   POST /attestomcp/passkey/verify                → verify assertion → four gates → completeOrder
+//   GET  /attestomcp/lib/sw/*                       → @simplewebauthn/browser ESM, same-origin
+//
+// Dependency-free (no `express` import — invariant from mount.ts): handlers are
+// registered against the structural CeremonyApp.get/post/use, the verify body is
+// read either from a host-installed parser (`req.body`) or off the request stream,
+// and the browser ESM is served from disk (no `express.static`).
+//
+// EVERY route resolves the order by id THROUGH `resolveOrder` (catalog re-pricing;
+// a tampered/unknown id is refused — CT3, invariant 2). Completion runs through the
+// SHARED `completeOrder` seam (ctx.completion) — the same path dc-payment uses — so
+// re-pricing, the age gate, settlement, and state-clearing behave identically
+// across rails (FR-008). WebAuthn stays bound to this server's origin/RP-ID with a
+// sealed, time-limited, single-use challenge (FR-007, invariant 6).
+//
+// Trust is PRESENCE-ONLY (Principle VII / FR-011): the WebAuthn flow is real, but
+// the mandate is dev-signed — a flow demo, not a real safety control.
+import { createRequire } from "node:module";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+import { resolveOrder } from "../mount.js";
+import { buildPasskeyMandate, buildBindingFields, runGates } from "../mandate.js";
+import { buildRegistrationOptions, verifyPasskeyAssertion } from "./verify.js";
+import { renderPasskeyPage } from "./page.js";
+function firstHeader(value) {
+    return Array.isArray(value) ? value[0] : value;
+}
+function originOf(ctx, req) {
+    const reqLike = { headers: req.headers, host: firstHeader(req.headers.host) ?? "localhost", protocol: req.protocol };
+    return ctx.origin(reqLike);
+}
+function isCrossDevice(raw) {
+    return (Array.isArray(raw) ? raw[0] : raw) === "1";
+}
+// Read the JSON body from a host-installed parser, or straight off the stream when
+// no parser ran (so the rail is self-contained — it doesn't require express.json()).
+async function readJsonBody(req) {
+    if (req.body && typeof req.body === "object")
+        return req.body;
+    try {
+        const chunks = [];
+        for await (const chunk of req) {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        if (chunks.length === 0)
+            return {};
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+const CONTENT_TYPES = {
+    ".js": "text/javascript",
+    ".mjs": "text/javascript",
+    ".map": "application/json",
+    ".json": "application/json",
+    ".ts": "text/plain",
+};
+// Resolve @simplewebauthn/browser's ESM dir (its `main` is script/index.js; walk
+// up two levels to the package root, then into /esm). Fail LOUDLY at wire-up if the
+// layout changed, rather than silently 404-ing the browser module at runtime.
+function resolveBrowserEsmDir() {
+    const requireFrom = createRequire(import.meta.url);
+    const scriptIndexPath = requireFrom.resolve("@simplewebauthn/browser");
+    const dir = path.join(path.dirname(path.dirname(scriptIndexPath)), "esm");
+    if (!existsSync(path.join(dir, "index.js"))) {
+        throw new Error(`[attestomcp] @simplewebauthn/browser ESM not found at ${dir}`);
+    }
+    return dir;
+}
+export const registerPasskeyGate = (app, ctx) => {
+    // The Foundational fail-fast tests mount() with a route-less app shape; only
+    // attach when the host app can actually route.
+    const get = app.get?.bind(app);
+    const post = app.post?.bind(app);
+    const use = app.use?.bind(app);
+    if (!get || !post || !use)
+        return;
+    // Serve @simplewebauthn/browser ESM same-origin (no CDN) — dependency-free file
+    // serving with path-traversal containment.
+    const browserEsmDir = resolveBrowserEsmDir();
+    use("/attestomcp/lib/sw", (req, res) => {
+        const rel = (req.path ?? req.url ?? "/").split("?")[0];
+        const filePath = path.resolve(browserEsmDir, "." + rel);
+        // Containment: a resolved path must stay inside the served ESM directory.
+        if (filePath !== browserEsmDir && !filePath.startsWith(browserEsmDir + path.sep)) {
+            res.status(403).type("text/plain").send("forbidden");
+            return;
+        }
+        if (!existsSync(filePath) || !statSync(filePath).isFile()) {
+            res.status(404).type("text/plain").send("not found");
+            return;
+        }
+        const mime = CONTENT_TYPES[path.extname(filePath)] ?? "application/octet-stream";
+        res.status(200).type(mime).send(readFileSync(filePath, "utf8"));
+    });
+    // GET the authorize page — re-priced order, presence-only honesty banner.
+    get("/attestomcp/passkey", async (req, res) => {
+        const order = await resolveOrder(ctx, typeof req.query.order === "string" ? req.query.order : undefined);
+        if (!order) {
+            res.status(404).type("html").send("<!doctype html><h1>Order not found</h1>");
+            return;
+        }
+        try {
+            res.status(200).type("html").send(renderPasskeyPage({ order, crossDevice: isCrossDevice(req.query.xdev) }));
+        }
+        catch {
+            // A hand-edited order can carry a bad currency that throws in Intl; never 500.
+            res.status(404).type("html").send("<!doctype html><h1>Order not found</h1>");
+        }
+    });
+    // GET WebAuthn options + a signed challenge token (order-independent — the
+    // challenge binds to this origin/RP-ID, the order is bound at verify).
+    get("/attestomcp/passkey/options", async (req, res) => {
+        const { options, challengeToken } = await buildRegistrationOptions(originOf(ctx, req), ctx.signingKey, {
+            crossDevice: isCrossDevice(req.query.xdev),
+        });
+        res.json({ options, challengeToken });
+    });
+    // POST verify — recover the nonce, verify the assertion against this origin/RP-ID,
+    // build the AP2 mandate, run the four deterministic gates, and complete through
+    // the SHARED completeOrder seam (re-price + age gate + idempotent record).
+    post("/attestomcp/passkey/verify", async (req, res) => {
+        const body = await readJsonBody(req);
+        const order = await resolveOrder(ctx, typeof body.order === "string" ? body.order : undefined);
+        if (!order) {
+            res.status(400).json({ completed: false, error: "missing or invalid order" });
+            return;
+        }
+        try {
+            const origin = originOf(ctx, req);
+            const authenticator = await verifyPasskeyAssertion({
+                response: body.response,
+                challengeToken: String(body.challengeToken ?? ""),
+                origin,
+                secret: ctx.signingKey,
+            });
+            const mandate = buildPasskeyMandate({ order, authenticator, origin });
+            const gates = runGates(mandate);
+            const completion = await ctx.completion({
+                order,
+                mandateId: mandate.id,
+                amount: mandate.payment.amount,
+                currency: mandate.payment.currency,
+                method: "passkey",
+                instrument: { issuer: mandate.payment.instrument, maskedAccount: mandate.payment.instrumentReference, holder: null },
+                gates: gates.map((g) => ({ gate: g.gate, pass: g.pass, detail: g.detail })),
+            });
+            res.json({
+                mandate,
+                gates,
+                completed: completion.completed,
+                settlement: completion.settlement ?? null,
+                settlementError: completion.settlementError ?? null,
+                reason: completion.reason ?? null,
+                binding: buildBindingFields(order, origin),
+                trust_level: "presence-only-demo",
+            });
+        }
+        catch (err) {
+            res.status(400).json({ completed: false, error: err.message });
+        }
+    });
+};

package/dist/ceremony/passkey/verify.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import { type RegistrationResponseJSON } from "@simplewebauthn/server";
+import type { Origin } from "../origin.js";
+import type { VerifiedAuthenticator } from "../mandate.js";
+export declare function buildRegistrationOptions(origin: Origin, secret: string, opts?: {
+    crossDevice?: boolean;
+}): Promise<{
+    options: import("@simplewebauthn/server").PublicKeyCredentialCreationOptionsJSON;
+    challengeToken: string;
+}>;
+export declare function verifyPasskeyAssertion(args: {
+    response: RegistrationResponseJSON;
+    challengeToken: string;
+    origin: Origin;
+    secret: string;
+}): Promise<VerifiedAuthenticator>;

package/dist/ceremony/passkey/verify.js ADDED Viewed

@@ -0,0 +1,56 @@
+// The passkey rail's WebAuthn step (US2) — extracted from the demo's
+// payment-gate/passkey/verify.ts. A single registration ceremony is the
+// authorization gesture: the challenge is recovered from the signed token
+// (stateless — survives an options→verify instance split), and the assertion is
+// verified against THIS server's origin/RP-ID with user verification required
+// (invariant 6). The signing secret is the injected `signingKey` seam (mount()
+// requires a stable one — D6), never a process global.
+//
+// Trust is PRESENCE-ONLY (Principle VII / FR-011): the attestation flow is real,
+// but the mandate it feeds (mandate.ts) is dev-signed, not key-bound — a flow
+// demo, not a real safety control.
+import { generateRegistrationOptions, verifyRegistrationResponse, } from "@simplewebauthn/server";
+import { issueChallenge, verifyChallenge } from "../challengeToken.js";
+const RP_NAME = "AttestoMcp Gate";
+// Build registration options + a signed challenge token. userID is ephemeral —
+// we never persist the credential, so a fresh random user each time is fine.
+// crossDevice pins authenticatorAttachment to "cross-platform", which removes the
+// local Touch ID option so the browser goes straight to the phone/QR (caBLE) path.
+export async function buildRegistrationOptions(origin, secret, opts = {}) {
+    const { challenge, token } = issueChallenge(secret);
+    const options = await generateRegistrationOptions({
+        rpName: RP_NAME,
+        rpID: origin.rpID,
+        userName: "attestomcp-gate-user",
+        challenge: Buffer.from(challenge, "base64url"),
+        attestationType: "none",
+        authenticatorSelection: {
+            residentKey: "preferred",
+            userVerification: "required",
+            ...(opts.crossDevice ? { authenticatorAttachment: "cross-platform" } : {}),
+        },
+    });
+    return { options, challengeToken: token };
+}
+export async function verifyPasskeyAssertion(args) {
+    // Recover + validate the sealed, time-limited nonce FIRST — a forged or expired
+    // token is rejected before any attestation parsing (invariant 6).
+    const expectedChallenge = verifyChallenge(args.challengeToken, args.secret);
+    const verification = await verifyRegistrationResponse({
+        response: args.response,
+        expectedChallenge,
+        expectedOrigin: args.origin.origin,
+        expectedRPID: args.origin.rpID,
+        requireUserVerification: true,
+    });
+    if (!verification.verified || !verification.registrationInfo) {
+        throw new Error("registration not verified");
+    }
+    const info = verification.registrationInfo;
+    return {
+        credentialID: info.credential.id,
+        userVerified: true,
+        credentialDeviceType: info.credentialDeviceType,
+        credentialBackedUp: info.credentialBackedUp,
+    };
+}

package/dist/ceremony/reconciliation.d.ts ADDED Viewed

@@ -0,0 +1,34 @@
+import type { CartMandate } from "./cartMandate.js";
+/** The Payment Mandate's bound fields as they reach the completion seam — each rail
+ *  projects them from its verified `mandate.payment` (+ the id of the order the
+ *  payment authorizes). Scalars, not the mandate object, so the seam stays
+ *  decoupled from the passkey/dc-payment mandate shapes. */
+export interface PaymentBinding {
+    /** The Payment Mandate's bound amount (`mandate.payment.amount`). */
+    amount: number;
+    /** The Payment Mandate's bound currency (`mandate.payment.currency`). */
+    currency: string;
+    /** The order id the payment authorizes (the mandate's cart/subject). */
+    orderId: string;
+}
+/** Why a Cart ↔ Payment reconciliation refused. */
+export type ReconcileRefusal = "order-id" | "currency" | "amount";
+export type ReconcileVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    reason: ReconcileRefusal;
+};
+/**
+ * Reconcile a (signature-verified) Cart Mandate with the Payment Mandate's binding,
+ * given the catalog-RE-DERIVED total (server-side truth, never the token — invariant
+ * 2). The verdict is `ok` only when all three agree:
+ *   1. order id / subject — the cart and the payment authorize the SAME order
+ *      (a Cart Mandate swapped onto another order's payment is refused);
+ *   2. currency — the cart and the payment settle in the same currency;
+ *   3. amount — `cart.total === rederivedTotal === payment.amount`, a single bound
+ *      figure (a cart sealed for X against a payment for Y≠X is refused; a discount
+ *      reconciles only when the re-derived total already reflects it — invariant 3).
+ * Returns a typed verdict; it never throws.
+ */
+export declare function reconcileCartPayment(cart: CartMandate, payment: PaymentBinding, rederivedTotal: number): ReconcileVerdict;

package/dist/ceremony/reconciliation.js ADDED Viewed

@@ -0,0 +1,21 @@
+/**
+ * Reconcile a (signature-verified) Cart Mandate with the Payment Mandate's binding,
+ * given the catalog-RE-DERIVED total (server-side truth, never the token — invariant
+ * 2). The verdict is `ok` only when all three agree:
+ *   1. order id / subject — the cart and the payment authorize the SAME order
+ *      (a Cart Mandate swapped onto another order's payment is refused);
+ *   2. currency — the cart and the payment settle in the same currency;
+ *   3. amount — `cart.total === rederivedTotal === payment.amount`, a single bound
+ *      figure (a cart sealed for X against a payment for Y≠X is refused; a discount
+ *      reconciles only when the re-derived total already reflects it — invariant 3).
+ * Returns a typed verdict; it never throws.
+ */
+export function reconcileCartPayment(cart, payment, rederivedTotal) {
+    if (cart.orderId !== payment.orderId)
+        return { ok: false, reason: "order-id" };
+    if (cart.currency !== payment.currency)
+        return { ok: false, reason: "currency" };
+    if (cart.total !== rederivedTotal || cart.total !== payment.amount)
+        return { ok: false, reason: "amount" };
+    return { ok: true };
+}

package/dist/ceremony/theme.d.ts ADDED Viewed

@@ -0,0 +1,63 @@
+/** <head> with the shared design-system CSS. `extraCss` lets a page add the few
+ *  component styles unique to it without forking the design language. */
+export declare function pageHead(title: string, extraCss?: string): string;
+/** The ATTESTOMCP wordmark + a discreet DEMO pill, with an optional confident h1 +
+ *  identity-first tagline underneath. Pass `h1`/`tagline` to render the heading block;
+ *  omit them to render just the brand row (a page can lay out its own heading). */
+export declare function brandHeader(opts?: {
+    h1?: string;
+    tagline?: string;
+}): string;
+/** An indeterminate "settling…" progress bar (hidden until JS adds `.on`). Shown on
+ *  the payment rails while x402 settlement runs on-chain (~10s) so the wait reads as
+ *  live work. `id` defaults to "settling" for the page script to toggle. */
+export declare function settlingBar(id?: string): string;
+/**
+ * The prominent end-of-ceremony handoff banner: every attestation + payment is done,
+ * so the order is COMPLETE. It tells the buyer they can close the window and continue
+ * in their agent — the MCP host polls order-status and resumes the conversation
+ * automatically (Mode A: the agent never runs the ceremony, it only orchestrates +
+ * polls). An optional secondary link returns to the checkout hub for a pure-browser
+ * flow. Built server-side and embedded into the gate page's receipt script.
+ */
+export declare function completionHandoffBanner(returnUrl?: string): string;
+export interface OrderSummaryLine {
+    /** Display label (e.g. "Oak Whiskey"). */
+    name: string;
+    quantity: number;
+    lineTotal: number;
+    /** ISO 4217; falls back to the card currency. */
+    currency?: string;
+}
+export interface OrderSummaryArgs {
+    lines: OrderSummaryLine[];
+    total: number;
+    /** Major-units discount; the accent row renders only when > 0. */
+    discount?: number;
+    currency: string;
+    /** Optional label on the discount row, e.g. "Loyalty discount (10%)". */
+    discountLabel?: string;
+    /** Optional caption above the table (e.g. "Order ORD-1 · 2 items"). */
+    caption?: string;
+}
+/** The order summary card: line items, an accent discount row, a bold Total with a
+ *  top hairline. Money is tabular. Shared by all three pages so the cart reads the
+ *  same everywhere. */
+export declare function orderSummaryCard(args: OrderSummaryArgs): string;
+export interface RailStep {
+    label: string;
+    /** true once this step's verification is recorded. */
+    done?: boolean;
+}
+/**
+ * The Age · Membership · Pay stepper. DONE = filled accent with ✓; CURRENT (the step
+ * at `currentIndex`, when not already done) = accent ring; everything else = muted.
+ * The hub passes real status; each gate page marks its OWN step current.
+ */
+export declare function progressRail(steps: RailStep[], currentIndex: number): string;
+/**
+ * The single, DISCREET presence-only honesty line (replaces the old yellow warning
+ * box). It MUST keep the literal "presence-only-demo" token (FR-011 + the honesty
+ * tests) — the wire crypto is real; the issuer trust anchor is not.
+ */
+export declare function trustFooter(): string;