@tollbooth-dpyc/web 1.8.1 → 1.8.2

package/dist/pagesProxy.d.ts

@@ -11,8 +11,15 @@
  *
  * Only the headers MCP needs are forwarded upstream. Cookies and anything else
  * the browser attached stay behind.
+ *
+ * Every request upstream carries a bearer. An operator with holder bearer on
+ * refuses a request without one; a page that holds no holder token is an
+ * anonymous caller, so the proxy says so with `Bearer anonymous` and the page
+ * proves itself with `dpop_token` as before. A page that does hold a token
+ * sends it, and it is forwarded untouched.
  */
 export declare const CORS_HEADERS: Record<string, string>;
+export declare const ANONYMOUS_BEARER = "Bearer anonymous";
 type Fetch = (input: string, init: RequestInit & {
     duplex?: string;
 }) => Promise<Response>;

package/dist/pagesProxy.js

@@ -11,14 +11,21 @@
  *
  * Only the headers MCP needs are forwarded upstream. Cookies and anything else
  * the browser attached stay behind.
+ *
+ * Every request upstream carries a bearer. An operator with holder bearer on
+ * refuses a request without one; a page that holds no holder token is an
+ * anonymous caller, so the proxy says so with `Bearer anonymous` and the page
+ * proves itself with `dpop_token` as before. A page that does hold a token
+ * sends it, and it is forwarded untouched.
  */
 export const CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
-    "Access-Control-Allow-Headers": "content-type, mcp-session-id, accept, last-event-id",
-    "Access-Control-Expose-Headers": "mcp-session-id",
+    "Access-Control-Allow-Headers": "content-type, mcp-session-id, accept, last-event-id, authorization",
+    "Access-Control-Expose-Headers": "mcp-session-id, www-authenticate",
 };
-const FORWARDED = new Set(["content-type", "accept", "mcp-session-id", "last-event-id"]);
+const FORWARDED = new Set(["content-type", "accept", "mcp-session-id", "last-event-id", "authorization"]);
+export const ANONYMOUS_BEARER = "Bearer anonymous";
 export function makeMcpProxy(upstream, fetchImpl = fetch) {
     const host = new URL(upstream).host;
     return async function onRequest(context) {
@@ -31,6 +38,8 @@ export function makeMcpProxy(upstream, fetchImpl = fetch) {
             if (FORWARDED.has(k.toLowerCase()))
                 headers.set(k, v);
         }
+        if (!headers.has("authorization"))
+            headers.set("Authorization", ANONYMOUS_BEARER);
         headers.set("Host", host);
         const init = { method: req.method, headers };
         if (req.method !== "GET" && req.method !== "HEAD" && req.method !== "DELETE") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tollbooth-dpyc/web",
-  "version": "1.8.1",
+  "version": "1.8.2",
   "description": "Shared browser SDK for Tollbooth DPYC operator front ends: npub sign-in, proofs, MCP client, profile and wallet",
   "license": "Apache-2.0",
   "author": "Lonnie VanZandt",