mppx 0.0.0-main-20260715214817

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026-present weth, LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,178 @@
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset=".github/logo-dark.svg">
+  <source media="(prefers-color-scheme: light)" srcset=".github/logo-light.svg">
+  <img alt="mppx" src=".github/logo-light.svg" width="100%" height="100px">
+</picture>
+
+<p></p>
+
+<p align="center"><b>TypeScript SDK for the <a href="https://mpp.dev">Machine Payments Protocol</a></b></p>
+
+<p align="center">
+  <a href="https://mpp.dev/sdk/typescript">Documentation</a> · <a href="#install">Install</a> · <a href="#quick-start">Quick Start</a> · <a href="#examples">Examples</a> · <a href="#cli">CLI</a> · <a href="#payments-proxy">Payments Proxy</a> · <a href="https://github.com/tempoxyz/mpp-specs">Protocol</a>
+</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/mppx">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/npm/v/mppx?colorA=21262d&colorB=21262d&style=flat">
+      <img src="https://img.shields.io/npm/v/mppx?colorA=f6f8fa&colorB=f6f8fa&style=flat" alt="Version">
+    </picture>
+  </a>
+  <a href="https://github.com/wevm/mppx/blob/main/LICENSE">
+    <picture>
+      <source media="(prefers-color-scheme: dark)" srcset="https://img.shields.io/npm/l/mppx?colorA=21262d&colorB=21262d&style=flat">
+      <img src="https://img.shields.io/npm/l/mppx?colorA=f6f8fa&colorB=f6f8fa&style=flat" alt="MIT License">
+    </picture>
+  </a>
+</p>
+
+---
+
+## Documentation
+
+Full documentation, API reference, and guides are available at **[mpp.dev/sdk/typescript](https://mpp.dev/sdk/typescript)**.
+
+## Install
+
+```bash
+npm i mppx
+```
+
+## Quick Start
+
+### Server
+
+```ts
+import { Mppx, tempo } from 'mppx/server'
+
+const mppx = Mppx.create({
+  methods: [
+    tempo({
+      currency: '0x20c0000000000000000000000000000000000000',
+      recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
+    }),
+  ],
+  secretKey: process.env.MPP_SECRET_KEY!,
+})
+
+export async function handler(request: Request) {
+  const response = await mppx.charge({ amount: '1' })(request)
+
+  if (response.status === 402) return response.challenge
+
+  return response.withReceipt(Response.json({ data: '...' }))
+}
+```
+
+Generate `MPP_SECRET_KEY` with at least 32 bytes, for example: `openssl rand -base64 32`.
+
+### Client
+
+```ts
+import { privateKeyToAccount } from 'viem/accounts'
+import { Mppx, tempo } from 'mppx/client'
+
+Mppx.create({
+  methods: [tempo({ account: privateKeyToAccount('0x...') })],
+})
+
+// Global fetch now handles 402 automatically
+const res = await fetch('https://mpp.dev/api/ping/paid')
+```
+
+## Examples
+
+| Example                                                | Description                                          |
+| ------------------------------------------------------ | ---------------------------------------------------- |
+| [charge](./examples/charge/)                           | Payment-gated photo generation API                   |
+| [charge-wagmi](./examples/charge-wagmi/)               | Payment-gated charge with Wagmi + React              |
+| [session/multi-fetch](./examples/session/multi-fetch/) | Multiple paid requests over a single payment channel |
+| [session/sse](./examples/session/sse/)                 | Pay-per-token LLM streaming with SSE                 |
+| [stripe](./examples/stripe/)                           | Stripe SPT charge with automatic client              |
+
+```bash
+npx gitpick wevm/mppx/examples/charge
+```
+
+## CLI
+
+`mppx` includes a basic CLI for making HTTP requests with automatic payment handling.
+
+```bash
+# create account - stored in keychain, autofunded on testnet
+mppx account create
+
+# make request - automatic payment handling, curl-like api
+mppx example.com
+```
+
+You can also install globally to use the `mppx` CLI from anywhere:
+
+```bash
+npm i -g mppx
+```
+
+## Payments Proxy
+
+`mppx` exports a `Proxy` server handler so that you can create or define a 402-protected payments proxy for any API.
+
+```ts
+import { openai, stripe, Proxy } from 'mppx/proxy'
+import { Mppx, tempo } from 'mppx/server'
+
+const mppx = Mppx.create({
+  methods: [tempo()],
+  secretKey: process.env.MPP_SECRET_KEY!,
+})
+
+const proxy = Proxy.create({
+  services: [
+    openai({
+      apiKey: 'sk-...',
+      routes: {
+        'POST /v1/chat/completions': mppx.charge({ amount: '0.05' }),
+        'POST /v1/completions': mppx.tempo.session({
+          amount: '0.0001',
+          unitType: 'token',
+        }),
+        'GET /v1/models': true,
+      },
+    }),
+    stripe({
+      apiKey: 'sk-...',
+      routes: {
+        'POST /v1/charges': mppx.charge({ amount: '0.01' }),
+        'GET /v1/customers/:id': true,
+      },
+    }),
+  ],
+})
+
+createServer(proxy.listener) // Node.js
+Bun.serve(proxy) // Bun
+Deno.serve(proxy.fetch) // Deno
+app.use(proxy.listener) // Express
+app.all('*', (c) => proxy.fetch(c.req.raw)) // Hono
+app.all('*', (c) => proxy.fetch(c.request)) // Elysia
+export const GET = proxy.fetch // Next.js
+export const POST = proxy.fetch // Next.js
+```
+
+This exposes the following routes:
+
+| Route                              | Pricing                       |
+| ---------------------------------- | ----------------------------- |
+| `POST /openai/v1/chat/completions` | charge **$0.005**             |
+| `POST /openai/v1/completions`      | session **$0.0001 per token** |
+| `GET /openai/v1/models`            | free                          |
+| `POST /stripe/v1/charges`          | charge **$0.01**              |
+| `GET /stripe/v1/customers/:id`     | free                          |
+
+## Protocol
+
+Built on the ["Payment" HTTP Authentication Scheme](https://datatracker.ietf.org/doc/draft-ryan-httpauth-payment/). See [mpp-specs](https://github.com/tempoxyz/mpp-specs) for the full specification.
+
+## License
+
+MIT

package/dist/BodyDigest.d.ts

@@ -0,0 +1,42 @@
+/**
+ * A body digest string in the format "algorithm=base64hash".
+ *
+ * @example
+ * ```ts
+ * import { BodyDigest } from 'mppx'
+ *
+ * const digest: BodyDigest.BodyDigest = 'sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE'
+ * ```
+ */
+export type BodyDigest = `sha-256=${string}`;
+/**
+ * Computes a SHA-256 digest of the given body.
+ *
+ * @param body - The body to digest (string or object).
+ * @returns A digest string in the format "sha-256=base64hash".
+ *
+ * @example
+ * ```ts
+ * import { BodyDigest } from 'mppx'
+ *
+ * const digest = BodyDigest.compute({ amount: '1000' })
+ * // => 'sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE'
+ * ```
+ */
+export declare function compute(body: Record<string, unknown> | string): BodyDigest;
+/**
+ * Verifies that a digest matches the given body.
+ *
+ * @param digest - The digest to verify.
+ * @param body - The body to verify against.
+ * @returns True if the digest matches, false otherwise.
+ *
+ * @example
+ * ```ts
+ * import { BodyDigest } from 'mppx'
+ *
+ * const isValid = BodyDigest.verify(digest, '{"amount":"1000"}')
+ * ```
+ */
+export declare function verify(digest: BodyDigest, body: Record<string, unknown> | string): boolean;
+//# sourceMappingURL=BodyDigest.d.ts.map

package/dist/BodyDigest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BodyDigest.d.ts","sourceRoot":"","sources":["../src/BodyDigest.ts"],"names":[],"mappings":"AAIA;;;;;;;;;GASG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,MAAM,EAAE,CAAA;AAE5C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,UAAU,CAM1E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,OAAO,CAE1F"}

package/dist/BodyDigest.js

@@ -0,0 +1,41 @@
+import { Base64, Bytes, Hash } from 'ox';
+import { constantTimeEqual } from './internal/constantTimeEqual.js';
+/**
+ * Computes a SHA-256 digest of the given body.
+ *
+ * @param body - The body to digest (string or object).
+ * @returns A digest string in the format "sha-256=base64hash".
+ *
+ * @example
+ * ```ts
+ * import { BodyDigest } from 'mppx'
+ *
+ * const digest = BodyDigest.compute({ amount: '1000' })
+ * // => 'sha-256=X48E9qOokqqrvdts8nOJRJN3OWDUoyWxBf7kbu9DBPE'
+ * ```
+ */
+export function compute(body) {
+    const str = typeof body === 'object' ? JSON.stringify(body) : body;
+    const bytes = Bytes.fromString(str);
+    const hash = Hash.sha256(bytes, { as: 'Bytes' });
+    const base64 = Base64.fromBytes(hash);
+    return `sha-256=${base64}`;
+}
+/**
+ * Verifies that a digest matches the given body.
+ *
+ * @param digest - The digest to verify.
+ * @param body - The body to verify against.
+ * @returns True if the digest matches, false otherwise.
+ *
+ * @example
+ * ```ts
+ * import { BodyDigest } from 'mppx'
+ *
+ * const isValid = BodyDigest.verify(digest, '{"amount":"1000"}')
+ * ```
+ */
+export function verify(digest, body) {
+    return constantTimeEqual(compute(body), digest);
+}
+//# sourceMappingURL=BodyDigest.js.map

package/dist/BodyDigest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BodyDigest.js","sourceRoot":"","sources":["../src/BodyDigest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAExC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAA;AAcnE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,OAAO,CAAC,IAAsC;IAC5D,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACrC,OAAO,WAAW,MAAM,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAsC;IAC/E,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC"}

package/dist/Challenge.d.ts

@@ -0,0 +1,312 @@
+import type { OneOf } from './internal/types.js';
+import type * as Method from './Method.js';
+import * as PaymentRequest from './PaymentRequest.js';
+import * as z from './zod.js';
+/**
+ * Schema for a payment challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.Schema.parse(data)
+ * ```
+ */
+export declare const Schema: z.ZodMiniObject<{
+    description: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    digest: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    expires: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    id: z.ZodMiniString<string>;
+    intent: z.ZodMiniString<string>;
+    method: z.ZodMiniString<string>;
+    meta: z.ZodMiniOptional<z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>>;
+    opaque: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    realm: z.ZodMiniString<string>;
+    request: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniUnknown>;
+}, z.core.$strip>;
+/**
+ * A parsed payment challenge from a `WWW-Authenticate` header.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge: Challenge.Challenge = {
+ *   id: 'abc123',
+ *   realm: 'api.example.com',
+ *   method: 'tempo',
+ *   intent: 'charge',
+ *   request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
+ * }
+ * ```
+ */
+export type Challenge<request = Record<string, unknown>, intent extends string = string, method extends string = string> = Omit<z.infer<typeof Schema>, 'intent' | 'method' | 'request'> & {
+    intent: intent;
+    method: method;
+    request: request;
+};
+/**
+ * Extracts a union of challenge types from an array of methods.
+ */
+export type FromMethods<methods extends readonly Method.Method[]> = {
+    [method in keyof methods]: Challenge<z.output<methods[method]['schema']['request']>, methods[method]['intent'], methods[method]['name']>;
+}[number];
+/**
+ * Creates a challenge from the given parameters.
+ *
+ * If `secretKey` option is provided, the challenge ID is computed as HMAC-SHA256
+ * over the canonical challenge ID input
+ * (`realm|method|intent|request|expires|digest|opaque`),
+ * cryptographically binding the ID to its contents.
+ *
+ * @param parameters - Challenge parameters.
+ * @param options - Optional settings including secretKey for HMAC-bound ID.
+ * @returns A challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * // With HMAC-bound ID (recommended for servers)
+ * const challenge = Challenge.from(
+ *   {
+ *     realm: 'api.example.com',
+ *     method: 'tempo',
+ *     intent: 'charge',
+ *     request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
+ *   },
+ *   { secretKey: 'my-secret' },
+ * )
+ *
+ * // With explicit ID
+ * const challenge = Challenge.from({
+ *   id: 'abc123',
+ *   realm: 'api.example.com',
+ *   method: 'tempo',
+ *   intent: 'charge',
+ *   request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
+ * })
+ * ```
+ */
+export declare function from<const parameters extends from.Parameters, const methods extends readonly Method.Method[] | undefined = undefined>(parameters: parameters, options?: from.Options<methods>): from.ReturnType<parameters, methods>;
+export declare namespace from {
+    type Options<methods extends readonly Method.Method[] | undefined = undefined> = {
+        methods?: methods;
+    };
+    type Parameters = OneOf<{
+        /** Explicit challenge ID. */
+        id: string;
+    } | {
+        /** Secret key for HMAC-bound challenge ID. */
+        secretKey: string;
+    }> & {
+        /** Optional human-readable description of the payment. */
+        description?: string | undefined;
+        /** Optional digest of the request body. */
+        digest?: string | undefined;
+        /** Optional expiration timestamp (ISO 8601). */
+        expires?: z.DatetimeInput | undefined;
+        /** Intent type (e.g., "charge", "session"). */
+        intent: string;
+        /** Optional server-defined correlation data (serialized as `opaque` on the challenge). Flat string-to-string map; clients MUST NOT modify. */
+        meta?: Record<string, string> | undefined;
+        /** Optional raw base64url-encoded server-defined correlation data. Clients MUST NOT modify. */
+        opaque?: string | undefined;
+        /** Payment method (e.g., "tempo", "stripe"). */
+        method: string;
+        /** Server realm (e.g., hostname). */
+        realm: string;
+        /** Method-specific request data. */
+        request: PaymentRequest.Request;
+    };
+    type ReturnType<parameters extends Parameters, methods extends readonly Method.Method[] | undefined = undefined> = methods extends readonly Method.Method[] ? FromMethods<methods> : Challenge<parameters['request']>;
+}
+/**
+ * Creates a validated challenge from a method intent.
+ *
+ * If `secretKey` option is provided, the challenge ID is computed as HMAC-SHA256
+ * over the canonical challenge ID input, cryptographically binding the ID to its contents.
+ *
+ * @param intent - The method intent to validate against.
+ * @param parameters - Challenge parameters (realm, request, optional expires/digest, and id if no secretKey).
+ * @param options - Optional settings including secretKey for HMAC-bound ID.
+ * @returns A validated challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ * import { Methods } from 'mppx/tempo'
+ *
+ * // With HMAC-bound ID (recommended for servers)
+ * const challenge = Challenge.fromMethod(
+ *   Methods.charge,
+ *   {
+ *     realm: 'api.example.com',
+ *     expires: '2025-01-06T12:00:00Z',
+ *     request: {
+ *       amount: '1000000',
+ *       currency: '0x20c0000000000000000000000000000000000001',
+ *       recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',
+ *     },
+ *   },
+ *   { secretKey: 'my-secret' },
+ * )
+ * ```
+ */
+export declare function fromMethod<const method extends Method.Method>(method: method, parameters: fromMethod.Parameters<method>): fromMethod.ReturnType<method>;
+export declare namespace fromMethod {
+    type Parameters<method extends Method.Method> = OneOf<{
+        /** Explicit challenge ID. */
+        id: string;
+    } | {
+        /** Secret key for HMAC-bound challenge ID. */
+        secretKey: string;
+    }> & {
+        /** Optional human-readable description of the payment. */
+        description?: string | undefined;
+        /** Optional digest of the request body. */
+        digest?: string | undefined;
+        /** Optional expiration timestamp (ISO 8601). */
+        expires?: z.DatetimeInput | undefined;
+        /** Optional server-defined correlation data (serialized as `opaque` on the challenge). Flat string-to-string map; clients MUST NOT modify. */
+        meta?: Record<string, string> | undefined;
+        /** Server realm (e.g., hostname). */
+        realm: string;
+        /** Method-specific request data. */
+        request: z.input<method['schema']['request']>;
+    };
+    type ReturnType<method extends Method.Method> = Challenge<z.output<method['schema']['request']>>;
+}
+/**
+ * Serializes a challenge to the WWW-Authenticate header format.
+ *
+ * @param challenge - The challenge to serialize.
+ * @returns A string suitable for the WWW-Authenticate header value.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const header = Challenge.serialize(challenge)
+ * // => 'Payment id="abc123", realm="api.example.com", method="tempo", intent="charge", request="eyJhbW91bnQiOi..."'
+ * ```
+ */
+export declare function serialize(challenge: Challenge): string;
+/**
+ * Deserializes a WWW-Authenticate header value to a challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.deserialize(header)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.deserialize(header, { methods })
+ * ```
+ *
+ * @param header - The WWW-Authenticate header value.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ */
+export declare function deserialize<const methods extends readonly Method.Method[] | undefined = undefined>(value: string, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>;
+/**
+ * Extracts the challenge from a Headers object.
+ *
+ * @param headers - The HTTP headers.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.fromHeaders(response.headers)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.fromHeaders(response.headers, { methods })
+ * ```
+ */
+export declare function fromHeaders<const methods extends readonly Method.Method[] | undefined = undefined>(headers: Headers, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>;
+/**
+ * Extracts the challenge from a Response's WWW-Authenticate header.
+ *
+ * @param response - The HTTP response (must be 402 status).
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const response = await fetch('/resource')
+ * if (response.status === 402)
+ *   const challenge = Challenge.fromResponse(response)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.fromResponse(response, { methods })
+ * ```
+ */
+export declare function fromResponse<const methods extends readonly Method.Method[] | undefined = undefined>(response: Response, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>;
+/**
+ * Extracts all Payment challenges from a Response with potentially merged
+ * `WWW-Authenticate` headers (multiple challenges in a single header value).
+ *
+ * @param response - The HTTP response (must be 402 status).
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns An array of deserialized challenges.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const response = await fetch('/resource')
+ * if (response.status === 402) {
+ *   const challenges = Challenge.fromResponseList(response)
+ *   // challenges[0] => tempo/charge, challenges[1] => stripe/charge
+ * }
+ * ```
+ */
+export declare function fromResponseList<const methods extends readonly Method.Method[] | undefined = undefined>(response: Response, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>[];
+/**
+ * Extracts all Payment challenges from a Headers object with potentially
+ * merged `WWW-Authenticate` values.
+ *
+ * @param headers - The HTTP headers.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns An array of deserialized challenges.
+ */
+export declare function fromHeadersList<const methods extends readonly Method.Method[] | undefined = undefined>(headers: Headers, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>[];
+/**
+ * Deserializes a `WWW-Authenticate` header value that may contain multiple
+ * Payment challenges (comma-separated per RFC 9110 §11.6.1).
+ *
+ * @param value - The raw WWW-Authenticate header value.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns An array of deserialized challenges.
+ */
+export declare function deserializeList<const methods extends readonly Method.Method[] | undefined = undefined>(value: string, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>[];
+/**
+ * Verifies that a challenge ID matches the expected HMAC for the given parameters.
+ *
+ * @param challenge - The challenge to verify.
+ * @param options - Options including the secret key.
+ * @returns True if the challenge ID is valid, false otherwise.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const isValid = Challenge.verify(challenge, { secretKey: 'my-secret' })
+ * ```
+ */
+export declare function verify(challenge: Challenge, options: verify.Options): boolean;
+export declare namespace verify {
+    type Options = {
+        /** Secret key for HMAC-bound challenge ID verification. */
+        secretKey: string;
+    };
+}
+/** Extracts parsed server-defined correlation data from a challenge when available. */
+export declare function meta(challenge: Challenge): Record<string, string> | undefined;
+//# sourceMappingURL=Challenge.d.ts.map

package/dist/Challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Challenge.d.ts","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAI7B;;;;;;;;;GASG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;iBAqBjB,CAAA;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,SAAS,CACnB,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,MAAM,SAAS,MAAM,GAAG,MAAM,EAC9B,MAAM,SAAS,MAAM,GAAG,MAAM,IAC5B,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,GAAG;IAClE,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,IAAI;KACjE,MAAM,IAAI,MAAM,OAAO,GAAG,SAAS,CAClC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,EAC9C,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,EACzB,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CACxB;CACF,CAAC,MAAM,CAAC,CAAA;AAET;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,IAAI,CAClB,KAAK,CAAC,UAAU,SAAS,IAAI,CAAC,UAAU,EACxC,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EACtE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAmC/F;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,OAAO,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,IAAI;QAC/E,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,CAAA;IAED,KAAK,UAAU,GAAG,KAAK,CACnB;QACE,6BAA6B;QAC7B,EAAE,EAAE,MAAM,CAAA;KACX,GACD;QACE,8CAA8C;QAC9C,SAAS,EAAE,MAAM,CAAA;KAClB,CACJ,GAAG;QACF,0DAA0D;QAC1D,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,2CAA2C;QAC3C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,gDAAgD;QAChD,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,GAAG,SAAS,CAAA;QACrC,+CAA+C;QAC/C,MAAM,EAAE,MAAM,CAAA;QACd,8IAA8I;QAC9I,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;QACzC,+FAA+F;QAC/F,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,gDAAgD;QAChD,MAAM,EAAE,MAAM,CAAA;QACd,qCAAqC;QACrC,KAAK,EAAE,MAAM,CAAA;QACb,oCAAoC;QACpC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAA;KAChC,CAAA;IAED,KAAK,UAAU,CACb,UAAU,SAAS,UAAU,EAC7B,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,IAC9D,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GACxC,WAAW,CAAC,OAAO,CAAC,GACpB,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAC3D,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,GACxC,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAiB/B;AAED,MAAM,CAAC,OAAO,WAAW,UAAU,CAAC;IAClC,KAAK,UAAU,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,IAAI,KAAK,CACjD;QACE,6BAA6B;QAC7B,EAAE,EAAE,MAAM,CAAA;KACX,GACD;QACE,8CAA8C;QAC9C,SAAS,EAAE,MAAM,CAAA;KAClB,CACJ,GAAG;QACF,0DAA0D;QAC1D,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,2CAA2C;QAC3C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,gDAAgD;QAChD,OAAO,CAAC,EAAE,CAAC,CAAC,aAAa,GAAG,SAAS,CAAA;QACrC,8IAA8I;QAC9I,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;QACzC,qCAAqC;QACrC,KAAK,EAAE,MAAM,CAAA;QACb,oCAAoC;QACpC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;KAC9C,CAAA;IAED,KAAK,UAAU,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;CACjG;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAkBtD;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EAChG,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAoB3C;AA6HD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EAChG,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAI3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAC1B,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EACtE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAGhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EAEtE,QAAQ,EAAE,QAAQ,EAClB,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAG7C;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EACtE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAIhG;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,KAAK,CAAC,OAAO,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,GAAG,SAAS,EACtE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,CAgB7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,GAAG,OAAO,CAG7E;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,OAAO,GAAG;QACb,2DAA2D;QAC3D,SAAS,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED,uFAAuF;AACvF,wBAAgB,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAE7E"}