mppx 0.0.1 → 0.1.0

package/dist/Challenge.js

@@ -0,0 +1,291 @@
+import { Base64, Bytes, Hash } from 'ox';
+import * as PaymentRequest from './PaymentRequest.js';
+import * as z from './zod.js';
+/**
+ * Schema for a payment challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.Schema.parse(data)
+ * ```
+ */
+export const Schema = z.object({
+    /** Optional human-readable description of the payment. */
+    description: z.optional(z.string()),
+    /** Optional digest of the request body (format: "sha-256=base64hash"). */
+    digest: z.optional(z.string().check(z.regex(/^sha-256=/, 'Invalid digest format'))),
+    /** Optional expiration timestamp (ISO 8601). */
+    expires: z.optional(z.datetime()),
+    /** Unique challenge identifier (HMAC-bound). */
+    id: z.string(),
+    /** Intent type (e.g., "charge", "authorize"). */
+    intent: z.string(),
+    /** Payment method (e.g., "tempo", "stripe"). */
+    method: z.string(),
+    /** Server realm (e.g., hostname). */
+    realm: z.string(),
+    /** Method-specific request data. */
+    request: z.record(z.string(), z.unknown()),
+});
+/**
+ * Creates a challenge from the given parameters.
+ *
+ * If `secretKey` option is provided, the challenge ID is computed as HMAC-SHA256
+ * over the challenge parameters (realm|method|intent|request|expires|digest),
+ * cryptographically binding the ID to its contents.
+ *
+ * @param parameters - Challenge parameters.
+ * @param options - Optional settings including secretKey for HMAC-bound ID.
+ * @returns A challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * // With HMAC-bound ID (recommended for servers)
+ * const challenge = Challenge.from(
+ *   {
+ *     realm: 'api.example.com',
+ *     method: 'tempo',
+ *     intent: 'charge',
+ *     request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
+ *   },
+ *   { secretKey: 'my-secret' },
+ * )
+ *
+ * // With explicit ID
+ * const challenge = Challenge.from({
+ *   id: 'abc123',
+ *   realm: 'api.example.com',
+ *   method: 'tempo',
+ *   intent: 'charge',
+ *   request: { amount: '1000000', currency: '0x...', recipient: '0x...' },
+ * })
+ * ```
+ */
+export function from(parameters, options) {
+    void options;
+    const { description, digest, method: methodName, intent, realm, request, secretKey } = parameters;
+    const expires = (parameters.expires ?? request.expires);
+    const id = secretKey
+        ? computeId({ ...parameters, expires }, { secretKey })
+        : parameters.id;
+    return Schema.parse({
+        id,
+        realm,
+        method: methodName,
+        intent,
+        request,
+        ...(description && { description }),
+        ...(digest && { digest }),
+        ...(expires && { expires }),
+    });
+}
+/**
+ * Creates a validated challenge from a method intent.
+ *
+ * If `secretKey` option is provided, the challenge ID is computed as HMAC-SHA256
+ * over the challenge parameters, cryptographically binding the ID to its contents.
+ *
+ * @param intent - The method intent to validate against.
+ * @param parameters - Challenge parameters (realm, request, optional expires/digest, and id if no secretKey).
+ * @param options - Optional settings including secretKey for HMAC-bound ID.
+ * @returns A validated challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ * import { Intents } from 'mppx/tempo'
+ *
+ * // With HMAC-bound ID (recommended for servers)
+ * const challenge = Challenge.fromIntent(
+ *   Intents.charge,
+ *   {
+ *     realm: 'api.example.com',
+ *     request: {
+ *       amount: '1000000',
+ *       currency: '0x20c0000000000000000000000000000000000001',
+ *       recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',
+ *       expires: '2025-01-06T12:00:00Z',
+ *     },
+ *   },
+ *   { secretKey: 'my-secret' },
+ * )
+ * ```
+ */
+export function fromIntent(intent, parameters) {
+    const { method, name } = intent;
+    const { description, digest, expires, id, realm, secretKey } = parameters;
+    const request = PaymentRequest.fromIntent(intent, parameters.request);
+    return from({
+        ...(id ? { id } : { secretKey }),
+        realm,
+        method,
+        intent: name,
+        request,
+        description,
+        digest,
+        expires,
+    });
+}
+/**
+ * Serializes a challenge to the WWW-Authenticate header format.
+ *
+ * @param challenge - The challenge to serialize.
+ * @returns A string suitable for the WWW-Authenticate header value.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const header = Challenge.serialize(challenge)
+ * // => 'Payment id="abc123", realm="api.example.com", method="tempo", intent="charge", request="eyJhbW91bnQiOi..."'
+ * ```
+ */
+export function serialize(challenge) {
+    const parts = [
+        `id="${challenge.id}"`,
+        `realm="${challenge.realm}"`,
+        `method="${challenge.method}"`,
+        `intent="${challenge.intent}"`,
+        `request="${PaymentRequest.serialize(challenge.request)}"`,
+    ];
+    if (challenge.description !== undefined)
+        parts.push(`description="${challenge.description}"`);
+    if (challenge.digest !== undefined)
+        parts.push(`digest="${challenge.digest}"`);
+    if (challenge.expires !== undefined)
+        parts.push(`expires="${challenge.expires}"`);
+    return `Payment ${parts.join(', ')}`;
+}
+/**
+ * Deserializes a WWW-Authenticate header value to a challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.deserialize(header)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.deserialize(header, { methods })
+ * ```
+ *
+ * @param header - The WWW-Authenticate header value.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ */
+export function deserialize(value, options) {
+    const prefixMatch = value.match(/^Payment\s+(.+)$/i);
+    if (!prefixMatch?.[1])
+        throw new Error('Missing Payment scheme.');
+    const params = prefixMatch[1];
+    const result = {};
+    for (const match of params.matchAll(/(\w+)="([^"]+)"/g)) {
+        const key = match[1];
+        const value = match[2];
+        if (key && value)
+            result[key] = value;
+    }
+    const { request, ...rest } = result;
+    if (!request)
+        throw new Error('Missing request parameter.');
+    return from({
+        ...rest,
+        request: PaymentRequest.deserialize(request),
+    }, options);
+}
+/**
+ * Extracts the challenge from a Headers object.
+ *
+ * @param headers - The HTTP headers.
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const challenge = Challenge.fromHeaders(response.headers)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.fromHeaders(response.headers, { methods })
+ * ```
+ */
+export function fromHeaders(headers, options) {
+    const header = headers.get('WWW-Authenticate');
+    if (!header)
+        throw new Error('Missing WWW-Authenticate header.');
+    return deserialize(header, options);
+}
+/**
+ * Extracts the challenge from a Response's WWW-Authenticate header.
+ *
+ * @param response - The HTTP response (must be 402 status).
+ * @param options - Optional settings to narrow the challenge type.
+ * @returns The deserialized challenge.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const response = await fetch('/resource')
+ * if (response.status === 402)
+ *   const challenge = Challenge.fromResponse(response)
+ *
+ * // With methods for type narrowing
+ * const challenge = Challenge.fromResponse(response, { methods })
+ * ```
+ */
+export function fromResponse(response, options) {
+    if (response.status !== 402)
+        throw new Error('Response status is not 402.');
+    return fromHeaders(response.headers, options);
+}
+/**
+ * Verifies that a challenge ID matches the expected HMAC for the given parameters.
+ *
+ * @param challenge - The challenge to verify.
+ * @param options - Options including the secret key.
+ * @returns True if the challenge ID is valid, false otherwise.
+ *
+ * @example
+ * ```ts
+ * import { Challenge } from 'mppx'
+ *
+ * const isValid = Challenge.verify(challenge, { secretKey: 'my-secret' })
+ * ```
+ */
+export function verify(challenge, options) {
+    const expectedId = computeId(challenge, options);
+    return constantTimeEqual(challenge.id, expectedId);
+}
+/** @internal Computes HMAC-SHA256 challenge ID from parameters. */
+function computeId(challenge, options) {
+    const input = [
+        challenge.realm,
+        challenge.method,
+        challenge.intent,
+        PaymentRequest.serialize(challenge.request),
+        challenge.expires ?? '',
+        challenge.digest ?? '',
+    ]
+        .filter(Boolean)
+        .join('|');
+    const key = Bytes.fromString(options.secretKey);
+    const data = Bytes.fromString(input);
+    const mac = Hash.hmac256(key, data, { as: 'Bytes' });
+    return Base64.fromBytes(mac, { url: true, pad: false });
+}
+/** @internal Constant-time string comparison to prevent timing attacks. */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++)
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return result === 0;
+}
+//# sourceMappingURL=Challenge.js.map

package/dist/Challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Challenge.js","sourceRoot":"","sources":["../src/Challenge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAGxC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAE7B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,0DAA0D;IAC1D,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,0EAA0E;IAC1E,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACnF,gDAAgD;IAChD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACjC,gDAAgD;IAChD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,iDAAiD;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,gDAAgD;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,qCAAqC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,oCAAoC;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC3C,CAAC,CAAA;AAuCF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,IAAI,CAGlB,UAAsB,EAAE,OAA+B;IACvD,KAAK,OAAO,CAAA;IACZ,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,CAAA;IAEjG,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAW,CAAA;IACjE,MAAM,EAAE,GAAG,SAAS;QAClB,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC,CAAE,UAA6B,CAAC,EAAE,CAAA;IAErC,OAAO,MAAM,CAAC,KAAK,CAAC;QAClB,EAAE;QACF,KAAK;QACL,MAAM,EAAE,UAAU;QAClB,MAAM;QACN,OAAO;QACP,GAAG,CAAC,WAAW,IAAI,EAAE,WAAW,EAAE,CAAC;QACnC,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;QACzB,GAAG,CAAC,OAAO,IAAI,EAAE,OAAO,EAAE,CAAC;KAC5B,CAAyC,CAAA;AAC5C,CAAC;AAyCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,UAAyC;IAEzC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;IAC/B,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAA;IAEzE,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAErE,OAAO,IAAI,CAAC;QACV,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;QAChC,KAAK;QACL,MAAM;QACN,MAAM,EAAE,IAAI;QACZ,OAAO;QACP,WAAW;QACX,MAAM;QACN,OAAO;KACW,CAAkC,CAAA;AACxD,CAAC;AA8BD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,SAAoB;IAC5C,MAAM,KAAK,GAAG;QACZ,OAAO,SAAS,CAAC,EAAE,GAAG;QACtB,UAAU,SAAS,CAAC,KAAK,GAAG;QAC5B,WAAW,SAAS,CAAC,MAAM,GAAG;QAC9B,WAAW,SAAS,CAAC,MAAM,GAAG;QAC9B,YAAY,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG;KAC3D,CAAA;IAED,IAAI,SAAS,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,SAAS,CAAC,WAAW,GAAG,CAAC,CAAA;IAC7F,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,SAAS,CAAC,MAAM,GAAG,CAAC,CAAA;IAC9E,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,SAAS,CAAC,OAAO,GAAG,CAAC,CAAA;IAEjF,OAAO,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAEzB,KAAa,EAAE,OAA+B;IAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IAEjE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAA;IAC7B,MAAM,MAAM,GAA2B,EAAE,CAAA;IAEzC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACtB,IAAI,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACvC,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACnC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAE3D,OAAO,IAAI,CACT;QACE,GAAG,IAAI;QACP,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC;KAC1B,EACpB,OAAO,CACR,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAEzB,OAAgB,EAAE,OAA+B;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;IAChE,OAAO,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAE1B,QAAkB,EAAE,OAA+B;IACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC3E,OAAO,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,MAAM,CAAC,SAAoB,EAAE,OAAuB;IAClE,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAChD,OAAO,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAA;AACpD,CAAC;AASD,mEAAmE;AACnE,SAAS,SAAS,CAAC,SAAgC,EAAE,OAA8B;IACjF,MAAM,KAAK,GAAG;QACZ,SAAS,CAAC,KAAK;QACf,SAAS,CAAC,MAAM;QAChB,SAAS,CAAC,MAAM;QAChB,cAAc,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC;QAC3C,SAAS,CAAC,OAAO,IAAI,EAAE;QACvB,SAAS,CAAC,MAAM,IAAI,EAAE;KACvB;SACE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;IAEZ,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACpD,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAA;AACzD,CAAC;AAED,2EAA2E;AAC3E,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC"}

package/dist/Credential.d.ts

@@ -0,0 +1,91 @@
+import * as Challenge from './Challenge.js';
+/**
+ * A payment credential containing the challenge and payment proof.
+ */
+export type Credential<payload = unknown, challenge extends Challenge.Challenge = Challenge.Challenge> = {
+    /** The challenge from the 402 response. */
+    challenge: challenge;
+    /** Method-specific payment proof. */
+    payload: payload;
+    /** Optional payer identifier as a DID (e.g., "did:pkh:eip155:1:0x..."). */
+    source?: string;
+};
+/**
+ * Deserializes an Authorization header value to a credential.
+ *
+ * @param header - The Authorization header value.
+ * @returns The deserialized credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const credential = Credential.deserialize(header)
+ * ```
+ */
+export declare function deserialize<payload = unknown>(value: string): Credential<payload>;
+/**
+ * Creates a credential from the given parameters.
+ *
+ * @param parameters - Credential parameters with a Challenge object.
+ * @returns A credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential, Challenge } from 'mppx'
+ *
+ * const credential = Credential.from({
+ *   challenge,
+ *   payload: { signature: '0x...' },
+ * })
+ * ```
+ */
+export declare function from<const parameters extends from.Parameters>(parameters: parameters): Credential<parameters['payload'], parameters['challenge']>;
+export declare namespace from {
+    type Parameters = {
+        /** The challenge from the 402 response. */
+        challenge: Challenge.Challenge;
+        /** Method-specific payment proof. */
+        payload: unknown;
+        /** Optional payer identifier as a DID (e.g., "did:pkh:eip155:1:0x..."). */
+        source?: string;
+    };
+}
+/**
+ * Extracts the credential from a Request's Authorization header.
+ *
+ * @param request - The HTTP request.
+ * @returns The deserialized credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const credential = Credential.fromRequest(request)
+ * ```
+ */
+export declare function fromRequest<payload = unknown>(request: Request): Credential<payload>;
+/**
+ * Serializes a credential to the Authorization header format.
+ *
+ * @param credential - The credential to serialize.
+ * @returns A string suitable for the Authorization header value.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const header = Credential.serialize(credential)
+ * // => 'Payment eyJjaGFsbGVuZ2UiOnsi...'
+ * ```
+ */
+export declare function serialize(credential: Credential): string;
+/**
+ * Extracts the `Payment` scheme from an Authorization header value
+ * that may contain multiple schemes (comma-separated per RFC 9110).
+ *
+ * @param header - The raw Authorization header value.
+ * @returns The `Payment ...` scheme string, or `null` if not found.
+ */
+export declare function extractPaymentScheme(header: string): string | null;
+//# sourceMappingURL=Credential.d.ts.map

package/dist/Credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credential.d.ts","sourceRoot":"","sources":["../src/Credential.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAG3C;;GAEG;AACH,MAAM,MAAM,UAAU,CACpB,OAAO,GAAG,OAAO,EACjB,SAAS,SAAS,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,IACzD;IACF,2CAA2C;IAC3C,SAAS,EAAE,SAAS,CAAA;IACpB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAsBjF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,UAAU,SAAS,IAAI,CAAC,UAAU,EAC3D,UAAU,EAAE,UAAU,GACrB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAO5D;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,KAAK,UAAU,GAAG;QAChB,2CAA2C;QAC3C,SAAS,EAAE,SAAS,CAAC,SAAS,CAAA;QAC9B,qCAAqC;QACrC,OAAO,EAAE,OAAO,CAAA;QAChB,2EAA2E;QAC3E,MAAM,CAAC,EAAE,MAAM,CAAA;KAChB,CAAA;CACF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAMpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAYxD;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE"}

package/dist/Credential.js

@@ -0,0 +1,122 @@
+import { Base64 } from 'ox';
+import * as Challenge from './Challenge.js';
+import * as PaymentRequest from './PaymentRequest.js';
+/**
+ * Deserializes an Authorization header value to a credential.
+ *
+ * @param header - The Authorization header value.
+ * @returns The deserialized credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const credential = Credential.deserialize(header)
+ * ```
+ */
+export function deserialize(value) {
+    const prefixMatch = value.match(/^Payment\s+(.+)$/i);
+    if (!prefixMatch?.[1])
+        throw new Error('Missing Payment scheme.');
+    try {
+        const json = Base64.toString(prefixMatch[1]);
+        const parsed = JSON.parse(json);
+        const challenge = Challenge.Schema.parse({
+            ...parsed.challenge,
+            request: PaymentRequest.deserialize(parsed.challenge.request),
+        });
+        return {
+            challenge,
+            payload: parsed.payload,
+            ...(parsed.source && { source: parsed.source }),
+        };
+    }
+    catch {
+        throw new Error('Invalid base64url or JSON.');
+    }
+}
+/**
+ * Creates a credential from the given parameters.
+ *
+ * @param parameters - Credential parameters with a Challenge object.
+ * @returns A credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential, Challenge } from 'mppx'
+ *
+ * const credential = Credential.from({
+ *   challenge,
+ *   payload: { signature: '0x...' },
+ * })
+ * ```
+ */
+export function from(parameters) {
+    const { challenge, payload, source } = parameters;
+    return {
+        challenge,
+        payload,
+        ...(source && { source }),
+    };
+}
+/**
+ * Extracts the credential from a Request's Authorization header.
+ *
+ * @param request - The HTTP request.
+ * @returns The deserialized credential.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const credential = Credential.fromRequest(request)
+ * ```
+ */
+export function fromRequest(request) {
+    const header = request.headers.get('Authorization');
+    if (!header)
+        throw new Error('Missing Authorization header.');
+    const payment = extractPaymentScheme(header);
+    if (!payment)
+        throw new Error('Missing Payment scheme.');
+    return deserialize(payment);
+}
+/**
+ * Serializes a credential to the Authorization header format.
+ *
+ * @param credential - The credential to serialize.
+ * @returns A string suitable for the Authorization header value.
+ *
+ * @example
+ * ```ts
+ * import { Credential } from 'mppx'
+ *
+ * const header = Credential.serialize(credential)
+ * // => 'Payment eyJjaGFsbGVuZ2UiOnsi...'
+ * ```
+ */
+export function serialize(credential) {
+    const wire = {
+        challenge: {
+            ...credential.challenge,
+            request: PaymentRequest.serialize(credential.challenge.request),
+        },
+        payload: credential.payload,
+        ...(credential.source && { source: credential.source }),
+    };
+    const json = JSON.stringify(wire);
+    const encoded = Base64.fromString(json, { pad: false, url: true });
+    return `Payment ${encoded}`;
+}
+/**
+ * Extracts the `Payment` scheme from an Authorization header value
+ * that may contain multiple schemes (comma-separated per RFC 9110).
+ *
+ * @param header - The raw Authorization header value.
+ * @returns The `Payment ...` scheme string, or `null` if not found.
+ */
+export function extractPaymentScheme(header) {
+    const schemes = header.split(',').map((s) => s.trim());
+    return schemes.find((s) => /^Payment\s+/i.test(s)) ?? null;
+}
+//# sourceMappingURL=Credential.js.map

package/dist/Credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Credential.js","sourceRoot":"","sources":["../src/Credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAC3B,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAiBrD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAoB,KAAa;IAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACjE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI7B,CAAA;QACD,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC;YACvC,GAAG,MAAM,CAAC,SAAS;YACnB,OAAO,EAAE,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9D,CAAC,CAAA;QACF,OAAO;YACL,SAAS;YACT,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;SACzB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,IAAI,CAClB,UAAsB;IAEtB,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,UAAU,CAAA;IACjD,OAAO;QACL,SAAS;QACT,OAAO;QACP,GAAG,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,CAAC;KACoC,CAAA;AACjE,CAAC;AAaD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAoB,OAAgB;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;IAC7D,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;IACxD,OAAO,WAAW,CAAU,OAAO,CAAC,CAAA;AACtC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,UAAsB;IAC9C,MAAM,IAAI,GAAG;QACX,SAAS,EAAE;YACT,GAAG,UAAU,CAAC,SAAS;YACvB,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,OAAO,CAAC;SAChE;QACD,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;KACxD,CAAA;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IAClE,OAAO,WAAW,OAAO,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACtD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;AAC5D,CAAC"}