mppx 0.13.3 → 0.13.5

package/dist/cli/validate/helpers.d.ts

@@ -37,6 +37,7 @@ export type Counts = {
     skipped: number;
 };
 export declare function printResults(results: CheckResult[], counts: Counts): void;
+/** Fetches the validation target without allowing it to redirect probes elsewhere. */
 export declare function fetchWithTimeout(url: RequestInfo | URL, init: RequestInit, timeoutMs?: number): Promise<Response>;
 export declare function formatBytes(bytes: number): string;
 export declare const HTTP_METHODS: Set<string>;

package/dist/cli/validate/helpers.js

@@ -57,11 +57,12 @@ export function printResults(results, counts) {
             counts.skipped++;
     }
 }
+/** Fetches the validation target without allowing it to redirect probes elsewhere. */
 export async function fetchWithTimeout(url, init, timeoutMs = 15_000) {
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        return await fetch(url, { ...init, signal: controller.signal });
+        return await fetch(url, { ...init, redirect: 'error', signal: controller.signal });
     }
     finally {
         clearTimeout(timeout);

package/dist/client/Mppx.d.ts

@@ -62,6 +62,8 @@ export type Mppx<methods extends Methods = Methods, transport extends Transport.
     transport: transport;
     /**
      * Selects a payment challenge without creating its credential.
+     * Native HTTP responses in payment events preserve status and headers only;
+     * the caller retains ownership of the original response body.
      *
      * @example
      * ```ts

package/dist/client/Mppx.js

@@ -405,17 +405,15 @@ function snapshotMethod(method) {
 }
 function snapshotResponse(response) {
     if (response instanceof Response) {
-        try {
+        if (response.body === null)
             return response.clone();
-        }
-        catch {
-            // A consumed body cannot be cloned, but status and headers are sufficient for event context.
-            return new Response(null, {
-                headers: response.headers,
-                status: response.status,
-                statusText: response.statusText,
-            });
-        }
+        // Event context can outlive an SSE response. Retaining a clone would queue
+        // every chunk consumed by the caller on an unread body branch.
+        return new Response(null, {
+            headers: response.headers,
+            status: response.status,
+            statusText: response.statusText,
+        });
     }
     return snapshotValue(response);
 }

package/dist/client/internal/Fetch.js

@@ -1,5 +1,6 @@
 import * as Challenge from '../../Challenge.js';
 import * as Constants from '../../Constants.js';
+import { PaymentOutcomeUnknownError } from '../../Errors.js';
 import * as Expires from '../../Expires.js';
 import * as AcceptPayment from '../../internal/AcceptPayment.js';
 import * as Transport from '../Transport.js';
@@ -10,8 +11,64 @@ import * as MethodResponse from './MethodResponse.js';
 // an unrelated fetch installed by user code or another library.
 const MPPX_FETCH_WRAPPER = Symbol.for('mppx.fetch.wrapper');
 const defaultMaxPaymentRetries = 3;
+const maxErrorBodyBytes = 64 * 1024;
+const errorBodyTimeoutMs = 2_000;
+/** Response header set when a paid-retry error body was cut off by {@link bufferErrorBody}. */
+const bodyTruncatedHeader = 'Mppx-Body-Truncated';
 let originalFetch;
 const eventObserverChecks = new WeakMap();
+/**
+ * Buffers a paid-retry error body within a size and time bound so its connection is
+ * released. A complete body stays in the original response. The body is diagnostic
+ * only: one larger than 64 KiB, or still arriving after 2 seconds, is cancelled and
+ * replaced with what arrived, marked with an `Mppx-Body-Truncated: true` header.
+ */
+async function bufferErrorBody(response) {
+    if (!response.body)
+        return response;
+    // Reading a clone pulls the shared source, buffering it in the original response.
+    const reader = response.clone().body.getReader();
+    const chunks = [];
+    let received = 0;
+    let truncated = false;
+    const timeout = setTimeout(() => {
+        truncated = true;
+        void reader.cancel().catch(() => { });
+    }, errorBodyTimeoutMs);
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            chunks.push(value);
+            received += value.byteLength;
+            if (received > maxErrorBodyBytes) {
+                truncated = true;
+                break;
+            }
+        }
+    }
+    finally {
+        clearTimeout(timeout);
+        // A tee's cancellation can wait for the other branch; do not await it.
+        void reader.cancel().catch(() => { });
+    }
+    if (!truncated)
+        return response;
+    // Cancelling both branches cancels the source and releases the connection.
+    void response.body.cancel().catch(() => { });
+    const headers = new Headers(response.headers);
+    headers.delete('content-length');
+    headers.set(bodyTruncatedHeader, 'true');
+    const truncatedResponse = new Response(new Blob(chunks).slice(0, maxErrorBodyBytes), {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+    for (const key of ['redirected', 'type', 'url'])
+        Object.defineProperty(truncatedResponse, key, { value: response[key] });
+    return truncatedResponse;
+}
 async function settleAttempt(prepared, outcome) {
     const settle = prepared?.attempt.settle;
     if (!settle)
@@ -67,6 +124,8 @@ export function from(config) {
         let challenges;
         let mi;
         let preparedCredential;
+        // Set when the paid request throws after the credential was sent.
+        let outcomeUnknown;
         try {
             for (let retry = 0; retry < maxPaymentRetries; retry++) {
                 challenges = await transport.getChallenges(response, transportRequest);
@@ -166,14 +225,26 @@ export function from(config) {
                     method: selected.method,
                     response,
                 }));
-                response = await baseFetch(paymentInput, {
-                    ...transport.setCredential({
-                        ...fetchInit,
-                        headers: initialRequest.headers,
-                    }, credential, { challenge: selectedChallenge }),
-                    // Runtimes do not strip custom payment headers on cross-origin redirects.
-                    redirect: 'manual',
+                const unknownOutcome = (cause) => new PaymentOutcomeUnknownError({
+                    cause,
+                    challenge: selectedChallenge,
+                    credential,
+                    transactionHash: MethodResponse.getTransactionHash(selected.method, credential),
                 });
+                try {
+                    response = await baseFetch(paymentInput, {
+                        ...transport.setCredential({
+                            ...fetchInit,
+                            headers: initialRequest.headers,
+                        }, credential, { challenge: selectedChallenge }),
+                        // Runtimes do not strip custom payment headers on cross-origin redirects.
+                        redirect: 'manual',
+                    });
+                }
+                catch (cause) {
+                    outcomeUnknown = unknownOutcome(cause);
+                    throw cause;
+                }
                 const paymentRequired = await transport.isPaymentRequired(response, transportRequest);
                 if (!paymentRequired) {
                     await settleAttempt(prepared, {
@@ -198,6 +269,33 @@ export function from(config) {
                         response,
                     }));
                 if (!paymentRequired) {
+                    // The server may have settled before failing: report the credential for
+                    // reconciliation and return the response. Retrying could pay twice.
+                    if (response.status >= 500 && hasEventObservers(events, 'payment.failed')) {
+                        try {
+                            // Release the connection before observers can make requests through it.
+                            response = await bufferErrorBody(response);
+                        }
+                        catch (cause) {
+                            outcomeUnknown = unknownOutcome(cause);
+                            // The failed body cannot be cloned for observers; keep its status and headers.
+                            response = new Response(null, {
+                                headers: response.headers,
+                                status: response.status,
+                                statusText: response.statusText,
+                            });
+                            throw cause;
+                        }
+                        await events.emit('payment.failed', createPaymentFailedPayload({
+                            challenge: selectedChallenge,
+                            challenges,
+                            error: unknownOutcome(),
+                            init,
+                            input,
+                            method: selected.method,
+                            response,
+                        }));
+                    }
                     if (!response.ok)
                         return response;
                     return MethodResponse.handle(selected.method, {
@@ -237,7 +335,8 @@ export function from(config) {
             await events.emit('payment.failed', createPaymentFailedPayload({
                 challenge,
                 challenges,
-                error,
+                // Observers get the credential to reconcile; callers keep the original error.
+                error: outcomeUnknown ?? error,
                 init,
                 input,
                 method: mi,

package/dist/client/internal/MethodResponse.d.ts

@@ -23,6 +23,8 @@ export type HandlerParameters = {
     response: Response;
     signal?: AbortSignal | undefined;
 };
+/** Derives the on-chain hash a credential's payment will have, when it is final before settlement. */
+export type TransactionHash = (credential: string) => string | undefined;
 /** Internal client-method response adapter. */
 export type Handler = (parameters: HandlerParameters) => MaybePromise<Response>;
 /** Registers an internal response adapter without changing the public method shape. */
@@ -35,4 +37,8 @@ export declare function attachAttempt(method: Method.AnyClient, parameters: obje
 export declare function getAttempt(parameters: object): Attempt | undefined;
 /** Lets the selected client method handle a successful paid response. */
 export declare function handle(method: Method.AnyClient, parameters: HandlerParameters): Promise<Response>;
+/** Registers credential hash derivation without changing the public method shape. */
+export declare function registerTransactionHash<const method extends Method.AnyClient>(method: method, derive: TransactionHash): method;
+/** Returns the credential's on-chain hash when its method can derive it. */
+export declare function getTransactionHash(method: Method.AnyClient, credential: string): string | undefined;
 //# sourceMappingURL=MethodResponse.d.ts.map

package/dist/client/internal/MethodResponse.js

@@ -1,5 +1,6 @@
 const handlers = new WeakMap();
 const attempts = new WeakMap();
+const transactionHashes = new WeakMap();
 /** Registers an internal response adapter without changing the public method shape. */
 export function register(method, handler) {
     handlers.set(method, handler);
@@ -22,4 +23,19 @@ export function getAttempt(parameters) {
 export function handle(method, parameters) {
     return Promise.resolve(handlers.get(method)?.(parameters) ?? parameters.response);
 }
+/** Registers credential hash derivation without changing the public method shape. */
+export function registerTransactionHash(method, derive) {
+    transactionHashes.set(method, derive);
+    return method;
+}
+/** Returns the credential's on-chain hash when its method can derive it. */
+export function getTransactionHash(method, credential) {
+    try {
+        return transactionHashes.get(method)?.(credential);
+    }
+    catch {
+        // Reconciliation metadata must never mask the payment outcome itself.
+        return undefined;
+    }
+}
 //# sourceMappingURL=MethodResponse.js.map

package/dist/client/internal/protocols/Mcp.js

@@ -18,6 +18,8 @@ function jsonRpcRequestId(body) {
         return undefined;
     }
 }
+// Bound automatic inspection; the caller retains the original response stream.
+const maxInspectionBytes = 1024 * 1024;
 const responseCache = new WeakMap();
 function mcpHttpRequestId(request) {
     const id = jsonRpcRequestId(request?.body);
@@ -94,6 +96,7 @@ async function parseSseJsonRpcResponse(response) {
     if (!reader)
         return undefined;
     const decoder = new TextDecoder();
+    let received = 0;
     let dataEventSeen = false;
     let message;
     const parser = createParser({
@@ -119,6 +122,9 @@ async function parseSseJsonRpcResponse(response) {
                 parser.reset({ consume: true });
                 return message;
             }
+            received += value.byteLength;
+            if (received > maxInspectionBytes)
+                return undefined;
             parser.feed(decoder.decode(value, { stream: true }));
         }
     }
@@ -126,6 +132,33 @@ async function parseSseJsonRpcResponse(response) {
         void reader.cancel().catch(() => { });
     }
 }
+/** Reads only a bounded JSON response, leaving the caller's stream untouched. */
+async function parseJsonResponse(response) {
+    const reader = response.clone().body?.getReader();
+    if (!reader)
+        return undefined;
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return parseMessage(JSON.parse(text + decoder.decode()));
+            received += value.byteLength;
+            if (received > maxInspectionBytes)
+                return undefined;
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        // A tee's cancellation can wait for the original stream; do not await it.
+        void reader.cancel().catch(() => { });
+    }
+}
 /** Reads a cloned HTTP body into the first JSON-RPC response message, if any. */
 function parseJsonRpcResponse(response) {
     const cached = responseCache.get(response);
@@ -133,12 +166,10 @@ function parseJsonRpcResponse(response) {
         return cached;
     const promise = (async () => {
         const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+        if (Number(response.headers.get('content-length')) > maxInspectionBytes)
+            return undefined;
         if (contentType.includes('application/json'))
-            return response
-                .clone()
-                .json()
-                .then(parseMessage)
-                .catch(() => undefined);
+            return parseJsonResponse(response);
         if (contentType.includes('text/event-stream'))
             return parseSseJsonRpcResponse(response);
         return undefined;

package/dist/evm/server/Charge.js

@@ -77,12 +77,14 @@ export function charge(parameters) {
                 source,
             };
             await config.validate?.(authorization);
+            const payer = getAddress(payload.from);
             return {
                 challenge: credential.challenge,
                 credential,
-                details: { payer: getAddress(payload.from) },
+                details: { payer },
                 intent: Methods.charge.intent,
                 method: Methods.charge.name,
+                payer,
                 request: credential.challenge.request,
                 source,
             };

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.13.3";
+export declare const version = "0.13.5";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.13.3";
+export declare const sdkIdentifier = "mppx/0.13.5";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.13.3';
+export const version = '0.13.5';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/internal/warnOnce.d.ts

@@ -0,0 +1,3 @@
+/** Logs `message` with `console.warn` the first time `key` is seen in this process. */
+export declare function warnOnce(key: string, message: string): void;
+//# sourceMappingURL=warnOnce.d.ts.map

package/dist/internal/warnOnce.js

@@ -0,0 +1,9 @@
+const warned = new Set();
+/** Logs `message` with `console.warn` the first time `key` is seen in this process. */
+export function warnOnce(key, message) {
+    if (warned.has(key))
+        return;
+    warned.add(key);
+    console.warn(`[mppx] ${message}`);
+}
+//# sourceMappingURL=warnOnce.js.map

package/dist/server/Mppx.d.ts

@@ -104,6 +104,11 @@ export type PaymentSuccessContext<method extends Method.Method = Method.Method,
     envelope?: Method.VerifiedChallengeEnvelope<z.output<method['schema']['request']>, z.output<method['schema']['credential']['payload']>, method['intent'], method['name']> | undefined;
     input?: Transport.InputOf<transport> | undefined;
     method: ServerMethodDescriptor<method>;
+    /**
+     * Payer identity verified by the method before settlement (for example, the
+     * Tempo sender address). Absent when the method does not report one.
+     */
+    payer?: string | undefined;
     receipt: Receipt.Receipt;
     /** Canonical request represented by the challenge. */
     request: z.output<method['schema']['request']>;
@@ -359,7 +364,7 @@ declare namespace MethodFn {
         description?: string | undefined;
         /** Optional challenge expiration timestamp (ISO 8601) or Date. */
         expires?: z.DatetimeInput | undefined;
-        /** Optional server-defined correlation data (serialized as `opaque` in the request). Flat string-to-string map; clients MUST NOT modify. */
+        /** Optional server-defined correlation data serialized as `opaque`. `_mppx_nonce` is reserved for a fresh server-generated issuance nonce; clients MUST echo opaque unchanged. */
         meta?: Record<string, string> | undefined;
         /** Optional route/resource scope bound via reserved challenge metadata. */
         scope?: string | undefined;

package/dist/server/Mppx.js

@@ -7,11 +7,13 @@ import * as Errors from '../Errors.js';
 import * as Expires from '../Expires.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
 import * as Env from '../internal/env.js';
+import { warnOnce } from '../internal/warnOnce.js';
 import * as Mcp from '../Mcp.js';
 import * as PaymentRequest from '../PaymentRequest.js';
 import * as x402_Header from '../x402/Header.js';
 import * as x402_Types from '../x402/Types.js';
 import * as z from '../zod.js';
+import * as ChallengeMeta from './internal/challengeMeta.js';
 import * as Html from './internal/html/config.js';
 import { serviceWorker } from './internal/html/serviceWorker.gen.js';
 import * as Scope from './internal/scope.js';
@@ -331,9 +333,10 @@ export function create(config) {
             }));
         };
         let receipt;
+        let validation;
         try {
             if (mi.broadcast && mi.validate)
-                await mi.validate({
+                validation = await mi.validate({
                     credential: parsedCredential,
                     envelope,
                     operation: 'broadcast',
@@ -343,7 +346,7 @@ export function create(config) {
             receipt = await broadcast({ credential: parsedCredential, envelope, request });
         }
         catch (e) {
-            const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+            const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
             await emitStandalonePaymentFailed({
                 challenge: prepared.credential.challenge,
                 credential: parsedCredential,
@@ -359,6 +362,7 @@ export function create(config) {
             credential: parsedCredential,
             envelope,
             method: mi,
+            payer: validation?.payer,
             receipt,
             request: parsedRequest,
             ...(requestInput !== undefined && { requestInput }),
@@ -607,7 +611,7 @@ function createMethodFn(parameters) {
                     ? credentialError
                     : reason
                         ? new Errors.MalformedCredentialError({ reason })
-                        : new Errors.InternalPaymentError();
+                        : new Errors.InternalPaymentError({ cause: credentialError });
                 await emitPaymentFailed({
                     challenge,
                     credential: null,
@@ -673,7 +677,7 @@ function createMethodFn(parameters) {
                     catch (e) {
                         if (!(e instanceof Errors.PaymentError))
                             console.error('mppx: internal authorization error', e);
-                        const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+                        const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
                         await emitPaymentFailed({
                             challenge,
                             credential: null,
@@ -833,9 +837,10 @@ function createMethodFn(parameters) {
             // User-provided verification (e.g., check signature, submit tx, verify payment).
             // If verification fails, re-issue the challenge so the client can retry.
             let receiptData;
+            let validation;
             try {
                 if (broadcast && validate)
-                    await validate({
+                    validation = await validate({
                         credential: parsedCredential,
                         envelope,
                         operation: 'broadcast',
@@ -851,7 +856,7 @@ function createMethodFn(parameters) {
             catch (e) {
                 if (!(e instanceof Errors.PaymentError))
                     console.error('mppx: internal verification error', e);
-                const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+                const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
                 await emitPaymentFailed({
                     challenge,
                     credential: parsedCredential,
@@ -889,6 +894,7 @@ function createMethodFn(parameters) {
                 envelope,
                 input,
                 method,
+                payer: validation?.payer,
                 receipt: receiptData,
                 request: parsedRequest,
                 requestInput: request,
@@ -985,6 +991,7 @@ function createServerEventDispatcher() {
                     await method.onPaymentSuccess({
                         challenge: success.challenge,
                         input: success.input,
+                        ...(success.payer !== undefined && { payer: success.payer }),
                         receipt: success.receipt,
                         request: success.request,
                         ...(success.requestInput !== undefined && { requestInput: success.requestInput }),
@@ -1065,6 +1072,7 @@ function createPaymentSuccessContext(parameters) {
         ...(parameters.envelope ? { envelope: snapshotVerifiedEnvelope(parameters.envelope) } : {}),
         ...snapshotInputProperty(parameters.input),
         method: snapshotMethod(parameters.method),
+        ...(parameters.payer !== undefined && { payer: parameters.payer }),
         receipt: snapshotValue(parameters.receipt),
         request: snapshotValue(parameters.request),
         ...(parameters.requestInput !== undefined && {
@@ -1083,6 +1091,7 @@ function snapshotError(error) {
         return error;
     const snapshot = Object.assign(Object.create(Object.getPrototypeOf(error)), error);
     Object.defineProperties(snapshot, {
+        ...('cause' in error && { cause: { value: error.cause, enumerable: false } }),
         message: { value: error.message, enumerable: false },
         name: { value: error.name, enumerable: false },
     });
@@ -1260,13 +1269,6 @@ export function isMissingReceiptResponseError(error) {
 function normalizeExpires(expires) {
     return expires === undefined ? undefined : z.toDatetimeString(expires);
 }
-const _warned = new Set();
-function warnOnce(key, message) {
-    if (_warned.has(key))
-        return;
-    _warned.add(key);
-    console.warn(`[mppx] ${message}`);
-}
 /** Extracts hostname from the captured request URL, falling back to a default. */
 function resolveRealmFromCapturedRequest(capturedRequest) {
     try {
@@ -1300,7 +1302,7 @@ async function resolveRouteChallenge(parameters) {
         description: parameters.description,
         expires: parameters.expires,
         header: parameters.header,
-        meta: parameters.meta,
+        meta: ChallengeMeta.withNonce(parameters.meta),
         realm: effectiveRealm,
         request: request,
         secretKey: parameters.secretKey,
@@ -1316,7 +1318,7 @@ function createFallbackChallenge(parameters) {
         description: parameters.description,
         expires: parameters.expires,
         header: parameters.header,
-        meta: parameters.meta,
+        meta: ChallengeMeta.withNonce(parameters.meta),
         realm: parameters.realm ??
             (parameters.capturedRequest
                 ? resolveRealmFromCapturedRequest(parameters.capturedRequest)
@@ -1478,7 +1480,9 @@ function normalizeComparable(value) {
     return typeof value === 'string' ? normalizeHex(value) : value;
 }
 function opaqueValuesMatch(expected, actual) {
-    return isDeepStrictEqual(expected, actual);
+    // The echoed nonce is authenticated by the challenge HMAC, but is not a
+    // stable route requirement. Every other metadata field remains pinned.
+    return isDeepStrictEqual(ChallengeMeta.routeMeta(expected), ChallengeMeta.routeMeta(actual));
 }
 function hydrateCredentialMeta(credential) {
     const { challenge } = credential;

package/dist/server/Transport.js

@@ -59,6 +59,16 @@ export function http(options = {}) {
         },
         async respondChallenge(options) {
             const { challenge, error, input } = options;
+            // A 403 means the payment was valid but cannot pay for this request.
+            // Omit the challenge so clients do not pay again.
+            if (error?.status === 403)
+                return new Response(JSON.stringify(error.toProblemDetails()), {
+                    status: error.status,
+                    headers: {
+                        'Cache-Control': 'no-store',
+                        'Content-Type': 'application/problem+json',
+                    },
+                });
             if (options.html && new URL(input.url).searchParams.has(Html.params.serviceWorker))
                 return new Response(serviceWorker, {
                     status: 200,

package/dist/server/internal/challengeMeta.d.ts

@@ -0,0 +1,5 @@
+/** Adds fresh issuance randomness while preserving application and route metadata. */
+export declare function withNonce(meta: Record<string, string> | undefined): Record<string, string>;
+/** Removes issuance-only metadata when comparing stable route requirements. */
+export declare function routeMeta(meta: Record<string, string> | undefined): Record<string, string> | undefined;
+//# sourceMappingURL=challengeMeta.d.ts.map

package/dist/server/internal/challengeMeta.js

@@ -0,0 +1,14 @@
+import { Secp256k1 } from 'ox';
+/** Reserved metadata key for HMAC-bound, per-issuance challenge randomness. */
+const nonceKey = '_mppx_nonce';
+/** Adds fresh issuance randomness while preserving application and route metadata. */
+export function withNonce(meta) {
+    // Ox uses runtime-specific secure randomness, including Node without global Web Crypto.
+    return { ...meta, [nonceKey]: Secp256k1.randomPrivateKey() };
+}
+/** Removes issuance-only metadata when comparing stable route requirements. */
+export function routeMeta(meta) {
+    const { [nonceKey]: _, ...rest } = meta ?? {};
+    return Object.keys(rest).length ? rest : undefined;
+}
+//# sourceMappingURL=challengeMeta.js.map