mppx 0.15.0 → 0.16.0

package/dist/tempo/session/client/Runtime.d.ts

@@ -377,6 +377,8 @@ export type SessionManagerRuntime = RuntimeState & {
     lastChallenge: TempoSessionChallenge | null;
     /** Last HTTP resource URL usable for management POSTs. */
     lastUrl: RequestInfo | URL | null;
+    /** Headers of the last HTTP request, whose application Authorization management POSTs keep. */
+    lastHeaders?: HeadersInit | undefined;
     /** Active WebSocket payment session bookkeeping, when a socket is open. */
     socketSession: ActiveSocketSession | null;
 };

package/dist/tempo/session/client/Session.js

@@ -323,7 +323,7 @@ export function session(parameters = {}) {
             },
         };
         return wrapSseResponse({
-            onNeedVoucher: (event, streamSignal) => handleSseNeedVoucher({ challenge, driver, input, signal: streamSignal }, event),
+            onNeedVoucher: (event, streamSignal) => handleSseNeedVoucher({ challenge, driver, headers, input, signal: streamSignal }, event),
             onReceipt() { },
             response,
             signal,

package/dist/tempo/session/client/SessionManager.d.ts

@@ -1,5 +1,6 @@
 import type { Hex } from 'ox';
 import { type Address } from 'viem';
+import * as ProofRealm from '../../../client/internal/ProofRealm.js';
 import * as Account from '../../../viem/Account.js';
 import * as Client from '../../../viem/Client.js';
 import { type ChannelStore } from '../client/ChannelStore.js';
@@ -73,6 +74,11 @@ export declare namespace sessionManager {
         autoSwap?: sessionPlugin.Parameters['autoSwap'];
         /** Enables same-route HEAD bootstrap from a server session snapshot before opening a new channel. */
         bootstrap?: boolean | undefined;
+        /**
+         * Server origins allowed to request bootstrap proofs for a realm other than their hostname,
+         * mapped to that realm, such as `{ 'https://api.example.com': 'MPP Payment' }`.
+         */
+        trustedTempoProofRealms?: ProofRealm.TrustedRealms | undefined;
         /** Viem client instance. Shorthand for `getClient: () => client`. */
         client?: import('viem').Client | undefined;
         /** Token decimals used to convert `maxDeposit` to raw units. Defaults to `6`. */

package/dist/tempo/session/client/SessionManager.js

@@ -4,6 +4,8 @@ import * as Challenge from '../../../Challenge.js';
 import * as Fetch from '../../../client/internal/Fetch.js';
 import * as MethodChallenge from '../../../client/internal/MethodChallenge.js';
 import * as MethodResponse from '../../../client/internal/MethodResponse.js';
+import * as ProofRealm from '../../../client/internal/ProofRealm.js';
+import { setCredentialHeader } from '../../../client/internal/protocols/Shared.js';
 import * as Constants from '../../../Constants.js';
 import * as Account from '../../../viem/Account.js';
 import * as Client from '../../../viem/Client.js';
@@ -353,17 +355,19 @@ export function sessionManager(parameters) {
                 return undefined;
             if (!isZeroAmountChargeChallenge(challenge))
                 return undefined;
+            // The proof authenticates the payer at the challenge realm: sign only for the server it is
+            // sent to, and never after a redirect to another origin.
+            const target = new URL(String(bootstrapInput), typeof location !== 'undefined' ? location.href : undefined);
+            if (challengeResponse.url && new URL(challengeResponse.url).origin !== target.origin)
+                return undefined;
+            ProofRealm.assert(challenge, target, parameters.trustedTempoProofRealms);
             const credential = await chargeMethod.createCredential({
                 challenge: challenge,
                 context: {},
             });
-            const response = await config.fetch(bootstrapInput, {
-                ...headInit,
-                headers: {
-                    ...Fetch.normalizeHeaders(headInit.headers),
-                    [Constants.Headers.authorization]: credential,
-                },
-            });
+            const response = await config.fetch(bootstrapInput, 
+            // Runtimes do not strip custom payment headers on cross-origin redirects.
+            setCredentialHeader({ ...headInit, redirect: 'manual' }, Challenge.credentialHeader(challenge), credential));
             if (response.ok)
                 return await storeSnapshotHeader(response);
             return undefined;
@@ -643,6 +647,7 @@ export function sessionManager(parameters) {
         if (channelUse)
             throw new Error('SessionManager: a request is already in flight; concurrent requests on one manager are not supported');
         runtime.lastUrl = input;
+        runtime.lastHeaders = init?.headers;
         const previous = captureRuntimeStateSnapshot({
             channel: runtime.channel,
             spent: runtime.spent,
@@ -732,6 +737,7 @@ export function sessionManager(parameters) {
             createSessionCredential,
             fetch: config.fetch,
             getMinimumSpent: () => runtime.spent,
+            headers: runtime.lastHeaders,
             lastUrl: runtime.lastUrl,
             resolveSignedCloseAmount: (challenge) => getValidatedFallbackCloseAmount(target, challenge, true),
             signedCloseAmount: getValidatedFallbackCloseAmount(target),
@@ -799,6 +805,7 @@ export function sessionManager(parameters) {
                     additionalDeposit: target.additionalDeposit,
                     challenge: target.challenge,
                     channelId: target.channelId,
+                    headers: runtime.lastHeaders,
                     input: target.input,
                 });
             });

package/dist/tempo/session/client/Transports.d.ts

@@ -78,6 +78,8 @@ export type TopUpRequirement = {
     deposit: bigint;
     /** Original paid resource URL; converted to a management URL by the caller. */
     input: RequestInfo | URL;
+    /** Headers of the paid request; management posts keep its application `Authorization`. */
+    headers?: HeadersInit | undefined;
     /** Minimum cumulative voucher amount the server needs. */
     requiredCumulative: bigint;
     /** Cancels nested management requests for this top-up. */
@@ -158,6 +160,8 @@ export type ResolveNeedVoucherContextParameters = {
     getChannel(): ChannelEntry | null;
     /** Original paid resource URL; converted to management URL by the caller. */
     input: RequestInfo | URL;
+    /** Headers of the paid request; management posts keep its application `Authorization`. */
+    headers?: HeadersInit | undefined;
     /** Cancels top-up work triggered by this event. */
     signal?: AbortSignal | undefined;
     /** Performs the deposit top-up when server-required cumulative exceeds deposit. */
@@ -211,6 +215,8 @@ export type PostTopUpParameters = {
     fetch: typeof globalThis.fetch;
     /** Original paid resource URL; normalized to a management URL before posting. */
     input: RequestInfo | URL;
+    /** Headers of the paid request; management posts keep its application `Authorization`. */
+    headers?: HeadersInit | undefined;
     /** Cancels the top-up management request. */
     signal?: AbortSignal | undefined;
     /** Persists an unresolved funding outcome before another caller can reuse the channel. */
@@ -254,6 +260,8 @@ export type CloseHttpSessionParameters = {
     fetch: typeof globalThis.fetch;
     /** Last paid resource URL; used as the management endpoint base. */
     lastUrl: RequestInfo | URL | null;
+    /** Headers of the last paid request; the close post keeps its application `Authorization`. */
+    headers?: HeadersInit | undefined;
     /** Returns the latest cumulative spend already confirmed by the client. */
     getMinimumSpent?: (() => bigint) | undefined;
     /** Resolves the close amount again when the server refreshes the challenge. */
@@ -271,8 +279,8 @@ export declare function isTempoSessionChallenge(challenge: Challenge.Challenge):
 export declare function isTip1034SessionChallenge(challenge: Challenge.Challenge): challenge is TempoSessionChallenge;
 /** Reads a server-provided session snapshot from challenge method details. */
 export declare function getSessionSnapshot(challenge: TempoSessionChallenge): SessionSnapshot | undefined;
-/** Merges request headers and sets the payment authorization header for a retry. */
-export declare function requestInitWithAuthorization(input: RequestInfo | URL, init: RequestInit | undefined, credential: string): RequestInit;
+/** Merges request headers and sets the challenge's credential header for a retry. */
+export declare function requestInitWithAuthorization(input: RequestInfo | URL, init: RequestInit | undefined, credential: string, challenge: TempoSessionChallenge): RequestInit;
 /** Returns the exact resource URL used for out-of-band management POSTs, without its fragment. */
 export declare function managementInput(input: RequestInfo | URL): RequestInfo | URL;
 /** Converts a WebSocket URL into the HTTP URL used for its payment challenge probe. */
@@ -335,7 +343,7 @@ export type SsePaymentDriver = Pick<OpenSseSessionParameters, 'assertVoucherWith
  */
 export declare function openSseSession(input: RequestInfo | URL, init: SseDriverOptions | undefined, driver: OpenSseSessionParameters): Promise<AsyncIterable<string>>;
 /** @internal Consumes an already-paid SSE response with the session transport driver. */
-export declare function consumeSseSessionResponse(input: RequestInfo | URL, response: Response, options: SseResponseOptions | undefined, driver: OpenSseSessionParameters): AsyncIterable<string>;
+export declare function consumeSseSessionResponse(input: RequestInfo | URL, response: Response, options: SseResponseOptions | undefined, driver: OpenSseSessionParameters, headers?: HeadersInit | undefined): AsyncIterable<string>;
 /** Application SSE frame emitted after session payment events are handled. */
 export type SseResponseFrame = {
     /** Parsed application data, when present. */
@@ -362,6 +370,7 @@ export declare function wrapSseResponse(parameters: DriveSseResponseParameters):
 export declare function handleSseNeedVoucher(parameters: {
     challenge: TempoSessionChallenge | null;
     driver: SsePaymentDriver;
+    headers?: HeadersInit | undefined;
     input: RequestInfo | URL;
     signal?: AbortSignal | undefined;
 }, event: NeedVoucherEvent): Promise<void>;

package/dist/tempo/session/client/Transports.js

@@ -1,6 +1,7 @@
 import { Hex } from 'ox';
 import * as Challenge from '../../../Challenge.js';
 import * as Fetch from '../../../client/internal/Fetch.js';
+import { setCredentialHeader } from '../../../client/internal/protocols/Shared.js';
 import * as Constants from '../../../Constants.js';
 import * as PaymentCredential from '../../../Credential.js';
 import { deserializeSessionReceipt, isEventStream, parseEvent, readSessionChallengeAmount, uint96, } from '../precompile/Protocol.js';
@@ -211,6 +212,7 @@ export async function resolveNeedVoucherContext(parameters) {
     await parameters.topUpIfNeeded({
         challenge: parameters.challenge,
         input: parameters.input,
+        headers: parameters.headers,
         channelId: parameters.expectedChannelId,
         deposit: eventAmounts.deposit,
         requiredCumulative: eventAmounts.requiredCumulative,
@@ -246,17 +248,18 @@ export function isTip1034SessionChallenge(challenge) {
 export function getSessionSnapshot(challenge) {
     return Constants.getMethodDetail(challenge.request.methodDetails, Constants.MethodDetailKeys.sessionSnapshot);
 }
-/** Merges request headers and sets the payment authorization header for a retry. */
-export function requestInitWithAuthorization(input, init, credential) {
+/** Merges request headers and sets the challenge's credential header for a retry. */
+export function requestInitWithAuthorization(input, init, credential, challenge) {
     const requestHeaders = input instanceof Request ? input.headers : undefined;
-    return {
+    return setCredentialHeader({
         ...init,
+        // Runtimes do not strip custom payment headers on cross-origin redirects.
+        redirect: 'manual',
         headers: {
             ...Fetch.normalizeHeaders(requestHeaders),
             ...Fetch.normalizeHeaders(init?.headers),
-            [Constants.Headers.authorization]: credential,
         },
-    };
+    }, Challenge.credentialHeader(challenge), credential);
 }
 /** Returns the exact resource URL used for out-of-band management POSTs, without its fragment. */
 export function managementInput(input) {
@@ -324,6 +327,7 @@ export async function postTopUp(parameters) {
         },
         createSessionCredential: parameters.createSessionCredential,
         fetch: parameters.fetch,
+        headers: parameters.headers,
         input: parameters.input,
         signal: parameters.signal,
     }).catch(async (error) => {
@@ -360,7 +364,8 @@ async function postManagementCredential(parameters) {
                 parameters.fetch(managementInput(parameters.input), {
                     method: 'POST',
                     signal: controller.signal,
-                    headers: { [Constants.Headers.authorization]: authorization },
+                    redirect: 'manual',
+                    headers: managementHeaders(challenge, authorization, parameters.input, parameters.headers),
                 }),
                 aborted,
             ]);
@@ -397,6 +402,7 @@ export async function retryHttpPaymentRequired(parameters) {
     await parameters.topUpIfNeeded({
         challenge,
         input: parameters.input,
+        headers: parameters.init?.headers,
         channelId: snapshot.channelId,
         deposit: BigInt(snapshot.deposit),
         requiredCumulative,
@@ -419,7 +425,7 @@ export async function retryHttpPaymentRequired(parameters) {
             descriptor: currentChannel.descriptor,
             cumulativeAmountRaw: cumulativeAmount.toString(),
         });
-        retry = await parameters.fetch(parameters.input, requestInitWithAuthorization(parameters.input, parameters.init, credential));
+        retry = await parameters.fetch(parameters.input, requestInitWithAuthorization(parameters.input, parameters.init, credential, challenge));
     }
     catch (error) {
         await restore();
@@ -463,7 +469,8 @@ export async function closeHttpSession(parameters) {
         });
         return parameters.fetch(parameters.lastUrl, {
             method: 'POST',
-            headers: { [Constants.Headers.authorization]: credential },
+            redirect: 'manual',
+            headers: managementHeaders(challenge, credential, parameters.lastUrl, parameters.headers),
         });
     };
     let response = await postClose(parameters.target.challenge);
@@ -516,17 +523,17 @@ export async function openSseSession(input, init, driver) {
     let response = await driver.doFetch(input, sseInit);
     if (!isEventStream(response) && driver.getChannel()?.opened)
         response = await driver.doFetch(input, sseInit);
-    return consumeSseSessionResponse(input, response, { onReceipt, signal }, driver);
+    return consumeSseSessionResponse(input, response, { onReceipt, signal }, driver, sseInit.headers);
 }
 /** @internal Consumes an already-paid SSE response with the session transport driver. */
-export function consumeSseSessionResponse(input, response, options, driver) {
+export function consumeSseSessionResponse(input, response, options, driver, headers) {
     if (!isEventStream(response))
         throw new Error('SSE response is not an event stream.');
     if (!response.body)
         throw new Error('Response has no body.');
     const challenge = driver.getChallenge();
     return iterateSseMessages({
-        onNeedVoucher: (event) => handleSseNeedVoucher({ challenge, driver, input, signal: options?.signal }, event),
+        onNeedVoucher: (event) => handleSseNeedVoucher({ challenge, driver, headers, input, signal: options?.signal }, event),
         onReceipt(receipt) {
             driver.acceptReceipt(receipt);
             options?.onReceipt?.(receipt);
@@ -682,6 +689,7 @@ export async function handleSseNeedVoucher(parameters, event) {
         event,
         expectedChannelId: channel.channelId,
         getChannel: parameters.driver.getChannel,
+        headers: parameters.headers,
         input: parameters.input,
         signal: parameters.signal,
         topUpIfNeeded: parameters.driver.topUpIfNeeded,
@@ -693,6 +701,7 @@ export async function handleSseNeedVoucher(parameters, event) {
         context: resolution.context,
         createSessionCredential: parameters.driver.createSessionCredential,
         fetch: parameters.driver.fetch,
+        headers: parameters.headers,
         input: parameters.input,
         signal: parameters.signal,
     });
@@ -979,4 +988,21 @@ function handleReceipt(parameters, receipt) {
     parameters.driver.options?.onReceipt?.(receipt);
     parameters.driver.settleReceipt(receipt);
 }
+/**
+ * Builds the headers of a management or close post: the session credential in the header the
+ * challenge selects, plus the paid request's application `Authorization` when the credential
+ * goes elsewhere (`requiresAuth`), so the post passes the same application authentication.
+ */
+function managementHeaders(challenge, credential, input, headers) {
+    const header = Challenge.credentialHeader(challenge);
+    const result = new Headers();
+    if (header.toLowerCase() !== Constants.Headers.authorization.toLowerCase()) {
+        const authorization = new Headers(headers).get(Constants.Headers.authorization) ??
+            (input instanceof Request ? input.headers.get(Constants.Headers.authorization) : null);
+        if (authorization && !authorization.startsWith(`${Constants.Schemes.payment} `))
+            result.set(Constants.Headers.authorization, authorization);
+    }
+    result.set(header, credential);
+    return result;
+}
 //# sourceMappingURL=Transports.js.map

package/dist/tempo/session/precompile/Chain.js

@@ -300,9 +300,6 @@ function validateCredentialSponsorship(parameters) {
         return;
     if (feePayer === true) {
         assertPrecompileFeePayerPolicy({ prepared: transaction, policy: feePayerPolicy });
-        if (feePayerPolicy?.allowKeyAuthorization === false &&
-            transaction.keyAuthorization !== undefined)
-            throw new BadRequestError({ reason: 'fee-payer policy keyAuthorization is not allowed' });
         FeePayer.assertAllowedFeeToken(transaction, allowedFeeTokens);
         FeePayer.assertTransactionPolicy({
             challengeExpires,

package/dist/tempo/subscription/Store.js

@@ -35,6 +35,14 @@ export function fromStore(store, options) {
             return null;
         return (await store.get(recordKey(subscriptionId)));
     }
+    async function ensureAccessKeyAddressIndex(record) {
+        await store.update(accessKeyAddressKey(record.accessKeyAddress), (current) => {
+            if (current)
+                return { op: 'noop', result: undefined };
+            return { op: 'set', value: record, result: undefined };
+        });
+        return record;
+    }
     async function clearRenewalState(subscriptionId, periodIndex, attempt) {
         await store.update(recordKey(subscriptionId), (current) => {
             const subscription = current;
@@ -216,7 +224,7 @@ export function fromStore(store, options) {
         async getOrCreateAccessKey(key) {
             const existing = (await store.get(accessKeyKey(key)));
             if (existing)
-                return existing;
+                return ensureAccessKeyAddressIndex(existing);
             const privateKey = Secp256k1.randomPrivateKey();
             const account = TempoAccount.fromSecp256k1(privateKey);
             const candidate = {
@@ -231,14 +239,7 @@ export function fromStore(store, options) {
                 }
                 return { op: 'set', value: candidate, result: candidate };
             })
-                .then(async (record) => {
-                await store.update(accessKeyAddressKey(record.accessKeyAddress), (current) => {
-                    if (current)
-                        return { op: 'noop', result: undefined };
-                    return { op: 'set', value: record, result: undefined };
-                });
-                return record;
-            });
+                .then(ensureAccessKeyAddressIndex);
         },
         async put(record) {
             await store.put(recordKey(record.subscriptionId), record);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",
@@ -35,9 +35,9 @@
       "types": "./dist/client/node.d.ts",
       "default": "./dist/client/node.js"
     },
-    "./attestation": {
-      "types": "./dist/attestation/index.d.ts",
-      "default": "./dist/attestation/index.js"
+    "./identity": {
+      "types": "./dist/identity/index.d.ts",
+      "default": "./dist/identity/index.js"
     },
     "./discovery": {
       "types": "./dist/discovery/index.d.ts",
@@ -123,13 +123,17 @@
       "types": "./dist/tempo/index.d.ts",
       "default": "./dist/tempo/index.js"
     },
-    "./attestation/tap": {
-      "types": "./dist/tap/index.d.ts",
-      "default": "./dist/tap/index.js"
+    "./extensions/identity": {
+      "types": "./dist/extensions/identity/index.d.ts",
+      "default": "./dist/extensions/identity/index.js"
     },
-    "./attestation/web-bot-auth": {
-      "types": "./dist/web-bot-auth/index.d.ts",
-      "default": "./dist/web-bot-auth/index.js"
+    "./extensions/identity/tap": {
+      "types": "./dist/extensions/identity/tap/index.d.ts",
+      "default": "./dist/extensions/identity/tap/index.js"
+    },
+    "./extensions/identity/web-bot-auth": {
+      "types": "./dist/extensions/identity/web-bot-auth/index.d.ts",
+      "default": "./dist/extensions/identity/web-bot-auth/index.js"
     },
     "./html": {
       "types": "./dist/Html.d.ts",
@@ -206,7 +210,7 @@
     "eventsource-parser": "4.1.1",
     "ox": "0.14.45",
     "structured-headers": "2.1.0",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "repository": {
     "type": "git",

package/dist/attestation/Client.d.ts

@@ -1,17 +0,0 @@
-import type * as Types from './Types.js';
-/**
- * Combines request signers using one shared context per call.
- *
- * The returned signer creates a fresh context unless its caller supplies one,
- * allowing every signature on one HTTP attempt to share a nonce and timestamp.
- */
-export declare function composeSigners(...signers: readonly [Types.Signer, ...Types.Signer[]]): Types.Signer<'composed'>;
-/**
- * Wraps a fetch implementation so every outbound request is attested.
- *
- * Configure this wrapper as the underlying `fetch` passed to `mppx/client`
- * `Fetch.from()`. MPPX then uses it for both the initial request and its
- * automatic request containing an `Authorization: Payment` credential.
- */
-export declare function wrapFetch(fetch: typeof globalThis.fetch, signer: Types.Signer): typeof globalThis.fetch;
-//# sourceMappingURL=Client.d.ts.map

package/dist/attestation/Client.js

@@ -1,28 +0,0 @@
-import * as SigningContext from './internal/SigningContext.js';
-/**
- * Combines request signers using one shared context per call.
- *
- * The returned signer creates a fresh context unless its caller supplies one,
- * allowing every signature on one HTTP attempt to share a nonce and timestamp.
- */
-export function composeSigners(...signers) {
-    return {
-        protocol: 'composed',
-        async sign(request, context = SigningContext.create()) {
-            for (const signer of signers)
-                request = await signer.sign(request, context);
-            return request;
-        },
-    };
-}
-/**
- * Wraps a fetch implementation so every outbound request is attested.
- *
- * Configure this wrapper as the underlying `fetch` passed to `mppx/client`
- * `Fetch.from()`. MPPX then uses it for both the initial request and its
- * automatic request containing an `Authorization: Payment` credential.
- */
-export function wrapFetch(fetch, signer) {
-    return async (input, init) => fetch(await signer.sign(new Request(input, init)));
-}
-//# sourceMappingURL=Client.js.map

package/dist/attestation/Server.d.ts

@@ -1,4 +0,0 @@
-import type * as Types from './Types.js';
-/** Verifies every configured request-attestation protocol. */
-export declare function verify<const verifiers extends Types.VerifierMap>(request: Request, verifiers: verifiers): Promise<Types.VerificationsFrom<verifiers>>;
-//# sourceMappingURL=Server.d.ts.map

package/dist/attestation/Server.js

@@ -1,8 +0,0 @@
-/** Verifies every configured request-attestation protocol. */
-export async function verify(request, verifiers) {
-    const outcomes = {};
-    for (const [name, verifier] of Object.entries(verifiers))
-        outcomes[name] = await verifier.verify(request);
-    return outcomes;
-}
-//# sourceMappingURL=Server.js.map

package/dist/attestation/Types.d.ts

@@ -1,76 +0,0 @@
-import type { MaybePromise } from '../internal/types.js';
-import type { Algorithms } from './Constants.js';
-/** RFC 9421 algorithms implemented by the request-attestation signer and verifier. */
-export type SignatureAlgorithm = (typeof Algorithms)[keyof typeof Algorithms];
-/** Resolves a trusted public key for a parsed request signature. */
-export type KeyResolver = (parameters: {
-    /** RFC 9421 algorithm declared by the signature. */
-    algorithm: SignatureAlgorithm;
-    /** Key identifier declared by the signature. */
-    keyId: string;
-    /** Request carrying the signature. */
-    request: Request;
-}) => MaybePromise<CryptoKey | undefined>;
-/**
- * The complete outcome of attempting one protocol verifier.
- *
- * `absent` means the protocol did not appear on the request. `invalid` means
- * it appeared but failed validation and must reject the request. `unverified`
- * means key material or another required verification dependency was unavailable.
- * `verified` carries protocol-specific data that is safe for callers to inspect.
- */
-export type Verification<value = unknown> = {
-    status: 'absent';
-} | {
-    status: 'invalid';
-    reason: string;
-} | {
-    status: 'unverified';
-    reason: string;
-} | {
-    status: 'verified';
-    value: value;
-};
-/**
- * Verifies one request-attestation protocol carried by an HTTP request.
- *
- * Verifiers are registered in a {@link VerifierMap}; each map key names the
- * result returned to the caller.
- */
-export type Verifier<value = unknown> = {
-    /** Validates the request and returns a complete protocol verification outcome. */
-    verify: (request: Request) => MaybePromise<Verification<value>>;
-};
-/** Maps each recognized protocol name to its verifier. */
-export type VerifierMap = Readonly<Record<string, Verifier>>;
-/** Preserves each configured protocol's complete verification outcome. */
-export type VerificationsFrom<verifiers extends VerifierMap> = {
-    readonly [protocol in keyof verifiers]: Awaited<ReturnType<verifiers[protocol]['verify']>>;
-};
-/**
- * Values shared by every signer contributing to one HTTP request attempt.
- *
- * A caller may reuse this context across independent signature protocols so
- * they describe the same attempt. A later network retry must use a new context.
- */
-export type SigningContext = {
-    /** Unix timestamp, in seconds, at which the request attempt was created. */
-    readonly created: number;
-    /** Base64url-encoded random value identifying this request attempt. */
-    readonly nonce: string;
-};
-/**
- * Signs each outbound HTTP request, including MPP payment retries.
- *
- * The protocol type preserves which adapter produced the signer for diagnostics
- * and composition, without asserting that the signer alone authorizes payment.
- */
-export type Signer<protocol extends string = string> = {
-    /** Protocol identifier used for diagnostics. */
-    protocol: protocol;
-    /** Returns a new request containing the protocol's signature material. */
-    sign: (request: Request, context?: SigningContext | undefined) => MaybePromise<Request>;
-};
-/** Maps application-defined names to request-attestation signers. */
-export type SignerMap = Readonly<Record<string, Signer>>;
-//# sourceMappingURL=Types.d.ts.map

package/dist/attestation/internal/SigningContext.d.ts

@@ -1,4 +0,0 @@
-import type * as Types from '../Types.js';
-/** Creates the signing context for one outbound HTTP request attempt. */
-export declare function create(): Types.SigningContext;
-//# sourceMappingURL=SigningContext.d.ts.map

package/dist/tap/client/index.d.ts

@@ -1,26 +0,0 @@
-import type * as AttestationTypes from '../../attestation/Types.js';
-import { Constants } from '../Constants.js';
-/**
- * Creates a TAP request signer.
- *
- * The signer emits RFC 9421 HTTP message signatures with TAP's
- * `agent-browser-auth` or `agent-payer-auth` tag. Pass it to
- * `Attestation.Client.wrapFetch` so MPPX signs both the initial request and
- * its automatic paid retry.
- */
-export declare function signer(config: signer.Config): AttestationTypes.Signer<typeof Constants.protocol>;
-export declare namespace signer {
-    type Config = {
-        /** TAP signature type for the request. */
-        intent: (typeof Constants.intents)[keyof typeof Constants.intents];
-        /** Ed25519 or RSA-PSS SHA-512 private key provisioned to the agent provider. */
-        key: CryptoKey;
-        /** Identifier the merchant uses to resolve the signing public key. */
-        keyId: string;
-        /** Signature lifetime in seconds. TAP permits at most eight minutes. @default 480 */
-        expiresIn?: number | undefined;
-        /** RFC 9421 dictionary label. @default 'tap' */
-        label?: string | undefined;
-    };
-}
-//# sourceMappingURL=index.d.ts.map

package/dist/tap/server/index.d.ts

@@ -1,20 +0,0 @@
-import type * as Attestation from '../../attestation/Types.js';
-import type * as Store from '../../Store.js';
-import type * as Types from '../Types.js';
-/**
- * Creates a verifier for TAP agent-recognition signatures.
- *
- * TAP verifies trusted agent participation and request integrity. Consumer
- * recognition and payment-container verification stay protocol-specific and
- * are intentionally not inferred from this header-only verifier.
- */
-export declare function verifier(config: verifier.Config): Attestation.Verifier<Types.VerifiedRequest>;
-export declare namespace verifier {
-    type Config = {
-        /** Resolves a TAP-approved public key by its `keyid` and signature algorithm. */
-        keyResolver: Attestation.KeyResolver;
-        /** Atomically consumes each nonce in shared storage for multi-instance deployments. */
-        nonceStore: Store.AtomicStore;
-    };
-}
-//# sourceMappingURL=index.d.ts.map