mppx 0.15.0 → 0.17.0

package/dist/client/internal/Fetch.js

@@ -2,14 +2,18 @@ import * as Challenge from '../../Challenge.js';
 import * as Constants from '../../Constants.js';
 import { PaymentOutcomeUnknownError } from '../../Errors.js';
 import * as Expires from '../../Expires.js';
+import * as IdentityClient from '../../identity/Client.js';
 import * as AcceptPayment from '../../internal/AcceptPayment.js';
 import * as Transport from '../Transport.js';
 import * as MethodChallenge from './MethodChallenge.js';
 import * as MethodResponse from './MethodResponse.js';
+import * as ProofRealm from './ProofRealm.js';
 // We tag wrappers with a global symbol so we can recognize wrappers created by mppx,
 // even across multiple module instances/bundles. This lets restore() avoid clobbering
 // an unrelated fetch installed by user code or another library.
 const MPPX_FETCH_WRAPPER = Symbol.for('mppx.fetch.wrapper');
+/** Identity runner of an mppx fetch wrapper, inherited when that wrapper is wrapped again. */
+const MPPX_FETCH_IDENTITY = Symbol.for('mppx.fetch.identity');
 const defaultMaxPaymentRetries = 3;
 const maxErrorBodyBytes = 64 * 1024;
 const errorBodyTimeoutMs = 2_000;
@@ -101,19 +105,25 @@ async function settleAttempt(prepared, outcome) {
  *
  */
 export function from(config) {
-    const { acceptPayment, acceptPaymentPolicy = 'always', fetch = globalThis.fetch, maxPaymentRetries = defaultMaxPaymentRetries, methods, onChallenge, orderChallenges, transport = Transport.http(), } = config;
+    const { acceptPayment, acceptPaymentPolicy = 'always', fetch = globalThis.fetch, maxPaymentRetries = defaultMaxPaymentRetries, methods, onChallenge, orderChallenges, transport = Transport.http(), trustedTempoProofRealms, } = config;
+    // Rewrapping an mppx fetch keeps its identity provers unless new ones are configured.
+    // Only an explicitly passed mppx fetch hands down its provers; the global fetch never does.
+    const identity = config.identity ?? (config.fetch && identityOf(config.fetch));
     const events = config.eventDispatcher ?? createEventDispatcher();
     const resolvedAcceptPayment = acceptPayment ?? AcceptPayment.resolve(methods);
     // Always operate on the true underlying fetch to avoid wrapper-on-wrapper stacking,
     // which can duplicate retries and make restore semantics fragile.
     const baseFetch = unwrapFetch(fetch);
+    const send = async (input, init, context) => identity
+        ? (await identity.send(baseFetch, new Request(input, init), context)).response
+        : baseFetch(input, init);
     const request = async (input, init, canRefetch) => {
         const callerHeaders = getCallerHeaders(input, init?.headers);
         const hasExplicitAcceptPayment = callerHeaders.has(Constants.Headers.acceptPayment);
         const paymentPreferences = resolvePaymentPreferences(callerHeaders, resolvedAcceptPayment);
         const capturedBody = captureRequestBody(input, init, callerHeaders);
         const initialRequest = prepareInitialRequest(input, init, callerHeaders, paymentPreferences.header, hasExplicitAcceptPayment, acceptPaymentPolicy);
-        let response = await baseFetch(cloneRequestInput(initialRequest.input), initialRequest.init);
+        let response = await send(cloneRequestInput(initialRequest.input), initialRequest.init);
         const transportRequest = withCapturedBody(initialRequest.init, await capturedBody);
         if (!(await transport.isPaymentRequired(response, transportRequest)))
             return response;
@@ -150,7 +160,9 @@ export function from(config) {
                 mi = selected.method;
                 if (challenge.expires)
                     Expires.assert(challenge.expires, challenge.id);
+                await identity?.challenge(response, { challenge: selectedChallenge }, resolveRequestUrl(initialRequest.input).href);
                 const paymentInput = resolvePaymentRetryInput(response, initialRequest.input, initialRequest.input);
+                ProofRealm.assert(selectedChallenge, () => resolveRequestUrl(paymentInput), trustedTempoProofRealms);
                 const previousCredential = preparedCredential;
                 const key = Challenge.serialize(selectedChallenge);
                 const sameAttempt = previousCredential?.method === selected.method && previousCredential?.key === key;
@@ -179,7 +191,12 @@ export function from(config) {
                         prepare: () => MethodChallenge.handle(selected.method, {
                             challenge: selectedChallenge,
                             context: credentialContext,
-                            fetch: baseFetch,
+                            // Management requests (e.g. session top-ups) carry the same identity proofs.
+                            fetch: identity
+                                ? IdentityClient.wrapFetch(baseFetch, identity, {
+                                    challenge: selectedChallenge,
+                                })
+                                : baseFetch,
                             input: paymentInput,
                             signal: resolveRequestSignal(input, init),
                         }),
@@ -232,14 +249,14 @@ export function from(config) {
                     transactionHash: MethodResponse.getTransactionHash(selected.method, credential),
                 });
                 try {
-                    response = await baseFetch(paymentInput, {
+                    response = await send(paymentInput, {
                         ...transport.setCredential({
                             ...fetchInit,
                             headers: initialRequest.headers,
                         }, credential, { challenge: selectedChallenge }),
                         // Runtimes do not strip custom payment headers on cross-origin redirects.
                         redirect: 'manual',
-                    });
+                    }, { challenge: selectedChallenge });
                 }
                 catch (cause) {
                     outcomeUnknown = unknownOutcome(cause);
@@ -347,6 +364,8 @@ export function from(config) {
     };
     const wrappedFetch = (input, init) => request(input, init, true);
     wrappedFetch[MPPX_FETCH_WRAPPER] = baseFetch;
+    if (identity)
+        wrappedFetch[MPPX_FETCH_IDENTITY] = identity;
     return wrappedFetch;
 }
 /**
@@ -380,7 +399,8 @@ export function polyfill(config) {
     globalThis.fetch = from({
         ...config,
         acceptPaymentPolicy: config.acceptPaymentPolicy ?? (isBrowser() ? 'same-origin' : 'always'),
-        fetch: globalThis.fetch,
+        // Unwrapped so a previous polyfill's identity provers are not inherited.
+        fetch: unwrapFetch(globalThis.fetch),
     });
 }
 /**
@@ -586,8 +606,22 @@ function snapshotMethod(method) {
     return freezeSnapshot(Object.assign({}, method));
 }
 function snapshotResponse(response) {
-    if (response instanceof Response)
-        return response.clone();
+    if (response instanceof Response) {
+        try {
+            return response.clone();
+        }
+        catch {
+            // Consumed or locked bodies cannot be cloned; retain isolated status, headers and URL.
+            const snapshot = new Response(null, {
+                headers: response.headers,
+                status: response.status,
+                statusText: response.statusText,
+            });
+            for (const key of ['redirected', 'type', 'url'])
+                Object.defineProperty(snapshot, key, { value: response[key] });
+            return snapshot;
+        }
+    }
     return snapshotValue(response);
 }
 function snapshotValue(value) {
@@ -667,6 +701,10 @@ function getCallerHeaders(input, headers) {
     return new Headers(input instanceof Request ? input.headers : undefined);
 }
 /** @internal */
+/** Returns the identity runner of an mppx fetch wrapper, if it has one. @internal */
+export function identityOf(fetch) {
+    return fetch[MPPX_FETCH_IDENTITY];
+}
 /** @internal */
 export function unwrapFetch(fetch) {
     let current = fetch;

package/dist/client/internal/ProofRealm.d.ts

@@ -0,0 +1,21 @@
+import type * as Challenge from '../../Challenge.js';
+/**
+ * Pins that let a server origin request zero-amount Tempo proofs for a realm other than its
+ * hostname, keyed by origin (`scheme://host[:port]`), such as
+ * `{ 'https://api.example.com': 'MPP Payment' }`.
+ */
+export type TrustedRealms = Readonly<Record<string, string>>;
+/**
+ * Refuses a zero-amount Tempo proof whose realm the HTTP server that sent the Challenge does not
+ * own. A proof authenticates the payer at the Challenge realm, so a foreign origin could otherwise
+ * relay another server's Challenge and replay the signed proof there. The server owns the realm
+ * when it is the request hostname, or when `trustedRealms` pins it to the request origin. Pass
+ * `url` as a function to resolve it only for proof Challenges.
+ */
+export declare function assert(challenge: Challenge.Challenge, url: URL | (() => URL), trustedRealms: TrustedRealms | undefined): void;
+/**
+ * Refuses a zero-amount Tempo proof on a transport without an origin, such as MCP, unless
+ * `trustedRealms` lists its realm.
+ */
+export declare function assertWithoutOrigin(challenge: Challenge.Challenge, trustedRealms: readonly string[] | undefined): void;
+//# sourceMappingURL=ProofRealm.d.ts.map

package/dist/client/internal/ProofRealm.js

@@ -0,0 +1,55 @@
+/**
+ * Refuses a zero-amount Tempo proof whose realm the HTTP server that sent the Challenge does not
+ * own. A proof authenticates the payer at the Challenge realm, so a foreign origin could otherwise
+ * relay another server's Challenge and replay the signed proof there. The server owns the realm
+ * when it is the request hostname, or when `trustedRealms` pins it to the request origin. Pass
+ * `url` as a function to resolve it only for proof Challenges.
+ */
+export function assert(challenge, url, trustedRealms) {
+    if (!isProof(challenge))
+        return;
+    url = typeof url === 'function' ? url() : url;
+    const { realm } = challenge;
+    if (realm.toLowerCase() === url.hostname.toLowerCase())
+        return;
+    const origin = url.origin.toLowerCase();
+    for (const [trustedOrigin, trustedRealm] of Object.entries(trustedRealms ?? {}))
+        if (trustedRealm === realm && normalizeOrigin(trustedOrigin) === origin)
+            return;
+    throw new Error(`Refusing to sign Tempo proof for realm ${JSON.stringify(realm)} from ${url.origin}. Pin the realm to this origin with \`trustedTempoProofRealms\` if this server is expected to issue it.`);
+}
+/**
+ * Refuses a zero-amount Tempo proof on a transport without an origin, such as MCP, unless
+ * `trustedRealms` lists its realm.
+ */
+export function assertWithoutOrigin(challenge, trustedRealms) {
+    if (!isProof(challenge))
+        return;
+    if (trustedRealms?.includes(challenge.realm))
+        return;
+    throw new Error(`Refusing to sign Tempo proof for untrusted realm ${JSON.stringify(challenge.realm)}. Add it to \`trustedTempoProofRealms\` if this server is expected to issue it.`);
+}
+/**
+ * Whether `challenge` is a zero-amount `tempo/charge` Challenge, paid with a signed proof. Uses the
+ * same `BigInt` conversion as the Tempo charge client, so every encoding it signs a proof for
+ * (such as `"0x0"` or `" 0 "`) is checked.
+ */
+function isProof(challenge) {
+    if (challenge.method !== 'tempo' || challenge.intent !== 'charge')
+        return false;
+    try {
+        return BigInt(challenge.request.amount) === 0n;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeOrigin(origin) {
+    try {
+        return new URL(origin).origin.toLowerCase();
+    }
+    catch {
+        return origin.toLowerCase();
+    }
+}
+//# sourceMappingURL=ProofRealm.js.map

package/dist/client/internal/protocols/Mpp.js

@@ -5,8 +5,11 @@ import { paymentRequiredStatus, setCredentialHeader } from './Shared.js';
 export function mpp() {
     return {
         getChallenges(response) {
+            const header = response.headers.get(Constants.Headers.wwwAuthenticate);
+            // A 402 without a Payment challenge (such as `WWW-Authenticate: X402`) is left to other protocols.
             if (response.status !== paymentRequiredStatus ||
-                !response.headers.has(Constants.Headers.wwwAuthenticate))
+                !header ||
+                !Challenge.hasPaymentScheme(header))
                 return [];
             return Challenge.fromResponseList(response);
         },

package/dist/{attestation → extensions/identity}/Constants.d.ts

@@ -1,11 +1,11 @@
-/** RFC 9421 signature algorithms supported by request attestation. */
+/** RFC 9421 signature algorithms supported by HTTP message signatures. */
 export declare const Algorithms: {
     /** EdDSA using the Ed25519 curve. */
     readonly ed25519: 'ed25519';
     /** RSASSA-PSS using SHA-512 and a 64-byte salt. */
     readonly rsaPssSha512: 'rsa-pss-sha512';
 };
-/** HTTP headers defined by RFC 9421 for request-attestation signatures. */
+/** HTTP headers defined by RFC 9421 for identity signatures. */
 export declare const Headers: {
     /** Carries the RFC 9421 signature bytes. */
     readonly signature: 'Signature';

package/dist/{attestation → extensions/identity}/Constants.js

@@ -1,11 +1,11 @@
-/** RFC 9421 signature algorithms supported by request attestation. */
+/** RFC 9421 signature algorithms supported by HTTP message signatures. */
 export const Algorithms = {
     /** EdDSA using the Ed25519 curve. */
     ed25519: 'ed25519',
     /** RSASSA-PSS using SHA-512 and a 64-byte salt. */
     rsaPssSha512: 'rsa-pss-sha512',
 };
-/** HTTP headers defined by RFC 9421 for request-attestation signatures. */
+/** HTTP headers defined by RFC 9421 for identity signatures. */
 export const Headers = {
     /** Carries the RFC 9421 signature bytes. */
     signature: 'Signature',

package/dist/extensions/identity/Types.d.ts

@@ -0,0 +1,21 @@
+import type { MaybePromise } from '../../internal/types.js';
+import type { Algorithms } from './Constants.js';
+/** RFC 9421 algorithms implemented by the HTTP message signature signer and verifier. */
+export type SignatureAlgorithm = (typeof Algorithms)[keyof typeof Algorithms];
+/** Resolves a trusted public key for a parsed request signature. */
+export type KeyResolver = (parameters: {
+    /** RFC 9421 algorithm declared by the signature. */
+    algorithm: SignatureAlgorithm;
+    /** Key identifier declared by the signature. */
+    keyId: string;
+    /** Request carrying the signature. */
+    request: Request;
+}) => MaybePromise<CryptoKey | undefined>;
+/** Values shared by every signature on one HTTP attempt. */
+export type SigningContext = {
+    /** Unix timestamp, in seconds, at which the attempt was created. */
+    readonly created: number;
+    /** Base64url-encoded random value identifying the attempt. */
+    readonly nonce: string;
+};
+//# sourceMappingURL=Types.d.ts.map

package/dist/extensions/identity/index.d.ts

@@ -0,0 +1,7 @@
+/** Client and server adapters for the TAP agent-recognition signature profile. */
+export * as Tap from './tap/index.js';
+/** Client and server adapters for the Web Bot Auth HTTPS-directory profile. */
+export * as WebBotAuth from './web-bot-auth/index.js';
+export * from './Constants.js';
+export type * from './Types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/extensions/identity/index.js

@@ -0,0 +1,6 @@
+/** Client and server adapters for the TAP agent-recognition signature profile. */
+export * as Tap from './tap/index.js';
+/** Client and server adapters for the Web Bot Auth HTTPS-directory profile. */
+export * as WebBotAuth from './web-bot-auth/index.js';
+export * from './Constants.js';
+//# sourceMappingURL=index.js.map

package/dist/{attestation → extensions/identity}/internal/HttpMessageSignature.d.ts

@@ -1,8 +1,8 @@
 import type { BareItem } from 'structured-headers';
-import type { MaybePromise } from '../../internal/types.js';
-import * as Store from '../../Store.js';
+import type { MaybePromise } from '../../../internal/types.js';
+import * as Store from '../../../Store.js';
 import type { KeyResolver, SignatureAlgorithm, SigningContext } from '../Types.js';
-/** RFC 9421 constants used by request-attestation signature profiles. */
+/** RFC 9421 constants used by identity signature profiles. */
 export declare const Constants: {
     /** Derived request components supported by this narrow request profile. */
     readonly components: {

package/dist/{attestation → extensions/identity}/internal/HttpMessageSignature.js

@@ -1,8 +1,8 @@
 import { isInnerList, parseDictionary, serializeItem, serializeDictionary, serializeInnerList, serializeParameters, } from 'structured-headers';
-import * as Store from '../../Store.js';
-import { Algorithms, Headers as AttestationHeaders } from '../Constants.js';
+import * as Store from '../../../Store.js';
+import { Algorithms, Headers as SignatureHeaders } from '../Constants.js';
 import * as SigningContextInternal from './SigningContext.js';
-/** RFC 9421 constants used by request-attestation signature profiles. */
+/** RFC 9421 constants used by identity signature profiles. */
 export const Constants = {
     /** Derived request components supported by this narrow request profile. */
     components: {
@@ -55,16 +55,16 @@ export async function sign(request, options) {
     };
     const signature = await crypto.subtle.sign(webCryptoAlgorithm(algorithm), options.key, toArrayBuffer(encode(signatureBase(request, input))));
     const headers = new Headers(request.headers);
-    const inputs = parseHeaderDictionary(headers, AttestationHeaders.signatureInput);
-    const signatures = parseHeaderDictionary(headers, AttestationHeaders.signature);
+    const inputs = parseHeaderDictionary(headers, SignatureHeaders.signatureInput);
+    const signatures = parseHeaderDictionary(headers, SignatureHeaders.signature);
     if (!haveSameKeys(inputs, signatures))
         throw new Error('Signature-Input and Signature must contain the same labels.');
     if (inputs.has(input.label) || signatures.has(input.label))
         throw new Error(`HTTP message signature label "${input.label}" already exists.`);
     inputs.set(input.label, toInnerList(input));
     signatures.set(input.label, [signature, new Map()]);
-    headers.set(AttestationHeaders.signatureInput, serializeDictionary(inputs));
-    headers.set(AttestationHeaders.signature, serializeDictionary(signatures));
+    headers.set(SignatureHeaders.signatureInput, serializeDictionary(inputs));
+    headers.set(SignatureHeaders.signature, serializeDictionary(signatures));
     return new Request(request, { headers });
 }
 /** Verifies a request signature, its lifetime, and optionally its nonce. */
@@ -137,8 +137,8 @@ export async function verify(request, options) {
     return { status: 'verified', input };
 }
 function parse(request, expectedTag) {
-    const inputHeader = request.headers.get(AttestationHeaders.signatureInput);
-    const signatureHeader = request.headers.get(AttestationHeaders.signature);
+    const inputHeader = request.headers.get(SignatureHeaders.signatureInput);
+    const signatureHeader = request.headers.get(SignatureHeaders.signature);
     if (!inputHeader && !signatureHeader)
         return undefined;
     if (!inputHeader || !signatureHeader)
@@ -219,7 +219,7 @@ function algorithmFromKey(key) {
     for (const algorithm of Object.values(Algorithms))
         if (keySupportsAlgorithm(key, algorithm))
             return algorithm;
-    throw new TypeError('Request attestation requires an Ed25519 or RSA-PSS SHA-512 signing key.');
+    throw new TypeError('HTTP message signatures require an Ed25519 or RSA-PSS SHA-512 signing key.');
 }
 function isInteger(value) {
     return typeof value === 'number' && Number.isInteger(value);

package/dist/extensions/identity/internal/SigningContext.d.ts

@@ -0,0 +1,6 @@
+/** Creates the attempt values shared by every prover on one HTTP attempt. */
+export declare function create(): {
+    readonly created: number;
+    readonly nonce: string;
+};
+//# sourceMappingURL=SigningContext.d.ts.map

package/dist/{attestation → extensions/identity}/internal/SigningContext.js

@@ -1,11 +1,11 @@
 import { Base64 } from 'ox';
-/** Creates the signing context for one outbound HTTP request attempt. */
+/** Creates the attempt values shared by every prover on one HTTP attempt. */
 export function create() {
     const bytes = new Uint8Array(64);
     crypto.getRandomValues(bytes);
-    return Object.freeze({
+    return {
         created: Math.floor(Date.now() / 1_000),
         nonce: Base64.fromBytes(bytes, { pad: false, url: true }),
-    });
+    };
 }
 //# sourceMappingURL=SigningContext.js.map

package/dist/extensions/identity/internal/Verification.d.ts

@@ -0,0 +1,9 @@
+import type * as Identity from '../../../identity/Types.js';
+import type { VerificationResult } from './HttpMessageSignature.js';
+/** Maps a non-verified HTTP message signature result to an identity verification. */
+export declare function fromSignature(result: Exclude<VerificationResult, {
+    status: 'verified';
+}>): Exclude<Identity.Verification, {
+    status: 'valid';
+}>;
+//# sourceMappingURL=Verification.d.ts.map

package/dist/extensions/identity/internal/Verification.js

@@ -0,0 +1,10 @@
+/** Maps a non-verified HTTP message signature result to an identity verification. */
+export function fromSignature(result) {
+    if (result.status === 'absent')
+        return { status: 'missing' };
+    if (result.status === 'invalid')
+        return { status: 'invalid', reason: result.reason };
+    // The signature was presented but its key is not trusted or available.
+    return { status: 'invalid', code: 403, reason: result.reason };
+}
+//# sourceMappingURL=Verification.js.map

package/dist/{tap → extensions/identity/tap}/Constants.js

@@ -1,4 +1,4 @@
-import { Constants as HttpMessageSignature } from '../attestation/internal/HttpMessageSignature.js';
+import { Constants as HttpMessageSignature } from '../internal/HttpMessageSignature.js';
 /** TAP values required for its RFC 9421 agent-recognition signature profile. */
 export const Constants = {
     /** Stable identifier for Trusted Agent Protocol signers and replay storage. */

package/dist/extensions/identity/tap/client/index.d.ts

@@ -0,0 +1,32 @@
+import type * as Identity from '../../../../identity/Types.js';
+import { Constants } from '../Constants.js';
+/**
+ * Creates a TAP identity prover.
+ *
+ * The prover signs each in-scope attempt, including MPP payment retries, with
+ * an RFC 9421 HTTP message signature carrying TAP's `agent-browser-auth` or
+ * `agent-payer-auth` tag.
+ *
+ * @example
+ * ```ts
+ * Mppx.create({ identity: [Tap.Client.prover({ intent: 'payment', key, keyId, scope: ['https://shop.example'] })], methods })
+ * ```
+ */
+export declare function prover(config: prover.Config): Identity.Prover;
+export declare namespace prover {
+    type Config = {
+        /** TAP signature type for the request. */
+        intent: (typeof Constants.intents)[keyof typeof Constants.intents];
+        /** Ed25519 or RSA-PSS SHA-512 private key provisioned to the agent provider. */
+        key: CryptoKey;
+        /** Identifier the merchant uses to resolve the signing public key. */
+        keyId: string;
+        /** Origins that receive TAP signatures, or `'*'` for any origin. */
+        scope: Identity.Prover['scope'];
+        /** Signature lifetime in seconds. TAP permits at most eight minutes. @default 480 */
+        expiresIn?: number | undefined;
+        /** RFC 9421 dictionary label. @default 'tap' */
+        label?: string | undefined;
+    };
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/{tap → extensions/identity/tap}/client/index.js

@@ -1,14 +1,18 @@
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js';
+import * as HttpMessageSignature from '../../internal/HttpMessageSignature.js';
 import { Constants } from '../Constants.js';
 /**
- * Creates a TAP request signer.
+ * Creates a TAP identity prover.
  *
- * The signer emits RFC 9421 HTTP message signatures with TAP's
- * `agent-browser-auth` or `agent-payer-auth` tag. Pass it to
- * `Attestation.Client.wrapFetch` so MPPX signs both the initial request and
- * its automatic paid retry.
+ * The prover signs each in-scope attempt, including MPP payment retries, with
+ * an RFC 9421 HTTP message signature carrying TAP's `agent-browser-auth` or
+ * `agent-payer-auth` tag.
+ *
+ * @example
+ * ```ts
+ * Mppx.create({ identity: [Tap.Client.prover({ intent: 'payment', key, keyId, scope: ['https://shop.example'] })], methods })
+ * ```
  */
-export function signer(config) {
+export function prover(config) {
     const tag = config.intent === Constants.intents.payment ? Constants.tags.payment : Constants.tags.browse;
     const expiresIn = config.expiresIn ?? Constants.defaultSignatureLifetime;
     if (!Number.isInteger(expiresIn) ||
@@ -16,8 +20,8 @@ export function signer(config) {
         expiresIn > Constants.maximumSignatureLifetime)
         throw new RangeError(`TAP expiresIn must be an integer from 1 to ${Constants.maximumSignatureLifetime}.`);
     return {
-        protocol: Constants.protocol,
-        sign(request, context) {
+        scope: config.scope,
+        prove(request, context) {
             return HttpMessageSignature.sign(request, {
                 components: Constants.requiredComponents,
                 context,

package/dist/extensions/identity/tap/server/index.d.ts

@@ -0,0 +1,27 @@
+import type * as Identity from '../../../../identity/Types.js';
+import type * as Store from '../../../../Store.js';
+import type * as SignatureTypes from '../../Types.js';
+import type * as Types from '../Types.js';
+/**
+ * Creates a request-stage identity verifier for TAP agent-recognition signatures.
+ *
+ * TAP verifies trusted agent participation and request integrity. Consumer
+ * recognition and payment-container verification stay protocol-specific and
+ * are intentionally not inferred from this header-only verifier.
+ *
+ * @example
+ * ```ts
+ * const tap = Tap.Server.verifier({ keyResolver, nonceStore })
+ * mppx.charge({ amount: '1', identity: [tap] })
+ * ```
+ */
+export declare function verifier(config: verifier.Config): Identity.Verifier<Types.VerifiedRequest>;
+export declare namespace verifier {
+    type Config = {
+        /** Resolves a TAP-approved public key by its `keyid` and signature algorithm. */
+        keyResolver: SignatureTypes.KeyResolver;
+        /** Atomically consumes each nonce in shared storage for multi-instance deployments. */
+        nonceStore: Store.AtomicStore;
+    };
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/{tap → extensions/identity/tap}/server/index.js

@@ -1,14 +1,22 @@
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js';
+import * as HttpMessageSignature from '../../internal/HttpMessageSignature.js';
+import * as Verification from '../../internal/Verification.js';
 import { Constants } from '../Constants.js';
 /**
- * Creates a verifier for TAP agent-recognition signatures.
+ * Creates a request-stage identity verifier for TAP agent-recognition signatures.
  *
  * TAP verifies trusted agent participation and request integrity. Consumer
  * recognition and payment-container verification stay protocol-specific and
  * are intentionally not inferred from this header-only verifier.
+ *
+ * @example
+ * ```ts
+ * const tap = Tap.Server.verifier({ keyResolver, nonceStore })
+ * mppx.charge({ amount: '1', identity: [tap] })
+ * ```
  */
 export function verifier(config) {
     return {
+        stage: 'request',
         async verify(request) {
             const result = await HttpMessageSignature.verify(request, {
                 keyResolver: config.keyResolver,
@@ -19,9 +27,9 @@ export function verifier(config) {
                 tag: [Constants.tags.browse, Constants.tags.payment],
             });
             if (result.status !== 'verified')
-                return result;
+                return Verification.fromSignature(result);
             return {
-                status: 'verified',
+                status: 'valid',
                 value: {
                     keyId: result.input.keyId,
                     nonce: result.input.nonce,

package/dist/{web-bot-auth → extensions/identity/web-bot-auth}/Constants.js

@@ -1,4 +1,4 @@
-import { Constants as HttpMessageSignature } from '../attestation/internal/HttpMessageSignature.js';
+import { Constants as HttpMessageSignature } from '../internal/HttpMessageSignature.js';
 /** Web Bot Auth values for the supported HTTPS-directory signature profile. */
 export const Constants = {
     /** Stable identifier for Web Bot Auth signers and replay storage. */

package/dist/{web-bot-auth → extensions/identity/web-bot-auth}/client/index.d.ts

@@ -1,7 +1,6 @@
-import type * as AttestationTypes from '../../attestation/Types.js';
-import { Constants } from '../Constants.js';
+import type * as Identity from '../../../../identity/Types.js';
 /**
- * Creates a Web Bot Auth HTTPS-directory profile request signer.
+ * Creates a Web Bot Auth HTTPS-directory profile identity prover.
  *
  * The signed `Signature-Agent` header links the request to the HTTPS origin
  * of an HTTP Message Signatures Directory. This adapter does not support
@@ -9,13 +8,15 @@ import { Constants } from '../Constants.js';
  * establishes bot identity only; it does not assert consumer identity or
  * authority to make a payment.
  */
-export declare function signer(config: signer.Config): AttestationTypes.Signer<typeof Constants.protocol>;
-export declare namespace signer {
+export declare function prover(config: prover.Config): Identity.Prover;
+export declare namespace prover {
     type Config = {
         /** Ed25519 or RSA-PSS SHA-512 private key registered for the bot. */
         key: CryptoKey;
         /** RFC 7638 JWK thumbprint for the registered public key. */
         keyId: string;
+        /** Origins that receive Web Bot Auth signatures, or `'*'` for any origin. */
+        scope: Identity.Prover['scope'];
         /** Required HTTPS directory origin, sent with the default `directory` discovery type. */
         signatureAgent: string;
         /** Dictionary member name used for `Signature-Agent`. @default signature label */

package/dist/{web-bot-auth → extensions/identity/web-bot-auth}/client/index.js

@@ -1,10 +1,10 @@
 import { parseDictionary, serializeDictionary } from 'structured-headers';
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js';
+import * as HttpMessageSignature from '../../internal/HttpMessageSignature.js';
 import { Constants } from '../Constants.js';
 import * as JwkThumbprint from '../internal/JwkThumbprint.js';
 import * as SignatureAgent from '../internal/SignatureAgent.js';
 /**
- * Creates a Web Bot Auth HTTPS-directory profile request signer.
+ * Creates a Web Bot Auth HTTPS-directory profile identity prover.
  *
  * The signed `Signature-Agent` header links the request to the HTTPS origin
  * of an HTTP Message Signatures Directory. This adapter does not support
@@ -12,7 +12,7 @@ import * as SignatureAgent from '../internal/SignatureAgent.js';
  * establishes bot identity only; it does not assert consumer identity or
  * authority to make a payment.
  */
-export function signer(config) {
+export function prover(config) {
     const label = config.label ?? Constants.label;
     const signatureAgentKey = config.signatureAgentKey ?? label;
     const expiresIn = config.expiresIn ?? Constants.defaultSignatureLifetime;
@@ -24,8 +24,8 @@ export function signer(config) {
     if (!Number.isInteger(expiresIn) || expiresIn <= 0)
         throw new RangeError('Web Bot Auth expiresIn must be a positive integer.');
     return {
-        protocol: Constants.protocol,
-        sign(request, context) {
+        scope: config.scope,
+        prove(request, context) {
             const headers = new Headers(request.headers);
             const signatureAgents = parseSignatureAgents(headers);
             if (signatureAgents.has(signatureAgentKey))