mppx 0.15.0 → 0.17.0

package/dist/{web-bot-auth → extensions/identity/web-bot-auth}/server/index.d.ts

@@ -1,8 +1,9 @@
-import type * as Attestation from '../../attestation/Types.js';
-import type * as Store from '../../Store.js';
+import type * as Identity from '../../../../identity/Types.js';
+import type * as Store from '../../../../Store.js';
+import type * as SignatureTypes from '../../Types.js';
 import type * as Types from '../Types.js';
 /**
- * Creates a verifier for the Web Bot Auth HTTPS-directory profile.
+ * Creates a request-stage identity verifier for the Web Bot Auth HTTPS-directory profile.
  *
  * It requires an `@authority` and signed `Signature-Agent` directory member;
  * direct key configuration and other Web Bot Auth discovery types are outside
@@ -10,7 +11,7 @@ import type * as Types from '../Types.js';
  * automated HTTP client. It must not be used on its own as user or payment
  * authorization.
  */
-export declare function verifier(config: verifier.Config): Attestation.Verifier<Types.VerifiedRequest>;
+export declare function verifier(config: verifier.Config): Identity.Verifier<Types.VerifiedRequest>;
 export declare namespace verifier {
     type Config = {
         /**
@@ -21,7 +22,7 @@ export declare namespace verifier {
          * must be extractable so their RFC 7638 thumbprints can be verified.
          */
         keyResolver: (parameters: {
-            algorithm: Attestation.SignatureAlgorithm;
+            algorithm: SignatureTypes.SignatureAlgorithm;
             keyId: string;
             request: Request;
             signatureAgent: string;

package/dist/{web-bot-auth → extensions/identity/web-bot-auth}/server/index.js

@@ -1,10 +1,11 @@
 import { isInnerList, parseDictionary, Token } from 'structured-headers';
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js';
+import * as HttpMessageSignature from '../../internal/HttpMessageSignature.js';
+import * as Verification from '../../internal/Verification.js';
 import { Constants } from '../Constants.js';
 import * as JwkThumbprint from '../internal/JwkThumbprint.js';
 import * as SignatureAgent from '../internal/SignatureAgent.js';
 /**
- * Creates a verifier for the Web Bot Auth HTTPS-directory profile.
+ * Creates a request-stage identity verifier for the Web Bot Auth HTTPS-directory profile.
  *
  * It requires an `@authority` and signed `Signature-Agent` directory member;
  * direct key configuration and other Web Bot Auth discovery types are outside
@@ -17,6 +18,7 @@ export function verifier(config) {
     if (!Number.isInteger(maxAge) || maxAge <= 0)
         throw new RangeError('Web Bot Auth maxAge must be a positive integer.');
     return {
+        stage: 'request',
         async verify(request) {
             let signatureAgent;
             const result = await HttpMessageSignature.verify(request, {
@@ -73,9 +75,9 @@ export function verifier(config) {
                 },
             });
             if (result.status !== 'verified')
-                return result;
+                return Verification.fromSignature(result);
             return {
-                status: 'verified',
+                status: 'valid',
                 value: {
                     keyId: result.input.keyId,
                     nonce: result.input.nonce,

package/dist/identity/Client.d.ts

@@ -0,0 +1,34 @@
+import type * as Types from './Types.js';
+/** Sends HTTP attempts with every in-scope prover applied. */
+export type Client = {
+    /**
+     * Proves and sends one request.
+     *
+     * Requests that carry proofs do not follow redirects: a redirect rejects
+     * (`redirect: 'error'`), so proofs never reach another URL. Requests with no
+     * prover in scope are sent unchanged. If a prover asks to retry a rejected
+     * (non-402) response, the request is proved again and resent once, except for
+     * paid attempts, which are never resent.
+     */
+    send: (fetch: typeof globalThis.fetch, request: Request, context?: Types.Context) => Promise<{
+        request: Request;
+        response: Response;
+    }>;
+    /** Lets in-scope provers prepare proofs for a 402 challenge from `url` before the payment retry. */
+    challenge: (response: Response, context: Types.Context, url: string) => Promise<void>;
+};
+/**
+ * Creates the client runner for a list of provers.
+ *
+ * Provers run in list order on every attempt, sharing one attempt context.
+ * List request signers last so their signatures cover headers added by
+ * earlier provers.
+ */
+export declare function from(provers: readonly Types.Prover[]): Client;
+/**
+ * Wraps a fetch implementation so every request is proved.
+ *
+ * Prefer `Mppx.create({ identity })`, which also passes the payment challenge to provers.
+ */
+export declare function wrapFetch(fetch: typeof globalThis.fetch, client: Client, context?: Types.Context): typeof globalThis.fetch;
+//# sourceMappingURL=Client.d.ts.map

package/dist/identity/Client.js

@@ -0,0 +1,133 @@
+import * as Challenge from '../Challenge.js';
+import * as Credential from '../Credential.js';
+import * as SigningContext from './internal/SigningContext.js';
+/** x402 credential headers (v2 and v1); a request carrying one is a paid attempt. */
+const x402CredentialHeaders = ['payment-signature', 'x-payment'];
+/**
+ * Creates the client runner for a list of provers.
+ *
+ * Provers run in list order on every attempt, sharing one attempt context.
+ * List request signers last so their signatures cover headers added by
+ * earlier provers.
+ */
+export function from(provers) {
+    if (provers.length === 0)
+        throw new TypeError('Mppx client identity must configure at least one prover.');
+    // Scopes are matched exactly: a string scope would fall back to substring matching.
+    for (const prover of provers)
+        if (prover.scope !== '*' && !Array.isArray(prover.scope))
+            throw new TypeError('Identity prover scope must be "*" or an array of origins.');
+    const inScope = (url) => {
+        const origin = new URL(url).origin;
+        return provers.filter((prover) => prover.scope === '*' || prover.scope.includes(origin));
+    };
+    async function sendOnce(fetch, request, context, resendable) {
+        // Keep the original readable only when it may be resent; otherwise a clone would tee
+        // (and buffer) a streamed body that is never read again.
+        const source = resendable ? request.clone() : request;
+        const scoped = inScope(request.url);
+        if (scoped.length === 0)
+            return { request: source, response: await fetch(source) };
+        const attempt = Object.freeze({ ...context, ...SigningContext.create() });
+        let sent = new Request(source, {
+            redirect: request.redirect === 'follow' ? 'error' : request.redirect,
+        });
+        for (const prover of scoped)
+            sent = await prover.prove(sent, attempt);
+        return { request: sent, response: await fetch(sent) };
+    }
+    return {
+        async send(fetch, request, context = {}) {
+            // A paid attempt (a challenge in context, or a Payment or x402 credential the caller
+            // attached) is never resent: its credential may already have settled, and replaying it
+            // could pay again.
+            const paid = context.challenge !== undefined ||
+                x402CredentialHeaders.some((name) => request.headers.has(name)) ||
+                [...request.headers.values()].some((value) => Credential.extractPaymentScheme(value) !== null);
+            const resendable = !paid && inScope(request.url).some((prover) => prover.retry);
+            const result = await sendOnce(fetch, request, context, resendable);
+            const { response } = result;
+            if (!resendable || response.status < 400 || response.status === 402)
+                return result;
+            // Each callback reads its own copy, so the returned response stays readable.
+            const copies = [];
+            let retry = false;
+            for (const prover of inScope(request.url)) {
+                if (!prover.retry)
+                    continue;
+                const copy = response.clone();
+                copies.push(copy);
+                if (await prover.retry(copy))
+                    retry = true;
+            }
+            if (!retry) {
+                release(copies);
+                return result;
+            }
+            release([response, ...copies]);
+            return sendOnce(fetch, request, context, false);
+        },
+        async challenge(response, context, url) {
+            for (const prover of inScope(url)) {
+                if (!prover.prepare)
+                    continue;
+                const copy = response.clone();
+                try {
+                    await prover.prepare(copy, context);
+                }
+                finally {
+                    release([copy]);
+                }
+            }
+        },
+    };
+}
+/** Releases unread response copies without waiting, so they neither buffer the body nor block a resend. */
+function release(responses) {
+    for (const unread of responses)
+        if (!unread.bodyUsed)
+            void unread.body?.cancel().catch(() => { });
+}
+/**
+ * Wraps a fetch implementation so every request is proved.
+ *
+ * Prefer `Mppx.create({ identity })`, which also passes the payment challenge to provers.
+ */
+export function wrapFetch(fetch, client, context) {
+    return async (input, init) => {
+        const request = new Request(input, init);
+        // A retry may answer a refreshed challenge: bind proofs to the challenge its credential
+        // carries, and let provers prepare for a refreshed 402 of the same method and intent.
+        const challenge = credentialChallenge(request.headers) ?? context?.challenge;
+        const { response } = await client.send(fetch, request, { ...context, challenge });
+        if (response.status === 402 && challenge)
+            // A 402 without a parseable Payment challenge is returned as is: the caller decides.
+            for (const next of challengesOf(response))
+                if (next.method === challenge.method && next.intent === challenge.intent)
+                    await client.challenge(response, { ...context, challenge: next }, request.url);
+        return response;
+    };
+}
+/** Returns the Payment challenges of a 402, or none when it carries none that parse. */
+function challengesOf(response) {
+    try {
+        return Challenge.fromResponseList(response);
+    }
+    catch {
+        return [];
+    }
+}
+/** Returns the challenge of a Payment credential in `headers`, if any. */
+function credentialChallenge(headers) {
+    for (const [, value] of headers) {
+        const payment = Credential.extractPaymentScheme(value);
+        if (!payment)
+            continue;
+        try {
+            return Credential.deserialize(payment).challenge;
+        }
+        catch { }
+    }
+    return undefined;
+}
+//# sourceMappingURL=Client.js.map

package/dist/identity/Server.d.ts

@@ -0,0 +1,59 @@
+import type * as Types from './Types.js';
+/**
+ * Accepts the first of several identity protocols that verifies.
+ *
+ * Every member runs. The result is `valid` if any member verifies, `invalid` if none verifies and
+ * any member was presented but failed, and `missing` otherwise, with every
+ * member's challenge headers. All members must run at the same stage.
+ *
+ * @example
+ * ```ts
+ * mppx.charge({ amount: '1', identity: [Identity.anyOf(tap, webBotAuth)] })
+ * ```
+ */
+export declare function anyOf(...verifiers: readonly [Types.Verifier, Types.Verifier, ...Types.Verifier[]]): Types.Verifier<{
+    index: number;
+    value: unknown;
+}>;
+/** The combined outcome of a route's verifiers at one stage. @internal */
+export type Outcome = {
+    status: 'valid';
+    values: ReadonlyMap<Types.Verifier, unknown>;
+} | {
+    status: 'missing' | 'invalid';
+    code: number;
+    headers: Headers;
+    reason: string;
+};
+/**
+ * Runs every verifier at one stage and combines their outcomes.
+ *
+ * Every verifier must be valid. Any `invalid` outcome rejects with 401 unless
+ * it sets its own code; otherwise any `missing` outcome rejects with 403. The
+ * headers of every rejected outcome are merged. Each verifier runs at most once
+ * per request and context, so replay-protected nonces are consumed once even
+ * when several handlers evaluate the same request.
+ */
+export declare function verify(request: Request, verifiers: readonly Types.Verifier[], context?: Types.Context): Promise<Outcome>;
+/**
+ * Collects the challenge headers of payment-stage verifiers for one 402.
+ *
+ * Each verifier's hook runs at most once per request and nonce, so every offer
+ * in a composed 402 carries the same challenge. @internal
+ */
+export declare function challenge(request: Request, verifiers: readonly Types.Verifier[], nonce: string): Promise<Headers>;
+/**
+ * Returns the identity nonce for every 402 issued on one request.
+ *
+ * Composed routes call each offer with the same request, so all offers share it. @internal
+ */
+export declare function nonceFor(request: Request, create: () => string): string;
+/** Builds the rejection response for a failed request-stage outcome. @internal */
+export declare function toResponse(outcome: Exclude<Outcome, {
+    status: 'valid';
+}>): Response;
+/** Creates a results lookup from verified values. @internal */
+export declare function results(values?: ReadonlyMap<Types.Verifier, unknown>): Types.Results;
+/** Returns the stage a verifier runs at. @internal */
+export declare function stageOf(verifier: Types.Verifier): Types.Stage;
+//# sourceMappingURL=Server.d.ts.map

package/dist/identity/Server.js

@@ -0,0 +1,194 @@
+const members = Symbol('mppx.identity.members');
+/**
+ * Accepts the first of several identity protocols that verifies.
+ *
+ * Every member runs. The result is `valid` if any member verifies, `invalid` if none verifies and
+ * any member was presented but failed, and `missing` otherwise, with every
+ * member's challenge headers. All members must run at the same stage.
+ *
+ * @example
+ * ```ts
+ * mppx.charge({ amount: '1', identity: [Identity.anyOf(tap, webBotAuth)] })
+ * ```
+ */
+export function anyOf(...verifiers) {
+    const stage = stageOf(verifiers[0]);
+    if (verifiers.some((verifier) => stageOf(verifier) !== stage))
+        throw new TypeError('Identity anyOf verifiers must run at the same stage.');
+    const verifier = {
+        [members]: verifiers,
+        stage,
+        async verify(request, context) {
+            // Every member runs, so each presented proof's replay nonce is consumed even when an
+            // earlier member already verified; the first valid member wins.
+            const all = [];
+            for (const member of verifiers)
+                all.push(await run(member, request, context));
+            const index = all.findIndex((outcome) => outcome.status === 'valid');
+            const matched = all[index];
+            if (matched?.status === 'valid')
+                return { status: 'valid', value: { index, value: matched.value } };
+            const outcomes = all;
+            const headers = mergeHeaders(outcomes);
+            const invalid = outcomes.find((outcome) => outcome.status === 'invalid');
+            if (invalid)
+                return { status: 'invalid', code: invalid.code, headers, reason: invalid.reason };
+            // Keep the first member's custom status so wrapping a verifier does not change its HTTP behavior.
+            const code = outcomes.find((outcome) => outcome.code !== undefined)?.code;
+            return {
+                status: 'missing',
+                ...(code !== undefined && { code }),
+                headers,
+                reason: 'None of the accepted identity proofs was presented.',
+            };
+        },
+    };
+    return verifier;
+}
+/**
+ * Runs every verifier at one stage and combines their outcomes.
+ *
+ * Every verifier must be valid. Any `invalid` outcome rejects with 401 unless
+ * it sets its own code; otherwise any `missing` outcome rejects with 403. The
+ * headers of every rejected outcome are merged. Each verifier runs at most once
+ * per request and context, so replay-protected nonces are consumed once even
+ * when several handlers evaluate the same request.
+ */
+export async function verify(request, verifiers, context = {}) {
+    const values = new Map();
+    const rejected = [];
+    for (const verifier of verifiers) {
+        const outcome = await run(verifier, request, context);
+        if (outcome.status !== 'valid') {
+            rejected.push(outcome);
+            continue;
+        }
+        // Record the matched member at every anyOf level, so results.get(leaf) works when nested.
+        let current = verifier;
+        let value = outcome.value;
+        for (;;) {
+            values.set(current, value);
+            const nested = current[members];
+            if (!nested)
+                break;
+            const matched = value;
+            current = nested[matched.index];
+            value = matched.value;
+        }
+    }
+    if (rejected.length === 0)
+        return { status: 'valid', values };
+    const headers = mergeHeaders(rejected);
+    const invalid = rejected.find((outcome) => outcome.status === 'invalid');
+    if (invalid)
+        return { status: 'invalid', code: invalid.code ?? 401, headers, reason: invalid.reason };
+    const missing = rejected[0];
+    return {
+        status: 'missing',
+        code: missing.code ?? 403,
+        headers,
+        reason: missing.reason ?? 'Identity verification is required.',
+    };
+}
+/**
+ * Collects the challenge headers of payment-stage verifiers for one 402.
+ *
+ * Each verifier's hook runs at most once per request and nonce, so every offer
+ * in a composed 402 carries the same challenge. @internal
+ */
+export async function challenge(request, verifiers, nonce) {
+    const headers = new Headers();
+    for (const verifier of verifiers) {
+        for (const member of leaves(verifier)) {
+            if (!member.challenge)
+                continue;
+            let byVerifier = challenges.get(request);
+            if (!byVerifier)
+                challenges.set(request, (byVerifier = new Map()));
+            let byNonce = byVerifier.get(member);
+            if (!byNonce)
+                byVerifier.set(member, (byNonce = new Map()));
+            let result = byNonce.get(nonce);
+            if (!result) {
+                result = Promise.resolve(member.challenge(request, { nonce }));
+                byNonce.set(nonce, result);
+            }
+            const init = await result;
+            if (init)
+                for (const [name, value] of new Headers(init))
+                    headers.append(name, value);
+        }
+    }
+    return headers;
+}
+/**
+ * Returns the identity nonce for every 402 issued on one request.
+ *
+ * Composed routes call each offer with the same request, so all offers share it. @internal
+ */
+export function nonceFor(request, create) {
+    let nonce = nonces.get(request);
+    if (!nonce)
+        nonces.set(request, (nonce = create()));
+    return nonce;
+}
+/** Builds the rejection response for a failed request-stage outcome. @internal */
+export function toResponse(outcome) {
+    const headers = new Headers(outcome.headers);
+    headers.set('Cache-Control', 'no-store');
+    return new Response(outcome.reason, { headers, status: outcome.code });
+}
+/** Creates a results lookup from verified values. @internal */
+export function results(values = new Map()) {
+    return Object.freeze({
+        get(verifier) {
+            return values.get(verifier);
+        },
+    });
+}
+/** Returns the stage a verifier runs at. @internal */
+export function stageOf(verifier) {
+    const stage = verifier.stage ?? 'request';
+    // An unknown stage would leave the verifier unchecked, so it is rejected (fail closed).
+    if (stage !== 'request' && stage !== 'payment')
+        throw new TypeError(`Unknown identity verifier stage "${String(stage)}".`);
+    return stage;
+}
+/** Returns a verifier and, through `anyOf`, every member it wraps. */
+function leaves(verifier) {
+    const nested = verifier[members];
+    return nested ? nested.flatMap(leaves) : [verifier];
+}
+const nonces = new WeakMap();
+const challenges = new WeakMap();
+const cache = new WeakMap();
+function run(verifier, request, context) {
+    let byVerifier = cache.get(request);
+    if (!byVerifier)
+        cache.set(request, (byVerifier = new Map()));
+    let byContext = byVerifier.get(verifier);
+    if (!byContext)
+        byVerifier.set(verifier, (byContext = new Map()));
+    // Decisions can depend on the credential, so each credential object gets its own entry.
+    const key = `${context.challenge?.id ?? ''}|${context.nonce ?? ''}`;
+    let byCredential = byContext.get(key);
+    if (!byCredential)
+        byContext.set(key, (byCredential = new Map()));
+    let outcome = byCredential.get(context.credential);
+    if (!outcome) {
+        outcome = Promise.resolve(verifier.verify(request, context));
+        byCredential.set(context.credential, outcome);
+    }
+    return outcome;
+}
+function mergeHeaders(outcomes) {
+    const merged = new Headers();
+    for (const outcome of outcomes) {
+        if (outcome.status === 'valid' || !outcome.headers)
+            continue;
+        for (const [name, value] of new Headers(outcome.headers))
+            merged.append(name, value);
+    }
+    return merged;
+}
+//# sourceMappingURL=Server.js.map

package/dist/identity/Types.d.ts

@@ -0,0 +1,112 @@
+import type * as Challenge from '../Challenge.js';
+import type * as Credential from '../Credential.js';
+import type { MaybePromise } from '../internal/types.js';
+/**
+ * When a verifier runs on the server.
+ *
+ * `request` verifiers run before any payment challenge is issued and reject
+ * the request with their own status code. `payment` verifiers add their own
+ * challenge headers to the 402 (through `challenge`) and run on the paid
+ * retry, before the credential is settled.
+ */
+export type Stage = 'request' | 'payment';
+/**
+ * Payment state passed to verifiers and provers.
+ *
+ * Request-stage verifiers receive an empty context. Payment-stage verifiers
+ * receive the answered challenge, its credential and the 402's identity nonce.
+ */
+export type Context = {
+    /** The MPP challenge being answered (or, for provers, selected). */
+    challenge?: Challenge.Challenge | undefined;
+    /** The payment credential submitted with the request. */
+    credential?: Credential.Credential | undefined;
+    /**
+     * The identity nonce of the 402 being answered.
+     *
+     * Every payment offer in one 402 carries the same HMAC-bound nonce, so a proof
+     * bound to it is bound to that 402 whichever offer the client pays.
+     */
+    nonce?: string | undefined;
+};
+/** Context passed to a payment-stage verifier's `challenge` hook. */
+export type ChallengeContext = {
+    /** The identity nonce shared by every payment offer in the 402. Bind the proof request to it. */
+    nonce: string;
+};
+/**
+ * The outcome of one identity verifier.
+ *
+ * `missing` means the identity proof was not presented; its `headers` (for
+ * example a protocol challenge) are returned to the client. `invalid` means a
+ * proof was presented but must be rejected. `valid` carries the verified value.
+ */
+export type Verification<value = unknown> = {
+    status: 'missing';
+    /** HTTP status for a request-stage rejection. @default 403 */
+    code?: number | undefined;
+    /** Headers returned to the client, such as a protocol challenge. */
+    headers?: HeadersInit | undefined;
+    /** Human-readable reason. */
+    reason?: string | undefined;
+} | {
+    status: 'invalid';
+    /** HTTP status for a request-stage rejection. @default 401 */
+    code?: number | undefined;
+    /** Headers returned to the client, such as a protocol error object. */
+    headers?: HeadersInit | undefined;
+    /** Human-readable reason. */
+    reason: string;
+} | {
+    status: 'valid';
+    value: value;
+};
+/** Verifies one identity protocol on the server. */
+export type Verifier<value = unknown> = {
+    /** When the verifier runs. @default 'request' */
+    stage?: Stage | undefined;
+    /**
+     * Returns the protocol's challenge headers to add to a 402, such as a proof request.
+     *
+     * Payment stage only. Runs once per 402, however many payment offers it carries.
+     */
+    challenge?: ((request: Request, context: ChallengeContext) => MaybePromise<HeadersInit | undefined>) | undefined;
+    /** Returns the protocol's verification outcome for the request. */
+    verify: (request: Request, context: Context) => MaybePromise<Verification<value>>;
+};
+/** Verified identity values, looked up by the verifier that produced them. */
+export type Results = {
+    /** Returns the verified value for a verifier, or `undefined` if it did not run or match. */
+    get<value>(verifier: Verifier<value>): value | undefined;
+};
+/**
+ * Values shared by every prover contributing to one HTTP attempt.
+ *
+ * Every retry gets a new context, so single-use nonces are never replayed.
+ */
+export type ProveContext = Context & {
+    /** Unix timestamp, in seconds, at which the attempt was created. */
+    readonly created: number;
+    /** Base64url-encoded random value identifying the attempt. */
+    readonly nonce: string;
+};
+/** Adds one identity protocol to outbound requests on the client. */
+export type Prover = {
+    /** Origins the prover may run for, such as `['https://shop.example']`, or `'*'` for any origin. */
+    scope: readonly string[] | '*';
+    /** Returns a new request carrying the protocol's identity material. */
+    prove: (request: Request, context: ProveContext) => MaybePromise<Request>;
+    /**
+     * Prepares a proof from a 402 before the payment retry, such as answering its proof request.
+     *
+     * The context carries the selected challenge; `prove` receives the same challenge
+     * on the paid retry.
+     */
+    prepare?: ((response: Response, context: Context) => MaybePromise<void>) | undefined;
+    /**
+     * Inspects a rejected (non-402) response. Return `true` to prove and resend the
+     * request once. Paid attempts are never resent.
+     */
+    retry?: ((response: Response) => MaybePromise<boolean | undefined>) | undefined;
+};
+//# sourceMappingURL=Types.d.ts.map

package/dist/identity/Types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Types.js.map

package/dist/{attestation → identity}/index.d.ts

@@ -1,6 +1,6 @@
 export * as Client from './Client.js';
 export * as Server from './Server.js';
+export { anyOf } from './Server.js';
 export * as Store from '../Store.js';
-export * from './Constants.js';
-export * from './Types.js';
+export type * from './Types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/{attestation → identity}/index.js

@@ -1,6 +1,5 @@
 export * as Client from './Client.js';
 export * as Server from './Server.js';
+export { anyOf } from './Server.js';
 export * as Store from '../Store.js';
-export * from './Constants.js';
-export * from './Types.js';
 //# sourceMappingURL=index.js.map

package/dist/identity/internal/SigningContext.d.ts

@@ -0,0 +1,6 @@
+/** Creates the attempt values shared by every prover on one HTTP attempt. */
+export declare function create(): {
+    readonly created: number;
+    readonly nonce: string;
+};
+//# sourceMappingURL=SigningContext.d.ts.map

package/dist/identity/internal/SigningContext.js

@@ -0,0 +1,11 @@
+import { Base64 } from 'ox';
+/** Creates the attempt values shared by every prover on one HTTP attempt. */
+export function create() {
+    const bytes = new Uint8Array(64);
+    crypto.getRandomValues(bytes);
+    return {
+        created: Math.floor(Date.now() / 1_000),
+        nonce: Base64.fromBytes(bytes, { pad: false, url: true }),
+    };
+}
+//# sourceMappingURL=SigningContext.js.map

package/dist/integrations/x402/Evm.d.ts

@@ -21,6 +21,7 @@ export declare function createHandler(parameters: {
     } | {
         status: 200;
         challenge?: import("../../Challenge.js").Challenge | undefined;
+        identity?: import("../../identity/Types.js").Results | undefined;
         withReceipt: import("../../server/Transport.js").WithReceipt<import("../../server/Transport.js").Http>;
     };
     skipHandlerResponse: Response | undefined;

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.15.0";
+export declare const version = "0.17.0";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.15.0";
+export declare const sdkIdentifier = "mppx/0.17.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.15.0';
+export const version = '0.17.0';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map