mppx 0.6.27 → 0.6.29

package/dist/evm/server/Charge.js

@@ -0,0 +1,172 @@
+import { getAddress, recoverTypedDataAddress } from 'viem';
+import { VerificationFailedError } from '../../Errors.js';
+import * as Method from '../../Method.js';
+import * as Receipt from '../../Receipt.js';
+import * as ServerTransport from '../../server/Transport.js';
+import * as X402 from '../../x402/server/EvmCharge.js';
+import * as Assets from '../Assets.js';
+import * as Methods from '../Methods.js';
+import * as Types from '../Types.js';
+export function charge(parameters) {
+    const config = resolveConfig(parameters);
+    const paths = createPaths(config);
+    const transport = httpTransport(paths);
+    return Method.toServer(Methods.charge, {
+        defaults: {
+            chainId: config.chainId,
+            currency: config.currency,
+            credentialTypes: ['authorization'],
+            decimals: config.decimals,
+            recipient: config.recipient,
+        },
+        transport,
+        async verify({ credential }) {
+            const payload = credential.payload;
+            const request = credential.challenge.request;
+            const chainId = request.methodDetails.chainId;
+            const isX402Credential = X402.isCredential(credential);
+            if (!request.methodDetails.credentialTypes?.includes('authorization')) {
+                throw new VerificationFailedError({
+                    reason: 'EVM authorization credentials are not supported for this challenge',
+                });
+            }
+            if (request.methodDetails.splits?.length) {
+                throw new VerificationFailedError({
+                    reason: 'EVM authorization credentials do not support splits',
+                });
+            }
+            assertAddressEqual(payload.to, request.recipient, 'EVM authorization recipient mismatch');
+            if (payload.value !== request.amount)
+                throw new VerificationFailedError({ reason: 'EVM authorization amount mismatch' });
+            if (!isX402Credential && payload.nonce !== Types.challengeHash(credential.challenge))
+                throw new VerificationFailedError({ reason: 'EVM authorization challenge hash mismatch' });
+            const now = BigInt(Math.floor(Date.now() / 1000));
+            if (BigInt(payload.validAfter) > now)
+                throw new VerificationFailedError({ reason: 'EVM authorization is not valid yet' });
+            if (BigInt(payload.validBefore) <= now)
+                throw new VerificationFailedError({ reason: 'EVM authorization has expired' });
+            const signer = await recoverTypedDataAddress({
+                domain: Types.authorizationDomain({
+                    authorization: config.authorization,
+                    chainId,
+                    currency: request.currency,
+                }),
+                message: {
+                    from: getAddress(payload.from),
+                    nonce: payload.nonce,
+                    to: getAddress(payload.to),
+                    validAfter: BigInt(payload.validAfter),
+                    validBefore: BigInt(payload.validBefore),
+                    value: BigInt(payload.value),
+                },
+                primaryType: 'TransferWithAuthorization',
+                signature: payload.signature,
+                types: Types.authorizationTypes,
+            });
+            assertAddressEqual(signer, payload.from, 'EVM authorization signature mismatch');
+            const source = Types.toSource({ address: getAddress(payload.from), chainId });
+            if (credential.source && credential.source !== source) {
+                throw new VerificationFailedError({ reason: 'EVM authorization source mismatch' });
+            }
+            const settled = await config.settle({
+                credential,
+                payload,
+                request,
+                source,
+            });
+            return Receipt.from({
+                method: Types.paymentMethod,
+                reference: settled.reference,
+                status: 'success',
+                timestamp: settled.timestamp ?? new Date().toISOString(),
+            });
+        },
+    });
+}
+function resolveConfig(config) {
+    const { currency, recipient } = config;
+    let address;
+    let authorization = config.authorization;
+    let chainId = config.chainId;
+    let decimals = config.decimals;
+    if (Assets.isAsset(currency)) {
+        address = currency.address;
+        chainId ??= Number(currency.network.slice('eip155:'.length));
+        decimals ??= currency.decimals;
+        if (currency.transfer.type === Types.eip3009) {
+            authorization ??= {
+                name: currency.transfer.name,
+                version: currency.transfer.version,
+            };
+        }
+    }
+    else {
+        address = currency;
+    }
+    if (!authorization)
+        throw new Error('EVM authorization requires `authorization` metadata.');
+    if (chainId === undefined)
+        throw new Error('EVM authorization requires `chainId`.');
+    if (decimals === undefined)
+        throw new Error('EVM authorization requires `decimals`.');
+    const x402 = X402.resolveOptions({
+        authorization,
+        options: config.x402,
+    });
+    const settle = config.settle ?? (x402?.facilitator ? X402.settleWithFacilitator(x402) : undefined);
+    if (!settle)
+        throw new Error('EVM authorization requires `settle` or `x402.facilitator`.');
+    return {
+        authorization,
+        chainId,
+        currency: getAddress(address),
+        decimals,
+        recipient: getAddress(recipient),
+        settle,
+        x402,
+    };
+}
+function createPaths(config) {
+    return {
+        mpp: createMppPath(),
+        x402: X402.createPath(config.x402),
+    };
+}
+function createMppPath() {
+    const transport = ServerTransport.http();
+    return {
+        bindCredential: (options) => transport.bindCredential?.(options) ?? options.credential,
+        captureRequest: transport.captureRequest,
+        getCredential: transport.getCredential,
+        respondChallenge: (options) => transport.respondChallenge(options),
+        respondReceipt: (options, response) => transport.respondReceipt({ ...options, response }),
+    };
+}
+function httpTransport(paths) {
+    return ServerTransport.from({
+        name: 'evm-http',
+        captureRequest: paths.mpp.captureRequest,
+        getCredential(input) {
+            return paths.mpp.getCredential(input) ?? paths.x402.getCredential(input);
+        },
+        bindCredential(options) {
+            if (X402.isPendingCredential(options.credential))
+                return paths.x402.bindCredential(options);
+            return paths.mpp.bindCredential?.(options) ?? options.credential;
+        },
+        async respondChallenge(options) {
+            const response = await paths.mpp.respondChallenge(options);
+            return paths.x402.respondChallenge(options, response);
+        },
+        respondReceipt(options) {
+            const response = paths.mpp.respondReceipt(options, options.response);
+            return paths.x402.respondReceipt(options, response);
+        },
+    });
+}
+function assertAddressEqual(actual, expected, reason) {
+    if (getAddress(actual) === getAddress(expected))
+        return;
+    throw new VerificationFailedError({ reason });
+}
+//# sourceMappingURL=Charge.js.map

package/dist/evm/server/Charge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Charge.js","sourceRoot":"","sources":["../../../src/evm/server/Charge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,MAAM,CAAA;AAG1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AACzD,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,eAAe,MAAM,2BAA2B,CAAA;AAC5D,OAAO,KAAK,IAAI,MAAM,gCAAgC,CAAA;AACtD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AACxC,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAUpC,MAAM,UAAU,MAAM,CAAC,UAA+B;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IAEtC,OAAO,MAAM,CAAC,QAAQ,CAA2D,OAAO,CAAC,MAAM,EAAE;QAC/F,QAAQ,EAAE;YACR,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,eAAe,EAAE,CAAC,eAAe,CAAC;YAClC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B;QACD,SAAS;QACT,KAAK,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE;YACzB,MAAM,OAAO,GAAG,UAAU,CAAC,OAAqC,CAAA;YAChE,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,OAA8B,CAAA;YACnE,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAA;YAC7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAA;YAEtD,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,eAAe,EAAE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,uBAAuB,CAAC;oBAChC,MAAM,EAAE,oEAAoE;iBAC7E,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBACzC,MAAM,IAAI,uBAAuB,CAAC;oBAChC,MAAM,EAAE,qDAAqD;iBAC9D,CAAC,CAAA;YACJ,CAAC;YAED,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,EAAE,sCAAsC,CAAC,CAAA;YACzF,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM;gBAClC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAA;YACpF,IAAI,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;gBAClF,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAA;YAC5F,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAA;YACjD,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG;gBAClC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAA;YACrF,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,GAAG;gBACpC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC,CAAA;YAEhF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBAC3C,MAAM,EAAE,KAAK,CAAC,mBAAmB,CAAC;oBAChC,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,OAAO;oBACP,QAAQ,EAAE,OAAO,CAAC,QAAyB;iBAC5C,CAAC;gBACF,OAAO,EAAE;oBACP,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAsB;oBACrC,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;oBACtC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;oBACxC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;iBAC7B;gBACD,WAAW,EAAE,2BAA2B;gBACxC,SAAS,EAAE,OAAO,CAAC,SAA0B;gBAC7C,KAAK,EAAE,KAAK,CAAC,kBAAkB;aAChC,CAAC,CAAA;YACF,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,sCAAsC,CAAC,CAAA;YAEhF,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,UAAU,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtD,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAA;YACpF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBAClC,UAAU;gBACV,OAAO;gBACP,OAAO;gBACP,MAAM;aACP,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,IAAI,CAAC;gBAClB,MAAM,EAAE,KAAK,CAAC,aAAa;gBAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACzD,CAAC,CAAA;QACJ,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAwFD,SAAS,aAAa,CAAC,MAA2B;IAChD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;IACtC,IAAI,OAAsB,CAAA;IAC1B,IAAI,aAAa,GAAG,MAAM,CAAC,aAAa,CAAA;IACxC,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC5B,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAE9B,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;QAC1B,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,QAAQ,KAAK,QAAQ,CAAC,QAAQ,CAAA;QAC9B,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7C,aAAa,KAAK;gBAChB,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAC5B,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;aACnC,CAAA;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,QAAQ,CAAA;IACpB,CAAC;IAED,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IAC3F,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;IACnF,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAErF,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/B,aAAa;QACb,OAAO,EAAE,MAAM,CAAC,IAAI;KACrB,CAAC,CAAA;IACF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAE1F,OAAO;QACL,aAAa;QACb,OAAO;QACP,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC;QAC7B,QAAQ;QACR,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC;QAChC,MAAM;QACN,IAAI;KACL,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,MAAsB;IACzC,OAAO;QACL,GAAG,EAAE,aAAa,EAAE;QACpB,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;KACnC,CAAA;AACH,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO;QACL,cAAc,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU;QACtF,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,gBAAgB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAClE,cAAc,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,CAAC;KAC1F,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAgB;IACrC,OAAO,eAAe,CAAC,IAAI,CAAoB;QAC7C,IAAI,EAAE,UAAU;QAEhB,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc;QAExC,aAAa,CAAC,KAAK;YACjB,OAAO,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;QAC1E,CAAC;QAED,cAAc,CAAC,OAAO;YACpB,IAAI,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;YAC3F,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,UAAU,CAAA;QAClE,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,OAAO;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAA;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACvD,CAAC;QAED,cAAc,CAAC,OAAO;YACpB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAA;YACpE,OAAO,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACrD,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,QAAgB,EAAE,MAAc;IAC1E,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAM;IACvD,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/C,CAAC"}

package/dist/evm/server/Methods.d.ts

@@ -0,0 +1,80 @@
+import type { NoExtraKeys } from '../../internal/types.js';
+import * as Assets from '../Assets.js';
+import * as Chains from '../Chains.js';
+import { charge as charge_ } from './Charge.js';
+/** Creates EVM server methods from shared charge parameters. */
+export declare function evm<const parameters extends evm.Parameters>(parameters: NoExtraKeys<parameters, evm.Parameters>): readonly [import("../../Method.js").Server<{
+    readonly name: "evm";
+    readonly intent: "charge";
+    readonly schema: {
+        readonly credential: {
+            readonly payload: import("zod/mini").ZodMiniObject<{
+                from: import("zod/mini").ZodMiniString<string>;
+                nonce: import("zod/mini").ZodMiniString<string>;
+                signature: import("zod/mini").ZodMiniString<string>;
+                to: import("zod/mini").ZodMiniString<string>;
+                type: import("zod/mini").ZodMiniLiteral<"authorization">;
+                validAfter: import("zod/mini").ZodMiniString<string>;
+                validBefore: import("zod/mini").ZodMiniString<string>;
+                value: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>;
+        };
+        readonly request: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniObject<{
+            amount: import("zod/mini").ZodMiniString<string>;
+            chainId: import("zod/mini").ZodMiniNumber<number>;
+            currency: import("zod/mini").ZodMiniString<string>;
+            credentialTypes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniEnum<{
+                authorization: "authorization";
+            }>>>;
+            decimals: import("zod/mini").ZodMiniNumber<number>;
+            description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            externalId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            permit2Address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            recipient: import("zod/mini").ZodMiniString<string>;
+            splits: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+                amount: import("zod/mini").ZodMiniString<string>;
+                recipient: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>>>;
+        }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniTransform<{
+            amount: string;
+            currency: `0x${string}`;
+            methodDetails: {
+                splits?: {
+                    amount: string;
+                    recipient: string;
+                }[] | undefined;
+                permit2Address?: `0x${string}` | undefined;
+                chainId: number;
+                credentialTypes: string[];
+                decimals: number;
+            };
+            recipient: `0x${string}`;
+            description?: string | undefined;
+            externalId?: string | undefined;
+        }, {
+            amount: string;
+            chainId: number;
+            currency: string;
+            decimals: number;
+            recipient: string;
+            credentialTypes?: "authorization"[] | undefined;
+            description?: string | undefined;
+            externalId?: string | undefined;
+            permit2Address?: string | undefined;
+            splits?: {
+                amount: string;
+                recipient: string;
+            }[] | undefined;
+        }>>;
+    };
+}, charge_.Defaults, undefined, {}>];
+export declare namespace evm {
+    type Parameters = charge_.Parameters;
+    /** Creates an EVM `charge` server method. */
+    const charge: typeof charge_;
+    /** Known EVM asset metadata for public config. */
+    const assets: typeof Assets;
+    /** Common EVM chain IDs for public config. */
+    const chains: typeof Chains;
+}
+//# sourceMappingURL=Methods.d.ts.map

package/dist/evm/server/Methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Methods.d.ts","sourceRoot":"","sources":["../../../src/evm/server/Methods.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,aAAa,CAAA;AAE/C,gEAAgE;AAChE,wBAAgB,GAAG,CAAC,KAAK,CAAC,UAAU,SAAS,GAAG,CAAC,UAAU,EACzD,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qCAGpD;AAED,yBAAiB,GAAG,CAAC;IACnB,KAAY,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IAE3C,6CAA6C;IACtC,MAAM,MAAM,gBAAU,CAAA;IAC7B,kDAAkD;IAC3C,MAAM,MAAM,eAAS,CAAA;IAC5B,8CAA8C;IACvC,MAAM,MAAM,eAAS,CAAA;CAC7B"}

package/dist/evm/server/Methods.js

@@ -0,0 +1,16 @@
+import * as Assets from '../Assets.js';
+import * as Chains from '../Chains.js';
+import { charge as charge_ } from './Charge.js';
+/** Creates EVM server methods from shared charge parameters. */
+export function evm(parameters) {
+    return [evm.charge(parameters)];
+}
+(function (evm) {
+    /** Creates an EVM `charge` server method. */
+    evm.charge = charge_;
+    /** Known EVM asset metadata for public config. */
+    evm.assets = Assets;
+    /** Common EVM chain IDs for public config. */
+    evm.chains = Chains;
+})(evm || (evm = {}));
+//# sourceMappingURL=Methods.js.map

package/dist/evm/server/Methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Methods.js","sourceRoot":"","sources":["../../../src/evm/server/Methods.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,MAAM,aAAa,CAAA;AAE/C,gEAAgE;AAChE,MAAM,UAAU,GAAG,CACjB,UAAmD;IAEnD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAU,CAAA;AAC1C,CAAC;AAED,WAAiB,GAAG;IAGlB,6CAA6C;IAChC,UAAM,GAAG,OAAO,CAAA;IAC7B,kDAAkD;IACrC,UAAM,GAAG,MAAM,CAAA;IAC5B,8CAA8C;IACjC,UAAM,GAAG,MAAM,CAAA;AAC9B,CAAC,EATgB,GAAG,KAAH,GAAG,QASnB"}

package/dist/evm/server/index.d.ts

@@ -0,0 +1,6 @@
+export * as assets from '../Assets.js';
+export * as Chains from '../Chains.js';
+export * as chains from '../Chains.js';
+export { charge } from './Charge.js';
+export { evm } from './Methods.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/evm/server/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/evm/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA"}

package/dist/evm/server/index.js

@@ -0,0 +1,6 @@
+export * as assets from '../Assets.js';
+export * as Chains from '../Chains.js';
+export * as chains from '../Chains.js';
+export { charge } from './Charge.js';
+export { evm } from './Methods.js';
+//# sourceMappingURL=index.js.map

package/dist/evm/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/evm/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA"}

package/dist/index.d.ts

@@ -3,10 +3,12 @@ export * as Challenge from './Challenge.js';
 export * as Credential from './Credential.js';
 export * as Errors from './Errors.js';
 export * as Expires from './Expires.js';
+export * as evm from './evm/index.js';
 export * as Mcp from './Mcp.js';
 export * as Method from './Method.js';
 export * as PaymentRequest from './PaymentRequest.js';
 export * as Receipt from './Receipt.js';
 export * as Store from './Store.js';
+export * as x402 from './x402/index.js';
 export * as z from './zod.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,IAAI,MAAM,iBAAiB,CAAA;AACvC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA"}

package/dist/index.js

@@ -3,10 +3,12 @@ export * as Challenge from './Challenge.js';
 export * as Credential from './Credential.js';
 export * as Errors from './Errors.js';
 export * as Expires from './Expires.js';
+export * as evm from './evm/index.js';
 export * as Mcp from './Mcp.js';
 export * as Method from './Method.js';
 export * as PaymentRequest from './PaymentRequest.js';
 export * as Receipt from './Receipt.js';
 export * as Store from './Store.js';
+export * as x402 from './x402/index.js';
 export * as z from './zod.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAA;AACrC,OAAO,KAAK,GAAG,MAAM,UAAU,CAAA;AAC/B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AACrD,OAAO,KAAK,OAAO,MAAM,cAAc,CAAA;AACvC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,IAAI,MAAM,iBAAiB,CAAA;AACvC,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA"}

package/dist/internal/HeaderCodec.d.ts

@@ -0,0 +1,18 @@
+import type * as z from '../zod.js';
+/**
+ * Creates a typed codec for JSON HTTP header values.
+ *
+ * x402 uses plain base64 JSON header bodies, while the Payment auth scheme uses
+ * its own base64url/JCS serializers. Keep this helper internal so transports
+ * can opt into the exact wire encoding their protocol expects.
+ */
+export declare function createJson<const schema extends z.ZodMiniType>(schema: schema): {
+    encode(value: z.core.output<schema>): string;
+    decode(value: string): z.core.output<schema>;
+};
+/** Error thrown when a JSON header value is not valid base64-encoded JSON. */
+export declare class InvalidJsonHeaderError extends Error {
+    readonly name = "InvalidJsonHeaderError";
+    constructor();
+}
+//# sourceMappingURL=HeaderCodec.d.ts.map

package/dist/internal/HeaderCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HeaderCodec.d.ts","sourceRoot":"","sources":["../../src/internal/HeaderCodec.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,CAAC,MAAM,WAAW,CAAA;AAEnC;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM;0CAInD,MAAM;kBAGd,MAAM;EAQvB;AAED,8EAA8E;AAC9E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,SAAkB,IAAI,4BAA2B;;CAKlD"}

package/dist/internal/HeaderCodec.js

@@ -0,0 +1,31 @@
+import { Base64 } from 'ox';
+/**
+ * Creates a typed codec for JSON HTTP header values.
+ *
+ * x402 uses plain base64 JSON header bodies, while the Payment auth scheme uses
+ * its own base64url/JCS serializers. Keep this helper internal so transports
+ * can opt into the exact wire encoding their protocol expects.
+ */
+export function createJson(schema) {
+    return {
+        encode(value) {
+            return Base64.fromString(JSON.stringify(schema.parse(value)));
+        },
+        decode(value) {
+            try {
+                return schema.parse(JSON.parse(Base64.toString(value)));
+            }
+            catch {
+                throw new InvalidJsonHeaderError();
+            }
+        },
+    };
+}
+/** Error thrown when a JSON header value is not valid base64-encoded JSON. */
+export class InvalidJsonHeaderError extends Error {
+    name = 'InvalidJsonHeaderError';
+    constructor() {
+        super('Invalid base64 JSON header.');
+    }
+}
+//# sourceMappingURL=HeaderCodec.js.map

package/dist/internal/HeaderCodec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HeaderCodec.js","sourceRoot":"","sources":["../../src/internal/HeaderCodec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAI3B;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAqC,MAAc;IAG3E,OAAO;QACL,MAAM,CAAC,KAAY;YACjB,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC/D,CAAC;QACD,MAAM,CAAC,KAAa;YAClB,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAU,CAAA;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,sBAAsB,EAAE,CAAA;YACpC,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC7B,IAAI,GAAG,wBAAwB,CAAA;IAEjD;QACE,KAAK,CAAC,6BAA6B,CAAC,CAAA;IACtC,CAAC;CACF"}

package/dist/middlewares/elysia.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"elysia.d.ts","sourceRoot":"","sources":["../../src/middlewares/elysia.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAY,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAEpC,KAAK,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;AAErE,yBAAiB,IAAI,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC,OAAO,EAC5D,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GACvC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAEzD;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,aAAa,CAAC,WAAW,EACpE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,GAAG,GAAG,OAAO,GAAG,KAAK,GACxE,UAAU,CAUZ;AAaD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;CACvB,CAAA;AAID;;GAEG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE;IAAE,OAAO,EAAE,SAAS,aAAa,CAAC,SAAS,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACpE,MAAM,GAAE,eAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmB7B"}
+{"version":3,"file":"elysia.d.ts","sourceRoot":"","sources":["../../src/middlewares/elysia.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAY,KAAK,cAAc,EAAE,KAAK,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAEpC,KAAK,UAAU,GAAG,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAA;AAErE,yBAAiB,IAAI,CAAC;IACpB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAgB,MAAM,CAAC,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC,OAAO,EAC5D,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GACvC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAEzD;CACF;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,OAAO,CAAC,KAAK,CAAC,MAAM,SAAS,aAAa,CAAC,WAAW,EACpE,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,EAAE,MAAM,OAAO,KAAK,GAAG,GAAG,OAAO,GAAG,KAAK,GACxE,UAAU,CASZ;AAaD,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,GAAG;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,WAAW,EAAE,CAAA;CACvB,CAAA;AAID;;GAEG;AACH,wBAAgB,SAAS,CACvB,IAAI,EAAE;IAAE,OAAO,EAAE,SAAS,aAAa,CAAC,SAAS,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EACpE,MAAM,GAAE,eAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmB7B"}

package/dist/middlewares/elysia.js

@@ -60,9 +60,8 @@ export function payment(intent, options) {
         if (managementResponse)
             return managementResponse;
         const receipt = result.withReceipt(new Response());
-        const header = receipt.headers.get('Payment-Receipt');
-        if (header)
-            set.headers['Payment-Receipt'] = header;
+        for (const [key, value] of receipt.headers)
+            set.headers[key] = value;
     };
 }
 function getManagementResponse(result) {

package/dist/middlewares/elysia.js.map

@@ -1 +1 @@
-{"version":3,"file":"elysia.js","sourceRoot":"","sources":["../../src/middlewares/elysia.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAyC,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAIpC,MAAM,KAAW,IAAI,CA2BpB;AA3BD,WAAiB,IAAI;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAgB,MAAM,CACpB,MAAwC;QAExC,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAJe,WAAM,SAIrB,CAAA;AACH,CAAC,EA3BgB,IAAI,KAAJ,IAAI,QA2BpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,OAAyE;IAEzE,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACxD,IAAI,kBAAkB;YAAE,OAAO,kBAAkB,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QACrD,IAAI,MAAM;YAAE,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAA;IACrD,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0D;IACvF,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,EAAE,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAOD,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEnE;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,IAAoE,EACpE,SAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,IAAI,eAAe,CAAA;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CACH,CAAA;IAED,OAAO,IAAI,MAAM,EAAE,CAAC,GAAG,CACrB,SAAS,EACT,GAAG,EAAE,CACH,IAAI,QAAQ,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE;KACrE,CAAC,CACL,CAAA;AACH,CAAC"}
+{"version":3,"file":"elysia.js","sourceRoot":"","sources":["../../src/middlewares/elysia.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAgB,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAyC,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAIpC,MAAM,KAAW,IAAI,CA2BpB;AA3BD,WAAiB,IAAI;IACnB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,SAAgB,MAAM,CACpB,MAAwC;QAExC,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAJe,WAAM,SAIrB,CAAA;AACH,CAAC,EA3BgB,IAAI,KAAJ,IAAI,QA2BpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,OAAyE;IAEzE,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAC,SAAS,CAAA;QAClD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAA;QACxD,IAAI,kBAAkB;YAAE,OAAO,kBAAkB,CAAA;QACjD,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAA;QAClD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO;YAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IACtE,CAAC,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,MAA0D;IACvF,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,WAAW,EAAE,CAAA;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS,CAAC,6BAA6B,CAAC,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAOD,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEnE;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,IAAoE,EACpE,SAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,IAAI,eAAe,CAAA;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CACH,CAAA;IAED,OAAO,IAAI,MAAM,EAAE,CAAC,GAAG,CACrB,SAAS,EACT,GAAG,EAAE,CACH,IAAI,QAAQ,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE;KACrE,CAAC,CACL,CAAA;AACH,CAAC"}

package/dist/middlewares/express.js

@@ -85,7 +85,8 @@ export function payment(intent, options) {
         const originalJson = res.json.bind(res);
         res.json = (body) => {
             const wrapped = result.withReceipt(Response.json(body));
-            res.setHeader('Payment-Receipt', wrapped.headers.get('Payment-Receipt'));
+            for (const [key, value] of wrapped.headers)
+                res.setHeader(key, value);
             return originalJson(body);
         };
         next();

package/dist/middlewares/express.js.map

@@ -1 +1 @@
-{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/middlewares/express.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAyC,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAEpC,MAAM,KAAW,IAAI,CAuBpB;AAvBD,WAAiB,IAAI;IACnB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAgB,MAAM,CACpB,MAAwC;QAExC,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAJe,WAAM,SAIrB,CAAA;AACH,CAAC,EAvBgB,IAAI,KAAJ,IAAI,QAuBpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,OAAyE;IAEzE,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE;YACjF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAiC;SAC/C,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAqB,CAAA;YAC9C,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC;gBACH,OAAQ,MAAM,CAAC,WAA8B,EAAE,CAAA;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,6BAA6B,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC/D,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,IAAI,kBAAkB,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAChF,IAAI,kBAAkB,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YAC7D,OAAM;QACR,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAS,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACvD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAE,CAAC,CAAA;YACzE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAA;QAED,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC;AAOD,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEnE;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,GAAY,EACZ,IAAoE,EACpE,SAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,IAAI,eAAe,CAAA;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CACH,CAAA;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;QACjD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../src/middlewares/express.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,QAAQ,EAAyC,MAAM,yBAAyB,CAAA;AACzF,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAA;AAC9C,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD,cAAc,sBAAsB,CAAA;AAEpC,MAAM,KAAW,IAAI,CAuBpB;AAvBD,WAAiB,IAAI;IACnB;;;;;;;;;;;;;;;;OAgBG;IACH,SAAgB,MAAM,CACpB,MAAwC;QAExC,OAAO,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;IAJe,WAAM,SAIrB,CAAA;AACH,CAAC,EAvBgB,IAAI,KAAJ,IAAI,QAuBpB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,OAAO,CACrB,MAAc,EACd,OAAyE;IAEzE,OAAO,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;QAC7E,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,MAAM,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,EAAE;YACjF,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAiC;SAC/C,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAA;QAE7C,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,SAAqB,CAAA;YAC9C,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,SAAS,CAAC,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACvE,GAAG,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;YAChC,OAAM;QACR,CAAC;QAED,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC;gBACH,OAAQ,MAAM,CAAC,WAA8B,EAAE,CAAA;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,6BAA6B,CAAC,KAAK,CAAC;oBAAE,OAAO,IAAI,CAAA;gBAC/D,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC,CAAC,EAAE,CAAA;QAEJ,IAAI,kBAAkB,EAAE,CAAC;YACvB,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAA;YACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,kBAAkB,CAAC,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YAChF,IAAI,kBAAkB,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACrC,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,OAAM;YACR,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;YAC7D,OAAM;QACR,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAS,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACrE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC,CAAA;QAED,IAAI,EAAE,CAAA;IACR,CAAC,CAAA;AACH,CAAC;AAOD,MAAM,gBAAgB,GAAG,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAA;AAEnE;;GAEG;AACH,MAAM,UAAU,SAAS,CACvB,GAAY,EACZ,IAAoE,EACpE,SAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,IAAI,eAAe,CAAA;IAEhD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAC3B,QAAQ,CAAC,IAAI,EAAE;QACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CACH,CAAA;IAED,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAoB,EAAE,GAAoB,EAAE,EAAE;QAChE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAA;QACjE,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;QACjD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/proxy/internal/Headers.d.ts

@@ -1,5 +1,17 @@
 /** Strips hop-by-hop, auth, encoding, cookie, and forwarding headers from a request before proxying upstream. */
 export declare function scrub(headers: Headers): Headers;
-/** Strips `content-encoding` and `content-length` from an upstream response so the proxy can re-stream it. */
+/**
+ * Strips re-streaming headers (`content-encoding`, `content-length`) and
+ * security-sensitive headers (`set-cookie`) from an upstream response.
+ *
+ * `set-cookie` is dropped because a paid API proxy must never let an upstream
+ * service set cookies in the user's browser under the proxy's origin. If a
+ * compromised, misbehaving, or attacker-influenced upstream returned
+ * `Set-Cookie: session=evil; Domain=.example.com`, the browser would honor it
+ * for every sibling subdomain of the proxy — turning any future path-confusion
+ * or open-redirect bug in the surrounding deployment into a session-fixation
+ * primitive. Proxied services authenticate via bearer tokens / signed
+ * payloads, never cookies, so dropping `set-cookie` is purely defensive.
+ */
 export declare function scrubResponse(response: Response): Response;
 //# sourceMappingURL=Headers.d.ts.map

package/dist/proxy/internal/Headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Headers.d.ts","sourceRoot":"","sources":["../../../src/proxy/internal/Headers.ts"],"names":[],"mappings":"AAWA,iHAAiH;AACjH,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAiB/C;AAED,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAS1D"}
+{"version":3,"file":"Headers.d.ts","sourceRoot":"","sources":["../../../src/proxy/internal/Headers.ts"],"names":[],"mappings":"AAsBA,iHAAiH;AACjH,wBAAgB,KAAK,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAiB/C;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAU1D"}

package/dist/proxy/internal/Headers.js

@@ -8,12 +8,22 @@ const hopByHopHeaders = new Set([
     'te',
     'trailer',
 ]);
+// Payment credentials are consumed by the proxy and must never reach upstream services.
+const paymentHeaders = new Set([
+    'accept-payment',
+    'authorization',
+    'payment-receipt',
+    'payment-required',
+    'payment-response',
+    'payment-signature',
+    'www-authenticate',
+]);
 /** Strips hop-by-hop, auth, encoding, cookie, and forwarding headers from a request before proxying upstream. */
 export function scrub(headers) {
     const scrubbed = new Headers();
     for (const [name, value] of headers) {
         const lower = name.toLowerCase();
-        if (lower === 'authorization')
+        if (paymentHeaders.has(lower))
             continue;
         if (lower === 'accept-encoding')
             continue;
@@ -29,11 +39,24 @@ export function scrub(headers) {
     }
     return scrubbed;
 }
-/** Strips `content-encoding` and `content-length` from an upstream response so the proxy can re-stream it. */
+/**
+ * Strips re-streaming headers (`content-encoding`, `content-length`) and
+ * security-sensitive headers (`set-cookie`) from an upstream response.
+ *
+ * `set-cookie` is dropped because a paid API proxy must never let an upstream
+ * service set cookies in the user's browser under the proxy's origin. If a
+ * compromised, misbehaving, or attacker-influenced upstream returned
+ * `Set-Cookie: session=evil; Domain=.example.com`, the browser would honor it
+ * for every sibling subdomain of the proxy — turning any future path-confusion
+ * or open-redirect bug in the surrounding deployment into a session-fixation
+ * primitive. Proxied services authenticate via bearer tokens / signed
+ * payloads, never cookies, so dropping `set-cookie` is purely defensive.
+ */
 export function scrubResponse(response) {
     const headers = new Headers(response.headers);
     headers.delete('content-encoding');
     headers.delete('content-length');
+    headers.delete('set-cookie');
     return new Response(response.body, {
         status: response.status,
         statusText: response.statusText,

package/dist/proxy/internal/Headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"Headers.js","sourceRoot":"","sources":["../../../src/proxy/internal/Headers.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;CACV,CAAC,CAAA;AAEF,iHAAiH;AACjH,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAA;IAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,KAAK,KAAK,eAAe;YAAE,SAAQ;QACvC,IAAI,KAAK,KAAK,iBAAiB;YAAE,SAAQ;QACzC,IAAI,KAAK,KAAK,gBAAgB;YAAE,SAAQ;QACxC,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAQ;QAChC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACxC,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAQ;QAE9C,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,QAAkB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAClC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAChC,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"Headers.js","sourceRoot":"","sources":["../../../src/proxy/internal/Headers.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,SAAS;IACT,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;CACV,CAAC,CAAA;AAEF,wFAAwF;AACxF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAA;AAEF,iHAAiH;AACjH,MAAM,UAAU,KAAK,CAAC,OAAgB;IACpC,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAE,CAAA;IAE9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEhC,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACvC,IAAI,KAAK,KAAK,iBAAiB;YAAE,SAAQ;QACzC,IAAI,KAAK,KAAK,gBAAgB;YAAE,SAAQ;QACxC,IAAI,KAAK,KAAK,QAAQ;YAAE,SAAQ;QAChC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAQ;QACxC,IAAI,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAQ;QAE9C,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,QAAkB;IAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC7C,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;IAClC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAChC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IAC5B,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAA;AACJ,CAAC"}

package/dist/proxy/services/openai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/proxy/services/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,mBAkB3C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAY,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAChC,8DAA8D;QAC9D,MAAM,EAAE,MAAM,CAAA;QACd,iEAAiE;QACjE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,8CAA8C;QAC9C,MAAM,EACF,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,GACrB,6BAA6B,GAC7B,uBAAuB,GACvB,4BAA4B,GAC5B,+BAA+B,GAC/B,6BAA6B,CAAA;KAClC,CAAC,CAAA;CACH"}
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/proxy/services/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,mBAoB3C;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAY,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;QAChC,8DAA8D;QAC9D,MAAM,EAAE,MAAM,CAAA;QACd,iEAAiE;QACjE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5B,8CAA8C;QAC9C,MAAM,EACF,2BAA2B,GAC3B,sBAAsB,GACtB,qBAAqB,GACrB,6BAA6B,GAC7B,uBAAuB,GACvB,4BAA4B,GAC5B,+BAA+B,GAC/B,6BAA6B,CAAA;KAClC,CAAC,CAAA;CACH"}

package/dist/proxy/services/openai.js

@@ -28,6 +28,8 @@ export function openai(config) {
         },
         rewriteRequest(request, ctx) {
             const apiKey = ctx.apiKey ?? config.apiKey;
+            request.headers.delete('OpenAI-Organization');
+            request.headers.delete('OpenAI-Project');
             request.headers.set('Authorization', `Bearer ${apiKey}`);
             return request;
         },

package/dist/proxy/services/openai.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/proxy/services/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAC,MAAqB;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAgB,QAAQ,EAAE;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,wBAAwB;QACnD,UAAU,EAAE,CAAC,IAAI,CAAC;QAClB,WAAW,EAAE,0EAA0E;QACvF,IAAI,EAAE;YACJ,YAAY,EAAE,gDAAgD;YAC9D,QAAQ,EAAE,kCAAkC;YAC5C,IAAI,EAAE,wDAAwD;SAC/D;QACD,cAAc,CAAC,OAAO,EAAE,GAAG;YACzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;YAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/proxy/services/openai.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,MAAM,CAAC,MAAqB;IAC1C,OAAO,OAAO,CAAC,IAAI,CAAgB,QAAQ,EAAE;QAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,wBAAwB;QACnD,UAAU,EAAE,CAAC,IAAI,CAAC;QAClB,WAAW,EAAE,0EAA0E;QACvF,IAAI,EAAE;YACJ,YAAY,EAAE,gDAAgD;YAC9D,QAAQ,EAAE,kCAAkC;YAC5C,IAAI,EAAE,wDAAwD;SAC/D;QACD,cAAc,CAAC,OAAO,EAAE,GAAG;YACzB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAA;YAC1C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAA;YAC7C,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YACxC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,MAAM,EAAE,CAAC,CAAA;YACxD,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,QAAQ;KAChB,CAAC,CAAA;AACJ,CAAC"}

package/dist/server/Methods.d.ts

@@ -1,3 +1,4 @@
+export { evm } from '../evm/server/index.js';
 export { stripe } from '../stripe/server/index.js';
 export { tempo } from '../tempo/server/index.js';
 //# sourceMappingURL=Methods.d.ts.map

package/dist/server/Methods.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Methods.d.ts","sourceRoot":"","sources":["../../src/server/Methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"Methods.d.ts","sourceRoot":"","sources":["../../src/server/Methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/server/Methods.js

@@ -1,3 +1,4 @@
+export { evm } from '../evm/server/index.js';
 export { stripe } from '../stripe/server/index.js';
 export { tempo } from '../tempo/server/index.js';
 //# sourceMappingURL=Methods.js.map

package/dist/server/Methods.js.map

@@ -1 +1 @@
-{"version":3,"file":"Methods.js","sourceRoot":"","sources":["../../src/server/Methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"Methods.js","sourceRoot":"","sources":["../../src/server/Methods.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,wBAAwB,CAAA;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAA"}