mppx 0.8.15 → 0.8.18

package/dist/tempo/session/server/Settlement.d.ts

@@ -160,8 +160,8 @@ export type SettlementTransactionOptions = {
     candidateFeeTokens?: readonly Address[] | undefined;
     /** TIP20EscrowChannel precompile address override. */
     escrowContract?: Address | undefined;
-    /** Optional fee-payer account for sponsored settlement. */
-    feePayer?: viem_Account | undefined;
+    /** Fee-payer account, or `true` when the client transport uses a configured hosted fee-payer service. */
+    feePayer?: viem_Account | true | undefined;
     /** Optional policy for sponsored settlement. */
     feePayerPolicy?: Partial<FeePayer.Policy> | undefined;
     /** Optional fee token override for settlement. */
@@ -177,8 +177,8 @@ export type MaybeSettleScheduledParameters = {
     channel: ChannelStore.State;
     /** viem client used to settle on-chain. */
     client: Chain.TransactionClient;
-    /** Optional fee-payer account for sponsored settlement. */
-    feePayer?: viem_Account | undefined;
+    /** Fee-payer account, or `true` when the client transport uses a configured hosted fee-payer service. */
+    feePayer?: viem_Account | true | undefined;
     /** Optional policy for sponsored settlement. */
     feePayerPolicy?: Partial<FeePayer.Policy> | undefined;
     /** Optional fee token override for settlement. */
@@ -198,6 +198,13 @@ export declare function getClientAccount(client: {
 }): viem_Account | undefined;
 /** Validates that the transaction sender is the channel payee or nonzero operator. */
 export declare function assertSettlementSender(parameters: SettlementSenderParameters): void;
+/**
+ * Assembles transaction options for settle/close transactions. Machine
+ * channels pin PathUSD (or an explicit override); direct channels leave the
+ * fee token unset so balance-aware selection can pick a funded candidate.
+ * The rail comes from the caller so fee pinning always matches dispatch.
+ */
+export declare function resolveChannelTransactionOptions(channel: Pick<ChannelStore.StoredPrecompileChannel, 'chainId' | 'token'>, options: SettlementTransactionOptions | undefined, account: viem_Account | undefined, machineRouter: Address | undefined): Chain.ChannelTransactionOptions | undefined;
 /** Applies automatic settlement when the server-owned schedule is due. */
 export declare function maybeSettleScheduled(parameters: MaybeSettleScheduledParameters): Promise<Hex | undefined>;
 /** Settles the highest accepted voucher for a precompile-backed session channel. */

package/dist/tempo/session/server/Settlement.js

@@ -1,5 +1,6 @@
 import { isAddress, isAddressEqual, parseUnits, zeroAddress, } from 'viem';
 import { BadRequestError, ChannelClosedError, ChannelNotFoundError, InsufficientBalanceError, VerificationFailedError, } from '../../../Errors.js';
+import * as MachineTokenSession from '../../internal/machine-token-session.js';
 import { isSessionContentRequest } from '../../server/internal/request-body.js';
 import * as Chain from '../precompile/Chain.js';
 import { readSettledReceiptFields } from '../precompile/Chain.js';
@@ -28,12 +29,10 @@ export function resolveRequestFeePayer(parameters) {
     if (requestFeePayer === false)
         return credential ? false : undefined;
     const account = typeof requestFeePayer === 'object' ? requestFeePayer : defaultFeePayer;
+    const hosted = parameterFeePayer === true || typeof parameterFeePayer === 'string';
     if (credential)
-        return account ?? undefined;
-    if (account ||
-        defaultFeePayer ||
-        parameterFeePayer === true ||
-        typeof parameterFeePayer === 'string')
+        return account ?? (hosted ? true : undefined);
+    if (account || hosted)
         return true;
     return undefined;
 }
@@ -184,6 +183,30 @@ export function assertSettlementSender(parameters) {
             ' If using an access key, pass a Tempo access-key account whose address is the payee/operator wallet, not the raw delegated key address.',
     });
 }
+/**
+ * Assembles transaction options for settle/close transactions. Machine
+ * channels pin PathUSD (or an explicit override); direct channels leave the
+ * fee token unset so balance-aware selection can pick a funded candidate.
+ * The rail comes from the caller so fee pinning always matches dispatch.
+ */
+export function resolveChannelTransactionOptions(channel, options, account, machineRouter) {
+    if (!account)
+        return undefined;
+    const feeToken = options?.feeToken ??
+        (machineRouter
+            ? MachineTokenSession.resolveFeeToken({
+                chainId: channel.chainId,
+                paymentToken: channel.token,
+            })
+            : undefined);
+    return {
+        account,
+        ...(options?.feePayer ? { feePayer: options.feePayer } : {}),
+        ...(options?.feePayerPolicy ? { feePayerPolicy: options.feePayerPolicy } : {}),
+        ...(feeToken ? { feeToken } : {}),
+        candidateFeeTokens: options?.candidateFeeTokens ?? [feeToken ?? channel.token],
+    };
+}
 /** Applies automatic settlement when the server-owned schedule is due. */
 export async function maybeSettleScheduled(parameters) {
     const { channel, schedule, store } = parameters;
@@ -214,23 +237,32 @@ export async function settle(store_, client, channelId_, options) {
         throw new VerificationFailedError({ reason: 'no voucher to settle' });
     const escrow = options?.escrowContract ?? channel.escrowContract;
     const account = options?.account ?? getClientAccount(client);
-    assertSettlementSender({
-        operation: 'settle',
-        channelId,
-        operator: channel.operator,
-        payee: channel.payee,
-        sender: account?.address,
-    });
+    const machineRouter = MachineTokenSession.matchDeployment({
+        chainId: channel.chainId,
+        descriptor: channel.descriptor,
+    })?.swap;
+    if (!machineRouter || !account)
+        assertSettlementSender({
+            operation: 'settle',
+            channelId,
+            operator: channel.operator,
+            payee: channel.payee,
+            sender: account?.address,
+        });
     const amount = uint96(channel.highestVoucher.cumulativeAmount);
-    const txHash = await Chain.settleOnChain(client, channel.descriptor, amount, channel.highestVoucher.signature, escrow, account
-        ? {
-            account,
-            ...(options?.feePayer ? { feePayer: options.feePayer } : {}),
-            ...(options?.feePayerPolicy ? { feePayerPolicy: options.feePayerPolicy } : {}),
-            ...(options?.feeToken ? { feeToken: options.feeToken } : {}),
-            candidateFeeTokens: options?.candidateFeeTokens ?? [channel.token],
-        }
-        : undefined);
+    const transactionOptions = resolveChannelTransactionOptions(channel, options, account, machineRouter);
+    let txHash;
+    if (machineRouter) {
+        const authorizationSignature = channel.highestVoucher.authorizationSignature;
+        if (!authorizationSignature)
+            throw new VerificationFailedError({
+                reason: 'machine-token voucher is missing its router authorization',
+            });
+        txHash = await Chain.settleMachineSessionOnChain(client, channel.descriptor, amount, channel.highestVoucher.signature, authorizationSignature, machineRouter, transactionOptions);
+    }
+    else {
+        txHash = await Chain.settleOnChain(client, channel.descriptor, amount, channel.highestVoucher.signature, escrow, transactionOptions);
+    }
     const receipt = await Chain.waitForSuccessfulReceipt(client, txHash);
     const settled = readSettledReceiptFields(Chain.getChannelEvent(receipt, 'Settled', channelId));
     const { newSettled } = settled;

package/dist/tempo/session/server/Sse.d.ts

@@ -1,6 +1,6 @@
 import type { Hex } from 'viem';
 import * as ChannelStore from './ChannelStore.js';
-import { type SessionController } from './MeteredStream.js';
+import { type MeteredStreamOptions, type SessionController } from './MeteredStream.js';
 /**
  * SSE (Server-Sent Events) utilities for metered streaming payments.
  *
@@ -41,6 +41,8 @@ export declare namespace serve {
         challengeId: string;
         tickCost: bigint;
         generate: AsyncIterable<string> | ((stream: SessionController) => AsyncIterable<string>);
+        /** Callback invoked after each nonzero stream charge is committed. */
+        onChargeCommitted?: MeteredStreamOptions['onChargeCommitted'];
         pollIntervalMs?: number | undefined;
         prepaidUnits?: number | undefined;
         signal?: AbortSignal | undefined;

package/dist/tempo/session/server/Sse.js

@@ -1,7 +1,7 @@
 import * as Constants from '../../../Constants.js';
 import * as Credential from '../../../Credential.js';
 import { createSessionReceipt, extractData, formatMessageEvent, formatNeedVoucherEvent, formatReceiptEvent, readSessionChallengeAmount, requireSessionCredentialContext, } from '../precompile/Protocol.js';
-import { meterIterable } from './MeteredStream.js';
+import { meterIterable, } from './MeteredStream.js';
 /**
  * SSE (Server-Sent Events) utilities for metered streaming payments.
  *
@@ -44,6 +44,7 @@ export function serve(options) {
                     channelId,
                     tickCost,
                     generate,
+                    onChargeCommitted: options.onChargeCommitted,
                     pollIntervalMs,
                     prepaidUnits: options.prepaidUnits,
                     signal,

package/dist/tempo/session/server/Transports.d.ts

@@ -40,7 +40,7 @@ export type CommitReservedChargesParameters = {
  */
 export declare function reserveChargeOrWait(options: ReserveChargeParameters): Promise<void>;
 /** Atomically commits previously reserved stream charges to channel spend and unit counters. */
-export declare function commitReservedCharges(options: CommitReservedChargesParameters): Promise<void>;
+export declare function commitReservedCharges(options: CommitReservedChargesParameters): Promise<ChannelStore.State | undefined>;
 /** Throws when a channel can no longer be used for streaming charges. */
 export declare function throwIfChannelClosed(channel: ChannelStore.State): void;
 /** Minimal socket event map supported by browser and Node-style WebSocket runtimes. */

package/dist/tempo/session/server/Transports.js

@@ -56,6 +56,7 @@ export async function commitReservedCharges(options) {
     throwIfChannelClosed(channel);
     if (!committed)
         throw new Error('reserved voucher coverage is no longer available');
+    return channel;
 }
 /** Throws when a channel can no longer be used for streaming charges. */
 export function throwIfChannelClosed(channel) {

package/dist/tempo/session/server/Ws.d.ts

@@ -1,5 +1,6 @@
 import * as ChannelStore from './ChannelStore.js';
-import type { SessionController } from './MeteredStream.js';
+import type { MeteredStreamOptions, SessionController } from './MeteredStream.js';
+import type { SettleChargedSessionChannel } from './Settlement.js';
 export type { SessionController } from './MeteredStream.js';
 export type { Socket } from './Transports.js';
 import { type Socket } from './Transports.js';
@@ -42,6 +43,10 @@ export declare namespace serve {
         /** Payment route handler. Receives synthetic `POST` requests with only
          *  the `Authorization` header — no cookies, bodies, or upgrade headers. */
         route: SessionRoute;
+        /** Optional low-level hook invoked after each committed stream charge. */
+        onChargeCommitted?: MeteredStreamOptions['onChargeCommitted'];
+        /** @deprecated Use `onChargeCommitted`. */
+        settleScheduled?: SettleChargedSessionChannel | undefined;
         socket: Socket;
         store: ChannelStore.ChannelStore | import('../../../Store.js').Store;
         url: string | URL;

package/dist/tempo/session/server/Ws.js

@@ -64,6 +64,7 @@ export async function serve(options) {
                 channelId: context.channelId,
                 tickCost: context.tickCost,
                 generate,
+                onChargeCommitted: options.onChargeCommitted ?? options.settleScheduled,
                 pollIntervalMs,
                 signal: abortController.signal,
                 emitNeedVoucher: (message) => send(socket, message),

package/dist/tempo/subscription/KeyAuthorization.d.ts

@@ -56,38 +56,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
     chainId: number;
     request: Pick<SubscriptionRequest, 'amount' | 'currency' | 'periodCount' | 'periodUnit' | 'recipient' | 'subscriptionExpires'>;
 }): Promise<{
-    readonly address: `0x${string}`;
-    readonly chainId: bigint;
-    readonly expiry: number;
-    readonly limits: readonly {
-        readonly token: `0x${string}`;
-        readonly limit: bigint;
-        readonly period: number;
-    }[];
-    readonly scopes: readonly {
-        readonly address: `0x${string}`;
-        readonly selector: "0x95777d59";
-        readonly recipients: readonly `0x${string}`[];
-    }[];
-    readonly type: "secp256k1" | "p256" | "webAuthn";
     signature: {
-        signature: {
-            r: bigint;
-            s: bigint;
-            yParity: number;
-        };
-        type: "secp256k1";
-        version?: undefined;
-        init?: undefined;
-        account?: undefined;
-        prehash?: undefined;
-        publicKey?: undefined;
-        metadata?: undefined;
-        userAddress?: undefined;
-        inner?: undefined;
-        keyId?: undefined;
-        signatures?: undefined;
-    } | {
         prehash: boolean;
         publicKey: {
             prefix: number;
@@ -99,15 +68,32 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
             s: bigint;
             yParity?: number | undefined;
         };
-        type: "p256";
-        version?: undefined;
-        init?: undefined;
+        type: 'p256';
         account?: undefined;
+        init?: undefined;
+        inner?: undefined;
+        keyId?: undefined;
         metadata?: undefined;
+        signatures?: undefined;
         userAddress?: undefined;
+        version?: undefined;
+    } | {
+        signature: {
+            r: bigint;
+            s: bigint;
+            yParity: number;
+        };
+        type: 'secp256k1';
+        account?: undefined;
+        init?: undefined;
         inner?: undefined;
         keyId?: undefined;
+        metadata?: undefined;
+        prehash?: undefined;
+        publicKey?: undefined;
         signatures?: undefined;
+        userAddress?: undefined;
+        version?: undefined;
     } | {
         metadata: {
             authenticatorData: import("ox/Hex").Hex;
@@ -123,16 +109,30 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
             x: bigint;
             y: bigint;
         };
-        type: "webAuthn";
-        version?: undefined;
-        init?: undefined;
+        type: 'webAuthn';
         account?: undefined;
-        prehash?: undefined;
-        userAddress?: undefined;
+        init?: undefined;
         inner?: undefined;
         keyId?: undefined;
+        prehash?: undefined;
         signatures?: undefined;
+        userAddress?: undefined;
+        version?: undefined;
     };
+    readonly address: `0x${string}`;
+    readonly chainId: bigint;
+    readonly expiry: number;
+    readonly limits: readonly {
+        readonly token: `0x${string}`;
+        readonly limit: bigint;
+        readonly period: number;
+    }[];
+    readonly scopes: readonly {
+        readonly address: `0x${string}`;
+        readonly selector: "0x95777d59";
+        readonly recipients: readonly `0x${string}`[];
+    }[];
+    readonly type: "p256" | "secp256k1" | "webAuthn";
 } | undefined>;
 /**
  * Verifies that a subscription credential contains a key authorization scoped to the requested

package/dist/web-bot-auth/Constants.d.ts

@@ -0,0 +1,20 @@
+/** Web Bot Auth values for the supported HTTPS-directory signature profile. */
+export declare const Constants: {
+    /** Stable identifier for Web Bot Auth signers and replay storage. */
+    readonly protocol: 'web-bot-auth';
+    /** Web Bot Auth discovery type supported by this adapter. */
+    readonly discoveryType: 'directory';
+    /** RFC 9421 signature label used when no label is configured. */
+    readonly label: 'webbot';
+    /** Tag identifying a Web Bot Auth request signature. */
+    readonly tag: 'web-bot-auth';
+    /** Structured HTTP header linking a bot signature to its HTTPS directory origin. */
+    readonly signatureAgentHeader: 'Signature-Agent';
+    /** Default lifetime, in seconds, for a bot request signature. */
+    readonly defaultSignatureLifetime: 60;
+    /** Default verifier limit, following the draft's recommended 24-hour maximum. */
+    readonly defaultMaximumSignatureLifetime: number;
+    /** HTTP components required by this directory profile. */
+    readonly requiredComponents: readonly ["@authority", "signature-agent"];
+};
+//# sourceMappingURL=Constants.d.ts.map

package/dist/web-bot-auth/Constants.js

@@ -0,0 +1,24 @@
+import { Constants as HttpMessageSignature } from '../attestation/internal/HttpMessageSignature.js';
+/** Web Bot Auth values for the supported HTTPS-directory signature profile. */
+export const Constants = {
+    /** Stable identifier for Web Bot Auth signers and replay storage. */
+    protocol: 'web-bot-auth',
+    /** Web Bot Auth discovery type supported by this adapter. */
+    discoveryType: 'directory',
+    /** RFC 9421 signature label used when no label is configured. */
+    label: 'webbot',
+    /** Tag identifying a Web Bot Auth request signature. */
+    tag: 'web-bot-auth',
+    /** Structured HTTP header linking a bot signature to its HTTPS directory origin. */
+    signatureAgentHeader: 'Signature-Agent',
+    /** Default lifetime, in seconds, for a bot request signature. */
+    defaultSignatureLifetime: 60,
+    /** Default verifier limit, following the draft's recommended 24-hour maximum. */
+    defaultMaximumSignatureLifetime: 24 * 60 * 60,
+    /** HTTP components required by this directory profile. */
+    requiredComponents: [
+        HttpMessageSignature.components.authority,
+        HttpMessageSignature.components.signatureAgent,
+    ],
+};
+//# sourceMappingURL=Constants.js.map

package/dist/web-bot-auth/Types.d.ts

@@ -0,0 +1,10 @@
+/** Verified Web Bot Auth HTTPS-directory profile request signature. */
+export type VerifiedRequest = {
+    /** Public-key thumbprint advertised by the bot. */
+    keyId: string;
+    /** HTTPS directory origin carried in the signed `Signature-Agent` header. */
+    signatureAgent: string;
+    /** Signature nonce supplied by the bot. */
+    nonce: string;
+};
+//# sourceMappingURL=Types.d.ts.map

package/dist/web-bot-auth/Types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Types.js.map

package/dist/web-bot-auth/client/index.d.ts

@@ -0,0 +1,29 @@
+import type * as AttestationTypes from '../../attestation/Types.js';
+import { Constants } from '../Constants.js';
+/**
+ * Creates a Web Bot Auth HTTPS-directory profile request signer.
+ *
+ * The signed `Signature-Agent` header links the request to the HTTPS origin
+ * of an HTTP Message Signatures Directory. This adapter does not support
+ * direct key configuration or other Web Bot Auth discovery types. It
+ * establishes bot identity only; it does not assert consumer identity or
+ * authority to make a payment.
+ */
+export declare function signer(config: signer.Config): AttestationTypes.Signer<typeof Constants.protocol>;
+export declare namespace signer {
+    type Config = {
+        /** Ed25519 or RSA-PSS SHA-512 private key registered for the bot. */
+        key: CryptoKey;
+        /** RFC 7638 JWK thumbprint for the registered public key. */
+        keyId: string;
+        /** Required HTTPS directory origin, sent with the default `directory` discovery type. */
+        signatureAgent: string;
+        /** Dictionary member name used for `Signature-Agent`. @default signature label */
+        signatureAgentKey?: string | undefined;
+        /** Signature lifetime in seconds. @default 60 */
+        expiresIn?: number | undefined;
+        /** RFC 9421 dictionary label. @default 'webbot' */
+        label?: string | undefined;
+    };
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/web-bot-auth/client/index.js

@@ -0,0 +1,64 @@
+import { parseDictionary, serializeDictionary } from 'structured-headers';
+import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js';
+import { Constants } from '../Constants.js';
+import * as JwkThumbprint from '../internal/JwkThumbprint.js';
+import * as SignatureAgent from '../internal/SignatureAgent.js';
+/**
+ * Creates a Web Bot Auth HTTPS-directory profile request signer.
+ *
+ * The signed `Signature-Agent` header links the request to the HTTPS origin
+ * of an HTTP Message Signatures Directory. This adapter does not support
+ * direct key configuration or other Web Bot Auth discovery types. It
+ * establishes bot identity only; it does not assert consumer identity or
+ * authority to make a payment.
+ */
+export function signer(config) {
+    const label = config.label ?? Constants.label;
+    const signatureAgentKey = config.signatureAgentKey ?? label;
+    const expiresIn = config.expiresIn ?? Constants.defaultSignatureLifetime;
+    const signatureAgent = SignatureAgent.directoryOrigin(config.signatureAgent);
+    if (!JwkThumbprint.is(config.keyId))
+        throw new TypeError('Web Bot Auth keyId must be an RFC 7638 SHA-256 JWK thumbprint.');
+    if (!signatureAgent)
+        throw new TypeError('Signature-Agent must identify a valid HTTPS origin.');
+    if (!Number.isInteger(expiresIn) || expiresIn <= 0)
+        throw new RangeError('Web Bot Auth expiresIn must be a positive integer.');
+    return {
+        protocol: Constants.protocol,
+        sign(request, context) {
+            const headers = new Headers(request.headers);
+            const signatureAgents = parseSignatureAgents(headers);
+            if (signatureAgents.has(signatureAgentKey))
+                throw new Error(`Signature-Agent member "${signatureAgentKey}" already exists.`);
+            signatureAgents.set(signatureAgentKey, [signatureAgent, new Map()]);
+            headers.set(Constants.signatureAgentHeader, serializeDictionary(signatureAgents));
+            return HttpMessageSignature.sign(new Request(request, { headers }), {
+                components: [
+                    HttpMessageSignature.Constants.components.authority,
+                    {
+                        id: HttpMessageSignature.Constants.components.signatureAgent,
+                        parameters: new Map([['key', signatureAgentKey]]),
+                    },
+                ],
+                context,
+                expiresIn,
+                key: config.key,
+                keyId: config.keyId,
+                label,
+                tag: Constants.tag,
+            });
+        },
+    };
+}
+function parseSignatureAgents(headers) {
+    const value = headers.get(Constants.signatureAgentHeader);
+    if (!value)
+        return new Map();
+    try {
+        return parseDictionary(value);
+    }
+    catch {
+        throw new Error(`HTTP header "${Constants.signatureAgentHeader}" is not a structured dictionary.`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/web-bot-auth/index.d.ts

@@ -0,0 +1,7 @@
+/** Client helpers for the Web Bot Auth HTTPS-directory profile. */
+export * as Client from './client/index.js';
+/** Server helpers for the Web Bot Auth HTTPS-directory profile. */
+export * as Server from './server/index.js';
+export * from './Constants.js';
+export * from './Types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/web-bot-auth/index.js

@@ -0,0 +1,7 @@
+/** Client helpers for the Web Bot Auth HTTPS-directory profile. */
+export * as Client from './client/index.js';
+/** Server helpers for the Web Bot Auth HTTPS-directory profile. */
+export * as Server from './server/index.js';
+export * from './Constants.js';
+export * from './Types.js';
+//# sourceMappingURL=index.js.map

package/dist/web-bot-auth/internal/JwkThumbprint.d.ts

@@ -0,0 +1,5 @@
+/** Returns whether a value has the RFC 7638 SHA-256 thumbprint encoding. */
+export declare function is(value: string): boolean;
+/** Derives an RFC 7638 thumbprint from an extractable Ed25519 or RSA public key. */
+export declare function fromKey(key: CryptoKey): Promise<string>;
+//# sourceMappingURL=JwkThumbprint.d.ts.map

package/dist/web-bot-auth/internal/JwkThumbprint.js

@@ -0,0 +1,20 @@
+import { Base64 } from 'ox';
+const pattern = /^[A-Za-z0-9_-]{43}$/;
+/** Returns whether a value has the RFC 7638 SHA-256 thumbprint encoding. */
+export function is(value) {
+    return pattern.test(value);
+}
+/** Derives an RFC 7638 thumbprint from an extractable Ed25519 or RSA public key. */
+export async function fromKey(key) {
+    const jwk = await crypto.subtle.exportKey('jwk', key);
+    let canonical;
+    if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.x)
+        canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x });
+    else if (jwk.kty === 'RSA' && jwk.e && jwk.n)
+        canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n });
+    else
+        throw new TypeError('Web Bot Auth requires an Ed25519 or RSA public key.');
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical));
+    return Base64.fromBytes(new Uint8Array(digest), { pad: false, url: true });
+}
+//# sourceMappingURL=JwkThumbprint.js.map

package/dist/web-bot-auth/internal/SignatureAgent.d.ts

@@ -0,0 +1,3 @@
+/** Returns the canonical origin for a Web Bot Auth directory identifier. */
+export declare function directoryOrigin(value: string): string | undefined;
+//# sourceMappingURL=SignatureAgent.d.ts.map

package/dist/web-bot-auth/internal/SignatureAgent.js

@@ -0,0 +1,18 @@
+/** Returns the canonical origin for a Web Bot Auth directory identifier. */
+export function directoryOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== 'https:' ||
+            url.username ||
+            url.password ||
+            url.pathname !== '/' ||
+            url.search ||
+            url.hash)
+            return undefined;
+        return url.origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=SignatureAgent.js.map

package/dist/web-bot-auth/server/index.d.ts

@@ -0,0 +1,35 @@
+import type * as Attestation from '../../attestation/Types.js';
+import type * as Store from '../../Store.js';
+import type * as Types from '../Types.js';
+/**
+ * Creates a verifier for the Web Bot Auth HTTPS-directory profile.
+ *
+ * It requires an `@authority` and signed `Signature-Agent` directory member;
+ * direct key configuration and other Web Bot Auth discovery types are outside
+ * this adapter's scope. Verification confirms the cryptographic identity of an
+ * automated HTTP client. It must not be used on its own as user or payment
+ * authorization.
+ */
+export declare function verifier(config: verifier.Config): Attestation.Verifier<Types.VerifiedRequest>;
+export declare namespace verifier {
+    type Config = {
+        /**
+         * Resolves a public key for the advertised directory.
+         *
+         * Apply the origin's trust policy before any network lookup; do not fetch an
+         * arbitrary caller-provided `signatureAgent` URL. Returned public keys
+         * must be extractable so their RFC 7638 thumbprints can be verified.
+         */
+        keyResolver: (parameters: {
+            algorithm: Attestation.SignatureAlgorithm;
+            keyId: string;
+            request: Request;
+            signatureAgent: string;
+        }) => Promise<CryptoKey | undefined> | CryptoKey | undefined;
+        /** Maximum accepted signature lifetime in seconds. @default 86400 */
+        maxAge?: number | undefined;
+        /** Atomically consumes each nonce in shared storage for multi-instance deployments. */
+        nonceStore: Store.AtomicStore;
+    };
+}
+//# sourceMappingURL=index.d.ts.map