mppx 0.8.17 → 0.8.19

package/src/web-bot-auth/client/index.ts

@@ -1,84 +0,0 @@
-import { parseDictionary, serializeDictionary } from 'structured-headers'
-import type { Dictionary } from 'structured-headers'
-
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js'
-import type * as AttestationTypes from '../../attestation/Types.js'
-import { Constants } from '../Constants.js'
-import * as JwkThumbprint from '../internal/JwkThumbprint.js'
-import * as SignatureAgent from '../internal/SignatureAgent.js'
-
-/**
- * Creates a Web Bot Auth HTTPS-directory profile request signer.
- *
- * The signed `Signature-Agent` header links the request to the HTTPS origin
- * of an HTTP Message Signatures Directory. This adapter does not support
- * direct key configuration or other Web Bot Auth discovery types. It
- * establishes bot identity only; it does not assert consumer identity or
- * authority to make a payment.
- */
-export function signer(config: signer.Config): AttestationTypes.Signer<typeof Constants.protocol> {
-  const label = config.label ?? Constants.label
-  const signatureAgentKey = config.signatureAgentKey ?? label
-  const expiresIn = config.expiresIn ?? Constants.defaultSignatureLifetime
-  const signatureAgent = SignatureAgent.directoryOrigin(config.signatureAgent)
-  if (!JwkThumbprint.is(config.keyId))
-    throw new TypeError('Web Bot Auth keyId must be an RFC 7638 SHA-256 JWK thumbprint.')
-  if (!signatureAgent) throw new TypeError('Signature-Agent must identify a valid HTTPS origin.')
-  if (!Number.isInteger(expiresIn) || expiresIn <= 0)
-    throw new RangeError('Web Bot Auth expiresIn must be a positive integer.')
-  return {
-    protocol: Constants.protocol,
-    sign(request, context) {
-      const headers = new Headers(request.headers)
-      const signatureAgents = parseSignatureAgents(headers)
-      if (signatureAgents.has(signatureAgentKey))
-        throw new Error(`Signature-Agent member "${signatureAgentKey}" already exists.`)
-      signatureAgents.set(signatureAgentKey, [signatureAgent, new Map()])
-      headers.set(Constants.signatureAgentHeader, serializeDictionary(signatureAgents))
-      return HttpMessageSignature.sign(new Request(request, { headers }), {
-        components: [
-          HttpMessageSignature.Constants.components.authority,
-          {
-            id: HttpMessageSignature.Constants.components.signatureAgent,
-            parameters: new Map([['key', signatureAgentKey]]),
-          },
-        ],
-        context,
-        expiresIn,
-        key: config.key,
-        keyId: config.keyId,
-        label,
-        tag: Constants.tag,
-      })
-    },
-  }
-}
-
-export declare namespace signer {
-  type Config = {
-    /** Ed25519 or RSA-PSS SHA-512 private key registered for the bot. */
-    key: CryptoKey
-    /** RFC 7638 JWK thumbprint for the registered public key. */
-    keyId: string
-    /** Required HTTPS directory origin, sent with the default `directory` discovery type. */
-    signatureAgent: string
-    /** Dictionary member name used for `Signature-Agent`. @default signature label */
-    signatureAgentKey?: string | undefined
-    /** Signature lifetime in seconds. @default 60 */
-    expiresIn?: number | undefined
-    /** RFC 9421 dictionary label. @default 'webbot' */
-    label?: string | undefined
-  }
-}
-
-function parseSignatureAgents(headers: Headers): Dictionary {
-  const value = headers.get(Constants.signatureAgentHeader)
-  if (!value) return new Map()
-  try {
-    return parseDictionary(value)
-  } catch {
-    throw new Error(
-      `HTTP header "${Constants.signatureAgentHeader}" is not a structured dictionary.`,
-    )
-  }
-}

package/src/web-bot-auth/index.ts

@@ -1,6 +0,0 @@
-/** Client helpers for the Web Bot Auth HTTPS-directory profile. */
-export * as Client from './client/index.js'
-/** Server helpers for the Web Bot Auth HTTPS-directory profile. */
-export * as Server from './server/index.js'
-export * from './Constants.js'
-export * from './Types.js'

package/src/web-bot-auth/internal/JwkThumbprint.ts

@@ -1,21 +0,0 @@
-import { Base64 } from 'ox'
-
-const pattern = /^[A-Za-z0-9_-]{43}$/
-
-/** Returns whether a value has the RFC 7638 SHA-256 thumbprint encoding. */
-export function is(value: string): boolean {
-  return pattern.test(value)
-}
-
-/** Derives an RFC 7638 thumbprint from an extractable Ed25519 or RSA public key. */
-export async function fromKey(key: CryptoKey): Promise<string> {
-  const jwk = await crypto.subtle.exportKey('jwk', key)
-  let canonical: string
-  if (jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.x)
-    canonical = JSON.stringify({ crv: jwk.crv, kty: jwk.kty, x: jwk.x })
-  else if (jwk.kty === 'RSA' && jwk.e && jwk.n)
-    canonical = JSON.stringify({ e: jwk.e, kty: jwk.kty, n: jwk.n })
-  else throw new TypeError('Web Bot Auth requires an Ed25519 or RSA public key.')
-  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical))
-  return Base64.fromBytes(new Uint8Array(digest), { pad: false, url: true })
-}

package/src/web-bot-auth/internal/SignatureAgent.ts

@@ -1,18 +0,0 @@
-/** Returns the canonical origin for a Web Bot Auth directory identifier. */
-export function directoryOrigin(value: string): string | undefined {
-  try {
-    const url = new URL(value)
-    if (
-      url.protocol !== 'https:' ||
-      url.username ||
-      url.password ||
-      url.pathname !== '/' ||
-      url.search ||
-      url.hash
-    )
-      return undefined
-    return url.origin
-  } catch {
-    return undefined
-  }
-}

package/src/web-bot-auth/server/index.ts

@@ -1,113 +0,0 @@
-import { isInnerList, parseDictionary, Token } from 'structured-headers'
-
-import * as HttpMessageSignature from '../../attestation/internal/HttpMessageSignature.js'
-import type * as Attestation from '../../attestation/Types.js'
-import type * as Store from '../../Store.js'
-import { Constants } from '../Constants.js'
-import * as JwkThumbprint from '../internal/JwkThumbprint.js'
-import * as SignatureAgent from '../internal/SignatureAgent.js'
-import type * as Types from '../Types.js'
-
-/**
- * Creates a verifier for the Web Bot Auth HTTPS-directory profile.
- *
- * It requires an `@authority` and signed `Signature-Agent` directory member;
- * direct key configuration and other Web Bot Auth discovery types are outside
- * this adapter's scope. Verification confirms the cryptographic identity of an
- * automated HTTP client. It must not be used on its own as user or payment
- * authorization.
- */
-export function verifier(config: verifier.Config): Attestation.Verifier<Types.VerifiedRequest> {
-  const maxAge = config.maxAge ?? Constants.defaultMaximumSignatureLifetime
-  if (!Number.isInteger(maxAge) || maxAge <= 0)
-    throw new RangeError('Web Bot Auth maxAge must be a positive integer.')
-  return {
-    async verify(request) {
-      let signatureAgent: string | undefined
-      const result = await HttpMessageSignature.verify(request, {
-        async keyResolver(parameters) {
-          return config.keyResolver({
-            ...parameters,
-            signatureAgent: signatureAgent!,
-          })
-        },
-        async validateKey(key, input) {
-          try {
-            return (await JwkThumbprint.fromKey(key)) === input.keyId
-              ? undefined
-              : 'The Web Bot Auth key does not match its RFC 7638 keyid.'
-          } catch {
-            return 'The Web Bot Auth key must be an extractable Ed25519 or RSA public key.'
-          }
-        },
-        maxAge,
-        nonceNamespace: Constants.protocol,
-        nonceStore: config.nonceStore,
-        requiredComponents: Constants.requiredComponents,
-        tag: Constants.tag,
-        validate(signature, request) {
-          if (!JwkThumbprint.is(signature.keyId))
-            return 'The Web Bot Auth keyid must be an RFC 7638 SHA-256 JWK thumbprint.'
-          const component = signature.components.find(
-            (entry) => entry.id === HttpMessageSignature.Constants.components.signatureAgent,
-          )
-          const key = component?.parameters?.get('key')
-          if (typeof key !== 'string')
-            return 'The signed Signature-Agent component must identify a dictionary member.'
-          const value = request.headers.get(Constants.signatureAgentHeader)
-          if (!value) return 'The Signature-Agent header is required.'
-          let agents
-          try {
-            agents = parseDictionary(value)
-          } catch {
-            return 'The Signature-Agent header must be a structured dictionary.'
-          }
-          const agent = agents.get(key)
-          if (!agent || isInnerList(agent) || typeof agent[0] !== 'string')
-            return 'The signed Signature-Agent member must be an HTTPS URL.'
-          const type = agent[1].get('type')
-          if (
-            type !== undefined &&
-            (!(type instanceof Token) || type.toString() !== Constants.discoveryType)
-          )
-            return 'The Signature-Agent discovery type is not supported by this directory profile.'
-          const origin = SignatureAgent.directoryOrigin(agent[0])
-          if (!origin) return 'The Signature-Agent header must identify a valid HTTPS origin.'
-          signatureAgent = origin
-          return undefined
-        },
-      })
-      if (result.status !== 'verified') return result
-      return {
-        status: 'verified',
-        value: {
-          keyId: result.input.keyId,
-          nonce: result.input.nonce,
-          signatureAgent: signatureAgent!,
-        },
-      }
-    },
-  }
-}
-
-export declare namespace verifier {
-  type Config = {
-    /**
-     * Resolves a public key for the advertised directory.
-     *
-     * Apply the origin's trust policy before any network lookup; do not fetch an
-     * arbitrary caller-provided `signatureAgent` URL. Returned public keys
-     * must be extractable so their RFC 7638 thumbprints can be verified.
-     */
-    keyResolver: (parameters: {
-      algorithm: Attestation.SignatureAlgorithm
-      keyId: string
-      request: Request
-      signatureAgent: string
-    }) => Promise<CryptoKey | undefined> | CryptoKey | undefined
-    /** Maximum accepted signature lifetime in seconds. @default 86400 */
-    maxAge?: number | undefined
-    /** Atomically consumes each nonce in shared storage for multi-instance deployments. */
-    nonceStore: Store.AtomicStore
-  }
-}

package/src/x402/Assets.test.ts

@@ -1,253 +0,0 @@
-import { usdc } from 'viem/tokens'
-import { describe, expect, test } from 'vp/test'
-
-import * as Assets from './Assets.js'
-
-describe('x402 assets', () => {
-  test('defines branded asset metadata', () => {
-    const asset = Assets.define({
-      address: '0x1111111111111111111111111111111111111111',
-      decimals: 18,
-      network: 'eip155:1',
-      transfer: {
-        name: 'USD Coin',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-
-    expect(Assets.isAsset(asset)).toBe(true)
-    expect(asset).toMatchObject({
-      address: '0x1111111111111111111111111111111111111111',
-      decimals: 18,
-      network: 'eip155:1',
-      transfer: {
-        name: 'USD Coin',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-
-  test('rejects unbranded values', () => {
-    expect(Assets.isAsset(null)).toBe(false)
-    expect(Assets.isAsset('0x1111111111111111111111111111111111111111')).toBe(false)
-    expect(
-      Assets.isAsset({
-        address: '0x1111111111111111111111111111111111111111',
-        decimals: 18,
-        network: 'eip155:1',
-        transfer: {
-          name: 'USD Coin',
-          type: 'eip3009',
-          version: '2',
-        },
-      }),
-    ).toBe(false)
-  })
-
-  test('defines asset metadata from viem tokens', () => {
-    const asset = Assets.fromToken(usdc, {
-      chainId: 84532,
-      transfer: {
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-
-    expect(Assets.isAsset(asset)).toBe(true)
-    expect(asset).toMatchObject({
-      address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-      decimals: 6,
-      network: 'eip155:84532',
-      transfer: {
-        name: 'USD Coin',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-
-  test('allows viem token transfer metadata overrides', () => {
-    const eip3009Asset = Assets.fromToken(usdc, {
-      chainId: 84532,
-      transfer: {
-        name: 'USDC',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-    const permit2Asset = Assets.fromToken(usdc, {
-      chainId: 84532,
-      transfer: {
-        type: 'permit2',
-      },
-    })
-
-    expect(eip3009Asset.transfer).toEqual({
-      name: 'USDC',
-      type: 'eip3009',
-      version: '2',
-    })
-    expect(permit2Asset.transfer).toEqual({
-      type: 'permit2',
-    })
-  })
-
-  test('requires token names for EIP-3009 viem token assets', () => {
-    const tokenWithoutName = Object.assign(
-      () => ({
-        address: '0x1111111111111111111111111111111111111111',
-        decimals: 6,
-        symbol: 'TEST',
-      }),
-      {
-        addresses: { 1: '0x1111111111111111111111111111111111111111' },
-        decimals: 6,
-      },
-    ) as unknown as Assets.ViemToken
-
-    expect(() =>
-      Assets.fromToken(tokenWithoutName, {
-        chainId: 1,
-        transfer: {
-          type: 'eip3009',
-          version: '2',
-        },
-      }),
-    ).toThrow('EIP-3009 token assets require a token name.')
-  })
-
-  test('identifies currency kinds and converts networks', () => {
-    expect(Assets.isToken(usdc)).toBe(true)
-    expect(Assets.isToken(Assets.baseSepolia.USDC)).toBe(false)
-    expect(Assets.isRawAddress('0x1111111111111111111111111111111111111111')).toBe(true)
-    expect(Assets.isRawAddress(Assets.baseSepolia.USDC)).toBe(false)
-    expect(Assets.toNetwork(84532)).toBe('eip155:84532')
-    expect(Assets.toChainId('eip155:84532')).toBe(84532)
-  })
-
-  test('resolves and matches raw addresses, known assets, and viem tokens', () => {
-    expect(Assets.resolve('0x1111111111111111111111111111111111111111', 'eip155:84532')).toEqual({
-      address: '0x1111111111111111111111111111111111111111',
-    })
-    expect(Assets.resolve(Assets.baseSepolia.USDC, 'eip155:84532')).toEqual({
-      address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-      decimals: 6,
-      transfer: {
-        name: 'USDC',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-    expect(Assets.resolve(Assets.baseSepolia.USDC, 'eip155:8453')).toBeUndefined()
-    expect(Assets.resolve(usdc, 'eip155:84532')).toEqual({
-      address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-      decimals: 6,
-      name: 'USD Coin',
-    })
-    expect(Assets.resolve(usdc, 'eip155:999999')).toBeUndefined()
-    expect(Assets.matches(usdc, '0x036CbD53842c5426634e7929541eC2318f3dCF7e', 'eip155:84532')).toBe(
-      true,
-    )
-    expect(Assets.matches(usdc, '0x036cbd53842c5426634e7929541ec2318f3dcf7e', 'eip155:84532')).toBe(
-      true,
-    )
-    expect(
-      Assets.matches(
-        '0x1111111111111111111111111111111111111111',
-        '0x1111111111111111111111111111111111111111',
-        'eip155:84532',
-      ),
-    ).toBe(true)
-    expect(
-      Assets.matches(
-        Assets.baseSepolia.USDC,
-        '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
-        'eip155:84532',
-      ),
-    ).toBe(false)
-  })
-
-  test('throws when creating assets from tokens unavailable on a chain', () => {
-    expect(() =>
-      Assets.fromToken(usdc, {
-        chainId: 999_999,
-        transfer: {
-          type: 'eip3009',
-          version: '2',
-        },
-      }),
-    ).toThrow('Token has no address for chain id "999999".')
-  })
-
-  test('exports Base USDC metadata', () => {
-    expect(Assets.isAsset(Assets.base.USDC)).toBe(true)
-    expect(Assets.base.USDC).toMatchObject({
-      address: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
-      decimals: 6,
-      network: 'eip155:8453',
-      transfer: {
-        name: 'USD Coin',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-
-  test('exports Base Sepolia USDC metadata', () => {
-    expect(Assets.isAsset(Assets.baseSepolia.USDC)).toBe(true)
-    expect(Assets.baseSepolia.USDC).toMatchObject({
-      address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-      decimals: 6,
-      network: 'eip155:84532',
-      transfer: {
-        name: 'USDC',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-
-  test('exports Celo USDC metadata', () => {
-    expect(Assets.isAsset(Assets.celo.USDC)).toBe(true)
-    expect(Assets.celo.USDC).toMatchObject({
-      address: '0xcebA9300f2b948710d2653dD7B07f33A8B32118C',
-      decimals: 6,
-      network: 'eip155:42220',
-      transfer: {
-        name: 'USDC',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-
-  test('exports Celo USDT metadata', () => {
-    expect(Assets.isAsset(Assets.celo.USDT)).toBe(true)
-    expect(Assets.celo.USDT).toMatchObject({
-      address: '0x48065fbBE25f71C9282ddf5e1cD6D6A887483D5e',
-      decimals: 6,
-      network: 'eip155:42220',
-      transfer: {
-        name: 'Tether USD',
-        type: 'eip3009',
-        version: '1',
-      },
-    })
-  })
-
-  test('exports Celo Sepolia USDC metadata', () => {
-    expect(Assets.isAsset(Assets.celoSepolia.USDC)).toBe(true)
-    expect(Assets.celoSepolia.USDC).toMatchObject({
-      address: '0x01C5C0122039549AD1493B8220cABEdD739BC44E',
-      decimals: 6,
-      network: 'eip155:11142220',
-      transfer: {
-        name: 'USDC',
-        type: 'eip3009',
-        version: '2',
-      },
-    })
-  })
-})