mppx 0.8.18 → 0.9.0

package/dist/integrations/x402/Negotiator.js

@@ -0,0 +1,165 @@
+import { decodePaymentRequiredHeader } from '@x402/core/http';
+import { getFacilitatorResponseError, x402HTTPResourceServer } from '@x402/core/server';
+import * as Constants from '../../Constants.js';
+import * as Credential from '../../Credential.js';
+import * as SecretKey from '../../server/internal/SecretKey.js';
+import * as Types from '../../x402/Types.js';
+import * as Evm from './Evm.js';
+/** Creates the native MPP side of an x402 compatibility integration. */
+export function create(config) {
+    SecretKey.assert(config.secretKey);
+    const httpServer = new x402HTTPResourceServer(config.server, config.routes);
+    let initialization;
+    async function initialize() {
+        initialization ??= httpServer.initialize().catch((error) => {
+            initialization = undefined;
+            throw error;
+        });
+        await initialization;
+    }
+    async function negotiate(request, context) {
+        if (!httpServer.requiresPayment(context))
+            return { status: 'unprotected' };
+        if (hasMppCredential(request) && getX402Credential(request))
+            return {
+                response: Response.json({ error: 'Send either an MPP credential or an x402 payment signature, not both.' }, { status: 400 }),
+                status: 'handled',
+            };
+        try {
+            await initialize();
+            if (getX402Credential(request))
+                return { status: 'x402' };
+            const result = await httpServer.processHTTPRequest(withoutX402Credential(context), config.paywallConfig);
+            if (result.type === 'no-payment-required')
+                return { status: 'unprotected' };
+            if (result.type !== 'payment-error')
+                throw new Error(`Expected x402 payment response, received ${result.type}.`);
+            const x402Response = responseFromInstructions(result.response);
+            const paymentRequired = getPaymentRequired(result);
+            const handler = paymentRequired
+                ? Evm.createHandler({ config, context, paymentRequired })
+                : undefined;
+            if (!handler)
+                return { response: x402Response, status: 'handled' };
+            const { payment, skipHandlerResponse } = await handler(request);
+            if (payment.status !== 402)
+                return skipHandlerResponse
+                    ? { response: payment.withReceipt(skipHandlerResponse), status: 'handled' }
+                    : { status: 'paid', withReceipt: payment.withReceipt };
+            const response = mergeChallenge(payment.challenge, x402Response);
+            return { response, status: 'handled' };
+        }
+        catch (error) {
+            const facilitatorError = getFacilitatorResponseError(error);
+            if (!facilitatorError)
+                throw error;
+            return {
+                response: Response.json({ error: facilitatorError.message }, { status: 502 }),
+                status: 'handled',
+            };
+        }
+    }
+    return { httpServer, negotiate };
+}
+/** Reads a current or legacy x402 payment credential. */
+export function getX402Credential(request) {
+    return (request.headers.get(Types.paymentSignatureHeader) ??
+        request.headers.get(Types.legacyPaymentSignatureHeader) ??
+        undefined);
+}
+/** Converts a Fetch request to the context consumed by x402 core. */
+export function createContext(request, body) {
+    const paymentHeader = getX402Credential(request);
+    return {
+        adapter: new FetchAdapter(request, body),
+        method: request.method,
+        path: new URL(request.url).pathname,
+        ...(paymentHeader ? { paymentHeader } : {}),
+    };
+}
+function hasMppCredential(request) {
+    const authorization = request.headers.get(Constants.Headers.authorization);
+    return authorization ? Credential.extractPaymentScheme(authorization) !== null : false;
+}
+function withoutX402Credential(context) {
+    const { paymentHeader: _, ...withoutCredential } = context;
+    return withoutCredential;
+}
+function getPaymentRequired(result) {
+    if (result.type !== 'payment-error')
+        return undefined;
+    const target = Types.paymentRequiredHeader.toLowerCase();
+    const encoded = Object.entries(result.response.headers).find(([name]) => name.toLowerCase() === target)?.[1];
+    return encoded ? decodePaymentRequiredHeader(encoded) : undefined;
+}
+function responseFromInstructions(instructions) {
+    const headers = new Headers(instructions.headers);
+    let body = null;
+    if (instructions.body !== undefined) {
+        if (instructions.isHtml || typeof instructions.body === 'string')
+            body = String(instructions.body);
+        else {
+            body = JSON.stringify(instructions.body);
+            if (!headers.has('Content-Type'))
+                headers.set('Content-Type', 'application/json');
+        }
+    }
+    return new Response(body, { headers, status: instructions.status });
+}
+function mergeChallenge(mpp, x402) {
+    const headers = new Headers(x402.headers);
+    const challenge = mpp.headers.get('WWW-Authenticate');
+    if (challenge)
+        headers.append('WWW-Authenticate', challenge);
+    headers.set('Cache-Control', 'no-store');
+    return new Response(x402.body, {
+        headers,
+        status: x402.status,
+        statusText: x402.statusText,
+    });
+}
+/** Fetch implementation used only by the MCP compatibility wrapper. */
+class FetchAdapter {
+    request;
+    body;
+    constructor(request, body) {
+        this.request = request;
+        this.body = body;
+    }
+    getAcceptHeader() {
+        return this.request.headers.get('Accept') ?? '';
+    }
+    getHeader(name) {
+        return this.request.headers.get(name) ?? undefined;
+    }
+    getBody() {
+        return this.body;
+    }
+    getMethod() {
+        return this.request.method;
+    }
+    getPath() {
+        return new URL(this.request.url).pathname;
+    }
+    getQueryParam(name) {
+        const values = new URL(this.request.url).searchParams.getAll(name);
+        if (values.length === 0)
+            return undefined;
+        return values.length === 1 ? values[0] : values;
+    }
+    getQueryParams() {
+        const parameters = {};
+        for (const key of new URL(this.request.url).searchParams.keys()) {
+            const values = new URL(this.request.url).searchParams.getAll(key);
+            parameters[key] = values.length === 1 ? values[0] : values;
+        }
+        return parameters;
+    }
+    getUrl() {
+        return this.request.url;
+    }
+    getUserAgent() {
+        return this.request.headers.get('User-Agent') ?? '';
+    }
+}
+//# sourceMappingURL=Negotiator.js.map

package/dist/mcp/internal/Credential.d.ts

@@ -0,0 +1,9 @@
+import * as Credential from '../../Credential.js';
+/** Parsed MCP credential and its canonical HTTP Authorization value. */
+export type Parsed = {
+    header: string;
+    value: Credential.Credential;
+};
+/** Validates an MCP metadata credential through the canonical wire serializer. */
+export declare function parse(value: unknown): Parsed | undefined;
+//# sourceMappingURL=Credential.d.ts.map

package/dist/mcp/internal/Credential.js

@@ -0,0 +1,16 @@
+import * as Credential from '../../Credential.js';
+/** Validates an MCP metadata credential through the canonical wire serializer. */
+export function parse(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    if (!('challenge' in value) || !('payload' in value))
+        return undefined;
+    try {
+        const header = Credential.serialize(value);
+        return { header, value: Credential.deserialize(header) };
+    }
+    catch {
+        return undefined;
+    }
+}
+//# sourceMappingURL=Credential.js.map

package/dist/mcp/server/Transport.js

@@ -1,5 +1,6 @@
 import * as core_Mcp from '../../Mcp.js';
 import * as Transport from '../../server/Transport.js';
+import * as McpCredential from '../internal/Credential.js';
 /**
  * MCP SDK transport for server-side payment handling with `@modelcontextprotocol/sdk`.
  *
@@ -40,10 +41,7 @@ export function mcpSdk() {
             };
         },
         getCredential(extra) {
-            const credential = extra._meta?.[core_Mcp.credentialMetaKey];
-            if (!credential)
-                return null;
-            return credential;
+            return McpCredential.parse(extra._meta?.[core_Mcp.credentialMetaKey])?.value ?? null;
         },
         async respondChallenge({ challenge, error }) {
             if (!McpErrorClass) {

package/dist/middlewares/express.js

@@ -1,5 +1,6 @@
 import { generate } from '../discovery/OpenApi.js';
 import * as Mppx_core from '../server/Mppx.js';
+import * as ExpressAdapter from './internal/express.js';
 import * as Mppx_internal from './internal/mppx.js';
 export * from '../server/Methods.js';
 export var Mppx;
@@ -48,17 +49,11 @@ export var Mppx;
  */
 export function payment(intent, options) {
     return async (req, res, next) => {
-        const request = new Request(`${req.protocol}://${req.hostname}${req.originalUrl}`, {
-            method: req.method,
-            headers: req.headers,
-        });
+        const request = ExpressAdapter.toRequest(req);
         const result = await intent(options)(request);
         if (result.status === 402) {
             const challenge = result.challenge;
-            res.status(challenge.status);
-            for (const [key, value] of challenge.headers)
-                res.setHeader(key, value);
-            res.send(await challenge.text());
+            await ExpressAdapter.sendResponse(res, challenge);
             return;
         }
         const managementResponse = (() => {
@@ -73,8 +68,7 @@ export function payment(intent, options) {
         })();
         if (managementResponse) {
             res.status(managementResponse.status);
-            for (const [key, value] of managementResponse.headers)
-                res.setHeader(key, value);
+            ExpressAdapter.copyHeaders(res, managementResponse.headers);
             if (managementResponse.body === null) {
                 res.end();
                 return;
@@ -85,8 +79,7 @@ export function payment(intent, options) {
         const originalJson = res.json.bind(res);
         res.json = (body) => {
             const wrapped = result.withReceipt(Response.json(body));
-            for (const [key, value] of wrapped.headers)
-                res.setHeader(key, value);
+            ExpressAdapter.copyHeaders(res, wrapped.headers);
             return originalJson(body);
         };
         next();

package/dist/middlewares/internal/express.d.ts

@@ -0,0 +1,8 @@
+import type { Request as ExpressRequest, Response as ExpressResponse } from 'express';
+/** Copies Fetch response headers to an Express response. */
+export declare function copyHeaders(response: ExpressResponse, headers: Headers): void;
+/** Sends a Fetch response through Express without changing its status, headers, or bytes. */
+export declare function sendResponse(response: ExpressResponse, fetchResponse: Response): Promise<ExpressResponse<any, Record<string, any>>>;
+/** Converts an Express parsed request into the Fetch request consumed by mppx core. */
+export declare function toRequest(request: ExpressRequest): Request;
+//# sourceMappingURL=express.d.ts.map

package/dist/middlewares/internal/express.js

@@ -0,0 +1,24 @@
+import * as NodeRequest from './node.js';
+/** Copies Fetch response headers to an Express response. */
+export function copyHeaders(response, headers) {
+    for (const [name, value] of headers)
+        response.setHeader(name, value);
+}
+/** Sends a Fetch response through Express without changing its status, headers, or bytes. */
+export async function sendResponse(response, fetchResponse) {
+    copyHeaders(response, fetchResponse.headers);
+    response.status(fetchResponse.status);
+    if (fetchResponse.body === null)
+        return response.end();
+    return response.send(Buffer.from(await fetchResponse.arrayBuffer()));
+}
+/** Converts an Express parsed request into the Fetch request consumed by mppx core. */
+export function toRequest(request) {
+    return NodeRequest.toRequest({
+        body: request.body,
+        headers: request.headers,
+        method: request.method,
+        url: `${request.protocol}://${request.get('host')}${request.originalUrl}`,
+    });
+}
+//# sourceMappingURL=express.js.map

package/dist/middlewares/internal/node.d.ts

@@ -0,0 +1,10 @@
+/** Parsed Node framework request fields needed to construct a Fetch request. */
+export type ParsedRequest = {
+    body?: unknown;
+    headers: Record<string, string | string[] | undefined>;
+    method: string;
+    url: string;
+};
+/** Converts a parsed Node framework request into the Fetch request consumed by mppx core. */
+export declare function toRequest(request: ParsedRequest): Request;
+//# sourceMappingURL=node.d.ts.map

package/dist/middlewares/internal/node.js

@@ -0,0 +1,34 @@
+/** Converts a parsed Node framework request into the Fetch request consumed by mppx core. */
+export function toRequest(request) {
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(request.headers)) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value))
+            for (const entry of value)
+                headers.append(name, entry);
+        else
+            headers.set(name, value);
+    }
+    const body = request.method === 'GET' || request.method === 'HEAD' || request.body === undefined
+        ? undefined
+        : toBody(request.body);
+    return new Request(request.url, {
+        ...(body === undefined ? {} : { body }),
+        headers,
+        method: request.method,
+    });
+}
+/** Preserves Fetch-compatible bodies and serializes parsed JSON values. */
+function toBody(body) {
+    if (typeof body === 'string' ||
+        body instanceof ArrayBuffer ||
+        ArrayBuffer.isView(body) ||
+        body instanceof Blob ||
+        body instanceof FormData ||
+        body instanceof URLSearchParams ||
+        body instanceof ReadableStream)
+        return body;
+    return JSON.stringify(body);
+}
+//# sourceMappingURL=node.js.map

package/dist/proxy/Proxy.js

@@ -310,16 +310,22 @@ function withBasePath(basePath, path) {
     return `${trimmed}${path}`;
 }
 function getPaymentBinding(request) {
-    try {
-        const credential = Credential.fromRequest(request);
-        return {
-            intent: credential.challenge.intent,
-            method: credential.challenge.method,
-        };
-    }
-    catch {
-        return null;
+    for (const [, value] of request.headers) {
+        const payment = Credential.extractPaymentScheme(value);
+        if (!payment)
+            continue;
+        try {
+            const credential = Credential.deserialize(payment);
+            return {
+                intent: credential.challenge.intent,
+                method: credential.challenge.method,
+            };
+        }
+        catch {
+            // A malformed payment header is handled by the selected route.
+        }
     }
+    return null;
 }
 function matchesPaymentBinding(endpoint, binding) {
     if (endpoint === true)

package/dist/server/Mppx.d.ts

@@ -315,6 +315,8 @@ export declare namespace create {
         attestation?: transport extends Transport.Http ? Attestation.VerifierMap | undefined : never;
         /** Array of configured methods. @example [tempo()] */
         methods: methods;
+        /** Uses `Payment-Authorization` for Payment credentials so `Authorization` remains available for application authentication. */
+        requiresAuth?: transport extends Transport.Http ? boolean | undefined : never;
         /** Server realm (e.g., hostname). Resolution order: explicit value > env vars (`MPP_REALM`, `FLY_APP_NAME`, `VERCEL_URL`, etc.) > request URL hostname > `"MPP Payment"`. */
         realm?: string | undefined;
         /** Secret key for HMAC-bound challenge IDs for stateless verification. Must be at least 32 bytes. Auto-detected from `MPP_SECRET_KEY` environment variable. */

package/dist/server/Mppx.js

@@ -14,11 +14,10 @@ import * as z from '../zod.js';
 import * as Html from './internal/html/config.js';
 import { serviceWorker } from './internal/html/serviceWorker.gen.js';
 import * as Scope from './internal/scope.js';
+import * as SecretKey from './internal/SecretKey.js';
 import * as NodeListener from './NodeListener.js';
 import * as Request from './Request.js';
 import * as Transport from './Transport.js';
-const minimumSecretKeyBytes = 32;
-const secretKeyGenerationCommand = 'openssl rand -base64 32';
 const reservedMppxKeyValues = [
     'challenge',
     'compose',
@@ -52,11 +51,12 @@ export const reservedMppxKeys = new Set(reservedMppxKeyValues);
  * ```
  */
 export function create(config) {
-    const { attestation, realm = Env.get('realm'), selectOffers, secretKey = Env.get('secretKey'), transport = Transport.http(), } = config;
+    const { attestation, requiresAuth, realm = Env.get('realm'), selectOffers, secretKey = Env.get('secretKey'), transport = Transport.http({ requiresAuth }), } = config;
+    const credentialHeader = requiresAuth ? Constants.Headers.paymentAuthorization : undefined;
     if (!secretKey) {
         throw new Error('Missing secret key. Set the MPP_SECRET_KEY environment variable or pass `secretKey` to Mppx.create().');
     }
-    assertSecretKey(secretKey);
+    SecretKey.assert(secretKey);
     const methods = config.methods.flat();
     const serverEvents = createServerEventDispatcher();
     const verifyAttestation = attestation
@@ -83,6 +83,7 @@ export function create(config) {
         const fn = createMethodFn({
             ...(verifyAttestation && { attest: verifyAttestation }),
             authorize: mi.authorize,
+            credentialHeader,
             defaults: mi.defaults,
             method: mi,
             realm,
@@ -143,6 +144,7 @@ export function create(config) {
         if (!challengeHandlers[mi.name])
             challengeHandlers[mi.name] = {};
         challengeHandlers[mi.name][mi.alias ?? mi.intent] = createChallengeFn({
+            credentialHeader,
             defaults: mi.defaults,
             method: mi,
             realm,
@@ -235,6 +237,7 @@ export function create(config) {
                     credential: parsedCredential,
                     defaults: mi.defaults,
                     expires: credential.challenge.expires,
+                    header: credential.challenge.header,
                     meta: expectedMeta,
                     method: mi,
                     realm: expectedRealm,
@@ -375,15 +378,9 @@ export function create(config) {
         ...handlers,
     };
 }
-function assertSecretKey(secretKey) {
-    const byteLength = new TextEncoder().encode(secretKey).byteLength;
-    if (byteLength >= minimumSecretKeyBytes)
-        return;
-    throw new Error(`Secret key must be at least ${minimumSecretKeyBytes} bytes. Generate one with \`${secretKeyGenerationCommand}\` and set MPP_SECRET_KEY or pass it to Mppx.create().`);
-}
 // biome-ignore lint/correctness/noUnusedVariables: _
 function createMethodFn(parameters) {
-    const { attest, authorize, defaults, events, method, preflight, realm, respond, secretKey, broadcast, stableBinding, transport, validate, verify, } = parameters;
+    const { attest, authorize, credentialHeader, defaults, events, method, preflight, realm, respond, secretKey, broadcast, stableBinding, transport, validate, verify, } = parameters;
     return (options) => {
         const { description, meta, scope, ...rest } = options;
         const staticMeta = Scope.merge({ meta, scope });
@@ -491,6 +488,7 @@ function createMethodFn(parameters) {
                 defaults,
                 description,
                 expires,
+                header: credentialHeader,
                 meta: effectiveMeta,
                 method,
                 realm,
@@ -505,6 +503,7 @@ function createMethodFn(parameters) {
                     defaults: defaults ?? {},
                     description,
                     expires,
+                    header: credentialHeader,
                     meta: effectiveMeta,
                     method,
                     realm,
@@ -850,7 +849,7 @@ function createMethodFn(parameters) {
  * but returns a Challenge object directly instead of a request handler.
  */
 function createChallengeFn(parameters) {
-    const { defaults, method, realm, secretKey } = parameters;
+    const { credentialHeader, defaults, method, realm, secretKey } = parameters;
     return async (options) => {
         const { description, meta, scope, ...rest } = options;
         const effectiveMeta = Scope.merge({ meta, scope });
@@ -861,6 +860,7 @@ function createChallengeFn(parameters) {
             defaults,
             description,
             expires,
+            header: credentialHeader,
             meta: effectiveMeta,
             method,
             realm,
@@ -1163,6 +1163,7 @@ async function resolveRouteChallenge(parameters) {
     const challenge = Challenge.fromMethod(parameters.method, {
         description: parameters.description,
         expires: parameters.expires,
+        header: parameters.header,
         meta: parameters.meta,
         realm: effectiveRealm,
         request: request,
@@ -1178,6 +1179,7 @@ function createFallbackChallenge(parameters) {
     return Challenge.fromMethod(parameters.method, {
         description: parameters.description,
         expires: parameters.expires,
+        header: parameters.header,
         meta: parameters.meta,
         realm: parameters.realm ??
             (parameters.capturedRequest
@@ -1405,8 +1407,9 @@ function composeHandlers(handlers, composeOptions, selectOffers) {
         // Try to extract a Payment credential to decide whether to dispatch or challenge.
         // Only gate on the Payment scheme — other auth schemes (Bearer, Basic, etc.)
         // should fall through to the merged-402 path so all offers are presented.
-        const header = input.headers.get(Constants.Headers.authorization);
-        const paymentHeader = header ? Credential.extractPaymentScheme(header) : null;
+        const paymentHeader = Array.from(input.headers.values())
+            .map((value) => Credential.extractPaymentScheme(value))
+            .find((value) => value !== null);
         if (paymentHeader) {
             // Parse the credential to find method+intent for dispatch.
             let credential;

package/dist/server/Transport.d.ts

@@ -89,11 +89,17 @@ export declare function from<input = unknown, challengeOutput = unknown, receipt
 /**
  * HTTP transport for server-side payment handling.
  *
- * - Reads credentials from the `Authorization` header
+ * - Reads credentials from the configured payment credential header
  * - Issues challenges via `WWW-Authenticate` header with 402 status
  * - Attaches receipts via `Payment-Receipt` header
  */
-export declare function http(): Http;
+export declare function http(options?: http.Options): Http;
+export declare namespace http {
+    type Options = {
+        /** Uses `Payment-Authorization` for Payment credentials so `Authorization` remains available for application authentication. */
+        requiresAuth?: boolean | undefined;
+    };
+}
 /**
  * MCP transport for server-side payment handling with raw JSON-RPC.
  *

package/dist/server/Transport.js

@@ -29,11 +29,14 @@ export function from(transport) {
 /**
  * HTTP transport for server-side payment handling.
  *
- * - Reads credentials from the `Authorization` header
+ * - Reads credentials from the configured payment credential header
  * - Issues challenges via `WWW-Authenticate` header with 402 status
  * - Attaches receipts via `Payment-Receipt` header
  */
-export function http() {
+export function http(options = {}) {
+    const credentialHeader = options.requiresAuth
+        ? Constants.Headers.paymentAuthorization
+        : Constants.Headers.authorization;
     return from({
         name: 'http',
         captureRequest(request) {
@@ -45,7 +48,7 @@ export function http() {
             };
         },
         getCredential(request) {
-            const header = request.headers.get(Constants.Headers.authorization);
+            const header = request.headers.get(credentialHeader);
             if (!header)
                 return null;
             const payment = Credential.extractPaymentScheme(header);

package/dist/server/internal/SecretKey.d.ts

@@ -0,0 +1,3 @@
+/** Validates the minimum entropy required for HMAC-bound payment challenges. */
+export declare function assert(secretKey: string): void;
+//# sourceMappingURL=SecretKey.d.ts.map

package/dist/server/internal/SecretKey.js

@@ -0,0 +1,9 @@
+const minimumBytes = 32;
+const generationCommand = 'openssl rand -base64 32';
+/** Validates the minimum entropy required for HMAC-bound payment challenges. */
+export function assert(secretKey) {
+    if (new TextEncoder().encode(secretKey).byteLength >= minimumBytes)
+        return;
+    throw new Error(`Secret key must be at least ${minimumBytes} bytes. Generate one with \`${generationCommand}\` and set MPP_SECRET_KEY or pass it to Mppx.create().`);
+}
+//# sourceMappingURL=SecretKey.js.map

package/dist/server/internal/html/serviceWorker.client.d.ts

@@ -1,2 +1,2 @@
-export declare function submitCredential(credential: string): Promise<void>;
+export declare function submitCredential(credential: string, header?: string): Promise<void>;
 //# sourceMappingURL=serviceWorker.client.d.ts.map

package/dist/server/internal/html/serviceWorker.client.js

@@ -1,5 +1,5 @@
 import { params } from './constants.js';
-export async function submitCredential(credential) {
+export async function submitCredential(credential, header = 'Authorization') {
     const url = new URL(location.href);
     url.searchParams.set(params.serviceWorker, '');
     const registration = await navigator.serviceWorker.register(url.pathname + url.search);
@@ -19,7 +19,7 @@ export async function submitCredential(credential) {
     await new Promise((resolve) => {
         const channel = new MessageChannel();
         channel.port1.onmessage = () => resolve();
-        serviceWorker.postMessage({ credential }, [channel.port2]);
+        serviceWorker.postMessage({ credential, header }, [channel.port2]);
     });
     location.reload();
 }

package/dist/server/internal/html/serviceWorker.gen.d.ts

@@ -1,2 +1,2 @@
-export declare const serviceWorker = "(function(){let e=self,t;e.addEventListener(`activate`,t=>{t.waitUntil(e.clients.claim())}),e.addEventListener(`message`,e=>{if(!e.source)return;let n=e.data?.credential;typeof n!=`string`||!n.startsWith(`Payment `)||(t=n,e.ports[0]?.postMessage(`ack`))}),e.addEventListener(`fetch`,n=>{if(!t||n.request.mode!==`navigate`||new URL(n.request.url).origin!==e.location.origin)return;let r=new Headers(n.request.headers);r.set(`Authorization`,t),t=void 0,n.respondWith(fetch(n.request,{headers:r})),e.registration.unregister()})})();";
+export declare const serviceWorker = "(function(){let e=self,t,n=`Authorization`;e.addEventListener(`activate`,t=>{t.waitUntil(e.clients.claim())}),e.addEventListener(`message`,e=>{if(!e.source)return;let r=e.data?.credential;typeof r!=`string`||!r.startsWith(`Payment `)||(t=r,typeof e.data?.header==`string`&&(n=e.data.header),e.ports[0]?.postMessage(`ack`))}),e.addEventListener(`fetch`,r=>{if(!t||r.request.mode!==`navigate`||new URL(r.request.url).origin!==e.location.origin)return;let i=new Headers(r.request.headers);i.set(n,t),t=void 0,r.respondWith(fetch(r.request,{headers:i})),e.registration.unregister()})})();";
 //# sourceMappingURL=serviceWorker.gen.d.ts.map

package/dist/server/internal/html/serviceWorker.gen.js

@@ -1,3 +1,3 @@
 // Generated — do not edit.
-export const serviceWorker = "(function(){let e=self,t;e.addEventListener(`activate`,t=>{t.waitUntil(e.clients.claim())}),e.addEventListener(`message`,e=>{if(!e.source)return;let n=e.data?.credential;typeof n!=`string`||!n.startsWith(`Payment `)||(t=n,e.ports[0]?.postMessage(`ack`))}),e.addEventListener(`fetch`,n=>{if(!t||n.request.mode!==`navigate`||new URL(n.request.url).origin!==e.location.origin)return;let r=new Headers(n.request.headers);r.set(`Authorization`,t),t=void 0,n.respondWith(fetch(n.request,{headers:r})),e.registration.unregister()})})();";
+export const serviceWorker = "(function(){let e=self,t,n=`Authorization`;e.addEventListener(`activate`,t=>{t.waitUntil(e.clients.claim())}),e.addEventListener(`message`,e=>{if(!e.source)return;let r=e.data?.credential;typeof r!=`string`||!r.startsWith(`Payment `)||(t=r,typeof e.data?.header==`string`&&(n=e.data.header),e.ports[0]?.postMessage(`ack`))}),e.addEventListener(`fetch`,r=>{if(!t||r.request.mode!==`navigate`||new URL(r.request.url).origin!==e.location.origin)return;let i=new Headers(r.request.headers);i.set(n,t),t=void 0,r.respondWith(fetch(r.request,{headers:i})),e.registration.unregister()})})();";
 //# sourceMappingURL=serviceWorker.gen.js.map