Bind subscriptions to signed payer source

[brendanjryan]

Summary

• Added credential-required Tempo subscription reuse that verifies the recovered payer against stored subscription state
• Added signed-source subscription lookup support so lookup keys can be derived after credential verification
• Updated the subscription example to remove user-controlled identity headers

Motivation

Subscription reuse should be able to follow the same trust model as sessions: request metadata can route a challenge, but reusable paid state should be resolved from verified payer identity when configured.

Key design considerations

• requireCredential disables no-credential reuse and forces a signed proof for active subscription access
• Source-derived lookup keeps the first challenge unbound, then resolves the subscription key after keyAuthorization verification
• Access keys can be recovered by public access-key address so automatic activation can settle source-derived subscriptions

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@578

commit: a879b25