mppx 0.10.1 → 0.12.0

package/dist/tempo/session/server/ChannelStore.d.ts

@@ -189,6 +189,8 @@ export type VerifyAndAcceptVoucherParameters = {
     methodDetails: SessionMethodDetails;
     /** Minimum allowed voucher delta in raw units. */
     minVoucherDelta: bigint;
+    /** Whether this presentation must advance the accepted voucher. */
+    requireAdvance?: boolean | undefined;
     /** Server channel store. */
     store: ChannelStore;
     /** Signed cumulative voucher to verify and accept. */

package/dist/tempo/session/server/ChannelStore.js

@@ -224,9 +224,11 @@ export async function validateVoucher(parameters) {
 }
 /** Verifies a cumulative voucher and returns a session receipt after store reconciliation. */
 export async function verifyAndAcceptVoucher(parameters) {
-    const { store, challenge, channel, voucher, channelState } = parameters;
+    const { store, challenge, channel, voucher, channelState, requireAdvance } = parameters;
     const validation = await validateVoucher(parameters);
-    if (validation.alreadyAccepted)
+    if (validation.alreadyAccepted) {
+        if (requireAdvance)
+            throw new DeltaTooSmallError({ reason: 'voucher does not add new funds for this request' });
         return createSessionReceipt({
             challengeId: challenge.id,
             channelId: voucher.channelId,
@@ -234,7 +236,14 @@ export async function verifyAndAcceptVoucher(parameters) {
             spent: channel.spent,
             units: channel.units,
         });
-    const updated = await store.updateChannel(voucher.channelId, (current) => acceptVoucherStateUpdate({ channelState, current, voucher }));
+    }
+    const updated = await store.updateChannel(voucher.channelId, (current) => {
+        if (requireAdvance &&
+            current !== null &&
+            voucher.cumulativeAmount <= current.highestVoucherAmount)
+            throw new DeltaTooSmallError({ reason: 'voucher does not add new funds for this request' });
+        return acceptVoucherStateUpdate({ channelState, current, voucher });
+    });
     if (!updated)
         throw new ChannelNotFoundError({ reason: 'channel not found' });
     return createSessionReceipt({

package/dist/tempo/session/server/CredentialVerification.d.ts

@@ -79,6 +79,8 @@ export type BroadcastCredentialPayloadParameters = {
     onSessionSettlement?: OnSessionSettlement | undefined;
     /** Discriminated session credential payload to verify. */
     payload: SessionCredentialPayload;
+    /** Whether an open or voucher credential must add new funds for this request. */
+    requireVoucherAdvance?: boolean | undefined;
     /** Server-side channel store. */
     store: ChannelStore.ChannelStore;
 };

package/dist/tempo/session/server/CredentialVerification.js

@@ -1,5 +1,5 @@
 import { isAddress, isAddressEqual, zeroAddress, } from 'viem';
-import { AmountExceedsDepositError, ChannelClosedError, ChannelNotFoundError, InsufficientBalanceError, InvalidSignatureError, VerificationFailedError, } from '../../../Errors.js';
+import { AmountExceedsDepositError, ChannelClosedError, ChannelNotFoundError, DeltaTooSmallError, InsufficientBalanceError, InvalidSignatureError, VerificationFailedError, } from '../../../Errors.js';
 import * as Chain from '../precompile/Chain.js';
 import { readChannelClosedReceiptFields } from '../precompile/Chain.js';
 import * as Channel from '../precompile/Channel.js';
@@ -513,18 +513,26 @@ async function handleOpenCredential(parameters) {
     const { descriptor, state } = result;
     assertSameDescriptor(descriptor, payload.descriptor);
     validateChannelState(state, request.amount);
-    const updated = await store.updateChannel(channelId, (current) => ChannelStore.openChannelState({
-        authorizedSigner: authorizedSigner(descriptor),
-        chainId,
-        channelId,
-        current,
-        descriptor,
-        escrow,
-        expiringNonceHash: result.expiringNonceHash,
-        cumulativeAmount,
-        signature: payload.signature,
-        state,
-    }));
+    const updated = await store.updateChannel(channelId, (current) => {
+        if (parameters.requireVoucherAdvance &&
+            current !== null &&
+            cumulativeAmount <= current.highestVoucherAmount)
+            throw new DeltaTooSmallError({
+                reason: 'voucher does not add new funds for this request',
+            });
+        return ChannelStore.openChannelState({
+            authorizedSigner: authorizedSigner(descriptor),
+            chainId,
+            channelId,
+            current,
+            descriptor,
+            escrow,
+            expiringNonceHash: result.expiringNonceHash,
+            cumulativeAmount,
+            signature: payload.signature,
+            state,
+        });
+    });
     if (!updated)
         throw new VerificationFailedError({ reason: 'failed to create channel' });
     return createSessionReceipt({
@@ -618,6 +626,7 @@ async function handleVoucherCredential(parameters) {
     return ChannelStore.verifyAndAcceptVoucher({
         store,
         minVoucherDelta,
+        requireAdvance: parameters.requireVoucherAdvance,
         challenge,
         channel,
         voucher,

package/dist/tempo/session/server/RequestState.d.ts

@@ -18,6 +18,10 @@ export type ResolveSessionSnapshotParameters = {
     channelId: Hex | undefined;
     /** Payment fields the reusable channel must match before it is advertised. */
     expected?: SessionSnapshotPaymentFields | undefined;
+    /** Minimum raw-unit increase required when the next voucher must advance. */
+    minimumVoucherAdvance?: bigint | undefined;
+    /** Whether the next voucher must advance beyond the accepted cumulative amount. */
+    requireVoucherAdvance?: boolean | undefined;
     /** Server channel store. */
     store: ChannelStore.ChannelStore;
 };
@@ -149,12 +153,14 @@ export type ResolveSessionPaymentRequestParameters = {
     decimals: number;
     defaultFeePayer?: viem_Account | undefined;
     getClient: ResolveRequestChainIdParameters['getClient'];
+    minVoucherDelta?: string | undefined;
     parameterChainId?: number | undefined;
     parameterEscrowContract?: Address | undefined;
     parameterFeePayer?: ParameterFeePayer;
     request: SessionPaymentRequestInput;
     resolveChannelId?: ResolveSessionChannelId | undefined;
     source?: string | undefined;
+    sseEnabled?: boolean | undefined;
     store: ChannelStore.ChannelStore;
 };
 /** Inputs used to resolve shared context for credential verification. */

package/dist/tempo/session/server/RequestState.js

@@ -47,7 +47,7 @@ export async function resolveSessionChannelId(parameters) {
 }
 /** Builds server bootstrap hints for a reusable precompile session channel. */
 export async function resolveSessionSnapshot(parameters) {
-    const { amount, channelId, expected, store } = parameters;
+    const { amount, channelId, expected, minimumVoucherAdvance = 0n, requireVoucherAdvance = false, store, } = parameters;
     if (!channelId)
         return undefined;
     const channel = await store.getChannel(ChannelStore.normalizeChannelId(channelId));
@@ -63,7 +63,11 @@ export async function resolveSessionSnapshot(parameters) {
         return undefined;
     if (expected && !matchesSnapshotPaymentFields(channel, expected))
         return undefined;
-    const requiredCumulative = channel.spent + amount;
+    const spendBoundary = channel.spent + amount;
+    const advanceBoundary = requireVoucherAdvance
+        ? channel.highestVoucherAmount + (minimumVoucherAdvance > 0n ? minimumVoucherAdvance : 1n)
+        : 0n;
+    const requiredCumulative = spendBoundary > advanceBoundary ? spendBoundary : advanceBoundary;
     return {
         acceptedCumulative: channel.highestVoucherAmount.toString(),
         chainId: channel.chainId,
@@ -158,7 +162,7 @@ export async function resolveRequestChainId(parameters) {
 }
 /** Resolves request-time TIP-1034 details and server bootstrap hints for a challenge. */
 export async function resolveSessionPaymentRequest(parameters) {
-    const { capturedRequest, credential, decimals, defaultFeePayer, getClient, parameterChainId, parameterEscrowContract, parameterFeePayer, request, resolveChannelId, source, store, } = parameters;
+    const { capturedRequest, credential, decimals, defaultFeePayer, getClient, minVoucherDelta, parameterChainId, parameterEscrowContract, parameterFeePayer, request, resolveChannelId, source, sseEnabled, store, } = parameters;
     const chainId = await resolveRequestChainId({
         getClient,
         parameterChainId,
@@ -172,6 +176,7 @@ export async function resolveSessionPaymentRequest(parameters) {
     const escrowContract = resolveRequestEscrowContract(request.escrowContract, parameterEscrowContract);
     const operator = resolveRequestOperator(request.operator);
     const requestAmount = parseUnits(request.amount, decimals);
+    const isContentRequest = capturedRequest ? isSessionContentRequest(capturedRequest) : false;
     const channelId = await resolveSessionChannelId({
         capturedRequest,
         credential,
@@ -181,7 +186,7 @@ export async function resolveSessionPaymentRequest(parameters) {
         store,
     });
     const sessionSnapshot = await resolveSessionSnapshot({
-        amount: capturedRequest && !isSessionContentRequest(capturedRequest) ? 0n : requestAmount,
+        amount: capturedRequest && !isContentRequest ? 0n : requestAmount,
         channelId,
         expected: {
             chainId,
@@ -189,6 +194,8 @@ export async function resolveSessionPaymentRequest(parameters) {
             escrowContract,
             recipient: readChallengeAddress(request.recipient, 'recipient'),
         },
+        minimumVoucherAdvance: parseUnits(minVoucherDelta ?? '0', decimals),
+        requireVoucherAdvance: Boolean(capturedRequest) && !sseEnabled && isContentRequest,
         store,
     });
     const { operator: _operator, ...requestWithoutOperator } = request;

package/dist/tempo/session/server/Session.js

@@ -26,7 +26,7 @@ import { broadcastCredentialPayload, validateCredentialPayload } from './Credent
 import { requireSessionCredentialPayload } from './CredentialVerification.js';
 import { resolveCredentialVerificationContext, resolveSessionChannelId, resolveSessionSnapshot, resolveSessionPaymentRequest, } from './RequestState.js';
 import { respondToSessionCredential } from './RequestState.js';
-import { applyVerifiedHttpAccounting, chargeSessionChannel, } from './Settlement.js';
+import { applyVerifiedHttpAccounting, chargeSessionChannel, shouldApplyVerifiedHttpAccounting, } from './Settlement.js';
 import { isSettlementDue, maybeSettleScheduled } from './Settlement.js';
 import { resolveSettlementSchedule, } from './Settlement.js';
 import * as Ws from './Ws.js';
@@ -305,6 +305,11 @@ export function session(p) {
             minVoucherDelta: context.minVoucherDelta,
             onSessionSettlement,
             payload,
+            requireVoucherAdvance: shouldApplyVerifiedHttpAccounting({
+                capturedRequest: envelope?.capturedRequest,
+                payloadAction: payload.action,
+                sseEnabled: Boolean(parameters.sse),
+            }),
             store,
         });
         return applyVerifiedHttpAccounting({
@@ -372,11 +377,13 @@ export function session(p) {
                 decimals,
                 defaultFeePayer: feePayer,
                 getClient,
+                minVoucherDelta: parameters.minVoucherDelta,
                 parameterChainId: parameters.chainId,
                 parameterEscrowContract: parameters.escrowContract,
                 parameterFeePayer: configuredFeePayer,
                 request,
                 resolveChannelId: parameters.resolveChannelId,
+                sseEnabled: Boolean(parameters.sse),
                 store,
             });
             return {

package/dist/tempo/session/server/Settlement.d.ts

@@ -138,6 +138,8 @@ export type ApplyVerifiedHttpAccountingParameters = {
     /** Runs optional server settlement policy after a successful content charge. */
     settleCharged: SettleChargedSessionChannel;
 };
+/** Returns whether an accepted credential will authorize and charge an HTTP content response. */
+export declare function shouldApplyVerifiedHttpAccounting(parameters: Pick<ApplyVerifiedHttpAccountingParameters, 'capturedRequest' | 'payloadAction' | 'sseEnabled'>): boolean;
 /** Applies the default HTTP content charge after a session credential has been accepted. */
 export declare function applyVerifiedHttpAccounting(parameters: ApplyVerifiedHttpAccountingParameters): Promise<SessionReceipt>;
 /** Atomically deducts spend from a channel and maps store failures to typed session errors. */

package/dist/tempo/session/server/Settlement.js

@@ -46,7 +46,7 @@ export function resolveCredentialFeePayer(parameters) {
         return requestFeePayer;
     if (typeof feePayer === 'object')
         return feePayer;
-    return typeof feePayer === 'string' ? true : undefined;
+    return feePayer === true || typeof feePayer === 'string' ? true : undefined;
 }
 /** Converts a public settlement schedule into raw-unit thresholds. */
 export function resolveSettlementSchedule(schedule, decimals) {
@@ -113,16 +113,21 @@ export async function markSettlementComplete(parameters) {
         }
         : current);
 }
-/** Applies the default HTTP content charge after a session credential has been accepted. */
-export async function applyVerifiedHttpAccounting(parameters) {
-    const { capturedRequest, payloadAction, receipt, sseEnabled } = parameters;
+/** Returns whether an accepted credential will authorize and charge an HTTP content response. */
+export function shouldApplyVerifiedHttpAccounting(parameters) {
+    const { capturedRequest, payloadAction, sseEnabled } = parameters;
     if (!capturedRequest)
-        return receipt;
+        return false;
     if (payloadAction !== 'open' && payloadAction !== 'voucher')
-        return receipt;
+        return false;
     if (sseEnabled && capturedRequest.method === 'POST')
-        return receipt;
-    if (!isSessionContentRequest(capturedRequest))
+        return false;
+    return isSessionContentRequest(capturedRequest);
+}
+/** Applies the default HTTP content charge after a session credential has been accepted. */
+export async function applyVerifiedHttpAccounting(parameters) {
+    const { receipt, sseEnabled } = parameters;
+    if (!shouldApplyVerifiedHttpAccounting(parameters))
         return receipt;
     const requestAmount = parameters.getRequestAmount();
     const charged = await parameters.charge(receipt.channelId, requestAmount);

package/dist/tempo/subscription/KeyAuthorization.d.ts

@@ -74,7 +74,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
         };
         type: 'p256';
         account?: undefined;
-        init?: undefined;
+        config?: undefined;
         inner?: undefined;
         keyId?: undefined;
         metadata?: undefined;
@@ -89,7 +89,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
         };
         type: 'secp256k1';
         account?: undefined;
-        init?: undefined;
+        config?: undefined;
         inner?: undefined;
         keyId?: undefined;
         metadata?: undefined;
@@ -103,25 +103,87 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
             authenticatorData: Hex.Hex;
             clientDataJSON: string;
         };
-        signature: {
-            r: bigint;
-            s: bigint;
-            yParity?: number | undefined;
-        };
         publicKey: {
             prefix: number;
             x: bigint;
             y: bigint;
         };
+        signature: {
+            r: bigint;
+            s: bigint;
+            yParity?: number | undefined;
+        };
         type: 'webAuthn';
         account?: undefined;
-        init?: undefined;
+        config?: undefined;
         inner?: undefined;
         keyId?: undefined;
         prehash?: undefined;
         signatures?: undefined;
         userAddress?: undefined;
         version?: undefined;
+    } | {
+        account: import("ox/Address").Address;
+        config: {
+            owners: readonly {
+                owner: import("ox/Address").Address;
+                weight: number;
+            }[];
+            salt: Hex.Hex;
+            threshold: number;
+            version: bigint;
+        };
+        signatures: readonly ({
+            prehash: boolean;
+            publicKey: {
+                prefix: number;
+                x: bigint;
+                y: bigint;
+            };
+            signature: {
+                r: bigint;
+                s: bigint;
+                yParity?: number | undefined;
+            };
+            type: 'p256';
+            metadata?: undefined;
+        } | {
+            signature: {
+                r: bigint;
+                s: bigint;
+                yParity: number;
+            };
+            type: 'secp256k1';
+            metadata?: undefined;
+            prehash?: undefined;
+            publicKey?: undefined;
+        } | {
+            metadata: {
+                authenticatorData: Hex.Hex;
+                clientDataJSON: string;
+            };
+            publicKey: {
+                prefix: number;
+                x: bigint;
+                y: bigint;
+            };
+            signature: {
+                r: bigint;
+                s: bigint;
+                yParity?: number | undefined;
+            };
+            type: 'webAuthn';
+            prehash?: undefined;
+        })[];
+        type: 'multisig';
+        inner?: undefined;
+        keyId?: undefined;
+        metadata?: undefined;
+        prehash?: undefined;
+        publicKey?: undefined;
+        signature?: undefined;
+        userAddress?: undefined;
+        version?: undefined;
     };
     readonly address: `0x${string}`;
     readonly chainId: bigint;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",
@@ -167,7 +167,7 @@
     "express": ">=5",
     "hono": ">=4.12.25",
     "next": ">=16.2.6",
-    "viem": ">=2.54.0"
+    "viem": ">=2.57.1"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -204,7 +204,7 @@
   "dependencies": {
     "@stripe/stripe-js": "9.13.0",
     "eventsource-parser": "3.1.1",
-    "ox": "0.14.33",
+    "ox": "0.14.45",
     "structured-headers": "2.0.3",
     "zod": "^4.4.3"
   },

package/dist/tempo/Tokens.d.ts

@@ -1,13 +0,0 @@
-import { defineToken } from 'viem/tokens';
-/** MACH token metadata and deployed addresses. */
-export declare const mach: defineToken.ReturnType<{
-    readonly addresses: {
-        readonly 4217: "0x20c000000000000000000000f37de3740ADec032";
-        readonly 42431: "0x20c000000000000000000000f37de3740ADec032";
-    };
-    readonly currency: "USD";
-    readonly decimals: 6;
-    readonly name: "MACH";
-    readonly symbol: "MACH";
-}>;
-//# sourceMappingURL=Tokens.d.ts.map

package/dist/tempo/Tokens.js

@@ -1,13 +0,0 @@
-import { defineToken } from 'viem/tokens';
-/** MACH token metadata and deployed addresses. */
-export const mach = defineToken({
-    addresses: {
-        4217: '0x20c000000000000000000000f37de3740ADec032',
-        42431: '0x20c000000000000000000000f37de3740ADec032',
-    },
-    currency: 'USD',
-    decimals: 6,
-    name: 'MACH',
-    symbol: 'MACH',
-});
-//# sourceMappingURL=Tokens.js.map