mppx 0.10.1 → 0.12.0

package/dist/cli/validate/payment.js

@@ -1,5 +1,5 @@
 import * as childProcess from 'node:child_process';
-import { createClient, erc20Abi, http } from 'viem';
+import { createClient, erc20Abi, http, isAddress, zeroAddress, } from 'viem';
 import { privateKeyToAccount, generatePrivateKey } from 'viem/accounts';
 import { readContract, waitForTransactionReceipt } from 'viem/actions';
 import * as viemChains from 'viem/chains';
@@ -24,6 +24,16 @@ async function provisionAndPayTestnet(challenge, verbose, silent) {
         const key = generatePrivateKey();
         const account = privateKeyToAccount(key);
         const client = createClient({ chain: tempoModerato, transport: http() });
+        if (isTempoSessionChallenge(challenge)) {
+            const { chainId, operator } = challenge.request.methodDetails ?? {};
+            if (chainId === tempoModerato.id &&
+                typeof operator === 'string' &&
+                isAddress(operator) &&
+                operator !== zeroAddress) {
+                const hashes = await Actions.faucet.fund(client, { account: operator });
+                await Promise.all(hashes.map((hash) => waitForTransactionReceipt(client, { hash })));
+            }
+        }
         const hashes = await Actions.faucet.fund(client, { account });
         await Promise.all(hashes.map((hash) => waitForTransactionReceipt(client, { hash })));
         if (!silent)
@@ -166,18 +176,25 @@ export async function validatePaymentFlow(baseUrl, endpoint, verbose, options) {
     if (tempoTestnetChallenge) {
         const provisioned = await provisionAndPayTestnet(tempoTestnetChallenge, verbose, options.silent);
         if (provisioned) {
-            const fakeResp = new Response(null, {
-                status: 402,
-                headers: {
-                    [Constants.Headers.wwwAuthenticate]: Challenge.serialize(tempoTestnetChallenge),
-                },
-            });
             try {
-                const mppx = Mppx.create({ methods: provisioned.methods, polyfill: false });
-                const credentialContext = await preparePayment(tempoTestnetChallenge, loaded?.config.extensions);
-                const cred = await mppx.createCredential(fakeResp, credentialContext);
-                results.push(check('Payment: submitted', 'ephemeral testnet wallet'));
-                await sendAndValidateResponse(results, url, endpoint, cred, fetchHeaders, fetchBody, verbose, tempoModerato, Challenge.credentialHeader(tempoTestnetChallenge));
+                const mppx = Mppx.create({
+                    methods: provisioned.methods,
+                    polyfill: false,
+                    async onChallenge(challenge, { createCredential }) {
+                        assertSamePaymentRequest(tempoTestnetChallenge, challenge);
+                        const context = await preparePayment(challenge, loaded?.config.extensions);
+                        const credential = await createCredential(context);
+                        results.push(check('Payment: submitted', 'ephemeral testnet wallet'));
+                        return credential;
+                    },
+                    fetch: (input, init) => fetchWithTimeout(input, init ?? {}, 30_000),
+                });
+                const response = await mppx.fetch(url, {
+                    method: endpoint.method,
+                    headers: fetchHeaders,
+                    body: fetchBody ?? null,
+                });
+                await validatePaymentResponse(results, response, verbose, tempoModerato);
             }
             catch (error) {
                 results.push(fail('Payment: create credential', error.message));

package/dist/client/internal/protocols/X402.js

@@ -17,8 +17,6 @@ export function x402() {
             if (!header)
                 return [];
             const paymentRequired = x402_Header.decodePaymentRequiredEnvelope(header);
-            if (response.url && paymentRequired.resource.url !== response.url)
-                throw new Error('x402 payment-required resource does not match response URL.');
             return paymentRequired.accepts.flatMap((rawAccepted, index) => {
                 const parsed = x402_Types.PaymentRequirementsSchema.safeParse(rawAccepted);
                 if (!parsed.success)

package/dist/evm/server/Methods.d.ts

@@ -2,8 +2,158 @@ import type { NoExtraKeys } from '../../internal/types.js';
 import * as Assets from '../Assets.js';
 import * as Chains from '../Chains.js';
 import { charge as charge_ } from './Charge.js';
-/** Creates EVM server methods from shared charge parameters. */
-export declare function evm<const parameters extends evm.Parameters>(parameters: NoExtraKeys<parameters, evm.Parameters>): readonly [import("../../Method.js").Server<{
+/**
+ * Creates ordered EVM charge offers from shared parameters.
+ *
+ * Pass `currencies: [token]` for one asset or an ordered list for multiple assets.
+ * Viem token definitions resolve against `chainId`; known assets carry their own
+ * network. Unsupported chain entries are skipped and duplicate chain/address
+ * pairs are removed. An empty resolved list throws.
+ *
+ * Token definitions need explicit EIP-3009 domain metadata. Use
+ * `evm.assets.fromToken(token, { chainId, transfer })` for per-token domains.
+ * A token registry entry alone does not establish EIP-3009 support.
+ *
+ * @example
+ * ```ts
+ * import { evm } from 'mppx/server'
+ *
+ * evm({
+ *   currencies: [evm.assets.base.USDC],
+ *   recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
+ *   settle: async ({ payload }) => settleAuthorization(payload),
+ * })
+ * ```
+ */
+export declare function evm<const parameters extends evm.Parameters>(parameters: NoExtraKeys<parameters, evm.Parameters>): [import("../../Method.js").Server<{
+    readonly name: "evm";
+    readonly intent: "charge";
+    readonly schema: {
+        credential: {
+            payload: import("zod/mini").ZodMiniObject<{
+                from: import("zod/mini").ZodMiniString<string>;
+                nonce: import("zod/mini").ZodMiniString<string>;
+                signature: import("zod/mini").ZodMiniString<string>;
+                to: import("zod/mini").ZodMiniString<string>;
+                type: import("zod/mini").ZodMiniLiteral<"authorization">;
+                validAfter: import("zod/mini").ZodMiniString<string>;
+                validBefore: import("zod/mini").ZodMiniString<string>;
+                value: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>;
+        };
+        request: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniObject<{
+            amount: import("zod/mini").ZodMiniString<string>;
+            chainId: import("zod/mini").ZodMiniNumber<number>;
+            currency: import("zod/mini").ZodMiniString<string>;
+            credentialTypes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniEnum<{
+                authorization: "authorization";
+            }>>>;
+            decimals: import("zod/mini").ZodMiniNumber<number>;
+            description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            externalId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            permit2Address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            recipient: import("zod/mini").ZodMiniString<string>;
+            splits: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+                amount: import("zod/mini").ZodMiniString<string>;
+                recipient: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>>>;
+        }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniTransform<{
+            description?: string | undefined;
+            externalId?: string | undefined;
+            amount: string;
+            currency: `0x${string}`;
+            methodDetails: {
+                chainId: number;
+                credentialTypes: string[];
+                decimals: number;
+                permit2Address?: `0x${string}` | undefined;
+                splits?: {
+                    amount: string;
+                    recipient: string;
+                }[] | undefined;
+            };
+            recipient: `0x${string}`;
+        }, {
+            amount: string;
+            chainId: number;
+            currency: string;
+            credentialTypes?: "authorization"[] | undefined;
+            decimals: number;
+            description?: string | undefined;
+            externalId?: string | undefined;
+            permit2Address?: string | undefined;
+            recipient: string;
+            splits?: {
+                amount: string;
+                recipient: string;
+            }[] | undefined;
+        }>>;
+    };
+}, charge_.Defaults, import("../../server/Transport.js").Http, {}, string | undefined>, ...import("../../Method.js").Server<{
+    readonly name: "evm";
+    readonly intent: "charge";
+    readonly schema: {
+        credential: {
+            payload: import("zod/mini").ZodMiniObject<{
+                from: import("zod/mini").ZodMiniString<string>;
+                nonce: import("zod/mini").ZodMiniString<string>;
+                signature: import("zod/mini").ZodMiniString<string>;
+                to: import("zod/mini").ZodMiniString<string>;
+                type: import("zod/mini").ZodMiniLiteral<"authorization">;
+                validAfter: import("zod/mini").ZodMiniString<string>;
+                validBefore: import("zod/mini").ZodMiniString<string>;
+                value: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>;
+        };
+        request: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniObject<{
+            amount: import("zod/mini").ZodMiniString<string>;
+            chainId: import("zod/mini").ZodMiniNumber<number>;
+            currency: import("zod/mini").ZodMiniString<string>;
+            credentialTypes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniEnum<{
+                authorization: "authorization";
+            }>>>;
+            decimals: import("zod/mini").ZodMiniNumber<number>;
+            description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            externalId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            permit2Address: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+            recipient: import("zod/mini").ZodMiniString<string>;
+            splits: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+                amount: import("zod/mini").ZodMiniString<string>;
+                recipient: import("zod/mini").ZodMiniString<string>;
+            }, import("zod/v4/core").$strip>>>;
+        }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniTransform<{
+            description?: string | undefined;
+            externalId?: string | undefined;
+            amount: string;
+            currency: `0x${string}`;
+            methodDetails: {
+                chainId: number;
+                credentialTypes: string[];
+                decimals: number;
+                permit2Address?: `0x${string}` | undefined;
+                splits?: {
+                    amount: string;
+                    recipient: string;
+                }[] | undefined;
+            };
+            recipient: `0x${string}`;
+        }, {
+            amount: string;
+            chainId: number;
+            currency: string;
+            credentialTypes?: "authorization"[] | undefined;
+            decimals: number;
+            description?: string | undefined;
+            externalId?: string | undefined;
+            permit2Address?: string | undefined;
+            recipient: string;
+            splits?: {
+                amount: string;
+                recipient: string;
+            }[] | undefined;
+        }>>;
+    };
+}, charge_.Defaults, import("../../server/Transport.js").Http, {}, string | undefined>[]] | readonly [import("../../Method.js").Server<{
     readonly name: "evm";
     readonly intent: "charge";
     readonly schema: {
@@ -69,7 +219,18 @@ export declare function evm<const parameters extends evm.Parameters>(parameters:
     };
 }, charge_.Defaults, import("../../server/Transport.js").Http, {}, string | undefined>];
 export declare namespace evm {
-    type Parameters = charge_.Parameters;
+    /** Accepted EVM currency metadata, including chain-indexed definitions from `viem/tokens`. */
+    type Currency = Assets.Currency;
+    /** Shared EVM settlement parameters and ordered accepted currencies. */
+    type Parameters = Omit<charge_.Parameters, 'currency'> & ({
+        /** Ordered accepted currencies. A one-element list accepts a single asset. */
+        currencies: readonly Currency[];
+        currency?: undefined;
+    } | {
+        /** @deprecated Use `currencies: [currency]` instead. */
+        currency: Currency;
+        currencies?: undefined;
+    });
     /** Creates an EVM `charge` server method. */
     const charge: typeof charge_;
     /** Known EVM asset metadata for public config. */

package/dist/evm/server/Methods.js

@@ -1,9 +1,57 @@
 import * as Assets from '../Assets.js';
 import * as Chains from '../Chains.js';
 import { charge as charge_ } from './Charge.js';
-/** Creates EVM server methods from shared charge parameters. */
+/**
+ * Creates ordered EVM charge offers from shared parameters.
+ *
+ * Pass `currencies: [token]` for one asset or an ordered list for multiple assets.
+ * Viem token definitions resolve against `chainId`; known assets carry their own
+ * network. Unsupported chain entries are skipped and duplicate chain/address
+ * pairs are removed. An empty resolved list throws.
+ *
+ * Token definitions need explicit EIP-3009 domain metadata. Use
+ * `evm.assets.fromToken(token, { chainId, transfer })` for per-token domains.
+ * A token registry entry alone does not establish EIP-3009 support.
+ *
+ * @example
+ * ```ts
+ * import { evm } from 'mppx/server'
+ *
+ * evm({
+ *   currencies: [evm.assets.base.USDC],
+ *   recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
+ *   settle: async ({ payload }) => settleAuthorization(payload),
+ * })
+ * ```
+ */
 export function evm(parameters) {
-    return [evm.charge(parameters)];
+    if (parameters.currency !== undefined) {
+        if (parameters.currencies !== undefined)
+            throw new Error('Specify either `currency` or `currencies`, not both.');
+        return [evm.charge(parameters)];
+    }
+    const { currencies, ...shared } = parameters;
+    const seen = new Set();
+    const methods = [];
+    for (const currency of currencies) {
+        const chainId = shared.chainId ?? (Assets.isAsset(currency) ? Assets.toChainId(currency.network) : undefined);
+        if (chainId === undefined)
+            throw new Error('EVM currencies require `chainId` or known asset metadata.');
+        const resolved = Assets.resolve(currency, Assets.toNetwork(chainId));
+        if (!resolved)
+            continue;
+        // One shared price cannot price non-USD or unknown-denomination token definitions.
+        if (Assets.isToken(currency) && currency.currency !== 'USD')
+            continue;
+        const key = `${chainId}:${resolved.address.toLowerCase()}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        methods.push(evm.charge({ ...shared, chainId, currency }));
+    }
+    if (methods.length === 0)
+        throw new Error('No accepted EVM currencies for the configured chain.');
+    return methods;
 }
 (function (evm) {
     /** Creates an EVM `charge` server method. */

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.10.1";
+export declare const version = "0.12.0";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.10.1";
+export declare const sdkIdentifier = "mppx/0.12.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.10.1';
+export const version = '0.12.0';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/server/Mppx.d.ts

@@ -112,6 +112,7 @@ export type VerifyCredentialOptions = {
     capturedRequest?: Method.CapturedRequest | undefined;
     meta?: Record<string, string> | undefined;
     realm?: string | undefined;
+    /** Route input used for binding checks and disambiguating configured methods before schema transforms. */
     request?: Record<string, unknown> | undefined;
     /** Optional expected route/resource scope bound via challenge `opaque`. */
     scope?: string | undefined;
@@ -140,7 +141,8 @@ export type Mppx<methods extends Methods = Methods, transport extends Transport.
      * all methods through HTTP headers or an MCP payment-required challenge list.
      *
      * Each entry is a `[method, options]` tuple where `method` is one of the
-     * server methods passed to `Mppx.create()`, looked up by `name`+`intent`.
+     * server methods passed to `Mppx.create()`, looked up by object identity.
+     * String keys use the named handler; function references use their configured method.
      *
      * Available on HTTP, MCP JSON-RPC, and MCP SDK transports. MCP handlers
      * accept the transport's input and return its challenge and receipt types.
@@ -381,6 +383,8 @@ type ConfiguredHandler<transport extends Transport.AnyTransport = Transport.Http
 type ComposedHandler<transport extends Transport.AnyTransport = Transport.Http> = ((input: Transport.InputOf<transport>) => Promise<MethodFn.Response<transport>>) & {
     _internal?: {
         offers: readonly ConfiguredHandler['_internal'][];
+        handlers?: readonly ConfiguredHandler<transport>[];
+        selectOffers?: SelectOffers<readonly Method.AnyServer[]> | undefined;
     };
 };
 /** An entry for `compose()`: a method reference, handler function ref, or string key paired with its options. */