mppx 0.11.0 → 0.13.1

package/CHANGELOG.md

@@ -1,5 +1,88 @@
 # mppx
 
+## 0.13.1
+
+### Patch Changes
+
+- ec6c6cf: Added paired Elysia lifecycle hooks that wrapped actual route responses for streaming metering. Rejected streaming payments registered with only a beforeHandle hook and required Elysia 1.2.0 or newer.
+- 86dddc8: Stopped emitting payment-success events when authorization reused existing access without verifying a new credential.
+- e60b7ea: Settled previously accepted vouchers when terminal voucher processing detected a pending channel close, using the existing shared scheduled-settlement claim. Kept standalone validation free of settlement side effects.
+- cfb4bff: Reserved stream charges atomically in shared channel state and released or expired unused reservations.
+
+## 0.13.0
+
+### Minor Changes
+
+- e6f903f: Required shared replay storage for Stripe Tempo payment methods.
+- 44b9115: Removed the deprecated legacy session client exports.
+
+### Patch Changes
+
+- e73cd68: Fixed Node server responses so streams stopped when clients disconnected.
+- eb888ab: Fixed server request handling so bodies were bounded and backpressured.
+- 22c0633: Fixed proxy requests so payment authorization was not forwarded upstream.
+- beceee5: Fixed proxy responses so payment-specific headers were stripped.
+- 47e2faf: Fixed Stripe proxy requests so caller routing headers were removed.
+- e2bfcf3: Fixed CLI discovery so untrusted origins were rejected.
+- b224b23: Fixed EVM nonce hashing so input fields were framed unambiguously.
+- 4bdad2b: Fixed Tempo SSE parsing so standard line endings were accepted.
+- e66245d: Fixed MCP payments so the selected payment method was used.
+- 8c42db6: Fixed Tempo transaction credentials so proofs were bound to their source account.
+- 23499aa: Fixed composed server methods so credential headers remained scoped to their transports.
+- 3fc6dd4: Fixed x402 verification so route-bound credentials were required by default.
+- 7e6a86a: Fixed CLI credential retries so requests remained pinned to the challenge origin.
+- 7c91998: Fixed CLI challenge handling so mismatched payment realms were rejected.
+- 8bfe2d1: Fixed middleware payment challenges so credentials were bound to routes.
+- 8bfeb03: Fixed manual session streams so terminal charges were committed.
+- 52b88c6: Fixed session charging so the final retry result was validated.
+- adc5c07: Fixed Tempo sessions so expected chain pins were applied.
+- f9c56d8: Fixed Tempo payment proofs so signer accounts were resolved correctly.
+- ad11f54: Fixed subscriptions so pending renewal credentials were rejected.
+- f14f1ee: Fixed CLI token approvals so configured decimals were verified.
+- c301267: Fixed session channel waits so timed-out callers were cancelled.
+- 91eed32: Fixed session WebSocket input so oversized frames were rejected.
+- f823c86: Fixed session management requests so nested operations honored cancellation.
+- 6568964: Fixed session SSE streams so values were pulled with backpressure.
+- d40dfbd: Fixed session WebSocket output so buffered data remained bounded.
+- e77e9c3: Fixed hosted session sponsorship so configured policy was enforced.
+- 9076794: Fixed sponsored access keys so installation required explicit opt-in.
+- dcee2e8: Fixed sponsored subscriptions so fee tokens were restricted to configured tokens.
+- a7eb66a: Fixed x402 compatibility offers so their payment lifecycle remained safe.
+- 25952d3: Fixed cooperative session closes so close credentials were authorized.
+- 909ccc1: Fixed sponsored session calls so supported call payloads were canonicalized.
+- f431415: Fixed session voucher acceptance so channel state was refreshed before validation.
+- 2afa94d: Fixed scheduled session settlements so concurrent workers claimed each settlement atomically.
+- bd96362: Fixed bodyless session responses so payment accounting completed before protected handlers continued.
+- c7968ca: Added optional funding currency metadata to Tempo charge receipts for verified direct, MACH, and DEX auto-swap payment routes.
+
+## 0.12.0
+
+### Minor Changes
+
+- e4f0e02: Added ordered `currencies` configuration to the Tempo and EVM server factories, with OUSD followed by USDC.e on Tempo mainnet and OUSD followed by pathUSD on Moderato. Added chain-aware viem token-set support and deprecated the factories' singular `currency` option. Explicit currency configuration continued to restrict acceptance to that currency.
+
+  Changed `tempo.charge()`, `tempo.session()`, and `tempo.subscription()` to return ordered method groups. Existing `methods: [tempo.charge(options)]` configuration remained supported. Code inspecting a single method directly must now destructure the returned group; explicit composition should use configured handlers such as `mppx.tempo.charge`. Wire Challenges and per-handler currency overrides remained singular.
+
+  Preserved offer selection, callbacks, and error responses through nested composition. Preserved proof replay policy without a configured store and honored explicit charge chain IDs. Shared session storage and settlement dispatch across accepted currencies, applied settlement thresholds using each channel's currency, and initialized session extensions without mutating previously created methods. Preserved each existing subscription's authorized currency during reuse and renewal, and defaulted new subscription offers to mainnet, with `testnet: true` selecting Moderato.
+
+  Reduced package size by removing duplicated HTML bundle literals from generated type declarations.
+
+  Pinned workspace viem dependencies to the public `2.57.1` release and required `viem >=2.57.1` as a peer dependency.
+
+### Patch Changes
+
+- 1d08567: Added AI agent attribution to the CLI User-Agent header when a recognized environment signal is present.
+- 869885e: Added `allowedFeeTokens` for sponsored Tempo charges. Preserved local token defaults and allowed hosted sponsors to choose their fee token unless explicitly restricted.
+- 3a23894: Fixed implicit and explicit composition to preserve each configured method's identity, currency defaults, and offer order. Resolved standalone credentials against configured request bindings, rejected ambiguous method matches, and limited per-method payment success hooks to the selected method.
+- dcf1589: Fixed CLI agent attribution test isolation across agent environments.
+- 75cb219: Fixed hosted fee sponsorship for credential-triggered Tempo session settlement and close.
+- fe2e66e: Fixed split-charge verification to reject payment transfers with attribution memos bound to conflicting challenges or realms.
+- 8d2fb06: Fixed Tempo session content requests to require a voucher advance before charging, preventing an accepted cumulative voucher from authorizing multiple responses while preserving idempotent management updates.
+- 8829293: Allowed `hostedFeePayer: true` in Stripe test mode by applying hosted fee sponsorship only in live mode.
+- 8405b23: Fixed Stripe sandbox sessions to use Tempo testnet.
+- 7159693: Fixed testnet validation of streaming Tempo sessions.
+- 420b99b: Added automatic testnet faucet funding for session operators in `mppx validate`.
+
 ## 0.11.0
 
 ### Minor Changes

package/README.md

@@ -51,7 +51,6 @@ import { Mppx, tempo } from 'mppx/server'
 const mppx = Mppx.create({
   methods: [
     tempo({
-      currency: '0x20c0000000000000000000000000000000000000',
       recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
     }),
   ],
@@ -226,3 +225,25 @@ Built on the ["Payment" HTTP Authentication Scheme](https://datatracker.ietf.org
 ## License
 
 MIT
+
+### Accepted Tempo currencies
+
+`tempo()`, `tempo.charge()`, `tempo.session()`, and `tempo.subscription()` offer OUSD first, followed by USDC.e on mainnet or pathUSD on Moderato (`testnet: true`). Each factory returns a group accepted directly by `Mppx.create`. Clients choose one offer; ordering does not trigger an automatic swap.
+
+```ts
+import { Mppx, tempo } from 'mppx/server'
+import { ousd, usdce } from 'viem/tokens'
+
+const mppx = Mppx.create({
+  methods: [
+    tempo.charge({
+      currencies: [ousd, usdce],
+      recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
+    }),
+  ],
+})
+```
+
+Omit `currencies` for the network defaults, or use `currencies: [ousd]` to accept only OUSD on mainnet. Explicit lists replace the defaults. The deprecated `currency` option also restricts acceptance to one token. Wire requests and handler overrides continue to use singular `currency`.
+
+Use configured handlers such as `mppx.tempo.charge` when composing payments. Code that directly inspects a Method can destructure the group: `const [charge] = tempo.charge({ currencies: [ousd] })`. Existing sessions and subscriptions continue using their originally authorized currency.

package/dist/Method.d.ts

@@ -84,7 +84,10 @@ export type VerifyContext<method extends Method> = {
     request: z.input<method['schema']['request']>;
 };
 /** Validation hook parameters for a single method. */
-export type ValidateContext<method extends Method> = VerifyContext<method>;
+export type ValidateContext<method extends Method> = VerifyContext<method> & {
+    /** Whether validation is standalone or immediately precedes terminal broadcast. */
+    operation?: 'broadcast' | 'validate' | undefined;
+};
 /** Response hook parameters for a single method. */
 export type RespondContext<method extends Method> = VerifyContext<method> & {
     input: globalThis.Request;
@@ -223,6 +226,9 @@ export type RequestFn<method extends Method> = (options: RequestContext<method>)
  * a server grant access based on existing application state (for example, an
  * active subscription) without requiring a fresh `Payment` credential.
  *
+ * Authorization does not emit `payment.success`; use method lifecycle hooks for
+ * payments performed during authorization.
+ *
  * **HTTP-only.** The `input` parameter is a Fetch `Request`; non-HTTP transports
  * do not invoke this hook.
  *

package/dist/Method.js

@@ -47,6 +47,7 @@ export async function validateCredential(methods, input) {
         });
     return prepared.method.validate({
         credential: prepared.credential,
+        operation: 'validate',
         request: prepared.request,
     });
 }
@@ -60,7 +61,11 @@ export async function broadcastCredential(methods, input) {
     const prepared = prepareCredential(methods, input);
     const { method } = prepared;
     if (method.broadcast && method.validate)
-        await method.validate({ credential: prepared.credential, request: prepared.request });
+        await method.validate({
+            credential: prepared.credential,
+            operation: 'broadcast',
+            request: prepared.request,
+        });
     const broadcast = method.broadcast ?? method.verify;
     return broadcast({ credential: prepared.credential, request: prepared.request });
 }
@@ -144,7 +149,7 @@ export function toServer(method, options) {
     const effectiveVerify = verify ??
         (async (parameters) => {
             if (validate)
-                await validate(parameters);
+                await validate({ ...parameters, operation: 'broadcast' });
             if (!broadcast)
                 throw new Errors.VerificationFailedError({
                     reason: `${method.name}/${method.intent} does not support credential broadcast`,

package/dist/Receipt.d.ts

@@ -1,6 +1,7 @@
 import * as z from './zod.js';
 /** Base-field schema used only to derive the {@link Receipt} type without an index signature. */
 declare const BaseSchema: z.ZodMiniObject<{
+    fundingCurrency: z.ZodMiniOptional<z.ZodMiniString<string>>;
     method: z.ZodMiniString<string>;
     reference: z.ZodMiniString<string>;
     externalId: z.ZodMiniOptional<z.ZodMiniString<string>>;
@@ -23,6 +24,7 @@ declare const BaseSchema: z.ZodMiniObject<{
  * ```
  */
 export declare const Schema: z.ZodMiniObject<{
+    fundingCurrency: z.ZodMiniOptional<z.ZodMiniString<string>>;
     method: z.ZodMiniString<string>;
     reference: z.ZodMiniString<string>;
     externalId: z.ZodMiniOptional<z.ZodMiniString<string>>;

package/dist/Receipt.js

@@ -2,6 +2,8 @@ import { Base64 } from 'ox';
 import * as Constants from './Constants.js';
 import * as z from './zod.js';
 const shape = {
+    /** Currency actually debited to fund the payment, when known. */
+    fundingCurrency: z.optional(z.string()),
     /** Payment method used (e.g., "tempo", "stripe"). */
     method: z.string(),
     /** Method-specific reference (e.g., transaction hash). */

package/dist/cli/agent.d.ts

@@ -0,0 +1,3 @@
+/** Returns the first recognized AI agent in signal priority order. */
+export declare function detectAgent(env?: NodeJS.ProcessEnv): string | undefined;
+//# sourceMappingURL=agent.d.ts.map

package/dist/cli/agent.js

@@ -0,0 +1,20 @@
+const agentSignals = [
+    ['ANTIGRAVITY_CLI_ALIAS', 'antigravity'],
+    ['CLAUDECODE', 'claude_code'],
+    ['CLINE_ACTIVE', 'cline'],
+    ['CODEX_SANDBOX', 'codex_cli'],
+    ['CODEX_THREAD_ID', 'codex_cli'],
+    ['CODEX_SANDBOX_NETWORK_DISABLED', 'codex_cli'],
+    ['CODEX_CI', 'codex_cli'],
+    ['CURSOR_AGENT', 'cursor'],
+    ['GEMINI_CLI', 'gemini_cli'],
+    ['OPENCODE', 'open_code'],
+    ['OPENCLAW_SHELL', 'openclaw'],
+    ['CLAUDE_CODE_ENTRYPOINT', 'claude_code'],
+    ['CODEX_INTERNAL_ORIGINATOR_OVERRIDE', 'codex_cli'],
+];
+/** Returns the first recognized AI agent in signal priority order. */
+export function detectAgent(env = process.env) {
+    return agentSignals.find(([variable]) => env[variable])?.[1];
+}
+//# sourceMappingURL=agent.js.map

package/dist/cli/cli.d.ts

@@ -1,4 +1,12 @@
 import { Cli } from 'incur';
+/** Resolves a credential retry without allowing an MPP challenge redirect to change origins. */
+export declare function resolveMppCredentialTarget(initialUrl: string, _initialTarget: {
+    host?: string | undefined;
+    url: string;
+}, responseUrl: string): {
+    host?: string | undefined;
+    url: string;
+};
 declare const cli: Cli.Cli<{
     mppx: {
         args: {
@@ -26,7 +34,7 @@ declare const cli: Cli.Cli<{
             session: string;
             silent: boolean;
             slippage?: number | undefined;
-            userAgent: string;
+            userAgent?: string | undefined;
             verbose: number;
         };
     };