mppx 0.12.0 → 0.13.1

package/dist/tempo/session/server/Transports.d.ts

@@ -13,34 +13,31 @@ export type ReserveChargeParameters = {
     formatNeedVoucher(parameters: NeedVoucherEvent): string;
     /** Store polling interval when `waitForUpdate` is unavailable. */
     pollIntervalMs: number;
-    /** Amount already reserved but not yet committed by this stream loop. */
-    reservedAmount: bigint;
+    /** Identifier owned by this stream across reserve, commit, and release. */
+    reservationId: string;
+    /** Requires a previous uncommitted charge to retain its lease. */
+    requireExisting?: boolean | undefined;
     /** Optional abort signal for long waits. */
     signal?: AbortSignal | undefined;
     /** Channel store used for state reads and waits. */
     store: ChannelStore.ChannelStore;
 };
-/** Parameters for committing previously reserved stream charges. */
+/** Inputs for updating the reservation owned by one stream. */
 export type CommitReservedChargesParameters = {
-    /** Reserved amount to commit. */
-    amount: bigint;
-    /** Channel being metered. */
     channelId: Hex;
-    /** Channel store used for atomic updates. */
+    reservationId: string;
     store: ChannelStore.ChannelStore;
-    /** Number of charge units to add. */
-    units: number;
 };
-/**
- * Reserves voucher headroom for a future stream emission.
- *
- * If the channel lacks headroom, emits one need-voucher frame, then waits for
- * a store update or polling interval until the accepted voucher covers both
- * already-reserved charges and the next requested amount.
- */
+/** Lease duration for abandoned stream reservations. Active generators renew it. */
+export declare const streamReservationLeaseMs = 30000;
+/** Atomically reserves shared voucher coverage before billable stream work begins. */
 export declare function reserveChargeOrWait(options: ReserveChargeParameters): Promise<void>;
-/** Atomically commits previously reserved stream charges to channel spend and unit counters. */
+/** Commits only this stream's live reservation, removing it in the same atomic update. */
 export declare function commitReservedCharges(options: CommitReservedChargesParameters): Promise<ChannelStore.State | undefined>;
+/** Releases only the unused reservation owned by this stream. */
+export declare function releaseReservedCharges({ store, channelId, reservationId, }: CommitReservedChargesParameters): Promise<void>;
+/** Renews a live reservation without reviving an expired or released lease. */
+export declare function renewReservedCharges({ store, channelId, reservationId, }: CommitReservedChargesParameters): Promise<void>;
 /** Throws when a channel can no longer be used for streaming charges. */
 export declare function throwIfChannelClosed(channel: ChannelStore.State): void;
 /** Minimal socket event map supported by browser and Node-style WebSocket runtimes. */
@@ -64,6 +61,8 @@ export type SocketEventListener<type extends keyof SocketEventMap> = ((event: So
 };
 /** Minimal socket shape required by the session WebSocket adapter. */
 export type Socket = {
+    /** Bytes queued by the runtime but not yet written to the network. */
+    readonly bufferedAmount?: number | undefined;
     close(code?: number, reason?: string): unknown;
     send(data: string): unknown;
     addEventListener?: <type extends keyof SocketEventMap>(type: type, listener: SocketEventListener<type>) => unknown;
@@ -71,6 +70,10 @@ export type Socket = {
     on?: <type extends keyof SocketEventMap>(type: type, listener: (event: SocketEventMap[type]) => void) => unknown;
     off?: <type extends keyof SocketEventMap>(type: type, listener: (event: SocketEventMap[type]) => void) => unknown;
 };
+/** Raised after a socket is closed to keep its outbound queue bounded. */
+export declare class WebSocketOutboundBufferLimitError extends Error {
+    readonly name = "WebSocketOutboundBufferLimitError";
+}
 /** Handlers for socket lifecycle and message events. */
 export type SocketHandlers = {
     /** Called when the socket closes. */
@@ -82,8 +85,10 @@ export type SocketHandlers = {
 };
 /** Subscribes to browser or Node-style socket events and returns an unsubscribe callback. */
 export declare function subscribe(socket: Socket, handlers: SocketHandlers): () => void;
-/** Sends a text frame through sync or async socket implementations. */
-export declare function send(socket: Socket, data: string): Promise<void>;
+/** Sends a text frame while bounding runtime-managed outbound buffering. */
+export declare function send(socket: Socket, data: string, options?: {
+    maxBufferedAmount?: number;
+}): Promise<void>;
 /** Converts socket message payloads into text frames when possible. */
 export declare function toText(value: unknown): string | null;
 //# sourceMappingURL=Transports.d.ts.map

package/dist/tempo/session/server/Transports.js

@@ -1,62 +1,133 @@
 import { ChannelClosedError } from '../../../Errors.js';
-/**
- * Reserves voucher headroom for a future stream emission.
- *
- * If the channel lacks headroom, emits one need-voucher frame, then waits for
- * a store update or polling interval until the accepted voucher covers both
- * already-reserved charges and the next requested amount.
- */
+import * as ChannelStore from './ChannelStore.js';
+/** Lease duration for abandoned stream reservations. Active generators renew it. */
+export const streamReservationLeaseMs = 30_000;
+/** Atomically reserves shared voucher coverage before billable stream work begins. */
 export async function reserveChargeOrWait(options) {
-    const { amount, channelId, emit, formatNeedVoucher, pollIntervalMs, reservedAmount, signal, store, } = options;
-    let channel = await store.getChannel(channelId);
-    if (!channel)
-        throw new Error('channel not found');
-    throwIfChannelClosed(channel);
-    const hasHeadroom = (state) => state.highestVoucherAmount - state.spent - reservedAmount >= amount;
-    if (hasHeadroom(channel))
-        return;
-    await Promise.resolve(emit(formatNeedVoucher({
-        channelId,
-        requiredCumulative: (channel.spent + reservedAmount + amount).toString(),
-        acceptedCumulative: channel.highestVoucherAmount.toString(),
-        deposit: channel.deposit.toString(),
-    })));
-    while (!hasHeadroom(channel)) {
-        await waitForUpdate(store, channelId, pollIntervalMs, signal);
-        channel = await store.getChannel(channelId);
+    const { amount, channelId, emit, formatNeedVoucher, pollIntervalMs, reservationId, signal, store, } = options;
+    if (amount < 0n)
+        throw new Error('stream charge must be non-negative');
+    if (store.atomic === false)
+        throw new Error('stream reservations require an atomic store');
+    let lastRequired;
+    while (true) {
+        throwIfAborted(signal);
+        let channel = await store.getChannel(channelId);
         if (!channel)
             throw new Error('channel not found');
         throwIfChannelClosed(channel);
+        if (options.requireExisting &&
+            (channel.streamReservations?.[reservationId]?.expiresAt ?? 0) <= Date.now())
+            throw new Error('stream reservation was lost');
+        if (channel.highestVoucherAmount - channel.spent - ChannelStore.reservedStreamAmount(channel) >=
+            amount) {
+            let reserved = false;
+            channel = await store.updateChannel(channelId, (current) => {
+                reserved = false;
+                if (!current)
+                    return current;
+                throwIfChannelClosed(current);
+                throwIfAborted(signal);
+                const now = Date.now();
+                const previous = current.streamReservations?.[reservationId];
+                if (options.requireExisting && !previous)
+                    throw new Error('stream reservation was lost');
+                if (previous && previous.expiresAt <= now)
+                    throw new Error('stream reservation expired');
+                if (current.highestVoucherAmount -
+                    current.spent -
+                    ChannelStore.reservedStreamAmount(current) <
+                    amount)
+                    return current;
+                const reservations = Object.fromEntries(Object.entries(current.streamReservations ?? {}).filter(([, item]) => item.expiresAt > now));
+                reserved = true;
+                return {
+                    ...current,
+                    streamReservations: {
+                        ...reservations,
+                        [reservationId]: {
+                            amount: (previous?.amount ?? 0n) + amount,
+                            units: (previous?.units ?? 0) + 1,
+                            expiresAt: now + streamReservationLeaseMs,
+                        },
+                    },
+                };
+            });
+            if (reserved)
+                return;
+            if (!channel)
+                throw new Error('channel not found');
+        }
+        const required = channel.spent + ChannelStore.reservedStreamAmount(channel) + amount;
+        if (required !== lastRequired) {
+            lastRequired = required;
+            await emit(formatNeedVoucher({
+                channelId,
+                requiredCumulative: required.toString(),
+                acceptedCumulative: channel.highestVoucherAmount.toString(),
+                deposit: channel.deposit.toString(),
+            }));
+        }
+        await waitForUpdate(store, channelId, pollIntervalMs, signal);
     }
 }
-/** Atomically commits previously reserved stream charges to channel spend and unit counters. */
+/** Commits only this stream's live reservation, removing it in the same atomic update. */
 export async function commitReservedCharges(options) {
-    const { amount, channelId, store, units } = options;
-    if (amount === 0n || units === 0)
-        return;
+    const { channelId, reservationId, store } = options;
     let committed = false;
     const channel = await store.updateChannel(channelId, (current) => {
+        committed = false;
         if (!current)
-            return null;
-        if (current.finalized)
-            return current;
-        if (current.closeRequestedAt !== 0n)
             return current;
-        if (current.highestVoucherAmount - current.spent < amount)
+        throwIfChannelClosed(current);
+        const reservation = current.streamReservations?.[reservationId];
+        if (!reservation)
             return current;
+        if (reservation.expiresAt <= Date.now())
+            throw new Error('stream reservation expired');
+        if (current.highestVoucherAmount - current.spent < reservation.amount)
+            throw new Error('reserved voucher coverage is no longer available');
+        const { [reservationId]: _, ...remaining } = current.streamReservations;
         committed = true;
         return {
             ...current,
-            spent: current.spent + amount,
-            units: current.units + units,
+            streamReservations: remaining,
+            spent: current.spent + reservation.amount,
+            units: current.units + reservation.units,
         };
     });
     if (!channel)
         throw new Error('channel not found');
-    throwIfChannelClosed(channel);
-    if (!committed)
-        throw new Error('reserved voucher coverage is no longer available');
-    return channel;
+    return committed ? channel : undefined;
+}
+/** Releases only the unused reservation owned by this stream. */
+export async function releaseReservedCharges({ store, channelId, reservationId, }) {
+    await store.updateChannel(channelId, (current) => {
+        if (!current?.streamReservations?.[reservationId])
+            return current;
+        const { [reservationId]: _, ...remaining } = current.streamReservations;
+        return { ...current, streamReservations: remaining };
+    });
+}
+/** Renews a live reservation without reviving an expired or released lease. */
+export async function renewReservedCharges({ store, channelId, reservationId, }) {
+    await store.updateChannel(channelId, (current) => {
+        if (!current)
+            throw new Error('channel not found');
+        throwIfChannelClosed(current);
+        const reservation = current.streamReservations?.[reservationId];
+        if (!reservation)
+            return current;
+        if (reservation.expiresAt <= Date.now())
+            throw new Error('stream reservation expired');
+        return {
+            ...current,
+            streamReservations: {
+                ...current.streamReservations,
+                [reservationId]: { ...reservation, expiresAt: Date.now() + streamReservationLeaseMs },
+            },
+        };
+    });
 }
 /** Throws when a channel can no longer be used for streaming charges. */
 export function throwIfChannelClosed(channel) {
@@ -68,11 +139,19 @@ export function throwIfChannelClosed(channel) {
 async function waitForUpdate(store, channelId, pollIntervalMs, signal) {
     throwIfAborted(signal);
     if (store.waitForUpdate) {
-        await Promise.race([
-            store.waitForUpdate(channelId),
-            sleep(pollIntervalMs, signal),
-            ...(signal ? [onceAborted(signal)] : []),
-        ]);
+        const controller = new AbortController();
+        const onAbort = () => controller.abort(signal?.reason);
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            await Promise.race([
+                store.waitForUpdate(channelId, controller.signal),
+                sleep(pollIntervalMs, controller.signal),
+            ]);
+        }
+        finally {
+            signal?.removeEventListener('abort', onAbort);
+            controller.abort();
+        }
     }
     else {
         await sleep(pollIntervalMs, signal);
@@ -92,21 +171,14 @@ function sleep(ms, signal) {
         signal?.addEventListener('abort', onAbort, { once: true });
     });
 }
-function onceAborted(signal) {
-    return new Promise((_, reject) => {
-        if (signal.aborted) {
-            reject(signal.reason ?? new Error('aborted'));
-            return;
-        }
-        signal.addEventListener('abort', () => reject(signal.reason ?? new Error('aborted')), {
-            once: true,
-        });
-    });
-}
 function throwIfAborted(signal) {
     if (signal?.aborted)
         throw signal.reason ?? new Error('aborted');
 }
+/** Raised after a socket is closed to keep its outbound queue bounded. */
+export class WebSocketOutboundBufferLimitError extends Error {
+    name = 'WebSocketOutboundBufferLimitError';
+}
 /** Subscribes to browser or Node-style socket events and returns an unsubscribe callback. */
 export function subscribe(socket, handlers) {
     if (socket.addEventListener && socket.removeEventListener) {
@@ -133,9 +205,48 @@ export function subscribe(socket, handlers) {
     }
     throw new Error('unsupported websocket implementation');
 }
-/** Sends a text frame through sync or async socket implementations. */
-export async function send(socket, data) {
-    await Promise.resolve(socket.send(data));
+const socketSendQueues = new WeakMap();
+/** Sends a text frame while bounding runtime-managed outbound buffering. */
+export async function send(socket, data, options = {}) {
+    const previous = socketSendQueues.get(socket) ?? Promise.resolve();
+    const current = previous
+        .catch(() => { })
+        .then(async () => {
+        const maxBufferedAmount = options.maxBufferedAmount ?? 1024 * 1024;
+        if ((socket.bufferedAmount ?? 0) + textByteLength(data) > maxBufferedAmount) {
+            try {
+                await Promise.resolve(socket.close(4008, 'outbound buffer limit exceeded'));
+            }
+            catch { }
+            throw new WebSocketOutboundBufferLimitError('websocket outbound buffer limit exceeded');
+        }
+        await Promise.resolve(socket.send(data));
+    });
+    socketSendQueues.set(socket, current);
+    try {
+        await current;
+    }
+    finally {
+        if (socketSendQueues.get(socket) === current)
+            socketSendQueues.delete(socket);
+    }
+}
+function textByteLength(value) {
+    let bytes = 0;
+    for (let index = 0; index < value.length; index++) {
+        const codePoint = value.codePointAt(index);
+        if (codePoint <= 0x7f)
+            bytes += 1;
+        else if (codePoint <= 0x7ff)
+            bytes += 2;
+        else if (codePoint <= 0xffff)
+            bytes += 3;
+        else {
+            bytes += 4;
+            index += 1;
+        }
+    }
+    return bytes;
 }
 /** Converts socket message payloads into text frames when possible. */
 export function toText(value) {

package/dist/tempo/session/server/Ws.d.ts

@@ -12,7 +12,7 @@ export type SessionRouteResult = {
     challenge: Response;
 } | {
     status: 200;
-    withReceipt(response?: Response): Response;
+    withReceipt(response?: Response): Response | Promise<Response>;
 };
 /** HTTP route used to perform a WebSocket payment probe. */
 export type SessionRoute = (request: Request) => Promise<SessionRouteResult>;
@@ -39,6 +39,10 @@ export declare namespace serve {
         /** Application stream. A manual stream can call `charge(amount)` with a
          *  per-message raw-unit amount; omitting it uses the challenge tick cost. */
         generate: AsyncIterable<string> | ((stream: SessionController) => AsyncIterable<string>);
+        /** Maximum accepted inbound WebSocket frame size in bytes. @default 65536 */
+        maxIncomingMessageBytes?: number | undefined;
+        /** Maximum queued outbound bytes before the socket is closed. @default 1048576 */
+        maxBufferedAmount?: number | undefined;
         pollIntervalMs?: number | undefined;
         /** Payment route handler. Receives synthetic `POST` requests with only
          *  the `Authorization` header — no cookies, bodies, or upgrade headers. */

package/dist/tempo/session/server/Ws.js

@@ -3,7 +3,7 @@ import * as Credential from '../../../Credential.js';
 import { createSessionReceipt, deserializeSessionReceipt, formatApplicationMessage, formatCloseReadyMessage, formatErrorMessage, formatNeedVoucherMessage, formatReceiptMessage, parseMessage, readSessionChallengeAmount, requireSessionCredentialContext, } from '../precompile/Protocol.js';
 import * as ChannelStore from './ChannelStore.js';
 import { meterIterable } from './MeteredStream.js';
-import { send, subscribe, toText } from './Transports.js';
+import { send, subscribe, toText, WebSocketOutboundBufferLimitError, } from './Transports.js';
 /** Public WebSocket payment frame helpers. */
 export { formatApplicationMessage, formatAuthorizationMessage, formatCloseReadyMessage, formatCloseRequestMessage, formatErrorMessage, formatNeedVoucherMessage, formatReceiptMessage, parseMessage, } from '../precompile/Protocol.js';
 /**
@@ -17,10 +17,11 @@ export { formatApplicationMessage, formatAuthorizationMessage, formatCloseReadyM
  * HTTP-specific context beyond the `Authorization` header.
  */
 export async function serve(options) {
-    const { amount: expectedAmount, generate, pollIntervalMs = 100, route, socket, store: rawStore, url, } = options;
+    const { amount: expectedAmount, generate, maxIncomingMessageBytes = 64 * 1024, maxBufferedAmount = 1024 * 1024, pollIntervalMs = 100, route, socket, store: rawStore, url, } = options;
     const store = 'getChannel' in rawStore ? rawStore : ChannelStore.fromStore(rawStore);
     const requestUrl = normalizeHttpUrl(url);
     const maxQueuedPaymentMessages = 32;
+    const sendFrame = (data) => send(socket, data, { maxBufferedAmount });
     const abortController = new AbortController();
     const runtime = {
         closed: false,
@@ -55,7 +56,7 @@ export async function serve(options) {
             spent: channel.spent,
             units: channel.units,
         });
-        await send(socket, formatCloseReadyMessage(receipt));
+        await sendFrame(formatCloseReadyMessage(receipt));
     };
     const runStream = async (context) => {
         try {
@@ -67,23 +68,28 @@ export async function serve(options) {
                 onChargeCommitted: options.onChargeCommitted ?? options.settleScheduled,
                 pollIntervalMs,
                 signal: abortController.signal,
-                emitNeedVoucher: (message) => send(socket, message),
+                emitNeedVoucher: (message) => sendFrame(message),
                 formatNeedVoucher: formatNeedVoucherMessage,
             })) {
                 if (abortController.signal.aborted)
                     break;
-                await send(socket, formatApplicationMessage(value));
+                await sendFrame(formatApplicationMessage(value));
             }
             if (!abortController.signal.aborted)
                 await sendCloseReady();
         }
         catch (error) {
             if (!abortController.signal.aborted) {
-                await send(socket, formatErrorMessage({
-                    message: error instanceof Error ? error.message : 'websocket session failed',
-                    status: 500,
-                }));
-                await close(1011, 'websocket session failed');
+                if (error instanceof WebSocketOutboundBufferLimitError) {
+                    await close(4008, 'outbound buffer limit exceeded').catch(() => { });
+                }
+                else {
+                    await sendFrame(formatErrorMessage({
+                        message: error instanceof Error ? error.message : 'websocket session failed',
+                        status: 500,
+                    })).catch(() => { });
+                    await close(1011, 'websocket session failed').catch(() => { });
+                }
             }
         }
         finally {
@@ -109,7 +115,7 @@ export async function serve(options) {
         if (payload.action === 'close')
             runtime.closeRequested = true;
         if (expectedAmount && credential.challenge.request.amount !== expectedAmount) {
-            await send(socket, formatErrorMessage({
+            await sendFrame(formatErrorMessage({
                 message: 'credential amount does not match this endpoint',
                 status: 402,
             }));
@@ -118,7 +124,7 @@ export async function serve(options) {
         }
         const authorizationResult = await authorizePaymentFrame({ authorization, requestUrl, route });
         if (authorizationResult.status === 'rejected') {
-            await send(socket, formatErrorMessage({
+            await sendFrame(formatErrorMessage({
                 message: authorizationResult.message,
                 status: authorizationResult.responseStatus,
             }));
@@ -129,7 +135,7 @@ export async function serve(options) {
         if (payload.action === 'voucher' && runtime.streamContext) {
             runtime.streamContext.challengeId = credential.challenge.id;
         }
-        await send(socket, formatReceiptMessage(receipt));
+        await sendFrame(formatReceiptMessage(receipt));
         if (payload.action === 'close') {
             await close(1000, 'payment session closed');
             return;
@@ -155,6 +161,15 @@ export async function serve(options) {
     const onMessage = (payload) => {
         if (runtime.closed)
             return;
+        const messageBytes = frameByteLength(payload);
+        if (messageBytes !== null && messageBytes > maxIncomingMessageBytes) {
+            runtime.closed = true;
+            abortController.abort();
+            unsubscribe();
+            void send(socket, formatErrorMessage({ message: 'payment message is too large', status: 413 })).catch(() => { });
+            void Promise.resolve(socket.close(1009, 'payment message is too large')).catch(() => { });
+            return;
+        }
         const raw = toText(payload);
         if (!raw)
             return;
@@ -173,7 +188,7 @@ export async function serve(options) {
         if (!work)
             return;
         if (runtime.queuedActions >= maxQueuedPaymentMessages) {
-            void send(socket, formatErrorMessage({
+            void sendFrame(formatErrorMessage({
                 message: 'too many queued payment messages',
                 status: 429,
             })).catch(() => { });
@@ -194,11 +209,16 @@ export async function serve(options) {
         })
             .catch(async (error) => {
             if (!runtime.closed) {
-                await send(socket, formatErrorMessage({
-                    message: error instanceof Error ? error.message : 'invalid payment message',
-                    status: 400,
-                }));
-                await close(1008, 'invalid payment message');
+                if (error instanceof WebSocketOutboundBufferLimitError) {
+                    await close(4008, 'outbound buffer limit exceeded').catch(() => { });
+                }
+                else {
+                    await sendFrame(formatErrorMessage({
+                        message: error instanceof Error ? error.message : 'invalid payment message',
+                        status: 400,
+                    })).catch(() => { });
+                    await close(1008, 'invalid payment message').catch(() => { });
+                }
             }
         });
     };
@@ -215,6 +235,41 @@ export async function serve(options) {
         message: onMessage,
     });
 }
+function frameByteLength(value) {
+    if (value instanceof ArrayBuffer)
+        return value.byteLength;
+    if (ArrayBuffer.isView(value))
+        return value.byteLength;
+    if (typeof Blob !== 'undefined' && value instanceof Blob)
+        return value.size;
+    if (Array.isArray(value)) {
+        let bytes = 0;
+        for (const fragment of value) {
+            const fragmentBytes = frameByteLength(fragment);
+            if (fragmentBytes === null)
+                return null;
+            bytes += fragmentBytes;
+        }
+        return bytes;
+    }
+    if (typeof value !== 'string')
+        return null;
+    let bytes = 0;
+    for (let index = 0; index < value.length; index++) {
+        const codePoint = value.codePointAt(index);
+        if (codePoint <= 0x7f)
+            bytes += 1;
+        else if (codePoint <= 0x7ff)
+            bytes += 2;
+        else if (codePoint <= 0xffff)
+            bytes += 3;
+        else {
+            bytes += 4;
+            index += 1;
+        }
+    }
+    return bytes;
+}
 function normalizeHttpUrl(value) {
     const url = new URL(value.toString());
     if (url.protocol === 'ws:')
@@ -239,7 +294,7 @@ async function authorizePaymentFrame(parameters) {
             responseStatus: response.status,
         };
     }
-    const response = result.withReceipt(new Response(null, { status: 204 }));
+    const response = await result.withReceipt(new Response(null, { status: 204 }));
     const receiptHeader = response.headers.get(Constants.Headers.paymentReceipt);
     if (!receiptHeader)
         throw new Error('management response missing Payment-Receipt header');

package/dist/tempo/subscription/Store.d.ts

@@ -6,6 +6,8 @@ export type SubscriptionStore = {
     activate<result extends {
         subscription: SubscriptionRecord;
     }>(parameters: ActivateParameters<result>): Promise<ActivateResult<result>>;
+    /** Releases a transient credential claim so the same challenge can be retried. */
+    releaseCredential(challengeId: string): Promise<void>;
     /** Looks up a subscription by subscription ID. */
     get(subscriptionId: string): Promise<SubscriptionRecord | null>;
     /** Looks up a generated access key for a resolved request key. */

package/dist/tempo/subscription/Store.js

@@ -146,6 +146,9 @@ export function fromStore(store, options) {
             await clearActivationState(subscription.lookupKey, challengeId);
             return { status: 'activated', result };
         },
+        async releaseCredential(challengeId) {
+            await store.delete(credentialKey(challengeId));
+        },
         async get(subscriptionId) {
             return (await store.get(recordKey(subscriptionId)));
         },

package/dist/validation/core.js

@@ -35,6 +35,7 @@ export async function* validateStream(options) {
         });
         const effectiveBody = resolvedBody ?? body;
         const isMpp = challengeResults.some((r) => r.severity === 'pass' && r.label === 'Challenge parseable');
+        const challengeIsValid = !challengeResults.some((result) => result.severity === 'fail');
         const chainIds = (parsedChallenges ?? [])
             .filter((ch) => ch.method !== 'stripe')
             .map((ch) => ch.request.methodDetails?.chainId)
@@ -63,7 +64,7 @@ export async function* validateStream(options) {
                 query: options.query,
             });
             yield { phase: 'errorHandling', endpoint, results: errorResults };
-            if (!options.skipPayment) {
+            if (!options.skipPayment && challengeIsValid) {
                 const onResults = options.onPaymentResults;
                 const paymentResults = await validatePaymentFlow(baseUrl, endpoint, verbose, {
                     body: effectiveBody,

package/dist/x402/server/EvmCharge.d.ts

@@ -25,7 +25,7 @@ export type Options = {
      * and client bugs, not an active attacker. Body binding is unaffected either
      * way — `challenge.digest` is verified against the actual body.
      *
-     * @default 'resource'
+     * @default 'required'
      */
     routeBinding?: RouteBindingMode | undefined;
 };
@@ -38,8 +38,10 @@ export type ResolvedOptions = {
     routeBinding: RouteBindingMode;
 };
 export type Path = {
+    credentialHeaders: readonly string[];
     bindCredential: NonNullable<ServerTransport.Http['bindCredential']>;
     getCredential: ServerTransport.Http['getCredential'];
+    matchCredential: NonNullable<ServerTransport.Http['matchCredential']>;
     respondChallenge: (options: Parameters<ServerTransport.Http['respondChallenge']>[0], response?: Response | undefined) => Response | Promise<Response>;
     respondReceipt: (options: Parameters<ServerTransport.Http['respondReceipt']>[0], response: Response) => Response;
 };

package/dist/x402/server/EvmCharge.js

@@ -37,12 +37,13 @@ export function resolveOptions(parameters) {
             }
             : {}),
         maxTimeoutSeconds: parameters.options?.maxTimeoutSeconds ?? 300,
-        routeBinding: parameters.options?.routeBinding ?? 'resource',
+        routeBinding: parameters.options?.routeBinding ?? 'required',
     };
 }
 /** Creates the x402 wire path for an EVM charge method. */
 export function createPath(config) {
     return {
+        credentialHeaders: [x402_Types.paymentSignatureHeader],
         getCredential(request) {
             const paymentSignature = request.headers.get(x402_Types.paymentSignatureHeader);
             if (!paymentSignature)
@@ -53,6 +54,18 @@ export function createPath(config) {
                 payload: paymentPayload,
             }));
         },
+        matchCredential({ input, request }) {
+            const paymentSignature = input.headers.get(x402_Types.paymentSignatureHeader);
+            if (!paymentSignature)
+                return false;
+            try {
+                const paymentPayload = x402_Header.decodePaymentSignature(paymentSignature);
+                return isDeepStrictEqual(paymentPayload.accepted, toPaymentRequirements(request, config));
+            }
+            catch {
+                return false;
+            }
+        },
         async bindCredential({ challenge, credential, input }) {
             const paymentPayload = parsePaymentPayload(credential.payload);
             if (!paymentPayload)