mppx 0.12.0 → 0.13.2

package/dist/server/NodeListener.js

@@ -4,6 +4,10 @@
  * Useful when bridging Fetch API handlers with Node.js HTTP servers.
  */
 export async function sendResponse(res, response) {
+    if (isResponseClosed(res)) {
+        await response.body?.cancel('response connection closed').catch(() => { });
+        return;
+    }
     const headers = {};
     for (const [key, value] of response.headers) {
         if (key in headers) {
@@ -23,21 +27,82 @@ export async function sendResponse(res, response) {
         res.writeHead(response.status, headers);
     if (response.body != null && res.req?.method !== 'HEAD') {
         const reader = response.body.getReader();
+        let connectionClosed = false;
+        const onClose = () => {
+            connectionClosed = true;
+            void reader.cancel('response connection closed').catch(() => { });
+        };
+        res.once('close', onClose);
+        if (isResponseClosed(res))
+            onClose();
         try {
+            if (res.destroyed || res.writableEnded) {
+                await reader.cancel('response connection closed');
+                return;
+            }
             while (true) {
                 const { done, value } = await reader.read();
-                if (done)
+                if (done || connectionClosed)
                     break;
-                if (res.write(value) === false)
-                    await new Promise((resolve) => {
-                        res.once('drain', resolve);
-                    });
+                if (res.write(value) === false) {
+                    try {
+                        if (!(await waitForDrain(res))) {
+                            await reader.cancel('response connection closed');
+                            return;
+                        }
+                    }
+                    catch (error) {
+                        await reader.cancel(error).catch(() => { });
+                        throw error;
+                    }
+                }
             }
         }
         finally {
+            res.removeListener('close', onClose);
             reader.releaseLock();
         }
     }
-    res.end();
+    if (!isResponseClosed(res))
+        res.end();
+}
+/** Returns whether the HTTP/1 response or underlying HTTP/2 stream has closed. */
+function isResponseClosed(res) {
+    const stream = 'stream' in res ? res.stream : undefined;
+    return Boolean(res.destroyed || res.writableEnded || stream?.destroyed || stream?.closed);
+}
+/**
+ * Waits for write backpressure to clear.
+ *
+ * Returns `true` on drain, `false` when the response closes, and rejects on a
+ * write-side error. Event listeners are always removed before settlement.
+ */
+function waitForDrain(res) {
+    if (isResponseClosed(res))
+        return Promise.resolve(false);
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            res.removeListener('drain', onDrain);
+            res.removeListener('close', onClose);
+            res.removeListener('error', onError);
+        };
+        const onDrain = () => {
+            cleanup();
+            resolve(true);
+        };
+        const onClose = () => {
+            cleanup();
+            resolve(false);
+        };
+        const onError = (error) => {
+            cleanup();
+            reject(error);
+        };
+        res.once('drain', onDrain);
+        res.once('close', onClose);
+        res.once('error', onError);
+        if (isResponseClosed(res))
+            onClose();
+    });
 }
 //# sourceMappingURL=NodeListener.js.map

package/dist/server/Request.d.ts

@@ -2,9 +2,17 @@ import type { IncomingMessage, RequestListener, ServerResponse } from 'node:http
 export type FetchHandler = (request: Request) => Promise<Response> | Response;
 export type RequestListenerOptions = {
     host?: string | undefined;
+    /** Maximum accepted request body size in bytes. @default 10485760 (10 MiB) */
+    maxBodySize?: number | undefined;
     onError?: ((error: unknown) => void | Response | Promise<void | Response>) | undefined;
     protocol?: string | undefined;
 };
+/** Options used only while converting a Node request to a Fetch request. */
+export type NodeConversionOptions = Omit<RequestListenerOptions, 'onError'>;
+/** Raised when a Node request body exceeds the configured byte limit. */
+export declare class RequestBodyTooLargeError extends Error {
+    readonly name = "RequestBodyTooLargeError";
+}
 /**
  * Converts a Fetch API handler into a Node.js HTTP request listener.
  *
@@ -20,5 +28,7 @@ export declare function toNodeListener(handler: FetchHandler, options?: RequestL
  * @param res - The Node.js ServerResponse (used for abort signal lifecycle).
  * @returns A Fetch API Request.
  */
-export declare function fromNodeListener(req: IncomingMessage, res: ServerResponse, options?: RequestListenerOptions | undefined): Request;
+export declare function fromNodeListener(req: IncomingMessage, res: ServerResponse, options?: NodeConversionOptions | undefined): Request;
+/** Waits for a Node-backed request body to finish and enforces its size limit. */
+export declare function waitForBody(request: Request): Promise<void>;
 //# sourceMappingURL=Request.d.ts.map

package/dist/server/Request.js

@@ -1,4 +1,10 @@
 import * as NodeListener from './NodeListener.js';
+const defaultMaxBodySize = 10 * 1024 * 1024;
+const bodyCompletions = new WeakMap();
+/** Raised when a Node request body exceeds the configured byte limit. */
+export class RequestBodyTooLargeError extends Error {
+    name = 'RequestBodyTooLargeError';
+}
 /**
  * Converts a Fetch API handler into a Node.js HTTP request listener.
  *
@@ -9,6 +15,11 @@ import * as NodeListener from './NodeListener.js';
 export function toNodeListener(handler, options) {
     const onError = options?.onError ??
         ((error) => {
+            if (error instanceof RequestBodyTooLargeError)
+                return new Response('Payload Too Large', {
+                    status: 413,
+                    headers: { 'Content-Type': 'text/plain' },
+                });
             console.error(error);
             return new Response('Internal Server Error', {
                 status: 500,
@@ -20,6 +31,7 @@ export function toNodeListener(handler, options) {
         try {
             const request = fromNodeListener(req, res, options);
             response = await handler(request);
+            await waitForBody(request);
         }
         catch (error) {
             try {
@@ -70,20 +82,127 @@ export function fromNodeListener(req, res, options) {
         headers,
         signal: controller.signal,
     };
-    if (method !== 'GET' && method !== 'HEAD' && hasBody(headers)) {
-        init.body = new ReadableStream({
-            start(c) {
-                req.on('data', (chunk) => {
-                    c.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
-                });
-                req.on('end', () => {
-                    c.close();
-                });
-            },
-        });
-        init.duplex = 'half';
+    const maxBodySize = options?.maxBodySize ?? defaultMaxBodySize;
+    validateBodySize(req, maxBodySize);
+    let bodyCompletion;
+    let body;
+    if (hasBody(headers)) {
+        const monitored = createBodyStream(req, maxBodySize);
+        body = monitored.body;
+        if (method !== 'GET' && method !== 'HEAD') {
+            init.body = body;
+            init.duplex = 'half';
+            bodyCompletion = monitored.completion;
+        }
+        else {
+            void consumeBody(body).catch(() => { });
+            bodyCompletion = monitored.completion;
+        }
+    }
+    let request;
+    try {
+        request = new Request(url, init);
+    }
+    catch (error) {
+        void body?.cancel(error).catch(() => { });
+        throw error;
+    }
+    if (bodyCompletion)
+        bodyCompletions.set(request, bodyCompletion);
+    return request;
+}
+/** Waits for a Node-backed request body to finish and enforces its size limit. */
+export async function waitForBody(request) {
+    const completion = bodyCompletions.get(request);
+    if (!completion)
+        return;
+    if (request.body && !request.bodyUsed && !request.body.locked)
+        await consumeBody(request.body);
+    const error = await completion;
+    if (error !== undefined)
+        throw error;
+}
+async function consumeBody(body) {
+    const reader = body.getReader();
+    try {
+        while (!(await reader.read()).done) { }
+    }
+    finally {
+        reader.releaseLock();
+    }
+}
+function createBodyStream(req, maxBodySize) {
+    let received = 0;
+    let closed = false;
+    let cleanup = () => { };
+    let resolveCompletion;
+    const completion = new Promise((resolve) => {
+        resolveCompletion = resolve;
+    });
+    const body = new ReadableStream({
+        start(controller) {
+            const finish = (action, error) => {
+                if (closed)
+                    return;
+                closed = true;
+                cleanup();
+                action();
+                resolveCompletion(error);
+            };
+            const onData = (value) => {
+                const chunk = typeof value === 'string' ? Buffer.from(value) : value;
+                received += chunk.byteLength;
+                if (received > maxBodySize) {
+                    const error = new RequestBodyTooLargeError(`Request body exceeds ${maxBodySize} bytes`);
+                    finish(() => controller.error(error), error);
+                    req.resume();
+                    return;
+                }
+                controller.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+                if ((controller.desiredSize ?? 0) <= 0)
+                    req.pause();
+            };
+            const onEnd = () => finish(() => controller.close());
+            const onError = (error) => finish(() => controller.error(error), error);
+            const onAborted = () => {
+                const error = new Error('request aborted');
+                finish(() => controller.error(error), error);
+            };
+            cleanup = () => {
+                req.removeListener('data', onData);
+                req.removeListener('end', onEnd);
+                req.removeListener('error', onError);
+                req.removeListener('aborted', onAborted);
+            };
+            req.pause();
+            req.on('data', onData);
+            req.once('end', onEnd);
+            req.once('error', onError);
+            req.once('aborted', onAborted);
+        },
+        pull() {
+            if (!closed)
+                req.resume();
+        },
+        cancel(reason) {
+            if (closed)
+                return;
+            closed = true;
+            cleanup();
+            req.destroy(reason instanceof Error ? reason : undefined);
+            resolveCompletion(reason);
+        },
+    });
+    return { body, completion };
+}
+function validateBodySize(req, maxBodySize) {
+    if (!Number.isSafeInteger(maxBodySize) || maxBodySize < 0)
+        throw new TypeError('maxBodySize must be a non-negative safe integer');
+    const contentLength = Number(req.headers['content-length']);
+    if (Number.isFinite(contentLength) && contentLength > maxBodySize) {
+        req.resume();
+        throw new RequestBodyTooLargeError(`Request body exceeds ${maxBodySize} bytes`);
     }
-    return new Request(url, init);
 }
 function hasBody(headers) {
     const contentLength = headers.get('content-length');

package/dist/server/Transport.d.ts

@@ -16,6 +16,10 @@ export { type McpSdk, mcpSdk } from '../mcp/server/Transport.js';
 export type Transport<in out input = unknown, in out challengeOutput = unknown, in receiptResponse = challengeOutput, out receiptOutput = receiptResponse> = {
     /** Transport name for identification. */
     name: string;
+    /** Whether receipt wrapping accepts route-produced async iterables. */
+    supportsStreamingReceipts?: boolean | undefined;
+    /** HTTP header names from which this transport can read credentials. */
+    credentialHeaders?: readonly string[] | undefined;
     /** Captures the transport request into an immutable verification snapshot. */
     captureRequest?: ((input: input) => MaybePromise<Method.CapturedRequest>) | undefined;
     /**
@@ -33,6 +37,11 @@ export type Transport<in out input = unknown, in out challengeOutput = unknown,
      * Returns `null` if no credential was provided, or throws if malformed.
      */
     getCredential: (input: input) => Credential.Credential | null;
+    /** Returns whether a transport-native credential targets a configured request. */
+    matchCredential?: ((options: {
+        input: input;
+        request: Record<string, unknown>;
+    }) => MaybePromise<boolean>) | undefined;
     /** Creates a transport response for a payment challenge. */
     respondChallenge: (options: {
         challenge: Challenge.Challenge;
@@ -53,7 +62,11 @@ export type Transport<in out input = unknown, in out challengeOutput = unknown,
 export type AnyTransport = Transport<any, any, any, any>;
 export type Http = Transport<Request, Response>;
 export type Mcp = Transport<core_Mcp.JsonRpcRequest, core_Mcp.Response>;
-export type Sse<stream = any> = Transport<Request, Response, Response | AsyncIterable<string> | ((stream: stream) => AsyncIterable<string>), Response>;
+/**
+ * SSE receipt wrapping is asynchronous so accounting completes before even a
+ * bodyless response can be returned to the application.
+ */
+export type Sse<stream = any> = Transport<Request, Response, Response | AsyncIterable<string> | ((stream: stream) => AsyncIterable<string>), Promise<Response>>;
 /** Extracts the input type from a transport. */
 export type InputOf<transport extends AnyTransport = AnyTransport> = transport extends Transport<infer input, any, any> ? input : never;
 /** Extracts the challenge output type from a transport. */

package/dist/server/Transport.js

@@ -39,6 +39,7 @@ export function http(options = {}) {
         : Constants.Headers.authorization;
     return from({
         name: 'http',
+        credentialHeaders: [credentialHeader],
         captureRequest(request) {
             return {
                 hasBody: request.body !== null,

package/dist/stripe/server/Methods.d.ts

@@ -1,5 +1,6 @@
 import { charge as evmCharge } from '../../evm/server/Charge.js';
 import type * as Method from '../../Method.js';
+import type * as Store from '../../Store.js';
 import { charge as tempoCharge } from '../../tempo/server/Charge.js';
 import { session as tempoSession } from '../../tempo/session/server/Session.js';
 import * as PaymentIntent from '../internal/payment-intent.js';
@@ -19,6 +20,10 @@ export declare namespace stripe {
         networkId: string;
         livemode: boolean;
         hostedFeePayer?: boolean | undefined;
+        /**
+         * Atomic replay store shared by every Stripe-backed Tempo server instance.
+         */
+        store: Store.AtomicStore;
         connect?: ConnectConfig;
         depositAddresses?: Partial<Record<Network, string>> | ((network: Network) => Promise<string>);
         metadata?: Record<string, string> | undefined;
@@ -40,7 +45,7 @@ type CustomRailNetwork = Exclude<stripe.Network, 'tempo' | 'base'>;
 type AdditionalConfig = {
     base?: BaseConfig;
     tempo?: {
-        session: Omit<tempoSession.Parameters, 'currency' | 'recipient'>;
+        session: Omit<tempoSession.Parameters, 'currency' | 'recipient' | 'store'>;
     };
 } & {
     [K in CustomRailNetwork]?: CustomRailFactory;
@@ -75,10 +80,10 @@ interface StripeMachinePayments<P extends stripe.Parameters = stripe.Parameters>
         charge: (params: {
             recipient: stripe.DepositAddress<'tempo'>;
             metadata?: Record<string, string>;
-        } & Partial<Omit<Parameters<typeof tempoCharge>[0], 'currency' | 'recipient'>>) => TempoServer;
+        } & Partial<Omit<Parameters<typeof tempoCharge>[0], 'currency' | 'recipient' | 'store' | 'storeKeyPrefix'>>) => TempoServer;
         session: (params: {
             recipient: stripe.DepositAddress<'tempo'>;
-        } & Omit<tempoSession.Parameters, 'currency' | 'recipient'>) => TempoSessionServer;
+        } & Omit<tempoSession.Parameters, 'currency' | 'recipient' | 'store'>) => TempoSessionServer;
     };
     base: {
         charge: (params: {
@@ -106,6 +111,7 @@ declare class DefaultMethodsBuilder implements PromiseLike<DefaultMethods> {
  *   client: stripeClient,
  *   networkId: process.env.STRIPE_PROFILE_ID!,
  *   livemode: !process.env.STRIPE_SECRET_KEY!.includes('_test_'),
+ *   store,
  * })
  *
  * // Async: deposit addresses resolved from Stripe API
@@ -123,6 +129,7 @@ declare class DefaultMethodsBuilder implements PromiseLike<DefaultMethods> {
  *   networkId: process.env.STRIPE_PROFILE_ID!,
  *   livemode: !process.env.STRIPE_SECRET_KEY!.includes('_test_'),
  *   depositAddresses: { tempo: process.env.TEMPO_DEPOSIT_ADDRESS! },
+ *   store,
  * })
  *
  * const mppx = Mppx.create({

package/dist/stripe/server/Methods.js

@@ -37,6 +37,7 @@ class DefaultMethodsBuilder {
  *   client: stripeClient,
  *   networkId: process.env.STRIPE_PROFILE_ID!,
  *   livemode: !process.env.STRIPE_SECRET_KEY!.includes('_test_'),
+ *   store,
  * })
  *
  * // Async: deposit addresses resolved from Stripe API
@@ -54,6 +55,7 @@ class DefaultMethodsBuilder {
  *   networkId: process.env.STRIPE_PROFILE_ID!,
  *   livemode: !process.env.STRIPE_SECRET_KEY!.includes('_test_'),
  *   depositAddresses: { tempo: process.env.TEMPO_DEPOSIT_ADDRESS! },
+ *   store,
  * })
  *
  * const mppx = Mppx.create({
@@ -80,11 +82,13 @@ class DefaultMethodsBuilder {
  * retries the recording once without them. SPT payments do not use this fallback.
  */
 export function stripe(parameters) {
-    const { client, networkId, livemode, hostedFeePayer, connect, depositAddresses, metadata } = parameters;
+    const { client, networkId, livemode, hostedFeePayer, connect, depositAddresses, metadata, store, } = parameters;
     if (!client.rawRequest)
         throw new Error('stripe.create() requires a Stripe SDK client with rawRequest() (v15+)');
     if (hostedFeePayer && connect)
         throw new Error('Stripe hosted fee payer does not support Connect account routing.');
+    if (typeof store?.update !== 'function')
+        throw new Error('stripe.create() requires a shared atomic `store` for replay protection.');
     const tempoCurrency = (livemode ? tempoDefaults.tokens.usdc : tempoDefaults.tokens.pathUsd);
     const hostedTempoFeePayer = hostedFeePayer && livemode ? HostedFeePayer.create(client) : undefined;
     const tempoPaymentHandler = createPaymentSuccessHandler(client, 'tempo', connect, metadata);
@@ -104,7 +108,13 @@ export function stripe(parameters) {
         });
     }
     function makeTempoCharge(params) {
-        const { recipient, metadata: callMetadata, ...rest } = params;
+        const supplied = params;
+        const suppliedStore = supplied.store;
+        if (suppliedStore !== undefined && suppliedStore !== store)
+            throw new Error('stripe.create() Tempo charges must use the factory-level shared atomic `store`.');
+        if (supplied.storeKeyPrefix !== undefined)
+            throw new Error('stripe.create() Tempo charges cannot override the shared store namespace.');
+        const { recipient, metadata: callMetadata, store: _, storeKeyPrefix: __, ...rest } = params;
         const handler = callMetadata
             ? createPaymentSuccessHandler(client, 'tempo', connect, { ...metadata, ...callMetadata })
             : tempoPaymentHandler;
@@ -116,9 +126,13 @@ export function stripe(parameters) {
             canOffer: cryptoCanOffer,
             onPaymentSuccess: handler,
             ...rest,
+            store,
         }));
     }
     function makeTempoSession(params) {
+        const suppliedStore = params.store;
+        if (suppliedStore !== undefined && suppliedStore !== store)
+            throw new Error('stripe.create() Tempo sessions must use the factory-level shared atomic `store`.');
         const { recipient, onSessionSettlement, ...rest } = params;
         return tempoSession({
             currency: tempoCurrency,
@@ -126,6 +140,7 @@ export function stripe(parameters) {
             ...(!livemode && { chainId: tempoDefaults.chainId.testnet }),
             ...(hostedTempoFeePayer && { feePayer: hostedTempoFeePayer }),
             ...rest,
+            store,
             async onSessionSettlement(context) {
                 await tempoPaymentHandler({
                     intent: 'session',