mppx 0.13.4 → 0.13.5

package/dist/tempo/Attribution.js

@@ -17,6 +17,8 @@ import { Bytes, Hash, Hex } from 'ox';
  *
  * The TAG prefix makes MPP transactions trivially distinguishable
  * from arbitrary memos via `TransferWithMemo` event topic filtering.
+ * The Tempo charge client uses the challenge `realm` as `serverId`, so
+ * `verifyServer(memo, realm)` matches on-chain transfers to a server.
  *
  * @module
  */
@@ -37,12 +39,12 @@ function fingerprint(value) {
 /**
  * Encodes an MPP attribution memo as a `bytes32` hex string.
  *
- * @param parameters - The serverId (server identity) and optional clientId.
+ * @param parameters - The challengeId, serverId (server identity), and optional clientId.
  * @returns A `0x`-prefixed 64-char hex string (32 bytes).
  *
  * @example
  * ```ts
- * import * as Attribution from './Attribution.js'
+ * import { Attribution } from 'mppx/tempo'
  *
  * const memo = Attribution.encode({ challengeId: 'challenge-123', clientId: 'my-app', serverId: 'api.example.com' })
  * ```
@@ -69,7 +71,7 @@ export function encode(parameters) {
  *
  * @example
  * ```ts
- * import * as Attribution from './Attribution.js'
+ * import { Attribution } from 'mppx/tempo'
  *
  * Attribution.isMppMemo(Attribution.encode({ challengeId: 'challenge-123', serverId: 'api.example.com' })) // true
  * Attribution.isMppMemo('0x0000...0000')      // false
@@ -90,6 +92,15 @@ export function isMppMemo(memo) {
  * @param memo - A `0x`-prefixed hex string (bytes32).
  * @param serverId - The expected server identity.
  * @returns `true` if the memo has a valid MPP tag and matching server fingerprint.
+ *
+ * @example
+ * ```ts
+ * import { Attribution } from 'mppx/tempo'
+ *
+ * const memo = Attribution.encode({ challengeId: 'challenge-123', serverId: 'api.example.com' })
+ * Attribution.verifyServer(memo, 'api.example.com')   // true
+ * Attribution.verifyServer(memo, 'other.example.com') // false
+ * ```
  */
 export function verifyServer(memo, serverId) {
     if (!isMppMemo(memo))
@@ -106,7 +117,7 @@ export function verifyServer(memo, serverId) {
  *
  * @example
  * ```ts
- * import * as Attribution from './Attribution.js'
+ * import { Attribution } from 'mppx/tempo'
  *
  * const memo = Attribution.encode({ challengeId: 'challenge-123', clientId: 'my-app', serverId: 'api.example.com' })
  * const decoded = Attribution.decode(memo)
@@ -127,7 +138,7 @@ export function decode(memo) {
  * Computes the 7-byte challenge-bound nonce: keccak256(challengeId)[0..6].
  * @internal
  */
-export function challengeNonce(challengeId) {
+function challengeNonce(challengeId) {
     const hash = Hash.keccak256(Bytes.fromString(challengeId), { as: 'Hex' });
     return Hex.toBytes(Hex.slice(hash, 0, 7));
 }
@@ -139,6 +150,15 @@ export function challengeNonce(challengeId) {
  * @param memo - A `0x`-prefixed hex string (bytes32).
  * @param challengeId - The expected challenge ID.
  * @returns `true` if the memo has a valid MPP tag and matching challenge nonce.
+ *
+ * @example
+ * ```ts
+ * import { Attribution } from 'mppx/tempo'
+ *
+ * const memo = Attribution.encode({ challengeId: 'challenge-123', serverId: 'api.example.com' })
+ * Attribution.verifyChallengeBinding(memo, 'challenge-123') // true
+ * Attribution.verifyChallengeBinding(memo, 'challenge-456') // false
+ * ```
  */
 export function verifyChallengeBinding(memo, challengeId) {
     const decoded = decode(memo);

package/dist/tempo/client/Charge.d.ts

@@ -1,4 +1,4 @@
-import type { Address } from 'viem';
+import { type Address } from 'viem';
 import * as Method from '../../Method.js';
 import * as Account from '../../viem/Account.js';
 import * as Client from '../../viem/Client.js';
@@ -25,7 +25,16 @@ export type ChargeContext = {
  * })
  * ```
  */
-export declare function charge(parameters?: charge.Parameters): Method.Client<{
+export declare function charge(parameters?: charge.Parameters): {
+    readonly canHandleChallenge?: Method.CanHandleChallengeFn | undefined;
+    readonly context?: z.ZodMiniObject<{
+        account: z.ZodMiniOptional<z.ZodMiniCustom<`0x${string}` | Account.Account | undefined, `0x${string}` | Account.Account | undefined>>;
+        autoSwap: z.ZodMiniOptional<z.ZodMiniCustom<AutoSwap.resolve.Value | undefined, AutoSwap.resolve.Value | undefined>>;
+        mode: z.ZodMiniOptional<z.ZodMiniEnum<{
+            pull: "pull";
+            push: "push";
+        }>>;
+    }, z.core.$strip> | undefined;
     readonly name: "tempo";
     readonly intent: "charge";
     readonly schema: {
@@ -97,14 +106,84 @@ export declare function charge(parameters?: charge.Parameters): Method.Client<{
             supportedModes?: ("pull" | "push")[] | undefined;
         }>>;
     };
-}, z.ZodMiniObject<{
-    account: z.ZodMiniOptional<z.ZodMiniCustom<`0x${string}` | Account.Account | undefined, `0x${string}` | Account.Account | undefined>>;
-    autoSwap: z.ZodMiniOptional<z.ZodMiniCustom<AutoSwap.resolve.Value | undefined, AutoSwap.resolve.Value | undefined>>;
-    mode: z.ZodMiniOptional<z.ZodMiniEnum<{
-        pull: "pull";
-        push: "push";
-    }>>;
-}, z.core.$strip>>;
+    readonly createCredential: Method.CreateCredentialFn<{
+        readonly name: "tempo";
+        readonly intent: "charge";
+        readonly schema: {
+            credential: {
+                payload: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
+                    hash: z.ZodMiniString<string>;
+                    type: z.ZodMiniLiteral<"hash">;
+                }, z.core.$strip>, z.ZodMiniObject<{
+                    signature: z.ZodMiniString<string>;
+                    type: z.ZodMiniLiteral<"transaction">;
+                }, z.core.$strip>, z.ZodMiniObject<{
+                    signature: z.ZodMiniString<string>;
+                    type: z.ZodMiniLiteral<"proof">;
+                }, z.core.$strip>], "type">;
+            };
+            request: z.ZodMiniPipe<z.ZodMiniObject<{
+                machineTokenEnabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
+                amount: z.ZodMiniString<string>;
+                chainId: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
+                currency: z.ZodMiniString<string>;
+                decimals: z.ZodMiniNumber<number>;
+                description: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                externalId: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                feePayer: z.ZodMiniOptional<z.ZodMiniPipe<z.ZodMiniUnion<readonly [z.ZodMiniBoolean<boolean>, z.ZodMiniCustom<import("viem").Account, import("viem").Account>]>, z.ZodMiniTransform<boolean, boolean | import("viem").Account>>>;
+                memo: z.ZodMiniOptional<z.ZodMiniNever>;
+                recipient: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                splits: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniObject<{
+                    amount: z.ZodMiniString<string>;
+                    memo: z.ZodMiniOptional<z.ZodMiniString<string>>;
+                    recipient: z.ZodMiniPipe<z.ZodMiniString<string>, z.ZodMiniTransform<`0x${string}`, string>>;
+                }, z.core.$strip>>>;
+                supportedModes: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniEnum<{
+                    pull: "pull";
+                    push: "push";
+                }>>>;
+            }, z.core.$strip>, z.ZodMiniTransform<{
+                currency: string;
+                description?: string | undefined;
+                externalId?: string | undefined;
+                recipient?: string | undefined;
+                amount: string;
+                methodDetails?: {
+                    machineTokenEnabled?: boolean | undefined;
+                    chainId?: number | undefined;
+                    feePayer?: boolean | undefined;
+                    splits?: {
+                        memo?: string | undefined;
+                        recipient: `0x${string}`;
+                        amount: string;
+                    }[] | undefined;
+                    supportedModes?: ("pull" | "push")[] | undefined;
+                } | undefined;
+            }, {
+                machineTokenEnabled?: boolean | undefined;
+                amount: string;
+                chainId?: number | undefined;
+                currency: string;
+                decimals: number;
+                description?: string | undefined;
+                externalId?: string | undefined;
+                feePayer?: boolean | undefined;
+                memo?: undefined;
+                recipient?: string | undefined;
+                splits?: {
+                    amount: string;
+                    memo?: string | undefined;
+                    recipient: `0x${string}`;
+                }[] | undefined;
+                supportedModes?: ("pull" | "push")[] | undefined;
+            }>>;
+        };
+    }, {
+        account?: `0x${string}` | Account.Account | undefined;
+        autoSwap?: AutoSwap.resolve.Value | undefined;
+        mode?: "pull" | "push" | undefined;
+    }>;
+};
 export declare namespace charge {
     type AutoSwap = AutoSwap.resolve.Value;
     type Context = ChargeContext;
@@ -137,6 +216,33 @@ export declare namespace charge {
          * recipient and every split recipient must be included in this list.
          */
         expectedRecipients?: readonly Address[] | undefined;
+        /**
+         * Allowlist of TIP-20 currency addresses this client will pay in, compared
+         * case-insensitively. Offers in other currencies are skipped during selection
+         * and rejected before signing; an empty list rejects all. Required with
+         * `maxAmount` or `maxAtomicAmount`, which are denominated in the challenge currency.
+         */
+        currencies?: readonly Address[] | undefined;
+        /**
+         * Decimals of the `currencies`, used to parse `maxAmount`. Required with
+         * `maxAmount` because challenges do not carry currency decimals.
+         */
+        decimals?: number | undefined;
+        /**
+         * Maximum display-unit amount (e.g. `'1.5'`) the client is willing to pay per
+         * charge, parsed with `decimals`. Values with more fractional digits than
+         * `decimals` are rejected rather than rounded. Compared against the challenge
+         * amount, which includes splits; larger offers are skipped during selection and
+         * rejected before signing. Applies per credential, not cumulatively across
+         * payment retries. Requires `currencies`.
+         */
+        maxAmount?: string | undefined;
+        /**
+         * Maximum amount the client is willing to pay per charge, in raw base units of
+         * the challenge currency (compared directly with the challenge `amount`).
+         * Checked like `maxAmount`. Requires `currencies`.
+         */
+        maxAtomicAmount?: string | undefined;
         /**
          * Controls how the charge transaction is submitted.
          *

package/dist/tempo/client/Charge.js

@@ -1,6 +1,9 @@
+import { TxEnvelopeTempo } from 'ox/tempo';
+import { keccak256, parseUnits } from 'viem';
 import { prepareTransactionRequest, sendCallsSync, sendTransactionSync, signTypedData, signTransaction, } from 'viem/actions';
 import { Actions } from 'viem/tempo';
 import { tempo as tempo_chain } from 'viem/tempo/chains';
+import * as MethodResponse from '../../client/internal/MethodResponse.js';
 import * as Credential from '../../Credential.js';
 import * as Method from '../../Method.js';
 import * as Account from '../../viem/Account.js';
@@ -34,24 +37,36 @@ const chargeContextSchema = z.object({
  */
 export function charge(parameters = {}) {
     const { clientId } = parameters;
+    // Caps are denominated in the challenge currency, so they require a currency pin.
+    if ((parameters.maxAmount !== undefined || parameters.maxAtomicAmount !== undefined) &&
+        parameters.currencies === undefined)
+        throw new Error('Tempo charge maxAmount and maxAtomicAmount require currencies.');
+    const caps = {
+        maxAmount: parseMaxAmount(parameters.maxAmount, parameters.decimals),
+        maxAtomicAmount: parameters.maxAtomicAmount === undefined ? undefined : BigInt(parameters.maxAtomicAmount),
+    };
     const getClient = Client.getResolver({
         chain: tempo_chain,
         getClient: parameters.getClient,
         rpcUrl: defaults.rpcUrl,
     });
     const getAccount = Account.getResolver({ account: parameters.account });
-    return Method.toClient(Methods.charge, {
+    const method = Method.toClient(Methods.charge, {
+        // Skip offers that violate client policy so an acceptable offer can be chosen.
+        canHandleChallenge({ challenge }) {
+            try {
+                assertChallengePolicy(parameters, caps, challenge.request);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
         context: chargeContextSchema,
         async createCredential({ challenge, context }) {
-            // Chain pinning: reject a challenge whose chain ID conflicts with the
-            // pinned one, and sign on the pin when the challenge omits a chain ID.
+            assertChallengePolicy(parameters, caps, challenge.request);
+            // Sign on the pinned chain when the challenge omits a chain ID.
             const challengeChainId = challenge.request.methodDetails?.chainId;
-            if (parameters.expectedChainId !== undefined &&
-                challengeChainId !== undefined &&
-                challengeChainId !== parameters.expectedChainId)
-                throw new Error(`Chain ID mismatch: expected ${parameters.expectedChainId}, got ${challengeChainId}.`);
-            if (challengeChainId !== undefined || parameters.allowedChainIds?.length === 0)
-                Client.assertAllowedChainId(parameters.allowedChainIds, challengeChainId);
             const resolvedChainId = challengeChainId ??
                 parameters.expectedChainId ??
                 (parameters.allowedChainIds?.length === 1 ? parameters.allowedChainIds[0] : undefined);
@@ -70,18 +85,6 @@ export function charge(parameters = {}) {
                 chainId,
                 operation,
             })) ?? defaultAccount;
-            if (parameters.expectedRecipients) {
-                const allowed = new Set(parameters.expectedRecipients.map((a) => a.toLowerCase()));
-                if (!request.recipient || !allowed.has(request.recipient.toLowerCase()))
-                    throw new Error(`Unexpected primary recipient: ${request.recipient}`);
-                const splits = methodDetails?.splits;
-                if (splits) {
-                    for (const split of splits) {
-                        if (!allowed.has(split.recipient.toLowerCase()))
-                            throw new Error(`Unexpected split recipient: ${split.recipient}`);
-                    }
-                }
-            }
             // Zero-amount: sign EIP-712 typed data instead of creating a transaction.
             if (BigInt(amount) === 0n) {
                 const account = await resolveAccount({ kind: 'signPaymentProof' });
@@ -198,7 +201,9 @@ export function charge(parameters = {}) {
                 const defaultExpiry = Math.floor(Date.now() / 1000) + 25;
                 if (!challenge.expires)
                     return defaultExpiry;
-                const challengeExpiry = Math.floor(new Date(challenge.expires).getTime() / 1000);
+                // `validBefore` is an exclusive whole-second bound, so cap at the second
+                // after a (possibly fractional) expiry to stay valid as long as the challenge.
+                const challengeExpiry = Math.floor(new Date(challenge.expires).getTime() / 1000) + 1;
                 return Math.min(defaultExpiry, challengeExpiry);
             })();
             if (mode === 'push') {
@@ -254,5 +259,94 @@ export function charge(parameters = {}) {
             });
         },
     });
+    // Share an in-flight signing so concurrent calls for one challenge cannot yield
+    // two independently settleable transactions. Settled signings are not reused.
+    const signing = new Map();
+    const createCredential = async (options) => {
+        // Enforce client policy on every call, including ones joining a signing.
+        assertChallengePolicy(parameters, caps, options.challenge.request);
+        const account = options.context?.account ?? parameters.account;
+        const signer = (typeof account === 'string' ? account : account?.address)?.toLowerCase();
+        const key = `${signer ?? ''}:${options.challenge.id}`;
+        let promise = signing.get(key);
+        if (!promise) {
+            promise = method.createCredential(options).finally(() => signing.delete(key));
+            signing.set(key, promise);
+        }
+        return promise;
+    };
+    return MethodResponse.registerTransactionHash({ ...method, createCredential }, transactionHash);
+}
+/**
+ * Returns the final transaction hash of a credential, when known before settlement.
+ *
+ * Push credentials carry the broadcast hash; pull credentials hash a canonical,
+ * sender-signed 0x76 transaction. Sponsored transactions (0x78 envelopes or 0x76
+ * awaiting a fee payer) return `undefined` because the fee payer's co-signature
+ * changes the final hash.
+ */
+function transactionHash(credential) {
+    const parsed = Methods.charge.schema.credential.payload.safeParse(Credential.deserialize(credential).payload);
+    if (!parsed.success)
+        return undefined;
+    const payload = parsed.data;
+    if (payload.type === 'hash')
+        return payload.hash;
+    const serialized = payload.signature;
+    if (payload.type !== 'transaction' || !serialized.startsWith(TxEnvelopeTempo.serializedType))
+        return undefined;
+    const transaction = TxEnvelopeTempo.deserialize(serialized);
+    if (!transaction.signature || transaction.feePayerSignature === null)
+        return undefined;
+    // Reject trailing or non-canonical bytes, which never identify an on-chain transaction.
+    if (TxEnvelopeTempo.serialize(transaction) !== serialized)
+        return undefined;
+    return keccak256(serialized);
+}
+/** Parses `maxAmount` to base units, rejecting values that cannot be represented exactly. */
+function parseMaxAmount(maxAmount, decimals) {
+    if (maxAmount === undefined)
+        return undefined;
+    if (decimals === undefined)
+        throw new Error('Tempo charge maxAmount requires currency decimals.');
+    // `parseUnits` rounds excess fractional digits, which could loosen the cap.
+    const fraction = maxAmount.split('.')[1]?.replace(/0+$/, '') ?? '';
+    if (fraction.length > decimals)
+        throw new Error(`Tempo charge maxAmount ${maxAmount} has more fractional digits than ${decimals} decimals allow.`);
+    return parseUnits(maxAmount, decimals);
+}
+/**
+ * Rejects a challenge whose chain, currency, recipients, or amount violate the client policy.
+ * Runs during challenge selection and again before any client, account, or signing work.
+ */
+function assertChallengePolicy(parameters, caps, request) {
+    const { amount, methodDetails, recipient } = request;
+    // Chain pinning: reject a challenge whose chain ID conflicts with the pinned one.
+    const challengeChainId = methodDetails?.chainId;
+    if (parameters.expectedChainId !== undefined &&
+        challengeChainId !== undefined &&
+        challengeChainId !== parameters.expectedChainId)
+        throw new Error(`Chain ID mismatch: expected ${parameters.expectedChainId}, got ${challengeChainId}.`);
+    if (challengeChainId !== undefined || parameters.allowedChainIds?.length === 0)
+        Client.assertAllowedChainId(parameters.allowedChainIds, challengeChainId);
+    if (parameters.currencies &&
+        !parameters.currencies.some((c) => c.toLowerCase() === request.currency.toLowerCase()))
+        throw new Error(`Tempo charge currency is not allowed: ${request.currency}.`);
+    if (parameters.expectedRecipients) {
+        const allowed = new Set(parameters.expectedRecipients.map((a) => a.toLowerCase()));
+        if (!recipient || !allowed.has(recipient.toLowerCase()))
+            throw new Error(`Unexpected primary recipient: ${recipient}`);
+        const splits = methodDetails?.splits;
+        if (splits) {
+            for (const split of splits) {
+                if (!allowed.has(split.recipient.toLowerCase()))
+                    throw new Error(`Unexpected split recipient: ${split.recipient}`);
+            }
+        }
+    }
+    if (caps.maxAtomicAmount !== undefined && BigInt(amount) > caps.maxAtomicAmount)
+        throw new Error('Tempo charge amount exceeds maxAtomicAmount.');
+    if (caps.maxAmount !== undefined && BigInt(amount) > caps.maxAmount)
+        throw new Error('Tempo charge amount exceeds maxAmount.');
 }
 //# sourceMappingURL=Charge.js.map

package/dist/tempo/client/Methods.d.ts

@@ -19,7 +19,16 @@ export { sessionClient as session };
  * })
  * ```
  */
-export declare function tempo(parameters?: tempo.Parameters): readonly [import("../../Method.js").Client<{
+export declare function tempo(parameters?: tempo.Parameters): readonly [{
+    readonly canHandleChallenge?: import("../../Method.js").CanHandleChallengeFn | undefined;
+    readonly context?: import("zod/mini").ZodMiniObject<{
+        account: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniCustom<`0x${string}` | import("../../viem/Account.js").Account | undefined, `0x${string}` | import("../../viem/Account.js").Account | undefined>>;
+        autoSwap: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniCustom<import("../internal/auto-swap.js").resolve.Value | undefined, import("../internal/auto-swap.js").resolve.Value | undefined>>;
+        mode: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
+            pull: "pull";
+            push: "push";
+        }>>;
+    }, import("zod/v4/core").$strip> | undefined;
     readonly name: "tempo";
     readonly intent: "charge";
     readonly schema: {
@@ -91,14 +100,84 @@ export declare function tempo(parameters?: tempo.Parameters): readonly [import("
             supportedModes?: ("pull" | "push")[] | undefined;
         }>>;
     };
-}, import("zod/mini").ZodMiniObject<{
-    account: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniCustom<`0x${string}` | import("../../viem/Account.js").Account | undefined, `0x${string}` | import("../../viem/Account.js").Account | undefined>>;
-    autoSwap: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniCustom<import("../internal/auto-swap.js").resolve.Value | undefined, import("../internal/auto-swap.js").resolve.Value | undefined>>;
-    mode: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniEnum<{
-        pull: "pull";
-        push: "push";
-    }>>;
-}, import("zod/v4/core").$strip>>, import("../../Method.js").Client<{
+    readonly createCredential: import("../../Method.js").CreateCredentialFn<{
+        readonly name: "tempo";
+        readonly intent: "charge";
+        readonly schema: {
+            credential: {
+                payload: import("zod/mini").ZodMiniDiscriminatedUnion<[import("zod/mini").ZodMiniObject<{
+                    hash: import("zod/mini").ZodMiniString<string>;
+                    type: import("zod/mini").ZodMiniLiteral<"hash">;
+                }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniObject<{
+                    signature: import("zod/mini").ZodMiniString<string>;
+                    type: import("zod/mini").ZodMiniLiteral<"transaction">;
+                }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniObject<{
+                    signature: import("zod/mini").ZodMiniString<string>;
+                    type: import("zod/mini").ZodMiniLiteral<"proof">;
+                }, import("zod/v4/core").$strip>], "type">;
+            };
+            request: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniObject<{
+                machineTokenEnabled: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniBoolean<boolean>>;
+                amount: import("zod/mini").ZodMiniString<string>;
+                chainId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNumber<number>>;
+                currency: import("zod/mini").ZodMiniString<string>;
+                decimals: import("zod/mini").ZodMiniNumber<number>;
+                description: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+                externalId: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+                feePayer: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniUnion<readonly [import("zod/mini").ZodMiniBoolean<boolean>, import("zod/mini").ZodMiniCustom<import("viem").Account, import("viem").Account>]>, import("zod/mini").ZodMiniTransform<boolean, boolean | import("viem").Account>>>;
+                memo: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniNever>;
+                recipient: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+                splits: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniObject<{
+                    amount: import("zod/mini").ZodMiniString<string>;
+                    memo: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniString<string>>;
+                    recipient: import("zod/mini").ZodMiniPipe<import("zod/mini").ZodMiniString<string>, import("zod/mini").ZodMiniTransform<`0x${string}`, string>>;
+                }, import("zod/v4/core").$strip>>>;
+                supportedModes: import("zod/mini").ZodMiniOptional<import("zod/mini").ZodMiniArray<import("zod/mini").ZodMiniEnum<{
+                    pull: "pull";
+                    push: "push";
+                }>>>;
+            }, import("zod/v4/core").$strip>, import("zod/mini").ZodMiniTransform<{
+                currency: string;
+                description?: string | undefined;
+                externalId?: string | undefined;
+                recipient?: string | undefined;
+                amount: string;
+                methodDetails?: {
+                    machineTokenEnabled?: boolean | undefined;
+                    chainId?: number | undefined;
+                    feePayer?: boolean | undefined;
+                    splits?: {
+                        memo?: string | undefined;
+                        recipient: `0x${string}`;
+                        amount: string;
+                    }[] | undefined;
+                    supportedModes?: ("pull" | "push")[] | undefined;
+                } | undefined;
+            }, {
+                machineTokenEnabled?: boolean | undefined;
+                amount: string;
+                chainId?: number | undefined;
+                currency: string;
+                decimals: number;
+                description?: string | undefined;
+                externalId?: string | undefined;
+                feePayer?: boolean | undefined;
+                memo?: undefined;
+                recipient?: string | undefined;
+                splits?: {
+                    amount: string;
+                    memo?: string | undefined;
+                    recipient: `0x${string}`;
+                }[] | undefined;
+                supportedModes?: ("pull" | "push")[] | undefined;
+            }>>;
+        };
+    }, {
+        account?: `0x${string}` | import("../../viem/Account.js").Account | undefined;
+        autoSwap?: import("../internal/auto-swap.js").resolve.Value | undefined;
+        mode?: "pull" | "push" | undefined;
+    }>;
+}, import("../../Method.js").Client<{
     readonly name: "tempo";
     readonly intent: "session";
     readonly schema: {

package/dist/tempo/index.d.ts

@@ -1,3 +1,4 @@
+export * as Attribution from './Attribution.js';
 export * as Proof from './Proof.js';
 export * as Methods from './Methods.js';
 export * as Session from './session/index.js';

package/dist/tempo/index.js

@@ -1,3 +1,4 @@
+export * as Attribution from './Attribution.js';
 export * as Proof from './Proof.js';
 export * as Methods from './Methods.js';
 export * as Session from './session/index.js';

package/dist/tempo/internal/fee-payer.js

@@ -495,6 +495,10 @@ export function assertTransactionPolicy(parameters) {
         fail('fee-sponsored transaction has already expired', {
             validBefore: String(validBeforeValue),
         });
+    if (validBeforeValue < Math.ceil(now.getTime() / 1_000) + 15)
+        fail('fee-sponsored transaction needs at least 15 seconds of remaining validity', {
+            validBefore: String(validBeforeValue),
+        });
     const challengeExpirySeconds = challengeExpires
         ? Math.floor(new Date(challengeExpires).getTime() / 1_000)
         : undefined;

package/dist/tempo/server/Charge.d.ts

@@ -55,6 +55,17 @@ export declare namespace charge {
          * checks still apply. This does not change the payment currency or sessions.
          */
         allowedFeeTokens?: readonly `0x${string}`[] | undefined;
+        /**
+         * Milliseconds to wait for a charge transaction receipt when
+         * `waitForConfirmation` is `true`. The synchronous broadcast may use at most
+         * two thirds of this budget. If it fails with an unknown outcome (e.g. a
+         * timeout, a lost connection, or "already known"), mppx polls for the
+         * receipt until the deadline, or until 2 seconds after the transaction's
+         * `validBefore` followed by one final lookup, before surfacing the broadcast
+         * error. Definitive rejections fail immediately.
+         * @default 30_000
+         */
+        confirmationTimeoutMs?: number | undefined;
         /** Enables first-party machine-token funding through the canonical swapper. */
         machineTokenEnabled?: boolean | undefined;
         /** Render payment page when Accept header is text/html (e.g. in browsers) */