mppx 0.13.4 → 0.13.6

package/dist/client/Mppx.d.ts

@@ -62,6 +62,8 @@ export type Mppx<methods extends Methods = Methods, transport extends Transport.
     transport: transport;
     /**
      * Selects a payment challenge without creating its credential.
+     * Native HTTP responses in payment events preserve status and headers only;
+     * the caller retains ownership of the original response body.
      *
      * @example
      * ```ts

package/dist/client/Mppx.js

@@ -405,17 +405,15 @@ function snapshotMethod(method) {
 }
 function snapshotResponse(response) {
     if (response instanceof Response) {
-        try {
+        if (response.body === null)
             return response.clone();
-        }
-        catch {
-            // A consumed body cannot be cloned, but status and headers are sufficient for event context.
-            return new Response(null, {
-                headers: response.headers,
-                status: response.status,
-                statusText: response.statusText,
-            });
-        }
+        // Event context can outlive an SSE response. Retaining a clone would queue
+        // every chunk consumed by the caller on an unread body branch.
+        return new Response(null, {
+            headers: response.headers,
+            status: response.status,
+            statusText: response.statusText,
+        });
     }
     return snapshotValue(response);
 }

package/dist/client/internal/Fetch.js

@@ -1,5 +1,6 @@
 import * as Challenge from '../../Challenge.js';
 import * as Constants from '../../Constants.js';
+import { PaymentOutcomeUnknownError } from '../../Errors.js';
 import * as Expires from '../../Expires.js';
 import * as AcceptPayment from '../../internal/AcceptPayment.js';
 import * as Transport from '../Transport.js';
@@ -10,8 +11,64 @@ import * as MethodResponse from './MethodResponse.js';
 // an unrelated fetch installed by user code or another library.
 const MPPX_FETCH_WRAPPER = Symbol.for('mppx.fetch.wrapper');
 const defaultMaxPaymentRetries = 3;
+const maxErrorBodyBytes = 64 * 1024;
+const errorBodyTimeoutMs = 2_000;
+/** Response header set when a paid-retry error body was cut off by {@link bufferErrorBody}. */
+const bodyTruncatedHeader = 'Mppx-Body-Truncated';
 let originalFetch;
 const eventObserverChecks = new WeakMap();
+/**
+ * Buffers a paid-retry error body within a size and time bound so its connection is
+ * released. A complete body stays in the original response. The body is diagnostic
+ * only: one larger than 64 KiB, or still arriving after 2 seconds, is cancelled and
+ * replaced with what arrived, marked with an `Mppx-Body-Truncated: true` header.
+ */
+async function bufferErrorBody(response) {
+    if (!response.body)
+        return response;
+    // Reading a clone pulls the shared source, buffering it in the original response.
+    const reader = response.clone().body.getReader();
+    const chunks = [];
+    let received = 0;
+    let truncated = false;
+    const timeout = setTimeout(() => {
+        truncated = true;
+        void reader.cancel().catch(() => { });
+    }, errorBodyTimeoutMs);
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            chunks.push(value);
+            received += value.byteLength;
+            if (received > maxErrorBodyBytes) {
+                truncated = true;
+                break;
+            }
+        }
+    }
+    finally {
+        clearTimeout(timeout);
+        // A tee's cancellation can wait for the other branch; do not await it.
+        void reader.cancel().catch(() => { });
+    }
+    if (!truncated)
+        return response;
+    // Cancelling both branches cancels the source and releases the connection.
+    void response.body.cancel().catch(() => { });
+    const headers = new Headers(response.headers);
+    headers.delete('content-length');
+    headers.set(bodyTruncatedHeader, 'true');
+    const truncatedResponse = new Response(new Blob(chunks).slice(0, maxErrorBodyBytes), {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+    for (const key of ['redirected', 'type', 'url'])
+        Object.defineProperty(truncatedResponse, key, { value: response[key] });
+    return truncatedResponse;
+}
 async function settleAttempt(prepared, outcome) {
     const settle = prepared?.attempt.settle;
     if (!settle)
@@ -67,6 +124,8 @@ export function from(config) {
         let challenges;
         let mi;
         let preparedCredential;
+        // Set when the paid request throws after the credential was sent.
+        let outcomeUnknown;
         try {
             for (let retry = 0; retry < maxPaymentRetries; retry++) {
                 challenges = await transport.getChallenges(response, transportRequest);
@@ -166,14 +225,26 @@ export function from(config) {
                     method: selected.method,
                     response,
                 }));
-                response = await baseFetch(paymentInput, {
-                    ...transport.setCredential({
-                        ...fetchInit,
-                        headers: initialRequest.headers,
-                    }, credential, { challenge: selectedChallenge }),
-                    // Runtimes do not strip custom payment headers on cross-origin redirects.
-                    redirect: 'manual',
+                const unknownOutcome = (cause) => new PaymentOutcomeUnknownError({
+                    cause,
+                    challenge: selectedChallenge,
+                    credential,
+                    transactionHash: MethodResponse.getTransactionHash(selected.method, credential),
                 });
+                try {
+                    response = await baseFetch(paymentInput, {
+                        ...transport.setCredential({
+                            ...fetchInit,
+                            headers: initialRequest.headers,
+                        }, credential, { challenge: selectedChallenge }),
+                        // Runtimes do not strip custom payment headers on cross-origin redirects.
+                        redirect: 'manual',
+                    });
+                }
+                catch (cause) {
+                    outcomeUnknown = unknownOutcome(cause);
+                    throw cause;
+                }
                 const paymentRequired = await transport.isPaymentRequired(response, transportRequest);
                 if (!paymentRequired) {
                     await settleAttempt(prepared, {
@@ -198,6 +269,33 @@ export function from(config) {
                         response,
                     }));
                 if (!paymentRequired) {
+                    // The server may have settled before failing: report the credential for
+                    // reconciliation and return the response. Retrying could pay twice.
+                    if (response.status >= 500 && hasEventObservers(events, 'payment.failed')) {
+                        try {
+                            // Release the connection before observers can make requests through it.
+                            response = await bufferErrorBody(response);
+                        }
+                        catch (cause) {
+                            outcomeUnknown = unknownOutcome(cause);
+                            // The failed body cannot be cloned for observers; keep its status and headers.
+                            response = new Response(null, {
+                                headers: response.headers,
+                                status: response.status,
+                                statusText: response.statusText,
+                            });
+                            throw cause;
+                        }
+                        await events.emit('payment.failed', createPaymentFailedPayload({
+                            challenge: selectedChallenge,
+                            challenges,
+                            error: unknownOutcome(),
+                            init,
+                            input,
+                            method: selected.method,
+                            response,
+                        }));
+                    }
                     if (!response.ok)
                         return response;
                     return MethodResponse.handle(selected.method, {
@@ -237,7 +335,8 @@ export function from(config) {
             await events.emit('payment.failed', createPaymentFailedPayload({
                 challenge,
                 challenges,
-                error,
+                // Observers get the credential to reconcile; callers keep the original error.
+                error: outcomeUnknown ?? error,
                 init,
                 input,
                 method: mi,

package/dist/client/internal/MethodChallenge.d.ts

@@ -17,4 +17,6 @@ export declare function register<const method extends Method.AnyClient>(method:
 export declare function has(method: Method.AnyClient): boolean;
 /** Runs method-specific work before creating a challenge credential. */
 export declare function handle(method: Method.AnyClient, parameters: HandlerParameters): Promise<void>;
+/** Returns the registered internal hook so a manager can coordinate its work. */
+export declare function get(method: Method.AnyClient): Handler | undefined;
 //# sourceMappingURL=MethodChallenge.d.ts.map

package/dist/client/internal/MethodChallenge.js

@@ -12,4 +12,8 @@ export function has(method) {
 export function handle(method, parameters) {
     return Promise.resolve(handlers.get(method)?.(parameters));
 }
+/** Returns the registered internal hook so a manager can coordinate its work. */
+export function get(method) {
+    return handlers.get(method);
+}
 //# sourceMappingURL=MethodChallenge.js.map

package/dist/client/internal/MethodResponse.d.ts

@@ -23,6 +23,8 @@ export type HandlerParameters = {
     response: Response;
     signal?: AbortSignal | undefined;
 };
+/** Derives the on-chain hash a credential's payment will have, when it is final before settlement. */
+export type TransactionHash = (credential: string) => string | undefined;
 /** Internal client-method response adapter. */
 export type Handler = (parameters: HandlerParameters) => MaybePromise<Response>;
 /** Registers an internal response adapter without changing the public method shape. */
@@ -35,4 +37,8 @@ export declare function attachAttempt(method: Method.AnyClient, parameters: obje
 export declare function getAttempt(parameters: object): Attempt | undefined;
 /** Lets the selected client method handle a successful paid response. */
 export declare function handle(method: Method.AnyClient, parameters: HandlerParameters): Promise<Response>;
+/** Registers credential hash derivation without changing the public method shape. */
+export declare function registerTransactionHash<const method extends Method.AnyClient>(method: method, derive: TransactionHash): method;
+/** Returns the credential's on-chain hash when its method can derive it. */
+export declare function getTransactionHash(method: Method.AnyClient, credential: string): string | undefined;
 //# sourceMappingURL=MethodResponse.d.ts.map

package/dist/client/internal/MethodResponse.js

@@ -1,5 +1,6 @@
 const handlers = new WeakMap();
 const attempts = new WeakMap();
+const transactionHashes = new WeakMap();
 /** Registers an internal response adapter without changing the public method shape. */
 export function register(method, handler) {
     handlers.set(method, handler);
@@ -22,4 +23,19 @@ export function getAttempt(parameters) {
 export function handle(method, parameters) {
     return Promise.resolve(handlers.get(method)?.(parameters) ?? parameters.response);
 }
+/** Registers credential hash derivation without changing the public method shape. */
+export function registerTransactionHash(method, derive) {
+    transactionHashes.set(method, derive);
+    return method;
+}
+/** Returns the credential's on-chain hash when its method can derive it. */
+export function getTransactionHash(method, credential) {
+    try {
+        return transactionHashes.get(method)?.(credential);
+    }
+    catch {
+        // Reconciliation metadata must never mask the payment outcome itself.
+        return undefined;
+    }
+}
 //# sourceMappingURL=MethodResponse.js.map

package/dist/client/internal/protocols/Mcp.js

@@ -18,6 +18,8 @@ function jsonRpcRequestId(body) {
         return undefined;
     }
 }
+// Bound automatic inspection; the caller retains the original response stream.
+const maxInspectionBytes = 1024 * 1024;
 const responseCache = new WeakMap();
 function mcpHttpRequestId(request) {
     const id = jsonRpcRequestId(request?.body);
@@ -94,6 +96,7 @@ async function parseSseJsonRpcResponse(response) {
     if (!reader)
         return undefined;
     const decoder = new TextDecoder();
+    let received = 0;
     let dataEventSeen = false;
     let message;
     const parser = createParser({
@@ -119,6 +122,9 @@ async function parseSseJsonRpcResponse(response) {
                 parser.reset({ consume: true });
                 return message;
             }
+            received += value.byteLength;
+            if (received > maxInspectionBytes)
+                return undefined;
             parser.feed(decoder.decode(value, { stream: true }));
         }
     }
@@ -126,6 +132,33 @@ async function parseSseJsonRpcResponse(response) {
         void reader.cancel().catch(() => { });
     }
 }
+/** Reads only a bounded JSON response, leaving the caller's stream untouched. */
+async function parseJsonResponse(response) {
+    const reader = response.clone().body?.getReader();
+    if (!reader)
+        return undefined;
+    const decoder = new TextDecoder();
+    let received = 0;
+    let text = '';
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return parseMessage(JSON.parse(text + decoder.decode()));
+            received += value.byteLength;
+            if (received > maxInspectionBytes)
+                return undefined;
+            text += decoder.decode(value, { stream: true });
+        }
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        // A tee's cancellation can wait for the original stream; do not await it.
+        void reader.cancel().catch(() => { });
+    }
+}
 /** Reads a cloned HTTP body into the first JSON-RPC response message, if any. */
 function parseJsonRpcResponse(response) {
     const cached = responseCache.get(response);
@@ -133,12 +166,10 @@ function parseJsonRpcResponse(response) {
         return cached;
     const promise = (async () => {
         const contentType = response.headers.get('content-type')?.toLowerCase() ?? '';
+        if (Number(response.headers.get('content-length')) > maxInspectionBytes)
+            return undefined;
         if (contentType.includes('application/json'))
-            return response
-                .clone()
-                .json()
-                .then(parseMessage)
-                .catch(() => undefined);
+            return parseJsonResponse(response);
         if (contentType.includes('text/event-stream'))
             return parseSseJsonRpcResponse(response);
         return undefined;

package/dist/evm/server/Charge.js

@@ -77,12 +77,14 @@ export function charge(parameters) {
                 source,
             };
             await config.validate?.(authorization);
+            const payer = getAddress(payload.from);
             return {
                 challenge: credential.challenge,
                 credential,
-                details: { payer: getAddress(payload.from) },
+                details: { payer },
                 intent: Methods.charge.intent,
                 method: Methods.charge.name,
+                payer,
                 request: credential.challenge.request,
                 source,
             };

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.13.4";
+export declare const version = "0.13.6";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.13.4";
+export declare const sdkIdentifier = "mppx/0.13.6";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.13.4';
+export const version = '0.13.6';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/internal/warnOnce.d.ts

@@ -0,0 +1,3 @@
+/** Logs `message` with `console.warn` the first time `key` is seen in this process. */
+export declare function warnOnce(key: string, message: string): void;
+//# sourceMappingURL=warnOnce.d.ts.map

package/dist/internal/warnOnce.js

@@ -0,0 +1,9 @@
+const warned = new Set();
+/** Logs `message` with `console.warn` the first time `key` is seen in this process. */
+export function warnOnce(key, message) {
+    if (warned.has(key))
+        return;
+    warned.add(key);
+    console.warn(`[mppx] ${message}`);
+}
+//# sourceMappingURL=warnOnce.js.map

package/dist/server/Mppx.d.ts

@@ -104,6 +104,11 @@ export type PaymentSuccessContext<method extends Method.Method = Method.Method,
     envelope?: Method.VerifiedChallengeEnvelope<z.output<method['schema']['request']>, z.output<method['schema']['credential']['payload']>, method['intent'], method['name']> | undefined;
     input?: Transport.InputOf<transport> | undefined;
     method: ServerMethodDescriptor<method>;
+    /**
+     * Payer identity verified by the method before settlement (for example, the
+     * Tempo sender address). Absent when the method does not report one.
+     */
+    payer?: string | undefined;
     receipt: Receipt.Receipt;
     /** Canonical request represented by the challenge. */
     request: z.output<method['schema']['request']>;

package/dist/server/Mppx.js

@@ -7,6 +7,7 @@ import * as Errors from '../Errors.js';
 import * as Expires from '../Expires.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
 import * as Env from '../internal/env.js';
+import { warnOnce } from '../internal/warnOnce.js';
 import * as Mcp from '../Mcp.js';
 import * as PaymentRequest from '../PaymentRequest.js';
 import * as x402_Header from '../x402/Header.js';
@@ -332,9 +333,10 @@ export function create(config) {
             }));
         };
         let receipt;
+        let validation;
         try {
             if (mi.broadcast && mi.validate)
-                await mi.validate({
+                validation = await mi.validate({
                     credential: parsedCredential,
                     envelope,
                     operation: 'broadcast',
@@ -344,7 +346,7 @@ export function create(config) {
             receipt = await broadcast({ credential: parsedCredential, envelope, request });
         }
         catch (e) {
-            const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+            const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
             await emitStandalonePaymentFailed({
                 challenge: prepared.credential.challenge,
                 credential: parsedCredential,
@@ -360,6 +362,7 @@ export function create(config) {
             credential: parsedCredential,
             envelope,
             method: mi,
+            payer: validation?.payer,
             receipt,
             request: parsedRequest,
             ...(requestInput !== undefined && { requestInput }),
@@ -608,7 +611,7 @@ function createMethodFn(parameters) {
                     ? credentialError
                     : reason
                         ? new Errors.MalformedCredentialError({ reason })
-                        : new Errors.InternalPaymentError();
+                        : new Errors.InternalPaymentError({ cause: credentialError });
                 await emitPaymentFailed({
                     challenge,
                     credential: null,
@@ -674,7 +677,7 @@ function createMethodFn(parameters) {
                     catch (e) {
                         if (!(e instanceof Errors.PaymentError))
                             console.error('mppx: internal authorization error', e);
-                        const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+                        const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
                         await emitPaymentFailed({
                             challenge,
                             credential: null,
@@ -834,9 +837,10 @@ function createMethodFn(parameters) {
             // User-provided verification (e.g., check signature, submit tx, verify payment).
             // If verification fails, re-issue the challenge so the client can retry.
             let receiptData;
+            let validation;
             try {
                 if (broadcast && validate)
-                    await validate({
+                    validation = await validate({
                         credential: parsedCredential,
                         envelope,
                         operation: 'broadcast',
@@ -852,7 +856,7 @@ function createMethodFn(parameters) {
             catch (e) {
                 if (!(e instanceof Errors.PaymentError))
                     console.error('mppx: internal verification error', e);
-                const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError();
+                const error = e instanceof Errors.PaymentError ? e : new Errors.InternalPaymentError({ cause: e });
                 await emitPaymentFailed({
                     challenge,
                     credential: parsedCredential,
@@ -890,6 +894,7 @@ function createMethodFn(parameters) {
                 envelope,
                 input,
                 method,
+                payer: validation?.payer,
                 receipt: receiptData,
                 request: parsedRequest,
                 requestInput: request,
@@ -986,6 +991,7 @@ function createServerEventDispatcher() {
                     await method.onPaymentSuccess({
                         challenge: success.challenge,
                         input: success.input,
+                        ...(success.payer !== undefined && { payer: success.payer }),
                         receipt: success.receipt,
                         request: success.request,
                         ...(success.requestInput !== undefined && { requestInput: success.requestInput }),
@@ -1066,6 +1072,7 @@ function createPaymentSuccessContext(parameters) {
         ...(parameters.envelope ? { envelope: snapshotVerifiedEnvelope(parameters.envelope) } : {}),
         ...snapshotInputProperty(parameters.input),
         method: snapshotMethod(parameters.method),
+        ...(parameters.payer !== undefined && { payer: parameters.payer }),
         receipt: snapshotValue(parameters.receipt),
         request: snapshotValue(parameters.request),
         ...(parameters.requestInput !== undefined && {
@@ -1084,6 +1091,7 @@ function snapshotError(error) {
         return error;
     const snapshot = Object.assign(Object.create(Object.getPrototypeOf(error)), error);
     Object.defineProperties(snapshot, {
+        ...('cause' in error && { cause: { value: error.cause, enumerable: false } }),
         message: { value: error.message, enumerable: false },
         name: { value: error.name, enumerable: false },
     });
@@ -1261,13 +1269,6 @@ export function isMissingReceiptResponseError(error) {
 function normalizeExpires(expires) {
     return expires === undefined ? undefined : z.toDatetimeString(expires);
 }
-const _warned = new Set();
-function warnOnce(key, message) {
-    if (_warned.has(key))
-        return;
-    _warned.add(key);
-    console.warn(`[mppx] ${message}`);
-}
 /** Extracts hostname from the captured request URL, falling back to a default. */
 function resolveRealmFromCapturedRequest(capturedRequest) {
     try {
@@ -1416,6 +1417,19 @@ function getPinnedRequestBindingMismatch(expectedRequest, actualRequest) {
     return (getCoreBindingMismatch(expected.coreBinding, actual.coreBinding) ??
         getMethodBindingMismatch(expected.methodBinding, actual.methodBinding));
 }
+/**
+ * Compares a credential with a composed handler's route request when dispatching. The route
+ * request lacks method details that the handler's `request()` hook adds (for example a session's
+ * `chainId` and `sessionProtocol`), so only the method fields it defines are compared. The
+ * selected handler still checks every pinned field against its full challenge.
+ */
+function getConfiguredRequestBindingMismatch(configuredRequest, actualRequest) {
+    const expected = getPinnedRequestBinding(configuredRequest);
+    const actual = getPinnedRequestBinding(actualRequest);
+    return (getCoreBindingMismatch(expected.coreBinding, actual.coreBinding) ??
+        methodBindingFields.find((field) => expected.methodBinding[field] !== undefined &&
+            !isDeepStrictEqual(expected.methodBinding[field], actual.methodBinding[field])));
+}
 function getCoreBindingMismatch(expected, actual) {
     return coreBindingFields.find((field) => !isDeepStrictEqual(expected[field], actual[field]));
 }
@@ -1447,6 +1461,15 @@ function getPinnedRequestBinding(request) {
         },
     };
 }
+/**
+ * Compares a credential with a composed handler's stable route binding when dispatching. The route
+ * request lacks fields its `request()` hook adds, so only the fields it defines are compared; the
+ * selected handler still checks the full binding against its challenge.
+ */
+function getConfiguredStableBindingMismatch(expected, actual) {
+    return Object.keys(expected).find((field) => expected[field] !== undefined &&
+        !isDeepStrictEqual(normalizeComparable(expected[field]), normalizeComparable(actual[field])));
+}
 function getRequestBindingMismatch(expected, actual) {
     const fields = [
         ...Object.keys(expected),
@@ -1601,9 +1624,13 @@ function composeHandlers(handlers, composeOptions, selectOffers) {
                         if (internal.name !== credMethod || internal.intent !== credIntent)
                             return false;
                         const mismatch = internal._stableBinding
-                            ? getRequestBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credReq, internal._stableBinding))
-                            : getPinnedRequestBindingMismatch(internal._canonicalRequest, credReq);
-                        return !mismatch && opaqueValuesMatch(internal.meta, credential.challenge.meta);
+                            ? getConfiguredStableBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credReq, internal._stableBinding))
+                            : getConfiguredRequestBindingMismatch(internal._canonicalRequest, credReq);
+                        // A handler without a static scope issues challenges scoped to the request's route.
+                        const effectiveMeta = internal.scope === undefined
+                            ? Scope.merge({ meta: internal.meta, scope: Scope.get(input) })
+                            : internal.meta;
+                        return !mismatch && opaqueValuesMatch(effectiveMeta, credential.challenge.meta);
                     }
                     catch {
                         return false;
@@ -1805,8 +1832,8 @@ function composeMcpHandlers(handlers, transport) {
             const match = candidates.find((handler) => getConfiguredOffers(handler).some((internal) => {
                 try {
                     const mismatch = internal._stableBinding
-                        ? getRequestBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credential.challenge.request, internal._stableBinding))
-                        : getPinnedRequestBindingMismatch(internal._canonicalRequest, credential.challenge.request);
+                        ? getConfiguredStableBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credential.challenge.request, internal._stableBinding))
+                        : getConfiguredRequestBindingMismatch(internal._canonicalRequest, credential.challenge.request);
                     return !mismatch && opaqueValuesMatch(internal.meta, credential.challenge.meta);
                 }
                 catch {

package/dist/server/Transport.js

@@ -59,6 +59,16 @@ export function http(options = {}) {
         },
         async respondChallenge(options) {
             const { challenge, error, input } = options;
+            // A 403 means the payment was valid but cannot pay for this request.
+            // Omit the challenge so clients do not pay again.
+            if (error?.status === 403)
+                return new Response(JSON.stringify(error.toProblemDetails()), {
+                    status: error.status,
+                    headers: {
+                        'Cache-Control': 'no-store',
+                        'Content-Type': 'application/problem+json',
+                    },
+                });
             if (options.html && new URL(input.url).searchParams.has(Html.params.serviceWorker))
                 return new Response(serviceWorker, {
                     status: 200,

package/dist/stripe/server/Methods.js

@@ -133,7 +133,7 @@ export function stripe(parameters) {
         const suppliedStore = params.store;
         if (suppliedStore !== undefined && suppliedStore !== store)
             throw new Error('stripe.create() Tempo sessions must use the factory-level shared atomic `store`.');
-        const { recipient, onSessionSettlement, ...rest } = params;
+        const { recipient, canOffer, onSessionSettlement, ...rest } = params;
         return tempoSession({
             currency: tempoCurrency,
             recipient,
@@ -141,6 +141,9 @@ export function stripe(parameters) {
             ...(hostedTempoFeePayer && { feePayer: hostedTempoFeePayer }),
             ...rest,
             store,
+            canOffer: canOffer
+                ? async (context) => cryptoCanOffer(context) && (await canOffer(context))
+                : cryptoCanOffer,
             async onSessionSettlement(context) {
                 await tempoPaymentHandler({
                     intent: 'session',