mppx 0.13.4 → 0.13.6

package/dist/tempo/internal/auto-swap.js

@@ -8,6 +8,7 @@ const bps = 10000n;
 export const defaultCurrencies = [
     defaults.tokens.pathUsd,
     defaults.tokens.usdc,
+    defaults.tokens.ousd,
 ];
 /**
  * Finds the optimal swap calls to acquire `amountOut` of `tokenOut`,
@@ -18,15 +19,34 @@ export const defaultCurrencies = [
  */
 export async function findCalls(client, parameters) {
     const { account, amountOut, tokenOut, tokenIn, slippage } = parameters;
+    if (!Number.isFinite(slippage) || slippage < 0 || slippage > 50)
+        throw new Error('Auto-swap slippage must be between 0 and 50 percent.');
+    if (parameters.maxAmountIn !== undefined && parameters.maxAmountIn <= 0n)
+        throw new Error('Auto-swap maxAmountIn must be positive.');
     const candidates = tokenIn.filter((t) => !TempoAddress.isEqual(t, tokenOut));
+    // Reads never carry the client's account: a node refuses every call from an access key whose
+    // authorization is not yet published, which would hide every route from a new key.
     const balanceResults = await Promise.allSettled([
-        readContract(client, Actions.token.getBalance.call(client, { account, token: tokenOut })),
-        ...candidates.map((t) => readContract(client, Actions.token.getBalance.call(client, { account, token: t }))),
+        readContract(client, {
+            ...Actions.token.getBalance.call(client, { account, token: tokenOut }),
+            account: null,
+        }),
+        ...candidates.map((t) => readContract(client, {
+            ...Actions.token.getBalance.call(client, { account, token: t }),
+            account: null,
+        })),
     ]);
     // If the account already has enough of the target token, no swap needed.
     const targetBalance = balanceResults[0];
-    if (targetBalance.status === 'fulfilled' && targetBalance.value >= amountOut)
+    if (targetBalance.status !== 'fulfilled')
+        throw targetBalance.reason;
+    const held = targetBalance.value;
+    if (held >= amountOut)
         return undefined;
+    const deficit = amountOut - held;
+    const slippageBps = BigInt(Math.round(slippage * 100));
+    // Bound price independently of the DEX quote. Stablecoin units default to parity.
+    const spendLimit = parameters.maxAmountIn ?? deficit + (deficit * slippageBps) / bps;
     // Find first candidate with enough balance to cover a swap.
     for (let i = 0; i < candidates.length; i++) {
         const result = balanceResults[i + 1];
@@ -38,12 +58,16 @@ export async function findCalls(client, parameters) {
         const tokenIn = candidates[i];
         try {
             const quotedAmountIn = await Actions.dex.getBuyQuote(client, {
+                account: null,
                 tokenIn,
                 tokenOut,
-                amountOut,
+                amountOut: deficit,
             });
-            if (balance >= quotedAmountIn) {
-                const maxAmountIn = quotedAmountIn + (quotedAmountIn * BigInt(Math.round(slippage * 100))) / bps;
+            if (quotedAmountIn <= 0n || quotedAmountIn > spendLimit)
+                continue;
+            const quotedLimit = quotedAmountIn + (quotedAmountIn * slippageBps) / bps;
+            const maxAmountIn = quotedLimit < spendLimit ? quotedLimit : spendLimit;
+            if (balance >= maxAmountIn) {
                 return [
                     Actions.token.approve.call(client, {
                         amount: maxAmountIn,
@@ -53,7 +77,7 @@ export async function findCalls(client, parameters) {
                     Actions.dex.buy.call({
                         tokenIn,
                         tokenOut,
-                        amountOut,
+                        amountOut: deficit,
                         maxAmountIn,
                     }),
                 ];
@@ -72,12 +96,15 @@ export function resolve(value, defaultCurrencies) {
     const tokenIn = value.tokenIn
         ? [
             ...value.tokenIn,
-            ...defaultCurrencies.filter((d) => !value.tokenIn.some((c) => TempoAddress.isEqual(c, d))),
+            ...(value.fallback === false
+                ? []
+                : defaultCurrencies.filter((d) => !value.tokenIn.some((c) => TempoAddress.isEqual(c, d)))),
         ]
         : defaultCurrencies;
     return {
         tokenIn,
         slippage: value.slippage ?? 1,
+        ...(value.maxAmountIn !== undefined ? { maxAmountIn: value.maxAmountIn } : {}),
     };
 }
 export class InsufficientFundsError extends Error {

package/dist/tempo/internal/fee-payer.d.ts

@@ -124,6 +124,14 @@ export declare function validateCalls(calls: readonly {
     currency?: TempoAddress.Address | undefined;
     expectedTransfers?: readonly ExpectedTransfer[] | undefined;
 }): TempoAddress.Address | undefined;
+/** Rejects transactions that can expire before sponsorship and submission finish. */
+export declare function assertRemainingValidity(parameters: {
+    details?: Record<string, string> | undefined;
+    now?: Date | undefined;
+    transaction: {
+        validBefore?: number | undefined;
+    };
+}): undefined;
 /** Validates sponsor fee policy limits for a fee-payer transaction. */
 export declare function assertTransactionPolicy(parameters: {
     challengeExpires?: string | undefined;

package/dist/tempo/internal/fee-payer.js

@@ -385,8 +385,8 @@ export function validateCalls(calls, details, options) {
         const expectedAmountOut = expectedTransfers.reduce((sum, transfer) => sum + BigInt(transfer.amount), 0n);
         if (!TempoAddress_internal.isEqual(tokenOut, currency))
             throw new FeePayerValidationError('swap tokenOut does not match payment currency', details);
-        if (amountOut !== expectedAmountOut)
-            throw new FeePayerValidationError('swap output does not match payment amount', details);
+        if (amountOut <= 0n || amountOut > expectedAmountOut)
+            throw new FeePayerValidationError('swap output must be positive and no greater than payment amount', details);
     }
     const transferCalls = calls.slice(hasSwapPrefix ? 2 : 0);
     const sorted = [...expectedTransfers].sort((a, b) => {
@@ -436,6 +436,20 @@ export function validateCalls(calls, details, options) {
     }
     return approveCall?.to ?? currency;
 }
+/** Rejects transactions that can expire before sponsorship and submission finish. */
+export function assertRemainingValidity(parameters) {
+    const { details = {}, now = new Date(), transaction } = parameters;
+    const { validBefore } = transaction;
+    const fail = (reason) => {
+        throw new FeePayerValidationError(reason, { ...details, validBefore: String(validBefore) });
+    };
+    if (validBefore === undefined)
+        return fail('fee-sponsored transaction must declare validBefore for the expiring nonce');
+    if (validBefore <= Math.floor(now.getTime() / 1_000))
+        fail('fee-sponsored transaction has already expired');
+    if (validBefore < Math.ceil(now.getTime() / 1_000) + 15)
+        fail('fee-sponsored transaction needs at least 15 seconds of remaining validity');
+}
 /** Validates sponsor fee policy limits for a fee-payer transaction. */
 export function assertTransactionPolicy(parameters) {
     const { challengeExpires, chainId, details, now = new Date(), policy: policyOverrides, transaction, } = parameters;
@@ -490,15 +504,13 @@ export function assertTransactionPolicy(parameters) {
     if (validBefore === undefined)
         fail('fee-sponsored transaction must declare validBefore for the expiring nonce');
     const validBeforeValue = validBefore;
-    const nowSeconds = Math.floor(now.getTime() / 1_000);
-    if (validBeforeValue <= nowSeconds)
-        fail('fee-sponsored transaction has already expired', {
-            validBefore: String(validBeforeValue),
-        });
+    if (!Number.isInteger(policy.maxValidityWindowSeconds) || policy.maxValidityWindowSeconds < 15)
+        fail('sponsor maxValidityWindowSeconds must be an integer of at least 15 seconds');
+    assertRemainingValidity({ transaction, details, now });
     const challengeExpirySeconds = challengeExpires
         ? Math.floor(new Date(challengeExpires).getTime() / 1_000)
         : undefined;
-    const maxValidBefore = Math.min(nowSeconds + policy.maxValidityWindowSeconds, challengeExpirySeconds ? challengeExpirySeconds + 60 : Number.MAX_SAFE_INTEGER);
+    const maxValidBefore = Math.min(Math.ceil(now.getTime() / 1_000) + policy.maxValidityWindowSeconds, challengeExpirySeconds ? challengeExpirySeconds + 60 : Number.MAX_SAFE_INTEGER);
     if (validBeforeValue > maxValidBefore)
         fail('fee-sponsored transaction validity window exceeds sponsor policy', {
             validBefore: String(validBeforeValue),

package/dist/tempo/legacy/session/Chain.js

@@ -373,7 +373,10 @@ export async function broadcastOpenTransaction(parameters) {
                     return { feePayer: feePayer.address, transaction: sponsored };
                 },
             });
-            return signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            const serialized = await signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            return serialized;
         }
         return serializedTransaction;
     };
@@ -491,7 +494,10 @@ export async function broadcastTopUpTransaction(parameters) {
                     return { feePayer: feePayer.address, transaction: sponsored };
                 },
             });
-            return signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            const serialized = await signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            return serialized;
         }
         return serializedTransaction;
     })();

package/dist/tempo/server/Charge.d.ts

@@ -55,6 +55,17 @@ export declare namespace charge {
          * checks still apply. This does not change the payment currency or sessions.
          */
         allowedFeeTokens?: readonly `0x${string}`[] | undefined;
+        /**
+         * Milliseconds to wait for a charge transaction receipt when
+         * `waitForConfirmation` is `true`. The synchronous broadcast may use at most
+         * two thirds of this budget. If it fails with an unknown outcome (e.g. a
+         * timeout, a lost connection, or "already known"), mppx polls for the
+         * receipt until the deadline, or until 2 seconds after the transaction's
+         * `validBefore` followed by one final lookup, before surfacing the broadcast
+         * error. Definitive rejections fail immediately.
+         * @default 30_000
+         */
+        confirmationTimeoutMs?: number | undefined;
         /** Enables first-party machine-token funding through the canonical swapper. */
         machineTokenEnabled?: boolean | undefined;
         /** Render payment page when Accept header is text/html (e.g. in browsers) */

package/dist/tempo/server/Charge.js

@@ -1,9 +1,9 @@
 import * as SignatureEnvelope from 'ox/tempo/SignatureEnvelope';
-import { decodeFunctionData, formatUnits, keccak256, parseEventLogs, } from 'viem';
-import { getTransaction, getTransactionReceipt, sendRawTransaction, sendRawTransactionSync, signTransaction, verifyTypedData, call as viem_call, } from 'viem/actions';
+import { decodeFunctionData, formatUnits, keccak256, parseEventLogs, WaitForTransactionReceiptTimeoutError, } from 'viem';
+import { getTransaction, getTransactionReceipt, sendRawTransaction, sendRawTransactionSync, signTransaction, verifyTypedData, waitForTransactionReceipt, call as viem_call, } from 'viem/actions';
 import { Abis, Actions, Transaction } from 'viem/tempo';
 import { tempo as tempo_chain } from 'viem/tempo/chains';
-import { PaymentError, VerificationFailedError } from '../../Errors.js';
+import { CredentialReplayedError, PaymentError, VerificationFailedError } from '../../Errors.js';
 import * as Expires from '../../Expires.js';
 import * as Method from '../../Method.js';
 import * as Store from '../../Store.js';
@@ -19,6 +19,7 @@ import * as MachineTokenCharge from '../internal/machine-token-charge.js';
 import * as Proof from '../internal/proof.js';
 import * as Selectors from '../internal/selectors.js';
 import * as Methods from '../Methods.js';
+import { fallbackStore } from './internal/fallback-store.js';
 import { html as htmlContent } from './internal/html.gen.js';
 import * as Relay from './Relay.js';
 import * as SponsorBudget from './SponsorBudget.js';
@@ -33,11 +34,12 @@ import * as SponsorBudget from './SponsorBudget.js';
  * ```
  */
 export function charge(parameters = {}) {
-    const { machineTokenEnabled, allowedFeeTokens: configuredAllowedFeeTokens, amount, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, relay, sponsorBudget, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
+    const { machineTokenEnabled, allowedFeeTokens: configuredAllowedFeeTokens, amount, confirmationTimeoutMs = 30_000, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, relay, sponsorBudget, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
     if (configuredAllowedFeeTokens?.length === 0)
         throw new Error('`allowedFeeTokens` must contain at least one token.');
     const storeKeyPrefix = parameters.storeKeyPrefix ?? '';
-    const rawStore = (parameters.store ?? Store.memory());
+    const rawStore = (parameters.store ??
+        fallbackStore('tempo.charge'));
     const store = Store.from(rawStore, { keyPrefix: storeKeyPrefix });
     const { maxInFlightReservations: legacyMaxInFlightReservations, maxInFlightTotalFee: legacyMaxInFlightTotalFee, ...transactionFeePayerPolicy } = feePayerPolicy ?? {};
     const sponsorBudgetConfig = sponsorBudget === false ? undefined : (sponsorBudget ?? {});
@@ -178,7 +180,13 @@ export function charge(parameters = {}) {
             challengeId: challenge.id,
             realm: challenge.realm,
         });
-        return { receipt, sender, transfers };
+        // The payer is the account the matched transfers debited, not the submitter.
+        // Settlement-contract transfers are funded by the transaction sender.
+        const payers = new Set(matchedLogs.map(({ args }) => (settlementSenders.some((settlementSender) => TempoAddress.isEqual(settlementSender, args.from))
+            ? receipt.from
+            : args.from).toLowerCase()));
+        const payer = payers.size === 1 ? [...payers][0] : undefined;
+        return { payer, receipt, sender, transfers };
     }
     async function validateProofCredential(credential, payload, context) {
         const { chainId, challenge, client, isZeroAmount } = context;
@@ -258,17 +266,22 @@ export function charge(parameters = {}) {
     async function validateCredential(credential, request, context) {
         switch (context.payload.type) {
             case 'hash': {
-                const { receipt, sender, transfers } = await validateHashCredential(credential, context.payload, context);
+                const { payer, receipt, sender, transfers } = await validateHashCredential(credential, context.payload, context);
                 return {
                     details: { mode: 'push', sender, transfers },
                     hash: context.payload.hash,
+                    payer,
                     receipt,
                     type: 'hash',
                 };
             }
             case 'proof': {
                 const { sender } = await validateProofCredential(credential, context.payload, context);
-                return { details: { mode: 'proof', sender }, type: 'proof' };
+                return {
+                    details: { mode: 'proof', sender },
+                    payer: sender,
+                    type: 'proof',
+                };
             }
             case 'transaction': {
                 const { fundingCurrency, isFeePayerTx, serializedTransaction, settlementSenders, transaction, transfers, } = await validateTransactionCredential(credential, context.payload, request, context);
@@ -281,6 +294,7 @@ export function charge(parameters = {}) {
                     },
                     fundingCurrency,
                     isFeePayerTx,
+                    payer: transaction.from,
                     serializedTransaction,
                     settlementSenders,
                     transaction,
@@ -387,6 +401,7 @@ export function charge(parameters = {}) {
                 details: validated.details,
                 intent: 'charge',
                 method: 'tempo',
+                payer: validated.payer,
                 request: context.resolvedRequest,
                 source: credential.source,
             };
@@ -407,7 +422,7 @@ export function charge(parameters = {}) {
                 case 'hash': {
                     const { hash, receipt } = validated;
                     if (!(await tryClaimHash(store, hash, replayExpires))) {
-                        throw new VerificationFailedError({
+                        throw new CredentialReplayedError({
                             reason: 'Transaction hash has already been used',
                         });
                     }
@@ -427,7 +442,7 @@ export function charge(parameters = {}) {
                 }
                 case 'proof': {
                     if (proofStore && !(await tryClaimProof(proofStore, challenge.id, replayExpires))) {
-                        throw new VerificationFailedError({
+                        throw new CredentialReplayedError({
                             reason: 'Proof credential has already been used',
                         });
                     }
@@ -438,7 +453,7 @@ export function charge(parameters = {}) {
                     // Pre-broadcast dedup: catch exact byte-for-byte replays early.
                     const hash = keccak256(serializedTransaction);
                     if (!(await tryClaimHash(store, hash, replayExpires))) {
-                        throw new VerificationFailedError({
+                        throw new CredentialReplayedError({
                             reason: 'Transaction hash has already been used',
                         });
                     }
@@ -480,6 +495,13 @@ export function charge(parameters = {}) {
                                         return { feePayer: feePayerAccount.address, transaction: sponsored };
                                     },
                                 });
+                                FeePayer.assertTransactionPolicy({
+                                    challengeExpires: expires,
+                                    chainId: chainId ?? client.chain.id,
+                                    details: { amount, currency, recipient },
+                                    policy: transactionFeePayerPolicy,
+                                    transaction: completed.transaction,
+                                });
                                 return {
                                     serializedTransaction: await signTransaction(client, completed.transaction),
                                     sponsor: completed.feePayer,
@@ -515,7 +537,7 @@ export function charge(parameters = {}) {
                         finalHash = keccak256(serializedTransaction_final);
                         if (finalHash.toLowerCase() !== hash.toLowerCase()) {
                             if (!(await tryClaimHash(store, finalHash, replayExpires)))
-                                throw new VerificationFailedError({
+                                throw new CredentialReplayedError({
                                     reason: 'Transaction hash has already been used',
                                 });
                             claimedFinalHash = finalHash;
@@ -560,11 +582,51 @@ export function charge(parameters = {}) {
                             throw new VerificationFailedError({
                                 reason: 'Sponsor budget reservation ownership was lost before broadcast',
                             });
+                        if (isFeePayerTx)
+                            FeePayer.assertTransactionPolicy({
+                                challengeExpires: expires,
+                                chainId: chainId ?? client.chain.id,
+                                details: { amount, currency, recipient },
+                                policy: transactionFeePayerPolicy,
+                                transaction,
+                            });
                         broadcastAttempted = true;
                         if (waitForConfirmation) {
-                            const receipt = await sendRawTransactionSync(client, {
-                                serializedTransaction: serializedTransaction_final,
-                            });
+                            const start = Date.now();
+                            // The sync send gets at most 2/3 of the budget, reserving the rest for recovery.
+                            const sendTimeoutMs = Math.floor((confirmationTimeoutMs * 2) / 3);
+                            const deadline = start + confirmationTimeoutMs;
+                            // An expiring transaction can no longer be included after this point.
+                            const validUntil = transaction.validBefore === undefined
+                                ? Number.POSITIVE_INFINITY
+                                : transaction.validBefore * 1_000 + 2_000;
+                            let receipt;
+                            try {
+                                receipt = await withDeadline(sendRawTransactionSync(client, {
+                                    serializedTransaction: serializedTransaction_final,
+                                    timeout: sendTimeoutMs,
+                                }), start + sendTimeoutMs, new WaitForTransactionReceiptTimeoutError({ hash: finalHash }));
+                            }
+                            catch (broadcastError) {
+                                if (!isAmbiguousBroadcastError(broadcastError))
+                                    throw broadcastError;
+                                // The node may have accepted the transaction, so poll for its receipt.
+                                const timeout = Math.min(deadline, validUntil) - Date.now();
+                                let recovered;
+                                if (timeout > 0)
+                                    recovered = await waitForTransactionReceipt(client, {
+                                        checkReplacement: false,
+                                        hash: finalHash,
+                                        timeout,
+                                    }).catch(() => undefined);
+                                // When the validity cap ends polling, a transaction mined just before
+                                // `validBefore` may only now be visible, so look it up exactly once more.
+                                if (!recovered && validUntil < deadline)
+                                    recovered = await withDeadline(getTransactionReceipt(client, { hash: finalHash }), Math.max(deadline, Date.now() + client.pollingInterval), broadcastError).catch(() => undefined);
+                                if (!recovered)
+                                    throw broadcastError;
+                                receipt = recovered;
+                            }
                             if (reservation)
                                 await SponsorBudget.release(sponsorBudgetStore, reservation);
                             const matchedLogs = await assertTransferLogs(receipt, {
@@ -601,13 +663,27 @@ export function charge(parameters = {}) {
                         return toReceipt(reference, fundingCurrency);
                     }
                     catch (error) {
-                        if (!broadcastAttempted) {
-                            if (reservation)
-                                await SponsorBudget.release(sponsorBudgetStore, reservation);
-                            if (claimedFinalHash)
-                                await releaseHashUse(store, claimedFinalHash);
-                            await releaseHashUse(store, hash);
+                        if (reservation) {
+                            try {
+                                // A broadcast transaction may still land, so its fee stays reserved
+                                // until reconciliation observes a receipt or the reservation expires.
+                                if (broadcastAttempted)
+                                    await SponsorBudget.transition(sponsorBudgetStore, reservation, 'pending');
+                                else
+                                    await SponsorBudget.release(sponsorBudgetStore, reservation);
+                            }
+                            catch (budgetError) {
+                                // The reservation expires on its own; the settlement error and
+                                // claim cleanup take precedence.
+                                console.error('mppx: sponsor budget cleanup error', budgetError);
+                            }
                         }
+                        // Only a successful settlement consumes the credential. A signed
+                        // transaction can be mined at most once, so a retry re-broadcasts it
+                        // and recovers the receipt instead of being rejected as a replay.
+                        if (claimedFinalHash)
+                            await releaseHashUse(store, claimedFinalHash);
+                        await releaseHashUse(store, hash);
                         throw error;
                     }
                 }
@@ -932,6 +1008,57 @@ async function isActiveAccessKey(client, parameters) {
         return false;
     }
 }
+const ambiguousErrorNames = new Set([
+    'AbortError',
+    'SocketClosedError',
+    'TimeoutError',
+    'WaitForTransactionReceiptTimeoutError',
+]);
+/**
+ * Whether a failed synchronous broadcast may still have reached the mempool,
+ * so its receipt is worth polling for. Every other error is a definitive
+ * rejection (e.g. method not found, invalid params, insufficient funds).
+ *
+ * Ambiguous outcomes, matched anywhere in the `cause` chain:
+ * - Timeouts and aborts: errors named `TimeoutError` or `AbortError`, or the
+ *   local confirmation deadline (`WaitForTransactionReceiptTimeoutError`).
+ * - Lost connections: `SocketClosedError`, or an `HttpRequestError` with no
+ *   status (network failure) or a 5xx status.
+ * - JSON-RPC code `4`: the EIP-7966 timeout for a pooled, unconfirmed transaction.
+ * - Messages containing the words "already known" or "known transaction": already
+ *   pooled ("unknown transaction type" does not match).
+ */
+function isAmbiguousBroadcastError(error) {
+    for (let cause = error; cause; cause = cause.cause) {
+        if (typeof cause !== 'object')
+            return false;
+        const { code, message, name, status } = cause;
+        if (name === 'HttpRequestError')
+            return status === undefined || Number(status) >= 500;
+        if (ambiguousErrorNames.has(name))
+            return true;
+        if (code === 4)
+            return true;
+        if (typeof message === 'string' && /\balready ?known\b|\bknown transaction\b/i.test(message))
+            return true;
+    }
+    return false;
+}
+/** Rejects with `error` if `promise` has not settled by `deadline` (epoch ms). */
+async function withDeadline(promise, deadline, error) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(error), deadline - Date.now());
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 /** @internal */
 function toReceipt(reference, fundingCurrency) {
     return {
@@ -943,30 +1070,34 @@ function toReceipt(reference, fundingCurrency) {
     };
 }
 function assertChallengeBoundMemo(matchedLogs, parameters) {
-    assertChallengeBoundMemos(matchedLogs.map((log) => (log.kind === 'memo' ? log.args.memo : undefined)), parameters);
+    const memos = matchedLogs.map((log) => (log.kind === 'memo' ? log.args.memo : undefined));
+    // The transfer already settled to the recipient, so another payment would not help.
+    if (!isChallengeBound(memos, parameters))
+        throw new CredentialReplayedError({ reason: 'memo is not bound to this challenge' });
 }
 function assertChallengeBoundCallMemo(matchedCalls, parameters) {
-    assertChallengeBoundMemos(matchedCalls.map((call) => call.memo), parameters);
+    const memos = matchedCalls.map((call) => call.memo);
+    if (!isChallengeBound(memos, parameters))
+        throw new MismatchError('Payment verification failed: memo is not bound to this challenge.', {});
 }
 /**
- * Requires a challenge-bound attribution memo and rejects conflicting attribution
- * on matched payment transfers. Otherwise, a split payment could authorize another
+ * Whether matched payment transfers carry a challenge-bound attribution memo and
+ * no conflicting attribution. Otherwise, a split payment could authorize another
  * challenge after the first challenge's replay marker expires. Unmatched transfers
  * cannot establish the binding; plain transfers and non-MPP memos remain allowed.
  * @internal
  */
-function assertChallengeBoundMemos(memos, parameters) {
+function isChallengeBound(memos, parameters) {
     let bound = false;
     for (const memo of memos) {
         if (!memo || !Attribution.isMppMemo(memo))
             continue;
         if (!Attribution.verifyServer(memo, parameters.realm) ||
             !Attribution.verifyChallengeBinding(memo, parameters.challengeId))
-            throw new MismatchError('Payment verification failed: memo is not bound to this challenge.', {});
+            return false;
         bound = true;
     }
-    if (!bound)
-        throw new MismatchError('Payment verification failed: memo is not bound to this challenge.', {});
+    return bound;
 }
 /** @internal */
 class MismatchError extends PaymentError {

package/dist/tempo/server/Methods.js

@@ -1,10 +1,11 @@
 import * as Store from '../../Store.js';
 import * as Currencies from '../internal/currencies.js';
 import * as ChannelStore from '../session/server/ChannelStore.js';
-import { charge as sessionCharge_, session as session_, settle as settle_, settleBatch as settleBatch_, } from '../session/server/Session.js';
+import { charge as sessionCharge_, session as session_, settle as settle_, settleBatch as settleBatch_, verifyStream as verifyStream_, } from '../session/server/Session.js';
 import * as Settlement from '../session/server/Settlement.js';
 import * as Ws_ from '../session/server/Ws.js';
 import { charge as charge_ } from './Charge.js';
+import { fallbackStore } from './internal/fallback-store.js';
 import { renew as renewSubscription_, subscription as subscription_ } from './Subscription.js';
 const sessionServer = Object.assign(session_, {
     charge: sessionCharge_,
@@ -58,9 +59,10 @@ export function tempo(parameters) {
     }
     const { currencies: _currencies, ...shared } = parameters ?? {};
     const [first, ...rest] = Currencies.resolve(parameters ?? {});
+    const sponsorBudget = sharedSponsorBudget(parameters);
     const sessions = sessionOffers(parameters);
     function createMethods(currency, index) {
-        const configured = { ...shared, ...currency };
+        const configured = { ...shared, ...currency, sponsorBudget };
         return [createChargeMethod(configured), sessions[index]];
     }
     return [
@@ -101,12 +103,22 @@ function resolveCurrencies(parameters) {
         ...(parameters.currency === undefined ? {} : { currencies: [parameters.currency] }),
     });
 }
+/** Shares sponsor exposure across sibling offers without changing replay-store policy. */
+function sharedSponsorBudget(parameters = {}) {
+    if (parameters.sponsorBudget === false)
+        return false;
+    return {
+        ...parameters.sponsorBudget,
+        store: parameters.sponsorBudget?.store ?? parameters.store ?? Store.memory(),
+    };
+}
 /** Creates OUSD-first charge offers, with explicit currency lists replacing the defaults. */
 function chargeOffers(parameters) {
     const { currencies: _currencies, ...shared } = parameters ?? {};
     const [first, ...rest] = resolveCurrencies(parameters ?? {});
+    const sponsorBudget = sharedSponsorBudget(parameters);
     function create(currency) {
-        const configured = { ...shared, ...currency };
+        const configured = { ...shared, ...currency, sponsorBudget };
         return charge_(configured);
     }
     return [create(first), ...rest.map(create)];
@@ -115,8 +127,9 @@ function chargeOffers(parameters) {
 function sessionOffers(parameters) {
     const { currencies: _currencies, ...shared } = parameters ?? {};
     const [first, ...rest] = resolveCurrencies(parameters ?? {});
-    const store = parameters?.store ?? Store.memory();
+    const store = parameters?.store ?? fallbackStore('tempo.session');
     const settlements = new Map();
+    const verifiers = new Map();
     const key = (chainId, currency) => `${chainId}:${currency.toLowerCase()}`;
     const settleScheduled = (channel) => {
         const settle = settlements.get(key(channel.chainId, channel.token));
@@ -129,6 +142,15 @@ function sessionOffers(parameters) {
         serveWebSocket: (options) => Ws_.serve({
             ...options,
             store: ChannelStore.fromStore(store),
+            beforeCharge: async (channelId) => {
+                const channel = await ChannelStore.fromStore(store).getChannel(channelId);
+                if (!channel)
+                    throw new Error('stream channel not found');
+                const verify = verifiers.get(key(channel.chainId, channel.token));
+                if (!verify)
+                    throw new Error('Channel currency is not configured for this session handler.');
+                await verify(channelId);
+            },
             // Failed settlements are reported by the session handler; the charged request stays served.
             onChargeCommitted: (channel) => settleScheduled(channel).catch(Settlement.ignoreRetryableSettlementFailure),
         }),
@@ -137,6 +159,7 @@ function sessionOffers(parameters) {
         const configured = { ...shared, ...currency, store };
         const method = session_(configured);
         settlements.set(key(currency.chainId, currency.currency), method.extensions.settleScheduled);
+        verifiers.set(key(currency.chainId, currency.currency), (channelId) => verifyStream_(method, channelId));
         return { ...method, extensions };
     }
     return [create(first), ...rest.map(create)];
@@ -145,7 +168,7 @@ function sessionOffers(parameters) {
 function subscriptionOffers(parameters) {
     const { currencies: _currencies, ...shared } = parameters;
     const [first, ...rest] = resolveCurrencies(parameters);
-    const store = parameters.store ?? Store.memory();
+    const store = parameters.store ?? fallbackStore('tempo.subscription');
     function create(currency) {
         const configured = { ...shared, ...currency, store };
         return subscription_(configured);