mppx 0.13.4 → 0.13.6

package/dist/tempo/server/Relay.js

@@ -1,4 +1,3 @@
-import { Bytes, Hash, Hex, Json } from 'ox';
 import { PaymentExpiredError, VerificationFailedError } from '../../Errors.js';
 import * as Receipt from '../../Receipt.js';
 const defaultApiBaseUrl = 'https://api.tempo.xyz';
@@ -43,9 +42,7 @@ export function configure(method, options) {
     };
     const broadcast = async (parameters) => {
         const input = toRelayInput(parameters.credential);
-        const receipt = await request.broadcast(input, {
-            idempotencyKey: idempotencyKey(input),
-        });
+        const receipt = await request.broadcast(input);
         if (receipt.method !== method.name)
             throw failure();
         try {
@@ -72,7 +69,7 @@ function createRequest(options) {
     const apiBaseUrl = new URL(options.apiBaseUrl ?? defaultApiBaseUrl);
     if (!apiBaseUrl.pathname.endsWith('/'))
         apiBaseUrl.pathname += '/';
-    async function post(path, input, headers) {
+    async function post(path, input) {
         let response;
         try {
             response = await fetch(new URL(path, apiBaseUrl), {
@@ -81,7 +78,6 @@ function createRequest(options) {
                     Accept: 'application/json',
                     'content-type': 'application/json',
                     'tempo-api-key': options.apiKey,
-                    ...headers,
                 },
                 method: 'POST',
             });
@@ -98,10 +94,10 @@ function createRequest(options) {
         if (!isValidateSuccess(response))
             throw failure(response);
     };
-    const broadcast = async (input, broadcastOptions) => {
-        const response = await post('v1/mpp/broadcast', input, {
-            'idempotency-key': broadcastOptions.idempotencyKey,
-        });
+    const broadcast = async (input) => {
+        // A cached settlement receipt must not authorize another protected operation.
+        // Omitting the idempotency key leaves credential consumption to the relay.
+        const response = await post('v1/mpp/broadcast', input);
         if (!isBroadcastSuccess(response))
             throw failure(response);
         return response.receipt;
@@ -118,18 +114,6 @@ function toRelayInput(credential) {
         ...(credential.source ? { source: credential.source } : {}),
     };
 }
-function idempotencyKey(input) {
-    const payload = input.payload;
-    if (isRecord(payload) &&
-        payload.type === 'transaction' &&
-        typeof payload.signature === 'string' &&
-        Hex.validate(payload.signature)) {
-        const transactionHash = Hash.keccak256(Hex.toBytes(payload.signature), { as: 'Hex' });
-        return `mpp_${transactionHash}`;
-    }
-    const hash = Hash.sha256(Bytes.fromString(Json.canonicalize(input)), { as: 'Hex' });
-    return `mpp_${hash}`;
-}
 function failure(value) {
     const code = relayErrorCodeFrom(value);
     if (code === 'expired')

package/dist/tempo/server/Subscription.js

@@ -18,6 +18,7 @@ import * as Methods from '../Methods.js';
 import { assertSubscriptionTiming, toSubscriptionPeriodSeconds, verifySubscriptionKeyAuthorization, } from '../subscription/KeyAuthorization.js';
 import * as SubscriptionReceipt from '../subscription/Receipt.js';
 import * as SubscriptionStore from '../subscription/Store.js';
+import { fallbackStore } from './internal/fallback-store.js';
 /**
  * Creates a Tempo subscription method for recurring TIP-20 token payments.
  *
@@ -25,7 +26,7 @@ import * as SubscriptionStore from '../subscription/Store.js';
  */
 export function subscription(p) {
     const parameters = p;
-    const rawStore = (parameters.store ?? Store.memory());
+    const rawStore = (parameters.store ?? fallbackStore('tempo.subscription'));
     if (typeof rawStore.update !== 'function') {
         throw new Error('tempo.subscription() requires an atomic store with `update`.');
     }
@@ -737,6 +738,7 @@ async function submitSubscriptionPayment(parameters) {
                 };
             },
         });
+        FeePayer.assertRemainingValidity({ transaction: completed.transaction });
         return await signTransaction(client, completed.transaction);
     })();
     const transaction = Transaction.deserialize(serializedTransaction);
@@ -747,6 +749,8 @@ async function submitSubscriptionPayment(parameters) {
             calls: transaction.calls,
             feePayerSignature: undefined,
         });
+    if (feePayer)
+        FeePayer.assertRemainingValidity({ transaction });
     if (!waitForConfirmation) {
         // Optimistic mode has no receipt to inspect, so it cannot detect a T6
         // (TIP-1028) held transfer. Use `waitForConfirmation: true` for T6-safe proof.

package/dist/tempo/server/internal/fallback-store.d.ts

@@ -0,0 +1,9 @@
+import * as Store from '../../../Store.js';
+/**
+ * Creates the in-memory store used when a Tempo server method is configured without `store`.
+ *
+ * Replay protection backed by this store only covers the current instance, so this warns once
+ * per `method` per process.
+ */
+export declare function fallbackStore(method: string): Store.AtomicStore;
+//# sourceMappingURL=fallback-store.d.ts.map

package/dist/tempo/server/internal/fallback-store.js

@@ -0,0 +1,13 @@
+import { warnOnce } from '../../../internal/warnOnce.js';
+import * as Store from '../../../Store.js';
+/**
+ * Creates the in-memory store used when a Tempo server method is configured without `store`.
+ *
+ * Replay protection backed by this store only covers the current instance, so this warns once
+ * per `method` per process.
+ */
+export function fallbackStore(method) {
+    warnOnce(`memory-store:${method}`, `${method}() has no \`store\` configured and is using an in-memory store. Replay protection and payment state are scoped to this instance, so a credential accepted by one replica, serverless isolate, or per-request \`Mppx\` instance can be accepted again by another. Pass a shared atomic store (e.g. \`Store.redis()\`, \`Store.upstash()\`, or \`Store.cloudflare()\` with \`update\`) when running more than one instance.`);
+    return Store.memory();
+}
+//# sourceMappingURL=fallback-store.js.map