mppx 0.13.5 → 0.13.6

package/dist/client/internal/MethodChallenge.d.ts

@@ -17,4 +17,6 @@ export declare function register<const method extends Method.AnyClient>(method:
 export declare function has(method: Method.AnyClient): boolean;
 /** Runs method-specific work before creating a challenge credential. */
 export declare function handle(method: Method.AnyClient, parameters: HandlerParameters): Promise<void>;
+/** Returns the registered internal hook so a manager can coordinate its work. */
+export declare function get(method: Method.AnyClient): Handler | undefined;
 //# sourceMappingURL=MethodChallenge.d.ts.map

package/dist/client/internal/MethodChallenge.js

@@ -12,4 +12,8 @@ export function has(method) {
 export function handle(method, parameters) {
     return Promise.resolve(handlers.get(method)?.(parameters));
 }
+/** Returns the registered internal hook so a manager can coordinate its work. */
+export function get(method) {
+    return handlers.get(method);
+}
 //# sourceMappingURL=MethodChallenge.js.map

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.13.5";
+export declare const version = "0.13.6";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.13.5";
+export declare const sdkIdentifier = "mppx/0.13.6";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.13.5';
+export const version = '0.13.6';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/server/Mppx.js

@@ -1417,6 +1417,19 @@ function getPinnedRequestBindingMismatch(expectedRequest, actualRequest) {
     return (getCoreBindingMismatch(expected.coreBinding, actual.coreBinding) ??
         getMethodBindingMismatch(expected.methodBinding, actual.methodBinding));
 }
+/**
+ * Compares a credential with a composed handler's route request when dispatching. The route
+ * request lacks method details that the handler's `request()` hook adds (for example a session's
+ * `chainId` and `sessionProtocol`), so only the method fields it defines are compared. The
+ * selected handler still checks every pinned field against its full challenge.
+ */
+function getConfiguredRequestBindingMismatch(configuredRequest, actualRequest) {
+    const expected = getPinnedRequestBinding(configuredRequest);
+    const actual = getPinnedRequestBinding(actualRequest);
+    return (getCoreBindingMismatch(expected.coreBinding, actual.coreBinding) ??
+        methodBindingFields.find((field) => expected.methodBinding[field] !== undefined &&
+            !isDeepStrictEqual(expected.methodBinding[field], actual.methodBinding[field])));
+}
 function getCoreBindingMismatch(expected, actual) {
     return coreBindingFields.find((field) => !isDeepStrictEqual(expected[field], actual[field]));
 }
@@ -1448,6 +1461,15 @@ function getPinnedRequestBinding(request) {
         },
     };
 }
+/**
+ * Compares a credential with a composed handler's stable route binding when dispatching. The route
+ * request lacks fields its `request()` hook adds, so only the fields it defines are compared; the
+ * selected handler still checks the full binding against its challenge.
+ */
+function getConfiguredStableBindingMismatch(expected, actual) {
+    return Object.keys(expected).find((field) => expected[field] !== undefined &&
+        !isDeepStrictEqual(normalizeComparable(expected[field]), normalizeComparable(actual[field])));
+}
 function getRequestBindingMismatch(expected, actual) {
     const fields = [
         ...Object.keys(expected),
@@ -1602,9 +1624,13 @@ function composeHandlers(handlers, composeOptions, selectOffers) {
                         if (internal.name !== credMethod || internal.intent !== credIntent)
                             return false;
                         const mismatch = internal._stableBinding
-                            ? getRequestBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credReq, internal._stableBinding))
-                            : getPinnedRequestBindingMismatch(internal._canonicalRequest, credReq);
-                        return !mismatch && opaqueValuesMatch(internal.meta, credential.challenge.meta);
+                            ? getConfiguredStableBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credReq, internal._stableBinding))
+                            : getConfiguredRequestBindingMismatch(internal._canonicalRequest, credReq);
+                        // A handler without a static scope issues challenges scoped to the request's route.
+                        const effectiveMeta = internal.scope === undefined
+                            ? Scope.merge({ meta: internal.meta, scope: Scope.get(input) })
+                            : internal.meta;
+                        return !mismatch && opaqueValuesMatch(effectiveMeta, credential.challenge.meta);
                     }
                     catch {
                         return false;
@@ -1806,8 +1832,8 @@ function composeMcpHandlers(handlers, transport) {
             const match = candidates.find((handler) => getConfiguredOffers(handler).some((internal) => {
                 try {
                     const mismatch = internal._stableBinding
-                        ? getRequestBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credential.challenge.request, internal._stableBinding))
-                        : getPinnedRequestBindingMismatch(internal._canonicalRequest, credential.challenge.request);
+                        ? getConfiguredStableBindingMismatch(getStableBinding(internal._canonicalRequest, internal._stableBinding), getStableBinding(credential.challenge.request, internal._stableBinding))
+                        : getConfiguredRequestBindingMismatch(internal._canonicalRequest, credential.challenge.request);
                     return !mismatch && opaqueValuesMatch(internal.meta, credential.challenge.meta);
                 }
                 catch {

package/dist/stripe/server/Methods.js

@@ -133,7 +133,7 @@ export function stripe(parameters) {
         const suppliedStore = params.store;
         if (suppliedStore !== undefined && suppliedStore !== store)
             throw new Error('stripe.create() Tempo sessions must use the factory-level shared atomic `store`.');
-        const { recipient, onSessionSettlement, ...rest } = params;
+        const { recipient, canOffer, onSessionSettlement, ...rest } = params;
         return tempoSession({
             currency: tempoCurrency,
             recipient,
@@ -141,6 +141,9 @@ export function stripe(parameters) {
             ...(hostedTempoFeePayer && { feePayer: hostedTempoFeePayer }),
             ...rest,
             store,
+            canOffer: canOffer
+                ? async (context) => cryptoCanOffer(context) && (await canOffer(context))
+                : cryptoCanOffer,
             async onSessionSettlement(context) {
                 await tempoPaymentHandler({
                     intent: 'session',

package/dist/tempo/client/Charge.js

@@ -171,6 +171,7 @@ export function charge(parameters = {}) {
                         tokenOut: currency,
                         tokenIn: autoSwap.tokenIn,
                         slippage: autoSwap.slippage,
+                        maxAmountIn: autoSwap.maxAmountIn,
                     })
                     : undefined;
             }

package/dist/tempo/internal/auto-swap.d.ts

@@ -17,6 +17,8 @@ export declare namespace findCalls {
         amountOut: bigint;
         /** Candidate input tokens to swap from, in priority order. */
         tokenIn: readonly Address[];
+        /** Maximum input-token units to spend. Defaults to the missing output amount plus slippage (1:1 units). */
+        maxAmountIn?: bigint | undefined;
         /** Max slippage tolerance as a percentage (e.g. `1` = 1%). */
         slippage: number;
         /** Address of the target token to acquire. */
@@ -29,8 +31,15 @@ export declare namespace findCalls {
 export declare function resolve(value: resolve.Value | undefined, defaultCurrencies: readonly Address[]): resolve.Resolved | false;
 export declare namespace resolve {
     type Options = {
+        /** Maximum input-token units per swap. Defaults to parity with the missing output amount plus slippage; set explicitly for non-parity pairs. */
+        maxAmountIn?: bigint | undefined;
         /** Fallback tokens to try swapping from, in priority order. */
         tokenIn?: Address[] | undefined;
+        /**
+         * Whether to also try the default currencies after `tokenIn`. Set `false` to swap only from
+         * `tokenIn`, as an allowlist. Ignored without `tokenIn`. @default true
+         */
+        fallback?: boolean | undefined;
         /** Max slippage tolerance as a percentage (e.g. `1` = 1%). @default 1 */
         slippage?: number | undefined;
     };
@@ -38,6 +47,7 @@ export declare namespace resolve {
     type Resolved = {
         tokenIn: readonly Address[];
         slippage: number;
+        maxAmountIn?: bigint | undefined;
     };
 }
 export declare class InsufficientFundsError extends Error {

package/dist/tempo/internal/auto-swap.js

@@ -8,6 +8,7 @@ const bps = 10000n;
 export const defaultCurrencies = [
     defaults.tokens.pathUsd,
     defaults.tokens.usdc,
+    defaults.tokens.ousd,
 ];
 /**
  * Finds the optimal swap calls to acquire `amountOut` of `tokenOut`,
@@ -18,15 +19,34 @@ export const defaultCurrencies = [
  */
 export async function findCalls(client, parameters) {
     const { account, amountOut, tokenOut, tokenIn, slippage } = parameters;
+    if (!Number.isFinite(slippage) || slippage < 0 || slippage > 50)
+        throw new Error('Auto-swap slippage must be between 0 and 50 percent.');
+    if (parameters.maxAmountIn !== undefined && parameters.maxAmountIn <= 0n)
+        throw new Error('Auto-swap maxAmountIn must be positive.');
     const candidates = tokenIn.filter((t) => !TempoAddress.isEqual(t, tokenOut));
+    // Reads never carry the client's account: a node refuses every call from an access key whose
+    // authorization is not yet published, which would hide every route from a new key.
     const balanceResults = await Promise.allSettled([
-        readContract(client, Actions.token.getBalance.call(client, { account, token: tokenOut })),
-        ...candidates.map((t) => readContract(client, Actions.token.getBalance.call(client, { account, token: t }))),
+        readContract(client, {
+            ...Actions.token.getBalance.call(client, { account, token: tokenOut }),
+            account: null,
+        }),
+        ...candidates.map((t) => readContract(client, {
+            ...Actions.token.getBalance.call(client, { account, token: t }),
+            account: null,
+        })),
     ]);
     // If the account already has enough of the target token, no swap needed.
     const targetBalance = balanceResults[0];
-    if (targetBalance.status === 'fulfilled' && targetBalance.value >= amountOut)
+    if (targetBalance.status !== 'fulfilled')
+        throw targetBalance.reason;
+    const held = targetBalance.value;
+    if (held >= amountOut)
         return undefined;
+    const deficit = amountOut - held;
+    const slippageBps = BigInt(Math.round(slippage * 100));
+    // Bound price independently of the DEX quote. Stablecoin units default to parity.
+    const spendLimit = parameters.maxAmountIn ?? deficit + (deficit * slippageBps) / bps;
     // Find first candidate with enough balance to cover a swap.
     for (let i = 0; i < candidates.length; i++) {
         const result = balanceResults[i + 1];
@@ -38,12 +58,16 @@ export async function findCalls(client, parameters) {
         const tokenIn = candidates[i];
         try {
             const quotedAmountIn = await Actions.dex.getBuyQuote(client, {
+                account: null,
                 tokenIn,
                 tokenOut,
-                amountOut,
+                amountOut: deficit,
             });
-            if (balance >= quotedAmountIn) {
-                const maxAmountIn = quotedAmountIn + (quotedAmountIn * BigInt(Math.round(slippage * 100))) / bps;
+            if (quotedAmountIn <= 0n || quotedAmountIn > spendLimit)
+                continue;
+            const quotedLimit = quotedAmountIn + (quotedAmountIn * slippageBps) / bps;
+            const maxAmountIn = quotedLimit < spendLimit ? quotedLimit : spendLimit;
+            if (balance >= maxAmountIn) {
                 return [
                     Actions.token.approve.call(client, {
                         amount: maxAmountIn,
@@ -53,7 +77,7 @@ export async function findCalls(client, parameters) {
                     Actions.dex.buy.call({
                         tokenIn,
                         tokenOut,
-                        amountOut,
+                        amountOut: deficit,
                         maxAmountIn,
                     }),
                 ];
@@ -72,12 +96,15 @@ export function resolve(value, defaultCurrencies) {
     const tokenIn = value.tokenIn
         ? [
             ...value.tokenIn,
-            ...defaultCurrencies.filter((d) => !value.tokenIn.some((c) => TempoAddress.isEqual(c, d))),
+            ...(value.fallback === false
+                ? []
+                : defaultCurrencies.filter((d) => !value.tokenIn.some((c) => TempoAddress.isEqual(c, d)))),
         ]
         : defaultCurrencies;
     return {
         tokenIn,
         slippage: value.slippage ?? 1,
+        ...(value.maxAmountIn !== undefined ? { maxAmountIn: value.maxAmountIn } : {}),
     };
 }
 export class InsufficientFundsError extends Error {

package/dist/tempo/internal/fee-payer.d.ts

@@ -124,6 +124,14 @@ export declare function validateCalls(calls: readonly {
     currency?: TempoAddress.Address | undefined;
     expectedTransfers?: readonly ExpectedTransfer[] | undefined;
 }): TempoAddress.Address | undefined;
+/** Rejects transactions that can expire before sponsorship and submission finish. */
+export declare function assertRemainingValidity(parameters: {
+    details?: Record<string, string> | undefined;
+    now?: Date | undefined;
+    transaction: {
+        validBefore?: number | undefined;
+    };
+}): undefined;
 /** Validates sponsor fee policy limits for a fee-payer transaction. */
 export declare function assertTransactionPolicy(parameters: {
     challengeExpires?: string | undefined;

package/dist/tempo/internal/fee-payer.js

@@ -385,8 +385,8 @@ export function validateCalls(calls, details, options) {
         const expectedAmountOut = expectedTransfers.reduce((sum, transfer) => sum + BigInt(transfer.amount), 0n);
         if (!TempoAddress_internal.isEqual(tokenOut, currency))
             throw new FeePayerValidationError('swap tokenOut does not match payment currency', details);
-        if (amountOut !== expectedAmountOut)
-            throw new FeePayerValidationError('swap output does not match payment amount', details);
+        if (amountOut <= 0n || amountOut > expectedAmountOut)
+            throw new FeePayerValidationError('swap output must be positive and no greater than payment amount', details);
     }
     const transferCalls = calls.slice(hasSwapPrefix ? 2 : 0);
     const sorted = [...expectedTransfers].sort((a, b) => {
@@ -436,6 +436,20 @@ export function validateCalls(calls, details, options) {
     }
     return approveCall?.to ?? currency;
 }
+/** Rejects transactions that can expire before sponsorship and submission finish. */
+export function assertRemainingValidity(parameters) {
+    const { details = {}, now = new Date(), transaction } = parameters;
+    const { validBefore } = transaction;
+    const fail = (reason) => {
+        throw new FeePayerValidationError(reason, { ...details, validBefore: String(validBefore) });
+    };
+    if (validBefore === undefined)
+        return fail('fee-sponsored transaction must declare validBefore for the expiring nonce');
+    if (validBefore <= Math.floor(now.getTime() / 1_000))
+        fail('fee-sponsored transaction has already expired');
+    if (validBefore < Math.ceil(now.getTime() / 1_000) + 15)
+        fail('fee-sponsored transaction needs at least 15 seconds of remaining validity');
+}
 /** Validates sponsor fee policy limits for a fee-payer transaction. */
 export function assertTransactionPolicy(parameters) {
     const { challengeExpires, chainId, details, now = new Date(), policy: policyOverrides, transaction, } = parameters;
@@ -490,19 +504,13 @@ export function assertTransactionPolicy(parameters) {
     if (validBefore === undefined)
         fail('fee-sponsored transaction must declare validBefore for the expiring nonce');
     const validBeforeValue = validBefore;
-    const nowSeconds = Math.floor(now.getTime() / 1_000);
-    if (validBeforeValue <= nowSeconds)
-        fail('fee-sponsored transaction has already expired', {
-            validBefore: String(validBeforeValue),
-        });
-    if (validBeforeValue < Math.ceil(now.getTime() / 1_000) + 15)
-        fail('fee-sponsored transaction needs at least 15 seconds of remaining validity', {
-            validBefore: String(validBeforeValue),
-        });
+    if (!Number.isInteger(policy.maxValidityWindowSeconds) || policy.maxValidityWindowSeconds < 15)
+        fail('sponsor maxValidityWindowSeconds must be an integer of at least 15 seconds');
+    assertRemainingValidity({ transaction, details, now });
     const challengeExpirySeconds = challengeExpires
         ? Math.floor(new Date(challengeExpires).getTime() / 1_000)
         : undefined;
-    const maxValidBefore = Math.min(nowSeconds + policy.maxValidityWindowSeconds, challengeExpirySeconds ? challengeExpirySeconds + 60 : Number.MAX_SAFE_INTEGER);
+    const maxValidBefore = Math.min(Math.ceil(now.getTime() / 1_000) + policy.maxValidityWindowSeconds, challengeExpirySeconds ? challengeExpirySeconds + 60 : Number.MAX_SAFE_INTEGER);
     if (validBeforeValue > maxValidBefore)
         fail('fee-sponsored transaction validity window exceeds sponsor policy', {
             validBefore: String(validBeforeValue),

package/dist/tempo/legacy/session/Chain.js

@@ -373,7 +373,10 @@ export async function broadcastOpenTransaction(parameters) {
                     return { feePayer: feePayer.address, transaction: sponsored };
                 },
             });
-            return signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            const serialized = await signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            return serialized;
         }
         return serializedTransaction;
     };
@@ -491,7 +494,10 @@ export async function broadcastTopUpTransaction(parameters) {
                     return { feePayer: feePayer.address, transaction: sponsored };
                 },
             });
-            return signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            const serialized = await signTransaction(client, completed.transaction);
+            FeePayer.assertRemainingValidity({ transaction: completed.transaction });
+            return serialized;
         }
         return serializedTransaction;
     })();

package/dist/tempo/server/Methods.js

@@ -1,7 +1,7 @@
 import * as Store from '../../Store.js';
 import * as Currencies from '../internal/currencies.js';
 import * as ChannelStore from '../session/server/ChannelStore.js';
-import { charge as sessionCharge_, session as session_, settle as settle_, settleBatch as settleBatch_, } from '../session/server/Session.js';
+import { charge as sessionCharge_, session as session_, settle as settle_, settleBatch as settleBatch_, verifyStream as verifyStream_, } from '../session/server/Session.js';
 import * as Settlement from '../session/server/Settlement.js';
 import * as Ws_ from '../session/server/Ws.js';
 import { charge as charge_ } from './Charge.js';
@@ -129,6 +129,7 @@ function sessionOffers(parameters) {
     const [first, ...rest] = resolveCurrencies(parameters ?? {});
     const store = parameters?.store ?? fallbackStore('tempo.session');
     const settlements = new Map();
+    const verifiers = new Map();
     const key = (chainId, currency) => `${chainId}:${currency.toLowerCase()}`;
     const settleScheduled = (channel) => {
         const settle = settlements.get(key(channel.chainId, channel.token));
@@ -141,6 +142,15 @@ function sessionOffers(parameters) {
         serveWebSocket: (options) => Ws_.serve({
             ...options,
             store: ChannelStore.fromStore(store),
+            beforeCharge: async (channelId) => {
+                const channel = await ChannelStore.fromStore(store).getChannel(channelId);
+                if (!channel)
+                    throw new Error('stream channel not found');
+                const verify = verifiers.get(key(channel.chainId, channel.token));
+                if (!verify)
+                    throw new Error('Channel currency is not configured for this session handler.');
+                await verify(channelId);
+            },
             // Failed settlements are reported by the session handler; the charged request stays served.
             onChargeCommitted: (channel) => settleScheduled(channel).catch(Settlement.ignoreRetryableSettlementFailure),
         }),
@@ -149,6 +159,7 @@ function sessionOffers(parameters) {
         const configured = { ...shared, ...currency, store };
         const method = session_(configured);
         settlements.set(key(currency.chainId, currency.currency), method.extensions.settleScheduled);
+        verifiers.set(key(currency.chainId, currency.currency), (channelId) => verifyStream_(method, channelId));
         return { ...method, extensions };
     }
     return [create(first), ...rest.map(create)];

package/dist/tempo/server/Relay.js

@@ -1,4 +1,3 @@
-import { Bytes, Hash, Hex, Json } from 'ox';
 import { PaymentExpiredError, VerificationFailedError } from '../../Errors.js';
 import * as Receipt from '../../Receipt.js';
 const defaultApiBaseUrl = 'https://api.tempo.xyz';
@@ -43,9 +42,7 @@ export function configure(method, options) {
     };
     const broadcast = async (parameters) => {
         const input = toRelayInput(parameters.credential);
-        const receipt = await request.broadcast(input, {
-            idempotencyKey: idempotencyKey(input),
-        });
+        const receipt = await request.broadcast(input);
         if (receipt.method !== method.name)
             throw failure();
         try {
@@ -72,7 +69,7 @@ function createRequest(options) {
     const apiBaseUrl = new URL(options.apiBaseUrl ?? defaultApiBaseUrl);
     if (!apiBaseUrl.pathname.endsWith('/'))
         apiBaseUrl.pathname += '/';
-    async function post(path, input, headers) {
+    async function post(path, input) {
         let response;
         try {
             response = await fetch(new URL(path, apiBaseUrl), {
@@ -81,7 +78,6 @@ function createRequest(options) {
                     Accept: 'application/json',
                     'content-type': 'application/json',
                     'tempo-api-key': options.apiKey,
-                    ...headers,
                 },
                 method: 'POST',
             });
@@ -98,10 +94,10 @@ function createRequest(options) {
         if (!isValidateSuccess(response))
             throw failure(response);
     };
-    const broadcast = async (input, broadcastOptions) => {
-        const response = await post('v1/mpp/broadcast', input, {
-            'idempotency-key': broadcastOptions.idempotencyKey,
-        });
+    const broadcast = async (input) => {
+        // A cached settlement receipt must not authorize another protected operation.
+        // Omitting the idempotency key leaves credential consumption to the relay.
+        const response = await post('v1/mpp/broadcast', input);
         if (!isBroadcastSuccess(response))
             throw failure(response);
         return response.receipt;
@@ -118,18 +114,6 @@ function toRelayInput(credential) {
         ...(credential.source ? { source: credential.source } : {}),
     };
 }
-function idempotencyKey(input) {
-    const payload = input.payload;
-    if (isRecord(payload) &&
-        payload.type === 'transaction' &&
-        typeof payload.signature === 'string' &&
-        Hex.validate(payload.signature)) {
-        const transactionHash = Hash.keccak256(Hex.toBytes(payload.signature), { as: 'Hex' });
-        return `mpp_${transactionHash}`;
-    }
-    const hash = Hash.sha256(Bytes.fromString(Json.canonicalize(input)), { as: 'Hex' });
-    return `mpp_${hash}`;
-}
 function failure(value) {
     const code = relayErrorCodeFrom(value);
     if (code === 'expired')

package/dist/tempo/server/Subscription.js

@@ -738,6 +738,7 @@ async function submitSubscriptionPayment(parameters) {
                 };
             },
         });
+        FeePayer.assertRemainingValidity({ transaction: completed.transaction });
         return await signTransaction(client, completed.transaction);
     })();
     const transaction = Transaction.deserialize(serializedTransaction);
@@ -748,6 +749,8 @@ async function submitSubscriptionPayment(parameters) {
             calls: transaction.calls,
             feePayerSignature: undefined,
         });
+    if (feePayer)
+        FeePayer.assertRemainingValidity({ transaction });
     if (!waitForConfirmation) {
         // Optimistic mode has no receipt to inspect, so it cannot detect a T6
         // (TIP-1028) held transfer. Use `waitForConfirmation: true` for T6-safe proof.