mppx 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,52 @@
 # mppx
 
+## 0.17.0
+
+### Minor Changes
+
+- 25c8468: Simplified payment-stage identity. Breaking changes to `mppx/identity`:
+
+  - Every payment offer in one 402 now carries the same HMAC-bound identity nonce, passed to verifiers as `context.nonce`. Bind payment-stage proofs to it instead of the challenge id. Routes may combine several offers with payment-stage identity (for example `tempo()`'s default currencies, or Tempo and Stripe), as long as they require the same verifiers; previously a route allowed only one such offer.
+  - Verifiers issue their 402 challenge headers through a new optional `challenge(request, { nonce })` hook, which runs once per 402, instead of returning them from `verify` as `missing`. `verify` only checks proofs.
+  - `Prover.retry` is split: `prepare(response, { challenge })` runs on a 402 before the payment retry, and `retry(response)` runs on other rejections and returns whether to resend.
+
+### Patch Changes
+
+- b149237: Raised the @hono/node-server override to 2.1.5 to resolve a dependency audit advisory.
+- faa4735: Fixed the client throwing `No Payment schemes found.` on a `402` whose `WWW-Authenticate` has no Payment challenge, so other protocols such as x402 now handle it.
+- 73b464f: Fixed the Tempo charge client signing a sponsored transaction whose `validBefore` had fewer than 15 seconds left after slow preparation: the pre-sign check now measures `validBefore` as well as the challenge expiry.
+- a0d54fd: Enforced the fee payer's 15-second remaining-validity minimum for Tempo charges: clients refused to sign a sponsored pull transaction for a challenge expiring in under 15 seconds, checking again right before signing, and servers refused to issue a sponsored challenge with a paid amount and pull mode that expires that soon. Push and zero-amount challenges were exempt. Request hooks received the expiry echoed by the credential when verifying it.
+- 7a68c55: Fixed focused tests failing in a clean checkout by generating the HTML modules on demand, and the package check's cleanup reinstalling dependencies with the publish manifest.
+- 443ad6d: Improved `mppx validate` SSE receipt scanning to search only newly received text for event boundaries, so long events no longer cost quadratic time.
+
+## 0.16.0
+
+### Minor Changes
+
+- 793aa2b: Replaced request attestation with per-route identity. Breaking changes:
+
+  - `mppx/attestation` became `mppx/identity`. Server `Mppx.create({ attestation })` was removed (passing it now throws); routes take `identity: [verifier, ...]` (all required), for example `mppx.charge({ amount, identity: [tap] })`, and the result exposes `result.identity.get(verifier)`.
+  - Added `Identity.anyOf(...)` to accept one of several protocols. Every member runs, so each presented proof is consumed.
+  - Verifiers return `missing`, `invalid` or `valid` (`unverified` became `invalid` with code 403), may set their own status `code` and `headers`, and declare a `stage`: `request` (checked before any 402) or `payment` (adds headers to the 402 and is checked against the answered challenge and credential before settlement). Identity rejections are returned on the non-200 branch as a 401/403 response.
+  - A composed route can include at most one offer with payment-stage identity. Payment-stage identity is not supported on methods with a preflight hook.
+  - Client `attestation` signer maps became `identity: [prover, ...]`. Provers have a required origin `scope`, receive the payment challenge in `prove(request, context)`, and can prepare proofs or request one resend with `retry(response, context)`. Requests that carry proofs do not follow redirects.
+  - TAP and Web Bot Auth moved to `mppx/extensions/identity/tap` and `mppx/extensions/identity/web-bot-auth`; `Client.signer` became `Client.prover`.
+
+### Patch Changes
+
+- e555544: Fixed client payment events masking original errors when a response body had already been consumed or locked.
+- 81a95e1: Fixed multi-method intent handlers rejecting every route option but `identity` when the methods' options can't be inferred, such as `mppx.charge({ amount })` with `stripe.create(...).defaultMethods()`.
+- c31d932: Added optional `summary` and `requestBody` to proxy endpoint definitions, emitted in the proxy's generated `/openapi.json`. Free routes can carry them as `{ free: true, summary, requestBody }`. An endpoint that is neither a payment handler, `true` nor `{ free: true }` (such as `{ pay: undefined }`) now fails closed with an error instead of being proxied.
+- dd2c3e3: Refused to sign a zero-amount Tempo proof when the Challenge realm differs from the hostname of the server that sent it, so another origin can't relay a Challenge and replay the proof at its realm. To allow a server whose realm isn't its hostname, pin the realm to its origin with `trustedTempoProofRealms` on `Mppx.create` and `Fetch.from`, such as `{ 'https://api.example.com': 'MPP Payment' }`. Without an origin (`McpClient.wrap`, or `Mppx.create` with `Transport.mcp()`), these proofs are refused unless `trustedTempoProofRealms` lists the realm. The `mppx` CLI and `sessionManager` bootstrap apply the same check, and `sessionManager` takes `trustedTempoProofRealms` too. This matches mpp-rs, mpp-go and pympp.
+- d78de2c: Fixed missing subscription access-key address indexes when reusing existing keys.
+- 909f3db: Fixed Tempo session top-up, voucher retry, close and bootstrap requests to send the credential in the header the challenge selects (such as `Payment-Authorization` with `requiresAuth`) instead of always using `Authorization`. These requests keep the paid request's own `Authorization` header and no longer follow redirects, so the credential can't reach another origin.
+- 464df9a: Fixed Tempo charge verification rejecting split amounts written with leading zeros by comparing them as integers.
+- 9008513: Removed the `allowKeyAuthorization` fee-payer policy: sponsored transactions may now carry a `keyAuthorization`, so an access key can open a fee-sponsored session (or pay a sponsored charge) in the transaction that installs it. Sponsor exposure stays bounded by `maxGas` and `maxTotalFee`.
+- 4cfd556: Fixed `mppx validate` failing Tempo session responses that stream over SSE: when the receipt arrives in the event stream instead of the `Payment-Receipt` header, validation checks the `payment-receipt` event in the stream instead of requiring the header, and fails when the stream has none.
+- 510d1ed: Fixed `mppx validate` failing valid SSE sessions: the in-stream `payment-receipt` event is now read from the server's own stream, which the session client strips, and lone-CR line endings are accepted.
+- e6d8ffc: Fixed `mppx validate` buffering SSE session streams in memory and hanging when the session client cancelled one: in-stream receipts are now read as the client consumes the stream instead of from an unread copy.
+- 464df9a: Raised the zod dependency to ^4.6.7 to pick up the fix for GHSA-mrhx-c7xc-m3w5.
+
 ## 0.15.0
 
 ### Minor Changes

package/dist/Challenge.d.ts

@@ -215,6 +215,12 @@ export declare function serialize(challenge: Challenge): string;
  * @returns The deserialized challenge.
  */
 export declare function deserialize<const methods extends readonly Method.Method[] | undefined = undefined>(value: string, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>;
+/**
+ * Returns whether a `WWW-Authenticate` value contains a Payment challenge.
+ *
+ * @internal
+ */
+export declare function hasPaymentScheme(value: string): boolean;
 /**
  * Extracts the challenge from a Headers object.
  *

package/dist/Challenge.js

@@ -335,6 +335,18 @@ function startsWithSchemeToken(value, index, token) {
     const next = value[index + token.length];
     return Boolean(next && /\s/.test(next));
 }
+/**
+ * Returns whether a `WWW-Authenticate` value contains a Payment challenge.
+ *
+ * @internal
+ */
+export function hasPaymentScheme(value) {
+    // A bare `Payment` scheme with no parameters is still a (malformed) Payment challenge.
+    return (findSchemeStarts(value, Constants.Schemes.payment).length > 0 ||
+        value
+            .split(',')
+            .some((part) => part.trim().toLowerCase() === Constants.Schemes.payment.toLowerCase()));
+}
 /** @internal Finds auth scheme boundaries while ignoring quoted-string contents. */
 function findSchemeStarts(value, token) {
     const starts = [];

package/dist/Method.d.ts

@@ -75,6 +75,8 @@ export type VerifiedChallengeEnvelope<request extends Record<string, unknown> =
 export type RequestContext<method extends Method> = {
     capturedRequest?: CapturedRequest;
     credential?: Credential.Credential | null;
+    /** Expiry (ISO 8601) of the challenge being issued, or echoed by `credential`. */
+    expires?: string | undefined;
     request: z.input<method['schema']['request']>;
 };
 /** Verification hook parameters for a single method. */