mppx 0.16.0 → 0.17.0

package/dist/tempo/internal/fee-payer.js

@@ -445,8 +445,8 @@ export function assertRemainingValidity(parameters) {
         return fail('fee-sponsored transaction must declare validBefore for the expiring nonce');
     if (validBefore <= Math.floor(now.getTime() / 1_000))
         fail('fee-sponsored transaction has already expired');
-    if (validBefore < Math.ceil(now.getTime() / 1_000) + 15)
-        fail('fee-sponsored transaction needs at least 15 seconds of remaining validity');
+    if (validBefore < Math.ceil(now.getTime() / 1_000) + defaults.minRemainingValiditySeconds)
+        fail(`fee-sponsored transaction needs at least ${defaults.minRemainingValiditySeconds} seconds of remaining validity`);
 }
 /** Validates sponsor fee policy limits for a fee-payer transaction. */
 export function assertTransactionPolicy(parameters) {

package/dist/tempo/server/Charge.js

@@ -350,7 +350,7 @@ export function charge(parameters = {}) {
             }
             : undefined,
         // TODO: dedupe `{charge,session}.request`
-        async request({ credential, request }) {
+        async request({ credential, expires, request }) {
             const chainId = await (async () => {
                 if (request.chainId)
                     return request.chainId;
@@ -385,6 +385,17 @@ export function charge(parameters = {}) {
                     return account ?? (remoteFeePayer ? true : undefined);
                 return account || remoteFeePayer ? true : undefined;
             })();
+            // Issued sponsored challenges must leave room for the fee payer's
+            // minimum remaining validity, or every credential for them is rejected.
+            // Zero-amount proofs and push-only routes never use the fee payer.
+            const modes = (request.supportedModes ?? supportedModes);
+            if (!credential &&
+                resolvedFeePayer &&
+                Number(request.amount) > 0 &&
+                (modes === undefined || modes.includes('pull')) &&
+                expires !== undefined &&
+                !(Date.parse(expires) - Date.now() >= defaults.minRemainingValiditySeconds * 1000))
+                throw new Error(`Sponsored charge challenges must expire at least ${defaults.minRemainingValiditySeconds} seconds after issuance.`);
             return {
                 ...request,
                 machineTokenEnabled: request.machineTokenEnabled || undefined,