mppx 0.16.0 → 0.17.1

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # mppx
 
+## 0.17.1
+
+### Patch Changes
+
+- 95dd056: Fixed closing a Tempo session paid with a Viem Tempo access key account. `signCloseAuthorization` now signs the close authorization hash raw with the access key, as vouchers already do, instead of returning a keychain signature that TIP-1034 rejects.
+- ed76e8e: Accepted the RFC 9530 byte-sequence form (`sha-256=:base64:`) in `BodyDigest.verify`, alongside the existing bare form. `BodyDigest.compute` still emits the bare form.
+- 20eca32: Added `feeToken` to the Tempo charge client, so an access key whose spending limits exclude the default fee token can pay an unsponsored charge's fee in a token it may spend.
+- 2b747bf: Fixed Tempo charge settlement returning a fresh 402 after a paid transaction was mined: a broadcast rejected with `ExpiringNonceReplay` (for example, a retried send) now recovers the transaction's receipt instead of failing.
+- cd6a2a7: Fixed payment retries losing Request-carried HTTP methods and bodies, including valid body overrides. Rejected automatic payment after redirects with ambiguous method rewriting before creating credentials.
+- 807376f: Fixed cooperative HTTP session close inheriting the resource Request's body and abort signal while preserving its transport settings and the same resource URL.
+- 2ca12d1: Charged request-priced SSE-enabled content before invoking application handlers, including POST requests that return plain responses. Marked the receipt prepaid to avoid charging the first stream unit twice. Per-item pricing remained stream-driven. Applications must refund request charges when they cannot serve the accepted request.
+- 3fca0d6: Added an opt-in `replay` option to `Proxy.create`, so a payer who loses the connection during a long paid request can collect the response. The paid upstream request runs detached from the client, and a retry with the same credential and request gets the stored response, `202` while it runs, or a new upstream attempt after a failed delivery, without paying again.
+- afb9924: Fixed rejected WebSocket payments leaving sockets open when detailed error messages exceeded the close-frame reason limit.
+- 3c2bc84: Bound each session manager to its first HTTP origin and persisted that binding with reusable channels. Rejected cross-origin HTTP, SSE, and WebSocket reuse before disclosing channel hints or payment credentials, and prevented redirects from forwarding session requests. Existing unbound channel entries acquired an origin on their next validated reuse.
+- 9957b10: Applied the `currencies`, `maxAmount`, `maxAtomicAmount` and `expectedRecipients` client options to Tempo session payments. `tempo()` passed them only to its charge method; its session method, and `tempo.session()` given them directly, now skip offers in other currencies, to other recipients or above the cap during selection and reject them before signing or topping up a channel. An explicit close passed to `Mppx.createCredential`, `fetch` or the MCP client stays available for any offer: `canHandleChallenge` now receives the caller's credential context when it is known before selection.
+- 5d353bb: Prevented validation probes from authorizing payments through an installed global Mppx fetch wrapper.
+
+## 0.17.0
+
+### Minor Changes
+
+- 25c8468: Simplified payment-stage identity. Breaking changes to `mppx/identity`:
+
+  - Every payment offer in one 402 now carries the same HMAC-bound identity nonce, passed to verifiers as `context.nonce`. Bind payment-stage proofs to it instead of the challenge id. Routes may combine several offers with payment-stage identity (for example `tempo()`'s default currencies, or Tempo and Stripe), as long as they require the same verifiers; previously a route allowed only one such offer.
+  - Verifiers issue their 402 challenge headers through a new optional `challenge(request, { nonce })` hook, which runs once per 402, instead of returning them from `verify` as `missing`. `verify` only checks proofs.
+  - `Prover.retry` is split: `prepare(response, { challenge })` runs on a 402 before the payment retry, and `retry(response)` runs on other rejections and returns whether to resend.
+
+### Patch Changes
+
+- b149237: Raised the @hono/node-server override to 2.1.5 to resolve a dependency audit advisory.
+- faa4735: Fixed the client throwing `No Payment schemes found.` on a `402` whose `WWW-Authenticate` has no Payment challenge, so other protocols such as x402 now handle it.
+- 73b464f: Fixed the Tempo charge client signing a sponsored transaction whose `validBefore` had fewer than 15 seconds left after slow preparation: the pre-sign check now measures `validBefore` as well as the challenge expiry.
+- a0d54fd: Enforced the fee payer's 15-second remaining-validity minimum for Tempo charges: clients refused to sign a sponsored pull transaction for a challenge expiring in under 15 seconds, checking again right before signing, and servers refused to issue a sponsored challenge with a paid amount and pull mode that expires that soon. Push and zero-amount challenges were exempt. Request hooks received the expiry echoed by the credential when verifying it.
+- 7a68c55: Fixed focused tests failing in a clean checkout by generating the HTML modules on demand, and the package check's cleanup reinstalling dependencies with the publish manifest.
+- 443ad6d: Improved `mppx validate` SSE receipt scanning to search only newly received text for event boundaries, so long events no longer cost quadratic time.
+
 ## 0.16.0
 
 ### Minor Changes

package/dist/BodyDigest.js

@@ -36,6 +36,18 @@ export function compute(body) {
  * ```
  */
 export function verify(digest, body) {
-    return constantTimeEqual(compute(body), digest);
+    return constantTimeEqual(compute(body), normalize(digest));
+}
+/**
+ * Accepts the RFC 9530 byte-sequence form `sha-256=:base64hash:` (the form the
+ * Payment spec shows) by stripping its colons and restoring any padding it
+ * omits (RFC 8941 `4.2.7). Other text is left unchanged.
+ */
+function normalize(digest) {
+    const match = /^sha-256=:([A-Za-z0-9+/]+)=*:$/.exec(digest);
+    if (!match)
+        return digest;
+    const hash = match[1];
+    return `sha-256=${hash}${'='.repeat((4 - (hash.length % 4)) % 4)}`;
 }
 //# sourceMappingURL=BodyDigest.js.map

package/dist/Challenge.d.ts

@@ -215,6 +215,12 @@ export declare function serialize(challenge: Challenge): string;
  * @returns The deserialized challenge.
  */
 export declare function deserialize<const methods extends readonly Method.Method[] | undefined = undefined>(value: string, options?: from.Options<methods>): from.ReturnType<from.Parameters, methods>;
+/**
+ * Returns whether a `WWW-Authenticate` value contains a Payment challenge.
+ *
+ * @internal
+ */
+export declare function hasPaymentScheme(value: string): boolean;
 /**
  * Extracts the challenge from a Headers object.
  *

package/dist/Challenge.js

@@ -335,6 +335,18 @@ function startsWithSchemeToken(value, index, token) {
     const next = value[index + token.length];
     return Boolean(next && /\s/.test(next));
 }
+/**
+ * Returns whether a `WWW-Authenticate` value contains a Payment challenge.
+ *
+ * @internal
+ */
+export function hasPaymentScheme(value) {
+    // A bare `Payment` scheme with no parameters is still a (malformed) Payment challenge.
+    return (findSchemeStarts(value, Constants.Schemes.payment).length > 0 ||
+        value
+            .split(',')
+            .some((part) => part.trim().toLowerCase() === Constants.Schemes.payment.toLowerCase()));
+}
 /** @internal Finds auth scheme boundaries while ignoring quoted-string contents. */
 function findSchemeStarts(value, token) {
     const starts = [];

package/dist/Method.d.ts

@@ -75,6 +75,8 @@ export type VerifiedChallengeEnvelope<request extends Record<string, unknown> =
 export type RequestContext<method extends Method> = {
     capturedRequest?: CapturedRequest;
     credential?: Credential.Credential | null;
+    /** Expiry (ISO 8601) of the challenge being issued, or echoed by `credential`. */
+    expires?: string | undefined;
     request: z.input<method['schema']['request']>;
 };
 /** Verification hook parameters for a single method. */
@@ -224,8 +226,13 @@ export type CreateCredentialFn<method extends Method, context = unknown> = (para
     context: context;
 })) => Promise<string>;
 /** Predicate used when multiple client implementations share a wire method/intent. */
+/**
+ * Returns whether a client method can sign a challenge. `context` is the caller's credential
+ * context when the caller supplied it before selection, such as an explicit session close.
+ */
 export type CanHandleChallengeFn = (parameters: {
     challenge: Challenge.Challenge;
+    context?: unknown;
 }) => boolean;
 /** Request transform function for a single method. */
 export type RequestFn<method extends Method> = (options: RequestContext<method>) => MaybePromise<z.input<method['schema']['request']>>;