mppx 0.16.0 → 0.17.1

package/dist/tempo/session/client/ChannelOps.d.ts

@@ -19,6 +19,8 @@ export type TempoChannelCall = {
 };
 /** Client-side cached channel metadata used for automatic voucher management. */
 export type ChannelEntry = {
+    /** HTTP origin bound by a session manager; absent on legacy or standalone method entries. */
+    origin?: string | undefined;
     /** TIP-1034 channel ID derived from descriptor, escrow, and chain ID. */
     channelId: Hex.Hex;
     /** Highest cumulative amount this client has locally authorized. */

package/dist/tempo/session/client/ChannelStore.js

@@ -91,6 +91,11 @@ export function withFundingLock(store, key, operation) {
 export async function persistChannel(store, entry) {
     await exclusive(store, `write:${entryKey(entry)}`, async () => {
         const current = await store.get(entryKey(entry));
+        if (current?.origin !== undefined) {
+            if (entry.origin !== undefined && entry.origin !== current.origin)
+                throw new Error('SessionManager: stored channel origin mismatch');
+            entry.origin = current.origin;
+        }
         if (current?.uncertainTopUp) {
             if (current.channelId !== entry.channelId)
                 throw new Error('Session funding outcome is unknown; reconcile the pending payment before replacing the channel.');

package/dist/tempo/session/client/Session.d.ts

@@ -134,7 +134,20 @@ export declare namespace session {
         autoSwap?: AutoSwap.resolve.Value | undefined;
         /** Pluggable persistence for reusable channels. Defaults to an in-memory store. */
         channelStore?: ChannelStore | undefined;
-        /** Token decimals for parsing human-readable amounts (default: 6). */
+        /**
+         * Allowlist of TIP-20 currency addresses this client will pay sessions in, compared
+         * case-insensitively. Offers in other currencies are skipped during selection and
+         * rejected before signing; an empty list rejects all. Required with `maxAmount` or
+         * `maxAtomicAmount`, which are denominated in the challenge currency.
+         */
+        currencies?: readonly Address[] | undefined;
+        /**
+         * Allowlist of session recipients (the channel payee), compared case-insensitively. Offers
+         * to other recipients, or without one, are skipped during selection and rejected before
+         * signing, as for charge. Explicit closes are exempt.
+         */
+        expectedRecipients?: readonly Address[] | undefined;
+        /** Token decimals for parsing human-readable amounts (default: 6). `maxAmount` requires it explicitly. */
         decimals?: number | undefined;
         /** Exact TIP20EscrowChannel address pin. Takes precedence over `allowCustomEscrow`. */
         escrow?: Address | undefined;
@@ -144,6 +157,18 @@ export declare namespace session {
          * challenge or resolved client must select an allowed chain.
          */
         allowedChainIds?: readonly number[] | undefined;
+        /**
+         * Maximum display-unit amount (e.g. `'1.5'`) the client is willing to pay per session
+         * unit (the challenge `amount`), parsed with an explicit `decimals`. Values with more
+         * fractional digits than `decimals` are rejected rather than rounded. Larger offers are
+         * skipped during selection and rejected before signing. Requires `currencies`.
+         */
+        maxAmount?: string | undefined;
+        /**
+         * Maximum amount the client is willing to pay per session unit, in raw base units of the
+         * challenge currency. Checked like `maxAmount`. Requires `currencies`.
+         */
+        maxAtomicAmount?: string | undefined;
         /** Maximum channel deposit in human-readable units. Caps server-suggested opens and automatic top-ups. */
         maxDeposit?: string | undefined;
         /**

package/dist/tempo/session/client/Session.js

@@ -4,6 +4,7 @@ import * as MethodChallenge from '../../../client/internal/MethodChallenge.js';
 import * as MethodResponse from '../../../client/internal/MethodResponse.js';
 import * as Constants from '../../../Constants.js';
 import * as Credential from '../../../Credential.js';
+import * as AcceptPayment from '../../../internal/AcceptPayment.js';
 import * as Method from '../../../Method.js';
 import * as Account from '../../../viem/Account.js';
 import * as Client from '../../../viem/Client.js';
@@ -69,6 +70,65 @@ function acknowledgesOpen(outcome, challenge, opened) {
         return matchesOpen(opened, getSessionSnapshot(candidate));
     }) ?? false);
 }
+/** Validates and parses the client's session spending options once, at construction. */
+function resolveSpendingPolicy(parameters) {
+    const { currencies, decimals, expectedRecipients, maxAmount, maxAtomicAmount } = parameters;
+    // Caps are denominated in the challenge currency, so they require a currency pin.
+    if ((maxAmount !== undefined || maxAtomicAmount !== undefined) && currencies === undefined)
+        throw new Error('Tempo session maxAmount and maxAtomicAmount require currencies.');
+    return {
+        currencies: currencies?.map((currency) => currency.toLowerCase()),
+        expectedRecipients: expectedRecipients
+            ? new Set(expectedRecipients.map((recipient) => recipient.toLowerCase()))
+            : undefined,
+        maxAmount: parseMaxAmount(maxAmount, decimals),
+        maxAtomicAmount: maxAtomicAmount === undefined ? undefined : BigInt(maxAtomicAmount),
+    };
+}
+/** Parses a display-unit cap, rejecting values that `parseUnits` would round. */
+function parseMaxAmount(maxAmount, decimals) {
+    if (maxAmount === undefined)
+        return undefined;
+    if (decimals === undefined)
+        throw new Error('Tempo session maxAmount requires currency decimals.');
+    const fraction = maxAmount.split('.')[1]?.replace(/0+$/, '') ?? '';
+    if (fraction.length > decimals)
+        throw new Error(`Tempo session maxAmount ${maxAmount} has more fractional digits than ${decimals} decimals allow.`);
+    return parseUnits(maxAmount, decimals);
+}
+/**
+ * Rejects a session challenge whose currency, recipient or per-unit amount violates the client
+ * policy. Runs during challenge selection, in the automatic top-up hook, and before any signing work.
+ */
+function assertSpendingPolicy(policy, request) {
+    if (policy.currencies && !policy.currencies.includes(request.currency.toLowerCase()))
+        throw new Error(`Tempo session currency is not allowed: ${request.currency}.`);
+    // The recipient is the channel payee, so it must be one the client expects, as for charge.
+    if (policy.expectedRecipients &&
+        (!request.recipient || !policy.expectedRecipients.has(request.recipient.toLowerCase())))
+        throw new Error(`Unexpected session recipient: ${request.recipient}`);
+    const amount = BigInt(request.amount);
+    if (policy.maxAtomicAmount !== undefined && amount > policy.maxAtomicAmount)
+        throw new Error('Tempo session amount exceeds maxAtomicAmount.');
+    if (policy.maxAmount !== undefined && amount > policy.maxAmount)
+        throw new Error('Tempo session amount exceeds maxAmount.');
+}
+/** Returns whether a session challenge satisfies the client policy. */
+function satisfiesSpendingPolicy(policy, request) {
+    try {
+        assertSpendingPolicy(policy, request);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Returns whether a caller-supplied credential context asks to close a channel. */
+function isExplicitClose(context) {
+    return (typeof context === 'object' &&
+        context !== null &&
+        context.action === 'close');
+}
 /**
  * Creates the low-level TIP-1034 session payment method for use with `Mppx.create()`.
  *
@@ -78,6 +138,7 @@ function acknowledgesOpen(outcome, challenge, opened) {
  */
 export function session(parameters = {}) {
     const { account, allowCustomEscrow = false, autoSwap: autoSwapParameter, channelStore, decimals = defaults.decimals, escrow: escrowOverride, allowedChainIds, getClient: getClientParameter, maxDeposit: maxDepositParameter, topUpAmount: topUpAmountParameter, onChannelUpdate, resolveAccount, } = parameters;
+    const policy = resolveSpendingPolicy(parameters);
     const getClient = Client.getResolver({
         chain: tempo_chain,
         getClient: getClientParameter,
@@ -112,10 +173,19 @@ export function session(parameters = {}) {
         resolved,
     });
     const method = Method.toClient(Methods.session, {
-        canHandleChallenge: ({ challenge }) => isTip1034SessionChallenge(challenge),
+        // Skip offers that violate client policy so an acceptable offer can be chosen. An explicit
+        // close, when the caller supplies it before selection, stays available for any offer. Flows
+        // that learn the context only after selection defer the policy to createCredential.
+        canHandleChallenge: ({ challenge, context }) => isTip1034SessionChallenge(challenge) &&
+            (isExplicitClose(context) ||
+                context === AcceptPayment.deferredContext ||
+                satisfiesSpendingPolicy(policy, challenge.request)),
         context: sessionContextSchema,
         async createCredential(parameters) {
             const { challenge, context } = parameters;
+            // Closing settles what the channel already spent, so it stays available for any offer.
+            if (context?.action !== 'close')
+                assertSpendingPolicy(policy, challenge.request);
             const resolved = await resolveChallengeContext({
                 allowCustomEscrow,
                 challenge,
@@ -252,6 +322,7 @@ export function session(parameters = {}) {
         const sessionContext = context === undefined ? undefined : sessionContextSchema.parse(context);
         if (hasSessionAction(sessionContext))
             return;
+        assertSpendingPolicy(policy, challenge.request);
         const resolved = await resolveChallengeContext({
             allowCustomEscrow,
             challenge,

package/dist/tempo/session/client/SessionManager.d.ts

@@ -60,6 +60,7 @@ export declare function mergeSessionCredentialContext(credentialContext: unknown
  * channel state management and credential creation, and to `Fetch.from`
  * for the 402 challenge/retry flow.
  *
+ * Each manager is pinned to its first request origin. Use a separate manager per origin.
  * `channelStore` can persist reusable channels between manager instances.
  */
 export declare function sessionManager(parameters: sessionManager.Parameters): SessionManager;

package/dist/tempo/session/client/SessionManager.js

@@ -7,6 +7,7 @@ import * as MethodResponse from '../../../client/internal/MethodResponse.js';
 import * as ProofRealm from '../../../client/internal/ProofRealm.js';
 import { setCredentialHeader } from '../../../client/internal/protocols/Shared.js';
 import * as Constants from '../../../Constants.js';
+import * as IdentityClient from '../../../identity/Client.js';
 import * as Account from '../../../viem/Account.js';
 import * as Client from '../../../viem/Client.js';
 import { charge as chargePlugin } from '../../client/Charge.js';
@@ -23,7 +24,7 @@ import { resolveCloseTarget } from './Runtime.js';
 import { assertVoucherWithinLocalLimit as assertVoucherWithinLocalAuthorization } from './Runtime.js';
 import { applySessionReceiptToRuntime, captureRuntimeSnapshot as captureRuntimeStateSnapshot, computeFallbackCloseAmount, createSessionManagerRuntime, dispatchSessionEvent, restoreCumulativeAuthorization, restoreRuntimeSnapshot as restoreRuntimeStateSnapshot, resolveAutomaticTopUp, } from './Runtime.js';
 import { closeSocketSession } from './Runtime.js';
-import { closeHttpSession, getSessionSnapshot, isTempoSessionChallenge, postTopUp, retryHttpPaymentRequired, webSocketProbeUrl, } from './Transports.js';
+import { closeHttpSession, getSessionSnapshot, isTempoSessionChallenge, isRequest, postTopUp, retryHttpPaymentRequired, webSocketProbeUrl, } from './Transports.js';
 import { WebSocketReadyState, } from './Transports.js';
 import { consumeSseSessionResponse, openSseSession } from './Transports.js';
 import { UncertainFundingError, applyTopUpResult, resolveManualTopUp, } from './Transports.js';
@@ -47,7 +48,7 @@ function isZeroAmountChargeChallenge(challenge) {
 function requestInitWithSessionHint(input, init, channelId) {
     if (!channelId)
         return init;
-    const requestHeaders = input instanceof Request ? input.headers : undefined;
+    const requestHeaders = isRequest(input) ? input.headers : undefined;
     const headers = {
         ...Fetch.normalizeHeaders(requestHeaders),
         ...Fetch.normalizeHeaders(init?.headers),
@@ -88,6 +89,7 @@ function resolveSessionManagerConfig(parameters) {
  * channel state management and credential creation, and to `Fetch.from`
  * for the 402 challenge/retry flow.
  *
+ * Each manager is pinned to its first request origin. Use a separate manager per origin.
  * `channelStore` can persist reusable channels between manager instances.
  */
 export function sessionManager(parameters) {
@@ -96,6 +98,34 @@ export function sessionManager(parameters) {
         Client.assertAllowedChainId(parameters.allowedChainIds, clientChainId);
     const allowCustomEscrow = parameters.allowCustomEscrow ?? false;
     const config = resolveSessionManagerConfig(parameters);
+    let sessionOrigin;
+    function bindOrigin(input) {
+        const url = new URL(isRequest(input) ? input.url : String(input), typeof location === 'undefined' ? undefined : location.href);
+        if (url.protocol !== 'http:' && url.protocol !== 'https:')
+            throw new Error('SessionManager: session payments require an HTTP origin');
+        const origin = url.origin;
+        if (sessionOrigin !== undefined && sessionOrigin !== origin)
+            throw new Error('SessionManager: session payment origin mismatch');
+        sessionOrigin = origin;
+        return origin;
+    }
+    const inheritedIdentity = Fetch.identityOf(config.fetch);
+    const rawFetch = Fetch.unwrapFetch(config.fetch);
+    config.fetch = async (input, init) => {
+        const origin = bindOrigin(input);
+        const response = await rawFetch(input, {
+            ...init,
+            redirect: (init?.redirect ?? (isRequest(input) ? input.redirect : undefined)) === 'manual'
+                ? 'manual'
+                : 'error',
+        });
+        if (response.url && new URL(response.url).origin !== origin)
+            throw new Error('SessionManager: session response origin mismatch');
+        return response;
+    };
+    const guardedFetch = config.fetch;
+    if (inheritedIdentity)
+        config.fetch = IdentityClient.wrapFetch(guardedFetch, inheritedIdentity);
     const getClient = Client.getResolver({
         chain: tempo_chain,
         getClient: parameters.client ? () => parameters.client : parameters.getClient,
@@ -115,11 +145,19 @@ export function sessionManager(parameters) {
     /** Returns the backing entry for `key` only when it is open and not ignored. */
     async function getReusable(key) {
         const entry = await backing.get(key);
-        if (entry?.opened && !ignoredChannelIds.has(entry.channelId))
+        if (entry?.opened && !ignoredChannelIds.has(entry.channelId)) {
+            if (entry.origin !== undefined && entry.origin !== sessionOrigin)
+                throw new Error('SessionManager: stored channel origin mismatch');
             return entry;
+        }
         return undefined;
     }
-    const persistChannel = (entry) => persistStoredChannel(backing, entry);
+    const persistChannel = (entry) => {
+        if (entry.origin !== undefined && entry.origin !== sessionOrigin)
+            throw new Error('SessionManager: stored channel origin mismatch');
+        entry.origin = sessionOrigin;
+        return persistStoredChannel(backing, entry);
+    };
     const store = {
         async get(key) {
             const entry = await getReusable(key);
@@ -252,7 +290,8 @@ export function sessionManager(parameters) {
         resolveAccount: parameters.resolveAccount,
     });
     const wrappedFetch = Fetch.from({
-        fetch: config.fetch,
+        fetch: guardedFetch,
+        identity: inheritedIdentity,
         methods: [method],
         onChallenge: async (challenge, _helpers) => {
             if (!isTempoSessionChallenge(challenge))
@@ -334,9 +373,9 @@ export function sessionManager(parameters) {
             return undefined;
         if (runtime.channel?.opened)
             return undefined;
-        const requestHeaders = input instanceof Request ? input.headers : undefined;
+        const requestHeaders = isRequest(input) ? input.headers : undefined;
         const { body: _body, method: _method, ...bootstrapInit } = init ?? {};
-        const bootstrapInput = input instanceof Request ? input.url : input;
+        const bootstrapInput = isRequest(input) ? input.url : input;
         const headInit = {
             ...bootstrapInit,
             method: 'HEAD',
@@ -646,6 +685,7 @@ export function sessionManager(parameters) {
         // corrupt each other's runtime and channel tracking.
         if (channelUse)
             throw new Error('SessionManager: a request is already in flight; concurrent requests on one manager are not supported');
+        bindOrigin(input);
         runtime.lastUrl = input;
         runtime.lastHeaders = init?.headers;
         const previous = captureRuntimeStateSnapshot({
@@ -818,6 +858,7 @@ export function sessionManager(parameters) {
                 throw new Error('No WebSocket implementation available. Pass `webSocket` to sessionManager() in this runtime.');
             }
             const probeUrl = webSocketProbeUrl(input);
+            bindOrigin(probeUrl);
             const signalInit = init?.signal ? { signal: init.signal } : undefined;
             await bootstrapSession(probeUrl, signalInit);
             // Cold starts resume from `channelStore` after the probe's 402.
@@ -906,9 +947,15 @@ export function sessionManager(parameters) {
     };
     registerSessionManagerInternals(self, {
         consumeSseResponse(input, response, options) {
+            const origin = bindOrigin(input);
+            if (response.url && new URL(response.url).origin !== origin)
+                throw new Error('SessionManager: session response origin mismatch');
             return consumeSseSessionResponse(input, response, options, sseDriver);
         },
         rehydrate({ channel, challenge, input, spent }) {
+            const origin = bindOrigin(input);
+            if (channel.origin !== undefined && channel.origin !== origin)
+                throw new Error('SessionManager: stored channel origin mismatch');
             if (!channel.opened)
                 throw new Error('Cannot restore a closed session channel.');
             if (!isTempoSessionChallenge(challenge)) {

package/dist/tempo/session/client/Transports.d.ts

@@ -282,6 +282,8 @@ export declare function getSessionSnapshot(challenge: TempoSessionChallenge): Se
 /** Merges request headers and sets the challenge's credential header for a retry. */
 export declare function requestInitWithAuthorization(input: RequestInfo | URL, init: RequestInit | undefined, credential: string, challenge: TempoSessionChallenge): RequestInit;
 /** Returns the exact resource URL used for out-of-band management POSTs, without its fragment. */
+/** Returns whether a value is a `Request`, including one from another realm such as an iframe. */
+export declare function isRequest(value: unknown): value is Request;
 export declare function managementInput(input: RequestInfo | URL): RequestInfo | URL;
 /** Converts a WebSocket URL into the HTTP URL used for its payment challenge probe. */
 export declare function webSocketProbeUrl(input: string | URL): URL;

package/dist/tempo/session/client/Transports.js

@@ -262,10 +262,20 @@ export function requestInitWithAuthorization(input, init, credential, challenge)
     }, Challenge.credentialHeader(challenge), credential);
 }
 /** Returns the exact resource URL used for out-of-band management POSTs, without its fragment. */
+/** Returns whether a value is a `Request`, including one from another realm such as an iframe. */
+export function isRequest(value) {
+    return (value instanceof Request ||
+        (typeof value === 'object' &&
+            value !== null &&
+            !(value instanceof URL) &&
+            typeof value.url === 'string' &&
+            typeof value.method === 'string' &&
+            typeof value.clone === 'function'));
+}
 export function managementInput(input) {
     try {
         const base = typeof location === 'undefined' ? undefined : location.href;
-        const url = input instanceof Request
+        const url = isRequest(input)
             ? new URL(input.url)
             : input instanceof URL
                 ? new URL(input)
@@ -456,6 +466,21 @@ export async function closeHttpSession(parameters) {
     }
     let closeChallenge = parameters.target.challenge;
     let signedCloseAmount = parameters.signedCloseAmount;
+    const request = isRequest(parameters.lastUrl) ? parameters.lastUrl : undefined;
+    // Retain transport policy without inheriting the resource body or cancellation. Redirects stay
+    // manual so the credential never follows one.
+    const requestOptions = request
+        ? {
+            cache: request.cache,
+            credentials: request.credentials,
+            integrity: request.integrity,
+            keepalive: request.keepalive,
+            // Fetch rejects `navigate` in a request init; a navigation becomes `same-origin`, as Fetch does.
+            mode: request.mode === 'navigate' ? 'same-origin' : request.mode,
+            referrer: request.referrer,
+            referrerPolicy: request.referrerPolicy,
+        }
+        : undefined;
     const postClose = async (challenge, refreshed = false) => {
         closeChallenge = challenge;
         signedCloseAmount =
@@ -467,7 +492,11 @@ export async function closeHttpSession(parameters) {
             descriptor: parameters.target.channel.descriptor,
             cumulativeAmountRaw: signedCloseAmount,
         });
-        return parameters.fetch(parameters.lastUrl, {
+        // Close is a separate management POST, independent of the resource Request.
+        // A Request's URL is absolute. Pass other inputs unchanged so the configured fetch resolves
+        // relative URLs exactly as it did for the paid resource.
+        return parameters.fetch(request ? managementInput(request) : parameters.lastUrl, {
+            ...requestOptions,
             method: 'POST',
             redirect: 'manual',
             headers: managementHeaders(challenge, credential, parameters.lastUrl, parameters.headers),

package/dist/tempo/session/precompile/Voucher.js

@@ -67,6 +67,10 @@ function getVoucherPayload(verifyingContract, chainId, voucher) {
 function isPrimitiveEnvelope(type) {
     return type === 'secp256k1' || type === 'p256' || type === 'webAuthn';
 }
+/** Detects a viem/tempo access key account the same way `Account.signVoucher` does. */
+function isAccessKeyAccount(account) {
+    return account.source === 'accessKey' && 'accessKeyAddress' in account;
+}
 function signCanonicalTempoVoucher(account, parameters) {
     // viem/tempo's canonical TIP-1034 voucher signer accepts Tempo account
     // extensions that are wider than viem's base Account type. Keep that
@@ -109,13 +113,22 @@ export async function signVoucher(client, account, voucher, verifyingContract, c
  * Signs a distinct EIP-712 authorization for cooperatively closing a channel.
  */
 export async function signCloseAuthorization(client, account, authorization, verifyingContract, chainId) {
-    const signature = await signTypedData(client, {
-        account,
-        domain: getVoucherDomain(verifyingContract, chainId),
-        types: closeAuthorizationTypes,
-        primaryType: 'CloseAuthorization',
-        message: authorization,
-    });
+    // `signTypedData` wraps access key signatures in a keychain envelope, which
+    // TIP-1034 rejects. Sign the hash raw instead, as viem/tempo's
+    // `Account.signVoucher` does for vouchers: the access key is the channel's
+    // authorized signer.
+    const signature = isAccessKeyAccount(account)
+        ? await account.sign({
+            hash: getCloseAuthorizationPayload(verifyingContract, chainId, authorization),
+            raw: true,
+        })
+        : await signTypedData(client, {
+            account,
+            domain: getVoucherDomain(verifyingContract, chainId),
+            types: closeAuthorizationTypes,
+            primaryType: 'CloseAuthorization',
+            message: authorization,
+        });
     const envelope = SignatureEnvelope.from(signature);
     if (!isPrimitiveEnvelope(envelope.type))
         throw new Error(`TIP-1034 close authorizations require a TIP-1020 primitive signature; received "${envelope.type}".`);

package/dist/tempo/session/server/Session.d.ts

@@ -184,7 +184,8 @@ export declare namespace session {
         /**
          * Charges request-priced content (`unitType: 'request'`) in the same store update that accepts
          * its voucher, before the response, instead of in a second update when the response is
-         * delivered. The server must then refund requests it cannot serve.
+         * delivered. Always enabled for SSE request-priced content, including POST requests that
+         * return plain responses. The server must refund requests it cannot serve.
          */
         chargeOnAcceptance?: boolean | undefined;
         /**

package/dist/tempo/session/server/Session.js

@@ -363,7 +363,7 @@ export function session(p) {
             minVoucherDelta: parameters.minVoucherDelta,
             request,
         });
-        const chargeAmount = parameters.chargeOnAcceptance &&
+        const chargeAmount = (parameters.chargeOnAcceptance || parameters.sse) &&
             shouldChargeVoucherOnAcceptance({
                 capturedRequest: envelope?.capturedRequest,
                 payloadAction: payload.action,
@@ -433,6 +433,7 @@ export function session(p) {
             getRequestAmount: () => BigInt(context.request.amount ?? challenge.request.amount),
             sseEnabled: Boolean(parameters.sse),
             markPrepaidReceipt: Transport.markPrepaidSessionTick,
+            unitType: context.request.unitType,
             charge: (channelId, requestAmount) => chargeSessionChannel({ store, channelId, amount: requestAmount }),
             settleCharged: settleAcceptedCharge,
         });

package/dist/tempo/session/server/Settlement.d.ts

@@ -167,13 +167,15 @@ export type ApplyVerifiedHttpAccountingParameters = {
     receipt: SessionReceipt;
     /** Marks an SSE receipt whose first content unit was charged during verification. */
     markPrepaidReceipt?: ((receipt: SessionReceipt) => SessionReceipt) | undefined;
-    /** Whether SSE transport is enabled. SSE accounting is stream-driven, not HTTP-response-driven. */
+    /** Pricing unit; request-priced content is charged before handing control to the application. */
+    unitType?: unknown;
+    /** Whether SSE transport is enabled. Non-request units are charged as the stream advances. */
     sseEnabled: boolean;
     /** Runs optional server settlement policy after a successful content charge. */
     settleCharged: SettleChargedSessionChannel;
 };
 /** Returns whether an accepted credential will authorize and charge an HTTP content response. */
-export declare function shouldApplyVerifiedHttpAccounting(parameters: Pick<ApplyVerifiedHttpAccountingParameters, 'capturedRequest' | 'payloadAction' | 'sseEnabled'>): boolean;
+export declare function shouldApplyVerifiedHttpAccounting(parameters: Pick<ApplyVerifiedHttpAccountingParameters, 'capturedRequest' | 'payloadAction' | 'sseEnabled' | 'unitType'>): boolean;
 /**
  * Returns whether a voucher pays for its request in the store update that accepts it. A
  * request-priced content request is charged exactly once, so this is the charge the HTTP

package/dist/tempo/session/server/Settlement.js

@@ -161,12 +161,12 @@ export async function releaseScheduledSettlement(parameters) {
 }
 /** Returns whether an accepted credential will authorize and charge an HTTP content response. */
 export function shouldApplyVerifiedHttpAccounting(parameters) {
-    const { capturedRequest, payloadAction, sseEnabled } = parameters;
+    const { capturedRequest, payloadAction, sseEnabled, unitType } = parameters;
     if (!capturedRequest)
         return false;
     if (payloadAction !== 'open' && payloadAction !== 'voucher')
         return false;
-    if (sseEnabled && capturedRequest.method === 'POST')
+    if (sseEnabled && capturedRequest.method === 'POST' && unitType !== 'request')
         return false;
     return isSessionContentRequest(capturedRequest);
 }

package/dist/tempo/session/server/Ws.js

@@ -40,7 +40,32 @@ export async function serve(options) {
         runtime.closed = true;
         abortController.abort();
         unsubscribe();
-        await Promise.resolve(socket.close(code, reason));
+        await closeSocket(code, reason);
+    };
+    const closeSocket = async (code, reason) => {
+        try {
+            await socket.close(code, reason);
+        }
+        catch {
+            // Some adapters reject a close even after the session has stopped.
+            // Retry without application data and contain both sync and async errors.
+            try {
+                await socket.close();
+            }
+            catch { }
+        }
+    };
+    const rejectAndClose = (message, status, code) => {
+        runtime.closed = true;
+        abortController.abort();
+        unsubscribe();
+        // Queue the small final diagnostic synchronously before close changes socket state.
+        // Do not wait for an adapter's send promise: a stalled peer must still be closed.
+        try {
+            void Promise.resolve(socket.send(formatErrorMessage({ message, status }))).catch(() => { });
+        }
+        catch { }
+        void closeSocket(code, message);
     };
     const sendCloseReady = async () => {
         if (runtime.closeReadySent || !runtime.streamContext || runtime.closed)
@@ -129,7 +154,7 @@ export async function serve(options) {
                 message: authorizationResult.message,
                 status: authorizationResult.responseStatus,
             }));
-            await close(1008, authorizationResult.message);
+            await close(1008, 'payment authorization rejected');
             return;
         }
         const { receipt } = authorizationResult;
@@ -169,11 +194,7 @@ export async function serve(options) {
             return;
         const messageBytes = frameByteLength(payload);
         if (messageBytes !== null && messageBytes > maxIncomingMessageBytes) {
-            runtime.closed = true;
-            abortController.abort();
-            unsubscribe();
-            void send(socket, formatErrorMessage({ message: 'payment message is too large', status: 413 })).catch(() => { });
-            void Promise.resolve(socket.close(1009, 'payment message is too large')).catch(() => { });
+            rejectAndClose('payment message is too large', 413, 1009);
             return;
         }
         const raw = toText(payload);
@@ -194,11 +215,7 @@ export async function serve(options) {
         if (!work)
             return;
         if (runtime.queuedActions >= maxQueuedPaymentMessages) {
-            void sendFrame(formatErrorMessage({
-                message: 'too many queued payment messages',
-                status: 429,
-            })).catch(() => { });
-            void close(1008, 'too many queued payment messages');
+            rejectAndClose('too many queued payment messages', 429, 1008);
             return;
         }
         runtime.queuedActions++;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",