mppx 0.17.1 → 0.17.3

package/dist/cli/sessions/Manager.js

@@ -1,4 +1,5 @@
 import * as Challenge from '../../Challenge.js';
+import * as ProofRealm from '../../client/internal/ProofRealm.js';
 import { resolveEscrow } from '../../tempo/session/client/ChannelOps.js';
 import { getSessionManagerInternals } from '../../tempo/session/client/internal/SessionManager.js';
 import { sessionManager } from '../../tempo/session/client/SessionManager.js';
@@ -25,6 +26,14 @@ function assertCloseChallengeScope(challenge, channel) {
 /** Rehydrates durable session context and cooperatively closes it through the manager. */
 export async function closeWithSessionManager(parameters) {
     assertCloseChallengeScope(parameters.challenge, parameters.channel);
+    let channel = parameters.channel;
+    if (channel.origin === undefined) {
+        const url = new URL(parameters.input instanceof Request ? parameters.input.url : parameters.input);
+        if (!['http:', 'https:'].includes(url.protocol))
+            throw new Error('Legacy session close requires an HTTP origin');
+        ProofRealm.assert(parameters.challenge, url, parameters.manager.trustedTempoProofRealms);
+        channel = { ...channel, origin: url.origin };
+    }
     const networkFetch = resolveFetch(parameters.fetch);
     let pendingChallenge;
     const validatedFetch = async (input, init) => {
@@ -48,7 +57,9 @@ export async function closeWithSessionManager(parameters) {
         escrow: parameters.channel.escrow,
         fetch: validatedFetch,
     });
-    getSessionManagerInternals(manager).rehydrate(parameters);
+    getSessionManagerInternals(manager).rehydrate({ ...parameters, channel });
+    if (channel !== parameters.channel)
+        await parameters.manager.channelStore?.set(channel);
     const receipt = await manager.close();
     if (!receipt)
         throw new Error('Session close response did not include a payment receipt.');

package/dist/cli/utils.d.ts

@@ -58,6 +58,8 @@ export declare function fmtRequestValue(key: string, value: unknown, ctx: {
 }): string;
 export declare function decodeMemo(hex: string): string | undefined;
 export declare function fmtChallengeValue(key: string, value: unknown): string;
+/** Formats a problem-details field for display, serializing nested objects and arrays as JSON. */
+export declare function fmtProblemValue(value: unknown): string;
 export declare function link(url: string, text: string): string;
 export declare function parseMethodOpts(raw: string | string[] | undefined): Record<string, string>;
 /** Returns true when the CLI is running inside an agent wrapper that prefers machine-readable output. */

package/dist/cli/utils.js

@@ -141,6 +141,12 @@ export function fmtChallengeValue(key, value) {
     }
     return String(value);
 }
+/** Formats a problem-details field for display, serializing nested objects and arrays as JSON. */
+export function fmtProblemValue(value) {
+    if (value !== null && typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
 export function link(url, text) {
     return pc.link(url, text);
 }

package/dist/client/Mppx.d.ts

@@ -189,7 +189,7 @@ export declare namespace create {
         /** Transport to use (defaults to HTTP). */
         transport?: transport | undefined;
         /**
-         * Server origins allowed to request zero-amount Tempo proofs for a realm other than their
+         * Server origins allowed to request zero-amount Tempo proofs or session payments for a realm other than their
          * hostname, mapped to that realm, such as `{ 'https://api.example.com': 'MPP Payment' }`.
          * With `Transport.mcp()`, which has no origin, only realms listed here are trusted,
          * whatever their origin.

package/dist/client/Mppx.js

@@ -4,6 +4,7 @@ import * as IdentityClient from '../identity/Client.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
 import * as Fetch from './internal/Fetch.js';
 import * as MethodChallenge from './internal/MethodChallenge.js';
+import * as MethodResponse from './internal/MethodResponse.js';
 import * as ProofRealm from './internal/ProofRealm.js';
 import * as Transport from './Transport.js';
 const preparedPaymentMethods = new WeakMap();
@@ -112,7 +113,7 @@ export function create(config) {
                 try {
                     if (selectedChallenge.expires)
                         Expires.assert(selectedChallenge.expires, selectedChallenge.id);
-                    const createCredential = memoizeCreateCredential((overrideContext) => createCredentialForMethod(selectedChallenge, selectedMethod, overrideContext ?? context));
+                    const createCredential = memoizeCreateCredential((overrideContext) => createCredentialForMethod(selectedChallenge, selectedMethod, overrideContext ?? context, responseUrl?.origin));
                     const eventCredential = await events.emit('challenge.received', createChallengeReceivedPayload({
                         challenge: selectedChallenge,
                         challenges,
@@ -482,9 +483,12 @@ function resolveChallengePreferences(fallback, override) {
 async function resolveChallengeOrder(candidates, orderChallenges) {
     return orderChallenges ? orderChallenges(candidates) : candidates;
 }
-async function createCredentialForMethod(challenge, mi, context) {
+async function createCredentialForMethod(challenge, mi, context, origin) {
     const parsedContext = mi.context && context !== undefined ? mi.context.parse(context) : undefined;
-    return mi.createCredential(parsedContext !== undefined ? { challenge, context: parsedContext } : { challenge });
+    const parameters = parsedContext !== undefined ? { challenge, context: parsedContext } : { challenge };
+    if (origin)
+        MethodResponse.attachOrigin(parameters, origin);
+    return mi.createCredential(parameters);
 }
 /** Returns the URL of the HTTP server that sent `response`, or `undefined` when it has none. */
 function resolveResponseUrl(response) {

package/dist/client/internal/Fetch.d.ts

@@ -116,7 +116,7 @@ export declare namespace from {
         /** Transport to use for challenge extraction and credential attachment. */
         transport?: Transport.AnyTransport | undefined;
         /**
-         * Server origins allowed to request zero-amount Tempo proofs for a realm other than their
+         * Server origins allowed to request zero-amount Tempo proofs or session payments for a realm other than their
          * hostname, mapped to that realm, such as `{ 'https://api.example.com': 'MPP Payment' }`.
          */
         trustedTempoProofRealms?: ProofRealm.TrustedRealms | undefined;

package/dist/client/internal/Fetch.js

@@ -8,6 +8,7 @@ import * as Transport from '../Transport.js';
 import * as MethodChallenge from './MethodChallenge.js';
 import * as MethodResponse from './MethodResponse.js';
 import * as ProofRealm from './ProofRealm.js';
+import { adapterOwnsPayment } from './protocols/Mcp.js';
 // We tag wrappers with a global symbol so we can recognize wrappers created by mppx,
 // even across multiple module instances/bundles. This lets restore() avoid clobbering
 // an unrelated fetch installed by user code or another library.
@@ -129,6 +130,8 @@ export function from(config) {
         const transportRequest = withCapturedBody(initialRequest.init, await capturedBody);
         if (init?.[skipPayment])
             return response;
+        if (adapterOwnsPayment(transportRequest))
+            return response;
         if (!(await transport.isPaymentRequired(response, transportRequest)))
             return response;
         // Only extract context for payment handling after confirming 402.
@@ -194,6 +197,7 @@ export function from(config) {
                     if (!MethodChallenge.has(selected.method))
                         return resolveCredential(selectedChallenge, selected.method, credentialContext);
                     const attempt = {
+                        origin: resolveRequestUrl(paymentInput).origin,
                         prepare: () => MethodChallenge.handle(selected.method, {
                             challenge: selectedChallenge,
                             context: credentialContext,
@@ -211,6 +215,7 @@ export function from(config) {
                         .prepare()
                         .then(() => resolveCredential(selectedChallenge, selected.method, credentialContext, attempt));
                     preparedCredential = {
+                        context: credentialContext,
                         attempt,
                         key: overrideContext === undefined ? key : undefined,
                         method: selected.method,
@@ -239,6 +244,7 @@ export function from(config) {
                     await settleAttempt(prepared, { status: 'rejected' });
                     preparedCredential = undefined;
                 }
+                const effectiveContext = preparedCredential ? preparedCredential.context : context;
                 validateCredentialHeaderValue(credential);
                 await events.emit('credential.created', createCredentialCreatedPayload({
                     challenge: selectedChallenge,
@@ -322,6 +328,7 @@ export function from(config) {
                     if (!response.ok)
                         return response;
                     return MethodResponse.handle(selected.method, {
+                        context: effectiveContext,
                         challenge: selectedChallenge,
                         credential,
                         fetch: baseFetch,
@@ -753,6 +760,8 @@ export function validateCredentialHeaderValue(credential) {
 async function resolveCredential(challenge, mi, context, attempt) {
     const parsedContext = mi.context && context !== undefined ? mi.context.parse(context) : undefined;
     const parameters = parsedContext !== undefined ? { challenge, context: parsedContext } : { challenge };
+    if (attempt?.origin)
+        MethodResponse.attachOrigin(parameters, attempt.origin);
     if (attempt)
         MethodResponse.attachAttempt(mi, parameters, attempt);
     return mi.createCredential(parameters);

package/dist/client/internal/MethodResponse.d.ts

@@ -7,6 +7,8 @@ export type AttemptOutcome = {
     status: 'accepted' | 'pending' | 'rejected';
 };
 export type Attempt = {
+    /** Authorized HTTP origin, checked before any credential is signed. */
+    origin?: string | undefined;
     /** Re-runs method preparation when serialized state changed before signing. */
     prepare: () => Promise<void>;
     /** Settles state created for one credential attempt. */
@@ -14,6 +16,8 @@ export type Attempt = {
 };
 /** Inputs available when a client method handles a successful paid response. */
 export type HandlerParameters = {
+    /** Original request policy for automatic follow-up payments. */
+    context?: unknown;
     challenge: Challenge.Challenge;
     credential: string;
     fetch: typeof globalThis.fetch;
@@ -41,4 +45,8 @@ export declare function handle(method: Method.AnyClient, parameters: HandlerPara
 export declare function registerTransactionHash<const method extends Method.AnyClient>(method: method, derive: TransactionHash): method;
 /** Returns the credential's on-chain hash when its method can derive it. */
 export declare function getTransactionHash(method: Method.AnyClient, credential: string): string | undefined;
+/** Associates an explicitly verified HTTP origin with credential creation. */
+export declare function attachOrigin(parameters: object, origin: string): void;
+/** Returns the authorized origin for direct or fetch-owned credential creation. */
+export declare function getOrigin(parameters: object): string | undefined;
 //# sourceMappingURL=MethodResponse.d.ts.map

package/dist/client/internal/MethodResponse.js

@@ -1,5 +1,6 @@
 const handlers = new WeakMap();
 const attempts = new WeakMap();
+const origins = new WeakMap();
 const transactionHashes = new WeakMap();
 /** Registers an internal response adapter without changing the public method shape. */
 export function register(method, handler) {
@@ -38,4 +39,12 @@ export function getTransactionHash(method, credential) {
         return undefined;
     }
 }
+/** Associates an explicitly verified HTTP origin with credential creation. */
+export function attachOrigin(parameters, origin) {
+    origins.set(parameters, origin);
+}
+/** Returns the authorized origin for direct or fetch-owned credential creation. */
+export function getOrigin(parameters) {
+    return origins.get(parameters) ?? attempts.get(parameters)?.origin;
+}
 //# sourceMappingURL=MethodResponse.js.map

package/dist/client/internal/ProofRealm.d.ts

@@ -1,12 +1,12 @@
 import type * as Challenge from '../../Challenge.js';
 /**
- * Pins that let a server origin request zero-amount Tempo proofs for a realm other than its
+ * Pins that let a server origin request zero-amount Tempo proofs or session payments for a realm other than its
  * hostname, keyed by origin (`scheme://host[:port]`), such as
  * `{ 'https://api.example.com': 'MPP Payment' }`.
  */
 export type TrustedRealms = Readonly<Record<string, string>>;
 /**
- * Refuses a zero-amount Tempo proof whose realm the HTTP server that sent the Challenge does not
+ * Refuses a Tempo proof or session payment whose realm the HTTP server that sent the Challenge does not
  * own. A proof authenticates the payer at the Challenge realm, so a foreign origin could otherwise
  * relay another server's Challenge and replay the signed proof there. The server owns the realm
  * when it is the request hostname, or when `trustedRealms` pins it to the request origin. Pass
@@ -14,7 +14,7 @@ export type TrustedRealms = Readonly<Record<string, string>>;
  */
 export declare function assert(challenge: Challenge.Challenge, url: URL | (() => URL), trustedRealms: TrustedRealms | undefined): void;
 /**
- * Refuses a zero-amount Tempo proof on a transport without an origin, such as MCP, unless
+ * Refuses a Tempo proof or session payment on a transport without an origin, such as MCP, unless
  * `trustedRealms` lists its realm.
  */
 export declare function assertWithoutOrigin(challenge: Challenge.Challenge, trustedRealms: readonly string[] | undefined): void;

package/dist/client/internal/ProofRealm.js

@@ -1,12 +1,12 @@
 /**
- * Refuses a zero-amount Tempo proof whose realm the HTTP server that sent the Challenge does not
+ * Refuses a Tempo proof or session payment whose realm the HTTP server that sent the Challenge does not
  * own. A proof authenticates the payer at the Challenge realm, so a foreign origin could otherwise
  * relay another server's Challenge and replay the signed proof there. The server owns the realm
  * when it is the request hostname, or when `trustedRealms` pins it to the request origin. Pass
  * `url` as a function to resolve it only for proof Challenges.
  */
 export function assert(challenge, url, trustedRealms) {
-    if (!isProof(challenge))
+    if (!isProof(challenge) && !(challenge.method === 'tempo' && challenge.intent === 'session'))
         return;
     url = typeof url === 'function' ? url() : url;
     const { realm } = challenge;
@@ -19,11 +19,11 @@ export function assert(challenge, url, trustedRealms) {
     throw new Error(`Refusing to sign Tempo proof for realm ${JSON.stringify(realm)} from ${url.origin}. Pin the realm to this origin with \`trustedTempoProofRealms\` if this server is expected to issue it.`);
 }
 /**
- * Refuses a zero-amount Tempo proof on a transport without an origin, such as MCP, unless
+ * Refuses a Tempo proof or session payment on a transport without an origin, such as MCP, unless
  * `trustedRealms` lists its realm.
  */
 export function assertWithoutOrigin(challenge, trustedRealms) {
-    if (!isProof(challenge))
+    if (!isProof(challenge) && !(challenge.method === 'tempo' && challenge.intent === 'session'))
         return;
     if (trustedRealms?.includes(challenge.realm))
         return;

package/dist/client/internal/protocols/Mcp.d.ts

@@ -1,5 +1,9 @@
 import * as Mcp from '../../../Mcp.js';
 import type { Protocol } from './Protocol.js';
+/** Metadata that delegates all payment decisions to the MCP client adapter. */
+export declare const adapterPaymentMetaKey = "mppx/payment-client";
+/** Whether the caller's MCP adapter owns approval and payment retry for this request. */
+export declare function adapterOwnsPayment(request?: RequestInit): boolean;
 type CorePaymentRequiredData = NonNullable<Mcp.ErrorObject['data']>;
 export type PaymentRequiredData = Pick<CorePaymentRequiredData, 'challenges'> & Partial<Pick<CorePaymentRequiredData, 'httpStatus' | 'problem'>>;
 /** Extracts validated payment-required data from MCP errors or tool result metadata. */

package/dist/client/internal/protocols/Mcp.js

@@ -1,6 +1,6 @@
-import { createParser } from 'eventsource-parser';
 import * as Challenge from '../../../Challenge.js';
 import * as Credential from '../../../Credential.js';
+import { createParser } from '../../../internal/sse.js';
 import * as Mcp from '../../../Mcp.js';
 import { paymentRequiredStatus } from './Shared.js';
 /** Returns the JSON-RPC request id — only requests can receive a `-32042` response. */
@@ -18,6 +18,22 @@ function jsonRpcRequestId(body) {
         return undefined;
     }
 }
+/** Metadata that delegates all payment decisions to the MCP client adapter. */
+export const adapterPaymentMetaKey = 'mppx/payment-client';
+/** Whether the caller's MCP adapter owns approval and payment retry for this request. */
+export function adapterOwnsPayment(request) {
+    if (typeof request?.body !== 'string')
+        return false;
+    try {
+        const message = JSON.parse(request.body);
+        return (message?.jsonrpc === '2.0' &&
+            message?.method === 'tools/call' &&
+            message.params?._meta?.[adapterPaymentMetaKey] === true);
+    }
+    catch {
+        return false;
+    }
+}
 // Bound automatic inspection; the caller retains the original response stream.
 const maxInspectionBytes = 1024 * 1024;
 const responseCache = new WeakMap();
@@ -99,18 +115,16 @@ async function parseSseJsonRpcResponse(response) {
     let received = 0;
     let dataEventSeen = false;
     let message;
-    const parser = createParser({
-        onEvent(event) {
-            if (dataEventSeen || !event.data)
-                return;
-            dataEventSeen = true;
-            if (event.event && event.event !== 'message')
-                return;
-            try {
-                message = parseMessage(JSON.parse(event.data));
-            }
-            catch { }
-        },
+    const parser = createParser((event) => {
+        if (dataEventSeen || !event.data)
+            return;
+        dataEventSeen = true;
+        if (event.event !== 'message')
+            return;
+        try {
+            message = parseMessage(JSON.parse(event.data));
+        }
+        catch { }
     });
     try {
         for (;;) {
@@ -119,7 +133,6 @@ async function parseSseJsonRpcResponse(response) {
             const { done, value } = await reader.read();
             if (done) {
                 parser.feed(decoder.decode());
-                parser.reset({ consume: true });
                 return message;
             }
             received += value.byteLength;

package/dist/identity/Client.js

@@ -1,6 +1,7 @@
 import * as Challenge from '../Challenge.js';
 import * as Credential from '../Credential.js';
 import * as SigningContext from './internal/SigningContext.js';
+const skipPayment = Symbol.for('mppx.fetch.skipPayment');
 /** x402 credential headers (v2 and v1); a request carrying one is a paid attempt. */
 const x402CredentialHeaders = ['payment-signature', 'x-payment'];
 /**
@@ -99,7 +100,12 @@ export function wrapFetch(fetch, client, context) {
         // A retry may answer a refreshed challenge: bind proofs to the challenge its credential
         // carries, and let provers prepare for a refreshed 402 of the same method and intent.
         const challenge = credentialChallenge(request.headers) ?? context?.challenge;
-        const { response } = await client.send(fetch, request, { ...context, challenge });
+        const { response } = await client.send((input, options) => fetch(input, {
+            ...options,
+            ...(init?.[skipPayment]
+                ? { [skipPayment]: true }
+                : {}),
+        }), request, { ...context, challenge });
         if (response.status === 402 && challenge)
             // A 402 without a parseable Payment challenge is returned as is: the caller decides.
             for (const next of challengesOf(response))

package/dist/internal/sse.d.ts

@@ -0,0 +1,21 @@
+/** An event dispatched from a `text/event-stream` body. */
+export type Event = {
+    /** The event's data: its `data` field values joined by `\n`. */
+    data: string;
+    /** The event's type: its last `event` field value, or `'message'` when it has none. */
+    event: string;
+};
+/**
+ * Creates an incremental parser for a `text/event-stream` body, as the WHATWG HTML
+ * spec interprets one. Feed it decoded text chunks split anywhere; it calls `onEvent`
+ * for each event a blank line ends. Lines end in `\n`, `\r\n` or `\r`; comments (`:`),
+ * `id`, `retry` and unknown fields are ignored, and an event that never ends is not
+ * dispatched.
+ *
+ * @see https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation
+ */
+export declare function createParser(onEvent: (event: Event) => void): {
+    /** Parses the next chunk of the stream. */
+    feed(chunk: string): void;
+};
+//# sourceMappingURL=sse.d.ts.map

package/dist/internal/sse.js

@@ -0,0 +1,65 @@
+/**
+ * Creates an incremental parser for a `text/event-stream` body, as the WHATWG HTML
+ * spec interprets one. Feed it decoded text chunks split anywhere; it calls `onEvent`
+ * for each event a blank line ends. Lines end in `\n`, `\r\n` or `\r`; comments (`:`),
+ * `id`, `retry` and unknown fields are ignored, and an event that never ends is not
+ * dispatched.
+ *
+ * @see https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation
+ */
+export function createParser(onEvent) {
+    let buffer = '';
+    let started = false;
+    let skipLineFeed = false;
+    let data;
+    let event = '';
+    function parseLine(line) {
+        if (line === '') {
+            if (data !== undefined)
+                onEvent({ data, event: event || 'message' });
+            data = undefined;
+            event = '';
+            return;
+        }
+        if (line.startsWith(':'))
+            return;
+        const colon = line.indexOf(':');
+        const field = colon === -1 ? line : line.slice(0, colon);
+        let value = colon === -1 ? '' : line.slice(colon + 1);
+        if (value.startsWith(' '))
+            value = value.slice(1);
+        if (field === 'data')
+            data = data === undefined ? value : `${data}\n${value}`;
+        else if (field === 'event')
+            event = value;
+    }
+    return {
+        /** Parses the next chunk of the stream. */
+        feed(chunk) {
+            if (!started && chunk) {
+                started = true;
+                if (chunk.startsWith('\uFEFF'))
+                    chunk = chunk.slice(1);
+            }
+            // A `\r` ending the last chunk may be the first half of a `\r\n`.
+            if (skipLineFeed && chunk) {
+                skipLineFeed = false;
+                if (chunk.startsWith('\n'))
+                    chunk = chunk.slice(1);
+            }
+            buffer += chunk;
+            if (!/[\r\n]/.test(chunk))
+                return;
+            let start = 0;
+            const terminator = /\r\n?|\n/g;
+            for (let match = terminator.exec(buffer); match; match = terminator.exec(buffer)) {
+                parseLine(buffer.slice(start, match.index));
+                start = terminator.lastIndex;
+                if (match[0] === '\r' && start === buffer.length)
+                    skipLineFeed = true;
+            }
+            buffer = buffer.slice(start);
+        },
+    };
+}
+//# sourceMappingURL=sse.js.map

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.17.1";
+export declare const version = "0.17.3";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.17.1";
+export declare const sdkIdentifier = "mppx/0.17.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.17.1';
+export const version = '0.17.3';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/mcp/client/McpClient.d.ts

@@ -70,8 +70,8 @@ export declare namespace wrap {
         /** Array of methods to use. Accepts individual clients or tuples (e.g. from `tempo()`). */
         methods: methods;
         /**
-         * Realms allowed to request zero-amount Tempo proofs. An MCP server has no origin that could
-         * own a realm, so these proofs are refused unless their realm is listed here.
+         * Realms allowed to request zero-amount Tempo proofs or session payments. An MCP server has no origin that could
+         * own a realm, so these signatures are refused unless their realm is listed here.
          */
         trustedTempoProofRealms?: readonly string[] | undefined;
     };

package/dist/mcp/client/McpClient.js

@@ -1,5 +1,6 @@
 import * as Challenge from '../../Challenge.js';
 import * as ProofRealm from '../../client/internal/ProofRealm.js';
+import { adapterPaymentMetaKey } from '../../client/internal/protocols/Mcp.js';
 import * as Credential from '../../Credential.js';
 import * as Expires from '../../Expires.js';
 import * as AcceptPayment from '../../internal/AcceptPayment.js';
@@ -57,9 +58,11 @@ export function wrap(client, config) {
         enumerable: false,
         value: (params, resultSchema, options) => {
             const { context, onPaymentRequired, ...requestOptions } = options ?? {};
-            return callTool(params, {
+            return callTool({ ...params, _meta: { ...params._meta, [adapterPaymentMetaKey]: true } }, {
                 context,
-                onPaymentRequired: onPaymentRequired === null ? undefined : (onPaymentRequired ?? config.onPaymentRequired),
+                onPaymentRequired: onPaymentRequired === null
+                    ? undefined
+                    : (onPaymentRequired ?? config.onPaymentRequired),
                 requestOptions: Object.keys(requestOptions).length
                     ? requestOptions
                     : undefined,

package/dist/proxy/Proxy.d.ts

@@ -49,6 +49,8 @@ export declare namespace create {
         docs?: Service.Docs | undefined;
         /** Custom `fetch` implementation. Defaults to `globalThis.fetch`. */
         fetch?: typeof globalThis.fetch | undefined;
+        /** Maximum request body bytes on every route, including free routes. Defaults to 10 MiB. */
+        maxRequestBodySize?: number | undefined;
         /** Default handler for failed upstream attempts. Services may override it. */
         onUpstreamError?: Service.UpstreamErrorHandler | undefined;
         /**

package/dist/proxy/Proxy.js

@@ -34,6 +34,9 @@ import * as Service from './Service.js';
  * ```
  */
 export function create(config) {
+    const maxRequestBodySize = config.maxRequestBodySize ?? 10 * 1024 * 1024;
+    if (!Number.isSafeInteger(maxRequestBodySize) || maxRequestBodySize < 0)
+        throw new RangeError('maxRequestBodySize must be a non-negative safe integer');
     const fetchImpl = config.fetch ?? globalThis.fetch;
     const replay = config.replay ? Replay.resolve(config.replay) : undefined;
     const services = new Map(config.services.map((s) => {
@@ -100,8 +103,22 @@ export function create(config) {
         if (!matched)
             return new Response('Not Found', { status: 404 });
         const endpoint = matched.value;
-        const ctx = { request, service, upstreamPath };
         const handler = Service.getHandler(endpoint);
+        const declaredLength = Number(request.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > maxRequestBodySize)
+            return new Response('Payload Too Large', { status: 413 });
+        const paymentCredential = handler
+            ? Replay.credentialOf(request, credentialHeaders(handler))
+            : undefined;
+        let boundedBody;
+        if ((!handler || paymentCredential) && request.body) {
+            const body = await Replay.readBody(request, maxRequestBodySize);
+            if (!body)
+                return new Response('Payload Too Large', { status: 413 });
+            boundedBody = body;
+            request = Replay.withBody(request, body);
+        }
+        const ctx = { request, service, upstreamPath };
         if (!handler)
             return proxyUpstream({
                 request,
@@ -116,11 +133,12 @@ export function create(config) {
         let replayBody;
         let replayKey;
         // Routes with identity verifiers keep paying normally: a replay would skip them.
-        const credential = replay && !fallbackMatch && !requiresIdentity(handler)
-            ? Replay.credentialOf(request, credentialHeaders(handler))
-            : undefined;
+        const credential = replay && !fallbackMatch && !requiresIdentity(handler) ? paymentCredential : undefined;
         if (replay && credential) {
-            const body = await Replay.readBody(request, replay.maxRequestBodySize);
+            const body = boundedBody ??
+                (await Replay.readBody(request, Math.min(maxRequestBodySize, replay.maxRequestBodySize)));
+            if (body && body.length > replay.maxRequestBodySize)
+                return new Response('Payload Too Large', { status: 413 });
             if (!body)
                 return new Response('Payload Too Large', { status: 413 });
             replayBody = body;
@@ -179,6 +197,13 @@ export function create(config) {
             return managementResponse;
         if (fallbackMatch)
             return new Response('Method Not Allowed', { status: 405 });
+        if (!boundedBody && !replayBody && request.body) {
+            const body = await Replay.readBody(request, maxRequestBodySize);
+            if (!body)
+                return result.withReceipt(new Response('Payload Too Large', { status: 413 }));
+            request = Replay.withBody(request, body);
+            ctx.request = request;
+        }
         const options = Service.getOptions(endpoint);
         if (replay && replayKey && replayBody) {
             const body = replayBody;
@@ -211,7 +236,7 @@ export function create(config) {
     }
     return {
         fetch: handle,
-        listener: Request.toNodeListener(handle),
+        listener: Request.toNodeListener(handle, { maxBodySize: maxRequestBodySize }),
     };
 }
 /** @internal */

package/dist/proxy/internal/Replay.js

@@ -183,7 +183,7 @@ async function keep(stream, maxBodySize) {
             break;
         size += value.byteLength;
         if (size > maxBodySize) {
-            await reader.cancel();
+            void reader.cancel().catch(() => { });
             return null;
         }
         chunks.push(value);

package/dist/server/Mppx.js

@@ -1876,11 +1876,12 @@ function composeHandlers(handlers, composeOptions, selectOffers) {
             }
             mergedHeaders.set('Content-Type', 'text/html; charset=utf-8');
             const firstData = Object.values(dataMap)[0];
+            const entries = await Promise.all(htmlEntries.map(async (entry) => ({
+                challenge: entry.challenge,
+                content: await Html.resolveContent(entry.handler._internal.html.content),
+            })));
             const body = Html.render({
-                entries: htmlEntries.map((entry) => ({
-                    challenge: entry.challenge,
-                    content: entry.handler._internal.html.content,
-                })),
+                entries,
                 dataMap,
                 formattedAmount: firstData.formattedAmount,
                 panels: true,

package/dist/server/Transport.js

@@ -98,7 +98,7 @@ export function http(options = {}) {
                         },
                     };
                     return Html.render({
-                        entries: [{ challenge, content: options.html.content }],
+                        entries: [{ challenge, content: await Html.resolveContent(options.html.content) }],
                         dataMap,
                         formattedAmount: amount,
                         text,