mppx 0.17.1 → 0.17.4

package/dist/cloudflare/Channels.js

@@ -0,0 +1,325 @@
+import { zeroAddress } from 'viem';
+import { ChannelNotFoundError, VerificationFailedError } from '../Errors.js';
+import * as Store from '../Store.js';
+import { parsePkhSource } from '../tempo/internal/proof.js';
+import { tip20ChannelEscrow } from '../tempo/session/precompile/Protocol.js';
+import { isPrecompileState } from '../tempo/session/server/ChannelStore.js';
+import { settle as settleChannel, SettlementCheckpointError, } from '../tempo/session/server/Settlement.js';
+import { isChannelState, pendingClose, unsettledAmount } from './ChannelStore.js';
+/**
+ * Tempo session channel storage on a {@link ChannelStore} Durable Object namespace, to spread
+ * into `tempo.session()`: `store` keeps each channel in its own object, which schedules its
+ * settlement, and `resolveChannelId` finds the payer's open channel to the same payee, token,
+ * escrow, operator and chain, so a client that lost its state resumes it instead of opening another.
+ * The lookup needs the payer's identity, which only a `bootstrap` HEAD proof supplies: enable
+ * `bootstrap` on the session and in the client's session manager, or it never resolves.
+ *
+ * The store keeps that lookup current: after a write opens, closes or finalizes a channel,
+ * it adds or removes the channel under its payer and authorized signer. Each lookup entry is
+ * its own key holding the payer's open channels there, most recent first, so closing one leaves
+ * the others findable. The lookup returns the first whose channel still resumes, so a delayed
+ * write for a channel that has since closed cannot hide an open one, and mppx validates any
+ * channel it resolves before reusing it.
+ *
+ * @example
+ * ```ts
+ * import { channels } from 'mppx/cloudflare'
+ * import { tempo } from 'mppx/server'
+ *
+ * tempo.session({ account, bootstrap: true, currency, getClient, ...channels(env.MPPX_CHANNELS) })
+ * ```
+ */
+export function channels(namespace, options) {
+    const base = Store.durableObject(namespace, options);
+    const escrowContract = options?.escrowContract ?? tip20ChannelEscrow;
+    /** Removes `channelId` from the entry under `key`. */
+    async function remove(key, channelId) {
+        await base.update(key, (current) => {
+            const ids = lookupIds(current);
+            if (!ids.includes(channelId))
+                return noop;
+            const rest = ids.filter((id) => id !== channelId);
+            return rest.length
+                ? { op: 'set', value: rest, result: undefined }
+                : { op: 'delete', result: undefined };
+        });
+    }
+    /**
+     * Adds `channelId` to the front of the entry under `key` while its stored channel still
+     * resumes, so a delayed add after its close leaves it out. A full entry drops channels that no
+     * longer resume before the oldest open one, keeping the most recent {@link maxLookupChannels}.
+     */
+    async function add(key, channelId) {
+        for (let attempt = 1;; attempt++) {
+            const ids = lookupIds(await base.get(key));
+            if (ids.includes(channelId))
+                return;
+            if (!resumable(await base.get(channelId)))
+                return;
+            const full = ids.length >= maxLookupChannels;
+            const states = full ? await Promise.all(ids.map((id) => base.get(id))) : [];
+            const closed = new Set(ids.filter((_, i) => full && !resumable(states[i])));
+            const added = await base.update(key, (current) => {
+                const listed = lookupIds(current);
+                if (listed.includes(channelId))
+                    return { op: 'noop', result: true };
+                // The entry changed since its channels were read: read them again, a few times at most.
+                if (attempt < maxLookupAttempts && !sameIds(listed, ids))
+                    return { op: 'noop', result: false };
+                return {
+                    op: 'set',
+                    value: [channelId, ...listed.filter((id) => !closed.has(id))].slice(0, maxLookupChannels),
+                    result: true,
+                };
+            });
+            if (added)
+                return;
+        }
+    }
+    /**
+     * Moves the lookup entries of a channel from its previous state to its next one. Entries
+     * for the next state are written on every write, not only when they change: the channel
+     * commits before its entries, so a failed entry write is repaired by the channel's next
+     * write instead of staying missing. Writing an entry that is already there changes nothing.
+     * Best effort: the channel write has already committed, so a failed entry write must not
+     * report it as failed (a charge would apply without its Receipt).
+     */
+    async function sync(previous, next) {
+        const before = lookupKeys(previous);
+        const after = lookupKeys(next);
+        await Promise.allSettled([
+            ...before
+                .filter((key) => !after.includes(key))
+                .map((key) => remove(key, previous.channelId)),
+            ...after.map((key) => add(key, next.channelId)),
+        ]);
+    }
+    const store = {
+        ...base,
+        async put(key, value) {
+            const previous = await base.get(key);
+            await base.put(key, value);
+            await sync(previous, value);
+        },
+        async delete(key) {
+            const previous = await base.get(key);
+            await base.delete(key);
+            await sync(previous, null);
+        },
+        async update(key, fn) {
+            // The last call of `fn` is the one the compare-and-swap committed.
+            const applied = {
+                previous: null,
+            };
+            const result = await base.update(key, (current) => {
+                applied.previous = current;
+                applied.change = fn(current);
+                return applied.change;
+            });
+            const { change, previous } = applied;
+            if (change && change.op !== 'noop')
+                await sync(previous, change.op === 'set' ? change.value : null);
+            return result;
+        },
+    };
+    const resolveChannelId = async ({ paymentRequest, source }) => {
+        const payer = source ? parsePkhSource(source) : null;
+        const { recipient } = paymentRequest;
+        if (!payer || !recipient)
+            return undefined;
+        if (paymentRequest.chainId !== undefined && paymentRequest.chainId !== payer.chainId)
+            return undefined;
+        const operator = paymentRequest.operator ?? zeroAddress;
+        const ids = lookupIds(await base.get(lookupKey({
+            chainId: payer.chainId,
+            escrowContract: paymentRequest.escrowContract ?? escrowContract,
+            payee: recipient,
+            operator,
+            payer: payer.address,
+            token: paymentRequest.currency,
+        })));
+        // An ID a delayed write left for a channel that has since closed resumes nothing.
+        for (const id of ids) {
+            const state = await base.get(id);
+            if (!resumable(state))
+                continue;
+            // mppx verifies a challenge without an operator against the zero operator, and only
+            // channels without one (legacy escrow channels) are not keyed by theirs.
+            if (isPrecompileState(state)
+                ? state.operator.toLowerCase() !== operator.toLowerCase()
+                : paymentRequest.operator !== undefined)
+                continue;
+            return id;
+        }
+        return undefined;
+    };
+    return { resolveChannelId, store };
+}
+/**
+ * Settles the channels of a settlement queue batch on-chain, from the Worker's `queue()`
+ * handler. Each message is acknowledged once its channel settled or has nothing left to
+ * settle, and when settlement cannot succeed (the channel is gone or has no voucher); any
+ * other failure, such as a fee over the fee payer's cap, retries it after 30 s, doubling up
+ * to 10 minutes. The {@link ChannelStore} watchdog sends a channel again if its job never settles it.
+ *
+ * @example
+ * ```ts
+ * import { channels, settle } from 'mppx/cloudflare'
+ *
+ * export default {
+ *   async queue(batch, env) {
+ *     await settle(batch, { account, getClient, store: channels(env.MPPX_CHANNELS).store })
+ *   },
+ * }
+ * ```
+ */
+export async function settle(batch, parameters) {
+    const { getClient, settle: settle_ = settleChannel, store, ...options } = parameters;
+    for (const message of batch.messages) {
+        try {
+            const channelId = message.body
+                ?.channelId;
+            // A malformed job can never settle: drop it instead of failing the batch.
+            if (typeof channelId !== 'string') {
+                message.ack();
+                continue;
+            }
+            const state = await store.get(channelId);
+            // A duplicate job, such as one the watchdog sent while the first was queued, has nothing left.
+            if (!isChannelState(state) || state.finalized || unsettledAmount(state) <= 0n) {
+                message.ack();
+                continue;
+            }
+            // The server's own cooperative close captures it: check again once that close lands or expires.
+            if (pendingClose(state)) {
+                message.retry({ delaySeconds: 60 });
+                continue;
+            }
+            // Another job or a scheduled settlement is settling it: check again once that one is done.
+            const leaseOwner = await claim(store, channelId);
+            if (!leaseOwner) {
+                message.retry({ delaySeconds: 60 });
+                continue;
+            }
+            // Waiting for the receipt can outlast the lease: keep it while the settlement runs, so no
+            // other job claims the channel and broadcasts the same voucher.
+            const renewal = setInterval(() => {
+                void renew(store, channelId, leaseOwner).catch(() => undefined);
+            }, settlementLeaseMs / 2);
+            try {
+                await settle_(store, await getClient({ chainId: state.chainId }), channelId, options);
+            }
+            finally {
+                clearInterval(renewal);
+                await release(store, channelId, leaseOwner).catch(() => undefined);
+            }
+            message.ack();
+        }
+        catch (error) {
+            if (isPermanent(error))
+                message.ack();
+            else
+                message.retry({ delaySeconds: Math.min(30 * 2 ** Math.max(0, message.attempts - 1), 600) });
+        }
+    }
+}
+const noop = { op: 'noop', result: undefined };
+/** How long a settlement claim holds before another job may take over, as scheduled settlement's. */
+const settlementLeaseMs = 5 * 60_000;
+/**
+ * Claims a channel's settlement with the lease scheduled settlement takes, so overlapping jobs,
+ * or a job and a scheduled settlement, never broadcast the same voucher twice. Returns the
+ * lease's owner, or `undefined` while another one holds a live lease.
+ */
+async function claim(store, channelId) {
+    const owner = globalThis.crypto.randomUUID();
+    const now = Date.now();
+    return store.update(channelId, (current) => {
+        if (!isChannelState(current))
+            return { op: 'noop', result: undefined };
+        const lease = current.scheduledSettlementLease;
+        if (lease && lease.expiresAt > now)
+            return { op: 'noop', result: undefined };
+        return {
+            op: 'set',
+            value: {
+                ...current,
+                scheduledSettlementLease: { expiresAt: now + settlementLeaseMs, owner },
+            },
+            result: owner,
+        };
+    });
+}
+/** Extends a settlement lease {@link claim} took while its owner still holds it. */
+async function renew(store, channelId, owner) {
+    await store.update(channelId, (current) => {
+        if (!isChannelState(current) || current.scheduledSettlementLease?.owner !== owner)
+            return noop;
+        return {
+            op: 'set',
+            value: {
+                ...current,
+                scheduledSettlementLease: { expiresAt: Date.now() + settlementLeaseMs, owner },
+            },
+            result: undefined,
+        };
+    });
+}
+/** Releases a settlement lease {@link claim} took, unless another owner has taken it since. */
+async function release(store, channelId, owner) {
+    await store.update(channelId, (current) => {
+        if (!isChannelState(current) || current.scheduledSettlementLease?.owner !== owner)
+            return noop;
+        const { scheduledSettlementLease: _, ...channel } = current;
+        return { op: 'set', value: channel, result: undefined };
+    });
+}
+/**
+ * Whether a settlement failed for good: the channel or its voucher is gone, the account cannot
+ * settle it, or the transaction confirmed and only recording it failed.
+ */
+function isPermanent(error) {
+    return (error instanceof ChannelNotFoundError ||
+        error instanceof VerificationFailedError ||
+        error instanceof SettlementCheckpointError);
+}
+/**
+ * The lookup key of a payer's channel to a payee, token, escrow, operator and chain. The operator
+ * is part of it so that channels opened with other operators cannot push a matching one out of
+ * the entry's {@link maxLookupChannels}.
+ */
+function lookupKey(lookup) {
+    const { chainId, escrowContract, operator, payee, payer, token } = lookup;
+    return `mppx:session-lookup:v3:${[payer, payee, token, escrowContract, operator].map((address) => address.toLowerCase()).join(':')}:${chainId}`;
+}
+/** Most channels a lookup entry keeps per payer, payee, token, escrow, operator and chain. */
+const maxLookupChannels = 8;
+/** Reads of a full lookup entry's channels before adding to it regardless of concurrent changes. */
+const maxLookupAttempts = 3;
+/** Whether two lookup entries list the same channels in the same order. */
+function sameIds(a, b) {
+    return a.length === b.length && a.every((id, i) => id === b[i]);
+}
+/** The channel IDs of a lookup entry, most recent first. */
+function lookupIds(entry) {
+    return Array.isArray(entry) ? entry.filter((id) => typeof id === 'string') : [];
+}
+/** Whether a payer may resume a stored channel: open, with no close requested. */
+function resumable(state) {
+    return isChannelState(state) && !state.finalized && !state.closeRequestedAt;
+}
+/** The lookup keys of a channel a payer may resume. */
+function lookupKeys(state) {
+    if (!resumable(state))
+        return [];
+    const signers = new Set([state.payer.toLowerCase(), state.authorizedSigner.toLowerCase()]);
+    return [...signers].map((payer) => lookupKey({
+        chainId: state.chainId,
+        escrowContract: state.escrowContract,
+        operator: isPrecompileState(state) ? state.operator : zeroAddress,
+        payee: state.payee,
+        payer,
+        token: state.token,
+    }));
+}
+//# sourceMappingURL=Channels.js.map

package/dist/cloudflare/index.d.ts

@@ -0,0 +1,5 @@
+/** Durable Object class that stores Tempo session channels and schedules their settlement. */
+export { ChannelStore } from './ChannelStore.js';
+/** Channel store and lookup for `tempo.session()`, and the settlement queue consumer. */
+export { channels, settle } from './Channels.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cloudflare/index.js

@@ -0,0 +1,5 @@
+/** Durable Object class that stores Tempo session channels and schedules their settlement. */
+export { ChannelStore } from './ChannelStore.js';
+/** Channel store and lookup for `tempo.session()`, and the settlement queue consumer. */
+export { channels, settle } from './Channels.js';
+//# sourceMappingURL=index.js.map

package/dist/identity/Client.js

@@ -1,6 +1,7 @@
 import * as Challenge from '../Challenge.js';
 import * as Credential from '../Credential.js';
 import * as SigningContext from './internal/SigningContext.js';
+const skipPayment = Symbol.for('mppx.fetch.skipPayment');
 /** x402 credential headers (v2 and v1); a request carrying one is a paid attempt. */
 const x402CredentialHeaders = ['payment-signature', 'x-payment'];
 /**
@@ -99,7 +100,12 @@ export function wrapFetch(fetch, client, context) {
         // A retry may answer a refreshed challenge: bind proofs to the challenge its credential
         // carries, and let provers prepare for a refreshed 402 of the same method and intent.
         const challenge = credentialChallenge(request.headers) ?? context?.challenge;
-        const { response } = await client.send(fetch, request, { ...context, challenge });
+        const { response } = await client.send((input, options) => fetch(input, {
+            ...options,
+            ...(init?.[skipPayment]
+                ? { [skipPayment]: true }
+                : {}),
+        }), request, { ...context, challenge });
         if (response.status === 402 && challenge)
             // A 402 without a parseable Payment challenge is returned as is: the caller decides.
             for (const next of challengesOf(response))

package/dist/internal/sse.d.ts

@@ -0,0 +1,21 @@
+/** An event dispatched from a `text/event-stream` body. */
+export type Event = {
+    /** The event's data: its `data` field values joined by `\n`. */
+    data: string;
+    /** The event's type: its last `event` field value, or `'message'` when it has none. */
+    event: string;
+};
+/**
+ * Creates an incremental parser for a `text/event-stream` body, as the WHATWG HTML
+ * spec interprets one. Feed it decoded text chunks split anywhere; it calls `onEvent`
+ * for each event a blank line ends. Lines end in `\n`, `\r\n` or `\r`; comments (`:`),
+ * `id`, `retry` and unknown fields are ignored, and an event that never ends is not
+ * dispatched.
+ *
+ * @see https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation
+ */
+export declare function createParser(onEvent: (event: Event) => void): {
+    /** Parses the next chunk of the stream. */
+    feed(chunk: string): void;
+};
+//# sourceMappingURL=sse.d.ts.map

package/dist/internal/sse.js

@@ -0,0 +1,82 @@
+/**
+ * Creates an incremental parser for a `text/event-stream` body, as the WHATWG HTML
+ * spec interprets one. Feed it decoded text chunks split anywhere; it calls `onEvent`
+ * for each event a blank line ends. Lines end in `\n`, `\r\n` or `\r`; comments (`:`),
+ * `id`, `retry` and unknown fields are ignored, and an event that never ends is not
+ * dispatched.
+ *
+ * @see https://html.spec.whatwg.org/multipage/server-sent-events.html#event-stream-interpretation
+ */
+export function createParser(onEvent) {
+    let buffer = '';
+    let started = false;
+    let skipLineFeed = false;
+    let data;
+    let event = '';
+    function parseLine(line) {
+        if (line === '') {
+            if (data !== undefined)
+                onEvent({ data, event: event || 'message' });
+            data = undefined;
+            event = '';
+            return;
+        }
+        const colon = line.indexOf(':');
+        if (colon === 0)
+            return;
+        const field = colon === -1 ? line : line.slice(0, colon);
+        if (field !== 'data' && field !== 'event')
+            return;
+        let value = '';
+        if (colon !== -1)
+            value = line.slice(line.charCodeAt(colon + 1) === 32 ? colon + 2 : colon + 1);
+        if (field === 'event')
+            event = value;
+        else
+            data = data === undefined ? value : data + '\n' + value;
+    }
+    return {
+        /** Parses the next chunk of the stream. */
+        feed(chunk) {
+            if (!started && chunk) {
+                started = true;
+                if (chunk.startsWith('\uFEFF'))
+                    chunk = chunk.slice(1);
+            }
+            // A `\r` ending the last chunk may be the first half of a `\r\n`.
+            if (skipLineFeed && chunk) {
+                skipLineFeed = false;
+                if (chunk.startsWith('\n'))
+                    chunk = chunk.slice(1);
+            }
+            buffer += chunk;
+            if (chunk.indexOf('\n') === -1 && chunk.indexOf('\r') === -1)
+                return;
+            // Scan with indexOf rather than a global RegExp: it is several times faster on
+            // line-dense bodies.
+            let start = 0;
+            let lineFeed = buffer.indexOf('\n');
+            let carriageReturn = buffer.indexOf('\r');
+            while (lineFeed !== -1 || carriageReturn !== -1) {
+                const end = lineFeed === -1
+                    ? carriageReturn
+                    : carriageReturn === -1
+                        ? lineFeed
+                        : Math.min(lineFeed, carriageReturn);
+                parseLine(buffer.slice(start, end));
+                start = end + 1;
+                if (end === carriageReturn) {
+                    if (start === buffer.length)
+                        skipLineFeed = true;
+                    else if (lineFeed === start)
+                        start++;
+                    carriageReturn = buffer.indexOf('\r', start);
+                }
+                if (lineFeed !== -1 && lineFeed < start)
+                    lineFeed = buffer.indexOf('\n', start);
+            }
+            buffer = buffer.slice(start);
+        },
+    };
+}
+//# sourceMappingURL=sse.js.map

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.17.1";
+export declare const version = "0.17.4";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.17.1";
+export declare const sdkIdentifier = "mppx/0.17.4";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.17.1';
+export const version = '0.17.4';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/mcp/client/McpClient.d.ts

@@ -70,8 +70,8 @@ export declare namespace wrap {
         /** Array of methods to use. Accepts individual clients or tuples (e.g. from `tempo()`). */
         methods: methods;
         /**
-         * Realms allowed to request zero-amount Tempo proofs. An MCP server has no origin that could
-         * own a realm, so these proofs are refused unless their realm is listed here.
+         * Realms allowed to request zero-amount Tempo proofs or session payments. An MCP server has no origin that could
+         * own a realm, so these signatures are refused unless their realm is listed here.
          */
         trustedTempoProofRealms?: readonly string[] | undefined;
     };

package/dist/mcp/client/McpClient.js

@@ -1,5 +1,6 @@
 import * as Challenge from '../../Challenge.js';
 import * as ProofRealm from '../../client/internal/ProofRealm.js';
+import { adapterPaymentMetaKey } from '../../client/internal/protocols/Mcp.js';
 import * as Credential from '../../Credential.js';
 import * as Expires from '../../Expires.js';
 import * as AcceptPayment from '../../internal/AcceptPayment.js';
@@ -57,9 +58,11 @@ export function wrap(client, config) {
         enumerable: false,
         value: (params, resultSchema, options) => {
             const { context, onPaymentRequired, ...requestOptions } = options ?? {};
-            return callTool(params, {
+            return callTool({ ...params, _meta: { ...params._meta, [adapterPaymentMetaKey]: true } }, {
                 context,
-                onPaymentRequired: onPaymentRequired === null ? undefined : (onPaymentRequired ?? config.onPaymentRequired),
+                onPaymentRequired: onPaymentRequired === null
+                    ? undefined
+                    : (onPaymentRequired ?? config.onPaymentRequired),
                 requestOptions: Object.keys(requestOptions).length
                     ? requestOptions
                     : undefined,

package/dist/proxy/Proxy.d.ts

@@ -49,6 +49,8 @@ export declare namespace create {
         docs?: Service.Docs | undefined;
         /** Custom `fetch` implementation. Defaults to `globalThis.fetch`. */
         fetch?: typeof globalThis.fetch | undefined;
+        /** Maximum request body bytes on every route, including free routes. Defaults to 10 MiB. */
+        maxRequestBodySize?: number | undefined;
         /** Default handler for failed upstream attempts. Services may override it. */
         onUpstreamError?: Service.UpstreamErrorHandler | undefined;
         /**

package/dist/proxy/Proxy.js

@@ -34,6 +34,9 @@ import * as Service from './Service.js';
  * ```
  */
 export function create(config) {
+    const maxRequestBodySize = config.maxRequestBodySize ?? 10 * 1024 * 1024;
+    if (!Number.isSafeInteger(maxRequestBodySize) || maxRequestBodySize < 0)
+        throw new RangeError('maxRequestBodySize must be a non-negative safe integer');
     const fetchImpl = config.fetch ?? globalThis.fetch;
     const replay = config.replay ? Replay.resolve(config.replay) : undefined;
     const services = new Map(config.services.map((s) => {
@@ -100,8 +103,22 @@ export function create(config) {
         if (!matched)
             return new Response('Not Found', { status: 404 });
         const endpoint = matched.value;
-        const ctx = { request, service, upstreamPath };
         const handler = Service.getHandler(endpoint);
+        const declaredLength = Number(request.headers.get('content-length'));
+        if (Number.isFinite(declaredLength) && declaredLength > maxRequestBodySize)
+            return new Response('Payload Too Large', { status: 413 });
+        const paymentCredential = handler
+            ? Replay.credentialOf(request, credentialHeaders(handler))
+            : undefined;
+        let boundedBody;
+        if ((!handler || paymentCredential) && request.body) {
+            const body = await Replay.readBody(request, maxRequestBodySize);
+            if (!body)
+                return new Response('Payload Too Large', { status: 413 });
+            boundedBody = body;
+            request = Replay.withBody(request, body);
+        }
+        const ctx = { request, service, upstreamPath };
         if (!handler)
             return proxyUpstream({
                 request,
@@ -116,11 +133,12 @@ export function create(config) {
         let replayBody;
         let replayKey;
         // Routes with identity verifiers keep paying normally: a replay would skip them.
-        const credential = replay && !fallbackMatch && !requiresIdentity(handler)
-            ? Replay.credentialOf(request, credentialHeaders(handler))
-            : undefined;
+        const credential = replay && !fallbackMatch && !requiresIdentity(handler) ? paymentCredential : undefined;
         if (replay && credential) {
-            const body = await Replay.readBody(request, replay.maxRequestBodySize);
+            const body = boundedBody ??
+                (await Replay.readBody(request, Math.min(maxRequestBodySize, replay.maxRequestBodySize)));
+            if (body && body.length > replay.maxRequestBodySize)
+                return new Response('Payload Too Large', { status: 413 });
             if (!body)
                 return new Response('Payload Too Large', { status: 413 });
             replayBody = body;
@@ -179,6 +197,13 @@ export function create(config) {
             return managementResponse;
         if (fallbackMatch)
             return new Response('Method Not Allowed', { status: 405 });
+        if (!boundedBody && !replayBody && request.body) {
+            const body = await Replay.readBody(request, maxRequestBodySize);
+            if (!body)
+                return result.withReceipt(new Response('Payload Too Large', { status: 413 }));
+            request = Replay.withBody(request, body);
+            ctx.request = request;
+        }
         const options = Service.getOptions(endpoint);
         if (replay && replayKey && replayBody) {
             const body = replayBody;
@@ -211,7 +236,7 @@ export function create(config) {
     }
     return {
         fetch: handle,
-        listener: Request.toNodeListener(handle),
+        listener: Request.toNodeListener(handle, { maxBodySize: maxRequestBodySize }),
     };
 }
 /** @internal */

package/dist/proxy/internal/Replay.js

@@ -183,7 +183,7 @@ async function keep(stream, maxBodySize) {
             break;
         size += value.byteLength;
         if (size > maxBodySize) {
-            await reader.cancel();
+            void reader.cancel().catch(() => { });
             return null;
         }
         chunks.push(value);

package/dist/server/Mppx.js

@@ -1876,11 +1876,12 @@ function composeHandlers(handlers, composeOptions, selectOffers) {
             }
             mergedHeaders.set('Content-Type', 'text/html; charset=utf-8');
             const firstData = Object.values(dataMap)[0];
+            const entries = await Promise.all(htmlEntries.map(async (entry) => ({
+                challenge: entry.challenge,
+                content: await Html.resolveContent(entry.handler._internal.html.content),
+            })));
             const body = Html.render({
-                entries: htmlEntries.map((entry) => ({
-                    challenge: entry.challenge,
-                    content: entry.handler._internal.html.content,
-                })),
+                entries,
                 dataMap,
                 formattedAmount: firstData.formattedAmount,
                 panels: true,

package/dist/server/Transport.js

@@ -98,7 +98,7 @@ export function http(options = {}) {
                         },
                     };
                     return Html.render({
-                        entries: [{ challenge, content: options.html.content }],
+                        entries: [{ challenge, content: await Html.resolveContent(options.html.content) }],
                         dataMap,
                         formattedAmount: amount,
                         text,

package/dist/server/internal/html/config.d.ts

@@ -2,7 +2,11 @@ import type * as Challenge from '../../../Challenge.js';
 import type * as Method from '../../../Method.js';
 export type Options = {
     config: Record<string, unknown>;
-    content: string;
+    /**
+     * The payment page's script, or a function that loads it. A loader lets a
+     * method import its (large) page bundle only when a page is rendered.
+     */
+    content: string | (() => Promise<string>);
     formatAmount: (request: any) => string | Promise<string>;
     text: Text | undefined;
     theme: Theme | undefined;
@@ -21,6 +25,8 @@ export type Data<method extends Method.Method = Method.Method, config extends Re
     };
 };
 export { attrs, classNames, ids, params } from './constants.js';
+/** Resolves {@link Options.content}, loading it when it is a loader function. */
+export declare function resolveContent(content: Options['content']): Promise<string>;
 declare class CssVar {
     readonly name: string;
     constructor(token: string);