mppx 0.17.3 → 0.17.4

package/dist/cli/internal.js

@@ -2,6 +2,8 @@ import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as Challenge from '../Challenge.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
+import * as PaymentRequest from '../PaymentRequest.js';
+import * as ChallengeMeta from '../server/internal/challengeMeta.js';
 import { evm as evmPlugin, stripe as stripePlugin, tempo as tempoPlugin, x402 as x402Plugin, } from './plugins/index.js';
 const builtinPlugins = [tempoPlugin(), stripePlugin(), evmPlugin(), x402Plugin()];
 /** Runs configured payment extensions in order and threads credential context between them. */
@@ -107,14 +109,34 @@ export function assertSamePaymentRequest(approved, retry) {
             else
                 delete request.methodDetails;
         }
-        return Challenge.serialize({
-            ...challenge,
-            request,
-            id: approved.id,
-            expires: approved.expires,
-        });
+        const { meta: _, opaque: __, ...rest } = challenge;
+        return JSON.stringify([
+            Challenge.serialize({ ...rest, request, id: approved.id, expires: approved.expires }),
+            stableOpaque(challenge),
+        ]);
     }
     if (paymentTerms(retry) !== paymentTerms(approved))
         throw new Error('Payment request changed on retry. Run the command again to approve the new payment.');
 }
+/**
+ * Returns a Challenge's opaque value without the per-issuance nonces mppx servers add
+ * (`_mppx_nonce`, `_mppx_identity`), which differ on every Challenge for the same payment.
+ */
+function stableOpaque(challenge) {
+    const opaque = challenge.opaque ?? (challenge.meta ? PaymentRequest.serialize(challenge.meta) : undefined);
+    if (opaque === undefined)
+        return undefined;
+    let meta;
+    try {
+        meta = PaymentRequest.deserialize(opaque);
+    }
+    catch {
+        return opaque;
+    }
+    // Only metadata objects carry the reserved nonces; keep any other opaque value as is.
+    if (typeof meta !== 'object' || meta === null || Array.isArray(meta))
+        return opaque;
+    const stable = ChallengeMeta.routeMeta(meta);
+    return stable ? PaymentRequest.serialize(stable) : undefined;
+}
 //# sourceMappingURL=internal.js.map