mppx 0.2.0 → 0.2.1

package/dist/Challenge.d.ts

@@ -139,7 +139,7 @@ export declare namespace from {
  * import { Methods } from 'mppx/tempo'
  *
  * // With HMAC-bound ID (recommended for servers)
- * const challenge = Challenge.fromIntent(
+ * const challenge = Challenge.fromMethod(
  *   Methods.charge,
  *   {
  *     realm: 'api.example.com',
@@ -154,8 +154,8 @@ export declare namespace from {
  * )
  * ```
  */
-export declare function fromIntent<const method extends Method.Method>(method: method, parameters: fromIntent.Parameters<method>): fromIntent.ReturnType<method>;
-export declare namespace fromIntent {
+export declare function fromMethod<const method extends Method.Method>(method: method, parameters: fromMethod.Parameters<method>): fromMethod.ReturnType<method>;
+export declare namespace fromMethod {
     type Parameters<method extends Method.Method> = OneOf<{
         /** Explicit challenge ID. */
         id: string;

package/dist/Challenge.js

@@ -100,7 +100,7 @@ export function from(parameters, options) {
  * import { Methods } from 'mppx/tempo'
  *
  * // With HMAC-bound ID (recommended for servers)
- * const challenge = Challenge.fromIntent(
+ * const challenge = Challenge.fromMethod(
  *   Methods.charge,
  *   {
  *     realm: 'api.example.com',
@@ -115,10 +115,10 @@ export function from(parameters, options) {
  * )
  * ```
  */
-export function fromIntent(method, parameters) {
+export function fromMethod(method, parameters) {
     const { name: methodName, intent } = method;
     const { description, digest, expires, id, realm, secretKey } = parameters;
-    const request = PaymentRequest.fromIntent(method, parameters.request);
+    const request = PaymentRequest.fromMethod(method, parameters.request);
     return from({
         ...(id ? { id } : { secretKey }),
         realm,

package/dist/PaymentRequest.d.ts

@@ -60,7 +60,7 @@ export declare function from<const request extends Request>(request: request): r
  * import { Request } from 'mppx'
  * import { Methods } from 'mppx/tempo'
  *
- * const request = Request.fromIntent(Methods.charge, {
+ * const request = Request.fromMethod(Methods.charge, {
  *   amount: '1000000',
  *   currency: '0x20c0000000000000000000000000000000000001',
  *   recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',
@@ -69,7 +69,7 @@ export declare function from<const request extends Request>(request: request): r
  * })
  * ```
  */
-export declare function fromIntent<const method extends Method.Method>(method: method, request: z.input<method['schema']['request']>): Request<z.output<method['schema']['request']>>;
+export declare function fromMethod<const method extends Method.Method>(method: method, request: z.input<method['schema']['request']>): Request<z.output<method['schema']['request']>>;
 /**
  * Serializes a request to a base64url string.
  *

package/dist/PaymentRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PaymentRequest.d.ts","sourceRoot":"","sources":["../src/PaymentRequest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,KAAK,CAAC,MAAM,UAAU,CAAA;AAElC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,OAAO,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACnF,OAAO,CAAC,OAAO,CAAC,CAAA;AAElB;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,SAAS,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAC3D,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAEhD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAGlD"}
+{"version":3,"file":"PaymentRequest.d.ts","sourceRoot":"","sources":["../src/PaymentRequest.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,KAAK,KAAK,MAAM,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,KAAK,CAAC,MAAM,UAAU,CAAA;AAKlC;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,OAAO,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IACnF,OAAO,CAAC,OAAO,CAAC,CAAA;AAElB;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGpD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,SAAS,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7E;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,UAAU,CAAC,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAC3D,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,GAC5C,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAEhD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAIlD"}

package/dist/PaymentRequest.js

@@ -1,4 +1,7 @@
+import { createRequire } from 'node:module';
 import { Base64 } from 'ox';
+const require = createRequire(import.meta.url);
+const canonicalize = require('canonicalize');
 /**
  * Deserializes a base64url string to a request.
  *
@@ -48,7 +51,7 @@ export function from(request) {
  * import { Request } from 'mppx'
  * import { Methods } from 'mppx/tempo'
  *
- * const request = Request.fromIntent(Methods.charge, {
+ * const request = Request.fromMethod(Methods.charge, {
  *   amount: '1000000',
  *   currency: '0x20c0000000000000000000000000000000000001',
  *   recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',
@@ -57,7 +60,7 @@ export function from(request) {
  * })
  * ```
  */
-export function fromIntent(method, request) {
+export function fromMethod(method, request) {
     return method.schema.request.parse(request);
 }
 /**
@@ -75,7 +78,9 @@ export function fromIntent(method, request) {
  * ```
  */
 export function serialize(request) {
-    const json = JSON.stringify(request);
+    const json = canonicalize(request);
+    if (!json)
+        throw new Error('Failed to canonicalize request');
     return Base64.fromString(json, { pad: false, url: true });
 }
 //# sourceMappingURL=PaymentRequest.js.map

package/dist/PaymentRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"PaymentRequest.js","sourceRoot":"","sources":["../src/PaymentRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAsB3B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,IAAI,CAAgC,OAAgB;IAClE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,OAA6C;IAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAmD,CAAA;AAC/F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;IACpC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAC3D,CAAC"}
+{"version":3,"file":"PaymentRequest.js","sourceRoot":"","sources":["../src/PaymentRequest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAA;AAK3B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAA2C,CAAA;AAmBtF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACrC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,IAAI,CAAgC,OAAgB;IAClE,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,UAAU,CACxB,MAAc,EACd,OAA6C;IAE7C,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAmD,CAAA;AAC/F,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,SAAS,CAAC,OAAgB;IACxC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC5D,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;AAC3D,CAAC"}

package/dist/server/Mppx.js

@@ -70,7 +70,7 @@ function createMethodFn(parameters) {
             // Recompute challenge from options. The HMAC-bound ID means we don't need to
             // store challenges server-side—if the client echoes back a credential with
             // a matching ID, we know it was issued by us with these exact parameters.
-            const challenge = Challenge.fromIntent(method, {
+            const challenge = Challenge.fromMethod(method, {
                 description,
                 expires,
                 realm,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "main": "./dist/index.js",
   "license": "MIT",
   "files": [
@@ -105,6 +105,7 @@
     "@remix-run/fetch-proxy": "^0.7.1",
     "@remix-run/node-fetch-server": "^0.13.0",
     "cac": "^6.7.14",
+    "canonicalize": "^2.1.0",
     "ox": "^0.12.0",
     "zod": "^4.3.6"
   },

package/src/Challenge.test.ts

@@ -106,9 +106,9 @@ describe('from', () => {
   })
 })
 
-describe('fromIntent', () => {
+describe('fromMethod', () => {
   test('behavior: creates validated challenge from intent', () => {
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       id: 'abc123',
       realm: 'api.example.com',
       request: {
@@ -138,7 +138,7 @@ describe('fromIntent', () => {
   })
 
   test('behavior: includes methodDetails in request', () => {
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       id: 'abc123',
       realm: 'api.example.com',
       request: {
@@ -174,7 +174,7 @@ describe('fromIntent', () => {
   })
 
   test('behavior: includes optional digest and expires', () => {
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       id: 'abc123',
       realm: 'api.example.com',
       request: {
@@ -193,7 +193,7 @@ describe('fromIntent', () => {
   })
 
   test('behavior: creates challenge with HMAC-bound id via secretKey', () => {
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       realm: 'api.example.com',
       request: {
         amount: '1',
@@ -212,7 +212,7 @@ describe('fromIntent', () => {
 
   test('error: invalid request', () => {
     expect(() =>
-      Challenge.fromIntent(Methods.charge, {
+      Challenge.fromMethod(Methods.charge, {
         id: 'abc123',
         realm: 'api.example.com',
         request: {

package/src/Challenge.ts

@@ -186,7 +186,7 @@ export declare namespace from {
  * import { Methods } from 'mppx/tempo'
  *
  * // With HMAC-bound ID (recommended for servers)
- * const challenge = Challenge.fromIntent(
+ * const challenge = Challenge.fromMethod(
  *   Methods.charge,
  *   {
  *     realm: 'api.example.com',
@@ -201,14 +201,14 @@ export declare namespace from {
  * )
  * ```
  */
-export function fromIntent<const method extends Method.Method>(
+export function fromMethod<const method extends Method.Method>(
   method: method,
-  parameters: fromIntent.Parameters<method>,
-): fromIntent.ReturnType<method> {
+  parameters: fromMethod.Parameters<method>,
+): fromMethod.ReturnType<method> {
   const { name: methodName, intent } = method
   const { description, digest, expires, id, realm, secretKey } = parameters
 
-  const request = PaymentRequest.fromIntent(method, parameters.request)
+  const request = PaymentRequest.fromMethod(method, parameters.request)
 
   return from({
     ...(id ? { id } : { secretKey }),
@@ -219,10 +219,10 @@ export function fromIntent<const method extends Method.Method>(
     description,
     digest,
     expires,
-  } as from.Parameters) as fromIntent.ReturnType<method>
+  } as from.Parameters) as fromMethod.ReturnType<method>
 }
 
-export declare namespace fromIntent {
+export declare namespace fromMethod {
   type Parameters<method extends Method.Method> = OneOf<
     | {
         /** Explicit challenge ID. */

package/src/PaymentRequest.test.ts

@@ -19,9 +19,9 @@ describe('from', () => {
   })
 })
 
-describe('fromIntent', () => {
+describe('fromMethod', () => {
   test('creates a validated request from intent', () => {
-    const request = PaymentRequest.fromIntent(Methods.charge, {
+    const request = PaymentRequest.fromMethod(Methods.charge, {
       amount: '1',
       currency: '0x20c0000000000000000000000000000000000001',
       decimals: 6,
@@ -39,7 +39,7 @@ describe('fromIntent', () => {
   })
 
   test('includes methodDetails fields', () => {
-    const request = PaymentRequest.fromIntent(Methods.charge, {
+    const request = PaymentRequest.fromMethod(Methods.charge, {
       amount: '1',
       currency: '0x20c0000000000000000000000000000000000001',
       decimals: 6,
@@ -62,7 +62,7 @@ describe('fromIntent', () => {
 
   test('throws on invalid request', () => {
     expect(() =>
-      PaymentRequest.fromIntent(Methods.charge, {
+      PaymentRequest.fromMethod(Methods.charge, {
         amount: 123,
         currency: '0x20c0000000000000000000000000000000000001',
         recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',

package/src/PaymentRequest.ts

@@ -1,8 +1,12 @@
+import { createRequire } from 'node:module'
 import { Base64 } from 'ox'
 import type { Compute } from './internal/types.js'
 import type * as Method from './Method.js'
 import type * as z from './zod.js'
 
+const require = createRequire(import.meta.url)
+const canonicalize = require('canonicalize') as (input: unknown) => string | undefined
+
 /**
  * Intent-specific payment parameters.
  *
@@ -71,7 +75,7 @@ export function from<const request extends Request>(request: request): request {
  * import { Request } from 'mppx'
  * import { Methods } from 'mppx/tempo'
  *
- * const request = Request.fromIntent(Methods.charge, {
+ * const request = Request.fromMethod(Methods.charge, {
  *   amount: '1000000',
  *   currency: '0x20c0000000000000000000000000000000000001',
  *   recipient: '0x742d35Cc6634C0532925a3b844Bc9e7595f8fE00',
@@ -80,7 +84,7 @@ export function from<const request extends Request>(request: request): request {
  * })
  * ```
  */
-export function fromIntent<const method extends Method.Method>(
+export function fromMethod<const method extends Method.Method>(
   method: method,
   request: z.input<method['schema']['request']>,
 ): Request<z.output<method['schema']['request']>> {
@@ -102,6 +106,7 @@ export function fromIntent<const method extends Method.Method>(
  * ```
  */
 export function serialize(request: Request): string {
-  const json = JSON.stringify(request)
+  const json = canonicalize(request)
+  if (!json) throw new Error('Failed to canonicalize request')
   return Base64.fromString(json, { pad: false, url: true })
 }

package/src/client/Mppx.test.ts

@@ -79,7 +79,7 @@ describe('createCredential', () => {
       methods: [tempo({ account: accounts[1], getClient: () => client })],
     })
 
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       realm,
       secretKey,
       request: {
@@ -192,7 +192,7 @@ describe('createCredential', () => {
       methods: [tempo({ getClient: () => client })],
     })
 
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       realm,
       secretKey,
       request: {
@@ -224,7 +224,7 @@ describe('createCredential', () => {
       methods: [tempo({ account: accounts[1], getClient: () => client })],
     })
 
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       realm,
       secretKey,
       request: {
@@ -255,7 +255,7 @@ describe('createCredential', () => {
       transport: Transport.mcp(),
     })
 
-    const challenge = Challenge.fromIntent(Methods.charge, {
+    const challenge = Challenge.fromMethod(Methods.charge, {
       realm,
       secretKey,
       request: {

package/src/client/Transport.test.ts

@@ -6,7 +6,7 @@ import { describe, expect, test } from 'vitest'
 const realm = 'api.example.com'
 const secretKey = 'test-secret-key'
 
-const challenge = Challenge.fromIntent(Methods.charge, {
+const challenge = Challenge.fromMethod(Methods.charge, {
   realm,
   secretKey,
   request: {
@@ -60,7 +60,7 @@ describe('http', () => {
       expect(transport.getChallenge(response)).toMatchInlineSnapshot(`
         {
           "expires": "2025-01-01T00:00:00.000Z",
-          "id": "EUAHxZRCSFB29SAs5TEcB4cQDS0uVDzl8uSYuA58aVs",
+          "id": "wv3vZAjsySM50i4f1sJCZxyOLNry0dLSOwuWDBqrXaw",
           "intent": "charge",
           "method": "tempo",
           "realm": "api.example.com",
@@ -91,7 +91,7 @@ describe('http', () => {
       const headers = result.headers as Headers
 
       expect(headers.get('Authorization')).toMatchInlineSnapshot(
-        `"Payment eyJjaGFsbGVuZ2UiOnsiZXhwaXJlcyI6IjIwMjUtMDEtMDFUMDA6MDA6MDAuMDAwWiIsImlkIjoiRVVBSHhaUkNTRkIyOVNBczVURWNCNGNRRFMwdVZEemw4dVNZdUE1OGFWcyIsImludGVudCI6ImNoYXJnZSIsIm1ldGhvZCI6InRlbXBvIiwicmVhbG0iOiJhcGkuZXhhbXBsZS5jb20iLCJyZXF1ZXN0IjoiZXlKamRYSnlaVzVqZVNJNklqQjRNakJqTURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TVNJc0ltVjRjR2x5WlhNaU9pSXlNREkxTFRBeExUQXhWREF3T2pBd09qQXdMakF3TUZvaUxDSnlaV05wY0dsbGJuUWlPaUl3ZURjME1tUXpOVU5qTmpZek5FTXdOVE15T1RJMVlUTmlPRFEwUW1NNVpUYzFPVFZtT0daRk1EQWlMQ0poYlc5MWJuUWlPaUl4TURBd0luMCJ9LCJwYXlsb2FkIjp7InNpZ25hdHVyZSI6IjB4YWJjMTIzIiwidHlwZSI6InRyYW5zYWN0aW9uIn19"`,
+        `"Payment eyJjaGFsbGVuZ2UiOnsiZXhwaXJlcyI6IjIwMjUtMDEtMDFUMDA6MDA6MDAuMDAwWiIsImlkIjoid3YzdlpBanN5U001MGk0ZjFzSkNaeHlPTE5yeTBkTFNPd3VXREJxclhhdyIsImludGVudCI6ImNoYXJnZSIsIm1ldGhvZCI6InRlbXBvIiwicmVhbG0iOiJhcGkuZXhhbXBsZS5jb20iLCJyZXF1ZXN0IjoiZXlKaGJXOTFiblFpT2lJeE1EQXdJaXdpWTNWeWNtVnVZM2tpT2lJd2VESXdZekF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREF3TURBd01EQXdNREVpTENKbGVIQnBjbVZ6SWpvaU1qQXlOUzB3TVMwd01WUXdNRG93TURvd01DNHdNREJhSWl3aWNtVmphWEJwWlc1MElqb2lNSGczTkRKa016VkRZelkyTXpSRE1EVXpNamt5TldFellqZzBORUpqT1dVM05UazFaamhtUlRBd0luMCJ9LCJwYXlsb2FkIjp7InNpZ25hdHVyZSI6IjB4YWJjMTIzIiwidHlwZSI6InRyYW5zYWN0aW9uIn19"`,
       )
     })
 
@@ -182,7 +182,7 @@ describe('mcp', () => {
       expect(transport.getChallenge(response)).toMatchInlineSnapshot(`
         {
           "expires": "2025-01-01T00:00:00.000Z",
-          "id": "EUAHxZRCSFB29SAs5TEcB4cQDS0uVDzl8uSYuA58aVs",
+          "id": "wv3vZAjsySM50i4f1sJCZxyOLNry0dLSOwuWDBqrXaw",
           "intent": "charge",
           "method": "tempo",
           "realm": "api.example.com",
@@ -239,7 +239,7 @@ describe('mcp', () => {
               "org.paymentauth/credential": {
                 "challenge": {
                   "expires": "2025-01-01T00:00:00.000Z",
-                  "id": "EUAHxZRCSFB29SAs5TEcB4cQDS0uVDzl8uSYuA58aVs",
+                  "id": "wv3vZAjsySM50i4f1sJCZxyOLNry0dLSOwuWDBqrXaw",
                   "intent": "charge",
                   "method": "tempo",
                   "realm": "api.example.com",

package/src/mcp-sdk/client/McpClient.test.ts

@@ -154,7 +154,7 @@ describe('McpClient.wrap', () => {
   })
 
   test('error: throws when method not found', async () => {
-    const challenge = Challenge.fromIntent(tempo_server.charge({ getClient: () => testClient }), {
+    const challenge = Challenge.fromMethod(tempo_server.charge({ getClient: () => testClient }), {
       realm,
       secretKey,
       request: {

package/src/server/Mppx.ts

@@ -160,7 +160,7 @@ function createMethodFn(parameters: createMethodFn.Parameters): createMethodFn.R
         // Recompute challenge from options. The HMAC-bound ID means we don't need to
         // store challenges server-side—if the client echoes back a credential with
         // a matching ID, we know it was issued by us with these exact parameters.
-        const challenge = Challenge.fromIntent(method, {
+        const challenge = Challenge.fromMethod(method, {
           description,
           expires,
           realm,

package/src/server/Transport.test.ts

@@ -7,7 +7,7 @@ import { BadRequestError, ChannelClosedError } from '../Errors.js'
 const realm = 'api.example.com'
 const secretKey = 'test-secret-key'
 
-const challenge = Challenge.fromIntent(Methods.charge, {
+const challenge = Challenge.fromMethod(Methods.charge, {
   realm,
   secretKey,
   request: {
@@ -43,7 +43,7 @@ describe('http', () => {
         {
           "challenge": {
             "expires": "2025-01-01T00:00:00.000Z",
-            "id": "jIuTUdphF_TyhJ-NT1lK2r5YzPXw4tuELfslOVa3nls",
+            "id": "6FkNG-Uv4Ff-viAxYvfyNLhbXbEXcfsbdEtB74ADviw",
             "intent": "charge",
             "method": "tempo",
             "realm": "api.example.com",
@@ -93,7 +93,7 @@ describe('http', () => {
         {
           "headers": {
             "cache-control": "no-store",
-            "www-authenticate": "Payment id="jIuTUdphF_TyhJ-NT1lK2r5YzPXw4tuELfslOVa3nls", realm="api.example.com", method="tempo", intent="charge", request="eyJjdXJyZW5jeSI6IjB4MjBjMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMSIsImV4cGlyZXMiOiIyMDI1LTAxLTAxVDAwOjAwOjAwLjAwMFoiLCJyZWNpcGllbnQiOiIweDc0MmQzNUNjNjYzNEMwNTMyOTI1YTNiODQ0QmM5ZTc1OTVmOGZFMDAiLCJhbW91bnQiOiIxMDAwMDAwMDAwIn0", expires="2025-01-01T00:00:00.000Z"",
+            "www-authenticate": "Payment id="6FkNG-Uv4Ff-viAxYvfyNLhbXbEXcfsbdEtB74ADviw", realm="api.example.com", method="tempo", intent="charge", request="eyJhbW91bnQiOiIxMDAwMDAwMDAwIiwiY3VycmVuY3kiOiIweDIwYzAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDEiLCJleHBpcmVzIjoiMjAyNS0wMS0wMVQwMDowMDowMC4wMDBaIiwicmVjaXBpZW50IjoiMHg3NDJkMzVDYzY2MzRDMDUzMjkyNWEzYjg0NEJjOWU3NTk1ZjhmRTAwIn0", expires="2025-01-01T00:00:00.000Z"",
           },
           "status": 402,
         }
@@ -183,7 +183,7 @@ describe('mcp', () => {
         {
           "challenge": {
             "expires": "2025-01-01T00:00:00.000Z",
-            "id": "jIuTUdphF_TyhJ-NT1lK2r5YzPXw4tuELfslOVa3nls",
+            "id": "6FkNG-Uv4Ff-viAxYvfyNLhbXbEXcfsbdEtB74ADviw",
             "intent": "charge",
             "method": "tempo",
             "realm": "api.example.com",
@@ -221,7 +221,7 @@ describe('mcp', () => {
               "challenges": [
                 {
                   "expires": "2025-01-01T00:00:00.000Z",
-                  "id": "jIuTUdphF_TyhJ-NT1lK2r5YzPXw4tuELfslOVa3nls",
+                  "id": "6FkNG-Uv4Ff-viAxYvfyNLhbXbEXcfsbdEtB74ADviw",
                   "intent": "charge",
                   "method": "tempo",
                   "realm": "api.example.com",
@@ -262,7 +262,7 @@ describe('mcp', () => {
           "result": {
             "_meta": {
               "org.paymentauth/receipt": {
-                "challengeId": "jIuTUdphF_TyhJ-NT1lK2r5YzPXw4tuELfslOVa3nls",
+                "challengeId": "6FkNG-Uv4Ff-viAxYvfyNLhbXbEXcfsbdEtB74ADviw",
                 "method": "tempo",
                 "reference": "0xtxhash",
                 "status": "success",