mppx 0.5.11 → 0.5.13

package/dist/tempo/server/internal/html.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,m4tbAAm4tb,CAAA"}
+{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,w91bAAw91b,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "main": "./dist/index.js",
   "license": "MIT",
   "files": [
@@ -124,7 +124,7 @@
   },
   "dependencies": {
     "incur": "^0.3.23",
-    "ox": "0.14.7",
+    "ox": "0.14.10",
     "zod": "^4.3.6"
   },
   "repository": {

package/src/cli/cli.test.ts

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
+import { pathToFileURL } from 'node:url'
 
 import { parseUnits } from 'viem'
 import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
@@ -14,6 +15,7 @@ import { accounts, asset, chain, client, fundAccount } from '~test/tempo/viem.js
 
 import * as Challenge from '../Challenge.js'
 import * as Credential from '../Credential.js'
+import * as Method from '../Method.js'
 import * as Receipt from '../Receipt.js'
 import * as Mppx_server from '../server/Mppx.js'
 import { toNodeListener } from '../server/Mppx.js'
@@ -21,6 +23,7 @@ import * as Store from '../Store.js'
 import { stripe as stripe_server } from '../stripe/server/Methods.js'
 import { tempo } from '../tempo/server/Methods.js'
 import type { SessionCredentialPayload } from '../tempo/session/Types.js'
+import * as z from '../zod.js'
 import cli from './cli.js'
 
 const testPrivateKey = generatePrivateKey()
@@ -78,6 +81,24 @@ async function serve(argv: string[], options?: { env?: Record<string, string | u
   return { output, stderr, exitCode }
 }
 
+function createMockChargeMethod(name: string) {
+  return Method.from({
+    name,
+    intent: 'charge',
+    schema: {
+      credential: {
+        payload: z.object({ token: z.string() }),
+      },
+      request: z.object({
+        amount: z.string(),
+        currency: z.string(),
+        decimals: z.number(),
+        recipient: z.string(),
+      }),
+    },
+  })
+}
+
 describe('discover validate', () => {
   test('validates a local discovery document', async () => {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mppx-discovery-'))
@@ -329,6 +350,198 @@ describe('basic charge (examples/basic)', () => {
     }
   })
 
+  test('selects a later supported challenge when the first offer is unsupported', async () => {
+    const unsupportedMethod = Method.toServer(createMockChargeMethod('unknown'), {
+      async verify() {
+        return {
+          method: 'unknown',
+          reference: 'unknown-ref',
+          status: 'success' as const,
+          timestamp: new Date().toISOString(),
+        }
+      },
+    })
+    const tempoMethod = tempo.charge({ getClient: () => client })
+
+    const server = Mppx_server.create({
+      methods: [unsupportedMethod, tempoMethod],
+      realm: 'cli-test-multi-offer',
+      secretKey: 'cli-test-secret',
+    })
+
+    const httpServer = await Http.createServer(async (req, res) => {
+      const result = await toNodeListener(
+        server.compose(
+          [
+            unsupportedMethod,
+            {
+              amount: '1',
+              currency: asset,
+              decimals: 6,
+              expires: new Date(Date.now() + 60_000).toISOString(),
+              recipient: accounts[0].address,
+            },
+          ],
+          [
+            tempoMethod,
+            {
+              amount: '1',
+              currency: asset,
+              decimals: 6,
+              expires: new Date(Date.now() + 60_000).toISOString(),
+              recipient: accounts[0].address,
+            },
+          ],
+        ),
+      )(req, res)
+      if (result.status === 402) return
+      res.end('paid-from-second-offer')
+    })
+
+    try {
+      const { output, exitCode } = await serve([httpServer.url, '--rpc-url', rpcUrl, '-s'], {
+        env: { MPPX_PRIVATE_KEY: testPrivateKey },
+      })
+
+      expect(exitCode).toBeUndefined()
+      expect(output).toContain('paid-from-second-offer')
+    } finally {
+      httpServer.close()
+    }
+  })
+
+  test('config methods emit Accept-Payment and select the preferred challenge', async () => {
+    const alphaMethod = Method.toServer(createMockChargeMethod('alpha'), {
+      async verify({ envelope }) {
+        if (!envelope) throw new Error('expected envelope')
+        if ((envelope.credential.payload as { token: string }).token !== 'alpha-token') {
+          throw new Error('expected alpha credential')
+        }
+
+        return {
+          method: 'alpha',
+          reference: 'alpha-ref',
+          status: 'success' as const,
+          timestamp: new Date().toISOString(),
+        }
+      },
+    })
+    const betaMethod = Method.toServer(createMockChargeMethod('beta'), {
+      async verify({ envelope }) {
+        if (!envelope) throw new Error('expected envelope')
+        if ((envelope.credential.payload as { token: string }).token !== 'beta-token') {
+          throw new Error('expected beta credential')
+        }
+
+        return {
+          method: 'beta',
+          reference: 'beta-ref',
+          status: 'success' as const,
+          timestamp: new Date().toISOString(),
+        }
+      },
+    })
+
+    const server = Mppx_server.create({
+      methods: [betaMethod, alphaMethod],
+      realm: 'cli-test-config-offers',
+      secretKey: 'cli-test-secret',
+    })
+
+    const configDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mppx-cli-config-'))
+    const configPath = path.join(configDir, 'mppx.config.mjs')
+    const mppxModuleUrl = pathToFileURL(path.join(process.cwd(), 'src/index.ts')).href
+    const cliModuleUrl = pathToFileURL(path.join(process.cwd(), 'src/cli/config.ts')).href
+    fs.writeFileSync(
+      configPath,
+      `
+import { Credential, Method, z } from '${mppxModuleUrl}'
+import { defineConfig } from '${cliModuleUrl}'
+
+const alpha = Method.toClient(Method.from({
+  name: 'alpha',
+  intent: 'charge',
+  schema: {
+    credential: { payload: z.object({ token: z.string() }) },
+    request: z.object({ amount: z.string(), currency: z.string(), decimals: z.number(), recipient: z.string() }),
+  },
+}), {
+  async createCredential({ challenge }) {
+    return Credential.serialize({ challenge, payload: { token: 'alpha-token' } })
+  },
+})
+
+const beta = Method.toClient(Method.from({
+  name: 'beta',
+  intent: 'charge',
+  schema: {
+    credential: { payload: z.object({ token: z.string() }) },
+    request: z.object({ amount: z.string(), currency: z.string(), decimals: z.number(), recipient: z.string() }),
+  },
+}), {
+  async createCredential({ challenge }) {
+    return Credential.serialize({ challenge, payload: { token: 'beta-token' } })
+  },
+})
+
+export default defineConfig({
+  methods: [beta, alpha],
+  paymentPreferences: ({ alpha, beta }) => ({
+    [alpha.charge]: 1,
+    [beta.charge]: 0.2,
+  }),
+})
+      `.trim(),
+    )
+
+    let acceptPaymentHeader: string | undefined
+    let authorization: string | undefined
+    const httpServer = await Http.createServer(async (req, res) => {
+      if (!req.headers.authorization)
+        acceptPaymentHeader = req.headers['accept-payment'] as string | undefined
+      else authorization = req.headers.authorization
+
+      const result = await toNodeListener(
+        server.compose(
+          [
+            betaMethod,
+            {
+              amount: '1',
+              currency: asset,
+              decimals: 6,
+              expires: new Date(Date.now() + 60_000).toISOString(),
+              recipient: accounts[0].address,
+            },
+          ],
+          [
+            alphaMethod,
+            {
+              amount: '1',
+              currency: asset,
+              decimals: 6,
+              expires: new Date(Date.now() + 60_000).toISOString(),
+              recipient: accounts[0].address,
+            },
+          ],
+        ),
+      )(req, res)
+      if (result.status === 402) return
+      res.end('paid-from-config-preference')
+    })
+
+    try {
+      const { output, exitCode } = await serve([httpServer.url, '--config', configPath, '-s'])
+
+      expect(exitCode).toBeUndefined()
+      expect(output).toContain('paid-from-config-preference')
+      expect(acceptPaymentHeader).toBe('beta/charge;q=0.2, alpha/charge')
+      expect(Credential.deserialize(authorization!).payload).toEqual({ token: 'alpha-token' })
+    } finally {
+      httpServer.close()
+      fs.rmSync(configDir, { recursive: true, force: true })
+    }
+  })
+
   test(
     'zero-amount charge uses a proof credential and receives response',
     { timeout: 120_000 },
@@ -1120,6 +1333,71 @@ describe('sign', () => {
     expect(output).toContain('Unsupported payment method')
   })
 
+  test('paymentPreferences opt-out is not bypassed by CLI fallback selection', async () => {
+    const configDir = fs.mkdtempSync(path.join(os.tmpdir(), 'mppx-sign-config-'))
+    const configPath = path.join(configDir, 'mppx.config.mjs')
+    const mppxModuleUrl = pathToFileURL(path.join(process.cwd(), 'src/index.ts')).href
+    const cliModuleUrl = pathToFileURL(path.join(process.cwd(), 'src/cli/config.ts')).href
+    fs.writeFileSync(
+      configPath,
+      `
+import { Credential, Method, z } from '${mppxModuleUrl}'
+import { defineConfig } from '${cliModuleUrl}'
+
+const alpha = Method.toClient(Method.from({
+  name: 'alpha',
+  intent: 'charge',
+  schema: {
+    credential: { payload: z.object({ token: z.string() }) },
+    request: z.object({ amount: z.string() }),
+  },
+}), {
+  async createCredential({ challenge }) {
+    return Credential.serialize({ challenge, payload: { token: 'alpha-token' } })
+  },
+})
+
+export default defineConfig({
+  methods: [alpha],
+  paymentPreferences: ({ alpha }) => ({
+    [alpha.charge]: 0,
+  }),
+})
+      `.trim(),
+    )
+
+    const challenge =
+      'Payment id="x", realm="x", method="alpha", intent="charge", request="eyJhbW91bnQiOiIxIn0"'
+
+    try {
+      const { exitCode, output } = await serve([
+        'sign',
+        '--challenge',
+        challenge,
+        '--config',
+        configPath,
+      ])
+      expect(exitCode).toBe(2)
+      expect(output).toContain('Unsupported payment method')
+    } finally {
+      fs.rmSync(configDir, { recursive: true, force: true })
+    }
+  })
+
+  test('selects a later supported challenge from a merged challenge value', async () => {
+    const merged = [
+      'Payment id="x", realm="x", method="unknown", intent="charge", request="e30"',
+      validChallenge,
+    ].join(', ')
+
+    const { output, exitCode } = await serve(['sign', '--challenge', merged, '--rpc-url', rpcUrl], {
+      env: { MPPX_PRIVATE_KEY: testPrivateKey },
+    })
+
+    expect(exitCode).toBeUndefined()
+    expect(output.trim()).toMatch(/^Payment\s+\S+/)
+  })
+
   test('error: no account for tempo', async () => {
     const { exitCode, output } = await serve(
       ['sign', '--challenge', validChallenge, '--account', 'nonexistent-sign-test'],

package/src/cli/cli.ts

@@ -13,7 +13,7 @@ import { normalizeHeaders } from '../client/internal/Fetch.js'
 import * as Mppx from '../client/Mppx.js'
 import { validate as validateDiscovery } from '../discovery/Validate.js'
 import { createDefaultStore, createKeychain, resolveAccountName } from './account.js'
-import { loadConfig, resolvePlugin } from './internal.js'
+import { loadConfig, resolveAcceptPayment, selectChallenge } from './internal.js'
 import type { Plugin } from './plugins/plugin.js'
 import { readTempoKeystore, resolveTempoAccount } from './plugins/tempo.js'
 import {
@@ -128,6 +128,13 @@ const cli = Cli.create('mppx', {
         headers[header.slice(0, index).trim()] = header.slice(index + 1).trim()
       }
     }
+    const acceptPayment = resolveAcceptPayment(loaded?.config)
+    if (
+      acceptPayment &&
+      !Object.keys(headers).some((key) => key.toLowerCase() === 'accept-payment')
+    ) {
+      headers['Accept-Payment'] = acceptPayment
+    }
 
     const url = (() => {
       const hasProtocol = /^https?:\/\//.test(c.args.url)
@@ -200,8 +207,26 @@ const cli = Cli.create('mppx', {
         return
       }
 
-      const challenge = Challenge.fromResponse(challengeResponse)
-      const { plugin, method: configMethod } = resolvePlugin(challenge, loaded?.config)
+      const selected = selectChallenge(
+        Challenge.fromResponseList(challengeResponse),
+        loaded?.config,
+      )
+      if (!selected) {
+        const offers = Challenge.fromResponseList(challengeResponse)
+          .map((challenge) => `${challenge.method}/${challenge.intent}`)
+          .join(', ')
+        return c.error({
+          code: 'UNSUPPORTED_METHOD',
+          message: `Unsupported payment method. Server offers: ${offers}. Add it to mppx.config.ts using defineConfig().`,
+          exitCode: 2,
+        })
+      }
+
+      const { challenge, plugin, method: configMethod } = selected
+      const selectedChallengeResponse = new Response(null, {
+        status: 402,
+        headers: { 'WWW-Authenticate': Challenge.serialize(challenge) },
+      })
 
       let tokenSymbol = (challenge.request.currency as string | undefined) ?? ''
       let tokenDecimals = (challenge.request.decimals as number | undefined) ?? 6
@@ -297,23 +322,17 @@ const cli = Cli.create('mppx', {
       // Create credential
       let credential: string
       if (pluginResult?.createCredential)
-        credential = await pluginResult.createCredential(challengeResponse)
+        credential = await pluginResult.createCredential(selectedChallengeResponse)
       else if (pluginResult) {
         const mppx = Mppx.create({ methods: pluginResult.methods, polyfill: false })
         credential = await mppx.createCredential(
-          challengeResponse,
+          selectedChallengeResponse,
           pluginResult.credentialContext as undefined,
         )
       } else if (configMethod) {
         const mppx = Mppx.create({ methods: [configMethod], polyfill: false })
-        credential = await mppx.createCredential(challengeResponse)
-      } else {
-        return c.error({
-          code: 'UNSUPPORTED_METHOD',
-          message: `Unsupported payment method: ${challenge.method}/${challenge.intent}. Add it to mppx.config.ts using defineConfig().`,
-          exitCode: 2,
-        })
-      }
+        credential = await mppx.createCredential(selectedChallengeResponse)
+      } else throw new Error('unreachable')
 
       // Send credential and get response
       const credentialHeaders = {
@@ -815,9 +834,9 @@ const sign = Cli.create('sign', {
       })
     }
 
-    let challenge: Challenge.Challenge
+    let challenges: Challenge.Challenge[]
     try {
-      challenge = Challenge.deserialize(raw)
+      challenges = Challenge.deserializeList(raw)
     } catch (err) {
       return c.error({
         code: 'INVALID_CHALLENGE',
@@ -832,7 +851,19 @@ const sign = Cli.create('sign', {
     }
 
     const loaded = await loadConfig(c.options.config)
-    const { plugin, method: configMethod } = resolvePlugin(challenge, loaded?.config)
+    const selected = selectChallenge(challenges, loaded?.config)
+    if (!selected) {
+      const offers = challenges
+        .map((challenge) => `${challenge.method}/${challenge.intent}`)
+        .join(', ')
+      return c.error({
+        code: 'UNSUPPORTED_METHOD',
+        message: `Unsupported payment method. Server offers: ${offers}. Add it to mppx.config.ts using defineConfig().`,
+        exitCode: 2,
+      })
+    }
+
+    const { challenge, plugin, method: configMethod } = selected
     const methodOpts = parseMethodOpts(c.options.methodOpt)
 
     const wwwAuth = Challenge.serialize(challenge)

package/src/cli/config.ts

@@ -28,17 +28,23 @@ import type { Plugin } from './plugins/plugin.js'
  * })
  * ```
  */
-export function defineConfig(config: defineConfig.Config): defineConfig.Config {
+export function defineConfig<const methods extends Mppx.Methods | undefined = undefined>(
+  config: defineConfig.Config<methods>,
+): defineConfig.Config<methods> {
   return config
 }
 
 export declare namespace defineConfig {
-  type Config = {
+  type Config<methods extends Mppx.Methods | undefined = undefined> = {
     /** Array of methods to use. */
-    methods?: Mppx.create.Config['methods'] | undefined
+    methods?: methods
+    /** Optional payment preferences for configured client methods. */
+    paymentPreferences?: methods extends Mppx.Methods
+      ? Mppx.create.Config<methods>['paymentPreferences']
+      : undefined
     /** Array of plugins to use. */
     plugins?: Plugin[] | undefined
   }
 }
 
-export type Config = defineConfig.Config
+export type Config = defineConfig.Config<Mppx.Methods>

package/src/cli/internal.ts

@@ -2,6 +2,7 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 
 import type * as Challenge from '../Challenge.js'
+import * as AcceptPayment from '../internal/AcceptPayment.js'
 import type * as Method from '../Method.js'
 import type { Config } from './config.js'
 import { stripe as stripePlugin, tempo as tempoPlugin } from './plugins/index.js'
@@ -13,13 +14,13 @@ export function resolvePlugin(
   challenge: Challenge.Challenge,
   config?: { plugins?: Plugin[] | undefined; methods?: any },
 ): { plugin?: Plugin | undefined; method?: Method.AnyClient | undefined } {
-  const configPlugin = config?.plugins?.find((p) => p.method === challenge.method)
+  const configPlugin = config?.plugins?.find((p) => supportsPlugin(p, challenge))
   if (configPlugin) return { plugin: configPlugin }
 
-  const builtin = builtinPlugins.find((p) => p.method === challenge.method)
+  const builtin = builtinPlugins.find((p) => supportsPlugin(p, challenge))
   if (builtin) return { plugin: builtin }
 
-  const configMethods = config?.methods?.flat() as Method.AnyClient[] | undefined
+  const configMethods = flattenConfigMethods(config)
   const matched = configMethods?.find(
     (m) => m.name === challenge.method && m.intent === challenge.intent,
   )
@@ -28,6 +29,61 @@ export function resolvePlugin(
   return {}
 }
 
+export function selectChallenge(
+  challenges: readonly Challenge.Challenge[],
+  config?: Config | undefined,
+):
+  | ({ challenge: Challenge.Challenge } & {
+      plugin?: Plugin | undefined
+      method?: Method.AnyClient | undefined
+    })
+  | undefined {
+  const configMethods = flattenConfigMethods(config)
+  if (configMethods?.length) {
+    const resolvedPreferences = AcceptPayment.resolve(
+      configMethods,
+      config?.paymentPreferences as AcceptPayment.Config<typeof configMethods> | undefined,
+    )
+    const selected = AcceptPayment.selectChallenge(
+      challenges,
+      configMethods,
+      resolvedPreferences.entries,
+    )
+    if (selected) {
+      return { challenge: selected.challenge, ...resolvePlugin(selected.challenge, config) }
+    }
+
+    return undefined
+  }
+
+  for (const challenge of challenges) {
+    const resolved = resolvePlugin(challenge, config)
+    if (resolved.plugin || resolved.method) return { challenge, ...resolved }
+  }
+
+  return undefined
+}
+
+export function resolveAcceptPayment(config?: Config | undefined): string | undefined {
+  const methods = flattenConfigMethods(config)
+  if (!methods?.length) return undefined
+
+  return AcceptPayment.resolve(
+    methods,
+    config?.paymentPreferences as AcceptPayment.Config<typeof methods> | undefined,
+  ).header
+}
+
+export function flattenConfigMethods(
+  config?: Pick<Config, 'methods'> | undefined,
+): Method.AnyClient[] | undefined {
+  return Array.isArray(config?.methods) ? (config.methods.flat() as Method.AnyClient[]) : undefined
+}
+
+function supportsPlugin(plugin: Plugin, challenge: Challenge.Challenge): boolean {
+  return plugin.supports ? plugin.supports(challenge) : plugin.method === challenge.method
+}
+
 const CONFIG_NAMES = ['mppx.config.ts', 'mppx.config.js', 'mppx.config.mjs'] as const
 
 export async function loadConfig(

package/src/cli/plugins/plugin.ts

@@ -9,6 +9,9 @@ export interface Plugin {
   /** Payment method name (e.g., 'tempo', 'stripe') */
   method: string
 
+  /** Optional predicate for challenge support when a plugin does not support every intent for its method. */
+  supports?(challenge: Challenge.Challenge): boolean
+
   /**
    * Resolve account, client, and display info for a challenge.
    * Returns methods for credential creation.

package/src/cli/plugins/stripe.ts

@@ -7,6 +7,9 @@ import { createPlugin } from './plugin.js'
 export function stripe() {
   return createPlugin({
     method: 'stripe',
+    supports(challenge) {
+      return challenge.method === 'stripe' && challenge.intent === 'charge'
+    },
 
     async setup({ challenge, methodOpts }) {
       const challengeRequest = challenge.request as Record<string, unknown>

package/src/cli/plugins/tempo.ts

@@ -46,6 +46,9 @@ export function tempo() {
 
   return createPlugin({
     method: 'tempo',
+    supports(challenge) {
+      return challenge.method === 'tempo' && ['charge', 'session'].includes(challenge.intent)
+    },
 
     async setup({ challenge, options, methodOpts }) {
       const accountName = resolveAccountName(options.account)

package/src/client/Mppx.test-d.ts

@@ -46,6 +46,23 @@ describe('create.Config', () => {
 
     expectTypeOf<Config>().toHaveProperty('methods')
   })
+
+  test('paymentPreferences callback exposes typed method keys', () => {
+    const mppx = Mppx.create({
+      methods: [tempo({ account: {} as Account })],
+      paymentPreferences: ({ tempo }) => {
+        expectTypeOf(tempo.charge).toEqualTypeOf<'tempo/charge'>()
+        expectTypeOf(tempo.session).toEqualTypeOf<'tempo/session'>()
+
+        return {
+          [tempo.charge]: 0.5,
+          [tempo.session]: 0,
+        }
+      },
+    })
+
+    expectTypeOf(mppx.fetch).toBeFunction()
+  })
 })
 
 describe('Method.toClient', () => {
@@ -99,6 +116,22 @@ describe('Mppx with context', () => {
     expectTypeOf(mppx.createCredential).toBeFunction()
     expectTypeOf(mppx.createCredential).returns.toMatchTypeOf<Promise<string>>()
   })
+
+  test('createCredential accepts an optional Accept-Payment override', () => {
+    const method = charge({
+      account: {} as Account,
+    })
+
+    const mppx = Mppx.create({ methods: [method] })
+
+    const createCredential: (
+      response: Response,
+      context?: Parameters<typeof mppx.createCredential>[1],
+      options?: Parameters<typeof mppx.createCredential>[2],
+    ) => Promise<string> = mppx.createCredential
+
+    expectTypeOf(createCredential).toBeFunction()
+  })
 })
 
 describe('fetch context', () => {