mppx 0.6.27 → 0.6.29

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.6.27",
+  "version": "0.6.29",
   "main": "./dist/index.js",
   "license": "MIT",
   "files": [
@@ -11,93 +11,113 @@
   ],
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
       "src": "./src/index.ts",
+      "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
     "./cli": {
-      "types": "./dist/cli/config.d.ts",
       "src": "./src/cli/config.ts",
+      "types": "./dist/cli/config.d.ts",
       "default": "./dist/cli/config.js"
     },
     "./cli/plugins": {
-      "types": "./dist/cli/plugins/index.d.ts",
       "src": "./src/cli/plugins/index.ts",
+      "types": "./dist/cli/plugins/index.d.ts",
       "default": "./dist/cli/plugins/index.js"
     },
     "./client": {
-      "types": "./dist/client/index.d.ts",
       "src": "./src/client/index.ts",
+      "types": "./dist/client/index.d.ts",
       "default": "./dist/client/index.js"
     },
     "./discovery": {
-      "types": "./dist/discovery/index.d.ts",
       "src": "./src/discovery/index.ts",
+      "types": "./dist/discovery/index.d.ts",
       "default": "./dist/discovery/index.js"
     },
+    "./evm": {
+      "src": "./src/evm/index.ts",
+      "types": "./dist/evm/index.d.ts",
+      "default": "./dist/evm/index.js"
+    },
+    "./evm/client": {
+      "src": "./src/evm/client/index.ts",
+      "types": "./dist/evm/client/index.d.ts",
+      "default": "./dist/evm/client/index.js"
+    },
+    "./evm/server": {
+      "src": "./src/evm/server/index.ts",
+      "types": "./dist/evm/server/index.d.ts",
+      "default": "./dist/evm/server/index.js"
+    },
     "./mcp-sdk/client": {
-      "types": "./dist/mcp-sdk/client/index.d.ts",
       "src": "./src/mcp-sdk/client/index.ts",
+      "types": "./dist/mcp-sdk/client/index.d.ts",
       "default": "./dist/mcp-sdk/client/index.js"
     },
     "./mcp-sdk/server": {
-      "types": "./dist/mcp-sdk/server/index.d.ts",
       "src": "./src/mcp-sdk/server/index.ts",
+      "types": "./dist/mcp-sdk/server/index.d.ts",
       "default": "./dist/mcp-sdk/server/index.js"
     },
     "./proxy": {
-      "types": "./dist/proxy/index.d.ts",
       "src": "./src/proxy/index.ts",
+      "types": "./dist/proxy/index.d.ts",
       "default": "./dist/proxy/index.js"
     },
     "./server": {
-      "types": "./dist/server/index.d.ts",
       "src": "./src/server/index.ts",
+      "types": "./dist/server/index.d.ts",
       "default": "./dist/server/index.js"
     },
     "./stripe": {
-      "types": "./dist/stripe/index.d.ts",
       "src": "./src/stripe/index.ts",
+      "types": "./dist/stripe/index.d.ts",
       "default": "./dist/stripe/index.js"
     },
     "./stripe/client": {
-      "types": "./dist/stripe/client/index.d.ts",
       "src": "./src/stripe/client/index.ts",
+      "types": "./dist/stripe/client/index.d.ts",
       "default": "./dist/stripe/client/index.js"
     },
     "./stripe/server": {
-      "types": "./dist/stripe/server/index.d.ts",
       "src": "./src/stripe/server/index.ts",
+      "types": "./dist/stripe/server/index.d.ts",
       "default": "./dist/stripe/server/index.js"
     },
+    "./x402": {
+      "src": "./src/x402/index.ts",
+      "types": "./dist/x402/index.d.ts",
+      "default": "./dist/x402/index.js"
+    },
     "./tempo": {
-      "types": "./dist/tempo/index.d.ts",
       "src": "./src/tempo/index.ts",
+      "types": "./dist/tempo/index.d.ts",
       "default": "./dist/tempo/index.js"
     },
     "./html": {
-      "types": "./dist/Html.d.ts",
       "src": "./src/Html.ts",
+      "types": "./dist/Html.d.ts",
       "default": "./dist/Html.js"
     },
     "./hono": {
-      "types": "./dist/middlewares/hono.d.ts",
       "src": "./src/middlewares/hono.ts",
+      "types": "./dist/middlewares/hono.d.ts",
       "default": "./dist/middlewares/hono.js"
     },
     "./express": {
-      "types": "./dist/middlewares/express.d.ts",
       "src": "./src/middlewares/express.ts",
+      "types": "./dist/middlewares/express.d.ts",
       "default": "./dist/middlewares/express.js"
     },
     "./nextjs": {
-      "types": "./dist/middlewares/nextjs.d.ts",
       "src": "./src/middlewares/nextjs.ts",
+      "types": "./dist/middlewares/nextjs.d.ts",
       "default": "./dist/middlewares/nextjs.js"
     },
     "./elysia": {
-      "types": "./dist/middlewares/elysia.d.ts",
       "src": "./src/middlewares/elysia.ts",
+      "types": "./dist/middlewares/elysia.d.ts",
       "default": "./dist/middlewares/elysia.js"
     }
   },
@@ -106,7 +126,7 @@
     "elysia": ">=1",
     "express": ">=5",
     "hono": ">=4.12.18",
-    "viem": ">=2.50.4"
+    "viem": ">=2.51.0"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {
@@ -124,7 +144,7 @@
   },
   "dependencies": {
     "incur": "^0.4.5",
-    "ox": "0.14.22",
+    "ox": "0.14.24",
     "zod": "^4.4.3"
   },
   "repository": {

package/src/Challenge.test.ts

@@ -453,6 +453,34 @@ describe('serialize', () => {
     expect(header).toContain('digest="sha-256=abc"')
     expect(header).toContain('expires="2025-01-06T12:00:00Z"')
   })
+
+  test('behavior: escapes quoted-string values', () => {
+    const challenge = Challenge.from({
+      id: 'abc123',
+      realm: 'api.example.com',
+      method: 'tempo',
+      intent: 'charge',
+      request: { amount: '1000000' },
+      description: 'Pay "premium" path C:\\tempo\\api',
+    })
+
+    const header = Challenge.serialize(challenge)
+    expect(header).toContain('description="Pay \\"premium\\" path C:\\\\tempo\\\\api"')
+    expect(Challenge.deserialize(header).description).toBe('Pay "premium" path C:\\tempo\\api')
+  })
+
+  test('error: rejects CRLF in quoted-string values', () => {
+    const challenge = Challenge.from({
+      id: 'abc123',
+      realm: 'api.example.com',
+      method: 'tempo',
+      intent: 'charge',
+      request: { amount: '1000000' },
+      description: 'Line one\r\nLine two',
+    })
+
+    expect(() => Challenge.serialize(challenge)).toThrow('Invalid quoted-string value.')
+  })
 })
 
 describe('deserialize', () => {

package/src/Challenge.ts

@@ -294,23 +294,30 @@ export declare namespace fromMethod {
  */
 export function serialize(challenge: Challenge): string {
   const parts = [
-    `id="${challenge.id}"`,
-    `realm="${challenge.realm}"`,
-    `method="${challenge.method}"`,
-    `intent="${challenge.intent}"`,
-    `request="${PaymentRequest.serialize(challenge.request)}"`,
+    authParam('id', challenge.id),
+    authParam('realm', challenge.realm),
+    authParam('method', challenge.method),
+    authParam('intent', challenge.intent),
+    authParam('request', PaymentRequest.serialize(challenge.request)),
   ]
 
-  if (challenge.description !== undefined) parts.push(`description="${challenge.description}"`)
-  if (challenge.digest !== undefined) parts.push(`digest="${challenge.digest}"`)
-  if (challenge.expires !== undefined) parts.push(`expires="${challenge.expires}"`)
-  if (challenge.opaque !== undefined) parts.push(`opaque="${challenge.opaque}"`)
+  if (challenge.description !== undefined)
+    parts.push(authParam('description', challenge.description))
+  if (challenge.digest !== undefined) parts.push(authParam('digest', challenge.digest))
+  if (challenge.expires !== undefined) parts.push(authParam('expires', challenge.expires))
+  if (challenge.opaque !== undefined) parts.push(authParam('opaque', challenge.opaque))
   else if (challenge.meta !== undefined)
-    parts.push(`opaque="${PaymentRequest.serialize(challenge.meta)}"`)
+    parts.push(authParam('opaque', PaymentRequest.serialize(challenge.meta)))
 
   return `Payment ${parts.join(', ')}`
 }
 
+/** @internal */
+function authParam(name: string, value: string): string {
+  if (/[\r\n]/.test(value)) throw new Error('Invalid quoted-string value.')
+  return `${name}="${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`
+}
+
 /**
  * Deserializes a WWW-Authenticate header value to a challenge.
  *

package/src/Method.ts

@@ -334,7 +334,7 @@ export declare namespace toServer {
     request?: RequestFn<method> | undefined
     respond?: RespondFn<method> | undefined
     stableBinding?: StableBindingFn<method> | undefined
-    transport?: transportOverride | undefined
+    transport?: transportOverride | Transport.AnyTransport | undefined
     verify: VerifyFn<method>
   }
 }

package/src/Store.test-d.ts

@@ -25,6 +25,64 @@ test('memory returns AtomicStore', () => {
   expectTypeOf(store).toEqualTypeOf<Store.AtomicStore>()
 })
 
+test('from with keyPrefix preserves AtomicStore', () => {
+  const store = Store.from(Store.memory(), { keyPrefix: 'tenant:' })
+  expectTypeOf(store).toEqualTypeOf<Store.AtomicStore>()
+})
+
+test('from with keyPrefix preserves typed Store', () => {
+  type ItemMap = { [key: `mppx:charge:${string}`]: number }
+  const store = {} as Store.Store<ItemMap>
+  const prefixed = Store.from(store, { keyPrefix: 'tenant:' })
+
+  expectTypeOf(prefixed.get).parameter(0).toEqualTypeOf<`mppx:charge:${string}`>()
+  expectTypeOf(prefixed.put).parameter(1).toEqualTypeOf<number>()
+})
+
+test('from with keyPrefix preserves typed AtomicStore', () => {
+  type ItemMap = { [key: `mppx:charge:${string}`]: number }
+  const store = {} as Store.AtomicStore<ItemMap>
+  const prefixed = Store.from(store, { keyPrefix: 'tenant:' })
+
+  expectTypeOf(prefixed.update).parameter(0).toEqualTypeOf<`mppx:charge:${string}`>()
+})
+
+test('memory accepts keyPrefix option', () => {
+  const store = Store.memory({ keyPrefix: 'tenant:' })
+  expectTypeOf(store).toEqualTypeOf<Store.AtomicStore>()
+})
+
+test('adapter constructors accept keyPrefix option', () => {
+  const cloudflare = Store.cloudflare(
+    {
+      get: async () => null,
+      put: async () => {},
+      delete: async () => {},
+    },
+    { keyPrefix: 'tenant:' },
+  )
+  const redis = Store.redis(
+    {
+      get: async () => null,
+      set: async () => null,
+      del: async () => null,
+    },
+    { keyPrefix: 'tenant:' },
+  )
+  const upstash = Store.upstash(
+    {
+      get: async () => null,
+      set: async () => null,
+      del: async () => null,
+    },
+    { keyPrefix: 'tenant:' },
+  )
+
+  expectTypeOf(cloudflare).toEqualTypeOf<Store.Store>()
+  expectTypeOf(redis).toEqualTypeOf<Store.Store>()
+  expectTypeOf(upstash).toEqualTypeOf<Store.Store>()
+})
+
 test('AtomicStore is assignable to Store', () => {
   const atomic = {} as Store.AtomicStore
   expectTypeOf(atomic).toMatchTypeOf<Store.Store>()

package/src/Store.test.ts

@@ -112,6 +112,83 @@ describe.each([
   })
 })
 
+describe('keyPrefix', () => {
+  test('scopes get, put, and delete to prefixed backing keys', async () => {
+    const backing = Store.memory()
+    const store = Store.from(backing, { keyPrefix: 'tenant:' })
+
+    await store.put('k', nested)
+    expect(await backing.get('tenant:k')).toEqual(nested)
+    expect(await backing.get('k')).toBeNull()
+    expect(await store.get('k')).toEqual(nested)
+
+    await store.delete('k')
+    expect(await backing.get('tenant:k')).toBeNull()
+  })
+
+  test('scopes atomic update to prefixed backing keys', async () => {
+    const backing = Store.memory()
+    const store = Store.from(backing, { keyPrefix: 'tenant:' })
+
+    const result = await store.update('k', (current) => {
+      expect(current).toBeNull()
+      return { op: 'set', value: { count: 1 }, result: 'created' as const }
+    })
+
+    expect(result).toBe('created')
+    expect(await backing.get('tenant:k')).toEqual({ count: 1 })
+    expect(await backing.get('k')).toBeNull()
+  })
+
+  test('returns the original store when keyPrefix is empty', () => {
+    const backing = Store.memory()
+    expect(Store.from(backing, { keyPrefix: '' })).toBe(backing)
+  })
+
+  test('reuses wrappers for the same backing store and prefix', () => {
+    const backing = Store.memory()
+    expect(Store.from(backing, { keyPrefix: 'tenant:' })).toBe(
+      Store.from(backing, { keyPrefix: 'tenant:' }),
+    )
+    expect(Store.from(backing, { keyPrefix: 'other:' })).not.toBe(
+      Store.from(backing, { keyPrefix: 'tenant:' }),
+    )
+  })
+
+  test('constructs memory stores with a keyPrefix', async () => {
+    const store = Store.memory({ keyPrefix: 'tenant:' })
+    await store.put('k', 'value')
+    expect(await store.get('k')).toBe('value')
+  })
+
+  test('constructs adapter stores with a keyPrefix', async () => {
+    const cloudflareKv = fakeStringKv()
+    const cloudflare = Store.cloudflare(cloudflareKv, { keyPrefix: 'tenant:' })
+    await cloudflare.put('k', 'value')
+    expect(await cloudflareKv.get('tenant:k')).not.toBeNull()
+    expect(await cloudflareKv.get('k')).toBeNull()
+
+    const redisKv = fakeStringKv()
+    const redis = Store.redis(
+      {
+        get: redisKv.get,
+        set: redisKv.put,
+        del: redisKv.delete,
+      },
+      { keyPrefix: 'tenant:' },
+    )
+    await redis.put('k', 'value')
+    expect(await redisKv.get('tenant:k')).not.toBeNull()
+    expect(await redisKv.get('k')).toBeNull()
+
+    const upstashKv = fakeUnknownKv()
+    const upstash = Store.upstash(upstashKv, { keyPrefix: 'tenant:' })
+    await upstash.put('k', 'value')
+    expect(await upstashKv.get('tenant:k')).toBe('value')
+    expect(await upstashKv.get('k')).toBeNull()
+  })
+})
+
 describe('json roundtrip behavior', () => {
   test('cloudflare json-roundtrips nested objects', async () => {
     const store = Store.cloudflare(fakeStringKv())

package/src/Store.ts

@@ -84,11 +84,55 @@ export type AtomicStore<itemMap extends StoreItemMap = StoreItemMap> = Store<
   AtomicActions<itemMap>
 >
 
+/** Options shared by store constructors. */
+export type Options = {
+  /** Prefix prepended to every backing store key. */
+  keyPrefix?: string | undefined
+}
+
+const keyPrefixCache = new WeakMap<Store, Map<string, Store | AtomicStore>>()
+
 /** Creates a {@link Store} from an existing implementation. */
-export function from<store extends Store>(store: store): store
-export function from<store extends AtomicStore>(store: store): store
-export function from(store: Store | AtomicStore) {
-  return store
+export function from<store extends AtomicStore<any>>(store: store, options?: Options): store
+export function from<store extends Store<any>>(store: store, options?: Options): store
+export function from(store: Store | AtomicStore, options?: Options) {
+  return withKeyPrefix(store, options?.keyPrefix)
+}
+
+function withKeyPrefix(store: Store | AtomicStore, keyPrefix = ''): Store | AtomicStore {
+  if (!keyPrefix) return store
+
+  const cached = keyPrefixCache.get(store)?.get(keyPrefix)
+  if (cached) return cached
+
+  const backing = store as Store
+  const prefixedKey = (key: string) => `${keyPrefix}${key}`
+  const prefixed = from({
+    async get(key: string) {
+      return backing.get(prefixedKey(key)) as Promise<unknown>
+    },
+    async put(key: string, value: unknown) {
+      await backing.put(prefixedKey(key), value)
+    },
+    async delete(key: string) {
+      await backing.delete(prefixedKey(key))
+    },
+    ...('update' in store
+      ? {
+          async update<result>(
+            key: string,
+            fn: (current: unknown | null) => Change<unknown, result>,
+          ) {
+            return (store as AtomicStore).update(prefixedKey(key), fn as never)
+          },
+        }
+      : {}),
+  } satisfies Store | AtomicStore)
+
+  const cachedByPrefix = keyPrefixCache.get(store) ?? new Map<string, Store | AtomicStore>()
+  cachedByPrefix.set(keyPrefix, prefixed)
+  keyPrefixCache.set(store, cachedByPrefix)
+  return prefixed
 }
 
 function wrapJsonUpdate(
@@ -113,26 +157,37 @@ function wrapJsonUpdate(
 }
 
 /** Wraps a Cloudflare KV namespace. */
-export function cloudflare(kv: cloudflare.AtomicParameters): AtomicStore
-export function cloudflare(kv: cloudflare.Parameters): Store
-export function cloudflare(kv: cloudflare.Parameters): Store {
-  return from({
-    async get(key) {
-      const raw = await kv.get(key)
-      if (raw == null) return null as any
-      return Json.parse(raw as string)
+export function cloudflare(
+  kv: cloudflare.AtomicParameters,
+  options?: cloudflare.Options,
+): AtomicStore
+export function cloudflare(kv: cloudflare.Parameters, options?: cloudflare.Options): Store
+export function cloudflare(kv: cloudflare.Parameters, options?: cloudflare.Options): Store {
+  return from(
+    {
+      async get(key: string) {
+        const raw = await kv.get(key)
+        if (raw == null) return null as any
+        return Json.parse(raw as string)
+      },
+      async put(key: string, value: unknown) {
+        await kv.put(key, Json.stringify(value))
+      },
+      async delete(key: string) {
+        await kv.delete(key)
+      },
+      ...wrapJsonUpdate(kv.update),
     },
-    async put(key, value) {
-      await kv.put(key, Json.stringify(value))
-    },
-    async delete(key) {
-      await kv.delete(key)
-    },
-    ...wrapJsonUpdate(kv.update),
-  })
+    options,
+  )
 }
 
 export declare namespace cloudflare {
+  export type Options = {
+    /** Prefix prepended to every backing store key. */
+    keyPrefix?: string | undefined
+  }
+
   export type Parameters = {
     get: (key: string) => Promise<unknown>
     put: (key: string, value: string) => Promise<void>
@@ -149,51 +204,69 @@ export declare namespace cloudflare {
 }
 
 /** In-memory store backed by a `Map`. JSON-roundtrips values to match production behavior. */
-export function memory(): AtomicStore {
+export function memory(options?: memory.Options): AtomicStore {
   const store = new Map<string, string>()
-  return from({
-    async get(key) {
-      const raw = store.get(key)
-      if (raw === undefined) return null as any
-      return Json.parse(raw)
+  return from(
+    {
+      async get(key: string) {
+        const raw = store.get(key)
+        if (raw === undefined) return null as any
+        return Json.parse(raw)
+      },
+      async put(key: string, value: unknown) {
+        store.set(key, Json.stringify(value))
+      },
+      async delete(key: string) {
+        store.delete(key)
+      },
+      async update<result>(key: string, fn: (current: unknown | null) => Change<unknown, result>) {
+        const current = store.has(key) ? (Json.parse(store.get(key)!) as never) : null
+        const change = fn(current)
+        if (change.op === 'set') store.set(key, Json.stringify(change.value))
+        if (change.op === 'delete') store.delete(key)
+        return change.result
+      },
     },
-    async put(key, value) {
-      store.set(key, Json.stringify(value))
-    },
-    async delete(key) {
-      store.delete(key)
-    },
-    async update(key, fn) {
-      const current = store.has(key) ? (Json.parse(store.get(key)!) as never) : null
-      const change = fn(current)
-      if (change.op === 'set') store.set(key, Json.stringify(change.value))
-      if (change.op === 'delete') store.delete(key)
-      return change.result
-    },
-  })
+    options,
+  )
+}
+
+export declare namespace memory {
+  export type Options = {
+    /** Prefix prepended to every backing store key. */
+    keyPrefix?: string | undefined
+  }
 }
 
 /** Wraps a standard Redis client (ioredis, node-redis, Valkey). */
-export function redis(client: redis.AtomicParameters): AtomicStore
-export function redis(client: redis.Parameters): Store
-export function redis(client: redis.Parameters): Store {
-  return from({
-    async get(key) {
-      const raw = await client.get(key)
-      if (raw == null) return null as any
-      return Json.parse(raw)
-    },
-    async put(key, value) {
-      await client.set(key, Json.stringify(value))
-    },
-    async delete(key) {
-      await client.del(key)
+export function redis(client: redis.AtomicParameters, options?: redis.Options): AtomicStore
+export function redis(client: redis.Parameters, options?: redis.Options): Store
+export function redis(client: redis.Parameters, options?: redis.Options): Store {
+  return from(
+    {
+      async get(key: string) {
+        const raw = await client.get(key)
+        if (raw == null) return null as any
+        return Json.parse(raw)
+      },
+      async put(key: string, value: unknown) {
+        await client.set(key, Json.stringify(value))
+      },
+      async delete(key: string) {
+        await client.del(key)
+      },
+      ...wrapJsonUpdate(client.update),
     },
-    ...wrapJsonUpdate(client.update),
-  })
+    options,
+  )
 }
 
 export declare namespace redis {
+  export type Options = {
+    /** Prefix prepended to every backing store key. */
+    keyPrefix?: string | undefined
+  }
+
   export type Parameters = {
     get: (key: string) => Promise<string | null>
     set: (key: string, value: string) => Promise<unknown>
@@ -210,28 +283,36 @@ export declare namespace redis {
 }
 
 /** Wraps an Upstash Redis instance (e.g. Vercel KV). */
-export function upstash(redis: upstash.AtomicParameters): AtomicStore
-export function upstash(redis: upstash.Parameters): Store
-export function upstash(redis: upstash.Parameters): Store {
-  return from({
-    async get(key) {
-      return (await redis.get(key)) as any
-    },
-    async put(key, value) {
-      await redis.set(key, value)
+export function upstash(redis: upstash.AtomicParameters, options?: upstash.Options): AtomicStore
+export function upstash(redis: upstash.Parameters, options?: upstash.Options): Store
+export function upstash(redis: upstash.Parameters, options?: upstash.Options): Store {
+  return from(
+    {
+      async get(key: string) {
+        return (await redis.get(key)) as any
+      },
+      async put(key: string, value: unknown) {
+        await redis.set(key, value)
+      },
+      async delete(key: string) {
+        await redis.del(key)
+      },
+      ...(redis.update
+        ? {
+            update: redis.update as Update,
+          }
+        : {}),
     },
-    async delete(key) {
-      await redis.del(key)
-    },
-    ...(redis.update
-      ? {
-          update: redis.update as Update,
-        }
-      : {}),
-  })
+    options,
+  )
 }
 
 export declare namespace upstash {
+  export type Options = {
+    /** Prefix prepended to every backing store key. */
+    keyPrefix?: string | undefined
+  }
+
   export type Parameters = {
     get: (key: string) => Promise<unknown>
     set: (key: string, value: unknown) => Promise<unknown>

package/src/client/Methods.ts

@@ -1,3 +1,4 @@
+export { evm } from '../evm/client/index.js'
 export { stripe } from '../stripe/client/index.js'
 export { subscription } from '../tempo/client/Subscription.js'
 export { tempo } from '../tempo/client/index.js'