mppx 0.6.3 → 0.6.6

package/dist/tempo/server/internal/html.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,qykcAAqykc,CAAA"}
+{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,6wtcAA6wtc,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.6.3",
+  "version": "0.6.6",
   "main": "./dist/index.js",
   "license": "MIT",
   "files": [
@@ -124,7 +124,7 @@
   },
   "dependencies": {
     "incur": "^0.3.25",
-    "ox": "0.14.15",
+    "ox": "0.14.18",
     "zod": "^4.3.6"
   },
   "repository": {

package/src/Challenge.test.ts

@@ -109,6 +109,29 @@ describe('from', () => {
       },
       expectedId: 'm39jbWWCIfmfJZSwCfvKFFtBl0Qwf9X4nOmDb21peLA',
     },
+    {
+      label: 'with opaque',
+      params: {
+        realm: 'api.example.com',
+        method: 'tempo',
+        intent: 'charge',
+        request: { amount: '1000000' },
+        meta: { pi: 'pi_3abc123XYZ' },
+      },
+      expectedId: 'rxzKZ2qjXvinqCH96RORTZEPs1KXsA-0AUjrCAPFOWc',
+    },
+    {
+      label: 'with opaque and expires',
+      params: {
+        realm: 'api.example.com',
+        method: 'tempo',
+        intent: 'charge',
+        request: { amount: '1000000' },
+        expires: '2025-01-06T12:00:00Z',
+        meta: { pi: 'pi_3abc123XYZ' },
+      },
+      expectedId: 'KAfoMrA4fnzS1DPWN_cUv_b3_yHxCizdp6OhH7gluMY',
+    },
     {
       label: 'with description (not in HMAC input)',
       params: {
@@ -150,6 +173,17 @@ describe('from', () => {
       },
       expectedId: 'yLN7yChAejW9WNmb54HpJIWpdb1WWXeA3_aCx4dxmkU',
     },
+    {
+      label: 'with empty opaque',
+      params: {
+        realm: 'api.example.com',
+        method: 'tempo',
+        intent: 'charge',
+        request: { amount: '1000000' },
+        meta: {},
+      },
+      expectedId: 'vb4IyH-0LdJ3s7L0QAw8jIzcZkyxksPhIvEfmHmzA9k',
+    },
     {
       label: 'different realm',
       params: {
@@ -180,6 +214,17 @@ describe('from', () => {
       },
       expectedId: 'aAY7_IEDzsznNYplhOSE8cERQxvjFcT4Lcn-7FHjLVE',
     },
+    {
+      label: 'with multi-key opaque',
+      params: {
+        realm: 'api.example.com',
+        method: 'tempo',
+        intent: 'charge',
+        request: { amount: '1000000' },
+        meta: { deposit: 'dep_456', pi: 'pi_3abc123XYZ' },
+      },
+      expectedId: 'aKskU8sadR5ZuFbUCsIwhO-ENxuVpTw17FdwHEXsJDk',
+    },
   ] as const
 
   test.each(hmacVectors)('hmac: $label', ({ params, expectedId }) => {

package/src/Credential.test.ts

@@ -1,4 +1,5 @@
 import { Challenge, Credential } from 'mppx'
+import { Base64 } from 'ox'
 import { describe, expect, test } from 'vp/test'
 
 const challenge = Challenge.from({
@@ -88,6 +89,28 @@ describe('serialize', () => {
     const deserialized = Credential.deserialize(header)
     expect(deserialized.challenge.request).toEqual({ amount: '1000' })
   })
+
+  test('behavior: serializes opaque as a base64url string', () => {
+    const credential = Credential.from({
+      challenge: Challenge.from({
+        id: 'opaque123',
+        intent: 'charge',
+        meta: { pi: 'pi_3abc123XYZ' },
+        method: 'tempo',
+        realm: 'api.example.com',
+        request: { amount: '1000' },
+      }),
+      payload: { signature: '0x1234' },
+    })
+
+    const header = Credential.serialize(credential)
+    const encoded = header.replace(/^Payment\s+/i, '')
+    const parsed = JSON.parse(Base64.toString(encoded)) as {
+      challenge: { opaque?: unknown }
+    }
+
+    expect(parsed.challenge.opaque).toBe('eyJwaSI6InBpXzNhYmMxMjNYWVoifQ')
+  })
 })
 
 describe('deserialize', () => {
@@ -134,6 +157,49 @@ describe('deserialize', () => {
     expect(deserialized.source).toBe(original.source)
   })
 
+  test('behavior: deserializes spec-compliant opaque string credentials', () => {
+    const encoded = Base64.fromString(
+      JSON.stringify({
+        challenge: {
+          id: 'opaque123',
+          intent: 'charge',
+          method: 'tempo',
+          opaque: 'eyJwaSI6InBpXzNhYmMxMjNYWVoifQ',
+          realm: 'api.example.com',
+          request: 'eyJhbW91bnQiOiIxMDAwIn0',
+        },
+        payload: { signature: '0x1234' },
+      }),
+      { pad: false, url: true },
+    )
+
+    const credential = Credential.deserialize(`Payment ${encoded}`)
+
+    expect(credential.challenge.opaque).toEqual({ pi: 'pi_3abc123XYZ' })
+    expect(credential.challenge.request).toEqual({ amount: '1000' })
+  })
+
+  test('behavior: preserves legacy object-shaped opaque credentials', () => {
+    const encoded = Base64.fromString(
+      JSON.stringify({
+        challenge: {
+          id: 'opaque123',
+          intent: 'charge',
+          method: 'tempo',
+          opaque: { pi: 'pi_3abc123XYZ' },
+          realm: 'api.example.com',
+          request: 'eyJhbW91bnQiOiIxMDAwIn0',
+        },
+        payload: { signature: '0x1234' },
+      }),
+      { pad: false, url: true },
+    )
+
+    const credential = Credential.deserialize(`Payment ${encoded}`)
+
+    expect(credential.challenge.opaque).toEqual({ pi: 'pi_3abc123XYZ' })
+  })
+
   test('error: throws for missing Payment scheme', () => {
     expect(() => Credential.deserialize('Bearer abc123')).toThrow('Missing Payment scheme.')
   })

package/src/Credential.ts

@@ -44,6 +44,8 @@ export class InvalidCredentialEncodingError extends Error {
 
 /**
  * Deserializes an Authorization header value to a credential.
+ * Accepts the spec-compliant base64url `opaque` string shape and the legacy
+ * object-shaped `opaque` form emitted by older mppx versions.
  *
  * @param header - The Authorization header value.
  * @returns The deserialized credential.
@@ -61,12 +63,26 @@ export function deserialize<payload = unknown>(value: string): Credential<payloa
   try {
     const json = Base64.toString(prefixMatch[1])
     const parsed = JSON.parse(json) as {
-      challenge: Omit<Challenge.Challenge, 'request'> & { request: string }
+      challenge: Omit<Challenge.Challenge, 'opaque' | 'request'> & {
+        opaque?: Record<string, string> | string
+        request: string
+      }
       payload: payload
       source?: string
     }
     const challenge = Challenge.Schema.parse({
       ...parsed.challenge,
+      ...(parsed.challenge.opaque !== undefined && {
+        // TODO: Drop the legacy object-shaped `opaque` fallback after old mppx
+        // clients are no longer in circulation. Older mppx versions echoed
+        // `opaque` as an expanded JSON object in credentials, but the Payment
+        // auth spec requires clients to return the original base64url string
+        // unchanged in the credential challenge object.
+        opaque:
+          typeof parsed.challenge.opaque === 'string'
+            ? (PaymentRequest.deserialize(parsed.challenge.opaque) as Record<string, string>)
+            : parsed.challenge.opaque,
+      }),
       request: PaymentRequest.deserialize(parsed.challenge.request),
     })
     return {
@@ -140,6 +156,8 @@ export function fromRequest<payload = unknown>(request: Request): Credential<pay
 
 /**
  * Serializes a credential to the Authorization header format.
+ * When present, `challenge.opaque` is encoded as the base64url string required
+ * by the Payment auth credential format.
  *
  * @param credential - The credential to serialize.
  * @returns A string suitable for the Authorization header value.
@@ -153,10 +171,12 @@ export function fromRequest<payload = unknown>(request: Request): Credential<pay
  * ```
  */
 export function serialize(credential: Credential): string {
+  const { opaque, request, ...challenge } = credential.challenge
   const wire = {
     challenge: {
-      ...credential.challenge,
-      request: PaymentRequest.serialize(credential.challenge.request),
+      ...challenge,
+      ...(opaque !== undefined && { opaque: PaymentRequest.serialize(opaque) }),
+      request: PaymentRequest.serialize(request),
     },
     payload: credential.payload,
     ...(credential.source && { source: credential.source }),

package/src/bin.ts

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
 import cli from './cli/cli.js'
 
-cli.serve().then(() => process.exit(0))
+await cli.serve()