mppx 0.6.30 → 0.7.0

package/src/middlewares/elysia.test.ts

@@ -2,14 +2,18 @@ import * as http from 'node:http'
 
 import { Elysia } from 'elysia'
 import { Receipt } from 'mppx'
-import { Mppx as Mppx_client, session as sessionIntent, tempo as tempo_client } from 'mppx/client'
+import {
+  Mppx as Mppx_client,
+  sessionLegacy as sessionIntent,
+  tempo as tempo_client,
+} from 'mppx/client'
 import { Mppx, discovery, payment } from 'mppx/elysia'
 import { tempo as tempo_server } from 'mppx/server'
 import type { Address } from 'viem'
 import { Addresses } from 'viem/tempo'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as TestHttp from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client, fundAccount } from '~test/tempo/viem.js'
 
 function createServer(app: Elysia<any, any, any, any, any, any, any>) {
@@ -202,7 +206,7 @@ describe('session', () => {
   function createSessionHarness(feePayer: boolean) {
     const mppx = Mppx.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           getClient: () => client,
           account: accounts[0],
           currency: asset,
@@ -218,7 +222,7 @@ describe('session', () => {
       methods: [
         sessionIntent({
           account: accounts[2],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],

package/src/middlewares/express.test.ts

@@ -1,13 +1,17 @@
 import express from 'express'
 import { Receipt } from 'mppx'
-import { Mppx as Mppx_client, session as sessionIntent, tempo as tempo_client } from 'mppx/client'
+import {
+  Mppx as Mppx_client,
+  sessionLegacy as sessionIntent,
+  tempo as tempo_client,
+} from 'mppx/client'
 import { Mppx, discovery, payment } from 'mppx/express'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
 import type { Address } from 'viem'
 import { Addresses } from 'viem/tempo'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client, fundAccount } from '~test/tempo/viem.js'
 
 function createServer(app: express.Express) {
@@ -196,7 +200,7 @@ describe('session', () => {
   function createSessionHarness(feePayer: boolean) {
     const mppx = Mppx.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           getClient: () => client,
           account: accounts[0],
           currency: asset,
@@ -212,7 +216,7 @@ describe('session', () => {
       methods: [
         sessionIntent({
           account: accounts[2],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],

package/src/middlewares/hono.test.ts

@@ -4,7 +4,7 @@ import { Challenge, Credential, Method, Receipt, z } from 'mppx'
 import {
   evm as evm_client,
   Mppx as Mppx_client,
-  session as sessionIntent,
+  sessionLegacy as sessionIntent,
   tempo as tempo_client,
 } from 'mppx/client'
 import { Mppx, discovery, payment } from 'mppx/hono'
@@ -19,7 +19,7 @@ import type { Address } from 'viem'
 import { Addresses } from 'viem/tempo'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client, fundAccount } from '~test/tempo/viem.js'
 
 function createServer(app: Hono) {
@@ -391,7 +391,7 @@ describe('session', () => {
   function createSessionHarness(feePayer: boolean) {
     const mppx = Mppx.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           getClient: () => client,
           account: accounts[0],
           currency: asset,
@@ -407,7 +407,7 @@ describe('session', () => {
       methods: [
         sessionIntent({
           account: accounts[2],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],

package/src/middlewares/nextjs.test.ts

@@ -1,14 +1,18 @@
 import * as http from 'node:http'
 
 import { Challenge, Credential, Receipt } from 'mppx'
-import { Mppx as Mppx_client, session as sessionIntent, tempo as tempo_client } from 'mppx/client'
+import {
+  Mppx as Mppx_client,
+  sessionLegacy as sessionIntent,
+  tempo as tempo_client,
+} from 'mppx/client'
 import { Mppx, discovery, payment } from 'mppx/nextjs'
 import { tempo as tempo_server } from 'mppx/server'
 import type { Address } from 'viem'
 import { Addresses } from 'viem/tempo'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import * as TestHttp from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, chain, client, fundAccount } from '~test/tempo/viem.js'
 
 function createServer(handler: (request: Request) => Promise<Response> | Response) {
@@ -279,7 +283,7 @@ describe('session', () => {
   function createSessionHarness(feePayer: boolean) {
     const mppx = Mppx.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           getClient: () => client,
           account: accounts[0],
           currency: asset,
@@ -295,7 +299,7 @@ describe('session', () => {
       methods: [
         sessionIntent({
           account: accounts[2],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],

package/src/proxy/Proxy.test.ts

@@ -3,20 +3,20 @@ import { Mppx as Mppx_client, tempo as tempo_client } from 'mppx/client'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
 import type { Address } from 'viem'
 import { afterEach, beforeAll, describe, expect, test } from 'vp/test'
-import { nodeEnv } from '~test/config.js'
+import { tempoNetwork } from '~test/config.js'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client } from '~test/tempo/viem.js'
 
-import { sessionManager } from '../tempo/client/SessionManager.js'
-import { deserializeSessionReceipt } from '../tempo/session/Receipt.js'
+import { sessionManager } from '../tempo/legacy/client/index.js'
+import { deserializeSessionReceipt } from '../tempo/session/precompile/Protocol.js'
 import * as ApiProxy from './Proxy.js'
 import * as Service from './Service.js'
 import { anthropic } from './services/anthropic.js'
 import { openai } from './services/openai.js'
 
 const secretKey = 'test-secret-key'
-const isLocalnet = nodeEnv === 'localnet'
+const isLocalnet = tempoNetwork === 'localnet'
 
 const mppx_server = Mppx_server.create({
   methods: [
@@ -907,7 +907,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
 
     const sessionHandler = Mppx_server.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           account: accounts[0],
           currency: asset,
           escrowContract: sessionEscrow,
@@ -967,7 +967,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
 
     const sessionHandler = Mppx_server.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           account: accounts[0],
           currency: asset,
           escrowContract: sessionEscrow,
@@ -997,7 +997,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
     const sessionClient = Mppx_client.create({
       polyfill: false,
       methods: [
-        tempo_client({
+        tempo_client.sessionLegacy.method({
           account: accounts[1],
           getClient: () => client,
           maxDeposit: '2',

package/src/server/Mppx.test-d.ts

@@ -34,6 +34,22 @@ const mockChargeB = Method.from({
   },
 })
 
+const mockSession = Method.from({
+  name: 'tempo',
+  intent: 'session',
+  schema: {
+    credential: {
+      payload: z.object({ token: z.string() }),
+    },
+    request: z.object({
+      amount: z.string(),
+      currency: z.string(),
+      methodDetails: z.object({ sessionProtocol: z.string() }),
+      unitType: z.string(),
+    }),
+  },
+})
+
 const alphaMethod = Method.toServer(mockChargeA, {
   async verify() {
     return {
@@ -56,6 +72,29 @@ const betaMethod = Method.toServer(mockChargeB, {
   },
 })
 
+const tip1034SessionMethod = Method.toServer(mockSession, {
+  async verify() {
+    return {
+      method: 'tempo',
+      reference: 'tx',
+      status: 'success' as const,
+      timestamp: new Date().toISOString(),
+    }
+  },
+})
+
+const legacySessionMethod = Method.toServer(mockSession, {
+  alias: 'sessionLegacy',
+  async verify() {
+    return {
+      method: 'tempo',
+      reference: 'tx',
+      status: 'success' as const,
+      timestamp: new Date().toISOString(),
+    }
+  },
+})
+
 const secretKey = 'test-secret'
 const realm = 'api.example.com'
 
@@ -105,6 +144,21 @@ describe('Mppx type tests', () => {
     expectTypeOf(mppx.beta.charge).toBeFunction()
   })
 
+  test('aliased duplicate handlers are accessible by nested and slash keys', () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    expectTypeOf(mppx.tempo.session).toBeFunction()
+    expectTypeOf(mppx.tempo.sessionLegacy).toBeFunction()
+    expectTypeOf(mppx['tempo/session']).toBeFunction()
+    expectTypeOf(mppx['tempo/sessionLegacy']).toBeFunction()
+    expectTypeOf(mppx.challenge.tempo.session).toBeFunction()
+    expectTypeOf(mppx.challenge.tempo.sessionLegacy).toBeFunction()
+  })
+
   test('slash key handlers are accessible', () => {
     const mppx = Mppx.create({ methods: [alphaMethod, betaMethod], realm, secretKey })
 

package/src/server/Mppx.test.ts

@@ -3,7 +3,7 @@ import * as http from 'node:http'
 import { Challenge, Credential, Errors, Method, Receipt, z } from 'mppx'
 import {
   Mppx as Mppx_client,
-  session as tempo_session_client,
+  sessionLegacy as tempo_session_client,
   tempo as tempo_client,
 } from 'mppx/client'
 import { Types as evm_Types } from 'mppx/evm'
@@ -12,10 +12,10 @@ import { Header as x402_Header, Types as x402_Types, type PaymentPayload } from
 import { getTransactionReceipt } from 'viem/actions'
 import { describe, expect, test } from 'vp/test'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client } from '~test/tempo/viem.js'
 
-import type { SessionReceipt } from '../tempo/session/Types.js'
+import type { SessionReceipt } from '../tempo/session/precompile/Protocol.js'
 import * as x402_RouteBinding from '../x402/internal/RouteBinding.js'
 
 const realm = 'api.example.com'
@@ -1837,6 +1837,22 @@ describe('compose', () => {
     },
   })
 
+  const mockSession = Method.from({
+    name: 'tempo',
+    intent: 'session',
+    schema: {
+      credential: {
+        payload: z.object({ token: z.string() }),
+      },
+      request: z.object({
+        amount: z.string(),
+        currency: z.string(),
+        methodDetails: z.object({ sessionProtocol: z.optional(z.string()) }),
+        unitType: z.string(),
+      }),
+    },
+  })
+
   function mockReceipt(name: string) {
     return {
       method: name,
@@ -1858,6 +1874,19 @@ describe('compose', () => {
     },
   })
 
+  const tip1034SessionMethod = Method.toServer(mockSession, {
+    async verify() {
+      return mockReceipt('v2')
+    },
+  })
+
+  const legacySessionMethod = Method.toServer(mockSession, {
+    alias: 'sessionLegacy',
+    async verify() {
+      return mockReceipt('v1')
+    },
+  })
+
   const x402Method = evm.charge({
     currency: evm.assets.baseSepolia.USDC,
     recipient: accounts[0].address,
@@ -1889,6 +1918,19 @@ describe('compose', () => {
     recipient: '0x0000000000000000000000000000000000000002',
   }
 
+  const sessionChallengeOpts = {
+    amount: '100',
+    currency: asset,
+    expires: new Date(Date.now() + 60_000),
+    methodDetails: { sessionProtocol: 'v2' },
+    unitType: 'request',
+  }
+
+  const legacySessionChallengeOpts = {
+    ...sessionChallengeOpts,
+    methodDetails: { sessionProtocol: 'v1' },
+  }
+
   test('returns 402 with multiple WWW-Authenticate headers when no credential', async () => {
     const mppx = Mppx.create({ methods: [alphaMethod, betaMethod], realm, secretKey })
 
@@ -1905,6 +1947,157 @@ describe('compose', () => {
     expect(wwwAuth).toContain('method="beta"')
   })
 
+  test('broadcasts duplicate tempo/session variants in compose order', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose(
+      [mppx.tempo.session, sessionChallengeOpts],
+      [mppx.tempo.sessionLegacy, legacySessionChallengeOpts],
+    )(new Request('https://example.com/resource'))
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+
+    const challenges = Challenge.fromResponseList(result.challenge)
+    expect(challenges.map((challenge) => challenge.request.methodDetails)).toEqual([
+      { sessionProtocol: 'v2' },
+      { sessionProtocol: 'v1' },
+    ])
+  })
+
+  test('keeps duplicate tempo/session variants when Accept-Payment allows tempo/session', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose(
+      [mppx.tempo.session, sessionChallengeOpts],
+      [mppx.tempo.sessionLegacy, legacySessionChallengeOpts],
+    )(
+      new Request('https://example.com/resource', {
+        headers: { 'Accept-Payment': 'tempo/session' },
+      }),
+    )
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+
+    expect(Challenge.fromResponseList(result.challenge)).toHaveLength(2)
+  })
+
+  test('uses TIP-1034 as the bare tempo/session handler regardless of registration order', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose([mppx.tempo.session, sessionChallengeOpts])(
+      new Request('https://example.com/resource'),
+    )
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+    expect(Challenge.fromResponse(result.challenge).request.methodDetails).toEqual({
+      sessionProtocol: 'v2',
+    })
+  })
+
+  test('rejects cross-protocol tempo/session credential replay', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+    const tip1034ChallengeResponse = await mppx.compose([mppx.tempo.session, sessionChallengeOpts])(
+      new Request('https://example.com/resource'),
+    )
+    expect(tip1034ChallengeResponse.status).toBe(402)
+    if (tip1034ChallengeResponse.status !== 402) throw new Error()
+    const tip1034Challenge = Challenge.fromResponse(tip1034ChallengeResponse.challenge)
+
+    const credential = Credential.serialize({
+      challenge: tip1034Challenge,
+      payload: { token: 'valid' },
+    })
+    const legacyResult = await mppx.compose([mppx.tempo.sessionLegacy, legacySessionChallengeOpts])(
+      new Request('https://example.com/resource', {
+        headers: { Authorization: credential },
+      }),
+    )
+
+    expect(legacyResult.status).toBe(402)
+  })
+
+  test('verifyCredential dispatches duplicate tempo/session variants by sessionProtocol', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+    const tip1034Challenge = await mppx.challenge.tempo.session(sessionChallengeOpts)
+    const legacyChallenge = await mppx.challenge.tempo.sessionLegacy(legacySessionChallengeOpts)
+
+    const tip1034Receipt = await mppx.verifyCredential(
+      Credential.serialize({
+        challenge: tip1034Challenge,
+        payload: { token: 'valid' },
+      }),
+    )
+    const legacyReceipt = await mppx.verifyCredential(
+      Credential.serialize({
+        challenge: legacyChallenge,
+        payload: { token: 'valid' },
+      }),
+    )
+
+    expect(tip1034Receipt.reference).toBe('tx-v2')
+    expect(legacyReceipt.reference).toBe('tx-v1')
+  })
+
+  test('verifyCredential routes unmarked tempo/session challenges to legacy v1', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+    const unmarkedLegacyChallenge = await mppx.challenge.tempo.sessionLegacy({
+      ...legacySessionChallengeOpts,
+      methodDetails: {},
+    })
+
+    await expect(
+      mppx.verifyCredential(
+        Credential.serialize({
+          challenge: unmarkedLegacyChallenge,
+          payload: { token: 'valid' },
+        }),
+      ),
+    ).resolves.toMatchObject({ reference: 'tx-v1' })
+  })
+
+  test('verifyCredential rejects unknown tempo/session protocol markers', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+    const challenge = await mppx.challenge.tempo.session({
+      ...sessionChallengeOpts,
+      methodDetails: { sessionProtocol: 'future' },
+    })
+
+    await expect(
+      mppx.verifyCredential(Credential.serialize({ challenge, payload: { token: 'valid' } })),
+    ).rejects.toThrow('no registered method for tempo/session')
+  })
+
   test('returns composed x402 challenge headers when no credential', async () => {
     const mppx = Mppx.create({ methods: [x402Method], realm, secretKey })
 
@@ -3983,6 +4176,80 @@ describe('realm auto-detection', () => {
     }
   })
 
+  // A raw request line can carry a protocol-relative or embedded-authority
+  // target that WHATWG URL would resolve into a foreign host, which would then
+  // be auto-detected as the challenge realm. The realm must stay bound to the
+  // Host header.
+  test.each([
+    { name: 'protocol-relative', path: '//evil.com/resource' },
+    { name: 'embedded authority', path: '//first.example//evil.com/resource' },
+  ])('ignores $name request targets when deriving realm in node listeners', async ({ path }) => {
+    const handler = Mppx.create({ methods: [mockMethod], secretKey })
+    const server = await Http.createServer(async (req, res) => {
+      const result = await Mppx.toNodeListener(
+        handler.charge({
+          amount: '100',
+          currency: '0x0000000000000000000000000000000000000001',
+          recipient: '0x0000000000000000000000000000000000000002',
+        }),
+      )(req, res)
+
+      if (result.status !== 402) res.end('OK')
+    })
+
+    try {
+      const rawResponse = await new Promise<{
+        body: string
+        headers: http.IncomingHttpHeaders
+        statusCode: number
+      }>((resolve, reject) => {
+        const request = http.request(
+          {
+            host: '127.0.0.1',
+            port: server.port,
+            method: 'GET',
+            path,
+            headers: { Host: `localhost:${server.port}` },
+          },
+          (response) => {
+            const chunks: Buffer[] = []
+            response.on('data', (chunk) => chunks.push(Buffer.from(chunk)))
+            response.on('end', () => {
+              resolve({
+                body: Buffer.concat(chunks).toString('utf8'),
+                headers: response.headers,
+                statusCode: response.statusCode ?? 0,
+              })
+            })
+          },
+        )
+
+        request.on('error', reject)
+        request.end()
+      })
+
+      const headers = new Headers()
+      for (const [name, value] of Object.entries(rawResponse.headers)) {
+        if (Array.isArray(value)) {
+          for (const item of value) headers.append(name, item)
+        } else if (value !== undefined) {
+          headers.append(name, value)
+        }
+      }
+
+      const challenge = Challenge.fromResponse(
+        new Response(rawResponse.body, {
+          status: rawResponse.statusCode,
+          headers,
+        }),
+      )
+
+      expect(challenge.realm).toBe('localhost')
+    } finally {
+      server.close()
+    }
+  })
+
   test('credential verifies across different casing of same host', async () => {
     const handler = Mppx.create({ methods: [mockMethod], secretKey })
 
@@ -5104,7 +5371,7 @@ describe('verifyCredential', () => {
     const escrowContract = await deployEscrow()
     const server = Mppx.create({
       methods: [
-        tempo.session({
+        tempo.sessionLegacy({
           store: Store.memory(),
           getClient: () => client,
           account: accounts[0],
@@ -5121,7 +5388,7 @@ describe('verifyCredential', () => {
       methods: [
         tempo_session_client({
           account: accounts[1],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],
@@ -5167,7 +5434,7 @@ describe('verifyCredential', () => {
     const escrowContract = await deployEscrow()
     const server = Mppx.create({
       methods: [
-        tempo.session({
+        tempo.sessionLegacy({
           store: Store.memory(),
           getClient: () => client,
           account: accounts[0],
@@ -5185,7 +5452,7 @@ describe('verifyCredential', () => {
       methods: [
         tempo_session_client({
           account: accounts[1],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],