mppx 0.6.31 → 0.8.0

package/src/proxy/Proxy.test.ts

@@ -3,20 +3,20 @@ import { Mppx as Mppx_client, tempo as tempo_client } from 'mppx/client'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
 import type { Address } from 'viem'
 import { afterEach, beforeAll, describe, expect, test } from 'vp/test'
-import { nodeEnv } from '~test/config.js'
+import { tempoNetwork } from '~test/config.js'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client } from '~test/tempo/viem.js'
 
-import { sessionManager } from '../tempo/client/SessionManager.js'
-import { deserializeSessionReceipt } from '../tempo/session/Receipt.js'
+import { sessionManager } from '../tempo/legacy/client/index.js'
+import { deserializeSessionReceipt } from '../tempo/session/precompile/Protocol.js'
 import * as ApiProxy from './Proxy.js'
 import * as Service from './Service.js'
 import { anthropic } from './services/anthropic.js'
 import { openai } from './services/openai.js'
 
-const secretKey = 'test-secret-key'
-const isLocalnet = nodeEnv === 'localnet'
+const secretKey = 'test-secret-key-test-secret-key-32'
+const isLocalnet = tempoNetwork === 'localnet'
 
 const mppx_server = Mppx_server.create({
   methods: [
@@ -907,7 +907,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
 
     const sessionHandler = Mppx_server.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           account: accounts[0],
           currency: asset,
           escrowContract: sessionEscrow,
@@ -967,7 +967,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
 
     const sessionHandler = Mppx_server.create({
       methods: [
-        tempo_server.session({
+        tempo_server.sessionLegacy({
           account: accounts[0],
           currency: asset,
           escrowContract: sessionEscrow,
@@ -997,7 +997,7 @@ describe.runIf(isLocalnet)('plain HTTP session proxy', () => {
     const sessionClient = Mppx_client.create({
       polyfill: false,
       methods: [
-        tempo_client({
+        tempo_client.sessionLegacy.method({
           account: accounts[1],
           getClient: () => client,
           maxDeposit: '2',

package/src/proxy/services/anthropic.test.ts

@@ -9,7 +9,7 @@ import * as ApiProxy from '../Proxy.js'
 import { anthropic } from './anthropic.js'
 
 const apiKey = 'sk-ant-test-fake-anthropic-key'
-const secretKey = 'test-secret-key'
+const secretKey = 'test-secret-key-test-secret-key-32'
 
 const mppx_server = Mppx_server.create({
   methods: [

package/src/proxy/services/openai.test.ts

@@ -11,7 +11,7 @@ import { openai } from './openai.js'
 const apiKey = process.env.VITE_OPENAI_API_KEY
 if (!apiKey) console.warn('OPENAI_API_KEY not set — openai proxy tests will be skipped')
 
-const secretKey = 'test-secret-key'
+const secretKey = 'test-secret-key-test-secret-key-32'
 
 const mppx_server = Mppx_server.create({
   methods: [

package/src/proxy/services/stripe.test.ts

@@ -9,7 +9,7 @@ import * as ApiProxy from '../Proxy.js'
 import { stripe } from './stripe.js'
 
 const apiKey = 'sk_test_fake_stripe_key'
-const secretKey = 'test-secret-key'
+const secretKey = 'test-secret-key-test-secret-key-32'
 
 const mppx_server = Mppx_server.create({
   methods: [

package/src/server/Mppx.authorize.test.ts

@@ -4,7 +4,7 @@ import { describe, expect, test } from 'vp/test'
 import * as Http from '~test/Http.js'
 
 const realm = 'api.example.com'
-const secretKey = 'test-secret-key'
+const secretKey = 'test-secret-key-test-secret-key-32'
 
 function successReceipt(method = 'mock') {
   return {

package/src/server/Mppx.test-d.ts

@@ -34,6 +34,22 @@ const mockChargeB = Method.from({
   },
 })
 
+const mockSession = Method.from({
+  name: 'tempo',
+  intent: 'session',
+  schema: {
+    credential: {
+      payload: z.object({ token: z.string() }),
+    },
+    request: z.object({
+      amount: z.string(),
+      currency: z.string(),
+      methodDetails: z.object({ sessionProtocol: z.string() }),
+      unitType: z.string(),
+    }),
+  },
+})
+
 const alphaMethod = Method.toServer(mockChargeA, {
   async verify() {
     return {
@@ -56,7 +72,30 @@ const betaMethod = Method.toServer(mockChargeB, {
   },
 })
 
-const secretKey = 'test-secret'
+const tip1034SessionMethod = Method.toServer(mockSession, {
+  async verify() {
+    return {
+      method: 'tempo',
+      reference: 'tx',
+      status: 'success' as const,
+      timestamp: new Date().toISOString(),
+    }
+  },
+})
+
+const legacySessionMethod = Method.toServer(mockSession, {
+  alias: 'sessionLegacy',
+  async verify() {
+    return {
+      method: 'tempo',
+      reference: 'tx',
+      status: 'success' as const,
+      timestamp: new Date().toISOString(),
+    }
+  },
+})
+
+const secretKey = 'test-secret-key-test-secret-key-32'
 const realm = 'api.example.com'
 
 describe('Mppx type tests', () => {
@@ -105,6 +144,21 @@ describe('Mppx type tests', () => {
     expectTypeOf(mppx.beta.charge).toBeFunction()
   })
 
+  test('aliased duplicate handlers are accessible by nested and slash keys', () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    expectTypeOf(mppx.tempo.session).toBeFunction()
+    expectTypeOf(mppx.tempo.sessionLegacy).toBeFunction()
+    expectTypeOf(mppx['tempo/session']).toBeFunction()
+    expectTypeOf(mppx['tempo/sessionLegacy']).toBeFunction()
+    expectTypeOf(mppx.challenge.tempo.session).toBeFunction()
+    expectTypeOf(mppx.challenge.tempo.sessionLegacy).toBeFunction()
+  })
+
   test('slash key handlers are accessible', () => {
     const mppx = Mppx.create({ methods: [alphaMethod, betaMethod], realm, secretKey })
 

package/src/server/Mppx.test.ts

@@ -3,23 +3,23 @@ import * as http from 'node:http'
 import { Challenge, Credential, Errors, Method, Receipt, z } from 'mppx'
 import {
   Mppx as Mppx_client,
-  session as tempo_session_client,
+  sessionLegacy as tempo_session_client,
   tempo as tempo_client,
 } from 'mppx/client'
 import { Types as evm_Types } from 'mppx/evm'
 import { evm, Mppx, stripe, Store, Transport, tempo } from 'mppx/server'
 import { Header as x402_Header, Types as x402_Types, type PaymentPayload } from 'mppx/x402'
 import { getTransactionReceipt } from 'viem/actions'
-import { describe, expect, test } from 'vp/test'
+import { describe, expect, test, vi } from 'vp/test'
 import * as Http from '~test/Http.js'
-import { deployEscrow } from '~test/tempo/session.js'
+import { deployEscrow } from '~test/tempo/legacy/session.js'
 import { accounts, asset, client } from '~test/tempo/viem.js'
 
-import type { SessionReceipt } from '../tempo/session/Types.js'
+import type { SessionReceipt } from '../tempo/session/precompile/Protocol.js'
 import * as x402_RouteBinding from '../x402/internal/RouteBinding.js'
 
 const realm = 'api.example.com'
-const secretKey = 'test-secret-key'
+const secretKey = 'test-secret-key-test-secret-key-32'
 
 const method = tempo({
   getClient: () => client,
@@ -40,6 +40,24 @@ describe('create', () => {
 
     expect(handler.transport.name).toBe('mcp')
   })
+
+  test('error: rejects short explicit secret key', () => {
+    expect(() => Mppx.create({ methods: [method], realm, secretKey: 'short' })).toThrow(
+      'Secret key must be at least 32 bytes.',
+    )
+  })
+
+  test('error: rejects short MPP_SECRET_KEY secret key', () => {
+    vi.stubEnv('MPP_SECRET_KEY', 'short')
+
+    try {
+      expect(() => Mppx.create({ methods: [method], realm })).toThrow(
+        'Secret key must be at least 32 bytes.',
+      )
+    } finally {
+      vi.unstubAllEnvs()
+    }
+  })
 })
 
 describe('request handler', () => {
@@ -1837,6 +1855,22 @@ describe('compose', () => {
     },
   })
 
+  const mockSession = Method.from({
+    name: 'tempo',
+    intent: 'session',
+    schema: {
+      credential: {
+        payload: z.object({ token: z.string() }),
+      },
+      request: z.object({
+        amount: z.string(),
+        currency: z.string(),
+        methodDetails: z.object({ sessionProtocol: z.optional(z.string()) }),
+        unitType: z.string(),
+      }),
+    },
+  })
+
   function mockReceipt(name: string) {
     return {
       method: name,
@@ -1858,6 +1892,19 @@ describe('compose', () => {
     },
   })
 
+  const tip1034SessionMethod = Method.toServer(mockSession, {
+    async verify() {
+      return mockReceipt('v2')
+    },
+  })
+
+  const legacySessionMethod = Method.toServer(mockSession, {
+    alias: 'sessionLegacy',
+    async verify() {
+      return mockReceipt('v1')
+    },
+  })
+
   const x402Method = evm.charge({
     currency: evm.assets.baseSepolia.USDC,
     recipient: accounts[0].address,
@@ -1889,6 +1936,19 @@ describe('compose', () => {
     recipient: '0x0000000000000000000000000000000000000002',
   }
 
+  const sessionChallengeOpts = {
+    amount: '100',
+    currency: asset,
+    expires: new Date(Date.now() + 60_000),
+    methodDetails: { sessionProtocol: 'v2' },
+    unitType: 'request',
+  }
+
+  const legacySessionChallengeOpts = {
+    ...sessionChallengeOpts,
+    methodDetails: { sessionProtocol: 'v1' },
+  }
+
   test('returns 402 with multiple WWW-Authenticate headers when no credential', async () => {
     const mppx = Mppx.create({ methods: [alphaMethod, betaMethod], realm, secretKey })
 
@@ -1905,6 +1965,157 @@ describe('compose', () => {
     expect(wwwAuth).toContain('method="beta"')
   })
 
+  test('broadcasts duplicate tempo/session variants in compose order', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose(
+      [mppx.tempo.session, sessionChallengeOpts],
+      [mppx.tempo.sessionLegacy, legacySessionChallengeOpts],
+    )(new Request('https://example.com/resource'))
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+
+    const challenges = Challenge.fromResponseList(result.challenge)
+    expect(challenges.map((challenge) => challenge.request.methodDetails)).toEqual([
+      { sessionProtocol: 'v2' },
+      { sessionProtocol: 'v1' },
+    ])
+  })
+
+  test('keeps duplicate tempo/session variants when Accept-Payment allows tempo/session', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose(
+      [mppx.tempo.session, sessionChallengeOpts],
+      [mppx.tempo.sessionLegacy, legacySessionChallengeOpts],
+    )(
+      new Request('https://example.com/resource', {
+        headers: { 'Accept-Payment': 'tempo/session' },
+      }),
+    )
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+
+    expect(Challenge.fromResponseList(result.challenge)).toHaveLength(2)
+  })
+
+  test('uses TIP-1034 as the bare tempo/session handler regardless of registration order', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+
+    const result = await mppx.compose([mppx.tempo.session, sessionChallengeOpts])(
+      new Request('https://example.com/resource'),
+    )
+
+    expect(result.status).toBe(402)
+    if (result.status !== 402) throw new Error()
+    expect(Challenge.fromResponse(result.challenge).request.methodDetails).toEqual({
+      sessionProtocol: 'v2',
+    })
+  })
+
+  test('rejects cross-protocol tempo/session credential replay', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+    const tip1034ChallengeResponse = await mppx.compose([mppx.tempo.session, sessionChallengeOpts])(
+      new Request('https://example.com/resource'),
+    )
+    expect(tip1034ChallengeResponse.status).toBe(402)
+    if (tip1034ChallengeResponse.status !== 402) throw new Error()
+    const tip1034Challenge = Challenge.fromResponse(tip1034ChallengeResponse.challenge)
+
+    const credential = Credential.serialize({
+      challenge: tip1034Challenge,
+      payload: { token: 'valid' },
+    })
+    const legacyResult = await mppx.compose([mppx.tempo.sessionLegacy, legacySessionChallengeOpts])(
+      new Request('https://example.com/resource', {
+        headers: { Authorization: credential },
+      }),
+    )
+
+    expect(legacyResult.status).toBe(402)
+  })
+
+  test('verifyCredential dispatches duplicate tempo/session variants by sessionProtocol', async () => {
+    const mppx = Mppx.create({
+      methods: [tip1034SessionMethod, legacySessionMethod],
+      realm,
+      secretKey,
+    })
+    const tip1034Challenge = await mppx.challenge.tempo.session(sessionChallengeOpts)
+    const legacyChallenge = await mppx.challenge.tempo.sessionLegacy(legacySessionChallengeOpts)
+
+    const tip1034Receipt = await mppx.verifyCredential(
+      Credential.serialize({
+        challenge: tip1034Challenge,
+        payload: { token: 'valid' },
+      }),
+    )
+    const legacyReceipt = await mppx.verifyCredential(
+      Credential.serialize({
+        challenge: legacyChallenge,
+        payload: { token: 'valid' },
+      }),
+    )
+
+    expect(tip1034Receipt.reference).toBe('tx-v2')
+    expect(legacyReceipt.reference).toBe('tx-v1')
+  })
+
+  test('verifyCredential routes unmarked tempo/session challenges to legacy v1', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+    const unmarkedLegacyChallenge = await mppx.challenge.tempo.sessionLegacy({
+      ...legacySessionChallengeOpts,
+      methodDetails: {},
+    })
+
+    await expect(
+      mppx.verifyCredential(
+        Credential.serialize({
+          challenge: unmarkedLegacyChallenge,
+          payload: { token: 'valid' },
+        }),
+      ),
+    ).resolves.toMatchObject({ reference: 'tx-v1' })
+  })
+
+  test('verifyCredential rejects unknown tempo/session protocol markers', async () => {
+    const mppx = Mppx.create({
+      methods: [legacySessionMethod, tip1034SessionMethod],
+      realm,
+      secretKey,
+    })
+    const challenge = await mppx.challenge.tempo.session({
+      ...sessionChallengeOpts,
+      methodDetails: { sessionProtocol: 'future' },
+    })
+
+    await expect(
+      mppx.verifyCredential(Credential.serialize({ challenge, payload: { token: 'valid' } })),
+    ).rejects.toThrow('no registered method for tempo/session')
+  })
+
   test('returns composed x402 challenge headers when no credential', async () => {
     const mppx = Mppx.create({ methods: [x402Method], realm, secretKey })
 
@@ -5178,7 +5389,7 @@ describe('verifyCredential', () => {
     const escrowContract = await deployEscrow()
     const server = Mppx.create({
       methods: [
-        tempo.session({
+        tempo.sessionLegacy({
           store: Store.memory(),
           getClient: () => client,
           account: accounts[0],
@@ -5195,7 +5406,7 @@ describe('verifyCredential', () => {
       methods: [
         tempo_session_client({
           account: accounts[1],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],
@@ -5241,7 +5452,7 @@ describe('verifyCredential', () => {
     const escrowContract = await deployEscrow()
     const server = Mppx.create({
       methods: [
-        tempo.session({
+        tempo.sessionLegacy({
           store: Store.memory(),
           getClient: () => client,
           account: accounts[0],
@@ -5259,7 +5470,7 @@ describe('verifyCredential', () => {
       methods: [
         tempo_session_client({
           account: accounts[1],
-          deposit: '10',
+          maxDeposit: '10',
           getClient: () => client,
         }),
       ],