mppx 0.8.0 → 0.8.2

package/src/client/Transport.test.ts

@@ -2,6 +2,7 @@ import { Challenge, Credential, Mcp } from 'mppx'
 import { Transport } from 'mppx/client'
 import { Methods } from 'mppx/tempo'
 import { Header as x402_Header, Types as x402_Types, type PaymentRequired } from 'mppx/x402'
+import { Base64 } from 'ox'
 import { describe, expect, test } from 'vp/test'
 
 import * as x402_ChallengeBrand from '../x402/internal/ChallengeBrand.js'
@@ -43,6 +44,25 @@ const x402PaymentRequired = {
   x402Version: 2,
 } satisfies PaymentRequired
 
+const unsupportedSolanaAccept = {
+  amount: '10000',
+  asset: 'USDC',
+  maxTimeoutSeconds: 60,
+  network: 'solana:mainnet',
+  payTo: '9xQeWvG816bUx9EPjHmaT23yvVM2ZWdYqPxfowV5n2kg',
+  scheme: 'exact',
+}
+
+const unsupportedSchemeAccept = {
+  ...x402PaymentRequired.accepts[0]!,
+  scheme: 'upto',
+}
+
+// Strict x402 encoding rejects unsupported accepts before the transport can filter them.
+function encodeRawPaymentRequiredHeader(value: unknown): string {
+  return Base64.fromString(JSON.stringify(value))
+}
+
 describe('http', () => {
   describe('isPaymentRequired', () => {
     test.each([
@@ -140,6 +160,28 @@ describe('http', () => {
         }),
         name: 'Payment auth and x402 challenges when both are present',
       },
+      {
+        expectedIds: [`${x402_Types.syntheticChallengeIdPrefix}0`],
+        expectedMethods: [x402_Types.paymentMethod],
+        headers: () => ({
+          'PAYMENT-REQUIRED': encodeRawPaymentRequiredHeader({
+            ...x402PaymentRequired,
+            accepts: [x402PaymentRequired.accepts[0]!, unsupportedSolanaAccept],
+          }),
+        }),
+        name: 'x402 challenges filtered from mixed EVM and Solana accepts',
+      },
+      {
+        expectedIds: [`${x402_Types.syntheticChallengeIdPrefix}0`],
+        expectedMethods: [x402_Types.paymentMethod],
+        headers: () => ({
+          'PAYMENT-REQUIRED': encodeRawPaymentRequiredHeader({
+            ...x402PaymentRequired,
+            accepts: [x402PaymentRequired.accepts[0]!, unsupportedSchemeAccept],
+          }),
+        }),
+        name: 'x402 challenges filtered from mixed exact and non-exact accepts',
+      },
     ])('returns $name', async ({ expectedIds, expectedMethods, headers }) => {
       const transport = Transport.http()
       const response = new Response(null, {
@@ -151,6 +193,42 @@ describe('http', () => {
       expect(challenges.map((entry) => entry.id)).toEqual(expectedIds)
       expect(challenges.map((entry) => entry.method)).toEqual(expectedMethods)
     })
+
+    test('returns Payment auth challenges when x402 accepts are unsupported', async () => {
+      const transport = Transport.http()
+      const response = new Response(null, {
+        status: 402,
+        headers: {
+          'PAYMENT-REQUIRED': encodeRawPaymentRequiredHeader({
+            ...x402PaymentRequired,
+            accepts: [unsupportedSolanaAccept],
+          }),
+          'WWW-Authenticate': Challenge.serialize(challenge),
+        },
+      })
+
+      const challenges = (await transport.getChallenges?.(response)) ?? []
+
+      expect(challenges.map((entry) => entry.id)).toEqual([challenge.id])
+      expect(challenges.map((entry) => entry.method)).toEqual(['tempo'])
+    })
+
+    test('returns no challenges when only unsupported x402 accepts are present', async () => {
+      const transport = Transport.http()
+      const response = new Response(null, {
+        status: 402,
+        headers: {
+          'PAYMENT-REQUIRED': encodeRawPaymentRequiredHeader({
+            ...x402PaymentRequired,
+            accepts: [unsupportedSolanaAccept],
+          }),
+        },
+      })
+
+      const challenges = (await transport.getChallenges?.(response)) ?? []
+      expect(challenges).toEqual([])
+      expect(() => transport.getChallenge(response)).toThrow('No challenge in response.')
+    })
   })
 
   describe('setCredential', () => {
@@ -322,8 +400,24 @@ describe('http (MCP-over-HTTP)', () => {
       data: { challenges: [challenge] },
     },
   }
+  const resultMessage = {
+    jsonrpc: '2.0',
+    id: 1,
+    result: {
+      content: [{ type: 'text', text: 'Payment Required' }],
+      isError: true,
+      _meta: {
+        [Mcp.paymentRequiredMetaKey]: {
+          httpStatus: 402,
+          challenges: [challenge],
+        },
+      },
+    },
+  }
   const jsonBody = () =>
     new Response(JSON.stringify(errorMessage), { headers: { 'content-type': 'application/json' } })
+  const jsonResultBody = () =>
+    new Response(JSON.stringify(resultMessage), { headers: { 'content-type': 'application/json' } })
   const sseBody = () =>
     new Response(`event: message\ndata: ${JSON.stringify(errorMessage)}\n\n`, {
       headers: { 'content-type': 'text/event-stream' },
@@ -332,6 +426,9 @@ describe('http (MCP-over-HTTP)', () => {
   test('detects -32042 in a JSON body (JSON-RPC request)', async () => {
     expect(await Transport.http().isPaymentRequired(jsonBody(), jsonRpcRequest)).toBe(true)
   })
+  test('detects payment-required metadata in a JSON-RPC result', async () => {
+    expect(await Transport.http().isPaymentRequired(jsonResultBody(), jsonRpcRequest)).toBe(true)
+  })
   test('ignores a JSON-RPC response for a different request id', async () => {
     const response = new Response(JSON.stringify({ ...errorMessage, id: 2 }), {
       headers: { 'content-type': 'application/json' },
@@ -403,6 +500,10 @@ describe('http (MCP-over-HTTP)', () => {
     const challenges = await Transport.http().getChallenges!(sseBody(), jsonRpcRequest)
     expect(challenges.map((entry) => entry.id)).toEqual([challenge.id])
   })
+  test('getChallenges extracts an MCP result metadata challenge', async () => {
+    const challenges = await Transport.http().getChallenges!(jsonResultBody(), jsonRpcRequest)
+    expect(challenges.map((entry) => entry.id)).toEqual([challenge.id])
+  })
   test('setCredential routes the MCP challenge into the JSON-RPC _meta', async () => {
     const transport = Transport.http()
     const [mcpChallenge] = await transport.getChallenges!(sseBody(), jsonRpcRequest)
@@ -473,6 +574,20 @@ describe('mcp', () => {
       },
     },
   }
+  const mcpResult: Mcp.Response = {
+    jsonrpc: '2.0',
+    id: 1,
+    result: {
+      content: [],
+      isError: true,
+      _meta: {
+        [Mcp.paymentRequiredMetaKey]: {
+          httpStatus: 402,
+          challenges: [challenge],
+        },
+      },
+    },
+  }
 
   test('extracts payment-required challenges from JSON-RPC errors', async () => {
     const transport = Transport.mcp()
@@ -483,6 +598,15 @@ describe('mcp', () => {
     ])
   })
 
+  test('extracts payment-required challenges from tool result metadata', async () => {
+    const transport = Transport.mcp()
+
+    expect(await transport.isPaymentRequired(mcpResult)).toBe(true)
+    expect((await transport.getChallenges?.(mcpResult))?.map((entry) => entry.id)).toEqual([
+      challenge.id,
+    ])
+  })
+
   test('sets credentials in JSON-RPC _meta', () => {
     const result = Transport.mcp().setCredential(mcpRequest, Credential.serialize(credential))
 

package/src/client/Transport.ts

@@ -1,7 +1,7 @@
 import * as Challenge from '../Challenge.js'
 import * as Credential from '../Credential.js'
 import * as Mcp from '../Mcp.js'
-import { mcp as mcpProtocol } from './internal/protocols/Mcp.js'
+import { mcp as mcpProtocol, paymentRequiredData } from './internal/protocols/Mcp.js'
 import { mpp as mppProtocol } from './internal/protocols/Mpp.js'
 import type { Protocol } from './internal/protocols/Protocol.js'
 import { paymentRequiredStatus } from './internal/protocols/Shared.js'
@@ -144,6 +144,12 @@ export function http(): Transport<RequestInit, Response> {
   })
 }
 
+function mcpPaymentRequiredChallenges(response: Mcp.Response) {
+  const data = paymentRequiredData(response)
+  if (!data) throw new Error('No challenge in response.')
+  return data.challenges
+}
+
 /**
  * MCP protocol transport for direct JSON-RPC objects.
  *
@@ -155,20 +161,16 @@ export function mcp() {
     name: 'mcp',
 
     isPaymentRequired(response) {
-      return 'error' in response && response.error?.code === Mcp.paymentRequiredCode
+      return !!paymentRequiredData(response)
     },
 
     getChallenges(response) {
-      if (!('error' in response) || !response.error) throw new Error('Response is not an error.')
-      const challenges = response.error.data?.challenges
-      if (!challenges?.length) throw new Error('No challenge in error response.')
-      return challenges
+      return mcpPaymentRequiredChallenges(response)
     },
 
     getChallenge(response) {
-      if (!('error' in response) || !response.error) throw new Error('Response is not an error.')
-      const challenge = response.error.data?.challenges[0]
-      if (!challenge) throw new Error('No challenge in error response.')
+      const challenge = mcpPaymentRequiredChallenges(response)[0]
+      if (!challenge) throw new Error('No challenge in response.')
       return challenge
     },
 

package/src/client/internal/Fetch.test-d.ts

@@ -57,6 +57,15 @@ describe('Fetch.from', () => {
     })
   })
 
+  test('behavior: accepts payment retry cap', () => {
+    const fetch = Fetch.from({
+      maxPaymentRetries: 1,
+      methods: [charge()],
+    })
+
+    expectTypeOf(fetch).toBeFunction()
+  })
+
   test('behavior: events infer payload types from methods', () => {
     const method = charge()
     const dispatcher = Fetch.createEventDispatcher<[typeof method]>()

package/src/client/internal/Fetch.test.ts

@@ -2,6 +2,7 @@ import { Challenge, Credential, Errors, Mcp, Receipt } from 'mppx'
 import { tempo } from 'mppx/client'
 import { Mppx as Mppx_server, tempo as tempo_server } from 'mppx/server'
 import { Header as x402_Header, Types as x402_Types, type PaymentRequired } from 'mppx/x402'
+import { Base64 } from 'ox'
 import { createClient, defineChain } from 'viem'
 import { describe, expect, test, vi } from 'vp/test'
 import * as Http from '~test/Http.js'
@@ -351,7 +352,8 @@ const x402PaymentRequired = {
 } satisfies PaymentRequired
 
 /** Builds a valid 402 response with a WWW-Authenticate header. */
-function make402(overrides?: { expires?: string; intent?: string; method?: string }) {
+function make402(overrides?: { expires?: string; id?: string; intent?: string; method?: string }) {
+  const id = overrides?.id ?? 'abc'
   const method = overrides?.method ?? 'test'
   const intent = overrides?.intent ?? 'test'
   const expires = overrides?.expires ? `, expires="${overrides.expires}"` : ''
@@ -359,7 +361,7 @@ function make402(overrides?: { expires?: string; intent?: string; method?: strin
     .replace(/\+/g, '-')
     .replace(/\//g, '_')
     .replace(/=+$/, '')
-  const header = `Payment id="abc", realm="test", method="${method}", intent="${intent}", request="${request}"${expires}`
+  const header = `Payment id="${id}", realm="test", method="${method}", intent="${intent}", request="${request}"${expires}`
   return new Response(null, {
     status: 402,
     headers: { 'WWW-Authenticate': header },
@@ -379,6 +381,11 @@ function makeCombined402() {
   })
 }
 
+// Strict x402 encoding rejects unsupported accepts before the transport can filter them.
+function encodeRawPaymentRequiredHeader(value: unknown): string {
+  return Base64.fromString(JSON.stringify(value))
+}
+
 describe('Fetch.from: init passthrough (non-402)', () => {
   test('preserves init object identity while adding Accept-Payment', async () => {
     const receivedInits: (RequestInit | undefined)[] = []
@@ -780,6 +787,69 @@ describe('Fetch.from: 402 retry path', () => {
     expect(calls).toHaveLength(2)
   })
 
+  test('settles MCP-over-HTTP result metadata payment challenges at the fetch boundary', async () => {
+    const mcpChallenge = Challenge.from({
+      id: 'mcp-result-challenge',
+      intent: 'test',
+      method: 'test',
+      realm: 'test',
+      request: { amount: '1' },
+    })
+    const method = {
+      ...noopMethod,
+      createCredential: async ({ challenge }: { challenge: Challenge.Challenge }) =>
+        Credential.serialize({ challenge, payload: { source: 'mcp-result' } }),
+    }
+    const initialBody = JSON.stringify({
+      jsonrpc: '2.0',
+      id: 1,
+      method: 'tools/call',
+      params: { name: 'paid-tool' },
+    })
+    let callCount = 0
+    const calls: { init: RequestInit | undefined }[] = []
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1)
+        return Response.json({
+          jsonrpc: '2.0',
+          id: 1,
+          result: {
+            content: [{ type: 'text', text: 'Payment Required' }],
+            isError: true,
+            _meta: {
+              [Mcp.paymentRequiredMetaKey]: {
+                httpStatus: 402,
+                challenges: [mcpChallenge],
+              },
+            },
+          },
+        })
+
+      const body = JSON.parse(init?.body as string)
+      expect(new Headers(init?.headers).get('Authorization')).toBeNull()
+      expect(body.params['_meta'][Mcp.credentialMetaKey]).toMatchObject({
+        payload: { source: 'mcp-result' },
+      })
+      return Response.json({ ok: true })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [method],
+    })
+
+    const response = await fetch('https://example.com/mcp', {
+      method: 'POST',
+      headers: { accept: 'application/json, text/event-stream' },
+      body: initialBody,
+    })
+
+    expect(response.status).toBe(200)
+    expect(calls).toHaveLength(2)
+  })
+
   test('settles MCP-over-HTTP when the JSON-RPC request body is carried by Request input', async () => {
     const mcpChallenge = Challenge.from({
       id: 'mcp-request-input-challenge',
@@ -1356,6 +1426,63 @@ describe('Fetch.from: 402 retry path', () => {
     expect(response.status).toBe(200)
   })
 
+  test('ignores unsupported x402 accepts when selecting a Payment auth challenge', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'tempo-credential')
+    const tempoChallenge = Challenge.from({
+      id: 'tempo',
+      realm: 'test',
+      method: 'tempo',
+      intent: 'charge',
+      request: { amount: '1' },
+    })
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      callCount++
+      if (callCount === 1) {
+        return new Response(null, {
+          status: 402,
+          headers: {
+            [x402_Types.paymentRequiredHeader]: encodeRawPaymentRequiredHeader({
+              accepts: [
+                {
+                  amount: '10000',
+                  asset: 'USDC',
+                  maxTimeoutSeconds: 60,
+                  network: 'solana:mainnet',
+                  payTo: '9xQeWvG816bUx9EPjHmaT23yvVM2ZWdYqPxfowV5n2kg',
+                  scheme: 'exact',
+                },
+              ],
+              resource: { url: 'https://example.com/api' },
+              x402Version: 2,
+            }),
+            'WWW-Authenticate': Challenge.serialize(tempoChallenge),
+          },
+        })
+      }
+
+      expect(new Headers(init?.headers).get('Authorization')).toBe('tempo-credential')
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [
+        {
+          name: 'tempo',
+          intent: 'charge',
+          context: undefined,
+          createCredential,
+        },
+      ] as const,
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    expect(createCredential).toHaveBeenCalledOnce()
+  })
+
   test('orderChallenges filters and sorts supported challenges before signing', async () => {
     let callCount = 0
     const pathUsd = Challenge.from({
@@ -1544,8 +1671,42 @@ describe('Fetch.from: 402 retry path', () => {
     )
   })
 
-  test('retries exactly once — does not loop on repeated 402', async () => {
+  test('creates a fresh credential for each incremental 402 challenge', async () => {
+    const createCredential = vi.fn(
+      async ({ challenge }: { challenge: Challenge.Challenge }) => `credential-${challenge.id}`,
+    )
+    const calls: { init: RequestInit | undefined }[] = []
+    let callCount = 0
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1) return make402({ id: 'first' })
+      if (callCount === 2) return make402({ id: 'second' })
+      if (callCount === 3) return make402({ id: 'third' })
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    expect(createCredential.mock.calls.map((call) => call[0].challenge.id)).toEqual([
+      'first',
+      'second',
+      'third',
+    ])
+    expect(
+      calls.slice(1).map((call) => new Headers(call.init?.headers).get('Authorization')),
+    ).toEqual(['credential-first', 'credential-second', 'credential-third'])
+  })
+
+  test('caps repeated 402 retries at three', async () => {
     let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
     const mockFetch: typeof globalThis.fetch = async () => {
       callCount++
       return make402()
@@ -1553,11 +1714,32 @@ describe('Fetch.from: 402 retry path', () => {
 
     const fetch = Fetch.from({
       fetch: mockFetch,
-      methods: [noopMethod],
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+    expect(callCount).toBe(4)
+    expect(createCredential).toHaveBeenCalledTimes(3)
+    expect(response.status).toBe(402)
+  })
+
+  test('respects configured retry cap', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
+    const mockFetch: typeof globalThis.fetch = async () => {
+      callCount++
+      return make402()
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      maxPaymentRetries: 1,
+      methods: [{ ...noopMethod, createCredential }],
     })
 
     const response = await fetch('https://example.com/api')
     expect(callCount).toBe(2)
+    expect(createCredential).toHaveBeenCalledOnce()
     expect(response.status).toBe(402)
   })
 })