mppx 0.8.13 → 0.8.14

package/dist/tempo/server/Charge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Charge.d.ts","sourceRoot":"","sources":["../../../src/tempo/server/Charge.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,KAAK,KAAK,IAAI,MAAM,sCAAsC,CAAA;AACjE,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAC9C,OAAO,KAAK,KAAK,CAAC,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAA;AAIjD,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AAIpD,OAAO,KAAK,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAGxC;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,CAAC,UAAU,EAC/D,UAAU,GAAE,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAGpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gEAseF;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,YAAY,GAAG;QAAE,CAAC,GAAG,EAAE,eAAe,MAAM,EAAE,GAAG,MAAM,CAAA;KAAE,CAAA;IAE9D,KAAK,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC,CAAA;IAElG,KAAK,cAAc,GAAG,CAAC,UAAU,EAAE,wBAAwB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE1F,KAAK,wBAAwB,GAAG;QAC9B,6CAA6C;QAC7C,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;QACrB,8DAA8D;QAC9D,cAAc,EAAE,KAAK,MAAM,EAAE,CAAA;QAC7B,sEAAsE;QACtE,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KACjE,CAAA;IAED,KAAK,UAAU,GAAG;QAChB,6EAA6E;QAC7E,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACxC;;;;;;;WAOG;QACH,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;QAC3C;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QACpC,oBAAoB;QACpB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC7B;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAA;QACrC;;;;WAIG;QACH,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;QAC3C;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACnC;;;;;;;;;;WAUG;QACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC1C,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,GAC/B,OAAO,CAAC,OAAO,CAAC,UAAU,GAC1B,QAAQ,CAAA;IAEV,KAAK,cAAc,CAAC,UAAU,SAAS,UAAU,IAAI,KAAK,CAAC,cAAc,CACvE,UAAU,EACV,QAAQ,EACR;QACE,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;KACjB,CACF,CAAA;IAED,KAAK,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CAC/C"}
+{"version":3,"file":"Charge.d.ts","sourceRoot":"","sources":["../../../src/tempo/server/Charge.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAiB,WAAW,EAAE,MAAM,YAAY,CAAA;AAKvD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrE,OAAO,KAAK,MAAM,MAAM,iBAAiB,CAAA;AACzC,OAAO,KAAK,KAAK,IAAI,MAAM,sCAAsC,CAAA;AACjE,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA;AACvC,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAA;AAG9C,OAAO,KAAK,OAAO,MAAM,wBAAwB,CAAA;AAIjD,OAAO,KAAK,QAAQ,MAAM,0BAA0B,CAAA;AAIpD,OAAO,KAAK,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAClD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAExC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAA;AACnC,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,MAAM,CAAC,KAAK,CAAC,UAAU,SAAS,MAAM,CAAC,UAAU,EAC/D,UAAU,GAAE,WAAW,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAGpD,GACA,MAAM,CAAC,MAAM,CAAC,OAAO,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CA2oBzE;AAED,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC;IAC9B,KAAK,YAAY,GAAG;QAClB,CAAC,GAAG,EAAE,eAAe,MAAM,EAAE,GAAG,MAAM,GAAG,aAAa,CAAC,KAAK,CAAA;KAC7D,CAAA;IAED,KAAK,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,OAAO,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC,CAAA;IAElG,KAAK,cAAc,GAAG,CAAC,UAAU,EAAE,wBAAwB,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAE1F,KAAK,iBAAiB,GAAG;QACvB,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAA;QAC/B,MAAM,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QAClC,qBAAqB,CAAC,EAAE,WAAW,CAAC,0BAA0B,GAAG,SAAS,CAAA;QAC1E,SAAS,CAAC,EAAE,SAAS,gBAAgB,EAAE,GAAG,SAAS,CAAA;KACpD,CAAA;IAED,KAAK,wBAAwB,GAAG;QAC9B,6CAA6C;QAC7C,MAAM,EAAE,KAAK,MAAM,EAAE,CAAA;QACrB,8DAA8D;QAC9D,cAAc,EAAE,KAAK,MAAM,EAAE,CAAA;QAC7B,sEAAsE;QACtE,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,SAAS,CAAA;KACjE,CAAA;IAED,KAAK,UAAU,GAAG;QAChB,6EAA6E;QAC7E,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;QACxC;;;;;;;;;;WAUG;QACH,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;QAC3C;;;;;;WAMG;QACH,QAAQ,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;QACpC,oBAAoB;QACpB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;QAC7B;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,SAAS,CAAA;QACrC;;;;WAIG;QACH,cAAc,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;QAC3C;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACnC,yGAAyG;QACzG,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;QAChC;;;;;;;;;;WAUG;QACH,mBAAmB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;KAC1C,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,GAC/B,OAAO,CAAC,OAAO,CAAC,UAAU,GAC1B,QAAQ,CAAA;IAEV,KAAK,cAAc,CAAC,UAAU,SAAS,UAAU,IAAI,KAAK,CAAC,cAAc,CACvE,UAAU,EACV,QAAQ,EACR;QACE,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;KACjB,CACF,CAAA;IAED,KAAK,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG;QAC/C,yFAAyF;QACzF,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC5C;;;;WAIG;QACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACzC,CAAA;IAED,6DAA6D;IAC7D,KAAK,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC,OAAO,CAAA;CAC5C;AA4BD,KAAK,gBAAgB,GAAG;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAClC,IAAI,CAAC,EAAE,KAAK,MAAM,EAAE,GAAG,SAAS,CAAA;IAChC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAA;CACzB,CAAA"}

package/dist/tempo/server/Charge.js

@@ -19,6 +19,8 @@ import * as Proof from '../internal/proof.js';
 import * as Selectors from '../internal/selectors.js';
 import * as Methods from '../Methods.js';
 import { html as htmlContent } from './internal/html.gen.js';
+import * as Relay from './Relay.js';
+import * as SponsorBudget from './SponsorBudget.js';
 /**
  * Creates a Tempo charge method intent for usage on the server.
  *
@@ -30,9 +32,19 @@ import { html as htmlContent } from './internal/html.gen.js';
  * ```
  */
 export function charge(parameters = {}) {
-    const { amount, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, memo, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
+    const { amount, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, memo, relay, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
     const storeKeyPrefix = parameters.storeKeyPrefix ?? '';
-    const store = Store.from((parameters.store ?? Store.memory()), { keyPrefix: storeKeyPrefix });
+    const rawStore = (parameters.store ?? Store.memory());
+    const store = Store.from(rawStore, { keyPrefix: storeKeyPrefix });
+    // Aggregate exposure belongs to the actual sponsor, not a caller-specific
+    // replay namespace. Sharing the raw store gives every tenant/process the same
+    // atomic sponsor-wide budget.
+    const sponsorBudgetStore = Store.from(rawStore);
+    const { maxInFlightReservations = 100, maxInFlightTotalFee = (feePayerPolicy?.maxTotalFee ?? 50000000000000000n) * 10n, ...transactionFeePayerPolicy } = feePayerPolicy ?? {};
+    if (!Number.isSafeInteger(maxInFlightReservations) || maxInFlightReservations <= 0)
+        throw new Error('`feePayerPolicy.maxInFlightReservations` must be a positive safe integer.');
+    if (maxInFlightTotalFee <= 0n)
+        throw new Error('`feePayerPolicy.maxInFlightTotalFee` must be greater than zero.');
     const proofStore = parameters.store
         ? Store.from(parameters.store, {
             keyPrefix: storeKeyPrefix,
@@ -47,7 +59,174 @@ export function charge(parameters = {}) {
         getClient: parameters.getClient,
         rpcUrl: defaults.rpcUrl,
     });
-    return Method.toServer(Methods.charge, {
+    function resolveRequest(request) {
+        const parsed = Methods.charge.schema.request.safeParse(request);
+        if (parsed.success)
+            return parsed.data;
+        // Credential handlers receive the HMAC-bound request in canonical output
+        // form, so it must not be transformed a second time.
+        return request;
+    }
+    async function resolveCredentialContext({ credential, request, }) {
+        const { challenge, payload } = credential;
+        const resolvedRequest = resolveRequest(request);
+        const chainId = resolvedRequest.methodDetails?.chainId ?? request.chainId;
+        const { amount, methodDetails } = resolvedRequest;
+        const supportedModes = methodDetails?.supportedModes;
+        const currency = resolvedRequest.currency;
+        const recipient = resolvedRequest.recipient;
+        const memo = methodDetails?.memo;
+        const isZeroAmount = BigInt(amount) === 0n;
+        Expires.assert(challenge.expires, challenge.id);
+        if (isZeroAmount && payload.type !== 'proof')
+            throw new MismatchError('Zero-amount challenges require a proof credential.', {});
+        return {
+            amount,
+            chainId,
+            challenge,
+            client: await getClient({ chainId }),
+            currency,
+            isZeroAmount,
+            memo,
+            methodDetails,
+            payload,
+            recipient,
+            requestAllowsFeePayer: request.feePayer !== false,
+            resolvedRequest,
+            supportedModes,
+        };
+    }
+    async function validateHashCredential(credential, payload, context) {
+        const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, supportedModes, } = context;
+        if (supportedModes && !supportedModes.includes('push'))
+            throw new MismatchError('Hash credentials are not supported for this challenge.', {});
+        const source = parseHashCredentialSource({
+            chainId: chainId ?? client.chain?.id,
+            source: credential.source,
+        });
+        const transfers = getExpectedTransfers({ amount, memo, methodDetails, recipient });
+        const receipt = await getTransactionReceipt(client, {
+            hash: payload.hash,
+        });
+        const sender = source?.address ?? receipt.from;
+        const matchedLogs = await assertTransferLogs(receipt, {
+            currency,
+            sender,
+            source,
+            transfers,
+            validateSender,
+        });
+        if (!memo)
+            assertChallengeBoundMemo(matchedLogs, {
+                challengeId: challenge.id,
+                realm: challenge.realm,
+            });
+        return { receipt: toReceipt(receipt), sender, transfers };
+    }
+    async function validateProofCredential(credential, payload, context) {
+        const { chainId, challenge, client, isZeroAmount } = context;
+        if (!isZeroAmount)
+            throw new MismatchError('Proof credentials are only valid for zero-amount challenges.', {});
+        const expectedSource = credential.source;
+        if (!expectedSource)
+            throw new MismatchError('Proof credential must include a source.', {});
+        const resolvedChainId = challenge.request.methodDetails?.chainId ?? chainId;
+        const source = Proof.parsePkhSource(expectedSource);
+        if (!source || source.chainId !== resolvedChainId)
+            throw new MismatchError('Proof credential source is invalid.', {});
+        const valid = await verifyTypedData(client, {
+            address: source.address,
+            ...Proof.typedData({
+                account: source.address,
+                chainId: resolvedChainId,
+                challengeId: challenge.id,
+                realm: challenge.realm,
+            }),
+            signature: payload.signature,
+        });
+        if (!valid) {
+            const proofSigner = recoverAuthorizedProofSigner({
+                chainId: resolvedChainId,
+                challengeId: challenge.id,
+                realm: challenge.realm,
+                signature: payload.signature,
+                sourceAddress: source.address,
+            });
+            const authorized = proofSigner
+                ? await isActiveAccessKey(client, { accessKey: proofSigner, account: source.address })
+                : false;
+            if (!authorized)
+                throw new MismatchError('Proof signature does not match source.', {});
+        }
+        return { sender: source.address };
+    }
+    async function validateTransactionCredential(credential, payload, request, context) {
+        const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, requestAllowsFeePayer, supportedModes, } = context;
+        if (supportedModes && !supportedModes.includes('pull'))
+            throw new MismatchError('Transaction credentials are not supported for this challenge.', {});
+        const serializedTransaction = payload.signature;
+        if (!FeePayer.isTempoTransaction(serializedTransaction))
+            throw new MismatchError('Only Tempo (0x76/0x78) transactions are supported.', {});
+        const transaction = Transaction.deserialize(serializedTransaction);
+        if (!transaction.signature || !transaction.from)
+            throw new MismatchError('Transaction must be signed by the sender before fee payer co-signing.', {});
+        const isFeePayerTx = methodDetails?.feePayer === true &&
+            requestAllowsFeePayer &&
+            !!(typeof request.feePayer === 'object' ? request.feePayer : feePayer || feePayerUrl);
+        const transfers = getExpectedTransfers({ amount, memo, methodDetails, recipient });
+        const matchedCalls = assertTransferCalls(transaction.calls ?? [], {
+            currency,
+            exactCount: isFeePayerTx,
+            transfers,
+        });
+        if (!memo)
+            assertChallengeBoundCallMemo(matchedCalls, {
+                challengeId: challenge.id,
+                realm: challenge.realm,
+            });
+        if (isFeePayerTx) {
+            FeePayer.validateCalls(transaction.calls, { amount, currency, recipient }, { currency, expectedTransfers: transfers });
+            FeePayer.assertAllowedFeeToken(transaction, FeePayer.defaultAllowedFeeTokens(chainId));
+        }
+        else {
+            await viem_call(client, FeePayer.simulationTransaction(transaction, { feePayer: false }));
+        }
+        return { isFeePayerTx, serializedTransaction, transaction, transfers };
+    }
+    async function validateCredential(credential, request, context) {
+        switch (context.payload.type) {
+            case 'hash': {
+                const { receipt, sender, transfers } = await validateHashCredential(credential, context.payload, context);
+                return {
+                    details: { mode: 'push', sender, transfers },
+                    hash: context.payload.hash,
+                    receipt,
+                    type: 'hash',
+                };
+            }
+            case 'proof': {
+                const { sender } = await validateProofCredential(credential, context.payload, context);
+                return { details: { mode: 'proof', sender }, type: 'proof' };
+            }
+            case 'transaction': {
+                const { isFeePayerTx, serializedTransaction, transaction, transfers } = await validateTransactionCredential(credential, context.payload, request, context);
+                return {
+                    details: {
+                        mode: 'pull',
+                        sender: transaction.from,
+                        serializedTransaction,
+                        transfers,
+                    },
+                    isFeePayerTx,
+                    serializedTransaction,
+                    transaction,
+                    transfers,
+                    type: 'transaction',
+                };
+            }
+        }
+    }
+    const method = Method.toServer(Methods.charge, {
         defaults: {
             amount,
             currency,
@@ -127,138 +306,44 @@ export function charge(parameters = {}) {
                 memo: request.memo || undefined,
             };
         },
-        async verify({ credential, request }) {
-            const { challenge } = credential;
-            const resolvedRequest = (() => {
-                const parsed = Methods.charge.schema.request.safeParse(request);
-                if (parsed.success)
-                    return parsed.data;
-                // verifyCredential() passes the HMAC-bound challenge request, which is
-                // already in canonical output form and should not be transformed again.
-                return request;
-            })();
-            const chainId = resolvedRequest.methodDetails?.chainId ?? request.chainId;
-            const client = await getClient({ chainId });
-            const { amount, methodDetails } = resolvedRequest;
-            const requestAllowsFeePayer = request.feePayer !== false &&
-                (request.feePayer === undefined ||
-                    request.feePayer === true ||
-                    typeof request.feePayer === 'object');
+        async validate({ credential, request }) {
+            const context = await resolveCredentialContext({ credential, request });
+            const validated = await validateCredential(credential, request, context);
+            return {
+                challenge: context.challenge,
+                credential,
+                details: validated.details,
+                intent: 'charge',
+                method: 'tempo',
+                request: context.resolvedRequest,
+                source: credential.source,
+            };
+        },
+        async broadcast({ credential, request }) {
+            const context = await resolveCredentialContext({ credential, request });
+            const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, requestAllowsFeePayer, } = context;
+            const validated = await validateCredential(credential, request, context);
             const feePayerAccount = methodDetails?.feePayer === true && requestAllowsFeePayer
                 ? typeof request.feePayer === 'object'
                     ? request.feePayer
                     : feePayer
                 : undefined;
             const expires = challenge.expires;
-            const supportedModes = methodDetails?.supportedModes;
-            const currency = resolvedRequest.currency;
-            const recipient = resolvedRequest.recipient;
-            Expires.assert(expires, challenge.id);
-            const memo = methodDetails?.memo;
-            const payload = credential.payload;
-            const isZeroAmount = BigInt(amount) === 0n;
-            if (isZeroAmount && payload.type !== 'proof')
-                throw new MismatchError('Zero-amount challenges require a proof credential.', {});
-            switch (payload.type) {
+            switch (validated.type) {
                 case 'hash': {
-                    if (supportedModes && !supportedModes.includes('push'))
-                        throw new MismatchError('Hash credentials are not supported for this challenge.', {});
-                    const hash = payload.hash;
-                    // Validate client-supplied identity before reserving the hash so a
-                    // malformed source cannot burn an otherwise valid payment attempt.
-                    const source = parseHashCredentialSource({
-                        chainId: chainId ?? client.chain?.id,
-                        source: credential.source,
-                    });
-                    // Reserve the hash while we verify it. This blocks concurrent
-                    // requests from racing to reuse the same on-chain payment.
+                    const { hash, receipt } = validated;
                     if (!(await markHashUsed(store, hash))) {
-                        throw new VerificationFailedError({ reason: 'Transaction hash has already been used' });
-                    }
-                    // If verification fails after reservation, release it so transient
-                    // RPC/log-validation errors do not force the payer to pay again.
-                    // Once we have proven the receipt is a successful matching payment,
-                    // keep the marker to enforce single-use semantics.
-                    let releaseReservation = true;
-                    try {
-                        const expectedTransfers = getExpectedTransfers({
-                            amount,
-                            memo,
-                            methodDetails,
-                            recipient,
-                        });
-                        const receipt = await getTransactionReceipt(client, { hash });
-                        const sender = source?.address ?? receipt.from;
-                        const matchedLogs = await assertTransferLogs(receipt, {
-                            currency,
-                            sender,
-                            source,
-                            transfers: expectedTransfers,
-                            validateSender,
+                        throw new VerificationFailedError({
+                            reason: 'Transaction hash has already been used',
                         });
-                        // Only verify challenge binding when using auto-generated attribution memos.
-                        // Explicit memos (set by the server) are strictly matched by assertTransferLogs
-                        // but are NOT challenge-bound — callers that set explicit memos are responsible
-                        // for ensuring memo uniqueness per challenge to prevent cross-challenge hash reuse.
-                        if (!memo)
-                            assertChallengeBoundMemo(matchedLogs, {
-                                challengeId: challenge.id,
-                                realm: challenge.realm,
-                            });
-                        const paymentReceipt = toReceipt(receipt);
-                        // `toReceipt` can throw for reverted transactions. Only keep the
-                        // reservation after it confirms the referenced transaction settled.
-                        releaseReservation = false;
-                        return paymentReceipt;
-                    }
-                    catch (error) {
-                        if (releaseReservation)
-                            await releaseHashUse(store, hash);
-                        throw error;
                     }
+                    return receipt;
                 }
                 case 'proof': {
-                    if (!isZeroAmount)
-                        throw new MismatchError('Proof credentials are only valid for zero-amount challenges.', {});
-                    const expectedSource = credential.source;
-                    if (!expectedSource)
-                        throw new MismatchError('Proof credential must include a source.', {});
-                    const resolvedChainId = challenge.request.methodDetails?.chainId ?? chainId;
-                    const source = Proof.parsePkhSource(expectedSource);
-                    if (!source || source.chainId !== resolvedChainId) {
-                        throw new MismatchError('Proof credential source is invalid.', {});
-                    }
-                    const valid = await verifyTypedData(client, {
-                        // Bind verification to the claimed payer (`source.address`): the
-                        // signer may be the payer itself or an access key authorized for it.
-                        address: source.address,
-                        ...Proof.typedData({
-                            account: source.address,
-                            chainId: resolvedChainId,
-                            challengeId: challenge.id,
-                            realm: challenge.realm,
-                        }),
-                        signature: payload.signature,
-                    });
-                    if (!valid) {
-                        const proofSigner = recoverAuthorizedProofSigner({
-                            chainId: resolvedChainId,
-                            challengeId: challenge.id,
-                            realm: challenge.realm,
-                            signature: payload.signature,
-                            sourceAddress: source.address,
-                        });
-                        const authorized = proofSigner
-                            ? await isActiveAccessKey(client, {
-                                accessKey: proofSigner,
-                                account: source.address,
-                            })
-                            : false;
-                        if (!authorized)
-                            throw new MismatchError('Proof signature does not match source.', {});
-                    }
                     if (proofStore && !(await markProofUsed(proofStore, challenge.id))) {
-                        throw new VerificationFailedError({ reason: 'Proof credential has already been used' });
+                        throw new VerificationFailedError({
+                            reason: 'Proof credential has already been used',
+                        });
                     }
                     return {
                         method: 'tempo',
@@ -268,58 +353,23 @@ export function charge(parameters = {}) {
                     };
                 }
                 case 'transaction': {
-                    if (supportedModes && !supportedModes.includes('pull'))
-                        throw new MismatchError('Transaction credentials are not supported for this challenge.', {});
-                    const serializedTransaction = payload.signature;
+                    const { isFeePayerTx, serializedTransaction, transaction, transfers } = validated;
                     // Pre-broadcast dedup: catch exact byte-for-byte replays early.
                     const hash = keccak256(serializedTransaction);
                     if (!(await markHashUsed(store, hash))) {
-                        throw new VerificationFailedError({ reason: 'Transaction hash has already been used' });
+                        throw new VerificationFailedError({
+                            reason: 'Transaction hash has already been used',
+                        });
                     }
-                    let releaseReservation = true;
-                    let sponsoredSenderReservation;
+                    let broadcastAttempted = false;
+                    let finalHash;
+                    let reservation;
                     try {
-                        if (!FeePayer.isTempoTransaction(serializedTransaction))
-                            throw new MismatchError('Only Tempo (0x76/0x78) transactions are supported.', {});
-                        const transaction = Transaction.deserialize(serializedTransaction);
-                        if (!transaction.signature || !transaction.from)
-                            throw new MismatchError('Transaction must be signed by the sender before fee payer co-signing.', {});
-                        const calls = (transaction.calls ?? []);
-                        const transfers = getExpectedTransfers({ amount, memo, methodDetails, recipient });
-                        const isFeePayerTx = methodDetails?.feePayer === true &&
-                            requestAllowsFeePayer &&
-                            !!(feePayerAccount || feePayerUrl);
-                        const matchedCalls = assertTransferCalls(calls, {
-                            currency,
-                            exactCount: isFeePayerTx,
-                            transfers,
-                        });
-                        if (!memo)
-                            assertChallengeBoundCallMemo(matchedCalls, {
-                                challengeId: challenge.id,
-                                realm: challenge.realm,
-                            });
-                        if (isFeePayerTx) {
-                            const reservationChainId = chainId ?? client.chain.id;
-                            if (!(await markSponsoredSenderInFlight(store, {
-                                chainId: reservationChainId,
-                                sender: transaction.from,
-                            }))) {
-                                throw new VerificationFailedError({
-                                    reason: 'Sponsored transaction from this sender is already in flight',
-                                });
-                            }
-                            sponsoredSenderReservation = {
-                                chainId: reservationChainId,
-                                sender: transaction.from,
-                            };
-                            FeePayer.validateCalls(transaction.calls, { amount, currency, recipient }, { currency, expectedTransfers: transfers });
-                        }
                         const allowedFeeTokens = FeePayer.defaultAllowedFeeTokens(chainId);
                         if (isFeePayerTx)
                             FeePayer.assertAllowedFeeToken(transaction, allowedFeeTokens);
                         const selectableFeeTokens = allowedFeeTokens;
-                        const serializedTransaction_final = await (async () => {
+                        const completedTransaction = await (async () => {
                             if (feePayerAccount && methodDetails?.feePayer !== false) {
                                 const completed = await FeePayer.preflightSponsorship({
                                     transaction,
@@ -339,7 +389,7 @@ export function charge(parameters = {}) {
                                             challengeExpires: expires,
                                             chainId: chainId ?? client.chain.id,
                                             details: { amount, currency, recipient },
-                                            policy: feePayerPolicy,
+                                            policy: transactionFeePayerPolicy,
                                             transaction: {
                                                 ...transaction,
                                                 ...(feeToken ? { feeToken } : {}),
@@ -348,7 +398,10 @@ export function charge(parameters = {}) {
                                         return { feePayer: feePayerAccount.address, transaction: sponsored };
                                     },
                                 });
-                                return signTransaction(client, completed.transaction);
+                                return {
+                                    serializedTransaction: await signTransaction(client, completed.transaction),
+                                    sponsor: completed.feePayer,
+                                };
                             }
                             if (feePayerUrl && isFeePayerTx) {
                                 const completed = await FeePayer.preflightSponsorship({
@@ -360,24 +413,73 @@ export function charge(parameters = {}) {
                                             challengeExpires: expires,
                                             chainId: chainId ?? client.chain.id,
                                             details: { amount, currency, recipient },
-                                            policy: feePayerPolicy,
+                                            policy: transactionFeePayerPolicy,
                                             transaction,
                                             url: feePayerUrl,
                                         });
                                         return { ...hosted, transaction };
                                     },
                                 });
-                                return completed.serializedTransaction;
+                                return {
+                                    serializedTransaction: completed.serializedTransaction,
+                                    sponsor: completed.feePayer,
+                                };
                             }
-                            return serializedTransaction;
+                            return { serializedTransaction, sponsor: undefined };
                         })();
+                        const serializedTransaction_final = completedTransaction.serializedTransaction;
+                        finalHash = keccak256(serializedTransaction_final);
+                        if (finalHash.toLowerCase() !== hash.toLowerCase() &&
+                            !(await markHashUsed(store, finalHash)))
+                            throw new VerificationFailedError({
+                                reason: 'Transaction hash has already been used',
+                            });
+                        if (isFeePayerTx) {
+                            const sponsor = completedTransaction.sponsor;
+                            if (!sponsor)
+                                throw new VerificationFailedError({
+                                    reason: 'Sponsored transaction has no configured fee payer',
+                                });
+                            const reservationChainId = chainId ?? client.chain.id;
+                            const { totalFee, validBeforeValue } = FeePayer.assertTransactionPolicy({
+                                challengeExpires: expires,
+                                chainId: reservationChainId,
+                                details: { amount, currency, recipient },
+                                policy: transactionFeePayerPolicy,
+                                transaction,
+                            });
+                            const expiresAt = validBeforeValue * 1_000;
+                            const waitUntil = Math.min(expiresAt, expires ? Date.parse(expires) : Number.MAX_SAFE_INTEGER);
+                            reservation = await SponsorBudget.reserve(sponsorBudgetStore, {
+                                chainId: reservationChainId,
+                                expiresAt,
+                                fee: totalFee,
+                                getReceipt: (transactionHash) => getTransactionReceipt(client, { hash: transactionHash }),
+                                id: finalHash.toLowerCase(),
+                                maxReservations: maxInFlightReservations,
+                                maxTotalFee: maxInFlightTotalFee,
+                                owner: globalThis.crypto.randomUUID(),
+                                sponsor,
+                                transactionHash: finalHash,
+                                waitUntil,
+                            });
+                            Expires.assert(challenge.expires, challenge.id);
+                        }
                         // Pre-broadcast simulation for non-sponsored transactions.
                         if (!isFeePayerTx)
                             await viem_call(client, FeePayer.simulationTransaction(transaction, { feePayer: false }));
+                        if (reservation &&
+                            !(await SponsorBudget.transition(sponsorBudgetStore, reservation, 'broadcasting')))
+                            throw new VerificationFailedError({
+                                reason: 'Sponsor budget reservation ownership was lost before broadcast',
+                            });
+                        broadcastAttempted = true;
                         if (waitForConfirmation) {
                             const receipt = await sendRawTransactionSync(client, {
                                 serializedTransaction: serializedTransaction_final,
                             });
+                            if (reservation)
+                                await SponsorBudget.release(sponsorBudgetStore, reservation);
                             const matchedLogs = await assertTransferLogs(receipt, {
                                 currency,
                                 sender: transaction.from,
@@ -388,17 +490,10 @@ export function charge(parameters = {}) {
                                     challengeId: challenge.id,
                                     realm: challenge.realm,
                                 });
-                            // Post-broadcast dedup: catch malleable input variants
-                            // (different serialized bytes, same underlying tx) that
-                            // bypass the pre-broadcast check. Skip if the broadcast
-                            // hash matches the input hash (already stored above).
-                            if (receipt.transactionHash.toLowerCase() !== hash.toLowerCase() &&
-                                !(await markHashUsed(store, receipt.transactionHash))) {
+                            if (receipt.transactionHash.toLowerCase() !== finalHash.toLowerCase())
                                 throw new VerificationFailedError({
-                                    reason: 'Transaction hash has already been used',
+                                    reason: 'Broadcast transaction hash does not match the signed transaction',
                                 });
-                            }
-                            releaseReservation = false;
                             return toReceipt(receipt);
                         }
                         // Optimistic path: broadcast without waiting for confirmation
@@ -407,14 +502,15 @@ export function charge(parameters = {}) {
                         const reference = await sendRawTransaction(client, {
                             serializedTransaction: serializedTransaction_final,
                         });
-                        // Post-broadcast dedup: same
-                        if (reference.toLowerCase() !== hash.toLowerCase() &&
-                            !(await markHashUsed(store, reference))) {
+                        if (reference.toLowerCase() !== finalHash.toLowerCase())
                             throw new VerificationFailedError({
-                                reason: 'Transaction hash has already been used',
+                                reason: 'Broadcast transaction hash does not match the signed transaction',
+                            });
+                        if (reservation &&
+                            !(await SponsorBudget.transition(sponsorBudgetStore, reservation, 'pending')))
+                            throw new VerificationFailedError({
+                                reason: 'Sponsor budget reservation ownership was lost after broadcast',
                             });
-                        }
-                        releaseReservation = false;
                         return {
                             method: 'tempo',
                             status: 'success',
@@ -423,20 +519,20 @@ export function charge(parameters = {}) {
                         };
                     }
                     catch (error) {
-                        if (releaseReservation)
+                        if (!broadcastAttempted) {
+                            if (reservation)
+                                await SponsorBudget.release(sponsorBudgetStore, reservation);
+                            if (finalHash && finalHash.toLowerCase() !== hash.toLowerCase())
+                                await releaseHashUse(store, finalHash);
                             await releaseHashUse(store, hash);
+                        }
                         throw error;
                     }
-                    finally {
-                        if (sponsoredSenderReservation)
-                            await releaseSponsoredSenderInFlight(store, sponsoredSenderReservation);
-                    }
                 }
-                default:
-                    throw new Error(`Unsupported credential type "${payload.type}".`);
             }
         },
     });
+    return relay ? Relay.configure(method, relay) : method;
 }
 function chargeBinding(request) {
     // Exhaustively destructure so new charge request fields require an explicit binding decision.
@@ -678,10 +774,6 @@ function getHashStoreKey(hash) {
 function getProofStoreKey(challengeId) {
     return `mppx:charge:proof:${challengeId}`;
 }
-/** @internal */
-function getSponsoredSenderStoreKey(parameters) {
-    return `mppx:charge:sponsor:${parameters.chainId}:${parameters.sender.toLowerCase()}`;
-}
 async function markHashUsed(store, hash) {
     return store.update(getHashStoreKey(hash), (current) => {
         if (current !== null)
@@ -704,18 +796,6 @@ function parseHashCredentialSource(parameters) {
     return parsed;
 }
 /** @internal */
-async function markSponsoredSenderInFlight(store, parameters) {
-    return store.update(getSponsoredSenderStoreKey(parameters), (current) => {
-        if (current !== null)
-            return { op: 'noop', result: false };
-        return { op: 'set', value: Date.now(), result: true };
-    });
-}
-/** @internal */
-async function releaseSponsoredSenderInFlight(store, parameters) {
-    await store.delete(getSponsoredSenderStoreKey(parameters));
-}
-/** @internal */
 async function markProofUsed(store, challengeId) {
     return store.update(getProofStoreKey(challengeId), (current) => {
         if (current !== null)
@@ -827,7 +907,7 @@ class MismatchError extends PaymentError {
                 ? reason
                 : `Payment verification failed: ${reason}`,
             ...Object.entries(details).map(([k, v]) => `  - ${k}: ${v}`),
-        ].join('\n'));
+        ].join('\n'), { details });
     }
 }
 //# sourceMappingURL=Charge.js.map