mppx 0.8.13 → 0.8.15

package/src/tempo/session/precompile/Chain.ts

@@ -1,5 +1,5 @@
 import type { Account, Address, Client, Hex } from 'viem'
-import { encodeFunctionData, isAddressEqual, parseEventLogs } from 'viem'
+import { decodeFunctionData, encodeFunctionData, isAddressEqual, parseEventLogs } from 'viem'
 import {
   call,
   prepareTransactionRequest,
@@ -10,7 +10,7 @@ import {
   signTransaction,
   waitForTransactionReceipt,
 } from 'viem/actions'
-import { Transaction } from 'viem/tempo'
+import { Abis, Addresses, Transaction } from 'viem/tempo'
 
 import { BadRequestError, VerificationFailedError } from '../../../Errors.js'
 import * as FeePayer from '../../internal/fee-payer.js'
@@ -401,6 +401,7 @@ export type ChannelTransactionOptions = {
 
 type ParsedPrecompileCredentialTransaction = {
   call: Transaction.TransactionTempo['calls'][number] & { data: Hex; to: Address }
+  prefixCalls: readonly Transaction.TransactionTempo['calls'][number][]
   transaction: ReturnType<(typeof Transaction)['deserialize']>
 }
 
@@ -418,11 +419,11 @@ function parsePrecompileCredentialTransaction(parameters: {
     serializedTransaction as Transaction.TransactionSerializedTempo,
   )
   const calls = transaction.calls
-  if (calls.length !== 1)
+  if (calls.length !== 1 && calls.length !== 3)
     throw new VerificationFailedError({
-      reason: `TIP-1034 ${label} transaction must contain exactly one call`,
+      reason: `TIP-1034 ${label} transaction must contain one management call, optionally preceded by an auto-swap`,
     })
-  const call = calls[0]!
+  const call = calls[calls.length - 1]!
   if (!call.to || !isAddressEqual(call.to, escrowContract))
     throw new VerificationFailedError({
       reason: `TIP-1034 ${label} transaction targets the wrong address`,
@@ -431,7 +432,88 @@ function parsePrecompileCredentialTransaction(parameters: {
     throw new VerificationFailedError({
       reason: `TIP-1034 ${label} transaction is missing calldata`,
     })
-  return { transaction, call: { ...call, data: call.data, to: call.to } }
+  return {
+    transaction,
+    call: { ...call, data: call.data, to: call.to },
+    prefixCalls: calls.slice(0, -1),
+  }
+}
+
+function validateAutoSwapPrefix(parameters: {
+  amountOut: bigint
+  currency: Address
+  label: 'open' | 'topUp'
+  prefixCalls: readonly Transaction.TransactionTempo['calls'][number][]
+}) {
+  const { amountOut, currency, label, prefixCalls } = parameters
+  if (prefixCalls.length === 0) return
+
+  const fail = (reason: string): never => {
+    throw new VerificationFailedError({ reason: `TIP-1034 ${label} auto-swap ${reason}` })
+  }
+  if (prefixCalls.length !== 2) fail('must contain exactly approve and swap calls')
+
+  const approveCall = prefixCalls[0]!
+  const swapCall = prefixCalls[1]!
+  const approveTo = approveCall.to
+  const approveData = approveCall.data
+  const swapTo = swapCall.to
+  const swapData = swapCall.data
+  if (!approveTo || !approveData || !swapTo || !swapData)
+    fail('call is missing a target or calldata')
+  const checkedApproveTo = approveTo as Address
+  const checkedApproveData = approveData as Hex
+  const checkedSwapTo = swapTo as Address
+  const checkedSwapData = swapData as Hex
+  if ((approveCall.value ?? 0n) !== 0n || (swapCall.value ?? 0n) !== 0n)
+    fail('calls must not transfer native value')
+  if (!isAddressEqual(checkedSwapTo, Addresses.stablecoinDex)) fail('targets the wrong DEX')
+
+  const approve = (() => {
+    try {
+      return decodeFunctionData({ abi: Abis.tip20, data: checkedApproveData })
+    } catch {
+      return fail('approval calldata is invalid')
+    }
+  })()
+  const swap = (() => {
+    try {
+      return decodeFunctionData({ abi: Abis.stablecoinDex, data: checkedSwapData })
+    } catch {
+      return fail('swap calldata is invalid')
+    }
+  })()
+  if (approve.functionName !== 'approve' || swap.functionName !== 'swapExactAmountOut')
+    fail('must contain approve followed by swapExactAmountOut')
+
+  const [spender, approvedAmount] = approve.args as readonly [Address, bigint]
+  const [tokenIn, tokenOut, swapAmountOut, maxAmountIn] = swap.args as readonly [
+    Address,
+    Address,
+    bigint,
+    bigint,
+  ]
+  if (!isAddressEqual(checkedApproveTo, tokenIn)) fail('approval token does not match swap input')
+  if (!isAddressEqual(spender, Addresses.stablecoinDex)) fail('approval spender is not the DEX')
+  if (approvedAmount !== maxAmountIn) fail('approval amount does not match swap maximum input')
+  if (!isAddressEqual(tokenOut, currency)) fail('output token does not match channel currency')
+  if (swapAmountOut !== amountOut) fail('output amount does not match channel deposit')
+  if (isAddressEqual(tokenIn, tokenOut)) fail('input and output tokens must differ')
+
+  const canonicalApprove = encodeFunctionData({
+    abi: Abis.tip20,
+    functionName: 'approve',
+    args: [spender, approvedAmount],
+  })
+  const canonicalSwap = encodeFunctionData({
+    abi: Abis.stablecoinDex,
+    functionName: 'swapExactAmountOut',
+    args: [tokenIn, tokenOut, swapAmountOut, maxAmountIn],
+  })
+  if (checkedApproveData.toLowerCase() !== canonicalApprove.toLowerCase())
+    fail('approval calldata is not canonical')
+  if (checkedSwapData.toLowerCase() !== canonicalSwap.toLowerCase())
+    fail('swap calldata is not canonical')
 }
 
 async function simulateTempoTransaction(client: Client, request: unknown) {
@@ -796,7 +878,7 @@ export type BroadcastOpenTransactionParameters = {
 export async function broadcastOpenTransaction(
   parameters: BroadcastOpenTransactionParameters,
 ): Promise<BroadcastOpenTransactionResult> {
-  const { transaction, call } = parsePrecompileCredentialTransaction({
+  const { transaction, call, prefixCalls } = parsePrecompileCredentialTransaction({
     escrowContract: parameters.escrowContract,
     feePayer: parameters.feePayer,
     label: 'open',
@@ -812,6 +894,12 @@ export async function broadcastOpenTransaction(
       authorizedSigner: parameters.expectedAuthorizedSigner,
     },
   })
+  validateAutoSwapPrefix({
+    amountOut: open.deposit,
+    currency: parameters.expectedCurrency,
+    label: 'open',
+    prefixCalls,
+  })
   const descriptor = ChannelOps.descriptorFromOpen({
     chainId: parameters.chainId,
     escrow: parameters.escrowContract,
@@ -920,7 +1008,7 @@ export type BroadcastTopUpTransactionParameters = {
 export async function broadcastTopUpTransaction(
   parameters: BroadcastTopUpTransactionParameters,
 ): Promise<BroadcastTopUpTransactionResult> {
-  const { transaction, call } = parsePrecompileCredentialTransaction({
+  const { transaction, call, prefixCalls } = parsePrecompileCredentialTransaction({
     escrowContract: parameters.escrowContract,
     feePayer: parameters.feePayer,
     label: 'topUp',
@@ -933,6 +1021,12 @@ export async function broadcastTopUpTransaction(
       additionalDeposit: parameters.additionalDeposit,
     },
   })
+  validateAutoSwapPrefix({
+    amountOut: parameters.additionalDeposit,
+    currency: parameters.expectedCurrency,
+    label: 'topUp',
+    prefixCalls,
+  })
   const receipt = await sendCredentialTransaction({
     challengeExpires: parameters.challengeExpires,
     chainId: parameters.chainId,

package/src/tempo/session/precompile/Channel.test.ts

@@ -27,6 +27,15 @@ const transaction = {
 } as const satisfies Channel.ExpiringNonceTransaction
 
 describe('precompile Channel.computeId', () => {
+  test('uses the payer when the descriptor delegates to the zero address', () => {
+    expect(
+      Channel.resolveAuthorizedSigner({
+        ...descriptor,
+        authorizedSigner: '0x0000000000000000000000000000000000000000',
+      }),
+    ).toBe(descriptor.payer)
+  })
+
   test('returns deterministic 32-byte hash for fixed inputs', () => {
     const id = Channel.computeId({ ...descriptor, chainId })
     expect(Channel.computeId({ ...descriptor, chainId })).toBe(id)

package/src/tempo/session/precompile/Channel.ts

@@ -9,6 +9,11 @@ import type { ChannelDescriptor } from './Protocol.js'
 /** Re-export of the TIP-1034 channel descriptor shape. */
 export type { ChannelDescriptor } from './Protocol.js'
 
+/** Resolves the descriptor's effective voucher signer; zero delegates to the payer. */
+export function resolveAuthorizedSigner(descriptor: ChannelDescriptor): Address {
+  return BigInt(descriptor.authorizedSigner) === 0n ? descriptor.payer : descriptor.authorizedSigner
+}
+
 /** Tempo transaction shape used to derive the TIP-1034 `expiringNonceHash`. */
 export type ExpiringNonceTransaction = (
   | z_TransactionSerializableTempo

package/src/tempo/session/server/RequestState.test.ts

@@ -544,10 +544,17 @@ describe('SessionSnapshotHints', () => {
       }
     })
 
-    test('omits hints for missing, non-precompile, or finalized channels', async () => {
+    test('omits hints for missing, non-precompile, closing, or finalized channels', async () => {
       await expect(
         resolveSessionSnapshot({ amount: 1n, channelId, store: store(null) }),
       ).resolves.toBe(undefined)
+      await expect(
+        resolveSessionSnapshot({
+          amount: 1n,
+          channelId,
+          store: store(channel({ closeRequestedAt: 1n })),
+        }),
+      ).resolves.toBe(undefined)
       await expect(
         resolveSessionSnapshot({
           amount: 1n,

package/src/tempo/session/server/RequestState.ts

@@ -143,6 +143,7 @@ export async function resolveSessionSnapshot(
   const channel = await store.getChannel(ChannelStore.normalizeChannelId(channelId))
   if (!channel || !ChannelStore.isPrecompileState(channel)) return undefined
   if (channel.finalized) return undefined
+  if (channel.closeRequestedAt !== 0n) return undefined
   if (!channel.highestVoucher) return undefined
   if (channel.highestVoucher.cumulativeAmount !== channel.highestVoucherAmount) return undefined
   if (expected && !matchesSnapshotPaymentFields(channel, expected)) return undefined
@@ -151,8 +152,7 @@ export async function resolveSessionSnapshot(
     acceptedCumulative: channel.highestVoucherAmount.toString(),
     chainId: channel.chainId,
     channelId: channel.channelId,
-    closeRequestedAt:
-      channel.closeRequestedAt === 0n ? undefined : channel.closeRequestedAt.toString(),
+    closeRequestedAt: undefined,
     deposit: channel.deposit.toString(),
     descriptor: channel.descriptor,
     escrow: channel.escrowContract,

package/src/tempo/session/server/Session.test.ts

@@ -2421,12 +2421,15 @@ describe('precompile server session unit guardrails', () => {
   })
 
   describe('WebSocket parity', () => {
-    async function createManagedWsHarness(options: { maxDeposit?: bigint } = {}) {
+    async function createManagedWsHarness(
+      options: { challengeTtlMs?: number; maxDeposit?: bigint } = {},
+    ) {
       const rawStore = Store.memory()
+      let challengeRequests = 0
       let currentPayload: SessionCredentialPayload | undefined
       let voucherPosts = 0
       const maxDeposit = options.maxDeposit ?? 3n
-      const routeHandler = Mppx_server.create({
+      const payment = Mppx_server.create({
         methods: [
           tempo_server.session({
             amount: '1',
@@ -2463,7 +2466,7 @@ describe('precompile server session unit guardrails', () => {
         ],
         realm: 'api.example.com',
         secretKey: 'test-secret-key-test-secret-key-32',
-      }).session({ amount: '1', decimals: 0, suggestedDeposit: maxDeposit.toString() })
+      })
 
       const route = async (request: Request) => {
         currentPayload = undefined
@@ -2472,7 +2475,15 @@ describe('precompile server session unit guardrails', () => {
             currentPayload = Credential.fromRequest<SessionCredentialPayload>(request).payload
             if (currentPayload.action === 'voucher') voucherPosts++
           } catch {}
-        }
+        } else challengeRequests++
+        const routeHandler = payment.session({
+          amount: '1',
+          decimals: 0,
+          suggestedDeposit: maxDeposit.toString(),
+          ...(options.challengeTtlMs === undefined
+            ? {}
+            : { expires: new Date(Date.now() + options.challengeTtlMs) }),
+        })
         return routeHandler(request)
       }
 
@@ -2510,6 +2521,9 @@ describe('precompile server session unit guardrails', () => {
         get port() {
           return port
         },
+        get challengeRequests() {
+          return challengeRequests
+        },
         get voucherPosts() {
           return voucherPosts
         },
@@ -2520,6 +2534,54 @@ describe('precompile server session unit guardrails', () => {
       }
     }
 
+    test('refreshes an expired challenge before sending a later websocket voucher', async () => {
+      const harness = await createManagedWsHarness({ challengeTtlMs: 2_000, maxDeposit: 2n })
+      harness.wsServer.on('connection', (socket: import('ws').WebSocket) => {
+        void TempoWs.serve({
+          socket,
+          store: harness.rawStore,
+          url: `${harness.server.url}/ws`,
+          route: harness.route,
+          generate: async function* (stream: TempoWs.SessionController) {
+            await stream.charge()
+            yield 'chunk-1'
+            await new Promise((resolve) => setTimeout(resolve, 2_200))
+            await stream.charge()
+            yield 'chunk-2'
+          },
+        })
+      })
+
+      try {
+        const manager = precompileSessionManager({
+          account: payer,
+          client: createSigningClient(),
+          decimals: 0,
+          fetch: globalThis.fetch,
+          maxDeposit: '2',
+          webSocket: WebSocket as never,
+        })
+        const ws = await manager.ws(`ws://localhost:${harness.port}/ws`)
+        const chunks: string[] = []
+
+        await new Promise<void>((resolve, reject) => {
+          ws.addEventListener('message', (event) => {
+            if (typeof event.data === 'string') chunks.push(event.data)
+          })
+          ws.addEventListener('close', () => resolve(), { once: true })
+          ws.addEventListener('error', () => reject(new Error('websocket stream failed')), {
+            once: true,
+          })
+        })
+
+        expect(chunks).toEqual(['chunk-1', 'chunk-2'])
+        expect(harness.challengeRequests).toBeGreaterThan(1)
+        expect(harness.voucherPosts).toBe(1)
+      } finally {
+        harness.close()
+      }
+    })
+
     test('open -> stream -> need-voucher -> resume -> close', async () => {
       const harness = await createManagedWsHarness({ maxDeposit: 3n })
       harness.wsServer.on('connection', (socket: import('ws').WebSocket) => {

package/src/tempo/session/server/Ws.ts

@@ -220,6 +220,9 @@ export async function serve(options: serve.Options): Promise<void> {
     }
 
     const { receipt } = authorizationResult
+    if (payload.action === 'voucher' && runtime.streamContext) {
+      runtime.streamContext.challengeId = credential.challenge.id
+    }
     await send(socket, formatReceiptMessage(receipt))
 
     if (payload.action === 'close') {

package/src/tempo/subscription/KeyAuthorization.test.ts

@@ -1,4 +1,5 @@
-import { KeyAuthorization } from 'ox/tempo'
+import { Rlp } from 'ox'
+import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo'
 import { privateKeyToAccount } from 'viem/accounts'
 import { describe, expect, test } from 'vp/test'
 
@@ -69,6 +70,25 @@ async function createPayload(request = parseRequest()) {
   } as const
 }
 
+function serializeCompositeSignature(
+  type: 'keychain' | 'multisig',
+  inner: SignatureEnvelope.Primitive,
+) {
+  return SignatureEnvelope.serialize(
+    type === 'keychain'
+      ? {
+          inner,
+          type,
+          userAddress: rootAccount.address,
+        }
+      : {
+          account: rootAccount.address,
+          signatures: [inner],
+          type,
+        },
+  )
+}
+
 describe('tempo subscription key authorization', () => {
   test('signs and verifies a scoped key authorization', async () => {
     const request = parseRequest()
@@ -87,6 +107,55 @@ describe('tempo subscription key authorization', () => {
     )
   })
 
+  test.each(['keychain', 'multisig'] as const)(
+    'rejects %s authorization signatures',
+    async (type) => {
+      const request = parseRequest()
+
+      await expect(
+        signSubscriptionKeyAuthorization({
+          accessKey,
+          account: {
+            async sign({ hash }) {
+              const inner = SignatureEnvelope.from(await rootAccount.sign({ hash }))
+              if (inner.type === 'keychain' || inner.type === 'multisig') {
+                throw new Error('expected primitive signature')
+              }
+              return serializeCompositeSignature(type, inner)
+            },
+          },
+          chainId: 4217,
+          request,
+        }),
+      ).rejects.toThrow('keyAuthorization must use a primitive signature')
+    },
+  )
+
+  test.each(['keychain', 'multisig'] as const)(
+    'rejects serialized %s authorization signatures',
+    async (type) => {
+      const request = parseRequest()
+      const payload = await createPayload(request)
+      const authorization = KeyAuthorization.deserialize(payload.signature)
+      const [authorizationTuple] = KeyAuthorization.toTuple(authorization)
+
+      expect(() =>
+        verifySubscriptionKeyAuthorization({
+          accessKey,
+          chainId: 4217,
+          payload: {
+            ...payload,
+            signature: Rlp.fromHex([
+              authorizationTuple,
+              serializeCompositeSignature(type, authorization.signature!),
+            ]),
+          },
+          request,
+        }),
+      ).toThrow('keyAuthorization must use a primitive signature')
+    },
+  )
+
   test('builds wallet allowed calls from the subscription request', () => {
     const request = parseRequest()
 

package/src/tempo/subscription/KeyAuthorization.ts

@@ -168,8 +168,14 @@ export async function signSubscriptionKeyAuthorization(parameters: {
   const signature = await account.sign({
     hash: KeyAuthorization.getSignPayload(authorization),
   })
+  const signatureEnvelope = SignatureEnvelope.from(signature)
+  if (signatureEnvelope.type === 'keychain' || signatureEnvelope.type === 'multisig') {
+    throw new VerificationFailedError({
+      reason: 'keyAuthorization must use a primitive signature',
+    })
+  }
   return KeyAuthorization.from(authorization, {
-    signature: SignatureEnvelope.from(signature),
+    signature,
   })
 }
 
@@ -238,14 +244,19 @@ function createUnsignedAuthorization(parameters: {
 function deserializeAuthorization(signature: `0x${string}`) {
   try {
     return KeyAuthorization.deserialize(signature)
-  } catch {
+  } catch (error) {
+    if (error instanceof KeyAuthorization.InvalidSignatureTypeError) {
+      throw new VerificationFailedError({
+        reason: 'keyAuthorization must use a primitive signature',
+      })
+    }
     throw new VerificationFailedError({ reason: 'invalid keyAuthorization payload' })
   }
 }
 
 function getPrimitiveSignature(authorization: Authorization) {
   const signature = authorization.signature
-  if (!signature || signature.type === 'keychain') {
+  if (!signature) {
     throw new VerificationFailedError({
       reason: 'keyAuthorization must use a primitive signature',
     })

package/src/viem/Client.test.ts

@@ -2,7 +2,7 @@ import { createClient, custom, defineChain, type Hex } from 'viem'
 import { privateKeyToAccount } from 'viem/accounts'
 import { signTransaction } from 'viem/actions'
 import { Account as TempoAccount, Transaction } from 'viem/tempo'
-import { tempoLocalnet } from 'viem/tempo/chains'
+import { tempo as tempoMainnetChain, tempoLocalnet, tempoModerato } from 'viem/tempo/chains'
 import { afterEach, describe, expect, test, vi } from 'vp/test'
 
 import * as Client from './Client.js'
@@ -48,6 +48,23 @@ describe('getResolver', () => {
     expect(client.chain?.name).toBe('test')
   })
 
+  test('behavior: resolves the correct named Tempo chain even when the default chain differs', async () => {
+    const getClient = Client.getResolver({
+      // Default chain is mainnet, but the resolved chain ID below is testnet.
+      chain: tempoMainnetChain as never,
+      rpcUrl: {
+        [tempoMainnetChain.id]: 'https://rpc.example.com',
+        [tempoModerato.id]: 'https://rpc2.example.com',
+      },
+    })
+
+    const client = await getClient({ chainId: tempoModerato.id })
+
+    expect(client.chain?.id).toBe(tempoModerato.id)
+    expect(client.chain?.name).toBe(tempoModerato.name)
+    expect(client.chain?.name).not.toBe(tempoMainnetChain.name)
+  })
+
   test('error: throws when no rpcUrl provided', () => {
     const getClient = Client.getResolver({})
 

package/src/viem/Client.ts

@@ -1,8 +1,14 @@
 import { type Chain, type Client, createClient, createTransport, custom, http } from 'viem'
 import { withFeePayer } from 'viem/tempo'
+import { tempo as tempoMainnetChain, tempoModerato } from 'viem/tempo/chains'
 
 import type { MaybePromise } from '../internal/types.js'
 
+const knownTempoChains: Record<number, Chain> = {
+  [tempoMainnetChain.id]: tempoMainnetChain,
+  [tempoModerato.id]: tempoModerato,
+}
+
 export function getResolver(
   parameters: getResolver.Parameters & {
     /** Default chain to use if not provided. */
@@ -73,7 +79,7 @@ export function getResolver(
     if (!url) throw new Error(`No \`rpcUrl\` configured for \`chainId\` (${resolvedChainId}).`)
     const transport = feePayerUrl ? withFeePayer(http(url), http(feePayerUrl)) : http(url)
     return createClient({
-      chain: { ...chain, id: resolvedChainId } as never,
+      chain: (knownTempoChains[resolvedChainId] ?? { ...chain, id: resolvedChainId }) as never,
       transport,
     })
   }