mppx 0.8.17 → 0.8.18

package/src/x402/Types.ts

@@ -1,248 +0,0 @@
-import * as z from '../zod.js'
-
-export const versions = [2] as const
-
-/** mppx method name used for EVM charge challenges backed by x402. */
-export const paymentMethod = 'evm' as const
-
-/** mppx intent name used for EVM charge challenges backed by x402 exact. */
-export const exactIntent = 'charge' as const
-
-export const schemes = ['exact'] as const
-export const assetTransferMethods = ['eip3009', 'permit2'] as const
-
-/** CAIP-2 namespace prefix for EVM networks. */
-export const evmNetworkPrefix = 'eip155:' as const
-
-/** Prefix for synthetic mppx challenge IDs derived from x402 `accepts` entries. */
-export const syntheticChallengeIdPrefix = 'x402:' as const
-
-/** x402 protocol version supported by this package. */
-export type Version = 2
-
-/** mppx payment method name used for EVM charge challenges backed by x402. */
-export type PaymentMethod = typeof paymentMethod
-
-/** mppx intent name used for EVM charge challenges backed by x402 exact. */
-export type ExactIntent = typeof exactIntent
-
-/** x402 scheme supported by this package. */
-export type Scheme = (typeof schemes)[number]
-
-/** x402 exact EVM asset transfer method. */
-export type AssetTransferMethod = (typeof assetTransferMethods)[number]
-
-/** CAIP-2 EVM network identifier. */
-export type EvmNetwork = `${typeof evmNetworkPrefix}${number}`
-
-/** HTTP header carrying a base64-encoded x402 payment-required response. */
-export const paymentRequiredHeader = 'PAYMENT-REQUIRED'
-
-/** HTTP header carrying a base64-encoded x402 payment payload. */
-export const paymentSignatureHeader = 'PAYMENT-SIGNATURE'
-
-/** HTTP header carrying a base64-encoded x402 settlement response. */
-export const paymentResponseHeader = 'PAYMENT-RESPONSE'
-
-const nonEmptyString = z.string().check(z.minLength(1))
-const positiveNumber = z.number().check(z.refine((value) => value > 0, 'Must be positive'))
-const atomicAmount = z.string().check(z.regex(/^\d+$/, 'Invalid atomic amount'))
-const address = z.address()
-const evmNetwork = z
-  .string()
-  .check(
-    z.regex(new RegExp(`^${evmNetworkPrefix}\\d+$`), 'Invalid EVM CAIP-2 network'),
-  ) as z.ZodMiniType<EvmNetwork>
-
-/** Describes the protected resource in x402 v2 payment-required responses. */
-export const ResourceInfoSchema = z.object({
-  description: z.optional(z.string()),
-  iconUrl: z.optional(z.string()),
-  mimeType: z.optional(z.string()),
-  serviceName: z.optional(z.string()),
-  tags: z.optional(z.array(z.string())),
-  url: nonEmptyString,
-})
-
-/** Describes the protected resource in x402 v2 payment-required responses. */
-export type ResourceInfo = z.infer<typeof ResourceInfoSchema>
-
-/** Public transfer configuration for exact EVM payments. */
-export const ExactTransferSchema = z.discriminatedUnion('type', [
-  z.object({
-    name: nonEmptyString,
-    type: z.literal('eip3009'),
-    version: nonEmptyString,
-  }),
-  z.object({
-    name: z.optional(z.string()),
-    type: z.literal('permit2'),
-    version: z.optional(z.string()),
-  }),
-])
-
-/** Public EIP-3009 transfer configuration for exact EVM payments. */
-export type ExactEip3009Transfer = Extract<z.infer<typeof ExactTransferSchema>, { type: 'eip3009' }>
-
-/** Public Permit2 transfer configuration for exact EVM payments. */
-export type ExactPermit2Transfer = Extract<z.infer<typeof ExactTransferSchema>, { type: 'permit2' }>
-
-/** Public transfer configuration for exact EVM payments. */
-export type ExactTransfer = z.infer<typeof ExactTransferSchema>
-
-/** Known asset metadata used to derive x402 wire `extra` fields. */
-export type Asset = {
-  address: `0x${string}`
-  decimals: number
-  transfer: ExactTransfer
-}
-
-/** x402 v2 payment requirements for the `exact` scheme. */
-export const PaymentRequirementsSchema = z.object({
-  amount: atomicAmount,
-  asset: nonEmptyString,
-  extra: z.optional(z.record(z.string(), z.unknown())),
-  maxTimeoutSeconds: positiveNumber,
-  network: evmNetwork,
-  payTo: nonEmptyString,
-  scheme: z.enum(schemes),
-})
-
-/** x402 v2 payment requirements for the `exact` scheme. */
-export type PaymentRequirements = z.infer<typeof PaymentRequirementsSchema>
-
-/** x402 v2 protocol extension value. */
-export const ExtensionSchema = z.object({
-  info: z.record(z.string(), z.unknown()),
-  schema: z.record(z.string(), z.unknown()),
-})
-
-/** x402 v2 protocol extension value. */
-export type Extension = z.infer<typeof ExtensionSchema>
-
-/** x402 v2 protocol extensions map. */
-export const ExtensionsSchema = z.record(z.string(), ExtensionSchema)
-
-/** x402 v2 protocol extensions map. */
-export type Extensions = z.infer<typeof ExtensionsSchema>
-
-/** Public exact EVM route request accepted by `mppx` handlers. */
-export type ExactRequest = PaymentRequirements & {
-  extensions?: Extensions | undefined
-  resource?: ResourceInfo | undefined
-}
-
-/** x402 v2 payment-required response. */
-export const PaymentRequiredSchema = z.object({
-  accepts: z.array(PaymentRequirementsSchema).check(z.minLength(1)),
-  error: z.optional(z.string()),
-  extensions: z.optional(ExtensionsSchema),
-  resource: ResourceInfoSchema,
-  x402Version: z.literal(2),
-})
-
-/** x402 v2 payment-required response. */
-export type PaymentRequired = z.infer<typeof PaymentRequiredSchema>
-
-/** EIP-3009 transferWithAuthorization payload for exact EVM payments. */
-export const ExactEip3009PayloadSchema = z.object({
-  authorization: z.object({
-    from: address,
-    nonce: z.hash(),
-    to: address,
-    validAfter: atomicAmount,
-    validBefore: atomicAmount,
-    value: atomicAmount,
-  }),
-  signature: z.signature(),
-})
-
-/** EIP-3009 transferWithAuthorization payload for exact EVM payments. */
-export type ExactEip3009Payload = z.infer<typeof ExactEip3009PayloadSchema>
-
-/** Permit2 payload for exact EVM payments. */
-export const ExactPermit2PayloadSchema = z.object({
-  permit2Authorization: z.object({
-    deadline: atomicAmount,
-    from: address,
-    nonce: atomicAmount,
-    permitted: z.object({
-      amount: atomicAmount,
-      token: address,
-    }),
-    spender: address,
-    witness: z.object({
-      to: address,
-      validAfter: atomicAmount,
-    }),
-  }),
-  signature: z.signature(),
-})
-
-/** Permit2 payload for exact EVM payments. */
-export type ExactPermit2Payload = z.infer<typeof ExactPermit2PayloadSchema>
-
-/** Exact EVM payment payload body. */
-export const ExactPayloadSchema = z.union([ExactEip3009PayloadSchema, ExactPermit2PayloadSchema])
-
-/** Exact EVM payment payload body. */
-export type ExactPayload = z.infer<typeof ExactPayloadSchema>
-
-/** x402 v2 payment payload. */
-export const PaymentPayloadSchema = z.object({
-  accepted: PaymentRequirementsSchema,
-  extensions: z.optional(ExtensionsSchema),
-  payload: ExactPayloadSchema,
-  resource: z.optional(ResourceInfoSchema),
-  x402Version: z.literal(2),
-})
-
-/** x402 v2 payment payload. */
-export type PaymentPayload = z.infer<typeof PaymentPayloadSchema>
-
-/** Facilitator verification response. */
-export const VerifyResponseSchema = z.object({
-  extensions: z.optional(ExtensionsSchema),
-  extra: z.optional(z.record(z.string(), z.unknown())),
-  invalidMessage: z.optional(z.string()),
-  invalidReason: z.optional(z.string()),
-  isValid: z.boolean(),
-  payer: z.optional(z.string()),
-})
-
-/** Facilitator verification response. */
-export type VerifyResponse = z.infer<typeof VerifyResponseSchema>
-
-/** Facilitator settlement response and x402 `PAYMENT-RESPONSE` body. */
-export const SettleResponseSchema = z.object({
-  amount: z.optional(atomicAmount),
-  errorMessage: z.optional(z.string()),
-  errorReason: z.optional(z.string()),
-  extensions: z.optional(ExtensionsSchema),
-  extra: z.optional(z.record(z.string(), z.unknown())),
-  network: nonEmptyString,
-  payer: z.optional(z.string()),
-  success: z.boolean(),
-  transaction: z.string(),
-})
-
-/** Facilitator settlement response and x402 `PAYMENT-RESPONSE` body. */
-export type SettleResponse = z.infer<typeof SettleResponseSchema>
-
-/** x402 facilitator client interface used by server exact config. */
-export type Facilitator = {
-  settle: (
-    paymentPayload: PaymentPayload,
-    paymentRequirements: PaymentRequirements,
-  ) => Promise<SettleResponse>
-  verify: (
-    paymentPayload: PaymentPayload,
-    paymentRequirements: PaymentRequirements,
-  ) => Promise<VerifyResponse>
-}
-
-/** Extracts x402 `PaymentRequirements` from a canonical exact request. */
-export function toPaymentRequirements(request: ExactRequest): PaymentRequirements {
-  const { extensions: _extensions, resource: _resource, ...paymentRequirements } = request
-  return PaymentRequirementsSchema.parse(paymentRequirements)
-}

package/src/x402/client/Exact.test.ts

@@ -1,309 +0,0 @@
-import { Challenge } from 'mppx'
-import type { Account } from 'viem'
-import { tokens } from 'viem/tokens'
-import { describe, expect, test, vi } from 'vp/test'
-
-import * as Chains from '../../evm/Chains.js'
-import * as Assets from '../Assets.js'
-import * as Header from '../Header.js'
-import * as RouteBinding from '../internal/RouteBinding.js'
-import * as Types from '../Types.js'
-import { createCredential } from './Exact.js'
-
-type X402Challenge = Parameters<typeof createCredential>[0]['challenge']
-
-const account = {
-  address: '0x1111111111111111111111111111111111111111',
-  signTypedData: vi.fn(async () => '0x1234'),
-} as unknown as Account
-const usdc = Assets.define({
-  address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-  decimals: 6,
-  network: 'eip155:84532',
-  transfer: {
-    name: 'USDC',
-    type: 'eip3009',
-    version: '2',
-  },
-})
-
-describe('x402 exact credential helper', () => {
-  test('enforces max amount, network, and currency policy before signing', async () => {
-    const config = {
-      account,
-      currencies: [usdc],
-      maxAmount: '0.01',
-      networks: [Chains.baseSepolia],
-    } as const
-
-    await expect(
-      createCredential({
-        challenge: challenge({ amount: '10001' }),
-        config,
-        context: {},
-      }),
-    ).rejects.toThrow('x402 exact amount exceeds maxAmount.')
-
-    await expect(
-      createCredential({
-        challenge: challenge({ network: 'eip155:8453' }),
-        config,
-        context: {},
-      }),
-    ).rejects.toThrow('x402 exact chain ID is not allowed: 8453.')
-
-    await expect(
-      createCredential({
-        challenge: challenge({ asset: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913' }),
-        config,
-        context: {},
-      }),
-    ).rejects.toThrow(
-      'x402 exact currency is not allowed: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913.',
-    )
-
-    expect(account.signTypedData).not.toHaveBeenCalled()
-  })
-
-  test('requires network policy for raw hex currencies', async () => {
-    await expect(
-      createCredential({
-        challenge: challenge(),
-        config: {
-          account,
-          currencies: [usdc.address],
-          maxAmount: '0.01',
-        },
-        context: {},
-      }),
-    ).rejects.toThrow('x402 exact raw currency allowlists require networks.')
-  })
-
-  test('uses known asset metadata for currency policy and maxAmount decimals', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    const credential = await createCredential({
-      challenge: challenge(),
-      config: {
-        account: {
-          ...account,
-          signTypedData,
-        } as unknown as Account,
-        currencies: [Assets.baseSepolia.USDC],
-        maxAmount: '0.01',
-      },
-      context: {},
-    })
-    const paymentPayload = Header.decodePaymentSignature(credential)
-
-    expect(signTypedData).toHaveBeenCalledOnce()
-    expect(paymentPayload.accepted.asset).toBe(Assets.baseSepolia.USDC.address)
-  })
-
-  test('pins known asset currency policy to its network', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    await expect(
-      createCredential({
-        challenge: challenge({ network: 'eip155:8453' }),
-        config: {
-          account: {
-            ...account,
-            signTypedData,
-          } as unknown as Account,
-          currencies: [Assets.baseSepolia.USDC],
-          maxAmount: '0.01',
-        },
-        context: {},
-      }),
-    ).rejects.toThrow(
-      'x402 exact currency is not allowed: 0x036CbD53842c5426634e7929541eC2318f3dCF7e.',
-    )
-    expect(signTypedData).not.toHaveBeenCalled()
-  })
-
-  test('accepts viem token sets for currency policy and decimals', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    const credential = await createCredential({
-      challenge: challenge({ amount: '1000000' }),
-      config: {
-        account: {
-          ...account,
-          signTypedData,
-        } as unknown as Account,
-        currencies: tokens.popular,
-        maxAmount: '1',
-      },
-      context: {},
-    })
-    const paymentPayload = Header.decodePaymentSignature(credential)
-
-    expect(signTypedData).toHaveBeenCalledOnce()
-    expect(paymentPayload.accepted.asset).toBe(Assets.baseSepolia.USDC.address)
-  })
-
-  test('uses viem token decimals for maxAmount policy', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    await expect(
-      createCredential({
-        challenge: challenge({ amount: '1000001' }),
-        config: {
-          account: {
-            ...account,
-            signTypedData,
-          } as unknown as Account,
-          currencies: tokens.popular,
-          maxAmount: '1',
-        },
-        context: {},
-      }),
-    ).rejects.toThrow('x402 exact amount exceeds maxAmount.')
-    expect(signTypedData).not.toHaveBeenCalled()
-  })
-
-  test('accepts viem token sets through legacy assets policy', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    const credential = await createCredential({
-      challenge: challenge({ amount: '1000000' }),
-      config: {
-        account: {
-          ...account,
-          signTypedData,
-        } as unknown as Account,
-        assets: tokens.popular,
-        maxAmount: '1',
-      },
-      context: {},
-    })
-
-    expect(signTypedData).toHaveBeenCalledOnce()
-    expect(Header.decodePaymentSignature(credential).accepted.asset).toBe(
-      Assets.baseSepolia.USDC.address,
-    )
-  })
-
-  test('pins viem token currency policy to available networks', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-
-    await expect(
-      createCredential({
-        challenge: challenge({ network: 'eip155:999999' }),
-        config: {
-          account: {
-            ...account,
-            signTypedData,
-          } as unknown as Account,
-          currencies: tokens.popular,
-          maxAmount: '1',
-        },
-        context: {},
-      }),
-    ).rejects.toThrow(
-      'x402 exact currency is not allowed: 0x036CbD53842c5426634e7929541eC2318f3dCF7e.',
-    )
-    expect(signTypedData).not.toHaveBeenCalled()
-  })
-
-  test('signs EIP-3009 exact payment payloads', async () => {
-    const signTypedData = vi.fn(async () => '0x1234')
-    const config = {
-      account: {
-        ...account,
-        signTypedData,
-      } as unknown as Account,
-      currencies: [usdc],
-      maxAmount: '0.01',
-      networks: [Chains.baseSepolia],
-    } as const
-
-    const credential = await createCredential({
-      challenge: challenge(),
-      config,
-      context: {},
-    })
-    const paymentPayload = Header.decodePaymentSignature(credential)
-
-    expect(signTypedData).toHaveBeenCalledOnce()
-    expect(paymentPayload.x402Version).toBe(2)
-    expect(paymentPayload.accepted.scheme).toBe('exact')
-    expect('authorization' in paymentPayload.payload).toBe(true)
-    if (!('authorization' in paymentPayload.payload)) throw new Error()
-    expect(paymentPayload.extensions?.mppx?.info.method).toBe('GET')
-    expect(paymentPayload.extensions?.mppx?.info.nonce).toMatch(/^[0-9a-f]{64}$/)
-    expect(paymentPayload.payload.authorization.nonce).toBe(
-      RouteBinding.nonce({
-        accepted: paymentPayload.accepted,
-        extensions: paymentPayload.extensions!,
-        resource: paymentPayload.resource!,
-      }),
-    )
-    expect(paymentPayload.payload.signature).toBe('0x1234')
-  })
-
-  test('uses a fresh route-bound nonce for repeated payments', async () => {
-    const config = {
-      account,
-      currencies: [usdc],
-      maxAmount: '0.01',
-      networks: [Chains.baseSepolia],
-    } as const
-
-    const first = Header.decodePaymentSignature(
-      await createCredential({
-        challenge: challenge(),
-        config,
-        context: {},
-      }),
-    )
-    const second = Header.decodePaymentSignature(
-      await createCredential({
-        challenge: challenge(),
-        config,
-        context: {},
-      }),
-    )
-
-    expect(first.extensions?.mppx?.info.nonce).not.toBe(second.extensions?.mppx?.info.nonce)
-    if (!('authorization' in first.payload) || !('authorization' in second.payload))
-      throw new Error()
-    expect(first.payload.authorization.nonce).not.toBe(second.payload.authorization.nonce)
-  })
-})
-
-function challenge(overrides: Partial<Types.PaymentRequirements> = {}): X402Challenge {
-  return Challenge.from({
-    id: 'x402-test',
-    intent: 'charge',
-    method: 'evm',
-    realm: 'example.com',
-    request: {
-      amount: '10000',
-      asset: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',
-      extra: {
-        assetTransferMethod: 'eip3009',
-        name: 'USDC',
-        version: '2',
-      },
-      maxTimeoutSeconds: 60,
-      network: 'eip155:84532',
-      payTo: '0x2222222222222222222222222222222222222222',
-      scheme: 'exact',
-      extensions: {
-        mppx: {
-          info: { method: 'GET' },
-          schema: {
-            additionalProperties: false,
-            properties: { method: { type: 'string' }, nonce: { type: 'string' } },
-            required: ['method'],
-            type: 'object',
-          },
-        },
-      },
-      resource: { url: 'https://example.com/paid' },
-      ...overrides,
-    },
-  }) as X402Challenge
-}