mppx 0.8.17 → 0.8.18

package/dist/tempo/internal/machine-token-session.js

@@ -0,0 +1,173 @@
+import { SignatureEnvelope } from 'ox/tempo';
+import { hashTypedData, isAddressEqual, parseAbi, zeroAddress, } from 'viem';
+import { readContract, signTypedData } from 'viem/actions';
+import { Actions } from 'viem/tempo';
+import { isAccessKeyAccount } from './account.js';
+import * as defaults from './defaults.js';
+import { parseCanonicalEnvelope, serializeCanonicalEnvelope } from './signature-envelope.js';
+const sessionRouteAbi = parseAbi([
+    'function sessionRouteFor(address merchant,address targetToken) view returns (address routeAddress)',
+    'function sessionRoutes(address routeAddress) view returns (address merchant,address targetToken)',
+]);
+const authorizationTypes = {
+    SessionAuthorization: [
+        { name: 'channelId', type: 'bytes32' },
+        { name: 'cumulativeAmount', type: 'uint96' },
+    ],
+};
+function getDeployment(chainId) {
+    if (chainId === undefined)
+        return undefined;
+    return defaults.machineToken[chainId];
+}
+/** Returns whether a unified machine-token router is configured on a chain. */
+export function isSupported(chainId) {
+    return !!getDeployment(chainId);
+}
+/** Matches a session descriptor to the configured router and machine token. */
+export function matchDeployment(parameters) {
+    const deployment = getDeployment(parameters.chainId);
+    return deployment &&
+        isAddressEqual(parameters.descriptor.operator, deployment.swap) &&
+        isAddressEqual(parameters.descriptor.token, deployment.token)
+        ? deployment
+        : undefined;
+}
+/** Returns whether an authenticated session challenge permits the machine-token rail. */
+export function isEnabledChallenge(challenge) {
+    return (challenge.request.methodDetails
+        ?.machineTokenEnabled === true);
+}
+/** Resolves the fee token from the payment token and an optional explicit override. */
+export function resolveFeeToken(parameters) {
+    if (parameters.override)
+        return parameters.override;
+    const deployment = getDeployment(parameters.chainId);
+    if (deployment && isAddressEqual(parameters.paymentToken, deployment.token))
+        return defaults.tokens.pathUsd;
+    return parameters.paymentToken;
+}
+/**
+ * Resolves the fee tokens accepted for direct-rail sponsored transactions.
+ * Clients released before the fee-token advertisement always pay sponsored
+ * fees in the payment token, so it stays accepted alongside a configured
+ * override. Machine-rail routes post-date the advertisement and pin a single
+ * token via {@link resolveFeeToken}.
+ */
+export function allowedSponsoredFeeTokens(parameters) {
+    const feeToken = resolveFeeToken(parameters);
+    if (isAddressEqual(feeToken, parameters.paymentToken))
+        return [feeToken];
+    return [feeToken, parameters.paymentToken];
+}
+/** Returns whether an account has enough of a TIP-20 token for an operation. */
+export async function hasSufficientBalance(client, parameters) {
+    try {
+        const balance = await readContract(client, Actions.token.getBalance.call(client, {
+            account: parameters.account,
+            token: parameters.token,
+        }));
+        return balance >= parameters.amount;
+    }
+    catch {
+        return false;
+    }
+}
+function authorizationDomain(router, chainId) {
+    return {
+        name: 'MachineUSD Session Router',
+        version: '1',
+        chainId,
+        verifyingContract: router,
+    };
+}
+function hashAuthorization(parameters) {
+    return hashTypedData({
+        domain: authorizationDomain(parameters.router, parameters.chainId),
+        types: authorizationTypes,
+        primaryType: 'SessionAuthorization',
+        message: parameters.authorization,
+    });
+}
+/** Signs a cumulative amount in the router-specific authorization domain. */
+export async function signAuthorization(client, account, parameters) {
+    const signature = isAccessKeyAccount(account)
+        ? await account.sign({
+            hash: hashAuthorization(parameters),
+            raw: true,
+        })
+        : await signTypedData(client, {
+            account,
+            domain: authorizationDomain(parameters.router, parameters.chainId),
+            types: authorizationTypes,
+            primaryType: 'SessionAuthorization',
+            message: parameters.authorization,
+        });
+    return serializeCanonicalEnvelope(signature, 'Machine-token session authorizations');
+}
+/** Verifies a cumulative authorization in the router-specific domain. */
+export function verifyAuthorization(parameters) {
+    try {
+        const envelope = parseCanonicalEnvelope(parameters.signature);
+        if (!envelope)
+            return false;
+        const payload = hashAuthorization(parameters);
+        return SignatureEnvelope.verify(envelope, { address: parameters.expectedSigner, payload });
+    }
+    catch {
+        return false;
+    }
+}
+async function readRoute(client, deployment, parameters) {
+    const payee = parameters.payee ??
+        (await readContract(client, {
+            address: deployment.swap,
+            abi: sessionRouteAbi,
+            functionName: 'sessionRouteFor',
+            args: [parameters.merchant, parameters.targetToken],
+        }));
+    if (isAddressEqual(payee, zeroAddress))
+        return undefined;
+    const [binding, activePayee] = await Promise.all([
+        readContract(client, {
+            address: deployment.swap,
+            abi: sessionRouteAbi,
+            functionName: 'sessionRoutes',
+            args: [payee],
+        }),
+        parameters.active && parameters.payee
+            ? readContract(client, {
+                address: deployment.swap,
+                abi: sessionRouteAbi,
+                functionName: 'sessionRouteFor',
+                args: [parameters.merchant, parameters.targetToken],
+            })
+            : payee,
+    ]);
+    if (isAddressEqual(binding[0], zeroAddress) ||
+        isAddressEqual(binding[1], zeroAddress) ||
+        !isAddressEqual(binding[0], parameters.merchant) ||
+        !isAddressEqual(binding[1], parameters.targetToken) ||
+        !isAddressEqual(activePayee, payee))
+        return undefined;
+    return { operator: deployment.swap, payee, token: deployment.token };
+}
+/** Resolves the active virtual payee and verifies its immutable reverse binding. */
+export async function resolveRoute(client, parameters) {
+    const deployment = getDeployment(parameters.chainId);
+    if (!deployment)
+        return undefined;
+    return readRoute(client, deployment, { ...parameters, active: true });
+}
+/** Verifies a descriptor against the trusted router and merchant payout binding. */
+export async function matchRoute(client, parameters) {
+    const deployment = matchDeployment(parameters);
+    if (!deployment)
+        return undefined;
+    return readRoute(client, deployment, {
+        ...parameters,
+        active: parameters.active !== false,
+        payee: parameters.descriptor.payee,
+    });
+}
+//# sourceMappingURL=machine-token-session.js.map

package/dist/tempo/internal/signature-envelope.d.ts

@@ -0,0 +1,14 @@
+import { SignatureEnvelope } from 'ox/tempo';
+import type { Hex } from 'viem';
+/**
+ * Canonicalizes a fresh TIP-1020 primitive signature for transport. Keychain
+ * wrappers, multisig signatures, and magic-suffixed encodings are rejected.
+ */
+export declare function serializeCanonicalEnvelope(signature: Hex, subject: string): Hex;
+/**
+ * Parses an incoming signature into a canonical TIP-1020 primitive envelope.
+ * Returns `undefined` for wrapper envelopes and aliased (non-canonical)
+ * encodings, so verified signatures can be replayed on-chain byte-for-byte.
+ */
+export declare function parseCanonicalEnvelope(signature: Hex): SignatureEnvelope.SignatureEnvelope | undefined;
+//# sourceMappingURL=signature-envelope.d.ts.map

package/dist/tempo/internal/signature-envelope.js

@@ -0,0 +1,28 @@
+import { SignatureEnvelope } from 'ox/tempo';
+function isPrimitiveEnvelope(type) {
+    return type === 'secp256k1' || type === 'p256' || type === 'webAuthn';
+}
+/**
+ * Canonicalizes a fresh TIP-1020 primitive signature for transport. Keychain
+ * wrappers, multisig signatures, and magic-suffixed encodings are rejected.
+ */
+export function serializeCanonicalEnvelope(signature, subject) {
+    const envelope = SignatureEnvelope.from(signature);
+    if (!isPrimitiveEnvelope(envelope.type))
+        throw new Error(`${subject} require a TIP-1020 primitive signature; received "${envelope.type}".`);
+    return SignatureEnvelope.serialize(envelope);
+}
+/**
+ * Parses an incoming signature into a canonical TIP-1020 primitive envelope.
+ * Returns `undefined` for wrapper envelopes and aliased (non-canonical)
+ * encodings, so verified signatures can be replayed on-chain byte-for-byte.
+ */
+export function parseCanonicalEnvelope(signature) {
+    const envelope = SignatureEnvelope.from(signature);
+    if (!isPrimitiveEnvelope(envelope.type))
+        return undefined;
+    if (SignatureEnvelope.serialize(envelope).toLowerCase() !== signature.toLowerCase())
+        return undefined;
+    return envelope;
+}
+//# sourceMappingURL=signature-envelope.js.map

package/dist/tempo/legacy/client/ChannelOps.d.ts

@@ -29,12 +29,12 @@ export type ChannelEntry = {
 };
 /** Resolves the chain ID embedded in a legacy session challenge. */
 export declare function resolveChainId(challenge: Challenge): number;
-/** Resolves the legacy escrow contract from local override, challenge hint, or defaults. */
+/** Resolves the server-advertised escrow against the client's trust policy. */
 export declare function resolveEscrow(challenge: {
     request: {
         methodDetails?: unknown;
     };
-}, chainId: number, escrowContractOverride?: Address): Address;
+}, chainId: number, escrowContractOverride?: Address, allowCustomEscrow?: boolean): Address;
 /** Serializes a legacy session credential with a payer DID source. */
 export declare function serializeCredential(challenge: Challenge, payload: LegacySessionCredentialPayload, chainId: number, account: viem_Account): string;
 /** Creates a legacy cumulative voucher credential payload. */

package/dist/tempo/legacy/client/ChannelOps.js

@@ -24,15 +24,21 @@ export function resolveChainId(challenge) {
     const md = challenge.request.methodDetails;
     return md?.chainId ?? 0;
 }
-/** Resolves the legacy escrow contract from local override, challenge hint, or defaults. */
-export function resolveEscrow(challenge, chainId, escrowContractOverride) {
+/** Resolves the server-advertised escrow against the client's trust policy. */
+export function resolveEscrow(challenge, chainId, escrowContractOverride, allowCustomEscrow = false) {
     const challengeEscrow = challenge.request.methodDetails
         ?.escrowContract;
     const escrow = escrowContractOverride ??
-        challengeEscrow ??
         defaults.escrowContract[chainId];
-    if (!escrow)
-        throw new Error('No `escrowContract` available. Provide it in parameters or ensure the server challenge includes it.');
+    if (!escrow && !(allowCustomEscrow && challengeEscrow))
+        throw new Error('No trusted `escrowContract` available. Provide it in client parameters or use a supported chain.');
+    if (challengeEscrow &&
+        escrow &&
+        challengeEscrow.toLowerCase() !== escrow.toLowerCase() &&
+        (!allowCustomEscrow || escrowContractOverride !== undefined))
+        throw new Error(`Tempo session escrow ${challengeEscrow} does not match client escrow ${escrow}.`);
+    if (challengeEscrow && (!escrow || challengeEscrow.toLowerCase() !== escrow.toLowerCase()))
+        return challengeEscrow;
     return escrow;
 }
 /** Serializes a legacy session credential with a payer DID source. */

package/dist/tempo/legacy/client/Session.d.ts

@@ -65,6 +65,7 @@ export declare function session(parameters?: session.Parameters): Method.Client<
         credential: {
             payload: z.ZodMiniDiscriminatedUnion<[z.ZodMiniObject<{
                 action: z.ZodMiniLiteral<"open">;
+                authorizationSignature: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 authorizedSigner: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 channelId: z.ZodMiniString<string>;
                 cumulativeAmount: z.ZodMiniString<string>;
@@ -81,15 +82,18 @@ export declare function session(parameters?: session.Parameters): Method.Client<
                 type: z.ZodMiniLiteral<"transaction">;
             }, z.core.$strip>, z.ZodMiniObject<{
                 action: z.ZodMiniLiteral<"voucher">;
+                authorizationSignature: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 channelId: z.ZodMiniString<string>;
                 cumulativeAmount: z.ZodMiniString<string>;
                 descriptor: z.ZodMiniOptional<z.ZodMiniCustom<import("../../session/precompile/Protocol.js").ChannelDescriptor, import("../../session/precompile/Protocol.js").ChannelDescriptor>>;
                 signature: z.ZodMiniString<string>;
             }, z.core.$strip>, z.ZodMiniObject<{
                 action: z.ZodMiniLiteral<"close">;
+                authorizationSignature: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 channelId: z.ZodMiniString<string>;
                 cumulativeAmount: z.ZodMiniString<string>;
                 descriptor: z.ZodMiniOptional<z.ZodMiniCustom<import("../../session/precompile/Protocol.js").ChannelDescriptor, import("../../session/precompile/Protocol.js").ChannelDescriptor>>;
+                refundSignature: z.ZodMiniOptional<z.ZodMiniString<string>>;
                 signature: z.ZodMiniString<string>;
             }, z.core.$strip>], "action">;
         };
@@ -101,6 +105,8 @@ export declare function session(parameters?: session.Parameters): Method.Client<
             decimals: z.ZodMiniNumber<number>;
             escrowContract: z.ZodMiniOptional<z.ZodMiniString<string>>;
             feePayer: z.ZodMiniOptional<z.ZodMiniPipe<z.ZodMiniUnion<readonly [z.ZodMiniBoolean<boolean>, z.ZodMiniCustom<viem_Account, viem_Account>]>, z.ZodMiniTransform<boolean, boolean | viem_Account>>>;
+            feeToken: z.ZodMiniOptional<z.ZodMiniString<string>>;
+            machineTokenEnabled: z.ZodMiniOptional<z.ZodMiniBoolean<boolean>>;
             minVoucherDelta: z.ZodMiniOptional<z.ZodMiniString<string>>;
             operator: z.ZodMiniOptional<z.ZodMiniString<string>>;
             recipient: z.ZodMiniOptional<z.ZodMiniString<string>>;
@@ -123,6 +129,8 @@ export declare function session(parameters?: session.Parameters): Method.Client<
                 minVoucherDelta?: string | undefined;
                 chainId?: number | undefined;
                 feePayer?: boolean | undefined;
+                feeToken?: string | undefined;
+                machineTokenEnabled?: boolean | undefined;
                 operator?: string | undefined;
                 sessionProtocol?: "v1" | "v2" | undefined;
                 sessionSnapshot?: import("../../session/Snapshot.js").SessionSnapshot | undefined;
@@ -135,6 +143,8 @@ export declare function session(parameters?: session.Parameters): Method.Client<
             decimals: number;
             escrowContract?: string | undefined;
             feePayer?: boolean | undefined;
+            feeToken?: string | undefined;
+            machineTokenEnabled?: boolean | undefined;
             minVoucherDelta?: string | undefined;
             operator?: string | undefined;
             recipient?: string | undefined;
@@ -163,13 +173,15 @@ export declare function session(parameters?: session.Parameters): Method.Client<
 /** Type helpers for the legacy low-level session client method. */
 export declare namespace session {
     type Parameters = Account.getResolver.Parameters & Client.getResolver.Parameters & {
+        /** Accept a noncanonical escrow contract advertised by the server. @default false */
+        allowCustomEscrow?: boolean | undefined;
         /** Account that signs voucher digests. Defaults to `account`; access-key accounts sign raw vouchers as their access-key address. */
         voucherSigner?: viem_Account | undefined;
         /** Token decimals for parsing human-readable amounts (default: 6). */
         decimals?: number | undefined;
         /** Initial deposit amount in human-readable units (e.g. "10" for 10 tokens). When set, the method handles the full channel lifecycle (open, voucher, cumulative tracking) automatically. */
         deposit?: string | undefined;
-        /** Escrow contract address override. Derived from challenge or defaults if not provided. */
+        /** Exact escrow contract address pin. Takes precedence over `allowCustomEscrow`. */
         escrowContract?: Address | undefined;
         /** Maximum deposit in human-readable units (e.g. "10"). Caps the server's `suggestedDeposit`. Enables auto-management like `deposit`. */
         maxDeposit?: string | undefined;

package/dist/tempo/legacy/client/Session.js

@@ -58,7 +58,7 @@ export const sessionContextSchema = z.object({
  * ```
  */
 export function session(parameters = {}) {
-    const { decimals = defaults.decimals } = parameters;
+    const { allowCustomEscrow = false, decimals = defaults.decimals } = parameters;
     const getClient = Client.getResolver({
         chain: tempo_chain,
         getClient: parameters.getClient,
@@ -79,9 +79,9 @@ export function session(parameters = {}) {
         if (channelId) {
             const cached = escrowContractMap.get(channelId);
             if (cached)
-                return cached;
+                return resolveEscrow(challenge, chainId, cached);
         }
-        return resolveEscrow(challenge, chainId, parameters.escrowContract);
+        return resolveEscrow(challenge, chainId, parameters.escrowContract, allowCustomEscrow);
     }
     async function autoManageCredential(challenge, account, context) {
         const md = challenge.request.methodDetails;

package/dist/tempo/legacy/client/SessionManager.d.ts

@@ -77,13 +77,15 @@ export declare function sessionManager(parameters: sessionManager.Parameters): S
 /** Type helpers for the legacy auto-driving session manager. */
 export declare namespace sessionManager {
     type Parameters = Account.getResolver.Parameters & Client.getResolver.Parameters & {
+        /** Accept a noncanonical escrow contract advertised by the server. @default false */
+        allowCustomEscrow?: boolean | undefined;
         /** Account that signs voucher digests. Defaults to `account`; access-key accounts sign raw vouchers as their access-key address. */
         voucherSigner?: viem_Account | undefined;
         /** Viem client instance. Shorthand for `getClient: () => client`. */
         client?: import('viem').Client | undefined;
         /** Token decimals used to convert `maxDeposit` to raw units. Defaults to `6`. */
         decimals?: number | undefined;
-        /** Escrow contract address. */
+        /** Exact escrow contract address pin. Takes precedence over `allowCustomEscrow`. */
         escrowContract?: Address | undefined;
         fetch?: typeof globalThis.fetch | undefined;
         /** Maximum deposit in human-readable units (e.g. `'10'` for 10 tokens). Converted to raw units via `decimals`. */

package/dist/tempo/legacy/client/SessionManager.js

@@ -37,6 +37,7 @@ const ClientWebSocketProtocolErrorCloseCode = 3008;
  * finalized, it resumes from the on-chain settled amount.
  */
 export function sessionManager(parameters) {
+    const allowCustomEscrow = parameters.allowCustomEscrow ?? false;
     const fetchFn = parameters.fetch ?? globalThis.fetch;
     const WebSocketImpl = parameters.webSocket ??
         globalThis.WebSocket;
@@ -59,6 +60,7 @@ export function sessionManager(parameters) {
     let wsTickCost = 0n;
     const method = sessionPlugin({
         account: parameters.account,
+        allowCustomEscrow,
         voucherSigner: parameters.voucherSigner,
         getClient: parameters.client ? () => parameters.client : parameters.getClient,
         escrowContract: parameters.escrowContract,

package/dist/tempo/server/Charge.d.ts

@@ -45,6 +45,8 @@ export declare namespace charge {
         } | undefined;
     };
     type Parameters = {
+        /** Enables first-party machine-token settlement for supported Tempo charges. */
+        machineTokenEnabled?: boolean | undefined;
         /** Render payment page when Accept header is text/html (e.g. in browsers) */
         html?: boolean | Html.Config | undefined;
         /**
@@ -99,6 +101,7 @@ export declare namespace charge {
          * relay broadcasts pull credentials, while it recognizes a push
          * credential as already broadcast and returns its receipt without sending
          * it again.
+         *
          */
         relay?: RelayOptions | undefined;
         /**

package/dist/tempo/server/Charge.js

@@ -1,5 +1,5 @@
 import * as SignatureEnvelope from 'ox/tempo/SignatureEnvelope';
-import { decodeFunctionData, formatUnits, keccak256, parseEventLogs, } from 'viem';
+import { createClient, decodeFunctionData, formatUnits, http, keccak256, parseEventLogs, } from 'viem';
 import { getTransactionReceipt, sendRawTransaction, sendRawTransactionSync, signTransaction, verifyTypedData, call as viem_call, } from 'viem/actions';
 import { Abis, Actions, Transaction } from 'viem/tempo';
 import { tempo as tempo_chain } from 'viem/tempo/chains';
@@ -15,6 +15,7 @@ import * as Charge_internal from '../internal/charge.js';
 import * as defaults from '../internal/defaults.js';
 import * as FeePayer from '../internal/fee-payer.js';
 import { resolveFeeToken } from '../internal/fee-token.js';
+import * as MachineTokenCharge from '../internal/machine-token-charge.js';
 import * as Proof from '../internal/proof.js';
 import * as Selectors from '../internal/selectors.js';
 import * as Methods from '../Methods.js';
@@ -32,7 +33,7 @@ import * as SponsorBudget from './SponsorBudget.js';
  * ```
  */
 export function charge(parameters = {}) {
-    const { amount, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, memo, relay, sponsorBudget, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
+    const { machineTokenEnabled, amount, currency = defaults.resolveCurrency(parameters), decimals = defaults.decimals, description, externalId, feeToken: configuredFeeToken, feePayerPolicy, html, memo, relay, sponsorBudget, splits, supportedModes, validateSender, waitForConfirmation = true, } = parameters;
     const storeKeyPrefix = parameters.storeKeyPrefix ?? '';
     const rawStore = (parameters.store ?? Store.memory());
     const store = Store.from(rawStore, { keyPrefix: storeKeyPrefix });
@@ -84,12 +85,17 @@ export function charge(parameters = {}) {
         const currency = resolvedRequest.currency;
         const recipient = resolvedRequest.recipient;
         const memo = methodDetails?.memo;
+        const machineTokenEnabled = methodDetails?.machineTokenEnabled === true;
+        const settlementSender = machineTokenEnabled
+            ? MachineTokenCharge.getSettlementSender(chainId)
+            : undefined;
         const isZeroAmount = BigInt(amount) === 0n;
         Expires.assert(challenge.expires, challenge.id);
         if (isZeroAmount && payload.type !== 'proof')
             throw new MismatchError('Zero-amount challenges require a proof credential.', {});
         return {
             amount,
+            machineTokenEnabled,
             chainId,
             challenge,
             client: await getClient({ chainId }),
@@ -101,11 +107,12 @@ export function charge(parameters = {}) {
             recipient,
             requestAllowsFeePayer: request.feePayer !== false,
             resolvedRequest,
+            settlementSenders: settlementSender ? [settlementSender] : [],
             supportedModes,
         };
     }
     async function validateHashCredential(credential, payload, context) {
-        const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, supportedModes, } = context;
+        const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, settlementSenders, supportedModes, } = context;
         if (supportedModes && !supportedModes.includes('push'))
             throw new MismatchError('Hash credentials are not supported for this challenge.', {});
         const source = parseHashCredentialSource({
@@ -120,6 +127,7 @@ export function charge(parameters = {}) {
         const matchedLogs = await assertTransferLogs(receipt, {
             currency,
             sender,
+            settlementSenders,
             source,
             transfers,
             validateSender,
@@ -169,7 +177,7 @@ export function charge(parameters = {}) {
         return { sender: source.address };
     }
     async function validateTransactionCredential(credential, payload, request, context) {
-        const { amount, chainId, challenge, client, currency, memo, methodDetails, recipient, requestAllowsFeePayer, supportedModes, } = context;
+        const { machineTokenEnabled, amount, chainId, challenge, client, currency, memo, methodDetails, recipient, requestAllowsFeePayer, supportedModes, } = context;
         if (supportedModes && !supportedModes.includes('pull'))
             throw new MismatchError('Transaction credentials are not supported for this challenge.', {});
         const serializedTransaction = payload.signature;
@@ -182,24 +190,40 @@ export function charge(parameters = {}) {
             requestAllowsFeePayer &&
             !!(typeof request.feePayer === 'object' ? request.feePayer : feePayer || feePayerUrl);
         const transfers = getExpectedTransfers({ amount, memo, methodDetails, recipient });
-        const matchedCalls = assertTransferCalls(transaction.calls ?? [], {
-            currency,
-            exactCount: isFeePayerTx,
-            transfers,
-        });
+        const machineTokenRoute = machineTokenEnabled
+            ? MachineTokenCharge.matchRoute({
+                calls: transaction.calls ?? [],
+                chainId: chainId ?? client.chain?.id,
+                currency,
+                transfers,
+            })
+            : undefined;
+        const matchedCalls = machineTokenRoute?.transfers ??
+            assertTransferCalls(transaction.calls ?? [], {
+                currency,
+                exactCount: isFeePayerTx,
+                transfers,
+            });
         if (!memo)
             assertChallengeBoundCallMemo(matchedCalls, {
                 challengeId: challenge.id,
                 realm: challenge.realm,
             });
         if (isFeePayerTx) {
-            FeePayer.validateCalls(transaction.calls, { amount, currency, recipient }, { currency, expectedTransfers: transfers });
+            if (!machineTokenRoute)
+                FeePayer.validateCalls(transaction.calls, { amount, currency, recipient }, { currency, expectedTransfers: transfers });
             FeePayer.assertAllowedFeeToken(transaction, FeePayer.defaultAllowedFeeTokens(chainId));
         }
         else {
             await viem_call(client, FeePayer.simulationTransaction(transaction, { feePayer: false }));
         }
-        return { isFeePayerTx, serializedTransaction, transaction, transfers };
+        return {
+            isFeePayerTx,
+            serializedTransaction,
+            settlementSenders: machineTokenRoute ? [machineTokenRoute.settlementSender] : [],
+            transaction,
+            transfers,
+        };
     }
     async function validateCredential(credential, request, context) {
         switch (context.payload.type) {
@@ -217,7 +241,7 @@ export function charge(parameters = {}) {
                 return { details: { mode: 'proof', sender }, type: 'proof' };
             }
             case 'transaction': {
-                const { isFeePayerTx, serializedTransaction, transaction, transfers } = await validateTransactionCredential(credential, context.payload, request, context);
+                const { isFeePayerTx, serializedTransaction, settlementSenders, transaction, transfers } = await validateTransactionCredential(credential, context.payload, request, context);
                 return {
                     details: {
                         mode: 'pull',
@@ -227,6 +251,7 @@ export function charge(parameters = {}) {
                     },
                     isFeePayerTx,
                     serializedTransaction,
+                    settlementSenders,
                     transaction,
                     transfers,
                     type: 'transaction',
@@ -238,6 +263,7 @@ export function charge(parameters = {}) {
         canOffer: parameters.canOffer,
         onPaymentSuccess: parameters.onPaymentSuccess,
         defaults: {
+            machineTokenEnabled,
             amount,
             currency,
             decimals,
@@ -298,6 +324,8 @@ export function charge(parameters = {}) {
             })();
             if (client.chain?.id !== chainId)
                 throw new Error(`Client not configured with chainId ${chainId}.`);
+            if (request.machineTokenEnabled && !MachineTokenCharge.isSupported(chainId))
+                throw new Error(`Machine tokens are not supported on chainId ${chainId}.`);
             const resolvedFeePayer = (() => {
                 if (request.feePayer === false)
                     return credential ? false : undefined;
@@ -311,6 +339,7 @@ export function charge(parameters = {}) {
             })();
             return {
                 ...request,
+                machineTokenEnabled: request.machineTokenEnabled || undefined,
                 chainId,
                 feePayer: resolvedFeePayer,
                 memo: request.memo || undefined,
@@ -365,7 +394,7 @@ export function charge(parameters = {}) {
                     };
                 }
                 case 'transaction': {
-                    const { isFeePayerTx, serializedTransaction, transaction, transfers } = validated;
+                    const { isFeePayerTx, serializedTransaction, settlementSenders, transaction, transfers } = validated;
                     // Pre-broadcast dedup: catch exact byte-for-byte replays early.
                     const hash = keccak256(serializedTransaction);
                     if (!(await tryClaimHash(store, hash, replayExpires))) {
@@ -377,6 +406,9 @@ export function charge(parameters = {}) {
                     let finalHash;
                     let reservation;
                     try {
+                        const broadcastClient = feePayerUrl && isFeePayerTx
+                            ? createClient({ chain: client.chain, transport: http(feePayerUrl) })
+                            : client;
                         const allowedFeeTokens = FeePayer.defaultAllowedFeeTokens(chainId);
                         if (isFeePayerTx)
                             FeePayer.assertAllowedFeeToken(transaction, allowedFeeTokens);
@@ -439,7 +471,9 @@ export function charge(parameters = {}) {
                             }
                             return { serializedTransaction, sponsor: undefined };
                         })();
-                        const serializedTransaction_final = completedTransaction.serializedTransaction;
+                        // Nodes normalize accepted signature encodings before deriving transaction hashes.
+                        // Broadcast the same canonical envelope so replay keys match the node reference.
+                        const serializedTransaction_final = await Transaction.serialize(Transaction.deserialize(completedTransaction.serializedTransaction));
                         finalHash = keccak256(serializedTransaction_final);
                         if (finalHash.toLowerCase() !== hash.toLowerCase() &&
                             !(await tryClaimHash(store, finalHash, replayExpires)))
@@ -488,7 +522,7 @@ export function charge(parameters = {}) {
                             });
                         broadcastAttempted = true;
                         if (waitForConfirmation) {
-                            const receipt = await sendRawTransactionSync(client, {
+                            const receipt = await sendRawTransactionSync(broadcastClient, {
                                 serializedTransaction: serializedTransaction_final,
                             });
                             if (reservation)
@@ -496,6 +530,7 @@ export function charge(parameters = {}) {
                             const matchedLogs = await assertTransferLogs(receipt, {
                                 currency,
                                 sender: transaction.from,
+                                settlementSenders,
                                 transfers,
                             });
                             if (!memo)
@@ -512,7 +547,7 @@ export function charge(parameters = {}) {
                         // Optimistic path: broadcast without waiting for confirmation
                         // (simulation above already ran). The returned receipt assumes
                         // success — callers opt in via waitForConfirmation: false.
-                        const reference = await sendRawTransaction(client, {
+                        const reference = await sendRawTransaction(broadcastClient, {
                             serializedTransaction: serializedTransaction_final,
                         });
                         if (reference.toLowerCase() !== finalHash.toLowerCase())
@@ -551,10 +586,11 @@ function chargeBinding(request) {
     // Exhaustively destructure so new charge request fields require an explicit binding decision.
     const { amount, currency, description, externalId, methodDetails, recipient, ...requestRest } = request;
     requestRest;
-    const { chainId, feePayer, memo, splits, supportedModes, ...methodDetailsRest } = methodDetails ?? {};
+    const { chainId, feePayer, machineTokenEnabled, memo, splits, supportedModes, ...methodDetailsRest } = methodDetails ?? {};
     methodDetailsRest;
     void feePayer;
     return {
+        machineTokenEnabled,
         amount,
         chainId,
         currency,
@@ -696,7 +732,9 @@ async function assertTransferLogs(receipt, parameters) {
             if (!(await isValidTransferSender({
                 expectedSender: parameters.sender,
                 sender: log.args.from,
+                settlementSenders: parameters.settlementSenders,
                 source: parameters.source,
+                transactionSender: receipt.from,
                 validateSender: parameters.validateSender,
             })))
                 continue;
@@ -771,6 +809,9 @@ function isSameTransferLog(a, b) {
 async function isValidTransferSender(parameters) {
     if (TempoAddress.isEqual(parameters.sender, parameters.expectedSender))
         return true;
+    if (TempoAddress.isEqual(parameters.transactionSender, parameters.expectedSender) &&
+        parameters.settlementSenders?.some((sender) => TempoAddress.isEqual(parameters.sender, sender)))
+        return true;
     if (!parameters.validateSender)
         return false;
     return parameters.validateSender({