mppx 0.8.17 → 0.8.18

package/src/server/internal/html/serviceWorker.client.ts

@@ -1,28 +0,0 @@
-import { params } from './constants.js'
-
-export async function submitCredential(credential: string): Promise<void> {
-  const url = new URL(location.href)
-  url.searchParams.set(params.serviceWorker, '')
-
-  const registration = await navigator.serviceWorker.register(url.pathname + url.search)
-
-  const serviceWorker = await new Promise<ServiceWorker>((resolve) => {
-    const mppxWorker = registration.installing ?? registration.waiting ?? registration.active
-    if (mppxWorker?.state === 'activated') return resolve(mppxWorker)
-    const target = mppxWorker ?? registration
-    target.addEventListener('statechange', function handler() {
-      const active = registration.active
-      if (active?.state === 'activated') {
-        target.removeEventListener('statechange', handler)
-        resolve(active)
-      }
-    })
-  })
-
-  await new Promise<void>((resolve) => {
-    const channel = new MessageChannel()
-    channel.port1.onmessage = () => resolve()
-    serviceWorker.postMessage({ credential }, [channel.port2])
-  })
-  location.reload()
-}

package/src/server/internal/html/serviceWorker.gen.ts

@@ -1,2 +0,0 @@
-// Generated — do not edit.
-export const serviceWorker = "(function(){let e=self,t;e.addEventListener(`activate`,t=>{t.waitUntil(e.clients.claim())}),e.addEventListener(`message`,e=>{if(!e.source)return;let n=e.data?.credential;typeof n!=`string`||!n.startsWith(`Payment `)||(t=n,e.ports[0]?.postMessage(`ack`))}),e.addEventListener(`fetch`,n=>{if(!t||n.request.mode!==`navigate`||new URL(n.request.url).origin!==e.location.origin)return;let r=new Headers(n.request.headers);r.set(`Authorization`,t),t=void 0,n.respondWith(fetch(n.request,{headers:r})),e.registration.unregister()})})();"

package/src/server/internal/html/serviceWorker.ts

@@ -1,27 +0,0 @@
-const serviceWorker = self as unknown as ServiceWorkerGlobalScope
-
-let credential: string | undefined
-
-serviceWorker.addEventListener('activate', (event) => {
-  event.waitUntil(serviceWorker.clients.claim())
-})
-
-serviceWorker.addEventListener('message', (event) => {
-  if (!event.source) return
-  const value = event.data?.credential
-  if (typeof value !== 'string' || !value.startsWith('Payment ')) return
-  credential = value
-  event.ports[0]?.postMessage('ack')
-})
-
-serviceWorker.addEventListener('fetch', (event) => {
-  if (!credential || event.request.mode !== 'navigate') return
-  if (new URL(event.request.url).origin !== serviceWorker.location.origin) return
-
-  const headers = new Headers(event.request.headers)
-  headers.set('Authorization', credential)
-  credential = undefined
-
-  event.respondWith(fetch(event.request, { headers }))
-  serviceWorker.registration.unregister()
-})

package/src/server/internal/html/tsconfig.compose.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../../tsconfig.base.json",
-  "compilerOptions": {
-    "lib": ["es2022", "dom"],
-    "types": []
-  },
-  "include": ["compose.main.ts"]
-}

package/src/server/internal/html/tsconfig.worker.client.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../../tsconfig.base.json",
-  "compilerOptions": {
-    "lib": ["es2022", "dom"],
-    "types": []
-  },
-  "include": ["serviceWorker.client.ts"]
-}

package/src/server/internal/html/tsconfig.worker.json

@@ -1,8 +0,0 @@
-{
-  "extends": "../../../../tsconfig.base.json",
-  "compilerOptions": {
-    "lib": ["es2022", "webworker"],
-    "types": []
-  },
-  "include": ["serviceWorker.ts"]
-}

package/src/server/internal/scope.ts

@@ -1,43 +0,0 @@
-const requestScopes = new WeakMap<Request, string>()
-
-/** Reserved `meta` key used for mppx-managed route/resource scope binding. */
-export const reservedMetaKey = '_mppx_scope'
-
-/** Attaches a trusted adapter-derived scope to a Request for this process only. */
-export function attach(request: Request, scope: string): Request {
-  requestScopes.set(request, scope)
-  return request
-}
-
-/** Reads a previously attached trusted adapter-derived scope from a Request. */
-export function get(request: Request): string | undefined {
-  return requestScopes.get(request)
-}
-
-/** Returns the reserved mppx scope value from challenge metadata, if present. */
-export function read(meta: Record<string, string> | undefined): string | undefined {
-  return meta?.[reservedMetaKey]
-}
-
-/**
- * Merges the public `scope` option into challenge metadata.
- *
- * Throws when both `scope` and `meta._mppx_scope` are provided with different
- * values so callers have a single authoritative way to bind route scope.
- */
-export function merge(parameters: {
-  meta?: Record<string, string> | undefined
-  scope?: string | undefined
-}): Record<string, string> | undefined {
-  const { meta, scope } = parameters
-  const metaScope = read(meta)
-
-  if (scope !== undefined && metaScope !== undefined && metaScope !== scope) {
-    throw new Error(
-      `Conflicting scope values: \`scope\` (${scope}) does not match \`meta.${reservedMetaKey}\` (${metaScope}).`,
-    )
-  }
-
-  if (scope === undefined || metaScope === scope) return meta
-  return { ...meta, [reservedMetaKey]: scope }
-}

package/src/stripe/Charge.integration.test.ts

@@ -1,329 +0,0 @@
-import { Challenge, Credential, Receipt } from 'mppx'
-import { Mppx as Mppx_client, stripe as stripe_client } from 'mppx/client'
-import { Mppx as Mppx_server, stripe as stripe_server } from 'mppx/server'
-import { afterEach, describe, expect, test } from 'vp/test'
-import * as Http from '~test/Http.js'
-
-const stripeSecretKey = process.env.VITE_STRIPE_SECRET_KEY
-
-const realm = 'api.example.com'
-const secretKey = 'test-secret-key-test-secret-key-32'
-
-let httpServer: Awaited<ReturnType<typeof Http.createServer>> | undefined
-
-afterEach(() => httpServer?.close())
-
-async function createTestSpt(parameters: {
-  paymentMethod: string
-  amount: string
-  currency: string
-  networkId: string | undefined
-  expiresAt: number
-  metadata?: Record<string, string> | undefined
-}) {
-  const body = new URLSearchParams({
-    payment_method: parameters.paymentMethod,
-    'usage_limits[currency]': parameters.currency,
-    'usage_limits[max_amount]': parameters.amount,
-    'usage_limits[expires_at]': parameters.expiresAt.toString(),
-  })
-  if (parameters.networkId) body.set('seller_details[network_id]', parameters.networkId)
-  if (parameters.metadata) {
-    for (const [key, value] of Object.entries(parameters.metadata)) {
-      body.set(`metadata[${key}]`, value)
-    }
-  }
-  // Test-only endpoint; production SPT flow uses the agent-side issued_tokens API.
-  const createSpt = async (bodyParams: URLSearchParams) =>
-    fetch('https://api.stripe.com/v1/test_helpers/shared_payment/granted_tokens', {
-      method: 'POST',
-      headers: {
-        Authorization: `Basic ${btoa(`${stripeSecretKey!}:`)}`,
-        'Content-Type': 'application/x-www-form-urlencoded',
-      },
-      body: bodyParams,
-    })
-
-  let response = await createSpt(body)
-  if (!response.ok) {
-    const error = (await response.json()) as { error: { message: string } }
-    if (
-      (parameters.metadata || parameters.networkId) &&
-      error.error.message.includes('Received unknown parameter')
-    ) {
-      const fallbackBody = new URLSearchParams({
-        payment_method: parameters.paymentMethod,
-        'usage_limits[currency]': parameters.currency,
-        'usage_limits[max_amount]': parameters.amount,
-        'usage_limits[expires_at]': parameters.expiresAt.toString(),
-      })
-      response = await createSpt(fallbackBody)
-    } else {
-      throw new Error(`Failed to create SPT: ${error.error.message}`)
-    }
-  }
-
-  if (!response.ok) {
-    const error = (await response.json()) as { error: { message: string } }
-    throw new Error(`Failed to create SPT: ${error.error.message}`)
-  }
-
-  const { id } = (await response.json()) as { id: string }
-  return id
-}
-
-describe.skipIf(!stripeSecretKey)('stripe', () => {
-  const server = Mppx_server.create({
-    methods: [
-      stripe_server.charge({
-        secretKey: stripeSecretKey!,
-        networkId: 'internal',
-        paymentMethodTypes: ['card'],
-        metadata: { example: 'metadata' },
-      }),
-    ],
-    realm,
-    secretKey,
-  })
-
-  const clientCharge = stripe_client.charge({
-    createToken: async (params) => {
-      if (!params.paymentMethod) throw new Error('paymentMethod is required')
-      return createTestSpt({ ...params, paymentMethod: params.paymentMethod })
-    },
-    paymentMethod: 'pm_card_visa',
-    externalId: 'client_order_789',
-  })
-
-  describe('intent: charge; type: spt', () => {
-    test('default', async () => {
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      expect(response.status).toBe(402)
-
-      const challenge = Challenge.fromResponse(response, {
-        methods: [clientCharge],
-      })
-      expect(challenge.method).toBe('stripe')
-      expect(challenge.intent).toBe('charge')
-      expect(challenge.request.amount).toBe('100')
-      expect(challenge.realm).toBe(realm)
-
-      const credential = await clientCharge.createCredential({ challenge, context: {} })
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: credential },
-        })
-        expect(response.status).toBe(200)
-
-        const receipt = Receipt.fromResponse(response)
-        expect({
-          ...receipt,
-          reference: '[reference]',
-          timestamp: '[timestamp]',
-          externalId: '[externalId]',
-        }).toMatchInlineSnapshot(`
-          {
-            "externalId": "[externalId]",
-            "method": "stripe",
-            "reference": "[reference]",
-            "status": "success",
-            "timestamp": "[timestamp]",
-          }
-        `)
-      }
-    })
-
-    test('behavior: rejects invalid SPT', async () => {
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      const challenge = Challenge.fromResponse(response)
-
-      const credential = Credential.from({
-        challenge,
-        payload: { spt: 'spt_invalid_token' },
-      })
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: Credential.serialize(credential) },
-        })
-        expect(response.status).toBe(402)
-        const body = (await response.json()) as { detail: string }
-        expect(body.detail).toContain('Stripe PaymentIntent failed')
-      }
-    })
-
-    test('behavior: rejects expired challenge', async () => {
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({
-            amount: '1',
-            currency: 'usd',
-            decimals: 2,
-            expires: new Date(Date.now() - 1000).toISOString(),
-          }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      expect(response.status).toBe(402)
-
-      const challenge = Challenge.fromResponse(response)
-
-      const credential = Credential.from({
-        challenge,
-        payload: { spt: 'spt_does_not_matter' },
-      })
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: Credential.serialize(credential) },
-        })
-        expect(response.status).toBe(402)
-        const body = (await response.json()) as { detail: string }
-        expect(body.detail).toMatch(/^Payment expired at /)
-      }
-    })
-
-    test('behavior: rejects malformed credential payload (missing spt)', async () => {
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      const challenge = Challenge.fromResponse(response)
-
-      const credential = Credential.from({
-        challenge,
-        payload: {},
-      })
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: Credential.serialize(credential) },
-        })
-        expect(response.status).toBe(402)
-      }
-    })
-
-    test('behavior: receipt format stability', async () => {
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      const challenge = Challenge.fromResponse(response, {
-        methods: [clientCharge],
-      })
-
-      const credential = await clientCharge.createCredential({ challenge, context: {} })
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: credential },
-        })
-        expect(response.status).toBe(200)
-
-        const receipt = Receipt.fromResponse(response)
-        expect(receipt.status).toBe('success')
-        expect(receipt.method).toBe('stripe')
-        expect(receipt.reference).toMatch(/^pi_/)
-        expect(receipt.timestamp).toMatch(/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}/)
-      }
-    })
-  })
-
-  describe('intent: charge; type: spt; via Mppx', () => {
-    test('default', async () => {
-      const mppx = Mppx_client.create({
-        polyfill: false,
-        methods: [clientCharge],
-      })
-
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await fetch(httpServer.url)
-      expect(response.status).toBe(402)
-
-      const credential = await mppx.createCredential(response)
-
-      {
-        const response = await fetch(httpServer.url, {
-          headers: { Authorization: credential },
-        })
-        expect(response.status).toBe(200)
-
-        const receipt = Receipt.fromResponse(response)
-        expect({
-          ...receipt,
-          reference: '[reference]',
-          timestamp: '[timestamp]',
-          externalId: '[externalId]',
-        }).toMatchInlineSnapshot(`
-          {
-            "externalId": "[externalId]",
-            "method": "stripe",
-            "reference": "[reference]",
-            "status": "success",
-            "timestamp": "[timestamp]",
-          }
-        `)
-      }
-    })
-
-    test('behavior: full mppx.fetch() auto flow', async () => {
-      const mppx = Mppx_client.create({
-        polyfill: false,
-        methods: [clientCharge],
-      })
-
-      httpServer = await Http.createServer(async (req, res) => {
-        const result = await Mppx_server.toNodeListener(
-          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-        )(req, res)
-        if (result.status === 402) return
-        res.end('OK')
-      })
-
-      const response = await mppx.fetch(httpServer.url)
-      expect(response.status).toBe(200)
-
-      const receipt = Receipt.fromResponse(response)
-      expect(receipt.status).toBe('success')
-      expect(receipt.method).toBe('stripe')
-      expect(receipt.reference).toMatch(/^pi_/)
-    })
-  })
-})

package/src/stripe/Methods.test.ts

@@ -1,62 +0,0 @@
-import { Methods } from 'mppx/stripe'
-import { describe, expect, expectTypeOf, test } from 'vp/test'
-
-describe('charge', () => {
-  test('has correct name and intent', () => {
-    expect(Methods.charge.intent).toBe('charge')
-    expect(Methods.charge.name).toBe('stripe')
-  })
-
-  test('types: intent is literal', () => {
-    expectTypeOf(Methods.charge.intent).toEqualTypeOf<'charge'>()
-  })
-
-  test('types: name is literal', () => {
-    expectTypeOf(Methods.charge.name).toEqualTypeOf<'stripe'>()
-  })
-
-  test('schema: validates valid request', () => {
-    const result = Methods.charge.schema.request.safeParse({
-      amount: '1',
-      currency: 'usd',
-      decimals: 2,
-      expires: '2025-02-05T12:05:00Z',
-      networkId: 'profile_123',
-      paymentMethodTypes: ['card'],
-      metadata: { example: 'metadata' },
-    })
-    expect(result.success).toBe(true)
-  })
-
-  test('schema: rejects invalid request', () => {
-    const result = Methods.charge.schema.request.safeParse({
-      amount: '1',
-    })
-    expect(result.success).toBe(false)
-  })
-
-  test('schema: requires decimals when no server default supplies it', () => {
-    const result = Methods.charge.schema.request.safeParse({
-      amount: '1',
-      currency: 'usd',
-      networkId: 'profile_123',
-      paymentMethodTypes: ['card'],
-    })
-    expect(result.success).toBe(false)
-  })
-
-  test('schema: validates spt payload', () => {
-    const result = Methods.charge.schema.credential.payload.safeParse({
-      spt: 'spt_test_123',
-      externalId: 'client_order_789',
-    })
-    expect(result.success).toBe(true)
-  })
-
-  test('schema: rejects invalid payload', () => {
-    const result = Methods.charge.schema.credential.payload.safeParse({
-      signature: '0x...',
-    })
-    expect(result.success).toBe(false)
-  })
-})

package/src/stripe/Methods.ts

@@ -1,44 +0,0 @@
-import { parseUnits } from 'viem'
-
-import * as Method from '../Method.js'
-import * as z from '../zod.js'
-
-/**
- * Stripe charge intent for one-time payments via Shared Payment Tokens (SPTs).
- *
- * @see https://github.com/tempoxyz/payment-auth-spec/blob/main/specs/methods/stripe/draft-stripe-charge-00.md
- */
-export const charge = Method.from({
-  name: 'stripe',
-  intent: 'charge',
-  schema: {
-    credential: {
-      payload: z.object({
-        externalId: z.optional(z.string()),
-        spt: z.string(),
-      }),
-    },
-    request: z.pipe(
-      z.object({
-        amount: z.amount(),
-        currency: z.string(),
-        decimals: z.number(),
-        description: z.optional(z.string()),
-        externalId: z.optional(z.string()),
-        metadata: z.optional(z.record(z.string(), z.string())),
-        networkId: z.string(),
-        paymentMethodTypes: z.array(z.string()).check(z.minLength(1)),
-        recipient: z.optional(z.string()),
-      }),
-      z.transform(({ amount, decimals, metadata, networkId, paymentMethodTypes, ...rest }) => ({
-        ...rest,
-        amount: parseUnits(amount, decimals).toString(),
-        methodDetails: {
-          networkId,
-          paymentMethodTypes,
-          ...(metadata !== undefined && { metadata }),
-        },
-      })),
-    ),
-  },
-})