mppx 0.8.19 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # mppx
 
+## 0.9.0
+
+### Minor Changes
+
+- c23eaf0: Removed machineUSD charge and session flows, requiring servers that advertise machineUSD to remove that configuration before upgrading.
+
+### Patch Changes
+
+- 9582c40: Routed hosted Tempo fee-payer fills through the configured `withFeePayer` transport and broadcast completed transactions through the default RPC transport.
+- d343aae: Added `preparePayment` for inspecting a selected client payment before creating and attaching its credential.
+- 7ce3160: Added the V8 coverage provider required by the configured test coverage command.
+- 5e10359: Fixed concurrent HTML builds sharing a temporary directory.
+- 4e4810a: Added a `requiresAuth` server option that used `Payment-Authorization` for Payment credentials.
+- 1a36a5e: Added HTTP headers to remote Tempo fee-payer configuration.
+- 07c59cf: Added dual MPP/x402 wrappers for Express, Hono, Next.js, and MCP, backed by official x402 adapters and native MPP protocol handling. Exposed Tempo and source-chain MPP payments for compatible EVM requirements; x402 Fastify and Axios compatibility adapters were deferred.
+
 ## 0.8.19
 
 ### Patch Changes

package/README.md

@@ -52,7 +52,6 @@ const mppx = Mppx.create({
   methods: [
     tempo({
       currency: '0x20c0000000000000000000000000000000000000',
-      machineTokenEnabled: true,
       recipient: '0x742d35Cc6634c0532925a3b844bC9e7595F8fE00',
     }),
   ],
@@ -84,11 +83,6 @@ Mppx.create({
 const res = await fetch('https://mpp.dev/api/ping/paid')
 ```
 
-The client API is the same for PathUSD, USDC.e, and machineUSD. A server advertises
-`machineTokenEnabled`; the client uses machineUSD when a verified route and sufficient balance
-are available, and otherwise pays the token requested by the challenge. Sessions keep the selected
-rail until the channel closes.
-
 ## Examples
 
 | Example                                                | Description                                          |

package/dist/Challenge.d.ts

@@ -16,6 +16,7 @@ export declare const Schema: z.ZodMiniObject<{
     description: z.ZodMiniOptional<z.ZodMiniString<string>>;
     digest: z.ZodMiniOptional<z.ZodMiniString<string>>;
     expires: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    header: z.ZodMiniOptional<z.ZodMiniString<string>>;
     id: z.ZodMiniString<string>;
     intent: z.ZodMiniString<string>;
     method: z.ZodMiniString<string>;
@@ -106,6 +107,8 @@ export declare namespace from {
         digest?: string | undefined;
         /** Optional expiration timestamp (ISO 8601). */
         expires?: z.DatetimeInput | undefined;
+        /** Optional HTTP field name to carry the payment credential. When omitted, uses Authorization. */
+        header?: string | undefined;
         /** Intent type (e.g., "charge", "session"). */
         intent: string;
         /** Optional server-defined correlation data (serialized as `opaque` on the challenge). Flat string-to-string map; clients MUST NOT modify. */
@@ -168,6 +171,8 @@ export declare namespace fromMethod {
         digest?: string | undefined;
         /** Optional expiration timestamp (ISO 8601). */
         expires?: z.DatetimeInput | undefined;
+        /** Optional HTTP field name to carry the payment credential. When omitted, uses Authorization. */
+        header?: string | undefined;
         /** Optional server-defined correlation data (serialized as `opaque` on the challenge). Flat string-to-string map; clients MUST NOT modify. */
         meta?: Record<string, string> | undefined;
         /** Server realm (e.g., hostname). */
@@ -309,4 +314,6 @@ export declare namespace verify {
 }
 /** Extracts parsed server-defined correlation data from a challenge when available. */
 export declare function meta(challenge: Challenge): Record<string, string> | undefined;
+/** Returns the HTTP field name a client must use for a payment credential. */
+export declare function credentialHeader(challenge: Challenge): string;
 //# sourceMappingURL=Challenge.d.ts.map

package/dist/Challenge.js

@@ -21,6 +21,8 @@ export const Schema = z.object({
     digest: z.optional(z.string().check(z.regex(/^sha-256=/, 'Invalid digest format'))),
     /** Optional expiration timestamp (ISO 8601). */
     expires: z.optional(z.datetime()),
+    /** Optional HTTP field name to carry the payment credential. When omitted, uses Authorization. */
+    header: z.optional(z.string().check(z.regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/, 'Invalid HTTP header name'))),
     /** Unique challenge identifier (HMAC-bound). */
     id: z.string().check(z.minLength(1)),
     /** Intent type (e.g., "charge", "session"). */
@@ -75,7 +77,11 @@ export const Schema = z.object({
  */
 export function from(parameters, options) {
     void options;
-    const { description, digest, meta, method: methodName, intent, realm, request, secretKey, } = parameters;
+    const { description, digest, meta, method: methodName, header: suppliedHeader, intent, realm, request, secretKey, } = parameters;
+    // `Authorization` is the implicit protocol default and is intentionally not
+    // advertised on the wire. This preserves the legacy challenge binding and
+    // lets servers opt into an alternate credential field explicitly.
+    const header = isDefaultCredentialHeader(suppliedHeader) ? undefined : suppliedHeader;
     const expires = parameters.expires ? z.toDatetimeString(parameters.expires) : undefined;
     const opaque = parameters.opaque ?? (meta !== undefined ? PaymentRequest.serialize(meta) : undefined);
     const id = secretKey
@@ -90,6 +96,7 @@ export function from(parameters, options) {
         ...(description && { description }),
         ...(digest && { digest }),
         ...(expires && { expires }),
+        ...(header !== undefined && { header }),
         ...(meta !== undefined && { meta }),
         ...(opaque !== undefined && { opaque }),
     });
@@ -128,7 +135,7 @@ export function from(parameters, options) {
  */
 export function fromMethod(method, parameters) {
     const { name: methodName, intent } = method;
-    const { description, digest, expires, id, meta, realm, secretKey } = parameters;
+    const { description, digest, expires, header, id, meta, realm, secretKey } = parameters;
     const request = PaymentRequest.fromMethod(method, parameters.request);
     return from({
         ...(id !== undefined ? { id } : { secretKey }),
@@ -139,6 +146,7 @@ export function fromMethod(method, parameters) {
         description,
         digest,
         expires,
+        header,
         meta,
     });
 }
@@ -170,6 +178,9 @@ export function serialize(challenge) {
         parts.push(authParam('digest', challenge.digest));
     if (challenge.expires !== undefined)
         parts.push(authParam('expires', challenge.expires));
+    const credentialHeader = challenge.header;
+    if (credentialHeader !== undefined && !isDefaultCredentialHeader(credentialHeader))
+        parts.push(authParam('header', credentialHeader));
     if (challenge.opaque !== undefined)
         parts.push(authParam('opaque', challenge.opaque));
     else if (challenge.meta !== undefined)
@@ -490,22 +501,37 @@ export function meta(challenge) {
  * of truth for what the challenge ID binds to — used by both `computeId()`
  * (challenge creation) and `verify()` (credential verification).
  *
- * Slots: realm | method | intent | request | expires | digest | opaque
+ * Legacy slots: realm | method | intent | request | expires | digest | opaque.
+ * Challenges advertising a credential header insert it immediately before the
+ * final opaque slot.
  *
  * Because the HMAC covers ALL fields, the server does not need to separately
  * pin opaque, digest, or expires during verification — any change to those
  * fields produces a different HMAC and fails the ID comparison.
  */
 function idBindingInput(challenge) {
-    return [
+    const values = [
         challenge.realm,
         challenge.method,
         challenge.intent,
         PaymentRequest.serialize(challenge.request),
         challenge.expires ?? '',
         challenge.digest ?? '',
-        challenge.opaque ?? (challenge.meta ? PaymentRequest.serialize(challenge.meta) : ''),
-    ].join('|');
+    ];
+    // Keep opaque in the final optional slot required by the Payment auth scheme.
+    const credentialHeader = challenge.header;
+    if (credentialHeader !== undefined && !isDefaultCredentialHeader(credentialHeader))
+        values.push(credentialHeader);
+    values.push(challenge.opaque ?? (challenge.meta ? PaymentRequest.serialize(challenge.meta) : ''));
+    return values.join('|');
+}
+/** Returns the HTTP field name a client must use for a payment credential. */
+export function credentialHeader(challenge) {
+    return challenge.header ?? Constants.Headers.authorization;
+}
+/** Returns whether a credential header is the implicit HTTP authentication default. */
+function isDefaultCredentialHeader(header) {
+    return header?.toLowerCase() === Constants.Headers.authorization.toLowerCase();
 }
 /** @internal Computes HMAC-SHA256 challenge ID from parameters. */
 function computeId(challenge, options) {

package/dist/Constants.d.ts

@@ -2,6 +2,7 @@
 export declare const Headers: {
     readonly acceptPayment: 'Accept-Payment';
     readonly authorization: 'Authorization';
+    readonly paymentAuthorization: 'Payment-Authorization';
     readonly paymentReceipt: 'Payment-Receipt';
     readonly paymentSession: 'Payment-Session';
     readonly paymentSessionSnapshot: 'Payment-Session-Snapshot';

package/dist/Constants.js

@@ -2,6 +2,7 @@
 export const Headers = {
     acceptPayment: 'Accept-Payment',
     authorization: 'Authorization',
+    paymentAuthorization: 'Payment-Authorization',
     paymentReceipt: 'Payment-Receipt',
     paymentSession: 'Payment-Session',
     paymentSessionSnapshot: 'Payment-Session-Snapshot',

package/dist/Credential.d.ts

@@ -12,7 +12,7 @@ export type Credential<payload = unknown, challenge extends Challenge.Challenge
 };
 export declare class MissingAuthorizationHeaderError extends Error {
     readonly name = "MissingAuthorizationHeaderError";
-    constructor();
+    constructor(header?: string);
 }
 export declare class MissingPaymentSchemeError extends Error {
     readonly name = "MissingPaymentSchemeError";
@@ -23,7 +23,7 @@ export declare class InvalidCredentialEncodingError extends Error {
     constructor();
 }
 /**
- * Deserializes an Authorization header value to a credential.
+ * Deserializes a Payment credential header value to a credential.
  * Accepts the spec-compliant base64url `opaque` string shape and the legacy
  * object-shaped `opaque` form emitted by older mppx versions.
  *
@@ -66,7 +66,7 @@ export declare namespace from {
     };
 }
 /**
- * Extracts the credential from a Request's Authorization header.
+ * Extracts the credential from a Request's configured credential header.
  *
  * @param request - The HTTP request.
  * @returns The deserialized credential.
@@ -78,9 +78,15 @@ export declare namespace from {
  * const credential = Credential.fromRequest(request)
  * ```
  */
-export declare function fromRequest<payload = unknown>(request: Request): Credential<payload>;
+export declare function fromRequest<payload = unknown>(request: Request, options?: fromRequest.Options): Credential<payload>;
+export declare namespace fromRequest {
+    type Options = {
+        /** HTTP field containing the Payment credential. @default 'Authorization' */
+        header?: string | undefined;
+    };
+}
 /**
- * Serializes a credential to the Authorization header format.
+ * Serializes a credential to the Payment credential header format.
  * When present, `challenge.opaque` is emitted unchanged as the base64url string
  * required by the Payment auth credential format.
  *

package/dist/Credential.js

@@ -4,8 +4,8 @@ import * as Constants from './Constants.js';
 import * as PaymentRequest from './PaymentRequest.js';
 export class MissingAuthorizationHeaderError extends Error {
     name = 'MissingAuthorizationHeaderError';
-    constructor() {
-        super('Missing Authorization header.');
+    constructor(header = Constants.Headers.authorization) {
+        super(`Missing ${header} header.`);
     }
 }
 export class MissingPaymentSchemeError extends Error {
@@ -21,7 +21,7 @@ export class InvalidCredentialEncodingError extends Error {
     }
 }
 /**
- * Deserializes an Authorization header value to a credential.
+ * Deserializes a Payment credential header value to a credential.
  * Accepts the spec-compliant base64url `opaque` string shape and the legacy
  * object-shaped `opaque` form emitted by older mppx versions.
  *
@@ -105,7 +105,7 @@ export function from(parameters) {
     };
 }
 /**
- * Extracts the credential from a Request's Authorization header.
+ * Extracts the credential from a Request's configured credential header.
  *
  * @param request - The HTTP request.
  * @returns The deserialized credential.
@@ -117,17 +117,17 @@ export function from(parameters) {
  * const credential = Credential.fromRequest(request)
  * ```
  */
-export function fromRequest(request) {
-    const header = request.headers.get(Constants.Headers.authorization);
+export function fromRequest(request, options = {}) {
+    const header = request.headers.get(options.header ?? Constants.Headers.authorization);
     if (!header)
-        throw new MissingAuthorizationHeaderError();
+        throw new MissingAuthorizationHeaderError(options.header);
     const payment = extractPaymentScheme(header);
     if (!payment)
         throw new MissingPaymentSchemeError();
     return deserialize(payment);
 }
 /**
- * Serializes a credential to the Authorization header format.
+ * Serializes a credential to the Payment credential header format.
  * When present, `challenge.opaque` is emitted unchanged as the base64url string
  * required by the Payment auth credential format.
  *

package/dist/Html.js

@@ -34,7 +34,7 @@ export function init(methodName) {
             document.getElementById(data.rootId)?.after(el);
         },
         root: document.getElementById(data.rootId),
-        submit: submitCredential,
+        submit: (credential) => submitCredential(credential, data.challenge.header),
         vars,
     };
 }

package/dist/cli/THIRD-PARTY-LICENSES.txt

@@ -253,7 +253,7 @@ SOFTWARE.
 
 ---
 
-# incur@0.4.26 (MIT)
+# incur@0.5.1 (MIT)
 
 LICENSE
 -------

package/dist/cli/cli.d.ts

@@ -1,6 +1,6 @@
 import { Cli } from 'incur';
 declare const cli: Cli.Cli<{
-    [x: string]: {
+    mppx: {
         args: {
             url: string;
         };
@@ -29,6 +29,6 @@ declare const cli: Cli.Cli<{
             verbose: number;
         };
     };
-}, undefined, undefined, undefined>;
+}, undefined, undefined, undefined, "mppx">;
 export default cli;
 //# sourceMappingURL=cli.d.ts.map