mppx 0.8.2 → 0.8.4

package/dist/tempo/server/internal/html.gen.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,2j2oBAA2j2oB,CAAA"}
+{"version":3,"file":"html.gen.js","sourceRoot":"","sources":["../../../../src/tempo/server/internal/html.gen.ts"],"names":[],"mappings":"AAAA,2BAA2B;AAC3B,MAAM,CAAC,MAAM,IAAI,GAAG,swrpBAAswrpB,CAAA"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.8.2",
+  "version": "0.8.4",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",
@@ -140,7 +140,7 @@
     "elysia": ">=1",
     "express": ">=5",
     "hono": ">=4.12.25",
-    "viem": ">=2.51.0"
+    "viem": ">=2.54.0"
   },
   "peerDependenciesMeta": {
     "@modelcontextprotocol/sdk": {

package/src/cli/cli.test.ts

@@ -20,6 +20,7 @@ import * as Receipt from '../Receipt.js'
 import * as Mppx_server from '../server/Mppx.js'
 import { toNodeListener } from '../server/Mppx.js'
 import * as Store from '../Store.js'
+import { stripePreviewVersion } from '../stripe/internal/constants.js'
 import { stripe as stripe_server } from '../stripe/server/Methods.js'
 import { tempo } from '../tempo/server/Methods.js'
 import { escrowAbi } from '../tempo/session/precompile/escrow.abi.js'
@@ -1403,40 +1404,144 @@ describe('stripe charge', () => {
     }
   })
 
-  test('error: production key rejected', { timeout: 60_000 }, async () => {
-    const server = Mppx_server.create({
-      methods: [
-        stripe_server.charge({
-          secretKey: 'sk_test_mock',
-          networkId: 'internal',
-          paymentMethodTypes: ['card'],
-        }),
-      ],
-      realm: 'cli-test-stripe-live',
-      secretKey: 'cli-test-secret-cli-test-secret-32',
-    })
+  test(
+    'happy path: live key uses production SPT endpoint and seller business profile',
+    { timeout: 60_000 },
+    async () => {
+      const mockStripeClient = {
+        paymentIntents: {
+          create: async () => ({ id: 'pi_mock_cli_live_123', status: 'succeeded' }),
+        },
+      }
 
-    const appServer = await Http.createServer(async (req, res) => {
-      const result = await Mppx_server.toNodeListener(
-        server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
-      )(req, res)
-      if (result.status === 402) return
-      res.end('paid')
-    })
+      const server = Mppx_server.create({
+        methods: [
+          stripe_server.charge({
+            client: mockStripeClient,
+            networkId: 'profile_live_mock',
+            paymentMethodTypes: ['card'],
+          }),
+        ],
+        realm: 'cli-test-stripe-live',
+        secretKey: 'cli-test-secret-cli-test-secret-32',
+      })
 
-    try {
-      const { output, exitCode } = await serve(
-        [appServer.url, '-s', '-M', 'paymentMethod=pm_card_visa'],
-        { env: { MPPX_STRIPE_SECRET_KEY: 'sk_live_fake' } },
+      const appServer = await Http.createServer(async (req, res) => {
+        const result = await Mppx_server.toNodeListener(
+          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
+        )(req, res)
+        if (result.status === 402) return
+        res.end('paid')
+      })
+
+      const { restore, stripeRequests } = mockSptFetch(
+        'https://api.stripe.com/v1/shared_payment/issued_tokens',
       )
-      expect(exitCode).toBe(2)
-      expect(output).toContain('test mode')
-    } finally {
-      appServer.close()
-    }
-  })
+
+      try {
+        const { output } = await serve([appServer.url, '-s', '-M', 'paymentMethod=pm_card_visa'], {
+          env: { MPPX_STRIPE_SECRET_KEY: 'sk_live_fake', MPPX_STRIPE_SPT_URL: undefined },
+        })
+        expect(output).toContain('paid')
+        const stripeRequest = stripeRequests[0]
+        expect(stripeRequest?.url).toBe('https://api.stripe.com/v1/shared_payment/issued_tokens')
+        expect(stripeRequest?.body.get('seller_details[network_business_profile]')).toBe(
+          'profile_live_mock',
+        )
+        expect(stripeRequest?.body.has('seller_details[network_id]')).toBe(false)
+        expect(stripeRequest?.headers['Stripe-Version']).toBe(stripePreviewVersion)
+      } finally {
+        restore()
+        appServer.close()
+      }
+    },
+  )
+
+  test(
+    'happy path: test key uses test-helper SPT endpoint and network ID',
+    { timeout: 60_000 },
+    async () => {
+      const mockStripeClient = {
+        paymentIntents: {
+          create: async () => ({ id: 'pi_mock_cli_test_123', status: 'succeeded' }),
+        },
+      }
+
+      const server = Mppx_server.create({
+        methods: [
+          stripe_server.charge({
+            client: mockStripeClient,
+            networkId: 'internal',
+            paymentMethodTypes: ['card'],
+          }),
+        ],
+        realm: 'cli-test-stripe-testmode',
+        secretKey: 'cli-test-secret-cli-test-secret-32',
+      })
+
+      const appServer = await Http.createServer(async (req, res) => {
+        const result = await Mppx_server.toNodeListener(
+          server.charge({ amount: '1', currency: 'usd', decimals: 2 }),
+        )(req, res)
+        if (result.status === 402) return
+        res.end('paid')
+      })
+
+      const { restore, stripeRequests } = mockSptFetch(
+        'https://api.stripe.com/v1/test_helpers/shared_payment/granted_tokens',
+      )
+
+      try {
+        const { output } = await serve([appServer.url, '-s', '-M', 'paymentMethod=pm_card_visa'], {
+          env: { MPPX_STRIPE_SECRET_KEY: 'sk_test_fake', MPPX_STRIPE_SPT_URL: undefined },
+        })
+        expect(output).toContain('paid')
+        const stripeRequest = stripeRequests[0]
+        expect(stripeRequest?.url).toBe(
+          'https://api.stripe.com/v1/test_helpers/shared_payment/granted_tokens',
+        )
+        expect(stripeRequest?.body.get('seller_details[network_id]')).toBe('internal')
+        expect(stripeRequest?.body.has('seller_details[network_business_profile]')).toBe(false)
+        expect(stripeRequest?.headers['Stripe-Version']).toBe(stripePreviewVersion)
+      } finally {
+        restore()
+        appServer.close()
+      }
+    },
+  )
 })
 
+/**
+ * Intercepts `globalThis.fetch` calls to `sptUrl`, recording each request and
+ * responding with a mock SPT. Returns the recorded requests and a `restore`
+ * function that reinstates the original fetch.
+ */
+function mockSptFetch(sptUrl: string) {
+  const originalFetch = globalThis.fetch
+  const stripeRequests: {
+    body: URLSearchParams
+    headers: Record<string, string>
+    url: string
+  }[] = []
+  globalThis.fetch = (async (input, init) => {
+    const url =
+      typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url
+    if (url === sptUrl) {
+      stripeRequests.push({
+        body: new URLSearchParams(init?.body as string),
+        headers: (init?.headers ?? {}) as Record<string, string>,
+        url,
+      })
+      return new Response(JSON.stringify({ id: 'spt_mock_cli_test' }), {
+        headers: { 'Content-Type': 'application/json' },
+        status: 200,
+      })
+    }
+    return originalFetch(input, init)
+  }) as typeof fetch
+  return { restore: () => (globalThis.fetch = originalFetch), stripeRequests }
+}
+
 // ---------------------------------------------------------------------------
 // account [action]
 // Keychain tests are opt-in because macOS/Linux keychain commands can block on

package/src/cli/cli.ts

@@ -40,6 +40,7 @@ import {
   resolveFundingNetwork,
   resolveRpcUrl,
 } from './utils.js'
+import validate from './validate/index.js'
 
 const packageJson = createRequire(import.meta.url)('../../package.json') as {
   name: string
@@ -1575,5 +1576,6 @@ cli.command(discover)
 cli.command(init)
 cli.command(services)
 cli.command(sign)
+cli.command(validate)
 
 export default cli

package/src/cli/mcp.test.ts

@@ -194,6 +194,7 @@ test('tools/list exposes mppx commands with input and output schemas', async ()
     'services_list',
     'services_show',
     'sign',
+    'validate',
   ])
   expect(tools.find((tool: { name: string }) => tool.name === 'account_list').outputSchema).toEqual(
     expect.objectContaining({

package/src/cli/plugins/stripe.ts

@@ -1,6 +1,7 @@
 import { Errors, z } from 'incur'
 
 import { stripe as stripeMethods } from '../../stripe/client/index.js'
+import { stripePreviewVersion } from '../../stripe/internal/constants.js'
 import { pc } from '../utils.js'
 import { createPlugin } from './plugin.js'
 
@@ -30,13 +31,6 @@ export function stripe() {
           message: 'MPPX_STRIPE_SECRET_KEY environment variable is required for Stripe payments.',
           exitCode: 2,
         })
-      if (!stripeSecretKey.startsWith('sk_test_'))
-        throw new Errors.IncurError({
-          code: 'UNSUPPORTED_MODE',
-          message:
-            'Stripe CLI payments are currently only supported in test mode (sk_test_... keys).',
-          exitCode: 2,
-        })
 
       return {
         tokenSymbol: currency?.toUpperCase() ?? '',
@@ -58,19 +52,35 @@ export function stripe() {
                 'usage_limits[max_amount]': amount,
                 'usage_limits[expires_at]': expiresAt.toString(),
               })
-              if (networkId) body.set('seller_details[network_id]', networkId)
+              const testMode = isTestKey(stripeSecretKey)
+              const sptUrl = (() => {
+                // Allow tests and custom deployments to target a specific SPT endpoint.
+                if (process.env.MPPX_STRIPE_SPT_URL) return process.env.MPPX_STRIPE_SPT_URL
+                // Preserve test-key behavior against Stripe's test-helper SPT endpoint.
+                if (testMode)
+                  return 'https://api.stripe.com/v1/test_helpers/shared_payment/granted_tokens'
+                // Live keys mint Shared Payment Tokens through the agent-side issued tokens API.
+                return 'https://api.stripe.com/v1/shared_payment/issued_tokens'
+              })()
+              if (networkId) {
+                // Live SPT issuance grants the token to the seller's Stripe business
+                // profile (`profile_...`); the test helper uses a plain network ID.
+                const sellerDetailsField = testMode
+                  ? 'seller_details[network_id]'
+                  : 'seller_details[network_business_profile]'
+                body.set(sellerDetailsField, networkId)
+              }
               if (metadata) {
                 for (const [key, value] of Object.entries(metadata)) {
                   body.set(`metadata[${key}]`, value)
                 }
               }
 
-              const sptUrl =
-                process.env.MPPX_STRIPE_SPT_URL ??
-                'https://api.stripe.com/v1/test_helpers/shared_payment/granted_tokens'
               const sptHeaders = {
                 Authorization: `Basic ${btoa(`${stripeSecretKey}:`)}`,
                 'Content-Type': 'application/x-www-form-urlencoded',
+                // SPT endpoints are in preview and require an explicit preview API version.
+                'Stripe-Version': stripePreviewVersion,
               }
 
               let response = await globalThis.fetch(sptUrl, {
@@ -80,7 +90,11 @@ export function stripe() {
               })
               if (!response.ok) {
                 const errorBody = (await response.json()) as { error: { message: string } }
+                // Retry without optional parameters only in test mode: the live
+                // issued-tokens endpoint requires `seller_details`, so a retry
+                // without it can never succeed.
                 if (
+                  testMode &&
                   (metadata || networkId) &&
                   errorBody.error.message.includes('Received unknown parameter')
                 ) {
@@ -122,7 +136,8 @@ export function stripe() {
 
     formatReceiptField(key, value) {
       if (key === 'reference' && typeof value === 'string' && value.startsWith('pi_')) {
-        const isTest = process.env.MPPX_STRIPE_SECRET_KEY?.startsWith('sk_test_')
+        const secretKey = process.env.MPPX_STRIPE_SECRET_KEY
+        const isTest = secretKey !== undefined && isTestKey(secretKey)
         const url = `https://dashboard.stripe.com${isTest ? '/test' : ''}/payments/${value}`
         return pc.link(url, value, true)
       }
@@ -132,6 +147,10 @@ export function stripe() {
 
 // --- Helpers ---
 
+function isTestKey(secretKey: string) {
+  return secretKey.startsWith('sk_test_') || secretKey.startsWith('rk_test_')
+}
+
 function parseOptions<const schema extends z.ZodType>(
   schema: schema,
   rawOptions: unknown,

package/src/cli/plugins/tempo.ts

@@ -883,6 +883,7 @@ async function scoreTempoChargeChallenge(
       account: probe.account,
       token: currency as Address,
     })
+    .then((value) => value.amount)
     .catch(() => undefined)
   if (balance === undefined) return 'unknownBalance'
   if (balance >= amountRaw) return 'payable'

package/src/cli/utils.test.ts

@@ -1,7 +1,13 @@
 import { tempo as tempoMainnet, tempoModerato } from 'viem/tempo/chains'
-import { afterEach, describe, expect, test } from 'vp/test'
+import { afterEach, describe, expect, test, vi } from 'vp/test'
 
-import { networkRpcUrls, resolveChain, resolveFundingNetwork, resolveRpcUrl } from './utils.js'
+import {
+  fetchTokenInfo,
+  networkRpcUrls,
+  resolveChain,
+  resolveFundingNetwork,
+  resolveRpcUrl,
+} from './utils.js'
 
 describe('resolveRpcUrl', () => {
   afterEach(() => {
@@ -97,3 +103,31 @@ describe('resolveChain', () => {
     expect(chain.id).not.toBe(tempoModerato.id)
   })
 })
+
+describe('fetchTokenInfo', () => {
+  afterEach(() => {
+    vi.doUnmock('viem/tempo')
+  })
+
+  test('uses 6 decimals when token metadata omits a numeric decimals value', async () => {
+    const token = '0x1111111111111111111111111111111111111111'
+    const account = '0x2222222222222222222222222222222222222222'
+    vi.doMock('viem/tempo', () => ({
+      Actions: {
+        token: {
+          getBalance: vi.fn(async () => ({ amount: 123n })),
+          getMetadata: vi.fn(async () => ({ decimals: undefined, symbol: 'TEST' })),
+        },
+      },
+    }))
+
+    const info = await fetchTokenInfo({} as never, token, account)
+
+    expect(info).toEqual({
+      balance: 123n,
+      decimals: 6,
+      symbol: 'TEST',
+      token,
+    })
+  })
+})

package/src/cli/utils.ts

@@ -287,6 +287,10 @@ export const testnetTokens = [
   '0x20c0000000000000000000000000000000000003',
 ] as const
 
+function toBaseUnitAmount(value: bigint | { amount: bigint }) {
+  return typeof value === 'bigint' ? value : value.amount
+}
+
 export function isTestnet(chain: Chain) {
   return chain.id !== tempoMainnet.id
 }
@@ -295,10 +299,18 @@ export async function fetchTokenInfo(
   client: ReturnType<typeof createClient>,
   token: Address,
   account: Address,
-) {
+): Promise<{
+  balance: bigint
+  decimals: number
+  symbol: string
+  token: Address
+}> {
   const { Actions } = await import('viem/tempo')
   const [balance, metadata] = await Promise.all([
-    Actions.token.getBalance(client, { account, token }).catch(() => 0n),
+    Actions.token
+      .getBalance(client, { account, token })
+      .then(toBaseUnitAmount)
+      .catch(() => 0n),
     Actions.token.getMetadata(client, { token }).catch(() => ({ symbol: token as string })),
   ])
   const knownSymbols: Record<string, string> = {
@@ -306,7 +318,8 @@ export async function fetchTokenInfo(
     [usdc]: 'USDC',
   }
   const symbol = knownSymbols[token] ?? metadata.symbol
-  const decimals = 'decimals' in metadata ? metadata.decimals : 6
+  const decimals =
+    'decimals' in metadata && typeof metadata.decimals === 'number' ? metadata.decimals : 6
   return { balance, symbol, decimals, token }
 }