mppx 0.8.4 → 0.8.6

package/src/Receipt.ts

@@ -3,17 +3,7 @@ import { Base64 } from 'ox'
 import * as Constants from './Constants.js'
 import * as z from './zod.js'
 
-/**
- * Schema for a payment receipt.
- *
- * @example
- * ```ts
- * import { Receipt } from 'mppx'
- *
- * const receipt = Receipt.Schema.parse(data)
- * ```
- */
-export const Schema = z.object({
+const shape = {
   /** Payment method used (e.g., "tempo", "stripe"). */
   method: z.string(),
   /** Method-specific reference (e.g., transaction hash). */
@@ -26,11 +16,34 @@ export const Schema = z.object({
   status: z.literal('success'),
   /** RFC 3339 settlement timestamp. */
   timestamp: z.datetime(),
-})
+}
+
+/** Base-field schema used only to derive the {@link Receipt} type without an index signature. */
+const BaseSchema = z.object(shape)
+
+/**
+ * Schema for a payment receipt.
+ *
+ * Method specifications may define additional receipt fields beyond the
+ * base set (per the core spec's Payment-Receipt section); unknown fields
+ * are preserved through parse/serialize round-trips rather than stripped.
+ *
+ * @example
+ * ```ts
+ * import { Receipt } from 'mppx'
+ *
+ * const receipt = Receipt.Schema.parse(data)
+ * ```
+ */
+export const Schema = z.looseObject(shape)
 
 /**
  * Payment receipt returned after verification.
  *
+ * Method-specific extension fields are preserved at runtime but not part of
+ * this base type; method packages can type them via intersection
+ * (e.g. `Receipt.Receipt & { originTxHash: string }`).
+ *
  * @example
  * ```ts
  * import { Receipt } from 'mppx'
@@ -43,7 +56,7 @@ export const Schema = z.object({
  * }
  * ```
  */
-export type Receipt = z.infer<typeof Schema>
+export type Receipt = z.infer<typeof BaseSchema>
 
 /**
  * Deserializes a Payment-Receipt header value to a receipt.

package/src/cli/cli.test.ts

@@ -43,7 +43,7 @@ afterAll(() => {
 })
 
 async function serve(argv: string[], options?: { env?: Record<string, string | undefined> }) {
-  let output = ''
+  const stdoutChunks: Buffer[] = []
   let stderr = ''
   let exitCode: number | undefined
   const saved: Record<string, string | undefined> = {}
@@ -58,7 +58,9 @@ async function serve(argv: string[], options?: { env?: Record<string, string | u
   const origLog = console.log
   const origError = console.error
   process.stdout.write = ((chunk: unknown) => {
-    output += typeof chunk === 'string' ? chunk : String(chunk)
+    if (typeof chunk === 'string') stdoutChunks.push(Buffer.from(chunk))
+    else if (chunk instanceof Uint8Array) stdoutChunks.push(Buffer.from(chunk))
+    else stdoutChunks.push(Buffer.from(String(chunk)))
     return true
   }) as typeof process.stdout.write
   process.stderr.write = ((chunk: unknown) => {
@@ -66,7 +68,7 @@ async function serve(argv: string[], options?: { env?: Record<string, string | u
     return true
   }) as typeof process.stderr.write
   console.log = (...args: unknown[]) => {
-    output += `${args.map(String).join(' ')}\n`
+    stdoutChunks.push(Buffer.from(`${args.map(String).join(' ')}\n`))
   }
   console.error = (...args: unknown[]) => {
     stderr += `${args.map(String).join(' ')}\n`
@@ -74,7 +76,7 @@ async function serve(argv: string[], options?: { env?: Record<string, string | u
   try {
     await cli.serve(argv, {
       stdout(s: string) {
-        output += s
+        stdoutChunks.push(Buffer.from(s))
       },
       exit(code: number) {
         exitCode = code
@@ -90,7 +92,8 @@ async function serve(argv: string[], options?: { env?: Record<string, string | u
       else process.env[key] = value
     }
   }
-  return { output, stderr, exitCode }
+  const stdoutBytes = Buffer.concat(stdoutChunks)
+  return { output: stdoutBytes.toString(), stderr, exitCode, stdoutBytes }
 }
 
 function createMockChargeMethod(name: string) {
@@ -430,6 +433,24 @@ describe('services', () => {
   })
 })
 
+describe('request output', () => {
+  test('writes non-402 response bodies to stdout without text decoding', async () => {
+    const body = Buffer.from([0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x0a, 0x0a])
+    const httpServer = await Http.createServer((_req, res) => {
+      res.writeHead(200, { 'Content-Type': 'application/pdf' })
+      res.end(body)
+    })
+
+    try {
+      const { exitCode, stdoutBytes } = await serve([httpServer.url, '-s'])
+      expect(exitCode).toBeUndefined()
+      expect(stdoutBytes).toEqual(body)
+    } finally {
+      httpServer.close()
+    }
+  })
+})
+
 describe('basic charge (examples/basic)', () => {
   test('happy path: makes payment and receives response', { timeout: 120_000 }, async () => {
     const { Actions } = await import('viem/tempo')
@@ -1819,6 +1840,21 @@ test('mppx --help', async () => {
   expect(output).toContain('sign')
 })
 
+describe('account fund help', () => {
+  test('only advertises testnet network funding', async () => {
+    const { output } = await serve(['account', 'fund', '--help'])
+    expect(output).toContain('--network <testnet>')
+    expect(output).not.toContain('mainnet|testnet')
+  })
+
+  test('rejects mainnet network funding', async () => {
+    const { exitCode, output } = await serve(['account', 'fund', '--network', 'mainnet'])
+    expect(exitCode).toBe(1)
+    expect(output).toContain('Invalid input')
+    expect(output).toContain('testnet')
+  })
+})
+
 // ---------------------------------------------------------------------------
 // sign
 // ---------------------------------------------------------------------------

package/src/cli/cli.ts

@@ -99,6 +99,10 @@ function outputResult<Data>(
   return undefined as unknown as Data
 }
 
+async function writeResponseBody(response: Response) {
+  process.stdout.write(Buffer.from(await response.arrayBuffer()))
+}
+
 function canReadCommandStdin() {
   if (process.stdin.isTTY !== false) return false
   return process.stdin.listenerCount('data') === 0 && process.stdin.listenerCount('readable') === 0
@@ -371,7 +375,7 @@ const cli = Cli.create('mppx', {
             exitCode: 22,
           })
         printResponseHeaders(challengeResponse, headerOpts)
-        console.log((await challengeResponse.text()).replace(/\n+$/, ''))
+        await writeResponseBody(challengeResponse)
         return
       }
 
@@ -625,8 +629,7 @@ const cli = Cli.create('mppx', {
           } catch {}
         }
 
-        const body = (await credentialResponse.text()).replace(/\n+$/, '')
-        console.log(body)
+        await writeResponseBody(credentialResponse)
       }
     } catch (err) {
       // Re-throw IncurError so incur's error handler formats it properly
@@ -864,7 +867,7 @@ const account = Cli.create('account', {
     description: 'Fund account with testnet tokens',
     options: z.object({
       account: z.string().optional().describe('Account name (env: MPPX_ACCOUNT)'),
-      network: z.enum(['mainnet', 'testnet']).optional().describe('Tempo network'),
+      network: z.enum(['testnet']).optional().describe('Tempo network'),
       rpcUrl: z.string().optional().describe('RPC endpoint (env: MPPX_RPC_URL)'),
     }),
     output: z.object({ account: z.string(), chain: z.string(), transactions: z.array(z.string()) }),

package/src/cli/plugins/tempo.ts

@@ -42,6 +42,11 @@ const booleanOption = z.union([
   z.literal('true').transform(() => true),
   z.literal('false').transform(() => false),
 ])
+
+async function writeResponseBody(response: Response) {
+  process.stdout.write(Buffer.from(await response.arrayBuffer()))
+}
+
 const tempoOptionSchema = z.object({
   autoSwap: z.optional(booleanOption),
   channel: z.optional(z.coerce.string()),
@@ -425,8 +430,7 @@ export function tempo() {
         })
       } else {
         // Non-SSE: print body, then close channel
-        const body = (await credentialResponse.text()).replace(/\n+$/, '')
-        console.log(body)
+        await writeResponseBody(credentialResponse)
 
         if (channelId && escrowContract && chainId) {
           if (confirmEnabled) info('\n')

package/src/client/internal/Fetch.test.ts

@@ -1742,6 +1742,50 @@ describe('Fetch.from: 402 retry path', () => {
     expect(createCredential).toHaveBeenCalledOnce()
     expect(response.status).toBe(402)
   })
+
+  test('returns a challenge-less 402 after a rejected payment', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
+    const mockFetch: typeof globalThis.fetch = async () => {
+      callCount++
+      if (callCount === 1) return make402()
+      return new Response(JSON.stringify({ title: 'Verification Failed' }), {
+        status: 402,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+    expect(callCount).toBe(2)
+    expect(createCredential).toHaveBeenCalledOnce()
+    expect(response.status).toBe(402)
+    await expect(response.json()).resolves.toEqual({ title: 'Verification Failed' })
+  })
+
+  test('returns a post-payment 402 with only unsupported challenges', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
+    const mockFetch: typeof globalThis.fetch = async () => {
+      callCount++
+      if (callCount === 1) return make402()
+      return make402({ method: 'stripe', intent: 'charge' })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+    expect(callCount).toBe(2)
+    expect(createCredential).toHaveBeenCalledOnce()
+    expect(response.status).toBe(402)
+  })
 })
 
 describe('Fetch.from: acceptPaymentPolicy', () => {

package/src/client/internal/Fetch.ts

@@ -221,10 +221,14 @@ export function from<const methods extends readonly Method.AnyClient[]>(
             orderChallenges,
         )
         const selected = orderedCandidates[0]
-        if (!selected)
+        if (!selected) {
+          // A post-payment 402 with no actionable challenge (e.g. rejected credential)
+          // is the server's final answer, not a new challenge round.
+          if (retry > 0) return response
           throw new Error(
             `No method found for challenges: ${challenges.map((c) => `${c.method}.${c.intent}`).join(', ')}. Available: ${methods.map((m) => `${m.name}.${m.intent}`).join(', ')}`,
           )
+        }
 
         const selectedChallenge = selected.challenge
         challenge = selectedChallenge

package/src/evm/PublicInterface.test-d.ts

@@ -7,6 +7,7 @@ import {
 } from 'mppx/evm/client'
 import { assets as serverAssets, charge as serverCharge, evm as serverEvm } from 'mppx/evm/server'
 import type { Account } from 'viem'
+import { tokens, usdc } from 'viem/tokens'
 import { describe, expectTypeOf, test } from 'vp/test'
 
 import { Mppx as ClientMppx } from '../client/index.js'
@@ -30,6 +31,12 @@ const facilitator = {
 describe('evm public interface', () => {
   test('exports EVM asset metadata from root and subpaths', () => {
     expectTypeOf(evmRoot.assets.base.USDC).toMatchTypeOf<typeof serverAssets.base.USDC>()
+    expectTypeOf(
+      evmRoot.assets.fromToken(usdc, {
+        chainId: clientChains.base,
+        transfer: { type: 'eip3009', version: '2' },
+      }),
+    ).toMatchTypeOf<typeof serverAssets.base.USDC>()
     expectTypeOf(clientAssets.baseSepolia.USDC).toMatchTypeOf<
       typeof serverAssets.baseSepolia.USDC
     >()
@@ -53,6 +60,13 @@ describe('evm public interface', () => {
 
     const mppx = ServerMppx.create({
       methods: [
+        serverEvm({
+          authorization: { name: 'USD Coin', version: '2' },
+          chainId: clientChains.base,
+          currency: usdc,
+          recipient,
+          x402: { facilitator },
+        }),
         serverEvm({
           currency: serverAssets.base.USDC,
           recipient,
@@ -90,9 +104,8 @@ describe('evm public interface', () => {
       methods: [
         clientEvm({
           account,
-          currencies: [clientAssets.baseSepolia.USDC],
+          currencies: tokens.popular,
           maxAmount: '0.01',
-          networks: [clientEvm.chains.baseSepolia],
         }),
       ],
       polyfill: false,

package/src/evm/client/Charge.test.ts

@@ -1,5 +1,6 @@
 import { Challenge } from 'mppx'
 import type { Account } from 'viem'
+import { tokens } from 'viem/tokens'
 import { describe, expect, test, vi } from 'vp/test'
 
 import * as Assets from '../Assets.js'
@@ -96,4 +97,251 @@ describe('evm charge client', () => {
       'EVM raw currency allowlists require networks.',
     )
   })
+
+  test('accepts viem token sets for currency policy and decimals', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      authorization: { name: 'USD Coin', version: '2' },
+      currencies: tokens.popular,
+      maxAmount: '1',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '1000000',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await client.createCredential({ challenge } as never)
+
+    expect(signTypedData).toHaveBeenCalledWith(
+      expect.objectContaining({
+        domain: expect.objectContaining({
+          name: 'USD Coin',
+          verifyingContract: Assets.baseSepolia.USDC.address,
+          version: '2',
+        }),
+      }),
+    )
+  })
+
+  test('uses viem token decimals for native authorization maxAmount policy', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      authorization: { name: 'USD Coin', version: '2' },
+      currencies: tokens.popular,
+      maxAmount: '1',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '1000001',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await expect(client.createCredential({ challenge } as never)).rejects.toThrow(
+      'EVM charge amount exceeds maxAmount.',
+    )
+    expect(signTypedData).not.toHaveBeenCalled()
+  })
+
+  test('requires authorization metadata when signing viem token currencies', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      currencies: tokens.popular,
+      maxAmount: '1',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '1000000',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await expect(client.createCredential({ challenge } as never)).rejects.toThrow(
+      'EVM authorization requires token name and version.',
+    )
+    expect(signTypedData).not.toHaveBeenCalled()
+  })
+
+  test('accepts viem token sets through legacy assets policy', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      assets: tokens.popular,
+      authorization: { name: 'USD Coin', version: '2' },
+      maxAmount: '1',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '1000000',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await client.createCredential({ challenge } as never)
+
+    expect(signTypedData).toHaveBeenCalledOnce()
+  })
+
+  test('uses known asset metadata for native authorization policy and signing domain', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      currencies: [Assets.baseSepolia.USDC],
+      maxAmount: '0.01',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '10000',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await client.createCredential({ challenge } as never)
+
+    expect(signTypedData).toHaveBeenCalledOnce()
+    expect(signTypedData).toHaveBeenCalledWith(
+      expect.objectContaining({
+        domain: expect.objectContaining({
+          name: 'USDC',
+          version: '2',
+        }),
+      }),
+    )
+  })
+
+  test('uses known asset decimals for native authorization maxAmount policy', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      currencies: [Assets.baseSepolia.USDC],
+      maxAmount: '0.01',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '10001',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 84532,
+          credentialTypes: ['authorization'],
+          decimals: 18,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await expect(client.createCredential({ challenge } as never)).rejects.toThrow(
+      'EVM charge amount exceeds maxAmount.',
+    )
+    expect(signTypedData).not.toHaveBeenCalled()
+  })
+
+  test('pins known asset native authorization policy to its network', async () => {
+    const signTypedData = vi.fn(async () => '0x1234')
+    const client = charge({
+      account: {
+        ...account,
+        signTypedData,
+      } as unknown as Account,
+      currencies: [Assets.baseSepolia.USDC],
+      maxAmount: '0.01',
+    })
+    const challenge = Challenge.from({
+      id: 'native',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'api.example.com',
+      request: {
+        amount: '10000',
+        currency: Assets.baseSepolia.USDC.address,
+        methodDetails: {
+          chainId: 8453,
+          credentialTypes: ['authorization'],
+          decimals: 6,
+        },
+        recipient: '0x2222222222222222222222222222222222222222',
+      },
+    })
+
+    await expect(client.createCredential({ challenge } as never)).rejects.toThrow(
+      'EVM currency is not allowed: 0x036CbD53842c5426634e7929541eC2318f3dCF7e.',
+    )
+    expect(signTypedData).not.toHaveBeenCalled()
+  })
 })

package/src/evm/client/Charge.ts

@@ -106,9 +106,9 @@ export declare namespace charge {
     /** Optional allowlist of supported EVM chain IDs. */
     networks?: readonly number[] | undefined
     /** Optional allowlist of supported currencies. */
-    currencies?: readonly (`0x${string}` | Assets.KnownAsset)[] | undefined
+    currencies?: readonly Assets.Currency[] | undefined
     /** Legacy alias for `currencies`. */
-    assets?: readonly (`0x${string}` | Assets.KnownAsset)[] | undefined
+    assets?: readonly Assets.Currency[] | undefined
   }
 }
 
@@ -127,12 +127,12 @@ function assertPolicy(parameters: charge.Parameters, request: Types.ChargeReques
     throw new Error(`EVM chain ID is not allowed: ${chainId}.`)
 
   const currencies = parameters.currencies ?? parameters.assets
-  if (currencies?.some((currency) => !Assets.isAsset(currency)) && !parameters.networks?.length)
+  if (currencies?.some((currency) => Assets.isRawAddress(currency)) && !parameters.networks?.length)
     throw new Error('EVM raw currency allowlists require networks.')
   if (currencies) {
     const acceptedCurrency = getAddress(request.currency as `0x${string}`)
     const allowed = currencies.some((currency) =>
-      currencyMatches(currency, acceptedCurrency, network),
+      Assets.matches(currency, acceptedCurrency, network),
     )
     if (!allowed) throw new Error(`EVM currency is not allowed: ${acceptedCurrency}.`)
   }
@@ -159,30 +159,18 @@ function resolveAuthorization(
   const acceptedCurrency = getAddress(request.currency as `0x${string}`)
   const network = Types.networkOf(request.methodDetails.chainId)
   const currency = currencies?.find((currency) =>
-    currencyMatches(currency, acceptedCurrency, network),
+    Assets.matches(currency, acceptedCurrency, network),
   )
-  if (currency && Assets.isAsset(currency) && currency.transfer.type === Types.eip3009)
+  const resolved = currency ? Assets.resolve(currency, network) : undefined
+  if (resolved?.transfer?.type === Types.eip3009)
     return {
-      name: currency.transfer.name,
-      version: currency.transfer.version,
+      name: resolved.transfer.name,
+      version: resolved.transfer.version,
     }
   if (parameters.authorization) return parameters.authorization
   throw new Error('EVM authorization requires token name and version.')
 }
 
-function addressOf(currency: `0x${string}` | Assets.KnownAsset): `0x${string}` {
-  return Assets.isAsset(currency) ? currency.address : currency
-}
-
-function currencyMatches(
-  currency: `0x${string}` | Assets.KnownAsset,
-  acceptedCurrency: `0x${string}`,
-  network: Types.EvmNetwork,
-): boolean {
-  if (getAddress(addressOf(currency)) !== acceptedCurrency) return false
-  return !Assets.isAsset(currency) || currency.network === network
-}
-
 function decimalsOfAcceptedCurrency(
   parameters: charge.Parameters,
   request: Types.ChargeRequest,
@@ -191,8 +179,9 @@ function decimalsOfAcceptedCurrency(
   const acceptedCurrency = getAddress(request.currency as `0x${string}`)
   const network = Types.networkOf(request.methodDetails.chainId)
   const currency = currencies?.find((currency) =>
-    currencyMatches(currency, acceptedCurrency, network),
+    Assets.matches(currency, acceptedCurrency, network),
   )
-  if (currency && Assets.isAsset(currency)) return currency.decimals
+  const resolved = currency ? Assets.resolve(currency, network) : undefined
+  if (resolved?.decimals !== undefined) return resolved.decimals
   return parameters.decimals
 }