mppx 0.8.5 → 0.8.7

package/src/cli/validate.test.ts

@@ -159,6 +159,12 @@ describe('validate: discovery', () => {
     expect(output).toContain('Document found and parseable')
   })
 
+  test('discovers openapi.json at root when subpath given', { timeout: 15_000 }, async () => {
+    const server = await mppServer(makeChallenge())
+    const { output } = await serve(['validate', `${server.url}/mpp`])
+    expect(output).toContain('Document found and parseable')
+  })
+
   test('reports invalid JSON', { timeout: 15_000 }, async () => {
     const server = await testServer((req, res) => {
       if (req.url?.includes('openapi.json')) {
@@ -280,9 +286,9 @@ describe('validate: challenge', () => {
       }
     })
     const { output, exitCode } = await serve(['validate', server.url])
-    expect(output).toContain(
-      'Not an MPP endpoint (No WWW-Authenticate header (may be x402 or other protocol))',
-    )
+    expect(output).toContain('Not an MPP endpoint')
+    expect(output).toContain('x402 protocol detected')
+    expect(output).toContain('x402 payment challenge')
     expect(exitCode).toBe(1)
   })
 
@@ -537,3 +543,137 @@ describe('validate: summary', () => {
     expect(output).toContain('failed')
   })
 })
+
+describe('validate: multi-challenge', () => {
+  function makeStripeChallenge(): Challenge.Challenge {
+    return {
+      id: 'stripe-id-123',
+      realm: 'localhost',
+      method: 'stripe',
+      intent: 'charge',
+      request: {
+        amount: '100',
+        currency: 'usd',
+        methodDetails: {
+          networkId: 'profile_test123',
+          paymentMethodTypes: ['card'],
+        },
+      },
+      expires: new Date(Date.now() + 300_000).toISOString(),
+    } as Challenge.Challenge
+  }
+
+  function makeEvmChallenge(): Challenge.Challenge {
+    return {
+      id: 'evm-id-123',
+      realm: 'localhost',
+      method: 'evm',
+      intent: 'charge',
+      request: {
+        amount: '10000',
+        currency: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',
+        recipient: '0x1234567890123456789012345678901234567890',
+        methodDetails: { chainId: 8453, credentialTypes: ['authorization'], decimals: 6 },
+      },
+      expires: new Date(Date.now() + 300_000).toISOString(),
+    } as Challenge.Challenge
+  }
+
+  function multiChallengeServer(challenges: Challenge.Challenge[]) {
+    const header = challenges.map((c) => Challenge.serialize(c)).join(', ')
+    return testServer((req, res) => {
+      const url = new URL(req.url!, 'http://localhost')
+      if (url.pathname === '/openapi.json') {
+        res.setHeader('Content-Type', 'application/json')
+        res.end(makeDiscoveryDoc({ '/api/test': {} }))
+        return
+      }
+      res.writeHead(402, { [Constants.Headers.wwwAuthenticate]: header })
+      res.end()
+    })
+  }
+
+  test('parses multiple challenges', { timeout: 15_000 }, async () => {
+    const server = await multiChallengeServer([makeChallenge(), makeStripeChallenge()])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('2 methods: tempo/charge, stripe/charge')
+  })
+
+  test('validates Stripe fields', { timeout: 15_000 }, async () => {
+    const server = await multiChallengeServer([makeStripeChallenge()])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Amount is valid integer string')
+    expect(output).toContain('Valid currency code (USD)')
+    expect(output).toContain('Has networkId')
+    expect(output).toContain('Has paymentMethodTypes (card)')
+  })
+
+  test('validates EVM fields', { timeout: 15_000 }, async () => {
+    const server = await multiChallengeServer([makeEvmChallenge()])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Valid recipient address')
+    expect(output).toContain('Valid currency address')
+    expect(output).toContain('Amount is valid integer string')
+    expect(output).toContain('Has chainId (8453)')
+  })
+
+  test('tags method names when multiple challenges present', { timeout: 15_000 }, async () => {
+    const server = await multiChallengeServer([
+      makeChallenge(),
+      makeStripeChallenge(),
+      makeEvmChallenge(),
+    ])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('[tempo] Valid recipient address')
+    expect(output).toContain('[stripe] Valid currency code')
+    expect(output).toContain('[evm] Has chainId')
+  })
+
+  test('no tags with single challenge', { timeout: 15_000 }, async () => {
+    const server = await multiChallengeServer([makeChallenge()])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Valid recipient address')
+    expect(output).not.toContain('[tempo]')
+  })
+
+  test('Tempo requires recipient or splits', { timeout: 15_000 }, async () => {
+    const noRecipient = makeChallenge({
+      request: {
+        amount: '10000',
+        currency: '0x20c0000000000000000000000000000000000000',
+        methodDetails: { chainId: 42431 },
+      },
+    } as Partial<Challenge.Challenge>)
+    const server = await multiChallengeServer([noRecipient])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Missing recipient (and no splits defined)')
+  })
+
+  test('Tempo accepts splits without recipient', { timeout: 15_000 }, async () => {
+    const withSplits = makeChallenge({
+      request: {
+        amount: '10000',
+        currency: '0x20c0000000000000000000000000000000000000',
+        methodDetails: {
+          chainId: 42431,
+          splits: [
+            { amount: '5000', recipient: '0x1234567890123456789012345678901234567890' },
+            { amount: '5000', recipient: '0x0987654321098765432109876543210987654321' },
+          ],
+        },
+      },
+    } as Partial<Challenge.Challenge>)
+    const server = await multiChallengeServer([withSplits])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Uses splits (no single recipient)')
+    expect(output).not.toContain('Missing recipient')
+  })
+
+  test('fails on invalid Stripe amount', { timeout: 15_000 }, async () => {
+    const bad = makeStripeChallenge()
+    ;(bad.request as Record<string, unknown>).amount = '1.50'
+    const server = await multiChallengeServer([bad])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Amount is valid integer string (Got: 1.50)')
+  })
+})

package/src/client/internal/Fetch.test.ts

@@ -368,8 +368,13 @@ function make402(overrides?: { expires?: string; id?: string; intent?: string; m
   })
 }
 
-function makeCombined402() {
-  const response = make402()
+function makeCombined402(overrides?: {
+  expires?: string
+  id?: string
+  intent?: string
+  method?: string
+}) {
+  const response = make402(overrides)
   const headers = new Headers(response.headers)
   headers.set(
     x402_Types.paymentRequiredHeader,
@@ -729,6 +734,141 @@ describe('Fetch.from: 402 retry path', () => {
     expect(retryHeaders.get(x402_Types.paymentSignatureHeader)).toBeNull()
   })
 
+  test('prefers mpp Payment-auth over x402 when both are signable', async () => {
+    let callCount = 0
+    const calls: { init: RequestInit | undefined }[] = []
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1) return makeCombined402({ method: 'tempo', intent: 'charge' })
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [
+        {
+          name: 'tempo',
+          intent: 'charge',
+          context: undefined,
+          createCredential: async () => 'tempo-credential',
+        },
+        {
+          name: 'evm',
+          intent: 'charge',
+          context: undefined,
+          createCredential: async () => 'evm-credential',
+        },
+      ] as const,
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    const retryHeaders = new Headers(calls[1]!.init?.headers)
+    expect(retryHeaders.get('Authorization')).toBe('tempo-credential')
+    expect(retryHeaders.get(x402_Types.paymentSignatureHeader)).toBeNull()
+  })
+
+  test('prefers native EVM Payment-auth over x402 for EVM-only clients', async () => {
+    let callCount = 0
+    const calls: { init: RequestInit | undefined }[] = []
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1) return makeCombined402({ method: 'evm', intent: 'charge' })
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [
+        {
+          name: 'evm',
+          intent: 'charge',
+          context: undefined,
+          createCredential: async () => 'evm-credential',
+        },
+      ] as const,
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    const retryHeaders = new Headers(calls[1]!.init?.headers)
+    expect(retryHeaders.get('Authorization')).toBe('evm-credential')
+    expect(retryHeaders.get(x402_Types.paymentSignatureHeader)).toBeNull()
+  })
+
+  test('uses x402 when no signable Payment-auth challenge is available', async () => {
+    let callCount = 0
+    const calls: { init: RequestInit | undefined }[] = []
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1)
+        return new Response(null, {
+          status: 402,
+          headers: {
+            [x402_Types.paymentRequiredHeader]:
+              x402_Header.encodePaymentRequired(x402PaymentRequired),
+          },
+        })
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [
+        {
+          name: 'evm',
+          intent: 'charge',
+          context: undefined,
+          createCredential: async () => 'x402-credential',
+        },
+      ] as const,
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    const retryHeaders = new Headers(calls[1]!.init?.headers)
+    expect(retryHeaders.get('Authorization')).toBeNull()
+    expect(retryHeaders.get(x402_Types.paymentSignatureHeader)).toBe('x402-credential')
+  })
+
+  test('lets orderChallenges force x402 before native Payment-auth', async () => {
+    let callCount = 0
+    const calls: { init: RequestInit | undefined }[] = []
+    const mockFetch: typeof globalThis.fetch = async (_input, init) => {
+      calls.push({ init })
+      callCount++
+      if (callCount === 1) return makeCombined402({ method: 'evm', intent: 'charge' })
+      return new Response('OK', { status: 200 })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [
+        {
+          name: 'evm',
+          intent: 'charge',
+          context: undefined,
+          createCredential: async () => 'x402-credential',
+        },
+      ] as const,
+      orderChallenges: (candidates) =>
+        [...candidates].sort((left, right) => right.challenge.id.localeCompare(left.challenge.id)),
+    })
+
+    const response = await fetch('https://example.com/api')
+
+    expect(response.status).toBe(200)
+    const retryHeaders = new Headers(calls[1]!.init?.headers)
+    expect(retryHeaders.get('Authorization')).toBeNull()
+    expect(retryHeaders.get(x402_Types.paymentSignatureHeader)).toBe('x402-credential')
+  })
+
   test('settles MCP-over-HTTP JSON-RPC payment challenges at the fetch boundary', async () => {
     const mcpChallenge = Challenge.from({
       id: 'mcp-challenge',
@@ -1742,6 +1882,50 @@ describe('Fetch.from: 402 retry path', () => {
     expect(createCredential).toHaveBeenCalledOnce()
     expect(response.status).toBe(402)
   })
+
+  test('returns a challenge-less 402 after a rejected payment', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
+    const mockFetch: typeof globalThis.fetch = async () => {
+      callCount++
+      if (callCount === 1) return make402()
+      return new Response(JSON.stringify({ title: 'Verification Failed' }), {
+        status: 402,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+    expect(callCount).toBe(2)
+    expect(createCredential).toHaveBeenCalledOnce()
+    expect(response.status).toBe(402)
+    await expect(response.json()).resolves.toEqual({ title: 'Verification Failed' })
+  })
+
+  test('returns a post-payment 402 with only unsupported challenges', async () => {
+    let callCount = 0
+    const createCredential = vi.fn(async () => 'credential')
+    const mockFetch: typeof globalThis.fetch = async () => {
+      callCount++
+      if (callCount === 1) return make402()
+      return make402({ method: 'stripe', intent: 'charge' })
+    }
+
+    const fetch = Fetch.from({
+      fetch: mockFetch,
+      methods: [{ ...noopMethod, createCredential }],
+    })
+
+    const response = await fetch('https://example.com/api')
+    expect(callCount).toBe(2)
+    expect(createCredential).toHaveBeenCalledOnce()
+    expect(response.status).toBe(402)
+  })
 })
 
 describe('Fetch.from: acceptPaymentPolicy', () => {

package/src/client/internal/Fetch.ts

@@ -221,10 +221,14 @@ export function from<const methods extends readonly Method.AnyClient[]>(
             orderChallenges,
         )
         const selected = orderedCandidates[0]
-        if (!selected)
+        if (!selected) {
+          // A post-payment 402 with no actionable challenge (e.g. rejected credential)
+          // is the server's final answer, not a new challenge round.
+          if (retry > 0) return response
           throw new Error(
             `No method found for challenges: ${challenges.map((c) => `${c.method}.${c.intent}`).join(', ')}. Available: ${methods.map((m) => `${m.name}.${m.intent}`).join(', ')}`,
           )
+        }
 
         const selectedChallenge = selected.challenge
         challenge = selectedChallenge

package/src/evm/Chains.ts

@@ -3,3 +3,9 @@ export const base = 8453
 
 /** Base Sepolia testnet EVM chain ID. */
 export const baseSepolia = 84532
+
+/** Celo mainnet EVM chain ID. */
+export const celo = 42220
+
+/** Celo Sepolia testnet EVM chain ID. */
+export const celoSepolia = 11142220

package/src/evm/PublicInterface.test-d.ts

@@ -40,8 +40,15 @@ describe('evm public interface', () => {
     expectTypeOf(clientAssets.baseSepolia.USDC).toMatchTypeOf<
       typeof serverAssets.baseSepolia.USDC
     >()
+    expectTypeOf(evmRoot.assets.celo.USDC).toMatchTypeOf<typeof serverAssets.celo.USDC>()
+    expectTypeOf(evmRoot.assets.celo.USDT).toMatchTypeOf<typeof serverAssets.celo.USDT>()
+    expectTypeOf(clientAssets.celoSepolia.USDC).toMatchTypeOf<
+      typeof serverAssets.celoSepolia.USDC
+    >()
     expectTypeOf(evmRoot.chains.base).toMatchTypeOf<number>()
     expectTypeOf(clientChains.baseSepolia).toMatchTypeOf<number>()
+    expectTypeOf(evmRoot.chains.celo).toMatchTypeOf<number>()
+    expectTypeOf(clientChains.celoSepolia).toMatchTypeOf<number>()
   })
 
   test('exports root EVM charge method definition', () => {

package/src/internal/AcceptPayment.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, test } from 'vp/test'
 
+import * as x402_ChallengeBrand from '../x402/internal/ChallengeBrand.js'
 import * as AcceptPayment from './AcceptPayment.js'
 
 function stripIndex(entry: AcceptPayment.Entry) {
@@ -178,6 +179,50 @@ describe('AcceptPayment', () => {
     ])
   })
 
+  test('selectChallengeCandidates prefers Payment-auth offers before x402 offers', () => {
+    const x402Challenge = x402_ChallengeBrand.mark({
+      id: 'x402:0',
+      intent: 'charge',
+      method: 'evm',
+      realm: 'test',
+      request: { scheme: 'exact' },
+    })
+    const nativeChallenge = {
+      id: 'native',
+      intent: 'charge',
+      method: 'tempo',
+      realm: 'test',
+      request: {},
+    }
+
+    const candidates = AcceptPayment.selectChallengeCandidates(
+      [x402Challenge, nativeChallenge],
+      [
+        { name: 'evm', intent: 'charge' },
+        { name: 'tempo', intent: 'charge' },
+      ] as const,
+      AcceptPayment.parse('evm/charge, tempo/charge;q=0.5'),
+    )
+
+    expect(candidates.map(({ challenge }) => challenge.id)).toEqual(['native', 'x402:0'])
+  })
+
+  test('selectChallengeCandidates preserves preference order within Payment-auth offers', () => {
+    const candidates = AcceptPayment.selectChallengeCandidates(
+      [
+        { id: 'tempo', intent: 'charge', method: 'tempo', realm: 'test', request: {} },
+        { id: 'evm', intent: 'charge', method: 'evm', realm: 'test', request: {} },
+      ],
+      [
+        { name: 'tempo', intent: 'charge' },
+        { name: 'evm', intent: 'charge' },
+      ] as const,
+      AcceptPayment.parse('evm/charge, tempo/charge;q=0.5'),
+    )
+
+    expect(candidates.map(({ challenge }) => challenge.id)).toEqual(['evm', 'tempo'])
+  })
+
   test('selectChallengeCandidates supports duplicate method keys with challenge predicates', () => {
     const challenges = [
       {

package/src/internal/AcceptPayment.ts

@@ -1,4 +1,5 @@
 import type * as Challenge from '../Challenge.js'
+import * as x402_ChallengeBrand from '../x402/internal/ChallengeBrand.js'
 import type { MaybePromise } from './types.js'
 
 type MethodLike = {
@@ -208,7 +209,12 @@ export function selectChallengeCandidates<const methods extends readonly MethodL
             }) as ChallengeCandidate<methods[number]> & { match: Match },
         )
     })
-    .sort((left, right) => right.match.q - left.match.q || left.index - right.index)
+    .sort(
+      (left, right) =>
+        protocolRank(left.challenge) - protocolRank(right.challenge) ||
+        right.match.q - left.match.q ||
+        left.index - right.index,
+    )
     .map((candidate) => {
       const { match: _match, ...rest } = candidate
       return rest as unknown as ChallengeCandidate<methods[number]>
@@ -261,6 +267,10 @@ function specificity(preference: Pick<Entry, 'intent' | 'method'>): number {
   return Number(preference.method !== '*') + Number(preference.intent !== '*')
 }
 
+function protocolRank(challenge: Challenge.Challenge): number {
+  return x402_ChallengeBrand.is(challenge) ? 1 : 0
+}
+
 function parseEntry(part: string, index: number): Entry {
   const match =
     /^(?<method>[^/;\s]+|\*)\s*\/\s*(?<intent>[^/;\s]+|\*)(?<params>(?:\s*;\s*.+)?)$/u.exec(part)

package/src/stripe/server/internal/html/package.json

@@ -3,7 +3,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@stripe/stripe-js": "9.8.0",
+    "@stripe/stripe-js": "9.9.0",
     "mppx": "workspace:*"
   }
 }