mppx 0.8.5 → 0.8.7

package/src/tempo/server/internal/request-body.test.ts

@@ -27,6 +27,15 @@ describe('request-body', () => {
       ).toBe(true)
     })
 
+    test('returns false for empty body streams with content-length zero', () => {
+      expect(
+        hasCapturedRequestBody({
+          hasBody: true,
+          headers: new Headers({ 'content-length': '0' }),
+        }),
+      ).toBe(false)
+    })
+
     test('returns true when content-length is non-zero', () => {
       expect(
         hasCapturedRequestBody({

package/src/tempo/server/internal/request-body.ts

@@ -19,6 +19,8 @@ export function captureRequestBodyProbe(input: Request): RequestBodyProbe {
 export function hasCapturedRequestBody(
   input: Pick<RequestBodyProbe, 'headers' | 'hasBody'>,
 ): boolean {
+  if (input.headers.get('content-length') === '0' && !input.headers.has('transfer-encoding'))
+    return false
   if (hasBodyFramingHeaders(input)) return true
   if (input.hasBody === true) return true
   return false

package/src/tempo/session/precompile/Chain.test.ts

@@ -51,6 +51,7 @@ function createMockClient(
     channel?: { descriptor: Channel.ChannelDescriptor; state: Chain.ChannelState } | undefined
     receipt?: Record<string, unknown> | null | undefined
     rpcMethods?: string[] | undefined
+    onRequest?: ((method: string, params: unknown) => void) | undefined
   } = {},
 ) {
   return createClient({
@@ -59,6 +60,7 @@ function createMockClient(
     transport: custom({
       async request(args) {
         parameters.rpcMethods?.push(args.method)
+        parameters.onRequest?.(args.method, args.params)
         if (args.method === 'eth_chainId') return `0x${chainId.toString(16)}`
         if (args.method === 'eth_sendRawTransaction') return txHash
         if (args.method === 'eth_sendRawTransactionSync') return parameters.receipt ?? receipt([])
@@ -91,7 +93,7 @@ function createMockClient(
   })
 }
 
-function receipt(logs: readonly Record<string, unknown>[]) {
+function receipt(logs: readonly Record<string, unknown>[], transactionHash: Hex = txHash) {
   return {
     blockHash: `0x${'01'.repeat(32)}`,
     blockNumber: '0x1',
@@ -104,7 +106,7 @@ function receipt(logs: readonly Record<string, unknown>[]) {
     logsBloom: `0x${'00'.repeat(256)}`,
     status: '0x1',
     to: tip20ChannelEscrow,
-    transactionHash: txHash,
+    transactionHash,
     transactionIndex: '0x0',
     type: '0x76',
   }
@@ -253,6 +255,41 @@ function expectedExpiringNonceHash(serializedTransaction: `0x${string}`) {
   )
 }
 
+describe('precompile receipt wait', () => {
+  test('does not run replacement detection while waiting for Tempo receipts', async () => {
+    const requestedHash = `0x${'12'.repeat(32)}` as Hex
+    const rpcMethods: string[] = []
+    let receiptReads = 0
+    let blockNumber = 0n
+    const client = createClient({
+      chain: { id: chainId } as never,
+      pollingInterval: 1,
+      transport: custom({
+        async request(args) {
+          rpcMethods.push(args.method)
+          if (args.method === 'eth_chainId') return `0x${chainId.toString(16)}`
+          if (args.method === 'eth_blockNumber') {
+            blockNumber += 1n
+            return `0x${blockNumber.toString(16)}`
+          }
+          if (args.method === 'eth_getTransactionReceipt') {
+            receiptReads += 1
+            if (receiptReads === 1) return null
+            return receipt([], requestedHash)
+          }
+          throw new Error(`unexpected rpc request: ${args.method}`)
+        },
+      }),
+    })
+
+    const result = await Chain.waitForSuccessfulReceipt(client, requestedHash)
+
+    expect(result.transactionHash).toBe(requestedHash)
+    expect(rpcMethods).not.toContain('eth_getTransactionByHash')
+    expect(rpcMethods).not.toContain('eth_getBlockByNumber')
+  })
+})
+
 describe('precompile open calldata parsing', () => {
   test('parseOpenCall accepts TIP-1034 open calldata', () => {
     const data = encodeFunctionData({
@@ -641,6 +678,44 @@ describe('precompile broadcastOpenTransaction', () => {
     })
   })
 
+  test('pins the read-back to the block that included the open transaction', async () => {
+    const serializedTransaction = await createOpenTransaction()
+    const expiringNonceHash = expectedExpiringNonceHash(serializedTransaction)
+    const expectedDescriptor = { ...descriptor, expiringNonceHash }
+    const channelId = Channel.computeId({
+      ...expectedDescriptor,
+      chainId,
+      escrow: tip20ChannelEscrow,
+    })
+    const state = { settled: 0n, deposit, closeRequestedAt: 0 }
+    // The open tx is mined in block 0x1 (see `receipt`). The read-back must be
+    // pinned to that block, not `latest`, so a lagging RPC replica cannot
+    // answer with stale/empty state.
+    const ethCallBlockTags: unknown[] = []
+
+    await Chain.broadcastOpenTransaction({
+      chainId,
+      client: createMockClient({
+        channel: { descriptor: expectedDescriptor, state },
+        receipt: receipt([openedLog({ channelId, expiringNonceHash })]),
+        onRequest: (method, params) => {
+          if (method === 'eth_call') ethCallBlockTags.push((params as unknown[])[1])
+        },
+      }),
+      escrowContract: tip20ChannelEscrow,
+      expectedAuthorizedSigner: descriptor.authorizedSigner,
+      expectedChannelId: channelId,
+      expectedCurrency: descriptor.token,
+      expectedExpiringNonceHash: expiringNonceHash,
+      expectedOperator: descriptor.operator,
+      expectedPayee: descriptor.payee,
+      expectedPayer: descriptor.payer,
+      serializedTransaction,
+    })
+
+    expect(ethCallBlockTags).toEqual(['0x1'])
+  })
+
   test('rejects ChannelOpened receipt deposit mismatches', async () => {
     const serializedTransaction = await createOpenTransaction()
     const expiringNonceHash = expectedExpiringNonceHash(serializedTransaction)
@@ -1256,3 +1331,47 @@ describe('Chain.assertPrecompileFeePayerPolicy', () => {
     }
   })
 })
+
+describe('Chain.readbackWithRetry', () => {
+  test('returns immediately when the read succeeds on the first attempt', async () => {
+    let calls = 0
+    const result = await Chain.readbackWithRetry(
+      async () => {
+        calls++
+        return 'ok'
+      },
+      { delayMs: 0 },
+    )
+    expect(result).toBe('ok')
+    expect(calls).toBe(1)
+  })
+
+  test('retries a lagging read until it resolves', async () => {
+    let calls = 0
+    const result = await Chain.readbackWithRetry(
+      async () => {
+        calls++
+        if (calls < 3) throw new Error('header not found')
+        return 'ok'
+      },
+      { retries: 5, delayMs: 0 },
+    )
+    expect(result).toBe('ok')
+    expect(calls).toBe(3)
+  })
+
+  test('rethrows the last error after exhausting retries', async () => {
+    let calls = 0
+    await expect(
+      Chain.readbackWithRetry(
+        async () => {
+          calls++
+          throw new Error(`attempt ${calls}`)
+        },
+        { retries: 2, delayMs: 0 },
+      ),
+    ).rejects.toThrow('attempt 3')
+    // 1 initial attempt + 2 retries.
+    expect(calls).toBe(3)
+  })
+})

package/src/tempo/session/precompile/Chain.ts

@@ -293,12 +293,14 @@ export async function getChannel(
   client: Client,
   descriptor: ChannelDescriptor,
   escrow: Address = tip20ChannelEscrow,
+  blockNumber?: bigint,
 ): Promise<Channel> {
   const channel = await readContract(client, {
     address: escrow,
     abi: escrowAbi,
     functionName: 'getChannel',
     args: [descriptorTuple(descriptor)],
+    ...(blockNumber !== undefined ? { blockNumber } : {}),
   })
   return {
     descriptor: channel.descriptor,
@@ -313,12 +315,14 @@ export async function getChannelState(
   client: Client,
   channelId: Hex,
   escrow: Address = tip20ChannelEscrow,
+  blockNumber?: bigint,
 ): Promise<ChannelState> {
   const state = await readContract(client, {
     address: escrow,
     abi: escrowAbi,
     functionName: 'getChannelState',
     args: [channelId],
+    ...(blockNumber !== undefined ? { blockNumber } : {}),
   })
   return stateFromTuple(state)
 }
@@ -340,6 +344,47 @@ export async function getChannelStatesBatch(
   return states.map(stateFromTuple)
 }
 
+/** Tuning for {@link readbackWithRetry}. */
+export type ReadbackRetryOptions = {
+  /** Additional attempts after the first, before giving up. @default 5 */
+  retries?: number | undefined
+  /** Delay between attempts, in milliseconds. @default 250 */
+  delayMs?: number | undefined
+}
+
+/**
+ * Retry an on-chain readback that is pinned to the block containing a just-sent
+ * transaction.
+ *
+ * The escrow state read is served by a load-balanced RPC whose replicas can lag
+ * behind the block that produced the transaction receipt. Callers pin the read
+ * to that block number (via the `blockNumber` arg on {@link getChannel} /
+ * {@link getChannelState}) so a node that has imported the block returns
+ * authoritative state; replicas that have not yet imported it throw (e.g.
+ * "header not found"), so we retry with a short backoff until one catches up.
+ *
+ * This closes the read-after-write race behind
+ * `on-chain channel state does not match open receipt` — without it, a stale
+ * `latest` read on a lagging replica returns an empty channel and fails
+ * verification even though the open transaction succeeded.
+ */
+export async function readbackWithRetry<T>(
+  read: () => Promise<T>,
+  options: ReadbackRetryOptions = {},
+): Promise<T> {
+  const { retries = 5, delayMs = 250 } = options
+  let lastError: unknown
+  for (let attempt = 0; attempt <= retries; attempt++) {
+    try {
+      return await read()
+    } catch (error) {
+      lastError = error
+      if (attempt < retries) await new Promise((resolve) => setTimeout(resolve, delayMs))
+    }
+  }
+  throw lastError
+}
+
 /** Options accepted by low-level TIP-1034 on-chain management helpers. */
 export type ChannelTransactionOptions = {
   /** Account used to send the transaction when the viem client has no default account. */
@@ -586,7 +631,7 @@ export async function sendTransaction(client: TransactionClient, transaction: He
 
 /** Wait for a receipt and reject reverted precompile transactions. */
 export async function waitForSuccessfulReceipt(client: TransactionClient, hash: Hex) {
-  const receipt = await waitForTransactionReceipt(client, { hash })
+  const receipt = await waitForTransactionReceipt(client, { hash, checkReplacement: false })
   if (receipt.status !== 'success')
     throw new VerificationFailedError({ reason: 'precompile transaction reverted' })
   return receipt
@@ -808,7 +853,9 @@ export async function broadcastOpenTransaction(
     expectedChannelId: parameters.expectedChannelId,
     openDeposit: open.deposit,
   })
-  const chainChannel = await getChannel(parameters.client, descriptor, parameters.escrowContract)
+  const chainChannel = await readbackWithRetry(() =>
+    getChannel(parameters.client, descriptor, parameters.escrowContract, receipt.blockNumber),
+  )
   const state = chainChannel.state
   validateOpenReadbackState({ emittedDeposit: opened.deposit, state })
   return {
@@ -896,10 +943,13 @@ export async function broadcastTopUpTransaction(
     emittedChannelId: toppedUp.channelId,
     expectedChannelId: parameters.expectedChannelId,
   })
-  const state = await getChannelState(
-    parameters.client,
-    toppedUp.channelId,
-    parameters.escrowContract,
+  const state = await readbackWithRetry(() =>
+    getChannelState(
+      parameters.client,
+      toppedUp.channelId,
+      parameters.escrowContract,
+      receipt.blockNumber,
+    ),
   )
   validateTopUpReadbackState({ newDeposit: toppedUp.newDeposit, state })
   return { txHash: receipt.transactionHash, newDeposit: toppedUp.newDeposit, state }

package/src/tempo/session/server/ChannelStore.test.ts

@@ -559,6 +559,23 @@ describe('ChannelStore voucher acceptance', () => {
     expect((await store.getChannel(stateUpdateChannelId))?.highestVoucherAmount).toBe(50n)
   })
 
+  test('rejects an already accepted voucher when it has settled on-chain', async () => {
+    vi.spyOn(Voucher, 'verifyVoucher').mockReturnValue(true)
+    const stored = voucherAcceptanceChannel({ highestVoucherAmount: 50n })
+
+    await expect(
+      ChannelStore.verifyAndAcceptVoucher({
+        challenge: voucherAcceptanceChallenge,
+        channel: stored,
+        channelState: { deposit: 100n, settled: 50n, closeRequestedAt: 0 },
+        methodDetails: { chainId: 4217, escrowContract: voucherAcceptanceEscrow },
+        minVoucherDelta: 5n,
+        store: memoryChannelStore(stored),
+        voucher: voucherAcceptanceVoucher(50n),
+      }),
+    ).rejects.toThrow(VerificationFailedError)
+  })
+
   test('rejects vouchers beyond deposit or below minimum delta', async () => {
     vi.spyOn(Voucher, 'verifyVoucher').mockReturnValue(true)
     const stored = voucherAcceptanceChannel({ highestVoucherAmount: 50n })

package/src/tempo/session/server/ChannelStore.ts

@@ -542,6 +542,10 @@ export async function verifyAndAcceptVoucher(
   )
   if (!valid) throw new InvalidSignatureError({ reason: 'invalid voucher signature' })
 
+  if (voucher.cumulativeAmount <= channelState.settled)
+    throw new VerificationFailedError({
+      reason: 'voucher cumulativeAmount is below on-chain settled amount',
+    })
   if (voucher.cumulativeAmount === channel.highestVoucherAmount)
     return createSessionReceipt({
       challengeId: challenge.id,
@@ -550,10 +554,6 @@ export async function verifyAndAcceptVoucher(
       spent: channel.spent,
       units: channel.units,
     })
-  if (voucher.cumulativeAmount <= channelState.settled)
-    throw new VerificationFailedError({
-      reason: 'voucher cumulativeAmount is below on-chain settled amount',
-    })
   const delta = voucher.cumulativeAmount - channel.highestVoucherAmount
   if (delta < minVoucherDelta)
     throw new DeltaTooSmallError({

package/src/tempo/session/server/CredentialVerification.test.ts

@@ -1,13 +1,19 @@
 import type { Address, Hex } from 'viem'
-import { describe, expect, test } from 'vp/test'
+import { afterEach, describe, expect, test, vi } from 'vp/test'
 
+import * as Challenge from '../../../Challenge.js'
+import * as Store from '../../../Store.js'
+import { chainId as chainIds } from '../../internal/defaults.js'
 import * as Channel from '../precompile/Channel.js'
+import * as Voucher from '../precompile/Voucher.js'
+import * as ChannelStore from './ChannelStore.js'
 import {
   assertOpenCredentialCoversRequest,
   requireSessionCredentialAction,
   requireSessionCredentialPayload,
   requireSessionCredentialPayloadHeader,
   validateChannelDescriptor,
+  verifyCredentialPayload,
 } from './CredentialVerification.js'
 
 describe('SessionCredentialGuards', () => {
@@ -24,6 +30,10 @@ describe('SessionCredentialGuards', () => {
   const signature = `0x${'ab'.repeat(65)}` as Hex
   const transaction = `0x${'cd'.repeat(32)}` as Hex
 
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
   describe('SessionCredentialGuards', () => {
     test('reads valid action discriminators', () => {
       expect(requireSessionCredentialAction({ action: 'open' })).toBe('open')
@@ -179,4 +189,111 @@ describe('SessionCredentialGuards', () => {
       ).toThrow(case_.expected)
     })
   })
+
+  describe('verifyCredentialPayload', () => {
+    const escrow = '0x4D50500000000000000000000000000000000000' as Address
+    const testChainId = chainIds.testnet
+    const computedChannelId = Channel.computeId({ ...descriptor, chainId: testChainId, escrow })
+    const challenge = Challenge.from({
+      id: 'credential-source-test',
+      realm: 'example.test',
+      method: 'tempo',
+      intent: 'session',
+      request: {
+        amount: '1',
+        currency: descriptor.token,
+        recipient: descriptor.payee,
+        unitType: 'request',
+      },
+    })
+
+    function channelStore(): ChannelStore.ChannelStore {
+      return ChannelStore.fromStore(Store.memory())
+    }
+
+    async function seedChannel(store: ChannelStore.ChannelStore) {
+      await store.updateChannel(computedChannelId, () => ({
+        backend: 'precompile',
+        authorizedSigner: descriptor.authorizedSigner,
+        chainId: testChainId,
+        channelId: computedChannelId,
+        closeRequestedAt: 0n,
+        createdAt: '2026-01-01T00:00:00.000Z',
+        deposit: 100n,
+        descriptor,
+        escrowContract: escrow,
+        expiringNonceHash: descriptor.expiringNonceHash,
+        finalized: false,
+        highestVoucher: null,
+        highestVoucherAmount: 50n,
+        operator: descriptor.operator,
+        payee: descriptor.payee,
+        payer: descriptor.payer,
+        salt: descriptor.salt,
+        settledOnChain: 0n,
+        spent: 0n,
+        token: descriptor.token,
+        units: 0,
+      }))
+    }
+
+    test.each([
+      { label: 'payer', sourceAddress: descriptor.payer },
+      { label: 'authorized signer', sourceAddress: descriptor.authorizedSigner },
+    ])('accepts voucher credentials from the channel $label', async ({ sourceAddress }) => {
+      const store = channelStore()
+      await seedChannel(store)
+      const verifyVoucher = vi.spyOn(Voucher, 'verifyVoucher').mockResolvedValue(true)
+
+      await expect(
+        verifyCredentialPayload({
+          challenge,
+          channelStateTtl: 60_000,
+          chainId: testChainId,
+          client: {} as never,
+          credentialSource: `did:pkh:eip155:${testChainId}:${sourceAddress}`,
+          escrow,
+          lastOnChainVerified: new Map([[computedChannelId, Date.now()]]),
+          minVoucherDelta: 1n,
+          payload: {
+            action: 'voucher',
+            channelId: computedChannelId,
+            cumulativeAmount: '60',
+            descriptor,
+            signature,
+          },
+          store,
+        }),
+      ).resolves.toMatchObject({ acceptedCumulative: '60' })
+      expect(verifyVoucher).toHaveBeenCalledOnce()
+    })
+
+    test('rejects voucher credentials from a different source', async () => {
+      const store = channelStore()
+      await seedChannel(store)
+      const verifyVoucher = vi.spyOn(Voucher, 'verifyVoucher').mockResolvedValue(true)
+
+      await expect(
+        verifyCredentialPayload({
+          challenge,
+          channelStateTtl: 60_000,
+          chainId: testChainId,
+          client: {} as never,
+          credentialSource: `did:pkh:eip155:${testChainId}:0x0000000000000000000000000000000000000099`,
+          escrow,
+          lastOnChainVerified: new Map([[computedChannelId, Date.now()]]),
+          minVoucherDelta: 1n,
+          payload: {
+            action: 'voucher',
+            channelId: computedChannelId,
+            cumulativeAmount: '60',
+            descriptor,
+            signature,
+          },
+          store,
+        }),
+      ).rejects.toThrow('credential source does not match channel payer or authorized signer')
+      expect(verifyVoucher).not.toHaveBeenCalled()
+    })
+  })
 })

package/src/tempo/session/server/CredentialVerification.ts

@@ -126,6 +126,32 @@ export function assertOpenCredentialCoversRequest(parameters: {
     throw new VerificationFailedError({ reason: 'voucher amount is less than request amount' })
 }
 
+/** Verifies that the credential source is authorized to spend from the channel. */
+export function assertCredentialSourceCanSpend(parameters: {
+  chainId: number
+  channel: Pick<ChannelStore.State, 'authorizedSigner' | 'payer'>
+  source?: string | undefined
+}): void {
+  const sourceAddress = readCredentialSourceAddress(parameters.source, parameters.chainId)
+  if (
+    isAddressEqual(sourceAddress, parameters.channel.payer) ||
+    isAddressEqual(sourceAddress, parameters.channel.authorizedSigner)
+  )
+    return
+  throw new VerificationFailedError({
+    reason: 'credential source does not match channel payer or authorized signer',
+  })
+}
+
+function readCredentialSourceAddress(source: string | undefined, chainId: number): Address {
+  const prefix = `did:pkh:eip155:${chainId}:`
+  if (!source?.startsWith(prefix))
+    throw new VerificationFailedError({ reason: 'credential source does not match channel' })
+  const address = source.slice(prefix.length)
+  if (isAddress(address, { strict: false })) return address
+  throw new VerificationFailedError({ reason: 'invalid credential source' })
+}
+
 const sessionCredentialActions = [
   'open',
   'topUp',
@@ -302,6 +328,8 @@ export type VerifyCredentialPayloadParameters = {
   chainId: number
   /** viem client used for precompile reads and transaction broadcasts. */
   client: Chain.TransactionClient
+  /** Optional payer identifier from the HTTP credential source field. */
+  credentialSource?: string | undefined
   /** TIP20EscrowChannel precompile address for this session method. */
   escrow: Address
   /** Operator address advertised in the HMAC-bound challenge details. */
@@ -531,6 +559,7 @@ async function handleVoucherCredential(
     store,
     client,
     challenge,
+    credentialSource,
     payload,
     chainId,
     escrow,
@@ -564,6 +593,7 @@ async function handleVoucherCredential(
     store,
     validateDescriptor: true,
   })
+  assertCredentialSourceCanSpend({ chainId, channel, source: credentialSource })
   if (channel.finalized) throw new ChannelClosedError({ reason: 'channel is finalized' })
   const isStale = Date.now() - (lastOnChainVerified.get(channelId) ?? 0) > channelStateTtl
   const state = isStale ? await Chain.getChannelState(client, channelId, escrow) : undefined

package/src/tempo/session/server/Session.integration.test.ts

@@ -84,6 +84,10 @@ function sessionRequest(channelId: Hex.Hex, amount = '100') {
   }
 }
 
+function sourceFor(account = payer): string {
+  return `did:pkh:eip155:${chain.id}:${account.address}`
+}
+
 describe.runIf(isPrecompileTestnet)('precompile server session chain integration', () => {
   test('broadcasts and verifies a real precompile open credential', async () => {
     const rawStore = Store.memory()
@@ -247,6 +251,7 @@ describe.runIf(isPrecompileTestnet)('precompile server session chain integration
           request: sessionRequest(channelId),
         } as never,
         payload,
+        source: sourceFor(),
       },
       request: sessionRequest(channelId) as never,
     })