mppx 0.8.9 → 0.8.12

package/src/tempo/internal/fee-payer.test.ts

@@ -11,8 +11,10 @@ import {
   defaultAllowedFeeTokens,
   FeePayerValidationError,
   fillHostedFeePayerTransaction,
+  preflightSponsorship,
   prepareSponsoredTransaction,
   simulationTransaction,
+  sponsoredSimulationTransaction,
   validateCalls,
 } from './fee-payer.js'
 import * as Selectors from './selectors.js'
@@ -768,6 +770,97 @@ describe('simulationTransaction', () => {
       feePayerSignature: undefined,
     })
   })
+
+  test('builds the final sponsored envelope without either signature', () => {
+    const transaction = {
+      calls: [{ to: bogus }],
+      feePayerSignature,
+      feeToken: swapTokenIn,
+      from: bogus,
+      signature: { r: 1n, s: 2n, yParity: 0 },
+    }
+
+    expect(
+      sponsoredSimulationTransaction(transaction as any, {
+        feePayer: swapTokenOut,
+        feeToken: bogus,
+      }),
+    ).toEqual({
+      ...transaction,
+      account: bogus,
+      calls: transaction.calls,
+      feePayer: swapTokenOut,
+      feePayerSignature: undefined,
+      feeToken: bogus,
+      signature: undefined,
+    })
+  })
+})
+
+describe('preflightSponsorship', () => {
+  const transaction = {
+    calls: [{ to: bogus }],
+    feeToken: swapTokenIn,
+    from: bogus,
+  }
+
+  test('simulates the sender before completion and the completed envelope after', async () => {
+    const simulations: Record<string, unknown>[] = []
+    let completions = 0
+
+    const result = await preflightSponsorship({
+      transaction: transaction as any,
+      async simulate(request) {
+        simulations.push(request)
+      },
+      async complete() {
+        completions += 1
+        return { feePayer: swapTokenOut, transaction: transaction as any }
+      },
+    })
+
+    expect(completions).toBe(1)
+    expect(result.feePayer).toBe(swapTokenOut)
+    expect(simulations).toEqual([
+      { account: bogus, calls: transaction.calls },
+      {
+        ...transaction,
+        account: bogus,
+        calls: transaction.calls,
+        feePayer: swapTokenOut,
+        feePayerSignature: undefined,
+        signature: undefined,
+      },
+    ])
+  })
+
+  test.each([
+    { completeCalls: 0, failingSimulation: 1, simulationCalls: 1 },
+    { completeCalls: 1, failingSimulation: 2, simulationCalls: 2 },
+  ])(
+    'stops at simulation $failingSimulation',
+    async ({ completeCalls, failingSimulation, simulationCalls }) => {
+      let completions = 0
+      let simulations = 0
+
+      await expect(
+        preflightSponsorship({
+          transaction: transaction as any,
+          async simulate() {
+            simulations += 1
+            if (simulations === failingSimulation) throw new Error('simulation failed')
+          },
+          async complete() {
+            completions += 1
+            return { feePayer: swapTokenOut, transaction: transaction as any }
+          },
+        }),
+      ).rejects.toThrow('simulation failed')
+
+      expect(completions).toBe(completeCalls)
+      expect(simulations).toBe(simulationCalls)
+    },
+  )
 })
 
 describe('prepareSponsoredTransaction', () => {

package/src/tempo/internal/fee-payer.ts

@@ -228,7 +228,7 @@ export async function fillHostedFeePayerTransaction(parameters: {
     ...(filled.feePayerSignature as Record<string, unknown>),
     yParity: Number((filled.feePayerSignature as { yParity?: unknown }).yParity),
   }
-  const feeToken = filled.feeToken
+  const feeToken = filled.feeToken as TempoAddress.Address
 
   // Recover the concrete sponsor address so the simulation can use a concrete
   // `feePayer` (the node rejects `eth_call` with `feePayer: true`).
@@ -266,7 +266,14 @@ export async function fillHostedFeePayerTransaction(parameters: {
   }
 }
 
-/** Returns a transaction shape suitable for pre-broadcast simulation. */
+/**
+ * Returns a transaction shape suitable for pre-broadcast simulation.
+ *
+ * Sponsored transactions are first simulated as calls from the sender with no
+ * fee fields or signatures. This checks call execution without requiring the
+ * sender to hold the fee token; transferred value and call-level balances are
+ * still checked by the RPC.
+ */
 export function simulationTransaction(
   transaction: SponsoredTransaction,
   options: { feePayer: boolean },
@@ -284,6 +291,61 @@ export function simulationTransaction(
   }
 }
 
+/**
+ * Returns the final fee-sponsored transaction shape for pre-broadcast
+ * simulation. RPC `eth_call` does not carry either transaction signature.
+ */
+export function sponsoredSimulationTransaction(
+  transaction: SponsoredTransaction,
+  options: { feePayer: TempoAddress.Address; feeToken?: TempoAddress.Address | undefined },
+) {
+  const { feePayer, feeToken } = options
+  return {
+    ...transaction,
+    account: transaction.from,
+    calls: transaction.calls,
+    feePayer,
+    feePayerSignature: undefined,
+    ...(feeToken !== undefined ? { feeToken } : {}),
+    signature: undefined,
+  }
+}
+
+/** A completed sponsorship envelope that can be simulated before signing or broadcast. */
+export type PreflightSponsorship = {
+  feePayer: TempoAddress.Address
+  feeToken?: TempoAddress.Address | undefined
+  transaction: SponsoredTransaction
+}
+
+/**
+ * Runs execution-only sender and final-envelope simulations around sponsorship.
+ *
+ * First, it simulates the calls with the sender as `from`, omitting fee fields
+ * and signatures so the sender's fee balance is irrelevant. Next, `complete`
+ * resolves the sponsor and produces the co-signed transaction. Finally, it
+ * simulates that transaction with its concrete fee payer and fee token.
+ *
+ * `complete` runs only after sender-context execution succeeds, so a reverting
+ * transaction never reaches a local signer or hosted fee-payer.
+ */
+export async function preflightSponsorship<sponsorship extends PreflightSponsorship>(parameters: {
+  complete: () => Promise<sponsorship>
+  simulate: (request: Record<string, unknown>) => Promise<unknown>
+  transaction: SponsoredTransaction
+}): Promise<sponsorship> {
+  const { complete, simulate, transaction } = parameters
+  await simulate(simulationTransaction(transaction, { feePayer: true }))
+  const completed = await complete()
+  await simulate(
+    sponsoredSimulationTransaction(completed.transaction, {
+      feePayer: completed.feePayer,
+      feeToken: completed.feeToken,
+    }),
+  )
+  return completed
+}
+
 /**
  * maxTotalFee must be high enough to cover `transferWithMemo` and
  * swap transactions at peak gas prices. Bumped from 0.01 ETH in #327.

package/src/tempo/internal/fee-token.test.ts

@@ -77,6 +77,43 @@ describe.runIf(isLocalnet)('resolveFeeToken', () => {
     expectAddress(feeToken, asset)
   })
 
+  test('prioritizes funded allowed candidates', async () => {
+    const account = testAccount()
+    const client = clientFor(account)
+    await fundAccount({ address: account.address, token: asset })
+    await fundAccount({ address: account.address, token: Addresses.pathUsd })
+    await Actions.fee.setUserTokenSync(client, {
+      feeToken: asset,
+      token: asset,
+    } as never)
+
+    const feeToken = await resolveFeeToken({
+      account: account.address,
+      allowedTokens: [Addresses.pathUsd, asset],
+      candidateTokens: [Addresses.pathUsd, asset],
+      client,
+      prioritizeCandidates: true,
+    })
+
+    expectAddress(feeToken, Addresses.pathUsd)
+  })
+
+  test('falls through prioritized candidates when pathUSD is unfunded', async () => {
+    const account = testAccount()
+    const client = clientFor(account)
+    await fundAccount({ address: account.address, token: asset })
+
+    const feeToken = await resolveFeeToken({
+      account: account.address,
+      allowedTokens: [Addresses.pathUsd, asset],
+      candidateTokens: [Addresses.pathUsd, asset],
+      client,
+      prioritizeCandidates: true,
+    })
+
+    expectAddress(feeToken, asset)
+  })
+
   test('uses a funded chain fee token when configured', async () => {
     const account = testAccount()
     const client = createClient({

package/src/tempo/internal/fee-token.ts

@@ -4,8 +4,17 @@ import { Actions, TokenId } from 'viem/tempo'
 import * as TempoAddress from './address.js'
 import * as defaults from './defaults.js'
 
-function pushUnique(tokens: Address[], token: Address | undefined) {
+function pushUnique(
+  tokens: Address[],
+  token: Address | undefined,
+  allowedTokens?: readonly Address[] | undefined,
+) {
   if (!token) return
+  if (
+    allowedTokens &&
+    !allowedTokens.some((allowedToken) => TempoAddress.isEqual(allowedToken, token))
+  )
+    return
   if (tokens.some((t) => TempoAddress.isEqual(t, token))) return
   tokens.push(token)
 }
@@ -27,21 +36,33 @@ function getChainFeeToken(client: Client): Address | undefined {
   return chainId ? defaults.currency[chainId as keyof typeof defaults.currency] : undefined
 }
 
+/**
+ * Resolves a funded fee token from account, chain, and caller-supplied preferences.
+ *
+ * `prioritizeCandidates` checks candidate tokens before account and chain
+ * preferences. `allowedTokens` limits every preference to the caller's policy.
+ */
 export async function resolveFeeToken(parameters: {
   account: Address
+  allowedTokens?: readonly Address[] | undefined
   candidateTokens?: readonly Address[] | undefined
   client: Client
+  prioritizeCandidates?: boolean | undefined
 }): Promise<Address | undefined> {
-  const { account, candidateTokens, client } = parameters
+  const { account, allowedTokens, candidateTokens, client, prioritizeCandidates } = parameters
   const tokens: Address[] = []
 
+  if (prioritizeCandidates)
+    for (const token of candidateTokens ?? []) pushUnique(tokens, token, allowedTokens)
+
   const userToken = await Actions.fee
     .getUserToken(client as never, { account })
     .then((token) => token?.address as Address | undefined)
     .catch(() => undefined)
-  pushUnique(tokens, userToken)
-  pushUnique(tokens, getChainFeeToken(client))
-  for (const token of candidateTokens ?? []) pushUnique(tokens, token)
+  pushUnique(tokens, userToken, allowedTokens)
+  pushUnique(tokens, getChainFeeToken(client), allowedTokens)
+  if (!prioritizeCandidates)
+    for (const token of candidateTokens ?? []) pushUnique(tokens, token, allowedTokens)
 
   for (const token of tokens) {
     if (await hasBalance(client, account, token)) return token

package/src/tempo/legacy/client/ChannelOps.test.ts

@@ -340,6 +340,27 @@ describe.runIf(isLocalnet)('tryRecoverChannel', () => {
     expect(result!.opened).toBe(true)
     expect(result!.escrowContract).toBe(escrow)
     expect(result!.chainId).toBe(chain.id)
+    // Channel opened with a zero authorizedSigner: the escrow verifies
+    // vouchers against the payer, so the recovered authority is the payer.
+    expect(result!.authorizedSigner.toLowerCase()).toBe(payer.address.toLowerCase())
+  })
+
+  test('recovers the on-chain authorizedSigner when set', async () => {
+    const authorizedSigner = accounts[4].address
+    const { channelId: signerChannelId } = await openChannel({
+      escrow,
+      payer,
+      payee,
+      token: currency,
+      deposit: 10_000_000n,
+      salt: Hex.random(32) as `0x${string}`,
+      authorizedSigner,
+    })
+
+    const result = await tryRecoverChannel(client, escrow, signerChannelId, chain.id)
+
+    expect(result).not.toBeUndefined()
+    expect(result!.authorizedSigner.toLowerCase()).toBe(authorizedSigner.toLowerCase())
   })
 
   test('returns undefined for non-existent channel', async () => {

package/src/tempo/legacy/client/ChannelOps.ts

@@ -27,6 +27,8 @@ import { signVoucher } from '../session/Voucher.js'
 
 /** Cached channel metadata used by the legacy auto-driving session client. */
 export type ChannelEntry = {
+  /** Voucher authority the channel was opened with. */
+  authorizedSigner: Address
   /** Legacy contract-backed channel ID. */
   channelId: Hex.Hex
   /** Salt used to derive the channel ID. */
@@ -209,6 +211,7 @@ export async function createOpenPayload(
 
   return {
     entry: {
+      authorizedSigner,
       channelId,
       salt,
       cumulativeAmount: initialAmount,
@@ -249,6 +252,10 @@ export async function tryRecoverChannel(
 
     if (onChain.deposit > 0n && !onChain.finalized) {
       return {
+        // A zero on-chain authorizedSigner means the escrow verifies vouchers
+        // against the payer, so record the payer as the voucher authority.
+        authorizedSigner:
+          BigInt(onChain.authorizedSigner) === 0n ? onChain.payer : onChain.authorizedSigner,
         channelId,
         salt: '0x' as Hex.Hex,
         cumulativeAmount: onChain.settled,

package/src/tempo/legacy/client/Session.test.ts

@@ -1,7 +1,16 @@
 import { SignatureEnvelope } from 'ox/tempo'
-import { type Address, createClient, decodeFunctionData, erc20Abi, type Hex, http } from 'viem'
+import {
+  type Address,
+  createClient,
+  custom,
+  decodeFunctionData,
+  erc20Abi,
+  type Hex,
+  http,
+} from 'viem'
 import { privateKeyToAccount } from 'viem/accounts'
 import { Account as TempoAccount, Addresses, Transaction, WebCryptoP256 } from 'viem/tempo'
+import { tempoModerato } from 'viem/tempo/chains'
 import { beforeAll, describe, expect, test } from 'vp/test'
 import { tempoNetwork } from '~test/config.js'
 import { deployEscrow, openChannel } from '~test/tempo/legacy/session.js'
@@ -374,6 +383,98 @@ describe('session (pure)', () => {
       expect(cred.source).toBe(`did:pkh:eip155:42431:${pureAccount.address}`)
     })
   })
+
+  describe('auto-manage channel reuse', () => {
+    const payerAccount = privateKeyToAccount(
+      '0x59c6995e998f97a5a0044966f09453863d462d2b3f1446a99f0a3d7b5d0f5a0d',
+    )
+    const signerA = TempoAccount.fromSecp256k1(
+      '0x5de4111afa1a4b94908f83103eb1f1706367c2e68ca870fc3fb9a804cdab365a',
+      { access: payerAccount },
+    )
+    const signerB = TempoAccount.fromSecp256k1(
+      '0x7c852118294e51e653712a81e05800f419141751be58f605c371e15141b007a6',
+      { access: payerAccount },
+    )
+
+    function makeAutoClient(account: typeof signerA) {
+      return createClient({
+        account,
+        chain: tempoModerato,
+        transport: custom({
+          async request({ method }: { method: string }) {
+            if (method === 'eth_chainId') return `0x${tempoModerato.id.toString(16)}`
+            if (method === 'eth_fillTransaction')
+              return {
+                raw: '0x',
+                tx: {
+                  chainId: `0x${tempoModerato.id.toString(16)}`,
+                  from: payerAccount.address,
+                  gas: '0x5208',
+                  input: '0x',
+                  maxFeePerGas: '0x1',
+                  maxPriorityFeePerGas: '0x1',
+                  nonce: '0x0',
+                  to: escrowAddress,
+                  type: '0x2',
+                  value: '0x0',
+                },
+              }
+            throw new Error(`unexpected rpc request: ${method}`)
+          },
+        }),
+      })
+    }
+
+    test('reuses the cached channel while the voucher signer is unchanged', async () => {
+      const method = session({
+        getClient: () => makeAutoClient(signerA),
+        maxDeposit: '10',
+      })
+
+      const first = deserializePayload(
+        await method.createCredential({ challenge: makeChallenge(), context: {} }),
+      )
+      const second = deserializePayload(
+        await method.createCredential({ challenge: makeChallenge(), context: {} }),
+      )
+
+      expect(first.payload.action).toBe('open')
+      expect(second.payload.action).toBe('voucher')
+      expect(second.payload.channelId).toBe(first.payload.channelId)
+    })
+
+    test('opens a new channel instead of reusing when the authorizedSigner changes', async () => {
+      let account = signerA
+      const method = session({
+        getClient: () => makeAutoClient(account),
+        maxDeposit: '10',
+      })
+
+      const first = deserializePayload(
+        await method.createCredential({ challenge: makeChallenge(), context: {} }),
+      )
+
+      account = signerB
+
+      const second = deserializePayload(
+        await method.createCredential({ challenge: makeChallenge(), context: {} }),
+      )
+
+      expect(first.payload.action).toBe('open')
+      if (first.payload.action !== 'open') throw new Error('expected open payload')
+      expect(first.payload.authorizedSigner?.toLowerCase()).toBe(
+        signerA.accessKeyAddress.toLowerCase(),
+      )
+
+      expect(second.payload.action).toBe('open')
+      if (second.payload.action !== 'open') throw new Error('expected open payload')
+      expect(second.payload.authorizedSigner?.toLowerCase()).toBe(
+        signerB.accessKeyAddress.toLowerCase(),
+      )
+      expect(second.payload.channelId).not.toBe(first.payload.channelId)
+    })
+  })
 })
 
 describe.runIf(isLocalnet)('session (on-chain)', () => {

package/src/tempo/legacy/client/Session.ts

@@ -175,6 +175,16 @@ export function session(parameters: session.Parameters = {}) {
       }
     }
 
+    // A channel only admits vouchers from the authorizedSigner it was opened
+    // with, so a cached or recovered entry stops being reusable once the
+    // resolved signer changes. Fall through to open a fresh channel instead
+    // of emitting a voucher the escrow would reject.
+    if (
+      entry?.opened &&
+      entry.authorizedSigner.toLowerCase() !== getAccountSignerAddress(voucherSigner).toLowerCase()
+    )
+      entry = undefined
+
     let payload: LegacySessionCredentialPayload
 
     if (entry?.opened) {

package/src/tempo/legacy/session/Chain.test.ts

@@ -457,7 +457,7 @@ describe.runIf(isLocalnet)('on-chain', () => {
       ).rejects.toThrow('gas exceeds sponsor policy')
     })
 
-    test('fee-payer: simulates open before broadcasting', async () => {
+    test('fee-payer: simulates open before broadcasting and recovers duplicate opens', async () => {
       const rpcMethods: string[] = []
       const interceptingClient = createClient({
         account: accounts[0],
@@ -521,6 +521,22 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(broadcastIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeLessThan(broadcastIndex)
+      expect(
+        rpcMethods.slice(0, broadcastIndex).filter((method) => method === 'eth_call'),
+      ).toHaveLength(2)
+
+      const recovered = await broadcastOpenTransaction({
+        client: interceptingClient,
+        serializedTransaction,
+        escrowContract,
+        channelId,
+        recipient,
+        currency,
+        feePayer: accounts[0],
+      })
+
+      expect(recovered.txHash).toBeUndefined()
+      expect(recovered.onChain.deposit).toBe(deposit)
     })
 
     test('fee-payer: rejects smuggled second open call', async () => {
@@ -620,6 +636,17 @@ describe.runIf(isLocalnet)('on-chain', () => {
     })
 
     test('waitForConfirmation: false returns derived on-chain state', async () => {
+      const rpcMethods: string[] = []
+      const interceptingClient = createClient({
+        account: accounts[0],
+        chain: client.chain,
+        transport: custom({
+          async request(args: any) {
+            rpcMethods.push(args.method)
+            return client.transport.request(args)
+          },
+        }),
+      })
       const salt = nextSalt()
       const deposit = 10_000_000n
 
@@ -633,7 +660,7 @@ describe.runIf(isLocalnet)('on-chain', () => {
       })
 
       const result = await broadcastOpenTransaction({
-        client,
+        client: interceptingClient,
         serializedTransaction,
         escrowContract,
         channelId,
@@ -649,6 +676,52 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(result.onChain.deposit).toBe(deposit)
       expect(result.onChain.settled).toBe(0n)
       expect(result.onChain.finalized).toBe(false)
+      const simulationIndex = rpcMethods.indexOf('eth_call')
+      const broadcastIndex = rpcMethods.indexOf('eth_sendRawTransaction')
+      expect(simulationIndex).toBeGreaterThan(-1)
+      expect(broadcastIndex).toBeGreaterThan(-1)
+      expect(simulationIndex).toBeLessThan(broadcastIndex)
+    })
+
+    test('fee-payer relay: optimistic open simulates before broadcasting', async () => {
+      const rpcMethods: string[] = []
+      const interceptingClient = createClient({
+        account: accounts[0],
+        chain: client.chain,
+        transport: custom({
+          async request(args: any) {
+            rpcMethods.push(args.method)
+            return client.transport.request(args)
+          },
+        }),
+      })
+      const salt = nextSalt()
+      const deposit = 10_000_000n
+      const { channelId, serializedTransaction } = await signOpenChannel({
+        escrow: escrowContract,
+        payer,
+        payee: recipient,
+        token: currency,
+        deposit,
+        salt,
+      })
+
+      await broadcastOpenTransaction({
+        client: interceptingClient,
+        serializedTransaction,
+        escrowContract,
+        channelId,
+        recipient,
+        currency,
+        isSponsored: true,
+        waitForConfirmation: false,
+      })
+
+      const simulationIndex = rpcMethods.indexOf('eth_call')
+      const broadcastIndex = rpcMethods.indexOf('eth_sendRawTransaction')
+      expect(simulationIndex).toBeGreaterThan(-1)
+      expect(broadcastIndex).toBeGreaterThan(-1)
+      expect(simulationIndex).toBeLessThan(broadcastIndex)
     })
   })
 
@@ -1034,6 +1107,9 @@ describe.runIf(isLocalnet)('on-chain', () => {
       expect(broadcastIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeGreaterThan(-1)
       expect(simulationIndex).toBeLessThan(broadcastIndex)
+      expect(
+        rpcMethods.slice(0, broadcastIndex).filter((method) => method === 'eth_call'),
+      ).toHaveLength(2)
     })
 
     test('fee-payer: rejects smuggled second topUp call', async () => {