mppx 0.9.1 → 0.9.3

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # mppx
 
+## 0.9.3
+
+### Patch Changes
+
+- 43ec92c: Bound subscription key authorizations to their server-issued payment challenge.
+- 175d709: Allowed EVM and x402 payments to be prepared without an account and signed using an account supplied during credential creation.
+- 5932b08: Added non-mutating EVM credential validation with facilitator checks and revalidation before settlement through the existing broadcast lifecycle.
+- 1fd8746: Expanded Tempo session close rollback and expiring-nonce transaction coverage.
+- 459b517: Added challenge context to payment-success hooks, standardized Stripe PaymentIntent analytics
+  metadata, and added a shared SDK version identifier.
+- 203bad2: Added typed multi-offer composition for MCP SDK and JSON-RPC transports while preserving selected-payment dispatch and receipt metadata.
+- a5451d0: Updated `fast-uri` and `qs` to patched versions, resolving their latest security advisories.
+- a802ce9: Added method-agnostic CLI payment extensions that can enforce policy or prepare funds before credential creation.
+- baa0fd5: Added a fee-payer policy option to reject sponsored key authorizations while allowing them by default.
+- f494ffd: Added request-scoped PaymentIntent option resolvers that run before terminal Stripe payments.
+- 7949db6: Fixed server-side session transactions to use expiring nonces across independent processes.
+- 26f9840: Removed the Stripe SPT runtime dependency on viem.
+
+## 0.9.2
+
+### Patch Changes
+
+- 14e8b25: Added CLI support for selecting and paying x402 payment challenges.
+- 5cbc5e4: Added request-scoped PaymentIntent customer, receipt email, and Tax calculation options, with fallback recording without rejected optional fields for completed crypto payments.
+- b12e65b: Fixed framework adapters to preserve multi-method intent challenges.
+- f13f800: Added a machine-payment metadata field to every Stripe PaymentIntent created by mppx.
+- 9dd9969: Added opt-in Stripe-hosted Tempo fee sponsorship to `stripe.create()` using the configured Stripe client.
+
 ## 0.9.1
 
 ### Patch Changes

package/README.md

@@ -109,6 +109,9 @@ mppx account create
 # make request - automatic payment handling, curl-like api
 mppx example.com
 
+# pay an x402 offer on a server that advertises both protocols
+mppx example.com --protocol x402
+
 # open another session instead of reusing the preferred channel
 mppx example.com --session new
 
@@ -131,6 +134,29 @@ its configured custom escrow in the payment challenge, but the client rejects it
 that do not support custom escrows should leave it unset. See the
 [session escrow trust documentation](./src/tempo/session/README.md#escrow-configuration-and-trust).
 
+`--protocol auto` is the default: MPP is preferred when available, and x402 is used otherwise.
+Pass `mpp` or `x402` to require one protocol. x402 payments use the same EVM account as EVM
+charges, so `MPPX_PRIVATE_KEY` or a stored account works for both.
+
+Payment extensions can enforce policy or prepare funds after challenge selection and confirmation,
+immediately before credential creation:
+
+```ts
+import { defineConfig, Extension } from 'mppx/cli'
+
+export default defineConfig({
+  extensions: [
+    Extension.from({
+      async preparePayment({ challenge }) {
+        await prepareFunds(challenge)
+      },
+    }),
+  ],
+})
+```
+
+Extensions run in configuration order. Throwing rejects the payment before Mppx signs it.
+
 You can also install globally to use the `mppx` CLI from anywhere:
 
 ```bash

package/dist/Method.d.ts

@@ -185,6 +185,8 @@ export type CanOfferFn<method extends Method> = (parameters: {
  * like recording the payment in an external system.
  */
 export type OnPaymentSuccessFn<method extends Method> = (parameters: {
+    /** Challenge associated with the successful payment. */
+    challenge?: DeepReadonly<Challenge.Challenge<z.output<method['schema']['request']>, method['intent'], method['name']>> | undefined;
     input?: globalThis.Request;
     receipt: DeepReadonly<Receipt.Receipt>;
     /** Canonical payment request included in the challenge. */

package/dist/cli/Extension.d.ts

@@ -0,0 +1,20 @@
+import type * as Challenge from '../Challenge.js';
+/** Context supplied before the CLI creates a payment credential. */
+export type Context = Readonly<{
+    challenge: Challenge.Challenge;
+    /** Method-specific context that will be supplied to credential creation. */
+    credentialContext?: unknown;
+}>;
+/** Result of preparing a selected payment. */
+export type Result = Readonly<{
+    /** Replaces the method-specific context supplied to credential creation. */
+    credentialContext?: unknown;
+}>;
+/** Method-agnostic CLI lifecycle hooks. */
+export type Extension = Readonly<{
+    /** Runs after challenge selection and confirmation, immediately before credential creation. */
+    preparePayment?(context: Context): Result | void | Promise<Result | void>;
+}>;
+/** Defines an Mppx CLI extension. */
+export declare function from(extension: Extension): Extension;
+//# sourceMappingURL=Extension.d.ts.map

package/dist/cli/Extension.js

@@ -0,0 +1,5 @@
+/** Defines an Mppx CLI extension. */
+export function from(extension) {
+    return extension;
+}
+//# sourceMappingURL=Extension.js.map

package/dist/cli/cli.d.ts

@@ -21,6 +21,7 @@ declare const cli: Cli.Cli<{
             methodOpt?: string[] | undefined;
             network?: "mainnet" | "testnet" | undefined;
             payWith?: string | undefined;
+            protocol: "auto" | "mpp" | "x402";
             rpcUrl?: string | undefined;
             session: string;
             silent: boolean;