mppx 0.9.1 → 0.9.3

package/dist/tempo/session/client/SessionManager.d.ts

@@ -3,6 +3,7 @@ import { type Address } from 'viem';
 import * as Account from '../../../viem/Account.js';
 import * as Client from '../../../viem/Client.js';
 import { type ChannelStore } from '../client/ChannelStore.js';
+import { type SessionContext } from '../client/CredentialState.js';
 import { session as sessionPlugin } from '../client/Session.js';
 import type { SessionReceipt } from '../precompile/Protocol.js';
 import { deserializeSnapshot as deserializeSessionSnapshot, serializeSnapshot as serializeSessionSnapshot } from '../Snapshot.js';
@@ -48,6 +49,8 @@ export type PaymentResponse = Response & {
     /** Local cumulative voucher authorization in raw token units. */
     cumulative: bigint;
 };
+/** @internal Merges manager-wide context without allowing it to replace an operation's fields. */
+export declare function mergeSessionCredentialContext(credentialContext: unknown, operationContext: SessionContext): SessionContext;
 /**
  * Creates a session manager that handles the full client payment lifecycle:
  * channel open, incremental vouchers, SSE streaming, and channel close.
@@ -78,6 +81,8 @@ export declare namespace sessionManager {
         escrow?: Address | undefined;
         /** Fetch implementation used for HTTP probes, management posts, and paid retries. */
         fetch?: typeof globalThis.fetch | undefined;
+        /** Base context supplied to every session credential created by the manager. */
+        credentialContext?: unknown;
         /** Maximum deposit in human-readable units (e.g. `'10'` for 10 tokens). Converted to raw units via `decimals`. */
         maxDeposit?: string | undefined;
         /**

package/dist/tempo/session/client/SessionManager.js

@@ -10,7 +10,7 @@ import * as Client from '../../../viem/Client.js';
 import { charge as chargePlugin } from '../../client/Charge.js';
 import * as defaults from '../../internal/defaults.js';
 import { createChannelStore, entryKey } from '../client/ChannelStore.js';
-import { hydrateSessionSnapshot } from '../client/CredentialState.js';
+import { hydrateSessionSnapshot, sessionContextSchema, } from '../client/CredentialState.js';
 import { session as sessionPlugin } from '../client/Session.js';
 import * as Channel from '../precompile/Channel.js';
 import { deserializeSessionReceipt } from '../precompile/Protocol.js';
@@ -60,6 +60,12 @@ function requestInitWithSessionHint(input, init, channelId) {
         },
     };
 }
+/** @internal Merges manager-wide context without allowing it to replace an operation's fields. */
+export function mergeSessionCredentialContext(credentialContext, operationContext) {
+    if (credentialContext === undefined)
+        return operationContext;
+    return { ...sessionContextSchema.parse(credentialContext), ...operationContext };
+}
 function resolveSessionManagerConfig(parameters) {
     const decimals = parameters.decimals ?? 6;
     const WebSocket = parameters.webSocket ??
@@ -92,6 +98,9 @@ export function sessionManager(parameters) {
     });
     const getAccount = Account.getResolver({ account: parameters.account });
     const runtime = createSessionManagerRuntime();
+    const credentialContext = parameters.credentialContext === undefined
+        ? undefined
+        : mergeSessionCredentialContext(parameters.credentialContext, {});
     const receipts = createSessionReceiptCoordinator({
         getSocketSession: () => runtime.socketSession,
     });
@@ -248,7 +257,10 @@ export function sessionManager(parameters) {
         },
     });
     function createSessionCredential(challenge, context) {
-        return method.createCredential({ challenge, context });
+        return method.createCredential({
+            challenge,
+            context: mergeSessionCredentialContext(credentialContext, context),
+        });
     }
     function updateSpentFromReceipt(receipt) {
         applySessionReceiptToRuntime({
@@ -535,6 +547,8 @@ export function sessionManager(parameters) {
             use.trackCreates = true;
             const liveHint = runtime.channel?.opened ? runtime.channel.channelId : undefined;
             let effectiveInit = requestInitWithSessionHint(input, init, liveHint);
+            if (credentialContext)
+                effectiveInit = { ...effectiveInit, context: credentialContext };
             // Stored channels may be stale, so retry once after evicting the resumed entry.
             let canRetryResumed = !previous.channel?.opened;
             async function retryWithoutResumed() {

package/dist/tempo/session/precompile/Chain.js

@@ -318,6 +318,7 @@ async function prepareFeePayerCallTransaction(client, parameters) {
         account,
         calls: [{ to, data }],
         feePayer: true,
+        nonceKey: 'expiring',
         ...(feeToken ? { feeToken } : {}),
     });
 }
@@ -329,6 +330,8 @@ function sendPrecompileContractCall(client, parameters) {
         ...(account ? { account } : {}),
         to,
         data,
+        // Server processes can share a signer without sharing viem's concurrency detection.
+        nonceKey: 'expiring',
         ...(feePayer ? { feePayer } : {}),
         ...(feeToken ? { feeToken } : {}),
     });

package/dist/tempo/subscription/KeyAuthorization.d.ts

@@ -1,3 +1,4 @@
+import { Hex } from 'ox';
 import { KeyAuthorization } from 'ox/tempo';
 import { type Address } from 'viem';
 import type * as Methods from '../Methods.js';
@@ -42,6 +43,8 @@ export declare function getSubscriptionRpcAllowedCalls(request: Pick<Subscriptio
         readonly recipients: readonly [`0x${string}`];
     }];
 }];
+/** Decodes the server-issued challenge identifier for use as a signed Tempo witness. */
+export declare function getSubscriptionChallengeWitness(challengeId: string): Hex.Hex;
 /**
  * Creates and signs a Tempo key authorization for subscription payments when the account can sign
  * arbitrary hashes locally.
@@ -53,6 +56,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
             hash: `0x${string}`;
         }) => Promise<`0x${string}`>) | undefined;
     };
+    challengeId: string;
     chainId: number;
     request: Pick<SubscriptionRequest, 'amount' | 'currency' | 'periodCount' | 'periodUnit' | 'recipient' | 'subscriptionExpires'>;
 }): Promise<{
@@ -96,7 +100,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
         version?: undefined;
     } | {
         metadata: {
-            authenticatorData: import("ox/Hex").Hex;
+            authenticatorData: Hex.Hex;
             clientDataJSON: string;
         };
         signature: {
@@ -133,6 +137,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
         readonly recipients: readonly `0x${string}`[];
     }[];
     readonly type: "p256" | "secp256k1" | "webAuthn";
+    readonly witness: `0x${string}`;
 } | undefined>;
 /**
  * Verifies that a subscription credential contains a key authorization scoped to the requested
@@ -140,6 +145,7 @@ export declare function signSubscriptionKeyAuthorization(parameters: {
  */
 export declare function verifySubscriptionKeyAuthorization(parameters: {
     accessKey?: SubscriptionAccessKey | undefined;
+    challengeId: string;
     chainId: number;
     payload: SubscriptionCredentialPayload;
     request: SubscriptionRequest;

package/dist/tempo/subscription/KeyAuthorization.js

@@ -1,3 +1,4 @@
+import { Base64, Hex } from 'ox';
 import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo';
 import { isAddress, isAddressEqual } from 'viem';
 import { VerificationFailedError } from '../../Errors.js';
@@ -104,16 +105,29 @@ export function getSubscriptionRpcAllowedCalls(request) {
         },
     ];
 }
+/** Decodes the server-issued challenge identifier for use as a signed Tempo witness. */
+export function getSubscriptionChallengeWitness(challengeId) {
+    try {
+        const witness = Hex.fromBytes(Base64.toBytes(challengeId));
+        if (Hex.size(witness) !== 32)
+            throw new Error('invalid challenge id size');
+        return witness;
+    }
+    catch {
+        throw new VerificationFailedError({ reason: 'challenge id must encode 32 bytes' });
+    }
+}
 /**
  * Creates and signs a Tempo key authorization for subscription payments when the account can sign
  * arbitrary hashes locally.
  */
 export async function signSubscriptionKeyAuthorization(parameters) {
-    const { accessKey, account, chainId, request } = parameters;
+    const { accessKey, account, challengeId, chainId, request } = parameters;
     if (typeof account.sign !== 'function')
         return undefined;
     const authorization = createUnsignedAuthorization({
         accessKey,
+        challengeId,
         chainId,
         request,
     });
@@ -135,7 +149,7 @@ export async function signSubscriptionKeyAuthorization(parameters) {
  * token, recipient, amount, period, expiry, chain, and server-issued access key.
  */
 export function verifySubscriptionKeyAuthorization(parameters) {
-    const { accessKey, chainId, payload, request } = parameters;
+    const { accessKey, challengeId, chainId, payload, request } = parameters;
     if (payload.type !== 'keyAuthorization') {
         throw new VerificationFailedError({ reason: 'invalid keyAuthorization payload' });
     }
@@ -146,6 +160,9 @@ export function verifySubscriptionKeyAuthorization(parameters) {
         authorization,
         chainId,
     });
+    if (authorization.witness?.toLowerCase() !== getSubscriptionChallengeWitness(challengeId)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization challenge mismatch' });
+    }
     assertAuthorizationExpiry(authorization, request);
     assertAuthorizationLimit(getSingleTokenLimit(authorization), request);
     assertAuthorizationScopes(authorization.scopes, request);
@@ -159,7 +176,7 @@ export function verifySubscriptionKeyAuthorization(parameters) {
     };
 }
 function createUnsignedAuthorization(parameters) {
-    const { accessKey, chainId, request } = parameters;
+    const { accessKey, challengeId, chainId, request } = parameters;
     return KeyAuthorization.from({
         address: normalizeAddress(accessKey.accessKeyAddress, 'accessKeyAddress'),
         chainId: BigInt(chainId),
@@ -173,6 +190,7 @@ function createUnsignedAuthorization(parameters) {
         ],
         scopes: getSubscriptionScopes(request),
         type: accessKey.keyType,
+        witness: getSubscriptionChallengeWitness(challengeId),
     });
 }
 function deserializeAuthorization(signature) {

package/dist/viem/Client.js

@@ -9,6 +9,7 @@ const knownTempoChains = {
 /** Creates an HTTP transport for a configured remote fee-payer service. */
 export function remoteFeePayerTransport(config, options = {}) {
     return http(config.url, {
+        fetchFn: config.fetch,
         fetchOptions: { headers: RemoteFeePayer.resolveHeaders(config) },
         ...options,
     });

package/dist/x402/client/Exact.d.ts

@@ -28,8 +28,8 @@ export type Signer = Account & {
     signTypedData?: (parameters: any) => Promise<`0x${string}`>;
 };
 export type Config = {
-    /** Account used to sign exact EVM payment payloads. */
-    account: Account;
+    /** Account used to sign exact EVM payment payloads, unless supplied in credential context. */
+    account?: Account | undefined;
     /** Optional token decimals used to parse `maxAmount` when currency metadata is not provided. */
     decimals?: number | undefined;
     /** Optional maximum display-unit amount the client is willing to pay. */

package/dist/x402/client/Exact.js

@@ -8,7 +8,7 @@ import * as Types from '../Types.js';
  */
 export async function createCredential(parameters) {
     const account = (parameters.context?.account ?? parameters.config.account);
-    if (!account.signTypedData)
+    if (!account?.signTypedData)
         throw new Error('x402 exact requires a typed-data signer.');
     const request = parameters.challenge.request;
     const accepted = Types.toPaymentRequirements(request);

package/dist/x402/server/EvmCharge.d.ts

@@ -52,6 +52,8 @@ export declare function resolveOptions(parameters: {
 export declare function createPath(config: ResolvedOptions): Path;
 /** Settles a verified EVM authorization through an x402 facilitator. */
 export declare function settleWithFacilitator(parameters: ResolvedOptions): SettleWithFacilitator;
+/** Checks an EVM authorization with the facilitator without settling it. */
+export declare function verifyWithFacilitator(parameters: ResolvedOptions, authorization: Parameters<SettleWithFacilitator>[0]): Promise<void>;
 export type SettleWithFacilitator = (parameters: {
     credential: Credential.Credential<Types.AuthorizationPayload>;
     payload: Types.AuthorizationPayload;

package/dist/x402/server/EvmCharge.js

@@ -174,34 +174,11 @@ export function createPath(config) {
 }
 /** Settles a verified EVM authorization through an x402 facilitator. */
 export function settleWithFacilitator(parameters) {
-    const { facilitator, maxTimeoutSeconds } = parameters;
+    const { facilitator } = parameters;
     if (!facilitator)
         throw new Error('EVM authorization x402 requires `facilitator`.');
-    return async ({ payload, request }) => {
-        const paymentRequirements = toPaymentRequirements(request, {
-            ...parameters,
-            maxTimeoutSeconds,
-        });
-        const paymentPayload = {
-            accepted: paymentRequirements,
-            payload: {
-                authorization: {
-                    from: payload.from,
-                    nonce: payload.nonce,
-                    to: payload.to,
-                    validAfter: payload.validAfter,
-                    validBefore: payload.validBefore,
-                    value: payload.value,
-                },
-                signature: payload.signature,
-            },
-            x402Version: 2,
-        };
-        const verified = await facilitator.verify(paymentPayload, paymentRequirements);
-        if (!verified.isValid)
-            throw new VerificationFailedError({
-                reason: verified.invalidMessage ?? verified.invalidReason ?? 'EVM facilitator verify failed',
-            });
+    return async (authorization) => {
+        const { paymentPayload, paymentRequirements } = facilitatorPayment(parameters, authorization);
         const settled = await facilitator.settle(paymentPayload, paymentRequirements);
         if (!settled.success)
             throw new VerificationFailedError({
@@ -212,6 +189,37 @@ export function settleWithFacilitator(parameters) {
         };
     };
 }
+/** Checks an EVM authorization with the facilitator without settling it. */
+export async function verifyWithFacilitator(parameters, authorization) {
+    const { facilitator } = parameters;
+    if (!facilitator)
+        throw new Error('EVM authorization x402 requires `facilitator`.');
+    const { paymentPayload, paymentRequirements } = facilitatorPayment(parameters, authorization);
+    const verified = await facilitator.verify(paymentPayload, paymentRequirements);
+    if (!verified.isValid)
+        throw new VerificationFailedError({
+            reason: verified.invalidMessage ?? verified.invalidReason ?? 'EVM facilitator verify failed',
+        });
+}
+function facilitatorPayment(parameters, { payload, request }) {
+    const paymentRequirements = toPaymentRequirements(request, parameters);
+    const paymentPayload = {
+        accepted: paymentRequirements,
+        payload: {
+            authorization: {
+                from: payload.from,
+                nonce: payload.nonce,
+                to: payload.to,
+                validAfter: payload.validAfter,
+                validBefore: payload.validBefore,
+                value: payload.value,
+            },
+            signature: payload.signature,
+        },
+        x402Version: 2,
+    };
+    return { paymentPayload, paymentRequirements };
+}
 /** Returns whether a credential was converted from an x402 payment payload. */
 export function isCredential(credential) {
     return credential[x402Credential] === true;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",