mppx 0.9.3 → 0.10.0

package/dist/cli/internal.d.ts

@@ -1,10 +1,11 @@
-import type * as Challenge from '../Challenge.js';
+import * as Challenge from '../Challenge.js';
 import type * as Method from '../Method.js';
 import type { Config } from './config.js';
 import type * as Extension from './Extension.js';
 import type { Plugin } from './plugins/plugin.js';
 /** Runs configured payment extensions in order and threads credential context between them. */
 export declare function preparePayment(challenge: Challenge.Challenge, extensions: readonly Extension.Extension[] | undefined, credentialContext?: unknown): Promise<unknown>;
+/** Resolves explicit payment configuration before falling back to built-in plugins. */
 export declare function resolvePlugin(challenge: Challenge.Challenge, config?: {
     plugins?: Plugin[] | undefined;
     methods?: any;
@@ -25,4 +26,6 @@ export declare function loadConfig(configFile?: string | undefined): Promise<{
     config: Config;
     path: string;
 } | undefined>;
+/** Rejects retry challenges that change the payment the caller approved. */
+export declare function assertSamePaymentRequest(approved: Challenge.Challenge, retry: Challenge.Challenge): void;
 //# sourceMappingURL=internal.d.ts.map

package/dist/cli/internal.js

@@ -1,5 +1,6 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
+import * as Challenge from '../Challenge.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
 import { evm as evmPlugin, stripe as stripePlugin, tempo as tempoPlugin, x402 as x402Plugin, } from './plugins/index.js';
 const builtinPlugins = [tempoPlugin(), stripePlugin(), evmPlugin(), x402Plugin()];
@@ -16,17 +17,21 @@ export async function preparePayment(challenge, extensions, credentialContext) {
     }
     return current;
 }
+/** Resolves explicit payment configuration before falling back to built-in plugins. */
 export function resolvePlugin(challenge, config) {
     const configPlugin = config?.plugins?.find((p) => supportsPlugin(p, challenge));
     if (configPlugin)
         return { plugin: configPlugin };
-    const builtin = builtinPlugins.find((p) => supportsPlugin(p, challenge));
-    if (builtin)
-        return { plugin: builtin };
     const configMethods = flattenConfigMethods(config);
-    const matched = configMethods?.find((m) => m.name === challenge.method && m.intent === challenge.intent);
+    const matching = configMethods?.filter((m) => m.name === challenge.method && m.intent === challenge.intent);
+    const matched = matching?.find((m) => m.canHandleChallenge?.({ challenge }) ?? true);
     if (matched)
         return { method: matched };
+    if (matching?.length)
+        return {};
+    const builtin = builtinPlugins.find((p) => supportsPlugin(p, challenge));
+    if (builtin)
+        return { plugin: builtin };
     return {};
 }
 export function selectChallenge(challenges, config) {
@@ -35,7 +40,11 @@ export function selectChallenge(challenges, config) {
         const resolvedPreferences = AcceptPayment.resolve(configMethods, config?.paymentPreferences);
         const selected = AcceptPayment.selectChallenge(challenges, configMethods, resolvedPreferences.entries);
         if (selected) {
-            return { challenge: selected.challenge, ...resolvePlugin(selected.challenge, config) };
+            const plugin = config?.plugins?.find((plugin) => supportsPlugin(plugin, selected.challenge));
+            return {
+                challenge: selected.challenge,
+                ...(plugin ? { plugin } : { method: selected.method }),
+            };
         }
         return undefined;
     }
@@ -84,4 +93,28 @@ function resolveConfigPath(configFile) {
     }
     return undefined;
 }
+/** Rejects retry challenges that change the payment the caller approved. */
+export function assertSamePaymentRequest(approved, retry) {
+    function paymentTerms(challenge) {
+        const request = { ...challenge.request };
+        if (challenge.method === 'tempo' && challenge.intent === 'session') {
+            const methodDetails = { ...request.methodDetails };
+            // Snapshots advance session state; the session method validates them against
+            // the unchanged payment terms before authorizing the next credential.
+            delete methodDetails.sessionSnapshot;
+            if (Object.keys(methodDetails).length)
+                request.methodDetails = methodDetails;
+            else
+                delete request.methodDetails;
+        }
+        return Challenge.serialize({
+            ...challenge,
+            request,
+            id: approved.id,
+            expires: approved.expires,
+        });
+    }
+    if (paymentTerms(retry) !== paymentTerms(approved))
+        throw new Error('Payment request changed on retry. Run the command again to approve the new payment.');
+}
 //# sourceMappingURL=internal.js.map