mppx 0.9.3 → 0.10.0

package/dist/client/Mppx.js

@@ -1,8 +1,11 @@
 import * as AttestationClient from '../attestation/Client.js';
+import * as Constants from '../Constants.js';
 import * as Expires from '../Expires.js';
 import * as AcceptPayment from '../internal/AcceptPayment.js';
 import * as Fetch from './internal/Fetch.js';
+import * as MethodChallenge from './internal/MethodChallenge.js';
 import * as Transport from './Transport.js';
+const preparedPaymentMethods = new WeakMap();
 /**
  * Creates a client-side payment handler from an array of methods.
  *
@@ -28,9 +31,12 @@ export function create(config) {
     const { attestation, maxPaymentRetries, onChallenge, orderChallenges, polyfill = true, acceptPaymentPolicy = polyfill && typeof globalThis.location !== 'undefined'
         ? 'same-origin'
         : 'always', transport = Transport.http(), } = config;
-    const rawFetch = config.fetch ?? globalThis.fetch;
-    const attestedFetch = attestation
-        ? createAttestedFetch(rawFetch, attestation)
+    const rawFetch = Fetch.unwrapFetch(config.fetch ?? globalThis.fetch);
+    const attestationSigner = attestation
+        ? createAttestationSigner(attestation)
+        : undefined;
+    const attestedFetch = attestationSigner
+        ? AttestationClient.wrapFetch(rawFetch, attestationSigner)
         : rawFetch;
     const methods = config.methods.flat();
     const acceptPayment = AcceptPayment.resolve(methods, config.paymentPreferences);
@@ -117,7 +123,7 @@ export function create(config) {
                     throw error;
                 }
             });
-            return Object.freeze({
+            const prepared = Object.freeze({
                 challenge: selectedChallenge,
                 challenges: challengeSnapshots,
                 createCredential: createPreparedCredential,
@@ -127,6 +133,8 @@ export function create(config) {
                     return transport.setCredential(request, credential, { challenge: transportChallenge });
                 },
             });
+            preparedPaymentMethods.set(prepared, selectedMethod);
+            return prepared;
         }
         catch (error) {
             await events.emit('payment.failed', createPaymentFailedPayload({
@@ -139,6 +147,51 @@ export function create(config) {
             throw error;
         }
     }
+    async function prepareRequest(input, init, options) {
+        const { maxRedirects = 20, ...paymentOptions } = options ?? {};
+        const preparedHttp = await prepareHttpRequest({
+            acceptPayment: acceptPayment.header,
+            acceptPaymentPolicy,
+            fetch: rawFetch,
+            init,
+            input,
+            maxRedirects,
+            signer: attestationSigner,
+        });
+        const requestInit = requestToInit(preparedHttp.replayRequest, preparedHttp.body);
+        if (!(await transport.isPaymentRequired(preparedHttp.response, requestInit)))
+            throw new Error('Response does not require payment.');
+        const payment = (await preparePayment(preparedHttp.response, {
+            ...paymentOptions,
+            request: requestInit,
+        }));
+        const paymentMethod = preparedPaymentMethods.get(payment) ?? payment.method;
+        const createRequestCredential = memoizeCreateCredential(async (context) => {
+            if (MethodChallenge.has(paymentMethod))
+                await MethodChallenge.handle(paymentMethod, {
+                    challenge: payment.challenge,
+                    context,
+                    fetch: attestedFetch,
+                    input: preparedHttp.replayRequest,
+                });
+            return payment.createCredential(context);
+        });
+        return Object.freeze({
+            ...payment,
+            createCredential: createRequestCredential,
+            request: preparedHttp.request,
+            response: preparedHttp.response,
+            redirects: preparedHttp.redirects,
+            async pay(context) {
+                const credential = await createRequestCredential(context);
+                const paidInit = payment.setCredential(requestToInit(preparedHttp.replayRequest, preparedHttp.body), credential);
+                return attestedFetch(preparedHttp.replayRequest.url, {
+                    ...paidInit,
+                    redirect: 'manual',
+                });
+            },
+        });
+    }
     return {
         fetch,
         rawFetch,
@@ -150,6 +203,7 @@ export function create(config) {
         onPaymentFailed,
         onPaymentResponse,
         preparePayment,
+        prepareRequest: prepareRequest,
         async createCredential(response, context, options) {
             const prepared = await preparePayment(response, options);
             return prepared.createCredential(context);
@@ -173,11 +227,131 @@ export function create(config) {
 export function restore() {
     Fetch.restore();
 }
-function createAttestedFetch(fetch, signers) {
+function createAttestationSigner(signers) {
     const values = Object.values(signers);
     if (values.length === 0)
         throw new TypeError('Mppx client attestation must configure at least one signer.');
-    return AttestationClient.wrapFetch(fetch, AttestationClient.composeSigners(...values));
+    return AttestationClient.composeSigners(...values);
+}
+const redirectStatuses = new Set([301, 302, 303, 307, 308]);
+const bodyHeaders = [
+    'content-encoding',
+    'content-language',
+    'content-length',
+    'content-location',
+    'content-type',
+    'transfer-encoding',
+];
+const crossOriginHeaders = [
+    'authorization',
+    'cookie',
+    'cookie2',
+    'host',
+    'payment-authorization',
+    'payment-signature',
+    'proxy-authorization',
+    'x-payment',
+];
+async function prepareHttpRequest(parameters) {
+    const { acceptPayment, acceptPaymentPolicy, fetch, init, input, maxRedirects, signer } = parameters;
+    if (!Number.isInteger(maxRedirects) || maxRedirects < 0)
+        throw new TypeError('maxRedirects must be a non-negative integer.');
+    let request = new Request(input, { ...init, redirect: 'manual' });
+    const explicitAcceptPayment = request.headers.has(Constants.Headers.acceptPayment);
+    let body = await replayBody(request, init?.body);
+    const redirects = [];
+    for (;;) {
+        request = withAcceptPayment(request, acceptPayment, explicitAcceptPayment, acceptPaymentPolicy);
+        const sentRequest = signer ? await signer.sign(request.clone()) : request.clone();
+        const response = await fetch(sentRequest);
+        if (response.type === 'opaqueredirect' || response.status === 0)
+            throw new Error('prepareRequest requires a runtime that exposes manual redirect responses.');
+        if (!redirectStatuses.has(response.status))
+            return {
+                body,
+                replayRequest: request,
+                request: sentRequest,
+                response,
+                redirects: Object.freeze(redirects),
+            };
+        const location = response.headers.get('location');
+        if (!location)
+            return {
+                body,
+                replayRequest: request,
+                request: sentRequest,
+                response,
+                redirects: Object.freeze(redirects),
+            };
+        if (redirects.length >= maxRedirects) {
+            await response.body?.cancel();
+            throw new Error(`Payment request exceeded ${maxRedirects} redirects.`);
+        }
+        const from = new URL(request.url);
+        const to = new URL(location, from);
+        if (from.protocol === 'https:' && to.protocol !== 'https:') {
+            await response.body?.cancel();
+            throw new Error(`Payment request refused HTTPS downgrade redirect to ${to.href}`);
+        }
+        const headers = new Headers(request.headers);
+        let method = request.method;
+        const switchesToGet = ((response.status === 301 || response.status === 302) && method === 'POST') ||
+            (response.status === 303 && method !== 'GET' && method !== 'HEAD');
+        if (switchesToGet) {
+            method = 'GET';
+            body = undefined;
+            for (const header of bodyHeaders)
+                headers.delete(header);
+        }
+        if (from.origin !== to.origin)
+            for (const header of [...headers.keys()]) {
+                const value = headers.get(header) ?? '';
+                if (crossOriginHeaders.includes(header) || value.startsWith('Payment '))
+                    headers.delete(header);
+            }
+        redirects.push(Object.freeze({ from: from.href, status: response.status, to: to.href }));
+        await response.body?.cancel();
+        request = new Request(to, requestInit(request, headers, method, body));
+    }
+}
+function requestToInit(request, body) {
+    return requestInit(request, new Headers(request.headers), request.method, body);
+}
+async function replayBody(request, suppliedBody) {
+    if (typeof suppliedBody === 'string')
+        return suppliedBody;
+    if (!request.body)
+        return undefined;
+    const accept = request.headers.get('accept')?.toLowerCase() ?? '';
+    if (request.headers.has('mcp-method') ||
+        (accept.includes('application/json') && accept.includes('text/event-stream')))
+        return request.clone().text();
+    return request.clone().arrayBuffer();
+}
+function withAcceptPayment(request, acceptPayment, explicit, policy) {
+    if (explicit)
+        return request;
+    const headers = new Headers(request.headers);
+    headers.delete(Constants.Headers.acceptPayment);
+    if (acceptPayment && Fetch.shouldInjectForPolicy(request, policy))
+        headers.set(Constants.Headers.acceptPayment, acceptPayment);
+    return new Request(request, { headers });
+}
+function requestInit(request, headers, method, body) {
+    return {
+        ...(body ? { body } : {}),
+        cache: request.cache,
+        credentials: request.credentials,
+        headers,
+        integrity: request.integrity,
+        keepalive: request.keepalive,
+        method,
+        mode: request.mode,
+        redirect: 'manual',
+        referrer: request.referrer,
+        referrerPolicy: request.referrerPolicy,
+        signal: request.signal,
+    };
 }
 function memoizeCreateCredential(createCredential) {
     let promise;

package/dist/client/internal/Fetch.d.ts

@@ -168,6 +168,12 @@ export declare function normalizeHeaders(headers: unknown): Record<string, strin
  */
 export declare function createEventDispatcher<methods extends readonly Method.AnyClient[] = readonly Method.AnyClient[], response = Response>(): ClientEventDispatcher<methods, response>;
 /** @internal */
+/** @internal */
+export declare function unwrapFetch(fetch: typeof globalThis.fetch): typeof globalThis.fetch;
+/** @internal */
 export declare function validateCredentialHeaderValue(credential: string): void;
+/** @internal */
+/** @internal */
+export declare function shouldInjectForPolicy(input: RequestInfo | URL, policy: NonNullable<from.Config['acceptPaymentPolicy']>): boolean;
 export {};
 //# sourceMappingURL=Fetch.d.ts.map

package/dist/client/internal/Fetch.js

@@ -558,7 +558,8 @@ function getCallerHeaders(input, headers) {
     return new Headers(input instanceof Request ? input.headers : undefined);
 }
 /** @internal */
-function unwrapFetch(fetch) {
+/** @internal */
+export function unwrapFetch(fetch) {
     let current = fetch;
     while (current[MPPX_FETCH_WRAPPER]) {
         current = current[MPPX_FETCH_WRAPPER];
@@ -620,7 +621,8 @@ async function resolveChallengeOrder(candidates, orderChallenges) {
     return orderChallenges ? orderChallenges(candidates) : candidates;
 }
 /** @internal */
-function shouldInjectForPolicy(input, policy) {
+/** @internal */
+export function shouldInjectForPolicy(input, policy) {
     if (policy === 'always')
         return true;
     if (policy === 'never')

package/dist/internal/version.d.ts

@@ -1,5 +1,5 @@
 /** Current mppx package version. */
-export declare const version = "0.9.3";
+export declare const version = "0.10.0";
 /** Canonical SDK identifier for this mppx release. */
-export declare const sdkIdentifier = "mppx/0.9.3";
+export declare const sdkIdentifier = "mppx/0.10.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/internal/version.js

@@ -1,6 +1,6 @@
 // Generated by scripts/sync-version.ts.
 /** Current mppx package version. */
-export const version = '0.9.3';
+export const version = '0.10.0';
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`;
 //# sourceMappingURL=version.js.map

package/dist/tempo/client/Charge.d.ts

@@ -125,8 +125,14 @@ export declare namespace charge {
          */
         expectedChainId?: number | undefined;
         /**
-         * Allowlist of expected split recipient addresses. When set, the client
-         * rejects any challenge whose split recipients are not in this list.
+         * Chains permitted for payment credentials. Omitted allows any chain; empty rejects all.
+         * A single entry supplies an omitted challenge chain unless `expectedChainId` is set.
+         * When both policies are set, the selected chain must satisfy both.
+         */
+        allowedChainIds?: readonly number[] | undefined;
+        /**
+         * Allowlist of payment recipient addresses. When set, both the primary
+         * recipient and every split recipient must be included in this list.
          */
         expectedRecipients?: readonly Address[] | undefined;
         /**

package/dist/tempo/client/Charge.js

@@ -51,15 +51,33 @@ export function charge(parameters = {}) {
                 challengeChainId !== undefined &&
                 challengeChainId !== parameters.expectedChainId)
                 throw new Error(`Chain ID mismatch: expected ${parameters.expectedChainId}, got ${challengeChainId}.`);
-            const resolvedChainId = challengeChainId ?? parameters.expectedChainId;
+            if (challengeChainId !== undefined || parameters.allowedChainIds?.length === 0)
+                Client.assertAllowedChainId(parameters.allowedChainIds, challengeChainId);
+            const resolvedChainId = challengeChainId ??
+                parameters.expectedChainId ??
+                (parameters.allowedChainIds?.length === 1 ? parameters.allowedChainIds[0] : undefined);
             const client = await getClient({ chainId: resolvedChainId });
+            Client.assertChainId(client, resolvedChainId);
             const chainId = resolvedChainId ?? client.chain?.id;
+            Client.assertAllowedChainId(parameters.allowedChainIds, chainId);
             if (chainId === undefined)
                 throw new Error('No `chainId` provided. Pass a chain ID in the challenge or client.');
             const { request } = challenge;
             const { amount, methodDetails } = request;
             const supportedModes = methodDetails?.supportedModes ?? ['pull', 'push'];
             const defaultAccount = getAccount(client, context);
+            if (parameters.expectedRecipients) {
+                const allowed = new Set(parameters.expectedRecipients.map((a) => a.toLowerCase()));
+                if (!request.recipient || !allowed.has(request.recipient.toLowerCase()))
+                    throw new Error(`Unexpected primary recipient: ${request.recipient}`);
+                const splits = methodDetails?.splits;
+                if (splits) {
+                    for (const split of splits) {
+                        if (!allowed.has(split.recipient.toLowerCase()))
+                            throw new Error(`Unexpected split recipient: ${split.recipient}`);
+                    }
+                }
+            }
             // Zero-amount: sign EIP-712 typed data instead of creating a transaction.
             if (BigInt(amount) === 0n) {
                 const signature = await signTypedData(client, {
@@ -80,16 +98,6 @@ export function charge(parameters = {}) {
                 });
             }
             const currency = request.currency;
-            if (parameters.expectedRecipients) {
-                const allowed = new Set(parameters.expectedRecipients.map((a) => a.toLowerCase()));
-                const splits = methodDetails?.splits;
-                if (splits) {
-                    for (const split of splits) {
-                        if (!allowed.has(split.recipient.toLowerCase()))
-                            throw new Error(`Unexpected split recipient: ${split.recipient}`);
-                    }
-                }
-            }
             const memo = methodDetails?.memo
                 ? methodDetails.memo
                 : Attribution.encode({ challengeId: challenge.id, clientId, serverId: challenge.realm });