mppx 0.9.3 → 0.10.1

package/dist/tempo/session/client/CredentialState.d.ts

@@ -113,6 +113,8 @@ export type ResolveChallengeContextParameters = {
     challenge: Challenge.Challenge;
     /** Optional local escrow override. */
     escrowOverride?: Address | undefined;
+    /** Permitted payment chains, checked before resolution when known and again before signing. */
+    allowedChainIds?: readonly number[] | undefined;
     /** Resolves the viem client for the challenge chain. */
     getClient(parameters: {
         chainId?: number | undefined;

package/dist/tempo/session/client/CredentialState.js

@@ -1,5 +1,6 @@
 import { isAddress, parseUnits, } from 'viem';
 import * as Constants from '../../../Constants.js';
+import { assertAllowedChainId, assertChainId } from '../../../viem/Client.js';
 import * as z from '../../../zod.js';
 import * as AutoSwap from '../../internal/auto-swap.js';
 import * as Chain from '../precompile/Chain.js';
@@ -126,10 +127,15 @@ function readSuggestedDeposit(value) {
 }
 /** Resolves raw challenge fields into the typed data required by client credential planning. */
 export async function resolveChallengeContext(parameters) {
-    const { allowCustomEscrow, challenge, escrowOverride, getClient } = parameters;
+    const { allowCustomEscrow, challenge, escrowOverride, allowedChainIds, getClient } = parameters;
     const methodDetails = readMethodDetails(challenge);
-    const client = await getClient({ chainId: methodDetails.chainId });
-    const chainId = methodDetails.chainId ?? client.chain?.id;
+    if (methodDetails.chainId !== undefined || allowedChainIds?.length === 0)
+        assertAllowedChainId(allowedChainIds, methodDetails.chainId);
+    const requestedChainId = methodDetails.chainId ?? (allowedChainIds?.length === 1 ? allowedChainIds[0] : undefined);
+    const client = await getClient({ chainId: requestedChainId });
+    assertChainId(client, requestedChainId);
+    const chainId = requestedChainId ?? client.chain?.id;
+    assertAllowedChainId(allowedChainIds, chainId);
     if (!chainId)
         throw new Error('No chainId configured for TIP-1034 session challenge.');
     const escrow = resolveEscrow(challenge, escrowOverride, allowCustomEscrow);

package/dist/tempo/session/client/Session.d.ts

@@ -137,6 +137,12 @@ export declare namespace session {
         decimals?: number | undefined;
         /** Exact TIP20EscrowChannel address pin. Takes precedence over `allowCustomEscrow`. */
         escrow?: Address | undefined;
+        /**
+         * Chains permitted for session credentials. Omitted allows any chain; empty rejects all.
+         * A single entry supplies the chain when omitted by the challenge. Otherwise the
+         * challenge or resolved client must select an allowed chain.
+         */
+        allowedChainIds?: readonly number[] | undefined;
         /** Maximum channel deposit in human-readable units. Caps server-suggested opens and automatic top-ups. */
         maxDeposit?: string | undefined;
         /**

package/dist/tempo/session/client/Session.js

@@ -77,7 +77,7 @@ function acknowledgesOpen(outcome, challenge, opened) {
  * channel descriptor).
  */
 export function session(parameters = {}) {
-    const { account, allowCustomEscrow = false, autoSwap: autoSwapParameter, channelStore, decimals = defaults.decimals, escrow: escrowOverride, getClient: getClientParameter, maxDeposit: maxDepositParameter, topUpAmount: topUpAmountParameter, onChannelUpdate, resolveAccount, } = parameters;
+    const { account, allowCustomEscrow = false, autoSwap: autoSwapParameter, channelStore, decimals = defaults.decimals, escrow: escrowOverride, allowedChainIds, getClient: getClientParameter, maxDeposit: maxDepositParameter, topUpAmount: topUpAmountParameter, onChannelUpdate, resolveAccount, } = parameters;
     const getClient = Client.getResolver({
         chain: tempo_chain,
         getClient: getClientParameter,
@@ -120,6 +120,7 @@ export function session(parameters = {}) {
                 allowCustomEscrow,
                 challenge,
                 escrowOverride,
+                allowedChainIds,
                 getClient,
             });
             const attempt = MethodResponse.getAttempt(parameters);
@@ -237,6 +238,7 @@ export function session(parameters = {}) {
             allowCustomEscrow,
             challenge,
             escrowOverride,
+            allowedChainIds,
             getClient,
         });
         const channel = await store.get(resolved.key);
@@ -278,6 +280,7 @@ export function session(parameters = {}) {
             allowCustomEscrow,
             challenge,
             escrowOverride,
+            allowedChainIds,
             getClient,
         })).key;
         let channel = await store.get(channelKey);

package/dist/tempo/session/client/SessionManager.d.ts

@@ -79,6 +79,12 @@ export declare namespace sessionManager {
         decimals?: number | undefined;
         /** Exact TIP20EscrowChannel address pin. Takes precedence over `allowCustomEscrow`. */
         escrow?: Address | undefined;
+        /**
+         * Chains permitted for sessions, bootstrap proofs, and snapshots. Omitted allows any
+         * chain; empty rejects all. A single entry supplies an omitted challenge chain;
+         * otherwise the challenge or resolved client must select an allowed chain.
+         */
+        allowedChainIds?: readonly number[] | undefined;
         /** Fetch implementation used for HTTP probes, management posts, and paid retries. */
         fetch?: typeof globalThis.fetch | undefined;
         /** Base context supplied to every session credential created by the manager. */

package/dist/tempo/session/client/SessionManager.js

@@ -89,6 +89,9 @@ function resolveSessionManagerConfig(parameters) {
  * `channelStore` can persist reusable channels between manager instances.
  */
 export function sessionManager(parameters) {
+    const clientChainId = parameters.client?.chain?.id;
+    if (clientChainId !== undefined || parameters.allowedChainIds?.length === 0)
+        Client.assertAllowedChainId(parameters.allowedChainIds, clientChainId);
     const allowCustomEscrow = parameters.allowCustomEscrow ?? false;
     const config = resolveSessionManagerConfig(parameters);
     const getClient = Client.getResolver({
@@ -206,6 +209,7 @@ export function sessionManager(parameters) {
         getClient: parameters.client ? () => parameters.client : parameters.getClient,
         resolveAccount: parameters.resolveAccount,
         escrow: parameters.escrow,
+        allowedChainIds: parameters.allowedChainIds,
         decimals: config.decimals,
         maxDeposit: parameters.maxDeposit,
         topUpAmount: parameters.topUpAmount,
@@ -228,6 +232,7 @@ export function sessionManager(parameters) {
     });
     MethodResponse.unregister(method);
     const chargeMethod = chargePlugin({
+        allowedChainIds: parameters.allowedChainIds,
         account: parameters.account,
         getClient: parameters.client ? () => parameters.client : parameters.getClient,
     });
@@ -290,7 +295,9 @@ export function sessionManager(parameters) {
         if (!header)
             return undefined;
         const snapshot = deserializeSessionSnapshot(header);
+        Client.assertAllowedChainId(parameters.allowedChainIds, snapshot.chainId);
         const client = await getClient({ chainId: snapshot.chainId });
+        Client.assertChainId(client, snapshot.chainId);
         const defaultAccount = getAccount(client);
         const account = (await parameters.resolveAccount?.({
             account: defaultAccount,

package/dist/validation/core.d.ts

@@ -37,6 +37,7 @@ export type ValidateResult = {
         passed: number;
         failed: number;
         warnings: number;
+        suggested: number;
         skipped: number;
     };
     suggestions: string[];

package/dist/validation/core.js

@@ -1,6 +1,6 @@
 import * as viemChains from 'viem/chains';
 import { validateChallenge, validateErrorHandling } from '../cli/validate/challenge.js';
-import { buildUrl, extractEndpointsFromDiscovery, extractRequestBodyFromDiscovery, fetchDiscoveryDoc, } from '../cli/validate/discovery.js';
+import { buildUrl, extractEndpointsFromDiscovery, extractRequestBodyFromDiscovery, fetchDiscoveryDoc, validateLlmsDoc, } from '../cli/validate/discovery.js';
 import { isValidIntegerAmount, parseEndpointArg, resolveBodyForEndpoint, } from '../cli/validate/helpers.js';
 import { missingDiscoverySuggestion } from '../cli/validate/messages.js';
 import { validatePaymentFlow } from '../cli/validate/payment.js';
@@ -123,7 +123,7 @@ export async function validate(options) {
                 break;
         }
     }
-    const summary = { passed: 0, failed: 0, warnings: 0, skipped: 0 };
+    const summary = { passed: 0, failed: 0, warnings: 0, suggested: 0, skipped: 0 };
     if (discovery) {
         for (const r of discovery.checks) {
             if (r.severity === 'pass')
@@ -132,6 +132,8 @@ export async function validate(options) {
                 summary.failed++;
             else if (r.severity === 'warn')
                 summary.warnings++;
+            else if (r.severity === 'suggested')
+                summary.suggested++;
             else if (r.severity === 'skip')
                 summary.skipped++;
         }
@@ -144,6 +146,8 @@ export async function validate(options) {
                 summary.failed++;
             else if (r.severity === 'warn')
                 summary.warnings++;
+            else if (r.severity === 'suggested')
+                summary.suggested++;
             else if (r.severity === 'skip')
                 summary.skipped++;
         }
@@ -189,6 +193,7 @@ async function runDiscovery(baseUrl, options) {
     let discoveryDoc = null;
     let found = false;
     let valid = false;
+    checks.push(await validateLlmsDoc(baseUrl));
     // Try the user's path first, then root, then /api.
     const origin = new URL(baseUrl).origin;
     let candidates;

package/dist/viem/Client.d.ts

@@ -25,4 +25,8 @@ export declare namespace getResolver {
         }) => MaybePromise<Client>) | undefined;
     };
 }
+/** Rejects a resolved client whose known chain conflicts with the requested payment chain. */
+export declare function assertChainId(client: Client, chainId: number | undefined): void;
+/** Rejects disallowed or unknown payment chains when an allowlist is configured. */
+export declare function assertAllowedChainId(allowedChainIds: readonly number[] | undefined, chainId: number | undefined): void;
 //# sourceMappingURL=Client.d.ts.map

package/dist/viem/Client.js

@@ -50,6 +50,8 @@ export function getResolver(parameters) {
             return Object.assign({}, resolvedClient, {
                 chain: {
                     ...chain,
+                    // Serializer defaults must not replace an explicitly requested network.
+                    ...(params.chainId !== undefined ? { id: params.chainId } : {}),
                     ...resolvedClient.chain,
                     formatters: resolvedClient.chain?.formatters ?? chain.formatters,
                     prepareTransactionRequest: resolvedClient.chain?.prepareTransactionRequest ?? chain.prepareTransactionRequest,
@@ -76,4 +78,15 @@ export function getResolver(parameters) {
         });
     };
 }
+/** Rejects a resolved client whose known chain conflicts with the requested payment chain. */
+export function assertChainId(client, chainId) {
+    if (chainId !== undefined && client.chain?.id !== undefined && client.chain.id !== chainId)
+        throw new Error(`Chain ID mismatch: expected ${chainId}, got ${client.chain.id}.`);
+}
+/** Rejects disallowed or unknown payment chains when an allowlist is configured. */
+export function assertAllowedChainId(allowedChainIds, chainId) {
+    if (allowedChainIds !== undefined &&
+        (chainId === undefined || !allowedChainIds.includes(chainId)))
+        throw new Error(`Chain ID not allowed: ${chainId ?? 'unknown'}.`);
+}
 //# sourceMappingURL=Client.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "mppx",
   "type": "module",
-  "version": "0.9.3",
+  "version": "0.10.1",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",