[brendanjryan]

tempo request now signs MPP charge credentials through machine-fetch (MppxFetch.createCredential), so the spend cap and funding run fail-closed right before signing. Today the last check lives in mppx's onChallengeReceived, which swallows listener errors, so it can't stop a payment. This was a blocker in machine-fetch's pre-open-source review.

Draft: blocked on machine-fetch 0.5.0 being published (version PR tempoxyz/machine-fetch#111). package.json already says "machine-fetch": "0.5.0", but pnpm-lock.yaml still points at the local tarball of machine-fetch main used for verification, so CI's install will fail until 0.5.0 is on npm and pnpm install regenerates the lockfile.

Changes

• New src/request/policy.ts: createChargeCredential builds MppxFetch.extension({ maxPayment, autoSwap }) per payment and calls MppxFetch.createCredential. Selection, then policy and funding, then signing.
• --max-spend / TEMPO_MAX_SPEND / saved max-spend / default 10 becomes a per-payment maxPayment ceiling in the charged token. If mppx selects an offer that differs from the one the CLI validated (amount, token or chain), it's refused with E_LIMIT_EXCEEDED before signing. The earlier enforceMaxSpend check stays as defence in depth.
• Behavior change: a charge the wallet can't cover swaps from OUSD only on the Tempo DEX in the same transaction, at most shortfall + 1%. --mach and unlisted tokens never swap. Previously charges never swapped. This adds a balance read over RPC before signing; a failed read fails the payment.
• machine-fetch errors map to existing codes (E_LIMIT_EXCEEDED, E_INSUFFICIENT_FUNDS, E_PAYMENT, E_PAYMENT_OUTCOME_UNKNOWN). No new codes.
• --dry-run within_budget for charges comes from Payment.plan.
• Sessions and subscriptions are unchanged. mppx 0.12.0 → 0.15.0 (no code changes were needed for the bump).

Follow-ups (not here)

• An access-key spendLimit reader, so a key that can't cover the swap is refused before signing with an OUSD-specific error.
• Reporting a potential swap in --dry-run.
• Cross-chain (Relay) funding for x402 with a persisted operation ID.

Verification

pnpm check passes (67 files, 2,914 tests), plus changelog:validate and docs:check. 23 new tests in test/request-policy.test.ts cover: a policy refusal never calls the signer, funding runs before signing, and each machine-fetch error maps to the right code.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mppx@​0.15.0

View full report