mppx validate: multi-challenge support, per-method validation, streaming output

[bensandler-stripe]

A number of improvements to mppx validate. Builds on #631.

Bug fixes:

• Instead of picking first method for automatic crypto transfer, iterates over all methods and makes transfers for any supported method (tempo, soon to be base)
• Fixed URL resolution when base URL has a subpath (e.g. mppx validate https://api.example.com/mpp now correctly resolves to /mpp/openapi.json instead of /openapi.json)
• Guarded all BigInt conversions with isValidIntegerAmount regex check first (prevents crash on non-integer amounts like "5.000000")
• Multi-challenge parsing: uses fromResponseList to parse all payment methods from WWW-Authenticate (previously only picked the first one)
• Amount is always required (fail not warn when missing)
• Console.log leak fixed in JSON mode

UX and validation improvements:

• Per-method field validation: validates Stripe (amount, currency, networkId, paymentMethodTypes), EVM (recipient, currency, amount, chainId), and Tempo (recipient/splits, currency, amount) challenge fields
• Common field checks reduced across all challenges (id, realm, expiration, realm-match) into single pass/fail per field
• Token symbol and chain name in payment prompts ("USDC.e on Tempo Mainnet")
• Tempo recipient validation: must have either recipient or splits
• Unsupported payment methods silently skipped (no noise in summary count)

Diffs before/after

• API which supports multiple methods: https://www.diffchecker.com/MlCLRk6Q
• API which supports one method: https://www.diffchecker.com/2OxdCZuw
• API where we previously completely failed: https://www.diffchecker.com/uAPHWsyM

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/mppx@629

commit: 09b0065

[bensandler-stripe]

r? @brendanjryan

[brendanjryan]

@bensandler-stripe -- some CI issues but content-wise this look good!

[bensandler-stripe]

ah @brendanjryan sorry if I wasted your time, I was adding a few other fixes to this branch. Will get your review in a few.

[bensandler-stripe]

@brendanjryan let's merge #631 first (this PR is now rebased off that branch) and then I'll have you review this one

[bensandler-stripe]

diff is a bit easier to review with hiding whitespace:

[brendanjryan]

code-wise this LGTM

Guarded all BigInt conversions with isValidIntegerAmount regex check first (prevents crash on non-integer amounts like "5.000000")

Why do we need checks like this? Shouldn't all of this be implicitly guarded by the mppx typing and data types?

There is some concern with servers passing invalid json on the wire, but IMO we should just fail are struct marshal time vs. trying to do field-level checks. This is much simpler to maintain