mppx validate: multi-challenge support, per-method validation, streaming output by bensandler-stripe · Pull Request #629 · wevm/mppx

bensandler-stripe · 2026-07-09T21:54:12Z

A number of improvements to mppx validate. Builds on #631.

Bug fixes:

Instead of picking first method for automatic crypto transfer, iterates over all methods and makes transfers for any supported method (tempo, soon to be base)
Fixed URL resolution when base URL has a subpath (e.g. mppx validate https://api.example.com/mpp now correctly resolves to /mpp/openapi.json instead of /openapi.json)
Guarded all BigInt conversions with isValidIntegerAmount regex check first (prevents crash on non-integer amounts like "5.000000")
Multi-challenge parsing: uses fromResponseList to parse all payment methods from WWW-Authenticate (previously only picked the first one)
Amount is always required (fail not warn when missing)
Console.log leak fixed in JSON mode

UX and validation improvements:

Per-method field validation: validates Stripe (amount, currency, networkId, paymentMethodTypes), EVM (recipient, currency, amount, chainId), and Tempo (recipient/splits, currency, amount) challenge fields
Common field checks reduced across all challenges (id, realm, expiration, realm-match) into single pass/fail per field
Token symbol and chain name in payment prompts ("USDC.e on Tempo Mainnet")
Tempo recipient validation: must have either recipient or splits
Unsupported payment methods silently skipped (no noise in summary count)

Diffs before/after

API which supports multiple methods: https://www.diffchecker.com/MlCLRk6Q
API which supports one method: https://www.diffchecker.com/2OxdCZuw
API where we previously completely failed: https://www.diffchecker.com/uAPHWsyM

pkg-pr-new · 2026-07-09T21:54:59Z

Open in StackBlitz

npm i https://pkg.pr.new/mppx@629

commit: 09b0065

bensandler-stripe · 2026-07-10T14:32:15Z

r? @brendanjryan

brendanjryan

@bensandler-stripe -- some CI issues but content-wise this look good!

bensandler-stripe · 2026-07-10T17:48:36Z

ah @brendanjryan sorry if I wasted your time, I was adding a few other fixes to this branch. Will get your review in a few.

bensandler-stripe · 2026-07-10T21:16:27Z

@brendanjryan let's merge #631 first (this PR is now rebased off that branch) and then I'll have you review this one

bensandler-stripe · 2026-07-11T16:16:25Z

@@ -0,0 +1,5 @@
+---


diff is a bit easier to review with hiding whitespace:

…ment loop - Multi-challenge parsing (fromResponseList) with per-method [tag] prefixes - Per-method field validation for Stripe, EVM, and Tempo - Payment loop tries each supported method with per-method prompts - Common field checks reduced across all challenges - URL resolution fix for subpath-mounted servers - BigInt guards with isValidIntegerAmount - Malformed challenge detection and reporting GIT_VALID_PII_OVERRIDE Committed-By-Agent: claude

brendanjryan · 2026-07-11T17:59:19Z

code-wise this LGTM

Guarded all BigInt conversions with isValidIntegerAmount regex check first (prevents crash on non-integer amounts like "5.000000")

Why do we need checks like this? Shouldn't all of this be implicitly guarded by the mppx typing and data types?

There is some concern with servers passing invalid json on the wire, but IMO we should just fail are struct marshal time vs. trying to do field-level checks. This is much simpler to maintain

bensandler-stripe · 2026-07-12T20:56:44Z

Why do we need checks like this? Shouldn't all of this be implicitly guarded by the mppx typing and data types?

@brendanjryan you mean, servers' usage of mppx (or another SDK) should prevent this from even happening?

My thinking is, if we rejected at struct-marshal time, we'd just get "parse failed" with no actionable feedback. There was a real user's server I validated (this diff shows before/after) where we previously failed on an opaque Error: Cannot convert 5.000000 to a BigInt and now return something much more descriptive.

Is your contention that we can't reasonably do this for every field, so perhaps it's not really worth doing for any? I think amounts specifically are reasonably tricky to get right, so I personally feel good about these validations. But I agree I wouldn't want to do the same for every other field.

brendanjryan · 2026-07-13T16:49:11Z

Yes -- main concern being that this is a little noisy and redundant, but I do see the benefit.

I'm +1 to this given that all of this is isolated in a designated "validate" package

brendanjryan

@bensandler-stripe -- some CI issues but content-wise this look good!

brendanjryan · 2026-07-11T17:57:14Z

+    ;(bad.request as Record<string, unknown>).amount = '1.50'
+    const server = await multiChallengeServer([bad])
+    const { output } = await serve(['validate', server.url])
+    expect(output).toContain('Amount is valid integer string (Got: 1.50)')


why is this "is a valid integer string?" shouldn't this be invalid?

bensandler-stripe force-pushed the bensandler-validate-improvements branch from 09fafb7 to 5a9072e Compare July 9, 2026 21:54

bensandler-stripe force-pushed the bensandler-validate-improvements branch 2 times, most recently from 7bec8d5 to 9241fef Compare July 9, 2026 22:04

bensandler-stripe marked this pull request as draft July 9, 2026 22:09

bensandler-stripe force-pushed the bensandler-validate-improvements branch from 9241fef to 91e84bf Compare July 9, 2026 22:10

bensandler-stripe marked this pull request as ready for review July 10, 2026 14:32

bensandler-stripe marked this pull request as draft July 10, 2026 15:17

bensandler-stripe force-pushed the bensandler-validate-improvements branch 8 times, most recently from ea9256f to ecc5e92 Compare July 10, 2026 16:19

brendanjryan marked this pull request as ready for review July 10, 2026 16:32

brendanjryan reviewed Jul 10, 2026

View reviewed changes

bensandler-stripe force-pushed the bensandler-validate-improvements branch 10 times, most recently from 0eca153 to e474a0c Compare July 10, 2026 17:45

bensandler-stripe marked this pull request as draft July 10, 2026 17:47

bensandler-stripe force-pushed the bensandler-validate-improvements branch 5 times, most recently from b77cf89 to fb93ddf Compare July 10, 2026 18:28

bensandler-stripe changed the title ~~Improve mppx validate error reporting and fix URL resolution~~ mppx validate: multi-challenge support, per-method validation, streaming output Jul 10, 2026

bensandler-stripe force-pushed the bensandler-validate-improvements branch 7 times, most recently from 65bd823 to 6f5a7dc Compare July 10, 2026 21:13

bensandler-stripe force-pushed the bensandler-validate-improvements branch from 6f5a7dc to a23b9ca Compare July 11, 2026 16:11

bensandler-stripe commented Jul 11, 2026

View reviewed changes

bensandler-stripe marked this pull request as ready for review July 11, 2026 16:16

bensandler-stripe requested a review from brendanjryan July 11, 2026 16:16

bensandler-stripe force-pushed the bensandler-validate-improvements branch from a23b9ca to 09b0065 Compare July 11, 2026 16:53

brendanjryan approved these changes Jul 13, 2026

View reviewed changes

brendanjryan merged commit d3d9d81 into wevm:main Jul 13, 2026
14 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

mppx validate: multi-challenge support, per-method validation, streaming output#629

mppx validate: multi-challenge support, per-method validation, streaming output#629
brendanjryan merged 1 commit into
wevm:mainfrom
bensandler-stripe:bensandler-validate-improvements

bensandler-stripe commented Jul 9, 2026 •

edited

Loading

Uh oh!

pkg-pr-new Bot commented Jul 9, 2026 •

edited

Loading

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

brendanjryan left a comment

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

bensandler-stripe Jul 11, 2026

Uh oh!

brendanjryan commented Jul 11, 2026 •

edited

Loading

Uh oh!

bensandler-stripe commented Jul 12, 2026

Uh oh!

brendanjryan commented Jul 13, 2026

Uh oh!

brendanjryan left a comment

Uh oh!

brendanjryan Jul 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

bensandler-stripe commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Diffs before/after

Uh oh!

pkg-pr-new Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

brendanjryan left a comment

Choose a reason for hiding this comment

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

bensandler-stripe commented Jul 10, 2026

Uh oh!

bensandler-stripe Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

brendanjryan commented Jul 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bensandler-stripe commented Jul 12, 2026

Uh oh!

brendanjryan commented Jul 13, 2026

Uh oh!

brendanjryan left a comment

Choose a reason for hiding this comment

Uh oh!

brendanjryan Jul 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bensandler-stripe commented Jul 9, 2026 •

edited

Loading

pkg-pr-new Bot commented Jul 9, 2026 •

edited

Loading

brendanjryan commented Jul 11, 2026 •

edited

Loading