feat: add payment-aware client runtime

[parvahuja]

Summary

• add one owned-loop PaymentRuntime for payment methods, events, origin policy, and uncertain-outcome state across synchronous HTTP, asynchronous HTTP, and explicit MCP clients
• construct loop-bound methods with method_factories, manage them with sync/async runtime contexts, and preserve the existing caller-loop behavior for direct async methods= APIs
• add SyncPaymentTransport, wrappers for existing HTTPX clients, and scoped global instrument(runtime) support for standard HTTPX clients
• preserve close leases, repeated-challenge protection, and conservative outcome tracking after a credential may have been sent
• keep non-payable 402 responses transparent and lazy; handle combined WWW-Authenticate fields, replay failures, invalid expirations, redirects, hooks, streaming bodies, and response cleanup
• support HTTPX 0.27.x and 0.28.x monkey-patching adapters with fail-fast version/shape checks and an exact patch-version CI matrix

Runtime boundaries

• the runtime owns exactly one background event loop
• method factories and async method context managers enter and exit on that loop
• direct methods are borrowed and must be loop-independent
• instrumentation is context-scoped by default; scope="process" is explicit, and ambiguous process bindings fail closed
• global instrumentation requires an origin allowlist unless unrestricted payment is explicitly enabled
• sent but unconfirmed attempts become compact tombstones, including when the runtime closes, so matching requests are blocked instead of blindly paid again

Intentionally not included

• public HTTP response/refetch hook APIs
• receipt model extensions
• global MCP instrumentation
• MCP payment challenges in successful result metadata; MCP remains explicit through McpClient(runtime=...) and follows the -32042 error flow in the published MCP payment transport draft

Validation

• exact-head local suite: 946 passed, 41 skipped, 92.11% coverage
• ruff check, ruff format --check, pyright, and actionlint
• strict wheel/sdist build and metadata validation
• built-wheel import smoke for base HTTP, sync transport, instrumentation, and MCP exports
• HTTPX CI matrix: 0.27.0, 0.27.1, 0.27.2, 0.28.0, 0.28.1
• Python CI matrix: 3.11, 3.12, 3.13, 3.14

The PR remains draft.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​openai@​2.48.0

View full report