chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

mppx@0.9.0

Minor Changes

• 4915654: Bundled the CLI runtime and removed source files, source maps, and source export conditions from the published package.

Patch Changes

• 61f847e: Added first-party machine-token payments for Tempo charges across push, pull, relay, and fee-sponsored settlement.

• 981389d: Changed Stripe PaymentIntent idempotency keys to use the SDK-independent mpp_ prefix.

• e59c031: Added support for composing native claim implementations with Redis and Upstash store adapters.

• 349543a: Added CI interoperability coverage against the Coinbase x402 resource server and facilitator implementations.

• 9774481: Fixed deserialization of challenges with mixed-case auth-param names.

• bc3c626: stripe.create(): defaultMethods() now returns sync SPT-only when no depositAddresses is provided, and uses Promise.allSettled in the function resolver path to gracefully degrade when individual networks fail.

• c004d2c: Fixed hosted fee-payer sponsorship for server-driven session settlement and close transactions.

• dc27415: Added lightweight core server and Stripe SPT entrypoints that excluded unrelated payment rails.

• 106ba18: Fixed challenge parsing for extension parameters named after Object.prototype properties.

• 3de6560: Required server-advertised Tempo session escrows to match the canonical address unless clients enable allowCustomEscrow.

• 4c9ce16: Added client signing support for standard x402 exact EIP-3009 offers without requiring mppx route-binding extensions.

• c326dc9: Fixed Tempo session fallback closes with stale receipts and rejected invalid close accounting.

• ae68a55: Fixed scoped EVM charges rejecting every spec-compliant x402 client, which made
  each route served through Proxy unpayable over x402.

  A route scope lands in challenge.meta, and the x402 path treated any route
  metadata as a demand for mppx's own extensions.mppx binding plus an EIP-3009
  nonce equal to an unexported sha256(accepted | resource | extensions). That
  derivation is not part of the x402 spec, so a client mppx did not write cannot
  produce it: the charge re-challenged forever with Credential is malformed.
Proxy attaches a derived scope to every charge it serves, so this applied to
  everything behind it whether or not an operator set scope.

  Such a credential is now bound the way x402 itself binds — by comparing the
  echoed resource and accepted — instead of being rejected. A credential that
  does carry extensions.mppx is still verified in full, including the
  route-bound nonce, so mppx's own client is unaffected. Body binding is unchanged:
  challenge.digest is verified against the request body either way.

  The trade is that route scope on the x402 rail is advisory for clients that don't
  implement mppx's binding. resource and accepted sit outside the EIP-3009
  signature, so two charges sharing a URL and a price are no longer distinguishable
  by scope alone. Cross-URL reuse is still refused. Operators who need scope
  enforced can restore the previous behaviour per method:

  evm({
    currency: evm.assets.base.USDC,
    recipient,
    x402: { facilitator, routeBinding: 'required' },
  })