From 2d6f9fc6611e8c9234c925924e6e0d09fc158ad6 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 19 Aug 2026 17:54:06 +0000 Subject: [PATCH] chore: version packages --- .changeset/bright-pandas-trade.md | 5 -- .changeset/calm-keys-align.md | 5 -- .changeset/clean-stores-compose.md | 5 -- .changeset/coinbase-x402-interoperability.md | 5 -- .changeset/dist-only-package.md | 5 -- .changeset/fuzzy-bats-accept.md | 5 -- .changeset/fuzzy-chairs-pay.md | 5 -- .changeset/graceful-degradation.md | 5 -- .changeset/hosted-session-settlement.md | 5 -- .changeset/lightweight-server-entrypoints.md | 5 -- .changeset/parse-auth-param-prototype.md | 5 -- .changeset/remove-stripe-mpp-metadata.md | 5 -- .changeset/secure-tempo-session-escrow.md | 5 -- .changeset/standard-x402-exact-client.md | 5 -- .changeset/tidy-clocks-close.md | 5 -- .changeset/x402-scoped-route-binding.md | 34 ------------- CHANGELOG.md | 53 ++++++++++++++++++++ package.json | 2 +- 18 files changed, 54 insertions(+), 110 deletions(-) delete mode 100644 .changeset/bright-pandas-trade.md delete mode 100644 .changeset/calm-keys-align.md delete mode 100644 .changeset/clean-stores-compose.md delete mode 100644 .changeset/coinbase-x402-interoperability.md delete mode 100644 .changeset/dist-only-package.md delete mode 100644 .changeset/fuzzy-bats-accept.md delete mode 100644 .changeset/fuzzy-chairs-pay.md delete mode 100644 .changeset/graceful-degradation.md delete mode 100644 .changeset/hosted-session-settlement.md delete mode 100644 .changeset/lightweight-server-entrypoints.md delete mode 100644 .changeset/parse-auth-param-prototype.md delete mode 100644 .changeset/remove-stripe-mpp-metadata.md delete mode 100644 .changeset/secure-tempo-session-escrow.md delete mode 100644 .changeset/standard-x402-exact-client.md delete mode 100644 .changeset/tidy-clocks-close.md delete mode 100644 .changeset/x402-scoped-route-binding.md diff --git a/.changeset/bright-pandas-trade.md b/.changeset/bright-pandas-trade.md deleted file mode 100644 index d31efdb76..000000000 --- a/.changeset/bright-pandas-trade.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Added first-party machine-token payments for Tempo charges across push, pull, relay, and fee-sponsored settlement. diff --git a/.changeset/calm-keys-align.md b/.changeset/calm-keys-align.md deleted file mode 100644 index 68100b945..000000000 --- a/.changeset/calm-keys-align.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Changed Stripe PaymentIntent idempotency keys to use the SDK-independent `mpp_` prefix. diff --git a/.changeset/clean-stores-compose.md b/.changeset/clean-stores-compose.md deleted file mode 100644 index 285be9660..000000000 --- a/.changeset/clean-stores-compose.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Added support for composing native claim implementations with Redis and Upstash store adapters. diff --git a/.changeset/coinbase-x402-interoperability.md b/.changeset/coinbase-x402-interoperability.md deleted file mode 100644 index 2e6b15044..000000000 --- a/.changeset/coinbase-x402-interoperability.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Added CI interoperability coverage against the Coinbase x402 resource server and facilitator implementations. diff --git a/.changeset/dist-only-package.md b/.changeset/dist-only-package.md deleted file mode 100644 index a4db56c48..000000000 --- a/.changeset/dist-only-package.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': minor ---- - -Bundled the CLI runtime and removed source files, source maps, and source export conditions from the published package. diff --git a/.changeset/fuzzy-bats-accept.md b/.changeset/fuzzy-bats-accept.md deleted file mode 100644 index 48cf884d1..000000000 --- a/.changeset/fuzzy-bats-accept.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Fixed deserialization of challenges with mixed-case auth-param names. diff --git a/.changeset/fuzzy-chairs-pay.md b/.changeset/fuzzy-chairs-pay.md deleted file mode 100644 index c3f0ce68f..000000000 --- a/.changeset/fuzzy-chairs-pay.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Fixed explicit session stream charges being discarded by prepaid units. diff --git a/.changeset/graceful-degradation.md b/.changeset/graceful-degradation.md deleted file mode 100644 index 7e1003a5d..000000000 --- a/.changeset/graceful-degradation.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -`stripe.create()`: `defaultMethods()` now returns sync SPT-only when no `depositAddresses` is provided, and uses `Promise.allSettled` in the function resolver path to gracefully degrade when individual networks fail. diff --git a/.changeset/hosted-session-settlement.md b/.changeset/hosted-session-settlement.md deleted file mode 100644 index 0843fc3fa..000000000 --- a/.changeset/hosted-session-settlement.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Fixed hosted fee-payer sponsorship for server-driven session settlement and close transactions. diff --git a/.changeset/lightweight-server-entrypoints.md b/.changeset/lightweight-server-entrypoints.md deleted file mode 100644 index 7763227a9..000000000 --- a/.changeset/lightweight-server-entrypoints.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Added lightweight core server and Stripe SPT entrypoints that excluded unrelated payment rails. diff --git a/.changeset/parse-auth-param-prototype.md b/.changeset/parse-auth-param-prototype.md deleted file mode 100644 index 7bff2cbd7..000000000 --- a/.changeset/parse-auth-param-prototype.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Fixed challenge parsing for extension parameters named after `Object.prototype` properties. diff --git a/.changeset/remove-stripe-mpp-metadata.md b/.changeset/remove-stripe-mpp-metadata.md deleted file mode 100644 index 126010cb8..000000000 --- a/.changeset/remove-stripe-mpp-metadata.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Removed obsolete MPP version metadata from Stripe charge PaymentIntents. diff --git a/.changeset/secure-tempo-session-escrow.md b/.changeset/secure-tempo-session-escrow.md deleted file mode 100644 index 768159012..000000000 --- a/.changeset/secure-tempo-session-escrow.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Required server-advertised Tempo session escrows to match the canonical address unless clients enable `allowCustomEscrow`. diff --git a/.changeset/standard-x402-exact-client.md b/.changeset/standard-x402-exact-client.md deleted file mode 100644 index 9e82e6d91..000000000 --- a/.changeset/standard-x402-exact-client.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Added client signing support for standard x402 exact EIP-3009 offers without requiring mppx route-binding extensions. diff --git a/.changeset/tidy-clocks-close.md b/.changeset/tidy-clocks-close.md deleted file mode 100644 index 2cf6e3828..000000000 --- a/.changeset/tidy-clocks-close.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -'mppx': patch ---- - -Fixed Tempo session fallback closes with stale receipts and rejected invalid close accounting. diff --git a/.changeset/x402-scoped-route-binding.md b/.changeset/x402-scoped-route-binding.md deleted file mode 100644 index bd535bb3c..000000000 --- a/.changeset/x402-scoped-route-binding.md +++ /dev/null @@ -1,34 +0,0 @@ ---- -'mppx': patch ---- - -Fixed scoped EVM charges rejecting every spec-compliant x402 client, which made -each route served through `Proxy` unpayable over x402. - -A route scope lands in `challenge.meta`, and the x402 path treated any route -metadata as a demand for mppx's own `extensions.mppx` binding plus an EIP-3009 -nonce equal to an unexported `sha256(accepted | resource | extensions)`. That -derivation is not part of the x402 spec, so a client mppx did not write cannot -produce it: the charge re-challenged forever with `Credential is malformed.` -`Proxy` attaches a derived scope to every charge it serves, so this applied to -everything behind it whether or not an operator set `scope`. - -Such a credential is now bound the way x402 itself binds — by comparing the -echoed `resource` and `accepted` — instead of being rejected. A credential that -does carry `extensions.mppx` is still verified in full, including the -route-bound nonce, so mppx's own client is unaffected. Body binding is unchanged: -`challenge.digest` is verified against the request body either way. - -The trade is that route scope on the x402 rail is advisory for clients that don't -implement mppx's binding. `resource` and `accepted` sit outside the EIP-3009 -signature, so two charges sharing a URL and a price are no longer distinguishable -by scope alone. Cross-URL reuse is still refused. Operators who need scope -enforced can restore the previous behaviour per method: - -```ts -evm({ - currency: evm.assets.base.USDC, - recipient, - x402: { facilitator, routeBinding: 'required' }, -}) -``` diff --git a/CHANGELOG.md b/CHANGELOG.md index fd498314f..2cbb14324 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,58 @@ # mppx +## 0.9.0 + +### Minor Changes + +- 4915654: Bundled the CLI runtime and removed source files, source maps, and source export conditions from the published package. + +### Patch Changes + +- 61f847e: Added first-party machine-token payments for Tempo charges across push, pull, relay, and fee-sponsored settlement. +- 981389d: Changed Stripe PaymentIntent idempotency keys to use the SDK-independent `mpp_` prefix. +- e59c031: Added support for composing native claim implementations with Redis and Upstash store adapters. +- 349543a: Added CI interoperability coverage against the Coinbase x402 resource server and facilitator implementations. +- 9774481: Fixed deserialization of challenges with mixed-case auth-param names. +- e240845: Fixed explicit session stream charges being discarded by prepaid units. +- bc3c626: `stripe.create()`: `defaultMethods()` now returns sync SPT-only when no `depositAddresses` is provided, and uses `Promise.allSettled` in the function resolver path to gracefully degrade when individual networks fail. +- c004d2c: Fixed hosted fee-payer sponsorship for server-driven session settlement and close transactions. +- dc27415: Added lightweight core server and Stripe SPT entrypoints that excluded unrelated payment rails. +- 106ba18: Fixed challenge parsing for extension parameters named after `Object.prototype` properties. +- b5f6bce: Removed obsolete MPP version metadata from Stripe charge PaymentIntents. +- 3de6560: Required server-advertised Tempo session escrows to match the canonical address unless clients enable `allowCustomEscrow`. +- 4c9ce16: Added client signing support for standard x402 exact EIP-3009 offers without requiring mppx route-binding extensions. +- c326dc9: Fixed Tempo session fallback closes with stale receipts and rejected invalid close accounting. +- ae68a55: Fixed scoped EVM charges rejecting every spec-compliant x402 client, which made + each route served through `Proxy` unpayable over x402. + + A route scope lands in `challenge.meta`, and the x402 path treated any route + metadata as a demand for mppx's own `extensions.mppx` binding plus an EIP-3009 + nonce equal to an unexported `sha256(accepted | resource | extensions)`. That + derivation is not part of the x402 spec, so a client mppx did not write cannot + produce it: the charge re-challenged forever with `Credential is malformed.` + `Proxy` attaches a derived scope to every charge it serves, so this applied to + everything behind it whether or not an operator set `scope`. + + Such a credential is now bound the way x402 itself binds — by comparing the + echoed `resource` and `accepted` — instead of being rejected. A credential that + does carry `extensions.mppx` is still verified in full, including the + route-bound nonce, so mppx's own client is unaffected. Body binding is unchanged: + `challenge.digest` is verified against the request body either way. + + The trade is that route scope on the x402 rail is advisory for clients that don't + implement mppx's binding. `resource` and `accepted` sit outside the EIP-3009 + signature, so two charges sharing a URL and a price are no longer distinguishable + by scope alone. Cross-URL reuse is still refused. Operators who need scope + enforced can restore the previous behaviour per method: + + ```ts + evm({ + currency: evm.assets.base.USDC, + recipient, + x402: { facilitator, routeBinding: 'required' }, + }) + ``` + ## 0.8.17 ### Patch Changes diff --git a/package.json b/package.json index 2464d2809..a2d9d59d5 100644 --- a/package.json +++ b/package.json @@ -71,7 +71,7 @@ "[!start-pkg]": "", "name": "mppx", "type": "module", - "version": "0.8.17", + "version": "0.9.0", "main": "./dist/index.js", "license": "MIT", "homepage": "https://github.com/wevm/mppx#readme",