wevm · github-actions · Aug 19, 2026
diff --git a/.changeset/bright-pandas-trade.md b/.changeset/bright-pandas-trade.md
diff --git a/.changeset/calm-keys-align.md b/.changeset/calm-keys-align.md
diff --git a/.changeset/clean-stores-compose.md b/.changeset/clean-stores-compose.md
diff --git a/.changeset/coinbase-x402-interoperability.md b/.changeset/coinbase-x402-interoperability.md
diff --git a/.changeset/dist-only-package.md b/.changeset/dist-only-package.md
diff --git a/.changeset/fuzzy-bats-accept.md b/.changeset/fuzzy-bats-accept.md
diff --git a/.changeset/fuzzy-chairs-pay.md b/.changeset/fuzzy-chairs-pay.md
diff --git a/.changeset/graceful-degradation.md b/.changeset/graceful-degradation.md
diff --git a/.changeset/hosted-session-settlement.md b/.changeset/hosted-session-settlement.md
diff --git a/.changeset/lightweight-server-entrypoints.md b/.changeset/lightweight-server-entrypoints.md
diff --git a/.changeset/parse-auth-param-prototype.md b/.changeset/parse-auth-param-prototype.md
diff --git a/.changeset/remove-stripe-mpp-metadata.md b/.changeset/remove-stripe-mpp-metadata.md
diff --git a/.changeset/secure-tempo-session-escrow.md b/.changeset/secure-tempo-session-escrow.md
diff --git a/.changeset/standard-x402-exact-client.md b/.changeset/standard-x402-exact-client.md
diff --git a/.changeset/tidy-clocks-close.md b/.changeset/tidy-clocks-close.md
diff --git a/.changeset/x402-scoped-route-binding.md b/.changeset/x402-scoped-route-binding.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,58 @@
 # mppx
 
+## 0.9.0
+
+### Minor Changes
+
+- 4915654: Bundled the CLI runtime and removed source files, source maps, and source export conditions from the published package.
+
+### Patch Changes
+
+- 61f847e: Added first-party machine-token payments for Tempo charges across push, pull, relay, and fee-sponsored settlement.
+- 981389d: Changed Stripe PaymentIntent idempotency keys to use the SDK-independent `mpp_` prefix.
+- e59c031: Added support for composing native claim implementations with Redis and Upstash store adapters.
+- 349543a: Added CI interoperability coverage against the Coinbase x402 resource server and facilitator implementations.
+- 9774481: Fixed deserialization of challenges with mixed-case auth-param names.
+- e240845: Fixed explicit session stream charges being discarded by prepaid units.
+- bc3c626: `stripe.create()`: `defaultMethods()` now returns sync SPT-only when no `depositAddresses` is provided, and uses `Promise.allSettled` in the function resolver path to gracefully degrade when individual networks fail.
+- c004d2c: Fixed hosted fee-payer sponsorship for server-driven session settlement and close transactions.
+- dc27415: Added lightweight core server and Stripe SPT entrypoints that excluded unrelated payment rails.
+- 106ba18: Fixed challenge parsing for extension parameters named after `Object.prototype` properties.
+- b5f6bce: Removed obsolete MPP version metadata from Stripe charge PaymentIntents.
+- 3de6560: Required server-advertised Tempo session escrows to match the canonical address unless clients enable `allowCustomEscrow`.
+- 4c9ce16: Added client signing support for standard x402 exact EIP-3009 offers without requiring mppx route-binding extensions.
+- c326dc9: Fixed Tempo session fallback closes with stale receipts and rejected invalid close accounting.
+- ae68a55: Fixed scoped EVM charges rejecting every spec-compliant x402 client, which made
+  each route served through `Proxy` unpayable over x402.
+
+  A route scope lands in `challenge.meta`, and the x402 path treated any route
+  metadata as a demand for mppx's own `extensions.mppx` binding plus an EIP-3009
+  nonce equal to an unexported `sha256(accepted | resource | extensions)`. That
+  derivation is not part of the x402 spec, so a client mppx did not write cannot
+  produce it: the charge re-challenged forever with `Credential is malformed.`
+  `Proxy` attaches a derived scope to every charge it serves, so this applied to
+  everything behind it whether or not an operator set `scope`.
+
+  Such a credential is now bound the way x402 itself binds — by comparing the
+  echoed `resource` and `accepted` — instead of being rejected. A credential that
+  does carry `extensions.mppx` is still verified in full, including the
+  route-bound nonce, so mppx's own client is unaffected. Body binding is unchanged:
+  `challenge.digest` is verified against the request body either way.
+
+  The trade is that route scope on the x402 rail is advisory for clients that don't
+  implement mppx's binding. `resource` and `accepted` sit outside the EIP-3009
+  signature, so two charges sharing a URL and a price are no longer distinguishable
+  by scope alone. Cross-URL reuse is still refused. Operators who need scope
+  enforced can restore the previous behaviour per method:
+
+  ```ts
+  evm({
+    currency: evm.assets.base.USDC,
+    recipient,
+    x402: { facilitator, routeBinding: 'required' },
+  })
+  ```
+
 ## 0.8.17
 
 ### Patch Changes

diff --git a/package.json b/package.json
@@ -71,7 +71,7 @@
   "[!start-pkg]": "",
   "name": "mppx",
   "type": "module",
-  "version": "0.8.17",
+  "version": "0.9.0",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",