[dependabot]

Bumps the minor-and-patch group with 16 updates in the / directory:

Package	From	To
@ai-sdk/openai	2.0.136	2.0.138
@aws-sdk/client-sqs	3.1156.0	3.1160.0
@sentry/nextjs	10.76.2	10.78.0
@x402/core	2.28.0	2.29.0
@x402/evm	2.28.0	2.29.0
@x402/next	2.28.0	2.29.0
ai	5.0.281	5.0.282
better-auth	1.7.7	1.7.14
jose	6.2.13	6.2.14
mppx	0.15.0	0.17.0
ox	0.14.57	0.14.60
resend	6.34.1	6.35.0
viem	2.57.11	2.57.13
workflow	4.8.14	4.8.15
@biomejs/biome	2.5.15	2.6.4
@inquirer/prompts	8.7.4	8.7.5

Updates @ai-sdk/openai from 2.0.136 to 2.0.138

Changelog

Sourced from @​ai-sdk/openai's changelog.

2.0.138

Patch Changes

• 1ff7951: fix(openai): report unfinished web searches as tool errors
• 1ff7951: Report failed and incomplete web searches as tool errors instead of successful tool results in OpenAI Responses API calls.

2.0.137

Patch Changes

• 6a87db5: Fix gpt-transcribe REST transcription. Requests with OpenAI provider options now use response_format: 'json' for gpt-transcribe and dated gpt-4o-mini-transcribe snapshots, which reject verbose_json. durationInSeconds is read from usage.seconds when a duration-billed response has no top-level duration.

Commits

• e036b65 Version Packages (#24136)
• 1ff7951 Backport: fix(openai): report unfinished web searches as tool errors (#24135)
• c2f84f4 Version Packages (#24124)
• 6a87db5 fix(openai): gpt-transcribe REST response format and duration (backport of #2...
• See full diff in compare view

Updates @aws-sdk/client-sqs from 3.1156.0 to 3.1160.0

Release notes

Sourced from @​aws-sdk/client-sqs's releases.

v3.1160.0

3.1160.0(2026-10-29)

New Features

• client-cleanrooms: Adds support for the PySpark 2.0 analysis template format and for choosing the file format (CSV or Parquet) of protected job results written to Amazon S3, including in a membership's default job result configuration. (8cb4c7eb)
• client-bedrock-agentcore-control: Adds Session Endpoint Feature on AgentCore Runtime (07ecbbc3)
• client-wafv2: AWS WAF customers using Targeted Bot Control, ATP, or ACFP managed rule groups can now enable automatic Challenge JavaScript SDK injection. When enabled, Amazon CloudFront injects the script tag into HTML responses on your behalf, removing the need for manual integration. (d4065359)
• client-bedrock-agentcore: Adds AgentCore Runtime session endpoint support, including sessionEndpointUrl on the InvokeAgentRuntime response (dac2f977)
• client-lightsail: This release adds support for instance health status checks and system status checks. (5bf15ec1)
• client-imagebuilder: This release adds support for on-demand AMI scanning with Amazon Inspector. (a1a1c3ea)
• checksums: add xxHash and SHA-512 checksum algorithms (#8383) (3aa504f3)
• codegen: add Smithy RPCv2 JSON protocol (#8386) (ee519d02)

---

For list of updated packages, view updated-packages.md in assets-3.1160.0.zip

v3.1159.0

3.1159.0(2026-10-28)

Chores

• readability, require braces for control flow (#8389) (2a160140)

New Features

• client-connectparticipant: Amazon Connect Participant Service now supports the optional UrlContentDisposition parameter on GetAttachment, which returns a pre-signed URL that renders a chat attachment inline in the browser instead of forcing a download. (264a9efc)
• client-connect: Amazon Connect APIs - CreateTaskTemplate and UpdateTaskTemplate accept a new ContactHooks parameter called WrapUpFlowId to identify the flow module that runs when an agent attempts to disconnect from a task created with the template. Use this to verify an agent's work or update external case repos. (86f44373)
• client-ec2: Amazon EC2 Capacity Manager adds supportability checks and capacity fulfillment metrics. Use GetCapacityManagerSupportabilityScores to score how well instance types and Availability Zones can support a capacity request, and GetCapacityManagerMetricData to retrieve fulfillment metrics. (2ab44578)
• client-opensearch: This release adds APIs to simplify setting up a replication relationship between OpenSearch clusters. The APIs include new Switchover and Failover actions for planned switchovers and unplanned failovers to ensure high availability for OpenSearch in the event of disaster in a single region. (59cc8c0d)
• client-ivs: InsertAdBreak now allows setting a customized adBreakId on a request and also adds a new field targetStartAt for a delayed ad insertion (c0656dd6)
• client-acm: AWS Certificate Manager now supports the Automatic Certificate Management Environment (ACME) protocol in the AWS GovCloud (US-East) and AWS GovCloud (US-West) Regions. (5b43833f)
• client-securityagent: Adds support for attaching client certificates for mutual TLS (mTLS) authentication to penetration test target endpoints via the new ClientCertificates field on Assets, enabling pentesting of endpoints that require client certificate authentication. (fe783883)
• client-kafkaconnect: Amazon MSK Connect now supports updating a connector's custom plugin and worker configuration via the UpdateConnector API. MSK Connect checks connector and task health after the update and rolls back on failure. Each call returns an operation ARN to track with DescribeConnectorOperation. (c9a2aa5a)
• client-artifact: Update support mode for Assurance Assistance (18fff2c6)
• client-medialive: AWS Elemental MediaLive now supports SMPTE 2022-7 seamless protection switching for multicast inputs on MediaLive Anywhere. Support for MulticastSettings sources to add a redundant copy of the stream received on a second network interface. (d44798e5)
• client-neptunedata: Get Storage API analyzes storage usage to identify database bloat and your storage footprint. Index Rebuild API triggers on-demand index reconstruction to eliminate bloat and restore query performance. (278cca93)

Bug Fixes

• middleware-sdk-s3: scope S3 Express cache by identity (#8387) (7485eaac)

---

For list of updated packages, view updated-packages.md in assets-3.1159.0.zip

v3.1158.0

... (truncated)

Changelog

Sourced from @​aws-sdk/client-sqs's changelog.

3.1160.0 (2026-10-29)

Note: Version bump only for package @​aws-sdk/client-sqs

3.1159.0 (2026-10-28)

Note: Version bump only for package @​aws-sdk/client-sqs

3.1158.0 (2026-10-27)

Note: Version bump only for package @​aws-sdk/client-sqs

3.1157.0 (2026-10-26)

Note: Version bump only for package @​aws-sdk/client-sqs

Commits

• 40bf3f7 Publish v3.1160.0
• c1fb86e Publish v3.1159.0
• 2d08e1c Publish v3.1158.0
• e5988ec Publish v3.1157.0
• f9d9119 chore(codegen): sync for service default socket timeout and RPC v2 JSON (#8378)
• See full diff in compare view

Updates @sentry/nextjs from 10.76.2 to 10.78.0

Release notes

Sourced from @​sentry/nextjs's releases.

10.78.0

• feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
• fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
• fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

Bundle size 📦

Path	Size
@​sentry/browser	27.64 KB
@​sentry/browser - with treeshaking flags	26.12 KB
@​sentry/browser (incl. Tracing)	46.2 KB
@​sentry/browser (incl. Tracing + Span Streaming)	47.96 KB
@​sentry/browser (incl. Tracing, Profiling)	50.87 KB
@​sentry/browser (incl. Tracing, Replay)	84.73 KB
@​sentry/browser (incl. Tracing, Replay) - with treeshaking flags	74.6 KB
@​sentry/browser (incl. Tracing, Replay with Canvas)	89.33 KB
@​sentry/browser (incl. Tracing, Replay, Feedback)	101.65 KB
@​sentry/browser (incl. Feedback)	44.42 KB
@​sentry/browser (incl. sendFeedback)	32.34 KB
@​sentry/browser (incl. FeedbackAsync)	37.34 KB
@​sentry/browser (incl. Metrics)	28.7 KB
@​sentry/browser (incl. Logs)	28.94 KB
@​sentry/browser (incl. Metrics & Logs)	29.6 KB
@​sentry/react	29.42 KB
@​sentry/react (incl. Tracing)	48.46 KB
@​sentry/vue	33.39 KB
@​sentry/vue (incl. Tracing)	48.52 KB
@​sentry/svelte	27.66 KB
CDN Bundle	30 KB
CDN Bundle (incl. Tracing)	48.13 KB
CDN Bundle (incl. Logs, Metrics)	31.56 KB
CDN Bundle (incl. Tracing, Logs, Metrics)	49.42 KB
CDN Bundle (incl. Replay, Logs, Metrics)	70.13 KB
CDN Bundle (incl. Tracing, Replay)	84.97 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics)	86.24 KB
CDN Bundle (incl. Tracing, Replay, Feedback)	90.65 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics)	91.9 KB
CDN Bundle - uncompressed	89.11 KB
CDN Bundle (incl. Tracing) - uncompressed	145.03 KB
CDN Bundle (incl. Logs, Metrics) - uncompressed	93.71 KB
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed	148.92 KB
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed	216.26 KB
CDN Bundle (incl. Tracing, Replay) - uncompressed	262.18 KB
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed	266.05 KB
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed	275.56 KB
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed	279.42 KB
@​sentry/nextjs (client)	51.06 KB

... (truncated)

Changelog

Sourced from @​sentry/nextjs's changelog.

10.78.0

• feat(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• fix(v10/core): Drop sampled-out errors before they take a promise buffer slot (#25753)
• fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• fix(v10/core): Use trace_metric data category for metrics rate limits and client reports (#25612)
• fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js version helper (#25730)

10.77.1

Important Changes

• feat(v10/nextjs): Add a tunnel route handler that sends only the event payload to Sentry (#25559)

  The tunnelRoute option can now send events through a route handler in your app. The handler forwards only the event payload to Sentry, and no request headers. To use it, add this file next to your tunnelRoute option:

  // app/sentry-tunnel/route.ts (or src/app/sentry-tunnel/route.ts)
  export { POST } from '@sentry/nextjs/tunnel';

  The handler accepts events for the DSN of your server SDK. To accept other DSNs, use createSentryTunnelRoute({ allowedDsns }) from the same import. Without the file, the tunnel route works as before.

  With the handler, tunnel requests go through your middleware. If your middleware blocks unauthenticated requests, exclude the tunnel route in its matcher.

  Also, the server no longer sends spans of tunnel requests when span streaming is on, because these spans only show the SDK's own traffic.

• feat(v10/nextjs): Send tunnel route requests with credentials: 'omit' (#25561)

  With tunnelRoute and no tunnel route handler, @sentry/nextjs now sends events from the browser with credentials: 'omit', because the tunnel route does not need cookies. If a layer in front of your app checks cookies before it lets requests through (for example Vercel Deployment Protection), you can send them again in your browser Sentry.init call:

  // instrumentation-client.ts
  Sentry.init({
    transportOptions: { fetchOptions: { credentials: 'same-origin' } },
  });

• fix(v10/deps)!: Limit @opentelemetry/api to <1.10.0 and the OpenTelemetry SDK to <3.0.0 (#25715)

  Breaking change

  If your app uses @opentelemetry/api 1.10.0 or OpenTelemetry SDK v3 together with v10 of the Sentry SDK, you must stay on @opentelemetry/api below 1.10.0 and OpenTelemetry SDK v2, or upgrade to v11.

  @opentelemetry/api 1.10.0 only works with OpenTelemetry SDK v3 (@opentelemetry/core 3.x, @opentelemetry/instrumentation 0.300.x). The SDK v2 packages that v10 uses only support @opentelemetry/api below 1.10.0, and SDK v3 needs Node.js 22.15.0 or newer, while v10 supports Node.js 18 and newer. For this reason, v10 now limits @opentelemetry/api to <1.10.0, and the @opentelemetry/instrumentation and @opentelemetry/exporter-trace-otlp-http peer dependencies of @sentry/node-core to <0.300.0.

  If your app depends on @opentelemetry/api directly, use a version below 1.10.0 (for example ~1.9.1). With 1.10.0, your app and the Sentry SDK use different copies of the API, and the OpenTelemetry calls of your app do not see the tracer provider of the Sentry SDK.

  To use @opentelemetry/api 1.10.0 and OpenTelemetry SDK v3, upgrade to v11 of the Sentry SDK. For the upgrade steps, see the migration guide.

... (truncated)

Commits

• 5f277de release: 10.78.0
• a4cc5f9 meta(changelog): Update changelog for 10.78.0 (#25831)
• e4ea7fd fix(v10/deno): Re-export portable helpers that Cloudflare exposes (#25708)
• 26744d3 fix(v10/core): Drop sampled-out errors before they take a promise buffer slot...
• 3c8e1d7 fix(v10/core): Stop sending client reports for breadcrumbs (#25752)
• 0664050 fix(v10/nextjs): Don't crash Cloudflare workers on import of the Next.js vers...
• 76defeb fix(v10/core): Use trace_metric data category for metrics rate limits and c...
• e2fa5ba meta(changelog): Merge 10.77.0 into 10.77.1 because 10.77.0 was not released ...
• bb2bb52 fix(v10/astro): defer to @sentry/cloudflare/vite on Cloudflare Workers (#25...
• 65d23eb fix(v10/elysia): Set SDK metadata on the options passed to init (#25486)
• Additional commits viewable in compare view

Updates @x402/core from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Updates @x402/evm from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Updates @x402/next from 2.28.0 to 2.29.0

Commits

• e4a0868 chore: version typescript packages  (#4036)
• bf8d857 chore(go): release (#4037)
• f22cb90 chore: version python package  (#4035)
• 374216b chore(ts): raise dependency floors for known CVEs (#3981)
• 443e3f4 fix(python): raise dependency floors for published security advisories (#3982)
• 14e83aa fix(go): upgrade SDK dependencies for published security advisories (#3984)
• 8065278 fix: upgrade zod to ^4.6.6 (GHSA-mrhx-c7xc-m3w5) (#3983)
• 8d81caf Add Canton Network exact scheme documentation (#4031)
• c5bed45 feat(canton): add @​x402/canton exact-scheme mechanism (#3242)
• db2c98e fix(avm): require canonical CAIP-2 networks (#3894)
• Additional commits viewable in compare view

Updates ai from 5.0.281 to 5.0.282

Changelog

Sourced from ai's changelog.

5.0.282

Patch Changes

• Updated dependencies [ab8e7fe]
  • @​ai-sdk/gateway@​2.0.173

Commits

• e91421e Version Packages (#24072)
• See full diff in compare view

Updates better-auth from 1.7.7 to 1.7.14

Release notes

Sourced from better-auth's releases.

v1.7.14

better-auth

Bug Fixes

• Fixed two-factor TOTP to accept imported Base32 secrets stored as base32:<secret> (#12031)

For detailed changes, see CHANGELOG

@better-auth/core

Bug Fixes

• Fixed Kakao sign-in to forward loginHint so the Kakao Account login page opens with the ID field prefilled (#12045)

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​bytaesu, @​honuuk

Full changelog: v1.7.13...v1.7.14

v1.7.13

better-auth

Bug Fixes

• Fixed type declarations so type-only exports are no longer listed as values, making a value import fail type checking instead of failing at runtime (#11985)

For detailed changes, see CHANGELOG

@better-auth/core

Features

• Added token endpoint authentication options to the Vercel social provider, including dynamic OIDC tokens and private key JWT client assertions, without replacing the built-in sign-in flow (#11948)

Bug Fixes

• Added tokenEndpointAuth: { method } to the Cloudflare provider and deprecated tokenEndpointAuthMethod, which remains supported (#11997)

For detailed changes, see CHANGELOG

@better-auth/stripe

Features

... (truncated)

Changelog

Sourced from better-auth's changelog.

1.7.14

Patch Changes

• #12031 d2cb7f5 Thanks @​bytaesu! - Two-factor TOTP now accepts imported Base32 secrets stored as base32:<secret>.

• Updated dependencies [2947ab7]:

  • @​better-auth/core@​1.7.14
  • @​better-auth/drizzle-adapter@​1.7.14
  • @​better-auth/kysely-adapter@​1.7.14
  • @​better-auth/memory-adapter@​1.7.14
  • @​better-auth/mongo-adapter@​1.7.14
  • @​better-auth/prisma-adapter@​1.7.14
  • @​better-auth/telemetry@​1.7.14

1.7.13

Patch Changes

• #11985 9cb95fe Thanks @​bytaesu! - Type declarations no longer list type-only exports as values, so importing one as a value now fails type checking instead of failing at runtime.

• Updated dependencies [2712441, 1cf4b2c]:

  • @​better-auth/core@​1.7.13
  • @​better-auth/drizzle-adapter@​1.7.13
  • @​better-auth/kysely-adapter@​1.7.13
  • @​better-auth/memory-adapter@​1.7.13
  • @​better-auth/mongo-adapter@​1.7.13
  • @​better-auth/prisma-adapter@​1.7.13
  • @​better-auth/telemetry@​1.7.13

1.7.12

Patch Changes

• #11925 fb48619 Thanks @​bytaesu! - The JWT plugin now verifies JWTs and session cookie-cache JWTs with the algorithm of the stored key instead of the one named in the token header, and logs a warning when it signs or verifies a JWT without an issuer or audience.

• #11924 681aa5c Thanks @​bytaesu! - auth.api.getSession() now keeps the original database error as error.cause when the session lookup fails, so server code can tell a transient failure from a bug.

• #11930 b18e3b8 Thanks @​bytaesu! - OAuth callbacks completed through the OAuth proxy now run the same checks as the standard OAuth callback, including issuer and ID token nonce validation.

• Updated dependencies [681aa5c, 4bc78ba, 876608d, 083a743, 492134a]:

  • @​better-auth/core@​1.7.12
  • @​better-auth/drizzle-adapter@​1.7.12
  • @​better-auth/kysely-adapter@​1.7.12
  • @​better-auth/memory-adapter@​1.7.12
  • @​better-auth/mongo-adapter@​1.7.12
  • @​better-auth/prisma-adapter@​1.7.12
  • @​better-auth/telemetry@​1.7.12

1.7.11

... (truncated)

Commits

• a936663 chore: release v1.7.14 (#12055)
• d2cb7f5 fix(two-factor): accept imported Base32 TOTP secrets (#12031)
• 7f61081 chore: release v1.7.13 (#11994)
• ea3cbfd docs(organization): addMember requires userId (#12007)
• 2712441 refactor(cloudflare): standardize token endpoint auth options (#11997)
• 1cf4b2c feat(vercel): support token endpoint authentication strategies (#11948)
• 7a1ecde chore(deps): bump next to 16.4.2 (#11976)
• f4260a9 chore: release v1.7.12 (#11922)
• b18e3b8 fix(oauth-proxy): run the standard callback checks on proxied callbacks (#11930)
• fb48619 fix(jwt): verify tokens with the stored key's algorithm (#11925)
• Additional commits viewable in compare view

Updates jose from 6.2.13 to 6.2.14

Release notes

Sourced from jose's releases.

v6.2.14

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

Changelog

Sourced from jose's changelog.

6.2.14 (2026-10-29)

Fixes

• types: preserve contextual JWT payload inference (0dbf7a0), closes #911

Commits

• 5a6a5b6 chore(release): 6.2.14
• b04c907 test: handle JWKS rotation and algorithm migration
• 4e3292e chore: bump packages
• 0dbf7a0 fix(types): preserve contextual JWT payload inference
• 4080772 test: simplify runtime support checks
• 2cddc59 chore: cleanup after release
• See full diff in compare view

Updates mppx from 0.15.0 to 0.17.0

Release notes

Sourced from mppx's releases.

mppx@0.17.0

Minor Changes

• 25c8468: Simplified payment-stage identity. Breaking changes to mppx/identity:

  • Every payment offer in one 402 now carries the same HMAC-bound identity nonce, passed to verifiers as context.nonce. Bind payment-stage proofs to it instead of the challenge id. Routes may combine several offers with payment-stage identity (for example tempo()'s default currencies, or Tempo and Stripe), as long as they require the same verifiers; previously a route allowed only one such offer.
  • Verifiers issue their 402 challenge headers through a new optional challenge(request, { nonce }) hook, which runs once per 402, instead of returning them from verify as missing. verify only checks proofs.
  • Prover.retry is split: prepare(response, { challenge }) runs on a 402 before the payment retry, and retry(response) runs on other rejections and returns whether to resend.

Patch Changes

• b149237: Raised the @​hono/node-server override to 2.1.5 to resolve a dependency audit advisory.
• faa4735: Fixed the client throwing No Payment schemes found. on a 402 whose WWW-Authenticate has no Payment challenge, so other protocols such as x402 now handle it.
• 73b464f: Fixed the Tempo charge client signing a sponsored transaction whose validBefore had fewer than 15 seconds left after slow preparation: the pre-sign check now measures validBefore as well as the challenge expiry.
• a0d54fd: Enforced the fee payer's 15-second remaining-validity minimum for Tempo charges: clients refused to sign a sponsored pull transaction for a challenge expiring in under 15 seconds, checking again right before signing, and servers refused to issue a sponsored challenge with a paid amount and pull mode that expires that soon. Push and zero-amount challenges were exempt. Request hooks received the expiry echoed by the credential when verifying it.
• 7a68c55: Fixed focused tests failing in a clean checkout by generating the HTML modules on demand, and the package check's cleanup reinstalling dependencies with the publish manifest.
• 443ad6d: Improved mppx validate SSE receipt scanning to search only newly received text for event boundaries, so long events no longer cost quadratic time.

mppx@0.16.0

Minor Changes

• 793aa2b: Replaced request attestation with per-route identity. Breaking changes:

  • mppx/attestation became mppx/identity. Server Mppx.create({ attestation }) was removed (passing it now throws); routes take identity: [verifier, ...] (all required), for example mppx.charge({ amount, identity: [tap] }), and the result exposes result.identity.get(verifier).
  • Added Identity.anyOf(...) to accept one of several protocols. Every member runs, so each presented proof is consumed.
  • Verifiers return missing, invalid or valid (unverified became invalid with code 403), may set their own status code and headers, and declare a stage: request (checked before any 402) or payment (adds headers to the 402 and is checked against the answered challenge and credential before settlement). Identity rejections are returned on the non-200 branch as a 401/403 response.
  • A composed route can include at most one offer with payment-stage identity. Payment-stage identity is not supported on methods with a preflight hook.
  • Client attestation signer maps became identity: [prover, ...]. Provers have a required origin scope, receive the payment challenge in prove(request, context), and can prepare proofs or request one resend with retry(response, context). Requests that carry proofs do not follow redirects.
  • TAP and Web Bot Auth moved to mppx/extensions/identity/tap and mppx/extensions/identity/web-bot-auth; Client.signer became Client.prover.

Patch Changes

• e555544: Fixed client payment events masking original errors when a response body had already been consumed or locked.
• 81a95e1: Fixed multi-method intent handlers rejecting every route option but identity when the methods' options can't be inferred, such as mppx.charge({ amount }) with stripe.create(...).defaultMethods().
• c31d932: Added optional summary and requestBody to proxy endpoint definitions, emitted in the proxy's generated /openapi.json. Free routes can carry them as { free: true, summary, requestBody }. An endpoint that is neither a payment handler, true nor { free: true } (such as { pay: undefined }) now fails closed with an error instead of being proxied.
• dd2c3e3: Refused to sign a zero-amount Tempo proof when the Challenge realm differs from the hostname of the server that sent it, so another origin can't relay a Challenge and replay the proof at its realm. To allow a server whose realm isn't its hostname, pin the realm to its origin with trustedTempoProofRealms on Mppx.create and Fetch.from, such as { 'https://api.example.com': 'MPP Payment' }. Without an origin (McpClient.wrap, or Mppx.create with Transport.mcp()), these proofs are refused unless trustedTempoProofRealms lists the realm. The mppx CLI and sessionManager bootstrap apply the same check, and sessionManager takes trustedTempoProofRealms too. This matches mpp-rs, mpp-go and pympp.
• d78de2c: Fixed missing subscription access-key address indexes when reusing existing keys.
• 909f3db: Fixed Tempo session top-up, voucher retry, close and bootstrap requests to send the credential in the header the challenge selects (such as Payment-Authorization with requiresAuth) instead of always using Authorization. These requests keep the paid request's own Authorization header and no longer follow redirects, so the credential can't reach another origin.
• 464df9a: Fixed Tempo charge verification rejecting split amounts written with leading zeros by comparing them as integers.
• 9008513: Removed the allowKeyAuthorization fee-payer policy: sponsored transactions may now carry a keyAuthorization, so an access key can open a fee-sponsored session (or pay a sponsored charge) in the transaction that installs it. Sponsor exposure stays bounded by maxGas and maxTotalFee.
• 4cfd556: Fixed mppx validate failing Tempo session responses that stream over SSE: when the receipt arrives in the event stream instead of the Payment-Receipt header, validation checks the payment-receipt event in the stream instead of requiring the header, and fails when the stream has none.
• 510d1ed: Fixed mppx validate failing valid SSE sessions: the in-stream payment-receipt event is now read from the server's own stream, which the session client strips, and lone-CR line endings are accepted.
• e6d8ffc: Fixed mppx validate buffering SSE session streams in memory and hanging when the session client cancelled one: in-stream receipts are now read as the client consumes the stream instead of from an unread copy.
• 464df9a: Raised the zod dependency to ^4.6.7 to pick up the fix for GHSA-mrhx-c7xc-m3w5.

Changelog

Sourced from mppx's changelog.

0.17.0

Minor Changes

• 25c8468: Simplified payment-stage identity. Breaking changes to mppx/identity:

  • Every payment offer in one 402 now carries the same HMAC-bound identity nonce, passed to verifiers as context.nonce. Bind payment-stage proofs to it instead of the challenge id. Routes may combine several offers with payment-stage identity (for example tempo()'s default currencies, or Tempo and Stripe), as long as they require the same verifiers; previously a route allowed only one such offer.
  • Verifiers issue their 402 challenge headers through a new optional challenge(request, { nonce }) hook, which runs once per 402, instead of returning them from verify as missing. verify only checks proofs.
  • Prover.retry is split: prepare(response, { challenge }) runs on a 402 before the payment retry, and retry(response) runs on other rejections and returns whether to resend.

Patch Changes

• b149237: Raised the @​hono/node-server override to 2.1.5 to resolve a dependency audit advisory.
• faa4735: Fixed the client throwing No Payment schemes found. on a 402 whose WWW-Authenticate has no Payment challenge, so other protocols such as x402 now handle it.
• 73b464f: Fixed the Tempo charge client signing a sponsored transaction whose validBefore had fewer than 15 seconds left after slow preparation: the pre-sign check now measures validBefore as well as the challenge expiry.
• a0d54fd: Enforced the fee payer's 15-second remaining-validity minimum for Tempo charges: clients refused to sign a sponsored pull transaction for a challenge expiring in under 15 seconds, checking again right before signing, and servers refused to issue a sponsored challenge with a paid amount and pull mode that expires that soon. Push and zero-amount challenges were exempt. Request hooks received the expiry echoed by the credential when verifying it.
• 7a68c55: Fixed focused tests failing in a clean checkout by generating the HTML modules on demand, and the package check's cleanup reinstalling dependencies with the publish manifest.
• 443ad6d: Improved mppx validate SSE receipt scanning to search only newly received text for event boundaries, so long events no longer cost quadratic time.

0.16.0

Minor Changes

• 793aa2b: Replaced request attestation with per-route identity. Breaking changes:

  • mppx/attestation became mppx/identity. Server Mppx.create({ attestation }) was removed (passing it now throws); routes take identity: [verifier, ...] (all required), for example mppx.charge({ amount, identity: [tap] }), and the result exposes result.identity.get(verifier).
  • Added Identity.anyOf(...) to accept one of several protocols. Every member runs, so each presented proof is consumed.
  • Verifiers return missing, invalid or valid (unverified became invalid with code 403), may set their own status code and headers, and declare a stage: request (checked before any 402) or payment (adds headers to the 402 and is checked against the answered challenge and credential before settlement). Identity rejections are returned on the non-200 branch as a 401/403 response.
  • A composed route can include at most one offer with payment-stage identity. Payment-stage identity is not supported on methods with a preflight hook.
  • Client attestation signer maps became identity: [prover, ...]. Provers have a required origin scope, receive the payment challenge in prove(request, context), and can prepare proofs or request one resend with retry(response, context). Requests that carry proofs do not follow redirects.
  • TAP and Web Bot Auth moved to mppx/extensions/identity/tap and mppx/extensions/identity/web-bot-auth; Client.signer became Client.prover.

Patch Changes

• e555544: Fixed client payment events masking original errors when a response body had already been consumed or locked.
• 81a95e1: Fixed multi-method intent handlers rejecting every route option but identity when the methods' options can't be inferred, such as mppx.charge({ amount }) with stripe.create(...).defaultMethods().
• c31d932: Added optional summary and requestBody to proxy endpoint definitions, emitted in the proxy's generated /openapi.json. Free routes can carry them as { free: true, summary, requestBody }. An endpoint that is neither a payment handler, true nor { free: true } (such as { pay: undefined }) now fails closed with an error instead of being proxied.
• dd2c3e3: Refused to sign a zero-amount Tempo proof when the Challenge realm differs from the hostname of the server that sent it, so another origin can't relay a Challenge and replay the proof at its realm. To allow a server whose realm isn't its hostname, pin the realm to its origin with trustedTempoProofRealms on Mppx.create and Fetch.from, such as { 'https://api.example.com': 'MPP Payment' }. Without an origin (McpClient.wrap, or Mppx.create with Transport.mcp()), these proofs are refused unless trustedTempoProofRealms lists the realm. The mppx CLI and sessionManager bootstrap apply the same check, and sessionManager takes trustedTempoProofRealms too. This matches mpp-rs, mpp-go and pympp.
• d78de2c: Fixed missing subscription access-key address indexes when reusing existing keys.
• 909f3db: Fixed Tempo session top-up, voucher retry, close and bootstrap requests to send the credential in the header the challenge selects (such as Payment-Authorization with requiresAuth) instead of always using Authorization. These requests keep the paid request's own Authorization header and no longer follow redirects, so the credential can't reach another origin.
• 464df9a: Fixed Tempo charge verification rejecting split amounts written with leading zeros by comparing them as integers.
• 9008513: Removed the allowKeyAuthorization fee-payer policy: sponsored transactions may now carry a keyAuthorization, so an access key can open a fee-sponsored session (or pay a sponsored charge) in the transaction that i...

  Description has been truncated