mppx@0.4.11

Patch Changes

• Fixed close voucher validation to reject vouchers equal to the on-chain settled amount. (GHSA-mv9j-8jvg-j8mr)
• Added Stripe credential replay protection via the Idempotent-Replayed header. (GHSA-8mhj-rffc-rcvw)

mppx@0.4.10

Patch Changes

• b4e1a3d: Add OpenAPI-first discovery tooling via mppx/discovery, framework discovery() helpers, and mppx discover validate.

  This also changes mppx/proxy discovery routes:

  • GET /openapi.json is now the canonical machine-readable discovery document.
  • GET /llms.txt remains available as the text-friendly discovery view.
  • Legacy /discover* routes now return 410 Gone.

• 70f6595: Fix two production session/SSE robustness issues.

  1. Accept exact voucher replays (cumulativeAmount == highestVoucherAmount) as idempotent success after signature verification, while still rejecting lower cumulative amounts and preserving monotonic state advancement rules.
  2. Prevent invalid null-body response wrapping in SSE receipt transport by returning 101/204/205/304 responses directly instead of stream-wrapping them.

• 3c713c9: tempo.session() now throws immediately at initialization if no viem Account is provided, instead of failing later with an opaque error during channel close. The error message includes an example fix.

mppx@0.4.9

Patch Changes

• d9b651d: Added Store.redis() adapter for standard Redis clients (ioredis, node-redis, Valkey) with BigInt-safe serialization.
• b69bbee: Fixed Express middleware hanging by constructing a Fetch Request directly from Express's req API.
• 7da6cfd: Fixed SSE header normalization.
• a2c6cc9: Skipped route amount/currency/recipient validation for topUp and voucher credentials. These POSTs carry no application body so the route's request hook may produce a different amount than the challenge echoed from the original request. The on-chain voucher signature is the real validation.

mppx@0.4.8

Patch Changes

• 99920d0: Updated validation.

mppx@0.4.7

Patch Changes

• 2a0b88e: Fixed cooperative close to sign the server-reported spent amount instead of the high-water mark (cumulativeAmount), preventing overcharging when actual usage was below the pre-authorized voucher amount.

mppx@0.4.6

Patch Changes

• 281005c: Added support for feePayer as a URL string on tempo method.

mppx@0.4.5

Patch Changes

• bbd4b3f: Updated Moderato (testnet) escrow contract address to 0xe1c4d3dce17bc111181ddf716f75bae49e61a336.

mppx@0.4.4

Patch Changes

• b09a35a: fix: update getChannel ABI field order to match new escrow contract
• c520705: Fixed Client.getResolver to inject Tempo serializers onto clients missing them, preventing the default serializer from rejecting Tempo-specific transaction fields.
• b09a35a: chore: update mainnet escrow contract address

mppx@0.4.3

Patch Changes

• 7f8d103: chore: update mainnet escrow contract address

mppx@0.4.2

Patch Changes

• c089da5: Added CLI config via mppx.config.(js|mjs|ts). Allows for extending mppx CLI to support non-built-in methods.