chore: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and the packages will be published to npm automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

mppx@0.8.0

Minor Changes

• daab9b8: Breaking: Collapsed McpClient.wrap and the in-place wrapClient variant into a single McpClient.wrap API on the mppx/mcp/client entrypoint.

  McpClient.wrap now adds payment handling to an MCP SDK client in place: the client is mutated and the same reference is returned, so surfaces that keep using the original client become payment-aware (e.g. when another SDK owns the client reference, like Cloudflare Agents). The MCP SDK callTool(params, resultSchema?, options?) signature is preserved, payment challenges are handled whether they arrive as payment-required errors or as tool results carrying org.paymentauth/payment-required metadata, and the config accepts orderChallenges and paymentPreferences alongside methods and onPaymentRequired. Calling wrap on the same client again replaces its payment configuration.

  Migration: move per-call options from the second argument to the third — mcp.callTool(params, undefined, { context, timeout }) — and replace the approval-first overload mcp.callTool(onPaymentRequired, params, options) with the onPaymentRequired option: mcp.callTool(params, undefined, { onPaymentRequired }) (pass null to bypass a configured hook). The MCP entrypoints moved to mppx/mcp/client and mppx/mcp/server; the mppx/mcp-sdk/* specifiers remain as aliases.

Patch Changes

• 4c79a78: Rejected empty Payment challenge IDs during construction and deserialization.
• 7c38c17: Deprecated uppercase asset and chain aliases in favor of lowercase exports.
• 0e88d07: Corrected PaymentRequest documentation examples to use the exported namespace name.
• 8da60b5: Documented explicit server secret key configuration in README examples.
• b5d8657: Updated Hono dependencies to patched versions.
• 5e27ef2: Fixed SSE session accounting so voucher management posts no longer consumed stream charges.
• ec1ad50: Hardened server secret-key validation and capped oversized WWW-Authenticate request parameters.
• 11db0bd: Removed now-unused wallet_authorizeChallenge support.
• e80feeb: The Tempo fee-payer (sponsor) pre-broadcast simulation now simulates the co-signed transaction the sponsor actually broadcasts — with the concrete fee payer and chosen fee token — instead of the pre-cosign 0x78 envelope, for both local and hosted (feePayerUrl) fee payers. This catches reverts in the exact transaction the sponsor pays gas for, and fails closed (no broadcast) when the simulation reverts.
• c2611f6: Added tempo.common() as an explicit alias for the Tempo charge and session method bundle.
• 034315e: Updated proxy route examples to use current route handler APIs.
• 4e5abf4: Hardened confirmed Tempo subscription settlement against T6 (TIP-1028) receive policies. Activation and renewal payments that wait for confirmation now verify that a TIP-20 TransferWithMemo log credits the intended recipient for the expected amount with the generated settlement memo, instead of trusting transaction success alone. Transfers held by a receiver's receive policy (redirected to ReceivePolicyGuard) are now rejected rather than treated as paid, and the memo binding excludes unrelated transfer effects in the same receipt. Documented that the optimistic waitForConfirmation: false mode cannot prove recipient credit under T6.
• c15be54: Added wallet_authorizeChallenge support. JSON-RPC accounts now delegate Tempo charge and session challenges to wallets that advertise MPP support via wallet_getCapabilities, falling back to local signing otherwise.
• d14d933: Bound Tempo zero-amount proof credentials to the payer wallet. The EIP-712 Proof typed-data now includes an account field (domain version bumped to 3), so a proof signature commits to a specific payer address and can no longer be replayed against a different account — including across an access key authorized for multiple accounts. Exposed the canonical proof contract via tempo.Proof (types, domain, primaryType, message, typedData, hash) and added deterministic conformance vectors covering the wallet-binding property.