[vvillait88]

Summary

Maintenance sweep for the coupled payment set: mppx 0.15.0 to 0.16.0 and viem 2.57.11 to 2.57.13 (exact pins, with the viem override), plus typescript-eslint 8.72.1. Version 0.7.6. incur is unchanged, so the serveCli protocol does not apply.

Worked with: Varun.

What changes for a buyer, from mppx 0.16:

• The client now refuses to sign a zero-amount Tempo proof unless the challenge realm is the hostname of the server that sent it, so another origin cannot relay a challenge and replay the proof. Every AgentScore store's challenge carries its own hostname as the realm (fullenrich read from a live 402), so their zero-amount flows keep working. A merchant whose realm is not its hostname now gets a refusal naming trustedTempoProofRealms instead of a signed proof.
• The Tempo proof's EIP-712 domain stays at version 3, matching node-commerce 3.1.7 and the stores.
• Tempo session requests send the credential in the header the challenge selects and no longer follow redirects. Payment events no longer mask the original error when a response body was already consumed.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. Commands and output are unchanged.

Test plan

• bun run lint, typecheck, knip, test and build all exit 0. bun install --frozen-lockfile is a no-op (435 installs across 509 packages). OSV over bun.lock reports no issues.
• The compiled darwin-arm64 binary reports 0.7.6 from --version, and check against a live store returns its 402 with six rails.
• Release (tag v0.7.6), the Homebrew formula and FLEET_PAY_VERSION follow the merge. The coupled move closes with a live settle on Base, Tempo and Solana once the stores are on the same set.

Checklist

• Tests cover the new behavior, and the suite passes locally (no behavior change of ours; suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review (fresh context, read-only)

Verdict: approve. One verification suggestion before tagging, no defect.

mppx 0.16 against src/commands/pay.ts. The only mppx surface is Mppx.create({ methods, fetch, onChallenge }) from mppx/client plus client.fetch. No attestation (0.16 now throws a TypeError if that key is passed; pay never passes it), no trustedTempoProofRealms, no MCP transport, no fee-payer policy. tempo({ account }) and @solana/mpp charge are unchanged at the call sites; @solana/mpp 0.7.0's mppx >=0.5.5 peer admits 0.16.0, and the lock carries one mppx copy.

Realm check. New client/internal/ProofRealm.js only acts on method === 'tempo' && intent === 'charge' with amount 0, and compares challenge.realm to new URL(response.url).hostname. pay's createSecureFetch returns the underlying native Response (manual redirects, same-origin hops only), so response.url is populated and the check runs against the real host; with a plain fetch the same holds. Live, unauthenticated, nothing paid: fullenrich (/company/lookup, tempo and solana challenges), martin-estate (agents.martinestate.com/purchase) and sayer-and-stone (agents.sayerandstone.com/purchase) all send their own hostname as realm, so their zero-amount flows keep working.

Proof domain. dist/tempo/internal/proof.js is { name: 'MPP', version: '3', chainId } in 0.15.0 and 0.16.0, so the client stays compatible with node-commerce and the current stores.

Version. 0.7.5 to 0.7.6; git grep 0.7.5 outside the lock returns nothing.

Gates I ran on the PR head: bun run typecheck exit 0; bun run test exit 0, 52 files passed (1 skipped), 547 tests passed (2 skipped). Installed mppx reads 0.16.0 and viem 2.57.13.

Suggestion (not blocking). The test plan exercises check only. The stores verify on mppx 0.15 with the same domain version, so a cents-sized settle on Base, Tempo and Solana with the 0.7.6 build against a live store is possible before the tag rather than after the storefronts move, and would put settle evidence behind the release itself.