0.5.3: coupled set to viem 2.56.3 and mppx 0.9.2, live all-rails settle passed

[vvillait88]

Summary

Dependency sweep, 2026-09-05, and the 0.5.3 version bump. This is the agent half of the coupled settle set moving: viem 2.56.1 to 2.56.3 and mppx 0.9.1 to 0.9.2 (node-commerce and the four merchants move in the same waterfall). Also @solana-program/system 0.14.1 and token 0.16.1, vitest and coverage 4 to 5, knip 6.34.0, typescript-eslint 8.69.0, @types/node 26.4.1, and the @agent-score/sdk floor to ^2.7.9 now that it is published.

What the coupled bump changed upstream, read from the shipped files: mppx 0.9.2 keeps the Tempo zero-amount proof credential's EIP-712 domain at version 3 (dist/tempo/internal/proof.js), so new-agent proofs verify against unbumped merchants; its other changes are additive (an intent-key collision fix in the middleware composer, Stripe PaymentIntent options for customer, tax hooks and receipt email, and a machine_payment metadata marker on Stripe charges). viem 2.56.2 fixes isHash on odd-length hex; 2.56.3 makes the Tempo client's types portable, which stopped them being assignable to the hand-written receipt reader, so ReceiptReader is now typed by the one member it calls and narrows the status on read.

The @x402 set stays exactly pinned at 2.24.0 (core, evm, fetch): @x402/fetch 2.25.0 is under the 24-hour release-age soak and nests its own core, so moving core alone split the x402Client type in two. The set moves together at the next sweep. incur stays at 0.5.1 (current), so its patch is untouched. Held: eslint 10, @eslint/js 10, TypeScript 7.

Worked with Varun, who asked for the SDK-first sweep.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

• bun install twice, second a no-op (Checked 556 installs across 583 packages); manifest diff confined to the packages above. bun run lint, typecheck, knip exit 0; bun run test: 574 passed, 2 skipped across 58 files on Vitest 5.
• Live all-rails settle from this build (bun run build, then node dist/index.js pay) against the live FullEnrich store, which still runs the unbumped verifier, which is the domain-compatibility proof the holds registry requires. Ungated POST /company/lookup ($0.02) settled 200 on Base, Tempo and Solana; gated POST /person/enrich/work-email ($0.07) settled 200 on Base with payment_status: completed and the passport attached. Smoke wallet balances before and after: Base 3.530968 to 3.440968 USDC, Tempo 0.027200 to 0.007169, Solana 0.040000 to 0.020000, each delta equal to the charges.
• Not run here: the serveCli compiled-binary protocol, which incur bumps owe and incur did not move.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests