2.11.1: coupled set to viem 2.56.3 and mppx 0.9.2, x402 dev set 2.25.0, sdk 2.7.9 floor

[vvillait88]

Summary

Dependency sweep, 2026-09-05, and the 2.11.1 version bump. This is the verifier half of the coupled settle set moving: viem 2.56.1 to 2.56.3 (runtime dependency) and mppx 0.9.1 to 0.9.2 (dev), alongside pay 0.5.3 on the agent side and the four merchants downstream. mppx 0.9.2 keeps the Tempo proof credential's EIP-712 domain at version 3, read from dist/tempo/internal/proof.js, so verification stays compatible with agents on either side of the bump; the rest of its diff is additive Stripe PaymentIntent options and a middleware intent-key fix. The dev-only @x402 set (core, evm, extensions) moves to 2.25.0 as a set: server-side additions only (FacilitatorCapabilityError, a background-init handler, server-owned info fields), the client bundle is byte-identical. Also vitest and coverage 4 to 5, knip 6.34.0, typescript-eslint 8.69.0, @types/node 26.4.1, and the @agent-score/sdk floor to ^2.7.9.

Held: eslint 10, @eslint/js 10, TypeScript 7 (registered holds). fastify, hono and jose are current under the release-age soak.

Worked with Varun, who asked for the SDK-first sweep.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

bun install twice, second a no-op (Checked 768 installs across 743 packages); manifest diff confined to the packages above. bun run lint, typecheck, knip, build exit 0; bun run test: 1824 passed, 4 skipped across 120 files on Vitest 5. The live all-rails settle for this coupled bump ran from pay 0.5.3 against the live FullEnrich store (Base, Tempo and Solana ungated, Base gated), recorded on pay's PR; the merchants re-run it on the new verifier once they take 2.11.1.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests