docs: sync mppx 0.13.1

[brendanjryan]

Motivation

Keep the MPP documentation aligned with mppx 0.13.1 and its current public interfaces and security defaults.

Summary

• Bump the documented mppx dependency and sync bookmark to 0.13.1
• Update Stripe, Session, middleware, transport, WebSocket, Node adapter, Receipt, and x402 references
• Remove examples for deprecated legacy Session exports

Key design considerations

• Require one shared atomic store for Stripe-backed replay protection
• Lead with secure route binding and current Session APIs
• Keep examples typechecked and aligned with mppx defaults

import { Store, stripe } from "mppx/server"

declare const store: Store.AtomicStore
const payments = stripe.create({ client, networkId, store })

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mpp	Ready	Preview	Oct 5, 2026 6:47pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-05T18:50:44.447719Z	7c55d43	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mppx@​0.12.0 ⏵ 0.13.1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Recently published: npm mppx published 3 days ago Location: Package overview From: package.json → npm/mppx@0.13.1 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mppx@0.13.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7c55d43ca6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the overview to match the sponsor default

For a local tempo.charge fee payer, this new text correctly says allowKeyAuthorization defaults to false, but src/pages/payment-methods/tempo/index.mdx:105 still says local sponsors allow access-key installation by default and recommends setting the option to false to reject it. Users following that overview can omit the now-required true opt-in and have sponsored access-key transactions rejected, so update the overview before marking the 0.13.1 documentation sync complete.

AGENTS.md reference: AGENTS.md:L65-L67

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Remove stale standard-client claims after changing the default

With the new routeBinding: 'required' default, the preceding Express example receives automatically derived route metadata and therefore rejects standard x402 Credentials that lack the mppx extension. However, line 196 still says standard clients don't need that extension, and line 219 still says the default compares the echoed resource URL. This can send users into a repeated 402 flow; either set routeBinding: 'resource' in the primary example or update both stale statements to match the secure default.

AGENTS.md reference: AGENTS.md:L65-L67

Useful? React with 👍 / 👎.