github-actions · Nov 3, 2026
diff --git a/.changeset/agents-shared-shape.md b/.changeset/agents-shared-shape.md
diff --git a/.changeset/body-digest-rfc9530.md b/.changeset/body-digest-rfc9530.md
diff --git a/.changeset/charge-fee-token.md b/.changeset/charge-fee-token.md
diff --git a/.changeset/expiring-nonce-replay-recovery.md b/.changeset/expiring-nonce-replay-recovery.md
diff --git a/.changeset/fine-paths-tease.md b/.changeset/fine-paths-tease.md
diff --git a/.changeset/fix-request-payment-retry.md b/.changeset/fix-request-payment-retry.md
diff --git a/.changeset/fix-session-close-request-state.md b/.changeset/fix-session-close-request-state.md
diff --git a/.changeset/package-size-budget.md b/.changeset/package-size-budget.md
diff --git a/.changeset/prepay-session-content.md b/.changeset/prepay-session-content.md
diff --git a/.changeset/proxy-replay.md b/.changeset/proxy-replay.md
diff --git a/.changeset/restore-get-configured-offers-jsdoc.md b/.changeset/restore-get-configured-offers-jsdoc.md
diff --git a/.changeset/safe-websocket-close.md b/.changeset/safe-websocket-close.md
diff --git a/.changeset/session-manager-origin.md b/.changeset/session-manager-origin.md
diff --git a/.changeset/thin-dodos-fetch.md b/.changeset/thin-dodos-fetch.md
diff --git a/.changeset/unpaid-validation-probes.md b/.changeset/unpaid-validation-probes.md
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # mppx
 
+## 0.17.1
+
+### Patch Changes
+
+- ed76e8e: Accepted the RFC 9530 byte-sequence form (`sha-256=:base64:`) in `BodyDigest.verify`, alongside the existing bare form. `BodyDigest.compute` still emits the bare form.
+- 20eca32: Added `feeToken` to the Tempo charge client, so an access key whose spending limits exclude the default fee token can pay an unsponsored charge's fee in a token it may spend.
+- 2b747bf: Fixed Tempo charge settlement returning a fresh 402 after a paid transaction was mined: a broadcast rejected with `ExpiringNonceReplay` (for example, a retried send) now recovers the transaction's receipt instead of failing.
+- cd6a2a7: Fixed payment retries losing Request-carried HTTP methods and bodies, including valid body overrides. Rejected automatic payment after redirects with ambiguous method rewriting before creating credentials.
+- 807376f: Fixed cooperative HTTP session close inheriting the resource Request's body and abort signal while preserving its transport settings and the same resource URL.
+- 2ca12d1: Charged request-priced SSE-enabled content before invoking application handlers, including POST requests that return plain responses. Marked the receipt prepaid to avoid charging the first stream unit twice. Per-item pricing remained stream-driven. Applications must refund request charges when they cannot serve the accepted request.
+- 3fca0d6: Added an opt-in `replay` option to `Proxy.create`, so a payer who loses the connection during a long paid request can collect the response. The paid upstream request runs detached from the client, and a retry with the same credential and request gets the stored response, `202` while it runs, or a new upstream attempt after a failed delivery, without paying again.
+- afb9924: Fixed rejected WebSocket payments leaving sockets open when detailed error messages exceeded the close-frame reason limit.
+- 3c2bc84: Bound each session manager to its first HTTP origin and persisted that binding with reusable channels. Rejected cross-origin HTTP, SSE, and WebSocket reuse before disclosing channel hints or payment credentials, and prevented redirects from forwarding session requests. Existing unbound channel entries acquired an origin on their next validated reuse.
+- 5d353bb: Prevented validation probes from authorizing payments through an installed global Mppx fetch wrapper.
+
 ## 0.17.0
 
 ### Minor Changes

diff --git a/package.json b/package.json
@@ -79,7 +79,7 @@
   "[!start-pkg]": "",
   "name": "mppx",
   "type": "module",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "main": "./dist/index.js",
   "license": "MIT",
   "homepage": "https://github.com/wevm/mppx#readme",

diff --git a/src/internal/version.ts b/src/internal/version.ts
@@ -1,7 +1,7 @@
 // Generated by scripts/sync-version.ts.
 
 /** Current mppx package version. */
-export const version = '0.17.0'
+export const version = '0.17.1'
 
 /** Canonical SDK identifier for this mppx release. */
 export const sdkIdentifier = `mppx/${version}`