fix: support P-256 V2 session vouchers

[brendanjryan]

Motivation

Wallet access-key rehydration supports passkeys, but the bundled MPP SDK cannot create P-256 V2 session vouchers.

Summary

• Upgrade MPP SDK to the P-256-capable release.
• Add a persisted P-256 access-key V2 voucher regression test.
• Adapt token calls to the upgraded Viem API.

Key design considerations

• Reuses the existing persisted passkey identity path and limits the change to SDK compatibility.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mppx@​0.8.9
	viem@​2.54.0

View full report

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 15ed7d6358

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Pin a viem version compatible with mppx charge payments

When tempo request receives a regular non-session 402, payAndRetryRequest builds Mppx.create({ methods: [tempo(methodOptions), ...] }) in src/commands/request.ts, so it enters mppx's charge path. mppx@0.8.9 still calls the old Actions.token.transfer.call({ ... }) helper form internally, but viem@2.54.0 changed token call helpers to require (client, args) and the old form was only restored in a later 2.54.x patch; with this exact pin, non-session Tempo payments throw while creating the credential instead of signing/paying. Please use a viem patch that includes the compatibility restore or a matching mppx version.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Switch to the V2 session method export

For reusable V2 session vouchers, paySessionAndRetryRequest passes a descriptor in the credential context, but after this upgrade the default session export from mppx/client is still the legacy session method and does not accept the descriptor-only voucher context; the P-256 V2 path this commit is trying to enable therefore still fails when reusing a stored precompile session. Use the new V2 session method export from mppx (or a version where session aliases it) before relying on descriptor-based vouchers.

Useful? React with 👍 / 👎.