docs: sync mppx recipient allowlists

[brendanjryan]

Motivation

MPP clients now validate both primary and split recipients before signing, including zero-amount proofs.

Summary

• Update the Tempo charge client reference and split-payment guide
• Add primary recipients to allowlist examples
• Bump the mppx main snapshot and sync bookmark

Key design considerations

• Clarify the migration for allowlists containing only split recipients
• Keep recipient validation opt-in through expectedRecipients

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mpp	Ready	Preview	Sep 11, 2026 1:29pm UTC

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mppx@​0.0.0-main-20260909172717 ⏵ 0.0.0-main-20260910213138

View full report

[socket-security]

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Block		Recently published: npm mppx published 16 hours ago Location: Package overview From: package.json → npm/mppx@0.0.0-main-20260910213138 ℹ Read more on: This package | This alert | What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mppx@0.0.0-main-20260910213138. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-11T13:27:59.893664Z	f4bb588	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[brendanjryan]

SocketSecurity ignore npm/mppx@0.0.0-main-20260910213138