pull in latest upstream - #2
Open
TtheBC01 wants to merge 976 commits into
Open
Conversation
github-actions
Bot
added
typescript
python
go
java
sdk
legacy
examples
specs
docs
website
ci
ecosystem
labels
* chore(stellar): upgrade stellar sdk to v16 * chore(stellar): add release changeset * chore(stellar): use sdk 16.0.1
* add authoring-specs skill * edit * edit * no new facilitator endpoints
* feat: improve & document wallet compatibility * fix: format/lint typescript * fix: format/lint go * fix: format/lint python * feat: reviewer feedback * fix: format * fix: format python * fix: go unit test * fix: python tests * fix: e2e tests & add sampling to e2e tests * fix: 6492 predeploy transactions landing * WIP * feat: improve wallet compatibility * fix: lint/format * fix: python tests * fix: e2e lock * fix: skip verification of deposit txn in settlement post-6492-deploy * fix: 6492 predeploy in typescript with batch-settlement simulates * fix: format/lint/test python/go * chore: remove orphaned account-abstraction submodule gitlink The contracts/evm/lib/account-abstraction gitlink was committed without a corresponding .gitmodules entry and is not referenced by any build config or source in this repo. Remove it so it no longer appears in the PR. Co-authored-by: Cursor <cursoragent@cursor.com> * feat: add changelog fragments * feat: removed dead code errors * fix: wallet-compatibility doc --------- Co-authored-by: Cursor <cursoragent@cursor.com>
#2700) * make facilitator's receiverAuthorizer optional * add changeset * add validateFacilitatorSupport hook * fix fmt * fix fmt
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* feat(concordium): exact mechanism implementation * feat(concordium): align exact impl with spec + examples * fix(concordium): address exact mechanism review * style(concordium): format advanced example readmes * feat(concordium): add shared e2e testnet coverage * test(concordium): fix offline facilitator signer mock * build(typescript): fix x402 CI validation * fix(concordium): address all PR #2390 review comments - Build fix: cast ccdNetwork as Network in all_networks.ts (#29) - v2-only: getRequiredAmount() returns requirements.amount directly (#22) - Remove offline e2e test (#4) - Add defaultMoneyConversion() for Concordium native CCD (#8/#35) - Private key support: new overload accepting hex-encoded Ed25519 key (#11/#19) - Client runtime: traced createPaymentPayload path, all guards correct (#30) - Tx simulation: addressed as chain limitation, preflightLikelyToSucceed correct (#3) - Fix lint: JSDoc completeness for signer overloads, unused param naming * fix(concordium): update e2e facilitator and integration tests for private key support - e2e facilitator: support CCD_FACILITATOR_PRIVATE_KEY + CCD_FACILITATOR_ADDRESS env vars as preferred path, with wallet export as fallback - e2e test.config.json: add new CCD env vars to optional list - Integration tests: support CONCORDIUM_CLIENT_PRIVATE_KEY + CONCORDIUM_CLIENT_ADDRESS and CONCORDIUM_FACILITATOR_PRIVATE_KEY + CONCORDIUM_FACILITATOR_ADDRESS as alternatives to wallet export files - Fix integration test expectations: asset field is 'CCD' for native CCD (matches actual parseAssetAmount/defaultMoneyConversion behavior) - Fix AssetAmount pass-through test: amount is converted to atomic units * fix(concordium): remove sponsor_as_recipient safety check The check blocked the standard x402 deployment model where the service provider runs both the facilitator (sponsoring gas) and the server (receiving payment). No other mechanism (EVM, SVM, Aptos, Hedera, Stellar, TVM) has this restriction. Verified with on-chain integration tests: - wallet 1 → wallet 2 (client pays service provider) - wallet 2 sponsors the transaction - Both CCD payment flows confirmed on Concordium testnet * fix(concordium): pass token decimals from server to client for PLT transfers Server parseAssetAmount now includes decimals in extra, which flows through PaymentRequirements.extra to the client. Client buildPltTransfer reads decimals from requirements.extra and uses it in TokenAmount.create instead of hardcoding 0. This fixes the invalid_token_amount_decimals error during facilitator verification of PLT token payments (e.g. EURR with 6 decimals). Integration tests: 10/10 pass including on-chain EURR transfer. * fix(e2e): support CCD private key env vars in e2e test runner Adds CCD_PRIVATE_KEY + CCD_ADDRESS as an alternative to CCD_WALLET_PATH across the entire e2e stack: - ClientConfig + FacilitatorConfig types: new optional fields - GenericClientProxy + GenericFacilitatorProxy: map to env vars - FacilitatorManager: pass through from process.env - fetch + axios clients: prefer private key, fall back to wallet - e2e/test.ts: read new env vars, OR-logic validation for CCD Backward compatible: wallet export path still works when private key vars are not set. * style(concordium): fix lint and format issues - Fix corrupted JSDoc in _get_tokens.ts - Add missing @PARAM decimals description in client scheme - Fix unused decodedPayload param in checkPayloadSafety (rename to _) - Fix _decodedPayload → decodedPayload in verify() local variable - Apply prettier formatting to integration test and server scheme * test(concordium): add USDR PLT token integration test case * fix: minimize e2e diff — revert refactoring, keep only Concordium additions Reverted 7 e2e runtime files to upstream2/main baseline and re-applied only Concordium-specific additions as localized inserts. Zero existing code touched — EVM, SVM, and all other chains completely unchanged. Also: - Restore EVM/SVM to required in all test.config.json files - Fix missing/extra braces in fastify Keeta/CCD route blocks - Fix duplicate ProtocolFamily type in networks.ts + types.ts - Remove trailing newline in DEFAULT_ASSETS.md - Revert EVM/SVM ! -> || '' in e2e/test.ts - Hardcode CCD testnet in facilitator example E2e runtime diff: 305 lines added (was 2,839 — 89% reduction) Zero Concordium-related tsc errors. All tests passing. * test(concordium): expand unit + integration coverage — large amounts, unknown token, asset deduplication - Unit: 106 tests covering buildCcdTransfer, buildPltTransfer, validation, edge cases - Integration: 32 tests covering happy path, large amounts, non-existent token, asset dedup - Total: 138 Concordium tests, all green * fix(concordium): simplify server scheme and fetch token decimals from RPC - Server scheme: remove registerAsset, getAsset, getSupportedAssets, getSupportedSymbols, parseAssetAmount, assetKey, toWholeUnits, isAssetAmount, defaultMoneyConversion, CCD_NATIVE, ConcordiumAssetInfo, AssetType (291→140 lines) - AssetAmount pass-through in atomic units, asset field required (throws if missing) - Money (string/number) throws unless money parser registered — no silent CCD fallback - Client: fetch PLT token decimals from gRPC getTokenInfo instead of trusting server-provided metadata - Update unit + integration tests for new scheme behavior * fix(concordium): replace CCD_WALLET_PATH with private key + address - e2e: replace CLIENT_CCD_WALLET_PATH/FACILITATOR_CCD_WALLET_PATH with CCD_PRIVATE_KEY + CCD_ADDRESS throughout test runner, clients, facilitators, and README - e2e/README.md: remove Concordium offline e2e section - examples/clients/advanced: CCD_WALLET_PATH → CCD_PRIVATE_KEY + CCD_ADDRESS, parseWallet → buildBasicAccountSigner - examples/servers/advanced/README.md: simplify Concordium testnet funding instructions * docs(concordium): update README and package metadata for new scheme - README: remove registerAsset() examples, add AssetAmount + registerMoneyParser() patterns, update Amount Format section - README: fix Supported Assets table (PLT decimals token-dependent), wildcard description - typescript/package.json: reorder devDependencies - e2e/package.json: minor dependency update * test(concordium): add unit and integration tests for review round 5 gaps - Server (7 tests): no-decimals leak, money parser chain, asset required, extra preservation - Facilitator (6 tests): preflight nonce/balance checks, PLT token balance preflight - Client (3 tests): decimal edge cases (0, 18, large+6) - Integration (7 tests): null/undefined/empty asset, no-decimals leak, preflight CCD+PLT, large-amount preflight Addresses D1-D3, E1, O2 from PR #2390 review round 5 * chore: resolve e2e/pnpm-lock.yaml conflict with upstream/main
…2711) * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/exact.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* py * go * changesets
* Update docs/schemes/batch-settlement.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/batch-settlement.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* ccd fast-follow * fix fmt
* add e2e lockfile check * regenerate
* updated ccd * chore: version typescript packages * fix fmt
* fix parsing * fix parsing * chore(go): release
…lanche, Celo, Linea, Unichain, Monad (#2718)
* feat(ts): add delegated receiver authorizer for SVM upto * fix startup * harden storage
* feat(go): exit on fatal facilitator capability errors Typed FacilitatorCapabilityError so HTTP adapters can distinguish permanent misconfiguration from retryable facilitator timeouts and exit instead of staying up until the first paid request. Co-authored-by: PhilBot <PhilBot402@users.noreply.github.com> Co-authored-by: phdargen <phdargen@users.noreply.github.com> * feat(go): add delegated receiver authorizer for SVM upto Optional facilitator-delegated receiverAuthorizer for SVM upto, matching EVM batch-settlement: /supported may advertise the authorizer, a server that omits ReceiverAuthorizerSigner no longer needs a voucher-signing key, and the facilitator signs the claim voucher only after binding the deposit to a caller identity and matching that same identity on claim. Co-authored-by: PhilBot <PhilBot402@users.noreply.github.com> Co-authored-by: phdargen <phdargen@users.noreply.github.com> * harden storage --------- Co-authored-by: PhilBot <PhilBot402@users.noreply.github.com> Co-authored-by: phdargen <phdargen@users.noreply.github.com> Co-authored-by: Philippe d'Argent <pdargent@icloud.com>
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
PaymentFilter.doFilter() called chain.doFilter() directly against the real response, so the protected handler's output was written (and often committed) to the client before facilitator.settle() ran. If settlement then failed - network error, RPC timeout, facilitator outage - the buyer had already received the paywalled content with no payment settled, and the existing respond402() fallback on settlement failure was reachable only when response.isCommitted() happened to still be false. This mirrors the buffering approach already used by this repo's own TypeScript/Express middleware (typescript/packages/http/express/src/index.ts): buffer the response body behind a wrapper, run the handler against the wrapper, and only flush the real response once settlement is confirmed. On settlement failure the buffered body is discarded and a 402 is sent instead - deterministically, not dependent on whether the container had already committed the response. Also fixes FilterIntegrationTest's stub facilitator, which returned a default (success=false) SettlementResponse - its validHeaderGets200 test was only passing because the pre-fix bug delivered the response before settle()'s result mattered. Added FilterSettlementFailureIntegrationTest, a new embedded-Jetty regression test that fails against the pre-fix code (verified locally: 200 + leaked body) and passes with the fix (402, body never delivered). Fixes #3068 Co-authored-by: Riley <313779891+rileybuilds@users.noreply.github.com>
Replica lag is a small multiple of Solana slot time, so exponential waits spent the 3s budget on one oversized delay. Match Go #3355: 6 linear reads at 200-1000ms, with optional config overrides. Co-authored-by: phdargen <phdargen@users.noreply.github.com>
Settle was issuing a second eth_getCode for the same payer after verify already classified deployment. Reuse that result so ERC-6492 deploy does not depend on a later RPC read. Co-authored-by: phdargen <phdargen@users.noreply.github.com>
* fix(python): reuse verify ERC-6492 payer code in settle Settle was issuing a second eth_getCode for the same payer verify already classified. Reuse that classification so RPC lag cannot split deploy vs skip across the two reads. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * docs(python): add changelog fragment for ERC-6492 settle reuse Co-authored-by: phdargen <phdargen@users.noreply.github.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com>
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* fix(python): exit on fatal HTTP adapter initialize errors Permanent FacilitatorCapabilityError and RouteConfigurationError at eager initialize must stop the process so a misconfigured server does not stay up until the first paid request. Transient facilitator timeouts stay retryable. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * chore(python): add changelog fragment for #3364 Co-authored-by: phdargen <phdargen@users.noreply.github.com> * fix(python): treat empty /supported as retryable at initialize A 200 with no kinds became RouteConfigurationError and HTTP adapters exited. Match TypeScript so a transient empty facilitator response does not kill the process. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com> Co-authored-by: Philippe d'Argent <pdargent@icloud.com> Co-authored-by: Cursor <cursoragent@cursor.com>
…#3372) * feat(ts): Add optional extra.minDeposit hint for EVM batch-settlement * shared resolver * docs(ts): note uncapped deposit behavior in batch-settlement client README Clarify that uncapped clients honor server-sized minDeposit hints as refundable but time-locked escrow. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
* Update docs/schemes/batch-settlement.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/batch-settlement.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* limit loc and complexity * increase test coverage * increase test coverage of more packages * fix fmt * fix tests
The two settlement-failure tests added with the coverage work hand-roll a context.res whose only arrayBuffer lives on clone(); the middleware buffers settlement replies by calling res.arrayBuffer() directly, so the mock throws TypeError, the generic catch returns the JSON 402 fallback, and both tests fail on main (breaking every PR's merge CI). With a real Response the tests exercise the intended settlement-failure paths and pass against the unchanged middleware: hono already honors isHtml and surfaces the 502.
* test(python): expect 90s HTTP facilitator timeout default Co-authored-by: phdargen <phdargen@users.noreply.github.com> * fix(python): default HTTPFacilitatorClient timeout to 90s Co-authored-by: phdargen <phdargen@users.noreply.github.com> * chore(python): add towncrier fragment for #3409 Co-authored-by: phdargen <phdargen@users.noreply.github.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com>
* fix(go): raise HTTPFacilitatorClient default timeout to 90s Long settle() calls can exceed the old 30s default. Match TypeScript HTTPFacilitatorClient (#3392) so identical facilitator traffic does not time out in Go while TypeScript continues waiting. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * chore(ts): drop verbose Hono settlement-failure test comments Remove the explanatory comments added in #3402. The real Response fixtures stay. Co-authored-by: phdargen <phdargen@users.noreply.github.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com>
…al checks (#3213) * fix(extensions): decode routeTemplate to a fixed point before traversal checks isValidRouteTemplate decoded a routeTemplate with a single decodeURIComponent pass before checking for ".." (traversal) and "://" (scheme injection). ROUTE_TEMPLATE_REGEX explicitly allows "%", so a double percent-encoded payload (%252e%252e, %253a%252f%252f, ...) survives one decode still percent-encoded — the substring checks never see the traversal/injection content, and the function incorrectly returns true. Per its own doc comment, a malicious routeTemplate lets a client cause the facilitator to catalog a payment under an arbitrary URL (catalog poisoning). A single extra decode pass would only close the double-encoded case specifically; triple-encoding (or deeper) would still bypass a fixed-count decode. Added fullyDecodeRouteTemplate, which decodes repeatedly until a fixed point is reached (further decoding produces no change) or a bounded pass budget (5) is exhausted, then runs the existing traversal/injection checks against that canonical form. This closes the gap for any encoding depth, not just double, while bounding the work done on adversarial input rather than decoding indefinitely. Malformed percent-encoding (fails to parse) or encoding that never reaches a fixed point within the budget both reject, matching the existing "malformed input → false" behavior. Adds regression tests in typescript/packages/extensions/test/bazaar.test.ts: - double- and triple-encoded traversal sequences rejected - double-encoded scheme injection rejected - a legitimate single percent-encoded segment (café) still accepted (must not become overly strict) - pathologically deep encoding (more passes than the budget) rejected Verified: pnpm --filter @x402/extensions test — 9 test files, 532 tests pass (including the 6 new ones), no regressions. Fixes #3169 * chore: add changeset for routeTemplate fixed-point decode fix Per @phdargen's review request — patch bump for @x402/extensions, matching the changeset format used elsewhere in this repo.
* feat: adding Java code * feat: added go * feat: adding python and typescript implementation * fix: adjusted dtos to match the spec * chore: linting issues * fix: update transaction hashing method for CSL v13+ compatibility * chore: add changeset for csl-v13-plus fix * chore: regenerate lockfiles after Cardano package additions * fix: fixing lintining issues in pipeline * feat: replaced csl with evolutionsdk for cardano transaction parsing * chore: regenerating lock files * docs: adding changelogs for go, python and typescript * chore: removed python, go and java for now * feat: adding e2e tests * chore: reverted unnecessary files for now * chore: alignment with other implementations * docs: readme updated * feat: made evm and svm optional to easier integrate other chains * reverting uv.lock files * docs: added cardano to readme.md * chore: updated lock file * chore: removed unnecessary configs * chore: reverted evm/svm optionality * chore: cleanups * chore: renamed function, adjusted comments to match function * Fix/cardano network string & merge main from remote (#15) * docs(svm): specify simulation-based smart wallet verification for exact scheme (#829) Document the outcome-based payment model and Sponsor Acceptance Policy for the exact scheme on Solana, aligned with the merged simulation-based smart wallet verification: - Reframe as outcome-based payment semantics with explicit terminology (client, merchant, sponsor, fee payer, smart wallet) - Add normative Exact Payment Outcome Definition, including exactly-one matching transfer and overpayment tolerance (>= required amount) - Add Sponsor Acceptance Policy (fee payer isolation, ALT visibility, compute budget caps, program allowlist, simulation rejection) - Document the two-path reference implementation (static fast path + simulation-based smart wallet path), path selection, and post-settlement TOCTOU verification - Add security invariants table (I1-I7) - Update static path instruction cap from 6 to 7 (third Lighthouse slot) * Add scripts for releases (#2580) * prepare go releases * fix fmt * fix uppercase keys * ts releases * fix legacy * fix hedera * add versions check * improve changelog parsing * fix * fix attribution * add tags * remove unused files * add combined ts releases (#2581) * feat(site): register Hedera testnet on the facilitator (#2589) Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com> * feat(evm): add Mezo mainnet (chain ID 31612) support with mUSD (#2590) Mezo mainnet launched with the canonical x402 contracts (Permit2 + Exact/Upto proxies) deployed at the same CREATE2 addresses as Base and Mezo testnet, so the SDKs can now offer mUSD as the chain's default stablecoin. Adds the eip155:31612 entry to all three SDK registries (TS DEFAULT_STABLECOINS, Go NetworkConfigs + ChainIDMezo, Python NETWORK_CONFIGS), mirroring the existing eip155:31611 testnet entry with only the token address and chain id differing. Field values were confirmed on-chain via ERC-5267 eip712Domain(): name "Mezo USD", version "1", chainId 31612; decimals()=18; EIP-2612 nonces() present (mUSD lacks EIP-3009, so transfers go through Permit2 with gasless EIP-2612 approval). No faucetUrl: mainnet has no faucet and the paywall faucet UI is testnet-gated. The Go constant is named ChainIDMezo (not ChainIDMezoMainnet) to match the unsuffixed-mainnet convention (ChainIDBase, ChainIDStable, ChainIDRadius, ChainIDHPP). Mainnet entries precede their testnet siblings in every registry, matching the other chain families. gen/decimals.ts is the build:paywall output for the new 18-decimal entry (DEFAULT_ASSETS.md step 3). The nine paywall template bundles were deliberately NOT regenerated: a clean-HEAD rebuild already changes all nine (pre-existing drift on main, likely from a dependency bump after the last regen; check_paywall_template is now workflow_dispatch-only so PRs no longer enforce it), and the client bundles do not embed the decimals map, so they have no functional dependency on this change. Including them would mix ~MB of unrelated minifier churn into a 34-line chain addition. Validation: full TS suite (45 turbo tasks), pytest (1651 passed), go test -race, plus lint/format gates for all three languages, green on base and on this change. Tracked by x4-hyn9fv.4; Python display-amount 6-decimal hardcoding found during review filed as x4-4a6mr8. * fix site + example builds (#2593) * fix builds * fix vercel build * Add Hedera Testnet to x402.org facilitator docs (#2592) * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * Add XDC Network mainnet (50) and Apothem testnet (51) USDC default stablecoins (#2597) * validAfter patch (#2601) * validAfter patch * add changelogs * fix fmt * Nightly e2e runs (#2600) * add daily e2e runs * fix parallel e2e * fix tests * fix next * fix tests * fix env * spec(upto): clarify settle-time verification convention for partial settlements (#2607) The upto EVM spec's Phase 3 step 4 requires `permitted.amount === requirements.amount`, but doesn't distinguish verify-time (where requirements.amount is the ceiling) from settle-time (where requirements.amount is the metered actual). This ambiguity allows facilitator implementations to enforce the equality check at settle time, rejecting all partial settlements — the core upto value proposition. Add an explicit "Settle-Time Verification" subsection to Phase 4 that documents the convention the reference implementation already follows: verify the signature against permitted.amount (the ceiling), validate settlement <= ceiling, then transfer the metered amount on-chain. Include a conformance note, a wire-shape example for the partial settlement case, and a cross-reference from the abstract scheme_upto.md. Add four conformance tests to the EVM facilitator test suite that validate the settle-time verification convention end-to-end: signature verified against ceiling, metered amount transferred on-chain, range of partial ratios, and rejection when exceeding the ceiling. Closes #2437 Co-authored-by: aisling404 <211950534+aisling404@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: cache Go SVM exact mint metadata (#2456) * fix go path (#2611) * fix e2e run (#2609) * Add buildercode s array (#2606) * add buildercode s array * add changelog * fix * Update builder-code docs for s array support (#2613) * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * chore: version python package (#2610) * chore: version typescript packages (#2617) * chore(go): release (#2618) * fix(py): cache SVM exact mint metadata (#2629) * fix(ts): cache SVM exact mint metadata (#2628) * Validate Retry After delta seconds (#2614) * patch py datetime (#2633) * fix: site typo (#2639) * docs: clarify mainnet facilitator setup (#2637) * feat(tvm): add TON mechanism for exact payment scheme (#1583) * feat(tvm): add TON mechanism for exact payment scheme Add @x402/tvm (TypeScript) and x402[tvm] (Python) mechanism packages implementing the exact payment scheme for TON blockchain. Python (mechanisms/tvm/): - Full gasless USDT payment flow via TONAPI relay - Ed25519 signature verification for W5R1 wallets - BoC parser for external messages, jetton transfers - 6-rule payment verification (protocol, signature, intent, replay, relay safety, simulation) - Idempotent settlement with state machine - 72 unit tests TypeScript (@x402/tvm): - SchemeNetworkClient/Server/Facilitator implementations - W5R1 wallet signing with @ton/ton SDK - Gasless estimate + settlement via TONAPI - CAIP-2 network IDs: tvm:-239 (mainnet), tvm:-3 (testnet) - 48 unit tests Refs: spec PR #1455, live facilitator at ton-facilitator.okhlopkov.com * fix(tvm): address code review — Ed25519 verification, stateInit, httpx dep - TS facilitator: add full Ed25519 signature verification using tweetnacl - TS client: compute commission from gasless estimate, propagate stateInit - Python: add httpx to tvm extras, lazy-import TonapiProvider - Update facilitator tests with real cryptographic fixtures * feat(tvm): update to self-relay architecture — remove gasless, add /prepare flow * fix(tvm): align TS/Python API contracts, delegate verify to facilitator Codex review fixes: - TS client /prepare now sends {walletAddress, walletPublicKey, paymentRequirements} matching Python and the actual facilitator API - TS facilitator delegates verify/settle to facilitator HTTP service instead of local BoC parsing (fixes security gap: was checking JSON fields but not BoC content) - TS /settle sends x402 envelope format matching facilitator API - validUntil comes from facilitator /prepare response, not invented locally - Remove unused error constants and Cell import - Update README: self-relay architecture, remove gasless/toFacilitatorTvmSigner docs - Update client tests to mock fetch instead of removed signer methods - Update changelog: "self-relay gas sponsorship" instead of "gasless" * chore(tvm): add all_networks examples, revert unrelated core changes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix(tvm): support both camelCase and snake_case facilitator responses The TVM facilitator scheme now accepts both response formats from the facilitator API, ensuring compatibility with facilitators that use either convention. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat(tvm): client uses RPC instead of /prepare — remove nonce Breaking changes: - Client resolves seqno + jetton wallet via TON RPC (default: toncenter.com) - ExactTvmScheme constructor now accepts optional { rpcUrl, apiKey } - Removed nonce from TvmPaymentPayload (dedup uses BoC hash) - Facilitator dedup tracks BoC hashes instead of nonces Aligns with spec review: no /prepare endpoint, client uses standard RPC calls like SVM/Stellar/Aptos. * fix(tvm): respect maxTimeoutSeconds from requirements - Client uses paymentRequirements.maxTimeoutSeconds for validUntil instead of hardcoded 300s - Facilitator forwards maxTimeoutSeconds to external /verify and /settle * chore(tvm): remove unused @ton-api deps, move tweetnacl to devDeps @ton-api/client and @ton-api/ton-adapter were leftover from the gasless relay approach. tweetnacl is only used in tests. * refactor: internal message BoC format, minimal payload Address TON Core team review feedback: - settlementBoc encodes internal message (not external) - Payload reduced to {settlementBoc, asset} only - Remove redundant fields (from, to, amount, walletPublicKey) - Set bounce=true on internal messages - Remove facilitatorUrl from PaymentRequirements extra * fix(tvm): align TS SDK with Python TVM flows * chore(tvm): update examples lockfile * fix(tvm): implement native TS facilitator * fix(tvm): address final review feedback --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Add contributing skill files (#2643) * add contributing skill * add ai policy * add -v to e2e run (#2645) * feat(keeta): add @x402/keeta TypeScript package (#2579) * feat(typescript): add keeta mechanism implementation * feat(keeta): queue settlement requests per feePayer account * chore(keeta): upgrade keetanet-client 0.16.1, anchor 0.0.50 * feat(keeta): add transaction simulation implementation * refactor(keeta): remove legacy register helper and use builder directly * feat(keeta): add typescript examples * feat(keeta): add to example facilitator * feat(keeta): add github publishing workflow * feat(keeta): add to docs * feat(keeta): add docs to README * feat(keeta): add unit and integration tests * feat(keeta): add e2e tests * feat(keeta): determine KTA/USDC via SDK, logger for facilitator And also contains a few other minor fixes. * chore(keeta): upgrade to keetanet-client 0.18.1, anchor 0.0.77 * fix(keeta): working e2e tests and add for hono, next, fastify * feat(keeta): update CI publish workflow and add to all * feat(keeta): harden facilitator CAIP parsing and moving its own funds * refactor(keeta): use @x402/core/utils for money parsing * feat(site): derive multiple Keeta signers from facilitator passphrase This enables the demo facilitator to run with multiple signers for Keeta by specifying a single passphrase and an amount of signers to use. * fix(keeta): pass duplicate_block error and avoid race in queue This now passes the `duplicate_block` error to clients instead of swallowing it silently and only passing a generic transaction_failed errorReason. Also, we fix a potential race condition where a running queue worker could pick up a job before the corresponding promise was added leading to the job failing and the promise becoming stuck. * fix(keeta): cleanup UserClients via destroy or await using * refactor(keeta): rename passphrase to mnemonic We decided that mnemonic would be clearer to most users/devs than passphrase which outweighs aligning the terminology with the SDK (which uses Account.seedFromPassphrase) and so replaced Keeta-related passphrase with mnemonic. * Add Keeta network to SDK features table (#2651) * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * tvm/keeta sdk follow ups (#2652) * tvm/keeta followups * fix fmt * patch: account for dynamic extension info fields in client echo validation (#2653) * fix siwx echo * fix offer-receipt * same for go * fix fmt * feat: add minting builder codes section to builder-code docs (#2656) * fix(evm): clarify client signer shape (#2635) Co-authored-by: go165 <196723798+go165@users.noreply.github.com> * Document dynamicInfoFields in extension interface (#2655) * Update docs/extensions/overview.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/overview.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * feat(go): add sign-in-with-x server and client support (#2485) * feat(go): add sign-in-with-x extension helpers * docs(go): add sign-in-with-x implementation plan * feat(go): add sign-in-with-x server extension * feat(go): add sign-in-with-x evm client signing * feat(go): retry sign-in-with-x auth before payment * docs(go): add sign-in-with-x examples * fix(go): satisfy sign-in-with-x lint checks * docs(go): update sign-in-with-x changelog * feat(go): add SIWX smart wallet verification * chore(go): tidy sign-in-with-x server example * docs(go): remove SIWX implementation plan * fix(go): align SIWX examples with TS interop * fix(go): address SIWX interop review feedback * Add Go support for sign-in-with-x extension (#2668) * Update docs/extensions/sign-in-with-x.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/sign-in-with-x.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/sign-in-with-x.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * Siwx go fastfollow (#2669) * remove ClientExtensionPaymentPayloadEchoPolicy * add svm support * add changelog * fix fmt * clean up * Pull request for mintlify/docs-update-1781889714891 (#2670) * Update docs/extensions/sign-in-with-x.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/sign-in-with-x.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * chore: version typescript packages (#2671) * bump to minor * add tvm/keeta to release script * release * chore: version python package (#2673) * chore(go): release (#2674) * fix script * release * patch ts tag script (#2675) * chore(stellar): upgrade stellar sdk to v16 (#2662) * chore(stellar): upgrade stellar sdk to v16 * chore(stellar): add release changeset * chore(stellar): use sdk 16.0.1 * fix(examples): type CARDANO_NETWORK as Network for register The env-derived network was a plain string, which is not assignable to the register() Network (`${string}:${string}`) parameter. Cast it like the other (literal-typed) networks so the facilitator example builds. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: fixing scheme location * chore: merged and adding tests * fix: added additionall checks for verify input. This checks if all inputs are unspent * fix: adding vkey signature verification * docs: adding duplication mitigation to docs * fix: making facilitator mnemonic optional * chore: cleaning pr --------- Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com> Co-authored-by: Notorious D.E.V. <notoriousd3v@gmail.com> Co-authored-by: phdargen <p.dargent@cern.ch> Co-authored-by: Peter Swierzy <123735851+piotrswierzy@users.noreply.github.com> Co-authored-by: Ryan R. Fox <ryanRfox@users.noreply.github.com> Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> Co-authored-by: Anil Chinchawale <anil24593@gmail.com> Co-authored-by: Aisling Cahill <aislingcahill10@gmail.com> Co-authored-by: aisling404 <211950534+aisling404@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: wonjoon <39115630+wnjoon@users.noreply.github.com> Co-authored-by: Kaly Node <53391581+samsamtrum@users.noreply.github.com> Co-authored-by: Carson Roscoe <CarsonRoscoe7@gmail.com> Co-authored-by: Dominik <39583330+skyc1e@users.noreply.github.com> Co-authored-by: Daniil Okhlopkov <5613295+ohld@users.noreply.github.com> Co-authored-by: scaler <240590331+sc4l3r@users.noreply.github.com> Co-authored-by: go165 <gaishibai@gmail.com> Co-authored-by: go165 <196723798+go165@users.noreply.github.com> * docs: adding minUtxo section to the spec * feat: implementing Cardano aliases for CIP-34 * fix: making facilitatormnemonic optional in e2e tests * chore: adding needed libraries to workspace and updated constants for tUSDM faucet * chore: replacing wait to fetch blockfrost utxos to avoid contention in e2e tests * feat: extending to fullfill masumi contract (#16) * docs: adding masumi contract details * feat: implemented masumi lock mechanism * fix: fixing feedback findings * chore: adding more validations * feat: enriching script method * chore: updating masumi script hash * Update e2e/pnpm-workspace.yaml Co-authored-by: phdargen <pdargent@icloud.com> * Update examples/typescript/pnpm-workspace.yaml Co-authored-by: phdargen <pdargent@icloud.com> * chore: removing masumi-usdm endpoint * chore: splitting client and server defined settings * doc: doc upgrades * docs(cardano): focus Masumi V2 payment flow Keep the existing Cardano scheme structure while defining the Masumi V2 request commitment, seller authorization, escrow datum, settlement policies, Hydra path, and replay rules. * style(python): format README examples * docs(cardano): fix settlement verification - order client submission before paid retry - bind registered agents to the global V2 registry - validate Hydra nonces in the selected head ledger * feat: updates according to the new spec * fix: fixing e2e tests * fix: fixing pipeline * fix(cardano): harden Masumi payment validation * fix(cardano): harden payment verification * fix(cardano): harden replay and submission * fix(cardano): close replay and settlement gaps * fix(cardano): address CodeRabbit findings * fix(cardano): validate payments before submission * fix(cardano): close Masumi interop gaps in the escrow lock Restrict Masumi datum addresses to the forms the escrow lifecycle can carry end to end: enterprise key addresses and base addresses whose payment and stake credentials are both key hashes. Masumi's own getPubKeyAddressDatum accepts nothing else, and every later transition rebuilds the continuation datum through it while vested_pay demands `new_datum.buyer == buyer` exactly, so a script stake credential or a pointer address strands the escrow with no recovery path. Enforce the deadline and payment-window rules at issue time. payByTime, the deadline gaps, Masumi's 15-minute submitResultTime lead and maxTimeoutSeconds are all covered by termsDigest, so a 402 that a buyer refuses cannot be repaired afterwards - only re-issued. Deadline strings are guarded before conversion so an unparseable value is a named rejection rather than a raw SyntaxError from BigInt. The interval rule now lives in one place and is shared by the issuer, the client and the facilitator instead of being copied three times. Make the facilitator capability check coherently fail-closed: a facilitator that publishes no extra is not describing itself and passes, but one that publishes a half-filled block is a rejection rather than silent permission to serve a 402 nobody can settle. Read settlementPolicy through the schema instead of an unchecked cast. Drop the dead maxTimeoutSeconds re-check before submission - the ceiling grows with the clock and cannot newly fail - keeping only the expiry check, which can. Document the relationship to masumi-payment-service: the escrow address, datum, collateral floor, min-UTxO headroom and blockchainIdentifier all match the deployed V2 contract, but reference_signature covers this scheme's termsDigest rather than Masumi's signed payload, so a lock built here cannot be driven through a Masumi node. * fix(cardano): bound the funds a Masumi 402 can immobilise Two seller-controlled values had no ceiling, and together they let a hostile or compromised resource server freeze a buyer's wallet while passing every existing check. Cap the deadline horizon. vested_pay gates the buyer's WithdrawRefund on `must_start_after(validity_range, submit_result_time)`, so until that deadline the buyer can recover neither the payment nor its collateral. Only minimum gaps were enforced, so a 402 naming external_dispute_unlock_ time years out froze the funds for that long. The issuer, the client and the facilitator now reject a last deadline more than 30 days out, and the client can raise the horizon for a counterparty whose settlement window it accepts. Checking against the verifier's own clock is monotonic: a facilitator sees a later `now` than the client did, so it can only accept what the client already accepted, never newly reject it. Cap the collateral. collateral_return_lovelace is derived from the datum size, and the datum carries reference_key and reference_signature verbatim - each allowed up to MAX_MASUMI_COSE_BYTES. A real lock is a ~450-byte datum needing at most ~3.7 ADA; padding the COSE fields toward the ledger's transaction limit pushes the buyer's own locked collateral past 50 ADA. The client now refuses a collateral above a configurable ceiling before it signs, rather than locking the funds away until submit_result_time. * fix(cardano): address CodeRabbit review findings Reject Masumi `auto` settlement against a facilitator that advertises only Hydra. This scheme authenticates L1 exclusively - verifyMasumiLock refuses a Hydra payload outright - so treating a Hydra-only advertisement as satisfying `auto` served a 402 whose every payment fails at verification. An explicit `hydra` policy still defers to the advertisement, so a subclass that does implement Hydra is unaffected. Re-check the clock-relative issue policy after `signTerms` resolves. Signing is asynchronous and unbounded - a hardware wallet, a remote signer or a human approval can take minutes - so a 402 could be served with a `payByTime` that expired while it was being signed. The second pass reads this function's own `terms` and `requirements` rather than `input`, so a caller mutating its argument mid-flight cannot steer it. The `maxTimeoutSeconds` ceiling is deliberately not the trigger: it moves forward with the clock and cannot newly fail. Skip the issue policy only for the literal boolean `true`, so a truthy non-boolean arriving from untyped configuration cannot silently disable a security check. Let the issuer configure its deadline horizon instead of always using the constant, mirroring the buyer-side option. Compute the test fixture's deadlines when each case runs rather than at module load. `payByTime` has only a minute of slack inside `maxTimeoutSeconds`, so a slow suite would have started failing on timing alone. * fix(cardano): make the deadline horizon buyer policy, not a verifier rule The horizon check ran on every path through verifyMasumiAuthorization, but only the client could configure it - the facilitator never sets maxDeadlineHorizonMs, so it was pinned to the 30-day default. A client whose operator raised the horizon to accept a long-settlement counterparty would sign and broadcast a lock the facilitator then rejected, stranding the funds the check exists to protect. The horizon is a judgement about how long the payer will accept its own funds being immobilised, so the payer is the side that makes it. It now applies only when a caller supplies one: the client always does, defaulting to the constant, and a verifier does not. Once the funds are locked, rejecting the payment for a distant deadline unfreezes nothing anyway - it only adds a failed settlement to a lock the buyer already chose to make. The interval rule is a protocol rule and still applies everywhere. Also correct the assertMasumiIssueWindow doc: it claimed the post-signing pass guards against drifting outside maxTimeoutSeconds, which it cannot. That ceiling is `now + maxTimeoutSeconds` and moves forward with the clock, so a payByTime once inside it stays inside it. Only the floors can trip late, which is what the second pass is for. * docs: updated docs to latest changes * feat: added areFeesSponsored optional flag * feat(cardano): declare payment flows and default assets Upstream now requires every server scheme to declare paymentFlows and defaultAssetTransferMethod, and clients to expose findDefaultAsset so spend controls can recognise USD-pegged assets. All Cardano asset transfer methods use the authorization flow; USDM is the default asset on mainnet/preprod and lovelace is deliberately not listed (not USD-pegged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(cardano): align integration suite with client spend controls Offline flows pay lovelace and USDM above the default cap, so they opt out like the e2e harness; the USDM flow now runs under default spend controls to prove findDefaultAsset recognises it, and lovelace is asserted rejected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(e2e): port Cardano to the catalog-driven harness Cardano routes (default, masumi, script) move into mechanisms_cardano.json with scheme registration in the shared TS server/client/facilitator modules. The catalog gains a static price.extra (nested script descriptors and confirmation policy) and a route-level payTo (script address). Masumi offers are one-shot, so the route issues a fresh offer per unpaid request through dynamic payTo/price instead of framework middleware. The facilitator client timeout is raised for ~20s Cardano blocks and the harness waits for Blockfrost to reflect each settlement before reusing the payer wallet. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(cardano): payment flow, default assets and example store State that every Cardano asset transfer method uses the authorization flow, document USDM as the default asset (lovelace intentionally excluded), and give the advanced server example the operation store the scheme requires. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(changeset): cover core/http adapter changes and Cardano defaults Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): keep Cardano Masumi offer state across route-config rebuilds The Next e2e server builds the withX402 route config per request, so the one-shot offer and its rotation guard must live outside the closure. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): resolve Cardano Masumi offers per request and by quoted nonce A shared single-slot offer let an unpaid request between a buyer's 402 and paid retry swap the offer under them. Cache the resolved offer per request context and look paid retries up by terms.sellerNonce in a bounded map. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(cardano): cover getAssetDecimals and ticker-suffixed money parsing Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(e2e): drop stale build artifacts from pre-refactor e2e dirs Upstream's e2e refactor removed these directories and moved the gitignore rules to the new paths, so the leftover Go binaries and Next build info slipped into the tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: trim PR to the changes the Cardano mechanism needs Drop the unrelated cash-mock fix, the monorepo-wide ws/picomatch/undici overrides (resolution is unchanged without them), an import reorder and an EOF-newline change; give the publish workflow upstream's repository guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(e2e): keep Cardano off the MCP surface Cardano binds a payment to a stable HTTP request adapter for replay protection, which the MCP transport does not provide, so its payments would abort 503 there. The MCP components declare the narrowing, and the Masumi accepts no longer assume a request context (MCP builds requirements once at startup with none). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(cardano): revert core HTTP replay, keep the Masumi handshake in-scheme Per review: a mechanism must not extend @x402/core or the HTTP adapters. Restores x402Client, mechanisms types, both resource servers and the express/fastify/hono/next adapters to upstream, dropping getRawBody, resource matching, skipHandler status/headers/raw replay and abort statuses. The Masumi guarantee those existed for now lives in the scheme, keyed off the payment rather than the HTTP request: MasumiTermsStorage (modeled on batch-settlement's ChannelStorage, with an in-memory default) records every issued 402 under its termsDigest, and onAfterVerify holds the paid retry to that exact quote and CAS-binds the first transaction to claim it. Concurrent buyers therefore keep their own offers. default and script need no storage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(cardano): satisfy lint after the replay revert Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: fixing e2e tests * chore: removed unnused files * chore: changed linting * chore: removed unnused files * chore: removing further unneeded code * chore: incorporated feedback and merged upstream main * chore: updates --------- Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com> Co-authored-by: Kammerlo <thomas.kammerlocher@cardanofoundation.org> Co-authored-by: maxalexweber1 <max@maxalexweber.de> Co-authored-by: Thomas Kammerlocher <th.kammerlocher@gmail.com> Co-authored-by: Notorious D.E.V. <notoriousd3v@gmail.com> Co-authored-by: phdargen <p.dargent@cern.ch> Co-authored-by: Peter Swierzy <123735851+piotrswierzy@users.noreply.github.com> Co-authored-by: Ryan R. Fox <ryanRfox@users.noreply.github.com> Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> Co-authored-by: Anil Chinchawale <anil24593@gmail.com> Co-authored-by: Aisling Cahill <aislingcahill10@gmail.com> Co-authored-by: aisling404 <211950534+aisling404@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: wonjoon <39115630+wnjoon@users.noreply.github.com> Co-authored-by: Kaly Node <53391581+samsamtrum@users.noreply.github.com> Co-authored-by: Carson Roscoe <CarsonRoscoe7@gmail.com> Co-authored-by: Dominik <39583330+skyc1e@users.noreply.github.com> Co-authored-by: Daniil Okhlopkov <5613295+ohld@users.noreply.github.com> Co-authored-by: scaler <240590331+sc4l3r@users.noreply.github.com> Co-authored-by: go165 <gaishibai@gmail.com> Co-authored-by: go165 <196723798+go165@users.noreply.github.com> Co-authored-by: phdargen <pdargent@icloud.com> Co-authored-by: Sandro Schaier <80533393+schaier-io@users.noreply.github.com>
* Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/exact.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…no sdk followups (#3430) * feat(mcp,ts): use accept's maxTimeoutSeconds for tool timeout * fix tests * fix ci * fix ci * fix ci * fix ci
…hecks (#3440) * test(python): add routeTemplate double-encoding regression tests Port the TypeScript #3213 cases that a single unquote pass misses: double- and triple-encoded traversal, double-encoded scheme injection, a legitimate cafe segment, and encoding deeper than the decode budget. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * fix(python): decode routeTemplate to a fixed point before traversal checks _is_valid_route_template decoded a routeTemplate with a single unquote pass before checking for ".." (traversal) and "://" (scheme injection). _ROUTE_TEMPLATE_RE explicitly allows "%", so a double percent-encoded payload (%252e%252e, %253a%252f%252f, ...) survives one decode still percent-encoded. The substring checks never see the traversal or injection content, and the function incorrectly returns true. A single extra decode pass would only close the double-encoded case. _fully_decode_route_template decodes repeatedly until a fixed point is reached or a bounded pass budget (5) is exhausted, then runs the existing checks against that canonical form. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * chore(python): add towncrier fragment for routeTemplate decode fix Co-authored-by: phdargen <phdargen@users.noreply.github.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com>
#3441) * test(go): add routeTemplate double-encoding regression tests Single-pass PathUnescape lets %252e%252e slip past traversal checks. These cases lock the intended reject behavior before the decode loop. Co-authored-by: phdargen <phdargen@users.noreply.github.com> * fix(go): decode routeTemplate to a fixed point before traversal checks isValidRouteTemplate used one PathUnescape pass, so double- and deeper- encoded payloads stayed percent-encoded and bypassed .. and :// checks. Decode until a fixed point or a 5-pass budget, matching TypeScript #3213. Co-authored-by: phdargen <phdargen@users.noreply.github.com> --------- Co-authored-by: phdargen <phdargen@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
19 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Tests
Checklist