Release 0.7.2: mppx 0.13.5, viem 2.57.7, incur 0.7.1, Solana programs

.github/dependabot.yml

@@ -16,11 +16,6 @@ updates:
       minor-patch:
         update-types: ["minor", "patch"]
     ignore:
-      # eslint 10 defaults churn lint org-wide; upgrade is a deliberate cross-repo pass (2026-07-08)
-      - dependency-name: "eslint"
-        update-types: ["version-update:semver-major"]
-      - dependency-name: "@eslint/js"
-        update-types: ["version-update:semver-major"]
       # TS majors are a deliberate org-wide pass, not a routine bump
       - dependency-name: "typescript"
         update-types: ["version-update:semver-major"]

.github/workflows/publish.yml

@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: "24"
+          node-version: "26"
           registry-url: "https://registry.npmjs.org"
 
       - name: Set version from tag

eslint.config.mjs

@@ -1,6 +1,6 @@
 import js from '@eslint/js';
 import { defineConfig, globalIgnores } from 'eslint/config';
-import importPlugin from 'eslint-plugin-import';
+import importPlugin from 'eslint-plugin-import-x';
 import unusedImports from 'eslint-plugin-unused-imports';
 import tseslint from 'typescript-eslint';
 

lefthook.yml

@@ -3,9 +3,9 @@
 # `bunx <tool>` resolves the tool independently of this project, so it can fetch
 # a different major and then fail, or pass, for reasons that have nothing to do
 # with the code being checked. That is not hypothetical here: this repo
-# deliberately holds eslint at 9 and TypeScript at 6 while 10 and 7 are
-# published, so `bunx eslint` and `bunx tsc` would pull exactly the majors the
-# manifest pins away from. `bunx` also writes to the lockfile as a side effect.
+# deliberately holds TypeScript at 6 while 7 is published, so `bunx tsc`
+# would pull exactly the major the manifest pins away from. `bunx` also writes
+# to the lockfile as a side effect.
 #
 # A bare `tsc --noEmit` has a second problem: it judges the current source
 # against whatever build output is lying around, so it goes through the pinned

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-score/pay",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "CLI wallet for one-shell-command agent payments across x402 (Base) and MPP (Tempo, Solana)",
   "type": "module",
   "main": "./dist/index.js",
@@ -61,42 +61,38 @@
     "@agent-score/sdk": "^2.9.1",
     "@clack/prompts": "^1.8.1",
     "@scure/bip39": "^2.4.0",
-    "@solana-program/system": "^0.15.0",
-    "@solana-program/token": "^0.17.0",
-    "@solana/kit": "^8.4.0",
+    "@solana-program/system": "^0.16.0",
+    "@solana-program/token": "^0.18.0",
+    "@solana/kit": "^8.5.0",
     "@solana/mpp": "^0.7.0",
     "@x402/core": "2.28.0",
     "@x402/evm": "2.28.0",
     "@x402/fetch": "2.28.0",
     "ed25519-hd-key": "^2.0.0",
-    "incur": "0.7.0",
-    "mppx": "0.13.4",
+    "incur": "0.7.1",
+    "mppx": "0.13.5",
     "qrcode-terminal": "^0.12.0",
-    "viem": "2.57.4"
+    "viem": "2.57.7"
   },
   "devDependencies": {
-    "@eslint/js": "^9.39.5",
+    "@eslint/js": "^10.0.1",
     "@types/node": "^26.6.5",
     "@types/qrcode-terminal": "^0.12.2",
-    "@vitest/coverage-v8": "^5.0.3",
-    "dotenv": "^18.0.7",
-    "eslint": "^9.39.5",
-    "eslint-plugin-import": "^2.32.0",
+    "@vitest/coverage-v8": "^5.0.5",
+    "dotenv": "^18.0.8",
+    "eslint": "^10.13.0",
+    "eslint-plugin-import-x": "^4.17.1",
     "eslint-plugin-unused-imports": "^4.4.1",
     "knip": "^6.41.0",
-    "lefthook": "^2.2.1",
-    "tsup": "^8.5.1",
-    "tsx": "^4.23.13",
+    "lefthook": "^2.2.2",
+    "tsup": "^9.0.0",
+    "tsx": "^4.23.15",
     "typescript": "^6.0.3",
-    "typescript-eslint": "^8.71.1",
-    "vitest": "^5.0.3"
+    "typescript-eslint": "^8.71.2",
+    "vitest": "^5.0.5"
   },
   "overrides": {
-    "esbuild": "^0.28.1",
-    "viem": "2.57.4"
+    "viem": "2.57.7"
   },
-  "packageManager": "bun@1.4.3",
-  "patchedDependencies": {
-    "incur@0.7.0": "patches/incur@0.7.0.patch"
-  }
+  "packageManager": "bun@1.4.3"
 }

src/commands/discover.ts

@@ -140,7 +140,7 @@ async function fetchWithTimeout(url: string, label: string): Promise<unknown> {
     return await res.json();
   } catch (err: unknown) {
     if (controller.signal.aborted) {
-      throw new Error(`${label} request timed out after ${FETCH_TIMEOUT_MS / 1000}s`);
+      throw new Error(`${label} request timed out after ${FETCH_TIMEOUT_MS / 1000}s`, { cause: err });
     }
     throw err;
   } finally {

src/onramp.ts

@@ -123,7 +123,7 @@ export async function createOnrampSession(input: CreateOnrampSessionInput): Prom
         stripe_request_id?: string;
       };
     }
-    let parsed: ParsedError | null = null;
+    let parsed: ParsedError | null;
     try { parsed = text ? (JSON.parse(text) as ParsedError) : null; } catch { parsed = null; }
     throw new OnrampApiError(
       parsed?.error?.code ?? 'http_error',
@@ -170,7 +170,7 @@ export async function getOnrampQuote(input: CreateOnrampQuoteInput): Promise<Onr
         stripe_request_id?: string;
       };
     }
-    let parsed: ParsedError | null = null;
+    let parsed: ParsedError | null;
     try { parsed = text ? (JSON.parse(text) as ParsedError) : null; } catch { parsed = null; }
     throw new OnrampApiError(
       parsed?.error?.code ?? 'http_error',

src/passport/auth.ts

@@ -198,7 +198,7 @@ export async function refreshAccessToken(input: RefreshAccessTokenInput): Promis
 
   const body = await response.text();
   if (!response.ok) {
-    let parsed: { error?: { code?: string; message?: string } } | null = null;
+    let parsed: { error?: { code?: string; message?: string } } | null;
     try {
       parsed = body ? JSON.parse(body) : null;
     } catch {
@@ -249,7 +249,7 @@ async function mintPublicSession(input: {
   });
   const body = await response.text();
   if (!response.ok) {
-    let parsed: { error?: { code?: string; message?: string } } | null = null;
+    let parsed: { error?: { code?: string; message?: string } } | null;
     try {
       parsed = body ? JSON.parse(body) : null;
     } catch {
@@ -291,7 +291,7 @@ async function pollPublicSession(input: {
   );
   const body = await response.text();
   if (!response.ok) {
-    let parsed: { error?: { code?: string; message?: string } } | null = null;
+    let parsed: { error?: { code?: string; message?: string } } | null;
     try {
       parsed = body ? JSON.parse(body) : null;
     } catch {

src/quotes.ts

@@ -106,9 +106,7 @@ export function parseBody(body: unknown, headers?: Headers): ParsedRails {
   if (Array.isArray(record.accepted_methods)) {
     const amountUsd = Number((record.amount_usd as string | undefined) ?? '0');
     for (const m of record.accepted_methods as MppAccept[]) {
-      let chain: Chain | null = null;
-      if (m.method?.startsWith('tempo/')) chain = 'tempo';
-      else chain = chainFromNetworkId(m.network);
+      const chain: Chain | null = m.method?.startsWith('tempo/') ? 'tempo' : chainFromNetworkId(m.network);
       if (!chain) {
         unsupported.push({
           protocol: 'mpp',