[vvillait88]

Summary

Maintenance sweep. Moves the coupled settle set together with node-commerce and the storefronts: mppx 0.16.0 to 0.17.0, viem 2.57.13 to 2.57.14 (dependency and override), @solana/kit ^8.5.0 to ^8.6.0. Dev bumps: @types/node, eslint, knip. Version 0.7.6 to 0.7.7. Requested by Varun as part of the weekly sweep.

What mppx 0.17.0 changes on our path (read from the dist diff, 24 files):

• The Tempo zero-amount proof EIP-712 domain is still version 3 (dist/tempo/internal/proof.js), so agent and verifier stay compatible.
• A fee-sponsored Tempo charge now needs at least 15 seconds of remaining validity: the client refuses to sign a challenge expiring sooner, and the server refuses to issue one. This changes nothing for us: it applies only to fee-sponsored charges, and node-commerce's registerTempo configures no fee payer.
• The client now ignores a 402 whose WWW-Authenticate carries no Payment scheme (for example an x402-only 402), leaving it to the other protocol.
• Composed routes may now carry several offers with the same payment-stage identity verifiers. We use none.

Adds a version-scoped OSV entry for minimatch 10.2.6 (GHSA-g3hv-75wg-m249, published 2026-10-30): the fix is only in 11.0.1, every lint parent still caps it at ^10, and it is not in the published package or binary. Expires 2027-01-31.

Not taken: TypeScript 7 (held, typescript-eslint still peers <6.1.0).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Ran locally: osv-scanner with the repo config reports no issues across 609 packages; lint, typecheck, knip, test (547 passed) and build all exit 0. Compiled the darwin-arm64 binary: --version reports 0.7.7, and an --mcp initialize plus tools/list handshake against the binary returns serverInfo 0.7.7 and the tool list. The live settle on Base, Tempo and Solana runs once node-commerce and the FullEnrich store are on the same set, and its result is recorded here.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code

[vvillait88]

Review: settle set and dev bumps, 0.7.7

Verdict: safe to merge and release as 0.7.7. I found no defects. One rationale in the body should be corrected; it does not block.

The mppx 0.16.0 to 0.17.0 dist diff (I read it myself)

I unpacked both releases with npm pack. 24 files differ under dist, 15 of them .js. The peerDependencies and dependencies are identical (viem >=2.57.1), and ProofRealm.js is unchanged, so the 0.16 realm rule in the holds entry carries over as it was.

• Proof domain: dist/tempo/internal/proof.js line 20 reads { name: 'MPP', version: '3', chainId } in both releases, so the verifier and the agent stay compatible across the set.
• The 15 second minimum: defaults.minRemainingValiditySeconds = 15. It applies only to fee-sponsored charges.
  • The client checks it twice, through assertSponsorable() before preparation and again before signing. It returns early unless methodDetails.feePayer === true.
  • The server checks it when issuing a challenge, only when a fee payer is configured, the amount is above 0, and pull mode applies.
  • The client's validBefore window is now the named constant validityWindowSeconds = 25, the same value as before.
• Non-Payment 402s: in client/internal/protocols/Mpp.js, the client now passes over any 402 whose WWW-Authenticate has no Payment scheme (Challenge.hasPaymentScheme).
  • Before this release, any WWW-Authenticate header was enough to engage it.
  • pay picks its protocol from its own parse of the 402 (chain === 'base' ? 'x402' : 'mpp' in src/commands/pay.ts), so mppx only ever sees responses that pay has already routed to MPP.
• Identity: a composed route may now carry several payment-stage identity offers that share one nonce. The client prover splits into retry and prepare. Neither node-commerce nor pay uses mppx/identity or paymentVerifiers (I grepped both src trees), so this is inert for us.

Correct the body: it gives the reason the 15 second rule changes nothing as "our servers issue 5-minute challenges". The real reason is that no server of ours configures a Tempo fee payer. node-commerce's registerTempo in src/payment/mppx_server.ts passes only currency, recipient and testnet to tempo.charge, so our Tempo challenges are never sponsored and neither check ever runs. The conclusion is the same, but the reason matters for whichever store turns sponsorship on first.

Gates (worktree of 2970bd7, branched from current main 7bb21d3)

• bun install --frozen-lockfile: 0, with 334 packages
• lint 0, typecheck 0, knip 0, build 0
• test 0, with 547 passed and 2 skipped (52 files plus 1 skipped)
• The coupled set resolves as single copies: viem@2.57.14 and mppx@0.17.0 each appear once in the lock, and the override equals the dependency pin. There is one @solana/kit@8.6.0. @solana/mpp 0.7.0 peers @solana/kit >=6.10.0 and mppx >=0.5.5, and @solana-program/token 0.18.0 peers @solana/kit ^8.5.0, so no dual-kit copy exists.
• Compiled binary: bun run build:binary:darwin-arm64 exits 0 (1169 modules).
  • --version prints 0.7.7.
  • An --mcp stdio handshake against the compiled binary (initialize, then notifications/initialized, then tools/list) returns serverInfo {"name":"agentscore-pay","version":"0.7.7"} on protocol 2025-06-18.
  • It also returns the 4 progressive-discovery tools: search_tools, get_tool_details, call_read_tool, call_write_tool.
• Nothing else to take: bun outdated lists only typescript 7, which stays held because typescript-eslint 8.72.1 peers <6.1.0. npm view on all 30 dependencies and devDependencies shows every one at its latest, including x402 2.29.0, incur 0.7.1, @solana/mpp 0.7.0, @solana-program/system 0.16.0 and token 0.18.0.
• OSV entry: the minimatch entry is identical to node-sdk's, scoped to 10.2.6 with an expiry and a lift condition.
• CI: gh pr checks 150 exits 0, and all 9 rows pass, including ci, node-compat 22/24/26 and Dependency Scan.

For the live all-rails settle (not blocking here)

The diff does not change how the settle is run. These points help read it:

• Mixed versions are fine for proofs. The proof domain is still 3, so a pay 0.7.7 against a store on an older node-commerce verifies zero-amount proofs the same way.
• What the Tempo leg exercises: it settles unsponsored, so the 15 second check never runs. If the Tempo leg fails with "Sponsored challenge expires in less than 15 seconds", that store has a fee payer configured. Treat it as a finding about that store, not as an mppx regression.
• The 402 check is newly load-bearing. Before the Tempo and Solana legs, the existing agentscore-pay check (or --dry-run) on the FullEnrich route should show a Payment challenge in WWW-Authenticate. From 0.17 the client silently steps aside on a 402 that has no Payment challenge, rather than engaging, so confirm that header is present before reading a failure.

Release follow-through

After the tag publishes 0.7.7, FLEET_PAY_VERSION moves in both shared-mounts.config.mjs files, followed by sync-shared and derive-template.mjs --update-lock, per the releasing section of the runbook.

[vvillait88]

Live settle for the mppx 0.17.0 / viem 2.57.14 / @solana/kit 8.6.0 set, run 2026-11-02 against the FullEnrich store after it deployed node-commerce 3.1.8 with the same set (image tag a28be02), paid from the smoke wallet with pay 0.7.7.

The store's 402 carries a Payment challenge with realm="fullenrich.agentscore.com" (its hostname), which the 0.17 client requires.

Call	Rail	Protocol	Status	Charged
company/lookup (ungated)	Base	x402	200	0.02
company/lookup (ungated)	Tempo	MPP	200	0.02
company/lookup (ungated)	Solana	MPP	200	0.02
person/enrich/work-email (gated, Passport)	Base	x402	200, completed, result found	0.07
person/enrich/work-email (gated, Passport)	Solana	MPP	200, completed, result found	0.07

Balance deltas, read with agentscore-pay balance before and after: Base 1.530968 to 1.440968 (0.09), Solana 0.200000 to 0.110000 (0.09), Tempo 0.074189 to 0.054158 (0.02 plus a 0.000031 network fee). Each matches the prices paid exactly.

Not run: the gated call on Tempo. The Tempo balance (0.054 after the ungated call) is below its 0.07 price, so it waits on a top-up. The gated path itself settled on Base and Solana, and the ungated Tempo call exercised the Tempo charge path on 0.17.