chore: merge upstream - #26
Merged
Merged
Conversation
* feat(ts): implement settlement-pending behavior in facilitator * feat(ts): implement settlement-pending behavior in server * feat(ts): add tests * feat(go): implement settlement-pending behavior in facilitator * feat(go): implement settlement-pending behavior in server * feat(go): add tests * feat(py): implement settlement-pending behavior in facilitator * feat(py): implement settlement-pending behavior in server * feat(py): add tests * feat: pr cleanup * feat: more pr cleanup * fix: address pr review feedback * fix: py format * chore: sync e2e Python lockfiles to x402 2.20.0 Update editable x402 version metadata in e2e uv.lock files after the python package bump on this branch. Co-authored-by: Cursor <cursoragent@cursor.com> * fix: address settlement-pending PR review feedback Distinguish terminal onchain confirmation failures from confirm-timeouts (TransactionOnchainFailureError) across SVM exact/upto settle paths so only timeouts stay settlement_pending; terminal failures now clear both caches and return transaction_failed. Run verifyPostSettlement during smart-wallet pending-settlement reconciliation to keep TOCTOU coverage on retries. Key upto deposit pending-settlement entries by transaction message hash (like exact) instead of channelId alone. Fall back to an optimistic channelState snapshot in batch-settlement deposit reconciliation when the post-confirm read fails, per spec. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* update auth-capture spec * sync vs async * improve backward compat * spec review 2 * refinements * clarify facilitator captureAuthorizer
…#3240) * update spec * add upfront to evm/svm * add other networks * add go * add upfront to py
* Update docs/schemes/overview.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/exact.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/exact.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…let support (x402-foundation#3263) * verify without feePayer signature * wire into e2e * fix e2e * align error codes * pr feedback
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* feat(evm): add Upto-only deployment entrypoint * docs(evm): clarify deployment signer naming
* fix(evm): restore x402UptoPermit2Proxy canonical deployment address * fix: upto init code used in vanity miner
* fix slot sync * align go * pr feedback
…3277) * Update docs/schemes/upto.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/schemes/upto.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* feat(ts/go): auth-capture client v1.1 * change to main v1.1 * fix tests
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…x402-foundation#3228) createE2EClient() derived EVM and SVM signers unconditionally at the top of the function, ahead of any --families scoping, while every other family below it (Aptos, Hedera, Keeta, Stellar, AVM, TVM, Near, XRPL) already only derives when its own CLIENT_* credential is set. A single-family run against a non-EVM/SVM network crashed here regardless of --families, unless unrelated EVM/SVM credentials happened to be set too. Made EVM and SVM signer derivation conditional on their own CLIENT_EVM_PRIVATE_KEY/CLIENT_SVM_PRIVATE_KEY, matching the pattern every other family already follows. batchSettlementScheme (EVM-only) is now BatchSettlementEvmScheme | undefined; runClientScenario throws a clear config error if EVM_BATCH_SETTLEMENT_PHASE is set without EVM creds, instead of a bare "Cannot read properties of undefined" once the refund path is actually reached. Second, separate gap: the harness's own preflight validation only ever checked facilitator env vars (uniqueFacilitators), printing "All required environment variables are present" without having looked at client env at all. A family-scoped run could pass that check cleanly and still crash deep inside a client for exactly this reason. Extended the same validation loop to also cover uniqueClients against each client's own catalog-declared config.environment.required. Verified with real code run, not just reasoning: built the full typescript workspace and called the actual createE2EClient() under five scenarios (no client creds, EVM-only, SVM-only using a real generated Ed25519 keypair, both, and the batch-settlement-without-EVM guard), all passing, including the exact reported crash scenario. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
…ion#3282) * fix(go): use maxTimeoutSeconds for EIP-3009 validBefore * update changelog
…n#3233) * feat(python): make facilitator gas limit configurable Facilitators need an explicit gas cap that can accommodate different settlement calls without modifying SDK internals. * chore(python): name changelog fragment for PR x402-foundation#3233 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> --------- Co-authored-by: ni <243717149+nniiovoo@users.noreply.github.com> Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
…402-foundation#3067) §8 was carried over from x402-specification-v1.md and only partly updated — x402-foundation#2094 replaced the `metadata` table row with `extensions` while syncing bazaar discovery across the SDKs, leaving the rest describing the v1 shape. Producers and consumers already agree, so nothing fails today: all six reference facilitators emit an ISO 8601 `lastUpdated` and all three SDK clients declare it a string. Only the document is outside that agreement — fed the 8.1 example, the Go client would fail to unmarshal. The live catalog matches across 2,000 sampled entries including all 12 v1-versioned items, so the example item's `x402Version: 1` does not justify the v1-shaped fields either. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* e2e: check wallet funds * fix near
* fix(e2e): startup validation * fix scenario selection * add changeset
…dation#3315) * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/builder-code.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/extensions/bazaar.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…n#3278) Align TypeScript HTTPFacilitatorClient with Python x402-foundation#3306: decode EXTENSION-RESPONSES into VerifyResponse/SettleResponse.extensionResponses (server-internal) instead of merging into extensions. encodePaymentResponseHeader strips extensionResponses so it never leaks to buyers via PAYMENT-RESPONSE. Fixes x402-foundation#3270. Majority of this change was drafted by an AI agent under human direction and is intended for human review before merge (CONTRIBUTING AI-assisted).
…#3051) * fix(core): throw when no scheme server is registered buildPaymentRequirements() logged a console.warn and resolved with an empty array when no scheme server matched the requested scheme/network, so callers relying on a thrown error built a 402 response with an empty accepts list instead of failing. It now throws, matching the adjacent guard for an unsupported facilitator scheme/network. Closes x402-foundation#2760 Co-authored-by: Cursor <cursoragent@cursor.com> * fix(http): register scheme servers in routing tests The throw added in the previous commit surfaced as a 500 in the express, fastify, hono and next routing tests. Each built an x402ResourceServer without registering a scheme server and relied on the former empty accepts array to still reach a 402. Register the exact scheme and a stub facilitator in those tests so they assert a real 402 rather than an under-configured server, and raise the changeset for @x402/core from patch to major: a call that previously resolved with an empty array now rejects, which is breaking for callers. Co-authored-by: Cursor <cursoragent@cursor.com> * Update typescript/.changeset/resource-server-throw-on-unregistered-scheme.md Co-authored-by: phdargen <pdargent@icloud.com> * test(http): register payment flows in middleware test scheme servers Upstream main added construct-time route validation (x402HTTPResourceServer.validateRouteConfiguration) that requires every registered scheme server to declare defaultAssetTransferMethod and a paymentFlows table. The middleware test stubs only implemented parsePrice/enhancePaymentRequirements, so after merging main the constructor threw and 21 tests across express, fastify, hono and next failed. Also registers the exact scheme in the express and hono encodedPathBypass tests, which still relied on the lenient no-scheme-registered path that this PR removes from core. * chore: trigger CI after signing key update --------- Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: phdargen <pdargent@icloud.com>
…foundation#3089) * docs(ts/mcp): update README to reflect current API and payment flow - Rename createX402MCPClient to createx402MCPClient - Update MCP SDK limitation section for structuredContent format - Update PaymentWrapperConfig to new accepts-based schema - Remove X402MCPServerConfig table and server hooks section Co-Authored-By: CatDesk * docs(ts/mcp): add supported PaymentRequired shapes table Co-Authored-By: CatDesk
…ion#3327) * fix(e2e): fall back to devnet RPC when SVM_TESTNET_RPC_URL is unset CI exported an empty SVM_RPC_URL when the secret was missing, which made swig-setup construct a WebSocket with an invalid URL. Treat blank RPC env as unset and only forward a custom URL from the workflow when one is set. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(e2e): use HTTP-only RPC for swig-setup transaction confirmation Replace sendAndConfirmTransactionFactory (WebSocket subscriptions) with sendTransaction plus getSignatureStatuses polling, matching the v2 SVM facilitator. Avoids deriving a WS URL from the HTTP RPC endpoint. Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…foundation#3335) * fix: replace crypto dependency with @noble/hashes in @x402/svm * fix: example/e2e locks
* docs: add builder-code hardening plan * fix(go): validate builder-code app attribution * chore: exclude local hardening plan * fix(go): normalize builder-code attribution values * fix(go): align builder-code attribution validation * test(go): cover v1 attribution boundaries
* docs(facilitators): list FTP Canton Facilitator * docs(facilitators): point FTP Canton entry to the landing page
Merges fork/main (38 commits, aeb0fdd..b0febf2) into chore/merge-upstream-02-09-26. One content conflict, in e2e/README.md: resolved as a union, keeping upstream's expanded "Swig smart wallet" custom-flow row alongside the fork's "Cardano one-shot Masumi offer" row. pnpm-lock.yaml in typescript/, e2e/ and examples/typescript/ was regenerated with `pnpm install --lockfile-only` rather than trusting git's textual auto-merge; all three came back identical, confirming the auto-merge was sound. Notable upstream changes absorbed: - @x402/core major: buildPaymentRequirements() now throws when no scheme server is registered (x402-foundation#3051), plus construct-time scheme-server validation. Cardano's exact scheme server already declares defaultAssetTransferMethod and paymentFlows, so it satisfies both. - settlement_pending auto-recovery (x402-foundation#3214) is gated on errorReason === "settlement_pending", which the Cardano mechanism never emits; inert on Cardano paths. - e2e catalog routes gained an optional `paymentFlow`; Cardano routes deliberately omit it and default to "authorization". Verified: pnpm build 29/29 tasks, pnpm test 57/57 tasks (@x402/cardano 15 files / 279 tests green). pnpm test:integration not run - it requires funded testnet credentials. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NPHLrW8uFSboEEo7nH8L7Y
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Tests
Checklist