fix(browser-wallet-example): atomic session consumption, payment bypass, chain enforcement on reconnect - #4
Open
osr21 wants to merge 570 commits into
Open
fix(browser-wallet-example): atomic session consumption, payment bypass, chain enforcement on reconnect#4osr21 wants to merge 570 commits into
osr21 wants to merge 570 commits into
Conversation
* feat: updated @x402/mcp to match updated spec * feat: updated to remove embdedded errors
…ng functions (x402-foundation#1025) Replace panic() calls with idiomatic Go error returns in the HTTP client and server encoding functions. This prevents application crashes from malformed input and follows Go best practices for error handling. Changes: - EncodePaymentSignatureHeader now returns (map[string]string, error) - encodePaymentRequiredHeader now returns (string, error) - encodePaymentResponseHeader now returns (string, error) - createHTTPResponseV2 now returns (*HTTPResponseInstructions, error) - createSettlementHeaders now returns (map[string]string, error) - Updated all call sites with proper error handling - Updated unit tests and integration tests accordingly
* feat: improved MCP SDK interfaces * feat: added mcp server example, mcp client example, and mcp client chatbot example * fix: lint
…#1060) Signed-off-by: logiccrafterdz <logiccrafterdz@gmail.com>
…) (x402-foundation#1085) * fix: improve error messages for insufficient funds (x402-foundation#909) - Add detailed error messages for insufficient funds in EVM mechanisms - Include required vs available balance in error messages - Suggest next steps for users (add funds to wallet) - Updated 3 EVM facilitator implementations: - exact/v1/facilitator/scheme.ts - exact/facilitator/permit2.ts - exact/facilitator/eip3009.ts - All tests passing * chore: add changeset for insufficient funds fix --------- Co-authored-by: 0xAxiom <0xAxiom@users.noreply.github.com>
* feat(extensions): add payment-identifier types and schema Add core type definitions and JSON Schema for the payment-identifier extension which enables client-provided idempotency keys. - PAYMENT_IDENTIFIER constant and length constraints - PaymentIdentifierInfo, PaymentIdentifierExtension interfaces - PaymentIdentifierDeclaration for server-side use - JSON Schema Draft 2020-12 compliant schema * feat(extensions): add payment-identifier utility functions Add utility functions for generating and validating payment identifiers. - generatePaymentId(): creates UUID v4 with optional prefix - isValidPaymentId(): validates ID format (16-128 chars, alphanumeric/hyphens/underscores) * feat(extensions): add payment-identifier client helper Add createPaymentIdentifierPayload() for clients to include idempotency keys in their PaymentPayload.extensions. - Auto-generates ID if not provided - Validates custom IDs before use - Returns extension object ready for PaymentPayload * feat(extensions): add payment-identifier resource server support Add server-side functions for advertising payment-identifier support. - declarePaymentIdentifierExtension(): creates declaration for PaymentRequired - paymentIdentifierResourceServerExtension: ResourceServerExtension implementation * feat(extensions): add payment-identifier validation and extraction Add validation and extraction utilities for processing payment identifiers. - validatePaymentIdentifier(): validates extension structure and ID format - extractPaymentIdentifier(): extracts ID from PaymentPayload - extractAndValidatePaymentIdentifier(): combined extraction with validation - hasPaymentIdentifier(): checks for extension presence * feat(extensions): add payment-identifier barrel export Add index.ts with all public exports and usage documentation. * feat(extensions): export payment-identifier from package Update package exports and build configuration for payment-identifier. - Add ./payment-identifier export path to package.json - Add payment-identifier entry to tsup.config.ts - Re-export payment-identifier from main index.ts * test(extensions): add payment-identifier unit tests Add comprehensive test coverage for the payment-identifier extension. - Constants and type exports - ID generation (prefix, uniqueness, format) - ID validation (length, characters, edge cases) - Client payload creation - Server declaration - Extension validation - PaymentPayload extraction - 37 tests covering all functionality * Lint * feat: add required & refactor client logic to append to extensions * feat: added examples * fix: lint * fix: cleanup --------- Co-authored-by: CarsonRoscoe <carsonroscoe7@gmail.com>
* Add payment-identifier extension spec * feat: add required field --------- Co-authored-by: CarsonRoscoe <carsonroscoe7@gmail.com>
* feat: fix changesets config & backfill changeset fragments * feat: update package dependency relations * feat: update locks after e2e tests * chore: version typescript packages
* add guidelines for adding new chains * add new all_networks examples * fixes
* Update docs/sdk-features.md * Update docs/extensions/sign-in-with-x.mdx * Update docs/docs.json --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
Add MegaETH (chain ID 4326) with USDM as the default stablecoin. TypeScript, Go, and Python SDK support added. Changelog fragments included for all SDKs.
Validate x402 payment configurations with CLI, SDK, website, and Claude skill. Checks configs, addresses, networks, and amounts. Category: Infrastructure & Tooling Website: https://x402lint.com
…limits (x402-foundation#1094) During high-concurrency serverless cold starts, multiple instances may call getSupported() simultaneously, triggering 429 rate limits from the facilitator API. This causes RouteConfigurationError failures. This change adds exponential backoff retry (1s, 2s, 4s) on 429 errors, allowing temporary rate limits to resolve before failing.
* Update docs/sdk-features.md * Update docs/extensions/payment-identifier.mdx * Update docs/docs.json --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
x402-foundation#792) * feat: Implement exact payment scheme specification for Hedera HTS FT and HBAR token Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com> * docs: Update Hedera exact scheme specification to include amount transfer details and account alias handling- Added clarification on the field for HBAR and HTS fungible tokens.- Specified that the decompiled transaction must be a directly.- Introduced a section on account aliases and auto-account creation, outlining potential risks and facilitator options. Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com> --------- Signed-off-by: Piotr Swierzy <piotr.swierzy@blockydevs.com>
x402-foundation#1102) * feat(cloudfront-lambda-edge): Add CDP facilitator authentication and mainnet support - Add facilitator-auth.ts module with CDP authentication helpers for mainnet payments - Introduce FacilitatorType configuration to support both testnet and mainnet facilitators - Add getAuthHeaders() function in config.ts for dynamic authentication based on facilitator type - Update README with comprehensive mainnet setup instructions and CDP integration guide - Add Solana network configurations (Devnet and Mainnet) to supported networks list - Expand documentation with production secrets management best practices for Lambda@Edge - Reorganize config.ts to separate facilitator configuration from payment settings - Update tsconfig.json to support new authentication module compilation - Enhance middleware library structure with index.ts for better package organization - Add security warnings about Lambda@Edge environment variable limitations and AWS Secrets Manager recommendations * refactor(cloudfront-lambda-edge): Simplify facilitator auth and improve documentation - Remove dedicated facilitator-auth.ts module and integrate auth into config - Update README with clearer mainnet setup instructions using facilitator packages - Simplify config.ts to remove CDP-specific type and credentials - Refactor origin-request.ts and origin-response.ts to accept facilitatorConfig parameter - Update package.json dependencies and build configuration - Improve documentation structure with consolidated setup steps - Make facilitator authentication flexible by accepting custom createAuthHeaders function - Reduce complexity by removing hardcoded CDP authentication logic in favor of generic config approach * revert tsconfig.json * revert tsconfig
* fix: select payment requirements in MCP wrapper * fix: tests * feat: added changesets
* feat: added mcp submodule to go * feat: added unit tests * feat: added mcp client example * feat: added mcp server example * feat: added mcp client chatbot example * feat: go changelog * feat: pr feedback * fix: format * fix: lint
* feat: added MCP module in Python * feat: added tests * feat: added mcp client example * feat: added mcp server example * feat: mcp client chatbot example * feat: added changelog entry * fix: readme * feat: pr feedback
…R settlement (x402-foundation#1110) Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: KAMIYO <kamiyo-ai@users.noreply.github.com>
* feat: improved e2e suite * feat: normalize e2e server paths * feat: refactored path structure to /scheme/implementation/test format
* fix gin streaming * fix e2e and echo/nethttp FacilitatorResponseError
x402-foundation#1790) * Applied monkey-patch on reply.raw write operations and buffered response to prevent content leak from direct raw writes bypassing Fastify's onSend lifecycle * fix e2e tests
* feat(evm): add upto payment scheme TypeScript SDK Implement the upto payment scheme for EVM, enabling usage-based payments where a client authorizes a maximum amount via Permit2 and the server settles for the actual amount used (which may be less). Covers all three roles: - Client: creates Permit2 payloads with max authorized amount - Server: builds payment requirements, forces permit2 transfer method - Facilitator: verifies permitted >= required, settles actual usage, supports zero-settlement path for no-charge responses Key design decisions: - Permit2 only (no EIP-3009, per spec) - Shared Permit2 witness struct with exact scheme - Re-exports shared utilities from exact (approval helpers, extensions, RPC) - V2 protocol only Resolves: CDPAI-714 * chore(evm): add JSDoc descriptions and fix lint errors in upto SDK Add comprehensive JSDoc descriptions, @PARAM, and @returns tags to all upto scheme files to satisfy eslint jsdoc rules. Remove unused imports in facilitator test file. * refactor(evm): extract shared permit2 helpers to reduce duplication between exact and upto facilitators * refactor(evm): consolidate client-side createPermit2Payload into shared helper * refactor(evm): extract shared trySignEip2612Permit and trySignErc20Approval from scheme classes * refactor(evm): split shared/permit2-helpers into permit2.ts and extensions.ts * test(evm): add upto server, register, and types tests; expand client and facilitator coverage Add 3 new test files (server.test.ts, register.test.ts, types.test.ts) covering upto-specific server behaviors (permit2 forcing, facilitator address injection, price parsing), registration helpers for all three roles, and type guard validation. Expand existing client and facilitator tests with additional edge cases. Also includes in-progress source changes: shared permit2 helper refactoring, upto facilitator hardening, spec clarifications, and defaultAssets extraction. * fix(evm): resolve lint errors for CI — add missing JSDoc descriptions and fix unused vars * fix(evm): address PR review — align upto verify flow with exact, update spec, remove createEvmClient * refactor(evm): move shared utils to shared/, remove upto register pattern - Move validateErc20ApprovalForPayment to shared/erc20approval.ts (was in exact/facilitator/, used by both exact and upto) - Move RPC utilities to shared/rpc.ts, rename types to drop Exact prefix (EvmSchemeConfig, EvmSchemeOptions, etc.) with deprecated aliases - Remove registerUptoEvmScheme from client, facilitator, and server (v1 legacy pattern not needed for v2-only upto scheme) - Backward-compat re-exports preserved at original paths * test(e2e): add upto payment scheme e2e test coverage Add full e2e test suite for the upto payment scheme mirroring exact permit2 coverage: direct settle, EIP-2612 gas sponsoring, and ERC-20 approval gas sponsoring endpoints. - Add 3 upto endpoints to Express e2e server with UptoEvmScheme - Register UptoEvmScheme in TypeScript facilitator - Register UptoEvmClientScheme in fetch and axios e2e clients - Add upto Permit2 approve/revoke cycle handling in test runner - Add upto entry points to @x402/evm tsup.config.ts - Update test.config.json files for all components * fix(evm): harden upto type guard, add time window validation, improve settlement comments - Add validAfter check to isUptoPermit2Payload for stricter exact/upto discrimination - Add deadline > validAfter guard in client permit2 payload creation - Default simulateInSettle to true for settlement re-verification - Expand settlement re-verification comment for reviewer clarity - Add no-register.ts comments explaining V1 compat is not needed for upto - Clarify e2e test config description for upto endpoint - Add tests for validAfter type guard and buildUptoPermit2SettleArgs * feat: added SettlementOverride * fix: examples lock * feat: Added upto to hono/next e2e tests * feat: update upto tests * feat: update tests to support fallback facilitator for non-SDK parity testing * fix: format/lint * fix: add linting to upto example --------- Co-authored-by: Fabrice Cheng <fabrice.cheng@coinbase.com>
* feat: added BAZAAR-RESPONSE header to spec * feat: generalized header
…er (x402-foundation#1831) * fix(go): add omitempty to QueryInput/BodyInput.Method to prevent spurious enum validation failure When external JSON omits info.input.method (valid when method is not in the schema's required list), Go zero-initializes the Method field to "" and re-marshaling produces "method":"", which fails the enum constraint in ValidateDiscoveryExtension. Adding omitempty ensures absent method fields remain absent after round-trip serialization. Fixes x402-foundation#1830 Made-with: Cursor * enforce method is required in TS and Python discovery extension schemas Per spec, the method field must always be present in a discovery extension's info.input. Add "method" to the required array in schemas built by the TS and Python resource service builders, so ValidateDiscoveryExtension rejects extensions missing method with a clear error. Also reverts the Go omitempty workaround from the prior commit; the Go SDK was already producing a validation error for absent method (via the enum constraint), and the schema-level required enforcement is the correct fix. Closes x402-foundation#1830 Made-with: Cursor * style: format resourceService.ts type union per Prettier Made-with: Cursor * fix: auto-populate HTTP method from adapter in all SDKs The SDK entry points (processHTTPRequest, requiresPayment, processSettlement) now derive the HTTP method from the adapter when it is not explicitly set on the request context. This ensures direct x402HTTPResourceServer users do not need to manually assign the method field — the SDK computes it at runtime, matching the behavior middleware users already get. Made-with: Cursor * test: add declare → enrich → validate flow tests for bazaar extension Verify the real middleware path: extensions are declared without method, enrichDeclaration injects method from the HTTP context at request time, and the enriched extension passes schema validation. Covers GET and POST in all three SDKs (TypeScript, Go, Python). Made-with: Cursor
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…n#1812) * Fix race condition in lazy facilitator initialization for FastAPI and Flask middleware Under concurrent requests, multiple coroutines/threads could see init_done=False simultaneously and all call http_server.initialize(), causing redundant init calls and inconsistent error propagation. - FastAPI: guard with asyncio.Lock using double-checked locking pattern - Flask: guard with threading.Lock using double-checked locking pattern - Add concurrency tests proving single-flight initialization for both frameworks - Add tests verifying failed init does not permanently block retries Closes x402-foundation#1584 * fix: remove unused variables to pass ruff lint
* fix: e2e approve bug
* feat: remove new docstring addition
* fix: update Next.js e2e server to /exact/evm/... path structure
The `feat: add upto to typescript sdk` commit reverted proxy.ts and
test.config.json from the improved `/api/exact/evm/...` path structure
back to old `protected-*` paths, without recreating the deleted route
files. Fix this properly by:
- Update proxy.ts route keys and config.matcher to /exact/evm/... paths
- Update test.config.json to /exact/evm/... paths, preserving
coldstart: true on the two permit2 endpoints
- Add missing proxy route files at new paths:
exact/evm/eip3009/proxy, exact/evm/permit2/proxy,
exact/evm/permit2-eip2612GasSponsoring/proxy,
exact/evm/permit2-erc20ApprovalGasSponsoring/proxy,
exact/svm/proxy, exact/stellar/proxy, exact/aptos/proxy
Note: route files are in directories named "proxy" which matches a
root .gitignore pattern, so they are tracked with git add -f.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix: flatten non-EVM chain routes to /exact/{chain} base path
SVM, Aptos, and Stellar each have a single transfer mechanism with no
variants, so the /proxy sub-path is unnecessary. Move them to the base
level /exact/{chain} pattern, matching EVM's approach of only adding
sub-paths when there are multiple mechanisms or extensions to test.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: pr cleanup and review
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* feat: add upto to go sdk * feat: cleanup PR * feat: added HTTPTransportContext to Go SDK * fix: ai reviewer feedback * fix: typescript tests * fix: header parsing for HTTPTransportContext in Typescript * feat: cleanup pr * feat: pr cleanup * feat: pr review * feat: update e2e go.mod for upto debs * fix: lint
* fix: randomize facilitator signer selection * fix: test
* Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
* Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>
…foundation#1791) Add native USDC (0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359) as the default stablecoin for Polygon mainnet across all three SDKs: - Go: ChainIDPolygon constant, v2 NetworkConfigs, v1 NetworkConfigs - TypeScript: v2 stablecoins map in ExactEvmScheme - Python: v2 NETWORK_CONFIGS with supported_assets Update Go v1 unit tests that previously used "polygon" as a network without a default asset config. Replace with "iotex" and add positive test coverage for Polygon config and asset resolution. Contract details (verified on-chain via PolygonScan): - Token: Circle native USDC (FiatTokenV2_2) - EIP-712 domain: name="USD Coin", version="2" - EIP-3009: transferWithAuthorization supported - x402 proxy deployed at canonical CREATE2 address
…foundation#1834) * fix(mcp): preserve structuredContent in payment wrapper result createPaymentWrapper was reconstructing the tool result with only content/isError/_meta, dropping structuredContent. This causes MCP SDK output schema validation to fail with "Tool has an output schema but no structured content was provided" for any tool that defines an outputSchema. Fix: spread the full handler result instead of cherry-picking fields, so structuredContent and any future fields are preserved. Adds test verifying structuredContent survives the payment wrapper. * fix(mcp): drop result._meta spread to fix TS2698 The index signature on ToolResult makes _meta typed as unknown, which cannot be spread. The wrapper owns _meta exclusively so no merge is needed.
…n#1813) * Fix HTTPFacilitatorClient not following 308 redirects from facilitator The x402.org/facilitator/supported endpoint returns HTTP 308 before resolving to 200. HTTPFacilitatorClient did not normalize the base URL or explicitly request redirect following, causing syncFacilitatorOnStart to silently fail in some runtimes. When no supported payment kinds are loaded, the middleware passes all requests through as 200 instead of 402. - Strip trailing slashes from facilitator URL in constructor to prevent unnecessary 308 redirects from trailing-slash normalization - Explicitly set redirect: "follow" on all fetch calls (verify, settle, getSupported) for cross-runtime compatibility - Add tests for URL normalization and redirect option propagation Closes x402-foundation#1692 * fix: apply prettier formatting to httpFacilitatorClient test
…dation#1733) * test(python): add missing sync test scenarios to existing test_server.py Add edge case coverage for: missing/malformed _meta, no matching requirements, MCPToolResult direct return, non-dict handler return, structuredContent preservation, empty accepts validation, verification failure without reason, and hook context field verification. * fix: apply ruff format to test_server.py * fix formatting: match existing test style, inline data construction, fix import order
* fix: evm contract deploys * feat: updated constants in SDKs * feat: added changeset fragments
…ty with TypeScript SDK (x402-foundation#1808)
…oundation#1786) * feat(evm): add Stable testnet (chain ID 2201) network support * style(go): fix gofmt alignment for chain ID variable declarations * fix(python): remove supported_assets from Stable network configs * style(ts): reorder Stable configs above Polygon/Arbitrum in defaultAssets
* docs: add initial x402 foundation charter (x402-foundation#1911) * fix: settlement overrides for upto in typescript sdk (x402-foundation#1913) * feat: refactor coinbase/x402 references to x402-foundation/x402 (x402-foundation#1912) * feat: refactor coinbase/x402 references to x402-foundation/x402 * fix: format * chore: changeset fragments for typescript, python and go * chore: version typescript, python and go packages (x402-foundation#1915) * chore: version typescript packages * chore: version python package * chore: version go package * feat: updated pypi workflow to use trusted publishing (x402-foundation#1916) * docs(bazaar): clarify EXTENSION-RESPONSES header applies to verify and settle (x402-foundation#1922) Made-with: Cursor * feat: add self-facilitation example (x402-foundation#1942) * add self-facilitation example * fix: regenerate examples/typescript lockfile against public npm registry Lockfile had tarball URLs pointing to internal Coinbase Artifactory, causing pnpm install to fail with ENOTFOUND in CI where that host is unreachable. * feat: added upto to docs (x402-foundation#1961) * feat: add upto readme and client examples (x402-foundation#1963) * chore(extensions): migrate to @signinwithethereum/siwe (x402-foundation#1917) * Migrate to @signinwithethereum/siwe Migrate the SIWE dependency to the Ethereum Identity Foundation package. package.json now depends on @signinwithethereum/siwe; evm.ts import was updated to import SiweMessage from the new package. Added a changeset describing the migration. (pnpm lock updated to reflect the dependency change.) * Add siwe v4.1.0 entries to pnpm-lock Update examples/typescript/pnpm-lock.yaml to add @signinwithethereum/siwe@4.1.0 and @signinwithethereum/siwe-parser@4.1.0. Adds package resolutions and snapshot entries, registers peerDependencies (ethers and viem marked optional), and removes the older siwe@2.3.2 entry in the importer. This pins the example project to the siwe v4 parser/runtime and records its dependency graph in the lockfile. * feat(specs): add Keeta exact scheme (x402-foundation#1575) * feat(specs): add Keeta exact scheme * feat(schemes/keeta): add transaction simulation to verification step This adds a few cheap checks to simulate the transaction and catch invalid blocks early on to prevent the server from doing expensive work unnecessarily. * Add Echo framework documentation (x402-foundation#1783) * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * add fastify --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> Co-authored-by: Philippe d'Argent <p.dargent@cern.ch> * improve defaultAsset docs (x402-foundation#1983) * feat(bazaar): add MCP resource type support to Go SDK (x402-foundation#1967) * feat(bazaar): add MCP resource type support to Go SDK Add MCP tool discovery extensions to the bazaar package, achieving parity with the TypeScript and Python SDKs. Servers can now declare MCP tool discovery extensions alongside HTTP resources, and facilitators can detect and extract them from payment payloads. Co-Authored-By: Claude <noreply@anthropic.com> * fix: gofmt formatting and gocritic if-else-chain lint Co-Authored-By: Claude <noreply@anthropic.com> * fix(bazaar): transport enum, doc examples, inline helper, add negative tests - Fix transport schema enum to include both valid values (streamable-http, sse) instead of only the provided value, matching TypeScript SDK behavior - Fix doc.go examples to use bazaar.BAZAAR.Key() instead of bazaar.BAZAAR - Inline createMcpDiscoveryExtension into DeclareMcpDiscoveryExtension - Add negative validation tests for wrong type and empty toolName - Add edge case tests for whitespace-only toolName and invalid transport Co-Authored-By: Claude <noreply@anthropic.com> * feat(mcp): wire extensions into PaymentWrapper 402 response Add Extensions field to PaymentWrapperConfig and pass it through to the PaymentRequired struct in 402 responses. This brings the MCP payment wrapper to parity with the HTTP middleware's RouteConfig.Extensions support, enabling bazaar discovery extensions in MCP tool responses. - Add Extensions map to PaymentWrapperConfig (types.go) - Set extensions in paymentRequiredResult (server.go) - Add unit tests for extensions present/absent in 402 (server_test.go) - Declare bazaar MCP extension in E2E server (main.go) - Add bazaar extension integration test (mcp_evm_test.go) Co-Authored-By: Claude <noreply@anthropic.com> * feat(mcp): wire TS extensions into 402 responses + Go integration tests Add extensions support to the TS MCP PaymentWrapperConfig and pass it through to createPaymentRequiredResponse so bazaar discovery metadata appears in 402 responses. Wire the E2E server with declareDiscoveryExtension for the get_weather tool. Add Go mocked-transport integration tests (5 cases) covering the full client↔server payment flow to match TS mcp-payment-flow.test.ts coverage. Co-Authored-By: Claude <noreply@anthropic.com> * fix: prettier formatting in MCP test files Co-Authored-By: Claude <noreply@anthropic.com> * fix(bazaar): address PR review feedback from @CarsonRoscoe - Use strings.TrimSpace for toolName validation to reject whitespace-only names - Allow custom transport values through schema validation (only enum for known transports) - Fix whitespace toolName test to assert error instead of success - Remove conditional guard in TS bazaar extension test so assertions always run Co-Authored-By: Claude <noreply@anthropic.com> * fix(bazaar): allow custom transport values in TS to match Go behavior Widen transport type from "streamable-http" | "sse" to string, and only apply enum constraint in schema for known transport values. This matches the Go-side fix so custom transports pass validation in both languages. Co-Authored-By: Claude <noreply@anthropic.com> --------- Co-authored-by: Claude <noreply@anthropic.com> * Ecosystem page changes (x402-foundation#1992) * feat(avm): Add Algorand (AVM) blockchain exact spec implementation and networks support for Typescript (x402-foundation#1560) * Migrate all code from branch-algorand-v2-typescript-algokit * Update format and lint pass on core and examples * Reformat template files * Update: Coinbase review changes applied * Fix Paywall builder pattern * Update: Reverted e2e/legacy, Remove: src/exact/v1 and src/v1 * Add Faucets URLs to AVM README * Optimizing and shrinking PR * Remove dead import * Add optimization changes related unit tests * Update coinbase review changes applied * Update avm e2e, rebased to latest, linted and formatted * Fix avm template format * Remove python and Go AVM templates, Made AVM optional to facilitator and Add SERVER_ADDRESS * Lint and format * Update: made AVM optional in proxy.ts * Rebased and Replayed some commits * Reset e2e pnpm-lock.yaml * Replayed correct updated lockfiles * Reverted accidentally overwritten files during rebase replay * Revert accidental overwritten files in examples * fix(evm): restore Mezo Testnet default asset dropped in v2.9.0 refactor (x402-foundation#1920) * docs(examples): clarify facilitator signer roles (x402-foundation#1937) * fix(paywall): read token name from payment requirements instead of hardcoding USDC (x402-foundation#1973) The EVM paywall hardcodes "USDC" as the token label in all display text. The payment requirements already carry the token name in extra.name (populated by the server from the default asset registry), but the paywall ignores it. Read extra.name from the first payment requirement and use it for all user-facing token text. Falls back to "USDC" when extra.name is absent (backward compatible with EIP-3009 tokens). 5 display strings updated: - Header: "please pay $X {tokenName}" (was "USDC") - Testnet prompt: "Need {tokenName} on {chainName}?" (was "USDC") - Balance: "$X {tokenName}" (was "USDC") - Amount row: "$X {tokenName}" (was "USDC") - Error: "Make sure you have {tokenName} on {chainName}" (was "USDC") Regenerated Go, Python, and TS paywall templates. * docs(evm): complete default-asset chain list in Go EVM mechanism README (x402-foundation#1998) The Go EVM mechanism README (introduced in x402-foundation#1983) listed only 4 chains under "Networks with default assets configured": - Base Mainnet, Base Sepolia, MegaETH Mainnet, Monad Mainnet But `go/mechanisms/evm/constants.go` configures 10, and the main docs table at `docs/core-concepts/network-and-token-support.mdx` lists all 10. Restore parity with the constants and the main docs table, in the same order as the mdx table: - Base, Base Sepolia, Polygon, Arbitrum One, Arbitrum Sepolia, Monad, Stable, Stable Testnet, MegaETH, Mezo Testnet All entries verified against `NetworkConfigs` in `go/mechanisms/evm/constants.go`. Follow-up to x402-foundation#1983 which introduced this README. * docs(sellers): replace legacy Go import path in Echo example (x402-foundation#2009) * Add Ultravioleta DAO facilitator to ecosystem directory (x402-foundation#1780) - 19 mainnets across 7 blockchain families (EVM, Solana, Sui, Fogo, NEAR, Stellar, Algorand) - 5 stablecoins: USDC, EURC, USDT, AUSD, PYUSD - Schemes: exact, commerce, upto - ERC-8004 reputation integration - Production endpoint: https://facilitator.ultravioletadao.xyz Co-authored-by: 0xultravioleta <ultravioletadao@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * chore(typescript): bump viem to 2.47.12 across all packages (x402-foundation#2013) All direct viem dependencies now resolve to 2.47.12, adding chain definitions for Mezo Testnet (31611), MegaETH (4326), Stable (988/2201), and others that were missing from earlier locked versions. Lockfile-only change. No package.json range changes — all existing ^2.x ranges already accept 2.47.12. * feat(svm): implement extra.memo support for exact scheme (x402-foundation#1688) Implement the spec change from PR x402-foundation#1682, adding optional seller-defined memo support to the SVM exact scheme across all three SDKs. Client changes (TypeScript, Go, Python - both v1 and v2): - When extra.memo is present, use its UTF-8 value as memo instruction data - When absent, fall back to existing random 16-byte nonce behavior - Validate memo does not exceed MAX_MEMO_BYTES (256) limit Facilitator changes (TypeScript, Go, Python - both v1 and v2): - When extra.memo is present in requirements, verify exactly one memo instruction exists and its data matches the expected value - Return specific error codes: memo_count / memo_mismatch Constants added: - MAX_MEMO_BYTES / MaxMemoBytes (256) across all languages - ERR_MEMO_MISMATCH, ERR_MEMO_COUNT (Python/Go) - ErrMemoExceedsMaxSize (Go client) Tests added: - TypeScript: 4 memo tests in duplicateTx.test.ts - Go: TestSellerMemo with 4 subtests in duplicate_tx_test.go - Python: TestSellerMemo class with 4 tests in test_duplicate_tx.py Closes x402-foundation#1682 * chore: version typescript packages (x402-foundation#2019) * fix workspace settings * fix avm/fastify changelogs * chore: version typescript packages * chore: version python package (x402-foundation#2020) * chore(go): release v2.9.0 (x402-foundation#2021) * remove old changesets * chore(go): release v2.9.0 * Add Algorand (AVM) support to documentation (x402-foundation#1993) * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/core-concepts/network-and-token-support.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-buyers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-buyers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-buyers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/getting-started/quickstart-for-sellers.mdx Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor * Update docs/sdk-features.md Generated-By: mintlify-agent Mintlify-Source: dashboard-editor --------- Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * remove legacy examples (x402-foundation#1356) * remove legacy examples * add deprecation note * Feat/add polygon facilitator (x402-foundation#2031) * feat: add Polygon facilitator to ecosystem Adds production-grade x402 facilitator for Polygon networks. - URL: https://x402.polygon.technology - Networks: polygon, polygon-amoy - Schemes: exact - Assets: EIP-3009 - Capabilities: verify, settle * feat: replace polygon logo with rounded icon * feat: update polygon facilitator with docs URL * add upto facilitator examples (x402-foundation#2028) * remove legacy examples (x402-foundation#2036) * feat: add batch-settlement payment scheme and Cloudflare network specification (x402-foundation#1145) * feat: updated legacy npm packages to deploy via trusted publishing (x402-foundation#2039) * docs: add AI-assisted contributions guidelines and sample agent prompt (x402-foundation#1968) Set expectations for AI-generated contributions: require human review before requesting PR review, remove verbosity and redundancy, verify payment/signing correctness against specs, and disclose significant AI usage. Include a sample system prompt for AI coding agents (Claude Code, Codex, Cursor) that aligns agent output with x402 contribution standards. Inspired by Neovim's AI-assisted work guidelines, adapted for x402's security-sensitive payment infrastructure context. * feat: upto evm python (x402-foundation#2023) * feat: add upto to python SDK * feat: add unit & integration tests * feat: add upto python clients/servers/facilitator to e2e suite * initial cleanup * implement partial settlement * improve parity with ts/go * better parity and fix tests * fix(python): sort imports and format test file to pass ruff lint New error constants were appended after ERR_UNSUPPORTED_SCHEME instead of in alphabetical order, causing I001 (import block un-sorted). Made-with: Cursor * add comment to e2e tests * fix failing integration test * changelog * fix changelog name --------- Co-authored-by: Ethan Oroshiba <ethan.oroshiba@gmail.com> * Update docs/sdk-features.md (x402-foundation#2052) Generated-By: mintlify-agent Mintlify-Source: dashboard-editor Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> * patch avm/fastify (x402-foundation#2041) * fix: scientific notation price conversion bug (x402-foundation#2053) * fix: scientific notation price conversion bug * fix: simplified changeset fragment description * fix: generalized solution * Map simulation and settlement failures to more detailed errors (x402-foundation#2062) * map errors * fix ci * update python * fix python ci * chore: version python package (x402-foundation#2064) * add python upto to docs (x402-foundation#2065) * SVM スキームの統合テスト placeholder を実テストに置換 (x402-foundation#1931) * docs: add Documentation Checklist + surface chain-contribution flow (x402-foundation#2049) * docs: add Documentation Checklist + surface chain-contribution flow DEFAULT_ASSETS.md's 'Adding a New Chain' numbered flow stopped at 'Update all three SDKs' → 'Submit a PR' and did not mention the user-facing docs surfaces that also enumerate every chain with default-asset support. As a result, recent onboarding PRs have shipped with stale docs (e.g. the Radius PR x402-foundation#2038 updated the SDKs but not the docs table or Go README). The existing Cross-SDK Checklist at the bottom enumerates only the three code registries, mirroring the same gap. network-and-token-support.mdx has a parallel discoverability problem: the pointer to DEFAULT_ASSETS.md used a repo-relative path that resolves to a broken link on docs.x402.org, and the pointer sat inside the 'Default Assets for Dollar-String Pricing' intro rather than under 'Adding Support for New Networks' where a would-be contributor actually looks. The 'Adding' section itself described only runtime registration (server.register from consumer code) and did not mention the separate upstream-contribution path, and it also contained a 'Running Your Own Facilitator' subsection that is about facilitator infrastructure, not about adding networks — a topical mismatch. The page also ordered the 'Facilitators' section before 'Adding Support for New Networks', which inverts the natural read → use → extend → operate narrative. Changes: * DEFAULT_ASSETS.md: - Promote 'Update user-facing documentation' to a numbered step in 'Adding a New Chain' (new step 3, between 'Update all three SDKs' and 'Submit a PR'), with a cross-reference to the new checklist. - Append a new 'Documentation Checklist' section below the existing Cross-SDK Checklist, naming the two hot docs surfaces (network-and-token-support.mdx and go/mechanisms/evm/README.md) that must also be updated on a new chain onboarding. * docs/core-concepts/network-and-token-support.mdx: - Remove the oddly-placed 'See DEFAULT_ASSETS.md' link from the Dollar-String Pricing intro; replace with an in-page anchor pointing at the new contribution subsection. - Split 'Adding Support for New Networks' into two subsections: 'Runtime Registration' (the existing content, unchanged) and a new 'Contributing a New Default Asset' subsection that links to DEFAULT_ASSETS.md via an absolute github.com URL (so the link works on the published docs site) and explicitly names the cross-SDK + docs checklist. - Move 'Running Your Own Facilitator' out of 'Adding Support for New Networks' into the existing 'Facilitators' section, where it belongs topically. - Swap top-level section order: 'Adding Support for New Networks' now precedes 'Facilitators', matching the read → use → extend → operate narrative. No code changes. Documentation only. * docs: revert DEFAULT_ASSETS.md, unify SDK READMEs to link docs Address review feedback: the Mintlify agent (.github/workflows/update-docs.yml) keeps docs/ in sync with code, so contributors should only update the three SDK constants files. Remove the Documentation Checklist and Step 3 from DEFAULT_ASSETS.md. Apply a consistent two-link block to all three SDK READMEs (Go/TS/Python) pointing at the mdx default-assets list and the mdx Adding Support for New Networks section. Soften the mdx Contributing a New Default Asset blurb to drop manual mdx/README update instructions. * feat: add Quicknode to adopted-by scroller (x402-foundation#2055) * fix(go): implement SupportedCache Clear (x402-foundation#2072) * docs: create `README.md` under `typescript/` to showcase list of available packages (x402-foundation#1978) * docs: add npm badge with package version (Typescript + Chains) * docs: create `README.md` under `typescript/` with full list of available packages * docs: improve top README for installation instructions per language * docs: separate code inputs to enable to copy / paste easily * docs: add missing packages in installation command * docs: break down and group package installation list for readability * docs: add badges for packages around Algorand and Fastify --------- Co-authored-by: Carson Roscoe <CarsonRoscoe7@gmail.com> Co-authored-by: caveman.eth <24273561+caveman-eth@users.noreply.github.com> Co-authored-by: scaler <240590331+sc4l3r@users.noreply.github.com> Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com> Co-authored-by: Philippe d'Argent <p.dargent@cern.ch> Co-authored-by: Andrew Reder <avidreder@gmail.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Ash <105402607+Must-be-Ash@users.noreply.github.com> Co-authored-by: MG <emg110@gmail.com> Co-authored-by: Ryan R. Fox <ryanRfox@users.noreply.github.com> Co-authored-by: Andrew Barnes <bortstheboat@gmail.com> Co-authored-by: VIkions <99107287+vikions@users.noreply.github.com> Co-authored-by: 0xultravioleta <0xultravioleta@gmail.com> Co-authored-by: 0xultravioleta <ultravioletadao@gmail.com> Co-authored-by: Misha Kolesnik <tenequm@gmail.com> Co-authored-by: AkshatGada <96907514+AkshatGada@users.noreply.github.com> Co-authored-by: Cameron Whiteside <35665916+CameronWhiteside@users.noreply.github.com> Co-authored-by: Notorious D.E.V. <notoriousd3v@gmail.com> Co-authored-by: Natsuki Yamaguchi <natsukingly@gmail.com> Co-authored-by: Sahil sen <sensahil25@gmail.com> Co-authored-by: GrishaG <118081038+viktorcrypt@users.noreply.github.com> Co-authored-by: Jean Cvllr <31145285+CJ42@users.noreply.github.com>
…n list, CORS from env
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security and correctness fixes for the
browser-wallet-exampletemplate. The README encourages shipping this as a foundation for real apps — these patches close the gaps before someone does.Changes
server/index.tsGET /api/sessionsendpoint that listed every live session ID with no auth. Sessions are now only accessible by ID, and IDs are never enumerated.GET /api/session/:idis now read-only. A newPOST /api/session/:id/consumedoes the actual consumption atomically using apendingConsume+consumedtwo-set gate (same pattern as discussed in coinbase/agentkit#1141) — prevents the double-spend race where two concurrent requests both readconsumed: falsebefore either writes.payeraddress extracted from the x402 payment-response header, giving each session an audit trail back to the settled on-chain payment.CORS_ORIGINenv var (comma-separated) replaces hard-codedlocalhostorigins, so the server works beyond local dev without a code change.NETWORKis non-testnet but noFACILITATOR_URLis set, rather than silently producing route-configuration errors at request time.client/src/contexts/WalletContext.tsxbuildClient()helper that checks and switches to Base Sepolia before creating the viem client. Previously only the manual connect flow enforced the chain switch; a returning user on mainnet would get EIP-712 signatures with a mismatchedchainIddomain that the facilitator rejects. Now both paths go through the same chain check.server/.env.exampleCORS_ORIGINwith a comment.What this doesn't cover
window.ethereumstill assumed. Worth a follow-up.x402-hono/x402-axiosare at 0.4.0; upgrading to current packages is a separate step once the security issues are closed.