wormhole-x402 0.1.3

Security hardening from the post-launch review, plus first-class facilitator support.

Closed bypasses

• guardSigner now guards every signing method a wallet exposes — signAllTransactions, signAndSendTransaction, and signAndSendAllTransactions previously routed around the check entirely.
• The System program is now a strict allowlist (only AdvanceNonceAccount passes). TransferWithSeed, Assign, WithdrawNonceAccount, allocation instructions, and unclassifiable tags are refused (X402-007 / new X402-009).
• Burn / BurnChecked riding beside a correct payment are refused (X402-006).
• ATA RecoverNested — an in-allowlist instruction that moves tokens — is refused; only Create and CreateIdempotent pass.
• New priority-fee cap (X402-010): a conforming payment carrying an outsized compute-unit price is refused. Default cap 0.01 SOL, configurable via InspectOptions.maxPriorityFeeLamports.

Facilitator flow

• inspectPaymentPayload(xPayment, quote) inspects the X-PAYMENT payload (object or base64 header) — in the SVM exact scheme the client still partially signs the settlement transaction, so the same bytes get the same checks.
• quoteFromRequirements(accepts[0]) maps a 402 response entry to the quote.
• EVM authorization payloads (EIP-3009) abstain rather than allow.

40 tests, each new rule with an attack case and a benign twin.

Docs: https://agentwormhole.com/docs