Skip to content

v2.2.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 13:55
· 83 commits to main since this release
v2.2.0
b25b506

APIbase v2.2.0: x402 2.28 and mppx 0.13.5

Payment-stack release. The x402 SDK moves to 2.28, the MPP SDK to mppx 0.13.5, settlement outcomes that cannot be proven are no longer retried, and /mcp accepts payments in the protocol-native transports.

Security

  • x402 2.28. @x402/core, @x402/evm and @x402/extensions are pinned to ^2.28.0; bypass-vector tests cover attempts to obtain a paid result without a verified payment.
  • mppx 0.13.5 replay fix. A replayed MPP credential gets a final 403 credential_replayed; no second transfer is accepted for the same credential.

Behaviour changes

  • 403 credential_replayed on a replayed MPP credential.
  • 503 mpp_settlement_unknown when an MPP settlement outcome cannot be determined; the payment is reconciled against the chain instead of being charged again.
  • Settlement pending states: an unknown x402 settle outcome (x402_settle_pending, facilitator timeout) is resolved by a 60 s chain reconcile job, never by a second settle.
  • Cache-Control: no-store on every 402 response.
  • maxTimeoutSeconds is 120 in x402 challenges.
  • Payment-Authorization: Payment <credential> is accepted on /mcp next to Authorization: Bearer <api key>.
  • _meta transport on /mcp: x402 payment in params._meta["x402/payment"], receipt in result _meta["x402/payment-response"]; an unpaid tool call returns isError: true with the payment requirements in _meta.
  • offers[] (methods tempo and evm) in x-payment-info of the discovery OpenAPI, next to the existing flat fields.
  • Description policy: tool and product descriptions pass a content-policy gate; catalog descriptions of shops are checked before moderation.

Client compatibility

  • mppx < 0.6.16 -> 400 "MPP payment verification failed … upgrade"; 0.6.16-0.8.x -> works; >= 0.12 -> works, pays USDC.e because the challenge pins it; a wallet holding only OUSD fails inside the client (no HTTP call, no on-chain movement).
  • x402 V1 and V2 payloads both accepted (unchanged); @x402/* client 2.x all work; @x402/fetch >= 2.23 default $1 spend cap -> client-side refusal for tools above $1; PayAI remote facilitator calls now time out at 30 s with FacilitatorTimeoutError (handled as an unknown outcome).
  • Header-based x402 and MPP clients unchanged; @x402/mcp 2.x clients now work; mppx < 0.9.0 keep using Authorization: Payment (accepted); MCP clients that time out at 30 s today get 120 s.

Removed

  • The custom MPP charge memo; a Tempo payment is tied to its quote by the challenge id and the receipt's transaction hash.
  • The unused @x402/express dependency.

Docs

Every payment statement now names the token of its rail (USDC on Base, USDC.e on Tempo) and links the x402 Foundation repository. Pages touched: docs/payments.md, docs/STRATEGY.md, SECURITY.md, packages/mcp-client/README.md, static/why.html, static/why.md, static/pricing.html, static/connect.html, static/frameworks.html, static/catalog.html, static/terms.html, static/privacy.html, static/index.md, static/integrator/index.{md,html}, static/integrator/why-base-tempo.md, static/.well-known/agent-skills/x402-payment.md, static/.well-known/agent-skills/index.json, static/.well-known/mcp.json, static/.well-known/mcp/server-card.json, static/.well-known/openapi.json, static/.well-known/openapi-discovery.json. New gate: tests/unit/docs-x402mpp-consistency.test.ts.

Assets 3
Loading