[vvillait88]

Summary

Maintenance sweep. Moves the coupled settle set together with pay and the storefronts: mppx 0.16.0 to 0.17.0, viem 2.57.13 to 2.57.14 (dev dependency and override), @solana/kit ^8.5.0 to ^8.6.0 (dev; the peer range >=8.0.0 <9.0.0 already admits it). Also hono ^4.13.16, jose ^6.2.14 (an optional peer loaded by dynamic import, not bundled), @types/node, eslint, knip. Version 3.1.7 to 3.1.8. Requested by Varun as part of the weekly sweep.

Released because the artifact changes: the build bundles mppx and viem, and diffing main's dist against this branch's shows mppx 0.17's new hasPaymentScheme helper and viem's version string. The Tempo proof EIP-712 domain is still version 3, and the new 15-second minimum validity applies only to fee-sponsored Tempo charges, which we never configure: registerTempo in src/payment/mppx_server.ts passes no feePayer to tempo.charge.

Security: relocks follow-redirects 1.16.1 to 1.16.2 (GHSA-mrwp-f3q8-3g9p, HIGH), inside axios's ^1.16.0 range, so no manifest change. Adds a version-scoped OSV entry for minimatch 10.2.6 (GHSA-g3hv-75wg-m249): the fix is only in 11.0.1 and every lint parent still caps it at ^10; it never reaches the published package. Expires 2027-01-31.

Types fix: the hono, express, fastify and web rate-limit entries now re-export RateLimitCoreOptions. Their option interfaces extend it, but no public entry exported it, so every build printed 8 rollup-plugin-dts warnings (main included) and a consumer emitting declarations could hit TS2742. Additive, type-only. The check is the build output: 8 warnings on main, 0 here. No vitest assertion was added because tsconfig.json includes only src and vitest does not typecheck, so a type test under tests/ would pass with or without the export.

Not taken: jose 6.2.15 (published 2026-11-01, inside the 24h release-age soak, next pass), TypeScript 7 (held).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Additive: RateLimitCoreOptions is now exported as a type from @agent-score/commerce/middleware/{hono,express,fastify,web}. No caller has to change anything.

Test plan

Ran locally: lint, typecheck, knip, test (1641 passed) and build all exit 0; osv-scanner with the repo config reports no issues across 844 packages. The live settle on Base, Tempo and Solana runs against the FullEnrich store once it is on this release, and its result is recorded on the pay PR that moves the same set.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the only public change is the additive type export above; no example or README uses it)
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code

[vvillait88]

Review: settle set, hono, follow-redirects, rate-limit type exports, 3.1.8

Verdict: the code, the dist and the public-API claim all check out. Before merging, take one more bump and correct the body.

Fix before merge: jose 6.2.14 is outside the soak and was not taken

The body says jose 6.2.14 is "inside the 24h release-age soak". It is not:

• npm's time field shows 6.2.14 published 2026-10-29T09:51:45Z, four days ago.
• The release that is still in the soak is 6.2.15, published 2026-11-01T22:28:55Z.
• bun outdated on the head confirms this. It lists jose (dev) 6.2.13 | 6.2.14 * | 6.2.14 *, where the * means 6.2.14 is the newest version that clears the soak.

The runbook says to take the latest version that clears the gate. Relocking to 6.2.14 (raising the floor to ^6.2.14 to match how the other caret dependencies are kept) costs nothing at release time: jose is an optional peer loaded with await import("jose"), and it is not bundled. Grepping dist/discovery/index.mjs shows only the dynamic import and the install hint.

Body corrections (non-blocking)

• 15 second rationale: the body says the 15 second fee-sponsor minimum misses us because challenges default to 5 minutes in src/payment/directive.ts. The Tempo challenges come from mppx's own Mppx.create, not from directive.ts. The real reason is that registerTempo in src/payment/mppx_server.ts passes only currency, recipient and testnet to tempo.charge. No fee payer is configured, so neither the issue-time check nor the client check ever runs.
• Checklist contradiction: the line "Docs and README examples updated if the public surface changed (nothing public changed)" contradicts the Public API section, which correctly says an export was added. Either reword it, or confirm that no doc lists the per-entry exports.

Verified

All checks ran on a worktree of 7641832, branched from current main 85a58be.

• Install and gates:
  • bun install --frozen-lockfile: 0, with 515 packages.
  • lint 0, knip 0, build 0.
  • test 0, with 1641 passed and 4 skipped (109 files plus 1 skipped).
  • typecheck exits 2 on a tree with no dist, because examples/tsconfig.json resolves @agent-score/commerce/* through the built package. After the build it exits 0. CI runs build before typecheck, so this is ordering, not a defect, and it predates this PR.
• The 8 rollup-plugin-dts warnings are gone.
  • A main build logs exactly 8 [plugin dts] ... RateLimitCoreOptions lines, for express, fastify, hono and web, each in .d.ts and .d.mts.
  • The head build logs 0 [plugin dts] lines.
  • The nextjs entry needs no change. It takes RateLimitWebOptions from ./web, and it produces no warning on either side.
• The public-API claim holds. The dist diff is 38 files, all of them "differ", and the main and head trees both hold 126 files.
  • The 8 changed declaration files each change one line, for example export { rateLimitHono } becomes export { RateLimitCoreOptions, rateLimitHono }. RateLimitCoreOptions arrives through import { R as RateLimitCoreOptions } from '../_core-kI7FRAiZ.js', and that chunk's name is unchanged.
  • No middleware/*.js or *.mjs file changed, so the export is type-only and additive.
• The rest of the JS diff is accounted for:
  • defaultUa moves from 3.1.7 to 3.1.8 in core, index and the identity entries.
  • index and stripe-multichain pick up the bundled viem version string (2.57.13 to 2.57.14) and mppx 0.17's hasPaymentScheme.
  • The artifact changes, so the release is owed.
• Settle set:
  • The lock holds one copy each of viem@2.57.14, mppx@0.17.0 and @solana/kit@8.6.0, and the viem override equals the pin.
  • The nested @coinbase/cdp-sdk/@solana/kit@5.5.1 is a dev-only copy that main also has. cdp-sdk appears 0 times in the dist.
  • The >=8.0.0 <9.0.0 peer admits 8.6.0.
  • I read the mppx 0.16 to 0.17 dist diff myself; details are on the pay PR. The proof domain is still version: '3', ProofRealm.js is unchanged, and the identity changes do not touch us, since paymentVerifiers is not used in src.
• Security:
  • follow-redirects@1.16.2 is locked. The advisory range is introduced 1.16.0, fixed 1.16.2.
  • The minimatch entry is identical to the node-sdk and pay copies.
• Other moves: only jose (above) and typescript 7 (held) remain behind latest. hono is at 4.13.16.
• CI: gh pr checks 167 exits 0, and all 9 rows pass.

For the settle

The Tempo server is not taken from this package's lock: src/payment/mppx_server.ts loads mppx with await import(moduleName) from the store's own install. The FullEnrich store currently pins mppx 0.16.0 and viem 2.57.13, with a viem override of 2.57.13.

So taking @agent-score/commerce 3.1.8 alone leaves the server side of the settle on mppx 0.16. The store PR has to move its mppx, viem and viem override to 0.17.0 and 2.57.14 in the same change, or the settle never exercises the server half of this set.

[vvillait88]

Review round 2

All round 1 items are closed. This is safe to merge, then tag 3.1.8.

• jose: commit 830f7e1 changes only package.json (+1 -1) and bun.lock (+2 -2), according to the compare API. The devDependency is now ^6.2.14, and the lock now holds jose@6.2.14. The peer range >=6.0.0 is unchanged. 6.2.15 (published 2026-11-01T22:28Z) is correctly left for the next pass, which the body now says. jose is external to the bundle (await import("jose")), so the dist analysis from round 1 still holds.
• Body: the 15 second reason now names the actual mechanism: registerTempo passes no feePayer to tempo.charge. The checklist line now agrees with the Public API section, since the additive type export is used by no example or README. The pay PR body carries the same corrected reason.
• CI on head 830f7e1: gh pr checks 167 --watch exits 0, and a bare gh pr checks 167 afterwards also exits 0. All 9 rows pass: ci, node-compat 22/24/26, Dependency Scan, CodeQL and Analyze.

For the settle, the round 1 note still applies: the FullEnrich store PR has to move its own mppx, viem and viem override to 0.17.0 and 2.57.14 alongside @agent-score/commerce 3.1.8.