@quackai/q402-mcp 0.8.25 → 0.8.27

package/dist/index.js

@@ -211,7 +211,7 @@ var isValidPrivateKey = (s) => typeof s === "string" && PRIVATE_KEY_RE.test(s);
 // package.json
 var package_default = {
   name: "@quackai/q402-mcp",
-  version: "0.8.25",
+  version: "0.8.27",
   description: "MCP server for Q402 \u2014 gasless USDC/USDT/RLUSD payments on 10 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   mcpName: "io.github.bitgett/q402-mcp",
   keywords: [
@@ -410,7 +410,7 @@ var CHAIN_CONFIG = {
     name: "Monad",
     chainId: 143,
     domainName: "Q402 Monad",
-    implContract: "0x39Ba9520718eE069D7f72882FF4C28a5Ea8a2acC",
+    implContract: "0x5a8fde1851491D9eD512a9eDa1c63CA7627BECb8",
     gasToken: "MON",
     explorer: "https://monadscan.com",
     // Native Circle USDC via CCTP V2 (not bridged) + USDT0 (LayerZero OFT).
@@ -424,7 +424,7 @@ var CHAIN_CONFIG = {
     name: "Scroll",
     chainId: 534352,
     domainName: "Q402 Scroll",
-    implContract: "0x2fb2B2D110b6c5664e701666B3741240242bf350",
+    implContract: "0x8D854436ab0426F5BC6Cc70865C90576AD523E73",
     gasToken: "ETH",
     explorer: "https://scrollscan.com",
     // Native Circle USDC + canonical Tether on Scroll mainnet (addresses
@@ -440,7 +440,7 @@ var CHAIN_CONFIG = {
     name: "Arbitrum One",
     chainId: 42161,
     domainName: "Q402 Arbitrum",
-    implContract: "0x2fb2B2D110b6c5664e701666B3741240242bf350",
+    implContract: "0xE5b90D564650bdcE7C2Bb4344F777f6582e05699",
     gasToken: "ETH",
     explorer: "https://arbiscan.io",
     // Native Circle USDC (CCTP) + canonical Tether on Arbitrum One.
@@ -936,6 +936,7 @@ function canonicalIntent(intent) {
       for (const k of Object.keys(src).sort()) out[k] = sortValue(src[k]);
       return out;
     }
+    if (typeof v === "number") return String(v);
     return v;
   };
   return JSON.stringify(sortValue(intent));
@@ -1120,7 +1121,12 @@ async function runPay(input) {
     // wallet, so a different walletMode/walletId needs a fresh preview.
     wm: effectiveMode,
     wid: (input.walletId ?? "").toLowerCase(),
-    ...input.hookParams?.splits ? { splits: input.hookParams.splits.map((s) => ({ r: s.recipient.toLowerCase(), bps: s.bps })) } : {}
+    ...input.hookParams?.splits ? { splits: input.hookParams.splits.map((s) => ({ r: s.recipient.toLowerCase(), bps: s.bps })) } : {},
+    // Bind the settlement-gating hooks too — a ConditionalOracle gate or a
+    // ReputationGate materially changes WHEN/IF money moves, so dropping or
+    // altering them after the preview must invalidate consent.
+    ...input.hookParams?.condition ? { cond: { kind: input.hookParams.condition.kind, op: input.hookParams.condition.op, value: input.hookParams.condition.value, feed: input.hookParams.condition.feed ?? null } } : {},
+    ...input.hookParams?.recipientAgentId ? { ragent: input.hookParams.recipientAgentId } : {}
   };
   const consent = checkConsent(consentIntent, input.consentToken);
   if (!consent.ok) {
@@ -3270,6 +3276,9 @@ async function runBridgeSend(input) {
     dst: input.dst,
     amount: input.amount,
     feeToken: input.feeToken === "native" ? "native" : "LINK",
+    // Bind the fee ceiling too — it bounds what the user actually pays, so it
+    // must not be addable/changeable after the preview.
+    maxFeeRaw: input.maxFeeRaw ?? null,
     // Bind the funding wallet too (see q402_pay).
     wid: (input.walletId ?? "").toLowerCase()
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quackai/q402-mcp",
-  "version": "0.8.25",
+  "version": "0.8.27",
   "description": "MCP server for Q402 — gasless USDC/USDT/RLUSD payments on 10 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   "mcpName": "io.github.bitgett/q402-mcp",
   "keywords": [