@quackai/q402-mcp 0.8.39 → 0.8.40

package/dist/index.js

@@ -211,7 +211,7 @@ var isValidPrivateKey = (s) => typeof s === "string" && PRIVATE_KEY_RE.test(s);
 // package.json
 var package_default = {
   name: "@quackai/q402-mcp",
-  version: "0.8.39",
+  version: "0.8.40",
   description: "MCP server for Q402 \u2014 gasless USDC/USDT/RLUSD payments on 11 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   mcpName: "io.github.bitgett/q402-mcp",
   keywords: [
@@ -1142,6 +1142,12 @@ async function runPay(input) {
     to: input.to.toLowerCase(),
     amount: input.amount,
     token: input.token,
+    // Bind the settlement RAIL. On Base the same (to, amount, token) settles
+    // very differently under q402 (EIP-7702) vs x402 (EIP-3009) — different
+    // signature scheme, gas path, and wallet-state constraints. Consenting to a
+    // Q402-rail preview must NOT authorise an x402 execution on the same token,
+    // so a rail change invalidates the consent and forces a fresh preview.
+    rail: input.rail ?? "q402",
     // Bind the funding source too — the user is consenting to spend from THIS
     // wallet, so a different walletMode/walletId needs a fresh preview.
     wm: effectiveMode,
@@ -1157,13 +1163,14 @@ async function runPay(input) {
   if (!consent.ok) {
     const splitNote = input.hookParams?.splits ? ` \u2014 split ${input.hookParams.splits.length} ways; funds go to the split recipients, not ${input.to}` : "";
     const fromNote = senderWallet ? ` from ${senderWallet.addressShort}` : "";
+    const railNote = input.rail === "x402" ? " via the x402 (EIP-3009) rail" : "";
     return {
       result: failureResult("consent"),
       guardsApplied: [...guardsApplied, "two_phase_consent"],
       senderWallet,
       needsConsent: {
         status: "needs_confirmation",
-        preview: `Send ${input.amount} ${input.token} to ${input.to} on ${chain.key}${fromNote}${splitNote}. Confirm with the user, then re-call q402_pay with the same args plus consentToken="${consent.expected}".`,
+        preview: `Send ${input.amount} ${input.token} to ${input.to} on ${chain.key}${railNote}${fromNote}${splitNote}. Confirm with the user, then re-call q402_pay with the same args plus consentToken="${consent.expected}".`,
         consentToken: consent.expected
       }
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quackai/q402-mcp",
-  "version": "0.8.39",
+  "version": "0.8.40",
   "description": "MCP server for Q402 — gasless USDC/USDT/RLUSD payments on 11 EVM chains + Chainlink CCIP USDC bridge on the eth/avax/arbitrum triangle, callable from Claude (Desktop / Code), OpenAI Codex CLI, and any other Model Context Protocol client.",
   "mcpName": "io.github.bitgett/q402-mcp",
   "keywords": [