openpay-x402-sdk 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.10.1 — 2026-09-23
+
+- Create spend-store directories with mode 0700, including compatibility saves,
+  so an env-key user's spend directory can later hold an MCP keystore without
+  failing its permission checks. Existing directories are never chmod-ed; inspect
+  and manually repair legacy 0755 directories before switching to keystore mode.
+  Mode 0700 also applies to newly created intermediate directories at custom
+  spend-store paths; pre-existing shared/group directories keep their permissions.
+- Preserve spend reservations, locks, accounting and wallet 0600/0700 checks.
+  No dependencies added. Unpublished; rule-15 human review is required before adoption.
+
 ## 0.10.0 — 2026-09-23
 
 - Breaking: seller gates require a trusted `resourceId` and `expectedRecipient`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpay-x402-sdk",
-  "version": "0.10.0",
+  "version": "0.10.1",
   "description": "Guarded Node.js buyer SDK for OpenPay x402 JPYC resources",
   "type": "module",
   "main": "./src/index.mjs",

package/src/spendStore.mjs

@@ -256,7 +256,9 @@ export function createFileSpendStore({ path, fsImpl } = {}) {
     if (!supportsAtomicFileUpdates(runtime.fileSystem)) {
       throw new Error('atomic spend store file operations are unavailable');
     }
-    await runtime.fileSystem.mkdir(runtime.directory, { recursive: true });
+    // Spend storage shares the default wallet directory: public directory bits would block
+    // a later keystore migration. Keep new directories private without chmod-ing existing ones.
+    await runtime.fileSystem.mkdir(runtime.directory, { recursive: true, mode: 0o700 });
     const handle = await acquireLock(runtime.fileSystem, runtime.lockPath);
     try {
       return await operation(runtime);
@@ -438,7 +440,8 @@ export function createFileSpendStore({ path, fsImpl } = {}) {
         }
         const current = documentForDate(document, key.slice(-10));
         current[key] = atomicString;
-        await runtime.fileSystem.mkdir(runtime.directory, { recursive: true });
+        // Compatibility saves must not create a shared directory the keystore would reject.
+        await runtime.fileSystem.mkdir(runtime.directory, { recursive: true, mode: 0o700 });
         await runtime.fileSystem.writeFile(
           runtime.targetPath,
           `${JSON.stringify(current, null, 2)}\n`,