twzrd-x402-gate 0.11.4 → 0.11.5

package/CHANGELOG.md

@@ -28,6 +28,10 @@ All notable changes to `twzrd-x402-gate`. Dates are npm publish dates (UTC).
 - **Seller side** (`createTwzrdSettleGuard`): fail-open by default. A screen that throws
   returns without aborting settlement unless `failOpen: false`.
 
+## 0.11.5 - 2026-10-02 (peer floor)
+
+- **`x402-solana` peer floor raised to `>=3.0.1`** (was `>=3.0.0`). x402-solana 3.0.1 refuses a non-positive amount, or one above the u64 range, before it builds or signs a transfer; 3.0.0 accepted a negative amount. An install that resolves the stock PayAI client now gets that check. The gate's own `amount_malformed` refusal (0.11.2) already rejected a signed or non-integer amount on every gate entry point; this closes the same hole for a payer that calls `x402-solana` directly. No gate allow/refuse outcome changes.
+
 ## 0.11.4 - 2026-10-01 (security fix)
 
 - **`createTwzrdPolicyFetch` and the x402 intent adapter refuse a non-USDC asset** (`twzrd_non_usdc_asset`) instead of reading its base units as USD: 5 wSOL (`500000000`) passed a $1000 cap as "$500". The hook and approval seats already refused it; the policy seat now agrees. A bare `"USDC"` symbol is not a mint and is refused like any other non-mint asset on a network with a known USDC set. The MPP seat has its own priced-asset table and is unchanged (it also prices USDT 1:1; the x402 seats do not).

package/QUICKSTART.md

@@ -6,13 +6,13 @@ is unreachable the gate never *invents* a wash flag. A failed preflight, or a me
 outage on a scored path, blocks by default (`TWZRD_FAIL_OPEN=true` to allow). A reachable
 card with no wash signal still proceeds.
 
-**Pin:** `twzrd-x402-gate@0.11.4` + stock PayAI client `x402-solana@3.0.0` (official
+**Pin:** `twzrd-x402-gate@0.11.5` + stock PayAI client `x402-solana@3.0.1` (official
 `beforePayment` seat). `@x402/core` Path E remains supported; refuse script is fallback.
 
 ## 1. Stock PayAI client (default seat — copy-paste)
 
 ```bash
-npm install twzrd-x402-gate@0.11.4 x402-solana@3.0.0
+npm install twzrd-x402-gate@0.11.5 x402-solana@3.0.1
 ```
 
 > **ESM-only.** The package ships `import` conditions only — a CommonJS
@@ -37,7 +37,7 @@ Then: `await client.fetch("https://merchant.example/paid");`
 ## 1b. Official `@x402/core` client (Path E)
 
 ```bash
-npm install twzrd-x402-gate@0.11.4 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.11.5 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript
@@ -109,7 +109,7 @@ Optional seat proofs (live intel; the clean-fixture leg can exit 2 when
 `CLEAN_PAYTO` is wash-flagged — that is not the first demo):
 
 ```bash
-# Stock-client seat proof (beforePayment). Needs x402-solana@3.0.0.
+# Stock-client seat proof (beforePayment). Needs x402-solana@3.0.1.
 # Harness fallback runs without it but does not clear closure.
 npm run x402-solana-before-payment-proof
 # writes block-proof-<run_id>.json — hook: beforePayment

package/README.md

@@ -41,7 +41,7 @@ refuse. Protects the **payer** from a risky **merchant** (`payTo`). Chain-neutra
 ### Default-on AutoGate (5 lines)
 
 ```bash
-npm install twzrd-x402-gate@0.11.4 @x402/core @x402/fetch @x402/svm
+npm install twzrd-x402-gate@0.11.5 @x402/core @x402/fetch @x402/svm
 ```
 
 ```typescript
@@ -80,7 +80,7 @@ transfer on-chain. Wash/sybil edges are primarily discounted in TWZRD scoring, n
 revenue refusal.
 
 ```bash
-npm install twzrd-x402-gate@0.11.4
+npm install twzrd-x402-gate@0.11.5
 ```
 
 ```typescript
@@ -125,7 +125,7 @@ Fixture-backed SVM extract tests live in `test/seller-hook.test.ts` +
 Install the published gate and run against wash fixtures:
 
 ```bash
-npm install twzrd-x402-gate@0.11.4
+npm install twzrd-x402-gate@0.11.5
 # from package root after install, or from a checkout:
 npm run wash-dogfood
 ```
@@ -299,7 +299,7 @@ Dogfood (one public live proof path):
 ## Install
 
 ```bash
-npm install twzrd-x402-gate@0.11.4
+npm install twzrd-x402-gate@0.11.5
 ```
 
 Do not hardcode a version in this doc — every past pin here (**0.5.4**, **0.7.1**, **0.8.5**,

package/dist/doctor.js

@@ -33,7 +33,7 @@ const HOSTS = [
         id: "solana-agent-kit",
         label: "Solana Agent Kit (SolanaAgentKit)",
         deps: ["solana-agent-kit"],
-        install: "npm install twzrd-x402-gate@0.11.4",
+        install: "npm install twzrd-x402-gate@0.11.5",
         snippet: `import { SolanaAgentKit } from "solana-agent-kit";
 import { twzrdBeforeSign } from "twzrd-x402-gate";
 
@@ -49,7 +49,7 @@ const agent = new SolanaAgentKit(wallet, rpcUrl, {
         id: "pay-kit",
         label: "Solana PayKit (createPayKitClient)",
         deps: ["@solana/pay-kit"],
-        install: "npm install twzrd-x402-gate@0.11.4 @solana/pay-kit",
+        install: "npm install twzrd-x402-gate@0.11.5 @solana/pay-kit",
         snippet: `import { createPayKitClient } from "@solana/pay-kit";
 import { createTwzrdPayKitBeforePaymentHook } from "twzrd-x402-gate";
 
@@ -71,7 +71,7 @@ const client = await createPayKitClient({
         id: "x402-client",
         label: "official x402 client (@x402/core)",
         deps: ["@x402/core", "@x402/fetch", "@x402/svm"],
-        install: "npm install twzrd-x402-gate@0.11.4 @x402/core @x402/fetch @x402/svm",
+        install: "npm install twzrd-x402-gate@0.11.5 @x402/core @x402/fetch @x402/svm",
         snippet: `import { x402Client } from "@x402/core/client";
 import { installTwzrdAutoGate } from "twzrd-x402-gate";
 
@@ -83,7 +83,7 @@ installTwzrdAutoGate(client, { refuseWashFlagged: true });`,
         id: "elizaos",
         label: "elizaOS agent runtime",
         deps: ["@elizaos/core", "elizaos"],
-        install: "npm install twzrd-x402-gate@0.11.4",
+        install: "npm install twzrd-x402-gate@0.11.5",
         snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
 
 // Gate the payment client your plugin hands to the runtime, not the runtime
@@ -94,7 +94,7 @@ installTwzrdAutoGate(paymentClient, { refuseWashFlagged: true });`,
         id: "goat",
         label: "GOAT SDK",
         deps: ["@goat-sdk/core"],
-        install: "npm install twzrd-x402-gate@0.11.4",
+        install: "npm install twzrd-x402-gate@0.11.5",
         snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
 
 installTwzrdAutoGate(walletClient, { refuseWashFlagged: true });`,
@@ -103,7 +103,7 @@ installTwzrdAutoGate(walletClient, { refuseWashFlagged: true });`,
         id: "raw-fetch",
         label: "raw fetch + x402 payer",
         deps: ["x402-fetch", "x402"],
-        install: "npm install twzrd-x402-gate@0.11.4",
+        install: "npm install twzrd-x402-gate@0.11.5",
         snippet: `import { installTwzrdAutoGate } from "twzrd-x402-gate";
 
 // Wraps fetch: a refused payment never reaches the payer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twzrd-x402-gate",
-  "version": "0.11.4",
+  "version": "0.11.5",
   "description": "Released identity 0.11.2. Buyer-side x402 trust gate: free preflight before signing USDC to a merchant. On Solana mainnet and Base mainnet (eip155:8453), a missing payTo is not approved, a buyer preflight outage does not sign unless TWZRD_FAIL_OPEN=true, null_reason unknown_subject does not sign, a price above recommended_cap_usdc does not sign, and disagreeing v1/v2 price or recipient fields are refused. An approved warn whose paying fetch is wired requests /v1/intel/quick and does not request /v1/intel/trust. Other EVM networks do not run the scored preflight. createTwzrdBeforePaymentHook does not read TWZRD_AUTO_GATE or TWZRD_GATE_ENABLED; those switches apply only to installTwzrdAutoGate. createTwzrdSettleGuard stays fail-open by default, so an unavailable gate does not abort. 0.11.0 is not uniformly fail-closed.",
   "type": "module",
   "main": "./dist/index.js",
@@ -111,7 +111,7 @@
     "@x402/fetch": ">=2.0.0",
     "@x402/svm": ">=2.0.0",
     "js-sha3": ">=0.8.0",
-    "x402-solana": ">=3.0.0"
+    "x402-solana": ">=3.0.1"
   },
   "peerDependenciesMeta": {
     "@scure/base": {
@@ -150,6 +150,6 @@
     "js-sha3": "^0.13.0",
     "tsx": "^4.23.12",
     "typescript": "^5.4.0",
-    "x402-solana": "^3.0.0"
+    "x402-solana": "^3.0.1"
   }
 }