warpmetal 0.7.1 → 0.7.2

package/README.md

@@ -34,7 +34,7 @@ published wallet CLI with the exact version WarpMetal reports:
 npm install --global warpmetal
 warpmetal --help
 
-npm install --global @x402api/agent-wallet-cli@0.2.3
+npm install --global @x402api/agent-wallet-cli@0.2.4
 x402api help --json
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.7.1",
+  "version": "0.7.2",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/references/cli-reference.md

@@ -62,7 +62,7 @@ private WarpMetal state directory. An explicit output path must not already
 contain different content. `challengeHandle` is intentionally absent from the
 wallet envelope: it is neither a buyer payment identifier nor signing input.
 
-The current integration targets `@x402api/agent-wallet-cli@0.2.3`. A compatible
+The current integration targets `@x402api/agent-wallet-cli@0.2.4`. A compatible
 live term is marked `agentWalletSupported: true` and must use the sponsored
 Base USDC or Solana USDC/USDT launch profile with buyer native fees disabled.
 For the current declaration, x402api pays actual gas from its platform treasury

package/skills/warpmetal/references/payments.md

@@ -16,10 +16,16 @@ The separate x402api Agent Wallet owns encrypted network keys, balance checks,
 payment authorization, and durable payment attempts. Never merge their state
 files or pass a WarpMetal credential to `x402api`.
 
+The CLI includes the matching `@x402api/agent-wallet-core` SDK. That SDK is the
+authoritative buyer-side parser and signer contract. WarpMetal retains its own
+merchant-side validation because the backend is Python and additionally binds
+the challenge to WarpMetal's exact resource, amount, recipient, and receipt
+contract.
+
 WarpMetal runs on Node.js 20 or 22. The x402api Agent Wallet currently requires
 Node.js 22. Use the exact published package reported by
 `paymentWorkflow.signerPackage.spec`; the current contract is
-`@x402api/agent-wallet-cli@0.2.3`. Do not add it as a WarpMetal dependency,
+`@x402api/agent-wallet-cli@0.2.4`. Do not add it as a WarpMetal dependency,
 install executable wallet code from an unpinned repository URL, or substitute
 a similarly named package.
 
@@ -130,7 +136,7 @@ reservation or any buyer-funded, unsupported, or unbound alternative.
 
 x402api pays actual gas from its platform treasury. The merchant tenant's
 active sponsorship allowance controls admission, but actual gas is not a
-tenant debit. During the coordinated rollout, accept only the exact 0.2.3
+tenant debit. During the coordinated rollout, accept only the exact 0.2.4
 platform-treasury declaration or the matched legacy tenant-credit declaration;
 never accept a mixed billing and final-charge policy.
 

package/src/payment.js

@@ -15,7 +15,7 @@ const MAX_ARTIFACT_BYTES = 1024 * 1024;
 const MAX_SIGNATURE_BYTES = 512 * 1024;
 
 export const AGENT_WALLET_PACKAGE = "@x402api/agent-wallet-cli";
-export const AGENT_WALLET_VERSION = "0.2.3";
+export const AGENT_WALLET_VERSION = "0.2.4";
 const AGENT_WALLET_SPEC = `${AGENT_WALLET_PACKAGE}@${AGENT_WALLET_VERSION}`;
 const GAS_SPONSORSHIP_EXTENSION = "com.x402api.gas-sponsorship";
 const BASE_NETWORK = "eip155:8453";
@@ -183,6 +183,9 @@ function paymentResource(value, label) {
 function validateGasSponsorship(declaration) {
   const info = declaration.info;
   const schema = declaration.schema;
+  // Mirror @x402api/agent-wallet-core: platform treasury is canonical, the
+  // matched tenant-credit pair remains rollout-compatible, and mixed pairs
+  // must fail closed.
   const platformTreasuryPolicy =
     isObject(info) &&
     info.billingParty === "platform_treasury" &&