[vvillait88]

Summary

Maintenance sweep for pay, released as 0.7.2.

• Tempo/MPP coupled set: mppx 0.13.4 to 0.13.5 and viem 2.57.4 to 2.57.7 (dependency and override). The Tempo proof EIP-712 domain version in mppx 0.13.5's dist/tempo/internal/proof.js is still 3, so verifiers on 0.13.x still agree. @solana/mpp 0.7.0 and @x402/* 2.28.0 are already latest.
• incur 0.7.0 to 0.7.1. 0.7.1 imports @modelcontextprotocol/server and /stdio with literal specifiers, so bun's compile tracing follows them and the compile-time patch is removed.
• Solana: @solana/kit ^8.5.0, @solana-program/system ^0.16.0 and @solana-program/token ^0.18.0; both programs peer @solana/kit ^8.5.0.
• Dev tooling: eslint 10 and @eslint/js 10 with eslint-plugin-import-x in place of eslint-plugin-import, and tsup 9, whose own esbuild ^0.28.2 dependency makes the esbuild override redundant (a clean install resolves a single esbuild 0.28.2 without it). eslint 10's new default rules flagged six dead initial = null assignments and one timeout rethrow without a cause; all are fixed, and the timeout error now carries the abort as its cause. The dependabot eslint major ignore is removed.
• In-range refresh: vitest 5.0.5, tsx 4.23.15, dotenv 18.0.8, lefthook 2.2.2, typescript-eslint 8.71.2.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: TypeScript stays on 6, since typescript-eslint 8.71.2 still peers typescript <6.1.0. The live all-rails settle the coupled set owes needs both sides on the new versions, so it runs after the FullEnrich store takes mppx 0.13.5 and viem 2.57.7; the result will be recorded on this PR. The consumers (FLEET_PAY_VERSION in the hivemind, the storefronts' coupled pins) move in their own repos after the tag.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. Command surface, flags and output shapes are unchanged.

Test plan

Run locally under Node 24: lint, typecheck, knip, test (547 passed, 2 skipped) and build, each exit 0. osv-scanner 2.7.0 over bun.lock reports no issues across 612 packages. incur serveCli protocol: the compiled darwin-arm64 binary, built without the patch, reports its version, renders config get --format yaml, and answers an MCP initialize (serverInfo agentscore-pay) and tools/list (search_tools, get_tool_details, call_read_tool, call_write_tool) over stdio. The error-envelope tests are part of the suite above.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Live coupled-set settle, 2026-10-18, both sides on the new versions: buyer agentscore-pay 0.7.2 (mppx 0.13.5, viem 2.57.7) against the FullEnrich store deployed with @agent-score/commerce 3.1.2, mppx 0.13.5 and viem 2.57.7.

Per rail, one ungated call (POST /company/lookup, $0.02) and one gated call (POST /person/enrich/work-email with the stored Passport, $0.07, charged only on delivery), paid from the smoke wallet. Evidence is each chain's USDC balance before and after, read with agentscore-pay balance:

Rail	Protocol	Before	After	Moved	Prices paid
Base	x402	1.890968	1.800968	0.090000	0.02 + 0.07
Tempo	MPP	0.364553	0.274344	0.090209	0.02 + 0.07, plus 0.000209 network fee
Solana	MPP	0.490000	0.400000	0.090000	0.02 + 0.07

The first gated call on Base returned service_timeout from the enrichment upstream with payment_status: no_charge, and the balance confirmed no charge. Retrying the same body resumed the job and charged once on delivery, which is the store's documented retry path.