[vvillait88]

Summary

Maintenance sweep release, 3.1.6.

• @agent-score/sdk ^2.9.3 to ^2.9.4 (the sweep release; its published code differs only in the user-agent version).
• viem 2.57.8 to 2.57.11 (dev pin and override), moving with pay and the storefronts as the coupled set. 2.57.10 renamed viem/tempo's nativeMultisig exports to configurableAccount; nothing here, in mppx or in @solana/mpp references either name. 2.57.11 is fixes. mppx did not move (0.15.0 is latest), so the EIP-712 proof domain is unchanged.
• dotenv 18.0.9 (dev).
• repository.url to git+https://github.com/agentscore/node-commerce.git, the form npm already rewrites it to at publish (the publish log's "auto-corrected some errors in your package.json" warning).

Hand-implemented specs, read against upstream and against what the storefronts serve: A2A (PROTOCOL_VERSION '1.0'; upstream v1.0.1 is a spec patch, and the card's version is major.minor), UCP (2026-08-25, upstream latest), MPP payment discovery (draft-01, the only draft), x402scan discovery, Agent Skills and llms.txt (no upstream change since the last discovery commit). Live on all three stores: agent card supportedInterfaces[0].protocolVersion 1.0, UCP 2026-08-25 on the two goods stores, every x-payment-info operation declares a 2xx response, skill.md metadata values are all strings, /llms.txt serves with the Link header, and an unauthenticated POST {} to a payable route answers 402.

Worked with: Varun, who asked for the sweep.

Not taken: knip 6.43.0 (inside the 24h release-age soak) and typescript 7 (held org-wide).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

lint, typecheck, typecheck:examples, knip, build and test (1637 passed, 4 skipped) all exit 0 locally; osv-scanner reports no issues. The coupled set's live all-rails settle runs once the storefronts deploy on viem 2.57.11, and its result is recorded here.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of e3eef75 (base 1ea3822). No blocking findings.

Lock. The lock moves exactly sdk 2.9.4, dotenv 18.0.9, viem 2.57.11 and viem/ox 0.14.57. The manifest edits are the matching ranges, the viem override, the version and repository.url. bun install --frozen-lockfile is clean.

Pins and outdated.

• bun outdated --filter '*' lists only knip (release-age) and typescript (hold).
• The exact dev pins all equal npm latest: @x402/core, @x402/evm and @x402/extensions at 2.28.0, mppx 0.15.0, viem 2.57.11.
• The viem change against Tempo is the same as on pay docs: import the payment-handler builders the UCP example uses #145. In viem/tempo chainConfig.js (2.57.8 to 2.57.11), the only nonce change is that an explicit nonceKey: 0n no longer forces nonce = 0. mppx's tempo charge prepares with nonceKey: 'expiring', an unchanged branch.

Gates at the head.

• lint, knip, build, test (1637 passed, 4 skipped), typecheck and typecheck:examples all exit 0.
• Typecheck resolves @agent-score/commerce through dist, so it needs a build first. CI and the pre-push hook both build first, so this is not a finding, only why a cold typecheck prints 30 TS2307s.
• All 9 PR checks are green, and no dependabot PRs are open.

OSV. With the toml: 842 packages, "No issues found". With an empty config: the single finding is GHSA-mrhx-c7xc-m3w5 on zod 3.25.76, so the existing version-scoped override still matches and is not stale.

Check 11, live spot-check.

• A2A: /.well-known/agent-card.json on all three stores serves supportedInterfaces[].protocolVersion ["1.0"], matching PROTOCOL_VERSION = '1.0'. Upstream latest is v1.0.1 (2026-05-28), a patch.
• UCP: /.well-known/ucp on agents.martinestate.com and agents.sayerandstone.com serves ucp.version and the dev.ucp.shopping service at 2026-08-25, which is upstream's latest release (v2026-08-25). The 2026-04-08 entries are the com.agentscore.identity capability version, as intended. FullEnrich answers 404, consistent with the body's "two goods stores".
• llms.txt: /llms.txt returns 200 with link: </llms.txt>; rel="describedby" on all three stores.
• FullEnrich /openapi.json: 8 operations carry x-payment-info, and none is missing a 2xx response.
• An unauthenticated POST {} to /company/lookup answers 402 with the tempo/charge challenge.

Every claim I sampled matches.

[vvillait88]

Coupled-set live settle, run 2026-10-25 against FullEnrich on the deployed stores (commerce 3.1.6, viem 2.57.11, image tags matching each merge commit), from the smoke wallet on agentscore-pay 0.7.5 (also viem 2.57.11). Balances read with agentscore-pay balance before and after each round.

Call	Price	Base	Solana	Tempo
company/lookup (ungated, our own domain)	0.02	1.710968 to 1.690968 (-0.020000)	0.310000 to 0.290000 (-0.020000)	0.184282 to 0.164251 (-0.020031, incl. network fee)
person/enrich/work-email (gated, our own name and domain, stored Passport)	0.07	1.690968 to 1.620968 (-0.070000)	0.290000 to 0.220000 (-0.070000)	0.164251 to 0.094220 (-0.070031, incl. network fee)

Every call returned 200 with payment_status: completed, x402 on Base and MPP charge on Tempo and Solana. The gated calls passed the identity gate and returned the enrichment result, so verification, settlement and the zero-amount proof domain agree across agent and verifier on every rail.