From 02a26861e7c68374d51634b2e563b58d33b2b428 Mon Sep 17 00:00:00 2001
From: Eras256 <219895655+Eras256@users.noreply.github.com>
Date: Fri, 23 Oct 2026 11:01:01 -0600
Subject: [PATCH 1/4] docs: fix stale repo name, audit scope wording, and RLS
 status

- actions/verify-audit-cid/README.md and packages/sdk-python/README.md
  still pointed at nirium-protocol/nirium-sdk, the pre-rename repo
  name. It redirects, but the real name is nirium-protocol/nirium.
- docs/FOR-REVIEWERS.md: the OtterSec audit line said "the vault
  strategy (Etherfuse CETES on Blend v2) was audited" without
  flagging that the Etherfuse pool itself sits outside that scope -
  the README's own "Networks" section already states this correctly,
  this page didn't match it. Also called the public mirror and this
  repo "two independent places citing the same transactions" when
  they're not independent - one is a manual sync of the other; the
  chain is what's actually independent. Fixed the stale
  Eras256/Nirium links to nirium-protocol/nirium-core. Re-verified
  every tx hash, contract address, PR/issue state and the GrantFox
  count live before updating "Last verified".
- SECURITY.md: the RLS fix noted 6 affected tables and called the
  migration "prepared but not yet applied". A 7th table (webhooks)
  turned out to have the same exposure, and all 7 are now fixed and
  re-verified (anon key gets Content-Range: */0 on all of them).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 SECURITY.md                        |  2 +-
 actions/verify-audit-cid/README.md |  2 +-
 docs/FOR-REVIEWERS.md              | 17 +++++++++--------
 packages/sdk-python/README.md      |  2 +-
 4 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index f7955cc..14b3a30 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -79,7 +79,7 @@ The Soroban contracts, the frontend at nirium.xyz and the agent API at nirium-ag
 - domainLock and response obfuscation modules exist in the repo but are not mounted on any route. **Update, 2026-10-12 (checked against the agent codebase that day):** this line previously also listed "AML screening" as a live control. The AML middleware was never imported or mounted on any route and has been removed as dead code.
 
 **Infrastructure:**
-- Row Level Security (RLS) on all Supabase tables - **Update, 2026-10-23 (checked against the live project that day, read-only HEAD requests with no row content fetched):** this line was false for six tables (`auth_keys`, `payroll_runs`, `treasury_vaults`, `security_events`, `sandbox_accounts`, `sandbox_usage`), all readable in full by the public anon key the browser ships, because the agent's own backend used that same anon key for privileged access and their RLS policies were left permissive to compensate. The agent's database client has been switched to the service_role key (which does not depend on RLS at all); a migration to remove the permissive policies and restrict those six tables to `service_role` is prepared but not yet applied to the live project as of this update. Tables that stay intentionally open to anon (`logs`, `agent_logs`, `nirium_swarm_agents`, `strategies`, `nirium_protocol_records` - the public verifiable feed; `vault_delegations`'s anon insert/update/active-only-select, a documented design relying on on-chain signature verification, not RLS; `nirium_llm_config`, documented as holding no sensitive data) are not covered by this line and were not changed.
+- Row Level Security (RLS) on all Supabase tables - **Update, 2026-10-23 (checked against the live project that day, read-only HEAD requests with no row content fetched):** this line was false for six tables (`auth_keys`, `payroll_runs`, `treasury_vaults`, `security_events`, `sandbox_accounts`, `sandbox_usage`), all readable in full by the public anon key the browser ships, because the agent's own backend used that same anon key for privileged access and their RLS policies were left permissive to compensate. The agent's database client has been switched to the service_role key (which does not depend on RLS at all); a migration to remove the permissive policies and restrict those six tables to `service_role` is prepared but not yet applied to the live project as of this update. Tables that stay intentionally open to anon (`logs`, `agent_logs`, `nirium_swarm_agents`, `strategies`, `nirium_protocol_records` - the public verifiable feed; `vault_delegations`'s anon insert/update/active-only-select, a documented design relying on on-chain signature verification, not RLS; `nirium_llm_config`, documented as holding no sensitive data) are not covered by this line and were not changed. **Update, 2026-10-23, later the same day (re-checked against the live project with the same read-only method):** a seventh table, `webhooks`, had the same exposure - its `secret` column is a raw HMAC signing key, stored in plaintext by necessity (it has to be the real key to sign outgoing payloads with), so this one was genuinely recoverable in cleartext, not just a hash. All seven tables' migrations have been applied to the live project and re-verified: the anon key now gets `Content-Range: */0` on all seven. The three `webhooks` rows that were exposed were already `active: false` test endpoints; their secrets were rotated before the fix landed. Closed.
 - Non-custodial architecture - users retain sole key control
 - HMAC-SHA256 signed immutable audit trail per agent action
 - x402/MPP payment validation middleware on all premium routes
diff --git a/actions/verify-audit-cid/README.md b/actions/verify-audit-cid/README.md
index 39d8d11..e0033cc 100644
--- a/actions/verify-audit-cid/README.md
+++ b/actions/verify-audit-cid/README.md
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: nirium-protocol/nirium-sdk/actions/verify-audit-cid@main
+      - uses: nirium-protocol/nirium/actions/verify-audit-cid@main
         id: audit
         with:
           cid: QmSSZdtt3dQ8BqUm62zrKQ85E4BUHYiVfvDgZmHfJsqU1U
diff --git a/docs/FOR-REVIEWERS.md b/docs/FOR-REVIEWERS.md
index f767ced..36015e4 100644
--- a/docs/FOR-REVIEWERS.md
+++ b/docs/FOR-REVIEWERS.md
@@ -29,13 +29,14 @@ Three things you can check on Stellar Expert directly:
 - Autonomous invest, **the agent signs** - this is the one that matters: the agent moved funds it doesn't own, and the contract gave it no way to take them out. [`82d73f53…6b3d4`](https://stellar.expert/explorer/public/tx/82d73f537e907140367f9343f63a36704c74a5286aced7a938cee8fffb56b3d4)
 - The vault contract itself, roles readable on-chain: [`CAMDXG6L…K57MH`](https://stellar.expert/explorer/public/contract/CAMDXG6L4LXLXXV675KZSHM3BMSETZ4NVMC7JYIQCZ2JTG54OMSK57MH)
 
-The underlying vault strategy (Etherfuse CETES on Blend v2) was audited by
-OtterSec, March 2025 - 16 findings, all 13 vulnerabilities resolved. Full
-writeup with the same links: [this repo's own README, "Networks"
+The DeFindex vault and its Blend v2 strategy code were audited by OtterSec
+(March 2025: 16 findings, 13 of them vulnerabilities, all resolved). The
+Etherfuse CETES pool itself is outside that audit. Full writeup with the
+same links: [this repo's own README, "Networks"
 section](../README.md#networks), and the identical evidence is
-cross-referenced in the full [Eras256/Nirium
-mirror](https://github.com/Eras256/Nirium) - two independent places
-citing the same verifiable transactions, not two different claims.
+cross-referenced in the full [nirium-core
+mirror](https://github.com/nirium-protocol/nirium-core) - both our repos
+cite the same transactions; the chain is the independent source.
 
 ## 3. A real partner integration, not a listed logo
 
@@ -54,7 +55,7 @@ The demo-app integration itself,
 
 **Another real integration, publicly thanked by the protocol, not just a logo.** [Trustless-Work/agentic-escrow-research](https://github.com/Trustless-Work/agentic-escrow-research): 4 PRs merged on 21-sep-2026 ([#1](https://github.com/Trustless-Work/agentic-escrow-research/pull/1), [#2](https://github.com/Trustless-Work/agentic-escrow-research/pull/2), [#3](https://github.com/Trustless-Work/agentic-escrow-research/pull/3), [#4](https://github.com/Trustless-Work/agentic-escrow-research/pull/4)), thanked by name by Trustless Work's official account.
 
-**A real escrow cycle, liquidated with real money, not a description of one.** Beyond the 4 merged PRs above, Nirium ran Trustless Work's own Multi-Release escrow contract end to end on mainnet, 3-sep-2026: deploy → fund → approve → release, a real 0.50 USDC, self-directed (one key holding every role, proving the mechanism, not a decision to open this flow to Payouts production - that stays behind legal review). Four confirmed transactions, receiver balance moved by exactly 0.4985 USDC (0.50 minus Trustless Work's fixed 0.3% fee): [`4110dd16…12aefe84`](https://stellar.expert/explorer/public/tx/4110dd16df6c7cdaf50d89f7402e3e51de0ac4f63255f6601e800e3912aefe84) → [`7b181a13…451c09c`](https://stellar.expert/explorer/public/tx/7b181a13160d6d7170f78ba9a4e15309cc0a8f6e20a1db01adfcdb667451c09c) → [`a3aa35a2…4096ca5`](https://stellar.expert/explorer/public/tx/a3aa35a272774547d3ca4ce5a32e361641daac6cf829ecf8951b83a194096ca5) → [`0c533088…a8192b`](https://stellar.expert/explorer/public/tx/0c533088ab6326a78b9f79c197b7636ca4662a0d72562968ddea37f370a8192b). Full detail, including the deploy-path timing evidence, in the [Eras256/Nirium mirror's README](https://github.com/Eras256/Nirium#readme).
+**A real escrow cycle, liquidated with real money, not a description of one.** Beyond the 4 merged PRs above, Nirium ran Trustless Work's own Multi-Release escrow contract end to end on mainnet, 3-sep-2026: deploy → fund → approve → release, a real 0.50 USDC, self-directed (one key holding every role, proving the mechanism, not a decision to open this flow to Payouts production - that stays behind legal review). Four confirmed transactions, receiver balance moved by exactly 0.4985 USDC (0.50 minus Trustless Work's fixed 0.3% fee): [`4110dd16…12aefe84`](https://stellar.expert/explorer/public/tx/4110dd16df6c7cdaf50d89f7402e3e51de0ac4f63255f6601e800e3912aefe84) → [`7b181a13…451c09c`](https://stellar.expert/explorer/public/tx/7b181a13160d6d7170f78ba9a4e15309cc0a8f6e20a1db01adfcdb667451c09c) → [`a3aa35a2…4096ca5`](https://stellar.expert/explorer/public/tx/a3aa35a272774547d3ca4ce5a32e361641daac6cf829ecf8951b83a194096ca5) → [`0c533088…a8192b`](https://stellar.expert/explorer/public/tx/0c533088ab6326a78b9f79c197b7636ca4662a0d72562968ddea37f370a8192b). Full detail, including the deploy-path timing evidence, in the [nirium-core mirror's README](https://github.com/nirium-protocol/nirium-core#readme).
 
 ## 4. Upstream contributions - bugs fixed in code we don't control
 
@@ -116,4 +117,4 @@ omit it - caught 2026-09-28 re-verifying this page.
 
 *Every number and link on this page was checked live against its source
 (Horizon, GitHub's API, the running API itself) before being written down
-- not copied from an internal doc or an earlier draft. Last verified: 28 Sep 2026.*
+- not copied from an internal doc or an earlier draft. Last verified: 23 Oct 2026.*
diff --git a/packages/sdk-python/README.md b/packages/sdk-python/README.md
index 06f065a..b93f42d 100644
--- a/packages/sdk-python/README.md
+++ b/packages/sdk-python/README.md
@@ -249,7 +249,7 @@ Anchor a **hash** rather than the data itself: IPFS content cannot be deleted, s
 - [Developer Sandbox](https://nirium.xyz/sandbox)
 - [API Reference](https://nirium.xyz/docs/api)
 - [MCP Server Integration](https://nirium.xyz/docs/mcp)
-- [GitHub](https://github.com/nirium-protocol/nirium-sdk)
+- [GitHub](https://github.com/nirium-protocol/nirium)
 
 ## License
 

From b7f7a32dfd7c8572a7e801c8816bd8561ef6b199 Mon Sep 17 00:00:00 2001
From: Eras256 <219895655+Eras256@users.noreply.github.com>
Date: Fri, 23 Oct 2026 15:51:27 -0600
Subject: [PATCH 2/4] fix(security): allowlist GHSA-mrhx-c7xc-m3w5, no
 compatible fix exists
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

zod < 4.6.6 (high, CWE-770 memory exhaustion validating oversized
arrays) is only fixed in zod 4.6.6+. @x402/core 2.28.0, the latest
published version, still requires zod ^3.24.2, which cannot resolve
to 4.x. No patched 3.x release of zod exists either.

npm has no package.json-level allowlist equivalent to pnpm's
auditConfig.ignoreGhsas, so this uses audit-ci instead, scoped to
exactly this one advisory — verified live (sdk, cli, mcp each go from
exit 1 to exit 0 with `--allowlist GHSA-mrhx-c7xc-m3w5`, same
lockfile, nothing else touched). The same GHSA also resolves via a
second, unrelated path in all three packages
(@stellar/mpp > mppx > viem/abitype/incur > zod@4.4.3, which CAN
reach zod 4.6.6+ since every package in that chain already accepts
zod ^4.x) — audit-ci's allowlist matches by advisory ID regardless of
path, so this is covered by the same one-line change, not forced via
override.

Exposure assessment (x402Serve(), the question of whether a client
could trigger this via a paid-route request): the client-submitted
payment proof travels in the PAYMENT-SIGNATURE header, base64-encoded
JSON (@x402/core's extractPayment()/decodePaymentSignatureHeader()),
not the request body — Node's default http.maxHeaderSize (16KB,
shared across all headers) caps what reaches JSON.parse regardless of
anything in this codebase or @x402/core/@x402/express/@x402/stellar,
none of which override it. The zod schemas that validate that
decoded payload (PaymentPayloadV1Schema: payload: Any;
PaymentPayloadV2Schema: accepted: <single object>) don't contain an
unconstrained array — this GHSA's specific "oversized array" OOM
mechanism isn't reachable through that path. The unconstrained arrays
that do exist in @x402/core (PaymentRequiredV1Schema/V2Schema's
`accepts: z.array(...).min(1)`, no .max()) validate the outgoing 402
challenge the server itself constructs from its own routes config,
not something a client submits.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/security-gate.yml | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/security-gate.yml b/.github/workflows/security-gate.yml
index 45af5bf..feb24e7 100644
--- a/.github/workflows/security-gate.yml
+++ b/.github/workflows/security-gate.yml
@@ -18,23 +18,35 @@ jobs:
         with:
           node-version: '22'
 
+      # GHSA-mrhx-c7xc-m3w5 (zod < 4.6.6, high, memory exhaustion on
+      # oversized array validation): only fixed in zod 4.6.6+, but
+      # @x402/core 2.28.0 (latest published) still requires zod ^3.24.2,
+      # which cannot resolve to 4.x. The same GHSA also shows up via
+      # @stellar/mpp > mppx > viem/abitype/incur > zod@4.4.3 - that path
+      # CAN reach zod 4.6.6+ (every package in that chain already accepts
+      # zod ^4.x), but hasn't been forced to on its own; allowlisted here
+      # too rather than attempting a scoped override untested in this
+      # repo. No compatible fix exists for the @x402/core path as of
+      # 2026-10-23. Every other high finding still blocks the build.
+      # Revisit when @x402/core moves to zod 4 (no issue filed upstream
+      # yet as of this date).
       - name: SDK — npm audit (high+ — blocks build)
         working-directory: packages/sdk
         run: |
           npm install --legacy-peer-deps
-          npm audit --audit-level=high
+          npx audit-ci@7 --high --allowlist GHSA-mrhx-c7xc-m3w5
 
       - name: CLI — npm audit (high+ — blocks build)
         working-directory: packages/cli
         run: |
           npm install --legacy-peer-deps
-          npm audit --audit-level=high
+          npx audit-ci@7 --high --allowlist GHSA-mrhx-c7xc-m3w5
 
       - name: MCP — npm audit (high+ — blocks build)
         working-directory: packages/mcp
         run: |
           npm install --legacy-peer-deps
-          npm audit --audit-level=high
+          npx audit-ci@7 --high --allowlist GHSA-mrhx-c7xc-m3w5
 
   python-audit:
     name: Python Supply Chain Audit

From f2179b044074ae455cd5c43080dcd0d4b369ca6a Mon Sep 17 00:00:00 2001
From: Eras256 <219895655+Eras256@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:10:54 -0600
Subject: [PATCH 3/4] fix(security): actually fix the mppx/zod path where it's
 safe to
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to b7f7a32, which allowlisted GHSA-mrhx-c7xc-m3w5 wholesale
without distinguishing its two separate paths. Tested properly this
time, per the explicit ask to verify rather than assume, and the
result differs by package:

sdk and cli: @stellar/mpp > mppx > viem/abitype/incur > zod resolved
below 4.6.6 (the patched version), but every package on that chain
already declares zod ^4.x in its own peerDependencies — nothing pins
it low, it just never got bumped. Fixed with a nested override
("overrides": { "mppx": { "zod": "^4.6.6" }, "@stellar/mpp": {...},
"viem": {...} }), scoped to only those three parents so it never
touches @x402/core's zod ^3.x dependency. Verified: `npm ls zod` shows
the whole subtree resolving to a patched version in both packages,
both still build clean. Proved the allowlist stays correctly scoped
by temporarily installing a real unrelated critical advisory
(GHSA-xvch-5gv4-984h via minimist@1.2.0, as a real tracked dependency,
not extraneous) and confirming the gate still failed on it while
passing on the zod one - reverted after.

mcp: tried the identical override and it broke something real, not
just a warning - `npm error code ELSPROBLEMS: invalid: zod@3.25.76`,
because mcp's own direct "zod": "^3.25.0" dependency conflicts with
@modelcontextprotocol/sdk wanting ^4.6.6 once the override applies.
npm's flatter resolution here doesn't give the same per-branch
isolation that let this exact pattern work safely in nirium-core
(pnpm). Reverted; mcp keeps the allowlist-only fix from b7f7a32.
Separately noticed while testing, unrelated to this fix and not
touched here: mcp's built server can't currently boot at all on a
pristine clone of this repo's unmodified main - `Cannot find package
'viem'` from mppx/dist/evm/client/Charge.js.

@x402/core (resolved in all three packages, 2.28.0) still requires
zod ^3.24.2, which cannot resolve to 4.x even with the override -
confirmed against the latest published @x402/core, same range. No
patched 3.x release of zod exists either. That's what's still
allowlisted via audit-ci in all three packages.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 .github/workflows/security-gate.yml |  49 +++--
 packages/cli/package-lock.json      | 163 +++++++---------
 packages/cli/package.json           |  11 +-
 packages/mcp/package-lock.json      |   6 +-
 packages/sdk/package-lock.json      | 282 ++++++++++++++++------------
 packages/sdk/package.json           |  11 +-
 6 files changed, 284 insertions(+), 238 deletions(-)

diff --git a/.github/workflows/security-gate.yml b/.github/workflows/security-gate.yml
index feb24e7..320cffd 100644
--- a/.github/workflows/security-gate.yml
+++ b/.github/workflows/security-gate.yml
@@ -19,17 +19,44 @@ jobs:
           node-version: '22'
 
       # GHSA-mrhx-c7xc-m3w5 (zod < 4.6.6, high, memory exhaustion on
-      # oversized array validation): only fixed in zod 4.6.6+, but
-      # @x402/core 2.28.0 (latest published) still requires zod ^3.24.2,
-      # which cannot resolve to 4.x. The same GHSA also shows up via
-      # @stellar/mpp > mppx > viem/abitype/incur > zod@4.4.3 - that path
-      # CAN reach zod 4.6.6+ (every package in that chain already accepts
-      # zod ^4.x), but hasn't been forced to on its own; allowlisted here
-      # too rather than attempting a scoped override untested in this
-      # repo. No compatible fix exists for the @x402/core path as of
-      # 2026-10-23. Every other high finding still blocks the build.
-      # Revisit when @x402/core moves to zod 4 (no issue filed upstream
-      # yet as of this date).
+      # oversized array validation): two separate paths resolved to it
+      # in each package below.
+      #
+      # @stellar/mpp > mppx > viem/abitype/incur > zod was fixed for
+      # real, in sdk and cli, via a nested override (package.json's
+      # "overrides": { "mppx": { "zod": "^4.6.6" }, "@stellar/mpp": {...},
+      # "viem": {...} }) — every package on that path already accepts
+      # zod ^4.x, so this bumps it to a patched version rather than
+      # forcing anything. Verified 2026-10-23: `npm ls zod` shows that
+      # whole subtree resolving to 4.6.7/4.6.2→4.6.7 in both packages;
+      # both still build clean; a live test (temporarily installing a
+      # real unrelated critical advisory, GHSA-xvch-5gv4-984h via
+      # minimist@1.2.0) confirmed the allowlist below does NOT swallow
+      # it — the gate still failed on that one while passing on this
+      # GHSA, proving the allowlist is scoped to exactly this advisory,
+      # not a blanket pass.
+      #
+      # mcp does NOT get the same override — tried it, and it produces
+      # a real `npm error code ELSPROBLEMS: invalid: zod@3.25.76`
+      # (mcp's own direct "zod": "^3.25.0" dependency conflicts with
+      # @modelcontextprotocol/sdk wanting ^4.6.6 once the override is
+      # applied; npm's flatter resolution here doesn't give the same
+      # per-branch isolation pnpm gives the equivalent case in
+      # nirium-core). Reverted; mcp keeps the allowlist-only fix.
+      # (Separately, confirmed on a pristine clone of this repo's
+      # unmodified main: mcp's built server currently can't boot at all
+      # - `Cannot find package 'viem'` from mppx/dist/evm/client -
+      # pre-existing, unrelated to this fix, not touched here.)
+      #
+      # @x402/core (resolved in all three packages, 2.28.0) still
+      # requires zod ^3.24.2, which cannot resolve to 4.x even with the
+      # override — confirmed against the latest published @x402/core,
+      # same range. No patched 3.x release of zod exists either. That
+      # instance is what's allowlisted below in all three packages -
+      # the only path left reaching this GHSA in sdk/cli after the
+      # override, and the only mechanism available for mcp. Every other
+      # high finding still blocks the build. Revisit when @x402/core
+      # moves to zod 4 (no issue filed upstream yet as of this date).
       - name: SDK — npm audit (high+ — blocks build)
         working-directory: packages/sdk
         run: |
diff --git a/packages/cli/package-lock.json b/packages/cli/package-lock.json
index f0e38ee..332f92b 100644
--- a/packages/cli/package-lock.json
+++ b/packages/cli/package-lock.json
@@ -294,15 +294,15 @@
       }
     },
     "node_modules/@x402/stellar/node_modules/@stellar/stellar-sdk": {
-      "version": "16.3.1",
-      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.3.1.tgz",
-      "integrity": "sha512-PPM1JA51NChSPyMkh+T9sHxJtP/v9e9Gcyc2BMNvnGvbZwqoKJclRSdPgmalLDAmTnTewGs7VMM9nRxDeCzzgQ==",
+      "version": "16.4.1",
+      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.4.1.tgz",
+      "integrity": "sha512-0kT+ShOUE6dc0smLEsajuizss1hvlGDsCooM88FqgxNOCKpY8IuQPzCs75RNKMSMITz+dX7KZ5qGhQ2EWGMTTg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^3.1.0",
         "@noble/hashes": "^2.2.0",
         "@stellar/js-xdr": "4.0.0",
-        "axios": "1.18.0",
+        "axios": "1.20.0",
         "base32.js": "^0.1.0",
         "bignumber.js": "^11.1.4",
         "buffer": "^6.0.3",
@@ -464,18 +464,18 @@
       }
     },
     "node_modules/body-parser": {
-      "version": "2.3.0",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
-      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.4.0.tgz",
+      "integrity": "sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==",
       "license": "MIT",
       "dependencies": {
         "bytes": "^3.1.2",
-        "content-type": "^2.0.0",
+        "content-type": "^2.1.0",
         "debug": "^4.4.3",
         "http-errors": "^2.0.1",
-        "iconv-lite": "^0.7.2",
+        "iconv-lite": "^0.7.3",
         "on-finished": "^2.4.1",
-        "qs": "^6.15.2",
+        "qs": "^6.16.1",
         "raw-body": "^3.0.2",
         "type-is": "^2.1.0"
       },
@@ -487,19 +487,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/buffer": {
       "version": "6.0.3",
       "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
@@ -602,9 +589,9 @@
       }
     },
     "node_modules/content-disposition": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
-      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
+      "integrity": "sha512-e+H0ZXHSWYrENhQzw1LPuP4oF5MzVKmDU6d3hxlvaPEYLLg62MxtQNPRx4SYSuYJSBUgnQIG4HIN2tEtNv7Dog==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -615,12 +602,16 @@
       }
     },
     "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie": {
@@ -807,15 +798,15 @@
       }
     },
     "node_modules/express": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/express/-/express-5.2.1.tgz",
-      "integrity": "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw==",
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/express/-/express-5.3.0.tgz",
+      "integrity": "sha512-qCqy1xSoaugxOD4IVHb1ZWdkvCF2W3aE2okKouWj8VwJ+ztskSiXoBnCSJqfKT+cVPJhuJqe9YLbY425+Zh00g==",
       "license": "MIT",
       "dependencies": {
         "accepts": "^2.0.0",
-        "body-parser": "^2.2.1",
-        "content-disposition": "^1.0.0",
-        "content-type": "^1.0.5",
+        "body-parser": "^2.3.0",
+        "content-disposition": "^2.0.1",
+        "content-type": "^2.0.0",
         "cookie": "^0.7.1",
         "cookie-signature": "^1.2.1",
         "debug": "^4.4.0",
@@ -831,14 +822,14 @@
         "on-finished": "^2.4.1",
         "once": "^1.4.0",
         "parseurl": "^1.3.3",
-        "proxy-addr": "^2.0.7",
-        "qs": "^6.14.0",
+        "proxy-addr": "^2.0.8",
+        "qs": "^6.16.0",
         "range-parser": "^1.2.1",
         "router": "^2.2.0",
         "send": "^1.1.0",
         "serve-static": "^2.2.0",
         "statuses": "^2.0.1",
-        "type-is": "^2.0.1",
+        "type-is": "^2.1.0",
         "vary": "^1.1.2"
       },
       "engines": {
@@ -1367,23 +1358,10 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/negotiator/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/nirium": {
-      "version": "0.16.0",
-      "resolved": "https://registry.npmjs.org/nirium/-/nirium-0.16.0.tgz",
-      "integrity": "sha512-SCLUN1VFCKSlWqIliGcaIKeg8Y1G94Cag8DHjoccPi803cAqoztvChmjdfSCy8EHc1ya37GtHww7WU+HZczTaA==",
+      "version": "0.16.1",
+      "resolved": "https://registry.npmjs.org/nirium/-/nirium-0.16.1.tgz",
+      "integrity": "sha512-ZGBAA//Dz1GQuJ96SZQyEZmOq13udv55P6tT4L2Ufu7Yn2ZojZ/w3+yGn5VtpEcfV08ROLU4eS7+hWljEdXjRg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@stellar/mpp": "^0.7.1",
@@ -1421,15 +1399,15 @@
       }
     },
     "node_modules/nirium/node_modules/@stellar/stellar-sdk": {
-      "version": "16.3.1",
-      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.3.1.tgz",
-      "integrity": "sha512-PPM1JA51NChSPyMkh+T9sHxJtP/v9e9Gcyc2BMNvnGvbZwqoKJclRSdPgmalLDAmTnTewGs7VMM9nRxDeCzzgQ==",
+      "version": "16.4.1",
+      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.4.1.tgz",
+      "integrity": "sha512-0kT+ShOUE6dc0smLEsajuizss1hvlGDsCooM88FqgxNOCKpY8IuQPzCs75RNKMSMITz+dX7KZ5qGhQ2EWGMTTg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^3.1.0",
         "@noble/hashes": "^2.2.0",
         "@stellar/js-xdr": "4.0.0",
-        "axios": "1.18.0",
+        "axios": "1.20.0",
         "base32.js": "^0.1.0",
         "bignumber.js": "^11.1.4",
         "buffer": "^6.0.3",
@@ -1486,15 +1464,19 @@
       }
     },
     "node_modules/on-finished": {
-      "version": "2.4.1",
-      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
-      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.2.tgz",
+      "integrity": "sha512-ATWUv387i+nLD49EiDoOft5scf32Vsdz3ktrQJG9bi7jRFmaXTssvyvj1EmeKVVgvesbqUtvQQvaS2TpTukAZQ==",
       "license": "MIT",
       "dependencies": {
         "ee-first": "1.1.1"
       },
       "engines": {
         "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/once": {
@@ -1861,9 +1843,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.0.tgz",
-      "integrity": "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==",
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.1.tgz",
+      "integrity": "sha512-j7WyPdf0CJoutMzMoPLF/bVXHtKZIT9Rb4eGeEbWw8X2t5oirjPgpL+OpaENZrILYaXqYwnVH+qgUwVbl+pUJQ==",
       "license": "BSD-3-Clause",
       "engines": {
         "node": ">= 18"
@@ -1937,19 +1919,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/type-is/node_modules/content-type": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
-      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/express"
-      }
-    },
     "node_modules/typed-array-buffer": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/typed-array-buffer/-/typed-array-buffer-1.0.3.tgz",
@@ -2022,9 +1991,9 @@
       }
     },
     "node_modules/viem": {
-      "version": "2.56.3",
-      "resolved": "https://registry.npmjs.org/viem/-/viem-2.56.3.tgz",
-      "integrity": "sha512-vUObq3GO7D3lz9gPNEE/xd5jIUnMbeVDWewh252o54pDEDlW4pDe6FEd/qTGL5RyK52cGHMM7kQ3wjxhilEvkQ==",
+      "version": "2.57.10",
+      "resolved": "https://registry.npmjs.org/viem/-/viem-2.57.10.tgz",
+      "integrity": "sha512-gQ6aELkfwvJDeWObxdOwWIQw8coUJhKhXDbyXCMOzzopU1F8s5Xs4l1HWQ4uaXa/uJ1/3uz8DiBU+RozllxPhw==",
       "funding": [
         {
           "type": "github",
@@ -2039,7 +2008,7 @@
         "@scure/bip39": "1.6.0",
         "abitype": "1.2.3",
         "isows": "1.0.7",
-        "ox": "0.14.44",
+        "ox": "0.14.57",
         "ws": "8.21.0"
       },
       "peerDependencies": {
@@ -2088,9 +2057,9 @@
       }
     },
     "node_modules/viem/node_modules/ox": {
-      "version": "0.14.44",
-      "resolved": "https://registry.npmjs.org/ox/-/ox-0.14.44.tgz",
-      "integrity": "sha512-O54qXXHEk4ySamMSyBpI0AeBegS5frxU6+LA6Jb9Sf6kMOxcTNaxYmwZfpOu22DIQsdKfgQxHq8EsAGaoBQScA==",
+      "version": "0.14.57",
+      "resolved": "https://registry.npmjs.org/ox/-/ox-0.14.57.tgz",
+      "integrity": "sha512-CPF6aEFyAuqgL0x7VaFM0vI2/CUd5Qk8+BIL6OnViPw+gF07O/VAhqEPOPw5GYnYPwomIk8mD91gTcQ1RAtupA==",
       "funding": [
         {
           "type": "github",
@@ -2139,9 +2108,9 @@
       }
     },
     "node_modules/which-typed-array": {
-      "version": "1.1.22",
-      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.22.tgz",
-      "integrity": "sha512-fvO4ExWMFsqyhG3AiPAObMuY1lxaqgYcxbc49CNdWDDECOJNgQyvsOWVwbZc+qf3rzRtxojBK+CMEv0Ld5CYpw==",
+      "version": "1.1.24",
+      "resolved": "https://registry.npmjs.org/which-typed-array/-/which-typed-array-1.1.24.tgz",
+      "integrity": "sha512-wk4Mf4pR5mRP7eYuuTBCIQ9d0ud2Fv2jRLQpfgnRjbOxAFHmjKFValgTpitVKzJJS8ajnYQV2Du1SZ8j6b/EUQ==",
       "license": "MIT",
       "dependencies": {
         "available-typed-arrays": "^1.0.7",
@@ -2166,9 +2135,9 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.3",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
-      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -2187,9 +2156,9 @@
       }
     },
     "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -2202,9 +2171,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.6.2",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.2.tgz",
-      "integrity": "sha512-lh5RCAGFa1Cm2hjtNwLQhSs/AsqdWnTQaBER9fEwN/88pSh7KOtJavtBx/0VlkN/uFd61SwYmljLMDAsHlvzBQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/packages/cli/package.json b/packages/cli/package.json
index edf8218..4922356 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -35,7 +35,16 @@
     "follow-redirects": ">=1.16.1",
     "proxy-addr": ">=2.0.8",
     "toml": ">=5.0.1",
-    "qs": ">=6.16.0"
+    "qs": ">=6.16.0",
+    "mppx": {
+      "zod": "^4.6.6"
+    },
+    "@stellar/mpp": {
+      "zod": "^4.6.6"
+    },
+    "viem": {
+      "zod": "^4.6.6"
+    }
   },
   "devDependencies": {
     "@types/node": "^20.19.30",
diff --git a/packages/mcp/package-lock.json b/packages/mcp/package-lock.json
index d926ac6..9cf9c7e 100644
--- a/packages/mcp/package-lock.json
+++ b/packages/mcp/package-lock.json
@@ -494,9 +494,9 @@
       }
     },
     "node_modules/@modelcontextprotocol/sdk": {
-      "version": "1.32.1",
-      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.1.tgz",
-      "integrity": "sha512-2DdE+SJDtzLEEWzY1ZjY7Q+VcPhcV1KisD3zI4u0XZyktsjHum1mwbMI+JaulUBi2OZk+KJAi2uPXzxichPkdw==",
+      "version": "1.32.2",
+      "resolved": "https://registry.npmjs.org/@modelcontextprotocol/sdk/-/sdk-1.32.2.tgz",
+      "integrity": "sha512-SWsVtH/0vULSQStoZ6xxH2K09Li8fXYTMC64ZeogCdpZ3XSi1eCPOByV1OpuJxuI3OcmHhosDWYyii07tpPsLw==",
       "license": "MIT",
       "dependencies": {
         "@hono/node-server": "^1.19.9 || ^2.0.5",
diff --git a/packages/sdk/package-lock.json b/packages/sdk/package-lock.json
index 8ec56c5..d42e653 100644
--- a/packages/sdk/package-lock.json
+++ b/packages/sdk/package-lock.json
@@ -209,23 +209,23 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.7",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
-      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.10.tgz",
+      "integrity": "sha512-EMCx3AGZ3WfAl6ht7AyQoPm2Lh+BGYEMdc4Q6Hf7uSCDOZFuLq44qNwL+iaim8VlyYhRAo4X43+weadK8ZB4Yg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/template": "^7.29.7",
-        "@babel/types": "^7.29.7"
+        "@babel/types": "^7.29.8"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
-      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
+      "version": "7.29.9",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.9.tgz",
+      "integrity": "sha512-CjXrNHTnvqBVqHgdBysY3vk2T8tpJHb5/RMeHJBTyVa9xgugCB0CJTx/3oO8RV2QRQP391RWpB7D6hLjm8V9uA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -493,16 +493,16 @@
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.8",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
-      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
+      "version": "7.29.10",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.10.tgz",
+      "integrity": "sha512-B3lYAs2nkKskbgQ1nfy8Ma9ao9Q1rntTAQHrzzyDuj+TSO+X3le6PfWwqDvodsb+OumE10eMFfuMCTQSQ5iuIQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
         "@babel/generator": "^7.29.8",
         "@babel/helper-globals": "^7.29.7",
-        "@babel/parser": "^7.29.8",
+        "@babel/parser": "^7.29.9",
         "@babel/template": "^7.29.7",
         "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
@@ -1093,9 +1093,9 @@
       }
     },
     "node_modules/@jridgewell/sourcemap-codec": {
-      "version": "1.5.5",
-      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
-      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.6.0.tgz",
+      "integrity": "sha512-T7jf+5zgsZHwNJ4lvQ7/aezbyk0nNX+zJVWpmHA7VYsEx7a7qr5Rg5IbtJFqkgze5Y2sruq1RUY8Q837Od7iFw==",
       "dev": true,
       "license": "MIT"
     },
@@ -1157,9 +1157,9 @@
       }
     },
     "node_modules/@noble/curves": {
-      "version": "1.9.7",
-      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.7.tgz",
-      "integrity": "sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==",
+      "version": "1.9.1",
+      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.1.tgz",
+      "integrity": "sha512-k11yZxZg+t+gWvBbIswW0yoJlu8cHOC7dhunwOzoWH/mXGBiYyR4YY6hAEK/3EUs4UpB8la1RfdRpeGsFHkWsA==",
       "license": "MIT",
       "dependencies": {
         "@noble/hashes": "1.8.0"
@@ -1171,22 +1171,34 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@noble/curves/node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@noble/ed25519": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/@noble/ed25519/-/ed25519-3.1.0.tgz",
-      "integrity": "sha512-pfcObRY3CtvwfaG9Mt5XqZdKmAQppl37tHUeuBhDUbiwJBCVY4/A4lbMvb1xKhMDx96AqAqZpMWuBX1HulhX4g==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/@noble/ed25519/-/ed25519-3.2.0.tgz",
+      "integrity": "sha512-criDgRlnUA09hchYrTy/JUWPIEap5rZxQe6wDWzRx51oWWpDRcUpuNzlgPxDJaOK6AsW9c0wKcj3rKRv6t+bPQ==",
       "license": "MIT",
       "funding": {
         "url": "https://paulmillr.com/funding/"
       }
     },
     "node_modules/@noble/hashes": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
-      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "version": "2.4.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz",
+      "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==",
       "license": "MIT",
       "engines": {
-        "node": "^14.21.3 || >=16"
+        "node": ">= 20.19.0"
       },
       "funding": {
         "url": "https://paulmillr.com/funding/"
@@ -1553,6 +1565,18 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@scure/bip32/node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@scure/bip39": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/@scure/bip39/-/bip39-1.6.0.tgz",
@@ -1566,6 +1590,18 @@
         "url": "https://paulmillr.com/funding/"
       }
     },
+    "node_modules/@scure/bip39/node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
+      "license": "MIT",
+      "engines": {
+        "node": "^14.21.3 || >=16"
+      },
+      "funding": {
+        "url": "https://paulmillr.com/funding/"
+      }
+    },
     "node_modules/@sinclair/typebox": {
       "version": "0.34.52",
       "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
@@ -1620,15 +1656,15 @@
       }
     },
     "node_modules/@stellar/stellar-sdk": {
-      "version": "16.3.0",
-      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.3.0.tgz",
-      "integrity": "sha512-pnB1t4bdnkN8M7tRIcLXnNboq+Hof62NzPMnQrl5MWBNC/d1vUbdrzXgy7yw8I+0hbfz5YN64uVb84BqzIpYiQ==",
+      "version": "16.4.1",
+      "resolved": "https://registry.npmjs.org/@stellar/stellar-sdk/-/stellar-sdk-16.4.1.tgz",
+      "integrity": "sha512-0kT+ShOUE6dc0smLEsajuizss1hvlGDsCooM88FqgxNOCKpY8IuQPzCs75RNKMSMITz+dX7KZ5qGhQ2EWGMTTg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^3.1.0",
         "@noble/hashes": "^2.2.0",
         "@stellar/js-xdr": "4.0.0",
-        "axios": "1.18.0",
+        "axios": "1.20.0",
         "base32.js": "^0.1.0",
         "bignumber.js": "^11.1.4",
         "buffer": "^6.0.3",
@@ -1645,18 +1681,6 @@
         "node": ">=22.0.0"
       }
     },
-    "node_modules/@stellar/stellar-sdk/node_modules/@noble/hashes": {
-      "version": "2.4.0",
-      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-2.4.0.tgz",
-      "integrity": "sha512-X5XaVWZIBCT7HHZGm5I7ZQXDwLG+bGXuSrMQAW+7Zvl87h1kmc1ZB1VSRJcpUfoUrGQp4Fkoxm5kZ+Ms+aW+eA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 20.19.0"
-      },
-      "funding": {
-        "url": "https://paulmillr.com/funding/"
-      }
-    },
     "node_modules/@toon-format/toon": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/@toon-format/toon/-/toon-2.3.1.tgz",
@@ -1802,9 +1826,9 @@
       "license": "MIT"
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.3",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.3.tgz",
-      "integrity": "sha512-60YRaenCQcVjYEKOcG824+DRGGIQ3VKErcBoAEDJZz5bKIs2ZG+X/H9Nk+Q6EVkwJk5QNApxbrc5QtBSwtrXAg==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
       "dev": true,
       "license": "ISC"
     },
@@ -2460,9 +2484,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.19",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.19.tgz",
-      "integrity": "sha512-Grytf1xOxOEMTGRwx6rLGKkTabd4vMg3VrKdj/7joCmV0qgh4QwMMO6xh34YEXQqirAuUdgQGa5orJQQ+69RBw==",
+      "version": "2.11.32",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.32.tgz",
+      "integrity": "sha512-UvuxFU9P3hM29LrQdwu0cD6w6/+SFr+UlB9s/knI7+O2rK9xFxKUwSDWxGdbbqQ9/V7BJ5s0NI5nQAE4uJp3gQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -2492,9 +2516,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.8",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
-      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
+      "version": "4.29.4",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.29.4.tgz",
+      "integrity": "sha512-2TcbbiwXEq+N0kD36tykpCfyyQigUXmuwNQbnPp4Xk4PX9JOqVIKjJlIDjpH7uY6tmRGoAd+apeT1p60T8wsdA==",
       "dev": true,
       "funding": [
         {
@@ -2512,11 +2536,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.11.12",
-        "caniuse-lite": "^1.0.30001809",
-        "electron-to-chromium": "^1.5.402",
-        "node-releases": "^2.0.53",
-        "update-browserslist-db": "^1.3.0"
+        "baseline-browser-mapping": "^2.11.29",
+        "caniuse-lite": "^1.0.30001816",
+        "electron-to-chromium": "^1.5.459",
+        "node-releases": "^2.0.59",
+        "update-browserslist-db": "^1.3.4"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -2539,11 +2563,11 @@
       }
     },
     "node_modules/bser": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.1.tgz",
-      "integrity": "sha512-gQxTNE/GAfIIrmHLUE3oJyp5FO6HRBfhjnw4/wMmA63ZGDJnWBmgY/lyQBpnDUkGmAhbSe39tx2d/iTOAfglwQ==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/bser/-/bser-2.1.2.tgz",
+      "integrity": "sha512-V2o8YS2EhrKMO9AumnkK0ynynfFlsajpYupwq7S46H5mhcanwxDkNTw3K67wPIcKTH1ffkA4vhMOtAc7gRmPZw==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "dependencies": {
         "node-int64": "^0.4.0"
       }
@@ -2606,9 +2630,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001810",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
-      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
+      "version": "1.0.30001819",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001819.tgz",
+      "integrity": "sha512-LFUqIIAwpzsIuevnKnsR9qnStBcgzPShTX61lBwN9uFkkf8o8zLiebEjbW8AYtZiF+1YKDWfdt/pWDtMuG8Xwg==",
       "dev": true,
       "funding": [
         {
@@ -2865,9 +2889,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.415",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.415.tgz",
-      "integrity": "sha512-958V+Kbhtgz+SxXeEVKBjrlKRBIDAYvUJfwhjxMZ5S6ut9jAl7l9ZKBkBrvjyjZE36PabLUo2L8kEeV5O4vgJg==",
+      "version": "1.5.464",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.464.tgz",
+      "integrity": "sha512-nRa65aFge40viPAKxMKULIY8tcXKwKboJWNn4RoKwyWXJ6SP7BnrDGKUTzc64818jIciH0PK7LSF8QzZes19GA==",
       "dev": true,
       "license": "ISC"
     },
@@ -3038,13 +3062,6 @@
         "url": "https://github.com/sindresorhus/execa?sponsor=1"
       }
     },
-    "node_modules/execa/node_modules/signal-exit": {
-      "version": "3.0.7",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
-      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/exit-x": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/exit-x/-/exit-x-0.2.2.tgz",
@@ -3081,13 +3098,13 @@
       "license": "MIT"
     },
     "node_modules/fb-watchman": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.2.tgz",
-      "integrity": "sha512-p5161BqbuCaSnB8jIbzQHOlpgsPmK5rJVDfDKO91Axs5NC1uu3HRQm6wt9cd9/+GtQQIO53JdGXXoyDpTAsgYA==",
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/fb-watchman/-/fb-watchman-2.0.4.tgz",
+      "integrity": "sha512-tGQtaoYisPDriJBN0mT5yZSyNETnJGA1gTYxaVRAE5KUO3LI9kPUc9WIu8JXcxaIci+faIKlzXqXyPgrmubtBQ==",
       "dev": true,
-      "license": "Apache-2.0",
+      "license": "MIT",
       "dependencies": {
-        "bser": "2.1.1"
+        "bser": "2.1.2"
       }
     },
     "node_modules/fdir": {
@@ -3168,6 +3185,19 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
+    "node_modules/foreground-child/node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/form-data": {
       "version": "4.0.6",
       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.6.tgz",
@@ -4518,12 +4548,13 @@
       "license": "MIT"
     },
     "node_modules/napi-postinstall": {
-      "version": "0.3.4",
-      "resolved": "https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.4.tgz",
-      "integrity": "sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==",
+      "version": "0.3.7",
+      "resolved": "https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.7.tgz",
+      "integrity": "sha512-jyU4cU4kVAmy/3qjP+DcoQTNXfINHc+dFw54gGqWC8nu0mpV0kOnk7kff+J+Q18SbX0k3Np8Rm7yFjd3phatNQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
+        "napi-patch": "lib/patch.js",
         "napi-postinstall": "lib/cli.js"
       },
       "engines": {
@@ -4562,9 +4593,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.53",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.53.tgz",
-      "integrity": "sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==",
+      "version": "2.0.60",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.60.tgz",
+      "integrity": "sha512-OmO8+GM1JUZqXET720VrJCwkjUCXmCMQm0Z3UDDRbfNLHS4NEAvY60j5jiFv0tkKw2PNNlqOLhahVmwJIOLDIQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -4640,14 +4671,11 @@
         }
       }
     },
-    "node_modules/ox/node_modules/@noble/curves": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.1.tgz",
-      "integrity": "sha512-k11yZxZg+t+gWvBbIswW0yoJlu8cHOC7dhunwOzoWH/mXGBiYyR4YY6hAEK/3EUs4UpB8la1RfdRpeGsFHkWsA==",
+    "node_modules/ox/node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
       "license": "MIT",
-      "dependencies": {
-        "@noble/hashes": "1.8.0"
-      },
       "engines": {
         "node": "^14.21.3 || >=16"
       },
@@ -4948,17 +4976,11 @@
       }
     },
     "node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+      "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ==",
       "dev": true,
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
+      "license": "ISC"
     },
     "node_modules/slash": {
       "version": "3.0.0",
@@ -5385,9 +5407,9 @@
       }
     },
     "node_modules/uint8array-extras": {
-      "version": "1.5.0",
-      "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.5.0.tgz",
-      "integrity": "sha512-rvKSBiC5zqCCiDZ9kAOszZcDvdAHwwIKJG33Ykj43OKcWsnmcBRL09YTU4nOeHZ8Y2a7l1MgTd08SBe9A8Qj6A==",
+      "version": "1.6.0",
+      "resolved": "https://registry.npmjs.org/uint8array-extras/-/uint8array-extras-1.6.0.tgz",
+      "integrity": "sha512-8iAasVS4wUx0gPLjH8Xtz2PeDzTSiy8QiLGu2DT3X5GU+egFEQhpnbtkehbAwjvDcxIERmCYcysiODFmE3Ud0Q==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -5442,9 +5464,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.1.tgz",
-      "integrity": "sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==",
+      "version": "1.3.4",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.4.tgz",
+      "integrity": "sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==",
       "dev": true,
       "funding": [
         {
@@ -5488,9 +5510,9 @@
       }
     },
     "node_modules/viem": {
-      "version": "2.57.7",
-      "resolved": "https://registry.npmjs.org/viem/-/viem-2.57.7.tgz",
-      "integrity": "sha512-x3UqqrcQuESaRVK6a0BvNmoNP0SVhu913uxEAxYLJx1lNYnj6ylTntfUdakCUKjk1+T+63gkdwFGJQ2O5C/nRw==",
+      "version": "2.57.10",
+      "resolved": "https://registry.npmjs.org/viem/-/viem-2.57.10.tgz",
+      "integrity": "sha512-gQ6aELkfwvJDeWObxdOwWIQw8coUJhKhXDbyXCMOzzopU1F8s5Xs4l1HWQ4uaXa/uJ1/3uz8DiBU+RozllxPhw==",
       "funding": [
         {
           "type": "github",
@@ -5505,7 +5527,7 @@
         "@scure/bip39": "1.6.0",
         "abitype": "1.2.3",
         "isows": "1.0.7",
-        "ox": "0.14.56",
+        "ox": "0.14.57",
         "ws": "8.21.0"
       },
       "peerDependencies": {
@@ -5517,14 +5539,11 @@
         }
       }
     },
-    "node_modules/viem/node_modules/@noble/curves": {
-      "version": "1.9.1",
-      "resolved": "https://registry.npmjs.org/@noble/curves/-/curves-1.9.1.tgz",
-      "integrity": "sha512-k11yZxZg+t+gWvBbIswW0yoJlu8cHOC7dhunwOzoWH/mXGBiYyR4YY6hAEK/3EUs4UpB8la1RfdRpeGsFHkWsA==",
+    "node_modules/viem/node_modules/@noble/hashes": {
+      "version": "1.8.0",
+      "resolved": "https://registry.npmjs.org/@noble/hashes/-/hashes-1.8.0.tgz",
+      "integrity": "sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==",
       "license": "MIT",
-      "dependencies": {
-        "@noble/hashes": "1.8.0"
-      },
       "engines": {
         "node": "^14.21.3 || >=16"
       },
@@ -5554,9 +5573,9 @@
       }
     },
     "node_modules/viem/node_modules/ox": {
-      "version": "0.14.56",
-      "resolved": "https://registry.npmjs.org/ox/-/ox-0.14.56.tgz",
-      "integrity": "sha512-Feinlj+deWEam6RIwurRE+eHZ2N3hoUb3AAjQ10BmxRCYIymfqNkv0eZ+4ln4GkgDmSGLD2rGtTMqsFYSVDC6w==",
+      "version": "0.14.57",
+      "resolved": "https://registry.npmjs.org/ox/-/ox-0.14.57.tgz",
+      "integrity": "sha512-CPF6aEFyAuqgL0x7VaFM0vI2/CUd5Qk8+BIL6OnViPw+gF07O/VAhqEPOPw5GYnYPwomIk8mD91gTcQ1RAtupA==",
       "funding": [
         {
           "type": "github",
@@ -5678,6 +5697,19 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "node_modules/write-file-atomic/node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/ws": {
       "version": "8.22.0",
       "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
@@ -5717,9 +5749,9 @@
       "license": "ISC"
     },
     "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.1.tgz",
+      "integrity": "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw==",
       "license": "ISC",
       "bin": {
         "yaml": "bin.mjs"
@@ -5774,9 +5806,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
-      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index ed8c76a..43b48c6 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -46,7 +46,16 @@
   "overrides": {
     "axios": ">=1.20.0",
     "follow-redirects": ">=1.16.1",
-    "smol-toml": ">=1.9.0"
+    "smol-toml": ">=1.9.0",
+    "mppx": {
+      "zod": "^4.6.6"
+    },
+    "@stellar/mpp": {
+      "zod": "^4.6.6"
+    },
+    "viem": {
+      "zod": "^4.6.6"
+    }
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",

From bf9da1fa7e6d86f51be1057bc38f7135db888ce9 Mon Sep 17 00:00:00 2001
From: Eras256 <219895655+Eras256@users.noreply.github.com>
Date: Fri, 23 Oct 2026 16:15:30 -0600
Subject: [PATCH 4/4] docs(readme): x402Serve() quickstart was missing its own
 peer deps

"Quickstart: charge for your API" only said `npm install nirium`,
inherited visually from the unrelated "pay for an API" section above
it. Following it as written hits `x402Serve needs "@x402/express".
Install it alongside the SDK: npm i @x402/express @x402/core
@x402/stellar` on the first real request - exactly the message
nirium's own code throws for this. Added the real install line.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 README.md | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/README.md b/README.md
index 96133eb..c93ed07 100644
--- a/README.md
+++ b/README.md
@@ -44,6 +44,10 @@ console.log(market);
 
 The other side of the counter. Wiring x402 by hand is ~25 lines of facilitator client, per-method auth headers, per-network scheme registration and a route table whose shape you have to reverse-engineer. This is the same thing with the defaults that already run in production:
 
+```bash
+npm install nirium @x402/express @x402/core @x402/stellar
+```
+
 ```ts
 import { x402Serve } from 'nirium';