diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 5353d46..c149519 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -10,7 +10,7 @@ Thank you for your interest in contributing. This repository holds the open-sour ### Prerequisites -- Node.js 20+ +- Node.js >=22.12.0 (`@stellar/stellar-sdk` 16.x requires it) - Python 3.10+ (for `packages/sdk-python`) - Git diff --git a/README.md b/README.md index 337a47e..7c23da0 100644 --- a/README.md +++ b/README.md @@ -8,6 +8,7 @@ Open-source autonomous treasury and agentic payments (x402/MPP) for Stellar/Soro This repository contains the TypeScript and Python SDKs, the MCP server, the CLI, examples and quickstarts that let any developer: - **Get paid by AI agents**: put your own API behind an x402 pay-gate in one call with `x402Serve()`, or pay for someone else's with `initX402()`. +- **Cap what your own agent can spend**: an experimental pre-sign policy hook (`initX402({ policy })`, shipped in 0.16.0) asks your own ALLOW/DENY policy before any payment is signed - see [`packages/sdk/README.md#pre-sign-policy-hook-experimental`](./packages/sdk/README.md#pre-sign-policy-hook-experimental) for its real scope and what it does not cover. - **Automate on-chain treasury**: a Nirium agent moves idle capital into a CETES strategy (tokenized Mexican T-bills via Etherfuse) and back, over a vault **you** own. The agent can propose a rebalance without ever holding a signing key; autonomous execution on mainnet (the agent signs) is invite-only while a legal review closes. - **Anchor immutable audit trails**: SHA-256 content hash pinned to IPFS, optionally carrying an ed25519 signature that proves *who* declared the fact, not just that it is unaltered. @@ -83,6 +84,13 @@ See [`docs/`](./docs) for full quickstarts, including [**"Charge AI agents in 5 Live on **both** Stellar networks. They are not two copies of the same thing. +**Update, 2026-10-24 (checked against the live `/api/v1/mpp/info` on both +boxes that day):** that applies to x402 and the treasury path below, not to +**MPP Charge**. MPP is implemented and `charge.enabled: true` on both +networks, but it has only ever settled on **testnet** (pull and push, 15 Oct +2026); mainnet is unverified. Don't read "live on both networks" as covering +MPP - see `packages/sdk/README.md#mpp-charge-experimental`. + > **Settlement note (proposal, not a demand):** because nirium already speaks > x402 (`x402Serve()`/`initX402()`), the same exact-scheme flow can also > settle **fee-free in Nano (XNO)** - instant finality, no gas, fully @@ -129,6 +137,8 @@ Real bugs found in code we don't control, in other people's repos, confirmed by **[OpenZeppelin/relayer-plugin-x402-facilitator#47](https://github.com/OpenZeppelin/relayer-plugin-x402-facilitator/issues/47)** - a facilitator sponsor account we rely on went silent for 205+ hours. Three independent integrators (us, [AgentLedger](https://agentpayments.fi), and a third party) converged on the same diagnosis across a month of silence on two official OpenZeppelin channels - until a direct tag to maintainers verified as active elsewhere in the org broke it open: *"Apologies for the slow response... looking into it now and will update here shortly"* ([`zeljkoX`](https://github.com/zeljkoX), 9-sep-2026). **Fixed 2026-09-11** - root cause was a stale RPC URL on the hosted pubnet facilitator instance, throwing before it ever evaluated a payload. Verified with a real settlement on our own mainnet box (clean `200`, confirmed on Horizon), then independently repeated by AgentLedger on 2026-09-12 with the same result. Closed by the maintainer 2026-09-14. ~32-day outage, ~2026-08-10 → 2026-09-11. +**Update, 2026-10-24:** at the time of this outage (Aug-Sep 2026), AgentLedger was independent of Nirium, which is what makes the corroboration above worth citing. Since then, Fer - AgentLedger's founder - also joined Nirium part-time (October 2026). Mentioned here for anyone reading this as third-party validation today. + **[stellar/stellar-mpp-sdk#69](https://github.com/stellar/stellar-mpp-sdk/pull/69)** - `@stellar/mpp`'s exported `USDC_SAC_MAINNET` (54 chars) and `XLM_SAC_MAINNET` (55 chars) both fail `StrKey.isValidEd25519PublicKey()` - invalid addresses, present in every version including 0.7.1. Filed with the exact byte counts and correct addresses; PR merged the **same day**. Our own `USDC_SAC_OVERRIDE` workaround (`middleware/mpp.ts`) stays until a release actually ships the fix. **[Trustless-Work/agentic-escrow-research](https://github.com/Trustless-Work/agentic-escrow-research)** - 4 PRs merged (#1-#4), all 4 within a 27-minute window, 21-sep-2026: bounded-authority milestone payouts, treasury rebalancing via a destination parameter that doesn't exist, direct x402 payment without escrow with real settlement verified on mainnet, and production evidence for their agentic-tool schema. Trustless Work thanked us publicly from their own account: *"We just merged our first 4 community contributions 🙏 @vaiossx @smithserrat @Niriumstellar."* diff --git a/docs/quickstart-x402.md b/docs/quickstart-x402.md index 73877f4..ff69923 100644 --- a/docs/quickstart-x402.md +++ b/docs/quickstart-x402.md @@ -4,7 +4,7 @@ This quickstart shows how to call a paid Nirium endpoint from a TypeScript scrip ## What You Need -- Node.js 18 or newer. +- Node.js >=22.12.0 - `@stellar/stellar-sdk` 16.x (a dependency of `nirium`) requires it; an older Node silently resolves an incompatible older SDK instead of failing. - A funded Stellar testnet secret key. Use a throwaway testnet account only. - A clean project where you can install `nirium`. diff --git a/examples/sdp-audit-bridge/README.md b/examples/sdp-audit-bridge/README.md index 4fa86de..94265b3 100644 --- a/examples/sdp-audit-bridge/README.md +++ b/examples/sdp-audit-bridge/README.md @@ -12,7 +12,7 @@ payments, reads an SDP database, or takes custody of funds. ## Requirements -- Node.js 20 or newer +- Node.js >=22.12.0 (`@stellar/stellar-sdk` 16.x requires it) - A completed batch identified by transaction hashes or a distribution account and UTC time window - Testnet only diff --git a/examples/treasury-vault-quickstart/README.md b/examples/treasury-vault-quickstart/README.md index 0d20d85..e7cf5cc 100644 --- a/examples/treasury-vault-quickstart/README.md +++ b/examples/treasury-vault-quickstart/README.md @@ -18,7 +18,7 @@ This issue is deploy + deposit only. It does not call `executeTreasuryRebalance` ## Prerequisites -- Node.js 20+ +- Node.js >=22.12.0 (`@stellar/stellar-sdk` 16.x requires it) - A **funded Stellar testnet** account you control: - **XLM** for fees / contract deploy - [Friendbot](https://friendbot.stellar.org) (`https://friendbot.stellar.org?addr=G...`) - A small balance of the vault asset. Default is **Blend testnet USDC** (`USDC-GATALTG…`, contract `CAQCFV…`) - not Circle USDC. The script opens that trustline if it is missing; then click Faucet on [testnet.blend.capital](https://testnet.blend.capital). Set `VAULT_ASSET=cetes` if you hold testnet CETES instead.