From 3c7fad4c1a6ad53886cc8387d6981b3a0680a4a2 Mon Sep 17 00:00:00 2001
From: Eras256 <219895655+Eras256@users.noreply.github.com>
Date: Thu, 5 Nov 2026 14:08:14 -0600
Subject: [PATCH] release(sdk): 0.17.0 - ship maxAmountPerPayment, closes #213

Cuts the release issue #213 asked for. Three things ship together,
all already merged to main and unreleased since 0.16.1:

- initX402({ maxAmountPerPayment }) (#106) - the actual reason for
  this minor bump.
- The local-dev default port fix (3001 -> 3002, from 3d440e7).
- The facilitatorApiKey JSDoc comment that contradicted its own
  runtime check (14fc29a) - doc-only.
- The zod GHSA-mrhx-c7xc-m3w5 override fix (f2179b0) - was only
  allowlisted before, now actually patched where resolvable.

tsc build clean, 165 node:test + jest all pass, npm pack --dry-run
shows only dist/ + README + package.json (no source, no .npmrc).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 packages/sdk/CHANGELOG.md      | 11 +++++++++++
 packages/sdk/package-lock.json |  6 +++---
 packages/sdk/package.json      |  2 +-
 3 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/packages/sdk/CHANGELOG.md b/packages/sdk/CHANGELOG.md
index 42e9cfd..73d2406 100644
--- a/packages/sdk/CHANGELOG.md
+++ b/packages/sdk/CHANGELOG.md
@@ -4,10 +4,21 @@ All notable changes to the `nirium` package are documented here.
 
 ## Unreleased
 
+## 0.17.0 - 2026-11-05
+
 ### Added
 
 - `initX402({ maxAmountPerPayment })` ([#106](https://github.com/nirium-protocol/nirium/issues/106)): sets the `@x402/core` 2.28 per-payment cap (`spendControls.maxAmountPerPayment`) so APIs priced above $1 can be paid. Accepts `'$5'`, `'5'` or `5`; validated at `initX402()` time (positive amounts only, `false` is rejected). Without the option, behavior is unchanged: the default stays `$1`. Works with and without `policy`. The `X402SpendCapError` message now points to the option.
 
+### Fixed
+
+- The default `baseUrl` (`Agent` constructor and its JSDoc example) was `http://localhost:3001` - that's only the agent's own standalone fallback, a path the documented `pnpm dev` quickstart never takes (it runs on `3002` via `master.ts`). Now `3002`, matching the quickstart everyone actually follows.
+- The `facilitatorApiKey` JSDoc comment on `X402ServeConfig` said "Mainnet lo exige; testnet no" while the runtime check two lines below throws on both networks ("the facilitator rejects unauthenticated servers on testnet too") - directly contradicting the code it described. Same false claim in the README's quickstart comment. Comment-only; behavior was already correct.
+
+### Security
+
+- `@stellar/mpp` > `mppx` > `viem`/`abitype`/`incur` > `zod` could resolve below 4.6.6 (patched) for `GHSA-mrhx-c7xc-m3w5`, previously only allowlisted rather than fixed. Every package on that chain already declares `zod ^4.x` in its own `peerDependencies` - nothing pinned it low, it just never got bumped. Added a scoped `overrides` entry (`mppx`, `@stellar/mpp`, `viem`) so the whole subtree resolves to a patched version; `@x402/core`'s own `zod ^3.x` is untouched. `@x402/core` itself still requires `zod ^3.24.2`, which cannot resolve to 4.x - no patched 3.x release exists, so that one dependency stays allowlisted via `audit-ci`.
+
 ## 0.16.1 - 2026-10-11
 
 Documentation and package metadata only. `dist/` is identical to 0.16.0.
diff --git a/packages/sdk/package-lock.json b/packages/sdk/package-lock.json
index 69daaa7..7318fc2 100644
--- a/packages/sdk/package-lock.json
+++ b/packages/sdk/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "nirium",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "nirium",
-      "version": "0.16.1",
+      "version": "0.17.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@stellar/mpp": "^0.7.1",
@@ -5373,7 +5373,7 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
-      "devOptional": true,
+      "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",
diff --git a/packages/sdk/package.json b/packages/sdk/package.json
index 43b48c6..b5cc315 100644
--- a/packages/sdk/package.json
+++ b/packages/sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "nirium",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "description": "Autonomous treasury and agentic-payments infrastructure for Stellar (x402)",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",