2.12.2: coupled set to x402 2.26.0, mppx 0.10.1 and viem 2.56.7, deps sweep 2026-09-17

[vvillait88]

Summary

Dependency sweep for node-commerce, plus the release bump to 2.12.2. The dev-side settle set moves with pay's: @x402/core, @x402/evm and @x402/extensions to 2.26.0 (server side: the facilitator and http default timeouts rise from 30s to 90s; the client-side spend-control change does not reach the merchant), mppx to 0.10.1 (Tempo proof domain version stays 3, so the zero-amount proof verification agrees with pay 0.5.7), viem to 2.56.7. Peer floors and dev pins for fastify 5.12.5 and hono 4.13.8. Dev tooling: @types/node 26.6.1, vitest and @vitest/coverage-v8 5.0.1, knip 6.36.0, lefthook 2.1.14. eslint 10 and TypeScript 7 stay held.

The @agent-score/sdk floor moves to 2.7.12 in a follow-up commit on this branch once node-sdk publishes it.

Worked with: Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Run locally on this branch after bun install reached a no-op (Checked 774 installs across 745 packages): bun run lint, bun run build, bun run typecheck, bun run typecheck:examples, bun run knip, bun run test (1825 passed, 4 skipped). The coupled set owes the live all-rails settle with pay 0.5.7 on the agent side after both releases; recorded on the storefront PRs.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Live settle after both sides were on the new versions: pay 0.5.7 (the released darwin-arm64 binary, reporting 0.5.7) against fullenrich.agentscore.com deployed on commerce 2.12.2, from the smoke wallet, --max-spend 0.10.

rail	ungated /company/lookup	gated /person/enrich/work-email
Base (x402)	200, charged 0.02, payment_status: completed	200, charged 0.07, completed
Tempo (MPP)	200, charged 0.02, completed	200, charged 0.07, completed
Solana (MPP)	merchant 402 payment_proof_invalid	not attempted

Solana is the same result the previous coupled-set settle recorded on 2026-09-14, so it is not a regression from this bump; agentscore-pay balance reads 0 USDC on the smoke wallet's Solana address, which is the funding gap the holds registry names. The rail stays unexercised until that wallet holds USDC on Solana.