pull in latest upstream

.gitbook.yaml

@@ -0,0 +1,5 @@
+root: ./docs/
+
+structure:
+  readme: README.md
+  summary: SUMMARY.md

.github/labeler.yml

@@ -0,0 +1,78 @@
+# Language labels
+typescript:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/**/*.ts'
+          - 'typescript/**/*.tsx'
+
+python:
+  - changed-files:
+      - any-glob-to-any-file: 'python/**/*.py'
+
+go:
+  - changed-files:
+      - any-glob-to-any-file: 'go/**/*.go'
+
+java:
+  - changed-files:
+      - any-glob-to-any-file: 'java/**/*.java'
+
+# SDK - v2 core packages only
+sdk:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/packages/core/**'
+          - 'typescript/packages/extensions/**'
+          - 'typescript/packages/http/**'
+          - 'typescript/packages/mechanisms/**'
+          - 'python/x402/**'
+          - 'go/*.go'
+          - 'go/http/**'
+          - 'go/mechanisms/**'
+          - 'go/signers/**'
+          - 'go/extensions/**'
+          - 'go/types/**'
+          - 'go/test/**'
+
+# Legacy packages and examples
+legacy:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/packages/legacy/**'
+          - 'python/legacy/**'
+          - 'go/legacy/**'
+          - 'java/**'
+          - 'examples/typescript/legacy/**'
+          - 'examples/python/legacy/**'
+
+# Examples
+examples:
+  - changed-files:
+      - any-glob-to-any-file: 'examples/**'
+
+# Protocol specifications
+specs:
+  - changed-files:
+      - any-glob-to-any-file: 'specs/**'
+
+# Documentation
+docs:
+  - changed-files:
+      - any-glob-to-any-file: 'docs/**'
+
+# Website
+website:
+  - changed-files:
+      - any-glob-to-any-file: 'typescript/site/**'
+
+# CI/CD workflows
+ci:
+  - changed-files:
+      - any-glob-to-any-file: '.github/**'
+
+# Ecosystem partner additions
+ecosystem:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'typescript/site/app/ecosystem/partners-data/**'
+          - 'typescript/site/public/logos/**'

.github/pull_request_template.md

@@ -20,6 +20,7 @@ Please describe the tests you've performed to verify your changes.
 Include relevant code samples, unit test cases, or screenshots if applicable.
 
 For TypeScript: Run `pnpm test` from the `/typescript` directory
+For Python: Run `uv run pytest` from the `python/x402/` directory
 For Go: Run `go test ./...` from the `/go` directory
 -->
 
@@ -28,8 +29,22 @@ For Go: Run `go test ./...` from the `/go` directory
 - [ ] I have formatted and linted my code
 - [ ] All new and existing tests pass
 - [ ] My commits are signed (required for merge) -- you may need to rebase if you initially pushed unsigned commits
+- [ ] I added a changelog fragment for user-facing changes (docs-only changes can skip)
+
+<!--
+Changelog fragments (required for user-facing changes):
+
+- TypeScript: add a Changesets file under `typescript/.changeset/*.md`
+  - Create: `pnpm -C typescript changeset`
+  - Select only publishable `@x402/*` packages
+- Go: add a Changie fragment under `go/.changes/unreleased/*`
+  - Create: `make -C go changelog-new`
+- Python (python/x402 v2): add a Towncrier fragment under `python/x402/changelog.d/<PR>.<type>.md`
+  - Create: `cd python/x402 && uv run towncrier create --content "Fixed ..." 123.bugfix.md`
+-->
 
 <!--
 For TypeScript: Run `pnpm format && pnpm lint` from `/typescript` and/or `/examples/typescript`
+For Python: Run `uvx ruff format && uvx ruff check` from the `python/x402/` directory
 For Go: Run `go fmt ./...` and `go vet ./...` from the `/go` directory
 --> 

.github/scripts/create-github-release-commit.py

@@ -0,0 +1,166 @@
+#!/usr/bin/env python3
+"""Create a GitHub-verified bot commit through the GraphQL API.
+
+Generic release helper. It takes a branch, a commit message, and a set of paths, 
+then creates a branch and a verified commit containing the current local contents of those paths. 
+Stdlib-only so it runs on CI runners via `python3` without any toolchain setup.
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+CREATE_COMMIT_MUTATION = """
+mutation($input: CreateCommitOnBranchInput!) {
+  createCommitOnBranch(input: $input) {
+    commit {
+      oid
+      url
+    }
+  }
+}
+"""
+
+
+class GitHubCommitError(RuntimeError):
+    """Raised when the GitHub API commit cannot be created."""
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Create a GitHub-verified commit from local file changes."
+    )
+    parser.add_argument("--branch", required=True, help="Release branch to create and commit to.")
+    parser.add_argument("--message", required=True, help="Commit message headline.")
+    parser.add_argument("paths", nargs="+", help="Files or directories to include in the commit.")
+    return parser.parse_args()
+
+
+def run(command: list[str], *, input_text: str | None = None) -> str:
+    try:
+        completed = subprocess.run(
+            command,
+            check=True,
+            capture_output=True,
+            input=input_text,
+            text=True,
+        )
+    except FileNotFoundError as exc:
+        raise GitHubCommitError(f"Required command not found: {command[0]}") from exc
+    except subprocess.CalledProcessError as exc:
+        message = exc.stderr.strip() or exc.stdout.strip() or str(exc)
+        raise GitHubCommitError(message) from exc
+
+    return completed.stdout.strip()
+
+
+def github_repository() -> str:
+    repository = os.environ.get("GITHUB_REPOSITORY")
+    if not repository:
+        raise GitHubCommitError("GITHUB_REPOSITORY is required.")
+    return repository
+
+
+def changed_paths(paths: list[str]) -> list[str]:
+    output = run(["git", "diff", "--name-only", "HEAD", "--", *paths])
+    return output.splitlines()
+
+
+def file_changes(paths: list[str]) -> dict[str, list[dict[str, str]]]:
+    additions = []
+    deletions = []
+
+    for path in paths:
+        file_path = Path(path)
+        if file_path.is_file():
+            additions.append(
+                {
+                    "path": path,
+                    "contents": base64.b64encode(file_path.read_bytes()).decode(),
+                }
+            )
+            continue
+
+        deletions.append({"path": path})
+
+    return {"additions": additions, "deletions": deletions}
+
+
+def create_branch(repository: str, branch: str, head_sha: str) -> None:
+    payload = json.dumps({"ref": f"refs/heads/{branch}", "sha": head_sha})
+    run(
+        ["gh", "api", "--method", "POST", f"repos/{repository}/git/refs", "--input", "-"],
+        input_text=payload,
+    )
+
+
+def create_commit(
+    repository: str,
+    branch: str,
+    message: str,
+    expected_head: str,
+    changes: dict[str, list[dict[str, str]]],
+) -> str:
+    request = {
+        "query": CREATE_COMMIT_MUTATION,
+        "variables": {
+            "input": {
+                "branch": {
+                    "repositoryNameWithOwner": repository,
+                    "branchName": branch,
+                },
+                "message": {"headline": message},
+                "fileChanges": changes,
+                "expectedHeadOid": expected_head,
+            }
+        },
+    }
+
+    return run(
+        [
+            "gh",
+            "api",
+            "graphql",
+            "--method",
+            "POST",
+            "--input",
+            "-",
+            "--jq",
+            ".data.createCommitOnBranch.commit.url",
+        ],
+        input_text=json.dumps(request),
+    )
+
+
+def main() -> int:
+    args = parse_args()
+    repository = github_repository()
+    head_sha = run(["git", "rev-parse", "HEAD"])
+    paths = changed_paths(args.paths)
+    if not paths:
+        raise GitHubCommitError("No changed paths found.")
+
+    create_branch(repository, args.branch, head_sha)
+    commit_url = create_commit(
+        repository,
+        args.branch,
+        args.message,
+        head_sha,
+        file_changes(paths),
+    )
+    print(commit_url)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except GitHubCommitError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        raise SystemExit(1) from exc

.github/workflows/check_format.yml

@@ -1,41 +1,47 @@
 name: Format
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-format-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
       - name: Ensure formatting
         working-directory: ./typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check
 
   check-format-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
       - name: Ensure formatting
         working-directory: ./examples/typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check