feat(mcp): 0.11.0 — openpay-x402-sdk ^0.2.0 (クエリ付き catalog trust) へ bump (PR-B)

packages/x402-mcp/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.11.0
+
+- Trust query-string variants of a query-free catalog URL after the same live
+  money-field verification, via `openpay-x402-sdk` 0.2.x.
+- Preserve all MCP tool names, descriptions, and input schemas byte-for-byte.
+
 ## 0.10.0
 
 - Delegate payment execution, catalog resolution, guards, payment wire handling,

packages/x402-mcp/README.md

@@ -173,10 +173,13 @@ Ordering flow (autonomous): `find_shops` → `order_menu` → pick items → `or
 | `STEWARD_SIGNER_SECRET` | unset | Required when `SIGNER_MODE=steward`; scoped signer secret. Treated as a secret. |
 | `MAX_PER_CALL_JPYC` | `10` | Upper bound for the tool call's required `maxTotalJpyc`. |
 | `MAX_SESSION_JPYC` | `100` | Process-lifetime cumulative cap for successful `x402_pay` calls. Restarting the process resets it. |
-| `CATALOG_TRUST` | `true` | When true, URLs listed (exact match) in the OpenPay discovery catalog are payable without editing `ALLOWED_HOSTS`. Before signing, the live `accepts` fetched from a catalog URL is checked field-by-field (asset / forwarder / merchant / fee receiver / amounts) against the catalog listing (server-authored), so a third-party domain cannot bait-and-switch a different destination; mismatches are refused (`catalog_accept_mismatch`). Money caps still apply. Set `false` for strict manual allowlisting. |
+| `CATALOG_TRUST` | `true` | When true, URLs listed in the OpenPay discovery catalog are payable without editing `ALLOWED_HOSTS`. Before signing, the live `accepts` fetched from a catalog URL is checked field-by-field (asset / forwarder / merchant / fee receiver / amounts) against the catalog listing (server-authored), so a third-party domain cannot bait-and-switch a different destination; mismatches are refused (`catalog_accept_mismatch`). Money caps still apply. Set `false` for strict manual allowlisting. |
 | `ALLOWED_HOSTS` | `open-pay.jp` | Comma-separated bare host allowlist. `x402_quote` still works outside the list but returns `host_not_allowed`. |
 | `DISCOVERY_URL` | `https://open-pay.jp/api/discovery` | Catalog used by `discovery_search`. |
 
+Query string variants of a query-free listed URL are trusted after the same
+money-field verification; query-bearing catalog entries remain exact-only.
+
 ## Signer Modes
 
 `env-key` is the default zero-config mode. It is convenient for local testing and should use a dedicated low-balance wallet.

packages/x402-mcp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openpay-x402-mcp",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Local MCP buyer for OpenPay x402 JPYC resources",
   "type": "module",
   "bin": {
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.18.0",
-    "openpay-x402-sdk": "^0.1.0",
+    "openpay-x402-sdk": "^0.2.0",
     "viem": "^2.45.0"
   }
 }