SubEtha is a **local, non-production proof of concept**. This page records the protocol scope, the package versions verified against the public registries, and the license boundaries that constrain how the pieces may be used. All version facts below were checked against the live registries on 2026-07-27 (UTC) and are re-checked automatically by this site's drift probe. ## Protocol scope - **x402 v2 only.** SubEtha's payment surface is the official x402 v2 protocol; the scheme is `subetha-zerc20` and everything SubEtha-specific rides inside the standard extension points. There is no x402 v1 (`X-PAYMENT`) fallback. - **MPP is deferred.** The official path runs x402 only; MPP framing is explicitly deferred in the product at the pinned commit ([`docs/OVERVIEW.md`](https://github.com/peaceandwhisky/SubEtha/blob/638fa1e9ca7face19a442cef43754f0d627c7705/docs/OVERVIEW.md)). - **Additive-only evolution.** For `x402Version: 2`, the scheme name, the payload discrimination rule, and the meaning of settle (= `accepted`) are frozen; new optional fields may appear in `extra`, payloads, and responses, and unknown keys must be ignored (see the [wire protocol reference](/reference/protocol/)). ## Published packages | package | registry | latest | license | role | |---|---|---|---|---| | `@subetha/x402-scheme` | npm | 0.1.0 (only published version; `latest` and `next` tags) | Apache-2.0 | payer-side scheme handler, wire types, fee interpretation — [TypeScript API](/reference/typescript/) | | `@subetha/provider` | npm | 0.1.0 (only published version; `latest` and `next` tags) | Apache-2.0 | provider-side scheme server, payment handler, facilitator HTTP client — [TypeScript API](/reference/typescript/) | | `subetha` | PyPI | 0.2.0 (published: 0.1.0, 0.2.0) | Apache-2.0 | payer-side reference client — [Python API](/reference/python/) | All three are **0.x, experimental**: APIs may change in breaking ways between 0.x minor releases. The Python package's README at the pinned commit still recommends the pin `subetha>=0.1,<0.2`, which excludes the 0.2.0 release that is current on PyPI — see the [Python API reference](/reference/python/) for the documented divergence. ## The facilitator is source-only `@subetha/facilitator` is **private and workspace-internal**: it is not published to npm (the registry answers 404 for it — verified 2026-07-27), its `package.json` at the pinned commit is marked `"private": true`, and there is no supported package-manager install path for it. It is operated only from the product repository source, built inside that workspace (see [`docs/FACILITATOR.md`](https://github.com/peaceandwhisky/SubEtha/blob/638fa1e9ca7face19a442cef43754f0d627c7705/docs/FACILITATOR.md)). The [configuration reference](/reference/configuration/) documents its config surface; nothing on this site installs it from a registry. ## License boundaries - **SubEtha's own code is Apache-2.0** — the SubEtha-authored sources under `apps/`, `packages/`, and `contracts/` (including `PermitBurner.sol`), and the three published packages above. - **`@zerc20/sdk` is BUSL-1.1** (Business Source License 1.1), not Apache-2.0. The product repository references it as a local link and does **not** vendor, copy, or redistribute the SDK source; this documentation repository likewise contains no `@zerc20/sdk` code. BUSL-1.1's `Additional Use Grant` is `None`, so production or commercial use of the zERC20 dependency requires a commercial license obtained directly from the zERC20 licensor. SubEtha's Apache-2.0 license grants no rights to the zERC20 toolchain. - The full statement, including the name/official-status notice, is the [product README's License section](https://github.com/peaceandwhisky/SubEtha/blob/638fa1e9ca7face19a442cef43754f0d627c7705/README.md). This page is a summary, not legal advice. ## Toolchain floor (published packages) | surface | requirement | |---|---| | `@subetha/x402-scheme`, `@subetha/provider` | Node.js >= 20, ESM-only; peer dependency `@x402/core` `^2.17.0` | | `subetha` (PyPI) | Python >= 3.11; depends only on `httpx`, `eth-account`, `eth-utils` | ## How these facts were verified Versions and tags were read from the public registries (`npm view … dist-tags versions license`, PyPI JSON API) on 2026-07-27 (UTC), and the license/scope statements from the product repository at pinned commit [`638fa1e`](https://github.com/peaceandwhisky/SubEtha/blob/638fa1e9ca7face19a442cef43754f0d627c7705/README.md). CI's drift probe re-compares every `VersionBadge` fact on this site against the live registries; a stated version that stops being `latest` turns the probe red until the page is re-verified.