@envarai/envarpay 0.2.0-alpha.19 → 0.2.0-alpha.20

package/README.md

@@ -1,76 +1,31 @@
-# EnvarPay TypeScript
+# `@envarai/envarpay`
 
-Independent service commerce for user-operated Agents. Public communication uses
-A2A 1.0; payments use native x402 v2 exact USDC or MPP Stripe charge. Prices and
-scope are versioned configuration, enforced before dispatch, not instructions in
-a prompt. Envar is an optional directory and management UI.
+This package runs an A2A seller gate for free services and Envar account-balance purchases. Buyers use their Envar Wallet; this package does not sign buyer payments.
 
-The 0.2 source line replaces the previous npm wallet-only MCP client. Build from
-this checkout while the release is undergoing acceptance; a source version is
-not evidence that its npm/OCI artifact is published.
+## Recommended setup
 
-## Runtime and entry points
-
-For Hermes onboarding, see [guided Skill setup](../../docs/hermes-skill-setup.md). The `setup --file ...` command reads the owner's local model configuration and creates a private seller with an empty catalog, ready for the first service to be configured in Envar.
-
-The experimental `external-setup` and `external-serve` commands connect an existing
-external Agent through scoped MCP tasks/events and a free A2A entry. See
-[external Agent acceptance](../../docs/external-agents.md) for OAuth pairing,
-Skill discovery, restart and the required real execution evidence.
-
-Node.js 22.14+ (Node 24 recommended). SQLite is single-instance. Contracts can be
-read without loading the seller or buyer runtime; Bun validation covers the
-contracts entry, not the SQLite server.
-
-| Entry | Purpose |
-|---|---|
-| `@envarai/envarpay` | Config types/validation, integer pricing, quotes and A2A Cards |
-| `/server` | Durable seller A2A handler, exact x402 gate and native upstream executor |
-| `/client` | Buyer policy, atomic budgets, original-operation recovery and private management |
-| `/mpp` | Opt-in native MPP seller and read-only Stripe reconciliation |
-| `/envar` | Optional bounded config pull/ack and durable observation reports |
+Use the Agent-specific setup file downloaded from Envar:
 
 ```sh
-npm ci --ignore-scripts
-npm run build
-node dist/commerce/cli.js init --directory ./private
-node dist/commerce/cli.js validate --config ./private/seller.json
+envarpay setup --file /private/path/envar-setup.json
 ```
 
-Initialization writes examples and a vault key; it never creates a purchase or
-funds a wallet. Replace example addresses/hosts and review service limits before
-starting. Keep Agent model credentials in the Agent, and signer keys in a separate
-private wallet boundary.
+Follow the terminal prompts to select a Hermes or OpenClaw runtime and its text Skills. Setup creates an owner-only directory containing `seller.json`, `credentials.json`, `envar.json`, `envar.token`, `vault.key`, `connection.json`, and `start.mjs`. Run the printed `node .../start.mjs` command, import `connection.json` in Envar, and select **Check connection**. The public [Agent guide](https://envar.ai/guide/agents) gives the platform-specific steps and the test message to send.
 
-```sh
-node dist/commerce/cli.js serve --config seller.json \
-  --credentials private/seller-auth.json --state private/seller.sqlite3 \
-  --origin https://seller.example --port 4020
-node dist/commerce/cli.js buyer-serve --config buyer-policy.json \
-  --credentials private/buyer-auth.json --state private/buyer.sqlite3 \
-  --origin https://buyer-management.example --port 4021
-```
+The generated seller starts with free services and a local balance receiving reference of `envar`. A paid service becomes available only after Envar approves this seller account and the service editor verifies the actual unpaid USD quote. In Envar, choose a Skill, enter its USD price, select **Test service**, then **Publish**. There is no separate payment setup command.
 
-The management service is private and owner-authenticated. A website may request a
-quote and confirm an already-reviewed purchase; it cannot change peers, recipient
-allowlists, budgets or signing keys. Unknown outcomes retain the original request,
-signature/SPT and reserved budget. Never create a replacement purchase after a
-timeout.
+## Manual seller commands
 
-[Seller and wire behavior](../../docs/a2a-commerce.md) ·
-[Buyer management](../../docs/a2a-buyer.md) ·
-[Continuation and recovery](../../docs/a2a-runtime-recovery.md) ·
-[Envar configuration integration](../../docs/a2a-envar.md)
+```sh
+envarpay init --directory /private/envarpay
+envarpay validate --config /private/envarpay/seller.json
+envarpay card --config /private/envarpay/seller.json --service SERVICE --offer OFFER --origin https://seller.example
+envarpay serve --config /private/envarpay/seller.json --credentials /private/envarpay/credentials.json --state /private/envarpay/seller.sqlite3 --origin https://seller.example --envar-config /private/envarpay/envar.json --envar-credentials /private/envarpay/envar.token
+envarpay inspect --state /private/envarpay/seller.sqlite3
+```
 
-## Payment guarantees
+`init` creates a sample seller config and vault key; it does not authorize paid work. Put secrets only in owner-only files (`chmod 600`), keep the state directory private, and use one running process per ledger. The runtime verifies the configured service revision, original A2A Task and one captured Envar balance claim before calling the private Agent. It stores the original claim and Task handles so a lost response can be recovered without charging twice.
 
-Payment confirmation, task completion and acceptance are separate facts. The MVP
-charges upfront for a new task; reads and permitted clarification use that same
-purchase. It does not provide escrow, automatic refunds, subscriptions or billing
-for arbitrary internal tools. A2A compatibility alone does not give an Agent a
-wallet or authorize payment.
+The seller configuration schema is [`schemas/envarpay.config.schema.json`](schemas/envarpay.config.schema.json). Paid amounts are integer **micro-USD** (`100000` = USD 0.10); free offers have no payment profile. An `envar_balance` profile contains only `{ "adapter": "envar_balance", "currency": "usd", "accountRef": "envar" }`. The private Envar policy must allow that exact account reference.
 
-MPP requires an eligible Stripe merchant, a permitted buyer token-creation flow,
-explicit test/live mode and any required customer authentication. Simulator tests
-are not card charges. Provider and chain acceptance must be recorded separately
-from SDK tests and build results.
+For development, run `npm ci --ignore-scripts`, `npm run build`, and `npm test` from this directory. Node.js 22.14+ is required; Node 24 is recommended.

package/dist/commerce/alerts.d.ts

@@ -1,31 +1,21 @@
-type SignalName = 'ledger_read' | 'payment_unknown' | 'execution_unknown' | 'recorded_provider_failure' | 'budget_near_limit' | 'budget_exhausted' | 'report_backlog' | 'report_failure';
+type Name = 'ledger_read' | 'payment_unknown' | 'execution_unknown' | 'report_backlog' | 'report_failure';
 type Signal = {
-    name: SignalName;
+    name: Name;
     status: 'clear' | 'alert' | 'unavailable' | 'not_applicable';
     severity: 'info' | 'warning' | 'critical';
     count: number | null;
 };
-type Budget = {
-    unit: string;
-    maxTotal: string;
-    reserved: string;
-    spent: string;
-    remaining: string;
-    state: 'available' | 'near_limit' | 'exhausted';
-};
 export interface LocalAlertOptions {
-    policyPath?: string;
     integrationPath?: string;
     integrationDisabled?: boolean;
 }
-/** Owner-local aggregate evidence only. Never opens a runtime store, signer, vault or network. */
 export declare function inspectLocalAlerts(path: string, options?: LocalAlertOptions): {
-    role: "unavailable" | "buyer" | "seller";
+    role: "unavailable" | "seller";
     view: "alerts";
     observation: "local_persisted_state_only";
-    status: string;
+    status: "unavailable" | "partial" | "available";
     signals: Signal[];
-    budgets: Budget[];
+    budgets: never[];
     alertCount: number;
     unavailableCount: number;
     providerHealth: "unavailable_not_probed";

package/dist/commerce/alerts.js

@@ -1,18 +1,10 @@
+/** Read-only health signals for one seller ledger and its Envar report queue. */
 import { DatabaseSync } from 'node:sqlite';
-import { lstatSync, readFileSync } from 'node:fs';
-import { loadBuyerPolicy } from './config.js';
-const CURRENCIES = {
-    usd: 'usd_cents',
-    'eip155:8453/erc20:0x833589fcd6edb6e08f4c7c32d4f71b54bda02913': 'base_usdc_atomic',
-    'eip155:84532/erc20:0x036cbd53842c5426634e7929541ec2318f3dcf7e': 'base_sepolia_usdc_atomic',
-};
-function privateFile(path, limit) {
+import { lstatSync } from 'node:fs';
+function database(path) {
     const stat = lstatSync(path);
-    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()) || (limit !== undefined && stat.size > limit))
+    if (!stat.isFile() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 || (process.getuid && stat.uid !== process.getuid()))
         throw new Error('private_source_unavailable');
-}
-function database(path) {
-    privateFile(path);
     const db = new DatabaseSync(path, { readOnly: true });
     try {
         db.exec('PRAGMA query_only=ON; PRAGMA busy_timeout=1000; BEGIN');
@@ -27,61 +19,19 @@ const count = (db, sql) => Number(db.prepare(sql).get().n);
 const signal = (name, value, severity = 'warning') => ({ name, status: value ? 'alert' : 'clear', severity: value ? severity : 'info', count: value });
 const missing = (name) => ({ name, status: 'unavailable', severity: 'warning', count: null });
 const irrelevant = (name) => ({ name, status: 'not_applicable', severity: 'info', count: null });
-/** Owner-local aggregate evidence only. Never opens a runtime store, signer, vault or network. */
 export function inspectLocalAlerts(path, options = {}) {
-    const signals = [], budgets = [];
-    let role = 'unavailable', db;
+    const signals = [];
+    let db;
+    let available = false;
     try {
         db = database(path);
-        const tables = new Set(db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(row => row.name));
-        if (tables.has('buyer_purchases') === tables.has('commerce_orders'))
-            throw new Error('unknown_ledger');
-        role = tables.has('buyer_purchases') ? 'buyer' : 'seller';
-        if (db.prepare(`SELECT version FROM ${role === 'buyer' ? 'buyer_meta' : 'commerce_meta'}`).get()?.version !== (role === 'buyer' ? 1 : 2))
+        if (db.prepare("SELECT version FROM commerce_meta").get()?.version !== 2)
             throw new Error('unknown_version');
-        const unknownPayments = count(db, role === 'buyer' ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.paymentState')='unknown'" : "SELECT COUNT(*) n FROM commerce_orders WHERE payment_state='unknown'");
-        const unknownExecution = count(db, role === 'buyer' ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.executionState')='unknown'" : "SELECT COUNT(*) n FROM commerce_orders WHERE execution_state='unknown'");
-        // Only concrete persisted provider errors count. Generic unknown is not proof of provider failure.
-        const providerFailures = count(db, role === 'buyer'
-            ? "SELECT COUNT(*) n FROM buyer_purchases WHERE json_extract(record_json,'$.paymentState')!='confirmed' AND json_extract(record_json,'$.errorCode') IN ('stripe_transport_unknown','stripe_request_failed','stripe_rate_limit','stripe_response','stripe_response_size')"
-            : "SELECT COUNT(*) n FROM commerce_payment_attempts WHERE state!='confirmed' AND json_extract(receipt_json,'$.success')=0 AND length(json_extract(receipt_json,'$.errorReason'))>0");
-        signals.push(signal('ledger_read', 0), signal('payment_unknown', unknownPayments), signal('execution_unknown', unknownExecution), signal('recorded_provider_failure', providerFailures));
-        if (role === 'seller')
-            signals.push(irrelevant('budget_near_limit'), irrelevant('budget_exhausted'));
-        else {
-            try {
-                if (!options.policyPath)
-                    throw new Error('policy_required');
-                privateFile(options.policyPath, 1024 * 1024);
-                const policy = loadBuyerPolicy(JSON.parse(readFileSync(options.policyPath, 'utf8')));
-                const usage = new Map();
-                for (const b of policy.budgets)
-                    usage.set(b.currency, { reserved: 0n, spent: 0n });
-                for (const row of db.prepare("SELECT currency,amount,budget_state FROM buyer_purchases WHERE budget_state!='none'").iterate()) {
-                    const currency = String(row.currency), amount = String(row.amount), state = row.budget_state;
-                    const target = usage.get(currency);
-                    if (!target || !/^[1-9][0-9]{0,77}$/.test(amount) || !['spent', 'reserved'].includes(String(state)))
-                        throw new Error('budget_binding');
-                    target[state === 'spent' ? 'spent' : 'reserved'] += BigInt(amount);
-                }
-                const checked = policy.budgets.map(b => {
-                    const u = usage.get(b.currency), cap = BigInt(b.maxTotal), used = u.reserved + u.spent;
-                    const state = used >= cap ? 'exhausted' : used * 10n >= cap * 9n ? 'near_limit' : 'available';
-                    return { unit: CURRENCIES[b.currency], maxTotal: cap.toString(), reserved: u.reserved.toString(), spent: u.spent.toString(), remaining: (used < cap ? cap - used : 0n).toString(), state };
-                });
-                budgets.push(...checked);
-                signals.push(signal('budget_near_limit', checked.filter(b => b.state === 'near_limit').length), signal('budget_exhausted', checked.filter(b => b.state === 'exhausted').length, 'critical'));
-            }
-            catch {
-                signals.push(missing('budget_near_limit'), missing('budget_exhausted'));
-            }
-        }
+        signals.push(signal('ledger_read', 0), signal('payment_unknown', count(db, "SELECT COUNT(*) n FROM commerce_orders WHERE payment_state='unknown'"), 'critical'), signal('execution_unknown', count(db, "SELECT COUNT(*) n FROM commerce_orders WHERE execution_state='unknown'")));
+        available = true;
     }
     catch {
-        role = 'unavailable';
-        signals.length = 0;
-        budgets.length = 0;
-        signals.push(...['ledger_read', 'payment_unknown', 'execution_unknown', 'recorded_provider_failure', 'budget_near_limit', 'budget_exhausted'].map(missing));
+        signals.push(missing('ledger_read'), missing('payment_unknown'), missing('execution_unknown'));
     }
     finally {
         db?.close();
@@ -92,21 +42,12 @@ export function inspectLocalAlerts(path, options = {}) {
             signals.push(irrelevant('report_backlog'), irrelevant('report_failure'));
         }
         else {
-            if (options.integrationDisabled)
-                throw new Error('ambiguous_integration');
-            if (!options.integrationPath)
+            if (options.integrationDisabled || !options.integrationPath)
                 throw new Error('integration_not_supplied');
             integration = database(options.integrationPath);
-            const binding = integration.prepare("SELECT value FROM meta WHERE key='binding'").get();
-            const source = integration.prepare("SELECT value FROM meta WHERE key='source_instance'").get();
-            if (!binding || !source || typeof binding.value !== 'string' || typeof source.value !== 'string')
-                throw new Error('integration_schema');
-            const parsed = JSON.parse(binding.value);
-            if (!parsed || typeof parsed.platformOrigin !== 'string' || typeof parsed.agentId !== 'string' || typeof parsed.runtimeAgentId !== 'string')
+            if (!integration.prepare("SELECT value FROM meta WHERE key='binding'").get() || !integration.prepare("SELECT value FROM meta WHERE key='source_instance'").get())
                 throw new Error('integration_schema');
-            const pending = count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending'");
-            const failed = count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending' AND attempts>0 AND last_error<>''");
-            signals.push(signal('report_backlog', pending), signal('report_failure', failed));
+            signals.push(signal('report_backlog', count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending'")), signal('report_failure', count(integration, "SELECT COUNT(*) n FROM outbox WHERE state='pending' AND attempts>0 AND last_error<>''")));
         }
     }
     catch {
@@ -115,11 +56,14 @@ export function inspectLocalAlerts(path, options = {}) {
     finally {
         integration?.close();
     }
-    const alertCount = signals.filter(s => s.status === 'alert').length, unavailableCount = signals.filter(s => s.status === 'unavailable').length;
+    const alertCount = signals.filter(s => s.status === 'alert').length;
+    const unavailableCount = signals.filter(s => s.status === 'unavailable').length;
     return {
-        role, view: 'alerts', observation: 'local_persisted_state_only',
-        status: role === 'unavailable' ? 'unavailable' : unavailableCount ? 'partial' : 'available',
-        signals, budgets, alertCount, unavailableCount,
+        role: available ? 'seller' : 'unavailable',
+        view: 'alerts',
+        observation: 'local_persisted_state_only',
+        status: !available ? 'unavailable' : unavailableCount ? 'partial' : 'available',
+        signals, budgets: [], alertCount, unavailableCount,
         providerHealth: 'unavailable_not_probed',
         recommendedExitCode: unavailableCount ? 3 : alertCount ? 2 : 0,
         paymentPerformed: false, refundPerformed: false, networkRequests: 0,

package/dist/commerce/card.js

@@ -14,7 +14,7 @@ export function createOfferCard(config, serviceId, offerId, origin) {
     if (!service || !offer)
         throw new CommerceError('offer_not_found', 'Service offer not found');
     const profile = offer.paymentProfile ? config.paymentProfiles[offer.paymentProfile] : null;
-    const payment = profile?.adapter === 'x402' ? { adapter: 'x402', network: profile.network, asset: profile.asset, payTo: profile.payTo } : profile?.adapter === 'envar_balance' ? { adapter: 'envar_balance', currency: 'usd', accountRef: profile.accountRef } : profile ? { adapter: 'mpp', method: 'stripe', intent: 'charge', currency: profile.currency } : null;
+    const payment = profile ? { adapter: 'envar_balance', currency: 'usd', accountRef: profile.accountRef } : null;
     return AgentCard.fromJSON({
         name: service.name,
         description: `Deliverables: ${service.contract.deliverables.join(', ')}`,

package/dist/commerce/cli.js

@@ -5,10 +5,8 @@ import { createRequire } from 'node:module';
 import { randomBytes } from 'node:crypto';
 import { once } from 'node:events';
 import { dirname, join, resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { privateKeyToAccount } from 'viem/accounts';
 import { AgentCard } from '@a2a-js/sdk';
-import { loadCommerceConfig, loadBuyerPolicy, digest } from './config.js';
+import { loadCommerceConfig, digest } from './config.js';
 import { createOfferCard } from './card.js';
 import { CommerceStore } from './store.js';
 import { CommerceServer, bearerAuthenticator } from './server.js';
@@ -16,16 +14,14 @@ import { EnvarIntegration } from './envar.js';
 import { EnvarSellerRuntime, PinnedUpstreams, restoreEnvarConfig } from './envar-runtime.js';
 import { listenCommerce } from './http.js';
 import { CredentialVault } from './vault.js';
-import { X402Gate } from './x402.js';
 import { EnvarBalanceGate } from './envar-balance.js';
-import { evmReceiptVerifier, evmSettlementRecovery } from './chain.js';
 import { CommerceError } from './types.js';
 import { createNativeSkillExecutor } from './native-skills.js';
 import { inspectLedger, inspectLocalAlerts } from './operations.js';
 import { serveManaged } from './managed.js';
 import { setupAgent } from './setup.js';
 import { SkillDiscovery } from './discovery.js';
-import { upgradeDiscovery, configurePayments } from './configure.js';
+import { upgradeDiscovery } from './configure.js';
 import { agentSetup } from './agent-setup.js';
 import { setupExternalAgent, serveExternalAgent } from './external-runtime.js';
 const { values, positionals } = parseArgs({ allowPositionals: true, options: {
@@ -35,7 +31,7 @@ const { values, positionals } = parseArgs({ allowPositionals: true, options: {
         after: { type: 'string' }, limit: { type: 'string' }, 'refund-review': { type: 'boolean' }, alerts: { type: 'boolean' }, 'fail-on-alert': { type: 'boolean' }, 'integration-state': { type: 'string' }, 'no-integration': { type: 'boolean' },
         framework: { type: 'string' }, file: { type: 'string' }, 'docker-container': { type: 'string' }, python: { type: 'string' }, 'hermes-home': { type: 'string' }, check: { type: 'boolean' },
     } });
-const usage = 'envarpay external-setup --directory DIR --origin HTTPS_ORIGIN | external-serve --config FILE --credentials FILE --state DB --origin HTTPS_ORIGIN\nenvarpay onboard --file invitation.json [--framework hermes|openclaw] [--check] [--python PATH] [--docker-container NAME] [--hermes-home PATH] [--origin HTTPS_ORIGIN]\nenvarpay upgrade --directory DIR [--hermes-home PATH] | payments --directory DIR --file receiving.json\nenvarpay setup --file envar-setup.json [--docker-container NAME | --python PATH] [--hermes-home PATH] [--directory DIR]\ninit --directory DIR | inspect --state DB [--after ROW --limit 100 --refund-review] [--alerts --config buyer-policy.json --integration-state DB/--no-integration --fail-on-alert] | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve/buyer-serve --config FILE --credentials FILE --state DB --origin URL';
+const usage = 'envarpay setup --file envar-setup.json [--docker-container NAME | --python PATH] [--hermes-home PATH] [--directory DIR]\nenvarpay onboard --file invitation.json [--framework hermes|openclaw] [--check] [--python PATH] [--docker-container NAME] [--hermes-home PATH] [--origin HTTPS_ORIGIN]\nenvarpay upgrade --directory DIR [--hermes-home PATH]\nenvarpay external-setup --directory DIR --origin HTTPS_ORIGIN | external-serve --config FILE --credentials FILE --state DB --origin HTTPS_ORIGIN\nenvarpay init --directory DIR | inspect --state DB [--after ROW --limit 100 --refund-review] | validate --config seller.json | card --config seller.json --service ID --offer ID --origin URL | serve --config FILE --credentials FILE --state DB --origin URL';
 const closers = [];
 function privateFile(path) {
     const stat = lstatSync(path);
@@ -75,16 +71,6 @@ function signals() {
 async function closeHttp(http) {
     await new Promise((resolve, reject) => http.close(error => error ? reject(error) : resolve()));
 }
-async function loadMppAdapter(path) {
-    privateFile(path);
-    const module = await import(pathToFileURL(resolve(path)).href);
-    if (typeof module.createMppBuyerOptions !== 'function')
-        throw new CommerceError('mpp_adapter_module', 'Owner-supplied module must export createMppBuyerOptions');
-    const options = await module.createMppBuyerOptions();
-    if (!options || typeof options.createToken !== 'function' || typeof options.recoverToken !== 'function' || typeof options.verifyReceipt !== 'function')
-        throw new CommerceError('mpp_adapter_module', 'MPP requires real token creation, original-operation recovery and receipt verification');
-    return options;
-}
 async function run() {
     if (values.help || positionals.length === 0 && !values.version) {
         console.log(usage);
@@ -129,10 +115,6 @@ async function run() {
         upgradeDiscovery(values.directory, values['hermes-home']);
         return;
     }
-    if (command === 'payments' && values.directory && values.file) {
-        await configurePayments(values.directory, values.file);
-        return;
-    }
     if (command === 'setup') {
         if (!values.file)
             throw new CommerceError('setup_file', 'Download the setup file from your Agent service page and pass --file PATH');
@@ -142,7 +124,7 @@ async function run() {
     if (values.alerts || values['fail-on-alert'] || values['integration-state'] || values['no-integration']) {
         if (command !== 'inspect' || !values.state || !values.alerts || values['refund-review'] || values.after || values.limit || (values['no-integration'] && values['integration-state']))
             throw new CommerceError('inspection_view', 'Alert inspection needs inspect --state and --alerts, without pagination or refund review; choose at most one integration source');
-        const report = inspectLocalAlerts(values.state, { policyPath: values.config, integrationPath: values['integration-state'], integrationDisabled: values['no-integration'] });
+        const report = inspectLocalAlerts(values.state, { integrationPath: values['integration-state'], integrationDisabled: values['no-integration'] });
         console.log(JSON.stringify(report, null, 2));
         if (values['fail-on-alert'])
             process.exitCode = report.recommendedExitCode;
@@ -160,7 +142,7 @@ async function run() {
         throw new CommerceError('envar_configuration', 'Supply both --envar-config and --envar-credentials');
     if (command === 'init' && values.directory) {
         mkdirSync(values.directory, { recursive: true, mode: 0o700 });
-        for (const [name, source] of [['seller.json', 'seller.json'], ['buyer-policy.json', 'buyer-policy.json']]) {
+        for (const [name, source] of [['seller.json', 'seller.json']]) {
             writeFileSync(join(values.directory, name), readFileSync(new URL(`../../examples/${source}`, import.meta.url)), { flag: 'wx', mode: 0o600 });
         }
         writeFileSync(join(values.directory, 'vault.key'), randomBytes(32), { flag: 'wx', mode: 0o600, flush: true });
@@ -170,81 +152,6 @@ async function run() {
     if (!values.config)
         throw new CommerceError('usage', usage);
     const raw = JSON.parse(readFileSync(values.config, 'utf8'));
-    if (command === 'buyer-serve') {
-        if (!values.origin || !values.state || !values.credentials)
-            throw new CommerceError('usage', usage);
-        const policy = loadBuyerPolicy(raw);
-        const secrets = JSON.parse(privateFile(values.credentials).toString('utf8'));
-        const needsEvm = policy.peers.some(peer => peer.protocol === 'x402'), needsMpp = policy.peers.some(peer => peer.protocol === 'mpp');
-        if (!secrets.peerTokens || (needsEvm || needsMpp) && !secrets.vaultKeyFile)
-            throw new CommerceError('buyer_credentials', 'Paid buyer needs private vault key and peer credentials');
-        let signer;
-        if (needsEvm) {
-            if (!secrets.privateKeyFile || !secrets.rpcUrls)
-                throw new CommerceError('buyer_credentials', 'x402 peers require local signer and RPC configuration');
-            const key = privateFile(secrets.privateKeyFile).toString('utf8').trim();
-            if (!/^0x[0-9a-fA-F]{64}$/.test(key))
-                throw new CommerceError('buyer_key', 'Signer file must contain one 32-byte 0x-prefixed private key');
-            signer = privateKeyToAccount(key);
-        }
-        if (secrets.mppAdapterModule && secrets.mppStripe)
-            throw new CommerceError('mpp_configuration', 'Choose the built-in Stripe issuer or one explicit adapter module');
-        if (needsMpp && !secrets.mppAdapterModule && !secrets.mppStripe)
-            throw new CommerceError('mpp_configuration', 'MPP peers require a configured Stripe issuer or explicit authorized funding adapter');
-        const buyerVault = secrets.vaultKeyFile ? new CredentialVault(join(dirname(values.state), 'buyer-authorizations'), privateFile(secrets.vaultKeyFile)) : undefined;
-        let mpp;
-        if (needsMpp && secrets.mppStripe) {
-            const configured = secrets.mppStripe;
-            if (!configured.secretKeyFile || !configured.sellers || typeof configured.sellers !== 'object' || Array.isArray(configured.sellers))
-                throw new CommerceError('mpp_configuration', 'Stripe issuer and seller read credentials must use private key files');
-            const { createStripeMppBuyer } = await import('./stripe-issuer.js');
-            const adapter = createStripeMppBuyer({
-                payer: configured.payer, mode: configured.mode, issuerAccountId: configured.issuerAccountId,
-                secretKey: privateFile(configured.secretKeyFile).toString('utf8').trim(), paymentMethod: configured.paymentMethod,
-                ...(configured.publishableKey !== undefined ? { publishableKey: configured.publishableKey } : {}),
-                sellers: Object.fromEntries(Object.entries(configured.sellers).map(([id, seller]) => [id, { accountId: seller.accountId, secretKey: privateFile(seller.secretKeyFile).toString('utf8').trim() }])),
-                ...(configured.issuance ? { issuance: configured.issuance } : {}), ...(configured.returnUrl ? { returnUrl: configured.returnUrl } : {}),
-            }, { statePath: values.state + '.stripe-issuer.sqlite3', vault: buyerVault });
-            closers.push(() => adapter.close());
-            await adapter.assertReady();
-            mpp = adapter;
-        }
-        else if (needsMpp)
-            mpp = await loadMppAdapter(secrets.mppAdapterModule);
-        const { BuyerStore } = await import('./buyer-store.js');
-        const { CommerceBuyer } = await import('./buyer.js');
-        const { BuyerManagement, listenBuyerManagement } = await import('./management.js');
-        const store = new BuyerStore(values.state);
-        closers.push(() => store.close());
-        const buyer = new CommerceBuyer({ policy, store, vault: buyerVault,
-            signer, mpp, peerTokens: secrets.peerTokens, peerEndpoints: secrets.peerEndpoints,
-            ...(needsEvm ? { verifyReceipt: evmReceiptVerifier(secrets.rpcUrls), ...evmSettlementRecovery(secrets.rpcUrls) } : {}) });
-        closers.push(() => buyer.stop());
-        if (secrets.peerProxies?.length) {
-            if (secrets.peerProxies.length > 8)
-                throw new CommerceError('proxy_limit', 'Configure at most8 explicit peer proxies per buyer');
-            const { A2APeerProxy, listenPeerProxy } = await import('./peer-proxy.js');
-            for (const settings of secrets.peerProxies) {
-                if (Object.keys(settings.tokens).some(token => Object.hasOwn(secrets.callers, token)))
-                    throw new CommerceError('proxy_token_scope', 'Agent proxy tokens must differ from owner management credentials');
-                if (!Number.isInteger(settings.port) || settings.port < 1 || settings.port > 65535)
-                    throw new CommerceError('proxy_port', 'Invalid proxy listen port');
-                const proxy = new A2APeerProxy({ ...settings, buyer });
-                closers.push(async () => { await proxy.stop(); proxy.close(); });
-                const listener = listenPeerProxy(proxy, settings.host ?? '127.0.0.1', settings.port);
-                closers.push(() => closeHttp(listener));
-                await once(listener, 'listening');
-            }
-        }
-        const management = new BuyerManagement({ buyer, origin: values.origin, authenticate: bearerAuthenticator(secrets.callers) });
-        const http = listenBuyerManagement(management, values.origin, values.host ?? '127.0.0.1', port(4021));
-        closers.push(() => closeHttp(http));
-        await once(http, 'listening');
-        buyer.start();
-        signals();
-        console.log(JSON.stringify({ listening: port(4021), role: 'buyer', paymentsEnabled: policy.paymentsEnabled }));
-        return;
-    }
     let config = loadCommerceConfig(raw);
     if (command === 'validate') {
         console.log(JSON.stringify({ valid: true, digest: digest(config), services: config.services.length, paymentPerformed: false }));
@@ -276,46 +183,18 @@ async function run() {
     closers.push(() => store.close());
     if (integration)
         config = restoreEnvarConfig(config, integration, store.catalogHistory());
-    const protocols = new Set(Object.values(config.paymentProfiles).map(p => p.adapter));
-    for (const historical of store.catalogHistory())
-        for (const profile of Object.values(historical.profiles))
-            protocols.add(profile.adapter);
-    if (syncSettings?.policy.allowedX402.length)
-        protocols.add('x402');
-    if (syncSettings?.policy.allowedMppAccounts.length)
-        protocols.add('mpp');
+    const needsBalance = Boolean(integration) || Object.values(config.paymentProfiles).length > 0 || store.catalogHistory().some(entry => Object.values(entry.profiles).length > 0);
     let vault;
-    if (protocols.size) {
+    if (needsBalance) {
         if (!secrets.vaultKeyFile)
             throw new CommerceError('vault_key', 'Paid services require a private vault key file');
         vault = new CredentialVault(join(dirname(values.state), 'authorizations'), privateFile(secrets.vaultKeyFile));
     }
-    const gates = {};
-    let stripeRecipientFor;
-    if (protocols.has('x402')) {
-        if (!secrets.payers || !secrets.rpcUrls)
-            throw new CommerceError('x402_configuration', 'x402 requires explicit caller-payer bindings and network RPCs');
-        const gate = new X402Gate({ store, vault: vault, payerFor: caller => secrets.payers?.[caller], verifyReceipt: evmReceiptVerifier(secrets.rpcUrls), ...evmSettlementRecovery(secrets.rpcUrls) });
-        await gate.check([...Object.values(config.paymentProfiles).filter((p) => p.adapter === 'x402'), ...(secrets.receivingProfiles ?? [])]);
-        gates.x402 = gate;
-    }
-    if (protocols.has('mpp')) {
-        if (!secrets.stripe || !secrets.mppHmacKeyFile)
-            throw new CommerceError('mpp_configuration', 'MPP requires private Stripe credentials and a separate challenge key');
-        const { MppGate } = await import('./mpp.js'), { stripeProvider } = await import('./stripe-provider.js');
-        const providers = Object.fromEntries(Object.entries(secrets.stripe).map(([ref, p]) => [ref, stripeProvider({ ...p, secretKey: privateFile(p.secretKeyFile).toString('utf8').trim() })]));
-        const hmacKey = privateFile(secrets.mppHmacKeyFile);
-        if (hmacKey.length < 32)
-            throw new CommerceError('mpp_hmac_key', 'MPP requires a private challenge key of at least32 random bytes');
-        const gate = new MppGate({ store, vault: vault, origin: values.origin, hmacSecret: hmacKey.toString('base64'), providers });
-        await gate.check();
-        gates.mpp = gate;
-        stripeRecipientFor = ref => gate.merchantRecipient(ref);
-    }
-    if (protocols.has('envar_balance')) {
+    let balanceGate;
+    if (needsBalance) {
         if (!integration)
             throw new CommerceError('balance_configuration', 'Envar balance requires an authenticated Envar seller integration');
-        gates.envar_balance = new EnvarBalanceGate({ store, vault: vault, claim: args => integration.claimBalancePayment(args) });
+        balanceGate = new EnvarBalanceGate({ store, vault: vault, claim: args => integration.claimBalancePayment(args) });
     }
     const nativeSkills = secrets.skills ? createNativeSkillExecutor(secrets.skills, values.origin, config.agent.name) : undefined;
     const discovery = secrets.skills?.discovery?.enabledFromWeb ? new SkillDiscovery(secrets.skills, secrets.skills.discovery, values.origin) : undefined;
@@ -325,30 +204,23 @@ async function run() {
     upstreams.prepare(config, store.catalogHistory().map(entry => entry.service));
     const validateAdapters = (candidate) => {
         for (const profile of Object.values(candidate.paymentProfiles)) {
-            if (!gates[profile.adapter])
-                throw new CommerceError('payment_method_unavailable', 'Configure the payment adapter locally before enabling this service');
-            if (profile.adapter === 'x402' && !secrets.rpcUrls?.[profile.network])
-                throw new CommerceError('x402_configuration', 'Configure the required network RPC locally');
-            if (profile.adapter === 'mpp' && !stripeRecipientFor?.(profile.accountRef))
-                throw new CommerceError('mpp_configuration', 'Configure and verify the merchant account locally');
-            if (profile.adapter === 'envar_balance' && !syncSettings?.policy.allowedBalanceAccounts?.includes(profile.accountRef))
+            if (!balanceGate || !syncSettings?.policy.allowedBalanceAccounts?.includes(profile.accountRef))
                 throw new CommerceError('balance_configuration', 'Allow this balance receiving account locally');
         }
     };
     validateAdapters(config);
-    const server = new CommerceServer({ config, origin: values.origin, store, stripeRecipientFor, ownershipChallenges: secrets.ownershipChallenges,
+    const server = new CommerceServer({ config, origin: values.origin, store, ownershipChallenges: secrets.ownershipChallenges,
         authenticate: bearerAuthenticator(secrets.callers), execute: upstreams.execute,
         paymentGate: { handle: async (request, order) => {
-                const adapter = order.quote.paymentProfile?.adapter, gate = adapter ? gates[adapter] : undefined;
-                if (!gate)
-                    throw new CommerceError('payment_method_unavailable', 'Configured payment adapter is unavailable');
-                return gate.handle(request, order);
+                if (!balanceGate)
+                    throw new CommerceError('payment_method_unavailable', 'Envar balance is unavailable');
+                return balanceGate.handle(request, order);
             } }, onError: (code, orderId) => console.error(JSON.stringify({ code, orderId })) });
     closers.push(async () => { server.stop(); controller.abort(); while (server.isRunning)
         await new Promise(r => setTimeout(r, 50)); });
     let connection;
     if (integration) {
-        connection = new EnvarSellerRuntime({ integration, server, upstreams, pollIntervalMs: syncSettings?.pollIntervalMs, validateConfig: validateAdapters, beforeSync: discovery ? () => discovery.sync(integration, [...Object.values(server.config.paymentProfiles).filter(p => p.adapter === 'x402'), ...(secrets.receivingProfiles ?? [])].map(p => ({ network: p.network, pay_to: p.payTo, facilitator_url: p.facilitatorUrl }))) : undefined, onError: code => console.error(JSON.stringify({ code, integration: 'envar' })) });
+        connection = new EnvarSellerRuntime({ integration, server, upstreams, pollIntervalMs: syncSettings?.pollIntervalMs, validateConfig: validateAdapters, beforeSync: discovery ? () => discovery.sync(integration) : undefined, onError: code => console.error(JSON.stringify({ code, integration: 'envar' })) });
         closers.push(() => connection.stop());
     }
     const http = listenCommerce(server, values.origin, values.host ?? '127.0.0.1', port(4020));
@@ -356,7 +228,7 @@ async function run() {
     await once(http, 'listening');
     connection?.start();
     signals();
-    console.log(JSON.stringify({ listening: port(4020), role: 'seller', paidTransports: [...protocols] }));
+    console.log(JSON.stringify({ listening: port(4020), role: 'seller', paymentMethod: needsBalance ? 'envar_balance' : 'free' }));
 }
 try {
     await run();

package/dist/commerce/config.d.ts

@@ -1,11 +1,8 @@
-import { type BuyerPolicy, type CommerceConfig, type Offer, type PaymentProfile, type Service } from './types.js';
+import { type CommerceConfig, type Offer, type PaymentProfile, type Service } from './types.js';
 export declare function atomic(value: string): bigint;
 export declare function validateUrl(value: string, allowPrivate?: boolean): URL;
 export declare function currencyOf(profile: PaymentProfile): string;
-/** Stripe documents sandbox Business Profile IDs as profile_test_<opaque id>. */
-export declare function isStripeProfileId(value: unknown): value is string;
 export declare function digest(value: unknown): string;
 /** Keep legacy quotes unchanged; skill-bound quotes freeze the installed skill revision too. */
 export declare function serviceTermsDigest(configVersion: 1 | 2, service: Service, offer: Offer, profile: PaymentProfile | null): string;
 export declare function loadCommerceConfig(value: unknown): CommerceConfig;
-export declare function loadBuyerPolicy(value: unknown): BuyerPolicy;