@fangorn-network/westmarch 2026.10.2-2.0-dev → 2026.10.2-7.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fangorn-network/westmarch",
-  "version": "2026.10.22.0-dev",
+  "version": "2026.10.27.1",
   "description": "all-in-one builder for fangorn apps",
   "license": "MIT",
   "type": "module",
@@ -45,7 +45,7 @@
     "@fangorn-network/markov": "^0.1.0"
   },
   "peerDependencies": {
-    "@fangorn-network/sdk": "^2026.10.21-dev",
+    "@fangorn-network/sdk": "^2026.10.26-dev",
     "@huggingface/transformers": "^4.2.0",
     "@noble/curves": "^1.9.1",
     "viem": "^2.55.1"
@@ -56,7 +56,7 @@
     }
   },
   "devDependencies": {
-    "@fangorn-network/sdk": "^2026.10.21-dev",
+    "@fangorn-network/sdk": "^2026.10.26-dev",
     "@huggingface/transformers": "^4.2.0",
     "@noble/curves": "^1.9.1",
     "@privy-io/react-auth": "^3.47.0",

package/src/agent/agent-card.js

@@ -17,6 +17,7 @@
 // point back at it, so writing someone else's appId here gets you nothing.
 
 import { FANGORN_APP_EXTENSION, BaseSepoliaConfig, appId as hashAppId } from "@fangorn-network/sdk";
+import { PLUGIN_MARKETPLACE, PLUGIN_NAME } from "../discover/apps.js";
 
 /** Run `register` against a recording `document.modelContext`; return what it
  *  registered. `register` is whatever the page calls at load. */
@@ -48,6 +49,10 @@ const HEX32 = /^0x[0-9a-fA-F]{64}$/;
  *              tools, as the free tier's Worker does at /mcp.
  *   config     the deployment; defaults to the SDK's, so the addresses in the
  *              card cannot drift from the ones `discoverApp` checks.
+ *   skill      `{url, sha256}`: the app's own agent skill (a SKILL.md), for agents
+ *              that adopt it, so its behaviour travels with the app and not with a
+ *              marketplace. The hash pins what the reader saw: an agent adopts it
+ *              only on its user's yes, and asks again when the hash changes.
  */
 export function agentCard({ name, description, url, version = "0.0.0", tools = [], tags = [], skills = [], fangorn, ...rest }) {
     if (!name || !url) throw new Error("agentCard: name and url are required");
@@ -75,7 +80,7 @@ export function agentCard({ name, description, url, version = "0.0.0", tools = [
 
 /** The params `discoverApp` reads, validated the same way it validates them.
  *  A malformed card should fail the build, not the first reader. */
-export function fangornExtension({ app, fromBlock, repos = [], views = [], mcp, paid, access, config = BaseSepoliaConfig }) {
+export function fangornExtension({ app, fromBlock, repos = [], views = [], mcp, paid, access, skill, plugin, config = BaseSepoliaConfig }) {
     if (!app) throw new Error("fangorn.app is required");
     const id = HEX32.test(app) ? app : hashAppId(app);
     const from = String(fromBlock ?? "");
@@ -96,6 +101,10 @@ export function fangornExtension({ app, fromBlock, repos = [], views = [], mcp,
     }
     // `access`: a private app. Its view and tools need a pass (`pass_url`, `pass` in base units, for
     // `days`) or one x402 payment of `call` per tool call; describe and the catalog are free.
+    if (skill && !(/^https?:\/\//.test(skill.url ?? "") && /^[0-9a-f]{64}$/.test(skill.sha256 ?? "")))
+        throw new Error(`fangorn.skill needs an http(s) url and the sha256 of the file, in hex: ${JSON.stringify(skill)}`);
+    if (plugin && !(PLUGIN_MARKETPLACE.test(plugin.marketplace ?? "") && PLUGIN_NAME.test(plugin.name ?? "")))
+        throw new Error(`fangorn.plugin needs a marketplace (GitHub owner/repo or https URL) and a plugin name: ${JSON.stringify(plugin)}`);
     if (access && !(/^https?:\/\//.test(access.pass_url ?? "") && /^\d+$/.test(String(access.pass)) && /^\d+$/.test(String(access.call))))
         throw new Error(`fangorn.access needs pass_url, and pass and call in base units: ${JSON.stringify(access)}`);
     return {
@@ -110,6 +119,8 @@ export function fangornExtension({ app, fromBlock, repos = [], views = [], mcp,
             ...(paid ? { paid: { url: paid.url, price: String(paid.price), asset: paid.asset, network: paid.network,
                                  symbol: paid.symbol ?? "USDC", decimals: paid.decimals ?? 6, description: paid.description ?? "" } } : {}),
             ...(access ? { access } : {}),
+            ...(skill ? { skill: { url: skill.url, sha256: skill.sha256 } } : {}),
+            ...(plugin ? { plugin: { marketplace: plugin.marketplace, name: plugin.name } } : {}),
         },
     };
 }
@@ -148,6 +159,12 @@ if (typeof process !== "undefined" && import.meta.url === `file://${process.argv
     throws(() => fangornExtension({ app: "a" }), /fromBlock/, "missing fromBlock");
     throws(() => fangornExtension({ app: "a", fromBlock: 0, views: ["javascript:alert(1)"] }), /views/, "non-http view");
     throws(() => agentCard({ name: "X" }), /url/, "missing url");
+    const sha = "a".repeat(64);
+    eq(fangornExtension({ app: "a", fromBlock: 0, skill: { url: "https://x.test/skill/a/SKILL.md", sha256: sha } }).params.skill, { url: "https://x.test/skill/a/SKILL.md", sha256: sha }, "a skill rides in the extension");
+    throws(() => fangornExtension({ app: "a", fromBlock: 0, skill: { url: "https://x.test/s.md" } }), /skill/, "a skill without its hash");
+    throws(() => fangornExtension({ app: "a", fromBlock: 0, skill: { url: "file:///etc/passwd", sha256: sha } }), /skill/, "a non-http skill");
+    eq(fangornExtension({ app: "a", fromBlock: 0, plugin: { marketplace: "o/r", name: "a" } }).params.plugin, { marketplace: "o/r", name: "a" }, "a plugin rides in the extension");
+    throws(() => fangornExtension({ app: "a", fromBlock: 0, plugin: { marketplace: "o/r; rm -rf ~", name: "a" } }), /plugin/, "a plugin that would inject into a shell");
 
     console.log("agent-card.js self-check ok — tools captured without executing, extension matches the SDK's, bad params fail the build");
 }

package/src/agent/mcp.js

@@ -24,7 +24,7 @@ import net from "node:net";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { createInterface } from "node:readline";
-import { APP_EXTENSION, listApps, toApp } from "../discover/apps.js";
+import { APP_EXTENSION, listApps, pluginOf, skillOf, toApp } from "../discover/apps.js";
 
 const log = (...a) => console.error("[fangorn-mcp]", ...a);   // stdout is the protocol
 // FANGORN_MCP_TRACE=1: step timings on stderr, for finding where an answer waits.
@@ -214,8 +214,9 @@ export function handlers(deps) {
         if (!mcp) throw new Error(`${card.name ?? cardUrl} has no MCP server (its card has no \`mcp\`)`);
         let s = slug(card.name ?? app);
         while (open.has(s)) s += "-";
-        const access = card.capabilities?.extensions?.find((e) => e.uri === APP_EXTENSION)?.params?.access ?? null;
-        const o = { slug: s, name: card.name, card: cardUrl, appId, ...await deps.remoteTools(mcp, { access }) };
+        const ext = card.capabilities?.extensions?.find((e) => e.uri === APP_EXTENSION);
+        const access = ext?.params?.access ?? null;
+        const o = { slug: s, name: card.name, card: cardUrl, appId, skill: skillOf(ext), plugin: pluginOf(ext), ...await deps.remoteTools(mcp, { access }) };
         trace(`open ${app}: ready`);
         open.set(o.slug, o);
         deps.notify?.("notifications/tools/list_changed");
@@ -249,7 +250,13 @@ export function handlers(deps) {
         "open-app": async ({ app }) => {
             const o = await openApp(app);
             return text({ app: o.slug, name: o.name, card: o.card,
-                          call_as: `${o.slug}__<tool>, or call-app-tool`, tools: o.tools });
+                          call_as: `${o.slug}__<tool>, or call-app-tool`, tools: o.tools,
+                          // An app's own skill: standing instructions for the reader's agent, so never loaded
+                          // silently. The fangorn-index skill offers it to the user and pins the hash on a yes.
+                          ...(o.skill ? { skill: { ...o.skill, adopt: "The app ships an agent skill. Offer it to the user (what it would make you do, from its description); adopt it only on their yes, checking sha256, and ask again if the hash changes." } } : {}),
+                          // Its Claude Code plugin: hooks run code on every matching event, so the same rule, louder.
+                          ...(o.plugin ? { plugin: { ...o.plugin, install: `claude plugin install ${o.plugin.name} --marketplace ${o.plugin.marketplace}`,
+                              adopt: "The app ships a Claude Code plugin, whose hooks run code on this machine without being called. Offer it to the user once, saying what its hooks trigger on; install only on their yes. It takes effect next session." } } : {}) });
         },
         "call-app-tool": async ({ app, tool, arguments: args }) => call(app, tool, args),
     };
@@ -298,7 +305,8 @@ if (process.argv[2] === "--selfcheck") {
         findApps: async () => ({ apps: [{ name: "Kings Foil", desc: "trials", card: "https://k.test/card", appId: "0xk" },
                                         { name: "Bare", desc: "", card: "https://b.test/card", appId: "0xb" }], rejected: [{}] }),
         exploreApps: async (q) => ({ ranked_by: q ? "meaning" : null, apps: [{ app: "kings-foil", name: "Kings Foil", relevant: true }, { app: "b", name: "B", relevant: false }] }),
-        resolveCard: async (url) => (url.includes("b.test") ? { card: { name: "Bare" }, mcp: null } : { card: { name: "Kings Foil" }, mcp: "https://k.test/mcp" }),
+        resolveCard: async (url) => (url.includes("b.test") ? { card: { name: "Bare" }, mcp: null } : { card: { name: "Kings Foil", capabilities: { extensions: [{ uri: APP_EXTENSION,
+            params: { skill: { url: "https://k.test/skill/kings-foil/SKILL.md", sha256: "b".repeat(64) }, plugin: { marketplace: "k/kf", name: "kings-foil" } } }] } }, mcp: "https://k.test/mcp" }),
         remoteTools: async () => (opened++, remote),
     };
     deps.notify = serve(handlers(deps), { input, output });
@@ -321,6 +329,8 @@ if (process.argv[2] === "--selfcheck") {
     call(5, "open-app", { app: "Kings Foil" }); await wait();
     call(6, "open-app", { app: "https://k.test/card" }); await wait();
     assert(body(5).tools[0].name === "search" && opened === 1, "open once, by name or by card URL");
+    assert(body(5).skill?.url === "https://k.test/skill/kings-foil/SKILL.md" && /user/.test(body(5).skill.adopt), "open-app offers the app's skill, for the user to adopt");
+    assert(body(5).plugin?.marketplace === "k/kf" && /user/.test(body(5).plugin.adopt), "open-app offers the app's plugin, for the user to install");
     assert(replies.some((r) => r.method === "notifications/tools/list_changed"), "opening notifies");
     rpc(7, "tools/list"); call(8, "kings-foil__search", { query: "x" }); call(9, "call-app-tool", { app: "kings-foil", tool: "search" });
     call(10, "call-app-tool", { app: "kings-foil", tool: "boom" }); call(11, "open-app", { app: "nope" }); call(13, "open-app", { app: "Bare" }); rpc(12, "nope"); await wait();

package/src/discover/apps.js

@@ -33,6 +33,20 @@ function safeView(url) {
  *  src/agent/agent-card.js's self-check fails if the two drift. */
 export const APP_EXTENSION = "https://fangorn.network/a2a/app/v1";
 
+/** The app's agent skill, `{url, sha256}`, when its card names one well-formed; else null. */
+export const skillOf = (ext) => {
+    const k = ext?.params?.skill;
+    return k && safeView(k.url) && /^[0-9a-f]{64}$/.test(k.sha256 ?? "") ? { url: k.url, sha256: k.sha256 } : null;
+};
+
+// The app's Claude Code plugin, for what a skill can't do (hooks). Both fields reach a shell command
+// in the reader's agent, so they are held to a GitHub owner/repo (or https URL) and a plain name.
+export const PLUGIN_MARKETPLACE = /^([\w.-]+\/[\w.-]+|https:\/\/[\w.\/-]+)$/, PLUGIN_NAME = /^[a-z0-9][a-z0-9-]*$/;
+export const pluginOf = (ext) => {
+    const p = ext?.params?.plugin;
+    return p && PLUGIN_MARKETPLACE.test(p.marketplace ?? "") && PLUGIN_NAME.test(p.name ?? "") ? { marketplace: p.marketplace, name: p.name } : null;
+};
+
 /** A verified card → an app entry. `views` is westmarch's param; the SDK does not read it. */
 export function toApp({ card, appId, fromBlock, repos }, cardUrl) {
     const ext = card.capabilities.extensions.find((e) => e.uri === APP_EXTENSION);
@@ -40,7 +54,7 @@ export function toApp({ card, appId, fromBlock, repos }, cardUrl) {
     const p = ext?.params?.paid;
     const paid = p && /^https?:\/\//.test(p.url ?? "") && p.url.includes("{id}") && /^\d+$/.test(String(p.price)) ? p : null;
     return {
-        appId, card: cardUrl, fromBlock, repos, views, paid,
+        appId, card: cardUrl, fromBlock, repos, views, paid, skill: skillOf(ext), plugin: pluginOf(ext),
         mcp: safeView(ext?.params?.mcp),
         name: card.name ?? appId,
         desc: card.description ?? "",

package/src/publish/ship.js

@@ -83,11 +83,17 @@ const log = (s) => console.error(`[ship] ${s}`);
 //                                 //   (pages/intro.html, a fragment, replaces the description on the front page)
 //             "nav": [{ "href": "coverage.html", "label": "Coverage" }],   // optional: header links to them
 //             "examples": ["…"],  // optional: questions to start from, on the front page (and a private app's gate)
+//             "plugin": {"marketplace": "owner/repo", "name": "…"},   // optional: its Claude Code plugin (hooks), offered by open-app
+//             "skill": "skill/SKILL.md",   // optional: the app's agent skill, served at skill/<app>/SKILL.md and named
+//                                          //   in the card with its sha256; fangorn-index offers it to whoever opens the app
 //             "agent": "app/agent.js" },   // optional: the module whose registerAgent the card lists, when
 //                                          // `pages` replaces the stock index.html with a page of its own
 //   "types": { "<tag>": { "description": "…", "role_map": {…}, "presentation": {…} } },
 //   "relations": [{ "rel": "…", "from": "<tag>", "to": "<tag>" }],
 //   "sources": [{ "namespace": "…", "cwd": "…", "command": ["python", "-m", "…", …] }],
+//   "live": ["readings"],     // optional: namespaces members push to from their own wallets (devices,
+//                             //   contributors), presented beside the sources'; true = every repo they push.
+//                             //   Without sources the app already presents every member's repo.
 //   "network": "baseSepolia", // required: the SDK's network name. baseSepolia for a new app; an app
 //                             //   already claimed on arbitrumSepolia keeps it (a different name re-claims it there)
 //   "fangorn": "fangorn",     // the CLI that signs; e.g. "node ~/fangorn/fangorn/lib/cli/cli.js",
@@ -146,9 +152,18 @@ export function loadConfig(path) {
     if (!c.site.project) throw new Error(`${path}: site.project names the Cloudflare Worker`);
     for (const s of c.sources) if (!s.namespace || !Array.isArray(s.command))
         throw new Error(`${path}: each source needs a namespace and a command (an argv array)`);
+    if (c.live != null && c.live !== true && !(Array.isArray(c.live) && c.live.every((n) => typeof n === "string")))
+        throw new Error(`${path}: live is true (every repo members push) or a list of the namespaces they push to`);
     return { relations: [], tags: [], types: {}, ...c };
 }
 
+/** The repo names the view presents: the sources' namespaces plus `live`'s, the ones members push
+ *  to themselves (devices, contributors). [] means every repo the app presents: no sources, or live: true. */
+export function presentedRepos(cfg) {
+    if (cfg.live === true) return [];
+    return [...new Set([...cfg.sources.map((s) => s.namespace), ...(cfg.live ?? [])])];
+}
+
 /** The Worker's wrangler config: the stock worker, the site as its assets, its bucket, the AI
  *  binding, the cron and CONFIG. `worker` is site/worker.js unless a test points elsewhere. */
 export function wranglerConfig({ name, site, account, cron = "*/5 * * * *", config, url, ipfsGateway, worker = join(HERE, "../../site/worker.js") }) {
@@ -359,7 +374,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     // site.url: the app's own domain, routed to the Worker. Otherwise its workers.dev URL,
     // which is only known once it is deployed: the first deploy learns it and the card follows.
     let url = cfg.site.url?.replace(/\/$/, "") ?? state.url ?? null;
-    const repos = [...new Set(cfg.sources.map((s) => s.namespace))];
+    const repos = presentedRepos(cfg);
     // Paid records are in the committed rows already, encrypted (`paid_ct`: AES-256-GCM under
     // HMAC-SHA256(PAID_SECRET, id), see x402.js). The Worker sells keys, never records, so the
     // data a buyer pays for is on IPFS, committed, and in their hands before they pay.
@@ -435,7 +450,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     } else if (deploy) log("card already bound");
 
     // A new app has no view until the cron runs, which may be hours off: build the first one now.
-    if (deploy && !dry && !register && cfg.sources.length && !await fetch(`${url}/view/cdn/catalog`).then((r) => r.ok, () => false)) {
+    if (deploy && !dry && !register && (cfg.sources.length || cfg.live) && !await fetch(`${url}/view/cdn/catalog`).then((r) => r.ok, () => false)) {
         log("no view yet: indexing it here rather than waiting for the cron");
         await indexHere(configPath).catch((e) => log(`✗ first index: ${e.message}; the cron will build it`));
     }
@@ -537,6 +552,15 @@ export async function buildSite(cfg, base) {
     if (cfg.site.pages) cpSync(resolve(base, cfg.site.pages), site, { recursive: true });
     writeFileSync(join(site, "nav.json"), JSON.stringify(cfg.site.nav ?? []));
     writeFileSync(join(site, "examples.json"), JSON.stringify(cfg.site.examples ?? []));
+    // site.skill: the app's agent skill (a SKILL.md), served at skill/<app>/SKILL.md and named in the
+    // card with its hash, so fangorn-index can offer it to whoever opens the app.
+    let skill = null;
+    if (cfg.site.skill) {
+        const bytes = readFileSync(resolve(base, cfg.site.skill));
+        mkdirSync(join(site, "skill", cfg.app), { recursive: true });
+        writeFileSync(join(site, "skill", cfg.app, "SKILL.md"), bytes);
+        skill = { path: `skill/${cfg.app}/SKILL.md`, sha256: createHash("sha256").update(bytes).digest("hex") };
+    }
     // The card lists the tools the page at `url` registers: the stock page's, or the app's own.
     const card = await import("../agent/agent-card.js");
     const { registerAgent } = await import(cfg.site.agent ? pathToFileURL(resolve(base, cfg.site.agent)).href : "../../site/agent.js");
@@ -552,7 +576,9 @@ export async function buildSite(cfg, base) {
                 ...(paid ? [{ id: "keys", name: "Keys", tags: [...(cfg.tags ?? []), "x402"],
                     description: `The keys to sealed records (POST ${u}/paid), per record.` }] : []),
             ],
-            fangorn: { app: cfg.app, fromBlock, repos, views: [`${u}/view`], mcp: `${u}/mcp`, config, ...(paid ? { paid } : {}), ...(access ? { access } : {}) },
+            fangorn: { app: cfg.app, fromBlock, repos, views: [`${u}/view`], mcp: `${u}/mcp`, config, ...(paid ? { paid } : {}), ...(access ? { access } : {}),
+                       ...(skill ? { skill: { url: `${u}/${skill.path}`, sha256: skill.sha256 } } : {}),
+                       ...(cfg.site.plugin ? { plugin: cfg.site.plugin } : {}) },
         });
         mkdirSync(join(site, ".well-known"), { recursive: true });
         writeFileSync(join(site, ".well-known/agent-card.json"), JSON.stringify(agentCard, null, 1));
@@ -732,12 +758,30 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
     const appId = `0x${createHash("sha256").update(cfg.app).digest("hex")}`, owner = `0x${"10ca1".padStart(40, "0")}`;
     const chain = {};
     // Storage addresses a record by its content, and so does this.
-    for (const [ns, records] of Object.entries(readStage(cfg, base, { crawl, only, log: say })))
+    if (cfg.sources.length) for (const [ns, records] of Object.entries(readStage(cfg, base, { crawl, only, log: say })))
         chain[`${owner}/${ns}`] = { records: records.map((r) => ({ ...r, cid: createHash("sha256").update(JSON.stringify(stable(r.payload))).digest("hex") })) };
+    // What members already pushed to the live namespaces, read from the chain (reads only, no gas),
+    // so a recipe is graded on contributed data too, not just on what the sources staged.
+    if (cfg.live) {
+        if (cfg.network) process.env.FANGORN_NETWORK = process.env.CHAIN_NAME = cfg.network;
+        const fangorn = await view.readOnlyFangorn();
+        fangorn.setAppId(cfg.app);
+        const statePath = join(base, ".ship/state.json");
+        const fromBlock = (existsSync(statePath) ? JSON.parse(readFileSync(statePath, "utf8")).fromBlock : null) ?? cfg.fromBlock;
+        const staged = new Set(cfg.sources.map((s) => s.namespace));
+        for (const t of await fangorn.appRepos(fromBlock == null ? {} : { fromBlock: BigInt(fromBlock) })) {
+            if (t.repo === "fangorn.schema" || staged.has(t.repo) || (only && !only.includes(t.repo))
+                || (cfg.live !== true && !cfg.live.includes(t.repo))) continue;
+            const { contents } = await fangorn.readRepo(t.owner, t.repo);
+            chain[`${t.owner.toLowerCase()}/${t.repo}`] = { records: contents.records };
+            say(`live ${t.owner}/${t.repo}: ${contents.records.length} records, from the chain`);
+        }
+    }
+    if (!Object.keys(chain).length) throw new Error("nothing to build: no sources staged anything and no member has pushed to a live namespace");
     rmSync(out, { recursive: true, force: true });
     mkdirSync(join(base, ".ship"), { recursive: true });
     const embed = view.cachedEmbed(join(base, ".ship/vectors.ndjson"));
-    const repos = [...new Set(cfg.sources.map((s) => s.namespace))].filter((n) => !only || only.includes(n));
+    const repos = presentedRepos(cfg).filter((n) => !only || only.includes(n));
     const report = await view.publishView({ fangorn: view.localFangorn(chain, { appId, owner }), app: cfg.app,
         schema: { types: cfg.types, relations: cfg.relations }, repos, out, embed, log: say });
     const rows = Object.values(report).reduce((n, r) => n + r.added, 0);
@@ -763,6 +807,10 @@ if (process.argv[1]?.endsWith("ship.js") || process.argv[1]?.endsWith("westmarch
         const dp = discovery({ name: "Q", description: "q" }, "https://q.example", null, { pass: "5000000", days: 30, call: "10000", decimals: 6 });
         if (dp.openapi.paths["/pass"].post["x-payment-info"].price.amount !== "5" || dp.x402.resources.join() !== "https://q.example/pass" || dp.openapi.paths["/paid"])
             throw new Error(`private discovery: ${JSON.stringify(dp.x402)}`);
+        const src = [{ namespace: "towns", command: ["py"] }];
+        if (presentedRepos({ sources: src }).join() !== "towns" || presentedRepos({ sources: src, live: ["readings", "towns"] }).join() !== "towns,readings"
+            || presentedRepos({ sources: src, live: true }).length || presentedRepos({ sources: [] }).length)
+            throw new Error("presentedRepos: sources plus live namespaces; [] (every repo) for live: true or no sources");
         if (units("0.01") !== "10000" || units("5") !== "5000000" || units("1.5", 2) !== "150") throw new Error("units");
         if (USDC["eip155:84532"].name !== "USDC" || USDC["eip155:8453"].name !== "USD Coin") throw new Error("USDC's EIP-712 name differs on Base Sepolia and Base");
         console.log("ship.js self-check ok — a source template fills per row, the Worker config binds its bucket, AI and cron, and the paid route is priced per id in /openapi.json and named in /.well-known/x402");

package/template/README.md

@@ -39,8 +39,9 @@ fangorn --app my-app push
 ```
 
 The view picks it up within 5 minutes at `<url>/view`. A source that crawls something
-on a schedule goes in `app.json` `sources`, and ships with `npx westmarch-ship app.json`;
-see westmarch's docs.
+on a schedule goes in `app.json` `sources`, and publishes with
+`npx westmarch-ship app.json --no-deploy` (the push to `main` deploys; without the flag it
+would deploy a second copy over this Worker). See westmarch's docs.
 
 ## Keep it good
 

package/template/package.json

@@ -6,7 +6,7 @@
     "deploy": "wrangler deploy"
   },
   "dependencies": {
-    "@fangorn-network/westmarch": "2026.10.22-dev",
+    "@fangorn-network/westmarch": "2026.10.27.1",
     "@huggingface/transformers": "^4.3.1",
     "wrangler": "^4.83.0"
   }