@fangorn-network/westmarch 2026.10.29 → 2026.11.4-dev

package/src/publish/ship.js

@@ -3,7 +3,7 @@
 //
 //   westmarch-ship app.json [--no-crawl] [--no-deploy] [--dry-run]
 //   westmarch-ship app.json --local <out> [--crawl]     a view from staged records, no chain (see buildLocal)
-//   westmarch-ship app.json --register                  the app alone: claim, empty site, card bound
+//   westmarch-ship app.json --register                  the app alone: its repo, empty site, card bound
 //   westmarch-ship app.json --devnet [--only …]         the whole app on this machine (see devnetShip)
 //   westmarch-ship app.json --index                     the deployed app's indexer, once, here (see indexHere)
 //
@@ -12,17 +12,16 @@
 // (/mcp) and its site. Nothing is embedded here. Every step checks the chain (or
 // Cloudflare) first and only acts on a difference, so re-running is how you update.
 //
-//   1. claim the app (first run only; the claim block becomes the card's fromBlock).
-//      The claimer is the app's first member, so its own updates are accepted.
+//   1. the app's repo, `<your wallet> : app` (first run only; that block becomes the card's fromBlock)
 //   2. run each source, which crawls and publishes straight into the app
 //   3. the stock page, the card and _headers → .ship/site
 //   4. deploy the Worker: its R2 bucket, Workers AI, the cron, CONFIG (app.json's schema rides in it)
-//   5. register the ERC-8004 agent and bind the card, if the chain points elsewhere
+//   5. register the ERC-8004 agent and point the repo's @card at the card, if it points elsewhere
 //
 // The Worker picks up what 2 published on its next cron run (every few minutes),
 // so the view follows the chain with nobody running anything.
 //
-// --register is the fast path, run before there is any data: 1, 3, 4 and 5 binding the card
+// --register is the fast path, run before there is any data: 1, 3, 4 and 5 pointing at the card
 // without minting. The mint copies the card's skills into its IPFS registration file and is
 // never redone, so it waits for the first full ship, when the card lists what the app does.
 //
@@ -31,7 +30,7 @@
 // to app.json: the site, the Worker's config and a small state.json.
 
 import { spawn, spawnSync } from "node:child_process";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash } from "node:crypto";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { createRequire } from "node:module";
 import { dirname, join, relative, resolve } from "node:path";
@@ -39,35 +38,6 @@ import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
 const HERE = dirname(fileURLToPath(import.meta.url));
-// USDC per x402 network (CAIP-2): its address and EIP-712 domain, as each contract reports them.
-// They differ: Base Sepolia's is "USDC", Base's "USD Coin", and a payment signed under the wrong
-// one fails at the facilitator.
-const USDC = {
-    "eip155:84532": { asset: "0x036CbD53842c5426634e7929541eC2318f3dCF7e", name: "USDC", version: "2" },
-    "eip155:8453": { asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", name: "USD Coin", version: "2" },
-    "eip155:421614": { asset: "0x75faf114eafb1BDbe2F0316DF893fd58CE46AA4d", name: "USD Coin", version: "2" },
-    "eip155:42161": { asset: "0xaf88d065e77c8cC2239327C5EDb3A432268e5831", name: "USD Coin", version: "2" },
-};
-const X402_NETWORK = { "base-sepolia": "eip155:84532", base: "eip155:8453", "arbitrum-sepolia": "eip155:421614", arbitrum: "eip155:42161" };
-
-/** How a sale settles, from `paid` or `private` in app.json: the network (`network`, else the
- *  app's own), the token and its EIP-712 domain, the payee (`payTo`, else the owner) and the facilitator. */
-export function settlement(o, { network: own, owner }) {
-    const network = o.network ? X402_NETWORK[o.network] ?? o.network : own;
-    const usdc = o.asset ? {} : USDC[network];
-    if (!usdc) throw new Error(`network ${network}: no default USDC; set asset, tokenName and tokenVersion`);
-    const name = o.tokenName ?? usdc.name, version = o.tokenVersion ?? usdc.version;
-    if (!name || !version) throw new Error("asset needs tokenName and tokenVersion: its EIP-712 domain");
-    return { network, asset: o.asset ?? usdc.asset, name, version, decimals: o.decimals ?? 6, symbol: o.symbol ?? "USDC",
-             payTo: o.payTo ?? owner, facilitator: (o.facilitator ?? "https://facilitator.payai.network").replace(/\/$/, "") };
-}
-
-/** "0.01" → "10000": a decimal price in the token's base units. */
-export function units(price, decimals = 6) {
-    if (!/^\d+(\.\d+)?$/.test(String(price))) throw new Error(`price must be a decimal like "0.01", got ${price}`);
-    const [whole, frac = ""] = String(price).split(".");
-    return (BigInt(whole) * 10n ** BigInt(decimals) + BigInt((frac + "0".repeat(decimals)).slice(0, decimals) || "0")).toString();
-}
 const STOCK = join(HERE, "../../site/dist");
 const log = (s) => console.error(`[ship] ${s}`);
 
@@ -82,8 +52,8 @@ const log = (s) => console.error(`[ship] ${s}`);
 //             "pages": "pages",   // optional: the app's own files, copied over the stock page
 //                                 //   (pages/intro.html, a fragment, replaces the description on the front page)
 //             "nav": [{ "href": "coverage.html", "label": "Coverage" }],   // optional: header links to them
-//             "examples": ["…"],  // optional: questions to start from, on the front page (and a private app's gate)
-//             "plugin": {"marketplace": "owner/repo", "name": "…"},   // optional: its Claude Code plugin (hooks), offered by open-app
+//             "examples": ["…"],  // optional: questions to start from, on the front page
+//             "plugin": {"marketplace": "owner/repo", "name": "…"},   // optional: its Claude Code plugin (hooks), named in its card
 //             "skill": "skill/SKILL.md",   // optional: the app's agent skill, served at skill/<app>/SKILL.md and named
 //                                          //   in the card with its sha256; fangorn-index offers it to whoever opens the app
 //             "agent": "app/agent.js" },   // optional: the module whose registerAgent the card lists, when
@@ -94,33 +64,22 @@ const log = (s) => console.error(`[ship] ${s}`);
 //   "live": ["readings"],     // optional: namespaces members push to from their own wallets (devices,
 //                             //   contributors), presented beside the sources'; true = every repo they push.
 //                             //   Without sources the app already presents every member's repo.
-//   "network": "baseSepolia", // required: the SDK's network name. baseSepolia for a new app; an app
-//                             //   already claimed on arbitrumSepolia keeps it (a different name re-claims it there)
+//   "network": "baseSepolia", // required: the SDK's network name
+//   "owner": "0x…",           // the wallet that publishes the app's repo; only `westmarch build` (the
+//                             //   deploy button) needs it, westmarch-ship asks the CLI
 //   "fangorn": "fangorn",     // the CLI that signs; e.g. "node ~/fangorn/fangorn/lib/cli/cli.js",
 //                             //   or "env HOME=<dir> node …/cli.js" to sign with <dir>/.fangorn/config.json
-//   "paid": { "price": "0.01", "description": "…" }   // settles in USDC on the app's network, or "network": "base" / "eip155:8453"…
+//   "paid": true,             // optional: the app quotes its records' prices over x402
+//   "facilitator": "https://…" // with paid: the x402 facilitator its quotes settle through (Barliman)
 // }
 //
-// `paid` sells per-record keys over x402 v2 (site/worker.js), and the price goes in the card,
-// /openapi.json and /.well-known/x402. The payee is the app owner unless `paid.payTo` says
-// otherwise; the asset is USDC on `paid.network` unless `paid.asset` (with `tokenName` and
-// `tokenVersion`, its EIP-712 domain) does. PAID_SECRET is a Worker secret
-// (`wrangler secret put PAID_SECRET`), the same value the sources encrypt with.
-// The facilitator (PayAI unless `paid.facilitator`) lists POST /paid in its Bazaar on the first
-// sale; each ship says whether it has.
-//
-//   "private": { "pass": { "price": "5", "days": 30 }, "call": "0.01", "description": "…" }
-//
-// `private` makes the data itself the product. Each source stages its records (it needs an
-// --output-dir), ship seals every row whole (x402.js's sealRow) and commits them, so IPFS holds
-// only ciphertext; the Worker opens them in its cron with PAID_SECRET (made once in
-// .ship/secret, or $PAID_SECRET, and put to the Worker on every deploy) and serves the view and
-// the MCP tools only with a pass (POST /pass, x402) or one x402 payment per tool call. The card,
-// the catalog and `describe` stay free. Settles like `paid` (network, payTo, asset, facilitator).
+// An app sells nothing itself: publishers seal and price their own records (`fangorn commit
+// --paid body --price 0.01`), and the app presents them. With `paid`, the Worker answers
+// GET /paid/<record id> with an x402 402 built from the record's signed terms, paid through
+// Barliman (CONFIG.facilitator); the buyer then settles and gets the key from the key server.
 //
 // A source is any command that publishes into the repo `--namespace` names when given
-// `--publish`. It runs with FANGORN_APP_ID set, so it uploads through this app's storage
-// whatever the CLI's saved app is.
+// `--publish`.
 
 /** `{field}`, `{field|slug}` and `{field|lower}` from a row; an argv item that is exactly
  *  `{args...}` splices the row's own `args` array (for flags only some rows need). */
@@ -211,11 +170,10 @@ function run(cmd, args, { cwd, env, capture = false, dry = false, input } = {})
 const expand = (p) => p.replace(/^~(?=\/|$)/, homedir());
 const cliArgv = (cfg) => expandEnv(process.env.FANGORN_CLI ?? cfg.fangorn ?? "fangorn").split(/\s+/).filter(Boolean).map(expand);
 let CLI = ["fangorn"];
-const fangornCli = (app, args, opts = {}) => run(CLI[0], [...CLI.slice(1), "--app", app, ...args], { capture: true, ...opts });
+const fangornCli = (args, opts = {}) => run(CLI[0], [...CLI.slice(1), ...args], { capture: true, ...opts });
 
 /** The CLI must be the SDK version westmarch reads with. A different one signs against
- *  another deployment's contracts: its claim and commits land where nothing here looks,
- *  and every read says the app is unclaimed. (It happened: a global 2026.08.18-dev CLI
+ *  another deployment's contracts: its commits land where nothing here looks. (It happened: a global 2026.08.18-dev CLI
  *  claimed and published onto the previous registries.) */
 function assertSameDeployment(cli) {
     // "env HOME=… node cli.js": a CLI with its own config (another wallet); find the script past the env.
@@ -235,18 +193,6 @@ function assertSameDeployment(cli) {
         "they talk to different contracts. Point app.json's \"fangorn\" at a matching CLI.");
 }
 
-/** The block `appId` was claimed in, or undefined: the AppRegistered log, window by window. */
-export async function claimBlock(chain, FangornConfig, appId) {
-    const { parseAbiItem } = await import("viem");
-    const from = BigInt(FangornConfig.appRegistryFromBlock), to = await chain.getBlockNumber(), step = BigInt(FangornConfig.logWindow ?? 10000);
-    const event = parseAbiItem("event AppRegistered(bytes32 indexed app_id, address indexed owner)");
-    for (let a = from; a <= to; a += step) {
-        const [claimed] = await chain.getLogs({ address: FangornConfig.appRegistryContractAddress, event, args: { app_id: appId },
-                                                fromBlock: a, toBlock: a + step - 1n < to ? a + step - 1n : to });
-        if (claimed) return String(claimed.blockNumber);
-    }
-}
-
 /** The template's app.json as `app`'s: its name, its type tag `<app>.item.v1` and the Worker. */
 export const TEMPLATE_APP = "my-app";
 export function nameApp(cfg, app) {
@@ -261,37 +207,30 @@ export function nameApp(cfg, app) {
  * `westmarch build`: what Workers Builds runs under the deploy button. The site, with a card
  * that names ORIGIN for its own URL (the Worker fills it in), and CONFIG, into the app's own
  * wrangler.json, which `wrangler deploy` then ships with the bucket, AI and cron it declares.
- * No chain writes and no Cloudflare calls: the owner claims the app and registers its agent
+ * No chain writes and no Cloudflare calls: the owner makes the repo and registers its agent
  * from fangorn.network. While app.json still names the template's app, the app is the Worker's name.
- *
- * ponytail: free apps only; a paid or private one ships with westmarch-ship, which sets its secret.
  */
 export async function buildForDeploy(configPath, wranglerPath = join(dirname(resolve(configPath)), "wrangler.json")) {
     const w = JSON.parse(readFileSync(wranglerPath, "utf8"));
     let cfg = loadConfig(configPath);
     if (cfg.app === TEMPLATE_APP) cfg = nameApp(cfg, w.name);
-    if (cfg.paid || cfg.private) throw new Error(`${configPath}: a paid or private app ships with westmarch-ship`);
     if (!cfg.network) throw new Error(`${configPath}: "network" is required`);
+    if (!/^0x[0-9a-fA-F]{40}$/.test(cfg.owner ?? "")) throw new Error(`${configPath}: "owner" is required: the wallet that publishes the app's repo`);
     if (!w.r2_buckets?.[0]?.bucket_name?.includes(w.name))
         log(`the R2 bucket ${w.r2_buckets?.[0]?.bucket_name} doesn't name the Worker; two apps sharing one overwrite each other's view`);
 
     process.env.FANGORN_NETWORK = process.env.CHAIN_NAME = cfg.network;
-    const [{ createPublicClient, http }, view] = await Promise.all([import("viem"), import("./view.js")]);
+    const view = await import("./view.js");
     const FangornConfig = await view.network(cfg.network);
-    const fangorn = await view.readOnlyFangorn();
-    fangorn.setAppId(cfg.app);
-    if (/^0x0+$/.test(await fangorn.getAppRegistry().getAppOwner()))
-        throw new Error(`${cfg.app} is unclaimed: claim it at fangorn.network first${/[._]/.test(cfg.app) ? "" : `, or set "app" in app.json to the name you claimed`}`);
-    const chain = createPublicClient({ transport: http(FangornConfig.rpcUrl) });
-    const fromBlock = cfg.fromBlock != null ? String(cfg.fromBlock) : await claimBlock(chain, FangornConfig, fangorn.getAppId());
+    const fromBlock = String(cfg.fromBlock ?? FangornConfig.fromBlock);
 
     const base = dirname(resolve(configPath));
     const { site, writeCard } = await buildSite(cfg, base);
-    writeCard(view.ORIGIN, { fromBlock, repos: [] });
+    writeCard(view.ORIGIN, { owner: cfg.owner, fromBlock, repos: [] });
     const gateway = process.env.FANGORN_IPFS_GATEWAY;
     w.assets = { ...w.assets, directory: relative(dirname(resolve(wranglerPath)), site) };
     w.vars = { ...w.vars, CONFIG: { app: cfg.app, name: cfg.name, description: cfg.description, fromBlock, network: cfg.network,
-                                    schema: { types: cfg.types, relations: cfg.relations }, repos: [], paid: null, private: null },
+                                    schema: { types: cfg.types, relations: cfg.relations }, repos: [], paid: false },
                ...(gateway ? { IPFS_GATEWAY: gateway } : {}) };
     writeFileSync(wranglerPath, JSON.stringify(w, null, 1) + "\n");
     log(`built ${cfg.app} (fromBlock ${fromBlock}) into ${site}; wrangler deploy ships it`);
@@ -301,11 +240,11 @@ export async function buildForDeploy(configPath, wranglerPath = join(dirname(res
 
 export async function ship(configPath, { crawl = true, deploy = true, dry = false, replace = false, only = null, register = false } = {}) {
     const cfg = loadConfig(configPath);
-    // No sources is fine: the app then presents whatever its members commit (repos: [] = all of them).
-    if (!register && !Object.keys(cfg.types).length)
+    // No sources is fine: the app then presents every repo on chain (repos: [] = all of them), as the explorer does.
+    if (!register && cfg.sources.length && !Object.keys(cfg.types).length)
         throw new Error(`${configPath}: no types yet, so nothing to build; --register sets up the app alone`);
-    // No default: one that changed would claim every app that leaned on it again, elsewhere.
-    if (!cfg.network) throw new Error(`${configPath}: "network" is required: "baseSepolia" for a new app, or the network the app was claimed on (before 2026-10-20 the default was "arbitrumSepolia")`);
+    if (!cfg.network) throw new Error(`${configPath}: "network" is required, e.g. "baseSepolia"`);
+    if (cfg.paid && !cfg.facilitator) throw new Error(`${configPath}: "paid" needs "facilitator", the URL of the x402 facilitator (Barliman) its quotes settle through`);
     CLI = cliArgv(cfg);
     assertSameDeployment(CLI);
     const base = dirname(resolve(configPath));
@@ -314,45 +253,28 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     mkdirSync(dir, { recursive: true });
     const state = existsSync(statePath) ? JSON.parse(readFileSync(statePath, "utf8")) : {};
     const save = () => !dry && writeFileSync(statePath, JSON.stringify(state, null, 1));
-    // A private app's PAID_SECRET: $PAID_SECRET, else made once in .ship/secret. Losing it loses
-    // every sealed row, so it is never made again over one that exists.
-    const secretPath = join(dir, "secret");
-    const secret = () => {
-        if (process.env.PAID_SECRET) return process.env.PAID_SECRET;
-        if (!existsSync(secretPath)) writeFileSync(secretPath, randomBytes(32).toString("hex"), { mode: 0o600 });
-        return readFileSync(secretPath, "utf8").trim();
-    };
-
     // The SDK's network name: view.js reads with it, and the CLI and the sources spawned below sign on it.
     process.env.FANGORN_NETWORK = process.env.CHAIN_NAME = cfg.network;
     const [{ createPublicClient, http }, view] = await Promise.all([import("viem"), import("./view.js")]);
     const FangornConfig = await view.network(cfg.network);
     const fangorn = await view.readOnlyFangorn();
-    fangorn.setAppId(cfg.app);
-    const appId = fangorn.getAppId();
-    const registry = fangorn.getAppRegistry();
     const cf = cfg.site.account ? { CLOUDFLARE_ACCOUNT_ID: cfg.site.account } : {};
 
-    // 1. claim: pays the subscription (the app sponsors its members' storage) and makes the
-    // claimer the app's first member.
-    const me = (fangornCli(cfg.app, ["wallet"]).match(/Address:\s+(0x[0-9a-fA-F]{40})/) ?? [])[1]?.toLowerCase();
+    // 1. the app's repo: this wallet's `cfg.app`. Repo names are per publisher, so there is nothing to claim.
+    const me = (fangornCli(["wallet"]).match(/Address:\s+(0x[0-9a-fA-F]{40})/) ?? [])[1];
     if (!me) throw new Error("`fangorn wallet` shows no address; run `fangorn init`");
-    let owner = (await registry.getAppOwner()).toLowerCase();
     const chain = createPublicClient({ transport: http(FangornConfig.rpcUrl) });
-    if (/^0x0+$/.test(owner)) {
-        const block = await chain.getBlockNumber();
-        state.fromBlock = String(block);
-        log(`${cfg.app} is unclaimed; claiming it for ${me} (fromBlock ${block})`);
-        fangornCli(cfg.app, ["app", "claim"], { dry });
-        owner = me;
+    const repoDir = join(dir, "repo");
+    if (!(await fangorn.onChainTip(me, cfg.app))) {
+        // Its own records start now; an app presenting every repo (the explorer) reads from the deployment's start.
+        if (presentedRepos(cfg).length) state.fromBlock = String(await chain.getBlockNumber());
+        log(`creating the app's repo ${me}:${cfg.app}`);
+        mkdirSync(repoDir, { recursive: true });
+        fangornCli(["repo", "init", cfg.app], { cwd: repoDir, dry });
         save();
-    } else if (owner !== me) {
-        throw new Error(`${cfg.app} belongs to ${owner}, not this wallet (${me}); pick another name`);
     }
-    // Claimed elsewhere (fangorn.network, the CLI): the view starts at the claim, found once.
-    if (state.fromBlock == null && cfg.fromBlock == null) state.fromBlock = await claimBlock(chain, FangornConfig, appId);
-    state.fromBlock ??= String(cfg.fromBlock ?? FangornConfig.appRegistryFromBlock);
-    log(`app ${cfg.app} = ${appId}, owner ${owner}, fromBlock ${state.fromBlock}`);
+    state.fromBlock ??= String(cfg.fromBlock ?? FangornConfig.fromBlock);
+    log(`app ${me}:${cfg.app}, fromBlock ${state.fromBlock}`);
 
     // 2. sources: crawl + publish straight into the app. One source failing (a site that
     // blocks us, a feed that is down) keeps its last published data and does not stop the
@@ -360,12 +282,9 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     const failed = [];
     if (crawl && !register) for (const s of cfg.sources.filter((s) => !only || only.includes(s.namespace))) {
         const cwd = s.cwd ? resolve(base, s.cwd.replace(/^~/, homedir())) : base;
-        const paidArgs = cfg.paid && s.paid_dir ? ["--paid-dir", resolve(cwd, s.paid_dir)] : [];
         try {
-            if (cfg.private) await publishSealed(cfg, base, s, { secret: secret(), dry });
-            else run(s.command[0], [...s.command.slice(1), ...paidArgs, ...(replace ? ["--replace"] : []),
-                                    "--publish", "--namespace", s.namespace, "--fangorn-bin", CLI.join(" ")],
-                     { cwd, env: { FANGORN_APP_ID: cfg.app }, dry });
+            run(s.command[0], [...s.command.slice(1), ...(replace ? ["--replace"] : []),
+                               "--publish", "--namespace", s.namespace, "--fangorn-bin", CLI.join(" ")], { cwd, dry });
         } catch (e) {
             log(`✗ ${s.namespace}: ${e.message}; its last published records stay live`);
             failed.push(s.namespace);
@@ -378,26 +297,7 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
     // which is only known once it is deployed: the first deploy learns it and the card follows.
     let url = cfg.site.url?.replace(/\/$/, "") ?? state.url ?? null;
     const repos = presentedRepos(cfg);
-    // Paid records are in the committed rows already, encrypted (`paid_ct`: AES-256-GCM under
-    // HMAC-SHA256(PAID_SECRET, id), see x402.js). The Worker sells keys, never records, so the
-    // data a buyer pays for is on IPFS, committed, and in their hands before they pay.
-    const terms = (o) => settlement(o, { network: `eip155:${FangornConfig.caip2}`, owner });
-    const sale = (u) => {
-        if (!cfg.paid) return { paid: null, sale: null };
-        const T = terms(cfg.paid), price = units(cfg.paid.price, T.decimals), description = cfg.paid.description ?? "";
-        const paid = { url: `${u}/paid/{id}`, price, asset: T.asset, network: T.network, decimals: T.decimals, symbol: T.symbol, description };
-        return { paid, sale: { ...T, price, description } };
-    };
-    const access = (u) => {
-        const X = cfg.private;
-        if (!X) return { card: null, config: null };
-        if (!X.pass?.price || !X.call) throw new Error(`${configPath}: private needs pass.price and call, decimal prices like "5" and "0.01"`);
-        const T = terms(X), days = X.pass.days ?? 30, description = X.description ?? "";
-        const pass = { price: units(X.pass.price, T.decimals), seconds: Math.round(days * 86400) }, call = units(X.call, T.decimals);
-        return { card: { pass_url: `${u}/pass`, pass: pass.price, days, call, network: T.network, asset: T.asset, symbol: T.symbol, decimals: T.decimals, description },
-                 config: { ...T, pass, call, description } };
-    };
-    const writeSite = (u) => writeCard(u, { fromBlock: state.fromBlock, repos, paid: sale(u).paid, access: access(u).card });
+    const writeSite = (u) => writeCard(u, { owner: me, fromBlock: state.fromBlock, repos, paid: !!cfg.paid });
     writeSite(url ?? `https://${cfg.site.project}.workers.dev`);
 
     // 4. the Worker
@@ -406,7 +306,8 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
         writeFileSync(path, JSON.stringify(wranglerConfig({
             name: cfg.site.project, site, account: cfg.site.account, cron: cfg.site.cron, cpuMs: cfg.site.cpu_ms, url: cfg.site.url, ipfsGateway: view.ipfsGateway(),
             config: { app: cfg.app, name: cfg.name, description: cfg.description, fromBlock: state.fromBlock, network: cfg.network,
-                      schema: { types: cfg.types, relations: cfg.relations }, repos: register ? [] : repos, paid: sale(u).sale, private: access(u).config },
+                      schema: { types: cfg.types, relations: cfg.relations }, repos: register ? [] : repos, paid: !!cfg.paid,
+                      ...(cfg.facilitator ? { facilitator: cfg.facilitator } : {}) },
         }), null, 1));
         return path;
     };
@@ -426,22 +327,20 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
         }
         state.url = url;
         save();
-        if (cfg.private) run("npx", ["wrangler", "secret", "put", "PAID_SECRET", "--config", workerConfig(url)], { env: cf, capture: true, dry, input: secret() });
-        else if (cfg.paid) log("paid: set the key secret once with `npx wrangler secret put PAID_SECRET --config .ship/wrangler.json`");
     } else workerConfig(url ?? `https://${cfg.site.project}.workers.dev`);
 
-    // 5. ERC-8004 + the binding
+    // 5. ERC-8004 + the repo's @card
     const cardUrl = `${url}/.well-known/agent-card.json`;
-    const bound = await registry.appAgentUri(appId).catch(() => "");
+    const bound = (await fangorn.cardOf(me, cfg.app).catch(() => undefined)) ?? "";
     const mint = () => {
-        const out = dry ? "" : fangornCli(cfg.app, ["app", "agent", cardUrl]);
+        const out = dry ? "" : fangornCli(["card", cardUrl, "--repo", cfg.app]);
         state.agentId = (out.match(/Agent ID:\s+(\S+)/) ?? [])[1] ?? state.agentId;
         delete state.agentPending;
         save();
     };
     if (deploy && bound !== cardUrl && register) {
         log(`binding ${cardUrl} (on chain: ${bound || "nothing"}); the agent is minted on the first full ship`);
-        fangornCli(cfg.app, ["app", "agent", cardUrl, "--skip-register"], { dry });
+        fangornCli(["card", cardUrl, "--repo", cfg.app, "--skip-register"], { dry });
         state.agentPending = true;
         save();
     } else if (deploy && bound !== cardUrl) {
@@ -458,93 +357,11 @@ export async function ship(configPath, { crawl = true, deploy = true, dry = fals
         await indexHere(configPath).catch((e) => log(`✗ first index: ${e.message}; the cron will build it`));
     }
 
-    // The Bazaar: the facilitator lists POST /paid once it settles a sale (and decides to);
-    // nothing here can list it sooner, so ship only says where it stands.
-    if (deploy && (cfg.paid || cfg.private) && !dry) for (const [route, T] of [["paid", sale(url).sale], ["pass", access(url).config]]) {
-        if (!T) continue;
-        const listed = await fetch(`${T.facilitator}/discovery/resources?payTo=${T.payTo}`).then((r) => r.json())
-            .then((d) => (d.items ?? []).some((i) => i.resource === `${url}/${route}`), () => null);
-        log(listed ? `the Bazaar at ${T.facilitator} lists ${url}/${route}`
-            : listed === false ? `the Bazaar at ${T.facilitator} does not list ${url}/${route} yet: it is listed on its first sale`
-            : `could not read the Bazaar at ${T.facilitator}`);
-    }
-
     log(`done: ${url}  ·  card ${cardUrl}  ·  MCP ${url}/mcp  ·  the view fills on the Worker's next cron run`);
     if (failed.length) throw new Error(`deployed, but these sources failed and kept their old records: ${failed.join(", ")}`);
     return { url, cardUrl, agentId: state.agentId };
 }
 
-/** A private app's source: staged (it needs an --output-dir), every row sealed whole, and committed
- *  as a full snapshot. Unchanged rows seal to the same bytes, so the Worker embeds only what changed. */
-async function publishSealed(cfg, base, s, { secret, dry }) {
-    const { sealRow } = await import("../agent/x402.js");
-    const rows = readStage({ ...cfg, sources: [s] }, base, { crawl: true })[s.namespace];
-    const sdir = join(base, ".ship/sealed", s.namespace);
-    mkdirSync(sdir, { recursive: true });
-    const records = await Promise.all(rows.map(async (r) => ({ id: r.id, type: r.type, payload: await sealRow(secret, r.payload) })));
-    writeFileSync(join(sdir, "commit.json"), JSON.stringify({ records }));
-    log(`${s.namespace}: ${records.length} rows sealed`);
-    try { fangornCli(cfg.app, ["status"], { cwd: sdir, dry }); } catch { fangornCli(cfg.app, ["repo", "init", s.namespace], { cwd: sdir, dry }); }
-    fangornCli(cfg.app, ["commit", "commit.json", "-m", `${s.namespace}: ${records.length} rows, sealed`, "--replace"], { cwd: sdir, dry });
-    fangornCli(cfg.app, ["push"], { cwd: sdir, dry });
-}
-
-/** What x402scan reads (docs/DISCOVERY.md in Merit-Systems/x402scan): /openapi.json with
- *  `x-payment-info` on each paid route, and /.well-known/x402 naming them. POST /paid (keys to
- *  sealed records) and POST /pass (a private app's pass); not GET /paid/{id}, a template no probe
- *  can call. The worker's live 402 is authoritative over both. A private app's tools, paid per
- *  call over MCP, are listed in the Bazaar instead: x402scan reads HTTP routes only.
- *  ponytail: currency "USD" assumes the asset is USDC, the only default ship knows. */
-export function discovery(cfg, u, paid = null, access = null) {
-    const token = paid ?? access;
-    const usd = (n) => String(Number(n) / 10 ** (token.decimals ?? 6));
-    const ids = { type: "array", items: { type: "string" }, minItems: 1, maxItems: 1000 };
-    const sym = token.symbol ?? "USDC";
-    const paths = {};
-    if (paid) paths["/paid"] = { post: {
-        operationId: "buyKeys",
-        summary: `Keys to ${cfg.name}'s sealed records, ${usd(paid.price)} ${sym} each`,
-        description: `${paid.description ? `${paid.description}. ` : ""}Each record is in the app's rows already, sealed (paid_ct, `
-            + `AES-256-GCM, with paid_sha256 of the plaintext): this sells its key. Find records and their ids with the MCP server at ${u}/mcp; `
-            + `the agent card is ${u}/.well-known/agent-card.json.`,
-        requestBody: { required: true, content: { "application/json": { schema: { type: "object", required: ["ids"], properties: { ids } } } } },
-        responses: {
-            200: { description: "A hex key per id; ids it could not sell are in missing", content: { "application/json": { schema: { type: "object", properties: {
-                keys: { type: "object", additionalProperties: { type: "string" } }, missing: ids, receipts: { type: "array", items: { type: "object" } },
-                paid: { type: "array", items: { type: "string" } } } } } } },
-            402: { description: "Payment required: x402 v2, the PaymentRequired in the PAYMENT-REQUIRED header" },
-        },
-        "x-payment-info": { protocols: [{ x402: {} }], price: { mode: "dynamic", currency: "USD", min: usd(paid.price), max: usd(BigInt(paid.price) * 1000n) } },
-    } };
-    if (access) paths["/pass"] = { post: {
-        operationId: "buyPass",
-        summary: `A ${access.days}-day pass to ${cfg.name}, ${usd(access.pass)} ${sym}`,
-        description: `${access.description ? `${access.description}. ` : ""}Every tool of the MCP server at ${u}/mcp (search, get, similar, count, `
-            + `browse) and the view at ${u}/view, for ${access.days} days: send Authorization: Bearer <token>. Without a pass each tool call costs `
-            + `${usd(access.call)} ${sym} over x402's MCP transport.`,
-        responses: {
-            200: { description: "The pass", content: { "application/json": { schema: { type: "object", properties: {
-                token: { type: "string" }, expires: { type: "integer", description: "Unix seconds" }, use: { type: "string" } } } } } },
-            402: { description: "Payment required: x402 v2, the PaymentRequired in the PAYMENT-REQUIRED header" },
-        },
-        "x-payment-info": { protocols: [{ x402: {} }], price: { mode: "fixed", currency: "USD", amount: usd(access.pass) } },
-    } };
-    const guidance = access
-        ? `${cfg.name}'s data is private. describe on the MCP server at ${u}/mcp is free. Buy a pass (POST /pass, x402 v2) and send `
-          + `Authorization: Bearer <token> to ${u}/mcp, or pay each tool call over x402's MCP transport (_meta["x402/payment"]).`
-        : `Search ${cfg.name} with the MCP server at ${u}/mcp (free). A row with paid_ct is for sale: POST its id to /paid, `
-          + `pay the 402 (x402 v2), and open paid_ct with the key that comes back (AES-256-GCM, nonce first; check paid_sha256).`;
-    return {
-        openapi: {
-            openapi: "3.1.0",
-            info: { title: cfg.name, version: new Date().toISOString().slice(0, 10), description: cfg.description, "x-guidance": guidance },
-            servers: [{ url: u }],
-            paths,
-        },
-        x402: { version: 1, resources: Object.keys(paths).map((p) => `${u}${p}`) },
-    };
-}
-
 /** The stock page with the app's own files over it, in .ship/site; `writeCard(url, …)` adds the card for where it is served. */
 export async function buildSite(cfg, base) {
     if (!existsSync(join(STOCK, "index.html"))) throw new Error(`no stock page at ${STOCK}; run \`npx vite build\` in westmarch/site`);
@@ -569,27 +386,18 @@ export async function buildSite(cfg, base) {
     const { registerAgent } = await import(cfg.site.agent ? pathToFileURL(resolve(base, cfg.site.agent)).href : "../../site/agent.js");
     const tools = await card.captureTools(() => registerAgent({}));
     const config = await (await import("./view.js")).network(cfg.network);
-    const writeCard = (u, { fromBlock, repos, paid = null, access = null }) => {
+    const writeCard = (u, { owner, fromBlock, repos, paid = false }) => {
         const agentCard = card.agentCard({
             name: cfg.name, description: cfg.description, url: `${u}/`, version: new Date().toISOString().slice(0, 10), tools, tags: cfg.tags,
             // What is sold, as a skill tagged x402: ERC-8004 registration reads x402Support off the tags.
-            skills: [
-                ...(access ? [{ id: "pass", name: "Pass", tags: [...(cfg.tags ?? []), "x402"],
-                    description: `A ${access.days}-day pass to every tool and the view (POST ${u}/pass), or one x402 payment per tool call.` }] : []),
-                ...(paid ? [{ id: "keys", name: "Keys", tags: [...(cfg.tags ?? []), "x402"],
-                    description: `The keys to sealed records (POST ${u}/paid), per record.` }] : []),
-            ],
-            fangorn: { app: cfg.app, fromBlock, repos, views: [`${u}/view`], mcp: `${u}/mcp`, config, ...(paid ? { paid } : {}), ...(access ? { access } : {}),
+            skills: paid ? [{ id: "records", name: "Paid records", tags: [...(cfg.tags ?? []), "x402"],
+                description: `Records whose publishers sell fields (rows with a \`sale\`): GET ${u}/paid/{publisher}/{repo}/{id} quotes one over x402 (scheme "fangorn").` }] : [],
+            fangorn: { app: cfg.app, owner, fromBlock, repos, views: [`${u}/view`], mcp: `${u}/mcp`, config, ...(paid ? { paid: { url: `${u}/paid/{publisher}/{repo}/{id}` } } : {}),
                        ...(skill ? { skill: { url: `${u}/${skill.path}`, sha256: skill.sha256 } } : {}),
                        ...(cfg.site.plugin ? { plugin: cfg.site.plugin } : {}) },
         });
         mkdirSync(join(site, ".well-known"), { recursive: true });
         writeFileSync(join(site, ".well-known/agent-card.json"), JSON.stringify(agentCard, null, 1));
-        if (paid || access) {
-            const d = discovery(cfg, u, paid, access);
-            writeFileSync(join(site, "openapi.json"), JSON.stringify(d.openapi, null, 1));
-            writeFileSync(join(site, ".well-known/x402"), JSON.stringify(d.x402, null, 1));
-        }
         writeFileSync(join(site, "_headers"), "/.well-known/agent-card.json\n  Access-Control-Allow-Origin: *\n"
             + "/openapi.json\n  Access-Control-Allow-Origin: *\n"
             + "/.well-known/x402\n  Access-Control-Allow-Origin: *\n  Content-Type: application/json\n"
@@ -640,7 +448,7 @@ export function readStage(cfg, base, { crawl = false, only = null, log: say = lo
 }
 
 /**
- * The whole app on this machine (devnet.js): a local chain and IPFS, the app claimed there, what the sources staged published into it, and its Worker under
+ * The whole app on this machine (devnet.js): a local chain and IPFS, what the sources staged published there, and its Worker under
  * `wrangler dev` with a local R2 and an encoder on localhost (or Workers AI with ai=true).
  * Runs the indexer once, says where everything is, and stays up until interrupted.
  */
@@ -650,9 +458,11 @@ export async function devnetShip(configPath, { crawl = false, only = null, port
     const { devnet } = await import("./devnet.js");
     const staged = readStage(cfg, base, { crawl, only });
     const net = await devnet({ log });
-    const owner = await net.client(cfg.app);
-    await owner.getAppRegistry().registerApp();
-    // The claimer publishes the sources, as `fangorn` does in a ship.
+    // A paid app's services, as a deployment runs them: the key server publishers deposit with,
+    // and Barliman, which its quotes settle through.
+    const services = cfg.paid ? await Promise.all([net.keyServer(), net.relay()]).then(([keys, r]) => ({ keys, relay: r.url })) : null;
+    const owner = await net.client();
+    // The owner publishes the sources, as `fangorn` does in a ship.
     for (const [ns, records] of Object.entries(staged)) {
         if (!records.length) continue;
         await owner.initRepo(ns);
@@ -663,9 +473,10 @@ export async function devnetShip(configPath, { crawl = false, only = null, port
     const url = `http://127.0.0.1:${port}`;
     const repos = Object.keys(staged);
     const { site, writeCard } = await buildSite(cfg, base);
-    writeCard(url, { fromBlock: "0", repos });
+    writeCard(url, { owner: owner.getAddress(), fromBlock: "0", repos, paid: !!services });
     const wcfg = wranglerConfig({ name: cfg.site.project, site, config: { app: cfg.app, name: cfg.name, description: cfg.description,
-        fromBlock: "0", schema: { types: cfg.types, relations: cfg.relations }, repos, paid: null, deployment: net.deployment } });
+        fromBlock: "0", schema: { types: cfg.types, relations: cfg.relations }, repos, paid: !!services, deployment: net.deployment,
+        ...(services ? { facilitator: services.relay } : {}) } });
     // Its own R2 and state, apart from a deployed app's.
     wcfg.vars.RPC_URL = net.rpcUrl;
     wcfg.vars.IPFS_GATEWAY = net.gatewayUrl;
@@ -693,13 +504,15 @@ export async function devnetShip(configPath, { crawl = false, only = null, port
     log(`done: ${catalog?.domains?.length ?? 0} domains, ${(catalog?.domains ?? []).reduce((n, d) => n + d.count, 0)} rows`);
     log(`site ${url}  ·  MCP ${url}/mcp  ·  view ${url}/view  ·  reindex: curl '${url}/__scheduled'  ·  Ctrl-C stops it all`);
     log(`grade it: npx westmarch-eval ${url}/view --golden eval/golden.jsonl`);
+    // ponytail: the devnet's IPFS is in this process's memory, so records are sold from here (sealRecords),
+    // not from a separate `fangorn` CLI; scripts/e2e-paid.mjs does exactly that.
+    if (services) log(`paid: key server ${services.keys}  ·  Barliman ${services.relay}`);
     await new Promise((r) => wrangler.on("exit", r));
 }
 
 /**
  * The deployed app's indexer, run once on this machine: its Worker under `wrangler dev` with
- * the app's own R2 bucket and Workers AI (remote bindings), its CONFIG, and for a private app
- * its PAID_SECRET (in .ship/.dev.vars for the run, then removed). The first view right after a
+ * the app's own R2 bucket and Workers AI (remote bindings) and its CONFIG. The first view right after a
  * deploy, without waiting for the cron; and a catalog too big for one cron run's limits, since
  * nothing here is capped. Writes the same view the cron would.
  * ponytail: Workers AI still embeds; an encoder on this machine (EMBED_URL) would record another
@@ -713,11 +526,8 @@ export async function indexHere(configPath, { port = 8791 } = {}) {
     w.r2_buckets = w.r2_buckets.map((b) => ({ ...b, remote: true }));
     w.ai = { ...w.ai, remote: true };
     delete w.routes;
-    const wpath = join(dir, "wrangler.index.json"), vars = join(dir, ".dev.vars");
+    const wpath = join(dir, "wrangler.index.json");
     writeFileSync(wpath, JSON.stringify(w, null, 1));
-    const secret = process.env.PAID_SECRET ?? (existsSync(join(dir, "secret")) ? readFileSync(join(dir, "secret"), "utf8").trim() : null);
-    if (cfg.private && !secret) throw new Error("a private app's rows open only with its PAID_SECRET: none in $PAID_SECRET or .ship/secret");
-    if (secret) writeFileSync(vars, `PAID_SECRET=${secret}\n`, { mode: 0o600 });
     const url = `http://127.0.0.1:${port}`, start = Math.floor(Date.now() / 1000);
     const wrangler = spawn("npx", ["wrangler", "dev", "--config", wpath, "--port", String(port), "--ip", "127.0.0.1", "--test-scheduled"],
         { cwd: join(HERE, "../.."), stdio: ["ignore", "pipe", "inherit"],
@@ -744,7 +554,6 @@ export async function indexHere(configPath, { port = 8791 } = {}) {
         return catalog;
     } finally {
         wrangler.kill();
-        rmSync(vars, { force: true });
     }
 }
 
@@ -761,8 +570,8 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
     const base = dirname(resolve(configPath));
     const [{ env }, view] = await Promise.all([import("@huggingface/transformers"), import("./view.js")]);
     env.cacheDir = `${homedir()}/.cache/fangorn-mcp/models`;
-    // Not the app's real id or owner: nothing here is compared with the chain.
-    const appId = `0x${createHash("sha256").update(cfg.app).digest("hex")}`, owner = `0x${"10ca1".padStart(40, "0")}`;
+    // Not the app's real owner: nothing here is compared with the chain.
+    const owner = `0x${"10ca1".padStart(40, "0")}`;
     const chain = {};
     // Storage addresses a record by its content, and so does this.
     if (cfg.sources.length) for (const [ns, records] of Object.entries(readStage(cfg, base, { crawl, only, log: say })))
@@ -772,11 +581,10 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
     if (cfg.live) {
         if (cfg.network) process.env.FANGORN_NETWORK = process.env.CHAIN_NAME = cfg.network;
         const fangorn = await view.readOnlyFangorn();
-        fangorn.setAppId(cfg.app);
         const statePath = join(base, ".ship/state.json");
         const fromBlock = (existsSync(statePath) ? JSON.parse(readFileSync(statePath, "utf8")).fromBlock : null) ?? cfg.fromBlock;
         const staged = new Set(cfg.sources.map((s) => s.namespace));
-        for (const t of await fangorn.appRepos(fromBlock == null ? {} : { fromBlock: BigInt(fromBlock) })) {
+        for (const t of await fangorn.repos(fromBlock == null ? {} : { fromBlock: BigInt(fromBlock) })) {
             if (t.repo === "fangorn.schema" || staged.has(t.repo) || (only && !only.includes(t.repo))
                 || (cfg.live !== true && !cfg.live.includes(t.repo))) continue;
             const { contents } = await fangorn.readRepo(t.owner, t.repo);
@@ -784,12 +592,12 @@ export async function buildLocal(configPath, out, { crawl = false, only = null,
             say(`live ${t.owner}/${t.repo}: ${contents.records.length} records, from the chain`);
         }
     }
-    if (!Object.keys(chain).length) throw new Error("nothing to build: no sources staged anything and no member has pushed to a live namespace");
+    if (!Object.keys(chain).length) throw new Error("nothing to build: no sources staged anything and no publisher has pushed to a live namespace");
     rmSync(out, { recursive: true, force: true });
     mkdirSync(join(base, ".ship"), { recursive: true });
     const embed = view.cachedEmbed(join(base, ".ship/vectors.ndjson"));
     const repos = presentedRepos(cfg).filter((n) => !only || only.includes(n));
-    const report = await view.publishView({ fangorn: view.localFangorn(chain, { appId, owner }), app: cfg.app,
+    const report = await view.publishView({ fangorn: view.localFangorn(chain), app: cfg.app,
         schema: { types: cfg.types, relations: cfg.relations }, repos, out, embed, log: say });
     const rows = Object.values(report).reduce((n, r) => n + r.added, 0);
     say(`local view: ${out}  ·  ${rows} records, ${embed.misses} embedded, ${rows - embed.misses} from the vector cache`);
@@ -807,26 +615,17 @@ if (process.argv[1]?.endsWith("ship.js") || process.argv[1]?.endsWith("westmarch
         if (w.r2_buckets[0].bucket_name !== "quorum-view" || !w.ai || !w.triggers.crons.length || w.routes[0].pattern !== "quorum.example"
             || !w.compatibility_flags.includes("nodejs_compat") || !existsSync(w.main) || !existsSync(w.alias["@huggingface/transformers"]))
             throw new Error(`wrangler config: ${JSON.stringify(w)}`);
-        const d = discovery({ name: "Q", description: "q" }, "https://q.example", { price: "10000", decimals: 6, symbol: "USDC" });
-        const op = d.openapi.paths["/paid"].post;
-        if (op["x-payment-info"].price.min !== "0.01" || op["x-payment-info"].price.max !== "10" || !op.responses[402] || d.x402.resources[0] !== "https://q.example/paid")
-            throw new Error(`discovery: ${JSON.stringify(d)}`);
-        const dp = discovery({ name: "Q", description: "q" }, "https://q.example", null, { pass: "5000000", days: 30, call: "10000", decimals: 6 });
-        if (dp.openapi.paths["/pass"].post["x-payment-info"].price.amount !== "5" || dp.x402.resources.join() !== "https://q.example/pass" || dp.openapi.paths["/paid"])
-            throw new Error(`private discovery: ${JSON.stringify(dp.x402)}`);
         const src = [{ namespace: "towns", command: ["py"] }];
         if (presentedRepos({ sources: src }).join() !== "towns" || presentedRepos({ sources: src, live: ["readings", "towns"] }).join() !== "towns,readings"
             || presentedRepos({ sources: src, live: true }).length || presentedRepos({ sources: [] }).length)
             throw new Error("presentedRepos: sources plus live namespaces; [] (every repo) for live: true or no sources");
-        if (units("0.01") !== "10000" || units("5") !== "5000000" || units("1.5", 2) !== "150") throw new Error("units");
-        if (USDC["eip155:84532"].name !== "USDC" || USDC["eip155:8453"].name !== "USD Coin") throw new Error("USDC's EIP-712 name differs on Base Sepolia and Base");
-        console.log("ship.js self-check ok — a source template fills per row, the Worker config binds its bucket, AI and cron, and the paid route is priced per id in /openapi.json and named in /.well-known/x402");
+        console.log("ship.js self-check ok — a source template fills per row, the Worker config binds its bucket, AI and cron, and presentedRepos merges sources and live namespaces");
         process.exit(0);
     }
     const [path, ...flags] = process.argv.slice(2);
     if (!path || flags.includes("--help")) {
         console.error("usage: westmarch-ship app.json [--no-crawl] [--no-deploy] [--dry-run] [--replace] [--only ns1,ns2]\n" +
-                      "       westmarch-ship app.json --register [--dry-run]   (claim, empty site, card bound: no data)\n" +
+                      "       westmarch-ship app.json --register [--dry-run]   (the app's repo, empty site, card bound: no data)\n" +
                       "       westmarch-ship app.json --local <out> [--crawl] [--only ns1,ns2]   (no chain, no deploy)\n" +
                       "       westmarch-ship app.json --index   (the deployed app's indexer, once, on this machine)\n" +
                       "       westmarch-ship app.json --devnet [--crawl] [--only ns1,ns2] [--port 8787] [--ai]   (the whole app on this machine)");