@seedhape/x402-merchant-sdk 0.5.2 → 0.5.3

package/README.md

@@ -3,14 +3,18 @@
 ## One catalog for agent commerce
 
 Use `createMerchantCommerce` to define products once. The same product
-definitions can feed the SDK's current x402 paywall and future ACP/UCP/MPP
-adapters; merchants do not maintain protocol-specific catalogs.
+definitions feed the SDK's x402 paywall, ACP/UCP catalog previews, and MPP
+metadata; merchants do not maintain protocol-specific catalogs.
+
+Set `kind` to tell fulfillment-aware clients what the buyer receives:
+`api` (default), `digital_download`, `license`, or `subscription`. Payment
+selection remains independent of this value.
 
 ```ts
 const commerce = createMerchantCommerce({
   paywall: { payTo, ...base, facilitator: base.facilitator },
   products: [{
-    id: "weather", name: "Weather API", description: "Current weather",
+    id: "weather", kind: "api", name: "Weather API", description: "Current weather",
     endpoint: "/weather",
     price: { amount: 50_000n, ...base },
   }],
@@ -20,10 +24,290 @@ commerce.catalog();       // publish to your agent-facing catalog
 commerce.paywallFor("weather"); // pass to existing paywall middleware
 ```
 
+Each catalog entry includes `paymentMethods`, such as `['x402']` or
+`['x402', 'mpp']`, based on the server-side configuration. Agents can use
+that metadata to select a compatible route; merchants still define one
+product and keep all payment credentials on the server.
+
+The seller facade also exposes protocol-shaped discovery previews from the
+same fixed-price products:
+
+```ts
+const ucpProducts = seller.ucpCatalog("https://api.example.com");
+const acpCart = seller.acpCart(
+  [{ id: "weather", quantity: 1 }],
+  "https://api.example.com",
+);
+```
+
+These helpers serialize catalog and cart data only. For UCP HTTP discovery and
+checkout, use the fetch-compatible `seller.ucpHandler` below; ACP cart
+serialization remains host-owned and does not create a payment.
+
 The helper normalizes discovery metadata and product lookup. Fulfillment and
 refunds remain merchant-owned and should use the purchase ID as their durable
 idempotency key.
 
+### UCP REST adapter (preview)
+
+For the simplest UCP integration, mount the SDK's fetch-compatible handler at
+your public app origin. It serves the UCP profile, catalog search and lookup,
+and checkout-session endpoints from the same product list:
+
+```ts
+import { base, createSeedhapeSeller } from "@seedhape/x402-merchant-sdk";
+
+const seller = createSeedhapeSeller({
+  products: [{
+    id: "weather",
+    name: "Weather API",
+    description: "Current weather data",
+    endpoint: "/weather",
+    price: "0.50",
+    fulfill: async ({ request }) => fetch("https://api.example.com/weather", {
+      headers: { authorization: request.headers.get("authorization") ?? "" },
+    }),
+  }],
+  x402: {
+    payTo: process.env.MERCHANT_WALLET!,
+    network: base.network,
+    asset: base.asset,
+    decimals: base.decimals,
+    facilitator: base.facilitator,
+  },
+});
+
+const ucp = seller.ucpHandler({
+  origin: process.env.PUBLIC_ORIGIN!, // e.g. https://merchant.example
+  currency: "USD",
+});
+
+// Pass every request to `ucp(request)` from your framework route. The handler
+// recognizes /.well-known/ucp and /api/ucp/*.
+export const GET = ucp;
+export const POST = ucp;
+```
+
+Use a stable HTTPS `PUBLIC_ORIGIN`; agents use `/.well-known/ucp` to discover
+the service and send `UCP-Agent`, `Request-Id`, and (for checkout mutations)
+`Idempotency-Key` headers. Checkout completion accepts either an MPP credential
+or an x402 payment signature and reuses the seller's existing payment path.
+Keep wallet, Stripe, facilitator, and MPP secrets on the server. The preview
+adapter keeps checkout sessions in memory, so replace that session store with a
+durable database before running multiple production instances.
+
+### Fulfillment responses
+
+The SDK does not store merchant files or expose an unprotected download path.
+After payment, a merchant can return a signed URL, license, or webhook
+reference using the protocol-neutral helpers:
+
+```ts
+import { createDownloadDelivery, createSeedhapeSeller } from "@seedhape/x402-merchant-sdk";
+
+const seller = createSeedhapeSeller({
+  products: [{
+    id: "report",
+    name: "Research report",
+    description: "One PDF report",
+    endpoint: "/report",
+    price: "5.00",
+    fulfill: async ({ orderId }) => createDownloadDelivery({
+      downloadUrl: await issueShortLivedDownloadUrl(orderId),
+      filename: "research-report.pdf",
+      maxDownloads: 1,
+    }),
+  }],
+});
+```
+
+For a Seedhape-hosted download route, use a grant containing only opaque
+merchant identifiers. Keep the signing secret on the server and resolve the
+asset through private storage after verification:
+
+```ts
+import { createDownloadGrant, verifyDownloadGrant } from "@seedhape/x402-merchant-sdk";
+
+const { token } = await createDownloadGrant({
+  secret: process.env.DOWNLOAD_GRANT_SECRET!,
+  assetId: "asset_123",
+  orderId: "order_123",
+  productId: "report",
+  maxDownloads: 1,
+});
+
+// GET /downloads/:token
+const grant = await verifyDownloadGrant(token, process.env.DOWNLOAD_GRANT_SECRET!);
+// Look up grant.assetId in private storage, then stream the file.
+```
+
+For a small hosted route, `createDownloadHandler` supplies the HTTP boundary
+around that lookup. Use an atomic `consumeGrant` implementation when enforcing
+download limits:
+
+```ts
+const download = createDownloadHandler({
+  secret: process.env.DOWNLOAD_GRANT_SECRET!,
+  consumeGrant: (grant) => orders.consumeDownload(grant.orderId, grant.assetId),
+  resolveAsset: (grant) => storage.readPrivateAsset(grant.assetId),
+});
+```
+
+The handler rejects invalid or expired grants, limits methods to GET and HEAD,
+sets private download headers, and never exposes the storage key.
+
+For a small Node deployment, the SDK also includes a traversal-safe local file
+resolver:
+
+```ts
+const resolveAsset = createLocalDownloadResolver({
+  rootDir: "/srv/private-assets",
+  assets: {
+    report: {
+      relativePath: "reports/report.pdf",
+      filename: "research-report.pdf",
+      contentType: "application/pdf",
+    },
+  },
+});
+
+const download = createDownloadHandler({
+  secret: process.env.DOWNLOAD_GRANT_SECRET!,
+  resolveAsset,
+});
+```
+
+The resolver rejects absolute paths, `..` escapes, symlink escapes, and
+directories. Use an object-storage resolver with the same interface when the
+merchant needs a multi-instance deployment.
+
+For S3, R2, or another object store, resolve a short-lived presigned URL only
+after the grant is verified:
+
+```ts
+const resolveAsset = createRemoteDownloadResolver({
+  getAsset: async (grant) => ({
+    url: await storage.createPresignedGetUrl(grant.assetId),
+    filename: "research-report.pdf",
+    contentType: "application/pdf",
+  }),
+  maxBytes: 50_000_000,
+});
+
+const download = createDownloadHandler({
+  secret: process.env.DOWNLOAD_GRANT_SECRET!,
+  resolveAsset,
+});
+```
+
+The resolver validates HTTPS and outbound network policy, blocks redirects,
+enforces a response-size limit, and never returns the presigned URL to the
+buyer.
+
+Use `createFulfillmentRouter` to keep product delivery selection in one place:
+
+```ts
+const fulfill = createFulfillmentRouter({
+  api: ({ request }) => proxy(request as Request),
+  digital_download: ({ orderId }) => issueDownload(orderId),
+  license: ({ orderId }) => issueLicense(orderId),
+  subscription: ({ orderId }) => activateSubscription(orderId),
+});
+
+// Each product can use the same callback:
+const seller = createSeedhapeSeller({
+  products: products.map((product) => ({ ...product, fulfill })),
+  // payment configuration...
+});
+```
+
+### Paid API proxy
+
+Merchants can keep an API on their own infrastructure while exposing a
+Seedhape-controlled payment URL. Wrap the proxy in the seller fulfillment
+callback so payment is verified before the upstream request is made:
+
+```ts
+import { createApiProxyHandler, createSeedhapeSeller } from "@seedhape/x402-merchant-sdk";
+
+const proxy = createApiProxyHandler({
+  upstream: "https://api.merchant.example/v1/quote",
+  allowedHosts: ["api.merchant.example"],
+  upstreamHeaders: { authorization: `Bearer ${process.env.UPSTREAM_API_KEY!}` },
+});
+
+const seller = createSeedhapeSeller({
+  products: [{
+    id: "quote",
+    name: "Price quote",
+    description: "One quote request",
+    endpoint: "/quote",
+    price: "0.01",
+    fulfill: ({ request }) => proxy(request as Request),
+  }],
+  x402: { /* merchant wallet, Base USDC, and facilitator */ },
+});
+```
+
+The proxy only forwards a small request-header allowlist, adds merchant-owned
+upstream headers server-side, rejects non-HTTPS or non-allowlisted origins,
+blocks redirects, applies a timeout and response-size limit, and strips
+cookies and payment headers from the upstream request.
+
+### License and subscription fulfillment
+
+Use signed webhooks when the merchant owns a licensing or entitlement system:
+
+```ts
+await sendFulfillmentWebhook({
+  url: process.env.MERCHANT_FULFILLMENT_URL!,
+  secret: process.env.MERCHANT_FULFILLMENT_SECRET!,
+  event: {
+    id: `license_${orderId}`,
+    type: "license.issue",
+    orderId,
+    productId: "pro-plan",
+    paymentReference,
+  },
+});
+```
+
+Events include an idempotency key and an HMAC signature over the timestamp and
+request body. Supported event types cover license issuance/revocation and
+subscription activation, renewal, and cancellation. The receiving merchant
+system remains responsible for creating keys and changing entitlements.
+
+On the receiving side, verify the signature before parsing or applying the
+event:
+
+```ts
+const valid = verifyFulfillmentWebhookSignature({
+  secret: process.env.MERCHANT_FULFILLMENT_SECRET!,
+  timestamp: request.headers.get("x-seedhape-timestamp") ?? "",
+  signature: request.headers.get("x-seedhape-signature") ?? "",
+  body: await request.text(),
+});
+if (!valid) return new Response("Invalid webhook", { status: 401 });
+const event = parseFulfillmentWebhookEvent(body);
+// Deduplicate event.id, then issue or revoke the license.
+```
+
+Use `sendFulfillmentWebhookWithRetry` from a queue worker when the merchant
+endpoint may be temporarily unavailable. Every attempt reuses the same event
+ID, so the merchant can safely deduplicate it:
+
+```ts
+await sendFulfillmentWebhookWithRetry(input, {
+  attempts: 5,
+  baseDelayMs: 500,
+  maxDelayMs: 10_000,
+});
+```
+
+The URL must be an HTTPS URL controlled by the merchant and should be
+short-lived. Storage, file access, license issuance, retries, and revocation
+remain merchant-owned until a managed Seedhape fulfillment service is enabled.
+
 ## Unified seller facade (preview)
 
 `createSeedhapeSeller` is the single-drop-in entry point for a server-side
@@ -61,6 +345,29 @@ const seller = createSeedhapeSeller({
 app.all("/weather", seller.route("weather"));
 ```
 
+To enable signed agent evidence, pass `trust` with the merchant identity,
+controller resolver, and signature reader. The Express adapter validates the
+buyer's signed request before the x402/MPP handler can settle, then signs the
+bounded final fulfillment response. For non-empty request bodies, install a
+raw-body parser before the route so verification uses the transmitted bytes:
+
+```ts
+app.post(
+  "/weather",
+  express.raw({ type: "*/*", limit: "1mb" }),
+  seller.route("weather"),
+);
+```
+
+When TLS terminates at a trusted reverse proxy, configure Express `trust proxy`
+so the route reconstructs the same public HTTPS URL that the buyer signed.
+
+`express.raw` makes the exact body bytes available as `req.body`. JSON parsers
+must use their `verify` callback to preserve a `req.rawBody` copy. If the exact
+body is unavailable or exceeds the configured limit, the route returns 400
+before payment. The fetch adapter works directly with Hono's `app.all(path,
+c => seller.fetch("weather")(c.req.raw))` pattern.
+
 The facade preserves the existing x402 Bazaar discovery challenge. It selects
 Stripe MPP when a client advertises the MPP payment scheme and selects x402
 otherwise. ACP/UCP checkout remains a separate integration gate; it will
@@ -75,13 +382,39 @@ Add an x402 payment gate to an existing Express, Hono, or `node:http` service. T
 npm install @seedhape/x402-merchant-sdk
 ```
 
+## Start a merchant service
+
+Run the initializer in your service directory. It writes an Express paywall
+configuration, a product metadata file, and a private ES256 signing key:
+
+```bash
+npx @seedhape/x402-merchant-sdk init
+# Or pass the payout address and use the defaults for price, route, and name:
+npx @seedhape/x402-merchant-sdk init --pay-to 0xYourBaseWallet --price 0.05 --route /api/weather --name "Weather API"
+npm install @seedhape/x402-merchant-sdk express
+```
+
+Mount the generated middleware with `app.use(paywall)` and keep the generated
+`.seedhape/merchant-keys.json` file private. The initializer adds that key file
+to `.gitignore`. Set `PUBLIC_ORIGIN` to the service's HTTPS origin when issuing
+AP2 checkout tokens. Rotate and inspect public keys with:
+
+```bash
+npx @seedhape/x402-merchant-sdk keys:generate
+npx @seedhape/x402-merchant-sdk keys:rotate
+npx @seedhape/x402-merchant-sdk keys:jwks
+```
+
+`keys:rotate` activates a new ES256 key while retaining earlier public keys in
+the JWKS output so existing signed checkout tokens can still be verified.
+
 ## Stripe machine payments (MPP)
 
-Install the optional MPP runtime when you want agents to pay with Stripe cards
-or Shared Payment Tokens:
+Install the optional MPP runtime and Stripe server client when you want agents
+to pay with Stripe cards or Shared Payment Tokens:
 
 ```bash
-npm install mppx
+npm install mppx stripe
 ```
 
 Create one Stripe MPP paywall per seller endpoint. The seller keeps the Stripe
@@ -107,11 +440,41 @@ export async function weather(request: Request) {
 }
 ```
 
+For stablecoin MPP, create a Stripe client from the same merchant-owned key and
+provide the merchant’s Stripe-managed deposit address:
+
+```ts
+import Stripe from "stripe";
+import { createStripeMppPaywall } from "@seedhape/x402-merchant-sdk";
+
+const stripeClient = new Stripe(process.env.STRIPE_SECRET_KEY!);
+const mpp = await createStripeMppPaywall({
+  stripeSecretKey: process.env.STRIPE_SECRET_KEY!,
+  stripeClient,
+  profileId: process.env.STRIPE_PROFILE_ID!,
+  mppSecretKey: process.env.MPP_SECRET_KEY!,
+  amount: "0.50",
+  depositAddresses: { tempo: process.env.TEMPO_DEPOSIT_ADDRESS! },
+});
+```
+
 An unpaid agent receives HTTP `402`; a valid credential is verified and
 settled before the fulfillment callback runs. For a Stripe Connect direct
 charge, pass `connect: { stripeAccount: "acct_..." }`. To enable Stripe's
 stablecoin MPP rail as well, supply a Stripe SDK client and a test Tempo deposit
-address. Use `profile_test_...` and `sk_test_...` in a Stripe Sandbox.
+address. The adapter rejects a deposit address without that client and does not
+combine stablecoin deposits with a Connect direct charge. Use
+`profile_test_...` and `sk_test_...` in a Stripe Sandbox.
+
+### Stripe account ownership
+
+The SDK is designed for a merchant-owned Stripe account (Standard/direct mode):
+`stripeSecretKey` and `profileId` must belong to the same merchant account. Do
+not pass Seedhape's platform key or the web app's Express connected-account ID
+to an SDK integration. If a platform uses OAuth, give the SDK the merchant's
+OAuth access token in place of the secret key and leave `connect` unset. The
+`connect` option remains available for platform-managed direct charges, but it
+is separate from the default merchant-owned SDK setup.
 
 ## Express
 
@@ -162,7 +525,7 @@ app.use(expressPaywall(merchantConfig(baseSepolia, {
 })));
 ```
 
-`paymentMethods` defaults to `['eip3009']`, the broadly supported payment method. Set `['eip3009', 'erc7710']` to let the buyer/client choose both methods. Only advertise ERC-7710 when the configured facilitator supports it. If the methods use different facilitators, configure `facilitators: { eip3009: {...}, erc7710: {...} }`; the SDK selects the facilitator matching the buyer's selected method.
+`paymentMethods` defaults to `['eip3009']`, which every x402 facilitator settles. Add `'erc7710'` only when your facilitator settles ERC-7710 delegations (the MetaMask facilitator does, and `init` sets it up that way); buyers such as Seedhape prefer ERC-7710 whenever it is offered, so advertising it without a facilitator that settles it makes payments fail. If the methods use different facilitators, configure `facilitators: { eip3009: {...}, erc7710: {...} }`; the SDK selects the facilitator matching the buyer's selected method.
 
 ### Base and Solana on one route
 

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,180 @@
+#!/usr/bin/env node
+import { generateKeyPairSync, randomUUID } from "node:crypto";
+import { mkdir, open, readFile, rename, writeFile } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { dirname, resolve } from "node:path";
+const configPath = resolve(process.cwd(), "seedhape.config.json");
+const keyPath = resolve(process.cwd(), ".seedhape/merchant-keys.json");
+const USAGE = `Usage: x402-merchant-sdk <command>
+
+  init [--pay-to 0x…] [--price 0.05] [--route /api/weather] [--name "Weather API"]
+                  write seedhape.config.mjs and seedhape.config.json (reuses existing keys)
+  keys:generate   add a signing key (creates the key file if there is none)
+  keys:rotate     switch to a new signing key; old public keys stay in the JWKS
+  keys:jwks       print the public keys to serve at your JWKS URL`;
+function flag(args, name) {
+    const index = args.indexOf(name);
+    return index >= 0 ? args[index + 1] : undefined;
+}
+function createMerchantKey() {
+    const { privateKey, publicKey } = generateKeyPairSync("ec", { namedCurve: "P-256" });
+    const kid = randomUUID();
+    return {
+        kid,
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+        publicJwk: { ...publicKey.export({ format: "jwk" }), kid, alg: "ES256", use: "sig" },
+    };
+}
+async function saveKeyFile(file, exclusive = false) {
+    await mkdir(dirname(keyPath), { recursive: true, mode: 0o700 });
+    const temporaryPath = `${keyPath}.${process.pid}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    if (exclusive) {
+        try {
+            const target = await open(keyPath, "wx", 0o600);
+            try {
+                await target.writeFile(await readFile(temporaryPath));
+            }
+            finally {
+                await target.close();
+            }
+            const { unlink } = await import("node:fs/promises");
+            await unlink(temporaryPath);
+        }
+        catch (error) {
+            const { unlink } = await import("node:fs/promises");
+            await unlink(temporaryPath).catch(() => undefined);
+            throw error;
+        }
+    }
+    else {
+        await rename(temporaryPath, keyPath);
+    }
+}
+async function loadKeyFile() {
+    const value = JSON.parse(await readFile(keyPath, "utf8"));
+    if (!value.activeKid || !Array.isArray(value.keys) || !value.keys.some((key) => key.kid === value.activeKid)) {
+        throw new Error(`Invalid key file: ${keyPath}`);
+    }
+    return value;
+}
+async function init(args) {
+    const rl = createInterface({ input: stdin, output: stdout });
+    try {
+        const payTo = flag(args, "--pay-to") ?? (stdin.isTTY ? await rl.question("Base USDC payout address: ") : "");
+        if (!/^0x(?!0{40}$)[0-9a-fA-F]{40}$/.test(payTo.trim()))
+            throw new Error("Pass a valid --pay-to Ethereum address (or run init in a terminal to enter it).");
+        const price = flag(args, "--price") ?? ((stdin.isTTY ? await rl.question("Price in USDC [0.05]: ") : "") || "0.05");
+        if (!/^\d+(?:\.\d{1,6})?$/.test(price) || Number(price) <= 0)
+            throw new Error("--price must be a positive USDC amount with at most six decimals.");
+        const routePath = flag(args, "--route") ?? ((stdin.isTTY ? await rl.question("Paid route [/api/weather]: ") : "") || "/api/weather");
+        if (!routePath.startsWith("/") || routePath.startsWith("//"))
+            throw new Error("--route must be an application path starting with one slash.");
+        const name = flag(args, "--name") ?? ((stdin.isTTY ? await rl.question("Service name [Weather API]: ") : "") || "Weather API");
+        const configModulePath = resolve(process.cwd(), "seedhape.config.mjs");
+        const exists = async (path) => {
+            try {
+                await readFile(path);
+                return true;
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return false;
+                throw error;
+            }
+        };
+        const existingConfig = (await Promise.all([configPath, configModulePath].map(async (path) => (await exists(path)) ? path : null))).filter(Boolean);
+        if (existingConfig.length)
+            throw new Error(`Refusing to overwrite ${existingConfig.join(" and ")}.`);
+        // Reuse keys made earlier with keys:generate; create one only if there is none.
+        const createdKey = !(await exists(keyPath));
+        let key;
+        if (createdKey) {
+            key = createMerchantKey();
+            await saveKeyFile({ activeKid: key.kid, keys: [key] }, true);
+        }
+        else {
+            const file = await loadKeyFile();
+            key = file.keys.find((item) => item.kid === file.activeKid);
+            if (!key.privateKeyPem)
+                throw new Error(`The active key in ${keyPath} has no private key. Run keys:rotate.`);
+        }
+        const config = {
+            network: "eip155:8453",
+            asset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+            decimals: 6,
+            payTo: payTo.trim(),
+            price,
+            route: { path: routePath, name, description: `${name} paid API`, inputSchema: { type: "object", properties: {} } },
+            facilitatorUrl: "https://tx-sentinel-base-mainnet.api.cx.metamask.io/platform/v2/x402",
+            keyFile: ".seedhape/merchant-keys.json",
+        };
+        const moduleSource = `import { readFileSync } from "node:fs";\nimport { base, expressPaywall, merchantConfig } from "@seedhape/x402-merchant-sdk";\n\nconst merchant = JSON.parse(readFileSync(new URL("./seedhape.config.json", import.meta.url), "utf8"));\nconst keyFile = JSON.parse(readFileSync(new URL(merchant.keyFile, import.meta.url), "utf8"));\nconst activeKey = keyFile.keys.find((key) => key.kid === keyFile.activeKid);\nif (!activeKey?.privateKeyPem) throw new Error("No active Seedhape merchant key. Run keys:rotate.");\nif (!process.env.PUBLIC_ORIGIN) throw new Error("Set PUBLIC_ORIGIN to your service HTTPS origin.");\nconst toBaseUnits = (amount) => {\n  const [whole, fraction = ""] = String(amount).split(".");\n  return BigInt(whole) * 10n ** BigInt(base.decimals) + BigInt((fraction + "0".repeat(base.decimals)).slice(0, base.decimals));\n};\n\nexport const config = merchantConfig(base, {\n  payTo: merchant.payTo,\n  paymentMethods: ["eip3009", "erc7710"],\n  price: ({ path }) => path === merchant.route.path\n    ? { amount: toBaseUnits(merchant.price), ...base }\n    : null,\n  route: merchant.route,\n  facilitator: { url: process.env.FACILITATOR_URL ?? merchant.facilitatorUrl },\n  ap2: { issuer: process.env.PUBLIC_ORIGIN, privateKeyPem: activeKey.privateKeyPem, keyId: activeKey.kid },\n});\n\nexport const paywall = expressPaywall(config);\n`;
+        try {
+            await writeFile(configModulePath, moduleSource, { flag: "wx", mode: 0o644 });
+            await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, { flag: "wx", mode: 0o644 });
+        }
+        catch (error) {
+            const { unlink } = await import("node:fs/promises");
+            await unlink(configModulePath).catch(() => undefined);
+            if (createdKey)
+                await unlink(keyPath).catch(() => undefined);
+            throw error;
+        }
+        console.log(createdKey ? `Created ${configModulePath}, ${configPath}, and ${keyPath}.` : `Created ${configModulePath} and ${configPath}, using the existing keys in ${keyPath}.`);
+        console.log(`The active ES256 key is ${key.kid}. Keep ${keyPath} private and serve its public keys at your JWKS URL.`);
+        console.log("Install @seedhape/x402-merchant-sdk and express, mount the generated middleware with app.use(paywall), and set PUBLIC_ORIGIN before issuing AP2 checkout tokens.");
+    }
+    finally {
+        rl.close();
+    }
+}
+async function generateKey(rotate) {
+    let file;
+    try {
+        file = await loadKeyFile();
+    }
+    catch (error) {
+        if (!rotate && error.code === "ENOENT") {
+            const key = createMerchantKey();
+            await saveKeyFile({ activeKid: key.kid, keys: [key] }, true);
+            console.log(`Created ES256 key ${key.kid} in ${keyPath}.`);
+            return;
+        }
+        throw new Error(`Could not read ${keyPath}. Run init or keys:generate first.`, { cause: error });
+    }
+    const key = createMerchantKey();
+    file.keys = rotate
+        ? [...file.keys.map(({ kid, publicJwk }) => ({ kid, publicJwk })), key]
+        : [...file.keys, key];
+    if (rotate)
+        file.activeKid = key.kid;
+    await saveKeyFile(file);
+    console.log(`${rotate ? "Rotated to" : "Generated"} ES256 key ${key.kid}. Previous public keys remain in JWKS for validating existing tokens.`);
+}
+async function printJwks() {
+    const file = await loadKeyFile();
+    console.log(JSON.stringify({ keys: file.keys.map(({ publicJwk }) => publicJwk) }, null, 2));
+}
+async function main() {
+    const [command, ...args] = process.argv.slice(2);
+    if (!command || ["help", "--help", "-h"].includes(command)) {
+        console.log(USAGE);
+        return;
+    }
+    if (command === "init")
+        return init(args);
+    if (command === "keys:generate")
+        return generateKey(false);
+    if (command === "keys:rotate")
+        return generateKey(true);
+    if (command === "keys:jwks")
+        return printJwks();
+    throw new Error(`Unknown command "${command}".\n${USAGE}`);
+}
+main().catch((error) => {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAK7C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;AAEvE,MAAM,KAAK,GAAG;;;;;;kEAMoD,CAAC;AAEnE,SAAS,IAAI,CAAC,IAAc,EAAE,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO;QACL,GAAG;QACH,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7E,SAAS,EAAE,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;KACrF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAa,EAAE,SAAS,GAAG,KAAK;IACzD,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,GAAG,OAAO,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACtD,MAAM,SAAS,CAAC,aAAa,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;YAAC,CAAC;oBAAS,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAChG,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAY,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAc;IAChC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7G,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QAC5J,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC;QACpH,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACnJ,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,cAAc,CAAC,CAAC;QACrI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC9I,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,CAAC;QAC/H,MAAM,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,qBAAqB,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE;YACpC,IAAI,CAAC;gBAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YAAC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QACjJ,CAAC,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnJ,IAAI,cAAc,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrG,gFAAgF;QAChF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,IAAI,GAAgB,CAAC;QACrB,IAAI,UAAU,EAAE,CAAC;YACf,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAC1B,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;YACjC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,SAAS,CAAE,CAAC;YAC7D,IAAI,CAAC,GAAG,CAAC,aAAa;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,uCAAuC,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,aAAa;YACtB,KAAK,EAAE,4CAA4C;YACnD,QAAQ,EAAE,CAAC;YACX,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;YACnB,KAAK;YACL,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,IAAI,WAAW,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE;YAClH,cAAc,EAAE,sEAAsE;YACtF,OAAO,EAAE,8BAA8B;SACxC,CAAC;QACF,MAAM,YAAY,GAAG,q0CAAq0C,CAAC;QAC31C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,gBAAgB,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7E,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,IAAI,UAAU;gBAAE,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,gBAAgB,KAAK,UAAU,SAAS,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,gBAAgB,QAAQ,UAAU,gCAAgC,OAAO,GAAG,CAAC,CAAC;QAClL,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,CAAC,GAAG,UAAU,OAAO,sDAAsD,CAAC,CAAC;QACvH,OAAO,CAAC,GAAG,CAAC,kKAAkK,CAAC,CAAC;IAClL,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAAe;IACxC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;IAAC,CAAC;IACnC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,MAAM,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;YAChC,MAAM,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,GAAG,OAAO,OAAO,GAAG,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,oCAAoC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI,GAAG,MAAM;QAChB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC;QACvE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM;QAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC;IACrC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,cAAc,GAAG,CAAC,GAAG,uEAAuE,CAAC,CAAC;AAClJ,CAAC;AAED,KAAK,UAAU,SAAS;IACtB,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,eAAe;QAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,aAAa;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,SAAS,EAAE,CAAC;IAChD,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/commerce.d.ts

@@ -2,6 +2,7 @@ import type { Money, PaywallConfig, RouteMetadata } from "./middleware.js";
 /** A merchant's protocol-neutral, agent-readable product definition. */
 export interface MerchantProduct {
     id: string;
+    kind?: "api" | "digital_download" | "license" | "subscription";
     name: string;
     description: string;
     price: Money;
@@ -23,6 +24,7 @@ export interface MerchantCatalogProduct extends Omit<MerchantProduct, "price"> {
         decimals: number;
     };
     capabilities: readonly ["quote", "purchase", "receipt"];
+    paymentMethods: readonly ["x402"];
 }
 /**
  * One merchant integration surface for catalogs and paid routes. Protocol

package/dist/commerce.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commerce.d.ts","sourceRoot":"","sources":["../src/commerce.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3E,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC;IAC5E,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,YAAY,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;CACzD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB;eAKtD,sBAAsB,EAAE;gBAOvB,MAAM,GAAG,eAAe,GAAG,IAAI;mBAG5B,MAAM,GAAG,aAAa;EAWxC"}
+{"version":3,"file":"commerce.d.ts","sourceRoot":"","sources":["../src/commerce.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3E,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,KAAK,GAAG,kBAAkB,GAAG,SAAS,GAAG,cAAc,CAAC;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtC,QAAQ,EAAE,SAAS,eAAe,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,sBAAuB,SAAQ,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC;IAC5E,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,YAAY,EAAE,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;CACnC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,sBAAsB;eAKtD,sBAAsB,EAAE;gBAQvB,MAAM,GAAG,eAAe,GAAG,IAAI;mBAG5B,MAAM,GAAG,aAAa;EAWxC"}

package/dist/commerce.js

@@ -14,6 +14,7 @@ export function createMerchantCommerce(config) {
                 ...product,
                 price: { ...product.price, amount: product.price.amount.toString() },
                 capabilities: ["quote", "purchase", "receipt"],
+                paymentMethods: ["x402"],
             }));
         },
         product(id) {