warpmetal 0.8.8 → 0.8.9

package/README.md

@@ -156,11 +156,15 @@ receipt finality while provisioning or renewal proceeds.
 
 For an interactive initial purchase, `checkout challenge` may also return a
 short-lived `humanCheckout` object. Its `url` and `qrPayload` are the same
-`https://pay.x402api.com/c/...` bearer capability for the exact charge; encode
-that URL as the QR, never the WarpMetal recipient address. The buyer connects
-their own wallet and needs only the advertised USDC/USDT balance because
-x402api sponsors the native gas. This is an alternative to the agent-wallet
-workflow, not a second payment. After browser payment, run the exact
+`https://pay.x402api.com/c/...` bearer capability for the exact charge.
+Present the exact URL as a clickable x402api handoff. If a QR is useful for
+another device, encode only the identical `qrPayload` and explain that
+scanning opens the hosted checkout without authorizing payment. x402api owns
+any wallet selection or wallet-specific opening QR inside that page; never
+synthesize a wallet link or encode the WarpMetal recipient address. The buyer
+needs only the advertised USDC/USDT balance because x402api sponsors the native
+gas. This is an alternative to the agent-wallet workflow, not a second
+payment. After browser payment, run the exact
 `humanCheckout.afterPayment.argv` status command. When the ready result asks
 for `ask_human_for_notification_email`, ask the owner and add the optional
 lifecycle-notification address they provide. Autonomous purchases and renewals

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.8.8",
+  "version": "0.8.9",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -90,11 +90,14 @@ open either file.
 
 In an interactive initial purchase, the result may also contain
 `humanCheckout`. Offer it as an alternative to the local agent wallet. Show
-`humanCheckout.url` as clickable text and render only the identical
-`humanCheckout.qrPayload` URL as the purchase QR; never render the recipient
-address as this QR. The URL is an expiring bearer capability, so do not log,
-save, or send it anywhere except to the buyer who requested this purchase. If
-the buyer uses it, do not authorize or submit through the agent wallet. Run the
+`humanCheckout.url` as clickable x402api text. If another-device acquisition
+is useful, render only the identical `humanCheckout.qrPayload` URL as a QR and
+explain that scanning opens the hosted checkout without authorizing payment.
+x402api owns any wallet selection and wallet-specific opening QR inside that
+page; never synthesize a wallet link or render the recipient address as this
+QR. The URL is an expiring bearer capability, so do not log, save, or send it
+anywhere except to the buyer who requested this purchase. If the buyer uses it,
+do not authorize or submit through the agent wallet. Run the
 exact `humanCheckout.afterPayment.argv` command, wait for the server to become
 ready, then follow `ask_human_for_notification_email`: ask the owner for the
 optional lifecycle-notification address and add only the address they provide.

package/skills/warpmetal/references/cli-reference.md

@@ -75,8 +75,11 @@ workflow.
 For interactive initial purchases, the response may additionally include
 `humanCheckout.url`, the identical `qrPayload`, `expiresAt`, and an exact
 `afterPayment.argv` command. The URL is a short-lived bearer capability for the
-same charge, not a recipient address. If the buyer pays in the hosted checkout,
-do not submit an agent-wallet artifact; run the returned status command and,
+same charge, not a recipient address. Present the URL as a clickable x402api
+handoff. An optional QR contains that exact web link for another-device
+acquisition; scanning it does not authorize payment, and x402api owns any
+wallet-specific choices inside the hosted page. If the buyer pays there, do not
+submit an agent-wallet artifact; run the returned status command and,
 after ready, follow `ask_human_for_notification_email` to offer lifecycle
 notices. The CLI does not persist the hosted URL. Renewal commands never expose
 or use this interactive option.

package/skills/warpmetal/references/payments.md

@@ -125,9 +125,13 @@ argv arrays returned under `paymentWorkflow`:
 
 For an interactive initial purchase, an optional `humanCheckout` object offers
 a second presentation path for the same charge. Its `url` and `qrPayload` must
-be identical hosted-checkout URLs; render that URL as the QR and copyable link,
-never a recipient address. If the buyer completes this path, skip agent-wallet
-authorization and run `humanCheckout.afterPayment.argv`. Continue bounded
+be identical hosted-checkout URLs. Present `url` as the clickable x402api
+handoff. If a QR is useful for another device, render only the exact
+`qrPayload` and explain that scanning opens the checkout without authorizing
+payment. x402api owns wallet selection and any wallet-specific opening QR
+inside that page; never synthesize a wallet link or render a recipient address.
+If the buyer completes this path, skip agent-wallet authorization and run
+`humanCheckout.afterPayment.argv`. Continue bounded
 status polling until ready, then ask for the optional lifecycle-notification
 email when the result returns `ask_human_for_notification_email`. The hosted
 URL expires at `humanCheckout.expiresAt`, is not persisted by the CLI, and is

package/src/cli.js

@@ -887,7 +887,7 @@ async function handleCheckoutChallenge(client, store, options, context) {
     stringOption(options, "request-envelope-out"),
   );
   const directCheckoutInstructions = safe.humanCheckout
-    ? `\nDirect wallet checkout (optional, expires ${safe.humanCheckout.expiresAt}): ${safe.humanCheckout.url}\nEncode only that URL as the purchase QR. After payment, continue with: ${shellCommand(safe.humanCheckout.afterPayment.argv)}. When provisioning is ready, ask the owner for the optional lifecycle-notification email before adding it.`
+    ? `\nHosted human checkout (optional, expires ${safe.humanCheckout.expiresAt}): ${safe.humanCheckout.url}\nOpen this exact x402api link. If another-device acquisition is useful, encode only the returned QR URL; scanning opens the checkout and does not authorize payment. x402api owns wallet selection and explicit approval. After payment, continue with: ${shellCommand(safe.humanCheckout.afterPayment.argv)}. When provisioning is ready, ask the owner for the optional lifecycle-notification email before adding it.`
     : "";
   const paymentInstructions = safe.paymentWorkflow
     ? `\nWallet package: ${safe.paymentWorkflow.signerPackage.spec} (Node ${safe.paymentWorkflow.signerNodeRequirement})\nInstall: ${shellCommand(safe.paymentWorkflow.signerPackage.install.argv)}\nVerify: ${shellCommand(safe.paymentWorkflow.signerContract.probe.argv)}\n${walletWorkflowInstructions(safe.paymentWorkflow)}\nRequest envelope: ${safe.paymentWorkflow.requestEnvelopePath}\nAuthorize only after selecting/funding one wallet: ${shellCommand(safe.paymentWorkflow.authorize.argv)}\nSubmit with WarpMetal: ${shellCommand(safe.paymentWorkflow.submit.argv)}`