x402-trust-layer 5.1.0

package/dist/lib/marketplace.js

@@ -0,0 +1,127 @@
+function normalizeQuery(q) {
+    return q.toLowerCase().trim();
+}
+function matchesQuery(resource, query) {
+    const q = normalizeQuery(query);
+    const haystack = [resource.name, resource.description, ...(resource.tags ?? [])]
+        .filter(Boolean)
+        .join(" ")
+        .toLowerCase();
+    const terms = q.split(/\s+/).filter(Boolean);
+    if (terms.length === 0)
+        return true;
+    return terms.some((t) => haystack.includes(t));
+}
+function mapLabResource(r) {
+    return {
+        name: r.name,
+        description: r.description,
+        url: r.public_url,
+        priceUsdc: r.base_price_usdc,
+        network: "solana",
+    };
+}
+function mergeResources(body) {
+    const nested = body.data;
+    const fromData = Array.isArray(nested)
+        ? nested
+        : nested && typeof nested === "object"
+            ? nested.resources
+            : undefined;
+    const merged = [
+        ...(body.resources ?? []),
+        ...(fromData ?? []),
+        ...(body.strongResults ?? []),
+        ...(body.relatedResults ?? []),
+        ...(body.items ?? []),
+    ];
+    const seen = new Set();
+    return merged.filter((r) => {
+        if (!r.url || seen.has(r.url))
+            return false;
+        seen.add(r.url);
+        return true;
+    });
+}
+async function searchFacilitatorCatalog(query, options) {
+    const url = new URL("https://api.dexter.cash/api/facilitator/marketplace/resources");
+    url.searchParams.set("search", query);
+    url.searchParams.set("sort", "quality_score");
+    url.searchParams.set("limit", String(options.limit ?? 15));
+    if (options.verified !== false)
+        url.searchParams.set("verified", "true");
+    if (options.maxPriceUsdc != null) {
+        url.searchParams.set("maxPrice", String(options.maxPriceUsdc));
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 20_000);
+    const res = await fetch(url, {
+        headers: { accept: "application/json" },
+        signal: controller.signal,
+    });
+    clearTimeout(timer);
+    if (!res.ok) {
+        throw new Error(`facilitator catalog HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    return mergeResources(body);
+}
+async function searchLabCatalog(query, options) {
+    const url = new URL("https://api.dexter.cash/api/dexter-lab/resources/public");
+    url.searchParams.set("limit", String(Math.min(options.limit ?? 15, 50)));
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 20_000);
+    const res = await fetch(url, {
+        headers: { accept: "application/json" },
+        signal: controller.signal,
+    });
+    clearTimeout(timer);
+    if (!res.ok) {
+        throw new Error(`lab catalog HTTP ${res.status}`);
+    }
+    const body = (await res.json());
+    let list = (body.resources ?? []).map(mapLabResource);
+    list = list.filter((r) => matchesQuery({ name: r.name, description: r.description }, query));
+    if (options.maxPriceUsdc != null) {
+        list = list.filter((r) => (r.priceUsdc ?? 999) <= options.maxPriceUsdc);
+    }
+    return list.slice(0, options.limit ?? 15);
+}
+export async function searchMarketplace(query, options = {}) {
+    try {
+        const primary = await searchFacilitatorCatalog(query, options);
+        if (primary.length > 0)
+            return primary;
+    }
+    catch (err) {
+        console.warn(`[marketplace] facilitator catalog:`, err);
+    }
+    try {
+        return await searchLabCatalog(query, options);
+    }
+    catch (err) {
+        console.warn(`[marketplace] lab catalog fallback failed for "${query}":`, err);
+        return [];
+    }
+}
+export function pickBestResource(resources, preferNetwork, query) {
+    if (resources.length === 0)
+        return null;
+    const scored = resources
+        .map((r) => {
+        const quality = r.qualityScore ?? 50;
+        const price = r.priceUsdc ?? 1;
+        const latencyPenalty = (r.latencyP50Ms ?? 0) / 100_000;
+        const networkBoost = preferNetwork && r.network?.toLowerCase().includes(preferNetwork.toLowerCase()) ? 5 : 0;
+        const haystack = [r.name, r.description, r.url].filter(Boolean).join(" ").toLowerCase();
+        const q = (query ?? "").toLowerCase();
+        const wantsOracle = /eth|ethereum|oracle|price|usd|btc|bitcoin/.test(q);
+        const oracleBoost = wantsOracle && /mycelia|oracle\/price/.test(haystack) ? 12 : 0;
+        return {
+            r,
+            score: quality * 2 - price * 10 - latencyPenalty + networkBoost + oracleBoost,
+        };
+    })
+        .sort((a, b) => b.score - a.score);
+    return scored[0]?.r ?? null;
+}

package/dist/lib/migrations.d.ts

@@ -0,0 +1,2 @@
+import type { Database as SqliteDatabase } from "better-sqlite3";
+export declare function runMigrations(db: SqliteDatabase): void;

package/dist/lib/migrations.js

@@ -0,0 +1,130 @@
+const MIGRATIONS = [
+    {
+        version: 1,
+        sql: `
+      CREATE TABLE IF NOT EXISTS schema_version (version INTEGER PRIMARY KEY);
+    `,
+    },
+    {
+        version: 2,
+        sql: `
+      CREATE TABLE IF NOT EXISTS mandates (
+        mandate_id TEXT PRIMARY KEY,
+        principal TEXT NOT NULL,
+        agent_id TEXT NOT NULL,
+        intent TEXT NOT NULL,
+        intent_hash TEXT NOT NULL,
+        scope JSON NOT NULL,
+        signature TEXT NOT NULL,
+        issued_at TEXT NOT NULL,
+        expires_at INTEGER,
+        suite_version TEXT NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_mandates_agent ON mandates(agent_id);
+      CREATE INDEX IF NOT EXISTS idx_mandates_expires ON mandates(expires_at);
+    `,
+    },
+    {
+        version: 3,
+        sql: `
+      CREATE TABLE IF NOT EXISTS protocol_kv (
+        store TEXT NOT NULL,
+        key TEXT NOT NULL,
+        value JSON NOT NULL,
+        updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+        PRIMARY KEY (store, key)
+      );
+      CREATE INDEX IF NOT EXISTS idx_kv_store ON protocol_kv(store, updated_at);
+    `,
+    },
+    {
+        version: 4,
+        sql: `
+      CREATE TABLE IF NOT EXISTS idempotency_cache (
+        cache_key TEXT PRIMARY KEY,
+        status INTEGER NOT NULL,
+        body JSON NOT NULL,
+        body_hash TEXT NOT NULL,
+        route TEXT NOT NULL,
+        created_at INTEGER NOT NULL DEFAULT (unixepoch())
+      );
+      CREATE TABLE IF NOT EXISTS idempotency_inflight (
+        cache_key TEXT PRIMARY KEY,
+        created_at INTEGER NOT NULL DEFAULT (unixepoch())
+      );
+    `,
+    },
+    {
+        version: 5,
+        sql: `
+      CREATE TABLE IF NOT EXISTS webhook_subscriptions (
+        id TEXT PRIMARY KEY,
+        fleet_id TEXT NOT NULL,
+        url TEXT NOT NULL,
+        events JSON NOT NULL,
+        secret TEXT NOT NULL,
+        created_at TEXT NOT NULL,
+        active INTEGER NOT NULL DEFAULT 1
+      );
+      CREATE INDEX IF NOT EXISTS idx_webhooks_fleet ON webhook_subscriptions(fleet_id, active);
+    `,
+    },
+    {
+        version: 6,
+        sql: `
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_spend_tx_hash ON spend_ledger(tx_hash)
+        WHERE tx_hash IS NOT NULL;
+      CREATE INDEX IF NOT EXISTS idx_spend_wallet ON spend_ledger(wallet_address, day_key);
+    `,
+    },
+    {
+        version: 7,
+        sql: `
+      CREATE TABLE IF NOT EXISTS telemetry_counters (
+        name TEXT PRIMARY KEY,
+        value INTEGER NOT NULL DEFAULT 0,
+        updated_at INTEGER NOT NULL DEFAULT (unixepoch())
+      );
+    `,
+    },
+    {
+        version: 8,
+        sql: `
+      CREATE TABLE IF NOT EXISTS escrows (
+        escrow_id TEXT PRIMARY KEY,
+        payer_agent_id TEXT NOT NULL,
+        payee_id TEXT NOT NULL,
+        amount_usdc REAL NOT NULL,
+        state TEXT NOT NULL DEFAULT 'CREATED',
+        resource_hash TEXT,
+        session_id TEXT,
+        release_condition TEXT,
+        quality_score REAL,
+        created_at INTEGER NOT NULL DEFAULT (unixepoch()),
+        updated_at INTEGER NOT NULL DEFAULT (unixepoch()),
+        settled_at INTEGER,
+        state_proof TEXT NOT NULL,
+        metadata JSON
+      );
+      CREATE TABLE IF NOT EXISTS escrow_transitions (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        escrow_id TEXT NOT NULL,
+        from_state TEXT NOT NULL,
+        to_state TEXT NOT NULL,
+        note TEXT,
+        transitioned_at INTEGER NOT NULL DEFAULT (unixepoch()),
+        proof TEXT
+      );
+      CREATE INDEX IF NOT EXISTS idx_escrow_state ON escrows(state, updated_at);
+    `,
+    },
+];
+export function runMigrations(db) {
+    db.exec("CREATE TABLE IF NOT EXISTS schema_version (version INTEGER PRIMARY KEY)");
+    const row = db.prepare("SELECT MAX(version) AS v FROM schema_version").get();
+    const current = row?.v ?? 0;
+    for (const m of MIGRATIONS.filter((x) => x.version > current)) {
+        db.exec(m.sql);
+        db.prepare("INSERT INTO schema_version (version) VALUES (?)").run(m.version);
+    }
+}

package/dist/lib/nonce-store.d.ts

@@ -0,0 +1,6 @@
+/** Claim a nonce/idempotency key once (payment, protocol replay, idempotency). */
+export declare function claimNonceKey(rawKey: string, network?: string, ttlSec?: number): Promise<boolean>;
+export declare function isNonceKeyUsed(rawKey: string): boolean;
+export declare function extractIdempotencyKey(req: {
+    headers: Record<string, unknown>;
+}): string | undefined;

package/dist/lib/nonce-store.js

@@ -0,0 +1,109 @@
+import { db } from "./db.js";
+import { assertSafeOutboundUrl } from "./ssrf.js";
+const checkNonce = db.prepare("SELECT 1 AS ok FROM used_nonces WHERE nonce = ?");
+const insertNonce = db.prepare("INSERT OR IGNORE INTO used_nonces (nonce, network) VALUES (?, ?)");
+const cleanOld = db.prepare("DELETE FROM used_nonces WHERE used_at < ?");
+const REDIS_REST_URL = (process.env.UPSTASH_REDIS_REST_URL ?? "").trim();
+const REDIS_REST_TOKEN = (process.env.UPSTASH_REDIS_REST_TOKEN ?? "").trim();
+const REDIS_URL = (process.env.REDIS_URL ?? "").trim();
+let redisSetNx = null;
+let redisInit = null;
+async function ensureRedis() {
+    if (redisSetNx)
+        return true;
+    if (!REDIS_URL)
+        return false;
+    if (!redisInit) {
+        redisInit = (async () => {
+            try {
+                const mod = await import("redis");
+                const client = mod.createClient({ url: REDIS_URL });
+                client.on("error", (err) => console.warn("[nonce-store] redis:", err.message));
+                await client.connect();
+                redisSetNx = async (key, ttlSec) => {
+                    const r = await client.set(key, "1", { NX: true, EX: ttlSec });
+                    return r === "OK";
+                };
+            }
+            catch (err) {
+                console.warn("[nonce-store] REDIS_URL set but redis package unavailable — using SQLite only:", err instanceof Error ? err.message : err);
+            }
+        })();
+    }
+    await redisInit;
+    return !!redisSetNx;
+}
+async function redisRestSetNx(key, ttlSec) {
+    if (!REDIS_REST_URL || !REDIS_REST_TOKEN)
+        return false;
+    assertSafeOutboundUrl(REDIS_REST_URL);
+    if (!REDIS_REST_URL.startsWith("https://")) {
+        throw new Error("Redis REST must be HTTPS");
+    }
+    const res = await fetch(REDIS_REST_URL, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${REDIS_REST_TOKEN}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify(["SET", key, "1", "NX", "EX", String(ttlSec)]),
+    });
+    if (!res.ok)
+        return false;
+    const data = (await res.json());
+    return data.result === "OK";
+}
+function sqliteClaim(key, network) {
+    if (checkNonce.get(key))
+        return false;
+    insertNonce.run(key, network);
+    return true;
+}
+function maybeCleanSqlite() {
+    if (Math.random() < 0.02) {
+        cleanOld.run(Math.floor(Date.now() / 1000) - 86_400 * 7);
+    }
+}
+/** Claim a nonce/idempotency key once (payment, protocol replay, idempotency). */
+export async function claimNonceKey(rawKey, network = "unknown", ttlSec = 86_400 * 7) {
+    const key = rawKey.trim();
+    if (!key || key.length < 8)
+        return true;
+    const storeKey = key.length > 200 ? key.slice(0, 200) : key;
+    if (await ensureRedis()) {
+        const ok = await redisSetNx(`x402:nonce:${storeKey}`, ttlSec);
+        if (ok) {
+            sqliteClaim(storeKey, network);
+            return true;
+        }
+        return false;
+    }
+    if (REDIS_REST_URL && REDIS_REST_TOKEN) {
+        const ok = await redisRestSetNx(`x402:nonce:${storeKey}`, ttlSec);
+        if (ok) {
+            sqliteClaim(storeKey, network);
+            return true;
+        }
+        if (checkNonce.get(storeKey))
+            return false;
+        return false;
+    }
+    maybeCleanSqlite();
+    if (checkNonce.get(storeKey))
+        return false;
+    insertNonce.run(storeKey, network);
+    return true;
+}
+export function isNonceKeyUsed(rawKey) {
+    const key = rawKey.trim();
+    if (!key || key.length < 8)
+        return false;
+    const storeKey = key.length > 200 ? key.slice(0, 200) : key;
+    return !!checkNonce.get(storeKey);
+}
+export function extractIdempotencyKey(req) {
+    const raw = req.headers["idempotency-key"] ??
+        req.headers["x-idempotency-key"];
+    const v = Array.isArray(raw) ? raw[0] : raw;
+    return typeof v === "string" && v.trim().length >= 8 ? v.trim() : undefined;
+}

package/dist/lib/openapi-agentcash.d.ts

@@ -0,0 +1,5 @@
+export declare function buildAgentCashOpenApi(): Record<string, unknown>;
+/** AgentCash / x402scan 2026 spec v2 — per-resource accepts with micro-units. */
+export declare function buildWellKnownX402V2(): Record<string, unknown>;
+/** x402scan / AgentCash compatibility fan-out */
+export declare function buildWellKnownX402Resources(): Record<string, unknown>;

package/dist/lib/openapi-agentcash.js

@@ -0,0 +1,288 @@
+import { config } from "../config.js";
+import { SUITE_VERSION } from "./version.js";
+import { listEndpoints } from "../routes/catalog.js";
+import { pricing } from "../config.js";
+import { defaultOutputExample } from "./bazaar-extension.js";
+import { ENDPOINT_META } from "./openapi-meta.js";
+import { VERIFY_EXAMPLES } from "./verify-examples.js";
+const X402_PROTOCOLS = [{ x402: {} }];
+const MPP_SESSION_PROTOCOLS = [
+    { x402: {} },
+    { mpp: { method: "POST", intent: "session", currency: "0x20c000000000000000000000b9537d11c60e8b50" } },
+];
+const AGENT_GUIDANCE = `x402 Trust Layer — 58 paid agent payment infrastructure APIs on Base, Solana, and Polygon via Dexter facilitator.
+
+Typical flow:
+1. POST /api/guard/pre-x402 or POST /api/x402/proxy before any downstream x402 payment.
+2. POST /api/merchant-trust/score for Know-Your-Merchant preflight on unknown hosts.
+3. POST /api/mandate/compile for AP2-style signed intent; POST /api/mandate/diff + /api/mandate/verify before spend.
+4. POST /api/trust-network/buyer-gate when paying certified sellers; POST /api/merchant-trust/certify to join network.
+5. POST /api/quality-escrow/semantic-settle after delivery for auto-refund on bad responses.
+6. POST /api/payment-intent/compile or POST /api/pipeline/execute for multi-step orchestration.
+7. POST /api/mpp/session with action open|voucher|close for batch settlement savings.
+8. POST /api/attestation/issue then pass X-Suite-Attestation on partner calls.
+9. POST /api/receipt-auditor/verify after external settlements; POST /api/compliance/ledger for audit.
+
+Pay with x402 (USDC). Unpaid GET probes return 402; send Payment-Signature on POST for full JSON responses.
+
+Free (not in this catalog): GET /health — monitoring only, returns 200 without payment.`;
+function formatUsdAmount(priceStr) {
+    const n = Number(priceStr.replace(/^\$/, ""));
+    if (!Number.isFinite(n))
+        return "0.010000";
+    return n.toFixed(6);
+}
+function exampleToSchema(value) {
+    if (value === null)
+        return { type: "null" };
+    if (Array.isArray(value)) {
+        const items = value.length ? exampleToSchema(value[0]) : { type: "object" };
+        return { type: "array", items };
+    }
+    switch (typeof value) {
+        case "string":
+            return { type: "string" };
+        case "number":
+            return { type: "number" };
+        case "boolean":
+            return { type: "boolean" };
+        case "object": {
+            const obj = value;
+            const properties = {};
+            for (const [k, v] of Object.entries(obj)) {
+                properties[k] = exampleToSchema(v);
+            }
+            return {
+                type: "object",
+                properties,
+                required: Object.keys(obj),
+            };
+        }
+        default:
+            return { type: "string" };
+    }
+}
+function operationId(path, method) {
+    const slug = path.replace(/^\/api\//, "").replace(/\//g, "_").replace(/-/g, "_");
+    return `${method}_${slug}`;
+}
+function paymentProtocols(path) {
+    if (path === "/api/mpp/session" || path === "/api/mpp/session-plan") {
+        return MPP_SESSION_PROTOCOLS;
+    }
+    return X402_PROTOCOLS;
+}
+function paidResponseSchema() {
+    return {
+        type: "object",
+        description: "Successful response after x402 settlement",
+        properties: {
+            ok: { type: "boolean" },
+            allowed: { type: "boolean" },
+            summary: { type: "string" },
+            confidence: { type: "number" },
+            checks_passed: { type: "array", items: { type: "string" } },
+        },
+        additionalProperties: true,
+    };
+}
+function paid200Response(path) {
+    const example = defaultOutputExample(path);
+    return {
+        description: "Successful response after x402 settlement",
+        content: {
+            "application/json": {
+                schema: paidResponseSchema(),
+                example,
+            },
+        },
+    };
+}
+function paymentRequiredResponse() {
+    return {
+        description: "Payment Required (x402 v2). Unpaid requests must receive HTTP 402 with Payment-Required header and non-empty accepts.",
+        headers: {
+            "Payment-Required": {
+                description: "Base64-encoded x402 payment requirements (v2)",
+                schema: { type: "string" },
+            },
+        },
+    };
+}
+function buildOperation(path, method, priceDisplay, tier) {
+    const meta = ENDPOINT_META[path] ?? { summary: path, tags: ["x402"] };
+    const priceUsd = formatUsdAmount(priceDisplay);
+    const upper = method.toUpperCase();
+    const example = VERIFY_EXAMPLES[path];
+    const op = {
+        operationId: operationId(path, method),
+        summary: meta.summary,
+        description: `${meta.summary} — ${priceDisplay} USDC via x402 (Dexter facilitator ${config.facilitatorUrl}).`,
+        tags: [tier, ...(meta.tags ?? [])],
+        security: [{ x402: [] }],
+        "x-payment-info": {
+            price: { mode: "fixed", currency: "USD", amount: priceUsd },
+            protocols: paymentProtocols(path),
+        },
+        responses: {
+            "200": paid200Response(path),
+            "402": paymentRequiredResponse(),
+        },
+    };
+    if (upper === "GET") {
+        if (path === "/api/attestation/registry") {
+            op.parameters = [
+                { name: "minGrade", in: "query", schema: { type: "string" }, required: false },
+                { name: "agentId", in: "query", schema: { type: "string" }, required: false },
+                { name: "limit", in: "query", schema: { type: "integer" }, required: false },
+            ];
+            op.responses = {
+                "200": {
+                    description: "Registry records after payment",
+                    content: {
+                        "application/json": {
+                            schema: paidResponseSchema(),
+                            example: defaultOutputExample(path),
+                        },
+                    },
+                },
+                "402": paymentRequiredResponse(),
+            };
+        }
+    }
+    else if (example && typeof example === "object") {
+        op.requestBody = {
+            required: true,
+            content: {
+                "application/json": {
+                    schema: exampleToSchema(example),
+                    example,
+                },
+            },
+        };
+    }
+    else {
+        op.requestBody = {
+            required: true,
+            content: {
+                "application/json": {
+                    schema: { type: "object", additionalProperties: true },
+                },
+            },
+        };
+    }
+    return op;
+}
+export function buildAgentCashOpenApi() {
+    const base = config.publicBaseUrl.replace(/\/$/, "");
+    const paths = {};
+    for (const entry of listEndpoints()) {
+        const [method, route] = entry.path.split(" ");
+        const m = (method ?? "POST").toLowerCase();
+        if (!paths[route])
+            paths[route] = {};
+        paths[route][m] = buildOperation(route, m, entry.price, entry.tier);
+    }
+    const ownershipProofs = [config.payToEvm, config.payTo].filter((v) => typeof v === "string" && v.length > 0);
+    return {
+        openapi: "3.1.0",
+        components: {
+            securitySchemes: {
+                x402: {
+                    type: "apiKey",
+                    in: "header",
+                    name: "Payment-Signature",
+                    description: "x402 v2 payment payload (base64)",
+                },
+            },
+        },
+        info: {
+            title: "x402 Trust Layer",
+            version: SUITE_VERSION,
+            description: "36 paid x402 trust infrastructure APIs: guard, semantic escrow, mandate diff, certified seller network, KYM, mandates, compliance, disputes, and orchestration.",
+            "x-guidance": AGENT_GUIDANCE,
+        },
+        "x-discovery": {
+            ownershipProofs,
+            publicEndpoints: [`${base}/health`, `${base}/.well-known/x402`],
+            freeEndpoints: [
+                { path: "/health", method: "GET", purpose: "Monitoring — not in OpenAPI paths" },
+                {
+                    path: "/.well-known/x402",
+                    method: "GET",
+                    purpose: "Paid URL catalog — register /api/* from resources[]",
+                },
+            ],
+        },
+        "x-x402scan": {
+            discoveryMode: "openapi-first",
+            paidRouteCount: listEndpoints().length,
+            note: `OpenAPI lists ${listEndpoints().length} paid /api/* operations. Free routes documented under x-discovery.freeEndpoints.`,
+        },
+        servers: [{ url: config.publicBaseUrl }],
+        paths,
+    };
+}
+const BASE_USDC = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
+function priceToMicro(priceStr) {
+    const n = Number(priceStr.replace(/^\$/, ""));
+    if (!Number.isFinite(n) || n <= 0)
+        return "10000";
+    return String(Math.round(n * 1_000_000));
+}
+function endpointAccepts(priceLabel) {
+    const payTo = config.payToEvm || config.payTo;
+    return {
+        scheme: "exact",
+        network: "eip155:8453",
+        asset: { address: BASE_USDC, decimals: 6 },
+        maxAmountRequired: priceToMicro(priceLabel),
+        payTo,
+        extra: { name: "USDC on Base" },
+    };
+}
+/** AgentCash / x402scan 2026 spec v2 — per-resource accepts with micro-units. */
+export function buildWellKnownX402V2() {
+    const base = config.publicBaseUrl.replace(/\/$/, "");
+    const resources = listEndpoints()
+        .filter((e) => e.path.startsWith("POST "))
+        .map((e) => {
+        const [, route] = e.path.split(" ");
+        return {
+            url: `${base}${route}`,
+            method: "POST",
+            description: `${route} — ${e.tier} tier trust API`,
+            accepts: [endpointAccepts(e.price)],
+            tags: ["x402", "trust", e.tier],
+            "x-agent-hint": "Call before any external x402 payment when using guard or proxy flows",
+        };
+    });
+    return {
+        x402Version: 2,
+        protocolVersion: "2.14.0",
+        resources,
+        capabilities: ["guard", "mandate", "escrow", "attestation", "receipt-audit"],
+        pricing: {
+            preX402Guard: pricing.preX402Guard,
+            x402Proxy: pricing.x402Proxy,
+        },
+    };
+}
+/** x402scan / AgentCash compatibility fan-out */
+export function buildWellKnownX402Resources() {
+    const ownershipProofs = [config.payToEvm, config.payTo].filter((v) => typeof v === "string" && v.length > 0);
+    const base = config.publicBaseUrl.replace(/\/$/, "");
+    const resources = listEndpoints().map((e) => {
+        const [, route] = e.path.split(" ");
+        return `${base}${route}`;
+    });
+    return {
+        x402Version: 2,
+        protocolVersion: "2.14.0",
+        version: 1,
+        resources,
+        ownershipProofs,
+        instructions: "Free catalog endpoint (HTTP 200). Register paid resource URLs from resources[] — not this URL. Paid routes: POST with Payment-Signature; GET /api/* returns 402 when unpaid.",
+        v2: `${base}/.well-known/x402/v2`,
+    };
+}

package/dist/lib/openapi-meta.d.ts

@@ -0,0 +1,5 @@
+/** OpenAPI / Bazaar summaries per route */
+export declare const ENDPOINT_META: Record<string, {
+    summary: string;
+    tags: string[];
+}>;