zk-agent-cli 0.1.0-rc.9 → 1.0.1

package/dist/index.js

@@ -8090,6 +8090,12 @@ function buildPaymentDashboardRecommendedCommand() {
 function buildPaymentFeedRecommendedCommand() {
   return "zk-agent payment feed";
 }
+function buildPaymentPublishRecommendedCommand() {
+  return "zk-agent payment publish";
+}
+function buildPaymentServeRecommendedCommand() {
+  return "zk-agent payment serve";
+}
 function buildPaymentApprovalRecommendedCommand(requestId) {
   return `zk-agent payment approval --request-id ${requestId}`;
 }
@@ -10393,7 +10399,7 @@ function buildSetupHelpText() {
     "  zk-agent next   -> canonical live routing contract",
     "",
     "Then stay on the default local-first path:",
-    "  zk-agent next",
+    "  zk-agent start",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
     `  ${buildTopLevelPayRecommendedCommand("main")}`,
@@ -11384,7 +11390,7 @@ function buildNextHelpText() {
     "",
     "Default first-run path:",
     "  zk-agent setup",
-    "  zk-agent next",
+    "  zk-agent start",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
     `  ${buildTopLevelPayRecommendedCommand("main")}`,
@@ -11454,7 +11460,7 @@ function buildStartHelpText() {
     "",
     "Shortest first proof:",
     "  zk-agent setup",
-    "  zk-agent next",
+    "  zk-agent start",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
     `  ${buildTopLevelPayRecommendedCommand("main")}`,
@@ -13263,6 +13269,8 @@ function createDefaultsCommand() {
 
 // src/commands/payment.ts
 import { randomBytes as randomBytes5 } from "node:crypto";
+import { mkdir as mkdir2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+import path7 from "node:path";
 import { Command as Command7 } from "commander";
 
 // ../agent-pay/src/lifecycle.ts
@@ -15180,6 +15188,117 @@ async function removeStoredPaymentRequest(requestId) {
   return deletePaymentRequest(requestId);
 }
 
+// src/lib/static-server.ts
+import { readFile as readFile2, stat } from "node:fs/promises";
+import { createServer } from "node:http";
+import path6 from "node:path";
+function writeBody(response, statusCode, contentType, value) {
+  response.statusCode = statusCode;
+  response.setHeader("Content-Type", contentType);
+  response.end(value);
+}
+function writeJson2(response, statusCode, value) {
+  writeBody(
+    response,
+    statusCode,
+    "application/json; charset=utf-8",
+    `${JSON.stringify(value, null, 2)}
+`
+  );
+}
+function contentTypeFor(filePath) {
+  switch (path6.extname(filePath).toLowerCase()) {
+    case ".html":
+      return "text/html; charset=utf-8";
+    case ".json":
+      return "application/json; charset=utf-8";
+    case ".js":
+      return "text/javascript; charset=utf-8";
+    case ".css":
+      return "text/css; charset=utf-8";
+    case ".svg":
+      return "image/svg+xml";
+    case ".txt":
+      return "text/plain; charset=utf-8";
+    default:
+      return "application/octet-stream";
+  }
+}
+function isSafeResolvedPath(rootDir, filePath) {
+  if (filePath === rootDir) return true;
+  const rootWithSeparator = rootDir.endsWith(path6.sep) ? rootDir : `${rootDir}${path6.sep}`;
+  return filePath.startsWith(rootWithSeparator);
+}
+async function startStaticServer(options) {
+  const rootDir = path6.resolve(options.rootDir);
+  const healthPath = options.healthPath?.trim() || "/health";
+  const server = createServer(async (request, response) => {
+    try {
+      const requestUrl = new URL(request.url || "/", "http://localhost");
+      const pathname = decodeURIComponent(requestUrl.pathname);
+      const method = request.method || "GET";
+      if (method === "OPTIONS") {
+        writeJson2(response, 204, {});
+        return;
+      }
+      if (method === "GET" && pathname === healthPath) {
+        writeJson2(response, 200, options.healthPayload ? options.healthPayload() : { ok: true });
+        return;
+      }
+      if (method !== "GET" && method !== "HEAD") {
+        writeJson2(response, 405, { error: `Unsupported static-server method: ${method}` });
+        return;
+      }
+      const relativePath = pathname === "/" ? "/index.html" : pathname;
+      const filePath = path6.resolve(rootDir, `.${relativePath}`);
+      if (!isSafeResolvedPath(rootDir, filePath)) {
+        writeJson2(response, 403, { error: "Forbidden path" });
+        return;
+      }
+      const fileStats = await stat(filePath).catch(() => null);
+      if (!fileStats?.isFile()) {
+        writeJson2(response, 404, { error: `Static file not found: ${pathname}` });
+        return;
+      }
+      const body = await readFile2(filePath);
+      response.statusCode = 200;
+      response.setHeader("Content-Type", contentTypeFor(filePath));
+      response.end(method === "HEAD" ? void 0 : body);
+    } catch (error) {
+      writeJson2(response, 500, {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+  });
+  const address = await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port, options.host, () => {
+      const bound = server.address();
+      if (!bound || typeof bound === "string") {
+        reject(new Error("Unable to resolve static server address."));
+        return;
+      }
+      resolve({
+        address: bound.address,
+        port: bound.port
+      });
+    });
+  });
+  return {
+    origin: `http://${address.address}:${address.port}`,
+    port: address.port,
+    close: async () => await new Promise((resolve, reject) => {
+      server.close((error) => {
+        if (error) {
+          reject(error);
+          return;
+        }
+        resolve();
+      });
+    })
+  };
+}
+
 // src/commands/payment.ts
 function parseMetadataEntries2(entries) {
   const metadata = {};
@@ -15566,15 +15685,435 @@ function paymentIntentLines(intent, inspectCommand, handoffCommand, partiesComma
 function buildAgentPayProductLayer(surface) {
   return {
     stage: "local-first-workbench",
-    publicShell: "submit -> next -> approval -> workspace -> handoff -> feed",
+    publicShell: "submit -> payment next -> approval -> workspace -> handoff -> feed",
     productClaim: "compact ingress, wallet-aware follow-up, one cross-request workspace, and stable exports",
     surfaceRole: surface === "workspace" ? "cross-request-workbench" : surface === "handoff" ? "single-request-export" : "cross-request-export",
     platformDirection: "handoff and feed are already shaped for external dashboards, agents, or backend ingestion",
     boundary: "local-first only today; not a hosted multi-tenant control plane"
   };
 }
+function buildAgentPayIntegrationLayer() {
+  return {
+    stage: "operator-controlled-export",
+    currentMode: "same-runtime, static export, or operator-controlled hosted preview",
+    currentProof: "stable workspace/feed/handoff JSON can already be published and served as a static bundle for external dashboards, agents, or backends from the same runtime or one operator-controlled host",
+    workbenchSurface: buildWorkspaceRecommendedCommand(),
+    singleRequestSurface: buildHandoffRecommendedCommand("<request-id>"),
+    batchSurface: buildFeedRecommendedCommand(),
+    publishSurface: buildPaymentPublishRecommendedCommand(),
+    serveSurface: buildPaymentServeRecommendedCommand(),
+    nextHostedStep: "prove the served static workspace/feed/handoff bundle behind one externally reachable operator URL before adding multi-tenant persistence",
+    boundary: "not yet a hosted multi-tenant control plane"
+  };
+}
+function sanitizePublishSegment(value) {
+  const normalized = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  return normalized || "all";
+}
+function defaultPaymentPublishDir(filters) {
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString().replace(/[:]/g, "-");
+  const walletSegment = sanitizePublishSegment(filters.walletName || "all-wallets");
+  const statusSegment = sanitizePublishSegment(filters.status || "all-statuses");
+  return path7.join(
+    storageDir(),
+    "exports",
+    "agent-pay",
+    `${generatedAt}-${walletSegment}-${statusSegment}`
+  );
+}
+function resolvePaymentPublishDir(dir, filters) {
+  const trimmed = dir?.trim();
+  return trimmed ? path7.resolve(trimmed) : defaultPaymentPublishDir(filters);
+}
+function resolvePaymentPublishPublicBaseUrl(value) {
+  return resolvePaymentAbsoluteHttpUrl(
+    value,
+    "--public-base-url",
+    "PAYMENT_PUBLISH_PUBLIC_BASE_URL_INVALID"
+  );
+}
+function resolvePaymentServePublicOrigin(value) {
+  return resolvePaymentAbsoluteHttpUrl(
+    value,
+    "--public-origin",
+    "PAYMENT_SERVE_PUBLIC_ORIGIN_INVALID"
+  );
+}
+function resolvePaymentAbsoluteHttpUrl(value, optionLabel, errorCode) {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  let parsed;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    throw new AgentError(
+      errorCode,
+      `Invalid ${optionLabel} value: ${value}. Use an absolute http(s) URL.`
+    );
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new AgentError(
+      errorCode,
+      `Invalid ${optionLabel} value: ${value}. Use an absolute http(s) URL.`
+    );
+  }
+  return parsed.href.replace(/\/+$/, "");
+}
+function paymentPublicOriginLooksLocal(origin) {
+  try {
+    const { hostname } = new URL(origin);
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "0.0.0.0" || hostname === "::1" || hostname === "[::1]";
+  } catch {
+    return false;
+  }
+}
+function resolvePaymentServePort(value) {
+  const parsed = Number.parseInt(value?.trim() || "4495", 10);
+  if (!Number.isInteger(parsed) || parsed < 0 || parsed > 65535) {
+    throw new AgentError(
+      "PAYMENT_SERVE_PORT_INVALID",
+      `Invalid payment serve port: ${value}. Use an integer between 0 and 65535.`
+    );
+  }
+  return parsed;
+}
+function buildPaymentPublishArtifactLink(relativePath, publicBaseUrl) {
+  const normalizedPath = relativePath.replace(/\\/g, "/");
+  return {
+    path: normalizedPath,
+    publicUrl: publicBaseUrl ? `${publicBaseUrl}/${normalizedPath}` : null
+  };
+}
+async function writePublishJsonFile(filePath, payload) {
+  await mkdir2(path7.dirname(filePath), { recursive: true, mode: 448 });
+  await writeFile2(filePath, `${JSON.stringify(payload, null, 2)}
+`, { mode: 384 });
+}
+async function writePublishTextFile(filePath, content) {
+  await mkdir2(path7.dirname(filePath), { recursive: true, mode: 448 });
+  await writeFile2(filePath, content, { mode: 384 });
+}
+function resolvePaymentPublishSelection(options) {
+  return {
+    walletName: options.wallet,
+    status: options.status ? resolvePaymentStatus(options.status) : void 0,
+    queueLimit: resolvePositiveInteger(options.queueLimit, "--queue-limit"),
+    walletLimit: resolvePositiveInteger(options.walletLimit, "--wallet-limit"),
+    recentActivityLimit: resolvePositiveInteger(options.activityLimit, "--activity-limit"),
+    feedLimit: resolvePositiveInteger(options.feedLimit, "--feed-limit")
+  };
+}
+async function loadPaymentPublishData(input) {
+  const workspaceResult = await buildStoredPaymentRequestsWorkspace({
+    walletName: input.walletName,
+    status: input.status,
+    queueLimit: input.queueLimit,
+    walletLimit: input.walletLimit,
+    recentActivityLimit: input.recentActivityLimit,
+    feedLimit: input.feedLimit
+  });
+  const requests = await listStoredPaymentRequests({
+    walletName: input.walletName,
+    status: input.status
+  });
+  const handoffResults = await Promise.all(
+    requests.map((record) => getStoredPaymentRequestHandoff(record.requestId))
+  );
+  return {
+    outputDir: resolvePaymentPublishDir(input.dir, workspaceResult.workspace.filters),
+    workspace: workspaceResult.workspace,
+    requests,
+    handoffResults
+  };
+}
+function buildPaymentPublishBundle(input) {
+  const workspaceRelativePath = "workspace.json";
+  const feedRelativePath = "feed.json";
+  const manifestRelativePath = "manifest.json";
+  const indexRelativePath = "index.html";
+  const handoffsRelativeDir = "handoffs";
+  const workspacePayload = buildPublishedWorkspacePayload(input.data.workspace);
+  const feedPayload = buildPublishedFeedPayload(input.data.workspace.feed);
+  const handoffPayloads = input.data.handoffResults.map((result) => {
+    const relativePath = `${handoffsRelativeDir}/${result.paymentRequest.requestId}.json`;
+    return {
+      requestId: result.paymentRequest.requestId,
+      status: result.paymentRequest.settlement.status,
+      relativePath,
+      payload: buildPublishedHandoffPayload(result)
+    };
+  });
+  const manifest = {
+    format: "zk-agent-payment-publish-manifest",
+    version: 1,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source: "local-first",
+    mode: "operator-controlled-static-export",
+    productLayer: buildAgentPayProductLayer("workspace"),
+    integrationLayer: buildAgentPayIntegrationLayer(),
+    filters: {
+      walletName: input.data.workspace.filters.walletName,
+      status: input.data.workspace.filters.status,
+      recentActivityLimit: input.data.workspace.filters.recentActivityLimit,
+      queueLimit: input.data.workspace.filters.queueLimit,
+      walletLimit: input.data.workspace.filters.walletLimit,
+      feedLimit: input.data.workspace.filters.feedLimit
+    },
+    summary: {
+      totalRequests: input.data.requests.length,
+      workspaceRequests: input.data.workspace.summary.totalRequests,
+      feedItems: input.data.workspace.feed.items.length,
+      queueItems: input.data.workspace.queue.items.length,
+      recentActivityCount: input.data.workspace.summary.recentActivityCount,
+      handoffCount: handoffPayloads.length
+    },
+    output: {
+      directory: input.data.outputDir,
+      publicBaseUrl: input.publicBaseUrl
+    },
+    entrypoints: {
+      index: buildPaymentPublishArtifactLink(indexRelativePath, input.publicBaseUrl),
+      manifest: buildPaymentPublishArtifactLink(manifestRelativePath, input.publicBaseUrl),
+      workspace: buildPaymentPublishArtifactLink(workspaceRelativePath, input.publicBaseUrl),
+      feed: buildPaymentPublishArtifactLink(feedRelativePath, input.publicBaseUrl),
+      handoffs: buildPaymentPublishArtifactLink(`${handoffsRelativeDir}/`, input.publicBaseUrl)
+    },
+    handoffs: handoffPayloads.map((entry) => ({
+      requestId: entry.requestId,
+      status: entry.status,
+      path: entry.relativePath,
+      publicUrl: buildPaymentPublishArtifactLink(entry.relativePath, input.publicBaseUrl).publicUrl
+    }))
+  };
+  return {
+    outputDir: input.data.outputDir,
+    publicBaseUrl: input.publicBaseUrl,
+    workspacePayload,
+    feedPayload,
+    handoffPayloads,
+    manifest
+  };
+}
+async function writePaymentPublishBundle(bundle) {
+  await mkdir2(bundle.outputDir, { recursive: true, mode: 448 });
+  await rm2(path7.join(bundle.outputDir, "handoffs"), { recursive: true, force: true });
+  await Promise.all([
+    writePublishJsonFile(path7.join(bundle.outputDir, "workspace.json"), bundle.workspacePayload),
+    writePublishJsonFile(path7.join(bundle.outputDir, "feed.json"), bundle.feedPayload),
+    writePublishJsonFile(path7.join(bundle.outputDir, "manifest.json"), bundle.manifest),
+    writePublishTextFile(
+      path7.join(bundle.outputDir, "index.html"),
+      buildPaymentPublishIndexHtml({
+        manifest: bundle.manifest,
+        workspaceLink: bundle.manifest.entrypoints.workspace,
+        feedLink: bundle.manifest.entrypoints.feed
+      })
+    ),
+    ...bundle.handoffPayloads.map(
+      (entry) => writePublishJsonFile(path7.join(bundle.outputDir, entry.relativePath), entry.payload)
+    )
+  ]);
+}
+function buildPaymentPublishPayload(bundle) {
+  return {
+    productLayer: bundle.manifest.productLayer,
+    integrationLayer: bundle.manifest.integrationLayer,
+    publish: {
+      format: "zk-agent-payment-publish",
+      version: 1,
+      generatedAt: bundle.manifest.generatedAt,
+      source: bundle.manifest.source,
+      mode: bundle.manifest.mode,
+      outputDir: bundle.outputDir,
+      publicBaseUrl: bundle.publicBaseUrl,
+      filters: bundle.manifest.filters,
+      summary: bundle.manifest.summary,
+      entrypoints: bundle.manifest.entrypoints
+    },
+    manifest: bundle.manifest
+  };
+}
+function buildPaymentServeRecommendedCommands(options) {
+  return {
+    serve: buildPaymentServeRecommendedCommand(),
+    publish: buildPaymentPublishRecommendedCommand(),
+    workspace: buildPaymentWorkspaceRecommendedCommand(),
+    handoff: buildPaymentHandoffRecommendedCommand("<request-id>"),
+    feed: buildPaymentFeedRecommendedCommand(),
+    ...options.publicOriginLooksLocal ? {
+      restartWithPublicOrigin: "zk-agent payment serve --public-origin https://pay.example.com"
+    } : {}
+  };
+}
+function buildPaymentServeNotes(options) {
+  if (!options.publicOriginLooksLocal) {
+    return [];
+  }
+  return [
+    options.publicOrigin.startsWith("http://127.0.0.1") || options.publicOrigin.startsWith("http://localhost") ? "Static bundle is still advertising a local bind origin. Set --public-origin to the externally reachable URL before using this as an externally hosted Agent Pay preview." : "Static bundle is still advertising a local-only public origin. Set --public-origin to the externally reachable URL before using this as an externally hosted Agent Pay preview."
+  ];
+}
+function buildPaymentPublishIndexHtml(input) {
+  const handoffItems = input.manifest.handoffs.length === 0 ? "<li>No handoff files were published for the current filter.</li>" : input.manifest.handoffs.slice(0, 20).map(
+    (entry) => `<li><a href="./${entry.path}">${entry.requestId}</a> <span>${entry.status}</span></li>`
+  ).join("\n");
+  const publicBaseUrl = input.manifest.output.publicBaseUrl ? `<p><strong>Public base URL:</strong> <code>${input.manifest.output.publicBaseUrl}</code></p>` : "";
+  return `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>zk-agent Agent Pay Publish Bundle</title>
+    <style>
+      :root {
+        color-scheme: light;
+        --bg: #f6f1e8;
+        --panel: #fffaf2;
+        --text: #1f2a22;
+        --muted: #5e675f;
+        --line: #d6c9b4;
+        --accent: #0d7a52;
+      }
+      body {
+        margin: 0;
+        font-family: "Iowan Old Style", "Palatino Linotype", "Book Antiqua", serif;
+        background:
+          radial-gradient(circle at top right, rgba(13, 122, 82, 0.08), transparent 28rem),
+          linear-gradient(180deg, #fcf8f1 0%, var(--bg) 100%);
+        color: var(--text);
+      }
+      main {
+        max-width: 960px;
+        margin: 0 auto;
+        padding: 48px 20px 72px;
+      }
+      section {
+        background: rgba(255, 250, 242, 0.92);
+        border: 1px solid var(--line);
+        border-radius: 20px;
+        padding: 24px;
+        margin-top: 20px;
+        box-shadow: 0 18px 40px rgba(52, 45, 29, 0.08);
+      }
+      h1, h2 {
+        margin: 0 0 12px;
+        font-weight: 600;
+      }
+      p, li {
+        line-height: 1.5;
+      }
+      ul {
+        padding-left: 20px;
+      }
+      a {
+        color: var(--accent);
+      }
+      code {
+        background: rgba(31, 42, 34, 0.06);
+        padding: 0.1rem 0.35rem;
+        border-radius: 0.35rem;
+      }
+      .meta {
+        color: var(--muted);
+      }
+      .grid {
+        display: grid;
+        gap: 12px;
+        grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+      }
+      .card {
+        border: 1px solid var(--line);
+        border-radius: 14px;
+        padding: 14px 16px;
+        background: rgba(255, 255, 255, 0.72);
+      }
+    </style>
+  </head>
+  <body>
+    <main>
+      <section>
+        <p class="meta">zk-agent Agent Pay static export</p>
+        <h1>Operator-controlled publish bundle</h1>
+        <p>This directory is the current static export proof for Agent Pay. It snapshots the stable <code>workspace</code>, <code>feed</code>, and per-request <code>handoff</code> contracts without claiming a hosted multi-tenant control plane.</p>
+        <p class="meta">Generated at ${input.manifest.generatedAt}</p>
+        ${publicBaseUrl}
+      </section>
+      <section>
+        <h2>Bundle summary</h2>
+        <div class="grid">
+          <div class="card"><strong>${input.manifest.summary.totalRequests}</strong><br />requests</div>
+          <div class="card"><strong>${input.manifest.summary.feedItems}</strong><br />feed items</div>
+          <div class="card"><strong>${input.manifest.summary.queueItems}</strong><br />queue items</div>
+          <div class="card"><strong>${input.manifest.summary.handoffCount}</strong><br />handoff files</div>
+        </div>
+      </section>
+      <section>
+        <h2>Entry points</h2>
+        <ul>
+          <li><a href="./manifest.json">manifest.json</a></li>
+          <li><a href="./${input.workspaceLink.path}">${input.workspaceLink.path}</a></li>
+          <li><a href="./${input.feedLink.path}">${input.feedLink.path}</a></li>
+        </ul>
+      </section>
+      <section>
+        <h2>Published handoffs</h2>
+        <ul>
+${handoffItems}
+        </ul>
+      </section>
+    </main>
+  </body>
+</html>
+`;
+}
+function paymentPublishLines(input) {
+  return [
+    ["mode", input.manifest.mode],
+    ["output dir", input.outputDir],
+    ["requests", String(input.manifest.summary.totalRequests)],
+    ["feed items", String(input.manifest.summary.feedItems)],
+    ["handoffs", String(input.manifest.summary.handoffCount)],
+    ["workspace", input.manifest.entrypoints.workspace.path],
+    ["feed", input.manifest.entrypoints.feed.path],
+    ["manifest", input.manifest.entrypoints.manifest.path],
+    ["index", input.manifest.entrypoints.index.path],
+    ["publish", buildPaymentPublishRecommendedCommand()],
+    ["serve", buildPaymentServeRecommendedCommand()],
+    ["workspace command", buildPaymentWorkspaceRecommendedCommand()],
+    ["feed command", buildPaymentFeedRecommendedCommand()]
+  ];
+}
+function paymentServeLines(input) {
+  return [
+    ["status", "payment-serving"],
+    ["origin", input.origin],
+    ["public origin", input.publicOrigin],
+    ["public origin source", input.publicOriginSource],
+    ["output dir", input.bundle.outputDir],
+    [
+      "workspace",
+      input.bundle.manifest.entrypoints.workspace.publicUrl || input.bundle.manifest.entrypoints.workspace.path
+    ],
+    [
+      "feed",
+      input.bundle.manifest.entrypoints.feed.publicUrl || input.bundle.manifest.entrypoints.feed.path
+    ],
+    [
+      "manifest",
+      input.bundle.manifest.entrypoints.manifest.publicUrl || input.bundle.manifest.entrypoints.manifest.path
+    ],
+    [
+      "index",
+      input.bundle.manifest.entrypoints.index.publicUrl || input.bundle.manifest.entrypoints.index.path
+    ],
+    ["health", `${input.origin}/health`],
+    ["publish", buildPaymentPublishRecommendedCommand()],
+    ["serve", buildPaymentServeRecommendedCommand()]
+  ];
+}
 function paymentHandoffLines(handoff, inspectCommand, partiesCommand, shareCommand, settlementCommand) {
   const productLayer = buildAgentPayProductLayer("handoff");
+  const integrationLayer = buildAgentPayIntegrationLayer();
   const lines = [
     ["request", handoff.requestId],
     ["product stage", productLayer.stage],
@@ -15582,6 +16121,15 @@ function paymentHandoffLines(handoff, inspectCommand, partiesCommand, shareComma
     ["surface role", productLayer.surfaceRole],
     ["platform direction", productLayer.platformDirection],
     ["boundary", productLayer.boundary],
+    ["integration stage", integrationLayer.stage],
+    ["integration mode", integrationLayer.currentMode],
+    ["integration proof", integrationLayer.currentProof],
+    [
+      "integration surfaces",
+      `${integrationLayer.workbenchSurface} -> ${integrationLayer.singleRequestSurface} -> ${integrationLayer.batchSurface}`
+    ],
+    ["hosted direction", integrationLayer.nextHostedStep],
+    ["integration boundary", integrationLayer.boundary],
     ["source", handoff.source],
     ["chain", `${handoff.chain} (${handoff.chainId})`],
     ["status", handoff.summary.settlementStatus],
@@ -15840,6 +16388,7 @@ function paymentIngressLines(input) {
 function paymentWorkspaceLines(workspace, workspaceCommand = buildDefaultPaymentWorkspaceCommand(), submitCommand = buildDefaultPaymentSubmitCommand(), approvalCommand = buildPaymentApprovalRecommendedCommand("<request-id>"), handoffCommand = buildPaymentHandoffRecommendedCommand("<request-id>"), feedCommand = buildPaymentFeedRecommendedCommand()) {
   const walletName = workspace.filters.walletName || "main";
   const productLayer = buildAgentPayProductLayer("workspace");
+  const integrationLayer = buildAgentPayIntegrationLayer();
   const lines = [
     ["surface", "cross-request Agent Pay workspace"],
     [
@@ -15852,6 +16401,15 @@ function paymentWorkspaceLines(workspace, workspaceCommand = buildDefaultPayment
     ["public shell", productLayer.publicShell],
     ["platform direction", productLayer.platformDirection],
     ["boundary", productLayer.boundary],
+    ["integration stage", integrationLayer.stage],
+    ["integration mode", integrationLayer.currentMode],
+    ["integration proof", integrationLayer.currentProof],
+    [
+      "integration surfaces",
+      `${integrationLayer.workbenchSurface} -> ${integrationLayer.singleRequestSurface} -> ${integrationLayer.batchSurface}`
+    ],
+    ["hosted direction", integrationLayer.nextHostedStep],
+    ["integration boundary", integrationLayer.boundary],
     ["generated", workspace.generatedAt],
     ["source", workspace.source],
     ["submit", submitCommand || buildPaymentSubmitRecommendedCommand(walletName)],
@@ -15916,6 +16474,72 @@ function buildDefaultPaymentWorkspaceCommand() {
 function buildDefaultPaymentSubmitCommand() {
   return buildPaymentSubmitRecommendedCommand();
 }
+function buildPublishedWorkspacePayload(workspace) {
+  const walletName = workspace.filters.walletName || "main";
+  return {
+    ok: true,
+    productLayer: buildAgentPayProductLayer("workspace"),
+    integrationLayer: buildAgentPayIntegrationLayer(),
+    workspace: {
+      ...workspace,
+      queue: {
+        ...workspace.queue,
+        items: workspace.queue.items.map((item) => ({
+          descriptor: item.descriptor,
+          executionPlan: buildPaymentExecutionPlanJson(item.executionPlan),
+          next: item.next
+        }))
+      }
+    },
+    recommendedCommands: {
+      workspace: buildPaymentWorkspaceRecommendedCommand(),
+      approval: buildPaymentApprovalRecommendedCommand("<request-id>"),
+      handoff: buildPaymentHandoffRecommendedCommand("<request-id>"),
+      feed: buildPaymentFeedRecommendedCommand(),
+      dashboard: buildPaymentDashboardRecommendedCommand(),
+      queue: buildPaymentQueueRecommendedCommand(),
+      report: buildPaymentReportRecommendedCommand(),
+      submit: buildPaymentSubmitRecommendedCommand(walletName),
+      next: buildPaymentNextRecommendedCommand("<request-id>"),
+      publish: buildPaymentPublishRecommendedCommand(),
+      serve: buildPaymentServeRecommendedCommand()
+    }
+  };
+}
+function buildPublishedFeedPayload(feed) {
+  const walletName = feed.filters.walletName || "main";
+  return {
+    ok: true,
+    productLayer: buildAgentPayProductLayer("feed"),
+    integrationLayer: buildAgentPayIntegrationLayer(),
+    feed,
+    recommendedCommands: {
+      workspace: buildPaymentWorkspaceRecommendedCommand(),
+      handoff: buildPaymentHandoffRecommendedCommand("<request-id>"),
+      feed: buildPaymentFeedRecommendedCommand(),
+      dashboard: buildPaymentDashboardRecommendedCommand(),
+      queue: buildPaymentQueueRecommendedCommand(),
+      report: buildPaymentReportRecommendedCommand(),
+      submit: buildPaymentSubmitRecommendedCommand(walletName),
+      publish: buildPaymentPublishRecommendedCommand(),
+      serve: buildPaymentServeRecommendedCommand()
+    }
+  };
+}
+function buildPublishedHandoffPayload(input) {
+  return {
+    ok: true,
+    requestId: input.paymentRequest.requestId,
+    productLayer: buildAgentPayProductLayer("handoff"),
+    integrationLayer: buildAgentPayIntegrationLayer(),
+    handoff: input.handoff,
+    recommendedCommands: {
+      ...buildPaymentRecommendedCommands(input.paymentRequest, input.executionPlan),
+      publish: buildPaymentPublishRecommendedCommand(),
+      serve: buildPaymentServeRecommendedCommand()
+    }
+  };
+}
 function buildWorkspaceSurfaceHelpText(options) {
   if (options.topLevel) {
     return [
@@ -15923,6 +16547,10 @@ function buildWorkspaceSurfaceHelpText(options) {
       "  Public workspace shortcut:",
       "    Use this when you already know the current question is the cross-request Agent Pay workbench.",
       "    This is the top-level shortcut for `zk-agent payment workspace`.",
+      "    Today this same workspace -> handoff -> feed chain already gives one operator-controlled external export path.",
+      "    `zk-agent payment publish` now materializes that same workspace/feed/handoff bundle as a hostable static export.",
+      "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+      "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL without claiming a multi-tenant control plane yet.",
       "    Stay on `suite` when the question is broader than the Agent Pay workbench.",
       "    Stay on `payment next`, `approval`, or `handoff` when the question is still one request lifecycle.",
       "",
@@ -15940,7 +16568,11 @@ function buildWorkspaceSurfaceHelpText(options) {
     "  Product workspace surface:",
     "    Use this when you need one cross-request Agent Pay workspace instead of stitching dashboard, queue, report, and feed together manually.",
     "    Public shortcut: zk-agent workspace.",
-    "    Shortest route into workspace: submit -> next -> approval -> workspace.",
+    "    Shortest route into workspace: submit -> payment next -> approval -> workspace.",
+    "    Today this same workspace -> handoff -> feed chain already gives one operator-controlled external export path.",
+    "    `zk-agent payment publish` now materializes that same workspace/feed/handoff bundle as a hostable static export.",
+    "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+    "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL without claiming a multi-tenant control plane yet.",
     "    Stay on `dashboard`, `queue`, `report`, or `feed` only when the workspace question has already narrowed to one slice.",
     "    Stay on `payment next`, `payment approval`, or `payment handoff` when the question is still one request lifecycle.",
     "",
@@ -15999,6 +16631,7 @@ function addWorkspaceSurfaceCommand(command, options) {
       {
         ok: true,
         productLayer: buildAgentPayProductLayer("workspace"),
+        integrationLayer: buildAgentPayIntegrationLayer(),
         workspace: {
           ...result.workspace,
           queue: {
@@ -16212,6 +16845,7 @@ function paymentDashboardLines(dashboard) {
 }
 function paymentFeedLines(feed, options = {}) {
   const productLayer = buildAgentPayProductLayer("feed");
+  const integrationLayer = buildAgentPayIntegrationLayer();
   const workspaceCommand = options.workspaceCommand ?? buildPaymentWorkspaceRecommendedCommand();
   const feedCommand = options.feedCommand ?? buildPaymentFeedRecommendedCommand();
   const lines = [
@@ -16220,6 +16854,15 @@ function paymentFeedLines(feed, options = {}) {
     ["surface role", productLayer.surfaceRole],
     ["platform direction", productLayer.platformDirection],
     ["boundary", productLayer.boundary],
+    ["integration stage", integrationLayer.stage],
+    ["integration mode", integrationLayer.currentMode],
+    ["integration proof", integrationLayer.currentProof],
+    [
+      "integration surfaces",
+      `${integrationLayer.workbenchSurface} -> ${integrationLayer.singleRequestSurface} -> ${integrationLayer.batchSurface}`
+    ],
+    ["hosted direction", integrationLayer.nextHostedStep],
+    ["integration boundary", integrationLayer.boundary],
     ["generated", feed.generatedAt],
     ["source", feed.source],
     ["requests", String(feed.summary.totalRequests)],
@@ -16263,6 +16906,10 @@ function buildFeedSurfaceHelpText(options) {
       "  Public feed shortcut:",
       "    Use this when the current question is already the integration-ready cross-request Agent Pay export.",
       "    This is the top-level shortcut for `zk-agent payment feed`.",
+      "    This already works as the current operator-controlled external export proof on the same runtime or host.",
+      "    `zk-agent payment publish` now snapshots the same feed/handoff bundle as a hostable static export.",
+      "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+      "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL before claiming a control plane.",
       "    Stay on `workspace` when you still need the broader cross-request Agent Pay workbench.",
       "    Stay on `handoff` when the current question is still one single-request export.",
       "",
@@ -16281,6 +16928,10 @@ function buildFeedSurfaceHelpText(options) {
     "  Integration-ready feed surface:",
     "    Use this when you need the stable cross-request Agent Pay batch export for dashboards, agents, or backend ingestion.",
     "    Public shortcut: zk-agent feed.",
+    "    This already works as the current operator-controlled external export proof on the same runtime or host.",
+    "    `zk-agent payment publish` now snapshots the same feed/handoff bundle as a hostable static export.",
+    "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+    "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL before claiming a control plane.",
     "    Stay on `payment workspace` when you still need the broader cross-request workbench first.",
     "    Stay on `payment handoff` when the current question is still one single-request export.",
     "",
@@ -16324,6 +16975,7 @@ function addFeedSurfaceCommand(command, options) {
       {
         ok: true,
         productLayer: buildAgentPayProductLayer("feed"),
+        integrationLayer: buildAgentPayIntegrationLayer(),
         feed: result.feed,
         recommendedCommands: {
           workspace: workspaceCommand,
@@ -16367,6 +17019,10 @@ function buildHandoffSurfaceHelpText(options) {
       "  Public handoff shortcut:",
       "    Use this when the current question is already the stable single-request Agent Pay export.",
       "    This is the top-level shortcut for `zk-agent payment handoff`.",
+      "    This is already the single-request export proof for the current operator-controlled hosted direction.",
+      "    `zk-agent payment publish` now snapshots this handoff alongside workspace/feed as a hostable static export bundle.",
+      "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+      "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL before claiming a control plane.",
       "    Stay on `workspace` when you still need the broader cross-request Agent Pay workbench.",
       "    Stay on `feed` when the current question has already widened to the cross-request batch export.",
       "",
@@ -16385,6 +17041,10 @@ function buildHandoffSurfaceHelpText(options) {
     "  Integration-ready handoff surface:",
     "    Use this when you need one stable local-first Agent Pay export bundle for an external dashboard, agent, or backend.",
     "    Public shortcut: zk-agent handoff.",
+    "    This is already the single-request export proof for the current operator-controlled hosted direction.",
+    "    `zk-agent payment publish` now snapshots this handoff alongside workspace/feed as a hostable static export bundle.",
+    "    `zk-agent payment serve` now turns that same bundle into the current operator-controlled hosted preview.",
+    "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL before claiming a control plane.",
     "    Stay on `payment inspect` when you still need the broader single-request aggregate view.",
     "    Stay on `payment share` or `payment parties` when the question has already narrowed to one projection.",
     "",
@@ -16412,6 +17072,7 @@ async function executePaymentHandoffSurface(requestId, topLevel) {
       ok: true,
       requestId: result.paymentRequest.requestId,
       productLayer: buildAgentPayProductLayer("handoff"),
+      integrationLayer: buildAgentPayIntegrationLayer(),
       handoff: result.handoff,
       recommendedCommands: buildPaymentRecommendedCommands(
         result.paymentRequest,
@@ -16720,7 +17381,10 @@ function createPaymentCommand() {
       "    `workspace`: review the cross-request operator view.",
       "    `handoff`: export one stable single-request integration bundle.",
       "    `feed`: export the stable cross-request batch view.",
-      "    If you only remember one route: submit -> next -> approval -> workspace -> handoff -> feed.",
+      "    `publish`: materialize the same stable workspace/feed/handoff bundle as a hostable static export.",
+      "    `serve`: host that same bundle from one operator-controlled endpoint.",
+      "    If you only remember one route: submit -> payment next -> approval -> workspace -> handoff -> feed.",
+      "    Current public hosted proof: publish -> serve the same workspace/feed/handoff bundle behind one operator-controlled URL.",
       "",
       "  Payment request surface:",
       "    Use this layer when execution is not the whole story and you need request capture, follow-up, sharing, reporting, or approval repair around the write path.",
@@ -16745,13 +17409,21 @@ function createPaymentCommand() {
       "    zk-agent workspace",
       "    zk-agent handoff --request-id <id>",
       "    zk-agent feed",
+      "    zk-agent payment publish --public-base-url <https-url>",
+      "    zk-agent payment serve --public-origin <https-url>",
       "    This proves compact ingress -> wallet-aware follow-up -> approval readiness -> cross-request workspace -> integration-ready export.",
+      "    `payment publish` turns those same exports into one static bundle that can be hosted by the operator.",
+      "    `payment serve` turns that same bundle into the current operator-controlled hosted preview.",
+      "    Together, publish -> serve is the current public Agent Pay proof on the hosted-preview boundary.",
+      "    The next hosted step is to keep that served bundle stable behind one externally reachable operator URL before claiming a multi-tenant control plane.",
       "",
       "  Public start here:",
       "    zk-agent submit --wallet main --to <address> --amount <amount>",
       "    zk-agent workspace",
       "    zk-agent handoff --request-id <id>",
       "    zk-agent feed",
+      "    zk-agent payment publish --public-base-url <https-url>",
+      "    zk-agent payment serve --public-origin <https-url>",
       "    zk-agent approval --request-id <id>",
       "    zk-agent payment next --request-id <id>",
       "",
@@ -16759,6 +17431,8 @@ function createPaymentCommand() {
       "    zk-agent payment dashboard",
       "    zk-agent payment queue",
       "    zk-agent payment report",
+      "    zk-agent payment publish",
+      "    zk-agent payment serve",
       "    zk-agent payment sync-approval --request-id <id>",
       "    zk-agent payment inspect --request-id <id>",
       "    zk-agent payment parties --request-id <id>",
@@ -16770,6 +17444,8 @@ function createPaymentCommand() {
       "    `dashboard`: what is the current dashboard summary across requests?",
       "    `handoff`: what is the stable single-request integration bundle?",
       "    `feed`: what is the stable cross-request integration feed?",
+      "    `publish`: what is the hostable static export bundle for the current Agent Pay surface?",
+      "    `serve`: what is the operator-controlled hosted preview for the current Agent Pay surface?",
       "    `suite`: I still need the packaged catalog across requests, discovery, funding, paymaster, and remote recovery.",
       "",
       "  Deeper per-request reads and writes:",
@@ -16800,6 +17476,8 @@ function createPaymentCommand() {
       "    zk-agent feed",
       "    zk-agent payment queue",
       "    zk-agent payment report",
+      "    zk-agent payment publish",
+      "    zk-agent payment serve",
       "    zk-agent approval --request-id <id>",
       "    zk-agent payment sync-approval --request-id <id>",
       "    zk-agent payment list",
@@ -16939,6 +17617,157 @@ function createPaymentCommand() {
       }
     )
   );
+  payment.command("publish").description(
+    "Materialize the current Agent Pay workspace/feed/handoff bundle as a hostable static export"
+  ).option("--wallet <name>", "Optional payer wallet filter").option(
+    "--status <status>",
+    "Optional status filter: draft, approval_pending, ready, paid, failed, expired, or cancelled"
+  ).option("--queue-limit <count>", "Optional maximum number of queue items to include in workspace.json").option("--wallet-limit <count>", "Optional maximum number of wallet summaries in workspace.json").option("--activity-limit <count>", "Optional recent-activity limit in workspace.json").option("--feed-limit <count>", "Optional maximum number of feed items in workspace.json and feed.json").option("--dir <path>", "Optional explicit output directory for the static export bundle").option(
+    "--public-base-url <url>",
+    "Optional absolute public base URL used to precompute public artifact URLs in the manifest"
+  ).addHelpText(
+    "after",
+    [
+      "",
+      "  Hosted static export surface:",
+      "    Use this when the current Agent Pay question is no longer just local inspection and you need one hostable static bundle.",
+      "    This command writes `index.html`, `manifest.json`, `workspace.json`, `feed.json`, and one `handoffs/<request-id>.json` file per matching request.",
+      "    This is the static half of the current public Agent Pay proof.",
+      "    It does not start a service or claim a hosted multi-tenant control plane.",
+      "    Pass `--public-base-url` when you already know where the bundle will be hosted and you want absolute artifact URLs in the manifest.",
+      "",
+      "  Common commands:",
+      `    ${buildPaymentPublishRecommendedCommand()}`,
+      "    zk-agent payment publish --wallet main --public-base-url <https-url>",
+      "    zk-agent payment workspace",
+      "    zk-agent payment handoff --request-id <id>",
+      "    zk-agent payment feed"
+    ].join("\n")
+  ).action(async (options) => {
+    const selection = resolvePaymentPublishSelection(options);
+    const publicBaseUrl = resolvePaymentPublishPublicBaseUrl(options.publicBaseUrl);
+    const data = await loadPaymentPublishData({
+      ...selection,
+      dir: options.dir
+    });
+    const bundle = buildPaymentPublishBundle({
+      data,
+      publicBaseUrl
+    });
+    await writePaymentPublishBundle(bundle);
+    printResult(paymentPublishLines({ manifest: bundle.manifest, outputDir: bundle.outputDir }), {
+      ok: true,
+      ...buildPaymentPublishPayload(bundle),
+      recommendedCommands: {
+        publish: buildPaymentPublishRecommendedCommand(),
+        serve: buildPaymentServeRecommendedCommand(),
+        workspace: buildPaymentWorkspaceRecommendedCommand(),
+        handoff: buildPaymentHandoffRecommendedCommand("<request-id>"),
+        feed: buildPaymentFeedRecommendedCommand()
+      }
+    });
+  });
+  payment.command("serve").description(
+    "Serve the current Agent Pay workspace/feed/handoff bundle from one operator-controlled static endpoint"
+  ).option("--wallet <name>", "Optional payer wallet filter").option(
+    "--status <status>",
+    "Optional status filter: draft, approval_pending, ready, paid, failed, expired, or cancelled"
+  ).option("--queue-limit <count>", "Optional maximum number of queue items to include in workspace.json").option("--wallet-limit <count>", "Optional maximum number of wallet summaries in workspace.json").option("--activity-limit <count>", "Optional recent-activity limit in workspace.json").option("--feed-limit <count>", "Optional maximum number of feed items in workspace.json and feed.json").option("--dir <path>", "Optional explicit output directory for the static export bundle").option("--host <host>", "Host to bind", "127.0.0.1").option("--port <port>", "Port to bind (0 = choose a free port)", "4495").option(
+    "--public-origin <url>",
+    "Optional absolute public origin to advertise when this static bundle is behind a tunnel or reverse proxy"
+  ).addHelpText(
+    "after",
+    [
+      "",
+      "  Hosted preview surface:",
+      "    Use this when the static Agent Pay bundle is no longer enough on disk and you need one operator-controlled hosted endpoint.",
+      "    This command regenerates the same `index.html`, `manifest.json`, `workspace.json`, `feed.json`, and `handoffs/<request-id>.json` bundle before serving it.",
+      "    This is the hosted half of the current public Agent Pay proof.",
+      "    Pass `--public-origin` when the bind origin is not the externally reachable URL.",
+      "",
+      "  Common commands:",
+      `    ${buildPaymentServeRecommendedCommand()}`,
+      "    zk-agent payment serve --public-origin <https-url>",
+      "    zk-agent payment publish --public-base-url <https-url>",
+      "    zk-agent workspace",
+      "    zk-agent feed"
+    ].join("\n")
+  ).action(async (options) => {
+    const selection = resolvePaymentPublishSelection(options);
+    const host = options.host?.trim() || "127.0.0.1";
+    const port = resolvePaymentServePort(options.port);
+    const data = await loadPaymentPublishData({
+      ...selection,
+      dir: options.dir
+    });
+    let origin = "";
+    let publicOrigin = "";
+    const server = await startStaticServer({
+      rootDir: data.outputDir,
+      host,
+      port,
+      healthPayload: () => ({
+        ok: true,
+        service: "zk-agent-payment-static",
+        mode: "operator-controlled-static-export",
+        origin,
+        publicOrigin,
+        outputDir: data.outputDir
+      })
+    });
+    origin = server.origin;
+    publicOrigin = resolvePaymentServePublicOrigin(options.publicOrigin) || server.origin;
+    const publicOriginSource = options.publicOrigin?.trim() ? "configured" : "bind-origin-default";
+    const publicOriginLooksLocal = paymentPublicOriginLooksLocal(publicOrigin);
+    const bundle = buildPaymentPublishBundle({
+      data,
+      publicBaseUrl: publicOrigin
+    });
+    await writePaymentPublishBundle(bundle);
+    const recommendedCommands = buildPaymentServeRecommendedCommands({
+      publicOriginLooksLocal
+    });
+    const notes = buildPaymentServeNotes({
+      publicOrigin,
+      publicOriginLooksLocal
+    });
+    printResult(
+      paymentServeLines({
+        origin,
+        publicOrigin,
+        publicOriginSource,
+        bundle
+      }),
+      {
+        ok: true,
+        status: "payment-serving",
+        origin,
+        publicOrigin,
+        publicOriginSource,
+        publicOriginLooksLocal,
+        port: server.port,
+        outputDir: bundle.outputDir,
+        healthUrl: `${origin}/health`,
+        publicHealthUrl: `${publicOrigin}/health`,
+        ...buildPaymentPublishPayload(bundle),
+        recommendedCommands,
+        notes
+      }
+    );
+    const shutdown = async () => {
+      process.off("SIGINT", handleSignal);
+      process.off("SIGTERM", handleSignal);
+      await server.close();
+      process.exit(0);
+    };
+    const handleSignal = () => {
+      void shutdown();
+    };
+    process.on("SIGINT", handleSignal);
+    process.on("SIGTERM", handleSignal);
+    await new Promise(() => {
+    });
+  });
   payment.command("queue").description(
     "Build the wallet-aware queue slice inside the cross-request Agent Pay workspace"
   ).option("--wallet <name>", "Optional payer wallet filter").option(
@@ -18092,9 +18921,11 @@ function buildOperatorSuitePayload(options = {}) {
     productClaim: "flagship pay, Agent Pay request routing, and hosted approval recovery already read like one product shell",
     flagshipSurface: publicFlagshipCommand,
     agentPaySurface: `${publicPaymentCommand} -> ${buildApprovalRecommendedCommand("<request-id>")} -> ${publicWorkspaceCommand} -> ${publicHandoffCommand} -> ${publicFeedCommand}`,
+    agentPayExportSurface: `${publicWorkspaceCommand} -> ${publicHandoffCommand} -> ${publicFeedCommand}`,
     hostedRecoverySurface: hostedRelayBaselineCommand,
     proofSurfaceIds: proofPaths.map((entry) => entry.id),
-    nextMaturityTarget: "add one stronger hosted/platform-facing proof surface above the current local-first request workbench",
+    hostedDirection: "current public proof is to publish and serve the stable workspace/feed/handoff bundle behind one operator-controlled hosted endpoint instead of claiming a multi-tenant control plane",
+    nextMaturityTarget: "prove the hosted Agent Pay bundle repeatedly behind one externally reachable operator URL",
     boundary: "local-first by default today; Agent Pay is not yet a hosted multi-tenant control plane"
   };
   return {
@@ -18255,8 +19086,10 @@ function operatorSuiteLines(payload) {
     ["platform claim", payload.platformLayer.productClaim],
     ["platform flagship surface", payload.platformLayer.flagshipSurface],
     ["platform agent pay surface", payload.platformLayer.agentPaySurface],
+    ["platform agent pay export surface", payload.platformLayer.agentPayExportSurface],
     ["platform hosted recovery surface", payload.platformLayer.hostedRecoverySurface],
     ["platform proof surfaces", payload.platformLayer.proofSurfaceIds.join(" -> ")],
+    ["platform hosted direction", payload.platformLayer.hostedDirection],
     ["platform next maturity", payload.platformLayer.nextMaturityTarget],
     ["platform boundary", payload.platformLayer.boundary],
     ["entry modes", payload.summary.entryModes.join(" -> ")],
@@ -18328,7 +19161,7 @@ function createSuiteCommand() {
       "",
       "  Most common product journeys:",
       "    send value now: go straight to the flagship pay path",
-      "    capture and track payments: follow submit -> next -> approval -> workspace -> handoff -> feed",
+      "    capture and track payments: follow submit -> payment next -> approval -> workspace -> handoff -> feed",
       "    inspect before acting: open assets/defaults/token inspection first",
       "    unstick a write: recover paymaster/funding readiness on the workflow path",
       "    recover remote approval: move approval to the hosted relay path",
@@ -18339,7 +19172,13 @@ function createSuiteCommand() {
       "    `workspace`: review the cross-request operator surface",
       "    `handoff`: export one stable single-request bundle",
       "    `feed`: export the stable cross-request batch view",
-      "    shortest tracked route: submit -> next -> approval -> workspace -> handoff -> feed",
+      "    shortest tracked route: submit -> payment next -> approval -> workspace -> handoff -> feed",
+      "",
+      "  Hosted/platform direction inside suite:",
+      "    current export proof: zk-agent workspace -> zk-agent handoff --request-id <id> -> zk-agent feed",
+      `    hostable bundle: ${buildPaymentPublishRecommendedCommand()} --public-base-url <https-url>`,
+      "    current public hosted proof: zk-agent payment publish --public-base-url <https-url> -> zk-agent payment serve --public-origin <https-url>",
+      "    next hosted step: keep one served bundle stable behind one externally reachable operator URL before claiming a multi-tenant control plane",
       "",
       "  If you only need one default starting point inside suite:",
       "    send value now",
@@ -18744,16 +19583,16 @@ function normalizeRole2(value) {
 import { Command as Command11 } from "commander";
 
 // src/lib/relay.ts
-import { createServer } from "node:http";
+import { createServer as createServer2 } from "node:http";
 import fs7 from "node:fs";
-import path7 from "node:path";
+import path9 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/lib/http.ts
 import { spawn } from "node:child_process";
-import { mkdtemp, readFile as readFile2, rm as rm2 } from "node:fs/promises";
+import { mkdtemp, readFile as readFile3, rm as rm3 } from "node:fs/promises";
 import os2 from "node:os";
-import path6 from "node:path";
+import path8 from "node:path";
 function isDnsResolutionFailure(error) {
   if (!error || typeof error !== "object") {
     return false;
@@ -18792,9 +19631,9 @@ function parseCurlHeaders(rawHeaders) {
   return { status, headers };
 }
 async function runCurlRequest(url, options) {
-  const tempDir = await mkdtemp(path6.join(os2.tmpdir(), "zk-agent-http-"));
-  const headersPath = path6.join(tempDir, "headers.txt");
-  const bodyPath = path6.join(tempDir, "body.txt");
+  const tempDir = await mkdtemp(path8.join(os2.tmpdir(), "zk-agent-http-"));
+  const headersPath = path8.join(tempDir, "headers.txt");
+  const bodyPath = path8.join(tempDir, "body.txt");
   try {
     const args = [
       "--silent",
@@ -18838,8 +19677,8 @@ async function runCurlRequest(url, options) {
       throw new Error(stderr.trim() || stdout.trim() || `curl exited with code ${exitCode}`);
     }
     const [rawHeaders, body] = await Promise.all([
-      readFile2(headersPath, "utf8"),
-      readFile2(bodyPath, "utf8")
+      readFile3(headersPath, "utf8"),
+      readFile3(bodyPath, "utf8")
     ]);
     const { status, headers } = parseCurlHeaders(rawHeaders);
     return {
@@ -18849,7 +19688,7 @@ async function runCurlRequest(url, options) {
       body
     };
   } finally {
-    await rm2(tempDir, { recursive: true, force: true });
+    await rm3(tempDir, { recursive: true, force: true });
   }
 }
 async function fetchTextWithFallback(url, options = {}) {
@@ -18889,14 +19728,14 @@ var RELAY_SCHEMA_VERSION = 1;
 var RELAY_STATE_BACKEND = "local-filesystem";
 var RELAY_DEPLOYMENT_SCOPE = "single-host";
 function relayDir() {
-  const directory = path7.join(storageDir(), "relay");
+  const directory = path9.join(storageDir(), "relay");
   if (!fs7.existsSync(directory)) {
     fs7.mkdirSync(directory, { recursive: true, mode: 448 });
   }
   return directory;
 }
 function relayRecordPath(requestId) {
-  return path7.join(relayDir(), `${requestId}.json`);
+  return path9.join(relayDir(), `${requestId}.json`);
 }
 function writeRelayRecord(record) {
   fs7.writeFileSync(relayRecordPath(record.request_id), JSON.stringify(record, null, 2), {
@@ -18964,14 +19803,14 @@ function readRequestBody(request, limitBytes = RELAY_BODY_LIMIT_BYTES) {
     request.once("error", reject);
   });
 }
-function writeJson2(response, statusCode, payload) {
-  writeBody(response, statusCode, "application/json; charset=utf-8", JSON.stringify(payload, null, 2), {
+function writeJson3(response, statusCode, payload) {
+  writeBody2(response, statusCode, "application/json; charset=utf-8", JSON.stringify(payload, null, 2), {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
     "Access-Control-Allow-Headers": "Content-Type"
   });
 }
-function writeBody(response, statusCode, contentType, value, extraHeaders = {}) {
+function writeBody2(response, statusCode, contentType, value, extraHeaders = {}) {
   response.statusCode = statusCode;
   response.setHeader("Content-Type", contentType);
   response.setHeader("Content-Length", Buffer.isBuffer(value) ? String(value.byteLength) : String(Buffer.byteLength(value)));
@@ -18982,20 +19821,20 @@ function writeBody(response, statusCode, contentType, value, extraHeaders = {})
 }
 function resolveConnectorUiDistRoot() {
   const currentFile = fileURLToPath3(import.meta.url);
-  const currentDir2 = path7.dirname(currentFile);
+  const currentDir2 = path9.dirname(currentFile);
   const candidates = [
-    path7.resolve(currentDir2, "./connector-ui"),
-    path7.resolve(currentDir2, "../../../zk-connector-ui/dist"),
-    path7.resolve(currentDir2, "../../zk-connector-ui/dist")
+    path9.resolve(currentDir2, "./connector-ui"),
+    path9.resolve(currentDir2, "../../../zk-connector-ui/dist"),
+    path9.resolve(currentDir2, "../../zk-connector-ui/dist")
   ];
   for (const candidate of candidates) {
-    if (fs7.existsSync(path7.join(candidate, "index.html"))) {
+    if (fs7.existsSync(path9.join(candidate, "index.html"))) {
       return candidate;
     }
   }
   return null;
 }
-function contentTypeFor(filePath) {
+function contentTypeFor2(filePath) {
   if (filePath.endsWith(".html")) return "text/html; charset=utf-8";
   if (filePath.endsWith(".js")) return "text/javascript; charset=utf-8";
   if (filePath.endsWith(".css")) return "text/css; charset=utf-8";
@@ -19107,18 +19946,18 @@ async function startRelayServer(options) {
   const uiDistRoot = resolveConnectorUiDistRoot();
   let bindBaseUrl = "";
   const publicOriginSource = options.publicOrigin?.trim() ? "configured" : "bind-origin-default";
-  const server = createServer(async (request, response) => {
+  const server = createServer2(async (request, response) => {
     try {
       const requestUrl = new URL(request.url || "/", "http://localhost");
       const pathname = requestUrl.pathname;
       const method = request.method || "GET";
       const publicBaseUrl = resolveRelayPublicBaseUrl(bindBaseUrl, options.publicOrigin);
       if (method === "OPTIONS") {
-        writeJson2(response, 204, {});
+        writeJson3(response, 204, {});
         return;
       }
       if (method === "GET" && pathname === "/health") {
-        writeJson2(
+        writeJson3(
           response,
           200,
           relayHealthResponse(
@@ -19141,7 +19980,7 @@ async function startRelayServer(options) {
           request: body.request
         };
         writeRelayRecord(record);
-        writeJson2(response, existing ? 200 : 201, {
+        writeJson3(response, existing ? 200 : 201, {
           request_id: record.request_id,
           status: relayStatus(record),
           share_url: relayShareUrl(publicBaseUrl, record.request_id),
@@ -19154,33 +19993,33 @@ async function startRelayServer(options) {
       if (requestMatch && method === "GET") {
         const record = loadRelayRecord(requestMatch[1]);
         if (!record) {
-          writeJson2(response, 404, { error: `Relay request not found: ${requestMatch[1]}` });
+          writeJson3(response, 404, { error: `Relay request not found: ${requestMatch[1]}` });
           return;
         }
-        writeJson2(response, 200, relayStatusResponse(publicBaseUrl, record));
+        writeJson3(response, 200, relayStatusResponse(publicBaseUrl, record));
         return;
       }
       const approvalMatch = pathname.match(/^\/api\/requests\/([^/]+)\/approval$/);
       if (approvalMatch && method === "GET") {
         const record = loadRelayRecord(approvalMatch[1]);
         if (!record) {
-          writeJson2(response, 404, { error: `Relay request not found: ${approvalMatch[1]}` });
+          writeJson3(response, 404, { error: `Relay request not found: ${approvalMatch[1]}` });
           return;
         }
-        writeJson2(response, 200, relayApprovalResponse(record));
+        writeJson3(response, 200, relayApprovalResponse(record));
         return;
       }
       if (approvalMatch && method === "POST") {
         const record = loadRelayRecord(approvalMatch[1]);
         if (!record) {
-          writeJson2(response, 404, { error: `Relay request not found: ${approvalMatch[1]}` });
+          writeJson3(response, 404, { error: `Relay request not found: ${approvalMatch[1]}` });
           return;
         }
         const body = JSON.parse(await readRequestBody(request));
         record.encrypted_payload = body.encrypted_payload;
         record.approval_submitted_at = (/* @__PURE__ */ new Date()).toISOString();
         writeRelayRecord(record);
-        writeJson2(response, 200, relayApprovalResponse(record));
+        writeJson3(response, 200, relayApprovalResponse(record));
         return;
       }
       const shareMatch = pathname.match(/^\/r\/([^/]+)$/);
@@ -19195,24 +20034,24 @@ async function startRelayServer(options) {
       }
       if (method === "GET" && uiDistRoot) {
         const relativePath = pathname === "/" ? "/index.html" : pathname;
-        const filePath = path7.resolve(uiDistRoot, `.${relativePath}`);
+        const filePath = path9.resolve(uiDistRoot, `.${relativePath}`);
         if (!filePath.startsWith(uiDistRoot)) {
-          writeJson2(response, 403, { error: "Forbidden path" });
+          writeJson3(response, 403, { error: "Forbidden path" });
           return;
         }
         if (fs7.existsSync(filePath) && fs7.statSync(filePath).isFile()) {
-          writeBody(response, 200, contentTypeFor(filePath), fs7.readFileSync(filePath));
+          writeBody2(response, 200, contentTypeFor2(filePath), fs7.readFileSync(filePath));
           return;
         }
-        const indexPath = path7.join(uiDistRoot, "index.html");
+        const indexPath = path9.join(uiDistRoot, "index.html");
         if (fs7.existsSync(indexPath)) {
-          writeBody(response, 200, "text/html; charset=utf-8", fs7.readFileSync(indexPath));
+          writeBody2(response, 200, "text/html; charset=utf-8", fs7.readFileSync(indexPath));
           return;
         }
       }
-      writeJson2(response, 404, { error: `Relay route not found: ${pathname}` });
+      writeJson3(response, 404, { error: `Relay route not found: ${pathname}` });
     } catch (error) {
-      writeJson2(response, 500, {
+      writeJson3(response, 500, {
         error: error instanceof Error ? error.message : String(error)
       });
     }
@@ -20044,18 +20883,18 @@ function createRelayCommand() {
 }
 
 // src/commands/wallet.ts
-import { createServer as createServer2 } from "node:http";
+import { createServer as createServer3 } from "node:http";
 import { createInterface } from "node:readline/promises";
 import { Command as Command12 } from "commander";
 
 // ../account-profiles/src/profiles.ts
 import fs8 from "node:fs";
-import path8 from "node:path";
+import path10 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 var PACKAGE_NAME = "@zk-agent/account-profiles";
 var PACKAGE_ROOT_FALLBACK = `<${PACKAGE_NAME} package root unavailable>`;
 function isExpectedPackageRoot(candidate) {
-  const manifestPath = path8.join(candidate, "package.json");
+  const manifestPath = path10.join(candidate, "package.json");
   if (!fs8.existsSync(manifestPath)) return false;
   try {
     const manifest = JSON.parse(fs8.readFileSync(manifestPath, "utf8"));
@@ -20065,19 +20904,19 @@ function isExpectedPackageRoot(candidate) {
   }
 }
 function resolvePackageRoot() {
-  const moduleRoot = path8.resolve(path8.dirname(fileURLToPath4(import.meta.url)), "..");
+  const moduleRoot = path10.resolve(path10.dirname(fileURLToPath4(import.meta.url)), "..");
   const cwd = process.cwd();
   const candidates = [
     process.env.ZK_AGENT_ACCOUNT_PROFILES_ROOT,
-    path8.join(moduleRoot, "dist", "builtin-account-profiles"),
+    path10.join(moduleRoot, "dist", "builtin-account-profiles"),
     moduleRoot,
-    path8.join(cwd, "packages", "account-profiles"),
-    path8.join(cwd, "account-profiles"),
+    path10.join(cwd, "packages", "account-profiles"),
+    path10.join(cwd, "account-profiles"),
     cwd
   ].filter((value) => typeof value === "string" && value.trim().length > 0);
   const seen = /* @__PURE__ */ new Set();
   for (const candidate of candidates) {
-    const normalized = path8.resolve(candidate);
+    const normalized = path10.resolve(candidate);
     if (seen.has(normalized)) continue;
     seen.add(normalized);
     if (isExpectedPackageRoot(normalized)) {
@@ -20149,11 +20988,11 @@ function missingArtifactError(profileId, artifactPath2) {
 }
 function contractPath(...segments) {
   const packageRoot = tryResolvePackageRoot();
-  return packageRoot ? path8.join(packageRoot, "contracts", ...segments) : path8.join(PACKAGE_ROOT_FALLBACK, "contracts", ...segments);
+  return packageRoot ? path10.join(packageRoot, "contracts", ...segments) : path10.join(PACKAGE_ROOT_FALLBACK, "contracts", ...segments);
 }
 function artifactPath(...segments) {
   const packageRoot = tryResolvePackageRoot();
-  return packageRoot ? path8.join(packageRoot, "artifacts", ...segments) : path8.join(PACKAGE_ROOT_FALLBACK, "artifacts", ...segments);
+  return packageRoot ? path10.join(packageRoot, "artifacts", ...segments) : path10.join(PACKAGE_ROOT_FALLBACK, "artifacts", ...segments);
 }
 function createDailySpendLimitProfile() {
   const resolvedArtifactPath = artifactPath("daily-spend-limit", "Account.json");
@@ -22586,7 +23425,7 @@ function buildCallbackUrl(host, port) {
 async function awaitLocalWalletApproval(options) {
   const { walletRequest, walletName, host, requestedPort, timeoutSeconds } = options;
   assertRequestActive(walletRequest.expiresAt);
-  const server = createServer2();
+  const server = createServer3();
   let settled = false;
   const completion = new Promise((resolve, reject) => {
     server.on("error", reject);
@@ -28031,14 +28870,30 @@ function buildDefaultOperatorPathHelpText() {
     "  One-shot CLI:  npx zk-agent-cli --help",
     "  Global CLI:    npm install -g zk-agent-cli",
     "",
+    "Install -> first proof -> broader follow-up:",
+    "  install once -> pick skills, npx, or npm -g",
+    "  prove once   -> zk-agent setup -> zk-agent start -> zk-agent wallet create --await-local -> zk-agent next -> zk-agent pay --wallet main --to <address> --amount <amount>",
+    "  broaden only after that first success -> zk-agent suite",
+    "",
+    "Product shell in one line:",
+    "  prove one local-first zkSync-native pay path first",
+    "  grow into Agent Pay requests, workspace, handoff, and feed on the same wallet runtime",
+    "  open hosted relay approval only when the browser is remote",
+    "",
+    "Payment-first product story:",
+    "  first proof -> get one wallet ready and send value once",
+    "  first expansion -> keep the same wallet runtime and add Agent Pay follow-up, workspace, handoff, and feed",
+    "  hosted fallback -> move approval to relay only when the browser is remote",
+    "",
     "Why use it:",
     "  local-first wallet and session control",
     "  zkSync-native smart-account and paymaster path centered on sed-lite",
-    "  Agent Pay request capture and follow-up surface around the same wallet runtime",
+    "  payment-first public shell: prove pay first, then grow into Agent Pay on the same runtime",
     "",
     "Best fit:",
     "  you want wallet and session control to stay local instead of starting with a managed browser product",
     "  you want a zkSync-native pay and paymaster path instead of a generic multichain wrapper",
+    "  you want to prove one pay route before reading a broad command catalog",
     "  you want Agent Pay request capture and a workbench on the same wallet runtime",
     "",
     "What makes zk-agent-cli different:",
@@ -28067,7 +28922,7 @@ function buildDefaultOperatorPathHelpText() {
     "",
     "First proof from a clean machine:",
     "  zk-agent setup",
-    "  zk-agent next",
+    "  zk-agent start",
     "  zk-agent wallet create --await-local",
     "  zk-agent next",
     `  ${buildTopLevelPayRecommendedCommand("main")}`,
@@ -28181,7 +29036,7 @@ function applyRootHelpCommandOrder(program) {
 }
 function createProgram() {
   const program = new Command14().name("zk-agent").description(
-    "Local-first zkSync-native CLI for wallet approval, flagship pay execution, Agent Pay request routing, and single-host hosted relay recovery"
+    "Payment-first local-first zkSync-native CLI for flagship pay, Agent Pay follow-up, and hosted approval fallback"
   ).showHelpAfterError().option("--json", "Force JSON output for agent harnesses", false).hook("preAction", (thisCommand) => {
     if (thisCommand.optsWithGlobals().json) process.env.ZK_AGENT_OUTPUT = "json";
   });