feat: add service metadata on resource to all 3 SDKs

.github/workflows/check_paywall_template.yml

@@ -0,0 +1,90 @@
+name: Check Paywall Template
+
+on:
+  pull_request:
+    paths:
+      - "typescript/packages/http/paywall/**"
+      - "typescript/packages/mechanisms/evm/**"
+      - "typescript/pnpm-lock.yaml"
+      - "python/x402/http/paywall/**"
+      - "go/http/evm_paywall_template.go"
+      - "go/http/svm_paywall_template.go"
+      - "go/http/avm_paywall_template.go"
+      - ".github/workflows/check_paywall_template.yml"
+
+jobs:
+  check-paywall-template:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          version: 10.7.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: ./typescript
+
+      - name: Install dependencies
+        working-directory: ./typescript
+        run: pnpm install --frozen-lockfile
+
+      - name: Build workspace dependencies
+        working-directory: ./typescript
+        run: pnpm -r run build
+
+      - name: Regenerate paywall bundles
+        working-directory: ./typescript/packages/http/paywall
+        run: pnpm run build:paywall
+
+      - name: Verify regenerated templates match committed files
+        run: |
+          git diff --exit-code -- \
+            typescript/packages/http/paywall/src/evm/gen/template.ts \
+            typescript/packages/http/paywall/src/svm/gen/template.ts \
+            typescript/packages/http/paywall/src/avm/gen/template.ts \
+            python/x402/http/paywall/evm_paywall_template.py \
+            python/x402/http/paywall/svm_paywall_template.py \
+            python/x402/http/paywall/avm_paywall_template.py \
+            go/http/evm_paywall_template.go \
+            go/http/svm_paywall_template.go \
+            go/http/avm_paywall_template.go \
+            || {
+              echo ""
+              echo "::error::Paywall bundled templates are stale. Run 'pnpm --filter @x402/paywall run build:paywall' locally and commit the result."
+              exit 1
+            }
+
+      - name: Verify determinism (re-run build, compare to first run)
+        working-directory: ./typescript/packages/http/paywall
+        run: |
+          first_sha=$(sha256sum \
+            src/evm/gen/template.ts \
+            src/svm/gen/template.ts \
+            src/avm/gen/template.ts \
+            ../../../../python/x402/http/paywall/evm_paywall_template.py \
+            ../../../../python/x402/http/paywall/svm_paywall_template.py \
+            ../../../../python/x402/http/paywall/avm_paywall_template.py \
+            ../../../../go/http/evm_paywall_template.go \
+            ../../../../go/http/svm_paywall_template.go \
+            ../../../../go/http/avm_paywall_template.go)
+          pnpm run build:paywall
+          second_sha=$(sha256sum \
+            src/evm/gen/template.ts \
+            src/svm/gen/template.ts \
+            src/avm/gen/template.ts \
+            ../../../../python/x402/http/paywall/evm_paywall_template.py \
+            ../../../../python/x402/http/paywall/svm_paywall_template.py \
+            ../../../../python/x402/http/paywall/avm_paywall_template.py \
+            ../../../../go/http/evm_paywall_template.go \
+            ../../../../go/http/svm_paywall_template.go \
+            ../../../../go/http/avm_paywall_template.go)
+          if [ "$first_sha" != "$second_sha" ]; then
+            echo "::error::build:paywall is non-deterministic across repeat runs. See x4-23b for context."
+            diff <(echo "$first_sha") <(echo "$second_sha")
+            exit 1
+          fi

.github/workflows/publish_npm_scoped_x402_avm.yml

@@ -0,0 +1,56 @@
+name: Publish @x402/avm package to NPM
+
+on:
+  workflow_dispatch:
+
+jobs:
+  publish-npm-x402-avm:
+    runs-on: ubuntu-latest
+    environment: ${{ github.ref == 'refs/heads/main' && 'npm' || '' }}
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          version: 10.7.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          registry-url: "https://registry.npmjs.org"
+          cache: "pnpm"
+          cache-dependency-path: ./typescript
+
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
+      - name: Install and build
+        working-directory: ./typescript
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm -r --filter=@x402/core --filter=@x402/extensions --filter=@x402/avm run build
+
+      - name: Publish @x402/avm package
+        working-directory: ./typescript/packages/mechanisms/avm
+        run: |
+          # Get package information directly
+          PACKAGE_NAME=$(node -p "require('./package.json').name")
+          PACKAGE_VERSION=$(node -p "require('./package.json').version")
+
+          echo "Package: $PACKAGE_NAME@$PACKAGE_VERSION"
+
+          # Check if running on main branch
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+            echo "Publishing to NPM (main branch)"
+            pnpm publish --provenance --access public
+          else
+            echo "Dry run only (non-main branch: ${{ github.ref }})"
+            pnpm publish --dry-run --no-git-checks
+          fi

.github/workflows/publish_npm_x402.yml

@@ -14,17 +14,23 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
         with:
           version: 10.7.0
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -48,5 +54,3 @@ jobs:
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.github/workflows/publish_npm_x402_axios.yml

@@ -14,17 +14,23 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
         with:
           version: 10.7.0
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -47,6 +53,4 @@ jobs:
           else
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
-          fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          fi

.github/workflows/publish_npm_x402_express.yml

@@ -14,17 +14,23 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
         with:
           version: 10.7.0
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -47,6 +53,4 @@ jobs:
           else
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
-          fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} 
+          fi

.github/workflows/publish_npm_x402_fetch.yml

@@ -14,17 +14,23 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
         with:
           version: 10.7.0
 
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -47,6 +53,4 @@ jobs:
           else
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
-          fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} 
+          fi

.github/workflows/publish_npm_x402_hono.yml

@@ -12,13 +12,25 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          version: 10.7.0
+
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
-      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
-        with:
-          version: 10.7.0
+          cache: "pnpm"
+          cache-dependency-path: ./typescript
+
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -42,5 +54,3 @@ jobs:
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} 

.github/workflows/publish_npm_x402_next.yml

@@ -12,13 +12,25 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@v4
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061
+        with:
+          version: 10.7.0
+
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: "24"
           registry-url: "https://registry.npmjs.org"
-      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
-        with:
-          version: 10.7.0
+          cache: "pnpm"
+          cache-dependency-path: ./typescript
+
+      - name: Update npm for OIDC trusted publishing
+        run: npm install -g npm@latest
+
+      - name: Configure npm for trusted publishing
+        run: npm config delete always-auth 2>/dev/null || true
+
       - name: Install and build
         working-directory: ./typescript
         run: |
@@ -42,5 +54,3 @@ jobs:
             echo "Dry run only (non-main branch: ${{ github.ref }})"
             pnpm publish --dry-run --no-git-checks
           fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} 

.github/workflows/publish_pypi_x402.yml

@@ -14,6 +14,7 @@ jobs:
       url: https://pypi.org/p/x402
     permissions:
       contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -45,4 +46,3 @@ jobs:
         uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc
         with:
           packages-dir: python/x402/dist/
-          password: ${{ secrets.PYPI_X402_TOKEN }}

.gitignore

@@ -12,6 +12,7 @@ e2e/facilitators/external-proxies/*
 !e2e/facilitators/external-proxies/README.md
 typescript/package-lock.json
 .pnpm-store/
+cdk.out/
 
 # e2e Go build artifacts (compiled binaries)
 e2e/clients/go-http/client