
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@xenarch/sdk
Advanced tools
Isomorphic TypeScript SDK for Xenarch — pay any HTTP 402 resource (sdk.x402) and get paid: pay-links, payments, subscribers, profile, webhooks (sdk.merchant). For human devs and AI agents. Gasless USDC on Base. 0% Xenarch fee.
Isomorphic TypeScript/JavaScript SDK for Xenarch. Pay for and get paid through HTTP 402 + USDC micropayments on Base L2. Direct, on-chain settlement. 0% Xenarch fee. Gasless: the wallet only ever holds USDC — no other gas coin needed.
One package, two sides of the market — for both human devs and AI agents:
sdk.x402 — pay any HTTP 402-gated resource on the open web (pure protocol; the seller never has to have heard of Xenarch).sdk.merchant — get paid: create and manage pay-links, read payments and subscribers, manage your merchant profile.sdk.webhooks — verify incoming webhook signatures on your backend.Runs on Node, Bun, Deno, and edge runtimes (Cloudflare Workers, Vercel Edge) — it's just fetch + Web Crypto + viem.
npm i @xenarch/sdk
import { createXenarch } from "@xenarch/sdk";
// Explicit credentials...
const sdk = createXenarch({ sessionToken, privateKey });
// ...or reuse the CLI's logged-in session + wallet (Node only):
// const sdk = await Xenarch.fromConfig();
sessionToken is the SIWE session from xenarch agent login (the xen_session cookie). privateKey is the merchant/agent wallet key — needed only for signing (links.create) and paying (x402.pay); read-only ops work without it.
sdk.merchantconst links = await sdk.merchant.links.list({ limit: 10 });
const payments = await sdk.merchant.payments.list({ limit: 20 });
const subs = await sdk.merchant.subscribers.list({ status: "active" });
const profile = await sdk.merchant.profile.show();
const params = {
to: { state: "lit", value: "0xYourWallet..." },
amount: { state: "lit", value: "50.00" },
currency: { state: "lit", value: "USDC" },
network: { state: "lit", value: "base" },
kind: { state: "lit", value: "checkout" },
// ...plus any other fields from sdk.merchant.links.schema()
};
// Check before signing — returns { ok, missing, errors } with field-level prompts
await sdk.merchant.links.validate(params);
// Signing commits your wallet to the terms, so it's confirm-gated:
const link = await sdk.merchant.links.create(params, { confirm: true });
console.log(link.link); // hosted checkout URL
const secret = link.webhook_secret; // shown once — store it now
await sdk.merchant.links.revoke(link.link_id, { confirm: true });
create always validates first, so "validate ok ⇒ create ok". It throws PayLinkValidationError (with .missing / .errors) when the params are incomplete. An Idempotency-Key is generated per create (dedupes a network-level retry of that one request).
Signing and revoking require { confirm: true } by default — a guard against a stray agent call committing funds or killing a live link. Trusted scripts can opt out once with createXenarch({ ..., requireConfirm: false }).
sdk.x402// Pay any 402-gated URL and get the unlocked response
const { txHash, response } = await sdk.x402.pay("https://example.com/paywalled");
const data = await response.json();
// Or just inspect the gate without paying
const { gated, gate } = await sdk.x402.checkGate("https://example.com/paywalled");
Settles USDC on Base, agent wallet to seller wallet, gasless. The agent wallet only ever holds USDC.
sdk.webhooksEach pay-link can POST events to your server, signed with X-Xenarch-Signature: sha256=<hex> (HMAC-SHA256 of the raw body, keyed by the link's whsec_... secret). Verify before trusting the payload — the same shape as Stripe / GitHub webhooks. Isomorphic (Web Crypto), so it runs on edge too.
import { webhooks } from "@xenarch/sdk";
// e.g. inside a Hono / Next route handler
const raw = await request.text(); // raw body, not a parsed object
const sig = request.headers.get("X-Xenarch-Signature");
if (!(await webhooks.verify(raw, sig, secret))) {
return new Response("bad signature", { status: 401 });
}
const event = JSON.parse(raw);
pip install xenarchMIT
FAQs
Isomorphic TypeScript SDK for Xenarch — pay any HTTP 402 resource (sdk.x402) and get paid: pay-links, metered usage, payments, subscribers, orders, services, profile, webhooks (sdk.merchant), plus the agent control plane (sdk.agent). For human devs and AI
The npm package @xenarch/sdk receives a total of 2 weekly downloads. As such, @xenarch/sdk popularity was classified as not popular.
We found that @xenarch/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.