feat(store): add agent x402 capacity purchases

[saltbo]

Summary

• return eligible paid-capacity offers when an agent upload exceeds workspace quota
• proxy the x402 quote, verification, settlement, fulfillment, and entitlement-delivery flow through ZPan using the published zpan-cloud-sdk@2.5.1
• add tenant-scoped idempotent purchase intents, unpaid-intent abuse limits, Agent OAuth quota:purchase, operator backfill, migrations, OpenAPI/Arazzo and generated CLI client support
• preserve existing 422 quota behavior on instances without a bound Cloud store and validate deterministic upload failures before offering payment

Verification

• pnpm lint
• pnpm lint:arch
• pnpm lint:http
• pnpm lint:spec
• pnpm typecheck
• pnpm openapi:client:check
• pnpm test (5,324 tests)
• unit coverage run (3,861 tests)
• integration coverage run (1,463 tests)
• pnpm test:cf (80 tests)
• canonical Node Playwright E2E profile (35 tests)
• Go formatting and coverage gate (71.4%, threshold 70%)
• pnpm build
• pnpm exec wrangler deploy --dry-run

Preview verification will be posted against the exact PR head before merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	zpan	920d5ee	Commit Preview URL Branch Preview URL	Jul 31 2026, 02:49 PM

[codecov]

Codecov Report

❌ Patch coverage is 96.31579% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.49%. Comparing base (a968f85) to head (920d5ee).
⚠️ Report is 6 commits behind head on main.

Files with missing lines	Patch %	Lines
scripts/backfill-agent-oauth-scopes.ts	91.76%	7 Missing ⚠️
server/usecases/store/store.ts	98.06%	3 Missing ⚠️
server/auth.ts	93.33%	2 Missing ⚠️
server/http/objects.ts	85.71%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #545      +/-   ##
==========================================
+ Coverage   93.30%   93.49%   +0.18%     
==========================================
  Files         278      282       +4     
  Lines       15382    15747     +365     
  Branches     4395     4528     +133     
==========================================
+ Hits        14352    14722     +370     
+ Misses       1030     1025       -5     

Flag	Coverage Δ
integration	84.98% <73.40%> (-0.25%)	⬇️
unit	53.04% <79.46%> (+0.82%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[saltbo]

Preview verification — exact head bb251610 (Workers version ce9515ac)

• Opened the exact commit preview and completed credential sign-in using an absolute preview-origin callback. The authenticated Files workspace loaded successfully.
• Quota preflight: a 20 MiB object against the 10 MiB workspace quota returned 402 CAPACITY_REQUIRED with the published “Starter 10 GiB” capacity offer.
• Purchase initiation returned an x402 402 challenge with a PAYMENT-REQUIRED header and an exact Base Sepolia USDC payment requirement.
• Verified the legacy Better Auth account-issuer migration restores existing credential sign-in; unsupported legacy providers fail before data changes.
• Verified staging Cloud publication, product, receiver, and license refresh paths against the online services.

Verdict: PASS.

Screenshot — authenticated exact-head preview:

[saltbo]

Latest-head preview follow-up (920d5ee1):

• Exact version: 50e35b85-868e-4180-8836-fa309bd9065a
• Exact URL: https://50e35b85-zpan.saltbo.workers.dev
• /api/health: 200
• Preview admin credential sign-in: successful
• /files: loaded successfully with the staging-backed workspace

The only delta from the screenshot-backed PASS above is the Quick Tunnel CI resilience script; application behavior and the previously verified capacity 402/x402 flow are unchanged. Verdict: PASS.