payments-stripe: retrofit into offchain pipeline conventions

.claude/skills/nexus-tool-builder/reference/hosting-options.md

@@ -23,7 +23,7 @@ The `templates/deploy/` folder emits:
 ## Alternatives (per-tool migration targets)
 
 | Provider | Fit | Trade-off |
-|---|---|---|
+| --- | --- | --- |
 | **Akash Network** | Best general DePIN fit. Mature compute marketplace, supports arbitrary Docker HTTPS services. | More ops friction than Cloud Run; debugging tooling weaker. |
 | **Spheron** | Web3 cloud aggregator on top of AWS / Akash. Closest to managed-deploy UX with a DePIN backend. | Newer; smaller ecosystem than Cloud Run. |
 | **Atoma Network** | Sui-native AI inference DePIN. Best fit when the tool itself is LLM inference. | Not general-purpose hosting — inference workloads only. |

.claude/skills/nexus-tool-builder/reference/interface.md

@@ -5,14 +5,14 @@ Source: `nexus-sdk/toolkit-rust/src/nexus_tool.rs`.
 ## Required associated types
 
 | Type | Constraints | Purpose |
-|---|---|---|
+| --- | --- | --- |
 | `Input` | `JsonSchema + DeserializeOwned + Send` | Generates the input schema. Deserialized from the request body. |
 | `Output` | `JsonSchema + Serialize + Send`, **must be a Rust `enum`** so the schema gets a top-level `oneOf` | Generates the output schema. Serialized into the response. |
 
 ## Required methods
 
 | Method | Signature | Notes |
-|---|---|---|
+| --- | --- | --- |
 | `fqn` | `fn fqn() -> ToolFqn` | Use the `fqn!("xyz.taluslabs.<category>.<service>.<endpoint>@1")` macro. |
 | `new` | `async fn new() -> Self` | Called per request. Inject dependencies here. |
 | `invoke` | `async fn invoke(&self, input: Self::Input) -> Self::Output` | Main logic. **No `Result`** — errors go in `Output::Err`. |
@@ -21,7 +21,7 @@ Source: `nexus-sdk/toolkit-rust/src/nexus_tool.rs`.
 ## Optional methods (have defaults)
 
 | Method | Default | When to override |
-|---|---|---|
+| --- | --- | --- |
 | `path` | `""` (root) | When multiple tools live in one crate — each needs a unique path. |
 | `description` | `""` | Always — surfaces in `/meta`. |
 | `timeout` | `Duration::from_secs(10)` | Override for slow upstreams; keep below the Leader's request budget. |
@@ -30,7 +30,7 @@ Source: `nexus-sdk/toolkit-rust/src/nexus_tool.rs`.
 ## Generated endpoints (from `NexusTool` impl)
 
 | Endpoint | Body |
-|---|---|
+| --- | --- |
 | `GET <path>/health` | Status code returned by `health()`. |
 | `GET <path>/meta` | JSON: `{ fqn, url, timeout, description, input_schema, output_schema }`. |
 | `POST <path>/invoke` | Deserializes body as `Input`, calls `invoke`, serializes the result as `Output`. |

.claude/skills/nexus-tool-builder/reference/security-checklist.md

@@ -7,7 +7,7 @@ its `AUDIT.md` output.
 ## Off-chain (Rust) — CRITICAL
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | C1 | `Output` is a Rust `enum` (not a struct) with `#[serde(rename_all = "snake_case")]` | Nexus runtime rejects non-`oneOf` schemas. |
 | C2 | No `unwrap()` / `expect()` / `panic!` on any path reachable from `invoke()` | Panics surface as opaque 500s; Nexus expects typed `Err` variants. |
 | C3 | No `danger_accept_invalid_certs` or any TLS bypass | Leader-side TLS verification is part of the Nexus trust model. |
@@ -23,7 +23,7 @@ its `AUDIT.md` output.
 ## Off-chain — HIGH
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | H1 | `Input` has `#[serde(deny_unknown_fields)]` | Stops silent acceptance of typos / injection of unknown control fields. |
 | H2 | Every `NexusTool::path()` is unique within the crate | `bootstrap!` will mount duplicates at the same route; behavior is undefined. |
 | H3 | `NexusTool::timeout()` is overridden to a value below the Leader request budget but above 2× expected upstream latency | Default 10s is too short for many real APIs and too long for cheap ones. |
@@ -38,7 +38,7 @@ its `AUDIT.md` output.
 ## Off-chain — MEDIUM
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | M1 | `NexusTool::description()` is non-empty | `/meta` exposes this to DAG authors. |
 | M2 | Every endpoint has a `mockito`-backed happy-path test | Regressions caught at PR time. |
 | M3 | Every endpoint has at least one error-variant test | Same. |
@@ -49,15 +49,15 @@ its `AUDIT.md` output.
 ## Off-chain — LOW / INFO
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | L1 | Doc comments on every `Input` / `Output` field — they show up in `input_schema` / `output_schema` | DAG authors need this. |
 | L2 | `Cargo.toml` `description` is set | Helps `cargo metadata` consumers. |
 | L3 | README has one section per FQN | Convention; consumed by tooling. |
 
 ## On-chain (Move) — CRITICAL
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | C-M1 | `execute` first parameter is `worksheet: &mut ProofOfUID`, last is `ctx: &mut TxContext`, returns `TaggedOutput` | Runtime enforces this signature. |
 | C-M2 | `worksheet.stamp_with_data(&witness.id, …)` is called on **every** code path before `execute` returns | Without it the Nexus runtime rejects the proof. Easy to miss in early-return branches. |
 | C-M3 | Witness struct does NOT have the `copy` ability | A copyable witness lets anyone forge proofs. |
@@ -68,7 +68,7 @@ its `AUDIT.md` output.
 ## On-chain — HIGH
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | H-M1 | Output enum has at least one `err`-prefixed variant | Nexus treats them as error variants. |
 | H-M2 | TaggedOutput field types use the right `as_*()` (number/string/bool/address/raw) | Wrong typing breaks downstream tools at the schema layer, after the Move call succeeded. |
 | H-M3 | No unbounded loops over caller-controlled `vector<T>` or dynamic field reads | Gas grief / out-of-budget aborts. |
@@ -79,22 +79,22 @@ its `AUDIT.md` output.
 ## On-chain — MEDIUM
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | M-M1 | No `friend` modules outside this package | `friend` widens access; reviewers need to follow the trust path. |
 | M-M2 | Every shared object is initialized in `init` and not re-creatable | Drift between the published state and the registered witness id breaks Nexus. |
 | M-M3 | Test for the witness-stamping flow (positive assertion that the worksheet has the expected stamp after `execute`) | Catches silent misuse of `stamp_with_data`. |
 
 ## On-chain — LOW / INFO
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | L-M1 | Doc comments on `execute` and on every `Output` variant | Schema generation reads them. |
 | L-M2 | Module path matches the FQN convention `<domain>.<category>.<name>@<version>` | Convention; helps discovery. |
 
 ## Cross-cutting (both kinds)
 
 | # | Check | Why it matters |
-|---|---|---|
+| --- | --- | --- |
 | X1 | FQN version (`@1`) is bumped when output schema changes | Existing DAGs break otherwise. |
 | X2 | `description` (Rust) / module-level docstrings (Move) accurately describe behavior | Misleading descriptions break DAG composition by humans and agents. |
 | X3 | Tool is **idempotent** under retry — same input ⇒ same output, side-effect-free for read tools | The Leader retries on transient failures. |

.claude/skills/nexus-tool-builder/reference/style-guide.md

@@ -28,7 +28,7 @@ Err {
 ## Interface design
 
 | ✅ Do | ❌ Don't |
-|---|---|
+| --- | --- |
 | Build a tool that encapsulates the API's surface (one tool per endpoint, parameterized). | Build a tool that only does one hardcoded call (e.g. "BTC-USD spot price"). |
 | Split `prompt` and `context` into separate input ports even if the API merges them. | Merge them into one input port — the DAG can't set defaults for fields combined with edge data. |
 | Accept `json_schema` as input and validate generic responses against it (where applicable). | Hardcode the output schema for a single endpoint when the underlying API serves many. |

offchain/tools/payments-stripe/.env.example

@@ -0,0 +1,14 @@
+# payments-stripe — required environment variables.
+#
+# Copy to `.env` for local dev (this file MUST stay in source control;
+# `.env` MUST be gitignored). In production these come from Cloud Run
+# `secretKeyRef` bindings to GCP Secret Manager, configured by the
+# operator out-of-band (the deploy pipeline does NOT provision the key).
+#
+# The tool exits 1 at startup if STRIPE_API_KEY is unset, empty, or does
+# not start with sk_test_ / sk_live_ / rk_test_ / rk_live_.
+
+STRIPE_API_KEY=sk_test_replace_with_real_key
+
+# Optional. Defaults to "info".
+RUST_LOG=info

tools/payments-stripe/Cargo.toml → offchain/tools/payments-stripe/Cargo.toml

@@ -12,17 +12,30 @@ authors.workspace = true
 keywords.workspace = true
 categories.workspace = true
 
+[[bin]]
+name = "payments-stripe"
+path = "src/main.rs"
+
 [dependencies]
-thiserror.workspace = true
-tokio.workspace = true
+anyhow.workspace = true
+dotenvy.workspace = true
+env_logger.workspace = true
+log.workspace = true
 reqwest = { workspace = true, features = ["json"] }
-serde_json.workspace = true
-serde.workspace = true
 schemars.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+thiserror.workspace = true
+tokio.workspace = true
+zeroize.workspace = true
 
 # === Nexus deps ===
 nexus-toolkit.workspace = true
 nexus-sdk.workspace = true
 
 [dev-dependencies]
 mockito.workspace = true
+
+[build-dependencies]
+serde_json.workspace = true
+toml = "0.8"