[M0nsxx]

Summary

x402Serve() had no way to declare the extensions.bazaar field on a route — every route it built was just { description?, accepts }. A seller using x402Serve() as documented couldn't get their endpoint listed in any x402 Bazaar.

• X402ServeConfig.routes entries now accept optional input, inputSchema, and output.
• When any of those is present, x402Serve() dynamically loads @x402/extensions/bazaar (same lazy-load pattern as the other @x402/* packages, via the existing load() helper) and sets declareDiscoveryExtension({ input, inputSchema, output }) as that route's extensions — the same shape PREMIUM_ROUTES in packages/agent/src/middleware/x402.ts (the private monorepo) already uses directly.
• Without those fields, nothing changes: no extensions key, no new required dependency, no behavior change for existing callers.

Live proof (not just unit tests)

Ran the actual fixed build (npm pack of this branch's packages/sdk) as a real x402Serve()-protected route on a public host (a throwaway Vercel deployment, deleted after this test), using Rail402's hosted testnet facilitator (https://testnet.rail402.dev) — no mocks, no hand-rolled @x402/express middleware bypassing the fix.

• Settled payment tx: 7fb9bca13c9451fdfa11b8e909a4b6c3d49fe6411b7865f4a9bf11da8a465139 (Stellar testnet, ledger 5608942, confirmed via Horizon)
• After settlement, the resource was cataloged: GET https://testnet.rail402.dev/discovery/resources?payTo=GB73CQ5UTUEUGR6ZSPW5T4XWMZZJAP545G2F6RH2SFL2CTR24RY2VCRK returns the route with extensions.bazaar and rail402.trust: "origin_verified".

Test plan

• New test packages/sdk/src/x402serve-discovery.test.ts: a route with input/inputSchema/output gets extensions.bazaar; a route without them gets no extensions key; mixed config only extends the opted-in route.
• Full suite green: npm test (jest + node:test) in packages/sdk — 165/165.
• tsc --noEmit and npm run build clean.
• Live testnet run against Rail402 as described above (tx hash and listing confirmed independently via curl, not just the test harness's own output).

Closes #217

[Eras256]

Approving — 17/17 checks green, and this includes the real live-testnet proof against Rail402's facilitator (settled tx + Bazaar listing at origin_verified trust) that the issue's "Done when" required. Clean fix, matches the reference pattern already used in packages/agent's own middleware.