Contract

The public contract is Protobuf 3, not a second JSON SDK.

Semantic SSOT: proto/sylphx/commerce/v1. Canonical API base: https://api.commerce.sylphx.com/v1. Generated SDK and CLI default only to that base. A handwritten public request model is a defect.

Product
Sylphx Commerce · product id commerce
Peel
https://api.commerce.sylphx.com — API door. The product site is https://commerce.sylphx.com.
API base
https://api.commerce.sylphx.com/v1
Package
sylphx.commerce.v1
Digest
sha256:75a5c67ff67e67aa787fd115d683c3fe1e54093cc4a9531b9b1a64d4096de976
Envelope
Binding + Delegation. Commerce never issues product API keys.

Service families

Family	Operations (selected)	Invariant
Metering	`CreateMeterVersion`, `RecordUsage`, `CorrectUsage`, `GetUsage`	Immutable facts; corrections are linked deltas
Catalog	`CreateProductVersion`, `CreatePriceVersion`	Effective-dated immutable versions; explicit currency and rounding
Rating	`RateUsage`, `ReRateCharge`	One digest for the same meter, price, usage set, and formula
Invoicing	`DraftInvoice`, `FinalizeInvoice`, `IssueCreditNote`	Finalized history is frozen; credits cannot exceed a line
Payments	`CreatePaymentAttempt`, `RequestRefund`, `ListPaymentRecords`	Verified provider receipts; HTTP 200 is not capture
Journal	`GetJournalEntry`, `ListJournalEntries`	Every entry balances per currency
Entitlements	`AppendEntitlementDecision`, `EvaluateEntitlement`	Replay as-of; limit cannot reactivate after revoke
Reconciliation	`IngestProviderStatement`, `RunReconciliation`	Unmatched provider and Commerce amounts stay explicit

Money on the wire

message Money {
  string currency = 1;     // ^[A-Z]{3}$
  sint64 units_minor = 2;  // integer minor units; never float
}

Authority headers

Authorization: Bearer <sylphx-delegation+jwt>
Sylphx-Project-Binding: <sylphx-project-binding+jwt>

Audience is https://api.commerce.sylphx.com/v1. Nested delegation binding is binding.id plus exact binding.revision. TTL ≤ 300s. Tenant/project headers and static secrets do not authorize a write. Missing or forged is 401; insufficient capability is 403; idempotent digest conflict is 409.

Fail closed. A second public schema, a predecessor Ledger route, a Consumer compatibility path, or defaulting a client to localhost is not this contract.