x402 v2: Client doesn't forward `extensions` in payment payload, breaking Bazaar discovery

[oceans404]

Problem

I was building Dermi (a skincare/makeup ingredient checker API) for the OWS hackathon and wanted to get it listed on the x402 Bazaar discovery layer. I had the v2 Bazaar extension configured correctly on the server side (@x402/extensions/bazaar with declareDiscoveryExtension), and payments were going through the CDP facilitator successfully — but Dermi never appeared in the Bazaar.

After debugging, I found that when the server returns a 402 with extensions.bazaar in the PAYMENT-REQUIRED header, OWS parses accepts and resource but ignores the extensions field entirely. When OWS builds the PaymentPayloadV2 to send back in the PAYMENT-SIGNATURE header, it doesn't include extensions.

This means the facilitator never sees the bazaar discovery metadata during verify/settle, and the service never gets indexed.

Root Cause

In ows-pay/src/types.rs:

• X402Response doesn't have an extensions field, so it's dropped during deserialization
• PaymentPayloadV2 doesn't have an extensions field, so it can't be included in the payment

// X402Response — missing extensions
pub struct X402Response {
    pub x402_version: Option<u32>,
    pub accepts: Vec<PaymentRequirements>,
    pub resource: Option<serde_json::Value>,
    // ← no extensions field
}

// PaymentPayloadV2 — missing extensions
pub struct PaymentPayloadV2 {
    pub x402_version: u32,
    pub accepted: PaymentRequirements,
    pub resource: Option<serde_json::Value>,
    pub payload: serde_json::Value,
    // ← no extensions field
}

Impact

Any x402 service using the v2 Bazaar extension will never appear in CDP or PayAI Bazaar discovery when payments are made through OWS. This blocks the entire Bazaar discovery flow for OWS users.

How I Found It

I compared the 402 PAYMENT-REQUIRED header (which contained extensions.bazaar with full input/output schemas) to what OWS actually sent in the PAYMENT-SIGNATURE payment payload (which had no extensions at all). Services listed on the Bazaar (like twit.sh, nansen, quicknode) were being called by clients that DO forward extensions (the official @x402/fetch and @x402/axios TypeScript clients).

Once I patched OWS locally to forward extensions, Dermi was indexed on both the CDP Bazaar and PayAI Bazaar immediately.

Fix

Add extensions: Option<serde_json::Value> to both structs and thread it through the payment flow in x402.rs. I'll open a PR with the fix.