sylius-x402 — off by default, and only on data routes.

Installing a bundle must not start charging money.

That is why the middleware is off by default. A default that demands payment after composer require turns an update into an outage for every client that could access the routes free of charge until then. If you want to switch x402 on, you should have to decide that — route by route.

The middleware never touches the storefront, never the checkout and never the discovery documents. A 402 on a /.well-known/ document would contradict itself: the agent would have to pay in order to learn how it can pay. And a 402 in the checkout hits people for whom that response contains no way forward.

Billing happens after the response, and only if it was successful. A request that ends in a 500 has delivered nothing — billing before that charges for a result that does not exist. The default verifier advertises prices correctly without money moving or a wallet key existing: you can check the price presentation end to end before connecting a payment path.