@agent-score/commerce 2.5.0 → 2.6.0

package/dist/index.js

@@ -5,11 +5,20 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __commonJS = (cb, mod) => function __require() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  try {
+    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+  } catch (e) {
+    throw mod = 0, e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -193,7 +202,7 @@ function mppPaymentHandler({
   networks: networks2
 }) {
   return {
-    "sh.agentscore.payment.mpp": [{
+    "com.agentscore.payment.mpp": [{
       id: "mpp",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/mpp`,
@@ -214,7 +223,7 @@ function x402PaymentHandler({
   networks: networks2
 }) {
   return {
-    "sh.agentscore.payment.x402": [{
+    "com.agentscore.payment.x402": [{
       id: "x402",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/x402`,
@@ -227,7 +236,7 @@ function stripeSptPaymentHandler({
   spec
 }) {
   return {
-    "sh.agentscore.payment.stripe_spt": [{
+    "com.agentscore.payment.stripe_spt": [{
       id: "stripe-spt",
       version: HANDLER_VERSION,
       spec: `${SPEC_BASE}/stripe_spt`,
@@ -245,10 +254,10 @@ var init_ucp = __esm({
       fromJWK: ucpSigningKeyFromJWKImpl
     };
     DEFAULT_VERSION = "2026-04-08";
-    AGENTSCORE_CAPABILITY_NAME = "sh.agentscore.identity";
+    AGENTSCORE_CAPABILITY_NAME = "com.agentscore.identity";
     AGENTSCORE_CAPABILITY_VERSION = "2026-04-08";
-    AGENTSCORE_DEFAULT_SPEC_URL = "https://agentscore.sh/specification/identity";
-    AGENTSCORE_DEFAULT_SCHEMA_URL = "https://agentscore.sh/schemas/ucp/sh-agentscore-identity-v1.json";
+    AGENTSCORE_DEFAULT_SPEC_URL = "https://www.agentscore.com/specification/identity";
+    AGENTSCORE_DEFAULT_SCHEMA_URL = "https://www.agentscore.com/schemas/ucp/com-agentscore-identity-v1.json";
     AGENTSCORE_EXTENDS = ["dev.ucp.shopping.checkout", "dev.ucp.shopping.cart"];
     RESERVED_TOP_LEVEL = /* @__PURE__ */ new Set([
       "ucp",
@@ -271,8 +280,8 @@ var init_ucp = __esm({
     ]);
     AGENTSCORE_UCP_CAPABILITY = AGENTSCORE_CAPABILITY_NAME;
     HANDLER_VERSION = "2026-04-08";
-    SPEC_BASE = "https://agentscore.sh/specification/payment-handlers";
-    SCHEMA_BASE = "https://agentscore.sh/schemas/payment-handlers";
+    SPEC_BASE = "https://www.agentscore.com/specification/payment-handlers";
+    SCHEMA_BASE = "https://www.agentscore.com/schemas/payment-handlers";
     CAIP2_TO_UCP_NETWORK = {
       "eip155:8453": "base-8453",
       "eip155:84532": "base-84532",
@@ -484,12 +493,12 @@ async function verifyUCPProfile(profile, jwks) {
             `UCP signature header kid must be a non-empty string; got ${kid === void 0 ? "undefined" : typeof kid}.`
           );
         }
-        const matches = jwks.keys.filter(
+        const matches2 = jwks.keys.filter(
           (k) => k != null && typeof k === "object" && k.kid === kid
         );
-        if (matches.length === 0) throw new UCPVerificationError("kid_not_found", `No JWK in JWKS matching kid=${JSON.stringify(kid)}.`);
-        if (matches.length > 1) throw new UCPVerificationError("duplicate_kid", `JWKS contains ${matches.length} keys with kid=${JSON.stringify(kid)}; expected exactly one.`);
-        const matchedKey = matches[0];
+        if (matches2.length === 0) throw new UCPVerificationError("kid_not_found", `No JWK in JWKS matching kid=${JSON.stringify(kid)}.`);
+        if (matches2.length > 1) throw new UCPVerificationError("duplicate_kid", `JWKS contains ${matches2.length} keys with kid=${JSON.stringify(kid)}; expected exactly one.`);
+        const matchedKey = matches2[0];
         if (matchedKey.use != null && matchedKey.use !== "sig") {
           throw new UCPVerificationError("unusable_key", `JWK with kid=${kid} has use=${JSON.stringify(matchedKey.use)}; expected "sig".`);
         }
@@ -499,7 +508,7 @@ async function verifyUCPProfile(profile, jwks) {
             `JWK alg ${JSON.stringify(matchedKey.alg)} does not match JWS header alg ${JSON.stringify(h.alg)}.`
           );
         }
-        return jose.importJWK(matches[0], h.alg);
+        return jose.importJWK(matches2[0], h.alg);
       }
     );
     signedPayload = verified.payload;
@@ -728,7 +737,7 @@ var init_Errors = __esm({
         const docsBaseUrl = options.docsOrigin ?? _BaseError.prototype.docsOrigin;
         const docs = `${docsBaseUrl}${docsPath ?? ""}`;
         const showVersion = Boolean(options.version ?? _BaseError.prototype.showVersion);
-        const version3 = options.version ?? _BaseError.prototype.version;
+        const version4 = options.version ?? _BaseError.prototype.version;
         const message = [
           shortMessage || "An error occurred.",
           ...options.metaMessages ? ["", ...options.metaMessages] : [],
@@ -736,7 +745,7 @@ var init_Errors = __esm({
             "",
             details ? `Details: ${details}` : void 0,
             docsPath ? `See: ${docs}` : void 0,
-            showVersion ? `Version: ${version3}` : void 0
+            showVersion ? `Version: ${version4}` : void 0
           ] : []
         ].filter((x) => typeof x === "string").join("\n");
         super(message, options.cause ? { cause: options.cause } : void 0);
@@ -801,7 +810,7 @@ var init_Errors = __esm({
         this.docsPath = docsPath;
         this.shortMessage = shortMessage;
         this.showVersion = showVersion;
-        this.version = version3;
+        this.version = version4;
       }
       walk(fn) {
         return walk(this, fn);
@@ -931,16 +940,16 @@ var init_hmac = __esm({
         this.blockLen = this.iHash.blockLen;
         this.outputLen = this.iHash.outputLen;
         const blockLen = this.blockLen;
-        const pad3 = new Uint8Array(blockLen);
-        pad3.set(key.length > blockLen ? hash3.create().update(key).digest() : key);
-        for (let i = 0; i < pad3.length; i++)
-          pad3[i] ^= 54;
-        this.iHash.update(pad3);
+        const pad4 = new Uint8Array(blockLen);
+        pad4.set(key.length > blockLen ? hash3.create().update(key).digest() : key);
+        for (let i = 0; i < pad4.length; i++)
+          pad4[i] ^= 54;
+        this.iHash.update(pad4);
         this.oHash = hash3.create();
-        for (let i = 0; i < pad3.length; i++)
-          pad3[i] ^= 54 ^ 92;
-        this.oHash.update(pad3);
-        clean(pad3);
+        for (let i = 0; i < pad4.length; i++)
+          pad4[i] ^= 54 ^ 92;
+        this.oHash.update(pad4);
+        clean(pad4);
       }
       update(buf) {
         aexists(this);
@@ -1679,19 +1688,19 @@ function charCodeToBase16(char) {
   return void 0;
 }
 function pad(bytes, options = {}) {
-  const { dir, size: size3 = 32 } = options;
-  if (size3 === 0)
+  const { dir, size: size4 = 32 } = options;
+  if (size4 === 0)
     return bytes;
-  if (bytes.length > size3)
+  if (bytes.length > size4)
     throw new SizeExceedsPaddingSizeError({
       size: bytes.length,
-      targetSize: size3,
+      targetSize: size4,
       type: "Bytes"
     });
-  const paddedBytes = new Uint8Array(size3);
-  for (let i = 0; i < size3; i++) {
+  const paddedBytes = new Uint8Array(size4);
+  for (let i = 0; i < size4; i++) {
     const padEnd = dir === "right";
-    paddedBytes[padEnd ? i : size3 - i - 1] = bytes[padEnd ? i : bytes.length - i - 1];
+    paddedBytes[padEnd ? i : size4 - i - 1] = bytes[padEnd ? i : bytes.length - i - 1];
   }
   return paddedBytes;
 }
@@ -1750,17 +1759,17 @@ function assertEndOffset2(value, start, end) {
   }
 }
 function pad2(hex_, options = {}) {
-  const { dir, size: size3 = 32 } = options;
-  if (size3 === 0)
+  const { dir, size: size4 = 32 } = options;
+  if (size4 === 0)
     return hex_;
   const hex3 = hex_.replace("0x", "");
-  if (hex3.length > size3 * 2)
+  if (hex3.length > size4 * 2)
     throw new SizeExceedsPaddingSizeError2({
       size: Math.ceil(hex3.length / 2),
-      targetSize: size3,
+      targetSize: size4,
       type: "Hex"
     });
-  return `0x${hex3[dir === "right" ? "padEnd" : "padStart"](size3 * 2, "0")}`;
+  return `0x${hex3[dir === "right" ? "padEnd" : "padStart"](size4 * 2, "0")}`;
 }
 function trim2(value, options = {}) {
   const { dir = "left" } = options;
@@ -1917,14 +1926,14 @@ function fromBytes(value, options = {}) {
   return hex3;
 }
 function fromNumber(value, options = {}) {
-  const { signed, size: size3 } = options;
+  const { signed, size: size4 } = options;
   const value_ = BigInt(value);
   let maxValue;
-  if (size3) {
+  if (size4) {
     if (signed)
-      maxValue = (1n << BigInt(size3) * 8n - 1n) - 1n;
+      maxValue = (1n << BigInt(size4) * 8n - 1n) - 1n;
     else
-      maxValue = 2n ** (BigInt(size3) * 8n) - 1n;
+      maxValue = 2n ** (BigInt(size4) * 8n) - 1n;
   } else if (typeof value === "number") {
     maxValue = BigInt(Number.MAX_SAFE_INTEGER);
   }
@@ -1935,14 +1944,14 @@ function fromNumber(value, options = {}) {
       max: maxValue ? `${maxValue}${suffix}` : void 0,
       min: `${minValue}${suffix}`,
       signed,
-      size: size3,
+      size: size4,
       value: `${value}${suffix}`
     });
   }
-  const stringValue = (signed && value_ < 0 ? BigInt.asUintN(size3 * 8, BigInt(value_)) : value_).toString(16);
+  const stringValue = (signed && value_ < 0 ? BigInt.asUintN(size4 * 8, BigInt(value_)) : value_).toString(16);
   const hex3 = `0x${stringValue}`;
-  if (size3)
-    return padLeft(hex3, size3);
+  if (size4)
+    return padLeft(hex3, size4);
   return hex3;
 }
 function fromString(value, options = {}) {
@@ -1951,11 +1960,11 @@ function fromString(value, options = {}) {
 function isEqual(hexA, hexB) {
   return equalBytes(fromHex(hexA), fromHex(hexB));
 }
-function padLeft(value, size3) {
-  return pad2(value, { dir: "left", size: size3 });
+function padLeft(value, size4) {
+  return pad2(value, { dir: "left", size: size4 });
 }
-function padRight(value, size3) {
-  return pad2(value, { dir: "right", size: size3 });
+function padRight(value, size4) {
+  return pad2(value, { dir: "right", size: size4 });
 }
 function random2(length) {
   return fromBytes(random(length));
@@ -1984,8 +1993,8 @@ function toBigInt(hex3, options = {}) {
   const value = BigInt(hex3);
   if (!signed)
     return value;
-  const size3 = (hex3.length - 2) / 2;
-  const max_unsigned = (1n << BigInt(size3) * 8n) - 1n;
+  const size4 = (hex3.length - 2) / 2;
+  const max_unsigned = (1n << BigInt(size4) * 8n) - 1n;
   const max_signed = max_unsigned >> 1n;
   if (value <= max_signed)
     return value;
@@ -2005,16 +2014,16 @@ function toBytes2(hex3, options = {}) {
   return fromHex(hex3, options);
 }
 function toNumber(hex3, options = {}) {
-  const { signed, size: size3 } = options;
-  if (!signed && !size3)
+  const { signed, size: size4 } = options;
+  if (!signed && !size4)
     return Number(hex3);
   return Number(toBigInt(hex3, options));
 }
 function toString(hex3, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   let bytes = fromHex(hex3);
-  if (size3) {
-    assertSize(bytes, size3);
+  if (size4) {
+    assertSize(bytes, size4);
     bytes = trimRight(bytes);
   }
   return new TextDecoder().decode(bytes);
@@ -2041,8 +2050,8 @@ var init_Hex = __esm({
     encoder = /* @__PURE__ */ new TextEncoder();
     hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_v, i) => i.toString(16).padStart(2, "0"));
     IntegerOutOfRangeError = class extends BaseError {
-      constructor({ max, min, signed, size: size3, value }) {
-        super(`Number \`${value}\` is not in safe${size3 ? ` ${size3 * 8}-bit` : ""}${signed ? " signed" : " unsigned"} integer range ${max ? `(\`${min}\` to \`${max}\`)` : `(above \`${min}\`)`}`);
+      constructor({ max, min, signed, size: size4, value }) {
+        super(`Number \`${value}\` is not in safe${size4 ? ` ${size4 * 8}-bit` : ""}${signed ? " signed" : " unsigned"} integer range ${max ? `(\`${min}\` to \`${max}\`)` : `(above \`${min}\`)`}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -2119,8 +2128,8 @@ var init_Hex = __esm({
       }
     };
     SliceOffsetOutOfBoundsError2 = class extends BaseError {
-      constructor({ offset, position, size: size3 }) {
-        super(`Slice ${position === "start" ? "starting" : "ending"} at offset \`${offset}\` is out-of-bounds (size: \`${size3}\`).`);
+      constructor({ offset, position, size: size4 }) {
+        super(`Slice ${position === "start" ? "starting" : "ending"} at offset \`${offset}\` is out-of-bounds (size: \`${size4}\`).`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -2130,8 +2139,8 @@ var init_Hex = __esm({
       }
     };
     SizeExceedsPaddingSizeError2 = class extends BaseError {
-      constructor({ size: size3, targetSize, type }) {
-        super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (\`${size3}\`) exceeds padding size (\`${targetSize}\`).`);
+      constructor({ size: size4, targetSize, type }) {
+        super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (\`${size4}\`) exceeds padding size (\`${targetSize}\`).`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -2210,21 +2219,21 @@ function fromArray(value) {
   return value instanceof Uint8Array ? value : new Uint8Array(value);
 }
 function fromBoolean2(value, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   const bytes = new Uint8Array(1);
   bytes[0] = Number(value);
-  if (typeof size3 === "number") {
-    assertSize(bytes, size3);
-    return padLeft2(bytes, size3);
+  if (typeof size4 === "number") {
+    assertSize(bytes, size4);
+    return padLeft2(bytes, size4);
   }
   return bytes;
 }
 function fromHex(value, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   let hex3 = value;
-  if (size3) {
-    assertSize2(value, size3);
-    hex3 = padRight(value, size3);
+  if (size4) {
+    assertSize2(value, size4);
+    hex3 = padRight(value, size4);
   }
   let hexString = hex3.slice(2);
   if (hexString.length % 2)
@@ -2246,22 +2255,22 @@ function fromNumber2(value, options) {
   return fromHex(hex3);
 }
 function fromString2(value, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   const bytes = encoder2.encode(value);
-  if (typeof size3 === "number") {
-    assertSize(bytes, size3);
-    return padRight2(bytes, size3);
+  if (typeof size4 === "number") {
+    assertSize(bytes, size4);
+    return padRight2(bytes, size4);
   }
   return bytes;
 }
 function isEqual2(bytesA, bytesB) {
   return equalBytes(bytesA, bytesB);
 }
-function padLeft2(value, size3) {
-  return pad(value, { dir: "left", size: size3 });
+function padLeft2(value, size4) {
+  return pad(value, { dir: "left", size: size4 });
 }
-function padRight2(value, size3) {
-  return pad(value, { dir: "right", size: size3 });
+function padRight2(value, size4) {
+  return pad(value, { dir: "right", size: size4 });
 }
 function random(length) {
   return crypto.getRandomValues(new Uint8Array(length));
@@ -2278,17 +2287,17 @@ function slice2(value, start, end, options = {}) {
   return value_;
 }
 function toBigInt2(bytes, options = {}) {
-  const { size: size3 } = options;
-  if (typeof size3 !== "undefined")
-    assertSize(bytes, size3);
+  const { size: size4 } = options;
+  if (typeof size4 !== "undefined")
+    assertSize(bytes, size4);
   const hex3 = fromBytes(bytes, options);
   return toBigInt(hex3, options);
 }
 function toBoolean2(bytes, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   let bytes_ = bytes;
-  if (typeof size3 !== "undefined") {
-    assertSize(bytes_, size3);
+  if (typeof size4 !== "undefined") {
+    assertSize(bytes_, size4);
     bytes_ = trimLeft2(bytes_);
   }
   if (bytes_.length > 1 || bytes_[0] > 1)
@@ -2299,17 +2308,17 @@ function toHex(value, options = {}) {
   return fromBytes(value, options);
 }
 function toNumber2(bytes, options = {}) {
-  const { size: size3 } = options;
-  if (typeof size3 !== "undefined")
-    assertSize(bytes, size3);
+  const { size: size4 } = options;
+  if (typeof size4 !== "undefined")
+    assertSize(bytes, size4);
   const hex3 = fromBytes(bytes, options);
   return toNumber(hex3, options);
 }
 function toString2(bytes, options = {}) {
-  const { size: size3 } = options;
+  const { size: size4 } = options;
   let bytes_ = bytes;
-  if (typeof size3 !== "undefined") {
-    assertSize(bytes_, size3);
+  if (typeof size4 !== "undefined") {
+    assertSize(bytes_, size4);
     bytes_ = trimRight(bytes_);
   }
   return decoder.decode(bytes_);
@@ -2380,8 +2389,8 @@ var init_Bytes = __esm({
       }
     };
     SliceOffsetOutOfBoundsError = class extends BaseError {
-      constructor({ offset, position, size: size3 }) {
-        super(`Slice ${position === "start" ? "starting" : "ending"} at offset \`${offset}\` is out-of-bounds (size: \`${size3}\`).`);
+      constructor({ offset, position, size: size4 }) {
+        super(`Slice ${position === "start" ? "starting" : "ending"} at offset \`${offset}\` is out-of-bounds (size: \`${size4}\`).`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -2391,8 +2400,8 @@ var init_Bytes = __esm({
       }
     };
     SizeExceedsPaddingSizeError = class extends BaseError {
-      constructor({ size: size3, targetSize, type }) {
-        super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (\`${size3}\`) exceeds padding size (\`${targetSize}\`).`);
+      constructor({ size: size4, targetSize, type }) {
+        super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (\`${size4}\`) exceeds padding size (\`${targetSize}\`).`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -2462,7 +2471,7 @@ var init_lru = __esm({
   "node_modules/ox/_esm/core/internal/lru.js"() {
     "use strict";
     LruMap = class extends Map {
-      constructor(size3) {
+      constructor(size4) {
         super();
         Object.defineProperty(this, "maxSize", {
           enumerable: true,
@@ -2470,7 +2479,7 @@ var init_lru = __esm({
           writable: true,
           value: void 0
         });
-        this.maxSize = size3;
+        this.maxSize = size4;
       }
       get(key) {
         const value = super.get(key);
@@ -2531,11 +2540,11 @@ function assert3(value, options = {}) {
       });
   }
 }
-function checksum2(address2) {
-  if (checksum.has(address2))
-    return checksum.get(address2);
-  assert3(address2, { strict: false });
-  const hexAddress = address2.substring(2).toLowerCase();
+function checksum2(address3) {
+  if (checksum.has(address3))
+    return checksum.get(address3);
+  assert3(address3, { strict: false });
+  const hexAddress = address3.substring(2).toLowerCase();
   const hash3 = keccak256(fromString2(hexAddress), { as: "Bytes" });
   const characters = hexAddress.split("");
   for (let i = 0; i < 40; i += 2) {
@@ -2547,7 +2556,7 @@ function checksum2(address2) {
     }
   }
   const result = `0x${characters.join("")}`;
-  checksum.set(address2, result);
+  checksum.set(address3, result);
   return result;
 }
 var addressRegex, InvalidAddressError, InvalidInputError, InvalidChecksumError;
@@ -2560,8 +2569,8 @@ var init_Address = __esm({
     init_Hash();
     addressRegex = /^0x[a-fA-F0-9]{40}$/;
     InvalidAddressError = class extends BaseError {
-      constructor({ address: address2, cause }) {
-        super(`Address "${address2}" is invalid.`, {
+      constructor({ address: address3, cause }) {
+        super(`Address "${address3}" is invalid.`, {
           cause
         });
         Object.defineProperty(this, "name", {
@@ -2737,9 +2746,9 @@ var init_AbiParameters = __esm({
     (function(encodePacked2) {
       function encode2(type, value, isArray = false) {
         if (type === "address") {
-          const address2 = value;
-          assert3(address2);
-          return padLeft(address2.toLowerCase(), isArray ? 32 : 0);
+          const address3 = value;
+          assert3(address3);
+          return padLeft(address3.toLowerCase(), isArray ? 32 : 0);
         }
         if (type === "string")
           return fromString(value);
@@ -2750,18 +2759,18 @@ var init_AbiParameters = __esm({
         const intMatch = type.match(integerRegex);
         if (intMatch) {
           const [_type, baseType, bits = "256"] = intMatch;
-          const size3 = Number.parseInt(bits, 10) / 8;
+          const size4 = Number.parseInt(bits, 10) / 8;
           return fromNumber(value, {
-            size: isArray ? 32 : size3,
+            size: isArray ? 32 : size4,
             signed: baseType === "int"
           });
         }
         const bytesMatch = type.match(bytesRegex);
         if (bytesMatch) {
-          const [_type, size3] = bytesMatch;
-          if (Number.parseInt(size3, 10) !== (value.length - 2) / 2)
+          const [_type, size4] = bytesMatch;
+          if (Number.parseInt(size4, 10) !== (value.length - 2) / 2)
             throw new BytesSizeMismatchError({
-              expectedSize: Number.parseInt(size3, 10),
+              expectedSize: Number.parseInt(size4, 10),
               value
             });
           return padRight(value, isArray ? 32 : 0);
@@ -2916,7 +2925,7 @@ __export(Base64_exports, {
   toString: () => toString3
 });
 function fromBytes2(value, options = {}) {
-  const { pad: pad3 = true, url: url2 = false } = options;
+  const { pad: pad4 = true, url: url2 = false } = options;
   const encoded = new Uint8Array(Math.ceil(value.length / 3) * 4);
   for (let i = 0, j = 0; j < value.length; i += 4, j += 3) {
     const y = (value[j] << 16) + (value[j + 1] << 8) + (value[j + 2] | 0);
@@ -2928,9 +2937,9 @@ function fromBytes2(value, options = {}) {
   const k = value.length % 3;
   const end = Math.floor(value.length / 3) * 4 + (k && k + 1);
   let base643 = decoder2.decode(new Uint8Array(encoded.buffer, 0, end));
-  if (pad3 && k === 1)
+  if (pad4 && k === 1)
     base643 += "==";
-  if (pad3 && k === 2)
+  if (pad4 && k === 2)
     base643 += "=";
   if (url2)
     base643 = base643.replaceAll("+", "-").replaceAll("/", "_");
@@ -2944,8 +2953,8 @@ function fromString3(value, options = {}) {
 }
 function toBytes3(value) {
   const base643 = value.replace(/=+$/, "");
-  const size3 = base643.length;
-  const decoded = new Uint8Array(size3 + 3);
+  const size4 = base643.length;
+  const decoded = new Uint8Array(size4 + 3);
   encoder3.encodeInto(base643 + "===", decoded);
   for (let i = 0, j = 0; i < base643.length; i += 4, j += 3) {
     const x = (characterToInteger[decoded[i]] << 18) + (characterToInteger[decoded[i + 1]] << 12) + (characterToInteger[decoded[i + 2]] << 6) + characterToInteger[decoded[i + 3]];
@@ -2953,7 +2962,7 @@ function toBytes3(value) {
     decoded[j + 1] = x >> 8 & 255;
     decoded[j + 2] = x & 255;
   }
-  const decodedSize = (size3 >> 2) * 3 + (size3 % 4 && size3 % 4 - 1);
+  const decodedSize = (size4 >> 2) * 3 + (size4 % 4 && size4 % 4 - 1);
   return new Uint8Array(decoded.buffer, 0, decodedSize);
 }
 function toHex2(value) {
@@ -3235,8 +3244,8 @@ var init_Cbor = __esm({
       }
     };
     StringTooLargeError = class extends BaseError {
-      constructor({ size: size3 }) {
-        super(`String length exceeds maximum (4294967295): ${size3}`);
+      constructor({ size: size4 }) {
+        super(`String length exceeds maximum (4294967295): ${size4}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -3246,8 +3255,8 @@ var init_Cbor = __esm({
       }
     };
     ArrayTooLargeError = class extends BaseError {
-      constructor({ size: size3 }) {
-        super(`Array length exceeds maximum (4294967295): ${size3}`);
+      constructor({ size: size4 }) {
+        super(`Array length exceeds maximum (4294967295): ${size4}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -3257,8 +3266,8 @@ var init_Cbor = __esm({
       }
     };
     ObjectTooLargeError = class extends BaseError {
-      constructor({ size: size3 }) {
-        super(`Object size exceeds maximum (4294967295): ${size3}`);
+      constructor({ size: size4 }) {
+        super(`Object size exceeds maximum (4294967295): ${size4}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -3268,8 +3277,8 @@ var init_Cbor = __esm({
       }
     };
     ByteStringTooLargeError = class extends BaseError {
-      constructor({ size: size3 }) {
-        super(`Byte string length exceeds maximum (4294967295): ${size3}`);
+      constructor({ size: size4 }) {
+        super(`Byte string length exceeds maximum (4294967295): ${size4}`);
         Object.defineProperty(this, "name", {
           enumerable: true,
           configurable: true,
@@ -3334,37 +3343,37 @@ var init_Cbor = __esm({
             };
           throw new NumberTooLargeError({ number: value.toString(10) });
         }
-        const positiveNumber = -1 - value;
+        const positiveNumber2 = -1 - value;
         if (value >= -24)
           return {
             length: 1,
-            encode: (cursor) => cursor.pushUint8(32 + positiveNumber)
+            encode: (cursor) => cursor.pushUint8(32 + positiveNumber2)
           };
-        if (positiveNumber <= 255)
+        if (positiveNumber2 <= 255)
           return {
             length: 2,
             // 1 byte prefix + 1 byte uint8
             encode: (cursor) => {
               cursor.pushUint8(56);
-              cursor.pushUint8(positiveNumber);
+              cursor.pushUint8(positiveNumber2);
             }
           };
-        if (positiveNumber <= 65535)
+        if (positiveNumber2 <= 65535)
           return {
             length: 3,
             // 1 byte prefix + 2 bytes uint16
             encode: (cursor) => {
               cursor.pushUint8(57);
-              cursor.pushUint16(positiveNumber);
+              cursor.pushUint16(positiveNumber2);
             }
           };
-        if (positiveNumber <= 4294967295)
+        if (positiveNumber2 <= 4294967295)
           return {
             length: 5,
             // 1 byte prefix + 4 bytes uint32
             encode: (cursor) => {
               cursor.pushUint8(58);
-              cursor.pushUint32(positiveNumber);
+              cursor.pushUint32(positiveNumber2);
             }
           };
         throw new NumberTooLargeError({ number: value.toString(10) });
@@ -3372,142 +3381,142 @@ var init_Cbor = __esm({
       getEncodable2.number = number4;
       function string4(value) {
         const encoded = fromString2(value);
-        const size3 = encoded.length;
-        if (size3 <= 23)
+        const size4 = encoded.length;
+        if (size4 <= 23)
           return {
-            length: 1 + size3,
+            length: 1 + size4,
             // 1 byte prefix + size bytes
             encode(cursor) {
-              cursor.pushUint8(96 + size3);
-              if (size3 > 0)
+              cursor.pushUint8(96 + size4);
+              if (size4 > 0)
                 cursor.pushBytes(encoded);
             }
           };
-        if (size3 <= 255)
+        if (size4 <= 255)
           return {
-            length: 2 + size3,
+            length: 2 + size4,
             // 1 byte prefix + 1 byte uint8 + size bytes
             encode(cursor) {
               cursor.pushUint8(120);
-              cursor.pushUint8(size3);
+              cursor.pushUint8(size4);
               cursor.pushBytes(encoded);
             }
           };
-        if (size3 <= 65535)
+        if (size4 <= 65535)
           return {
-            length: 3 + size3,
+            length: 3 + size4,
             // 1 byte prefix + 2 bytes uint16 + size bytes
             encode(cursor) {
               cursor.pushUint8(121);
-              cursor.pushUint16(size3);
+              cursor.pushUint16(size4);
               cursor.pushBytes(encoded);
             }
           };
-        if (size3 <= 4294967295)
+        if (size4 <= 4294967295)
           return {
-            length: 5 + size3,
+            length: 5 + size4,
             // 1 byte prefix + 4 bytes uint32 + size bytes
             encode(cursor) {
               cursor.pushUint8(122);
-              cursor.pushUint32(size3);
+              cursor.pushUint32(size4);
               cursor.pushBytes(encoded);
             }
           };
-        throw new StringTooLargeError({ size: size3 });
+        throw new StringTooLargeError({ size: size4 });
       }
       getEncodable2.string = string4;
       function array2(value) {
         const items = value.map((item) => getEncodable2(item));
         const bodyLength = items.reduce((acc, item) => acc + item.length, 0);
-        const size3 = value.length;
-        if (size3 <= 23)
+        const size4 = value.length;
+        if (size4 <= 23)
           return {
             length: 1 + bodyLength,
             // 1 byte prefix + body length
             encode(cursor) {
-              cursor.pushUint8(128 + size3);
+              cursor.pushUint8(128 + size4);
               for (const item of items)
                 item.encode(cursor);
             }
           };
-        if (size3 <= 255)
+        if (size4 <= 255)
           return {
             length: 2 + bodyLength,
             // 1 byte prefix + 1 byte uint8 + body length
             encode(cursor) {
               cursor.pushUint8(152);
-              cursor.pushUint8(size3);
+              cursor.pushUint8(size4);
               for (const item of items)
                 item.encode(cursor);
             }
           };
-        if (size3 <= 65535)
+        if (size4 <= 65535)
           return {
             length: 3 + bodyLength,
             // 1 byte prefix + 2 bytes uint16 + body length
             encode(cursor) {
               cursor.pushUint8(153);
-              cursor.pushUint16(size3);
+              cursor.pushUint16(size4);
               for (const item of items)
                 item.encode(cursor);
             }
           };
-        if (size3 <= 4294967295)
+        if (size4 <= 4294967295)
           return {
             length: 5 + bodyLength,
             // 1 byte prefix + 4 bytes uint32 + body length
             encode(cursor) {
               cursor.pushUint8(154);
-              cursor.pushUint32(size3);
+              cursor.pushUint32(size4);
               for (const item of items)
                 item.encode(cursor);
             }
           };
-        throw new ArrayTooLargeError({ size: size3 });
+        throw new ArrayTooLargeError({ size: size4 });
       }
       getEncodable2.array = array2;
       function byteString(value) {
-        const size3 = value.byteLength;
-        if (size3 <= 23)
+        const size4 = value.byteLength;
+        if (size4 <= 23)
           return {
-            length: 1 + size3,
+            length: 1 + size4,
             // 1 byte prefix + size bytes
             encode(cursor) {
-              cursor.pushUint8(64 + size3);
+              cursor.pushUint8(64 + size4);
               cursor.pushBytes(value);
             }
           };
-        if (size3 <= 255)
+        if (size4 <= 255)
           return {
-            length: 2 + size3,
+            length: 2 + size4,
             // 1 byte prefix + 1 byte uint8 + size bytes
             encode(cursor) {
               cursor.pushUint8(88);
-              cursor.pushUint8(size3);
+              cursor.pushUint8(size4);
               cursor.pushBytes(value);
             }
           };
-        if (size3 <= 65535)
+        if (size4 <= 65535)
           return {
-            length: 3 + size3,
+            length: 3 + size4,
             // 1 byte prefix + 2 bytes uint16 + size bytes
             encode(cursor) {
               cursor.pushUint8(89);
-              cursor.pushUint16(size3);
+              cursor.pushUint16(size4);
               cursor.pushBytes(value);
             }
           };
-        if (size3 <= 4294967295)
+        if (size4 <= 4294967295)
           return {
-            length: 5 + size3,
+            length: 5 + size4,
             // 1 byte prefix + 4 bytes uint32 + size bytes
             encode(cursor) {
               cursor.pushUint8(90);
-              cursor.pushUint32(size3);
+              cursor.pushUint32(size4);
               cursor.pushBytes(value);
             }
           };
-        throw new ByteStringTooLargeError({ size: size3 });
+        throw new ByteStringTooLargeError({ size: size4 });
       }
       getEncodable2.byteString = byteString;
       function object2(value) {
@@ -3517,59 +3526,59 @@ var init_Cbor = __esm({
           value: getEncodable2(value[key])
         }));
         const bodyLength = entries.reduce((acc, entry) => acc + entry.key.length + entry.value.length, 0);
-        const size3 = keys.length;
-        if (size3 <= 23)
+        const size4 = keys.length;
+        if (size4 <= 23)
           return {
             length: 1 + bodyLength,
             // 1 byte prefix + body length
             encode(cursor) {
-              cursor.pushUint8(160 + size3);
+              cursor.pushUint8(160 + size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 255)
+        if (size4 <= 255)
           return {
             length: 2 + bodyLength,
             // 1 byte prefix + 1 byte uint8 + body length
             encode(cursor) {
               cursor.pushUint8(184);
-              cursor.pushUint8(size3);
+              cursor.pushUint8(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 65535)
+        if (size4 <= 65535)
           return {
             length: 3 + bodyLength,
             // 1 byte prefix + 2 bytes uint16 + body length
             encode(cursor) {
               cursor.pushUint8(185);
-              cursor.pushUint16(size3);
+              cursor.pushUint16(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 4294967295)
+        if (size4 <= 4294967295)
           return {
             length: 5 + bodyLength,
             // 1 byte prefix + 4 bytes uint32 + body length
             encode(cursor) {
               cursor.pushUint8(186);
-              cursor.pushUint32(size3);
+              cursor.pushUint32(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        throw new ObjectTooLargeError({ size: size3 });
+        throw new ObjectTooLargeError({ size: size4 });
       }
       getEncodable2.object = object2;
       function map2(value) {
@@ -3577,55 +3586,55 @@ var init_Cbor = __esm({
         for (const [k, v] of value)
           entries.push({ key: getEncodable2(k), value: getEncodable2(v) });
         const bodyLength = entries.reduce((acc, entry) => acc + entry.key.length + entry.value.length, 0);
-        const size3 = value.size;
-        if (size3 <= 23)
+        const size4 = value.size;
+        if (size4 <= 23)
           return {
             length: 1 + bodyLength,
             encode(cursor) {
-              cursor.pushUint8(160 + size3);
+              cursor.pushUint8(160 + size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 255)
+        if (size4 <= 255)
           return {
             length: 2 + bodyLength,
             encode(cursor) {
               cursor.pushUint8(184);
-              cursor.pushUint8(size3);
+              cursor.pushUint8(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 65535)
+        if (size4 <= 65535)
           return {
             length: 3 + bodyLength,
             encode(cursor) {
               cursor.pushUint8(185);
-              cursor.pushUint16(size3);
+              cursor.pushUint16(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        if (size3 <= 4294967295)
+        if (size4 <= 4294967295)
           return {
             length: 5 + bodyLength,
             encode(cursor) {
               cursor.pushUint8(186);
-              cursor.pushUint32(size3);
+              cursor.pushUint32(size4);
               for (const entry of entries) {
                 entry.key.encode(cursor);
                 entry.value.encode(cursor);
               }
             }
           };
-        throw new ObjectTooLargeError({ size: size3 });
+        throw new ObjectTooLargeError({ size: size4 });
       }
       getEncodable2.map = map2;
     })(getEncodable || (getEncodable = {}));
@@ -5061,6 +5070,60 @@ var init_BodyDigest = __esm({
   }
 });
 
+// node_modules/mppx/dist/Constants.js
+var Constants_exports = {};
+__export(Constants_exports, {
+  Headers: () => Headers2,
+  Intents: () => Intents,
+  MethodDetailKeys: () => MethodDetailKeys,
+  Methods: () => Methods,
+  Schemes: () => Schemes,
+  SessionProtocols: () => SessionProtocols,
+  getMethodDetail: () => getMethodDetail
+});
+function getMethodDetail(methodDetails, key) {
+  if (!methodDetails || typeof methodDetails !== "object")
+    return void 0;
+  return methodDetails[key];
+}
+var Headers2, Schemes, Methods, Intents, MethodDetailKeys, SessionProtocols;
+var init_Constants = __esm({
+  "node_modules/mppx/dist/Constants.js"() {
+    "use strict";
+    Headers2 = {
+      acceptPayment: "Accept-Payment",
+      authorization: "Authorization",
+      paymentReceipt: "Payment-Receipt",
+      paymentSession: "Payment-Session",
+      paymentSessionSnapshot: "Payment-Session-Snapshot",
+      wwwAuthenticate: "WWW-Authenticate"
+    };
+    Schemes = {
+      payment: "Payment"
+    };
+    Methods = {
+      evm: "evm",
+      stripe: "stripe",
+      tempo: "tempo"
+    };
+    Intents = {
+      charge: "charge",
+      session: "session",
+      subscription: "subscription"
+    };
+    MethodDetailKeys = {
+      sessionProtocol: "sessionProtocol",
+      sessionSnapshot: "sessionSnapshot"
+    };
+    SessionProtocols = {
+      /** Legacy contract-backed Tempo session protocol. */
+      v1: "v1",
+      /** TIP-1034 precompile-backed Tempo session protocol. */
+      v2: "v2"
+    };
+  }
+});
+
 // node_modules/mppx/dist/PaymentRequest.js
 var PaymentRequest_exports = {};
 __export(PaymentRequest_exports, {
@@ -6223,10 +6286,10 @@ var init_regexes = __esm({
     duration = /^P(?:(\d+W)|(?!.*W)(?=\d|T\d)(\d+Y)?(\d+M)?(\d+D)?(T(?=\d)(\d+H)?(\d+M)?(\d+([.,]\d+)?S)?)?)$/;
     extendedDuration = /^[-+]?P(?!$)(?:(?:[-+]?\d+Y)|(?:[-+]?\d+[.,]\d+Y$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:(?:[-+]?\d+W)|(?:[-+]?\d+[.,]\d+W$))?(?:(?:[-+]?\d+D)|(?:[-+]?\d+[.,]\d+D$))?(?:T(?=[\d+-])(?:(?:[-+]?\d+H)|(?:[-+]?\d+[.,]\d+H$))?(?:(?:[-+]?\d+M)|(?:[-+]?\d+[.,]\d+M$))?(?:[-+]?\d+(?:[.,]\d+)?S)?)??$/;
     guid = /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/;
-    uuid = (version3) => {
-      if (!version3)
+    uuid = (version4) => {
+      if (!version4)
         return /^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/;
-      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version3}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
+      return new RegExp(`^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-${version4}[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12})$`);
     };
     uuid4 = /* @__PURE__ */ uuid(4);
     uuid6 = /* @__PURE__ */ uuid(6);
@@ -6515,8 +6578,8 @@ var init_checks = __esm({
       });
       inst._zod.check = (payload) => {
         const input = payload.value;
-        const size3 = input.size;
-        if (size3 <= def.maximum)
+        const size4 = input.size;
+        if (size4 <= def.maximum)
           return;
         payload.issues.push({
           origin: getSizableOrigin(input),
@@ -6543,8 +6606,8 @@ var init_checks = __esm({
       });
       inst._zod.check = (payload) => {
         const input = payload.value;
-        const size3 = input.size;
-        if (size3 >= def.minimum)
+        const size4 = input.size;
+        if (size4 >= def.minimum)
           return;
         payload.issues.push({
           origin: getSizableOrigin(input),
@@ -6572,10 +6635,10 @@ var init_checks = __esm({
       });
       inst._zod.check = (payload) => {
         const input = payload.value;
-        const size3 = input.size;
-        if (size3 === def.size)
+        const size4 = input.size;
+        if (size4 === def.size)
           return;
-        const tooBig = size3 > def.size;
+        const tooBig = size4 > def.size;
         payload.issues.push({
           origin: getSizableOrigin(input),
           ...tooBig ? { code: "too_big", maximum: def.size } : { code: "too_small", minimum: def.size },
@@ -7624,7 +7687,7 @@ var init_schemas = __esm({
         try {
           if (parts.length !== 2)
             throw new Error();
-          const [address2, prefix] = parts;
+          const [address3, prefix] = parts;
           if (!prefix)
             throw new Error();
           const prefixNum = Number(prefix);
@@ -7632,7 +7695,7 @@ var init_schemas = __esm({
             throw new Error();
           if (prefixNum < 0 || prefixNum > 128)
             throw new Error();
-          new URL(`http://[${address2}]`);
+          new URL(`http://[${address3}]`);
         } catch {
           payload.issues.push({
             code: "invalid_format",
@@ -15985,11 +16048,11 @@ function _minSize(minimum, params) {
   });
 }
 // @__NO_SIDE_EFFECTS__
-function _size(size3, params) {
+function _size(size4, params) {
   return new $ZodCheckSizeEquals({
     check: "size_equals",
     ...normalizeParams(params),
-    size: size3
+    size: size4
   });
 }
 // @__NO_SIDE_EFFECTS__
@@ -19403,7 +19466,7 @@ function fromMethod2(method, parameters) {
   const { description, digest, expires, id, meta: meta4, realm, secretKey } = parameters;
   const request = fromMethod(method, parameters.request);
   return from4({
-    ...id ? { id } : { secretKey },
+    ...id !== void 0 ? { id } : { secretKey },
     realm,
     method: methodName,
     intent,
@@ -19416,23 +19479,28 @@ function fromMethod2(method, parameters) {
 }
 function serialize2(challenge) {
   const parts = [
-    `id="${challenge.id}"`,
-    `realm="${challenge.realm}"`,
-    `method="${challenge.method}"`,
-    `intent="${challenge.intent}"`,
-    `request="${serialize(challenge.request)}"`
+    authParam("id", challenge.id),
+    authParam("realm", challenge.realm),
+    authParam("method", challenge.method),
+    authParam("intent", challenge.intent),
+    authParam("request", serialize(challenge.request))
   ];
   if (challenge.description !== void 0)
-    parts.push(`description="${challenge.description}"`);
+    parts.push(authParam("description", challenge.description));
   if (challenge.digest !== void 0)
-    parts.push(`digest="${challenge.digest}"`);
+    parts.push(authParam("digest", challenge.digest));
   if (challenge.expires !== void 0)
-    parts.push(`expires="${challenge.expires}"`);
+    parts.push(authParam("expires", challenge.expires));
   if (challenge.opaque !== void 0)
-    parts.push(`opaque="${challenge.opaque}"`);
+    parts.push(authParam("opaque", challenge.opaque));
   else if (challenge.meta !== void 0)
-    parts.push(`opaque="${serialize(challenge.meta)}"`);
-  return `Payment ${parts.join(", ")}`;
+    parts.push(authParam("opaque", serialize(challenge.meta)));
+  return `${Schemes.payment} ${parts.join(", ")}`;
+}
+function authParam(name, value) {
+  if (/[\r\n]/.test(value))
+    throw new Error("Invalid quoted-string value.");
+  return `${name}="${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
 }
 function deserialize2(value, options) {
   const params = extractPaymentAuthParams(value);
@@ -19442,6 +19510,8 @@ function deserialize2(value, options) {
   const { request, opaque, ...rest } = result;
   if (!request)
     throw new Error("Missing request parameter.");
+  if (request.length > maxRequestParameterLength)
+    throw new Error("Request parameter too large.");
   if (rest.method && !/^[a-z][a-z0-9:_-]*$/.test(rest.method))
     throw new Error(`Invalid method: "${rest.method}". Must be lowercase per spec.`);
   return from4({
@@ -19451,7 +19521,7 @@ function deserialize2(value, options) {
   }, options);
 }
 function extractPaymentAuthParams(header) {
-  const token = "Payment";
+  const token = Schemes.payment;
   let inQuotes = false;
   let escaped = false;
   for (let i = 0; i < header.length; i++) {
@@ -19520,23 +19590,30 @@ function readAuthParamValue(input, start) {
 }
 function readQuotedAuthParamValue(input, start) {
   let i = start;
-  let value = "";
   let escaped = false;
+  let segmentStart = start;
+  let parts;
   while (i < input.length) {
     const char = input[i];
     i++;
     if (escaped) {
-      value += char;
+      parts ??= [];
+      parts.push(char);
+      segmentStart = i;
       escaped = false;
       continue;
     }
     if (char === "\\") {
+      parts ??= [];
+      parts.push(input.slice(segmentStart, i - 1));
+      segmentStart = i;
       escaped = true;
       continue;
     }
-    if (char === '"')
+    if (char === '"') {
+      const value = parts ? [...parts, input.slice(segmentStart, i - 1)].join("") : input.slice(start, i - 1);
       return [value, i];
-    value += char;
+    }
   }
   throw new Error("Unterminated quoted-string.");
 }
@@ -19547,9 +19624,9 @@ function startsWithSchemeToken(value, index, token) {
   return Boolean(next && /\s/.test(next));
 }
 function fromHeaders(headers, options) {
-  const header = headers.get("WWW-Authenticate");
+  const header = headers.get(Headers2.wwwAuthenticate);
   if (!header)
-    throw new Error("Missing WWW-Authenticate header.");
+    throw new Error(`Missing ${Headers2.wwwAuthenticate} header.`);
   return deserialize2(header, options);
 }
 function fromResponse(response, options) {
@@ -19563,14 +19640,15 @@ function fromResponseList(response, options) {
   return fromHeadersList(response.headers, options);
 }
 function fromHeadersList(headers, options) {
-  const header = headers.get("WWW-Authenticate");
+  const header = headers.get(Headers2.wwwAuthenticate);
   if (!header)
-    throw new Error("Missing WWW-Authenticate header.");
+    throw new Error(`Missing ${Headers2.wwwAuthenticate} header.`);
   return deserializeList(header, options);
 }
 function deserializeList(value, options) {
   const starts = [];
-  for (const match of value.matchAll(/Payment\s+/gi)) {
+  const schemePattern = new RegExp(`${Schemes.payment}\\s+`, "gi");
+  for (const match of value.matchAll(schemePattern)) {
     starts.push(match.index);
   }
   if (starts.length === 0)
@@ -19606,14 +19684,16 @@ function computeId(challenge, options) {
   const mac3 = Hash_exports.hmac256(key, data, { as: "Bytes" });
   return Base64_exports.fromBytes(mac3, { url: true, pad: false });
 }
-var Schema;
+var maxRequestParameterLength, Schema;
 var init_Challenge = __esm({
   "node_modules/mppx/dist/Challenge.js"() {
     "use strict";
     init_esm2();
+    init_Constants();
     init_constantTimeEqual();
     init_PaymentRequest();
     init_zod();
+    maxRequestParameterLength = 16 * 1024;
     Schema = object({
       /** Optional human-readable description of the payment. */
       description: optional(string2()),
@@ -19622,7 +19702,7 @@ var init_Challenge = __esm({
       /** Optional expiration timestamp (ISO 8601). */
       expires: optional(datetime3()),
       /** Unique challenge identifier (HMAC-bound). */
-      id: string2(),
+      id: string2().check(_minLength(1)),
       /** Intent type (e.g., "charge", "session"). */
       intent: string2(),
       /** Payment method (e.g., "tempo", "stripe"). */
@@ -19652,7 +19732,7 @@ __export(Credential_exports, {
   serialize: () => serialize3
 });
 function deserialize3(value) {
-  const prefixMatch = value.match(/^Payment\s+(.+)$/i);
+  const prefixMatch = value.match(new RegExp(`^${Schemes.payment}\\s+(.+)$`, "i"));
   if (!prefixMatch?.[1])
     throw new MissingPaymentSchemeError();
   try {
@@ -19701,7 +19781,7 @@ function from5(parameters) {
   };
 }
 function fromRequest(request) {
-  const header = request.headers.get("Authorization");
+  const header = request.headers.get(Headers2.authorization);
   if (!header)
     throw new MissingAuthorizationHeaderError();
   const payment = extractPaymentScheme(header);
@@ -19723,11 +19803,11 @@ function serialize3(credential) {
   };
   const json2 = JSON.stringify(wire);
   const encoded = Base64_exports.fromString(json2, { pad: false, url: true });
-  return `Payment ${encoded}`;
+  return `${Schemes.payment} ${encoded}`;
 }
 function extractPaymentScheme(header) {
-  const schemes = header.split(",").map((s) => s.trim());
-  return schemes.find((s) => /^Payment\s+/i.test(s)) ?? null;
+  const schemes2 = header.split(",").map((s) => s.trim());
+  return schemes2.find((s) => new RegExp(`^${Schemes.payment}\\s+`, "i").test(s)) ?? null;
 }
 var MissingAuthorizationHeaderError, MissingPaymentSchemeError, InvalidCredentialEncodingError;
 var init_Credential = __esm({
@@ -19735,6 +19815,7 @@ var init_Credential = __esm({
     "use strict";
     init_esm2();
     init_Challenge();
+    init_Constants();
     init_PaymentRequest();
     MissingAuthorizationHeaderError = class extends Error {
       name = "MissingAuthorizationHeaderError";
@@ -19765,6 +19846,7 @@ __export(Errors_exports2, {
   ChannelClosedError: () => ChannelClosedError,
   ChannelNotFoundError: () => ChannelNotFoundError,
   DeltaTooSmallError: () => DeltaTooSmallError,
+  Hints: () => Hints,
   InsufficientBalanceError: () => InsufficientBalanceError,
   InvalidChallengeError: () => InvalidChallengeError,
   InvalidPayloadError: () => InvalidPayloadError,
@@ -19779,13 +19861,20 @@ __export(Errors_exports2, {
   SignerMismatchError: () => SignerMismatchError,
   VerificationFailedError: () => VerificationFailedError
 });
-var PaymentError, MalformedCredentialError, InvalidChallengeError, VerificationFailedError, PaymentActionRequiredError, PaymentExpiredError, PaymentRequiredError2, InvalidPayloadError, BadRequestError, PaymentInsufficientError, PaymentMethodUnsupportedError, InsufficientBalanceError, InvalidSignatureError, SignerMismatchError, AmountExceedsDepositError, DeltaTooSmallError, ChannelNotFoundError, ChannelClosedError;
+var Hints, PaymentError, MalformedCredentialError, InvalidChallengeError, VerificationFailedError, PaymentActionRequiredError, PaymentExpiredError, PaymentRequiredError2, InvalidPayloadError, BadRequestError, PaymentInsufficientError, PaymentMethodUnsupportedError, InsufficientBalanceError, InvalidSignatureError, SignerMismatchError, AmountExceedsDepositError, DeltaTooSmallError, ChannelNotFoundError, ChannelClosedError;
 var init_Errors2 = __esm({
   "node_modules/mppx/dist/Errors.js"() {
     "use strict";
+    Hints = {
+      paymentRequired: "Use a supported wallet to pay for this resource using one of the supported payment methods returned in the WWW-Authenticate header. See https://mpp.dev/tools/wallet.md",
+      malformedCredential: "Use a supported wallet to construct valid credentials for one of the supported payment methods returned in the WWW-Authenticate header. See https://mpp.dev/tools/wallet.md",
+      methodUnsupported: "Use a supported wallet to pay for this resource using one of the supported payment methods returned in the WWW-Authenticate header. See https://mpp.dev/tools/wallet.md"
+    };
     PaymentError = class extends Error {
       /** HTTP status code. */
       status = 402;
+      /** Actionable hint for resolving the error (RFC 9457 extension member). */
+      hint;
       /** Converts the error to RFC 9457 Problem Details format. */
       toProblemDetails(challengeId) {
         return {
@@ -19793,6 +19882,7 @@ var init_Errors2 = __esm({
           title: this.title,
           status: this.status,
           detail: this.message,
+          ...this.hint && { hint: this.hint },
           ...challengeId && { challengeId }
         };
       }
@@ -19802,6 +19892,7 @@ var init_Errors2 = __esm({
       title = "Malformed Credential";
       status = 402;
       type = "https://paymentauth.org/problems/malformed-credential";
+      hint = Hints.malformedCredential;
       constructor(options = {}) {
         const { reason } = options;
         super(reason ? `Credential is malformed: ${reason}.` : "Credential is malformed.");
@@ -19850,6 +19941,7 @@ var init_Errors2 = __esm({
       name = "PaymentRequiredError";
       title = "Payment Required";
       type = "https://paymentauth.org/problems/payment-required";
+      hint = Hints.paymentRequired;
       constructor(options = {}) {
         const { description } = options;
         const parts = ["Payment is required"];
@@ -19891,6 +19983,7 @@ var init_Errors2 = __esm({
       title = "Method Unsupported";
       status = 400;
       type = "https://paymentauth.org/problems/method-unsupported";
+      hint = Hints.methodUnsupported;
       constructor(options = {}) {
         const { method } = options;
         super(method ? `Payment method "${method}" is not supported.` : "Payment method is not supported.");
@@ -20023,147 +20116,1120 @@ var init_Expires = __esm({
   }
 });
 
-// node_modules/mppx/dist/Mcp.js
-var Mcp_exports = {};
-__export(Mcp_exports, {
-  credentialMetaKey: () => credentialMetaKey,
-  paymentRequiredCode: () => paymentRequiredCode,
-  paymentVerificationFailedCode: () => paymentVerificationFailedCode,
-  receiptMetaKey: () => receiptMetaKey
+// node_modules/viem/_esm/utils/data/isHex.js
+function isHex(value, { strict = true } = {}) {
+  if (!value)
+    return false;
+  if (typeof value !== "string")
+    return false;
+  return strict ? /^0x[0-9a-fA-F]*$/.test(value) : value.startsWith("0x");
+}
+var init_isHex = __esm({
+  "node_modules/viem/_esm/utils/data/isHex.js"() {
+    "use strict";
+  }
 });
-var paymentRequiredCode, paymentVerificationFailedCode, credentialMetaKey, receiptMetaKey;
-var init_Mcp = __esm({
-  "node_modules/mppx/dist/Mcp.js"() {
+
+// node_modules/viem/_esm/utils/data/size.js
+function size3(value) {
+  if (isHex(value, { strict: false }))
+    return Math.ceil((value.length - 2) / 2);
+  return value.length;
+}
+var init_size = __esm({
+  "node_modules/viem/_esm/utils/data/size.js"() {
     "use strict";
-    paymentRequiredCode = -32042;
-    paymentVerificationFailedCode = -32043;
-    credentialMetaKey = "org.paymentauth/credential";
-    receiptMetaKey = "org.paymentauth/receipt";
+    init_isHex();
   }
 });
 
-// node_modules/mppx/dist/Method.js
-var Method_exports = {};
-__export(Method_exports, {
-  from: () => from6,
-  toClient: () => toClient,
-  toServer: () => toServer
+// node_modules/viem/_esm/errors/version.js
+var version3;
+var init_version2 = __esm({
+  "node_modules/viem/_esm/errors/version.js"() {
+    "use strict";
+    version3 = "2.54.4";
+  }
 });
-function from6(method) {
-  return method;
+
+// node_modules/viem/_esm/errors/base.js
+function walk2(err, fn) {
+  if (fn?.(err))
+    return err;
+  if (err && typeof err === "object" && "cause" in err && err.cause !== void 0)
+    return walk2(err.cause, fn);
+  return fn ? null : err;
 }
-function toClient(method, options) {
-  const { context, createCredential } = options;
-  return {
-    ...method,
-    context,
-    createCredential
-  };
+var errorConfig, BaseError3;
+var init_base = __esm({
+  "node_modules/viem/_esm/errors/base.js"() {
+    "use strict";
+    init_version2();
+    errorConfig = {
+      getDocsUrl: ({ docsBaseUrl, docsPath = "", docsSlug }) => docsPath ? `${docsBaseUrl ?? "https://viem.sh"}${docsPath}${docsSlug ? `#${docsSlug}` : ""}` : void 0,
+      version: `viem@${version3}`
+    };
+    BaseError3 = class _BaseError extends Error {
+      constructor(shortMessage, args = {}) {
+        const details = (() => {
+          if (args.cause instanceof _BaseError)
+            return args.cause.details;
+          if (args.cause?.message)
+            return args.cause.message;
+          return args.details;
+        })();
+        const docsPath = (() => {
+          if (args.cause instanceof _BaseError)
+            return args.cause.docsPath || args.docsPath;
+          return args.docsPath;
+        })();
+        const docsUrl = errorConfig.getDocsUrl?.({ ...args, docsPath });
+        const message = [
+          shortMessage || "An error occurred.",
+          "",
+          ...args.metaMessages ? [...args.metaMessages, ""] : [],
+          ...docsUrl ? [`Docs: ${docsUrl}`] : [],
+          ...details ? [`Details: ${details}`] : [],
+          ...errorConfig.version ? [`Version: ${errorConfig.version}`] : []
+        ].join("\n");
+        super(message, args.cause ? { cause: args.cause } : void 0);
+        Object.defineProperty(this, "details", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "docsPath", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "metaMessages", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "shortMessage", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "version", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        Object.defineProperty(this, "name", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: "BaseError"
+        });
+        this.details = details;
+        this.docsPath = docsPath;
+        this.metaMessages = args.metaMessages;
+        this.name = args.name ?? this.name;
+        this.shortMessage = shortMessage;
+        this.version = version3;
+      }
+      walk(fn) {
+        return walk2(this, fn);
+      }
+    };
+  }
+});
+
+// node_modules/viem/_esm/errors/data.js
+var SizeExceedsPaddingSizeError3;
+var init_data = __esm({
+  "node_modules/viem/_esm/errors/data.js"() {
+    "use strict";
+    init_base();
+    SizeExceedsPaddingSizeError3 = class extends BaseError3 {
+      constructor({ size: size4, targetSize, type }) {
+        super(`${type.charAt(0).toUpperCase()}${type.slice(1).toLowerCase()} size (${size4}) exceeds padding size (${targetSize}).`, { name: "SizeExceedsPaddingSizeError" });
+      }
+    };
+  }
+});
+
+// node_modules/viem/_esm/utils/data/pad.js
+function pad3(hexOrBytes, { dir, size: size4 = 32 } = {}) {
+  if (typeof hexOrBytes === "string")
+    return padHex(hexOrBytes, { dir, size: size4 });
+  return padBytes(hexOrBytes, { dir, size: size4 });
 }
-function toServer(method, options) {
-  const { authorize, defaults, extensions, html, request, respond, stableBinding, transport, verify: verify3 } = options;
-  return {
-    ...method,
-    authorize,
-    defaults,
-    extensions,
-    html,
-    request,
-    respond,
-    stableBinding,
-    transport,
-    verify: verify3
-  };
+function padHex(hex_, { dir, size: size4 = 32 } = {}) {
+  if (size4 === null)
+    return hex_;
+  const hex3 = hex_.replace("0x", "");
+  if (hex3.length > size4 * 2)
+    throw new SizeExceedsPaddingSizeError3({
+      size: Math.ceil(hex3.length / 2),
+      targetSize: size4,
+      type: "hex"
+    });
+  return `0x${hex3[dir === "right" ? "padEnd" : "padStart"](size4 * 2, "0")}`;
 }
-var init_Method = __esm({
-  "node_modules/mppx/dist/Method.js"() {
+function padBytes(bytes, { dir, size: size4 = 32 } = {}) {
+  if (size4 === null)
+    return bytes;
+  if (bytes.length > size4)
+    throw new SizeExceedsPaddingSizeError3({
+      size: bytes.length,
+      targetSize: size4,
+      type: "bytes"
+    });
+  const paddedBytes = new Uint8Array(size4);
+  for (let i = 0; i < size4; i++) {
+    const padEnd = dir === "right";
+    paddedBytes[padEnd ? i : size4 - i - 1] = bytes[padEnd ? i : bytes.length - i - 1];
+  }
+  return paddedBytes;
+}
+var init_pad = __esm({
+  "node_modules/viem/_esm/utils/data/pad.js"() {
     "use strict";
+    init_data();
   }
 });
 
-// node_modules/mppx/dist/Receipt.js
-var Receipt_exports = {};
-__export(Receipt_exports, {
-  Schema: () => Schema2,
-  deserialize: () => deserialize4,
-  from: () => from7,
-  fromResponse: () => fromResponse2,
-  serialize: () => serialize4
+// node_modules/viem/_esm/errors/encoding.js
+var IntegerOutOfRangeError2, SizeOverflowError3;
+var init_encoding = __esm({
+  "node_modules/viem/_esm/errors/encoding.js"() {
+    "use strict";
+    init_base();
+    IntegerOutOfRangeError2 = class extends BaseError3 {
+      constructor({ max, min, signed, size: size4, value }) {
+        super(`Number "${value}" is not in safe ${size4 ? `${size4 * 8}-bit ${signed ? "signed" : "unsigned"} ` : ""}integer range ${max ? `(${min} to ${max})` : `(above ${min})`}`, { name: "IntegerOutOfRangeError" });
+      }
+    };
+    SizeOverflowError3 = class extends BaseError3 {
+      constructor({ givenSize, maxSize }) {
+        super(`Size cannot exceed ${maxSize} bytes. Given size: ${givenSize} bytes.`, { name: "SizeOverflowError" });
+      }
+    };
+  }
 });
-function deserialize4(encoded) {
-  const json2 = Base64_exports.toString(encoded);
-  return from7(JSON.parse(json2));
+
+// node_modules/viem/_esm/utils/encoding/fromHex.js
+function assertSize3(hexOrBytes, { size: size4 }) {
+  if (size3(hexOrBytes) > size4)
+    throw new SizeOverflowError3({
+      givenSize: size3(hexOrBytes),
+      maxSize: size4
+    });
 }
-function from7(parameters) {
-  return Schema2.parse(parameters);
+var init_fromHex = __esm({
+  "node_modules/viem/_esm/utils/encoding/fromHex.js"() {
+    "use strict";
+    init_encoding();
+    init_size();
+  }
+});
+
+// node_modules/viem/_esm/utils/encoding/toHex.js
+function toHex3(value, opts = {}) {
+  if (typeof value === "number" || typeof value === "bigint")
+    return numberToHex(value, opts);
+  if (typeof value === "string") {
+    return stringToHex(value, opts);
+  }
+  if (typeof value === "boolean")
+    return boolToHex(value, opts);
+  return bytesToHex(value, opts);
 }
-function serialize4(receipt) {
-  const json2 = JSON.stringify(receipt);
-  return Base64_exports.fromString(json2, { pad: false, url: true });
+function boolToHex(value, opts = {}) {
+  const hex3 = `0x${Number(value)}`;
+  if (typeof opts.size === "number") {
+    assertSize3(hex3, { size: opts.size });
+    return pad3(hex3, { size: opts.size });
+  }
+  return hex3;
 }
-function fromResponse2(response) {
-  const header = response.headers.get("Payment-Receipt");
-  if (!header)
-    throw new Error("Missing Payment-Receipt header.");
-  return deserialize4(header);
+function bytesToHex(value, opts = {}) {
+  let string4 = "";
+  for (let i = 0; i < value.length; i++) {
+    string4 += hexes2[value[i]];
+  }
+  const hex3 = `0x${string4}`;
+  if (typeof opts.size === "number") {
+    assertSize3(hex3, { size: opts.size });
+    return pad3(hex3, { dir: "right", size: opts.size });
+  }
+  return hex3;
 }
-var Schema2;
-var init_Receipt = __esm({
-  "node_modules/mppx/dist/Receipt.js"() {
-    "use strict";
-    init_esm2();
-    init_zod();
-    Schema2 = object({
-      /** Payment method used (e.g., "tempo", "stripe"). */
-      method: string2(),
-      /** Method-specific reference (e.g., transaction hash). */
-      reference: string2(),
-      /** Optional external reference ID echoed from the credential payload. */
-      externalId: optional(string2()),
-      /** Optional server-issued subscription identifier for recurring payments. */
-      subscriptionId: optional(string2()),
-      /** Payment status. Always "success" — failures use 402 + Problem Details. */
-      status: literal("success"),
-      /** RFC 3339 settlement timestamp. */
-      timestamp: datetime3()
+function numberToHex(value_, opts = {}) {
+  const { signed, size: size4 } = opts;
+  const value = BigInt(value_);
+  let maxValue;
+  if (size4) {
+    if (signed)
+      maxValue = (1n << BigInt(size4) * 8n - 1n) - 1n;
+    else
+      maxValue = 2n ** (BigInt(size4) * 8n) - 1n;
+  } else if (typeof value_ === "number") {
+    maxValue = BigInt(Number.MAX_SAFE_INTEGER);
+  }
+  const minValue = typeof maxValue === "bigint" && signed ? -maxValue - 1n : 0;
+  if (maxValue && value > maxValue || value < minValue) {
+    const suffix = typeof value_ === "bigint" ? "n" : "";
+    throw new IntegerOutOfRangeError2({
+      max: maxValue ? `${maxValue}${suffix}` : void 0,
+      min: `${minValue}${suffix}`,
+      signed,
+      size: size4,
+      value: `${value_}${suffix}`
     });
   }
+  const hex3 = `0x${(signed && value < 0 ? (1n << BigInt(size4 * 8)) + BigInt(value) : value).toString(16)}`;
+  if (size4)
+    return pad3(hex3, { size: size4 });
+  return hex3;
+}
+function stringToHex(value_, opts = {}) {
+  const value = encoder4.encode(value_);
+  return bytesToHex(value, opts);
+}
+var hexes2, encoder4;
+var init_toHex = __esm({
+  "node_modules/viem/_esm/utils/encoding/toHex.js"() {
+    "use strict";
+    init_encoding();
+    init_pad();
+    init_fromHex();
+    hexes2 = /* @__PURE__ */ Array.from({ length: 256 }, (_v, i) => i.toString(16).padStart(2, "0"));
+    encoder4 = /* @__PURE__ */ new TextEncoder();
+  }
 });
 
-// node_modules/mppx/dist/Store.js
-var Store_exports = {};
-__export(Store_exports, {
-  cloudflare: () => cloudflare,
-  from: () => from8,
-  memory: () => memory,
-  redis: () => redis,
-  upstash: () => upstash
-});
-function from8(store) {
-  return store;
+// node_modules/viem/_esm/utils/encoding/toBytes.js
+function toBytes4(value, opts = {}) {
+  if (typeof value === "number" || typeof value === "bigint")
+    return numberToBytes(value, opts);
+  if (typeof value === "boolean")
+    return boolToBytes(value, opts);
+  if (isHex(value))
+    return hexToBytes(value, opts);
+  return stringToBytes(value, opts);
 }
-function wrapJsonUpdate(update) {
-  if (!update)
-    return {};
-  return {
-    async update(key, fn) {
-      return update(key, (current) => {
-        const parsed = current == null ? null : Json_exports.parse(current);
-        const change = fn(parsed);
-        if (change.op !== "set")
-          return change;
-        return { ...change, value: Json_exports.stringify(change.value) };
-      });
-    }
-  };
+function boolToBytes(value, opts = {}) {
+  const bytes = new Uint8Array(1);
+  bytes[0] = Number(value);
+  if (typeof opts.size === "number") {
+    assertSize3(bytes, { size: opts.size });
+    return pad3(bytes, { size: opts.size });
+  }
+  return bytes;
 }
-function cloudflare(kv) {
-  return from8({
-    async get(key) {
-      const raw = await kv.get(key);
-      if (raw == null)
-        return null;
-      return Json_exports.parse(raw);
+function charCodeToBase162(char) {
+  if (char >= charCodeMap2.zero && char <= charCodeMap2.nine)
+    return char - charCodeMap2.zero;
+  if (char >= charCodeMap2.A && char <= charCodeMap2.F)
+    return char - (charCodeMap2.A - 10);
+  if (char >= charCodeMap2.a && char <= charCodeMap2.f)
+    return char - (charCodeMap2.a - 10);
+  return void 0;
+}
+function hexToBytes(hex_, opts = {}) {
+  let hex3 = hex_;
+  if (opts.size) {
+    assertSize3(hex3, { size: opts.size });
+    hex3 = pad3(hex3, { dir: "right", size: opts.size });
+  }
+  let hexString = hex3.slice(2);
+  if (hexString.length % 2)
+    hexString = `0${hexString}`;
+  const length = hexString.length / 2;
+  const bytes = new Uint8Array(length);
+  for (let index = 0, j = 0; index < length; index++) {
+    const nibbleLeft = charCodeToBase162(hexString.charCodeAt(j++));
+    const nibbleRight = charCodeToBase162(hexString.charCodeAt(j++));
+    if (nibbleLeft === void 0 || nibbleRight === void 0) {
+      throw new BaseError3(`Invalid byte sequence ("${hexString[j - 2]}${hexString[j - 1]}" in "${hexString}").`);
+    }
+    bytes[index] = nibbleLeft * 16 + nibbleRight;
+  }
+  return bytes;
+}
+function numberToBytes(value, opts) {
+  const hex3 = numberToHex(value, opts);
+  return hexToBytes(hex3);
+}
+function stringToBytes(value, opts = {}) {
+  const bytes = encoder5.encode(value);
+  if (typeof opts.size === "number") {
+    assertSize3(bytes, { size: opts.size });
+    return pad3(bytes, { dir: "right", size: opts.size });
+  }
+  return bytes;
+}
+var encoder5, charCodeMap2;
+var init_toBytes = __esm({
+  "node_modules/viem/_esm/utils/encoding/toBytes.js"() {
+    "use strict";
+    init_base();
+    init_isHex();
+    init_pad();
+    init_fromHex();
+    init_toHex();
+    encoder5 = /* @__PURE__ */ new TextEncoder();
+    charCodeMap2 = {
+      zero: 48,
+      nine: 57,
+      A: 65,
+      F: 70,
+      a: 97,
+      f: 102
+    };
+  }
+});
+
+// node_modules/viem/_esm/utils/hash/keccak256.js
+function keccak2562(value, to_) {
+  const to = to_ || "hex";
+  const bytes = keccak_256(isHex(value, { strict: false }) ? toBytes4(value) : value);
+  if (to === "bytes")
+    return bytes;
+  return toHex3(bytes);
+}
+var init_keccak256 = __esm({
+  "node_modules/viem/_esm/utils/hash/keccak256.js"() {
+    "use strict";
+    init_sha3();
+    init_isHex();
+    init_toBytes();
+    init_toHex();
+  }
+});
+
+// node_modules/viem/_esm/errors/address.js
+var InvalidAddressError2;
+var init_address = __esm({
+  "node_modules/viem/_esm/errors/address.js"() {
+    "use strict";
+    init_base();
+    InvalidAddressError2 = class extends BaseError3 {
+      constructor({ address: address3 }) {
+        super(`Address "${address3}" is invalid.`, {
+          metaMessages: [
+            "- Address must be a hex value of 20 bytes (40 hex characters).",
+            "- Address must match its checksum counterpart."
+          ],
+          name: "InvalidAddressError"
+        });
+      }
+    };
+  }
+});
+
+// node_modules/viem/_esm/utils/lru.js
+var LruMap2;
+var init_lru2 = __esm({
+  "node_modules/viem/_esm/utils/lru.js"() {
+    "use strict";
+    LruMap2 = class extends Map {
+      constructor(size4) {
+        super();
+        Object.defineProperty(this, "maxSize", {
+          enumerable: true,
+          configurable: true,
+          writable: true,
+          value: void 0
+        });
+        this.maxSize = size4;
+      }
+      get(key) {
+        const value = super.get(key);
+        if (super.has(key)) {
+          super.delete(key);
+          super.set(key, value);
+        }
+        return value;
+      }
+      set(key, value) {
+        if (super.has(key))
+          super.delete(key);
+        super.set(key, value);
+        if (this.maxSize && this.size > this.maxSize) {
+          const firstKey = super.keys().next().value;
+          if (firstKey !== void 0)
+            super.delete(firstKey);
+        }
+        return this;
+      }
+    };
+  }
+});
+
+// node_modules/viem/_esm/utils/address/getAddress.js
+function checksumAddress(address_, chainId) {
+  if (checksumAddressCache.has(`${address_}.${chainId}`))
+    return checksumAddressCache.get(`${address_}.${chainId}`);
+  const hexAddress = chainId ? `${chainId}${address_.toLowerCase()}` : address_.substring(2).toLowerCase();
+  const hash3 = keccak2562(stringToBytes(hexAddress), "bytes");
+  const address3 = (chainId ? hexAddress.substring(`${chainId}0x`.length) : hexAddress).split("");
+  for (let i = 0; i < 40; i += 2) {
+    if (hash3[i >> 1] >> 4 >= 8 && address3[i]) {
+      address3[i] = address3[i].toUpperCase();
+    }
+    if ((hash3[i >> 1] & 15) >= 8 && address3[i + 1]) {
+      address3[i + 1] = address3[i + 1].toUpperCase();
+    }
+  }
+  const result = `0x${address3.join("")}`;
+  checksumAddressCache.set(`${address_}.${chainId}`, result);
+  return result;
+}
+function getAddress(address3, chainId) {
+  if (!isAddress(address3, { strict: false }))
+    throw new InvalidAddressError2({ address: address3 });
+  return checksumAddress(address3, chainId);
+}
+var checksumAddressCache;
+var init_getAddress = __esm({
+  "node_modules/viem/_esm/utils/address/getAddress.js"() {
+    "use strict";
+    init_address();
+    init_toBytes();
+    init_keccak256();
+    init_lru2();
+    init_isAddress();
+    checksumAddressCache = /* @__PURE__ */ new LruMap2(8192);
+  }
+});
+
+// node_modules/viem/_esm/utils/address/isAddress.js
+function isAddress(address3, options) {
+  const { strict = true } = options ?? {};
+  const cacheKey2 = `${address3}.${strict}`;
+  if (isAddressCache.has(cacheKey2))
+    return isAddressCache.get(cacheKey2);
+  const result = (() => {
+    if (!addressRegex2.test(address3))
+      return false;
+    if (address3.toLowerCase() === address3)
+      return true;
+    if (strict)
+      return checksumAddress(address3) === address3;
+    return true;
+  })();
+  isAddressCache.set(cacheKey2, result);
+  return result;
+}
+var addressRegex2, isAddressCache;
+var init_isAddress = __esm({
+  "node_modules/viem/_esm/utils/address/isAddress.js"() {
+    "use strict";
+    init_lru2();
+    init_getAddress();
+    addressRegex2 = /^0x[a-fA-F0-9]{40}$/;
+    isAddressCache = /* @__PURE__ */ new LruMap2(8192);
+  }
+});
+
+// node_modules/viem/_esm/errors/unit.js
+var InvalidDecimalNumberError;
+var init_unit = __esm({
+  "node_modules/viem/_esm/errors/unit.js"() {
+    "use strict";
+    init_base();
+    InvalidDecimalNumberError = class extends BaseError3 {
+      constructor({ value }) {
+        super(`Number \`${value}\` is not a valid decimal number.`, {
+          name: "InvalidDecimalNumberError"
+        });
+      }
+    };
+  }
+});
+
+// node_modules/viem/_esm/utils/unit/parseUnits.js
+function parseUnits(value, decimals) {
+  if (!/^(-?)([0-9]*)\.?([0-9]*)$/.test(value))
+    throw new InvalidDecimalNumberError({ value });
+  let [integer2, fraction = "0"] = value.split(".");
+  const negative = integer2.startsWith("-");
+  if (negative)
+    integer2 = integer2.slice(1);
+  fraction = fraction.replace(/(0+)$/, "");
+  if (decimals === 0) {
+    if (Math.round(Number(`.${fraction}`)) === 1)
+      integer2 = `${BigInt(integer2) + 1n}`;
+    fraction = "";
+  } else if (fraction.length > decimals) {
+    const [left, unit, right] = [
+      fraction.slice(0, decimals - 1),
+      fraction.slice(decimals - 1, decimals),
+      fraction.slice(decimals)
+    ];
+    const rounded = Math.round(Number(`${unit}.${right}`));
+    if (rounded > 9)
+      fraction = `${BigInt(left) + BigInt(1)}0`.padStart(left.length + 1, "0");
+    else
+      fraction = `${left}${rounded}`;
+    if (fraction.length > decimals) {
+      fraction = fraction.slice(1);
+      integer2 = `${BigInt(integer2) + 1n}`;
+    }
+    fraction = fraction.slice(0, decimals);
+  } else {
+    fraction = fraction.padEnd(decimals, "0");
+  }
+  return BigInt(`${negative ? "-" : ""}${integer2}${fraction}`);
+}
+var init_parseUnits = __esm({
+  "node_modules/viem/_esm/utils/unit/parseUnits.js"() {
+    "use strict";
+    init_unit();
+  }
+});
+
+// node_modules/viem/_esm/index.js
+var init_esm3 = __esm({
+  "node_modules/viem/_esm/index.js"() {
+    "use strict";
+    init_getAddress();
+    init_parseUnits();
+  }
+});
+
+// node_modules/mppx/dist/x402/Assets.js
+var Assets_exports = {};
+__export(Assets_exports, {
+  base: () => base,
+  baseSepolia: () => baseSepolia,
+  define: () => define,
+  fromToken: () => fromToken,
+  isAsset: () => isAsset,
+  isRawAddress: () => isRawAddress,
+  isToken: () => isToken,
+  matches: () => matches,
+  resolve: () => resolve,
+  toChainId: () => toChainId,
+  toNetwork: () => toNetwork
+});
+function define(parameters) {
+  return {
+    [knownAsset]: true,
+    address: parameters.address,
+    decimals: parameters.decimals,
+    network: parameters.network,
+    transfer: parameters.transfer
+  };
+}
+function fromToken(token, parameters) {
+  const resolved = token(parameters.chainId);
+  return define({
+    address: resolved.address,
+    decimals: resolved.decimals,
+    network: toNetwork(parameters.chainId),
+    transfer: withTokenDefaults(parameters.transfer, resolved)
+  });
+}
+function isAsset(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  return value[knownAsset] === true;
+}
+function isToken(value) {
+  return typeof value === "function" && typeof value.addresses === "object" && typeof value.decimals === "number";
+}
+function isRawAddress(currency) {
+  return typeof currency === "string";
+}
+function resolve(currency, network) {
+  if (isAsset(currency)) {
+    if (currency.network !== network)
+      return void 0;
+    return {
+      address: currency.address,
+      decimals: currency.decimals,
+      transfer: currency.transfer
+    };
+  }
+  if (isToken(currency)) {
+    const address3 = currency.addresses[toChainId(network)];
+    if (!address3)
+      return void 0;
+    return {
+      address: address3,
+      decimals: currency.decimals,
+      name: currency.name
+    };
+  }
+  return {
+    address: currency
+  };
+}
+function matches(currency, acceptedCurrency, network) {
+  const resolved = resolve(currency, network);
+  if (!resolved)
+    return false;
+  return getAddress(resolved.address) === getAddress(acceptedCurrency);
+}
+function toNetwork(chainId) {
+  return `eip155:${chainId}`;
+}
+function toChainId(network) {
+  return Number(network.slice("eip155:".length));
+}
+function withTokenDefaults(transfer, token) {
+  if (transfer.type !== "eip3009")
+    return transfer;
+  if (transfer.name)
+    return { ...transfer, name: transfer.name };
+  if (!token.name)
+    throw new Error("EIP-3009 token assets require a token name.");
+  return {
+    ...transfer,
+    name: token.name
+  };
+}
+var knownAsset, base, baseSepolia;
+var init_Assets = __esm({
+  "node_modules/mppx/dist/x402/Assets.js"() {
+    "use strict";
+    init_esm3();
+    knownAsset = /* @__PURE__ */ Symbol("mppx.x402.asset");
+    base = {
+      USDC: define({
+        address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+        decimals: 6,
+        network: "eip155:8453",
+        transfer: {
+          // USDC's EIP-712 domain name differs between Base and Base Sepolia.
+          name: "USD Coin",
+          type: "eip3009",
+          version: "2"
+        }
+      })
+    };
+    baseSepolia = {
+      USDC: define({
+        address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+        decimals: 6,
+        network: "eip155:84532",
+        transfer: {
+          // Base Sepolia test USDC signs with the shorter EIP-712 domain name.
+          name: "USDC",
+          type: "eip3009",
+          version: "2"
+        }
+      })
+    };
+  }
+});
+
+// node_modules/mppx/dist/evm/Assets.js
+var Assets_exports2 = {};
+__export(Assets_exports2, {
+  base: () => base,
+  baseSepolia: () => baseSepolia,
+  define: () => define,
+  fromToken: () => fromToken,
+  isAsset: () => isAsset,
+  isRawAddress: () => isRawAddress,
+  isToken: () => isToken,
+  matches: () => matches,
+  resolve: () => resolve,
+  toChainId: () => toChainId,
+  toNetwork: () => toNetwork
+});
+var init_Assets2 = __esm({
+  "node_modules/mppx/dist/evm/Assets.js"() {
+    "use strict";
+    init_Assets();
+  }
+});
+
+// node_modules/mppx/dist/evm/Chains.js
+var Chains_exports = {};
+__export(Chains_exports, {
+  base: () => base2,
+  baseSepolia: () => baseSepolia2
+});
+var base2, baseSepolia2;
+var init_Chains = __esm({
+  "node_modules/mppx/dist/evm/Chains.js"() {
+    "use strict";
+    base2 = 8453;
+    baseSepolia2 = 84532;
+  }
+});
+
+// node_modules/mppx/dist/Method.js
+var Method_exports = {};
+__export(Method_exports, {
+  from: () => from6,
+  toClient: () => toClient,
+  toServer: () => toServer
+});
+function from6(method) {
+  return method;
+}
+function toClient(method, options) {
+  const { canHandleChallenge, context, createCredential } = options;
+  return {
+    ...method,
+    canHandleChallenge,
+    context,
+    createCredential
+  };
+}
+function toServer(method, options) {
+  const { alias, authorize, defaults, extensions, html, preflight, request, respond, stableBinding, transport, verify: verify3 } = options;
+  return {
+    ...method,
+    alias,
+    authorize,
+    defaults,
+    extensions,
+    html,
+    preflight,
+    request,
+    respond,
+    stableBinding,
+    transport,
+    verify: verify3
+  };
+}
+var init_Method = __esm({
+  "node_modules/mppx/dist/Method.js"() {
+    "use strict";
+  }
+});
+
+// node_modules/mppx/dist/evm/Types.js
+var Types_exports = {};
+__export(Types_exports, {
+  AuthorizationConfigSchema: () => AuthorizationConfigSchema,
+  AuthorizationPayloadSchema: () => AuthorizationPayloadSchema,
+  ChargePayloadSchema: () => ChargePayloadSchema,
+  ChargeRequestInputSchema: () => ChargeRequestInputSchema,
+  ChargeRequestSchema: () => ChargeRequestSchema,
+  MethodDetailsSchema: () => MethodDetailsSchema,
+  authorizationDomain: () => authorizationDomain,
+  authorizationTypes: () => authorizationTypes,
+  challengeHash: () => challengeHash,
+  chargeIntent: () => chargeIntent,
+  credentialTypes: () => credentialTypes,
+  eip3009: () => eip3009,
+  evmNetworkPrefix: () => evmNetworkPrefix,
+  networkOf: () => networkOf,
+  paymentMethod: () => paymentMethod,
+  toSource: () => toSource
+});
+function authorizationDomain(parameters) {
+  return {
+    chainId: parameters.chainId,
+    name: parameters.authorization.name,
+    verifyingContract: parameters.currency,
+    version: parameters.authorization.version
+  };
+}
+function challengeHash(challenge) {
+  return Hash_exports.keccak256(Bytes_exports.fromString(`${challenge.id}${challenge.realm}`), {
+    as: "Hex"
+  });
+}
+function networkOf(chainId) {
+  return `${evmNetworkPrefix}${chainId}`;
+}
+function toSource(parameters) {
+  return `did:pkh:eip155:${parameters.chainId}:${parameters.address}`;
+}
+var paymentMethod, chargeIntent, evmNetworkPrefix, eip3009, credentialTypes, atomicAmount, AuthorizationConfigSchema, MethodDetailsSchema, ChargeRequestSchema, ChargeRequestInputSchema, AuthorizationPayloadSchema, ChargePayloadSchema, authorizationTypes;
+var init_Types = __esm({
+  "node_modules/mppx/dist/evm/Types.js"() {
+    "use strict";
+    init_esm2();
+    init_zod();
+    paymentMethod = "evm";
+    chargeIntent = "charge";
+    evmNetworkPrefix = "eip155:";
+    eip3009 = "eip3009";
+    credentialTypes = ["authorization"];
+    atomicAmount = string2().check(_regex(/^\d+$/, "Invalid atomic amount"));
+    AuthorizationConfigSchema = object({
+      name: string2().check(_minLength(1)),
+      version: string2().check(_minLength(1))
+    });
+    MethodDetailsSchema = object({
+      chainId: number2(),
+      credentialTypes: optional(array(_enum2(credentialTypes)).check(_minLength(1))),
+      decimals: optional(number2()),
+      permit2Address: optional(address()),
+      splits: optional(array(object({
+        amount: atomicAmount,
+        recipient: address()
+      })))
+    });
+    ChargeRequestSchema = object({
+      amount: atomicAmount,
+      currency: address(),
+      description: optional(string2()),
+      externalId: optional(string2()),
+      methodDetails: MethodDetailsSchema,
+      recipient: address()
+    });
+    ChargeRequestInputSchema = object({
+      amount: amount(),
+      chainId: number2(),
+      currency: address(),
+      credentialTypes: optional(array(_enum2(credentialTypes)).check(_minLength(1))),
+      decimals: number2(),
+      description: optional(string2()),
+      externalId: optional(string2()),
+      permit2Address: optional(address()),
+      recipient: address(),
+      splits: optional(array(object({
+        amount: atomicAmount,
+        recipient: address()
+      })))
+    });
+    AuthorizationPayloadSchema = object({
+      from: address(),
+      nonce: hash2(),
+      signature: signature(),
+      to: address(),
+      type: literal("authorization"),
+      validAfter: atomicAmount,
+      validBefore: atomicAmount,
+      value: atomicAmount
+    });
+    ChargePayloadSchema = AuthorizationPayloadSchema;
+    authorizationTypes = {
+      TransferWithAuthorization: [
+        { name: "from", type: "address" },
+        { name: "to", type: "address" },
+        { name: "value", type: "uint256" },
+        { name: "validAfter", type: "uint256" },
+        { name: "validBefore", type: "uint256" },
+        { name: "nonce", type: "bytes32" }
+      ]
+    };
+  }
+});
+
+// node_modules/mppx/dist/evm/Methods.js
+var Methods_exports = {};
+__export(Methods_exports, {
+  charge: () => charge
+});
+var charge;
+var init_Methods = __esm({
+  "node_modules/mppx/dist/evm/Methods.js"() {
+    "use strict";
+    init_esm3();
+    init_Method();
+    init_zod();
+    init_Types();
+    charge = from6({
+      name: paymentMethod,
+      intent: chargeIntent,
+      schema: {
+        credential: {
+          payload: ChargePayloadSchema
+        },
+        request: pipe(ChargeRequestInputSchema, transform(({ amount: amount2, chainId, credentialTypes: credentialTypes2 = ["authorization"], currency, decimals, permit2Address, recipient, splits, ...request }) => ({
+          ...request,
+          amount: parseUnits(amount2, decimals).toString(),
+          currency: getAddress(currency),
+          methodDetails: {
+            chainId,
+            credentialTypes: credentialTypes2,
+            decimals,
+            ...permit2Address ? { permit2Address: getAddress(permit2Address) } : {},
+            ...splits ? { splits } : {}
+          },
+          recipient: getAddress(recipient)
+        })))
+      }
+    });
+  }
+});
+
+// node_modules/mppx/dist/evm/index.js
+var evm_exports = {};
+__export(evm_exports, {
+  Assets: () => Assets_exports2,
+  AuthorizationConfigSchema: () => AuthorizationConfigSchema,
+  AuthorizationPayloadSchema: () => AuthorizationPayloadSchema,
+  Chains: () => Chains_exports,
+  ChargePayloadSchema: () => ChargePayloadSchema,
+  ChargeRequestInputSchema: () => ChargeRequestInputSchema,
+  ChargeRequestSchema: () => ChargeRequestSchema,
+  MethodDetailsSchema: () => MethodDetailsSchema,
+  Methods: () => Methods_exports,
+  Types: () => Types_exports,
+  assets: () => Assets_exports2,
+  authorizationDomain: () => authorizationDomain,
+  authorizationTypes: () => authorizationTypes,
+  chains: () => Chains_exports,
+  challengeHash: () => challengeHash,
+  charge: () => charge,
+  chargeIntent: () => chargeIntent,
+  credentialTypes: () => credentialTypes,
+  eip3009: () => eip3009,
+  evmNetworkPrefix: () => evmNetworkPrefix,
+  networkOf: () => networkOf,
+  paymentMethod: () => paymentMethod,
+  toSource: () => toSource
+});
+var init_evm = __esm({
+  "node_modules/mppx/dist/evm/index.js"() {
+    "use strict";
+    init_Assets2();
+    init_Chains();
+    init_Methods();
+    init_Types();
+    init_Assets2();
+    init_Chains();
+    init_Methods();
+    init_Types();
+  }
+});
+
+// node_modules/mppx/dist/Mcp.js
+var Mcp_exports = {};
+__export(Mcp_exports, {
+  credentialMetaKey: () => credentialMetaKey,
+  paymentRequiredCode: () => paymentRequiredCode,
+  paymentRequiredMetaKey: () => paymentRequiredMetaKey,
+  paymentVerificationFailedCode: () => paymentVerificationFailedCode,
+  receiptMetaKey: () => receiptMetaKey
+});
+var paymentRequiredCode, paymentVerificationFailedCode, credentialMetaKey, paymentRequiredMetaKey, receiptMetaKey;
+var init_Mcp = __esm({
+  "node_modules/mppx/dist/Mcp.js"() {
+    "use strict";
+    paymentRequiredCode = -32042;
+    paymentVerificationFailedCode = -32043;
+    credentialMetaKey = "org.paymentauth/credential";
+    paymentRequiredMetaKey = "org.paymentauth/payment-required";
+    receiptMetaKey = "org.paymentauth/receipt";
+  }
+});
+
+// node_modules/mppx/dist/Receipt.js
+var Receipt_exports = {};
+__export(Receipt_exports, {
+  Schema: () => Schema2,
+  deserialize: () => deserialize4,
+  from: () => from7,
+  fromResponse: () => fromResponse2,
+  serialize: () => serialize4
+});
+function deserialize4(encoded) {
+  const json2 = Base64_exports.toString(encoded);
+  return from7(JSON.parse(json2));
+}
+function from7(parameters) {
+  return Schema2.parse(parameters);
+}
+function serialize4(receipt) {
+  const json2 = JSON.stringify(receipt);
+  return Base64_exports.fromString(json2, { pad: false, url: true });
+}
+function fromResponse2(response) {
+  const header = response.headers.get(Headers2.paymentReceipt);
+  if (!header)
+    throw new Error(`Missing ${Headers2.paymentReceipt} header.`);
+  return deserialize4(header);
+}
+var Schema2;
+var init_Receipt = __esm({
+  "node_modules/mppx/dist/Receipt.js"() {
+    "use strict";
+    init_esm2();
+    init_Constants();
+    init_zod();
+    Schema2 = object({
+      /** Payment method used (e.g., "tempo", "stripe"). */
+      method: string2(),
+      /** Method-specific reference (e.g., transaction hash). */
+      reference: string2(),
+      /** Optional external reference ID echoed from the credential payload. */
+      externalId: optional(string2()),
+      /** Optional server-issued subscription identifier for recurring payments. */
+      subscriptionId: optional(string2()),
+      /** Payment status. Always "success" — failures use 402 + Problem Details. */
+      status: literal("success"),
+      /** RFC 3339 settlement timestamp. */
+      timestamp: datetime3()
+    });
+  }
+});
+
+// node_modules/mppx/dist/Store.js
+var Store_exports = {};
+__export(Store_exports, {
+  cloudflare: () => cloudflare,
+  from: () => from8,
+  memory: () => memory,
+  redis: () => redis,
+  upstash: () => upstash
+});
+function from8(store, options) {
+  return withKeyPrefix(store, options?.keyPrefix);
+}
+function withKeyPrefix(store, keyPrefix = "") {
+  if (!keyPrefix)
+    return store;
+  const cached2 = keyPrefixCache.get(store)?.get(keyPrefix);
+  if (cached2)
+    return cached2;
+  const backing = store;
+  const prefixedKey = (key) => `${keyPrefix}${key}`;
+  const prefixed = from8({
+    async get(key) {
+      return backing.get(prefixedKey(key));
+    },
+    async put(key, value) {
+      await backing.put(prefixedKey(key), value);
+    },
+    async delete(key) {
+      await backing.delete(prefixedKey(key));
+    },
+    ..."update" in store ? {
+      async update(key, fn) {
+        return store.update(prefixedKey(key), fn);
+      }
+    } : {}
+  });
+  const cachedByPrefix = keyPrefixCache.get(store) ?? /* @__PURE__ */ new Map();
+  cachedByPrefix.set(keyPrefix, prefixed);
+  keyPrefixCache.set(store, cachedByPrefix);
+  return prefixed;
+}
+function wrapJsonUpdate(update) {
+  if (!update)
+    return {};
+  return {
+    async update(key, fn) {
+      return update(key, (current) => {
+        const parsed = current == null ? null : Json_exports.parse(current);
+        const change = fn(parsed);
+        if (change.op !== "set")
+          return change;
+        return { ...change, value: Json_exports.stringify(change.value) };
+      });
+    }
+  };
+}
+function cloudflare(kv, options) {
+  return from8({
+    async get(key) {
+      const raw = await kv.get(key);
+      if (raw == null)
+        return null;
+      return Json_exports.parse(raw);
     },
     async put(key, value) {
       await kv.put(key, Json_exports.stringify(value));
@@ -20172,9 +21238,9 @@ function cloudflare(kv) {
       await kv.delete(key);
     },
     ...wrapJsonUpdate(kv.update)
-  });
+  }, options);
 }
-function memory() {
+function memory(options) {
   const store = /* @__PURE__ */ new Map();
   return from8({
     async get(key) {
@@ -20198,9 +21264,9 @@ function memory() {
         store.delete(key);
       return change.result;
     }
-  });
+  }, options);
 }
-function redis(client) {
+function redis(client, options) {
   return from8({
     async get(key) {
       const raw = await client.get(key);
@@ -20215,9 +21281,9 @@ function redis(client) {
       await client.del(key);
     },
     ...wrapJsonUpdate(client.update)
-  });
+  }, options);
 }
-function upstash(redis2) {
+function upstash(redis2, options) {
   return from8({
     async get(key) {
       return await redis2.get(key);
@@ -20231,12 +21297,288 @@ function upstash(redis2) {
     ...redis2.update ? {
       update: redis2.update
     } : {}
-  });
+  }, options);
 }
+var keyPrefixCache;
 var init_Store = __esm({
   "node_modules/mppx/dist/Store.js"() {
     "use strict";
     init_esm2();
+    keyPrefixCache = /* @__PURE__ */ new WeakMap();
+  }
+});
+
+// node_modules/mppx/dist/internal/HeaderCodec.js
+function createJson(schema) {
+  return {
+    encode(value) {
+      return Base64_exports.fromString(JSON.stringify(schema.parse(value)));
+    },
+    decode(value) {
+      try {
+        return schema.parse(JSON.parse(Base64_exports.toString(value)));
+      } catch {
+        throw new InvalidJsonHeaderError();
+      }
+    }
+  };
+}
+var InvalidJsonHeaderError;
+var init_HeaderCodec = __esm({
+  "node_modules/mppx/dist/internal/HeaderCodec.js"() {
+    "use strict";
+    init_esm2();
+    InvalidJsonHeaderError = class extends Error {
+      name = "InvalidJsonHeaderError";
+      constructor() {
+        super("Invalid base64 JSON header.");
+      }
+    };
+  }
+});
+
+// node_modules/mppx/dist/x402/Types.js
+var Types_exports2 = {};
+__export(Types_exports2, {
+  ExactEip3009PayloadSchema: () => ExactEip3009PayloadSchema,
+  ExactPayloadSchema: () => ExactPayloadSchema,
+  ExactPermit2PayloadSchema: () => ExactPermit2PayloadSchema,
+  ExactTransferSchema: () => ExactTransferSchema,
+  ExtensionSchema: () => ExtensionSchema,
+  ExtensionsSchema: () => ExtensionsSchema,
+  PaymentPayloadSchema: () => PaymentPayloadSchema,
+  PaymentRequiredSchema: () => PaymentRequiredSchema,
+  PaymentRequirementsSchema: () => PaymentRequirementsSchema,
+  ResourceInfoSchema: () => ResourceInfoSchema,
+  SettleResponseSchema: () => SettleResponseSchema,
+  VerifyResponseSchema: () => VerifyResponseSchema,
+  assetTransferMethods: () => assetTransferMethods,
+  evmNetworkPrefix: () => evmNetworkPrefix2,
+  exactIntent: () => exactIntent,
+  paymentMethod: () => paymentMethod2,
+  paymentRequiredHeader: () => paymentRequiredHeader,
+  paymentResponseHeader: () => paymentResponseHeader,
+  paymentSignatureHeader: () => paymentSignatureHeader,
+  schemes: () => schemes,
+  syntheticChallengeIdPrefix: () => syntheticChallengeIdPrefix,
+  toPaymentRequirements: () => toPaymentRequirements,
+  versions: () => versions
+});
+function toPaymentRequirements(request) {
+  const { extensions: _extensions, resource: _resource, ...paymentRequirements } = request;
+  return PaymentRequirementsSchema.parse(paymentRequirements);
+}
+var versions, paymentMethod2, exactIntent, schemes, assetTransferMethods, evmNetworkPrefix2, syntheticChallengeIdPrefix, paymentRequiredHeader, paymentSignatureHeader, paymentResponseHeader, nonEmptyString, positiveNumber, atomicAmount2, address2, evmNetwork, ResourceInfoSchema, ExactTransferSchema, PaymentRequirementsSchema, ExtensionSchema, ExtensionsSchema, PaymentRequiredSchema, ExactEip3009PayloadSchema, ExactPermit2PayloadSchema, ExactPayloadSchema, PaymentPayloadSchema, VerifyResponseSchema, SettleResponseSchema;
+var init_Types2 = __esm({
+  "node_modules/mppx/dist/x402/Types.js"() {
+    "use strict";
+    init_zod();
+    versions = [2];
+    paymentMethod2 = "evm";
+    exactIntent = "charge";
+    schemes = ["exact"];
+    assetTransferMethods = ["eip3009", "permit2"];
+    evmNetworkPrefix2 = "eip155:";
+    syntheticChallengeIdPrefix = "x402:";
+    paymentRequiredHeader = "PAYMENT-REQUIRED";
+    paymentSignatureHeader = "PAYMENT-SIGNATURE";
+    paymentResponseHeader = "PAYMENT-RESPONSE";
+    nonEmptyString = string2().check(_minLength(1));
+    positiveNumber = number2().check(refine((value) => value > 0, "Must be positive"));
+    atomicAmount2 = string2().check(_regex(/^\d+$/, "Invalid atomic amount"));
+    address2 = address();
+    evmNetwork = string2().check(_regex(new RegExp(`^${evmNetworkPrefix2}\\d+$`), "Invalid EVM CAIP-2 network"));
+    ResourceInfoSchema = object({
+      description: optional(string2()),
+      iconUrl: optional(string2()),
+      mimeType: optional(string2()),
+      serviceName: optional(string2()),
+      tags: optional(array(string2())),
+      url: nonEmptyString
+    });
+    ExactTransferSchema = discriminatedUnion("type", [
+      object({
+        name: nonEmptyString,
+        type: literal("eip3009"),
+        version: nonEmptyString
+      }),
+      object({
+        name: optional(string2()),
+        type: literal("permit2"),
+        version: optional(string2())
+      })
+    ]);
+    PaymentRequirementsSchema = object({
+      amount: atomicAmount2,
+      asset: nonEmptyString,
+      extra: optional(record(string2(), unknown())),
+      maxTimeoutSeconds: positiveNumber,
+      network: evmNetwork,
+      payTo: nonEmptyString,
+      scheme: _enum2(schemes)
+    });
+    ExtensionSchema = object({
+      info: record(string2(), unknown()),
+      schema: record(string2(), unknown())
+    });
+    ExtensionsSchema = record(string2(), ExtensionSchema);
+    PaymentRequiredSchema = object({
+      accepts: array(PaymentRequirementsSchema).check(_minLength(1)),
+      error: optional(string2()),
+      extensions: optional(ExtensionsSchema),
+      resource: ResourceInfoSchema,
+      x402Version: literal(2)
+    });
+    ExactEip3009PayloadSchema = object({
+      authorization: object({
+        from: address2,
+        nonce: hash2(),
+        to: address2,
+        validAfter: atomicAmount2,
+        validBefore: atomicAmount2,
+        value: atomicAmount2
+      }),
+      signature: signature()
+    });
+    ExactPermit2PayloadSchema = object({
+      permit2Authorization: object({
+        deadline: atomicAmount2,
+        from: address2,
+        nonce: atomicAmount2,
+        permitted: object({
+          amount: atomicAmount2,
+          token: address2
+        }),
+        spender: address2,
+        witness: object({
+          to: address2,
+          validAfter: atomicAmount2
+        })
+      }),
+      signature: signature()
+    });
+    ExactPayloadSchema = union([ExactEip3009PayloadSchema, ExactPermit2PayloadSchema]);
+    PaymentPayloadSchema = object({
+      accepted: PaymentRequirementsSchema,
+      extensions: optional(ExtensionsSchema),
+      payload: ExactPayloadSchema,
+      resource: optional(ResourceInfoSchema),
+      x402Version: literal(2)
+    });
+    VerifyResponseSchema = object({
+      extensions: optional(ExtensionsSchema),
+      extra: optional(record(string2(), unknown())),
+      invalidMessage: optional(string2()),
+      invalidReason: optional(string2()),
+      isValid: boolean2(),
+      payer: optional(string2())
+    });
+    SettleResponseSchema = object({
+      amount: optional(atomicAmount2),
+      errorMessage: optional(string2()),
+      errorReason: optional(string2()),
+      extensions: optional(ExtensionsSchema),
+      extra: optional(record(string2(), unknown())),
+      network: nonEmptyString,
+      payer: optional(string2()),
+      success: boolean2(),
+      transaction: string2()
+    });
+  }
+});
+
+// node_modules/mppx/dist/x402/Header.js
+var Header_exports = {};
+__export(Header_exports, {
+  decodePaymentRequired: () => decodePaymentRequired,
+  decodePaymentRequiredEnvelope: () => decodePaymentRequiredEnvelope,
+  decodePaymentResponse: () => decodePaymentResponse,
+  decodePaymentSignature: () => decodePaymentSignature,
+  encodePaymentRequired: () => encodePaymentRequired,
+  encodePaymentResponse: () => encodePaymentResponse,
+  encodePaymentSignature: () => encodePaymentSignature
+});
+function decodePaymentRequiredEnvelope(value) {
+  try {
+    const parsed = JSON.parse(Base64_exports.toString(value));
+    return parsePaymentRequiredEnvelope(parsed);
+  } catch {
+    throw new InvalidJsonHeaderError();
+  }
+}
+var paymentRequired, paymentSignature, paymentResponse, encodePaymentRequired, decodePaymentRequired, encodePaymentSignature, decodePaymentSignature, encodePaymentResponse, decodePaymentResponse, parsePaymentRequiredEnvelope;
+var init_Header = __esm({
+  "node_modules/mppx/dist/x402/Header.js"() {
+    "use strict";
+    init_esm2();
+    init_HeaderCodec();
+    init_Types2();
+    paymentRequired = createJson(PaymentRequiredSchema);
+    paymentSignature = createJson(PaymentPayloadSchema);
+    paymentResponse = createJson(SettleResponseSchema);
+    encodePaymentRequired = paymentRequired.encode;
+    decodePaymentRequired = paymentRequired.decode;
+    encodePaymentSignature = paymentSignature.encode;
+    decodePaymentSignature = paymentSignature.decode;
+    encodePaymentResponse = paymentResponse.encode;
+    decodePaymentResponse = paymentResponse.decode;
+    parsePaymentRequiredEnvelope = (value) => {
+      if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new InvalidJsonHeaderError();
+      const record2 = value;
+      if (record2.x402Version !== 2 || !Array.isArray(record2.accepts))
+        throw new InvalidJsonHeaderError();
+      const resource = ResourceInfoSchema.parse(record2.resource);
+      const extensions = record2.extensions === void 0 ? void 0 : ExtensionsSchema.parse(record2.extensions);
+      return {
+        accepts: record2.accepts,
+        ...extensions ? { extensions } : {},
+        resource,
+        x402Version: 2
+      };
+    };
+  }
+});
+
+// node_modules/mppx/dist/x402/index.js
+var x402_exports = {};
+__export(x402_exports, {
+  Assets: () => Assets_exports,
+  ExactEip3009PayloadSchema: () => ExactEip3009PayloadSchema,
+  ExactPayloadSchema: () => ExactPayloadSchema,
+  ExactPermit2PayloadSchema: () => ExactPermit2PayloadSchema,
+  ExactTransferSchema: () => ExactTransferSchema,
+  ExtensionSchema: () => ExtensionSchema,
+  ExtensionsSchema: () => ExtensionsSchema,
+  Header: () => Header_exports,
+  PaymentPayloadSchema: () => PaymentPayloadSchema,
+  PaymentRequiredSchema: () => PaymentRequiredSchema,
+  PaymentRequirementsSchema: () => PaymentRequirementsSchema,
+  ResourceInfoSchema: () => ResourceInfoSchema,
+  SettleResponseSchema: () => SettleResponseSchema,
+  Types: () => Types_exports2,
+  VerifyResponseSchema: () => VerifyResponseSchema,
+  assetTransferMethods: () => assetTransferMethods,
+  assets: () => Assets_exports,
+  evmNetworkPrefix: () => evmNetworkPrefix2,
+  exactIntent: () => exactIntent,
+  paymentMethod: () => paymentMethod2,
+  paymentRequiredHeader: () => paymentRequiredHeader,
+  paymentResponseHeader: () => paymentResponseHeader,
+  paymentSignatureHeader: () => paymentSignatureHeader,
+  schemes: () => schemes,
+  syntheticChallengeIdPrefix: () => syntheticChallengeIdPrefix,
+  toPaymentRequirements: () => toPaymentRequirements,
+  versions: () => versions
+});
+var init_x402 = __esm({
+  "node_modules/mppx/dist/x402/index.js"() {
+    "use strict";
+    init_Assets();
+    init_Header();
+    init_Types2();
+    init_Assets();
+    init_Types2();
   }
 });
 
@@ -20245,6 +21587,7 @@ var dist_exports = {};
 __export(dist_exports, {
   BodyDigest: () => BodyDigest_exports,
   Challenge: () => Challenge_exports,
+  Constants: () => Constants_exports,
   Credential: () => Credential_exports,
   Errors: () => Errors_exports2,
   Expires: () => Expires_exports,
@@ -20253,6 +21596,8 @@ __export(dist_exports, {
   PaymentRequest: () => PaymentRequest_exports,
   Receipt: () => Receipt_exports,
   Store: () => Store_exports,
+  evm: () => evm_exports,
+  x402: () => x402_exports,
   z: () => zod_exports
 });
 var init_dist2 = __esm({
@@ -20260,14 +21605,17 @@ var init_dist2 = __esm({
     "use strict";
     init_BodyDigest();
     init_Challenge();
+    init_Constants();
     init_Credential();
     init_Errors2();
     init_Expires();
+    init_evm();
     init_Mcp();
     init_Method();
     init_PaymentRequest();
     init_Receipt();
     init_Store();
+    init_x402();
     init_zod();
   }
 });
@@ -20295,12 +21643,20 @@ var init_usdc = __esm({
 });
 
 // src/payment/wwwauthenticate.ts
-function paymentRequiredHeader({
+function paymentRequiredHeader2({
   x402Version,
   accepts,
-  resource
+  resource,
+  extensions
 }) {
-  return Buffer.from(JSON.stringify({ x402Version, accepts, ...resource ? { resource } : {} })).toString("base64");
+  return Buffer.from(
+    JSON.stringify({
+      x402Version,
+      accepts,
+      ...resource ? { resource } : {},
+      ...extensions && Object.keys(extensions).length > 0 ? { extensions } : {}
+    })
+  ).toString("base64");
 }
 var init_wwwauthenticate = __esm({
   "src/payment/wwwauthenticate.ts"() {
@@ -20595,7 +21951,7 @@ function buildDiscoveryProbeResponse(opts) {
   if (opts.x402Sample) {
     const x402Version = opts.x402Sample.version ?? 2;
     const sampleAccepts = opts.x402Sample.accepts ?? (opts.x402Sample.networks ?? []).map((n) => sampleX402AcceptForNetwork(n, opts.x402Sample.amountAtomic ?? "1000000")).filter((e) => e !== null);
-    headers["payment-required"] = paymentRequiredHeader({
+    headers["payment-required"] = paymentRequiredHeader2({
       x402Version,
       accepts: sampleAccepts,
       ...opts.x402Sample.resourceUrl ? { resource: { url: opts.x402Sample.resourceUrl, mimeType: "application/json" } } : {}
@@ -20860,6 +22216,7 @@ __export(index_exports, {
   AGENTSCORE_CANONICAL_ISSUER: () => AGENTSCORE_CANONICAL_ISSUER,
   AGENTSCORE_UCP_CAPABILITY: () => AGENTSCORE_UCP_CAPABILITY,
   AGENT_IDENTITY_HEADER: () => AGENT_IDENTITY_HEADER,
+  AIP_A2A_EXTENSION_URI: () => AIP_A2A_EXTENSION_URI,
   AIP_COVERED_COMPONENTS: () => AIP_COVERED_COMPONENTS,
   AIP_SIGNATURE_TAG: () => AIP_SIGNATURE_TAG,
   Checkout: () => Checkout,
@@ -20868,15 +22225,18 @@ __export(index_exports, {
   HARD_MAX_CACHE_SECONDS: () => HARD_MAX_CACHE_SECONDS,
   JWKS_WELL_KNOWN_PATH: () => JWKS_WELL_KNOWN_PATH,
   JwksCache: () => JwksCache,
+  MAX_POP_WINDOW_SECONDS: () => MAX_POP_WINDOW_SECONDS,
   UCPSigningKey: () => UCPSigningKey,
   UCPVerificationError: () => UCPVerificationError,
   UCP_A2A_EXTENSION_URI: () => UCP_A2A_EXTENSION_URI,
+  aipA2AExtension: () => aipA2AExtension,
   aipErrorCode: () => aipErrorCode,
   aipErrorStatus: () => aipErrorStatus,
   buildA2AAgentCard: () => buildA2AAgentCard,
   buildAgentMemoryHint: () => buildAgentMemoryHint,
   buildAipErrorBody: () => buildAipErrorBody,
   buildAipTrustedIssuers: () => buildAipTrustedIssuers,
+  buildAipWeakAuthBody: () => buildAipWeakAuthBody,
   buildContactSupportNextSteps: () => buildContactSupportNextSteps,
   buildDefaultCheckoutRails: () => buildDefaultCheckoutRails,
   buildGateFromPolicy: () => buildGateFromPolicy,
@@ -20887,12 +22247,15 @@ __export(index_exports, {
   buildVerificationRequiredBody: () => buildVerificationRequiredBody,
   buildVerifyContextFromRequest: () => buildVerifyContextFromRequest,
   canonicalizeIssuer: () => canonicalizeIssuer,
+  checkTrustRequirements: () => checkTrustRequirements,
   computeFirstCheckout: () => computeFirstCheckout,
   createDefaultOnDenied: () => createDefaultOnDenied,
   createQuoteCache: () => createQuoteCache,
   defaultReadOnlyOnDenied: () => defaultReadOnlyOnDenied,
   denialReasonStatus: () => denialReasonStatus,
   denialReasonToBody: () => denialReasonToBody,
+  evaluateAipParts: () => evaluateAipParts,
+  evaluateAipRequest: () => evaluateAipRequest,
   extractOwnerScope: () => extractOwnerScope,
   extractPaymentSigner: () => extractPaymentSigner,
   extractPaymentSignerFromAuth: () => extractPaymentSignerFromAuth,
@@ -20913,6 +22276,7 @@ __export(index_exports, {
   loadUCPSigningKeyFromEnv: () => loadUCPSigningKeyFromEnv,
   makeMppxComposeHook: () => makeMppxComposeHook,
   mppPaymentHandler: () => mppPaymentHandler,
+  normalizeAddress: () => normalizeAddress,
   pricingResult: () => pricingResult,
   readX402PaymentHeader: () => readX402PaymentHeader,
   runGateWithEnforcement: () => runGateWithEnforcement,
@@ -20964,7 +22328,7 @@ function buildSignerMismatchBody({
   learnMoreUrl
 }) {
   if (result.kind === "pass") return null;
-  const learnMoreUrlResolved = learnMoreUrl ?? "https://docs.agentscore.sh/guides/agent-identity";
+  const learnMoreUrlResolved = learnMoreUrl ?? "https://docs.agentscore.com/guides/agent-identity";
   if (result.kind === "wallet_signer_mismatch") {
     const linkedWallets = result.linkedWallets ?? [];
     const userMessageResolved = userMessage ?? (linkedWallets.length > 0 ? `Sign the payment with one of the wallets linked to this operator: ${linkedWallets.join(", ")}. Then retry.` : "Sign the payment with the same wallet you claimed via X-Wallet-Address, or switch to X-Operator-Token for rail-independent identity.");
@@ -21014,7 +22378,7 @@ function verificationAgentInstructions({
   extra
 } = {}) {
   const baseSteps = [
-    "Present the verify_url directly to the user \u2014 it is a complete, ready-to-open URL with the session token already embedded (e.g. https://agentscore.sh/verify?session=sess_...). Do NOT modify or construct the URL yourself.",
+    "Present the verify_url directly to the user \u2014 it is a complete, ready-to-open URL with the session token already embedded (e.g. https://www.agentscore.com/verify?session=sess_...). Do NOT modify or construct the URL yourself.",
     `Immediately begin polling poll_url every ${pollIntervalSeconds} seconds with header X-Poll-Secret set to poll_secret. The user will complete verification in their browser while you poll in the background.`,
     "The user visits the URL, signs in, completes identity verification (photo ID + selfie via Stripe Identity), and closes the tab. They do NOT need to copy or paste anything back to you.",
     'When your poll returns status "verified", extract operator_token from the response. This is a one-time value \u2014 save it immediately. Subsequent polls return status "consumed" without the token.',
@@ -21063,7 +22427,7 @@ var IDENTITY_VERIFICATION_REQUIRED_FALLBACK_INSTRUCTIONS = JSON.stringify({
 var API_ERROR_INSTRUCTIONS = JSON.stringify({
   action: "retry_with_backoff",
   steps: [
-    "Verification is temporarily unavailable. Retry the request after 5\u201330 seconds with exponential backoff.",
+    "Verification is temporarily unavailable. Retry the request after 5-30 seconds with exponential backoff.",
     "This is NOT a compliance denial \u2014 the user does not need to re-verify their identity. Send the same identity headers (X-Wallet-Address or X-Operator-Token) on retry.",
     "If the request continues to fail after 3+ retries (~60 seconds total), surface the error to the user with the merchant's support contact."
   ],
@@ -21166,12 +22530,12 @@ function denialReasonToBody(reason) {
 
 // src/address.ts
 var SOLANA_BASE58_RE = /^[1-9A-HJ-NP-Za-km-z]{32,44}$/;
-var isSolanaAddress = (address2) => SOLANA_BASE58_RE.test(address2) && !address2.startsWith("0x");
-var normalizeAddress = (address2) => {
-  if (isSolanaAddress(address2)) {
-    return address2;
+var isSolanaAddress = (address3) => SOLANA_BASE58_RE.test(address3) && !address3.startsWith("0x");
+var normalizeAddress = (address3) => {
+  if (isSolanaAddress(address3)) {
+    return address3;
   }
-  return address2.toLowerCase();
+  return address3.toLowerCase();
 };
 
 // src/cache.ts
@@ -21230,7 +22594,7 @@ function stripTrailingSlashes(s) {
   while (end > 0 && s.charCodeAt(end - 1) === 47) end--;
   return end === s.length ? s : s.slice(0, end);
 }
-var CANONICAL_AGENTSCORE_API = "https://api.agentscore.sh";
+var CANONICAL_AGENTSCORE_API = "https://api.agentscore.com";
 var WALLET_SIGNER_MISMATCH_INSTRUCTIONS = JSON.stringify({
   action: "resign_or_switch_to_operator_token",
   steps: [
@@ -21262,7 +22626,7 @@ function buildAgentMemoryHint(aipTrustedIssuers) {
   return {
     save_for_future_agentscore_gates: true,
     pattern_summary: "AgentScore is a cross-merchant identity substrate for agent commerce. Any endpoint that returns 403 missing_identity / identity_verification_required or 402 challenges referencing AgentScore uses the same identity system. One KYC works across all AgentScore merchants \u2014 no re-verification per site. Save this pattern (and the endpoints below) to persistent memory so future AgentScore encounters skip the cold-start session flow.",
-    quickstart: "https://docs.agentscore.sh/guides/agent-identity",
+    quickstart: "https://docs.agentscore.com/guides/agent-identity",
     identity_check_endpoint: `${api}/v1/credentials`,
     identity_paths: {
       wallet: "If paying from a crypto wallet you have used before on any AgentScore merchant, send `X-Wallet-Address: 0x...`. Shortest path; no token lifecycle to manage.",
@@ -21279,7 +22643,7 @@ function buildAgentMemoryHint(aipTrustedIssuers) {
 }
 function createAgentScoreCore(options) {
   if (!options.apiKey) {
-    throw new Error("AgentScore API key is required. Get one at https://agentscore.sh/sign-up");
+    throw new Error("AgentScore API key is required. Get one at https://www.agentscore.com/sign-up");
   }
   const {
     apiKey,
@@ -21290,7 +22654,7 @@ function createAgentScoreCore(options) {
     allowedJurisdictions,
     failOpen = false,
     cacheSeconds = 300,
-    baseUrl: rawBaseUrl = "https://api.agentscore.sh",
+    baseUrl: rawBaseUrl = "https://api.agentscore.com",
     chain: gateChain,
     userAgent,
     createSessionOnMissing,
@@ -21298,7 +22662,7 @@ function createAgentScoreCore(options) {
   } = options;
   const baseUrl = stripTrailingSlashes(rawBaseUrl);
   const agentMemoryHint = buildAgentMemoryHint(aipTrustedIssuers);
-  const defaultUa = `@agent-score/commerce@${"2.5.0"}`;
+  const defaultUa = `@agent-score/commerce@${"2.6.0"}`;
   const userAgentHeader = userAgent ? `${userAgent} (${defaultUa})` : defaultUa;
   const sdk = new import_sdk.AgentScore({ apiKey, baseUrl, userAgent: userAgentHeader });
   const sessionSdkCache = /* @__PURE__ */ new Map();
@@ -21316,7 +22680,6 @@ function createAgentScoreCore(options) {
     return s;
   }
   const cache = new TTLCache(cacheSeconds * 1e3);
-  const lastSignerRaw = /* @__PURE__ */ new Map();
   async function tryMintSessionDenial(ctx) {
     if (!createSessionOnMissing) return void 0;
     try {
@@ -21388,7 +22751,7 @@ function createAgentScoreCore(options) {
           ...aipStep,
           "If you have a wallet AND this merchant accepts a wallet-signing rail (Tempo MPP or x402 \u2014 see openapi.json x-payment-info): send X-Wallet-Address and retry. If the wallet is already linked to an AgentScore operator (via prior SIWE claim or prior captureWallet), this passes in one round trip. If the wallet is unlinked or the account has no KYC, the 403 will include a verify_url \u2014 share it with the user to claim the wallet + complete KYC, then retry.",
           "If step 1 is denied or you already have a stored operator_token (valid + not expired): send X-Operator-Token: opc_... and retry.",
-          "If neither applies: retry with NO identity header. Merchants that auto-create verification sessions (most AgentScore merchants do) return verify_url + session_id + poll_secret in the 403 body \u2014 share verify_url with the user, then poll poll_url every 5s with the X-Poll-Secret header until status=verified (the poll returns a one-time operator_token). If the retry returns the same bare 403, this merchant does not support self-service session bootstrapping \u2014 direct the user to https://agentscore.sh/sign-up to create an AgentScore identity and mint an operator_token from their dashboard (https://agentscore.sh/dashboard/verify). The user hands the opc_... to you, and you retry with X-Operator-Token."
+          "If neither applies: retry with NO identity header. Merchants that auto-create verification sessions (most AgentScore merchants do) return verify_url + session_id + poll_secret in the 403 body \u2014 share verify_url with the user, then poll poll_url every 5s with the X-Poll-Secret header until status=verified (the poll returns a one-time operator_token). If the retry returns the same bare 403, this merchant does not support self-service session bootstrapping \u2014 direct the user to https://www.agentscore.com/sign-up to create an AgentScore identity and mint an operator_token from their dashboard (https://www.agentscore.com/dashboard/verify). The user hands the opc_... to you, and you retry with X-Operator-Token."
         ],
         user_message: "Try X-Wallet-Address first if you have a wallet and the merchant accepts Tempo/x402; fall back to a stored X-Operator-Token, then to the session/verify flow described in agent_memory.bootstrap."
       });
@@ -21401,21 +22764,26 @@ function createAgentScoreCore(options) {
         }
       };
     }
-    const cacheKey2 = identity.aipToken ? `aip:${(0, import_node_crypto.createHash)("sha256").update(identity.aipToken).digest("hex")}` : identity.operatorToken?.toLowerCase() ?? (identity.address ? normalizeAddress(identity.address) : "");
+    const identityKey = identity.aipToken ? `aip:${(0, import_node_crypto.createHash)("sha256").update(identity.aipToken).digest("hex")}` : identity.operatorToken?.toLowerCase() ?? (identity.address ? normalizeAddress(identity.address) : "");
+    const cacheKey2 = signer ? JSON.stringify([identityKey, signer.network, normalizeAddress(signer.address)]) : JSON.stringify([identityKey]);
     const cached2 = cache.get(cacheKey2);
     if (cached2) {
+      const cachedVerdict = cached2.raw ? buildSignerVerdict(identity, cached2.raw) : void 0;
       if (cached2.allow) {
         const cachedRaw = cached2.raw;
         const cachedQuota = cachedRaw?.quota;
         return {
           kind: "allow",
           data: cachedRaw,
-          ...cachedQuota !== void 0 && { quota: cachedQuota }
+          ...cachedQuota !== void 0 && { quota: cachedQuota },
+          ...cachedVerdict !== void 0 && { signerVerdict: cachedVerdict }
         };
       }
       if (isFixableDenial(cached2.reasons)) {
         const sessionReason = await tryMintSessionDenial(ctx);
-        if (sessionReason) return { kind: "deny", reason: sessionReason };
+        if (sessionReason) {
+          return { kind: "deny", reason: sessionReason, ...cachedVerdict !== void 0 && { signerVerdict: cachedVerdict } };
+        }
       }
       return {
         kind: "deny",
@@ -21425,7 +22793,8 @@ function createAgentScoreCore(options) {
           reasons: cached2.reasons,
           verify_url: cached2.raw?.verify_url,
           data: cached2.raw
-        }
+        },
+        ...cachedVerdict !== void 0 && { signerVerdict: cachedVerdict }
       };
     }
     const policy = {};
@@ -21446,7 +22815,10 @@ function createAgentScoreCore(options) {
         // regardless of policy.require_sanctions_clear (which gates the separate NAME screen).
         ...signer && { signer: { address: signer.address, network: signer.network } }
       };
-      const result = identity.aipToken ? await sdk.assess(null, { ...opts, aipToken: identity.aipToken }) : identity.address ? await sdk.assess(identity.address, { ...opts, operatorToken: identity.operatorToken }) : await sdk.assess(null, { ...opts, operatorToken: identity.operatorToken });
+      if (identity.aipToken !== void 0 && identity.aipSignature === void 0) {
+        throw new Error("AgentScoreCore.evaluate: aipToken requires aipSignature (RFC 9421 proof-of-possession material).");
+      }
+      const result = identity.aipToken !== void 0 && identity.aipSignature !== void 0 ? await sdk.assess(null, { ...opts, aipToken: identity.aipToken, aipSignature: identity.aipSignature }) : identity.address ? await sdk.assess(identity.address, { ...opts, operatorToken: identity.operatorToken }) : await sdk.assess(null, { ...opts, operatorToken: identity.operatorToken });
       data = result;
     } catch (err) {
       if (err instanceof import_sdk.PaymentRequiredError) {
@@ -21517,20 +22889,21 @@ function createAgentScoreCore(options) {
     const decisionReasons = data.decision_reasons ?? [];
     const allow = decision === "allow" || decision == null;
     cache.set(cacheKey2, { allow, decision: decision ?? void 0, reasons: decisionReasons, raw: data });
-    if (identity.address !== void 0 && identity.operatorToken === void 0 && identity.aipToken === void 0 && (data.signer_match !== void 0 || data.signer_sanctions !== void 0)) {
-      lastSignerRaw.set(normalizeAddress(identity.address), data);
-    }
+    const signerVerdict = buildSignerVerdict(identity, data);
     if (allow) {
       const quota = data.quota;
       return {
         kind: "allow",
         data,
-        ...quota !== void 0 && { quota }
+        ...quota !== void 0 && { quota },
+        ...signerVerdict !== void 0 && { signerVerdict }
       };
     }
     if (isFixableDenial(decisionReasons)) {
       const sessionReason = await tryMintSessionDenial(ctx);
-      if (sessionReason) return { kind: "deny", reason: sessionReason };
+      if (sessionReason) {
+        return { kind: "deny", reason: sessionReason, ...signerVerdict !== void 0 && { signerVerdict } };
+      }
     }
     return {
       kind: "deny",
@@ -21540,7 +22913,8 @@ function createAgentScoreCore(options) {
         reasons: decisionReasons,
         verify_url: data.verify_url,
         data
-      }
+      },
+      ...signerVerdict !== void 0 && { signerVerdict }
     };
   }
   async function captureWallet(options2) {
@@ -21582,20 +22956,21 @@ function createAgentScoreCore(options) {
       agentInstructions: sm.agent_instructions ?? WALLET_SIGNER_MISMATCH_INSTRUCTIONS
     };
   }
-  function getSignerVerdict(claimedAddress) {
-    const claimedNorm = normalizeAddress(claimedAddress);
-    const raw = lastSignerRaw.get(claimedNorm) ?? cache.get(claimedNorm)?.raw;
-    if (!raw) return void 0;
+  function buildSignerVerdict(identity, raw) {
+    if (identity.address === void 0 || identity.operatorToken !== void 0 || identity.aipToken !== void 0) {
+      return void 0;
+    }
     const rawMatch = raw.signer_match;
     const rawSanctions = raw.signer_sanctions;
     if (!rawMatch && !rawSanctions) return void 0;
+    const claimedNorm = normalizeAddress(identity.address);
     const signerNorm = rawMatch?.actual_signer ?? claimedNorm;
     return {
       signer_match: rawMatch ? projectSignerMatch(rawMatch, claimedNorm, signerNorm) : null,
       signer_sanctions: rawSanctions ?? null
     };
   }
-  return { evaluate, captureWallet, getSignerVerdict };
+  return { evaluate, captureWallet };
 }
 
 // src/_headers.ts
@@ -21707,6 +23082,7 @@ var DEFAULT_TRANSPORT = "JSONRPC";
 var DEFAULT_INPUT_MODE = "application/json";
 var DEFAULT_OUTPUT_MODE = "application/json";
 var UCP_A2A_EXTENSION_URI = "https://ucp.dev/2026-04-08/specification/reference";
+var AIP_A2A_EXTENSION_URI = "https://www.agentscore.com/.well-known/agent-identity";
 function ucpA2AExtension(capabilities = {}, options = {}) {
   return {
     uri: UCP_A2A_EXTENSION_URI,
@@ -21715,6 +23091,20 @@ function ucpA2AExtension(capabilities = {}, options = {}) {
     params: { capabilities }
   };
 }
+function aipA2AExtension(opts = {}) {
+  return {
+    uri: AIP_A2A_EXTENSION_URI,
+    description: "AIP support: present an Agent Identity Token (JWT) in an Agent-Identity header plus an RFC 9421 HTTP Message Signature (over @method @authority @path agent-identity) proving possession of the token-bound cnf key. `agentscore-pay pay --identity aip` attaches it automatically.",
+    required: opts.required ?? false,
+    params: {
+      header: "Agent-Identity",
+      signature: "RFC 9421",
+      ...opts.trustedIssuers !== void 0 && opts.trustedIssuers.length > 0 && { trusted_issuers: opts.trustedIssuers },
+      ...opts.requiredTrustLevel !== void 0 && { required_trust_level: opts.requiredTrustLevel },
+      ...opts.requiredAmr !== void 0 && opts.requiredAmr.length > 0 && { required_amr: opts.requiredAmr }
+    }
+  };
+}
 function buildA2AAgentCard(input) {
   if (!input.skills || input.skills.length === 0) {
     throw new Error(
@@ -21781,26 +23171,45 @@ var CheckoutValidationError = class extends Error {
 };
 
 // src/identity/policy.ts
-function buildGateFromPolicy(policy, base) {
+function buildGateFromPolicy(policy, base3) {
   if (!policy || !policy.enforcement) return null;
   return {
-    apiKey: base.apiKey,
-    ...base.baseUrl !== void 0 && { baseUrl: base.baseUrl },
+    apiKey: base3.apiKey,
+    ...base3.baseUrl !== void 0 && { baseUrl: base3.baseUrl },
     ...policy.requireKyc !== void 0 && { requireKyc: policy.requireKyc },
     ...policy.requireSanctionsClear !== void 0 && {
       requireSanctionsClear: policy.requireSanctionsClear
     },
     ...policy.minAge !== void 0 && { minAge: policy.minAge },
+    ...policy.blockedJurisdictions !== void 0 && {
+      blockedJurisdictions: [...policy.blockedJurisdictions]
+    },
     ...policy.allowedJurisdictions !== void 0 && {
       allowedJurisdictions: [...policy.allowedJurisdictions]
     }
   };
 }
+var SANCTIONS_DENIAL_REASONS = /* @__PURE__ */ new Set([
+  "sanctions_flagged",
+  "sanctions_check_unavailable"
+]);
+function isSanctionsDenial(body) {
+  if (!body || typeof body !== "object") return false;
+  for (const key of ["reasons", "decision_reasons"]) {
+    const raw = body[key];
+    if (Array.isArray(raw) && raw.some((r) => typeof r === "string" && SANCTIONS_DENIAL_REASONS.has(r))) {
+      return true;
+    }
+  }
+  const error51 = body.error;
+  const code = error51 && typeof error51 === "object" ? error51.code : void 0;
+  return typeof code === "string" && SANCTIONS_DENIAL_REASONS.has(code);
+}
 async function runGateWithEnforcement(enforcement, runGate) {
   if (!runGate || !enforcement) return { status: "anonymous" };
   const outcome = await runGate();
   if (outcome.ok) return { status: "verified" };
-  if (enforcement === "hard") {
+  if (enforcement === "hard" || isSanctionsDenial(outcome.body)) {
     return {
       status: "denied",
       denialStatus: outcome.status,
@@ -21890,7 +23299,7 @@ function extractOwnerScope(input) {
   const walletAddress = readHeader(headers, "x-wallet-address");
   const operatorToken = readHeader(headers, "x-operator-token");
   return {
-    ...walletAddress ? { walletAddress } : {},
+    ...walletAddress ? { walletAddress: normalizeAddress(walletAddress) } : {},
     ...operatorToken ? { operatorTokenHash: hashOperatorToken(operatorToken) } : {}
   };
 }
@@ -21960,6 +23369,7 @@ var bytesToB64 = (bytes) => {
 var AIP_COVERED_COMPONENTS = ["@method", "@authority", "@path", "agent-identity"];
 var AIP_SIGNATURE_TAG = "agent-identity";
 var DEFAULT_MAX_SKEW_SECONDS = 60;
+var MAX_POP_WINDOW_SECONDS = 120;
 var normalizeAuthority = (authority) => {
   const lower = authority.trim().toLowerCase();
   const colon = lower.lastIndexOf(":");
@@ -22010,7 +23420,7 @@ var serializeParams = (p) => {
   }
   return parts.map((s) => `;${s}`).join("");
 };
-var buildSignatureBase = (params, input) => {
+var buildSignatureBase = (params, input, rawSignatureParams) => {
   const lines = [];
   for (const name of params.components) {
     const value = componentValue(name, input);
@@ -22019,7 +23429,7 @@ var buildSignatureBase = (params, input) => {
     }
     lines.push(`"${name}": ${value}`);
   }
-  const paramsValue = serializeComponentList(params.components) + serializeParams(params);
+  const paramsValue = rawSignatureParams ?? serializeComponentList(params.components) + serializeParams(params);
   lines.push(`"@signature-params": ${paramsValue}`);
   return lines.join("\n");
 };
@@ -22038,19 +23448,12 @@ var parseSignatureInput = (header, tag = AIP_SIGNATURE_TAG) => {
   }
   const parsed = members.map((m) => {
     const params = parseInnerListMember(m.value);
-    return params ? { label: m.label, params } : null;
+    return params ? { label: m.label, params, rawParams: m.value } : null;
   }).filter((x) => x !== null);
   if (parsed.length === 0) {
     return null;
   }
-  const tagged = parsed.find((p) => p.params.tag === tag);
-  if (tagged) {
-    return tagged;
-  }
-  if (parsed.length === 1 && parsed[0].params.tag === void 0) {
-    return parsed[0];
-  }
-  return null;
+  return parsed.find((p) => p.params.tag === tag) ?? null;
 };
 var parseSignatureValue = (header, label) => {
   const members = splitDictionary(header);
@@ -22164,7 +23567,7 @@ var verifyMessageSignature = async (input) => {
   if (!selected) {
     return { ok: false, reason: "no_aip_signature" };
   }
-  const { label, params } = selected;
+  const { label, params, rawParams } = selected;
   if (params.alg !== void 0 && !["ed25519", "eddsa"].includes(params.alg.toLowerCase())) {
     return { ok: false, reason: "unsupported_alg" };
   }
@@ -22173,12 +23576,21 @@ var verifyMessageSignature = async (input) => {
       return { ok: false, reason: "missing_covered_component" };
     }
   }
+  if (params.created === void 0) {
+    return { ok: false, reason: "created_missing" };
+  }
+  if (params.expires === void 0) {
+    return { ok: false, reason: "expires_missing" };
+  }
+  if (params.expires < params.created || params.expires - params.created > MAX_POP_WINDOW_SECONDS) {
+    return { ok: false, reason: "pop_window_too_long" };
+  }
   const now = input.now ?? Math.floor(Date.now() / 1e3);
   const skew = input.maxSkewSeconds ?? DEFAULT_MAX_SKEW_SECONDS;
-  if (params.created !== void 0 && params.created > now + skew) {
+  if (params.created > now + skew) {
     return { ok: false, reason: "created_in_future" };
   }
-  if (params.expires !== void 0 && params.expires < now - skew) {
+  if (params.expires < now - skew) {
     return { ok: false, reason: "expired" };
   }
   if (!params.keyid) {
@@ -22201,15 +23613,15 @@ var verifyMessageSignature = async (input) => {
   if (!sig) {
     return { ok: false, reason: "malformed_signature" };
   }
-  let base;
+  let base3;
   try {
-    base = buildSignatureBase(params, {
+    base3 = buildSignatureBase(params, {
       method: input.method,
       authority: input.authority,
       path: input.path,
       agentIdentity: input.agentIdentity,
       extra: input.extraComponents
-    });
+    }, rawParams);
   } catch (err) {
     if (err instanceof MissingComponentError) {
       return { ok: false, reason: "missing_covered_component" };
@@ -22226,7 +23638,7 @@ var verifyMessageSignature = async (input) => {
       { name: "Ed25519" },
       key,
       sig,
-      new TextEncoder().encode(base)
+      new TextEncoder().encode(base3)
     );
   } catch {
     return { ok: false, reason: "signature_invalid" };
@@ -22245,7 +23657,7 @@ var signMessage = async (input) => {
     keyid,
     tag: AIP_SIGNATURE_TAG
   };
-  const base = buildSignatureBase(params, {
+  const base3 = buildSignatureBase(params, {
     method: input.method,
     authority: input.authority,
     path: input.path,
@@ -22259,7 +23671,7 @@ var signMessage = async (input) => {
   const sigBytes = await subtle.sign(
     "Ed25519",
     key,
-    new TextEncoder().encode(base)
+    new TextEncoder().encode(base3)
   );
   const b64 = bytesToB64(new Uint8Array(sigBytes));
   const signatureInput = `${label}=${serializeComponentList(components)}${serializeParams(params)}`;
@@ -22315,6 +23727,8 @@ var verifyAit = async (ctx, opts) => {
   if (!ctx.signatureInput || !ctx.signature) {
     return { ok: false, reason: "pop_signature_missing" };
   }
+  const signatureInput = ctx.signatureInput;
+  const signature2 = ctx.signature;
   let lastFailure = "malformed_token";
   for (const raw of ctx.agentIdentityHeaders) {
     const token = stripBearer(raw);
@@ -22353,7 +23767,7 @@ var verifyAit = async (ctx, opts) => {
         // Pin the signature algorithm allowlist (RFC 8725 §3.1) — also rejects `alg:none`. Without
         // this, jose accepts whatever alg the resolved JWK supports, so a trusted IdP publishing a
         // non-Ed25519 (e.g. RSA/EC) `use:sig` key would let an attacker present an RS256/ES256
-        // token that verifies. Matches the server-side allowlist in core/api aip-verify.
+        // token that verifies. Matches the server-side allowlist in the AgentScore API verifier.
         algorithms: AIT_SIGNING_ALGS,
         clockTolerance: jwtClockTolerance,
         currentDate: opts.now !== void 0 ? new Date(opts.now * 1e3) : void 0
@@ -22367,13 +23781,20 @@ var verifyAit = async (ctx, opts) => {
       lastFailure = "expired_token";
       continue;
     }
+    if (claims.exp - claims.iat > (opts.maxLifetimeSeconds ?? 300)) {
+      lastFailure = "expired_token";
+      continue;
+    }
     const popResult = await verifyMessageSignature({
       method: ctx.method,
       authority: ctx.authority,
       path: ctx.path,
-      agentIdentity: raw,
-      signatureInput: ctx.signatureInput,
-      signature: ctx.signature,
+      // The agent-identity covered component is the BARE AIT (a Bearer prefix, if present, is
+      // transport that `stripBearer` removed above). Verify over `token`, not `raw`, so the edge and
+      // the API — which verifies over the forwarded bare aip_token — reconstruct the identical base.
+      agentIdentity: token,
+      signatureInput,
+      signature: signature2,
       cnfJwk: claims.cnf.jwk,
       now: opts.now,
       maxSkewSeconds: opts.maxSkewSeconds
@@ -22382,7 +23803,22 @@ var verifyAit = async (ctx, opts) => {
       lastFailure = "pop_signature_invalid";
       continue;
     }
-    return { ok: true, ait: { payload: claims, iss: claims.iss, cnfJwk: claims.cnf.jwk, token } };
+    return {
+      ok: true,
+      ait: {
+        payload: claims,
+        iss: claims.iss,
+        cnfJwk: claims.cnf.jwk,
+        token,
+        signatureMaterial: {
+          method: ctx.method,
+          authority: ctx.authority,
+          path: ctx.path,
+          signature_input: signatureInput,
+          signature: signature2
+        }
+      }
+    };
   }
   return { ok: false, reason: lastFailure };
 };
@@ -22403,11 +23839,11 @@ var readAgentIdentityHeaders = (headers) => {
   return raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 };
 var deriveAuthority = (req, url2) => req.headers.get("host") ?? url2.host;
-var buildVerifyContextFromRequest = (req) => {
+var buildVerifyContextFromRequest = (req, authority) => {
   const url2 = new URL(req.url);
   return {
     method: req.method,
-    authority: deriveAuthority(req, url2),
+    authority: authority ?? deriveAuthority(req, url2),
     path: url2.pathname,
     agentIdentityHeaders: readAgentIdentityHeaders(req.headers),
     signatureInput: req.headers.get("signature-input"),
@@ -22432,7 +23868,12 @@ var buildVerifyContextFromParts = (parts) => {
   const host = parts.authority ?? readNodeHeader(parts.headers, "host") ?? "";
   let path;
   try {
-    path = new URL(parts.url, host ? `http://${host}` : "http://localhost").pathname;
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(parts.url)) {
+      path = new URL(parts.url).pathname;
+    } else {
+      const target = parts.url.startsWith("/") ? parts.url : `/${parts.url}`;
+      path = new URL(`http://${host || "localhost"}${target}`).pathname;
+    }
   } catch {
     const q = parts.url.indexOf("?");
     path = q === -1 ? parts.url : parts.url.slice(0, q);
@@ -22452,8 +23893,12 @@ var verifyFromContext = async (ctx, opts) => {
   const result = await verifyAit(ctx, { jwks: opts.jwks, now: opts.now, maxSkewSeconds: opts.maxSkewSeconds });
   return result.ok ? { ok: true, ait: result.ait } : { ok: false, failure: result.reason };
 };
-var verifyAitRequest = (req, opts) => verifyFromContext(buildVerifyContextFromRequest(req), opts);
-var verifyAitParts = (parts, opts) => verifyFromContext(buildVerifyContextFromParts(parts), opts);
+var partsWithAuthority = (parts, opts) => {
+  const authority = parts.authority ?? opts.authority;
+  return authority !== void 0 ? { ...parts, authority } : parts;
+};
+var verifyAitRequest = (req, opts) => verifyFromContext(buildVerifyContextFromRequest(req, opts.authority), opts);
+var verifyAitParts = (parts, opts) => verifyFromContext(buildVerifyContextFromParts(partsWithAuthority(parts, opts)), opts);
 var aipErrorCode = (failure) => {
   switch (failure) {
     case "no_token":
@@ -22510,21 +23955,116 @@ var aipErrorDetail = (failure) => {
       return "Token verification failed.";
   }
 };
-var buildAipErrorBody = (failure) => {
+var buildAipErrorBody = (failure, requirements) => {
   const code = aipErrorCode(failure);
-  return {
+  const body = {
     type: `urn:aip:error:${code}`,
     title: code.replace(/_/g, " "),
     status: aipErrorStatus(failure),
     detail: aipErrorDetail(failure)
   };
+  if (requirements) {
+    if (code === "untrusted_issuer" && requirements.trustedIssuers?.length) {
+      body.trusted_issuers = requirements.trustedIssuers;
+    }
+    if (code === "insufficient_claims") {
+      if (requirements.requiredClaims?.length) body.required_claims = requirements.requiredClaims;
+      if (requirements.requiredTrustLevel !== void 0) body.required_trust_level = requirements.requiredTrustLevel;
+      if (requirements.requiredAmr?.length) body.required_amr = requirements.requiredAmr;
+    }
+  }
+  return body;
+};
+var aipPolicyDenyCode = (code) => {
+  switch (code) {
+    case "token_expired":
+      return { code: "expired_token", status: 401 };
+    case "invalid_credential":
+      return { code: "invalid_signature", status: 401 };
+    case "api_error":
+      return { code: "idp_unavailable", status: 503 };
+    default:
+      return { code: "insufficient_claims", status: 403 };
+  }
+};
+var buildAipPolicyDenyBody = (code, reasons, body, requirements) => {
+  const spec = aipPolicyDenyCode(code);
+  const reasonList = reasons ?? [];
+  const detail = spec.code === "insufficient_claims" ? reasonList.length > 0 ? `The Agent Identity Token did not attest a passing value for the required compliance claim(s). AgentScore decision: ${code} (${reasonList.join(", ")}).` : `The Agent Identity Token did not satisfy the merchant's compliance policy. AgentScore decision: ${code}.` : `AgentScore decision: ${code}.`;
+  const superset = {
+    type: `urn:aip:error:${spec.code}`,
+    title: spec.code.replace(/_/g, " "),
+    status: spec.status,
+    detail
+  };
+  if (requirements && spec.code === "insufficient_claims") {
+    if (requirements.requiredClaims?.length) superset.required_claims = requirements.requiredClaims;
+    if (requirements.requiredTrustLevel !== void 0) superset.required_trust_level = requirements.requiredTrustLevel;
+    if (requirements.requiredAmr?.length) superset.required_amr = requirements.requiredAmr;
+  }
+  const { type: _type, title: _title, status: _status, detail: _detail, ...rest } = body;
+  return { ...superset, ...rest };
+};
+var TRUST_RANK = { autonomous: 0, human_present: 1, human_confirmed: 2 };
+var checkTrustRequirements = (payload, requiredTrustLevel, requiredAmr) => {
+  if (requiredTrustLevel !== void 0) {
+    const have = TRUST_RANK[payload.trust_level ?? "autonomous"] ?? 0;
+    const need = TRUST_RANK[requiredTrustLevel] ?? 0;
+    if (have < need) {
+      return `This endpoint requires trust_level '${requiredTrustLevel}'; the token asserts '${payload.trust_level ?? "autonomous"}'. Re-mint an AIT at the required trust level (human confirmation).`;
+    }
+  }
+  if (requiredAmr !== void 0 && requiredAmr.length > 0) {
+    const amr = Array.isArray(payload.auth?.amr) ? payload.auth.amr : [];
+    if (!amr.some((m) => requiredAmr.includes(m))) {
+      return `This endpoint requires an authentication method in [${requiredAmr.join(", ")}]; the token carries [${amr.join(", ") || "none"}].`;
+    }
+  }
+  return null;
+};
+var buildAipWeakAuthBody = (opts) => ({
+  type: "urn:aip:error:weak_auth",
+  title: "weak auth",
+  status: 403,
+  detail: opts.detail,
+  ...opts.requiredTrustLevel !== void 0 && { required_trust_level: opts.requiredTrustLevel },
+  ...opts.requiredAmr !== void 0 && opts.requiredAmr.length > 0 && { required_amr: opts.requiredAmr },
+  ...opts.trustedIssuers !== void 0 && opts.trustedIssuers.length > 0 && { trusted_issuers: opts.trustedIssuers }
+});
+var requirementsFromOptions = (opts) => ({
+  ...opts.trustedIssuers !== void 0 && { trustedIssuers: opts.trustedIssuers },
+  ...opts.requiredClaims !== void 0 && { requiredClaims: opts.requiredClaims },
+  ...opts.requireTrustLevel !== void 0 && { requiredTrustLevel: opts.requireTrustLevel },
+  ...opts.requireAmr !== void 0 && { requiredAmr: opts.requireAmr }
+});
+var evaluateFromContext = async (ctx, opts) => {
+  const result = await verifyAit(ctx, { jwks: opts.jwks, now: opts.now, maxSkewSeconds: opts.maxSkewSeconds });
+  if (!result.ok) {
+    return { ok: false, body: buildAipErrorBody(result.reason, requirementsFromOptions(opts)) };
+  }
+  const weak = checkTrustRequirements(result.ait.payload, opts.requireTrustLevel, opts.requireAmr);
+  if (weak !== null) {
+    return {
+      ok: false,
+      body: buildAipWeakAuthBody({
+        detail: weak,
+        ...opts.requireTrustLevel !== void 0 && { requiredTrustLevel: opts.requireTrustLevel },
+        ...opts.requireAmr !== void 0 && { requiredAmr: opts.requireAmr },
+        ...opts.trustedIssuers !== void 0 && { trustedIssuers: opts.trustedIssuers }
+      })
+    };
+  }
+  return { ok: true, ait: result.ait };
 };
+var evaluateAipRequest = (req, opts) => evaluateFromContext(buildVerifyContextFromRequest(req, opts.authority), opts);
+var evaluateAipParts = (parts, opts) => evaluateFromContext(buildVerifyContextFromParts(partsWithAuthority(parts, opts)), opts);
 
 // src/aip/jwks.ts
 var JWKS_WELL_KNOWN_PATH = "/.well-known/agent-identity/jwks.json";
 var HARD_MAX_CACHE_SECONDS = 86400;
 var DEFAULT_CACHE_SECONDS = 300;
-var AGENTSCORE_CANONICAL_ISSUER = "https://agentscore.sh";
+var REFETCH_COOLDOWN_MS = 3e4;
+var AGENTSCORE_CANONICAL_ISSUER = "https://www.agentscore.com";
 var canonicalizeIssuer = (iss) => {
   let url2;
   try {
@@ -22563,6 +24103,12 @@ var JwksCache = class {
   now;
   userAgent;
   cache = /* @__PURE__ */ new Map();
+  /** Per-issuer in-flight refresh promise — coalesces concurrent refreshes to ONE upstream fetch.
+   *  Without it, a concurrent burst of distinct-kid lookups on a cold/expired cache each call
+   *  `refresh()` before any has populated the cache → N parallel JWKS GETs (refetch amplification).
+   *  The cooldown only suppresses SEQUENTIAL refetches; single-flight suppresses CONCURRENT ones.
+   *  Entry is cleared in a `finally` once the fetch settles. */
+  inflight = /* @__PURE__ */ new Map();
   constructor(opts) {
     this.trusted = new Set(
       [AGENTSCORE_CANONICAL_ISSUER, ...opts.trustedIssuers ?? []].map(canonicalizeIssuer).filter((s) => s !== null)
@@ -22594,13 +24140,21 @@ var JwksCache = class {
       if (hit2) {
         return { ok: true, key: hit2 };
       }
+      if (this.now() < cached2.cooldownUntil) {
+        return { ok: false, reason: "key_not_found" };
+      }
+    } else if (cached2 && this.now() < cached2.cooldownUntil) {
+      return { ok: false, reason: cached2.lastFailure ?? "key_not_found" };
     }
     const refreshed = await this.refresh(canon);
     if (!refreshed.ok) {
       return refreshed;
     }
     const hit = this.select(refreshed.keys, kid);
-    return hit ? { ok: true, key: hit } : { ok: false, reason: "key_not_found" };
+    if (hit) {
+      return { ok: true, key: hit };
+    }
+    return { ok: false, reason: "key_not_found" };
   }
   select(keys, kid) {
     const candidates = signingKeys(keys);
@@ -22613,31 +24167,68 @@ var JwksCache = class {
     }
     return candidates.length === 1 ? candidates[0] : void 0;
   }
+  /**
+   * Refresh the cached key set for `canonIssuer`, coalescing concurrent callers onto a single
+   * upstream fetch (single-flight). The first caller for an issuer with no in-flight refresh kicks
+   * off the fetch and registers the promise; concurrent callers await that same promise instead of
+   * issuing their own GET. The entry is cleared once the fetch settles so the NEXT cold/expired
+   * lookup can refresh again.
+   */
   async refresh(canonIssuer) {
+    const existing = this.inflight.get(canonIssuer);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const promise2 = this.fetchAndCache(canonIssuer).finally(() => {
+      this.inflight.delete(canonIssuer);
+    });
+    this.inflight.set(canonIssuer, promise2);
+    return promise2;
+  }
+  async fetchAndCache(canonIssuer) {
     const url2 = `${canonIssuer}${JWKS_WELL_KNOWN_PATH}`;
     let res;
     try {
       res = await this.fetchImpl(url2, { headers: { "User-Agent": this.userAgent, Accept: "application/jwk-set+json, application/json" } });
     } catch {
-      return { ok: false, reason: "fetch_failed" };
+      return this.stampFailure(canonIssuer, "fetch_failed");
     }
     if (!res.ok) {
-      return { ok: false, reason: "fetch_failed" };
+      return this.stampFailure(canonIssuer, "fetch_failed");
     }
     let body;
     try {
       body = await res.json();
     } catch {
-      return { ok: false, reason: "malformed_jwks" };
+      return this.stampFailure(canonIssuer, "malformed_jwks");
     }
     if (typeof body !== "object" || body === null || !Array.isArray(body.keys)) {
-      return { ok: false, reason: "malformed_jwks" };
+      return this.stampFailure(canonIssuer, "malformed_jwks");
     }
     const keys = body.keys;
     const ttlSeconds = resolveCacheSeconds(res.headers.get("cache-control"));
-    this.cache.set(canonIssuer, { keys, expiresAt: this.now() + ttlSeconds * 1e3 });
+    const now = this.now();
+    this.cache.set(canonIssuer, {
+      keys,
+      expiresAt: now + ttlSeconds * 1e3,
+      cooldownUntil: now + REFETCH_COOLDOWN_MS
+    });
     return { ok: true, keys };
   }
+  /** Stamp the per-issuer refetch cooldown on a FAILED fetch attempt (the negative cache). Any
+   *  previously cached keys + expiry are preserved — a failed kid-miss refetch must not nuke a
+   *  still-fresh key set; only the cooldown and failure reason are updated. */
+  stampFailure(canonIssuer, reason) {
+    const now = this.now();
+    const prev = this.cache.get(canonIssuer);
+    this.cache.set(canonIssuer, {
+      keys: prev?.keys ?? [],
+      expiresAt: prev?.expiresAt ?? now,
+      cooldownUntil: now + REFETCH_COOLDOWN_MS,
+      lastFailure: reason
+    });
+    return { ok: false, reason };
+  }
 };
 
 // src/payment/rail_spec.ts
@@ -22822,6 +24413,7 @@ function build402Body({
   if (x402) {
     body.x402Version = x402.version ?? 2;
     body.accepts = x402.accepts;
+    if (x402.resource !== void 0) body.resource = x402.resource;
     if (x402.extensions !== void 0 && Object.keys(x402.extensions).length > 0) {
       body.extensions = x402.extensions;
     }
@@ -22997,7 +24589,7 @@ function respond402({
   const headers = normalizeHeadersToLowercase(mppxChallengeHeaders);
   headers["content-type"] = "application/json";
   if (x402) {
-    headers["payment-required"] = paymentRequiredHeader(x402);
+    headers["payment-required"] = paymentRequiredHeader2(x402);
   }
   return { body, headers, status: 402 };
 }
@@ -23021,6 +24613,29 @@ function buildValidationError({
   return body;
 }
 
+// src/discovery/bazaar.ts
+async function enrichBazaarDiscoveryExtensions(extensions, request) {
+  if (extensions === void 0) return extensions;
+  const bazaar = await dynamicImport("@x402/extensions/bazaar");
+  const ext = bazaar?.bazaarResourceServerExtension;
+  if (!ext?.key || typeof ext.enrichDeclaration !== "function") return extensions;
+  const declaration = extensions[ext.key];
+  if (declaration === void 0) return extensions;
+  const transportContext = {
+    method: request.method,
+    adapter: { getPath: () => request.path },
+    routePattern: request.path
+  };
+  return { ...extensions, [ext.key]: ext.enrichDeclaration(declaration, transportContext) };
+}
+async function dynamicImport(moduleName) {
+  try {
+    return await import(moduleName);
+  } catch {
+    return null;
+  }
+}
+
 // src/payment/constants.ts
 var STRIPE_MIN_CHARGE_USD = 0.5;
 
@@ -23077,7 +24692,7 @@ async function createMppxServer({
   methods: extraMethods,
   secretKey
 }) {
-  const mppx = await dynamicImport("mppx/server");
+  const mppx = await dynamicImport2("mppx/server");
   if (!mppx?.Mppx?.create) {
     throw new Error("mppx not installed \u2014 `npm install mppx` to use createMppxServer.");
   }
@@ -23132,7 +24747,7 @@ async function registerTempoSession(mppx, spec) {
   });
 }
 async function registerSolana(spec) {
-  const solanaMpp = await dynamicImport("@solana/mpp/server");
+  const solanaMpp = await dynamicImport2("@solana/mpp/server");
   if (!solanaMpp?.charge) {
     throw new Error(
       "@solana/mpp not installed \u2014 `npm install @solana/mpp @solana/kit` to use the solana rail."
@@ -23171,7 +24786,7 @@ async function registerStripe(spec) {
     paymentMethodTypes: spec.paymentMethodTypes
   });
 }
-async function dynamicImport(moduleName) {
+async function dynamicImport2(moduleName) {
   try {
     return await import(moduleName);
   } catch {
@@ -23248,7 +24863,7 @@ function registerX402SchemesV1V2(server, network, scheme) {
 
 // src/payment/x402_server.ts
 async function createX402Server(opts = {}) {
-  const x402Core = await dynamicImport2("@x402/core/server") ?? null;
+  const x402Core = await dynamicImport3("@x402/core/server") ?? null;
   if (!x402Core) {
     throw new Error(
       "@x402/core not installed \u2014 `npm install @x402/core` to use createX402Server."
@@ -23257,7 +24872,7 @@ async function createX402Server(opts = {}) {
   let facilitator;
   const facilitatorChoice = opts.facilitator ?? (process.env.CDP_API_KEY_ID && process.env.CDP_API_KEY_SECRET ? "coinbase" : "http");
   if (facilitatorChoice === "coinbase") {
-    const cb = await dynamicImport2("@coinbase/x402");
+    const cb = await dynamicImport3("@coinbase/x402");
     if (!cb?.facilitator) {
       throw new Error(
         '@coinbase/x402 not installed \u2014 `npm install @coinbase/x402` for facilitator: "coinbase".'
@@ -23278,13 +24893,13 @@ async function createX402Server(opts = {}) {
       const baseRail = isUpto ? rail.slice(0, -5) : rail;
       const network = baseRail === "x402-base-mainnet" ? networks.base.mainnet.caip2 : networks.base.sepolia.caip2;
       if (isUpto) {
-        evmUptoModule ??= await dynamicImport2("@x402/evm/upto/server");
+        evmUptoModule ??= await dynamicImport3("@x402/evm/upto/server");
         if (!evmUptoModule?.UptoEvmScheme) {
           throw new Error("@x402/evm not installed \u2014 `npm install @x402/evm` for x402 base upto rails.");
         }
         registerX402SchemesV1V2(server, network, new evmUptoModule.UptoEvmScheme());
       } else {
-        evmExactModule ??= await dynamicImport2("@x402/evm/exact/server");
+        evmExactModule ??= await dynamicImport3("@x402/evm/exact/server");
         if (!evmExactModule?.ExactEvmScheme) {
           throw new Error("@x402/evm not installed \u2014 `npm install @x402/evm` for x402 base rails.");
         }
@@ -23296,7 +24911,7 @@ async function createX402Server(opts = {}) {
     registerX402SchemesV1V2(server, network, scheme);
   }
   if (opts.bazaar) {
-    const bazaar = await dynamicImport2("@x402/extensions/bazaar");
+    const bazaar = await dynamicImport3("@x402/extensions/bazaar");
     if (!bazaar?.bazaarResourceServerExtension) {
       throw new Error(
         "@x402/extensions not installed \u2014 `npm install @x402/extensions` for bazaar discovery."
@@ -23322,7 +24937,7 @@ async function buildX402AcceptsFor402(server, opts) {
   );
   return Array.isArray(requirements) ? requirements : [];
 }
-async function dynamicImport2(moduleName) {
+async function dynamicImport3(moduleName) {
   try {
     return await import(moduleName);
   } catch {
@@ -23499,12 +25114,12 @@ async function processX402Settle({
       enrichedExt,
       resolvedTransportContext
     );
-    const paymentResponseHeader = settleResult ? Buffer.from(JSON.stringify(settleResult)).toString("base64") : void 0;
+    const paymentResponseHeader2 = settleResult ? Buffer.from(JSON.stringify(settleResult)).toString("base64") : void 0;
     return {
       success: true,
       matchedRequirement,
       settleResult,
-      paymentResponseHeader,
+      paymentResponseHeader: paymentResponseHeader2,
       verifyResult
     };
   } catch (err) {
@@ -23746,6 +25361,19 @@ function isStripeRailSpec2(s) {
 function isTempoSessionRailSpec3(s) {
   return "escrowContract" in s && "store" in s;
 }
+function staticRecipient2(r) {
+  return typeof r === "string" && r.length > 0 ? r : null;
+}
+function collectStaticX402Recipients(rails2) {
+  const out = /* @__PURE__ */ new Set();
+  for (const spec of Object.values(rails2)) {
+    if (isStripeRailSpec2(spec) || isTempoSessionRailSpec3(spec)) continue;
+    if (!isEvmNetwork(spec)) continue;
+    const recipient = staticRecipient2(spec.recipient);
+    if (recipient !== null) out.add(recipient.toLowerCase());
+  }
+  return out;
+}
 function specRailKey(spec) {
   if (isStripeRailSpec2(spec)) return "stripe";
   if (isTempoSessionRailSpec3(spec)) return "tempo_mpp";
@@ -23844,6 +25472,16 @@ function buildAipTrustedIssuers(externalIssuers) {
 function aipTrustedIssuerSet(cfg) {
   return buildAipTrustedIssuers(cfg.trustedIssuers);
 }
+function aipRequiredClaims(policy) {
+  const claims = [];
+  if (policy.requireKyc) claims.push("id_verified");
+  if (policy.requireSanctionsClear) claims.push("sanctions_clear");
+  if (policy.minAge != null) claims.push(`age_over_${policy.minAge}`);
+  if (policy.blockedJurisdictions !== void 0 || policy.allowedJurisdictions !== void 0) {
+    claims.push("jurisdiction");
+  }
+  return claims;
+}
 function resolveIssuerPolicy(issuerPolicies, iss) {
   const target = canonicalizeIssuer(iss);
   if (target === null) return void 0;
@@ -23864,9 +25502,14 @@ var Checkout = class {
   mintReferenceId;
   onSettled;
   isCachedAddress;
+  /** Lowercased static recipient addresses for the x402-base rail(s). When the merchant
+   *  configured a static recipient and supplied no `isCachedAddress`, the gate binds the
+   *  agent-supplied `payTo` to this set (anti funds-drain). Empty for pure per-order minting. */
+  x402StaticRecipients;
   zeroSettleCarveOut;
   gate;
   discoveryExtensions;
+  resourceInfo;
   discoveryProbe;
   _x402ServerGetter;
   /** Lazily-built JWKS cache for AIP verification, shared across requests so issuer keys
@@ -23943,9 +25586,11 @@ var Checkout = class {
     this.mintReferenceId = opts.mintReferenceId;
     this.onSettled = opts.onSettled;
     this.isCachedAddress = opts.isCachedAddress;
+    this.x402StaticRecipients = collectStaticX402Recipients(opts.rails);
     this.zeroSettleCarveOut = opts.zeroSettleCarveOut ?? false;
     this.gate = opts.gate;
     this.discoveryExtensions = opts.discoveryExtensions;
+    this.resourceInfo = opts.resourceInfo;
     this.discoveryProbe = opts.discoveryProbe;
   }
   /** Canonical `RailKey` list derived from the configured rails dict. Each
@@ -24170,6 +25815,7 @@ var Checkout = class {
     const operatorToken = headers["x-operator-token"];
     let aipToken;
     let aipIssuer;
+    let aipSignature;
     if (gate.aip !== void 0 && hasAgentIdentityHeaderNode(headers)) {
       const aipResult = await verifyAitParts(
         {
@@ -24184,7 +25830,11 @@ var Checkout = class {
         }
       );
       if (!aipResult.ok) {
-        const body2 = buildAipErrorBody(aipResult.failure);
+        const body2 = buildAipErrorBody(aipResult.failure, {
+          trustedIssuers: aipTrustedIssuerSet(gate.aip),
+          ...gate.aip.requireTrustLevel !== void 0 && { requiredTrustLevel: gate.aip.requireTrustLevel },
+          ...gate.aip.requireAmr !== void 0 && { requiredAmr: gate.aip.requireAmr }
+        });
         return {
           status: body2.status,
           body: body2,
@@ -24198,6 +25848,17 @@ var Checkout = class {
       }
       aipToken = aipResult.ait.token;
       aipIssuer = aipResult.ait.iss;
+      aipSignature = aipResult.ait.signatureMaterial;
+      const weakAuthDetail = checkTrustRequirements(aipResult.ait.payload, gate.aip.requireTrustLevel, gate.aip.requireAmr);
+      if (weakAuthDetail) {
+        const body2 = buildAipWeakAuthBody({
+          detail: weakAuthDetail,
+          ...gate.aip.requireTrustLevel !== void 0 && { requiredTrustLevel: gate.aip.requireTrustLevel },
+          ...gate.aip.requireAmr !== void 0 && { requiredAmr: gate.aip.requireAmr },
+          trustedIssuers: aipTrustedIssuerSet(gate.aip)
+        });
+        return { status: 403, body: body2, headers: { "content-type": "application/problem+json" } };
+      }
     }
     const issuerPolicy = aipIssuer !== void 0 && gate.aip?.issuerPolicies !== void 0 ? resolveIssuerPolicy(gate.aip.issuerPolicies, aipIssuer) : void 0;
     const effPolicy = issuerPolicy ?? {
@@ -24228,7 +25889,7 @@ var Checkout = class {
     let policyOverride;
     if (gate.perRequestPolicy !== void 0) {
       policyOverride = await gate.perRequestPolicy(ctx);
-      if (policyOverride === null) return null;
+      if (policyOverride === null) return this.runWalletSanctionsOnly(ctx);
     }
     const coreOpts = {
       apiKey: gate.apiKey,
@@ -24262,7 +25923,7 @@ var Checkout = class {
       ...policyOverride ?? {}
     };
     const core = createAgentScoreCore(coreOpts);
-    const identity = aipToken !== void 0 ? { aipToken } : walletAddress !== void 0 || operatorToken !== void 0 ? {
+    const identity = aipToken !== void 0 ? { aipToken, ...aipSignature !== void 0 && { aipSignature } } : walletAddress !== void 0 || operatorToken !== void 0 ? {
       ...walletAddress !== void 0 && { address: walletAddress },
       ...operatorToken !== void 0 && { operatorToken }
     } : void 0;
@@ -24282,8 +25943,7 @@ var Checkout = class {
         };
       }
       if (aipToken === void 0 && walletAddress !== void 0) {
-        const verdict = core.getSignerVerdict(walletAddress);
-        const sm = verdict?.signer_match;
+        const sm = outcome.signerVerdict?.signer_match;
         if (sm && sm.kind !== "pass") {
           const reason2 = sm.kind === "wallet_auth_requires_wallet_signing" ? {
             code: "wallet_auth_requires_wallet_signing",
@@ -24314,6 +25974,19 @@ var Checkout = class {
       if (custom2 !== null) return custom2;
     }
     const body = denialReasonToBody(reason);
+    if (aipToken !== void 0) {
+      const superset = buildAipPolicyDenyBody(reason.code, reason.reasons, body, {
+        trustedIssuers: gate.aip !== void 0 ? aipTrustedIssuerSet(gate.aip) : void 0,
+        requiredClaims: aipRequiredClaims(effPolicy),
+        ...gate.aip?.requireTrustLevel !== void 0 && { requiredTrustLevel: gate.aip.requireTrustLevel },
+        ...gate.aip?.requireAmr !== void 0 && { requiredAmr: gate.aip.requireAmr }
+      });
+      return {
+        status: superset.status,
+        body: superset,
+        headers: { "content-type": "application/problem+json" }
+      };
+    }
     const status = reason.code === "token_expired" || reason.code === "invalid_credential" ? 401 : reason.code === "api_error" ? 503 : 403;
     return { status, body };
   }
@@ -24329,7 +26002,7 @@ var Checkout = class {
    *   - `AGENTSCORE_API_KEY` — required. No key → one-time warning + skip
    *     (dev/testnet pattern; production should always configure a key).
    *   - `AGENTSCORE_BASE_URL` — optional override for staging/dev API
-   *     (e.g. `https://api-dev.agentscore.sh` or `http://localhost:3002`).
+   *     (e.g. `https://api.staging.example` or `http://localhost:3002`).
    *
    * Stripe SPT (no extractable wallet signer) → skip silently; Stripe runs
    * its own OFAC screen on the buyer's Stripe account at customer creation.
@@ -24342,7 +26015,7 @@ var Checkout = class {
    * clean buyer is just bad UX).
    */
   async runWalletSanctionsOnly(ctx) {
-    const apiKey = process.env.AGENTSCORE_API_KEY;
+    const apiKey = this.gate?.apiKey ?? process.env.AGENTSCORE_API_KEY;
     if (!apiKey) {
       warnMissingApiKeyOnce("checkout");
       return null;
@@ -24371,8 +26044,7 @@ var Checkout = class {
   }
   async handleZeroSettle(ctx, rail) {
     if (!this.zeroSettleCarveOut || ctx.pricing === null) return null;
-    const cents = Math.round(ctx.pricing.amountUsd * 100);
-    if (cents !== 0) return null;
+    if (ctx.pricing.amountUsd !== 0) return null;
     const headers = normalizeHeadersToLowercase(ctx.request.headers);
     let zero;
     if (rail === "x402-base") {
@@ -24413,9 +26085,16 @@ var Checkout = class {
     ctx.recipients = { ...await this.mintRecipients(ctx) };
     return ctx.recipients;
   }
-  async asyncIsCachedAddress(address2) {
-    if (this.isCachedAddress === void 0) return true;
-    return Promise.resolve(this.isCachedAddress(address2));
+  async asyncIsCachedAddress(address3, ctx) {
+    if (this.isCachedAddress !== void 0) return Promise.resolve(this.isCachedAddress(address3));
+    const minted = ctx?.recipients["x402_base"];
+    if (minted !== void 0 && minted.length > 0) {
+      return address3.toLowerCase() === minted.toLowerCase();
+    }
+    if (this.x402StaticRecipients.size > 0) {
+      return this.x402StaticRecipients.has(address3.toLowerCase());
+    }
+    return true;
   }
   async handleX402(ctx) {
     const x402Server = await this.getX402Server();
@@ -24428,7 +26107,7 @@ var Checkout = class {
     });
     const verified = await verifyX402Request({
       request: fakeRequest,
-      isCachedAddress: this.asyncIsCachedAddress.bind(this),
+      isCachedAddress: (addr) => this.asyncIsCachedAddress(addr, ctx),
       acceptedNetwork: this.x402BaseNetwork
     });
     if (!verified.ok) {
@@ -24452,7 +26131,7 @@ var Checkout = class {
         maxTimeoutSeconds: 300
       },
       resourceMeta: {
-        url: ctx.request.url,
+        url: resolveResourceUrl(ctx.request),
         description: "Agent purchase via x402",
         mimeType: "application/json"
       }
@@ -24610,13 +26289,29 @@ var Checkout = class {
             payTo: recipient,
             maxTimeoutSeconds: 300
           });
-          x402Resource = { url: ctx.request.url, mimeType: "application/json" };
+          x402Resource = {
+            url: resolveResourceUrl(ctx.request),
+            mimeType: "application/json",
+            ...this.resourceInfo?.description !== void 0 && { description: this.resourceInfo.description },
+            ...this.resourceInfo?.serviceName !== void 0 && { serviceName: this.resourceInfo.serviceName },
+            ...this.resourceInfo?.tags !== void 0 && { tags: this.resourceInfo.tags },
+            ...this.resourceInfo?.iconUrl !== void 0 && { iconUrl: this.resourceInfo.iconUrl }
+          };
         } catch {
           x402Accepts = [];
         }
       }
     }
     const identityMetadata = resolveIdentityMetadata(ctx);
+    let requestPath = ctx.request.url;
+    try {
+      requestPath = new URL(resolveResourceUrl(ctx.request)).pathname;
+    } catch {
+    }
+    const enrichedExtensions = await enrichBazaarDiscoveryExtensions(this.discoveryExtensions, {
+      method: ctx.request.method,
+      path: requestPath
+    });
     const body = build402Body({
       acceptedMethods: accepted,
       agentInstructions: buildAgentInstructions({ howToPay }),
@@ -24638,7 +26333,8 @@ var Checkout = class {
       ...x402Accepts.length > 0 ? {
         x402: {
           accepts: x402Accepts,
-          ...this.discoveryExtensions !== void 0 && Object.keys(this.discoveryExtensions).length > 0 ? { extensions: this.discoveryExtensions } : {}
+          ...x402Resource ? { resource: x402Resource } : {},
+          ...enrichedExtensions !== void 0 && Object.keys(enrichedExtensions).length > 0 ? { extensions: enrichedExtensions } : {}
         }
       } : {}
     });
@@ -24647,7 +26343,8 @@ var Checkout = class {
       x402Block = {
         x402Version: 2,
         accepts: x402Accepts,
-        ...x402Resource ? { resource: x402Resource } : {}
+        ...x402Resource ? { resource: x402Resource } : {},
+        ...enrichedExtensions !== void 0 && Object.keys(enrichedExtensions).length > 0 ? { extensions: enrichedExtensions } : {}
       };
     }
     const respond = respond402({
@@ -24725,11 +26422,18 @@ function validationResponseNextjs(input) {
 function validationResponseWeb(input) {
   return validationResponseHono(input);
 }
-function invalidBodyEnvelope() {
-  return validationEnvelope({
-    code: "invalid_body",
-    message: "Request body must be valid JSON."
-  });
+function resolveResourceUrl(request) {
+  const fwd = request.headers["x-forwarded-proto"] ?? request.headers["X-Forwarded-Proto"];
+  const proto = typeof fwd === "string" ? fwd.split(",")[0]?.trim() : void 0;
+  if (proto) {
+    try {
+      const u = new URL(request.url);
+      u.protocol = `${proto}:`;
+      return u.toString();
+    } catch {
+    }
+  }
+  return request.url;
 }
 function stripContentType(headers) {
   const out = {};
@@ -24738,6 +26442,12 @@ function stripContentType(headers) {
   }
   return out;
 }
+function explicitContentType(headers) {
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === "content-type") return v;
+  }
+  return void 0;
+}
 function headersToRecord(h) {
   if (h === void 0) return {};
   if (h instanceof Headers) {
@@ -24757,10 +26467,7 @@ Checkout.prototype.handleHono = async function(c, body) {
     try {
       parsedBody = await c.req.json();
     } catch {
-      return new Response(JSON.stringify(invalidBodyEnvelope()), {
-        status: 400,
-        headers: { "Content-Type": "application/json" }
-      });
+      parsedBody = {};
     }
   }
   const rawHeaders = c.req.header();
@@ -24775,16 +26482,11 @@ Checkout.prototype.handleHono = async function(c, body) {
   });
   return new Response(JSON.stringify(result.body), {
     status: result.status,
-    headers: { "Content-Type": "application/json", ...stripContentType(result.headers) }
+    headers: { "Content-Type": explicitContentType(result.headers) ?? "application/json", ...stripContentType(result.headers) }
   });
 };
 Checkout.prototype.handleExpress = async function(req, res, body) {
-  const parsedBody = body ?? (typeof req.body === "object" && req.body !== null ? req.body : null);
-  if (parsedBody === null) {
-    res.status(400);
-    res.json(invalidBodyEnvelope());
-    return;
-  }
+  const parsedBody = body ?? (typeof req.body === "object" && req.body !== null ? req.body : {});
   const headers = {};
   for (const [k, v] of Object.entries(req.headers)) {
     if (typeof v === "string") headers[k] = v;
@@ -24800,15 +26502,13 @@ Checkout.prototype.handleExpress = async function(req, res, body) {
     raw: req
   });
   for (const [k, v] of Object.entries(stripContentType(result.headers))) res.setHeader(k, v);
+  const ct = explicitContentType(result.headers);
+  if (ct !== void 0) res.setHeader("Content-Type", ct);
   res.status(result.status);
   res.json(result.body);
 };
 Checkout.prototype.handleFastify = async function(request, reply, body) {
-  const parsedBody = body ?? (typeof request.body === "object" && request.body !== null ? request.body : null);
-  if (parsedBody === null) {
-    reply.code(400);
-    return reply.send(invalidBodyEnvelope());
-  }
+  const parsedBody = body ?? (typeof request.body === "object" && request.body !== null ? request.body : {});
   const headers = {};
   for (const [k, v] of Object.entries(request.headers)) {
     if (typeof v === "string") headers[k] = v;
@@ -24824,6 +26524,11 @@ Checkout.prototype.handleFastify = async function(request, reply, body) {
   });
   for (const [k, v] of Object.entries(stripContentType(result.headers))) reply.header(k, v);
   reply.code(result.status);
+  const ct = explicitContentType(result.headers);
+  if (ct !== void 0) {
+    reply.header("content-type", ct);
+    return reply.send(JSON.stringify(result.body));
+  }
   return reply.send(result.body);
 };
 Checkout.prototype.handleNextjs = async function(request, body) {
@@ -24834,10 +26539,7 @@ Checkout.prototype.handleNextjs = async function(request, body) {
     try {
       parsedBody = await request.json();
     } catch {
-      return new Response(JSON.stringify(invalidBodyEnvelope()), {
-        status: 400,
-        headers: { "Content-Type": "application/json" }
-      });
+      parsedBody = {};
     }
   }
   const headers = {};
@@ -24854,7 +26556,7 @@ Checkout.prototype.handleNextjs = async function(request, body) {
   });
   return new Response(JSON.stringify(result.body), {
     status: result.status,
-    headers: { "Content-Type": "application/json", ...stripContentType(result.headers) }
+    headers: { "Content-Type": explicitContentType(result.headers) ?? "application/json", ...stripContentType(result.headers) }
   });
 };
 Checkout.prototype.handleWeb = Checkout.prototype.handleNextjs;
@@ -25327,7 +27029,7 @@ function computeFirstCheckout(opts) {
     for (const [k, v] of Object.entries(mppChallengeHeaders)) headers.set(k, v);
     headers.set(
       "PAYMENT-REQUIRED",
-      paymentRequiredHeader({ x402Version: 2, accepts: accepted, resource: { url: opts.url } })
+      paymentRequiredHeader2({ x402Version: 2, accepts: accepted, resource: { url: opts.url } })
     );
     return new Response(JSON.stringify(body402), { status: 402, headers });
   }
@@ -25362,9 +27064,10 @@ function computeFirstCheckout(opts) {
     );
   }
   async function handleX402Settle(req, referenceId, cachedBody, priceCents, recipients) {
+    const expectedPayTo = recipients.x402_base?.toLowerCase();
     const verified = await verifyX402Request({
       request: req,
-      isCachedAddress: async () => true,
+      isCachedAddress: async (addr) => expectedPayTo === void 0 || addr.toLowerCase() === expectedPayTo,
       acceptedNetwork: opts.rails.x402_base?.network ?? "eip155:8453"
     });
     if (!verified.ok) {
@@ -25697,6 +27400,7 @@ function defaultReadOnlyOnDenied(reason) {
   AGENTSCORE_CANONICAL_ISSUER,
   AGENTSCORE_UCP_CAPABILITY,
   AGENT_IDENTITY_HEADER,
+  AIP_A2A_EXTENSION_URI,
   AIP_COVERED_COMPONENTS,
   AIP_SIGNATURE_TAG,
   Checkout,
@@ -25705,15 +27409,18 @@ function defaultReadOnlyOnDenied(reason) {
   HARD_MAX_CACHE_SECONDS,
   JWKS_WELL_KNOWN_PATH,
   JwksCache,
+  MAX_POP_WINDOW_SECONDS,
   UCPSigningKey,
   UCPVerificationError,
   UCP_A2A_EXTENSION_URI,
+  aipA2AExtension,
   aipErrorCode,
   aipErrorStatus,
   buildA2AAgentCard,
   buildAgentMemoryHint,
   buildAipErrorBody,
   buildAipTrustedIssuers,
+  buildAipWeakAuthBody,
   buildContactSupportNextSteps,
   buildDefaultCheckoutRails,
   buildGateFromPolicy,
@@ -25724,12 +27431,15 @@ function defaultReadOnlyOnDenied(reason) {
   buildVerificationRequiredBody,
   buildVerifyContextFromRequest,
   canonicalizeIssuer,
+  checkTrustRequirements,
   computeFirstCheckout,
   createDefaultOnDenied,
   createQuoteCache,
   defaultReadOnlyOnDenied,
   denialReasonStatus,
   denialReasonToBody,
+  evaluateAipParts,
+  evaluateAipRequest,
   extractOwnerScope,
   extractPaymentSigner,
   extractPaymentSignerFromAuth,
@@ -25750,6 +27460,7 @@ function defaultReadOnlyOnDenied(reason) {
   loadUCPSigningKeyFromEnv,
   makeMppxComposeHook,
   mppPaymentHandler,
+  normalizeAddress,
   pricingResult,
   readX402PaymentHeader,
   runGateWithEnforcement,