@primitivedotdev/sdk 1.4.0 → 1.6.0

package/dist/{operations.generated-XrEy5EtX.js → operations.generated-DQIrhCT5.js}

@@ -73,6 +73,10 @@ const openapiDocument = {
 			"name": "Filters",
 			"description": "Manage whitelist and blocklist filter rules"
 		},
+		{
+			"name": "Payments",
+			"description": "Collect and pay stablecoin (USDC) payments with x402. Settlement is\nnon-custodial: funds move directly from payer to payee on-chain via an\nEIP-3009 authorization the payer signs with their own key, and Primitive\nnever holds funds. The payee registers a payout address and creates a\nchallenge; the payer signs and settles it under a configurable spend\npolicy (kill-switch, per-payment and per-day caps, payee allowlist).\n"
+		},
 		{
 			"name": "Webhook Deliveries",
 			"description": "View and replay webhook delivery attempts"
@@ -2168,6 +2172,111 @@ const openapiDocument = {
 				}
 			}
 		},
+		"/org/secrets": {
+			"get": {
+				"operationId": "listOrgSecrets",
+				"summary": "List org-level (global) secrets",
+				"description": "Returns metadata for every org-level secret. Org secrets apply\nto every function in the org and are read as `env.<KEY>` in\nhandlers. **Values are never returned.** Secret writes are\nwrite-only. A function-level secret of the same name overrides\nthe org-level value for that function.\n",
+				"tags": ["Functions"],
+				"responses": {
+					"200": {
+						"description": "List of org secrets (metadata only, no values)",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "object",
+								"properties": { "items": {
+									"type": "array",
+									"items": { "$ref": "#/components/schemas/OrgSecretListItem" }
+								} },
+								"required": ["items"]
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"post": {
+				"operationId": "createOrgSecret",
+				"summary": "Create or update an org secret",
+				"description": "Idempotent insert-or-update keyed on `(org_id, key)`. Returns\n201 the first time the key is set, 200 on subsequent updates.\nValues are encrypted at rest. A changed value lands in a\nfunction only on that function's next deploy.\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
+				"tags": ["Functions"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateOrgSecretInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Secret updated",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"201": {
+						"description": "Secret created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			}
+		},
+		"/org/secrets/{key}": {
+			"parameters": [{
+				"name": "key",
+				"in": "path",
+				"required": true,
+				"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+				"schema": {
+					"type": "string",
+					"pattern": "^[A-Z_][A-Z0-9_]*$"
+				}
+			}],
+			"put": {
+				"operationId": "setOrgSecret",
+				"summary": "Set an org secret by key",
+				"description": "Path-keyed companion to `POST /org/secrets`. Idempotent:\nreturns 201 the first time the key is set, 200 on subsequent\nupdates. Same validation and write-only guarantees as POST.\n",
+				"tags": ["Functions"],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/SetOrgSecretInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "Secret updated",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"201": {
+						"description": "Secret created",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/OrgSecretWriteResult" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" }
+				}
+			},
+			"delete": {
+				"operationId": "deleteOrgSecret",
+				"summary": "Delete an org secret",
+				"description": "Removes the org secret. Functions keep the previous value until\neach is redeployed. Returns 404 if the key did not exist.\n",
+				"tags": ["Functions"],
+				"responses": {
+					"204": { "description": "Secret deleted" },
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"404": { "$ref": "#/components/responses/NotFound" }
+				}
+			}
+		},
 		"/functions/{id}/logs": {
 			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
 			"get": {
@@ -2220,7 +2329,199 @@ const openapiDocument = {
 					"404": { "$ref": "#/components/responses/NotFound" }
 				}
 			}
-		}
+		},
+		"/x402/payout-addresses": {
+			"post": {
+				"operationId": "registerPayoutAddress",
+				"summary": "Register a payout address",
+				"description": "Register (or update) the default payout address your org receives x402\npayments at, for a given network. You prove control of the address with\nan org-bound `personal_sign` signature over the message produced by the\nSDK helper `buildPayoutRegistrationMessage`. The org id is taken from your\nauthenticated key, never the body, so a captured signature can't register\nan address under another org. Exactly one default address exists per\n(org, network); registering again replaces it. A payee MUST register a\npayout address before calling `createChallenge`, because the challenge's\n`pay_to` is resolved from this directory.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/RegisterPayoutAddressInput" } } }
+				},
+				"responses": {
+					"201": {
+						"description": "Payout address registered (or updated) and set as default",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402PayoutAddress" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			},
+			"get": {
+				"operationId": "listPayoutAddresses",
+				"summary": "List payout addresses",
+				"description": "List your org's registered payout addresses, newest first.",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"responses": {
+					"200": {
+						"description": "Your registered payout addresses",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": {
+								"type": "array",
+								"items": { "$ref": "#/components/schemas/X402PayoutAddress" }
+							} }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			}
+		},
+		"/x402/challenges": { "post": {
+			"operationId": "createChallenge",
+			"summary": "Create a payment challenge",
+			"description": "Create an x402 payment challenge (the payee side of a payment). The\n`pay_to` address is resolved server-side from your registered default\npayout address for the network, never from the request. The response\ncarries the `nonce_binding` and `payment_requirements` the payer needs to\nsign; hand the whole challenge object to the payer (for example in an\nemail reply). Amounts are in token base units (USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC).\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateChallengeInput" } } }
+			},
+			"responses": {
+				"201": {
+					"description": "Challenge created",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Challenge" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/x402/challenges/{id}": { "get": {
+			"operationId": "getChallenge",
+			"summary": "Get a payment challenge",
+			"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"responses": {
+				"200": {
+					"description": "The challenge",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Challenge" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} },
+		"/x402/challenges/{id}/pay": { "post": {
+			"operationId": "payChallenge",
+			"summary": "Pay a payment challenge",
+			"description": "Settle a challenge addressed to your org as payer. The request body\ncarries a signed x402 `PaymentPayload`: an EIP-3009\n`transferWithAuthorization` signed locally with your own key, whose nonce\nis bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform\nverifies every signed field against its own record of the challenge,\napplies your spend policy, and settles on-chain through a facilitator.\nSettlement is non-custodial; Primitive never holds funds. Idempotent:\npaying an already-settled challenge returns the original receipt. Most\ncallers use the SDK `pay()` helper rather than building the payload by\nhand.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"parameters": [{ "$ref": "#/components/parameters/ResourceId" }],
+			"requestBody": {
+				"required": true,
+				"content": { "application/json": { "schema": { "$ref": "#/components/schemas/PayChallengeInput" } } }
+			},
+			"responses": {
+				"200": {
+					"description": "Challenge settled (or already settled)",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": { "$ref": "#/components/schemas/X402Receipt" } }
+					}] } } }
+				},
+				"400": { "$ref": "#/components/responses/ValidationError" },
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"404": { "$ref": "#/components/responses/NotFound" },
+				"409": { "$ref": "#/components/responses/Conflict" },
+				"422": { "$ref": "#/components/responses/UnprocessableEntity" },
+				"429": { "$ref": "#/components/responses/RateLimited" },
+				"502": { "$ref": "#/components/responses/BadGateway" }
+			}
+		} },
+		"/x402/spend-policy": {
+			"get": {
+				"operationId": "getSpendPolicy",
+				"summary": "Get your spend policy",
+				"description": "Read your org's outbound spend policy: the kill-switch, per-payment and\nper-day caps, and the payee allowlist. Returns the defaults (no limits,\nnot paused) when no policy has been set.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"responses": {
+					"200": {
+						"description": "The spend policy",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402SpendPolicy" } }
+						}] } } }
+					},
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			},
+			"put": {
+				"operationId": "updateSpendPolicy",
+				"summary": "Update your spend policy",
+				"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+				"tags": ["Payments"],
+				"security": [{ "BearerAuth": [] }],
+				"requestBody": {
+					"required": true,
+					"content": { "application/json": { "schema": { "$ref": "#/components/schemas/UpdateSpendPolicyInput" } } }
+				},
+				"responses": {
+					"200": {
+						"description": "The updated spend policy",
+						"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+							"type": "object",
+							"properties": { "data": { "$ref": "#/components/schemas/X402SpendPolicy" } }
+						}] } } }
+					},
+					"400": { "$ref": "#/components/responses/ValidationError" },
+					"401": { "$ref": "#/components/responses/Unauthorized" },
+					"403": { "$ref": "#/components/responses/Forbidden" },
+					"429": { "$ref": "#/components/responses/RateLimited" }
+				}
+			}
+		},
+		"/x402/declined-payments": { "get": {
+			"operationId": "listDeclinedPayments",
+			"summary": "List declined payments",
+			"description": "The 50 most recent payments your org's spend policy declined, newest\nfirst. Use this to see why an outbound payment was refused (a cap, the\npayee allowlist, or the kill-switch) instead of only reading the\ndashboard.\n",
+			"tags": ["Payments"],
+			"security": [{ "BearerAuth": [] }],
+			"responses": {
+				"200": {
+					"description": "Recently declined payments",
+					"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
+						"type": "object",
+						"properties": { "data": {
+							"type": "array",
+							"items": { "$ref": "#/components/schemas/X402DeclinedPayment" }
+						} }
+					}] } } }
+				},
+				"401": { "$ref": "#/components/responses/Unauthorized" },
+				"403": { "$ref": "#/components/responses/Forbidden" },
+				"429": { "$ref": "#/components/responses/RateLimited" }
+			}
+		} }
 	},
 	"components": {
 		"securitySchemes": {
@@ -2387,6 +2688,32 @@ const openapiDocument = {
 					}
 				} }
 			},
+			"Conflict": {
+				"description": "The request conflicts with the current state of the resource",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "conflict",
+							"message": "settlement already in progress"
+						}
+					}
+				} }
+			},
+			"UnprocessableEntity": {
+				"description": "The request was well-formed but could not be processed. For Payments\nthis covers a missing payout address, a failed payment verification, a\nspend-policy decline, or an expired challenge; `error.code` distinguishes\nthem.\n",
+				"content": { "application/json": {
+					"schema": { "$ref": "#/components/schemas/ErrorResponse" },
+					"example": {
+						"success": false,
+						"error": {
+							"code": "payment_declined",
+							"message": "payment exceeds the per-payment cap"
+						}
+					}
+				} }
+			},
 			"Deleted": {
 				"description": "Resource deleted",
 				"content": { "application/json": { "schema": { "allOf": [{ "$ref": "#/components/schemas/SuccessEnvelope" }, {
@@ -2403,27 +2730,467 @@ const openapiDocument = {
 			}
 		},
 		"schemas": {
-			"SuccessEnvelope": {
-				"type": "object",
-				"properties": { "success": {
-					"type": "boolean",
-					"const": true
-				} },
-				"required": ["success", "data"]
-			},
-			"ListEnvelope": {
+			"RegisterPayoutAddressInput": {
 				"type": "object",
+				"additionalProperties": false,
 				"properties": {
-					"success": {
-						"type": "boolean",
-						"const": true
+					"address": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]{40}$",
+						"description": "The payout address (your signer's own EVM address), 0x-prefixed."
 					},
-					"meta": { "$ref": "#/components/schemas/PaginationMeta" }
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"],
+						"description": "The chain the address receives on."
+					},
+					"signature": {
+						"type": "string",
+						"pattern": "^0x[0-9a-fA-F]+$",
+						"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+					},
+					"issued_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+					},
+					"label": {
+						"type": "string",
+						"maxLength": 80,
+						"description": "Optional human-readable label."
+					}
 				},
 				"required": [
-					"success",
-					"data",
-					"meta"
+					"address",
+					"network",
+					"signature",
+					"issued_at"
+				]
+			},
+			"X402PayoutAddress": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": {
+						"type": "string",
+						"description": "The checksummed payout address."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"label": { "type": ["string", "null"] },
+					"is_default": {
+						"type": "boolean",
+						"description": "Exactly one address per (org, network) is the default."
+					},
+					"verified_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When ownership of the address was last proven."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"address",
+					"network",
+					"label",
+					"is_default",
+					"verified_at"
+				]
+			},
+			"CreateChallengeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": {
+					"amount": {
+						"type": "string",
+						"pattern": "^[1-9][0-9]{0,38}$",
+						"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payer_org": {
+						"type": "string",
+						"format": "uuid",
+						"description": "The org id allowed to pay this challenge (on-net binding). Optional.\n"
+					},
+					"expires_in": {
+						"type": "integer",
+						"minimum": 60,
+						"maximum": 86400,
+						"description": "Seconds until the challenge expires. Defaults to 3600."
+					},
+					"resource": {
+						"type": "string",
+						"format": "uri",
+						"maxLength": 2048,
+						"description": "Optional URL identifying what is being paid for. Defaults to a\nsynthetic `x402:challenge:<id>` identifier.\n"
+					},
+					"description": {
+						"type": "string",
+						"maxLength": 512,
+						"description": "Optional human-readable description of the payment."
+					}
+				},
+				"required": ["amount", "network"]
+			},
+			"X402NonceBinding": {
+				"type": "object",
+				"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+				"properties": {
+					"interaction_id": {
+						"type": "string",
+						"description": "Interaction id, including its `@domain` part."
+					},
+					"challenge_step_id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_nonce": {
+						"type": "string",
+						"pattern": "^[0-9a-f]{64}$",
+						"description": "32 random bytes as 64 lowercase hex chars."
+					}
+				},
+				"required": [
+					"interaction_id",
+					"challenge_step_id",
+					"challenge_nonce"
+				]
+			},
+			"X402PaymentRequirements": {
+				"type": "object",
+				"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+				"properties": {
+					"scheme": {
+						"type": "string",
+						"description": "The x402 settlement scheme. Always `exact` for v1.",
+						"example": "exact"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"maxAmountRequired": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"payTo": {
+						"type": "string",
+						"description": "The payee's resolved payout address (checksummed)."
+					},
+					"asset": {
+						"type": "string",
+						"description": "The token contract address (checksummed). USDC."
+					},
+					"resource": { "type": "string" },
+					"description": { "type": "string" },
+					"maxTimeoutSeconds": { "type": "integer" },
+					"extra": {
+						"type": "object",
+						"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+						"properties": {
+							"name": { "type": "string" },
+							"version": { "type": "string" }
+						},
+						"required": ["name", "version"]
+					}
+				},
+				"required": [
+					"scheme",
+					"network",
+					"maxAmountRequired",
+					"payTo",
+					"asset",
+					"extra"
+				]
+			},
+			"X402Challenge": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"status": {
+						"type": "string",
+						"enum": [
+							"pending",
+							"settling",
+							"settled",
+							"failed",
+							"expired"
+						]
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"asset": {
+						"type": "string",
+						"description": "Token contract address (checksummed)."
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"pay_to": {
+						"type": "string",
+						"description": "The payee's resolved payout address (checksummed)."
+					},
+					"payer_org": {
+						"type": ["string", "null"],
+						"description": "The org id bound as payer, if one was set at creation."
+					},
+					"resource": { "type": ["string", "null"] },
+					"description": { "type": ["string", "null"] },
+					"nonce_binding": { "$ref": "#/components/schemas/X402NonceBinding" },
+					"settle_tx": {
+						"type": ["string", "null"],
+						"description": "On-chain settlement transaction hash once settled."
+					},
+					"settled_at": {
+						"type": ["string", "null"],
+						"format": "date-time"
+					},
+					"failure_reason": { "type": ["string", "null"] },
+					"expires_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"payment_requirements": {
+						"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+						"allOf": [{ "$ref": "#/components/schemas/X402PaymentRequirements" }]
+					}
+				},
+				"required": [
+					"id",
+					"status",
+					"network",
+					"asset",
+					"amount",
+					"pay_to",
+					"nonce_binding",
+					"expires_at"
+				]
+			},
+			"X402PaymentPayload": {
+				"type": "object",
+				"description": "A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this;\ncallers rarely construct it by hand. Field names are x402-native.\n",
+				"properties": {
+					"x402Version": {
+						"type": "integer",
+						"const": 1
+					},
+					"scheme": {
+						"type": "string",
+						"const": "exact"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payload": {
+						"type": "object",
+						"properties": {
+							"signature": {
+								"type": "string",
+								"pattern": "^0x[0-9a-fA-F]+$",
+								"description": "The EIP-712 signature over the authorization."
+							},
+							"authorization": {
+								"type": "object",
+								"description": "The EIP-3009 `transferWithAuthorization` fields, as strings.",
+								"properties": {
+									"from": { "type": "string" },
+									"to": { "type": "string" },
+									"value": { "type": "string" },
+									"validAfter": { "type": "string" },
+									"validBefore": { "type": "string" },
+									"nonce": { "type": "string" }
+								},
+								"required": [
+									"from",
+									"to",
+									"value",
+									"validAfter",
+									"validBefore",
+									"nonce"
+								]
+							}
+						},
+						"required": ["signature", "authorization"]
+					}
+				},
+				"required": [
+					"x402Version",
+					"scheme",
+					"network",
+					"payload"
+				]
+			},
+			"PayChallengeInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"properties": { "payment": { "$ref": "#/components/schemas/X402PaymentPayload" } },
+				"required": ["payment"]
+			},
+			"X402Receipt": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"status": {
+						"type": "string",
+						"enum": ["settled"]
+					},
+					"settle_tx": {
+						"type": ["string", "null"],
+						"description": "On-chain settlement transaction hash."
+					}
+				},
+				"required": [
+					"id",
+					"status",
+					"settle_tx"
+				]
+			},
+			"X402SpendPolicy": {
+				"type": "object",
+				"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+				"properties": {
+					"paused": {
+						"type": "boolean",
+						"description": "Kill-switch. When true, all outbound payments are refused."
+					},
+					"max_per_payment": {
+						"type": ["string", "null"],
+						"description": "Per-payment cap in token base units, or null for no cap."
+					},
+					"max_per_day": {
+						"type": ["string", "null"],
+						"description": "Rolling-day cap in token base units, or null for no cap."
+					},
+					"allowlist": {
+						"type": ["array", "null"],
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+					}
+				},
+				"required": [
+					"paused",
+					"max_per_payment",
+					"max_per_day",
+					"allowlist"
+				]
+			},
+			"UpdateSpendPolicyInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+				"properties": {
+					"paused": { "type": "boolean" },
+					"max_per_payment": {
+						"type": ["string", "null"],
+						"pattern": "^[1-9][0-9]{0,38}$"
+					},
+					"max_per_day": {
+						"type": ["string", "null"],
+						"pattern": "^[1-9][0-9]{0,38}$"
+					},
+					"allowlist": {
+						"type": ["array", "null"],
+						"maxItems": 1e3,
+						"items": {
+							"type": "string",
+							"format": "uuid"
+						}
+					}
+				}
+			},
+			"X402DeclinedPayment": {
+				"type": "object",
+				"description": "A payment the org's spend policy refused.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The challenge that was declined, if still present."
+					},
+					"counterparty_org": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The payee (challenger) org, when known."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"reason": {
+						"type": "string",
+						"description": "Why the payment was declined (cap, allowlist, paused)."
+					},
+					"declined_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"network",
+					"amount",
+					"reason",
+					"declined_at"
+				]
+			},
+			"SuccessEnvelope": {
+				"type": "object",
+				"properties": { "success": {
+					"type": "boolean",
+					"const": true
+				} },
+				"required": ["success", "data"]
+			},
+			"ListEnvelope": {
+				"type": "object",
+				"properties": {
+					"success": {
+						"type": "boolean",
+						"const": true
+					},
+					"meta": { "$ref": "#/components/schemas/PaginationMeta" }
+				},
+				"required": [
+					"success",
+					"data",
+					"meta"
 				]
 			},
 			"PaginationMeta": {
@@ -2492,7 +3259,14 @@ const openapiDocument = {
 									"email_delivery_failed",
 									"clerk_signup_failed",
 									"no_orgs_for_user",
-									"org_not_accessible"
+									"org_not_accessible",
+									"feature_disabled",
+									"no_payout_address",
+									"ownership_proof_failed",
+									"payment_verification_failed",
+									"payment_declined",
+									"challenge_expired",
+									"settlement_failed"
 								]
 							},
 							"message": { "type": "string" },
@@ -6379,9 +7153,84 @@ const openapiDocument = {
 					"updated_at",
 					"created"
 				]
-			}
-		}
-	}
+			},
+			"OrgSecretListItem": {
+				"type": "object",
+				"description": "One row from GET /org/secrets. Org secrets are always user-set\n(there are no managed org secrets), so `created_at` /\n`updated_at` are always present.\n",
+				"properties": {
+					"key": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"key",
+					"created_at",
+					"updated_at"
+				]
+			},
+			"CreateOrgSecretInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Body for POST /org/secrets.",
+				"properties": {
+					"key": {
+						"type": "string",
+						"pattern": "^[A-Z_][A-Z0-9_]*$",
+						"description": "Uppercase letters, digits, and underscores. Must start with\na letter or underscore. System-managed keys are reserved.\n"
+					},
+					"value": {
+						"type": "string",
+						"minLength": 1,
+						"maxLength": 4096,
+						"description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest.\nNever returned by any read endpoint.\n"
+					}
+				},
+				"required": ["key", "value"]
+			},
+			"SetOrgSecretInput": {
+				"type": "object",
+				"additionalProperties": false,
+				"description": "Body for PUT /org/secrets/{key}. Key comes from the path.",
+				"properties": { "value": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 4096
+				} },
+				"required": ["value"]
+			},
+			"OrgSecretWriteResult": {
+				"type": "object",
+				"description": "Returned by POST and PUT org secret routes.",
+				"properties": {
+					"key": { "type": "string" },
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"updated_at": {
+						"type": "string",
+						"format": "date-time"
+					},
+					"created": {
+						"type": "boolean",
+						"description": "True if this call inserted a new row, false if it updated an existing one."
+					}
+				},
+				"required": [
+					"key",
+					"created_at",
+					"updated_at",
+					"created"
+				]
+			}
+		}
+	}
 };
 //#endregion
 //#region ../packages/api-core/src/openapi/operations.generated.ts
@@ -10083,6 +10932,66 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-org-secret",
+		"description": "Idempotent insert-or-update keyed on `(org_id, key)`. Returns\n201 the first time the key is set, 200 on subsequent updates.\nValues are encrypted at rest. A changed value lands in a\nfunction only on that function's next deploy.\n\nKeys must match `^[A-Z_][A-Z0-9_]*$` (uppercase letters,\ndigits, underscores; first character is a letter or\nunderscore). Values are at most 4096 UTF-8 bytes. System-\nmanaged keys are reserved and rejected.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createOrgSecret",
+		"path": "/org/secrets",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Body for POST /org/secrets.",
+			"properties": {
+				"key": {
+					"type": "string",
+					"pattern": "^[A-Z_][A-Z0-9_]*$",
+					"description": "Uppercase letters, digits, and underscores. Must start with\na letter or underscore. System-managed keys are reserved.\n"
+				},
+				"value": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 4096,
+					"description": "Secret value, up to 4096 UTF-8 bytes. Encrypted at rest.\nNever returned by any read endpoint.\n"
+				}
+			},
+			"required": ["key", "value"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Returned by POST and PUT org secret routes.",
+			"properties": {
+				"key": { "type": "string" },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created": {
+					"type": "boolean",
+					"description": "True if this call inserted a new row, false if it updated an existing one."
+				}
+			},
+			"required": [
+				"key",
+				"created_at",
+				"updated_at",
+				"created"
+			]
+		},
+		"sdkName": "createOrgSecret",
+		"summary": "Create or update an org secret",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -10137,6 +11046,30 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "delete-org-secret",
+		"description": "Removes the org secret. Functions keep the previous value until\neach is redeployed. Returns 404 if the key did not exist.\n",
+		"hasJsonBody": false,
+		"method": "DELETE",
+		"operationId": "deleteOrgSecret",
+		"path": "/org/secrets/{key}",
+		"pathParams": [{
+			"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+			"enum": null,
+			"name": "key",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": null,
+		"sdkName": "deleteOrgSecret",
+		"summary": "Delete an org secret",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -11017,6 +11950,50 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-org-secrets",
+		"description": "Returns metadata for every org-level secret. Org secrets apply\nto every function in the org and are read as `env.<KEY>` in\nhandlers. **Values are never returned.** Secret writes are\nwrite-only. A function-level secret of the same name overrides\nthe org-level value for that function.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listOrgSecrets",
+		"path": "/org/secrets",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": { "items": {
+				"type": "array",
+				"items": {
+					"type": "object",
+					"description": "One row from GET /org/secrets. Org secrets are always user-set\n(there are no managed org secrets), so `created_at` /\n`updated_at` are always present.\n",
+					"properties": {
+						"key": { "type": "string" },
+						"created_at": {
+							"type": "string",
+							"format": "date-time"
+						},
+						"updated_at": {
+							"type": "string",
+							"format": "date-time"
+						}
+					},
+					"required": [
+						"key",
+						"created_at",
+						"updated_at"
+					]
+				}
+			} },
+			"required": ["items"]
+		},
+		"sdkName": "listOrgSecrets",
+		"summary": "List org-level (global) secrets",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,
@@ -11205,6 +12182,64 @@ const operationManifest = [
 		"tag": "Functions",
 		"tagCommand": "functions"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "set-org-secret",
+		"description": "Path-keyed companion to `POST /org/secrets`. Idempotent:\nreturns 201 the first time the key is set, 200 on subsequent\nupdates. Same validation and write-only guarantees as POST.\n",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "setOrgSecret",
+		"path": "/org/secrets/{key}",
+		"pathParams": [{
+			"description": "Secret key. Must match `^[A-Z_][A-Z0-9_]*$`.",
+			"enum": null,
+			"name": "key",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Body for PUT /org/secrets/{key}. Key comes from the path.",
+			"properties": { "value": {
+				"type": "string",
+				"minLength": 1,
+				"maxLength": 4096
+			} },
+			"required": ["value"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "Returned by POST and PUT org secret routes.",
+			"properties": {
+				"key": { "type": "string" },
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created": {
+					"type": "boolean",
+					"description": "True if this call inserted a new row, false if it updated an existing one."
+				}
+			},
+			"required": [
+				"key",
+				"created_at",
+				"updated_at",
+				"created"
+			]
+		},
+		"sdkName": "setOrgSecret",
+		"summary": "Set an org secret by key",
+		"tag": "Functions",
+		"tagCommand": "functions"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": false,
@@ -11605,6 +12640,806 @@ const operationManifest = [
 		"tag": "Inbox",
 		"tagCommand": "inbox"
 	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "create-challenge",
+		"description": "Create an x402 payment challenge (the payee side of a payment). The\n`pay_to` address is resolved server-side from your registered default\npayout address for the network, never from the request. The response\ncarries the `nonce_binding` and `payment_requirements` the payer needs to\nsign; hand the whole challenge object to the payer (for example in an\nemail reply). Amounts are in token base units (USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC).\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "createChallenge",
+		"path": "/x402/challenges",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"amount": {
+					"type": "string",
+					"pattern": "^[1-9][0-9]{0,38}$",
+					"description": "Amount to collect, in token base units. USDC has 6 decimals, so\n`\"10000\"` is 0.01 USDC.\n"
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"payer_org": {
+					"type": "string",
+					"format": "uuid",
+					"description": "The org id allowed to pay this challenge (on-net binding). Optional.\n"
+				},
+				"expires_in": {
+					"type": "integer",
+					"minimum": 60,
+					"maximum": 86400,
+					"description": "Seconds until the challenge expires. Defaults to 3600."
+				},
+				"resource": {
+					"type": "string",
+					"format": "uri",
+					"maxLength": 2048,
+					"description": "Optional URL identifying what is being paid for. Defaults to a\nsynthetic `x402:challenge:<id>` identifier.\n"
+				},
+				"description": {
+					"type": "string",
+					"maxLength": 512,
+					"description": "Optional human-readable description of the payment."
+				}
+			},
+			"required": ["amount", "network"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": [
+						"pending",
+						"settling",
+						"settled",
+						"failed",
+						"expired"
+					]
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"asset": {
+					"type": "string",
+					"description": "Token contract address (checksummed)."
+				},
+				"amount": {
+					"type": "string",
+					"description": "Amount in token base units."
+				},
+				"pay_to": {
+					"type": "string",
+					"description": "The payee's resolved payout address (checksummed)."
+				},
+				"payer_org": {
+					"type": ["string", "null"],
+					"description": "The org id bound as payer, if one was set at creation."
+				},
+				"resource": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"nonce_binding": {
+					"type": "object",
+					"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+					"properties": {
+						"interaction_id": {
+							"type": "string",
+							"description": "Interaction id, including its `@domain` part."
+						},
+						"challenge_step_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"challenge_nonce": {
+							"type": "string",
+							"pattern": "^[0-9a-f]{64}$",
+							"description": "32 random bytes as 64 lowercase hex chars."
+						}
+					},
+					"required": [
+						"interaction_id",
+						"challenge_step_id",
+						"challenge_nonce"
+					]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash once settled."
+				},
+				"settled_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"failure_reason": { "type": ["string", "null"] },
+				"expires_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"payment_requirements": {
+					"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+					"allOf": [{
+						"type": "object",
+						"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+						"properties": {
+							"scheme": {
+								"type": "string",
+								"description": "The x402 settlement scheme. Always `exact` for v1.",
+								"example": "exact"
+							},
+							"network": {
+								"type": "string",
+								"enum": ["base", "base-sepolia"]
+							},
+							"maxAmountRequired": {
+								"type": "string",
+								"description": "Amount in token base units."
+							},
+							"payTo": {
+								"type": "string",
+								"description": "The payee's resolved payout address (checksummed)."
+							},
+							"asset": {
+								"type": "string",
+								"description": "The token contract address (checksummed). USDC."
+							},
+							"resource": { "type": "string" },
+							"description": { "type": "string" },
+							"maxTimeoutSeconds": { "type": "integer" },
+							"extra": {
+								"type": "object",
+								"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+								"properties": {
+									"name": { "type": "string" },
+									"version": { "type": "string" }
+								},
+								"required": ["name", "version"]
+							}
+						},
+						"required": [
+							"scheme",
+							"network",
+							"maxAmountRequired",
+							"payTo",
+							"asset",
+							"extra"
+						]
+					}]
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"network",
+				"asset",
+				"amount",
+				"pay_to",
+				"nonce_binding",
+				"expires_at"
+			]
+		},
+		"sdkName": "createChallenge",
+		"summary": "Create a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-challenge",
+		"description": "Fetch a challenge you created, to poll its `status` and settlement\nreceipt (`settle_tx`). Scoped to the challenger org that created it.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getChallenge",
+		"path": "/x402/challenges/{id}",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": [
+						"pending",
+						"settling",
+						"settled",
+						"failed",
+						"expired"
+					]
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"asset": {
+					"type": "string",
+					"description": "Token contract address (checksummed)."
+				},
+				"amount": {
+					"type": "string",
+					"description": "Amount in token base units."
+				},
+				"pay_to": {
+					"type": "string",
+					"description": "The payee's resolved payout address (checksummed)."
+				},
+				"payer_org": {
+					"type": ["string", "null"],
+					"description": "The org id bound as payer, if one was set at creation."
+				},
+				"resource": { "type": ["string", "null"] },
+				"description": { "type": ["string", "null"] },
+				"nonce_binding": {
+					"type": "object",
+					"description": "The interaction binding the payer hashes into the EIP-3009 nonce\n(`deriveEip3009Nonce`). Pinning the nonce to this binding is what lets an\nx402 payment ride asynchronous transports safely: a replayed challenge\ncan't redirect funds and a signed payment can't settle twice.\n",
+					"properties": {
+						"interaction_id": {
+							"type": "string",
+							"description": "Interaction id, including its `@domain` part."
+						},
+						"challenge_step_id": {
+							"type": "string",
+							"format": "uuid"
+						},
+						"challenge_nonce": {
+							"type": "string",
+							"pattern": "^[0-9a-f]{64}$",
+							"description": "32 random bytes as 64 lowercase hex chars."
+						}
+					},
+					"required": [
+						"interaction_id",
+						"challenge_step_id",
+						"challenge_nonce"
+					]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash once settled."
+				},
+				"settled_at": {
+					"type": ["string", "null"],
+					"format": "date-time"
+				},
+				"failure_reason": { "type": ["string", "null"] },
+				"expires_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"payment_requirements": {
+					"description": "Present on the create response. Hand the whole challenge (including\nthis) to the payer; `getChallenge` omits it (it is for status polling\nby the challenger).\n",
+					"allOf": [{
+						"type": "object",
+						"description": "The x402 `PaymentRequirements` the payer signs over. Field names are\nx402's native camelCase, preserved byte-for-byte.\n",
+						"properties": {
+							"scheme": {
+								"type": "string",
+								"description": "The x402 settlement scheme. Always `exact` for v1.",
+								"example": "exact"
+							},
+							"network": {
+								"type": "string",
+								"enum": ["base", "base-sepolia"]
+							},
+							"maxAmountRequired": {
+								"type": "string",
+								"description": "Amount in token base units."
+							},
+							"payTo": {
+								"type": "string",
+								"description": "The payee's resolved payout address (checksummed)."
+							},
+							"asset": {
+								"type": "string",
+								"description": "The token contract address (checksummed). USDC."
+							},
+							"resource": { "type": "string" },
+							"description": { "type": "string" },
+							"maxTimeoutSeconds": { "type": "integer" },
+							"extra": {
+								"type": "object",
+								"description": "The token's load-bearing EIP-712 domain params. `name` differs by\nchain (Base mainnet USDC is `USD Coin`, Base Sepolia is `USDC`); a\nwrong value produces a signature the verifier rejects.\n",
+								"properties": {
+									"name": { "type": "string" },
+									"version": { "type": "string" }
+								},
+								"required": ["name", "version"]
+							}
+						},
+						"required": [
+							"scheme",
+							"network",
+							"maxAmountRequired",
+							"payTo",
+							"asset",
+							"extra"
+						]
+					}]
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"network",
+				"asset",
+				"amount",
+				"pay_to",
+				"nonce_binding",
+				"expires_at"
+			]
+		},
+		"sdkName": "getChallenge",
+		"summary": "Get a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "get-spend-policy",
+		"description": "Read your org's outbound spend policy: the kill-switch, per-payment and\nper-day caps, and the payee allowlist. Returns the defaults (no limits,\nnot paused) when no policy has been set.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "getSpendPolicy",
+		"path": "/x402/spend-policy",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "object",
+			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+			"properties": {
+				"paused": {
+					"type": "boolean",
+					"description": "Kill-switch. When true, all outbound payments are refused."
+				},
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"description": "Per-payment cap in token base units, or null for no cap."
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"description": "Rolling-day cap in token base units, or null for no cap."
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+				}
+			},
+			"required": [
+				"paused",
+				"max_per_payment",
+				"max_per_day",
+				"allowlist"
+			]
+		},
+		"sdkName": "getSpendPolicy",
+		"summary": "Get your spend policy",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-declined-payments",
+		"description": "The 50 most recent payments your org's spend policy declined, newest\nfirst. Use this to see why an outbound payment was refused (a cap, the\npayee allowlist, or the kill-switch) instead of only reading the\ndashboard.\n",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listDeclinedPayments",
+		"path": "/x402/declined-payments",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"description": "A payment the org's spend policy refused.",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"challenge_id": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The challenge that was declined, if still present."
+					},
+					"counterparty_org": {
+						"type": ["string", "null"],
+						"format": "uuid",
+						"description": "The payee (challenger) org, when known."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"amount": {
+						"type": "string",
+						"description": "Amount in token base units."
+					},
+					"reason": {
+						"type": "string",
+						"description": "Why the payment was declined (cap, allowlist, paused)."
+					},
+					"declined_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"network",
+					"amount",
+					"reason",
+					"declined_at"
+				]
+			}
+		},
+		"sdkName": "listDeclinedPayments",
+		"summary": "List declined payments",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": false,
+		"command": "list-payout-addresses",
+		"description": "List your org's registered payout addresses, newest first.",
+		"hasJsonBody": false,
+		"method": "GET",
+		"operationId": "listPayoutAddresses",
+		"path": "/x402/payout-addresses",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": null,
+		"responseSchema": {
+			"type": "array",
+			"items": {
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"address": {
+						"type": "string",
+						"description": "The checksummed payout address."
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"label": { "type": ["string", "null"] },
+					"is_default": {
+						"type": "boolean",
+						"description": "Exactly one address per (org, network) is the default."
+					},
+					"verified_at": {
+						"type": "string",
+						"format": "date-time",
+						"description": "When ownership of the address was last proven."
+					},
+					"created_at": {
+						"type": "string",
+						"format": "date-time"
+					}
+				},
+				"required": [
+					"id",
+					"address",
+					"network",
+					"label",
+					"is_default",
+					"verified_at"
+				]
+			}
+		},
+		"sdkName": "listPayoutAddresses",
+		"summary": "List payout addresses",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "pay-challenge",
+		"description": "Settle a challenge addressed to your org as payer. The request body\ncarries a signed x402 `PaymentPayload`: an EIP-3009\n`transferWithAuthorization` signed locally with your own key, whose nonce\nis bound to the challenge via the SDK's `deriveEip3009Nonce`. The platform\nverifies every signed field against its own record of the challenge,\napplies your spend policy, and settles on-chain through a facilitator.\nSettlement is non-custodial; Primitive never holds funds. Idempotent:\npaying an already-settled challenge returns the original receipt. Most\ncallers use the SDK `pay()` helper rather than building the payload by\nhand.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "payChallenge",
+		"path": "/x402/challenges/{id}/pay",
+		"pathParams": [{
+			"description": "Resource UUID",
+			"enum": null,
+			"name": "id",
+			"required": true,
+			"type": "string"
+		}],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": { "payment": {
+				"type": "object",
+				"description": "A signed x402 v1 `PaymentPayload`. The SDK `pay()` helper builds this;\ncallers rarely construct it by hand. Field names are x402-native.\n",
+				"properties": {
+					"x402Version": {
+						"type": "integer",
+						"const": 1
+					},
+					"scheme": {
+						"type": "string",
+						"const": "exact"
+					},
+					"network": {
+						"type": "string",
+						"enum": ["base", "base-sepolia"]
+					},
+					"payload": {
+						"type": "object",
+						"properties": {
+							"signature": {
+								"type": "string",
+								"pattern": "^0x[0-9a-fA-F]+$",
+								"description": "The EIP-712 signature over the authorization."
+							},
+							"authorization": {
+								"type": "object",
+								"description": "The EIP-3009 `transferWithAuthorization` fields, as strings.",
+								"properties": {
+									"from": { "type": "string" },
+									"to": { "type": "string" },
+									"value": { "type": "string" },
+									"validAfter": { "type": "string" },
+									"validBefore": { "type": "string" },
+									"nonce": { "type": "string" }
+								},
+								"required": [
+									"from",
+									"to",
+									"value",
+									"validAfter",
+									"validBefore",
+									"nonce"
+								]
+							}
+						},
+						"required": ["signature", "authorization"]
+					}
+				},
+				"required": [
+					"x402Version",
+					"scheme",
+					"network",
+					"payload"
+				]
+			} },
+			"required": ["payment"]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"status": {
+					"type": "string",
+					"enum": ["settled"]
+				},
+				"settle_tx": {
+					"type": ["string", "null"],
+					"description": "On-chain settlement transaction hash."
+				}
+			},
+			"required": [
+				"id",
+				"status",
+				"settle_tx"
+			]
+		},
+		"sdkName": "payChallenge",
+		"summary": "Pay a payment challenge",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "register-payout-address",
+		"description": "Register (or update) the default payout address your org receives x402\npayments at, for a given network. You prove control of the address with\nan org-bound `personal_sign` signature over the message produced by the\nSDK helper `buildPayoutRegistrationMessage`. The org id is taken from your\nauthenticated key, never the body, so a captured signature can't register\nan address under another org. Exactly one default address exists per\n(org, network); registering again replaces it. A payee MUST register a\npayout address before calling `createChallenge`, because the challenge's\n`pay_to` is resolved from this directory.\n",
+		"hasJsonBody": true,
+		"method": "POST",
+		"operationId": "registerPayoutAddress",
+		"path": "/x402/payout-addresses",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"properties": {
+				"address": {
+					"type": "string",
+					"pattern": "^0x[0-9a-fA-F]{40}$",
+					"description": "The payout address (your signer's own EVM address), 0x-prefixed."
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"],
+					"description": "The chain the address receives on."
+				},
+				"signature": {
+					"type": "string",
+					"pattern": "^0x[0-9a-fA-F]+$",
+					"description": "A `personal_sign` signature over the org-bound message produced by\nthe SDK helper `buildPayoutRegistrationMessage`. Recovered and\nchecked against `address`; the org id is bound into the signed bytes.\n"
+				},
+				"issued_at": {
+					"type": "string",
+					"format": "date-time",
+					"description": "ISO-8601 timestamp embedded in the signed message. Must be within a\nshort freshness window (about 10 minutes) of server time.\n"
+				},
+				"label": {
+					"type": "string",
+					"maxLength": 80,
+					"description": "Optional human-readable label."
+				}
+			},
+			"required": [
+				"address",
+				"network",
+				"signature",
+				"issued_at"
+			]
+		},
+		"responseSchema": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"address": {
+					"type": "string",
+					"description": "The checksummed payout address."
+				},
+				"network": {
+					"type": "string",
+					"enum": ["base", "base-sepolia"]
+				},
+				"label": { "type": ["string", "null"] },
+				"is_default": {
+					"type": "boolean",
+					"description": "Exactly one address per (org, network) is the default."
+				},
+				"verified_at": {
+					"type": "string",
+					"format": "date-time",
+					"description": "When ownership of the address was last proven."
+				},
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				}
+			},
+			"required": [
+				"id",
+				"address",
+				"network",
+				"label",
+				"is_default",
+				"verified_at"
+			]
+		},
+		"sdkName": "registerPayoutAddress",
+		"summary": "Register a payout address",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
+	{
+		"binaryResponse": false,
+		"bodyRequired": true,
+		"command": "update-spend-policy",
+		"description": "Update your org's spend policy. Applied as a merge: only the fields you\ninclude change, and omitted fields keep their current value, so a partial\nupdate can't silently reset the kill-switch. Send an explicit `null` to\nclear a cap. Caps are in token base units.\n",
+		"hasJsonBody": true,
+		"method": "PUT",
+		"operationId": "updateSpendPolicy",
+		"path": "/x402/spend-policy",
+		"pathParams": [],
+		"queryParams": [],
+		"requestSchema": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Merge update: only the fields you include change; omit a field to keep\nits current value; send `null` to clear a cap.\n",
+			"properties": {
+				"paused": { "type": "boolean" },
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"pattern": "^[1-9][0-9]{0,38}$"
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"maxItems": 1e3,
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					}
+				}
+			}
+		},
+		"responseSchema": {
+			"type": "object",
+			"description": "The payer's outbound spend policy. Returned with defaults (not paused,\nno caps, any on-net payee) when none is set.\n",
+			"properties": {
+				"paused": {
+					"type": "boolean",
+					"description": "Kill-switch. When true, all outbound payments are refused."
+				},
+				"max_per_payment": {
+					"type": ["string", "null"],
+					"description": "Per-payment cap in token base units, or null for no cap."
+				},
+				"max_per_day": {
+					"type": ["string", "null"],
+					"description": "Rolling-day cap in token base units, or null for no cap."
+				},
+				"allowlist": {
+					"type": ["array", "null"],
+					"items": {
+						"type": "string",
+						"format": "uuid"
+					},
+					"description": "Allowed payee org ids. `null` allows any on-net payee; `[]` denies\nall.\n"
+				}
+			},
+			"required": [
+				"paused",
+				"max_per_payment",
+				"max_per_day",
+				"allowlist"
+			]
+		},
+		"sdkName": "updateSpendPolicy",
+		"summary": "Update your spend policy",
+		"tag": "Payments",
+		"tagCommand": "payments"
+	},
 	{
 		"binaryResponse": false,
 		"bodyRequired": true,