across-pay-mpp 1.0.0

package/.env

@@ -0,0 +1,3 @@
+TEMPO_WALLET_PRIVATE_KEY=0xe9fad02b3b0c226929ef15ae8ec790c0ddc110ab9f652f0575eedc3f085de00e
+MERCHANT_KEY=0x9593f890cb5779da1817bd921712d8446e7468f84b887a342fe5bf8795ce2f8b
+PORT=3000

package/.env.example

@@ -0,0 +1,5 @@
+TEMPO_WALLET_PRIVATE_KEY=0xyour_tempo_demo_private_key
+# Legacy fallback still accepted by the demo wallet adapter:
+# AGENT_PRIVATE_KEY=0xyour_agent_private_key
+MERCHANT_KEY=0xyour_merchant_private_key
+PORT=3000

package/.herenow/state.json

@@ -0,0 +1,7 @@
+{
+  "publishes": {
+    "frosty-plume-fvac": {
+      "siteUrl": "https://frosty-plume-fvac.here.now/"
+    }
+  }
+}

package/PRD.md

@@ -0,0 +1,236 @@
+# Across MPP Skill
+Enable agents to pay for MPP-protected resources from any chain using Across as a transparent crosschain funding layer.
+
+**Team:** Across Protocol
+**Contributors:** Hart Lambur (Product), Bobby Bola (Engineering)
+**Resources:** [Hart/Bobby Call Notes](https://docs.google.com/document/d/1XerVgt6PDbJJiqmjs5cxpH1TrX9NKTzjNIup4QMEON0/edit), [MPP Docs](https://mpp.dev), [Across Docs](https://docs.across.to), [Tempo Docs](https://docs.tempo.xyz)
+**Status:** Draft
+**Last Updated:** Monday, March 24, 2026
+
+---
+
+## Problem Alignment
+
+**Agents receiving a 402 Payment Required response cannot pay if their funds are on a different chain than the one the merchant expects.** MPP (Machine Payments Protocol) tells agents exactly where and how to pay, but if the agent holds USDC on Base and the merchant wants USDC on Tempo, the payment fails. There is no fallback.
+
+**Why does this matter to our customers and business?**
+
+- MPP is the emerging standard for machine-to-machine payments (co-developed by Tempo and Stripe). As adoption grows, agents will encounter 402 payment gates across hundreds of services, each potentially on a different chain. An agent that can only pay on one chain is severely limited.
+- Across is the leading crosschain intents protocol. If Across can transparently solve the "wrong chain" problem inside MPP, it becomes critical infrastructure for every agent making payments. This positions Across as the default crosschain rail for the entire MPP ecosystem.
+- Strategic partnerships with Tempo, Stripe, Coinbase, and Solana Foundation all benefit from Across making it easy to accept payments on any chain. Each partner can promote "accept payments everywhere, settle on your preferred chain" powered by Across.
+
+**What evidence or insights do we have?**
+
+- MPP is live and functional. Bobby has a working MPP implementation on testnet with Tempo charge and session payments.
+- Hart validated with Dan (Tempo/Paradigm) that MPP commoditizing payment chains is a world Across should push for — it increases Across's utility as the universal settlement layer.
+- The MPP SDK (`mppx`) has an async `createCredential` hook that allows arbitrary logic before payment signing, making the integration technically clean.
+
+---
+
+## High Level Approach
+
+Wrap the existing Tempo payment method with an Across pre-funding step. When an agent gets a 402 and doesn't have funds on the destination chain, Across bridges the shortfall to the agent's own address on that chain, then the standard payment completes as normal. The merchant never knows Across was involved. No protocol changes required.
+
+---
+
+## Goals
+
+1. **Agent can pay any Tempo MPP merchant from any Across-supported chain** — the core product promise. Agent has funds on Base, merchant wants Tempo, payment succeeds.
+2. **Zero merchant-side changes** — works with the existing Tempo/Stripe payment flow. Tempo and Stripe don't change a thing.
+3. **Transparent to the protocol** — the credential the merchant receives is a standard Tempo credential. Across is invisible middleware on the agent side.
+4. **Demoable end-to-end flow** — a working demo that shows: agent on Base -> 402 -> Across bridge -> Tempo charge -> resource unlocked. Something we can show Tempo, Stripe, and partners.
+5. **Foundation for Step 2** — the architecture should inform the merchant-side multi-chain acceptance + sweep story without blocking on it.
+
+**Immeasurable goals:**
+- An agent developer should feel like crosschain payments "just work" — no extra config, no new methods to learn.
+- Hart, Dan, and partners should look at the demo and immediately see how this plugs into their ecosystem.
+
+## Non-goals
+
+- **Building a new MPP payment method** — we are not creating an "across" payment method alongside "tempo". We are augmenting the existing tempo method. Creating a new method would require merchant adoption and fragment the ecosystem.
+- **Merchant-side multi-chain sweep (Step 2)** — deploying contracts on every chain, accepting payments everywhere, and periodically rebalancing to a preferred chain via Across. This is the next phase, not this one.
+- **Virtual addresses (Step 3)** — Tempo's virtual address concept (sub-addresses with encoded crosschain instructions) is interesting but premature. Deferred until Tempo ships the feature.
+- **x402 compatibility** — Coinbase's x402 is a separate but similar protocol. We should build for both eventually, but this PRD focuses on MPP/Tempo. The architecture should be portable.
+- **Production key management** — for this phase, a private key in an env var is sufficient. WebAuthn/passkey/KMS integration is a production concern for later.
+- **Gas optimization** — for 2-cent micropayments, per-request bridging doesn't make economic sense (bridging costs may exceed payment). That's exactly what Step 2 solves. Step 1 targets payments where the bridge cost is acceptable relative to the payment amount.
+
+---
+
+## Solution Alignment
+
+### Key Features
+
+**Plan of record:**
+
+1. **Working MPP/Tempo baseline** — standard mppx client with Tempo payment method, tested against `mpp.dev/api/ping/paid`. This validates the payment flow works before adding Across.
+
+2. **Across pre-funding wrapper** — the core feature. Wraps `tempo()` client method's `createCredential` with balance-check-and-bridge logic. If the agent has funds on the destination chain, the wrapper is a no-op. If not, it bridges the shortfall via Across to the agent's own address on the destination chain, then delegates to the standard Tempo signing.
+
+3. **Across API integration layer** — helpers for quote fetching (`GET /swap/approval`), transaction execution, and deposit status polling. Thin wrapper around the Across Swap API.
+
+4. **Demo surface (Agent Shop)** — simple server with a premium endpoint behind a standard Tempo payment gate. The server is vanilla mppx — no custom verifier, no awareness of Across. Proves the wrapper works transparently.
+
+5. **402 challenge documentation** — captured and documented real 402 response shape, decoded challenge fields, credential format. Serves as the internal protocol reference.
+
+**Future considerations:**
+
+- **Step 2: Merchant multi-chain acceptance + Across sweep** — merchants deploy lightweight contracts on multiple chains, accept payments natively, and Across rebalances to their preferred chain hourly/daily. This is the pitch to Stripe, Tempo, Coinbase, and Solana. Architecture from Step 1 informs but doesn't block this.
+- **Step 2: x402 support** — same Across pre-funding wrapper pattern applied to Coinbase's x402 protocol. Portable architecture.
+- **Step 3: Virtual addresses** — Tempo's upcoming feature where sub-addresses encode crosschain routing instructions. Could eliminate the need for agent-side bridging entirely.
+- **Session (pay-as-you-go) support** — Step 1 targets `charge` (one-time payments). Extending to `session` (streaming micropayments) where the agent pre-funds a payment channel on Tempo.
+- **Multi-chain balance detection** — automatically detect which chain the agent has funds on, rather than hardcoding an origin chain. Could query balances across all Across-supported chains and pick the cheapest/fastest route.
+
+### Key Flows
+
+**Flow 1: Agent pays Tempo merchant from a different chain (primary flow)**
+
+```
+Agent (funds on Base)              Across                    Merchant (Tempo)
+  |                                  |                          |
+  |--- GET /premium-resource ------------------------------------->|
+  |<-- 402 Payment Required + WWW-Authenticate: tempo charge ------|
+  |    (amount: "100000", currency: "USDC", recipient: "0xMerch")  |
+  |                                  |                          |
+  | [createCredential fires]         |                          |
+  | [check USDC balance on Tempo: $0]|                          |
+  | [need $1 USDC, bridge shortfall] |                          |
+  |                                  |                          |
+  |--- GET /swap/approval ---------->|                          |
+  |    originChainId: 8453 (Base)    |                          |
+  |    destChainId: 4217 (Tempo)     |                          |
+  |    amount: "100000"              |                          |
+  |    recipient: agent's own addr   |                          |
+  |    tradeType: exactOutput        |                          |
+  |<-- quote + swap tx data ---------|                          |
+  |                                  |                          |
+  |--- sign + send swap tx -------->|                          |
+  |    (1 tx on Base)                |                          |
+  |                                  |--- relayer fills ------->|
+  |                                  |    (USDC to agent addr)  |
+  |<-- fill confirmed (~5-15s) -----|                          |
+  |                                  |                          |
+  | [agent now has USDC on Tempo]    |                          |
+  | [sign standard EIP-3009 TransferWithAuthorization]          |
+  |                                  |                          |
+  |--- GET /premium-resource (retry) + Tempo credential ------->|
+  |<-- 200 + premium content ----------------------------------------|
+```
+
+**Flow 2: Agent already has funds on destination chain (pass-through)**
+
+```
+Agent (funds on Tempo)                                   Merchant (Tempo)
+  |                                                         |
+  |--- GET /premium-resource --------------------------------->|
+  |<-- 402 + WWW-Authenticate: tempo charge ------------------|
+  |                                                         |
+  | [createCredential fires]                                |
+  | [check USDC balance on Tempo: sufficient]               |
+  | [skip bridge — no-op]                                   |
+  | [sign standard Tempo charge]                            |
+  |                                                         |
+  |--- GET /premium-resource (retry) + Tempo credential --->|
+  |<-- 200 + premium content -------------------------------|
+```
+
+**Flow 3: Bridge completes but challenge expired (graceful retry)**
+
+```
+Agent (funds on Base)              Across                    Merchant (Tempo)
+  |                                  |                          |
+  |--- GET /resource ------------------------------------------>|
+  |<-- 402 + challenge (expires in 30s) -----------------------|
+  |                                  |                          |
+  | [bridge takes 25s...]           |                          |
+  | [challenge expired during bridge]|                          |
+  | [but funds are now on Tempo!]    |                          |
+  |                                  |                          |
+  |--- GET /resource (new request) ----------------------------->|
+  |<-- 402 + fresh challenge -----------------------------------|
+  |                                  |                          |
+  | [have funds on Tempo now]        |                          |
+  | [sign immediately — instant]     |                          |
+  |                                  |                          |
+  |--- GET /resource (retry) + Tempo credential --------------->|
+  |<-- 200 + resource ------------------------------------------|
+```
+
+### Key Logic
+
+| Rule | Detail |
+|------|--------|
+| **Bridge to self, never to merchant** | Across always bridges to the agent's own address on the destination chain. The agent retains control of funds if anything goes wrong downstream. The standard Tempo charge handles the merchant payment. |
+| **Bridge only the shortfall** | If the agent has $0.50 on Tempo and needs $1.00, bridge $0.50, not $1.00. Use `tradeType: exactOutput` for precise amounts. |
+| **No-op when funded** | If balance >= needed amount, skip the bridge entirely. The wrapper adds zero latency to the happy path. |
+| **Challenge expiry is recoverable** | If the bridge takes longer than the challenge allows, the agent simply makes a new request. Funds are already on Tempo, so the retry is instant. This is not a failure — it's the expected flow for slow bridges. |
+| **One origin-chain transaction** | The agent executes one tx (the bridge swap on Base). The Tempo charge is an off-chain signature. With server fee sponsorship, the agent needs zero gas on Tempo. |
+| **Token address mapping** | USDC has different contract addresses per chain. The wrapper needs a mapping from the challenge's token (on Tempo) to the equivalent token on the origin chain. Across's discovery endpoint provides this. |
+| **Gas on Tempo** | Not required for the agent. The Tempo charge is an EIP-3009 off-chain signature. The server/facilitator broadcasts the on-chain tx and can sponsor gas via Tempo's `feePayer` feature. |
+
+---
+
+## Launch Plan
+
+### Key Milestones
+
+| Target Date | Milestone | Description | Exit Criteria |
+|-------------|-----------|-------------|---------------|
+| 2026-03-25 | Phase 1: Tempo Baseline | Basic mppx client with Tempo payments working | Successfully pay `mpp.dev/api/ping/paid`, 402 challenge shape documented |
+| 2026-03-27 | Phase 2: Across Wrapper | Pre-funding wrapper around tempo() with Across bridge | Agent on Base successfully pays a Tempo merchant end-to-end |
+| 2026-03-28 | Phase 3: Demo Surface | Agent Shop with standard Tempo payment gate | Demoable end-to-end flow: agent on Base -> 402 -> bridge -> pay -> resource |
+| 2026-03-31 | Review with Hart | Demo the working flow, discuss Step 2 | Hart validates direction, agrees on Step 2 scope |
+
+**Risks and dependencies:**
+
+| Risk | Impact | Mitigation |
+|------|--------|------------|
+| `mppx` tempo() method's `createCredential` may not be wrappable | Blocks the wrapper approach | Fallback: use `Method.toClient` with the same Tempo method definition and implement signing manually |
+| Across fill times may exceed typical challenge expiry | Agent needs two requests instead of one | Acceptable — second request is instant since funds are already on Tempo. Document this as expected behavior. |
+| Tempo testnet may have reliability issues | Blocks testing | Use `mpp.dev/api/ping/paid` as primary test surface; fall back to local demo server |
+| Agent needs a funded wallet on Base (testnet) for testing | Blocks end-to-end demo | Fund a test wallet via Base Sepolia faucet or Across testnet |
+
+### Operational Checklist
+
+| Team | Prompt | Y/N | Action |
+|------|--------|-----|--------|
+| Partners | Will this impact Tempo or Stripe? | No | Agent-side only. No partner changes needed for Step 1. |
+| Partners | Should we coordinate with Dan/Tempo? | Yes | Share demo with Dan after Phase 3. Discuss promoting Across skill on Tempo docs. |
+| Risk | Does this expose a risk vector? | Yes | Agent funds are at risk during bridge. Mitigated by bridge-to-self (agent retains control). Never bridge directly to merchant. |
+| Legal | Are there potential legal ramifications? | No | Standard crosschain bridge usage. No custody of user funds. |
+
+---
+
+## Appendix
+
+### Changelog
+
+| Date | Description |
+|------|-------------|
+| 2026-03-24 | Initial PRD drafted from Hart/Bobby call notes and architecture review. Key decision: Across integrates INTO the existing Tempo flow (wrapping `tempo()` createCredential), not as a separate payment method. |
+
+### Open Questions
+
+| # | Question | Status | Answer |
+|---|----------|--------|--------|
+| 1 | Can we wrap `tempo()` return value's `createCredential` directly, or do we need to use `Method.toClient`? | Open | Need to inspect mppx source or test empirically |
+| 2 | What is the actual challenge expiry time for Tempo merchants? | Open | Will capture from real 402 in Phase 1 |
+| 3 | Which testnet should we use for end-to-end testing? | Open | Tempo testnet + Base Sepolia likely |
+| 4 | Should we support multiple origin chains in Step 1, or just Base? | Open | Recommend Base only for Step 1, multi-chain in Step 2 |
+| 5 | How does the Across Swap API handle Tempo (chain 4217)? Is it supported? | Open | Need to verify via Across API discovery endpoint |
+
+### FAQs
+
+**Q: Why not create a separate "across" payment method?**
+A: Because it would require every merchant to explicitly add the "across" method to their server. Hart's constraint is clear: Tempo and Stripe change nothing. By wrapping the existing Tempo method, every Tempo merchant automatically works with Across-powered agents.
+
+**Q: What happens if the bridge fails?**
+A: The agent's funds stay on the origin chain (the bridge tx reverts or never completes). The `createCredential` function throws an error, and the mppx client returns a payment failure. No money is lost because we bridge to the agent's own address, not to the merchant.
+
+**Q: Isn't per-request bridging expensive for micropayments?**
+A: Yes. For 2-cent payments, bridge gas costs may exceed the payment itself. That's exactly what Step 2 solves: merchants accept payments on multiple chains natively, and Across sweeps balances back to their preferred chain periodically. Step 1 targets payments where the amount justifies the bridge cost.
+
+**Q: How is this different from x402?**
+A: x402 is Coinbase's version of the same concept (HTTP 402 payment protocol). MPP is Stripe/Tempo's version. They're architecturally similar. The Across pre-funding wrapper pattern is portable to x402 — we'd just wrap the x402 payment method instead of the Tempo one. We start with MPP because of the Dan/Tempo relationship.
+
+**Q: Can the agent pre-sign the Tempo charge before the bridge completes?**
+A: No. The EIP-3009 `TransferWithAuthorization` requires the signer to have a sufficient token balance at execution time. The server verifies this when broadcasting. The bridge must complete first.

package/PROGRESS-UPDATE.md

@@ -0,0 +1,214 @@
+# Across MPP Progress Update
+
+## Latest: March 25, 2026 — Real Merchant Test Passed
+
+**The full Across + MPP flow works against a real production merchant.** An agent with USDC on Base scraped the Across homepage via Firecrawl, paying $0.002 on Tempo after bridging funds crosschain via Across. Firecrawl had no idea Across was involved — it saw a standard Tempo charge.
+
+### The Proof: Firecrawl Scrape via Across Bridge
+
+| Field | Value |
+|-------|-------|
+| Time | 2026-03-25T09:04:59 UTC |
+| Merchant | Firecrawl (production) |
+| Result | **SUCCESS (via Across bridge)** |
+| Total time | 27.9 seconds |
+| Payment | $0.002 USDC.e to Firecrawl |
+| Bridge cost | ~$0.025 (Base USDC → Tempo USDC.e) |
+| Content received | "Fast, Cheap, Secure Crosschain Bridge for ETH, WBTC, USDC & USDT" — 4821 chars |
+| Proof file | `firecrawl-response.json` |
+
+### Transaction Trail
+
+| Step | Explorer Link |
+|------|--------------|
+| Bridge deposit (Base) | [basescan.org/tx/0x345470...](https://basescan.org/tx/0x3454709c2725aa34d29dbd353bef3088c94d8138832871c073569d8ccb3a5483) |
+| Across transfer | [app.across.to/transfer/0x345470...](https://app.across.to/transfer/0x3454709c2725aa34d29dbd353bef3088c94d8138832871c073569d8ccb3a5483) |
+| Bridge fill (Tempo) | [explore.tempo.xyz/tx/0x36f2d0...](https://explore.tempo.xyz/tx/0x36f2d0ac16078be1278f6edaee4b52d4b12c5eae53ea8dd3f40b2f4305a0b16a) |
+| Tempo payment | [explore.tempo.xyz/tx/0x9e3685...](https://explore.tempo.xyz/tx/0x9e368560c6505687b3b36c1496be7c3ea3a78c4f9ecf778ccf3a2f5fa70da8df) |
+| Firecrawl recipient | [explore.tempo.xyz/address/0xca4e83...](https://explore.tempo.xyz/address/0xca4e835F803cB0b7C428222B3A3B98518d4779Fe) |
+
+### Also tested: Direct Tempo charge (no bridge)
+
+When the agent already had USDC.e on Tempo, the bridge was skipped and the charge went through directly in 20.7 seconds. This validates both paths:
+- **With Across:** agent has no Tempo funds → bridge from Base → pay → get content
+- **Without Across:** agent has Tempo funds → pay directly → get content
+
+---
+
+## Previous: March 24, 2026 — Local Server Test Passed
+
+First successful Across bridge + Tempo charge against our own demo server on mainnet.
+
+| Field | Value |
+|-------|-------|
+| Time | 2026-03-24T23:14:28 UTC |
+| Merchant | Local demo server (localhost:3000) |
+| Result | **SUCCESS (via Across bridge)** |
+| Total time | 13.8 seconds |
+| Payment | $0.15 USDC.e to merchant |
+
+### Transaction Trail (March 24)
+
+| Step | Explorer Link |
+|------|--------------|
+| Bridge deposit (Base) | [basescan.org/tx/0x6a39cc...](https://basescan.org/tx/0x6a39cc1087066ea00f2b878565d9cdaee76d821489d7f094a10293d461da40f4) |
+| Across transfer | [app.across.to/transfer/0x6a39cc...](https://app.across.to/transfer/0x6a39cc1087066ea00f2b878565d9cdaee76d821489d7f094a10293d461da40f4) |
+| Bridge fill (Tempo) | [explore.tempo.xyz/tx/0x547d9c...](https://explore.tempo.xyz/tx/0x547d9ca9e4560ffc2cdb5bce8dc5ce6ca557f62b878d418f4e2e32d1041b812b) |
+| Tempo payment | [explore.tempo.xyz/tx/0xa7d784...](https://explore.tempo.xyz/tx/0xa7d784057eddee97b3459a2f21b54daec356c4e597a0472ccdf4f503d29b45fa) |
+
+---
+
+## What We Built
+
+### Architecture
+
+```
+Agent (Base USDC)  →  Across Bridge (~2-5s fill)  →  Tempo USDC.e  →  Tempo Charge  →  Merchant paid
+```
+
+Across is wrapped INSIDE the existing Tempo payment method via mppx's `onChallenge` hook. The merchant sees a standard Tempo credential. No protocol changes, no new payment methods, no server-side modifications.
+
+### Components
+
+| File | Purpose |
+|------|---------|
+| `src/buyer/tempo-with-across.ts` | **Core wrapper** — `onChallenge` hook checks Tempo balance, bridges via Across if needed, then delegates to standard Tempo charge |
+| `src/buyer/across.ts` | Across API helpers — quote fetching, deposit status polling, chain/token config |
+| `src/buyer/balance.ts` | Token balance checker for Tempo mainnet and origin chains |
+| `src/dev/server.ts` | Demo MPP server on Tempo mainnet with separate merchant address |
+| `src/demo/external.ts` | Test against real MPP merchants (Firecrawl) with proof-of-access logging |
+| `src/demo/local.ts` | Test against local demo server with full logging |
+| `src/dev/preflight.ts` | Pre-test validation (free, no transactions) |
+| `src/capture-402.ts` | Raw 402 challenge inspection tool |
+
+### How the onChallenge Hook Works
+
+```ts
+// Inside Mppx.create({ onChallenge: ... })
+
+1. Parse 402 challenge (amount, currency, recipient, chain)
+2. Check USDC.e balance at agent's key address on Tempo
+3. If sufficient → skip bridge → standard Tempo charge proceeds
+4. If insufficient → calculate shortfall + gas buffer (0.01 USDC.e)
+5. Get Across quote (exactOutput, Base USDC → Tempo USDC.e)
+6. Send approval tx on Base → wait for confirmation
+7. Send bridge tx on Base → wait for confirmation
+8. Poll Across deposit status → wait for fill on Tempo (~2-5s)
+9. Return undefined → standard Tempo charge proceeds with new balance
+```
+
+---
+
+## Addresses
+
+| Role | Address | Explorer |
+|------|---------|----------|
+| Agent (buyer) | `0x8d2FD2173f5d40Ef4691cE8009D788950F843EBc` | [Base](https://basescan.org/address/0x8d2FD2173f5d40Ef4691cE8009D788950F843EBc) / [Tempo](https://explore.tempo.xyz/address/0x8d2FD2173f5d40Ef4691cE8009D788950F843EBc) |
+| Demo merchant | `0x530F217b0E9EC0a782613857BFFB26D09DE317Fd` | [Tempo](https://explore.tempo.xyz/address/0x530F217b0E9EC0a782613857BFFB26D09DE317Fd) |
+| Firecrawl merchant | `0xca4e835F803cB0b7C428222B3A3B98518d4779Fe` | [Tempo](https://explore.tempo.xyz/address/0xca4e835F803cB0b7C428222B3A3B98518d4779Fe) |
+
+## Current Wallet State (March 25)
+
+| Chain | Asset | Balance | Address |
+|-------|-------|---------|---------|
+| Base | USDC | ~5.99 | `0x8d2F...3EBc` (agent) |
+| Base | ETH | ~0.0004 | `0x8d2F...3EBc` (agent) |
+| Tempo (SCW) | USDC.e | ~10.5 | `0xbceb...c435` (wallet) |
+| Tempo (key) | USDC.e | ~0.01 | `0x8d2F...3EBc` (agent, leftover from bridge buffer) |
+
+---
+
+## What We Learned
+
+### Tempo Networks
+- **Mainnet** (chain 4217, `rpc.tempo.xyz`) — production MPP services (Firecrawl, Browserbase, Tavily), Across bridges here
+- **Moderato/Testnet** (chain 42431, `rpc.moderato.tempo.xyz`) — `mpp.dev/api/ping/paid` lives here, Across does NOT support this
+- mppx auto-selects network based on the challenge's `chainId`
+
+### Tempo Account Model
+- Smart contract wallets (SCW) hold funds; keys are authorized signers
+- mppx checks balance at the key address, not the wallet
+- Across deposits directly to the key address, bypassing the SCW
+- `tempo wallet transfer` moves funds within the wallet system, not to key's EOA balance
+
+### Token Types
+- **pathUSD** (`0x20c...0000`) — testnet default
+- **USDC.e** (`0x20c...b9537d`) — mainnet default, what Across delivers and merchants charge
+
+### Bugs Fixed (March 24)
+1. Approval tx not confirmed before bridge tx → added `waitForTransactionReceipt`
+2. No gas buffer → added 0.01 USDC.e buffer to shortfall
+3. Wrong network (testnet vs mainnet) → switched to mainnet services
+4. Fee sponsorship failed (empty merchant) → enabled after merchant received funds
+
+---
+
+## Full Test History
+
+| # | Date | Time | Target | Result | Across | Issue |
+|---|------|------|--------|--------|--------|-------|
+| 1 | Mar 24 | 19:41 | mpp.dev (testnet) | ERROR | No | Wrong token (pathUSD vs USDC.e) |
+| 2 | Mar 24 | 19:41 | mpp.dev (testnet) | ERROR | Attempted | Approval tx not confirmed |
+| 3 | Mar 24 | 22:22 | mpp.dev (testnet) | ERROR | No | Same token issue |
+| 4 | Mar 24 | 22:24 | mpp.dev (testnet) | ERROR | Yes (bridge worked!) | Bridge to mainnet, merchant on testnet |
+| 5 | Mar 24 | 22:48 | localhost (mainnet) | ERROR | No | Fee sponsor empty |
+| 6 | Mar 24 | 22:51 | localhost (mainnet) | **SUCCESS** | No (had balance) | Direct charge, no bridge needed |
+| 7 | Mar 24 | 23:06 | localhost (mainnet) | ERROR | Yes (bridge worked!) | No gas buffer |
+| 8 | Mar 24 | 23:14 | localhost (mainnet) | **SUCCESS** | **Yes** | Full Across bridge + charge |
+| 9 | Mar 25 | 08:59 | Firecrawl (mainnet) | **SUCCESS** | No (had balance) | Direct charge to real merchant |
+| 10 | Mar 25 | 09:04 | Firecrawl (mainnet) | **SUCCESS** | **Yes** | **Full flow: Across bridge → real merchant** |
+
+---
+
+## March 25, 2026 (afternoon) — Skill Packaged & Tested on Fresh Instance
+
+**The Across MPP Bridge skill works end-to-end on a completely fresh Claude Code instance** — no prior context, no memory, no existing code. A cold agent picked up the skill, wrote the code, connected to Firecrawl, and successfully scraped content via crosschain payment.
+
+### Skill evolution (4 iterations)
+
+| Version | Change | Result |
+|---------|--------|--------|
+| v0.1 | Initial — 3 files, hardcoded Tempo, dotenv setup | Worked but agent hardcoded origin chain, top-level await broke |
+| v0.2 | Removed dotenv, wrapped in `async main()`, better triggers | Fixed breakage, agent still over-specified config |
+| v0.3 | Chain-agnostic (dynamic routes), auto-detect origin, accept any payment methods | Generic — works with any merchant on any Across-supported chain |
+| v0.4 | **Single file**, graceful RPC failure handling, removed `originChainIds` hint from example | Clean. Fresh agent used it successfully without over-specializing |
+
+### What the skill does
+
+One file (`src/mpp-with-across.ts`, ~150 lines) that wraps any mppx payment method with Across bridging:
+- Reads destination chain from the 402 challenge (`methodDetails.chainId`)
+- Auto-detects which origin chain the agent has funds on
+- Dynamically discovers Across routes via `GET /available-routes`
+- Bridges shortfall + gas buffer, waits for fill
+- Standard payment charge proceeds — merchant sees normal credential
+- Stripe/Lightning/Card pass through untouched (no `chainId` = no bridge)
+
+### Skill location
+
+`/Users/bobbybola/agentmpp/across-mpp-bridge/SKILL.md`
+
+### Key learnings from skill testing
+
+1. **Don't hint at hardcoding** — showing `originChainIds: [8453]` even as a comment caused the agent to hardcode it
+2. **Single file > multiple files** — 3 files for 200 lines was over-modularized. Fresh agents create unnecessary helper files
+3. **Wrap in `async main()`** — top-level await breaks under tsx/CJS, the most common way people run .ts
+4. **Graceful RPC failures** — silently skip chains with bad RPCs instead of crashing the whole auto-detect loop
+5. **Trigger description matters** — vague descriptions don't activate the skill. Needs explicit coding keywords like "set up", "add", "handle 402", "crosschain integration"
+
+---
+
+## Next Steps
+
+### Immediate
+1. **Publish skill to GitHub** — host at `across-protocol/skills` or separate repo, installable via `npx skills add`
+2. **Test with more merchants** — Browserbase ($0.01), Tavily ($0.09) to verify chain-agnostic behavior
+3. **Test with non-Base origin** — verify auto-detect picks Arbitrum/Optimism when funds are there
+
+### Step 2 (Hart's roadmap)
+4. **Merchant multi-chain acceptance** — merchants accept payments on multiple chains, Across sweeps to preferred chain periodically
+5. **Pitch to Tempo/Stripe** — "accept payments from any chain, settle on your preferred chain"
+6. **x402 support** — same Across wrapper pattern for Coinbase's protocol
+
+### Step 3 (future)
+7. **Solana origin chain support** — needs `@solana/web3.js` for signing (currently Solana is destination-only)
+8. **Virtual addresses** — Tempo's upcoming feature for sub-address routing

package/README.md

@@ -0,0 +1,35 @@
+# MPP Tempo Buyer Demo
+
+Tempo-first MPP buyer demo with Across pre-funding.
+
+## What Lives Here
+
+- `src/buyer/` contains the MPP buyer flow and Across funding logic.
+- `src/demo/` contains runnable demo entrypoints.
+- `src/dev/` contains local-only dev helpers and the local seller.
+- `STEP2-DEMO-PLAN.md` is the agreed build plan for the separate MPP Step 2 batching demo.
+
+## Wallet Surface
+
+The demo uses a **Tempo-native smart account** via `Account.fromSecp256k1()` from `viem/tempo`. This gives the buyer proper Tempo signature envelopes, access key support, and fee sponsorship capability — unlike a plain viem EOA.
+
+The wallet is resolved through `src/buyer/tempo-wallet.ts`:
+
+- Preferred env: `TEMPO_WALLET_PRIVATE_KEY`
+- Backward-compatible fallback: `AGENT_PRIVATE_KEY`
+
+## Commands
+
+```bash
+npm install
+npm run preflight
+npm run demo:local
+npm run demo:external
+npm run dev:server
+```
+
+## Notes
+
+- `demo:local` targets the local MPP dev seller by default.
+- `demo:external` targets Firecrawl on Tempo mainnet.
+- The local dev server remains here for smoke testing and workflow demos, but the product-facing story is buyer-first.

package/SESSION-LOG.md

@@ -0,0 +1,122 @@
+# Session Log — March 24, 2026
+
+## What We Built
+
+An Across-powered crosschain payment layer for MPP (Machine Payments Protocol). When an agent gets a 402 Payment Required and doesn't have funds on the merchant's chain, Across bridges funds transparently before completing the standard Tempo charge.
+
+## Key Decisions
+
+1. **Across wraps INSIDE the existing Tempo flow** — not a separate payment method. The merchant sees a standard Tempo credential and never knows Across was involved. This was Hart's core requirement: "Tempo and Stripe don't change a thing."
+
+2. **`onChallenge` hook is the integration point** — mppx's `Mppx.create()` accepts an `onChallenge` callback that fires before credential creation. This is where the Across pre-funding logic lives. It checks Tempo balance, bridges if needed, then returns `undefined` to let the standard Tempo charge proceed.
+
+3. **`autoSwap: true` solves the token mismatch** — Tempo has two stablecoins: USDC.e (`0x20c...b9537d`) and pathUSD (`0x20c...0000`). Merchants price in pathUSD. mppx's `tempo()` has a built-in `autoSwap` parameter that swaps USDC.e → pathUSD via Tempo's DEX automatically.
+
+## What We Discovered
+
+### Tempo Account Model
+- Tempo uses **smart contract wallets** (SCW), not plain EOAs
+- **Wallet** (`0xbceb415b...`) — holds funds, is a smart contract
+- **Key** (`0x8d2fd217...`) — an authorized signing key with $100 spending limit, expires 2026-04-23
+- The key signs on behalf of the wallet via Tempo's custom tx type (`0x76`)
+- `privateKeyToAccount()` from viem works — mppx handles the Tempo-specific routing
+
+### The Real 402 Challenge (from mpp.dev/api/ping/paid)
+```
+WWW-Authenticate: Payment
+  id="...",
+  realm="mpp.sh",
+  method="tempo",
+  intent="charge",
+  request=base64({
+    "amount": "100000",          // 0.10 USDC (6 decimals)
+    "currency": "0x20c0...0000", // pathUSD on Tempo
+    "methodDetails": {
+      "chainId": 42431,          // Tempo chain ID (RPC)
+      "feePayer": true           // Server pays gas!
+    },
+    "recipient": "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266"
+  }),
+  description="Ping endpoint access",
+  expires="2026-03-24T18:39:14.613Z"  // 5 min expiry
+```
+
+### Across Routes to Tempo
+- Across uses chain ID **4217** for Tempo (not 42431 from the RPC)
+- Routes from 15+ chains including Base, Arbitrum, Ethereum, Optimism, Polygon, Solana
+- Can bridge to **pathUSD** (`0x20c...0000`) or **USDC.e** (`0x20c...b9537d`)
+- Base USDC → Tempo pathUSD: ~2 second fill, ~$0.012 fees for a $0.10 payment
+- Quote example: $0.10 output costs $0.112 input (fees are mostly destination gas)
+
+### Bridge Economics (Hart's concern validated)
+For $0.10 micropayment: bridge fees ($0.012) are ~12% of the payment. This confirms Step 2 (merchant multi-chain acceptance + periodic sweep) is needed for micropayments. Step 1 works for payments where bridge cost is acceptable.
+
+## Current Wallet State
+
+| Chain | Asset | Balance | Address |
+|-------|-------|---------|---------|
+| Tempo (SCW) | USDC.e | ~12.59 | `0xbceb415b64e057f2fc4018921e0480ca49e7c435` |
+| Base | USDC | 6.37 | `0x8d2FD2173f5d40Ef4691cE8009D788950F843EBc` |
+| Base | ETH | 0.0004 | `0x8d2FD2173f5d40Ef4691cE8009D788950F843EBc` |
+
+Private key: `0xe9fad02b3b0c226929ef15ae8ec790c0ddc110ab9f652f0575eedc3f085de00e`
+(Also imported in Rabby wallet)
+
+## Project Files
+
+```
+agentmpp/
+├── PRD.md                      # Full product requirements doc
+├── across-mpp-step1-plan.md    # Original plan (from before this session)
+├── SESSION-LOG.md              # This file
+├── package.json                # mppx, viem, tsx, typescript
+├── tsconfig.json
+└── src/
+    ├── across.ts               # Across API helpers (getQuote, waitForFill, chain config)
+    ├── balance.ts              # Token balance checker (Tempo + origin chains)
+    ├── capture-402.ts          # Raw 402 inspection tool (no wallet needed)
+    ├── client.ts               # Basic mppx client with tempo + autoSwap
+    ├── tempo-with-across.ts    # THE CORE: onChallenge hook with Across pre-funding
+    ├── test-across.ts          # End-to-end Across test script
+    └── test-ping.ts            # Basic Tempo-only test script
+```
+
+## What's Working
+
+- [x] Tempo CLI installed and authenticated (v1.5.0)
+- [x] mppx v0.4.9 + viem installed
+- [x] 402 challenge captured and fully decoded
+- [x] Basic Tempo client created with `autoSwap: true`
+- [x] Across API confirmed working (quote for Base → Tempo)
+- [x] Across wrapper code complete (`tempo-with-across.ts`)
+
+## What's NOT Tested Yet
+
+- [ ] **Basic Tempo charge with `autoSwap`** — should swap USDC.e → pathUSD and pay. Run:
+  ```
+  AGENT_PRIVATE_KEY=0xe9fad02b3b0c226929ef15ae8ec790c0ddc110ab9f652f0575eedc3f085de00e npx tsx src/test-ping.ts
+  ```
+- [ ] **Across end-to-end flow** — Base USDC → Across → Tempo pathUSD → charge. Run:
+  ```
+  AGENT_PRIVATE_KEY=0xe9fad02b3b0c226929ef15ae8ec790c0ddc110ab9f652f0575eedc3f085de00e npx tsx src/test-across.ts
+  ```
+- [ ] Demo server (Phase 3)
+
+## Next Session: Pick Up Here
+
+1. Run `test-ping.ts` — validates basic Tempo charge with autoSwap
+2. Run `test-across.ts` — validates full Across crosschain flow
+3. If both pass, build the demo server (Phase 3)
+4. Then review with Hart
+
+## Reference Links
+
+- [MPP Docs](https://mpp.dev)
+- [MPP Full LLM Context](https://mpp.dev/llms-full.txt)
+- [mppx Client Quickstart](https://mpp.dev/quickstart/client)
+- [Custom Payment Methods](https://mpp.dev/payment-methods/custom)
+- [Across Skills](https://skills.across.to/)
+- [Across MCP Server](https://mcp.across.to/mcp)
+- [Tempo SKILL.md](https://tempo.xyz/SKILL.md)
+- [Tempo Docs](https://docs.tempo.xyz)
+- [Hart/Bobby Call Notes](https://docs.google.com/document/d/1XerVgt6PDbJJiqmjs5cxpH1TrX9NKTzjNIup4QMEON0/edit)