warpmetal 0.7.8 → 0.8.0

package/README.md

@@ -124,6 +124,12 @@ treasury; the merchant tenant's active allowance controls sponsorship
 admission but is not charged actual gas. Payment authority depends on execution
 context:
 
+WarpMetal can advertise any currently executable subset of those rails, from a
+single alternative through all three. Agent Kit requires the sponsorship and
+external-recipient extension bindings to match the advertised alternatives
+exactly, then preserves the chosen authorization artifact byte-for-byte for
+every pending or ambiguous retry.
+
 - When a human is actively chatting with the agent, show the exact live terms
   and ask for confirmation immediately before authorizing and submitting.
 - In an unattended run, a pre-funded dedicated wallet is standing spend
@@ -191,7 +197,7 @@ or escalation mechanism or stop with `funding_required`.
 
 Configure renewal only with explicit bounds. This example allows at most 12
 renewals, enforces a 30 USDC per-payment ceiling and a 360 USDC cumulative
-budget, and requests a verified notification recipient:
+budget, and activates a human notification recipient after server authorization:
 
 ```sh
 warpmetal renewal configure \
@@ -207,12 +213,26 @@ warpmetal renewal configure \
   --json
 ```
 
-The recipient must follow the one-time verification link before lifecycle or
-refill mail is sent. If no verified notification email exists, `renewal
-configure` returns `email_required` before changing policy. Supply `--email`,
-or deliberately continue with `--without-email-notifications`; the latter does
-not enable signed refill-email workflows. A recurring unattended agent can then
-run:
+No email verification is required: the saved owner credential or an SSH-derived
+server token authorizes the change. WarpMetal queues a branded transactional
+advisory identifying the server, why the address was added, and a link that
+removes only that address. Up to five active addresses may be attached
+to one server. If none exists, `renewal configure` returns `email_required`
+before changing policy. Supply `--email`, or deliberately continue with
+`--without-email-notifications`; the latter does not enable signed refill-email
+workflows. A recurring unattended agent can then run:
+
+```sh
+warpmetal notifications add --server <serverId> --email ops@example.com --json
+warpmetal notifications list --server <serverId> --json
+warpmetal notifications remove --server <serverId> --recipient <recipientId> --json
+warpmetal notifications events --server <serverId> --events renewal.due,server.ready --json
+warpmetal notifications disable --server <serverId> --json
+```
+
+After provisioning, `warpmetal order status` includes the structured
+`ask_human_for_notification_email` next action until a recipient is active or
+the human explicitly opts out. Public CLI output contains only masked addresses.
 
 ```sh
 warpmetal renewal due --all --json
@@ -221,17 +241,17 @@ warpmetal renewal run --all-due --json
 
 Inside policy, the CLI returns the exact Agent Wallet authorization and submit
 argv. If balance is insufficient, `refillWorkflow` is returned only when the
-server has an active verified notification subscription. Run its argv with the
+server has an active notification recipient. Run its argv with the
 returned `X402API_NOTIFICATION_URL` environment value. `x402api wallet
 notify-refill` signs an opaque subscription reference and wallet-produced
 balance fields; it cannot choose an email address. WarpMetal verifies the
-wallet signature and current on-chain balance before emailing the verified
-human the network, stablecoin, public wallet address, required minimum top-up,
+wallet signature and current on-chain balance before emailing every active
+human recipient the network, stablecoin, public wallet address, required minimum top-up,
 and a locally generated QR encoding only that wallet address. The address is
 also repeated as copyable text. The human may transfer more than that minimum;
 the renewal policy—not the refill target—remains the spending authority.
 
-The agent never sends a partial x402 payment. If no verified refill path
+The agent never sends a partial x402 payment. If no active recipient refill path
 exists, it reports `funding_required`. If a previous payment is pending or
 ambiguous, it reconciles the saved attempt and never signs a second payment.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "warpmetal",
-  "version": "0.7.8",
+  "version": "0.8.0",
   "description": "Agent-safe CLI and skill for purchasing, renewing, and managing WarpMetal VPS servers",
   "type": "module",
   "bin": {

package/skills/warpmetal/SKILL.md

@@ -173,7 +173,8 @@ use `paymentWorkflow.fundingWorkflow` to obtain the public address and balance,
 then show the address as both a QR code and copyable text. Only when
 `refillNotification.available` is true, set the returned
 `refillWorkflow.environment`, invoke its exact argv once, and stop until
-funding arrives. The signed refill intent resolves to a verified human contact;
+funding arrives. The signed refill intent resolves server-side to the active
+SSH-authorized human recipients;
 never add an email address to it. Never make a partial payment.
 
 After funding, prepare again, authorize exactly once, submit with WarpMetal,
@@ -188,6 +189,15 @@ Poll a prepared or paid order with:
 warpmetal order status --task <taskId> --wait --json
 ```
 
+When the ready response contains
+`nextAction.action: ask_human_for_notification_email`, ask the human whether
+they want renewal and lifecycle notices. If yes, add the supplied address with
+`warpmetal notifications add --server <serverId> --email <address> --json`.
+The server credential is the authorization; there is no email verification
+step. The address receives a branded advisory and can remove itself without
+affecting other recipients. If the human declines, run the returned
+`notifications disable` command so future status checks do not ask again.
+
 `manual_review` remains terminal for payment and mutation attempts. A later
 read-only status check may observe the backend's authoritative reconciliation;
 prepare a replacement only for the exact `retrySafe: true` result described

package/skills/warpmetal/references/cli-reference.md

@@ -125,15 +125,25 @@ warpmetal renewal prepare --server <serverId> --json
 warpmetal renewal submit --server <serverId> \
   --payment-artifact <path> [--wait] --json
 warpmetal renewal run (--server <serverId> | --all-due) --json
-warpmetal notifications configure --server <serverId> --email <address> \
+warpmetal notifications add --server <serverId> --email <address> \
   [--events <comma-separated-events>] --json
-warpmetal notifications status --server <serverId> --json
+warpmetal notifications list --server <serverId> --json
+warpmetal notifications remove --server <serverId> --recipient <recipientId> --json
+warpmetal notifications events --server <serverId> \
+  --events <comma-separated-events> --json
+warpmetal notifications disable --server <serverId> --json
 ```
 
-Without a verified notification email, renewal configuration asks for an email
-before mutating policy unless `--without-email-notifications` explicitly opts
-out. `renewal prepare` always returns safe funding address/balance argv and
-returns signed refill-email argv only for a verified active subscription.
+After a server becomes ready, `order status` returns
+`nextAction.action: ask_human_for_notification_email` when setup has not been
+completed or dismissed. Ask the human for an optional address, then use
+`notifications add`; the server credential authorizes immediate activation, so
+there is no verification step. A branded advisory identifies the server and
+provides recipient-scoped removal. Up to five active recipients are supported.
+Renewal configuration asks for an email before mutating policy unless
+`--without-email-notifications` explicitly opts out. `renewal prepare` always
+returns safe funding address/balance argv and returns signed refill-email argv
+only when at least one active recipient exists.
 `renewal run` is an agent-facing state machine, not a wallet-signing daemon.
 See [renewals.md](renewals.md).
 

package/skills/warpmetal/references/renewals.md

@@ -27,9 +27,10 @@ warpmetal renewal configure \
   --json
 ```
 
-Without an active verified notification email, configuration asks for one
-before changing policy. `--email` queues verification; refill and expanded
-lifecycle notices remain disabled until the human opens the verification link.
+Without an active notification recipient, configuration asks for one before
+changing policy. `--email` immediately activates the address because the owner
+or SSH-derived server credential authorizes the change. WarpMetal sends a
+transactional advisory to the new address; it does not require verification.
 Use `--without-email-notifications` only as an explicit opt-out; no signed
 refill-email workflow is returned in that state. A refill target is a funding
 target, not spend permission, and cannot exceed the per-renewal cap. The human
@@ -75,8 +76,8 @@ paymentWorkflow.authorize.argv
 paymentWorkflow.submit.argv
 paymentWorkflow.fundingWorkflow
 refillNotification
-refillWorkflow.environment (verified email only)
-refillWorkflow.argv (verified email only)
+refillWorkflow.environment (active recipient only)
+refillWorkflow.argv (active recipient only)
 ```
 
 Invoke the authorize argv once. It writes an owner-only artifact. Then invoke

package/src/api.js

@@ -208,19 +208,43 @@ export class WarpMetalClient {
     );
   }
 
-  putNotifications(serverId, body, token) {
+  putNotifications(serverId, body, token, idempotencyKey) {
     return this.request(
       "PUT",
       `/servers/${encodeURIComponent(serverId)}/notifications`,
-      { body, token },
+      { body, token, idempotencyKey },
+    );
+  }
+
+  addNotificationRecipient(serverId, body, token, idempotencyKey) {
+    return this.request(
+      "POST",
+      `/servers/${encodeURIComponent(serverId)}/notification-recipients`,
+      { body, token, idempotencyKey },
+    );
+  }
+
+  patchNotifications(serverId, body, token, idempotencyKey) {
+    return this.request(
+      "PATCH",
+      `/servers/${encodeURIComponent(serverId)}/notifications`,
+      { body, token, idempotencyKey },
     );
   }
 
-  deleteNotifications(serverId, token) {
+  deleteNotifications(serverId, token, idempotencyKey) {
     return this.request(
       "DELETE",
       `/servers/${encodeURIComponent(serverId)}/notifications`,
-      { token },
+      { token, idempotencyKey },
+    );
+  }
+
+  deleteNotificationRecipient(serverId, recipientId, token, idempotencyKey) {
+    return this.request(
+      "DELETE",
+      `/servers/${encodeURIComponent(serverId)}/notification-recipients/${encodeURIComponent(recipientId)}`,
+      { token, idempotencyKey },
     );
   }
 

package/src/cli.js

@@ -87,8 +87,14 @@ Usage:
     [--email <address> | --without-email-notifications]
   warpmetal renewal status|prepare|submit|run ...
   warpmetal renewal due (--server <serverId> | --all)
-  warpmetal notifications configure --server <serverId> --email <address>
-  warpmetal notifications status --server <serverId>
+  warpmetal notifications add --server <serverId> --email <address>
+    [--events <comma-separated-events>] [--idempotency-key <key>]
+  warpmetal notifications list --server <serverId>
+  warpmetal notifications remove --server <serverId> --recipient <recipientId>
+    [--idempotency-key <key>]
+  warpmetal notifications events --server <serverId> --events <comma-separated-events>
+    [--idempotency-key <key>]
+  warpmetal notifications disable --server <serverId> [--idempotency-key <key>]
   warpmetal identity generate --hostname <name> [--ssh-key-name <name>]
   warpmetal identity list
   warpmetal server identity --server <serverId>
@@ -673,11 +679,40 @@ async function handleTaskStatus(client, store, options, context) {
   const result = booleanOption(options, "wait")
     ? await pollTask(client, taskId, token, timeout)
     : await client.getTask(taskId, token);
+  const output = { ...result.data };
+  let notificationMessage = "";
+  if (result.data.task.state === "ready" && result.data.task.serverId) {
+    try {
+      const notifications = (
+        await client.getNotifications(result.data.task.serverId, token)
+      ).data;
+      output.notifications = notifications;
+      if (notifications.setupRecommended) {
+        output.nextAction = {
+          action: "ask_human_for_notification_email",
+          optional: true,
+          reason:
+            "A human can receive renewal, wallet refill, and server lifecycle notifications.",
+          addCommand: `warpmetal notifications add --server ${result.data.task.serverId} --email <address> --json`,
+          skipCommand: `warpmetal notifications disable --server ${result.data.task.serverId} --json`,
+        };
+        notificationMessage =
+          `\nAsk the human whether they want renewal and lifecycle notifications. ` +
+          `If yes, run: warpmetal notifications add --server ${result.data.task.serverId} --email <address>`;
+      }
+    } catch (error) {
+      output.notificationSetup = {
+        action: "check_notifications",
+        unavailable: true,
+        reason: toErrorMessage(error),
+      };
+    }
+  }
   emit(
     context.stdout,
-    result.data,
+    output,
     context.json,
-    `${result.data.task.id}: ${result.data.task.state}${result.data.task.publicIp ? ` (${result.data.task.publicIp})` : ""}`,
+    `${result.data.task.id}: ${result.data.task.state}${result.data.task.publicIp ? ` (${result.data.task.publicIp})` : ""}${notificationMessage}`,
   );
   return result.data.task.state === "manual_review" ? 6 : 0;
 }
@@ -853,8 +888,9 @@ function activeNotificationSubscription(notifications) {
   const subscription = notifications?.subscription;
   return Boolean(
     notifications?.configured &&
-      subscription?.verified &&
-      !subscription?.disabled,
+      !subscription?.disabled &&
+      Array.isArray(subscription?.recipients) &&
+      subscription.recipients.length > 0,
   );
 }
 
@@ -863,14 +899,14 @@ function refillNotificationState(notifications, policy) {
   if (!notifications?.configured || !subscription || subscription.disabled) {
     return {
       available: false,
-      reason: "verified_email_required",
+      reason: "active_notification_recipient_required",
       subscription: subscription || null,
     };
   }
-  if (!subscription.verified) {
+  if (!Array.isArray(subscription.recipients) || subscription.recipients.length === 0) {
     return {
       available: false,
-      reason: "email_verification_required",
+      reason: "active_notification_recipient_required",
       subscription,
     };
   }
@@ -949,20 +985,10 @@ async function handleRenewalConfigure(client, store, options, context) {
     !withoutEmailNotifications &&
     !activeNotificationSubscription(notifications)
   ) {
-    const verificationPending = Boolean(
-      notifications.configured &&
-        notifications.subscription &&
-        !notifications.subscription.disabled,
-    );
-    const action = verificationPending
-      ? "email_verification_required"
-      : "email_required";
     const output = {
-      action,
+      action: "email_required",
       serverId,
-      reason: verificationPending
-        ? "Verify the existing notification email or resend verification with --email."
-        : "A verified email enables renewal and wallet-refill notifications.",
+      reason: "A human email enables renewal and wallet-refill notifications.",
       notifications,
       next: {
         configureEmail: `warpmetal renewal configure ... --email <address>`,
@@ -974,27 +1000,27 @@ async function handleRenewalConfigure(client, store, options, context) {
       context.stdout,
       output,
       context.json,
-      verificationPending
-        ? `Verify the notification email for ${serverId}, or rerun with --email to resend verification. To opt out explicitly, rerun with --without-email-notifications.`
-        : `An email is needed for renewal and wallet-refill notifications. Rerun with --email <address>, or opt out explicitly with --without-email-notifications.`,
+      `Ask the human for an email to receive renewal and lifecycle notifications for ${serverId}, then rerun with --email <address>. To opt out explicitly, rerun with --without-email-notifications.`,
     );
     return 6;
   }
   if (email) {
     notifications = (
-      await client.putNotifications(serverId, { email }, token)
+      await client.addNotificationRecipient(
+        serverId,
+        { email },
+        token,
+        stringOption(options, "idempotency-key") || idempotencyKey("notification-add"),
+      )
+    ).data;
+  } else if (withoutEmailNotifications) {
+    notifications = (
+      await client.deleteNotifications(
+        serverId,
+        token,
+        stringOption(options, "idempotency-key") || idempotencyKey("notification-disable"),
+      )
     ).data;
-  } else if (
-    withoutEmailNotifications &&
-    notifications.configured &&
-    notifications.subscription &&
-    !notifications.subscription.disabled
-  ) {
-    await client.deleteNotifications(serverId, token);
-    notifications = {
-      ...notifications,
-      subscription: { ...notifications.subscription, disabled: true },
-    };
   }
   const result = await client.putRenewalPolicy(serverId, body, token);
   await store.saveRenewalPolicy(
@@ -1009,8 +1035,8 @@ async function handleRenewalConfigure(client, store, options, context) {
     status: withoutEmailNotifications
       ? "opted_out"
       : activeNotificationSubscription(notifications)
-        ? "verified"
-        : "verification_required",
+        ? "active"
+        : "recipient_required",
   };
   const output = {
     ...result.data,
@@ -1023,7 +1049,7 @@ async function handleRenewalConfigure(client, store, options, context) {
     context.stdout,
     output,
     context.json,
-    `Configured bounded renewal for ${serverId} with wallet ${wallet}.${email && !notificationState.refillAvailable ? " Check the email verification link." : withoutEmailNotifications ? " Email and wallet-refill notifications were explicitly skipped." : ""}`,
+    `Configured bounded renewal for ${serverId} with wallet ${wallet}.${email ? " The notification recipient is active and its security advisory was queued." : withoutEmailNotifications ? " Email and wallet-refill notifications were explicitly skipped." : ""}`,
   );
   return 0;
 }
@@ -1257,9 +1283,9 @@ async function handleRenewalPrepare(client, store, options, context) {
     ? `\n${walletWorkflowInstructions(safe.paymentWorkflow)}. Show the returned payer address as both a QR code and copyable text, with the exact network, asset, and deficit.`
     : "";
   const refillInstructions = safe.refillWorkflow
-    ? `\nFor verified email refill, set ${Object.entries(safe.refillWorkflow.environment).map(([key, value]) => `${key}=${value}`).join(" ")} and run: ${shellCommand(safe.refillWorkflow.argv)}`
+    ? `\nFor human refill notification, set ${Object.entries(safe.refillWorkflow.environment).map(([key, value]) => `${key}=${value}`).join(" ")} and run: ${shellCommand(safe.refillWorkflow.argv)}`
     : safe.paymentWorkflow
-      ? `\nVerified email refill is unavailable (${safe.refillNotification.reason}). Configure and verify notifications, or fund the displayed payer address directly.`
+      ? `\nEmail refill is unavailable (${safe.refillNotification.reason}). Add a notification recipient, or fund the displayed payer address directly.`
       : "";
   const instructions = safe.paymentWorkflow
     ? `\nAuthorize: ${shellCommand(safe.paymentWorkflow.authorize.argv)}${fundingInstructions}${refillInstructions}\nSubmit: ${shellCommand(safe.paymentWorkflow.submit.argv)}`
@@ -1464,38 +1490,113 @@ async function handleRenewalDue(client, store, options, context) {
   return due.length ? 8 : 0;
 }
 
-async function handleNotificationsConfigure(client, store, options, context) {
+function notificationEvents(options, { required = false } = {}) {
+  const eventValue = stringOption(options, "events", { required });
+  if (!eventValue) return undefined;
+  const events = eventValue.split(",").map((value) => value.trim());
+  if (events.some((value) => !value)) {
+    throw new CliError("--events must contain comma-separated event names.", {
+      exitCode: 2,
+    });
+  }
+  return events;
+}
+
+async function handleNotificationsAdd(client, store, options, context) {
   const serverId = stringOption(options, "server", { required: true });
   const email = stringOption(options, "email", { required: true });
-  const eventValue = stringOption(options, "events");
   const body = { email };
-  if (eventValue) body.events = eventValue.split(",").map((value) => value.trim());
+  const events = notificationEvents(options);
+  if (events) body.events = events;
   const token = await requireServerToken(store, serverId, options, context.env);
-  const result = await client.putNotifications(serverId, body, token);
+  const result = await client.addNotificationRecipient(
+    serverId,
+    body,
+    token,
+    stringOption(options, "idempotency-key") || idempotencyKey("notification-add"),
+  );
   emit(
     context.stdout,
     result.data,
     context.json,
-    `Verification email queued for ${result.data.subscription.email}.`,
+    result.data.created
+      ? `${result.data.recipient.email} is active for ${serverId}; WarpMetal queued a security advisory to that address.`
+      : `${result.data.recipient.email} was already active for ${serverId}.`,
   );
   return 0;
 }
 
-async function handleNotificationsStatus(client, store, options, context) {
+async function handleNotificationsList(client, store, options, context) {
   const serverId = stringOption(options, "server", { required: true });
   const token = await requireServerToken(store, serverId, options, context.env);
   const result = await client.getNotifications(serverId, token);
+  const count = result.data.subscription?.recipients?.length || 0;
   emit(
     context.stdout,
     result.data,
     context.json,
     result.data.configured
-      ? `${serverId}: notifications ${result.data.subscription.verified ? "verified" : "awaiting verification"}`
+      ? `${serverId}: ${count} active notification recipient${count === 1 ? "" : "s"}`
       : `${serverId}: notifications are not configured`,
   );
   return 0;
 }
 
+async function handleNotificationsRemove(client, store, options, context) {
+  const serverId = stringOption(options, "server", { required: true });
+  const recipientId = stringOption(options, "recipient", { required: true });
+  const token = await requireServerToken(store, serverId, options, context.env);
+  const result = await client.deleteNotificationRecipient(
+    serverId,
+    recipientId,
+    token,
+    stringOption(options, "idempotency-key") || idempotencyKey("notification-remove"),
+  );
+  emit(
+    context.stdout,
+    result.data,
+    context.json,
+    `Removed ${recipientId} from ${serverId} notifications.`,
+  );
+  return 0;
+}
+
+async function handleNotificationsEvents(client, store, options, context) {
+  const serverId = stringOption(options, "server", { required: true });
+  const events = notificationEvents(options, { required: true });
+  const token = await requireServerToken(store, serverId, options, context.env);
+  const result = await client.patchNotifications(
+    serverId,
+    { events },
+    token,
+    stringOption(options, "idempotency-key") || idempotencyKey("notification-events"),
+  );
+  emit(
+    context.stdout,
+    result.data,
+    context.json,
+    `Updated notification events for ${serverId}.`,
+  );
+  return 0;
+}
+
+async function handleNotificationsDisable(client, store, options, context) {
+  const serverId = stringOption(options, "server", { required: true });
+  const token = await requireServerToken(store, serverId, options, context.env);
+  const result = await client.deleteNotifications(
+    serverId,
+    token,
+    stringOption(options, "idempotency-key") || idempotencyKey("notification-disable"),
+  );
+  emit(
+    context.stdout,
+    result.data,
+    context.json,
+    `Disabled lifecycle notifications for ${serverId}.`,
+  );
+  return 0;
+}
+
 async function loginServer(client, store, serverId, identity) {
   const challenge = (await client.issueSshChallenge(serverId)).data;
   const signature = await signSshChallenge(challenge.payload, identity);
@@ -2553,6 +2654,7 @@ async function dispatch(positionals, options, passthrough, context) {
         "email",
         "without-email-notifications",
         "disabled",
+        "idempotency-key",
       ]);
       return handleRenewalConfigure(client, store, options, context);
     case "renewal status":
@@ -2597,6 +2699,7 @@ async function dispatch(positionals, options, passthrough, context) {
         "request-envelope-out",
       ]);
       return handleRenewalRun(client, store, options, context);
+    case "notifications add":
     case "notifications configure":
       rejectUnknownOptions(options, [
         ...COMMON_OPTIONS,
@@ -2604,15 +2707,43 @@ async function dispatch(positionals, options, passthrough, context) {
         "token-file",
         "email",
         "events",
+        "idempotency-key",
       ]);
-      return handleNotificationsConfigure(client, store, options, context);
+      return handleNotificationsAdd(client, store, options, context);
+    case "notifications list":
     case "notifications status":
       rejectUnknownOptions(options, [
         ...COMMON_OPTIONS,
         "server",
         "token-file",
       ]);
-      return handleNotificationsStatus(client, store, options, context);
+      return handleNotificationsList(client, store, options, context);
+    case "notifications remove":
+      rejectUnknownOptions(options, [
+        ...COMMON_OPTIONS,
+        "server",
+        "token-file",
+        "recipient",
+        "idempotency-key",
+      ]);
+      return handleNotificationsRemove(client, store, options, context);
+    case "notifications events":
+      rejectUnknownOptions(options, [
+        ...COMMON_OPTIONS,
+        "server",
+        "token-file",
+        "events",
+        "idempotency-key",
+      ]);
+      return handleNotificationsEvents(client, store, options, context);
+    case "notifications disable":
+      rejectUnknownOptions(options, [
+        ...COMMON_OPTIONS,
+        "server",
+        "token-file",
+        "idempotency-key",
+      ]);
+      return handleNotificationsDisable(client, store, options, context);
     case "server login":
       rejectUnknownOptions(options, [...COMMON_OPTIONS, "server", "identity"]);
       return handleServerLogin(client, store, options, context);

package/src/payment.js

@@ -338,6 +338,47 @@ function externalRecipientBinds(requirement, extensions) {
   return matches.length === 1;
 }
 
+function exactExtensionBindings(accepts, sponsorship, extensions) {
+  if (!sponsorship) return;
+  const sponsoredAccepts = new Set(
+    accepts.map(
+      (requirement) =>
+        `${requirement.network}|${requirement.asset.toLowerCase()}|${requirement.extra.payloadProfile}`,
+    ),
+  );
+  const sponsorshipBindings = new Set(
+    sponsorship.requirements.map(
+      (binding) =>
+        `${binding.network}|${binding.asset.toLowerCase()}|${binding.payloadProfile}`,
+    ),
+  );
+  const recipients = extensions["com.k1hub.external-recipient"]?.info?.recipients;
+  const acceptedRecipients = new Set(
+    accepts.map(
+      (requirement) =>
+        `${requirement.network}|${requirement.asset}|${requirement.payTo}`,
+    ),
+  );
+  const recipientBindings = new Set(
+    Array.isArray(recipients)
+      ? recipients.map(
+          (recipient) =>
+            `${recipient.network}|${recipient.asset}|${recipient.payTo}`,
+        )
+      : [],
+  );
+  if (
+    sponsoredAccepts.size !== sponsorshipBindings.size ||
+    [...sponsoredAccepts].some((identity) => !sponsorshipBindings.has(identity)) ||
+    acceptedRecipients.size !== recipientBindings.size ||
+    [...acceptedRecipients].some((identity) => !recipientBindings.has(identity))
+  ) {
+    throw invalid(
+      "The x402 sponsorship and recipient bindings do not exactly match PAYMENT-REQUIRED.",
+    );
+  }
+}
+
 function agentWalletSupports(requirement, sponsorship, extensions) {
   const profile = requirement.extra.payloadProfile;
   const baseExtra = Object.keys(requirement.extra).sort().join(",");
@@ -397,6 +438,7 @@ export function parsePaymentRequired(value, expectedUrl) {
     "The x402 challenge extension",
   );
   const sponsorship = extensions[GAS_SPONSORSHIP_EXTENSION]?.info;
+  exactExtensionBindings(accepts, sponsorship, extensions);
   return {
     challenge: parsed,
     paymentRequiredDigest: digestJson(parsed),