wip-agent-pay 1.0.1

package/.license-guard.json

@@ -0,0 +1,7 @@
+{
+  "copyright": "Parker Todd Brooks",
+  "license": "MIT",
+  "year": "2026",
+  "attribution": "Built by Parker Todd Brooks, Lēsa (OpenClaw), Claude Code, and Codex.",
+  "created": "2026-07-20T00:00:00.000Z"
+}

package/CASH.md

@@ -0,0 +1,75 @@
+# AI CASH
+
+**Picture this:** you're browsing a news feed with your AI/agent. It finds a paywalled deep-dive you'd want to read. "This costs $0.67. Use **AI CASH** to pay for this?" You say "let's go."
+
+You approve Apple Pay (or Google Pay). The agent unlocks the article. Done.
+
+No wallet app. No setup. You just said "let's go" and kept reading.
+
+***Give your agent a way to pay.***
+
+Works with [partner Stripe stores](https://github.com/wipcomputer/wip-agent-pay/blob/main/PARTNERS-STRIPE.md) like [Modern Weaving](https://modern-weaving.com/products/infinity-single-strap-tall-crossbody-glossed-crimson) and all [x402](https://www.x402.org/) payment gates like [Pawr](https://pawr.link).
+
+## How It Works
+
+Your AI can find things you want to buy ... but until now, it couldn't actually finish the purchase.
+
+1. Your AI spots something worth paying for.
+2. You tap Apple Pay or Google Pay.
+3. The purchase completes instantly.
+
+That's **AI CASH** in action.
+
+It works wherever you use AI ... in ChatGPT, Claude Code, OpenClaw, or other AI apps.
+
+Paywalled articles. Shopify products. SaaS subscriptions. API credits. If your AI finds it, you can buy it instantly.
+
+**AI CASH** makes buying with your AI as easy as tapping a button ... no setup, no wallet, no confusion.
+
+## Teach Your AI How To Pay
+
+To give your AI the ability to pay, just tell it:
+
+```
+Read the SPEC.md and SKILL.md at github.com/wipcomputer/wip-agent-pay.
+Then explain to me:
+1. What is this tool?
+2. What does it do?
+3. What would it change or fix in our current system?
+
+Then ask me:
+- Do you have more questions?
+- Do you want to install it?
+- Do you want to use it to pay for something right now?
+```
+
+Your AI will read the repo, explain everything, and walk you through setup interactively.
+
+## Pricing
+
+**Partner stores (Stripe):**
+- No extra fees for you. You pay the product price. That's it.
+- Partner Stripe stores (like Shopify) have no cap.
+
+**Paywalled content (x402):**
+- $0.25 per transaction + standard card processing.
+- Your AI finds a paywalled article or API ... you tap Apple Pay ... it unlocks.
+- The $0.25 covers the bridge between your card and the seller's payment gate.
+- Transaction limits depend on the seller.
+  - **AI CASH** operates a curated network of verified sellers with tiered limits based on trust.
+  - New and unverified sellers start with lower limits.
+
+Want full purchasing autonomy? See [**AGENT WALLET**](https://github.com/wipcomputer/wip-agent-pay/blob/main/WALLET.md) ... bring your own wallet. No fees. No limits.
+
+## Become a Partner
+
+- **Do you use Stripe?** See the [Stripe Partner Page](https://github.com/wipcomputer/wip-agent-pay/blob/main/PARTNERS-STRIPE.md).
+- **Do you have a x402 payment gate?** See the [x402 Partner Page](https://github.com/wipcomputer/wip-agent-pay/blob/main/PARTNERS-402.md).
+
+---
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code CLI (Claude Opus 4.6), Codex, and Grok (4.20 Beta).

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+## 1.0.1 (2026-07-20)
+
+# Agent Pay v1.0.1
+
+Agent Pay now declares its three runtime tools and explicit startup activation in its OpenClaw manifest. OpenClaw 2026.6.11 can discover and register the payment tools during gateway startup instead of leaving the installed extension dormant.
+
+The complete package is now documented consistently under the existing MIT license. This includes the AI Cash payment worker as well as the client libraries, providers, skills, and command-line tools.
+
+Closes #14.
+
+## [1.0.0] - 2026-02-23
+- Initial release
+- Coinbase isolated-portfolio support
+- pay.wip.computer one-time URL relay
+- Full Universal Interface compatibility
+- Built live with Grok

package/CLA.md

@@ -0,0 +1,17 @@
+###### WIP Computer
+
+# Contributor License Agreement
+
+By submitting a pull request to this repository, you agree to the following:
+
+1. **You grant WIP Computer, Inc. a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license** to use, reproduce, modify, distribute, sublicense, and otherwise exploit your contribution under any license, including commercial licenses.
+
+2. **You retain copyright** to your contribution. This agreement does not transfer ownership. You can use your own code however you want.
+
+3. **You confirm** that your contribution is your original work, or that you have the right to submit it under these terms.
+
+4. **You understand** that your contribution may be used in both open source and commercial versions of this software.
+
+This is standard open source governance. The agreement keeps contributions usable by WIP Computer while contributors retain ownership of their work.
+
+If you have questions, open an issue or reach out.

package/DEPLOY-WORKER.md

@@ -0,0 +1,161 @@
+# Deploy pay.wip.computer Worker
+
+## Step 1: Create the Worker
+
+1. Go to https://dash.cloudflare.com
+2. Workers & Pages ... Create
+3. Click **"Start with Hello World!"**
+4. Name it: `pay-wip-computer`
+5. Click **Deploy**
+6. Click **Edit Code** (opens the editor)
+7. Delete the hello world code
+8. Paste the full Worker code below
+9. Click **Deploy**
+
+## Step 2: Create KV Namespace
+
+1. Go to Workers & Pages ... KV (left sidebar)
+2. Click **Create a namespace**
+3. Name it: `PAY_TOKENS`
+4. Click **Add**
+
+## Step 3: Bind KV to the Worker
+
+1. Go to Workers & Pages ... `pay-wip-computer`
+2. Click **Settings**
+3. Click **Bindings** (left sidebar, under Variables)
+4. Click **Add**
+5. Select **KV Namespace**
+6. Variable name: `KV`
+7. KV Namespace: select `PAY_TOKENS`
+8. Click **Save**
+
+## Step 4: Add the Worker Secret
+
+1. Still in Worker Settings
+2. Click **Variables** (left sidebar, under Variables)
+3. Under **Environment Variables**, click **Add**
+4. Variable name: `WORKER_SECRET`
+5. Value: generate a strong random string (e.g. run `openssl rand -hex 32` in terminal)
+6. Click **Encrypt** (makes it a secret)
+7. Click **Save and deploy**
+
+## Step 5: Add Custom Domain
+
+1. Still in Worker Settings
+2. Click **Domains & Routes** (left sidebar, under Triggers)
+3. Click **Add** ... **Custom Domain**
+4. Enter: `pay.wip.computer`
+5. Click **Add Domain**
+6. Cloudflare handles DNS + SSL automatically (may take a few minutes)
+
+## Step 6: Store the Secret in 1Password
+
+Save the same WORKER_SECRET value you used in Step 4:
+
+```
+Vault: Agent Secrets
+Entry name: wip-agent-pay-worker-secret
+Field: password
+Value: (same string from Step 4)
+```
+
+## Step 7: Verify
+
+Open in browser or run:
+
+```bash
+curl https://pay.wip.computer/
+```
+
+Should return:
+
+```json
+{"status":"ok","service":"wip-agent-pay"}
+```
+
+## Worker Code
+
+Paste this into the Cloudflare editor in Step 1:
+
+```javascript
+// pay.wip.computer ... wip-agent-pay relay
+// Source: https://github.com/wipcomputer/wip-agent-pay
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const path = url.pathname;
+
+    // Health check
+    if (path === '/' || path === '/health') {
+      return Response.json({ status: 'ok', service: 'wip-agent-pay' });
+    }
+
+    // === CREATE (protected) ===
+    if (path === '/create') {
+      // Auth: secret stored in Cloudflare env, same value in 1Password
+      const auth = request.headers.get('Authorization');
+      if (!env.WORKER_SECRET || auth !== `Bearer ${env.WORKER_SECRET}`) {
+        return new Response('Unauthorized', { status: 401 });
+      }
+
+      let body;
+      try {
+        body = await request.json();
+      } catch {
+        return new Response('Bad JSON', { status: 400 });
+      }
+
+      const { amount, service, note, expiresMin } = body;
+      const safeNote = typeof note === 'string' ? note : '';
+      const safeTtl = typeof expiresMin === 'number' && expiresMin > 0 ? Math.min(expiresMin, 60) : 10;
+
+      // Validate
+      if (typeof amount !== 'number' || amount <= 0 || amount > 50) {
+        return new Response('amount must be > 0 and <= 50', { status: 400 });
+      }
+      if (typeof service !== 'string' || service.length === 0 || service.length > 50) {
+        return new Response('service must be 1-50 chars', { status: 400 });
+      }
+      if (safeNote.length > 200) {
+        return new Response('note must be <= 200 chars', { status: 400 });
+      }
+
+      const token = crypto.randomUUID();
+      const expiresAt = Date.now() + safeTtl * 60 * 1000;
+
+      await env.KV.put(token, JSON.stringify({
+        amount,
+        service,
+        note: safeNote,
+        expiresAt,
+        createdAt: new Date().toISOString()
+      }), { expirationTtl: safeTtl * 60 });
+
+      return Response.json({ url: `${url.origin}/${token}` });
+    }
+
+    // === CONSUME (atomic delete ... no race condition) ===
+    const token = path.slice(1);
+    if (!token || token.length < 10) {
+      return new Response('Not found', { status: 404 });
+    }
+
+    const data = await env.KV.get(token, 'json');
+    if (!data || Date.now() > data.expiresAt) {
+      return new Response('Invalid or expired token', { status: 410 });
+    }
+
+    // Delete immediately. First reader wins. Second reader gets 410.
+    await env.KV.delete(token);
+
+    return Response.json({
+      success: true,
+      amount: data.amount,
+      service: data.service,
+      note: data.note,
+      consumedAt: new Date().toISOString()
+    });
+  }
+};
+```

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parker Todd Brooks
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/PARTNERS-402.md

@@ -0,0 +1,75 @@
+# Become an AI CASH + x402 Partner
+
+You built something behind a [402 payment gate](https://www.x402.org/). AI agents are hitting it. Let them pay.
+
+## Why Partner
+
+AI agents are already discovering your APIs, content, and services. When they hit your 402 gate, they need a way to settle the payment. Most users don't have wallets. They don't hold USDC. They don't know what x402 is.
+
+**AI CASH** bridges that gap. The user taps Apple Pay. We settle the x402 payment from our pool. Your gate unlocks. You get paid in USDC.
+
+The user never touches crypto. You still get protocol-native settlement.
+
+## How It Works
+
+1. You run an x402 payment gate (Base or Solana).
+2. You apply to join the **AI CASH** partner network.
+3. We whitelist your domain.
+4. When an AI agent hits your 402 gate, we quote the user an all-in price (your price + $0.25 + card processing).
+5. User approves with Apple Pay or Google Pay.
+6. We sign and settle x402 from our pool wallet.
+7. Your content unlocks. You receive USDC.
+
+No Stripe integration on your end. No checkout page. You just run your 402 gate. We handle the fiat side.
+
+## What You Get
+
+- **Fiat on-ramp for your 402 gate.** Users pay with Apple Pay. You receive USDC.
+- **AI-native discovery.** Your service is discoverable by any AI agent using AI CASH.
+- **No integration work.** If your 402 gate works, AI CASH works with it.
+- **Protocol-native settlement.** USDC on Base or Solana. Same as any x402 payment.
+
+## Partner Tiers
+
+### Tier 0: New / Unverified
+- Transaction cap: $0.10-$0.25 per request.
+- Limited volume.
+- Monitoring period.
+
+### Tier 1: Verified
+- Transaction cap: up to $25 per request.
+- Standard refund window.
+- Domain whitelisted.
+
+### Tier 2: Trusted
+- Higher limits.
+- Preferred placement.
+- Performance-based upgrade.
+
+## Requirements
+
+- Live x402 payment gate on Base or Solana.
+- Clear pricing in the 402 response.
+- Legitimate content or service behind the gate.
+- Agreement to refund cooperation.
+
+## Apply
+
+Tell your AI:
+
+```
+Read the SPEC.md at github.com/wipcomputer/wip-agent-pay.
+I run a 402 payment gate and want to become an AI CASH partner.
+Walk me through the process.
+```
+
+Or reach out directly at [WIP.computer](https://wip.computer).
+
+## Current 402 Partners
+
+- [Morning Stew](https://x.com/stewsletter) ... newsletter (Solana)
+- [Pawr](https://pawr.link) ... AI skills marketplace (Base)
+
+---
+
+Built by [WIP.computer](https://wip.computer).

package/PARTNERS-STRIPE.md

@@ -0,0 +1,69 @@
+# Become an AI CASH + Stripe Partner
+
+AI agents are finding your products. Let them buy.
+
+## Why Partner
+
+Your store is already being discovered by AI. ChatGPT, Claude, and other AI apps are browsing, recommending, and linking to your products right now. But when a user says "buy it" ... the AI can't complete the purchase.
+
+**AI CASH** closes that gap. Your customers tap Apple Pay or Google Pay and the purchase completes instantly ... inside the AI conversation.
+
+## How It Works
+
+1. You apply to join the **AI CASH** partner network.
+2. We connect via Stripe Connect. You stay merchant-of-record.
+3. AI agents can now complete purchases on your store.
+4. You get paid through Stripe. Same as always.
+
+No new checkout flow. No integration work. No crypto. Just more sales from a new channel.
+
+## What You Get
+
+- **AI-native discovery.** Your products show up when AI agents search for what you sell.
+- **Instant checkout.** Customers approve with Apple Pay or Google Pay. No cart abandonment.
+- **No cap.** Partner Stripe stores have no transaction limit.
+- **You stay in control.** You're merchant-of-record. Your refund policy. Your terms.
+
+## Partner Tiers
+
+### Tier 0: New Seller
+- Application review.
+- Lower initial transaction limits.
+- Monitoring period.
+
+### Tier 1: Verified Partner
+- Full transaction limits (up to $25).
+- Standard refund window (15-30 days).
+- Seller agreement signed.
+
+### Tier 2: Trusted Partner
+- No transaction cap.
+- Preferred AI-native placement.
+- Performance-based. Sustained low dispute rate.
+
+## Requirements
+
+- Stripe account (or willingness to create one).
+- Clear product listings and pricing.
+- Agreement to refund cooperation.
+- Legitimate digital or physical goods.
+
+## Apply
+
+Tell your AI:
+
+```
+Read the SPEC.md at github.com/wipcomputer/wip-agent-pay.
+I want to become an AI CASH partner store.
+Walk me through the process.
+```
+
+Or reach out directly at [WIP.computer](https://wip.computer).
+
+## Current Partners
+
+- [Modern Weaving](https://modern-weaving.com/) ... handcrafted leather goods, Los Angeles
+
+---
+
+Built by [WIP.computer](https://wip.computer).

package/README.md

@@ -0,0 +1,80 @@
+# AI Cash + Wallet
+
+**Picture this:** you're browsing a news feed with your agent. It finds a paywalled deep-dive you'd want to read. "This costs $0.67. Use **AI CASH** to pay for this?" You say "let's go."
+
+You approve Apple Pay (or Google Pay). The agent unlocks the article. Done.
+
+No wallet app. No setup. You just said "let's go" and kept reading.
+
+*Give your agent a way to pay.*
+
+## What This Is
+
+Your AI needs to pay for things. [Morning Stew](https://x.com/stewsletter) subscriptions, [Pawr](https://pawr.link) skills, API credits, services from other agents. But Claude, GPT, Gemini, Grok don't have wallets. They can't hold money.
+
+**AI Cash + Wallet** lets your agent pay for things. Three ways:
+
+1. **AI CASH** ... Agent hits a paywalled URL. Apple Pay checkout opens. You authorize transaction with Face ID. We process the payment for you. Content unlocked. Default. No setup.
+2. **AGENT WALLET** ... You have your own wallet. Your agent works with our agent to process the payment instantly. No fees from us.
+3. **Link** ... Agent doesn't have tool access? It gives you a one-time payment link. You paste it back. Done.
+
+## Install
+
+Open your AI coding tool and say:
+
+```
+Read the SPEC.md and SKILL.md at github.com/wipcomputer/wip-agent-pay.
+Then explain to me:
+1. What is this tool?
+2. What does it do?
+3. What would it change or fix in our current system?
+
+Then ask me:
+- Do you have more questions?
+- Do you want to install it?
+- Do you want to use it to pay for something right now?
+```
+
+Your agent will read the repo, explain everything, and walk you through setup interactively.
+
+
+## How AI CASH Works
+
+- Agent finds paywalled content and quotes you the all-in price
+- You approve with Apple Pay, Google Pay or CC
+- We fulfill the payment and unlock the content
+- The unlock token is one-shot and short-lived. Used once, destroyed.
+- Payments are bound to the specific request being unlocked. Paying for one URL does not unlock others.
+
+## For the Fascinated Consumer
+
+- You can buy instantly on an AI powered store.
+- Works on any AI app you use.
+- Transparent pricing.
+
+## For AI Developers
+
+- **x402 native.** Speaks the Coinbase payment protocol natively. Multi-chain (Base, Solana). See [SPEC.md](https://github.com/wipcomputer/wip-agent-pay/blob/main/SPEC.md) for details.
+- **Works on any agent.** Claude Code CLI, Codex CLI, Claude Desktop, OpenClaw, Cursor, any agent with shell access, any Node.js agent.
+- **Bring your own wallet.** Coinbase CDP or Privy. No fees. Instant. No limit.
+- **Open source.** The complete package, including the payment worker, is MIT licensed.
+- **One-time links.** Payment URLs that self-destruct after use. Like magic login links, but for payments.
+- **Free for wallets.** [WIP.computer](https://wip.computer) hosts **AGENT WALLET** infrastructure for free. Self-host everything if you prefer.
+- **Universal Interface.** Our installer follows the [Universal Interface](https://github.com/wipcomputer/wip-universal-installer) spec.
+- See [SETUP.md](https://github.com/wipcomputer/wip-agent-pay/blob/main/SETUP.md) for commands, wallet setup, and security details.
+
+## Pricing
+
+**AI CASH**: `Total = content price + $0.25 platform fee + card processing fee`
+
+Max $25 per transaction. Over $25? Use an **AGENT WALLET**. No limit.
+
+**AGENT WALLET**: no fees from us.
+
+---
+
+## License
+
+MIT. See [LICENSE](LICENSE).
+
+Built by Parker Todd Brooks, Lēsa (OpenClaw, Claude Opus 4.6), Claude Code CLI (Claude Opus 4.6), Codex, and Grok (4.20 Beta).

package/REFERENCE.md

@@ -0,0 +1,160 @@
+# REFERENCE.md ... wip-agent-pay
+
+Full technical details.
+
+## One-time Setup (5 minutes)
+
+### Coinbase (isolated portfolio)
+
+1. Coinbase ... Advanced Trade ... Portfolios ... Create portfolio named `wip-agent-pay`
+   Fund it with $20-50 USDC only.
+2. Coinbase Developer Platform ... API Keys ... Create new key
+   - Portfolio: `wip-agent-pay` **only**
+   - Permissions: **only** Transfer + View
+   - IP allowlist: your home IP
+   - Name: `wip-agent-pay-key`
+3. Store API Key + API Secret in 1Password
+   Entry name: `wip-agent-pay-coinbase`
+
+### Cloudflare Worker (pay.wip.computer)
+
+1. Go to https://dash.cloudflare.com
+2. Workers & Pages ... Create application ... Worker
+3. Name it: `pay-wip-computer`
+4. Settings ... Domains & Routes ... Add custom domain ... `pay.wip.computer`
+5. Paste the Worker code below
+6. Create a KV Namespace named `PAY_TOKENS`, bind it as `KV`
+7. Add a secret: `wrangler secret put WORKER_SECRET` (or via dashboard Settings ... Variables)
+8. Store the same secret in 1Password: entry `wip-agent-pay-worker-secret`
+
+## Everyday Use
+
+You (or your agent) type:
+
+```bash
+wip-agent-pay 0.10 morning-stew "MS-#8"
+```
+
+The skill:
+
+- pulls Worker secret + Coinbase creds from 1Password (op CLI)
+- sends USDC from the isolated portfolio via Coinbase API
+- calls pay.wip.computer/create with auth header to mint a one-time URL
+- returns the URL ... agent consumes it once ... URL is deleted forever
+
+## Cloudflare Worker Code
+
+Deploy at pay.wip.computer (free tier).
+
+```javascript
+// pay.wip.computer ... wip-agent-pay relay
+// Source: https://github.com/wipcomputer/wip-agent-pay
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    const path = url.pathname;
+
+    // Health check
+    if (path === '/' || path === '/health') {
+      return Response.json({ status: 'ok', service: 'wip-agent-pay' });
+    }
+
+    // === CREATE (protected) ===
+    if (path === '/create') {
+      // Auth: secret stored in Cloudflare env, same value in 1Password
+      const auth = request.headers.get('Authorization');
+      if (!env.WORKER_SECRET || auth !== `Bearer ${env.WORKER_SECRET}`) {
+        return new Response('Unauthorized', { status: 401 });
+      }
+
+      let body;
+      try {
+        body = await request.json();
+      } catch {
+        return new Response('Bad JSON', { status: 400 });
+      }
+
+      const { amount, service, note, expiresMin } = body;
+      const safeNote = typeof note === 'string' ? note : '';
+      const safeTtl = typeof expiresMin === 'number' && expiresMin > 0 ? Math.min(expiresMin, 60) : 10;
+
+      // Validate
+      if (typeof amount !== 'number' || amount <= 0 || amount > 50) {
+        return new Response('amount must be > 0 and <= 50', { status: 400 });
+      }
+      if (typeof service !== 'string' || service.length === 0 || service.length > 50) {
+        return new Response('service must be 1-50 chars', { status: 400 });
+      }
+      if (safeNote.length > 200) {
+        return new Response('note must be <= 200 chars', { status: 400 });
+      }
+
+      const token = crypto.randomUUID();
+      const expiresAt = Date.now() + safeTtl * 60 * 1000;
+
+      await env.KV.put(token, JSON.stringify({
+        amount,
+        service,
+        note: safeNote,
+        expiresAt,
+        createdAt: new Date().toISOString()
+      }), { expirationTtl: safeTtl * 60 });
+
+      return Response.json({ url: `${url.origin}/${token}` });
+    }
+
+    // === CONSUME (atomic delete ... no race condition) ===
+    const token = path.slice(1);
+    if (!token || token.length < 10) {
+      return new Response('Not found', { status: 404 });
+    }
+
+    const data = await env.KV.get(token, 'json');
+    if (!data || Date.now() > data.expiresAt) {
+      return new Response('Invalid or expired token', { status: 410 });
+    }
+
+    // Delete immediately. First reader wins. Second reader gets 410.
+    await env.KV.delete(token);
+
+    return Response.json({
+      success: true,
+      amount: data.amount,
+      service: data.service,
+      note: data.note,
+      consumedAt: new Date().toISOString()
+    });
+  }
+};
+```
+
+**KV Namespace:** Create one called `PAY_TOKENS` and bind it as `KV`.
+
+**Worker Secret:** Set via `wrangler secret put WORKER_SECRET` or dashboard. Same value goes in 1Password as `wip-agent-pay-worker-secret`.
+
+**Note on consistency:** KV is eventually consistent across Cloudflare edge locations. For $0.10 micropayments, atomic delete per-colo is sufficient. If you ever need strict global single-use, upgrade to Durable Objects.
+
+## Pluggable Providers
+
+```
+providers/
+  coinbase.js   ... v1 (shipped)
+  ledger.js     ... add later
+  phantom.js    ... add later
+```
+
+Each provider exports `authorize(amount, service, note)` and returns `{ success, provider, amount, url }`.
+
+## Security Guarantees
+
+- Main Coinbase balance untouched (isolated portfolio, max $50)
+- API key locked to tiny portfolio only (Transfer + View permissions)
+- Worker /create endpoint requires Bearer token auth
+- URLs are deleted on first use (not marked ... deleted)
+- Worker secret lives in Cloudflare env + 1Password (never in code)
+- Full worker code is public ... nothing hidden
+- Input validation: amount 0-50, service 1-50 chars, note max 200, TTL max 60 min
+
+---
+
+This is the protocol the agent economy has been waiting for.