docs: clarify payment identifier request binding

.github/workflows/check_format.yml

@@ -1,41 +1,47 @@
 name: Format
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-format-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
       - name: Ensure formatting
         working-directory: ./typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check
 
   check-format-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
       - name: Ensure formatting
         working-directory: ./examples/typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm format:check

.github/workflows/check_go.yml

@@ -1,17 +1,21 @@
 name: Check Go
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-format-go:
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: ./go
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.24"
           cache-dependency-path: ./go/go.sum
@@ -32,10 +36,10 @@ jobs:
       run:
         working-directory: ./go
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.24"
           cache-dependency-path: ./go/go.sum
@@ -51,10 +55,10 @@ jobs:
       run:
         working-directory: ./go
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version: "1.24"
           cache-dependency-path: ./go/go.sum

.github/workflows/check_lint.yml

@@ -1,41 +1,47 @@
 name: Lint
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-lint-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
       - name: Ensure Linting
         working-directory: ./typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm lint:check
 
   check-lint-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
       - name: Ensure Linting
         working-directory: ./examples/typescript
         run: |
-          pnpm install --frozen-lockfile
+          pnpm install --frozen-lockfile --ignore-scripts
           pnpm lint:check

.github/workflows/check_package_lock.yml

@@ -1,27 +1,32 @@
 name: Package Lock
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   check-package-lock-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./typescript
 
       - name: Check if pnpm-lock.yaml changed
         working-directory: ./typescript
         run: |
-          pnpm install
+          pnpm install --ignore-scripts
           if [ -n "$(git diff pnpm-lock.yaml)" ]; then
             echo "Error: pnpm-lock.yaml was modified after running pnpm install. Please commit the updated pnpm-lock.yaml file."
             git diff pnpm-lock.yaml
@@ -31,23 +36,24 @@ jobs:
   check-package-lock-examples-typescript:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
         with:
+          version: 11.1.1
           run_install: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: "20"
+          node-version: "22"
           cache: "pnpm"
           cache-dependency-path: ./examples/typescript
 
       - name: Check if pnpm-lock.yaml changed
         working-directory: ./examples/typescript
         run: |
-          pnpm install
+          pnpm install --ignore-scripts
           if [ -n "$(git diff pnpm-lock.yaml)" ]; then
             echo "Error: pnpm-lock.yaml was modified after running pnpm install. Please commit the updated pnpm-lock.yaml file."
             git diff pnpm-lock.yaml

.github/workflows/check_paywall_template.yml

@@ -0,0 +1,111 @@
+name: Check Paywall Template
+
+on:
+  pull_request:
+    paths:
+      - "typescript/packages/http/paywall/**"
+      - "typescript/packages/mechanisms/evm/**"
+      - "typescript/pnpm-lock.yaml"
+      - "python/x402/http/paywall/**"
+      - "go/http/evm_paywall_template.go"
+      - "go/http/svm_paywall_template.go"
+      - "go/http/avm_paywall_template.go"
+      - ".github/workflows/check_paywall_template.yml"
+
+permissions:
+  contents: read
+  id-token: none
+
+jobs:
+  check-paywall-template:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: 11.1.1
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "24"
+          cache: "pnpm"
+          cache-dependency-path: ./typescript
+
+      - name: Install dependencies
+        working-directory: ./typescript
+        run: pnpm install --frozen-lockfile --ignore-scripts
+
+      - name: Build workspace dependencies
+        working-directory: ./typescript
+        run: pnpm run build:paywall-deps
+
+      - name: Regenerate paywall bundles
+        working-directory: ./typescript/packages/http/paywall
+        run: pnpm run build:paywall
+
+      - name: Verify regenerated templates match committed files
+        run: |
+          git diff --exit-code -- \
+            typescript/packages/http/paywall/src/evm/gen/template.ts \
+            typescript/packages/http/paywall/src/svm/gen/template.ts \
+            typescript/packages/http/paywall/src/avm/gen/template.ts \
+            python/x402/http/paywall/evm_paywall_template.py \
+            python/x402/http/paywall/svm_paywall_template.py \
+            python/x402/http/paywall/avm_paywall_template.py \
+            go/http/evm_paywall_template.go \
+            go/http/svm_paywall_template.go \
+            go/http/avm_paywall_template.go \
+            || {
+              echo ""
+              echo "::error::Stale paywall templates: regenerated outputs differ from committed snapshots."
+              echo "Regenerate exactly as CI does (from \`typescript/\`, deps first):"
+              echo "  cd typescript"
+              echo "  pnpm install --frozen-lockfile --ignore-scripts"
+              echo "  pnpm run build:paywall-deps"
+              echo "  pnpm --filter @x402/paywall run build:paywall"
+              echo "Then stage and commit the nine template files under typescript/, python/, and go/http/ listed in this workflow."
+              echo ""
+              git diff --stat -- \
+                typescript/packages/http/paywall/src/evm/gen/template.ts \
+                typescript/packages/http/paywall/src/svm/gen/template.ts \
+                typescript/packages/http/paywall/src/avm/gen/template.ts \
+                python/x402/http/paywall/evm_paywall_template.py \
+                python/x402/http/paywall/svm_paywall_template.py \
+                python/x402/http/paywall/avm_paywall_template.py \
+                go/http/evm_paywall_template.go \
+                go/http/svm_paywall_template.go \
+                go/http/avm_paywall_template.go
+              exit 1
+            }
+
+      - name: Verify determinism (re-run build, compare to first run)
+        working-directory: ./typescript/packages/http/paywall
+        run: |
+          first_sha=$(sha256sum \
+            src/evm/gen/template.ts \
+            src/svm/gen/template.ts \
+            src/avm/gen/template.ts \
+            ../../../../python/x402/http/paywall/evm_paywall_template.py \
+            ../../../../python/x402/http/paywall/svm_paywall_template.py \
+            ../../../../python/x402/http/paywall/avm_paywall_template.py \
+            ../../../../go/http/evm_paywall_template.go \
+            ../../../../go/http/svm_paywall_template.go \
+            ../../../../go/http/avm_paywall_template.go)
+          pnpm run build:paywall
+          second_sha=$(sha256sum \
+            src/evm/gen/template.ts \
+            src/svm/gen/template.ts \
+            src/avm/gen/template.ts \
+            ../../../../python/x402/http/paywall/evm_paywall_template.py \
+            ../../../../python/x402/http/paywall/svm_paywall_template.py \
+            ../../../../python/x402/http/paywall/avm_paywall_template.py \
+            ../../../../go/http/evm_paywall_template.go \
+            ../../../../go/http/svm_paywall_template.go \
+            ../../../../go/http/avm_paywall_template.go)
+          if [ "$first_sha" != "$second_sha" ]; then
+            echo "::error::build:paywall is non-deterministic across repeat runs. See x4-23b for context."
+            diff <(echo "$first_sha") <(echo "$second_sha")
+            exit 1
+          fi

.github/workflows/check_python.yml

@@ -1,17 +1,21 @@
 name: Check Python
 on: [pull_request]
 
+permissions:
+  contents: read
+  id-token: none
+
 jobs:
   test-python:
     runs-on: ubuntu-latest
     defaults:
       run:
         working-directory: ./python/x402
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
           cache-dependency-glob: "python/x402/uv.lock"
@@ -31,10 +35,10 @@ jobs:
       run:
         working-directory: ./python/x402
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
         with:
           enable-cache: true
           cache-dependency-glob: "python/x402/uv.lock"