Buy a service with an agent.

One POST to the selected callUrl, with JSON matching inputSchema:
  first response: HTTP 402 + PAYMENT-REQUIRED (x402 v2)
  resource.url: this call with its short-lived quote ID
  accepts: exact · eip155:8453 · current Base USDC asset
           atomic amount · seller payTo · timeout
  intent.info (Voidpay extension): listing ID/version · input digest · quote expiry
           outputPrivacy · rightsManifestSha256 (nullable)
  intent.info.optionalBuyerSignatureHeader: x-voidpay-intent-signature

Your guarded fetch adapter reads and checks this response before it lets
@x402/fetch sign or retry. Reject a required work-purchase signature;
that negotiated work flow is outside this example.

// Work from the exact JSON body that will be sent, after schema validation.
function canonicalJson(value: unknown): string {
  if (value === null || typeof value !== 'object') return JSON.stringify(value)
  if (Array.isArray(value)) return '[' + value.map(canonicalJson).join(',') + ']'
  const object = value as Record<string, unknown>
  return '{' + Object.keys(object).sort().map(key =>
    JSON.stringify(key) + ':' + canonicalJson(object[key])
  ).join(',') + '}'
}
async function inputDigest(body: string): Promise<string> {
  const parsed = JSON.parse(body)
  const bytes = new TextEncoder().encode(canonicalJson(parsed))
  const hash = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))
  return '0x' + Array.from(hash, byte => byte.toString(16).padStart(2, '0')).join('')
}
const body = JSON.stringify(validatedInput)
const expectedInputSha256 = await inputDigest(body)

import { x402Client, wrapFetchWithPayment } from '@x402/fetch'
import { registerExactEvmScheme } from '@x402/evm/exact/client'

// Supply these from your buyer wallet and durable policy/journal adapter.
// The adapter checks the 402 against expectedInputSha256, records the
// original quote, rights digest and authorization, and permits one signed attempt.
const client = new x402Client()
registerExactEvmScheme(client, { signer: configuredBuyerSigner, networks: ['eip155:8453'] })
const paidFetch = wrapFetchWithPayment(inspectAndJournalFetch, client)

const response = await paidFetch(current.callUrl, {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  body,
})
// A returned 200 still needs signed receipt, work-envelope and byte verification.

From a new paid response:
  1. Read x-voidpay-delivery-receipt, x-voidpay-work-envelope
     and PAYMENT-RESPONSE.
  2. Fetch https://x402.voidly.ai/.well-known/voidpay-receipt-keys.json.
  3. Verify the receipt's Ed25519 signature with its keyVersion.
  4. Require signed status = delivered. Compare network and transaction
     hash with PAYMENT-RESPONSE. Compare asset, payer, payTo and amount
     with the saved 402 and authorization.
  5. Compare listing ID/version, quote ID, resource URL and input SHA-256
     with the saved attempt. Hash the exact returned response bytes and
     compare that SHA-256 with the signed output digest.
  6. Decode the work envelope. Verify its separate Ed25519 signature over
     "voidpay-work-envelope-v1\n" + sorted-key JSON payload without signature,
     using envelope.keyVersion from the key registry. This can differ from
     receipt.keyVersion.
  7. Match envelope.receiptSha256 to SHA-256 of the canonical v1 receipt
     payload without signature; match receiptSignature to the verified
     receipt signature. Match receiptKeyVersion, paymentKey, quoteId and
     status to the receipt and saved attempt.
  8. Match envelope.rightsManifestSha256 to the accepted 402
     intent.info rightsManifestSha256 and saved public rights summary digest.
     For this ordinary call, require acceptedTermsSha256,
     listingSnapshotSha256 and purchaseIntentSha256 to be null.

A decoded receipt or envelope without signature verification is not proof.

// Use the original payer and values saved before the signed request.
const message = [
  'Voidpay Marketplace recovery v1',
  'chainId:' + chainId,
  'paymentKey:' + paymentKey,
  'quoteId:' + quoteId,
].join('\n')
const signature = await signMessage(message) // EIP-191, original payer
const result = await fetch(
  API + '/v1/services/' + listingId + '/quotes/' + quoteId + '/result',
  { headers: {
    'x-voidpay-recovery-payment-key': paymentKey,
    'x-voidpay-recovery-signature': signature,
  } },
)
// Verify returned signed receipt and work envelope; hash delivered bytes as above.