[Abdulwasiu45]

Summary

• Reject duplicate policy contract IDs within a single agent grant while allowing reuse across grants for different tokens.
• Reject agent expirations at or before the current time before passkey resume or mint.
• Reject valid JSON values that are not objects in PAYMENT-REQUIRED headers with a named error before consumers access payload fields.
• Add regression coverage and preserve the x402 control-character vectors as reviewable text.

Fixes #762
Fixes #763
Fixes #668

Validation

• Focused tests: npx vitest run src/agents-facade.test.ts src/x402-untrusted.test.ts src/x402-guards.test.ts (138 passed).
• git diff --check passes.
• Repository-wide typecheck and tests currently fail on unrelated existing errors in other files/contrib suites.

[github-actions]

Thanks for the contribution — but contributor PRs may only change files inside contrib/.

This PR touches file(s) outside that folder:

• .gitattributes
• src/agents-facade.test.ts
• src/agents-facade.ts
• src/x402-guards.ts
• src/x402-untrusted-vectors.ts
• src/x402-untrusted.test.ts

Please open a new PR with your changes scoped to contrib/ only, targeting dev. See CONTRIBUTING.md and contrib/README.md. If your assigned issue genuinely needs changes elsewhere, say so on the issue first — don't open a PR outside contrib/.

Questions? Ask in the Telegram group.