Add shielded EVM payments as assetTransferMethod for exact scheme

[mmchougule]

Problem

Every x402 payment on EVM exposes the payer's wallet address on-chain. For AI agents making hundreds of API calls per day, this creates a complete trail of which services they use, how much they spend, and how often they call each endpoint. Any observer can reconstruct an agent's operational behavior from its payment history.

Proposed Solution

Add assetTransferMethod: "shielded" to the existing exact scheme on EVM. Clients withdraw tokens from an on-chain privacy pool directly to the resource server's payTo address. The privacy pool contract handles ZK proof verification and nullifier-based double-spend prevention on-chain. The facilitator confirms the resulting ERC-20 Transfer event matches the payment requirements.

How it works

On-chain (handled by the privacy pool contract):

1. Client generates a groth16 ZK proof proving ownership of a shielded UTXO
2. The proof includes nullifiers — cryptographic commitments that mark the UTXO as spent
3. Client submits the proof to the pool contract
4. Contract verifies the ZK proof, checks nullifiers against its on-chain spent set, and executes the ERC-20 transfer
5. If the tx succeeds, the proof was valid and the UTXO is now spent (nullified)

Facilitator verification:

1. Client sends txHash in PAYMENT-SIGNATURE header
2. Facilitator fetches tx receipt, confirms it was not reverted (meaning the pool contract accepted the ZK proof)
3. Facilitator checks the ERC-20 Transfer event: from is a registered pool contract, to matches payTo, value >= required amount
4. Facilitator tracks txHash to prevent the same payment from being reused for multiple API calls

The payer's wallet address never appears on-chain. The from field in the Transfer event shows the pool contract. The ZK proof ensures the payer owns sufficient funds without revealing which funds.

Why assetTransferMethod under exact

The exact scheme means the client pays the exact amount specified. shielded is a new transfer method — same semantics as EIP-3009, Permit2, and ERC-7710, but with sender privacy. The resource server advertises extra.assetTransferMethod: "shielded" in the 402 response.

Works with any ERC-20 on any EVM chain that has a compatible privacy pool (e.g., Railgun on Base, Ethereum, BSC, Polygon, Arbitrum).