@aifinpay/agent 1.8.2 → 2.0.0-rc.12

package/dist/unifiedAgent.js

@@ -15,14 +15,30 @@ import bs58 from "bs58";
 import { createHash, randomBytes } from "node:crypto";
 import { createPublicClient, createWalletClient, http, keccak256, toHex, toFunctionSelector, formatEther, } from "viem";
 import { privateKeyToAccount, } from "viem/accounts";
-import { defineChain } from "viem";
 import { polygon, base, arbitrum, optimism, bsc, mainnet, unichain } from "viem/chains";
-import { Connection, Keypair, PublicKey, SystemProgram, Transaction, TransactionInstruction, sendAndConfirmTransaction, } from "@solana/web3.js";
+import { botchain, xrplevm } from "./chains.js";
 import { AiFinPayError, X402Error, } from "./errors.js";
 import { Agent } from "./agent.js";
+import { loadLocalWalletIdentity } from "./localIdentity.js";
+import { SettlementClient, executeSettlementInvoice } from "./settlement.js";
 import { MemorySpendLedger, FileSpendLedger } from "./spendLedger.js";
 import { aifp1Fetch, Aifp1ReceiptCache, } from "./aifp1.js";
 import { bridgeQuote as crossChainQuote, bridgeExecute as crossChainExecute, bridgeWaitForArrival, USDC_NATIVE, } from "./crossChain.js";
+/**
+ * The native-token payment block of a bridge 402, whichever key it arrived
+ * under.
+ *
+ * Both names, newest first. The production bridges renamed the block
+ * `pay_matic` → `pay_native` on 2026-08-04 when the on-chain entrypoint became
+ * `payNative` — and no SDK branch followed, so `agent.call()` failed against
+ * every live bridge with an error blaming facilitator wiring (AIFINP-118).
+ * Exported so the captured-fixture test drives this exact function; the
+ * original bug survived because the tests built their 402s in the SDK's own
+ * vocabulary and never met a real one.
+ */
+export function nativePayBlock(challenge) {
+    return challenge.pay_native ?? challenge.pay_matic;
+}
 // ── B2BSplitter contract ABI ─────────────────────────────────────────────
 // `payMatic` is the splitter's generic NATIVE-token payment entrypoint —
 // the name is a Polygon-era legacy. On Base/Optimism/Unichain it settles
@@ -72,32 +88,6 @@ const SPLITTER_PAY_NATIVE_ABI = [
 export function paymentIdFor(orderId) {
     return keccak256(toHex(orderId));
 }
-// ── B2BSplitter multi-chain deployment registry ──────────────────────────
-//
-// Chains where the fee-on-top B2BSplitter contract is DEPLOYED AND VERIFIED
-// on-chain (eth_getCode returned bytecode for every address below,
-// 2026-07-15). Do NOT add chains here without re-running that check.
-//
-// BOT Chain (677) and XRPL EVM (1440000) are not shipped with viem/chains,
-// so we defineChain() them locally.
-const botchain = defineChain({
-    id: 677,
-    name: "BOT Chain",
-    nativeCurrency: { name: "BOT", symbol: "BOT", decimals: 18 },
-    rpcUrls: { default: { http: ["https://rpc.botchain.ai"] } },
-    blockExplorers: {
-        default: { name: "BOT Chain Explorer", url: "https://scan.botchain.ai" },
-    },
-});
-const xrplevm = defineChain({
-    id: 1440000,
-    name: "XRPL EVM",
-    nativeCurrency: { name: "XRP", symbol: "XRP", decimals: 18 },
-    rpcUrls: { default: { http: ["https://rpc.xrplevm.org"] } },
-    blockExplorers: {
-        default: { name: "XRPL EVM Explorer", url: "https://explorer.xrplevm.org" },
-    },
-});
 export const SPLITTER_DEPLOYMENTS = {
     polygon: {
         version: "1.2",
@@ -384,8 +374,30 @@ export class AiFinPayAgent {
     }
     // ── Constructors ─────────────────────────────────────────────────────────
     /**
-     * Generate a fresh agent — new Solana keypair + new EVM keypair.
-     * Use `fromSeed()` to derive both from a single backup phrase instead.
+     * Load an existing local identity without creating or replacing a wallet.
+     * Priority: SEED_HASH → ./aifinpay/agents.json → AIFINPAY_AGENT_SECRET →
+     * the MCP keystore at AIFINPAY_HOME/agent.json (default ~/.aifinpay).
+     * AIFINPAY_AGENTS_FILE/AGENT_ID select a project file/record; encrypted
+     * keystores require AIFINPAY_WALLET_PASSPHRASE. Reads process.env, not .env.
+     * Missing, invalid or ambiguous configuration throws before any network call.
+     */
+    static async fromEnvironment(opts = {}) {
+        const identity = loadLocalWalletIdentity();
+        try {
+            return identity.seedHash !== undefined
+                ? await AiFinPayAgent.fromSeed(identity.seedHash, opts)
+                : await AiFinPayAgent.fromSolanaSecret(identity.secretB58, opts);
+        }
+        catch {
+            // Decoder/library errors can include input. Never echo local key material.
+            throw new AiFinPayError(`Invalid wallet selected from ${identity.source}; refusing to generate a replacement wallet`);
+        }
+    }
+    /**
+     * Generate a fresh, ephemeral agent. Every call selects a new identity;
+     * existing environment variables and keystores are NOT loaded or changed.
+     * This method does not persist its keys. Use fromEnvironment() for a funded
+     * existing wallet, or privately persist the new seed/secret before funding.
      */
     static async new(opts = {}) {
         // Seed-derived, NOT an independent random EVM key.
@@ -422,17 +434,21 @@ export class AiFinPayAgent {
      * TODO(phase-1): replace with BIP-39/BIP-44 derivation
      *   m/44'/501'/0'/0' (Solana) + m/44'/60'/0'/0/0 (EVM) once the
      *   wallet-import audit recommendation lands.
+     * An explicit opts.evmPrivateKey imports an existing EVM wallet instead;
+     * keep that key as well as the seed to restore the same EVM address.
      */
     static async fromSeed(seedHex, opts = {}) {
-        const seed = hexToBytes(seedHex.replace(/^0x/, ""));
-        if (seed.length !== 32) {
+        const normalizedSeed = seedHex.replace(/^0x/, "");
+        if (!/^[0-9a-fA-F]{64}$/.test(normalizedSeed)) {
             throw new AiFinPayError(`fromSeed: seed must be 32 bytes (64 hex chars)`);
         }
+        const seed = hexToBytes(normalizedSeed);
         const kp = nacl.sign.keyPair.fromSeed(seed);
         const inner = Agent
             ._ofKeyPair?.(kp, opts) ?? Agent.fromSecretB58(bs58.encode(kp.secretKey), opts);
         // Derive EVM key from seed (independent, not BIP-44 — see TODO above)
-        const evmHex = ("0x" + bytesToHex(crypto32(seed)));
+        const evmHex = opts.evmPrivateKey
+            ?? ("0x" + bytesToHex(crypto32(seed)));
         const evmAccount = privateKeyToAccount(evmHex);
         return new AiFinPayAgent(inner, evmAccount, opts);
     }
@@ -959,14 +975,10 @@ export class AiFinPayAgent {
     }
     // ── Call ────────────────────────────────────────────────────────────────
     /**
-     * High-level paid call. Resolves the provider, picks a chain, builds the
-     * payment, sends to the bridge, retries with payment proof.
-     *
-     * EVM settlement: per-call splitter via on-chain `B2BSplitter.payMatic()`
-     * (generic native-token entrypoint) on any SPLITTER_DEPLOYMENTS chain —
-     * polygon (default), base, optimism, unichain, botchain, xrplevm. Pass
-     * `chain` in CallOptions to override (the provider must accept it).
-     * Solana settlement: b2b_pay_with_split (live since 2026-05-18).
+     * Legacy bridge call. Free/read-only bridge responses are passed through;
+     * paid 402 challenges fail closed because this legacy settlement surface has
+     * no independently reviewed target. Use the reviewed fetchPaid v1.3 route
+     * with a fresh trusted quote/FX result for paid requests.
      *
      * Returns `null` (instead of a `Response`) iff a budget cap was hit
      * AND budget.on_limit_exceeded is set to "skip" — the call is dropped
@@ -1031,119 +1043,22 @@ export class AiFinPayAgent {
             catch (e) {
                 throw new X402Error(`bridge returned 402 with non-JSON body`);
             }
-            // ── Solana branch (b2b_pay_with_split atomic split, live 2026-05-18) ──
-            if (chain === "solana") {
-                if (!challenge.pay_solana) {
-                    throw new X402Error(`Bridge ${provider.name} returned 402 without a pay_solana block. ` +
-                        `Either pick chain: "polygon" or ask the operator to set ` +
-                        `BRIDGE_MERCHANT_SOLANA on the bridge service.`);
-                }
-                const ps = challenge.pay_solana;
-                // Guard: the bridge controls the challenge — verify the demanded
-                // amount is in the same ballpark as the declared cost / caps before
-                // signing anything. Stops a misquoting bridge from draining the agent.
-                {
-                    const lamports = Number(ps.total_lamports ?? ps.merchant_amount_lamports);
-                    const solUsd = parseFloat(process.env.AIFINPAY_SOL_USD ?? "200");
-                    const estUsd = (Number.isFinite(lamports) ? lamports / 1e9 : 0) * solUsd;
-                    const guarded = this.guardChallengeAmount(estUsd, cost, provider.name);
-                    if (!guarded)
-                        return null;
-                }
-                const solTxSig = await this.submitSolanaB2BPayWithSplit(ps);
-                const paidResp = await this.inner.fetchImpl(fullUrl, buildInit({
-                    "x-solana-tx": solTxSig,
-                    "x-order-id": ps.order_id,
-                }));
-                if (!paidResp.ok) {
-                    const detail = await paidResp.text().catch(() => "<unreadable>");
-                    throw new AiFinPayError(`Bridge retry failed ${paidResp.status} after Solana payment ${solTxSig}: ${detail.slice(0, 300)}`);
-                }
-                // Money moved here, and only here. The reservation becomes a
-                // settled amount; the finally below then has nothing to release.
-                this.spend24h.add(cost);
-                if (typeof reservation === "string") {
-                    await this.ledger.commit(reservation, cost);
-                }
-                settled = true;
-                if (this.telemetry)
-                    this.reportTelemetry({ kind: "call", provider: provider.name, chain, cost, tx: solTxSig });
-                // @internal — attach settlement metadata for consumers (MCP, telemetry
-                // dashboards) that need to surface the tx hash without an extra RPC
-                // call. Response headers are read-only after construction so we use
-                // an instance property + cast on the read side.
-                paidResp.aifinpayTx = solTxSig;
-                paidResp.aifinpayChain = "solana";
-                return paidResp;
-            }
-            // ── EVM branch (B2BSplitter.payMatic — generic native-token atomic split) ──
-            // Settles on any chain in SPLITTER_DEPLOYMENTS (polygon default; base,
-            // optimism, unichain, botchain, xrplevm). Native token only — the
-            // deployed splitter payment path has no ERC-20/USDC entrypoint.
-            if (!challenge.pay_matic) {
-                throw new X402Error(`bridge ${provider.name} returned 402 but no pay_matic block — only legacy AiFinPay/Coinbase facilitators not yet wired into AiFinPayAgent.call()`);
-            }
-            const pm = challenge.pay_matic;
-            const deployment = SPLITTER_DEPLOYMENTS[chain];
-            if (!deployment) {
-                throw new AiFinPayError(`No B2BSplitter deployment registered for chain "${chain}" — supported: ${Object.keys(SPLITTER_DEPLOYMENTS).join(", ")}`);
+            // Legacy bridge settlement is fail-closed. The challenge historically
+            // supplied arbitrary splitter/program addresses and native amounts, so
+            // continuing from here could sign against an unreviewed target or let a
+            // missing price bypass the budget. Keep free/read-only calls above, but
+            // refuse every paid legacy challenge before any signing or broadcast.
+            if (!(typeof provider.price_usd === "number" && Number.isFinite(provider.price_usd) && provider.price_usd > 0) ||
+                !(typeof cost === "number" && Number.isFinite(cost) && cost > 0)) {
+                throw new AiFinPayError(`legacy call() refused ${provider.name}: the provider has no trusted positive USD price; ` +
+                    `use the reviewed fetchPaid v1.3 route with fresh trusted FX instead`);
             }
-            // Refuse to pay a quote denominated for another chain's native token:
-            // total_wei quoted for POL on Polygon would be a massive overpay if
-            // blindly re-sent as ETH on Base. Legacy bridges always emit "polygon".
-            if (pm.chain && pm.chain !== chain) {
-                throw new X402Error(`bridge ${provider.name} quoted pay_matic for chain "${pm.chain}" but the call was routed to "${chain}" — refusing cross-denomination payment`);
+            if (!legacySettlementIsReviewed()) {
+                throw new AiFinPayError(`legacy call() settlement is disabled: challenge targets are not trusted for mainnet payment; ` +
+                    `use fetchPaid with a reviewed v1.3 settlement pin and fresh trusted FX`);
             }
-            // Guard: same ballpark check as the Solana branch — never sign for an
-            // amount wildly above the declared cost / per-call cap. Native-token
-            // USD price per chain via SPLITTER_DEPLOYMENTS.nativeUsdEnv.
-            {
-                const wei = Number(pm.total_wei);
-                const { usd: nativeUsd } = await this.nativeUsdFor(deployment);
-                // NaN when no price is known — guardChallengeAmount then declines to
-                // block rather than blocking on a guess. See nativeUsdFor().
-                const estUsd = (Number.isFinite(wei) ? wei / 1e18 : 0) * nativeUsd;
-                const guarded = this.guardChallengeAmount(estUsd, cost, provider.name);
-                if (!guarded)
-                    return null;
-            }
-            // 2. Submit the B2BSplitter payment on the selected chain's mainnet and
-            // wait for it to land. Prefer the challenge's splitter address (current
-            // bridge behaviour); fall back to the registry address for bridges that
-            // omit it.
-            const splitterAddress = pm.splitter
-                ?? deployment.splitter;
-            const txHash = await this.settleSplitterNative({
-                chain,
-                splitter: splitterAddress,
-                splitterVersion: pm.splitter_version,
-                merchantWallet: pm.merchant_wallet,
-                totalWei: BigInt(pm.total_wei),
-                orderId: pm.order_id,
-                ipCreator: pm.ip_creator,
-            });
-            // 3. Retry the bridge with payment proof.
-            const paidResp = await this.inner.fetchImpl(fullUrl, buildInit({
-                "x-tx-hash": txHash,
-                "x-order-id": pm.order_id,
-            }));
-            if (!paidResp.ok) {
-                const detail = await paidResp.text().catch(() => "<unreadable>");
-                throw new AiFinPayError(`Bridge retry failed ${paidResp.status} after on-chain payment ${txHash}: ${detail.slice(0, 300)}`);
-            }
-            // Money moved here, and only here. The reservation becomes a
-            // settled amount; the finally below then has nothing to release.
-            this.spend24h.add(cost);
-            if (typeof reservation === "string") {
-                await this.ledger.commit(reservation, cost);
-            }
-            settled = true;
-            if (this.telemetry)
-                this.reportTelemetry({ kind: "call", provider: provider.name, chain, cost, tx: txHash });
-            // @internal — see Solana branch above for rationale on property-attach.
-            paidResp.aifinpayTx = txHash;
-            paidResp.aifinpayChain = chain;
-            return paidResp;
+            throw new AiFinPayError(`legacy call() settlement is disabled: challenge targets are not trusted for mainnet payment; ` +
+                `use fetchPaid with a reviewed v1.3 settlement pin and fresh trusted FX`);
         }
         finally {
             // Every path that did not move money gives the budget back now rather
@@ -1167,74 +1082,14 @@ export class AiFinPayAgent {
     // a reverted transaction would otherwise be handed to a merchant as proof of
     // a payment that never moved.
     async settleSplitterNative(p) {
-        // call() has already checked this for the bridge flow; repeated here
-        // because settlement is now reachable without going through call().
-        const deployment = SPLITTER_DEPLOYMENTS[p.chain];
-        if (!deployment) {
-            throw new AiFinPayError(`No B2BSplitter deployment registered for chain "${p.chain}" — supported: ${Object.keys(SPLITTER_DEPLOYMENTS).join(", ")}`);
-        }
-        // ipCreator routing: prefer the caller's explicit ip_creator; else route
-        // the royalty slot to the splitter's treasury (mirrors the Solana branch).
-        // Passing address(0) would skip the transfer and permanently strand the
-        // 1bp inside B2BSplitter — the contract has no sweep function.
-        const ipCreator = p.ipCreator
-            ?? await this.splitterTreasury(p.splitter, p.chain)
-            ?? "0x0000000000000000000000000000000000000000";
-        const { publicClient, walletClient } = this.splitterClients(p.chain);
-        // The entrypoint follows the deployed contract, not the SDK release: v1.2
-        // (Polygon, Optimism, BOT Chain, XRPL EVM as of 2026-07-31) takes a bytes32
-        // paymentId and rejects one it has already settled, while Base and Unichain
-        // still run v1.1. Sending v1.2 calldata to a v1.1 contract reverts with no
-        // useful reason, so this must be decided per chain.
-        // An explicit `splitterVersion` wins — a server that states it knows what
-        // it deployed. What it must NOT fall back to is this registry's
-        // chain -> version entry, because the ADDRESS came from the server and
-        // the version would come from a table: two sources that can disagree.
-        //
-        // In production they did. The Exa bridge still hands out the pre-v1.2
-        // splitter 0xE34Fc0E6… and sends no version; the table says "polygon is
-        // 1.2"; the SDK called payNative on a contract that only has payMatic, and
-        // the payment reverted with nothing in the reason to explain it.
-        //
-        // So when the server is silent, ask the contract at the address we were
-        // actually handed. The registry is used only if the chain cannot be read.
-        const splitterVersion = p.splitterVersion
-            ?? await this.detectSplitterVersion(p.splitter, p.chain, deployment.version);
-        await this.assertCanAffordNative(publicClient, deployment, p.totalWei);
-        const txHash = splitterVersion === "1.2"
-            ? await walletClient.writeContract({
-                address: p.splitter,
-                abi: SPLITTER_PAY_NATIVE_ABI,
-                functionName: "payNative",
-                args: [
-                    paymentIdFor(p.orderId),
-                    p.merchantWallet,
-                    ipCreator,
-                    p.orderId,
-                ],
-                value: p.totalWei,
-                chain: deployment.chain,
-                account: this.evmAccount,
-            })
-            : await walletClient.writeContract({
-                address: p.splitter,
-                abi: SPLITTER_PAY_MATIC_ABI,
-                functionName: "payMatic",
-                args: [
-                    p.merchantWallet,
-                    ipCreator,
-                    p.orderId,
-                ],
-                value: p.totalWei,
-                chain: deployment.chain,
-                account: this.evmAccount,
-            });
-        // Wait for receipt (inclusion is enough on these fast-block chains).
-        const receipt = await publicClient.waitForTransactionReceipt({ hash: txHash });
-        if (receipt.status !== "success") {
-            throw new AiFinPayError(`${deployment.chain.name} tx reverted: ${txHash}`);
-        }
-        return txHash;
+        void p;
+        throw new AiFinPayError("legacy splitter settlement is disabled; use fetchPaid with a reviewed v1.3 settlement pin");
+    }
+    // Legacy Solana settlement remains a named private surface only so older
+    // callers fail with a clear migration error instead of reaching a signer.
+    async submitSolanaB2BPayWithSplit(ps) {
+        void ps;
+        throw new AiFinPayError("legacy Solana settlement is disabled; use fetchPaid with a reviewed v1.3 settlement pin");
     }
     // ── AIFP-1 merchant paywall (gateway.aifinpay.io) ───────────────────────
     //
@@ -1251,6 +1106,24 @@ export class AiFinPayAgent {
      * contain bearer JWTs — treat them like keys, and do not log them.
      */
     get aifp1Receipts() { return this._aifp1Cache; }
+    /**
+     * Use the canonical invoice executor only with a caller-supplied deployment
+     * pin. An unauthenticated quote cannot establish its own signing authority.
+     */
+    async settleAifp1NativeV13(p, opts) {
+        const pin = opts.settlementPin;
+        if (!pin || pin.route_class !== "AIFP-1" || pin.chain !== "polygon" || pin.testnet) {
+            throw new AiFinPayError("AIFP-1 fetchPaid requires an independent trusted Polygon v1.3 settlement pin; other receipt networks are not supported");
+        }
+        const client = new SettlementClient({ baseUrl: opts.apiBaseUrl ?? "https://api.aifinpay.io", fetchImpl: this.inner.fetchImpl, timeoutMs: this.inner.timeoutMs });
+        const invoice = await client.invoice({
+            route_class: "AIFP-1", chain: "polygon", asset: "POL", gross_amount: p.grossWei,
+            merchant_wallet: p.merchantWallet, order_id: p.orderId, valid_until: Number(p.validUntil),
+        });
+        const { publicClient, walletClient } = this.polygonClients();
+        const execution = await executeSettlementInvoice(invoice, walletClient, publicClient, pin);
+        return execution.settlement_tx;
+    }
     /**
      * Fetch a paywalled URL, paying the AIFP-1 gateway if it asks.
      *
@@ -1266,7 +1139,6 @@ export class AiFinPayAgent {
      * `budgetCaps.on_limit_exceeded` is "skip".
      */
     async fetchPaid(url, init = {}, opts = {}) {
-        const deployment = SPLITTER_DEPLOYMENTS.polygon;
         const deps = {
             fetchImpl: this.inner.fetchImpl,
             cache: this._aifp1Cache,
@@ -1274,25 +1146,9 @@ export class AiFinPayAgent {
             // (backend/aifp/agent-policy.js normalizeAddress) — a Solana pubkey here
             // would silently opt the agent out of its owner's own limits.
             agentId: opts.agentId ?? this.evmAddress,
-            settle: (p) => this.settleSplitterNative({
-                // Polygon-only, and not by preference: /v1/pay verifies the settlement
-                // by reading the Splitter's Payment event, and that verifier implements
-                // Polygon alone (backend/aifp/verify-settlement.js — Solana returns
-                // notImplemented, anything else unsupported_chain). Settling elsewhere
-                // would move real money for a receipt that can never be issued.
-                chain: "polygon",
-                // The address is not carried in the quote, so it comes from this SDK's
-                // own verified registry. The backend checks the tx against its
-                // configured SPLITTER_ADDRESS_POLYGON; if an operator has pointed that
-                // somewhere else, /v1/pay answers no_splitter_payment_event, which is
-                // loud. Override here if you are running against such a deployment.
-                splitter: opts.splitter ?? deployment.splitter,
-                // Left undetected on purpose — settleSplitterNative asks the contract,
-                // which is the only source that cannot disagree with itself.
-                merchantWallet: p.merchantWallet,
-                totalWei: p.totalWei,
-                orderId: p.orderId,
-            }),
+            payerAddress: this.evmAddress,
+            signPaymentAuthorization: (message) => this.evmAccount.signMessage({ message }),
+            settle: (p) => this.settleAifp1NativeV13(p, opts),
             checkPerCall: (usd) => this.checkPerCall(usd),
             reserveDaily: (usd) => this.reserveDaily(usd),
             commit: (id, usd) => this.ledger.commit(id, usd),
@@ -1309,66 +1165,6 @@ export class AiFinPayAgent {
         };
         return aifp1Fetch(deps, url, init, opts);
     }
-    // ── Solana b2b_pay_with_split — build, sign, send via @solana/web3.js ───
-    //
-    // Manual instruction encoding (no Anchor dep):
-    //   discriminator = sha256("global:b2b_pay_with_split")[:8]
-    //   args (Borsh)   = u64 merchant_amount_lamports + string order_id
-    //   accounts       = [config_pda, vault_pda, agent (signer), treasury,
-    //                     ip_creator, merchant_wallet, system_program]
-    // PDAs derived from program_id with seeds ["config"] and ["vault"].
-    async submitSolanaB2BPayWithSplit(ps) {
-        const conn = new Connection(this.solanaRpc, "confirmed");
-        const programId = new PublicKey(ps.program_id);
-        const merchant = new PublicKey(ps.merchant_wallet);
-        const treasury = new PublicKey(ps.treasury);
-        // ip_creator slot: not surfaced by current bridge 402s; route through
-        // treasury so the on-chain 1bp still settles atomically (treasury earns
-        // both 100bp + 1bp). When bridges add per-merchant ip_creator support,
-        // accept it from `ps` and pass through.
-        const ipCreator = treasury;
-        // Solana keypair from legacy Agent inner (tweetnacl 64-byte secret).
-        const kp = Keypair.fromSecretKey(this.inner.secretKey);
-        if (kp.publicKey.toString() !== this.inner.address) {
-            throw new AiFinPayError(`Internal: Solana keypair pubkey ${kp.publicKey.toString()} does not match agent address ${this.inner.address}`);
-        }
-        // PDAs
-        const [configPda] = PublicKey.findProgramAddressSync([Buffer.from("config")], programId);
-        const [vaultPda] = PublicKey.findProgramAddressSync([Buffer.from("vault")], programId);
-        // Instruction discriminator: Anchor convention sha256("global:<fn_name>")[:8].
-        const disc = createHash("sha256").update("global:b2b_pay_with_split").digest().subarray(0, 8);
-        // Borsh args: merchant_amount_lamports (u64 LE) + order_id (string = u32 len + utf8)
-        const merchantAmount = BigInt(ps.merchant_amount_lamports);
-        const amountBuf = Buffer.alloc(8);
-        amountBuf.writeBigUInt64LE(merchantAmount);
-        const orderBytes = Buffer.from(ps.order_id, "utf8");
-        if (orderBytes.length > 64) {
-            throw new AiFinPayError(`order_id too long (${orderBytes.length} bytes > 64 limit)`);
-        }
-        const orderLenBuf = Buffer.alloc(4);
-        orderLenBuf.writeUInt32LE(orderBytes.length);
-        const data = Buffer.concat([disc, amountBuf, orderLenBuf, orderBytes]);
-        const ix = new TransactionInstruction({
-            programId,
-            keys: [
-                { pubkey: configPda, isSigner: false, isWritable: false },
-                { pubkey: vaultPda, isSigner: false, isWritable: false },
-                { pubkey: kp.publicKey, isSigner: true, isWritable: true },
-                { pubkey: treasury, isSigner: false, isWritable: true },
-                { pubkey: ipCreator, isSigner: false, isWritable: true },
-                { pubkey: merchant, isSigner: false, isWritable: true },
-                { pubkey: SystemProgram.programId, isSigner: false, isWritable: false },
-            ],
-            data,
-        });
-        const tx = new Transaction().add(ix);
-        // sendAndConfirmTransaction sets recentBlockhash + feePayer + signs.
-        const sig = await sendAndConfirmTransaction(conn, tx, [kp], {
-            commitment: "confirmed",
-            preflightCommitment: "confirmed",
-        });
-        return sig;
-    }
     // ── Sessions ────────────────────────────────────────────────────────────
     /**
      * TODO(phase-3): open a metered budget session.
@@ -1475,8 +1271,6 @@ export class AiFinPayAgent {
             return 0; // never block balance() on Solana RPC issues
         }
     }
-    // Cache: "chain:splitter address" → treasury address (constant per deployment).
-    splitterTreasuryCache = new Map();
     /** Read + cache B2BSplitter.treasury() on the given chain (default
      *  polygon for back-compat). Returns null on RPC failure. */
     /**
@@ -1495,8 +1289,8 @@ export class AiFinPayAgent {
      * six registry chains against mainnet.
      *
      * One eth_getCode, cached per (chain, address). Falls back to the registry
-     * only when the code cannot be read: guessing beats refusing to pay, and for
-     * the addresses we deployed the guess is right.
+     * only for this read-only diagnostic when code cannot be read. The legacy
+     * payment path is disabled regardless of the reported or detected version.
      */
     splitterVersionCache = new Map();
     async detectSplitterVersion(splitter, chainName, fallback) {
@@ -1518,27 +1312,6 @@ export class AiFinPayAgent {
             return fallback;
         }
     }
-    async splitterTreasury(splitter, chainName = "polygon") {
-        const cacheKey = `${chainName}:${splitter.toLowerCase()}`;
-        const cached = this.splitterTreasuryCache.get(cacheKey);
-        if (cached)
-            return cached;
-        try {
-            const { publicClient } = this.splitterClients(chainName);
-            const treasury = await publicClient.readContract({
-                address: splitter,
-                abi: SPLITTER_TREASURY_ABI,
-                functionName: "treasury",
-            });
-            if (!treasury || treasury === "0x0000000000000000000000000000000000000000")
-                return null;
-            this.splitterTreasuryCache.set(cacheKey, treasury);
-            return treasury;
-        }
-        catch {
-            return null;
-        }
-    }
     /**
      * Read the native Polygon USDC (Circle-issued, 6 decimals) balance for the
      * agent's EVM address via the existing viem publicClient. Returns 0
@@ -1583,6 +1356,8 @@ export class AiFinPayAgent {
         }).catch(() => { });
     }
 }
+/** Legacy bridge settlement has no reviewed mainnet route; keep this closed. */
+function legacySettlementIsReviewed() { return false; }
 // ── Internal hex helpers (small, no extra deps) ────────────────────────────
 function hexToBytes(hex) {
     const out = new Uint8Array(hex.length / 2);