@c4roa0/agentpay-user 0.3.3 → 0.3.5

package/doc/TODO.md

@@ -1,10 +1,23 @@
 # User TODO
 
+## Existing Market address update
+
+- [x] Allow source-to-npm reconnect without an onboarding draft; verify Policy contracts and preserve missing files.
+- [ ] Publish 0.3.5 and retry the participant address update.
+
+- [x] Reauthenticate and verify original account, Wallet tuple and Policy connection before replacing an address.
+- [x] Verify unchanged deployment; preserve RPC, key, Policy, history/cache and original cancellation IDs.
+- [x] Apply under installer lock, restart managed Runtime, retain retry marker and show incomplete update in status.
+- [x] Full regression (387 checks), followed by targeted reconnect-boundary/transaction checks.
+- [x] Publish User 0.3.4 through v0.3.4; workflow and independent registry integrity verification passed.
+- [ ] Verify the existing participant installation and explicit address update against HTTPS.
+
 ## Directory npm update, then HTTPS
 
 - [x] Support directory-local npm update without replacing source/link installs.
 - [x] Verify real npm directory upgrade and isolated preflight; nine regression checks passed.
-- [ ] Publish a follow-up version and verify participant directory install/update.
+- [x] Publish 0.3.3 via v0.3.3 and independently verify registry archive/dependency pins.
+- [ ] Verify participant directory install/update.
 
 ## Tag-triggered publication
 

package/doc/architecture.md

@@ -98,3 +98,20 @@ required for the local test suite.
 Tests use public interfaces and controlled remote responses. The explicit fault
 loader only instruments a spawned test Runtime; production startup contains no
 crash-test switch. See [test guide](https://github.com/c4rO-0/agentpay-user/blob/main/test/README.md) for evidence limits.
+
+## Explicit platform address changes
+
+`connect-market.mjs` reauthenticates at the user-selected origin and checks the
+original account, Wallet tuple and exact Policy connection ID. Public configuration
+is not a Market identity proof. `platform-endpoints.mjs` compares saved deployment
+and bound Policy with the new configuration, probes Settlement's existing public
+readiness projection, then changes only transport URLs after consent. No new API
+or platform identity key is introduced.
+
+The shared installer lock serializes the local apply step. Only the managed Runtime
+unit is stopped; its listener must be gone before writes. Private atomic files and
+a pending marker allow retry after interruption. Wallet and Order files are never
+rewritten. `settlement-address-history.mjs` preserves exact directed, Policy-scoped
+address mappings so cancellation retries retain their immutable original IDs.
+Runtime recovery observations remain tagged by source and are rechecked instead of
+being relabelled. The pending marker is surfaced by status.

package/doc/records/local-npm-update-2026-11-08.md

@@ -26,3 +26,7 @@ User 0.3.3 release preparation (2026-11-09): all 383 behavior checks and standal
 archive installation with isolated Wallet/Runtime process checks passed. Wallet
 0.3.2, Protocol 0.14.3 and official package pin are unchanged. Publication and
 participant acceptance remain separate gates.
+
+Publication verified on 2026-11-09: tag v0.3.3 at c5f3be1, GitHub run
+42567636609. Public npm archive matches the final local release archive byte for
+byte; provenance metadata is present. Participant acceptance remains pending.

package/doc/runbooks/market-connection.md

@@ -16,6 +16,43 @@ Review the account and nickname, then type `confirm`. Use `details` to inspect t
 Safe, network and Policy. Open Market → Account to view your Wallets and Orders.
 A separate browser login may be needed; terminal sign-in does not create browser cookies.
 
+## Change the address of the same Market
+
+In a version containing the address-update feature, run:
+
+```sh
+agentpay market connect --market https://YOUR_NEW_MARKET_ADDRESS
+```
+
+For a folder installation, use `./node_modules/.bin/agentpay` instead of `agentpay`.
+Sign in again at the address you trust. User checks that the account ID and the
+original Wallet/Policy connection are still present. The existing nickname is
+reused. It also checks the network, contracts and Settlement deployment before
+showing the new platform addresses for confirmation.
+
+Confirm to update the saved Market address and, if changed, the Settlement and
+package download addresses. Runtime pauses briefly and restarts; Wallet remains
+unlocked. Keys, Policy, Orders, input/output caches, startup preference and the
+participant's RPC address stay unchanged. No paid test runs automatically.
+
+A different account, missing original connection or changed contracts stops the
+address update. This is a deliberate address change, not automatic discovery or
+cryptographic proof of server identity. Check the website address yourself; the
+terminal never forwards a previously saved login token to the new address.
+
+If interrupted, repeat the same command with the same address. `status` reports
+an incomplete update until it finishes. If a killed process leaves an installation
+lock, confirm no installer is running before following the lock-review guidance;
+User does not break an unknown live lock automatically. Existing cancellation requests keep their
+original IDs; recovery checks refresh observations from the new Settlement.
+Keep any old SSH tunnels until the update succeeds and `status` confirms operation.
+This feature requires User 0.3.5 or newer. Updating software does not change
+your saved addresses; run the command above to review the change.
+
+Older source installations may leave onboarding files outside the npm package.
+Address updates use the saved Wallet Policy and Runtime settings; they do not
+require or recreate an old onboarding draft.
+
 ## Wallet identity and Policy access
 
 A Wallet is identified by network + Module + Safe + execution address. Its nickname

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c4roa0/agentpay-user",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "type": "module",
   "dependencies": {
     "@c4roa0/agentpay-protocol": "0.14.3",

package/progress.md

@@ -1,5 +1,53 @@
 # AgentPay User progress
 
+## Missing onboarding draft during npm address update — 2026-11-09
+
+Participant 0.3.4 reconnect stopped before address writes because an old onboarding
+file was absent. Address updates now validate the saved Policy and service settings
+without requiring that draft; existing draft/public files are updated only if
+present. No RPC, Policy, test configuration or private history is synthesized.
+389 full regressions passed, followed by targeted error-guidance checks. Missing
+drafts still reject contract drift; preflight errors explain the stage, preserved
+state and retry action, while interrupted writes warn about partial updates.
+User 0.3.5 publication is pending;
+participant migration remains unverified.
+
+## User 0.3.4 published — 2026-11-09
+
+Release the explicit Market address update with unchanged Wallet 0.3.2 and
+Protocol 0.14.3 pins. No participant data or running services are changed by
+publication. Independent npm archive installation and real isolated local-service
+startup passed; all 388 release regressions passed. Tag v0.3.4 identifies c63ff80.
+GitHub run 42574859894 completed OIDC publication and registry verification.
+Independent registry integrity comparison matched the reviewed local archive.
+Participant address migration remains pending.
+
+
+## Explicit Market address update — 2026-11-09
+
+Approved reduced scope: reuse login, Wallet list and public deployment interfaces;
+no Market identity key or new backend endpoint. User-selected address changes must
+match the original account/Wallet/Policy connection and deployment. Consent updates
+transport URLs, restarts only managed Runtime and preserves key/Policy/Orders/cache.
+Policy-scoped aliases retain cancellation IDs; interrupted apply has a retry marker
+and status guidance. Controlled address/connection/cancellation/status checks pass;
+387 full regression checks passed; subsequent reconnect-boundary/transaction
+changes passed targeted checks. npm publication and participant acceptance remain
+pending. Only explicit origin changes or interrupted updates enter this path;
+ordinary reconnect/renewal does not acquire new configuration dependencies.
+No participant settings have been modified.
+
+## User 0.3.3 published — 2026-11-09
+
+Tag v0.3.3 identifies c5f3be1. GitHub run 42567636609 passed behavior, standalone
+archive and OIDC publication steps. Independent public-registry verification
+confirmed exact Wallet 0.3.2 / Protocol 0.14.3 dependencies, provenance metadata
+and byte-identical archive (SHA-256
+aa231297a4690117850f5d50414d89ad0da86b29c29d03947383c23bfa62a833).
+Participant directory-update acceptance remains pending. Existing directory installs
+older than 0.3.3 need one npm install of 0.3.3 and repair before using local update.
+HTTPS endpoint migration is not included.
+
 ## User 0.3.3 release candidate — 2026-11-09
 
 Release directory-local npm updates, keeping exact Wallet 0.3.2 and Protocol

package/src/connect-market.mjs

@@ -13,6 +13,7 @@ import { checkServiceDirectory } from "./local-services.mjs";
 import { localWalletAdmin } from "./local-wallet-ipc.mjs";
 import { repairMarketWallet } from "./repair-market-wallet.mjs";
 import { controlWallet } from "./wallet-control.mjs";
+import { preparePlatformEndpoints } from "./platform-endpoints.mjs";
 import { fetchJsonWithTimeout } from "./transport.mjs";
 export function marketOrigin(value) {
   const u = new URL(value);
@@ -129,6 +130,7 @@ export async function connectMarket(
     save = saveConnection,
     repair = repairMarketWallet,
     unlock = controlWallet,
+    prepareEndpoints = preparePlatformEndpoints,
   } = {},
 ) {
   let token, origin, completion;
@@ -194,6 +196,8 @@ export async function connectMarket(
       return 0;
     }
     origin = marketOrigin(answer.trim() || previous?.marketOrigin);
+    write("Checking Market and platform addresses…");
+    const changingOrigin = !!previous?.marketOrigin && marketOrigin(previous.marketOrigin) !== origin;
     const call = async (path, body, auth = true) => {
       const { response, result } = await fetchJson(
         origin + "/market" + path,
@@ -244,6 +248,8 @@ export async function connectMarket(
     token = signedIn.sessionToken;
     if (typeof token !== "string" || !token || !signedIn.developer?.id)
       throw Error("Market returned an invalid sign-in response.");
+    if (changingOrigin && previous.accountId !== signedIn.developer.id)
+      throw Error("This is not your saved Market account. The previous connection and addresses were kept.");
     write(
       "\n------------------------------------------------------------\n2/3 Name your Wallet\n------------------------------------------------------------",
     );
@@ -257,6 +263,33 @@ export async function connectMarket(
           String(w[key]).toLowerCase() === scope[key].toLowerCase(),
       ),
     );
+    // These authenticated record checks detect accidental cross-Market moves.
+    // They are not a cryptographic server identity; the user chooses the URL.
+    const originalConnectionMatches = !!previous?.connection?.id && !!existing &&
+      ["network", "module", "safe", "delegate"].every(key =>
+        typeof previous.connection[key] === "string" &&
+        previous.connection[key].toLowerCase() === String(existing[key]).toLowerCase()) &&
+      existing.policies?.some(p => p.id === previous.connection.id &&
+        String(p.policyId).toLowerCase() === String(previous.connection.policyId).toLowerCase());
+    if (changingOrigin && !originalConnectionMatches)
+      throw Error("Your original Wallet connection was not found at this address. The previous connection and addresses were kept.");
+    let endpoints;
+    try {
+      endpoints = previous ? await prepareEndpoints({dataDir,origin,scope,fetchJson,changingOrigin}) : {changed:false,apply:async()=>{}};
+    } catch (error) {
+      const networkFailure = ["AbortError", "TimeoutError"].includes(error.name) ||
+        ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT"].includes(error.code || error.cause?.code) || error.message === "fetch failed";
+      const reason = networkFailure
+        ? "Could not reach the platform to check its settings. Check your network and the Market address."
+        : error.message;
+      write("\n[!] Platform address check stopped");
+      write(reason);
+      write("No local settings were changed by this check. Your Wallet and Order records are kept.");
+      write("Next: resolve the issue above, then retry this command.");
+      return 1;
+    }
+    if (endpoints.changed && (previous?.accountId !== signedIn.developer.id || !originalConnectionMatches))
+      throw Error("Platform addresses changed, but your original account and Wallet connection could not be confirmed. Current addresses were kept.");
     if (existing) write(`Using your Wallet name: ${existing.label}`);
     else
       write(
@@ -307,6 +340,10 @@ export async function connectMarket(
         write(
           "View this Wallet’s Orders and request help on Market. No spending permission is added.",
         );
+        if (endpoints.changed) write(`Also update platform addresses:
+Settlement: ${endpoints.urls.settlementUrl}
+Downloads: ${endpoints.urls.marketBundleMetadataUrl}
+Runtime will restart; your spending permission stays the same.`);
         while (true) {
           const choice = (
             await ask(
@@ -345,17 +382,24 @@ export async function connectMarket(
           throw Error("Connection execution address differs from this Wallet.");
         if (result.connection.label !== label)
           throw Error("Connection nickname differs. Check Market Settings.");
-        try {
-          await save(dataDir, {
-            version: 1,
-            marketOrigin: origin,
-            accountId: signedIn.developer.id,
-            connection: result.connection,
-          });
-        } catch {
-          write(
-            "Market connected this Wallet, but the local shortcut could not be saved. Use --market URL next time.",
-          );
+        if (changingOrigin && previous.connection.policyId === scope.policyId &&
+            result.connection.id !== previous.connection.id)
+          throw Error("Market returned a different connection record. The previous local connection was kept.");
+        const saveConnected = () => save(dataDir, {
+          version: 1,
+          marketOrigin: origin,
+          accountId: signedIn.developer.id,
+          connection: result.connection,
+        });
+        if (endpoints.changed) {
+          await endpoints.apply({write,saveConnection:saveConnected});
+        } else {
+          try { await saveConnected(); }
+          catch {
+            if (changingOrigin)
+              throw Error("The updated Market connection could not be saved. Retry the same command.");
+            write("Market connected this Wallet, but the local shortcut could not be saved. Use --market URL next time.");
+          }
         }
         completion = `\nWallet connected: ${label}\nView this Wallet’s Orders in Market → Account → My Orders.\nManage or disconnect it in Market Settings. This guide has finished.`;
         return 0;

package/src/order-cancellation.mjs

@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: MPL-2.0
 // This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
 // If a copy was not distributed with this file, see https://mozilla.org/MPL/2.0/.
+import { sameSettlementAddress } from "./settlement-address-history.mjs";
 import { isUnpaidExpiry } from "./order-closure.mjs";
 import { randomBytes, createHash } from "node:crypto";
 import { constants } from "node:fs";
@@ -109,7 +110,7 @@ async function readIntent(ctx) {
     !B32.test(intent.cancellationId || "") ||
     intent.orderId !== ctx.orderId ||
     intent.policyId !== ctx.policyId ||
-    intent.settlementUrl !== ctx.settlementUrl ||
+    !(await sameSettlementAddress(ctx.dataDir,intent.settlementUrl,ctx.settlementUrl,ctx.policyId)) ||
     !Number.isSafeInteger(intent.createdAtMs) ||
     intent.createdAtMs < 0
   )

package/src/platform-endpoints.mjs

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: MPL-2.0
+// Deliberate transport changes only. Never replace a Policy, request, or result.
+import {open,mkdir,lstat,rename,unlink,readFile} from 'node:fs/promises';
+import {constants} from 'node:fs';
+import {join,dirname} from 'node:path';
+import {homedir} from 'node:os';
+import {randomUUID} from 'node:crypto';
+import {execFile} from 'node:child_process';
+import {promisify} from 'node:util';
+import {installedUserDir} from './local-data-directory.mjs';
+import {deploymentFilePath,installationDirectory} from './installation-paths.mjs';
+import {readPrivateJson,deploymentChanges} from './deployment-status.mjs';
+import {validatePublicDeployment} from './prepare-onboarding.mjs';
+import {readServiceSettings,checkServiceDirectory,listenerPresent} from './local-services.mjs';
+import {isManagedUnit} from './autostart-files.mjs';
+import {fetchJsonWithTimeout} from './transport.mjs';
+import {settlementProfileBlocker} from './readiness-profile.mjs';
+import {readRuntimeStatus} from './runtime-status.mjs';
+import {readSettlementAddresses} from './settlement-address-history.mjs';
+
+const execute=promisify(execFile);
+const normalize=value=>new URL(value).href.replace(/\/+$/,'');
+const same=(a,b)=>JSON.stringify(a)===JSON.stringify(b);
+const pendingPath=dir=>join(dir,'runtime/endpoint-update.pending.json');
+const aliasesPath=dir=>join(dir,'runtime/settlement-addresses.json');
+
+async function durableJson(path,value){
+ const temp=path+'.'+randomUUID()+'.tmp';let file;
+ try{
+  file=await open(temp,'wx',0o600);await file.writeFile(JSON.stringify(value)+'\n');await file.sync();await file.close();file=null;
+  await rename(temp,path);
+  const directory=await open(dirname(path),constants.O_RDONLY|constants.O_DIRECTORY|constants.O_NOFOLLOW);
+  try{await directory.sync();}finally{await directory.close();}
+ }finally{await file?.close();await unlink(temp).catch(e=>{if(e.code!=='ENOENT')throw e;});}
+}
+
+
+async function runtimeControl(action,{dataDir,settings}){
+ if(process.platform!=='linux')throw Error('Automatic address updates currently require managed Linux services. Keep your saved settings.');
+ const unit='agentpay-local-runtime.service',path=join(homedir(),'.config/systemd/user',unit);
+ const stat=await lstat(path);
+ if(!stat.isFile()||stat.isSymbolicLink()||stat.uid!==process.getuid()||(stat.mode&0o022)||!isManagedUnit(await readFile(path,'utf8'),unit,dataDir))
+  throw Error('Runtime is not managed by this User installation. Run agentpay repair before updating addresses.');
+ const ctl=async args=>(await execute('systemctl',['--user',...args],{timeout:45000,maxBuffer:16384})).stdout.trim();
+ if(await ctl(['show',unit,'--property=FragmentPath','--value'])!==path||await ctl(['show',unit,'--property=DropInPaths','--value']))
+  throw Error('Runtime service settings need review before updating addresses.');
+ await ctl([action,unit]);
+ if(action==='stop'){
+  const url=new URL(settings.runtimeUrl);
+  if(await listenerPresent({host:url.hostname,port:Number(url.port)}))throw Error('Runtime is still running. No connection settings were changed.');
+ }else{
+  for(let i=0;i<30;i++){
+   try{await readRuntimeStatus(dataDir);return;}catch{await new Promise(r=>setTimeout(r,500));}
+  }
+  throw Error('Runtime did not become ready. Retry agentpay market connect with the same Market address.');
+ }
+}
+
+export async function preparePlatformEndpoints({dataDir,origin,scope,userDir=installedUserDir,fetchJson=fetchJsonWithTimeout,changingOrigin=false}){
+ await checkServiceDirectory(dataDir);
+ const pending=await readPrivateJson(pendingPath(dataDir));
+ // Ordinary reconnect/renewal keeps its existing behavior. Only a deliberately
+ // changed origin or an interrupted update owns transport changes.
+ if(!changingOrigin&&!pending)return {changed:false,apply:async()=>{}};
+ const setup=await readPrivateJson(await deploymentFilePath(dataDir,userDir,'anvil-onboarding.json'));
+ // A source-to-npm installation may have no copied onboarding draft. The
+ // bound Policy and live service settings remain the authoritative local state.
+ // Never synthesize a draft or replace its RPC/test configuration from Market.
+ const policy=await readPrivateJson(join(dataDir,'wallet/policy.json'));
+ if(!policy)throw Error('Saved spending permission is missing (wallet/policy.json). Check your data folder with agentpay wallet info and restore its backup before retrying. Do not create a replacement Policy to fix this.');
+ if(!policy||policy.policyId?.toLowerCase()!==scope.policyId?.toLowerCase()||policy.safe?.toLowerCase()!==scope.safe?.toLowerCase()||`eip155:${policy.chainId}`!==scope.network||policy.module?.toLowerCase()!==scope.module?.toLowerCase())
+  throw Error('Wallet authorization changed. Run agentpay market connect again.');
+ const connectionBefore=await readPrivateJson(join(dataDir,'market-connection.json'));
+ if(pending&&(pending.version!==1||pending.origin!==origin||pending.policyId!==policy.policyId))
+  throw Error('Finish the pending address update with the same Policy. Retry: agentpay market connect --market '+pending.origin);
+ const {response,result}=await fetchJson(origin+'/market/web/onboarding/user-config',{method:'GET'},15000);
+ if(!response.ok)throw Error('Market deployment settings are unavailable. Check the website address and your connection, then retry.');
+ const proposed=validatePublicDeployment(result);
+ let settings;
+ try{settings=await readServiceSettings(dataDir);}catch(e){
+  if(e.code==='ENOENT')throw Error('Runtime settings are missing (runtime/local-services.json). Run agentpay repair, then retry this command.');
+  throw Error('Runtime settings could not be read safely. Check the selected data folder with agentpay wallet info before retrying.');
+ }
+ const urls={settlementUrl:proposed.settlementUrl,marketBundleMetadataUrl:proposed.marketBundleMetadataUrl};
+ const changed=!!setup&&Object.keys(urls).some(key=>normalize(setup[key])!==normalize(urls[key]))||normalize(settings.settlementUrl)!==normalize(urls.settlementUrl)||!!pending;
+ // RPC is participant-owned: a different local tunnel must never be overwritten.
+ // A Market connection alone is not authority to rotate contracts or test packages.
+ const publicPath=await deploymentFilePath(dataDir,userDir,'user-deployment.json');
+ const previousPublic=await readPrivateJson(publicPath);
+ if(!changed&&!changingOrigin)return {changed:false,apply:async()=>{}};
+ if(deploymentChanges(policy,proposed).length||(setup&&(deploymentChanges(setup,proposed).length||setup.mode!==proposed.mode||setup.tokenDecimals!==proposed.tokenDecimals||setup.tokenSymbol!==proposed.tokenSymbol)))
+  throw Error('This Market uses different network or contract settings. Address update stopped; your current Policy and Orders are kept.');
+
+ // Query an unknown service to inspect deployment identity without depending on
+ // a particular Provider being online, or granting it an Order.
+ const query=new URL(normalize(urls.settlementUrl)+'/agentpay/purchase-readiness');
+ query.searchParams.set('skillId','0x'+'0'.repeat(64));query.searchParams.set('profileHash','0x'+'0'.repeat(64));
+ const readiness=await fetchJson(query.href,{method:'GET'},15000);
+ if(!readiness.response.ok||!readiness.result?.ok||settlementProfileBlocker(policy,readiness.result.result?.settlementProfile))
+  throw Error('The new Settlement address does not match this Wallet deployment. Current addresses are kept.');
+ const metadata=await fetchJson(urls.marketBundleMetadataUrl,{method:'GET'},15000);
+ if(!metadata.response.ok||!metadata.result?.ok||!/^[a-f0-9]{64}$/.test(metadata.result.result?.sha256||''))
+  throw Error('The new package address could not be checked. Current addresses are kept.');
+ if(!changed)return {changed:false,apply:async()=>{}};
+ return {changed:true,urls,async apply({write=console.log,manage=runtimeControl,stateDir=installationDirectory(),saveConnection=async()=>{}}={}){
+  await mkdir(stateDir,{recursive:true,mode:0o700});
+  const stat=await lstat(stateDir);
+  if(!stat.isDirectory()||stat.isSymbolicLink()||stat.uid!==process.getuid()||(stat.mode&0o077))throw Error('Unsafe installation state directory.');
+  const lockPath=join(stateDir,'install.lock');let lock;
+  try{lock=await open(lockPath,'wx',0o600);}catch(e){if(e.code==='EEXIST')throw Error('Another setup or update is running. Retry market connect when it finishes.');throw e;}
+  let updating=false;
+  try{
+   if(!same(await readPrivateJson(join(dataDir,'market-connection.json')),connectionBefore)||!same(await readPrivateJson(join(dataDir,'wallet/policy.json')),policy)||!same(await readServiceSettings(dataDir),settings)||!same(await readPrivateJson(publicPath),previousPublic)||!same(await readPrivateJson(await deploymentFilePath(dataDir,userDir,'anvil-onboarding.json')),setup))
+    throw Error('Local settings changed during connection. Retry market connect; no addresses were changed.');
+   const aliases=await readSettlementAddresses(dataDir);
+   const entry={from:normalize(settings.settlementUrl),to:normalize(urls.settlementUrl),policyId:policy.policyId};
+   if(entry.from!==entry.to&&!aliases.entries.some(e=>same(e,entry))){
+    if(aliases.entries.length>=256)throw Error('Settlement address history needs review.');
+    aliases.entries.push(entry);
+   }
+   write('Updating platform addresses. Runtime will pause briefly; Wallet stays unlocked.');
+   // A durable marker makes interruptions retryable even after settings are written.
+   // Write the alias before the new active address; never mutate cancellation IDs.
+   await durableJson(pendingPath(dataDir),{version:1,origin,policyId:policy.policyId});
+   updating=true;
+   await saveConnection();
+   await manage('stop',{dataDir,settings});
+   await durableJson(aliasesPath(dataDir),aliases);
+   if(previousPublic)await durableJson(join(dataDir,'user-deployment.json'),{...previousPublic,...urls});
+   if(setup)await durableJson(join(dataDir,'anvil-onboarding.json'),{...setup,...urls});
+   await durableJson(join(dataDir,'runtime/local-services.json'),{...settings,settlementUrl:normalize(urls.settlementUrl)});
+   await manage('start',{dataDir,settings:{...settings,settlementUrl:normalize(urls.settlementUrl)}});
+   await unlink(pendingPath(dataDir));
+   write('Platform addresses updated. Your Wallet, permission and Order records were kept.');
+  }catch(e){throw Error('Address update did not finish.\n'+e.message+'\n'+(updating?'Some connection settings may already be saved. Wallet keys, Policies and Orders were kept.':'No connection addresses were changed.')+'\nNext: agentpay market connect --market '+origin);}
+  finally{await lock.close();await unlink(lockPath);}
+ }};
+}

package/src/settlement-address-history.mjs

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: MPL-2.0
+// Local aliases acknowledge an explicitly confirmed address change, not extra
+// authority. Cancellation IDs and Policy scopes remain unchanged.
+import {join} from 'node:path';
+import {readPrivateFile} from './runtime-client.mjs';
+const normalize=value=>{
+ const u=new URL(value);
+ if(u.username||u.password||u.search||u.hash||!(u.protocol==='https:'||u.protocol==='http:'&&['localhost','127.0.0.1','[::1]'].includes(u.hostname)))throw Error('Invalid saved Settlement address.');
+ return u.href.replace(/\/+$/,'');
+};
+export async function readSettlementAddresses(dataDir){
+ let saved;
+ try{saved=JSON.parse(await readPrivateFile(join(dataDir,'runtime/settlement-addresses.json'),65536));}
+ catch(e){if(e.code==='ENOENT')return {version:1,entries:[]};throw e;}
+ if(saved?.version!==1||!Array.isArray(saved.entries)||saved.entries.length>256)throw Error('Invalid saved Settlement address history.');
+ for(const e of saved.entries){
+  if(!e||Object.keys(e).sort().join(',')!=='from,policyId,to'||!/^0x[a-fA-F0-9]{64}$/.test(e.policyId)||normalize(e.from)!==e.from||normalize(e.to)!==e.to)throw Error('Invalid saved Settlement address history.');
+ }
+ return saved;
+}
+export async function sameSettlementAddress(dataDir,from,to,policyId){
+ if(normalize(from)===normalize(to))return true;
+ const saved=await readSettlementAddresses(dataDir),seen=new Set([normalize(from)]);
+ for(let i=0;i<saved.entries.length;i++)for(const entry of saved.entries){
+  if(entry.policyId.toLowerCase()===policyId.toLowerCase()&&seen.has(entry.from))seen.add(entry.to);
+ }
+ return seen.has(normalize(to));
+}

package/src/status-panel.mjs

@@ -118,6 +118,16 @@ export async function readMarketStatus(dataDir) {
       await h?.close();
     }
   }
+  const endpointUpdate = await saved("runtime/endpoint-update.pending.json");
+  if (endpointUpdate) {
+    let origin;
+    try {
+      const url = new URL(endpointUpdate.origin);
+      if (url.origin === endpointUpdate.origin &&
+          (url.protocol === "https:" || url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))) origin = url.origin;
+    } catch {}
+    return {state:"address_pending", ...(origin ? {origin} : {})};
+  }
   const receipt = await saved("market-connection.json");
   if (!receipt) return { state: "none" };
   const policy = await saved("wallet/policy.json"),
@@ -409,7 +419,7 @@ export function renderStatusPanel(
     next =
       "Keep services running. Check progress in the original Agent conversation. If continuing a supported request, keep its original identifier; never create a replacement purchase.";
   }
-  const marketPending = ["pending", "unknown"].includes(model.market?.state);
+  const marketPending = ["pending", "unknown", "address_pending"].includes(model.market?.state);
   if (marketPending && level === "ok") {
     title =
       model.market.state === "pending"
@@ -420,6 +430,12 @@ export function renderStatusPanel(
       "Website access to this Policy is not confirmed. Local payments are unaffected.";
     next = "agentpay market connect";
   }
+  if (model.market?.state === "address_pending") {
+    title = "Platform address update incomplete";
+    level = "wait";
+    detail = "Retry your Market connection to finish updating addresses. Original Order records are kept.";
+    next = "agentpay market connect" + (model.market.origin ? " --market " + model.market.origin : "");
+  }
   const divider = "-".repeat(Math.min(60, width));
   const lines = [
     "",
@@ -524,7 +540,9 @@ export function renderStatusPanel(
       lines.push("", "> Market");
       const state = model.market.state;
       lines.push(
-        state === "saved"
+        state === "address_pending"
+          ? `  ${badge("wait")} Platform address update incomplete`
+          : state === "saved"
           ? `  ${badge("ok")} Current Policy connection saved locally`
           : state === "none"
             ? "  Not connected from this installation"

package/update-pair.json

@@ -1,6 +1,6 @@
 {
   "format": "agentpay.local-update-pair.v1",
-  "userVersion": "0.3.3",
+  "userVersion": "0.3.5",
   "walletVersion": "0.3.2",
   "typesDependency": "0.14.3"
 }