@haven_ai/mcp 0.8.1-alpha.0 → 0.10.0-alpha.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { composeDescription, toolDescriptions as toolDescriptions$1, HavenClient, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, resolveTokenBySymbol, formatTokenAmount, HavenApiError, HavenPaymentStateError, HavenSigningError, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, verifyPaymentReceipt, discoverMerchantMcpUrl, sameUrl, resolveTokenFromAddress, TASK_SIGN_CONTEXT_VERSION, connectorUpgradeCommand } from '@haven_ai/sdk';
+import { composeDescription, toolDescriptions as toolDescriptions$1, HavenClient, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, resolveTokenBySymbol, formatTokenAmount, HavenApiError, HavenPaymentStateError, HavenSigningError, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, verifyPaymentReceipt, catalogFundingLegExpected, discoverMerchantMcpUrl, sameUrl, resolveTokenFromAddress, TASK_SIGN_CONTEXT_VERSION, connectorUpgradeCommand } from '@haven_ai/sdk';
 import { readFile, mkdir, writeFile, stat } from 'fs/promises';
 import { z } from 'zod/v3';
 import { createHash } from 'crypto';
@@ -336,7 +336,21 @@ var toolSchemas = {
     compact: z.boolean().optional().describe("true drops challengePayload, selectedPayment and protocolReceiptPayload from each row; omit for the full row.")
   },
   haven_verify_receipt: {
-    receipt: z.unknown()
+    receipt: z.unknown(),
+    // #3723: the spread form — the endpoint's `{ receipt, verification }`
+    // spread as top-level arguments — verifies: `verification` is declared
+    // ACCEPTED-AND-IGNORED (Haven's own self-check, never read). The stdio
+    // z.object would strip it silently anyway; declaring it keeps the schema
+    // identical to the hosted runtime's, where the key must be declared to
+    // pass its strict refusal.
+    verification: z.unknown().optional().describe("accepted and ignored \u2014 verification reads the receipt itself")
+  },
+  // #3723: the signed bundle's read — `{ receipt }` only, settled payments
+  // only. The endpoint's server-side `verification` is deliberately NOT
+  // returned: it is computed on Haven's server, not offline, and an agent
+  // that trusted it would skip haven_verify_receipt.
+  haven_get_receipt: {
+    payment_id: z.string().min(1)
   },
   // #3329: a budget for one task that ends by itself — a short-lived child of
   // the agent's own budget, capped and time-boxed independently of the period
@@ -421,6 +435,8 @@ var toolDescriptions = {
   haven_submit_catalog_entry: composeDescription(toolDescriptions$1.submitCatalogEntry),
   haven_list_receipts: composeDescription(toolDescriptions$1.listReceipts),
   haven_verify_receipt: composeDescription(toolDescriptions$1.verifyReceipt),
+  // #3723: the signed bundle's read, described from the shared fragment.
+  haven_get_receipt: composeDescription(toolDescriptions$1.getReceipt),
   haven_open_task_budget: OPEN_TASK_BUDGET_DESCRIPTION,
   haven_close_task_budget: CLOSE_TASK_BUDGET_DESCRIPTION,
   haven_get_task_budget: GET_TASK_BUDGET_DESCRIPTION,
@@ -709,6 +725,10 @@ function createToolHandlers(haven) {
           price_atomic: entry.priceAtomic,
           asset: entry.asset,
           network: entry.network,
+          // #3839: same hint the hosted surface emits — a catalog hint, the
+          // live quote stays authoritative; "unknown" when nothing is recorded.
+          asset_transfer_methods: entry.assetTransferMethods ?? null,
+          funding_leg_expected: catalogFundingLegExpected(entry.assetTransferMethods),
           status: entry.status,
           verified_at: entry.verifiedAt,
           source: entry.source,
@@ -767,6 +787,17 @@ function createToolHandlers(haven) {
       const args = objectInput("haven_verify_receipt", input);
       return runTool(async () => verifyPaymentReceipt(args.receipt));
     },
+    // #3723: the signed bundle's home on the local surface. Parsed INSIDE
+    // runTool, so a missing payment_id is a structured INVALID_INPUT failure
+    // rather than a thrown ZodError (the hosted runtime's parseStrict already
+    // answers that way). Returns `{ receipt }` only — the endpoint's
+    // server-side `verification` is not offline evidence, and the agent
+    // verifies with haven_verify_receipt, which reads the bundle unchanged.
+    haven_get_receipt: async (input) => runTool(async () => {
+      const args = objectInput("haven_get_receipt", input);
+      const { receipt } = await haven.getReceipt(args.payment_id);
+      return { receipt };
+    }),
     haven_open_task_budget: async (input) => {
       const args = objectInput("haven_open_task_budget", input);
       return runTool(async () => {
@@ -963,17 +994,26 @@ function parseMaybeJson(text) {
     return text;
   }
 }
+var MERCHANT_OUT_OF_GAS_REASON = "settlement_wallet_out_of_gas";
+function merchantOutOfGasMessage(settlementsRemaining, failFloor) {
+  const remaining = typeof settlementsRemaining === "number" ? settlementsRemaining : null;
+  const floor = typeof failFloor === "number" ? failFloor : null;
+  const figures = remaining !== null && floor !== null ? ` It has gas for ${remaining} more settlement${remaining === 1 ? "" : "s"} and refuses new payments below ${floor} (settlements_remaining: ${remaining}, fail_floor: ${floor}).` : remaining !== null ? ` settlements_remaining: ${remaining}.` : "";
+  return `The merchant refused this call: its settlement wallet is out of gas (reason_code: ${MERCHANT_OUT_OF_GAS_REASON}).` + figures + " No payment was created. The merchant's operator must top up its settlement wallet; until then every retry is refused again. Tell the user, and re-quote once the merchant has been topped up.";
+}
 var MerchantNotReadyError = class extends Error {
+  constructor(message, nextToolOmittedReason = "the merchant needs to recover first; re-quote after the retry_after_s in the message") {
+    super(message);
+    this.nextToolOmittedReason = nextToolOmittedReason;
+    this.name = "MerchantNotReadyError";
+  }
+  nextToolOmittedReason;
   code = AgentPaymentFailureCode.MerchantNotReady;
   statusCode = 503;
   nextAction = AgentPaymentNextAction.StopAndTellUser;
   // Genuinely retryable — unlike a rejection, nothing about THIS call was
   // wrong; the merchant's own wallet needs to recover first.
   retryWithNewQuote = true;
-  constructor(message) {
-    super(message);
-    this.name = "MerchantNotReadyError";
-  }
 };
 async function merchantNotReadyErrorFor(response) {
   if (response.status !== 503) return null;
@@ -986,7 +1026,14 @@ async function merchantNotReadyErrorFor(response) {
   if (!body || typeof body !== "object" || body.error !== "merchant_not_ready") {
     return null;
   }
-  const { reason_code, settlements_remaining, retry_after_s } = body;
+  const { reason_code, settlements_remaining, fail_floor, retry_after_s } = body;
+  if (reason_code === MERCHANT_OUT_OF_GAS_REASON) {
+    return new MerchantNotReadyError(
+      merchantOutOfGasMessage(settlements_remaining, fail_floor),
+      // Same reason the hosted runtime returns (support/mcp-context.ts).
+      "the merchant's operator must top up its settlement wallet first; re-quote after that"
+    );
+  }
   return new MerchantNotReadyError(
     "The merchant refused this call: it cannot settle a payment right now" + (typeof reason_code === "string" ? ` (reason_code: ${reason_code})` : "") + (typeof settlements_remaining === "number" ? `, settlements_remaining: ${settlements_remaining}` : "") + ". No payment was created." + (typeof retry_after_s === "number" ? ` Retry after approximately ${retry_after_s}s.` : " This is often transient; retry later.")
   );
@@ -1007,8 +1054,10 @@ function normalizeError(err) {
       next_action: err.nextAction,
       retry_with_new_quote: err.retryWithNewQuote,
       // #3103: the local runtime's one decision site — no tool can act until
-      // the merchant recovers; the message carries retry_after_s.
-      next_tool_omitted_reason: "the merchant needs to recover first; re-quote after the retry_after_s in the message"
+      // the merchant recovers. The reason rides the error (#3834): the
+      // generic one points at the message's retry_after_s, the out-of-gas
+      // one at the operator top-up.
+      next_tool_omitted_reason: err.nextToolOmittedReason
     };
   }
   if (err instanceof HavenPaymentStateError) {
@@ -1050,6 +1099,14 @@ function normalizeError(err) {
       body: err.body
     };
   }
+  if (err instanceof z.ZodError) {
+    return {
+      success: false,
+      code: "INVALID_INPUT",
+      message: err.errors.map((e) => `${e.path.join(".") || "(root)"}: ${e.message}`).join("; "),
+      statusCode: 400
+    };
+  }
   if (err instanceof HavenError) {
     return {
       success: false,
@@ -1278,7 +1335,7 @@ async function resolveHavenClient(options = {}) {
   return { client, credentials };
 }
 var MCP_NAME = "@haven_ai/mcp";
-var MCP_VERSION = "0.8.1-alpha.0";
+var MCP_VERSION = "0.10.0-alpha.0";
 var MCP_INSTRUCTIONS = [
   "Haven local MCP server: signs in-process with the delegate key it holds on",
   "this machine \u2014 the key never leaves this process. Call haven_get_agent",