@haven_ai/sdk 0.0.0-dev.202609191954.6adcc6b → 0.0.0-dev.202609192153.41dae78

package/README.md

@@ -579,6 +579,18 @@ original `tools/call`, setting BOTH `PAYMENT-SIGNATURE` (x402 v2) and `X-PAYMENT
 user intent so fresh merchant quotes or sessions do not become duplicate Haven
 payments.
 
+If the merchant's session is gone by the time the paid retry arrives (it
+expired, or the merchant restarted), a merchant that answers HTTP 404 with
+JSON-RPC `-32001` **and** `error.data = { settled: false, next_action:
+'reinitialize_then_retry_same_payment_header' }` is stating its own guarantee
+that nothing was settled; since #3171 `fetch()`, `payX402Quote()`,
+`resumeX402Payment()` and `completeX402MerchantCall()` act on exactly that
+shape — re-initialize once and resend the SAME payment header on the new
+session. A bare `-32001` without the data, any other 404, a failed
+re-initialize, or a second 404 is returned to you unchanged and, after
+funding, recorded as a rejection as before: the SDK never resends on an
+inference, only on the merchant's stated guarantee.
+
 See [`examples/mcp-x402-sse.ts`](./examples/mcp-x402-sse.ts) for a complete
 MCP flow with initialize, `mcp-session-id`, JSON-RPC `tools/call`, quote
 inspection, saved resume state, and final retry.

package/dist/index.cjs

@@ -1494,6 +1494,7 @@ var MCP_CLIENT_INFO = { name: "haven-sdk", version: "1" };
 var MCP_X402_PAYMENT_META_KEY = "x402/payment";
 var MCP_X402_PAYMENT_RESPONSE_META_KEY = "x402/payment-response";
 var X402_RETRY_REJECTED_STATUS = 402;
+var SESSION_NOT_FOUND_NEXT_ACTION = "reinitialize_then_retry_same_payment_header";
 var McpMerchantTransport = class {
   merchantTimeout;
   fetchImpl;
@@ -1654,6 +1655,29 @@ var McpMerchantTransport = class {
     }
     return this.fetch(url, withMcpPaymentMeta({ ...init, headers }, paymentHeader));
   }
+  /**
+   * #3171: deliver the payment; if the merchant answers its unknown-session
+   * 404 WITH the settled-nothing recovery data, re-initialize once and resend
+   * the SAME header on the new session. The merchant's own guarantee (#1578:
+   * the session guard runs before its payment gate) is what makes the resend
+   * safe — a bare -32001, or any other 404, is returned to the caller
+   * untouched (body re-wrapped, since reading it consumed the stream). One
+   * recovery only: a second 404 is the answer.
+   */
+  async deliverPaymentRecoveringSession(url, init, paymentHeader, reinitialize) {
+    const first = await this.deliverPayment(url, init, paymentHeader);
+    if (first.status !== 404) return first;
+    let text;
+    try {
+      text = await first.clone().text();
+    } catch {
+      return first;
+    }
+    if (!sessionNotFoundRecovery(text)) return first;
+    const sessionId = await reinitialize();
+    if (!sessionId) return first;
+    return this.deliverPayment(url, this.withSessionHeaders(init, sessionId), paymentHeader);
+  }
   /**
    * #3118: read a native MCP payment-required tool result from a response
    * WITHOUT consuming it — JSON or SSE framed. `undefined` for anything that
@@ -1780,6 +1804,24 @@ function parseJsonRpcToolsCall(body) {
 function isJsonRpcToolsCallBody(body) {
   return parseJsonRpcToolsCall(body) !== void 0;
 }
+function sessionNotFoundRecovery(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed.error)) return void 0;
+  if (parsed.error.code !== -32001) return void 0;
+  const data = parsed.error.data;
+  if (!isRecord(data)) return void 0;
+  if (data.settled !== false || data.next_action !== SESSION_NOT_FOUND_NEXT_ACTION) return void 0;
+  return {
+    reason: typeof data.reason === "string" ? data.reason : "session_expired",
+    settled: false,
+    next_action: SESSION_NOT_FOUND_NEXT_ACTION
+  };
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -2931,10 +2973,11 @@ var MerchantCompletion = class {
     if (!receipt.paymentHeader) {
       throw new HavenApiError("No x402 payment header was returned for payment retry", 500);
     }
-    const retryResponse = await this.merchantTransport.deliverPayment(
+    const retryResponse = await this.merchantTransport.deliverPaymentRecoveringSession(
       url,
       initialInit,
-      receipt.paymentHeader
+      receipt.paymentHeader,
+      () => this.merchantTransport.initialize(url, initialInit)
     );
     const toolResult = retryResponse.ok ? await this.merchantTransport.readToolResult(retryResponse) : void 0;
     const inBandChallenge = toolResult ? extractMcpPaymentRequired(toolResult) : void 0;
@@ -4265,7 +4308,12 @@ var HavenClient = class {
     }
     let requestInit = withX402Wallet(input.init, x402Wallet) ?? {};
     if (mcpSessionId) requestInit = this.merchantTransport.withSessionHeaders(requestInit, mcpSessionId);
-    const response = await this.merchantTransport.deliverPayment(input.url, requestInit, input.paymentHeader);
+    const response = await this.merchantTransport.deliverPaymentRecoveringSession(
+      input.url,
+      requestInit,
+      input.paymentHeader,
+      () => this.merchantTransport.initialize(input.url, input.init, x402Wallet)
+    );
     const surfaced = await this.merchantTransport.surfaceResult(response);
     const text = await surfaced.text();
     let body;