@haven_ai/sdk 0.0.0-dev.202609241737.2d2b91b → 0.0.0-dev.202609241957.179f300

package/README.md

@@ -257,7 +257,7 @@ const data = await response.json()
 
 Merchant-verified x402 retries use the official EIP-3009 `exact` scheme on Base USDC (`base` / `eip155:8453`). `haven.fetch()` sends the payment under `PAYMENT-SIGNATURE` (the x402 v2 name), and on the EIP-3009 bridge also under `X-PAYMENT` (v1), so a merchant on either version reads it. **On erc7710 it sends the v2 name ALONE**: that payload is always x402 v2, and its header carries a whole delegation chain, so duplicating it overflows the merchant's header limit and the request is refused with HTTP 431. If you build the retry yourself, follow the same rule. Haven's older tx-hash proof helper remains exported for Haven-native integrations; it is a different payload that happens to have shared the v2 name, and it is not what `haven.fetch()` sends.
 
-For standard x402, the `x402-wallet` identity is the agent delegate wallet, because that is the wallet that signs and settles the merchant payment. Integrations that scope access by Haven wallet/Safe address should use a Haven-native flow instead of standard merchant x402.
+For standard x402, the `x402-wallet` identity is the agent delegate wallet, because that is the wallet that signs and settles the merchant payment. Integrations that scope access by Haven wallet address should use a Haven-native flow instead of standard merchant x402.
 
 ## AI Agent Integration
 

package/dist/{base64-fVc9Cnn-.d.cts → base64-CuxQKlr6.d.cts}

@@ -34,7 +34,7 @@ interface HavenClientConfig {
      * JSON-RPC RPC URLs keyed by EIP-155 chain ID.
      *
      * When provided for a chain, the SDK waits for ≥1 on-chain confirmation of
-     * the AllowanceModule funding tx before retrying the merchant. This prevents
+     * the funding tx (account → delegate EOA) before retrying the merchant. This prevents
      * the race where the merchant's `balanceOf(delegate)` call runs before the
      * funding block has propagated to the merchant's RPC node.
      *
@@ -259,10 +259,10 @@ interface X402AuthorizationOptions {
  * Keyless x402 construct result.
  *
  * Returned by `createX402Intent` — the non-custodial half of an x402 payment.
- * It carries the unsigned funding hash (`signData.hash`, Safe → delegate EOA)
+ * It carries the unsigned funding payload (`signData`, account → delegate EOA)
  * plus everything the *edge* needs to build and sign the EIP-3009 merchant
  * header itself. The construct path never signs; both delegate signatures
- * (funding hash + merchant header) happen on the machine that holds the key.
+ * (funding payload + merchant header) happen on the machine that holds the key.
  */
 interface X402Intent {
     /** Haven payment id for the funding transfer. */
@@ -272,7 +272,7 @@ interface X402Intent {
     status: 'pending_signature';
     /** ISO 8601 expiry of the funding intent, if returned. */
     expiresAt?: string;
-    /** The unsigned funding hash to sign with the delegate key (Safe → delegate EOA). */
+    /** The unsigned funding payload to sign with the delegate key (account → delegate EOA). */
     signData: SignData;
     /** The selected x402 option — the edge needs this to build the EIP-3009 header. */
     accepted: X402PaymentOption;
@@ -323,6 +323,11 @@ interface X402ExpectedContext {
      * which is NOT what the account validates — binding it alone would leave the
      * edge signer unable to verify the payload it is being asked to sign. Binding
      * this digest makes Haven's declaration cover the real payload.
+     *
+     * Absent ⇒ the retired version-1 bare-hash context. Since #3272 the backend
+     * never emits one (`signX402ExpectedContext` requires this field) and
+     * `@haven_ai/signer` refuses it with its version-mismatch refusal; the field
+     * stays optional here only because the type also describes older payloads.
      */
     typedDataHash?: string;
     /**
@@ -338,8 +343,9 @@ interface X402ExpectedContext {
 }
 interface X402ExpectedAuth {
     /**
-     * 1 = hash-only (legacy rail). 2 = carries `typedDataHash` (delegation rail,
-     * #1138).
+     * 2 = carries `typedDataHash` (delegation rail, #1138). 3 = additionally binds
+     * the payer identity (#1690). 1 (hash-only, retired Safe rail) is never
+     * emitted since #3272 and the signer refuses it.
      *
      * Deliberately `number`, not a literal union (#1143). This is an **inbound**
      * value: a signer parses a context Haven produced, and a signer older than the
@@ -619,12 +625,12 @@ interface HavenBalanceCoverage {
 /**
  * Affirmative spend-readiness for the authenticated agent, derived from the raw
  * agent status plus the remaining spend authority the backend reports per rail
- * (the on-chain AllowanceModule on the legacy rail; the active budget
- * delegation on the delegation rail — #1135):
+ * (the active budget delegation on the delegation rail — #1135; the retired
+ * AllowanceModule rail used an on-chain allowance instead):
  * - `ready`         — active and at least one token has remaining spend authority.
  * - `needs_approval`— active but no remaining spend authority to auto-spend.
- *                     The over-budget outcome differs by rail: on the legacy
- *                     AllowanceModule rail the payment is queued for the wallet
+ *                     The over-budget outcome differs by rail: on the retired
+ *                     AllowanceModule rail the payment was queued for the wallet
  *                     owner to approve in Haven; on the delegation rail there is
  *                     NO approval queue — an over-budget redemption reverts
  *                     on-chain, so the owner must grant or raise the budget in
@@ -836,7 +842,7 @@ declare const DEFAULT_CONFIRMATION_TIMEOUT_MS = 90000;
  * done, or as failed, are the same defect in opposite directions.
  */
 type SweepConfirmation = 
-/** A receipt was observed. The funds are in the Safe. */
+/** A receipt was observed. The funds are in the agent's Haven account. */
 'confirmed'
 /**
  * Broadcast, but no receipt within `DEFAULT_CONFIRMATION_TIMEOUT_MS` (or the
@@ -877,7 +883,7 @@ interface SweepEntry {
 interface SweepResult {
     /** Address funds were swept FROM */
     fromAddress: string;
-    /** Address funds were swept TO (always the originating Safe) */
+    /** Address funds were swept TO (always the agent's Haven account) */
     toAddress: string;
     /** Chain the sweep occurred on */
     chainId: number;
@@ -985,9 +991,9 @@ declare const AgentPaymentNextAction: {
      */
     readonly FundAccountOrRaiseAllowance: "fund_account_or_raise_allowance";
     /**
-     * The delegate wallet may hold funds that were sent from the Safe but never
-     * settled to the merchant. The wallet owner should initiate a sweep to
-     * return those funds to the originating Safe.
+     * The delegate wallet may hold funds that were sent from the agent's Haven
+     * account but never settled to the merchant. The wallet owner should initiate
+     * a sweep to return those funds to that account.
      */
     readonly SweepStrandedFunds: "sweep_stranded_funds";
     /**
@@ -1083,7 +1089,7 @@ type AgentPaymentFailureCode = (typeof AgentPaymentFailureCode)[keyof typeof Age
  * historical `mpp_demo` rows, which remain readable.
  */
 declare const AgentPaymentRail: {
-    /** Standard Haven payment from the user's Safe through an approved delegate allowance. */
+    /** Standard Haven payment from the user's account, redeemed through the agent's budget delegation. */
     readonly Direct: "direct";
     /** x402 HTTP 402 payment flow with a Haven funding leg and merchant retry leg. */
     readonly X402: "x402";
@@ -1645,7 +1651,7 @@ interface SweepEip712Domain {
 interface SweepAuthorization {
     /** Delegate EOA the funds are swept FROM. */
     from: string;
-    /** Originating Safe the funds are swept TO. */
+    /** The agent's Haven account the funds are swept TO. */
     to: string;
     /** Atomic USDC amount (decimal string). */
     value: string;
@@ -2214,7 +2220,7 @@ declare function x402FacilitatorAddresses(option: X402PaymentOption): string[] |
  * positional match and never look at `extra.assetTransferMethod`, so a merchant
  * that listed its erc7710 entry first made a Haven client echo that option
  * while signing a standard EIP-3009 authorization. The merchant rejects the
- * mismatch cleanly — but on the legacy two-leg the Safe→delegate funding
+ * mismatch cleanly — but on the two-leg bridge the account→delegate funding
  * transfer has already executed, so the visible result is a stranded delegate
  * balance for the sweep to reclaim. Only our own demo merchant's ordering was
  * holding that shut, and that pin binds our merchant, not the ones we do not

package/dist/{base64-fVc9Cnn-.d.ts → base64-CuxQKlr6.d.ts}

@@ -34,7 +34,7 @@ interface HavenClientConfig {
      * JSON-RPC RPC URLs keyed by EIP-155 chain ID.
      *
      * When provided for a chain, the SDK waits for ≥1 on-chain confirmation of
-     * the AllowanceModule funding tx before retrying the merchant. This prevents
+     * the funding tx (account → delegate EOA) before retrying the merchant. This prevents
      * the race where the merchant's `balanceOf(delegate)` call runs before the
      * funding block has propagated to the merchant's RPC node.
      *
@@ -259,10 +259,10 @@ interface X402AuthorizationOptions {
  * Keyless x402 construct result.
  *
  * Returned by `createX402Intent` — the non-custodial half of an x402 payment.
- * It carries the unsigned funding hash (`signData.hash`, Safe → delegate EOA)
+ * It carries the unsigned funding payload (`signData`, account → delegate EOA)
  * plus everything the *edge* needs to build and sign the EIP-3009 merchant
  * header itself. The construct path never signs; both delegate signatures
- * (funding hash + merchant header) happen on the machine that holds the key.
+ * (funding payload + merchant header) happen on the machine that holds the key.
  */
 interface X402Intent {
     /** Haven payment id for the funding transfer. */
@@ -272,7 +272,7 @@ interface X402Intent {
     status: 'pending_signature';
     /** ISO 8601 expiry of the funding intent, if returned. */
     expiresAt?: string;
-    /** The unsigned funding hash to sign with the delegate key (Safe → delegate EOA). */
+    /** The unsigned funding payload to sign with the delegate key (account → delegate EOA). */
     signData: SignData;
     /** The selected x402 option — the edge needs this to build the EIP-3009 header. */
     accepted: X402PaymentOption;
@@ -323,6 +323,11 @@ interface X402ExpectedContext {
      * which is NOT what the account validates — binding it alone would leave the
      * edge signer unable to verify the payload it is being asked to sign. Binding
      * this digest makes Haven's declaration cover the real payload.
+     *
+     * Absent ⇒ the retired version-1 bare-hash context. Since #3272 the backend
+     * never emits one (`signX402ExpectedContext` requires this field) and
+     * `@haven_ai/signer` refuses it with its version-mismatch refusal; the field
+     * stays optional here only because the type also describes older payloads.
      */
     typedDataHash?: string;
     /**
@@ -338,8 +343,9 @@ interface X402ExpectedContext {
 }
 interface X402ExpectedAuth {
     /**
-     * 1 = hash-only (legacy rail). 2 = carries `typedDataHash` (delegation rail,
-     * #1138).
+     * 2 = carries `typedDataHash` (delegation rail, #1138). 3 = additionally binds
+     * the payer identity (#1690). 1 (hash-only, retired Safe rail) is never
+     * emitted since #3272 and the signer refuses it.
      *
      * Deliberately `number`, not a literal union (#1143). This is an **inbound**
      * value: a signer parses a context Haven produced, and a signer older than the
@@ -619,12 +625,12 @@ interface HavenBalanceCoverage {
 /**
  * Affirmative spend-readiness for the authenticated agent, derived from the raw
  * agent status plus the remaining spend authority the backend reports per rail
- * (the on-chain AllowanceModule on the legacy rail; the active budget
- * delegation on the delegation rail — #1135):
+ * (the active budget delegation on the delegation rail — #1135; the retired
+ * AllowanceModule rail used an on-chain allowance instead):
  * - `ready`         — active and at least one token has remaining spend authority.
  * - `needs_approval`— active but no remaining spend authority to auto-spend.
- *                     The over-budget outcome differs by rail: on the legacy
- *                     AllowanceModule rail the payment is queued for the wallet
+ *                     The over-budget outcome differs by rail: on the retired
+ *                     AllowanceModule rail the payment was queued for the wallet
  *                     owner to approve in Haven; on the delegation rail there is
  *                     NO approval queue — an over-budget redemption reverts
  *                     on-chain, so the owner must grant or raise the budget in
@@ -836,7 +842,7 @@ declare const DEFAULT_CONFIRMATION_TIMEOUT_MS = 90000;
  * done, or as failed, are the same defect in opposite directions.
  */
 type SweepConfirmation = 
-/** A receipt was observed. The funds are in the Safe. */
+/** A receipt was observed. The funds are in the agent's Haven account. */
 'confirmed'
 /**
  * Broadcast, but no receipt within `DEFAULT_CONFIRMATION_TIMEOUT_MS` (or the
@@ -877,7 +883,7 @@ interface SweepEntry {
 interface SweepResult {
     /** Address funds were swept FROM */
     fromAddress: string;
-    /** Address funds were swept TO (always the originating Safe) */
+    /** Address funds were swept TO (always the agent's Haven account) */
     toAddress: string;
     /** Chain the sweep occurred on */
     chainId: number;
@@ -985,9 +991,9 @@ declare const AgentPaymentNextAction: {
      */
     readonly FundAccountOrRaiseAllowance: "fund_account_or_raise_allowance";
     /**
-     * The delegate wallet may hold funds that were sent from the Safe but never
-     * settled to the merchant. The wallet owner should initiate a sweep to
-     * return those funds to the originating Safe.
+     * The delegate wallet may hold funds that were sent from the agent's Haven
+     * account but never settled to the merchant. The wallet owner should initiate
+     * a sweep to return those funds to that account.
      */
     readonly SweepStrandedFunds: "sweep_stranded_funds";
     /**
@@ -1083,7 +1089,7 @@ type AgentPaymentFailureCode = (typeof AgentPaymentFailureCode)[keyof typeof Age
  * historical `mpp_demo` rows, which remain readable.
  */
 declare const AgentPaymentRail: {
-    /** Standard Haven payment from the user's Safe through an approved delegate allowance. */
+    /** Standard Haven payment from the user's account, redeemed through the agent's budget delegation. */
     readonly Direct: "direct";
     /** x402 HTTP 402 payment flow with a Haven funding leg and merchant retry leg. */
     readonly X402: "x402";
@@ -1645,7 +1651,7 @@ interface SweepEip712Domain {
 interface SweepAuthorization {
     /** Delegate EOA the funds are swept FROM. */
     from: string;
-    /** Originating Safe the funds are swept TO. */
+    /** The agent's Haven account the funds are swept TO. */
     to: string;
     /** Atomic USDC amount (decimal string). */
     value: string;
@@ -2214,7 +2220,7 @@ declare function x402FacilitatorAddresses(option: X402PaymentOption): string[] |
  * positional match and never look at `extra.assetTransferMethod`, so a merchant
  * that listed its erc7710 entry first made a Haven client echo that option
  * while signing a standard EIP-3009 authorization. The merchant rejects the
- * mismatch cleanly — but on the legacy two-leg the Safe→delegate funding
+ * mismatch cleanly — but on the two-leg bridge the account→delegate funding
  * transfer has already executed, so the visible result is a stranded delegate
  * balance for the sweep to reclaim. Only our own demo merchant's ordering was
  * holding that shut, and that pin binds our merchant, not the ones we do not

package/dist/{chunk-CSWZXQ2L.cjs → chunk-64ACOOIE.cjs}

@@ -115,9 +115,9 @@ var AgentPaymentNextAction = {
    */
   FundAccountOrRaiseAllowance: "fund_account_or_raise_allowance",
   /**
-   * The delegate wallet may hold funds that were sent from the Safe but never
-   * settled to the merchant. The wallet owner should initiate a sweep to
-   * return those funds to the originating Safe.
+   * The delegate wallet may hold funds that were sent from the agent's Haven
+   * account but never settled to the merchant. The wallet owner should initiate
+   * a sweep to return those funds to that account.
    */
   SweepStrandedFunds: "sweep_stranded_funds",
   /**
@@ -191,7 +191,7 @@ var AgentPaymentFailureCode = {
   MerchantNotReady: "MERCHANT_NOT_READY"
 };
 var AgentPaymentRail = {
-  /** Standard Haven payment from the user's Safe through an approved delegate allowance. */
+  /** Standard Haven payment from the user's account, redeemed through the agent's budget delegation. */
   Direct: "direct",
   /** x402 HTTP 402 payment flow with a Haven funding leg and merchant retry leg. */
   X402: "x402",
@@ -1394,5 +1394,5 @@ exports.x402FacilitatorAddresses = x402FacilitatorAddresses;
 exports.x402PaymentHeaderNamesFor = x402PaymentHeaderNamesFor;
 exports.x402PaymentHeaderNamesSent = x402PaymentHeaderNamesSent;
 exports.x402V2PaymentEnvelope = x402V2PaymentEnvelope;
-//# sourceMappingURL=chunk-CSWZXQ2L.cjs.map
-//# sourceMappingURL=chunk-CSWZXQ2L.cjs.map
+//# sourceMappingURL=chunk-64ACOOIE.cjs.map
+//# sourceMappingURL=chunk-64ACOOIE.cjs.map