@haven_ai/sdk 0.0.0-dev.202609241802.ea320de → 0.0.0-dev.202609242134.f497e3b

package/README.md

@@ -21,11 +21,16 @@ and managing the account from the shell with `@haven_ai/cli`.
 npm install @haven_ai/sdk@alpha
 ```
 
-The package has two entries. `@haven_ai/sdk` is the full client. `@haven_ai/sdk/edge`
+The package has three entries. `@haven_ai/sdk` is the full client. `@haven_ai/sdk/edge`
 (#3173) is the ethers-free subset the local signer imports — error classes, the
-typed-next-step builder, the x402 message builders, viem-based key helpers — and
-loads in about a third of the time; use it when you need those helpers without
-the HTTP client. A class imported from either entry is the same class.
+typed-next-step builder, the x402 message builders, viem-based key helpers, and
+(#3283) the signing-surface guard: `assertBoundDirectPaymentUserOp`, the
+redemption guard, `deriveDelegateAccountAddress` and `verifySettlementChild` —
+and loads in about a third of the time; use it when you need those helpers
+without the HTTP client. A class imported from either entry is the same class.
+`@haven_ai/sdk/test-support` (#3283) holds test fixture builders shared by
+Haven's own packages; it is not a signing API, nothing at runtime imports it,
+and it carries no semver guarantee.
 
 ## Quick Start
 
@@ -116,9 +121,13 @@ const intent = await haven.createIntent({
 // the account validates the EIP-712 typed data in intent.signData.typed_data,
 // never the bare hash — a signature over signData.hash is rejected on-chain
 // (AA24). Sign that typed data with your delegate key (viem signTypedData),
-// after checking it with assertUserOpTypedDataBinding(typed_data, hash).
-// There is no public HavenClient method for this step yet; pay() does it
-// for you.
+// after checking it with assertUserOpTypedDataBinding(typed_data, hash) AND
+// assertBoundDirectPaymentUserOp(typed_data, yourDelegateAddress) — the
+// first proves the typed data matches the hash, the second that it is your
+// own account redeeming your budget delegation, not a self-call (#3283).
+// There is no public HavenClient method for this step yet; pay() does both
+// for you. HavenClient.sign(hash) and signUserOpTypedDataForDelegation are
+// verbatim primitives: they check nothing.
 const signature = await signTypedDataWithYourDelegateKey(intent.signData.typed_data)
 
 // Step 3: Submit the signature

package/dist/{base64-CPxbmyU9.d.cts → base64-9_tWgxq-.d.cts}

@@ -1,5 +1,5 @@
 import { PaymentRequirements } from 'x402/types';
-import { Hex } from 'viem';
+import { Hex, Address } from 'viem';
 
 interface HavenClientConfig {
     /** Haven API key (sk_agent_xxx) */
@@ -323,6 +323,11 @@ interface X402ExpectedContext {
      * which is NOT what the account validates — binding it alone would leave the
      * edge signer unable to verify the payload it is being asked to sign. Binding
      * this digest makes Haven's declaration cover the real payload.
+     *
+     * Absent ⇒ the retired version-1 bare-hash context. Since #3272 the backend
+     * never emits one (`signX402ExpectedContext` requires this field) and
+     * `@haven_ai/signer` refuses it with its version-mismatch refusal; the field
+     * stays optional here only because the type also describes older payloads.
      */
     typedDataHash?: string;
     /**
@@ -338,8 +343,9 @@ interface X402ExpectedContext {
 }
 interface X402ExpectedAuth {
     /**
-     * 1 = hash-only (legacy rail). 2 = carries `typedDataHash` (delegation rail,
-     * #1138).
+     * 2 = carries `typedDataHash` (delegation rail, #1138). 3 = additionally binds
+     * the payer identity (#1690). 1 (hash-only, retired Safe rail) is never
+     * emitted since #3272 and the signer refuses it.
      *
      * Deliberately `number`, not a literal union (#1143). This is an **inbound**
      * value: a signer parses a context Haven produced, and a signer older than the
@@ -2329,8 +2335,10 @@ declare function resolveTokenFromAddress(address: string, network?: string): {
  * typed data the hash does NOT cover (domain name/version/verifyingContract,
  * the field list, the EntryPoint). It is a CORRUPTION check: the caller supplies
  * both values, so it proves they describe the same operation, never that Haven
- * prepared it. Provenance is the byte-free sign context (`payment_id`); what the
- * signer will sign at all is #3272.
+ * prepared it. Provenance is the byte-free sign context (`payment_id`); what a
+ * delegate key will sign at all is `assertBoundDirectPaymentUserOp`
+ * (`direct-payment-guard.ts`, #3272 / #3283), which every caller of this check
+ * — `HavenClient.signForData` and the signer's `haven_sign` — runs next.
  *
  * Pure viem, no ethers: `@haven_ai/sdk/edge` re-exports it for the edge signer,
  * and `edge-imports.test.ts` pins that graph.
@@ -2372,6 +2380,233 @@ declare function packedUserOperationHash(typedData: unknown): Hex;
  */
 declare function assertUserOpTypedDataBinding(typedData: unknown, payloadHash: string): Hex;
 
+/**
+ * The counterfactual HybridDeleGator account address for an owner EOA (#3272).
+ *
+ * `haven_sign`'s unbound branch (`@haven_ai/signer`'s `tools.ts`) and, since
+ * #3283, `HavenClient.signForData` (`direct-payment-guard.ts`) sign a
+ * `PackedUserOperation`
+ * only when its `sender` (== `domain.verifyingContract`) is THIS SIGNER'S OWN
+ * delegate account — never any other HybridDeleGator, and never a third
+ * party's. Haven provisions that account counterfactually at signup (#970):
+ * it may have zero on-chain transactions, so the signer must be able to
+ * compute its address OFFLINE, from nothing but the delegate key's own
+ * address.
+ *
+ * This is exactly what `@metamask/smart-accounts-kit`'s
+ * `getCounterfactualAccountData` computes for
+ * `implementation: 'Hybrid'`, `deployParams: [owner, [], [], []]` (no passkey
+ * co-owners — the only shape Haven's signup flow provisions), `deploySalt:
+ * '0x'`: CREATE2 of an `ERC1967Proxy(HybridDeleGatorImpl, initialize(owner,
+ * [], [], []))` behind the `SimpleFactory`.
+ *
+ * VENDORED, NOT IMPORTED. `@metamask/smart-accounts-kit` is a devDependency
+ * only (see `package.json`) — this package installs on users' machines and
+ * must not carry it at runtime. The constants below (the factory and
+ * implementation addresses, the `ERC1967Proxy` bytecode) are copied from the
+ * kit's pinned environment / `@metamask/delegation-abis`' bytecode export,
+ * exactly like `settlement-child.ts` vendors the DelegationManager and caveat
+ * enforcer addresses for the same reason. Cross-checked against the kit by
+ * `packages/signer/src/delegate-account.pins.test.ts`, including against the real, on-chain
+ * `direct-payment-userop.json` fixture.
+ */
+
+/**
+ * SimpleFactory — deterministically deployed, so Base and Base Sepolia share
+ * the address (matches `packages/backend/src/rails/delegation-contracts.ts`'s
+ * `simpleFactory` pin for both chains).
+ */
+declare const SIMPLE_FACTORY_ADDRESS: Address;
+/**
+ * HybridDeleGator implementation — matches `delegation-contracts.ts`'s
+ * `hybridDeleGatorImpl` pin for both chains.
+ */
+declare const HYBRID_DELEGATOR_IMPLEMENTATION: Address;
+/**
+ * Derive the counterfactual HybridDeleGator account address for `owner`, with
+ * no passkey co-owners — the only shape Haven's signup flow provisions
+ * (#970). Pure and offline: no RPC call, no dependency on the account having
+ * been deployed. Verified byte-for-byte against
+ * `@metamask/smart-accounts-kit`'s `getCounterfactualAccountData` by
+ * `packages/signer/src/delegate-account.pins.test.ts`, including against a real Base Sepolia payload served by the dev backend
+ * (`direct-payment-userop.json`).
+ */
+declare function deriveDelegateAccountAddress(owner: Address): Address;
+
+/**
+ * Independent verification of an erc7710 x402 settlement child (#1455).
+ *
+ * Moved from `@haven_ai/signer` into the SDK by #3283 (epic #3284) so the
+ * signer and `HavenClient.signForData` run ONE verifier. The signer checks the
+ * child against the Haven-signed expected context; the SDK checks it against
+ * the merchant's own 402, which Haven does not produce.
+ *
+ * WHY THIS EXISTS. `assertExpectedBinding` proves Haven *declared* a payload:
+ * the expected context is signed by `HAVEN_X402_BINDING_SIGNER` and commits to
+ * the digest of the exact bytes being signed. That is a real property, and it
+ * is not this one. It says nothing about what the payload MEANS.
+ *
+ * A backend that declared `merchantTo = the real merchant` while pinning a
+ * different payee in the child's `AllowedCalldata` caveat would produce a
+ * perfectly consistent pair: the declaration binds the digest, the digest is
+ * the child's, and the child pays someone else. The signature is the authority
+ * here — the merchant's facilitator redeems it and pulls from the treasury — so
+ * the signer has to re-derive the meaning locally or it is a pass-through with
+ * extra steps.
+ *
+ * ADDRESSES ARE PINNED HERE ON PURPOSE. Reading the enforcer map from Haven
+ * would make the check circular: an attacker who can pick which contract counts
+ * as "the payee enforcer" can satisfy any comparison. Taking
+ * `@metamask/smart-accounts-kit` as a runtime dependency was the other option
+ * and was rejected — this package installs on users' machines. The constants
+ * below are snapshot-pinned and cross-checked against the kit by a test
+ * (`packages/signer/src/settlement-child.pins.test.ts`), the same pattern
+ * `packages/core/src/chains.ts` uses against its registry.
+ *
+ * EXTRA CAVEATS ARE ALLOWED, and that is deliberate — verified, not assumed
+ * (#1455 review challenged it directly).
+ *
+ * `DelegationManager.redeemDelegations` loops every caveat of every delegation
+ * and calls `beforeHook` on each, with no break and no try/catch: a single
+ * revert aborts the whole redemption, and nothing lets one caveat cause another
+ * to be skipped. Top-level caveats are therefore strictly AND-ed, so one this
+ * file does not recognise can only add a constraint, never remove one.
+ *
+ * The specific challenge was `LogicalOrWrapperEnforcer`, whose terms encode
+ * several caveat GROUPS and whose own security notice warns that "the redeemer
+ * can select the least restrictive group, bypassing stricter requirements in
+ * other groups". That warning is about groups INSIDE the wrapper — it binds
+ * whoever authors wrapper terms. The wrapper is itself one caveat among the
+ * delegation's, so it is AND-ed with the four required below and cannot unlock
+ * them.
+ *
+ * The shape that WOULD be dangerous is the inverse: a required caveat hidden
+ * inside a wrapper group instead of sitting at top level, where the redeemer
+ * could select a group that omits it. This file scans top-level caveats and
+ * refuses on absence, so that child is refused for lacking the caveat — which
+ * is the correct outcome and is pinned by a test.
+ */
+/** DelegationManager, the EIP-712 `verifyingContract` for a delegation. */
+declare const DELEGATION_MANAGER = "0xdb9B1e94B5b69Df7e401DDbedE43491141047dB3";
+/**
+ * Caveat enforcers, by role. Deterministically deployed, so Base and Base
+ * Sepolia share addresses — verified for both chains by the pin test.
+ */
+declare const CAVEAT_ENFORCERS: {
+    readonly erc20TransferAmount: "0xf100b0819427117EcF76Ed94B358B1A5b5C6D2Fc";
+    readonly allowedCalldata: "0xc2b0d624c1c4319760C96503BA27C347F3260f55";
+    readonly timestamp: "0x1046bb45C8d673d4ea75321280DB34899413c069";
+    readonly redeemer: "0xE144b0b2618071B4E56f746313528a669c7E65c5";
+};
+/** The backend's own ceiling (`MAX_SETTLEMENT_WINDOW_SECONDS`), enforced again here. */
+declare const MAX_SETTLEMENT_WINDOW_SECONDS = 600;
+interface SettlementChildTypedData {
+    domain: {
+        name?: string;
+        version?: string;
+        chainId?: number | string;
+        verifyingContract?: string;
+    };
+    types: Record<string, unknown>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+/** True when this typed data is a delegation — the shape that must never be signed unbound. */
+declare function isSettlementChildTypedData(value: unknown): value is SettlementChildTypedData;
+/**
+ * Map an x402 network string to a chain id. Local on purpose (#1455 review):
+ * the chain must come from Haven's SIGNED `network` field, never from the
+ * payload under verification — see `verifySettlementChild`.
+ */
+declare function chainIdForNetwork(network: string | undefined): number | undefined;
+interface SettlementChildExpectation {
+    merchantTo: string;
+    amount: string;
+    asset: string;
+    /**
+     * Derived from the expected context's SIGNED `network`, never from
+     * `typedData.domain.chainId`. Comparing the payload's own claim against
+     * itself is a check that cannot fail — which is exactly what shipped in the
+     * first draft of this file's call site, and what the review caught.
+     */
+    chainId: number;
+    /** ISO timestamp; the child must not outlive it. */
+    expiresAt?: string;
+    /**
+     * #3283 / #3281 criterion 8: the signer's OWN derived delegate account.
+     * When set, the child's `delegator` must be exactly this account — the
+     * child is a re-delegation of this agent's budget, never a grant from some
+     * other account the key happens to control.
+     */
+    delegatorAccount?: string;
+    /**
+     * #3283: the facilitator addresses the merchant's 402 advertised
+     * (`extra.facilitatorAddresses`). When non-empty, the child must carry a
+     * `RedeemerEnforcer` caveat pinning exactly this set — otherwise the child
+     * is a bearer instrument any party could redeem within its bounds.
+     */
+    redeemers?: readonly string[];
+}
+/** `@metamask/delegation-core`'s `ROOT_AUTHORITY` — a delegation chained to nothing. */
+declare const ROOT_AUTHORITY: string;
+/**
+ * Verify a settlement child implements what the expected context declares.
+ * Throws `HavenSigningError` on any disagreement; returns nothing on success.
+ *
+ * `now` is injectable so the expiry checks are testable without faking clocks.
+ */
+declare function verifySettlementChild(typedData: SettlementChildTypedData, expected: SettlementChildExpectation, now?: number): void;
+
+/** Wire code for a typed-data payload outside the signable allowlist. */
+declare const TYPED_DATA_NOT_ALLOWED: "TYPED_DATA_NOT_ALLOWED";
+/**
+ * A typed-data payload was refused before signing because it is not a shape
+ * a delegate key may sign. Nothing was signed. `@haven_ai/signer` subclasses
+ * this to attach its MCP next step; the `code` is the same on both.
+ */
+declare class HavenTypedDataRefusedError extends HavenSigningError {
+    readonly code: typeof TYPED_DATA_NOT_ALLOWED;
+    constructor(message: string);
+}
+/**
+ * Chains the delegation rail has PINNED delegation contracts for
+ * (`packages/backend/src/rails/delegation-contracts.ts`) — the only chains a
+ * direct-payment UserOp may be scoped to. Gnosis (100) has no pinned
+ * DelegationManager/enforcer set, so it is deliberately excluded even though
+ * the delegate account itself could exist there.
+ */
+declare const DIRECT_PAYMENT_CHAIN_IDS: ReadonlySet<number>;
+/** The DeleGator's single-execution `execute((address,uint256,bytes))` — selector `0x5c1c6dcd`. */
+declare const EXECUTE_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "execute";
+    readonly inputs: readonly [{
+        readonly name: "_execution";
+        readonly type: "tuple";
+        readonly components: readonly [{
+            readonly name: "target";
+            readonly type: "address";
+        }, {
+            readonly name: "value";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }];
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+}];
+/**
+ * The content + provenance allowlist (#3272 criteria 1–2). Call ONLY after
+ * `assertUserOpTypedDataBinding` has already proven `typedData` is a
+ * well-formed `PackedUserOperation` matching its own hash — this function
+ * trusts `typedData.domain`/`message` are shaped correctly and checks only
+ * what they SAY. Throws `HavenTypedDataRefusedError` (never returns) on any
+ * disagreement.
+ */
+declare function assertBoundDirectPaymentUserOp(typedData: Record<string, unknown>, delegateAddress: string): void;
+
 /**
  * Runtime-agnostic base64 helpers — the single source of truth for the wire
  * encoding shared by the SDK and the edge signer (#325).
@@ -2410,4 +2645,4 @@ declare function encodeBase64Json(value: unknown): string;
  */
 declare function decodeBase64Json<T>(value: string, label?: string): T;
 
-export { type AgentPaymentSummary as $, type AgentPaymentWarning as A, type X402McpTransport as B, type X402MerchantCallContext as C, HavenError as D, AGENT_PAYMENT_FAILURE_CODE_VALUES as E, AGENT_PAYMENT_NEXT_ACTION_VALUES as F, AGENT_PAYMENT_PHASE_VALUES as G, type HavenClientConfig as H, AGENT_PAYMENT_RAIL_VALUES as I, type AgentNextStep as J, type AgentPaymentEnumSchema as K, AgentPaymentFailureCode as L, AgentPaymentFailureCodeDescriptions as M, AgentPaymentFailureCodeSchema as N, AgentPaymentNextAction as O, type PaymentRequest as P, AgentPaymentNextActionDescriptions as Q, type RawPaymentParties as R, type SweepResult as S, AgentPaymentNextActionSchema as T, AgentPaymentPhase as U, AgentPaymentPhaseDescriptions as V, AgentPaymentPhaseSchema as W, type X402PaymentRequired as X, AgentPaymentRail as Y, AgentPaymentRailDescriptions as Z, AgentPaymentRailSchema as _, type PaymentResult as a, type X402SchemeSelection as a$, AgentPaymentWarningCode as a0, type AgentPurchaseSummary as a1, CONNECTOR_PACKAGE_NAME as a2, type CatalogSubmissionAccepted as a3, DEFAULT_CONFIRMATION_TIMEOUT_MS as a4, DEFAULT_NEXT_TOOL_BY_ACTION as a5, DIRECT_SIGN_CONTEXT_VERSION as a6, ENTRY_POINT_V07 as a7, ERC7710_ASSET_TRANSFER_METHOD as a8, HAVEN_CONNECTOR_CHANNEL as a9, PACKED_USER_OPERATION_FIELDS as aA, type PaymentFee as aB, type PaymentNextAction as aC, type PaymentPhase as aD, type PaymentStatus as aE, SIGNER_UPDATE_FALLBACK as aF, SWEEP_BASE_CHAIN_ID as aG, SWEEP_BASE_SEPOLIA_CHAIN_ID as aH, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as aI, SWEEP_BASE_USDC_ADDRESS as aJ, SignerRefusalCode as aK, type SweepConfirmation as aL, type SweepEip712Domain as aM, type SweepEntry as aN, type SweepExpectedAuth as aO, type SweepPreparation as aP, type SweepSubmitResult as aQ, type SweepTypedData as aR, TRANSFER_WITH_AUTHORIZATION_TYPES as aS, type UnsupportedNodeVersionMessageOptions as aT, X402AlreadySettledError as aU, type X402ExpectedAuth as aV, type X402ExpectedContext as aW, type X402PaymentHeaderContext as aX, X402PaymentHeaderValidationError as aY, type X402PaymentOption as aZ, type X402RequestSnapshot as a_, HAVEN_MINIMUM_NODE_VERSION as aa, HYBRID_DELEGATOR_DOMAIN_NAME as ab, HYBRID_DELEGATOR_DOMAIN_VERSION as ac, type HavenAgentAllowanceSummary as ad, type HavenAgentReadiness as ae, type HavenAllowance as af, HavenApiError as ag, type HavenCatalogMerchant as ah, type HavenListScope as ai, HavenPaymentStateError as aj, HavenSigningError as ak, HavenTimeoutError as al, HavenUnsupportedSignerVersionError as am, HavenUserOpBindingError as an, HavenZeroSettlementHashError as ao, type MachinePaymentRail as ap, MerchantTimeoutError as aq, NEXT_TOOL_SERVER_NAMES as ar, NEXT_TOOL_SERVER_ROLES as as, type NextStep as at, type NextStepArguments as au, type NextStepHandoff as av, type NextStepInput as aw, type NextStepTarget as ax, type NextStepTargets as ay, type NextToolServerRole as az, type PaymentIntent as b, X402UnexpectedStatusError as b0, X402_LEGACY_PAYMENT_HEADER_NAME as b1, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as b2, X402_PAYMENT_HEADER_NAME as b3, X402_PAYMENT_HEADER_NAMES_SENT as b4, X402_PAYMENT_REQUIRED_HEADER_NAME as b5, X402_PAYMENT_RESPONSE_HEADER_NAME as b6, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as b7, assertUserOpTypedDataBinding as b8, buildSweepAuthorizationMessage as b9, selectPaymentOption as bA, selectStandardPaymentOption as bB, selectX402SettlementScheme as bC, signerUpdateFallback as bD, sweepUsdcAddress as bE, sweepUsdcDomain as bF, toStandardPaymentRequirements as bG, unsupportedNodeVersionMessage as bH, validateStandardX402PaymentHeader as bI, x402AssetTransferMethod as bJ, x402AuthorizationAmount as bK, x402FacilitatorAddresses as bL, x402V2PaymentEnvelope as bM, buildSweepTypedData as ba, buildX402ExpectedMessage as bb, compareNodeVersions as bc, connectorRerunCommand as bd, connectorSpec as be, createNextStepBuilder as bf, decodeBase64Json as bg, decodeBase64Utf8 as bh, defaultNextToolFor as bi, encodeBase64Json as bj, encodeBase64Utf8 as bk, encodePaymentProof as bl, isConnectorChannel as bm, isErc7710Option as bn, isPackedUserOperationTypedData as bo, isSupportedNodeVersion as bp, isSweepableChain as bq, normalizePaymentRequired as br, packedUserOperationHash as bs, parseNextTool as bt, parsePaymentRequired as bu, parsePaymentRequiredResponse as bv, renderNextTool as bw, resolveConnectorChannel as bx, resolveTokenFromAddress as by, selectErc7710PaymentOption as bz, type X402AuthorizationOptions as c, type X402Intent as d, type PaymentStatusResult as e, type HavenAgent as f, type HavenAgentSummary as g, type SweepPrepareResponse as h, type SweepAuthorization as i, type SweepSubmitResponse as j, type HavenAllowanceSummary as k, type HavenBalanceCoverage as l, type PostPurchaseAllowanceSummary as m, type HavenCatalogEntry as n, type HavenCatalogSubmission as o, type HavenPaymentReceipt as p, type HavenPaymentReceiptsPage as q, type PaymentResumeState as r, type X402Receipt as s, type X402Quote as t, type X402Erc7710Settlement as u, type X402McpCallContext as v, type SignData as w, type ResumeAuthorizedX402Input as x, type ResumeX402PaymentInput as y, type X402ResumeState as z };
+export { type AgentPaymentSummary as $, type AgentPaymentWarning as A, type X402McpTransport as B, type X402MerchantCallContext as C, HavenError as D, AGENT_PAYMENT_FAILURE_CODE_VALUES as E, AGENT_PAYMENT_NEXT_ACTION_VALUES as F, AGENT_PAYMENT_PHASE_VALUES as G, type HavenClientConfig as H, AGENT_PAYMENT_RAIL_VALUES as I, type AgentNextStep as J, type AgentPaymentEnumSchema as K, AgentPaymentFailureCode as L, AgentPaymentFailureCodeDescriptions as M, AgentPaymentFailureCodeSchema as N, AgentPaymentNextAction as O, type PaymentRequest as P, AgentPaymentNextActionDescriptions as Q, type RawPaymentParties as R, type SweepResult as S, AgentPaymentNextActionSchema as T, AgentPaymentPhase as U, AgentPaymentPhaseDescriptions as V, AgentPaymentPhaseSchema as W, type X402PaymentRequired as X, AgentPaymentRail as Y, AgentPaymentRailDescriptions as Z, AgentPaymentRailSchema as _, type PaymentResult as a, type X402PaymentHeaderContext as a$, AgentPaymentWarningCode as a0, type AgentPurchaseSummary as a1, CONNECTOR_PACKAGE_NAME as a2, type CatalogSubmissionAccepted as a3, DEFAULT_CONFIRMATION_TIMEOUT_MS as a4, DEFAULT_NEXT_TOOL_BY_ACTION as a5, DIRECT_SIGN_CONTEXT_VERSION as a6, ENTRY_POINT_V07 as a7, ERC7710_ASSET_TRANSFER_METHOD as a8, HAVEN_CONNECTOR_CHANNEL as a9, type NextToolServerRole as aA, PACKED_USER_OPERATION_FIELDS as aB, type PaymentFee as aC, type PaymentNextAction as aD, type PaymentPhase as aE, type PaymentStatus as aF, ROOT_AUTHORITY as aG, SIGNER_UPDATE_FALLBACK as aH, SWEEP_BASE_CHAIN_ID as aI, SWEEP_BASE_SEPOLIA_CHAIN_ID as aJ, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as aK, SWEEP_BASE_USDC_ADDRESS as aL, type SettlementChildExpectation as aM, SignerRefusalCode as aN, type SweepConfirmation as aO, type SweepEip712Domain as aP, type SweepEntry as aQ, type SweepExpectedAuth as aR, type SweepPreparation as aS, type SweepSubmitResult as aT, type SweepTypedData as aU, TRANSFER_WITH_AUTHORIZATION_TYPES as aV, TYPED_DATA_NOT_ALLOWED as aW, type UnsupportedNodeVersionMessageOptions as aX, X402AlreadySettledError as aY, type X402ExpectedAuth as aZ, type X402ExpectedContext as a_, HAVEN_MINIMUM_NODE_VERSION as aa, HYBRID_DELEGATOR_DOMAIN_NAME as ab, HYBRID_DELEGATOR_DOMAIN_VERSION as ac, type HavenAgentAllowanceSummary as ad, type HavenAgentReadiness as ae, type HavenAllowance as af, HavenApiError as ag, type HavenCatalogMerchant as ah, type HavenListScope as ai, HavenPaymentStateError as aj, HavenSigningError as ak, HavenTimeoutError as al, HavenTypedDataRefusedError as am, HavenUnsupportedSignerVersionError as an, HavenUserOpBindingError as ao, HavenZeroSettlementHashError as ap, type MachinePaymentRail as aq, MerchantTimeoutError as ar, NEXT_TOOL_SERVER_NAMES as as, NEXT_TOOL_SERVER_ROLES as at, type NextStep as au, type NextStepArguments as av, type NextStepHandoff as aw, type NextStepInput as ax, type NextStepTarget as ay, type NextStepTargets as az, type PaymentIntent as b, type SettlementChildTypedData as b$, X402PaymentHeaderValidationError as b0, type X402PaymentOption as b1, type X402RequestSnapshot as b2, type X402SchemeSelection as b3, X402UnexpectedStatusError as b4, X402_LEGACY_PAYMENT_HEADER_NAME as b5, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as b6, X402_PAYMENT_HEADER_NAME as b7, X402_PAYMENT_HEADER_NAMES_SENT as b8, X402_PAYMENT_REQUIRED_HEADER_NAME as b9, parsePaymentRequired as bA, parsePaymentRequiredResponse as bB, renderNextTool as bC, resolveConnectorChannel as bD, resolveTokenFromAddress as bE, selectErc7710PaymentOption as bF, selectPaymentOption as bG, selectStandardPaymentOption as bH, selectX402SettlementScheme as bI, signerUpdateFallback as bJ, sweepUsdcAddress as bK, sweepUsdcDomain as bL, toStandardPaymentRequirements as bM, unsupportedNodeVersionMessage as bN, validateStandardX402PaymentHeader as bO, verifySettlementChild as bP, x402AssetTransferMethod as bQ, x402AuthorizationAmount as bR, x402FacilitatorAddresses as bS, x402V2PaymentEnvelope as bT, CAVEAT_ENFORCERS as bU, DELEGATION_MANAGER as bV, DIRECT_PAYMENT_CHAIN_IDS as bW, EXECUTE_ABI as bX, HYBRID_DELEGATOR_IMPLEMENTATION as bY, MAX_SETTLEMENT_WINDOW_SECONDS as bZ, SIMPLE_FACTORY_ADDRESS as b_, X402_PAYMENT_RESPONSE_HEADER_NAME as ba, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as bb, assertBoundDirectPaymentUserOp as bc, assertUserOpTypedDataBinding as bd, buildSweepAuthorizationMessage as be, buildSweepTypedData as bf, buildX402ExpectedMessage as bg, compareNodeVersions as bh, connectorRerunCommand as bi, connectorSpec as bj, createNextStepBuilder as bk, decodeBase64Json as bl, decodeBase64Utf8 as bm, defaultNextToolFor as bn, deriveDelegateAccountAddress as bo, encodeBase64Json as bp, encodeBase64Utf8 as bq, encodePaymentProof as br, isConnectorChannel as bs, isErc7710Option as bt, isPackedUserOperationTypedData as bu, isSupportedNodeVersion as bv, isSweepableChain as bw, normalizePaymentRequired as bx, packedUserOperationHash as by, parseNextTool as bz, type X402AuthorizationOptions as c, chainIdForNetwork as c0, isSettlementChildTypedData as c1, type X402Intent as d, type PaymentStatusResult as e, type HavenAgent as f, type HavenAgentSummary as g, type SweepPrepareResponse as h, type SweepAuthorization as i, type SweepSubmitResponse as j, type HavenAllowanceSummary as k, type HavenBalanceCoverage as l, type PostPurchaseAllowanceSummary as m, type HavenCatalogEntry as n, type HavenCatalogSubmission as o, type HavenPaymentReceipt as p, type HavenPaymentReceiptsPage as q, type PaymentResumeState as r, type X402Receipt as s, type X402Quote as t, type X402Erc7710Settlement as u, type X402McpCallContext as v, type SignData as w, type ResumeAuthorizedX402Input as x, type ResumeX402PaymentInput as y, type X402ResumeState as z };

package/dist/{base64-CPxbmyU9.d.ts → base64-9_tWgxq-.d.ts}

@@ -1,5 +1,5 @@
 import { PaymentRequirements } from 'x402/types';
-import { Hex } from 'viem';
+import { Hex, Address } from 'viem';
 
 interface HavenClientConfig {
     /** Haven API key (sk_agent_xxx) */
@@ -323,6 +323,11 @@ interface X402ExpectedContext {
      * which is NOT what the account validates — binding it alone would leave the
      * edge signer unable to verify the payload it is being asked to sign. Binding
      * this digest makes Haven's declaration cover the real payload.
+     *
+     * Absent ⇒ the retired version-1 bare-hash context. Since #3272 the backend
+     * never emits one (`signX402ExpectedContext` requires this field) and
+     * `@haven_ai/signer` refuses it with its version-mismatch refusal; the field
+     * stays optional here only because the type also describes older payloads.
      */
     typedDataHash?: string;
     /**
@@ -338,8 +343,9 @@ interface X402ExpectedContext {
 }
 interface X402ExpectedAuth {
     /**
-     * 1 = hash-only (legacy rail). 2 = carries `typedDataHash` (delegation rail,
-     * #1138).
+     * 2 = carries `typedDataHash` (delegation rail, #1138). 3 = additionally binds
+     * the payer identity (#1690). 1 (hash-only, retired Safe rail) is never
+     * emitted since #3272 and the signer refuses it.
      *
      * Deliberately `number`, not a literal union (#1143). This is an **inbound**
      * value: a signer parses a context Haven produced, and a signer older than the
@@ -2329,8 +2335,10 @@ declare function resolveTokenFromAddress(address: string, network?: string): {
  * typed data the hash does NOT cover (domain name/version/verifyingContract,
  * the field list, the EntryPoint). It is a CORRUPTION check: the caller supplies
  * both values, so it proves they describe the same operation, never that Haven
- * prepared it. Provenance is the byte-free sign context (`payment_id`); what the
- * signer will sign at all is #3272.
+ * prepared it. Provenance is the byte-free sign context (`payment_id`); what a
+ * delegate key will sign at all is `assertBoundDirectPaymentUserOp`
+ * (`direct-payment-guard.ts`, #3272 / #3283), which every caller of this check
+ * — `HavenClient.signForData` and the signer's `haven_sign` — runs next.
  *
  * Pure viem, no ethers: `@haven_ai/sdk/edge` re-exports it for the edge signer,
  * and `edge-imports.test.ts` pins that graph.
@@ -2372,6 +2380,233 @@ declare function packedUserOperationHash(typedData: unknown): Hex;
  */
 declare function assertUserOpTypedDataBinding(typedData: unknown, payloadHash: string): Hex;
 
+/**
+ * The counterfactual HybridDeleGator account address for an owner EOA (#3272).
+ *
+ * `haven_sign`'s unbound branch (`@haven_ai/signer`'s `tools.ts`) and, since
+ * #3283, `HavenClient.signForData` (`direct-payment-guard.ts`) sign a
+ * `PackedUserOperation`
+ * only when its `sender` (== `domain.verifyingContract`) is THIS SIGNER'S OWN
+ * delegate account — never any other HybridDeleGator, and never a third
+ * party's. Haven provisions that account counterfactually at signup (#970):
+ * it may have zero on-chain transactions, so the signer must be able to
+ * compute its address OFFLINE, from nothing but the delegate key's own
+ * address.
+ *
+ * This is exactly what `@metamask/smart-accounts-kit`'s
+ * `getCounterfactualAccountData` computes for
+ * `implementation: 'Hybrid'`, `deployParams: [owner, [], [], []]` (no passkey
+ * co-owners — the only shape Haven's signup flow provisions), `deploySalt:
+ * '0x'`: CREATE2 of an `ERC1967Proxy(HybridDeleGatorImpl, initialize(owner,
+ * [], [], []))` behind the `SimpleFactory`.
+ *
+ * VENDORED, NOT IMPORTED. `@metamask/smart-accounts-kit` is a devDependency
+ * only (see `package.json`) — this package installs on users' machines and
+ * must not carry it at runtime. The constants below (the factory and
+ * implementation addresses, the `ERC1967Proxy` bytecode) are copied from the
+ * kit's pinned environment / `@metamask/delegation-abis`' bytecode export,
+ * exactly like `settlement-child.ts` vendors the DelegationManager and caveat
+ * enforcer addresses for the same reason. Cross-checked against the kit by
+ * `packages/signer/src/delegate-account.pins.test.ts`, including against the real, on-chain
+ * `direct-payment-userop.json` fixture.
+ */
+
+/**
+ * SimpleFactory — deterministically deployed, so Base and Base Sepolia share
+ * the address (matches `packages/backend/src/rails/delegation-contracts.ts`'s
+ * `simpleFactory` pin for both chains).
+ */
+declare const SIMPLE_FACTORY_ADDRESS: Address;
+/**
+ * HybridDeleGator implementation — matches `delegation-contracts.ts`'s
+ * `hybridDeleGatorImpl` pin for both chains.
+ */
+declare const HYBRID_DELEGATOR_IMPLEMENTATION: Address;
+/**
+ * Derive the counterfactual HybridDeleGator account address for `owner`, with
+ * no passkey co-owners — the only shape Haven's signup flow provisions
+ * (#970). Pure and offline: no RPC call, no dependency on the account having
+ * been deployed. Verified byte-for-byte against
+ * `@metamask/smart-accounts-kit`'s `getCounterfactualAccountData` by
+ * `packages/signer/src/delegate-account.pins.test.ts`, including against a real Base Sepolia payload served by the dev backend
+ * (`direct-payment-userop.json`).
+ */
+declare function deriveDelegateAccountAddress(owner: Address): Address;
+
+/**
+ * Independent verification of an erc7710 x402 settlement child (#1455).
+ *
+ * Moved from `@haven_ai/signer` into the SDK by #3283 (epic #3284) so the
+ * signer and `HavenClient.signForData` run ONE verifier. The signer checks the
+ * child against the Haven-signed expected context; the SDK checks it against
+ * the merchant's own 402, which Haven does not produce.
+ *
+ * WHY THIS EXISTS. `assertExpectedBinding` proves Haven *declared* a payload:
+ * the expected context is signed by `HAVEN_X402_BINDING_SIGNER` and commits to
+ * the digest of the exact bytes being signed. That is a real property, and it
+ * is not this one. It says nothing about what the payload MEANS.
+ *
+ * A backend that declared `merchantTo = the real merchant` while pinning a
+ * different payee in the child's `AllowedCalldata` caveat would produce a
+ * perfectly consistent pair: the declaration binds the digest, the digest is
+ * the child's, and the child pays someone else. The signature is the authority
+ * here — the merchant's facilitator redeems it and pulls from the treasury — so
+ * the signer has to re-derive the meaning locally or it is a pass-through with
+ * extra steps.
+ *
+ * ADDRESSES ARE PINNED HERE ON PURPOSE. Reading the enforcer map from Haven
+ * would make the check circular: an attacker who can pick which contract counts
+ * as "the payee enforcer" can satisfy any comparison. Taking
+ * `@metamask/smart-accounts-kit` as a runtime dependency was the other option
+ * and was rejected — this package installs on users' machines. The constants
+ * below are snapshot-pinned and cross-checked against the kit by a test
+ * (`packages/signer/src/settlement-child.pins.test.ts`), the same pattern
+ * `packages/core/src/chains.ts` uses against its registry.
+ *
+ * EXTRA CAVEATS ARE ALLOWED, and that is deliberate — verified, not assumed
+ * (#1455 review challenged it directly).
+ *
+ * `DelegationManager.redeemDelegations` loops every caveat of every delegation
+ * and calls `beforeHook` on each, with no break and no try/catch: a single
+ * revert aborts the whole redemption, and nothing lets one caveat cause another
+ * to be skipped. Top-level caveats are therefore strictly AND-ed, so one this
+ * file does not recognise can only add a constraint, never remove one.
+ *
+ * The specific challenge was `LogicalOrWrapperEnforcer`, whose terms encode
+ * several caveat GROUPS and whose own security notice warns that "the redeemer
+ * can select the least restrictive group, bypassing stricter requirements in
+ * other groups". That warning is about groups INSIDE the wrapper — it binds
+ * whoever authors wrapper terms. The wrapper is itself one caveat among the
+ * delegation's, so it is AND-ed with the four required below and cannot unlock
+ * them.
+ *
+ * The shape that WOULD be dangerous is the inverse: a required caveat hidden
+ * inside a wrapper group instead of sitting at top level, where the redeemer
+ * could select a group that omits it. This file scans top-level caveats and
+ * refuses on absence, so that child is refused for lacking the caveat — which
+ * is the correct outcome and is pinned by a test.
+ */
+/** DelegationManager, the EIP-712 `verifyingContract` for a delegation. */
+declare const DELEGATION_MANAGER = "0xdb9B1e94B5b69Df7e401DDbedE43491141047dB3";
+/**
+ * Caveat enforcers, by role. Deterministically deployed, so Base and Base
+ * Sepolia share addresses — verified for both chains by the pin test.
+ */
+declare const CAVEAT_ENFORCERS: {
+    readonly erc20TransferAmount: "0xf100b0819427117EcF76Ed94B358B1A5b5C6D2Fc";
+    readonly allowedCalldata: "0xc2b0d624c1c4319760C96503BA27C347F3260f55";
+    readonly timestamp: "0x1046bb45C8d673d4ea75321280DB34899413c069";
+    readonly redeemer: "0xE144b0b2618071B4E56f746313528a669c7E65c5";
+};
+/** The backend's own ceiling (`MAX_SETTLEMENT_WINDOW_SECONDS`), enforced again here. */
+declare const MAX_SETTLEMENT_WINDOW_SECONDS = 600;
+interface SettlementChildTypedData {
+    domain: {
+        name?: string;
+        version?: string;
+        chainId?: number | string;
+        verifyingContract?: string;
+    };
+    types: Record<string, unknown>;
+    primaryType: string;
+    message: Record<string, unknown>;
+}
+/** True when this typed data is a delegation — the shape that must never be signed unbound. */
+declare function isSettlementChildTypedData(value: unknown): value is SettlementChildTypedData;
+/**
+ * Map an x402 network string to a chain id. Local on purpose (#1455 review):
+ * the chain must come from Haven's SIGNED `network` field, never from the
+ * payload under verification — see `verifySettlementChild`.
+ */
+declare function chainIdForNetwork(network: string | undefined): number | undefined;
+interface SettlementChildExpectation {
+    merchantTo: string;
+    amount: string;
+    asset: string;
+    /**
+     * Derived from the expected context's SIGNED `network`, never from
+     * `typedData.domain.chainId`. Comparing the payload's own claim against
+     * itself is a check that cannot fail — which is exactly what shipped in the
+     * first draft of this file's call site, and what the review caught.
+     */
+    chainId: number;
+    /** ISO timestamp; the child must not outlive it. */
+    expiresAt?: string;
+    /**
+     * #3283 / #3281 criterion 8: the signer's OWN derived delegate account.
+     * When set, the child's `delegator` must be exactly this account — the
+     * child is a re-delegation of this agent's budget, never a grant from some
+     * other account the key happens to control.
+     */
+    delegatorAccount?: string;
+    /**
+     * #3283: the facilitator addresses the merchant's 402 advertised
+     * (`extra.facilitatorAddresses`). When non-empty, the child must carry a
+     * `RedeemerEnforcer` caveat pinning exactly this set — otherwise the child
+     * is a bearer instrument any party could redeem within its bounds.
+     */
+    redeemers?: readonly string[];
+}
+/** `@metamask/delegation-core`'s `ROOT_AUTHORITY` — a delegation chained to nothing. */
+declare const ROOT_AUTHORITY: string;
+/**
+ * Verify a settlement child implements what the expected context declares.
+ * Throws `HavenSigningError` on any disagreement; returns nothing on success.
+ *
+ * `now` is injectable so the expiry checks are testable without faking clocks.
+ */
+declare function verifySettlementChild(typedData: SettlementChildTypedData, expected: SettlementChildExpectation, now?: number): void;
+
+/** Wire code for a typed-data payload outside the signable allowlist. */
+declare const TYPED_DATA_NOT_ALLOWED: "TYPED_DATA_NOT_ALLOWED";
+/**
+ * A typed-data payload was refused before signing because it is not a shape
+ * a delegate key may sign. Nothing was signed. `@haven_ai/signer` subclasses
+ * this to attach its MCP next step; the `code` is the same on both.
+ */
+declare class HavenTypedDataRefusedError extends HavenSigningError {
+    readonly code: typeof TYPED_DATA_NOT_ALLOWED;
+    constructor(message: string);
+}
+/**
+ * Chains the delegation rail has PINNED delegation contracts for
+ * (`packages/backend/src/rails/delegation-contracts.ts`) — the only chains a
+ * direct-payment UserOp may be scoped to. Gnosis (100) has no pinned
+ * DelegationManager/enforcer set, so it is deliberately excluded even though
+ * the delegate account itself could exist there.
+ */
+declare const DIRECT_PAYMENT_CHAIN_IDS: ReadonlySet<number>;
+/** The DeleGator's single-execution `execute((address,uint256,bytes))` — selector `0x5c1c6dcd`. */
+declare const EXECUTE_ABI: readonly [{
+    readonly type: "function";
+    readonly name: "execute";
+    readonly inputs: readonly [{
+        readonly name: "_execution";
+        readonly type: "tuple";
+        readonly components: readonly [{
+            readonly name: "target";
+            readonly type: "address";
+        }, {
+            readonly name: "value";
+            readonly type: "uint256";
+        }, {
+            readonly name: "callData";
+            readonly type: "bytes";
+        }];
+    }];
+    readonly outputs: readonly [];
+    readonly stateMutability: "payable";
+}];
+/**
+ * The content + provenance allowlist (#3272 criteria 1–2). Call ONLY after
+ * `assertUserOpTypedDataBinding` has already proven `typedData` is a
+ * well-formed `PackedUserOperation` matching its own hash — this function
+ * trusts `typedData.domain`/`message` are shaped correctly and checks only
+ * what they SAY. Throws `HavenTypedDataRefusedError` (never returns) on any
+ * disagreement.
+ */
+declare function assertBoundDirectPaymentUserOp(typedData: Record<string, unknown>, delegateAddress: string): void;
+
 /**
  * Runtime-agnostic base64 helpers — the single source of truth for the wire
  * encoding shared by the SDK and the edge signer (#325).
@@ -2410,4 +2645,4 @@ declare function encodeBase64Json(value: unknown): string;
  */
 declare function decodeBase64Json<T>(value: string, label?: string): T;
 
-export { type AgentPaymentSummary as $, type AgentPaymentWarning as A, type X402McpTransport as B, type X402MerchantCallContext as C, HavenError as D, AGENT_PAYMENT_FAILURE_CODE_VALUES as E, AGENT_PAYMENT_NEXT_ACTION_VALUES as F, AGENT_PAYMENT_PHASE_VALUES as G, type HavenClientConfig as H, AGENT_PAYMENT_RAIL_VALUES as I, type AgentNextStep as J, type AgentPaymentEnumSchema as K, AgentPaymentFailureCode as L, AgentPaymentFailureCodeDescriptions as M, AgentPaymentFailureCodeSchema as N, AgentPaymentNextAction as O, type PaymentRequest as P, AgentPaymentNextActionDescriptions as Q, type RawPaymentParties as R, type SweepResult as S, AgentPaymentNextActionSchema as T, AgentPaymentPhase as U, AgentPaymentPhaseDescriptions as V, AgentPaymentPhaseSchema as W, type X402PaymentRequired as X, AgentPaymentRail as Y, AgentPaymentRailDescriptions as Z, AgentPaymentRailSchema as _, type PaymentResult as a, type X402SchemeSelection as a$, AgentPaymentWarningCode as a0, type AgentPurchaseSummary as a1, CONNECTOR_PACKAGE_NAME as a2, type CatalogSubmissionAccepted as a3, DEFAULT_CONFIRMATION_TIMEOUT_MS as a4, DEFAULT_NEXT_TOOL_BY_ACTION as a5, DIRECT_SIGN_CONTEXT_VERSION as a6, ENTRY_POINT_V07 as a7, ERC7710_ASSET_TRANSFER_METHOD as a8, HAVEN_CONNECTOR_CHANNEL as a9, PACKED_USER_OPERATION_FIELDS as aA, type PaymentFee as aB, type PaymentNextAction as aC, type PaymentPhase as aD, type PaymentStatus as aE, SIGNER_UPDATE_FALLBACK as aF, SWEEP_BASE_CHAIN_ID as aG, SWEEP_BASE_SEPOLIA_CHAIN_ID as aH, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as aI, SWEEP_BASE_USDC_ADDRESS as aJ, SignerRefusalCode as aK, type SweepConfirmation as aL, type SweepEip712Domain as aM, type SweepEntry as aN, type SweepExpectedAuth as aO, type SweepPreparation as aP, type SweepSubmitResult as aQ, type SweepTypedData as aR, TRANSFER_WITH_AUTHORIZATION_TYPES as aS, type UnsupportedNodeVersionMessageOptions as aT, X402AlreadySettledError as aU, type X402ExpectedAuth as aV, type X402ExpectedContext as aW, type X402PaymentHeaderContext as aX, X402PaymentHeaderValidationError as aY, type X402PaymentOption as aZ, type X402RequestSnapshot as a_, HAVEN_MINIMUM_NODE_VERSION as aa, HYBRID_DELEGATOR_DOMAIN_NAME as ab, HYBRID_DELEGATOR_DOMAIN_VERSION as ac, type HavenAgentAllowanceSummary as ad, type HavenAgentReadiness as ae, type HavenAllowance as af, HavenApiError as ag, type HavenCatalogMerchant as ah, type HavenListScope as ai, HavenPaymentStateError as aj, HavenSigningError as ak, HavenTimeoutError as al, HavenUnsupportedSignerVersionError as am, HavenUserOpBindingError as an, HavenZeroSettlementHashError as ao, type MachinePaymentRail as ap, MerchantTimeoutError as aq, NEXT_TOOL_SERVER_NAMES as ar, NEXT_TOOL_SERVER_ROLES as as, type NextStep as at, type NextStepArguments as au, type NextStepHandoff as av, type NextStepInput as aw, type NextStepTarget as ax, type NextStepTargets as ay, type NextToolServerRole as az, type PaymentIntent as b, X402UnexpectedStatusError as b0, X402_LEGACY_PAYMENT_HEADER_NAME as b1, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as b2, X402_PAYMENT_HEADER_NAME as b3, X402_PAYMENT_HEADER_NAMES_SENT as b4, X402_PAYMENT_REQUIRED_HEADER_NAME as b5, X402_PAYMENT_RESPONSE_HEADER_NAME as b6, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as b7, assertUserOpTypedDataBinding as b8, buildSweepAuthorizationMessage as b9, selectPaymentOption as bA, selectStandardPaymentOption as bB, selectX402SettlementScheme as bC, signerUpdateFallback as bD, sweepUsdcAddress as bE, sweepUsdcDomain as bF, toStandardPaymentRequirements as bG, unsupportedNodeVersionMessage as bH, validateStandardX402PaymentHeader as bI, x402AssetTransferMethod as bJ, x402AuthorizationAmount as bK, x402FacilitatorAddresses as bL, x402V2PaymentEnvelope as bM, buildSweepTypedData as ba, buildX402ExpectedMessage as bb, compareNodeVersions as bc, connectorRerunCommand as bd, connectorSpec as be, createNextStepBuilder as bf, decodeBase64Json as bg, decodeBase64Utf8 as bh, defaultNextToolFor as bi, encodeBase64Json as bj, encodeBase64Utf8 as bk, encodePaymentProof as bl, isConnectorChannel as bm, isErc7710Option as bn, isPackedUserOperationTypedData as bo, isSupportedNodeVersion as bp, isSweepableChain as bq, normalizePaymentRequired as br, packedUserOperationHash as bs, parseNextTool as bt, parsePaymentRequired as bu, parsePaymentRequiredResponse as bv, renderNextTool as bw, resolveConnectorChannel as bx, resolveTokenFromAddress as by, selectErc7710PaymentOption as bz, type X402AuthorizationOptions as c, type X402Intent as d, type PaymentStatusResult as e, type HavenAgent as f, type HavenAgentSummary as g, type SweepPrepareResponse as h, type SweepAuthorization as i, type SweepSubmitResponse as j, type HavenAllowanceSummary as k, type HavenBalanceCoverage as l, type PostPurchaseAllowanceSummary as m, type HavenCatalogEntry as n, type HavenCatalogSubmission as o, type HavenPaymentReceipt as p, type HavenPaymentReceiptsPage as q, type PaymentResumeState as r, type X402Receipt as s, type X402Quote as t, type X402Erc7710Settlement as u, type X402McpCallContext as v, type SignData as w, type ResumeAuthorizedX402Input as x, type ResumeX402PaymentInput as y, type X402ResumeState as z };
+export { type AgentPaymentSummary as $, type AgentPaymentWarning as A, type X402McpTransport as B, type X402MerchantCallContext as C, HavenError as D, AGENT_PAYMENT_FAILURE_CODE_VALUES as E, AGENT_PAYMENT_NEXT_ACTION_VALUES as F, AGENT_PAYMENT_PHASE_VALUES as G, type HavenClientConfig as H, AGENT_PAYMENT_RAIL_VALUES as I, type AgentNextStep as J, type AgentPaymentEnumSchema as K, AgentPaymentFailureCode as L, AgentPaymentFailureCodeDescriptions as M, AgentPaymentFailureCodeSchema as N, AgentPaymentNextAction as O, type PaymentRequest as P, AgentPaymentNextActionDescriptions as Q, type RawPaymentParties as R, type SweepResult as S, AgentPaymentNextActionSchema as T, AgentPaymentPhase as U, AgentPaymentPhaseDescriptions as V, AgentPaymentPhaseSchema as W, type X402PaymentRequired as X, AgentPaymentRail as Y, AgentPaymentRailDescriptions as Z, AgentPaymentRailSchema as _, type PaymentResult as a, type X402PaymentHeaderContext as a$, AgentPaymentWarningCode as a0, type AgentPurchaseSummary as a1, CONNECTOR_PACKAGE_NAME as a2, type CatalogSubmissionAccepted as a3, DEFAULT_CONFIRMATION_TIMEOUT_MS as a4, DEFAULT_NEXT_TOOL_BY_ACTION as a5, DIRECT_SIGN_CONTEXT_VERSION as a6, ENTRY_POINT_V07 as a7, ERC7710_ASSET_TRANSFER_METHOD as a8, HAVEN_CONNECTOR_CHANNEL as a9, type NextToolServerRole as aA, PACKED_USER_OPERATION_FIELDS as aB, type PaymentFee as aC, type PaymentNextAction as aD, type PaymentPhase as aE, type PaymentStatus as aF, ROOT_AUTHORITY as aG, SIGNER_UPDATE_FALLBACK as aH, SWEEP_BASE_CHAIN_ID as aI, SWEEP_BASE_SEPOLIA_CHAIN_ID as aJ, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as aK, SWEEP_BASE_USDC_ADDRESS as aL, type SettlementChildExpectation as aM, SignerRefusalCode as aN, type SweepConfirmation as aO, type SweepEip712Domain as aP, type SweepEntry as aQ, type SweepExpectedAuth as aR, type SweepPreparation as aS, type SweepSubmitResult as aT, type SweepTypedData as aU, TRANSFER_WITH_AUTHORIZATION_TYPES as aV, TYPED_DATA_NOT_ALLOWED as aW, type UnsupportedNodeVersionMessageOptions as aX, X402AlreadySettledError as aY, type X402ExpectedAuth as aZ, type X402ExpectedContext as a_, HAVEN_MINIMUM_NODE_VERSION as aa, HYBRID_DELEGATOR_DOMAIN_NAME as ab, HYBRID_DELEGATOR_DOMAIN_VERSION as ac, type HavenAgentAllowanceSummary as ad, type HavenAgentReadiness as ae, type HavenAllowance as af, HavenApiError as ag, type HavenCatalogMerchant as ah, type HavenListScope as ai, HavenPaymentStateError as aj, HavenSigningError as ak, HavenTimeoutError as al, HavenTypedDataRefusedError as am, HavenUnsupportedSignerVersionError as an, HavenUserOpBindingError as ao, HavenZeroSettlementHashError as ap, type MachinePaymentRail as aq, MerchantTimeoutError as ar, NEXT_TOOL_SERVER_NAMES as as, NEXT_TOOL_SERVER_ROLES as at, type NextStep as au, type NextStepArguments as av, type NextStepHandoff as aw, type NextStepInput as ax, type NextStepTarget as ay, type NextStepTargets as az, type PaymentIntent as b, type SettlementChildTypedData as b$, X402PaymentHeaderValidationError as b0, type X402PaymentOption as b1, type X402RequestSnapshot as b2, type X402SchemeSelection as b3, X402UnexpectedStatusError as b4, X402_LEGACY_PAYMENT_HEADER_NAME as b5, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as b6, X402_PAYMENT_HEADER_NAME as b7, X402_PAYMENT_HEADER_NAMES_SENT as b8, X402_PAYMENT_REQUIRED_HEADER_NAME as b9, parsePaymentRequired as bA, parsePaymentRequiredResponse as bB, renderNextTool as bC, resolveConnectorChannel as bD, resolveTokenFromAddress as bE, selectErc7710PaymentOption as bF, selectPaymentOption as bG, selectStandardPaymentOption as bH, selectX402SettlementScheme as bI, signerUpdateFallback as bJ, sweepUsdcAddress as bK, sweepUsdcDomain as bL, toStandardPaymentRequirements as bM, unsupportedNodeVersionMessage as bN, validateStandardX402PaymentHeader as bO, verifySettlementChild as bP, x402AssetTransferMethod as bQ, x402AuthorizationAmount as bR, x402FacilitatorAddresses as bS, x402V2PaymentEnvelope as bT, CAVEAT_ENFORCERS as bU, DELEGATION_MANAGER as bV, DIRECT_PAYMENT_CHAIN_IDS as bW, EXECUTE_ABI as bX, HYBRID_DELEGATOR_IMPLEMENTATION as bY, MAX_SETTLEMENT_WINDOW_SECONDS as bZ, SIMPLE_FACTORY_ADDRESS as b_, X402_PAYMENT_RESPONSE_HEADER_NAME as ba, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as bb, assertBoundDirectPaymentUserOp as bc, assertUserOpTypedDataBinding as bd, buildSweepAuthorizationMessage as be, buildSweepTypedData as bf, buildX402ExpectedMessage as bg, compareNodeVersions as bh, connectorRerunCommand as bi, connectorSpec as bj, createNextStepBuilder as bk, decodeBase64Json as bl, decodeBase64Utf8 as bm, defaultNextToolFor as bn, deriveDelegateAccountAddress as bo, encodeBase64Json as bp, encodeBase64Utf8 as bq, encodePaymentProof as br, isConnectorChannel as bs, isErc7710Option as bt, isPackedUserOperationTypedData as bu, isSupportedNodeVersion as bv, isSweepableChain as bw, normalizePaymentRequired as bx, packedUserOperationHash as by, parseNextTool as bz, type X402AuthorizationOptions as c, chainIdForNetwork as c0, isSettlementChildTypedData as c1, type X402Intent as d, type PaymentStatusResult as e, type HavenAgent as f, type HavenAgentSummary as g, type SweepPrepareResponse as h, type SweepAuthorization as i, type SweepSubmitResponse as j, type HavenAllowanceSummary as k, type HavenBalanceCoverage as l, type PostPurchaseAllowanceSummary as m, type HavenCatalogEntry as n, type HavenCatalogSubmission as o, type HavenPaymentReceipt as p, type HavenPaymentReceiptsPage as q, type PaymentResumeState as r, type X402Receipt as s, type X402Quote as t, type X402Erc7710Settlement as u, type X402McpCallContext as v, type SignData as w, type ResumeAuthorizedX402Input as x, type ResumeX402PaymentInput as y, type X402ResumeState as z };