@haven_ai/sdk 0.1.22-alpha.0 → 0.1.23-alpha.1

package/dist/index.js

@@ -102,7 +102,23 @@ var AgentPaymentFailureCode = {
    * mechanical: re-send merchant_url, tool_name, arguments, and
    * mcp_transport explicitly (the version-skew path).
    */
-  MerchantCallContextUnavailable: "MERCHANT_CALL_CONTEXT_UNAVAILABLE"
+  MerchantCallContextUnavailable: "MERCHANT_CALL_CONTEXT_UNAVAILABLE",
+  /**
+   * #1351: the caller supplied BOTH the atomic `max_amount` and the
+   * human-denominated `max_amount_human` cap for one purchase. Haven refuses
+   * to guess which the user meant — the two differ by a factor of 10^decimals,
+   * so picking wrong is exactly the silent-overspend this cap exists to
+   * prevent. Rejected before any merchant probe, funding intent, or signature.
+   */
+  AmbiguousMaxAmount: "AMBIGUOUS_MAX_AMOUNT",
+  /**
+   * #1351: a human-denominated cap was supplied, but it cannot be converted to
+   * atomic units against THIS quote — either the quote's asset has no known
+   * decimals on its network, or the cap carries more fraction digits than the
+   * asset can represent (truncating it would silently change the user's cap).
+   * The fallback is the exact atomic `max_amount`.
+   */
+  MaxAmountUnconvertible: "MAX_AMOUNT_UNCONVERTIBLE"
 };
 var AgentPaymentRail = {
   /** Standard Haven payment from the user's Safe through an approved delegate allowance. */
@@ -157,7 +173,9 @@ var AgentPaymentFailureCodeDescriptions = {
   [AgentPaymentFailureCode.PaymentWindowExpired]: "The x402 funding/quote window expired before the signer or hosted settle step could finish. Re-quote via haven_pay_mcp_tool with the same idempotency key to avoid duplicate funding.",
   [AgentPaymentFailureCode.MerchantRejectedAfterFunding]: "The Haven funding leg succeeded, but the merchant rejected the paid retry. Stop retrying the merchant and reconcile stranded delegate funds with haven_sweep_delegate.",
   [AgentPaymentFailureCode.MerchantUnresponsiveAfterFunding]: "The Haven funding leg succeeded, but the merchant did not answer the paid retry before the timeout. The merchant may still settle late \u2014 check haven_get_payment_status (and retry haven_complete_mcp_tool once) BEFORE sweeping; sweep only if no settlement appears.",
-  [AgentPaymentFailureCode.MerchantCallContextUnavailable]: "merchant_url/tool_name were omitted and no stored merchant call context is available for this payment_id. Re-send merchant_url, tool_name, arguments, and mcp_transport explicitly."
+  [AgentPaymentFailureCode.MerchantCallContextUnavailable]: "merchant_url/tool_name were omitted and no stored merchant call context is available for this payment_id. Re-send merchant_url, tool_name, arguments, and mcp_transport explicitly.",
+  [AgentPaymentFailureCode.AmbiguousMaxAmount]: "Both max_amount (atomic units) and max_amount_human (whole tokens) were supplied for one purchase. Nothing was contacted and nothing was spent. Re-send with exactly ONE: max_amount_human for a cap the user stated in tokens, max_amount for an exact atomic figure.",
+  [AgentPaymentFailureCode.MaxAmountUnconvertible]: "max_amount_human could not be converted to atomic units against this quote's asset \u2014 either its decimals are unknown to Haven or the cap has more decimal places than the asset supports. Nothing was spent. Round the cap, or re-send it as an exact atomic max_amount."
 };
 var AgentPaymentWarningCode = {
   /** No max_amount cap was supplied — the live quoted price was accepted as-is. */
@@ -683,73 +701,6 @@ function stableStringify(value) {
   const object = value;
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
 }
-function normalizeChallenge(value) {
-  const candidate = value;
-  if (!candidate || typeof candidate !== "object" || candidate.rail !== "mpp_demo" || typeof candidate.version !== "string" || typeof candidate.challengeId !== "string" || typeof candidate.resource !== "string" || typeof candidate.description !== "string" || // TODO: relax these checks when non-demo machine payment rails are added.
-  candidate.network?.chainId !== 8453 || candidate.network?.name !== "base" || candidate.asset?.symbol !== "USDC" || typeof candidate.asset?.address !== "string" || candidate.asset.decimals !== 6 || typeof candidate.amount?.display !== "string" || typeof candidate.amount?.atomic !== "string" || typeof candidate.recipient !== "string" || typeof candidate.expiresAt !== "string") {
-    return null;
-  }
-  return {
-    rail: candidate.rail,
-    version: candidate.version,
-    challengeId: candidate.challengeId,
-    resource: candidate.resource,
-    description: candidate.description,
-    network: candidate.network,
-    asset: candidate.asset,
-    amount: candidate.amount,
-    recipient: candidate.recipient,
-    expiresAt: candidate.expiresAt,
-    metadata: candidate.metadata
-  };
-}
-function parseMachinePaymentChallenge(response) {
-  const header = response.headers.get("MACHINE-PAYMENT-CHALLENGE");
-  if (!header) {
-    throw new Error("No MACHINE-PAYMENT-CHALLENGE header found in 402 response.");
-  }
-  const parsed = normalizeChallenge(
-    decodeBase64Json(header, "MACHINE-PAYMENT-CHALLENGE header")
-  );
-  if (!parsed) throw new Error("Invalid machine payment challenge");
-  return parsed;
-}
-async function parseMachinePaymentChallengeResponse(response) {
-  try {
-    return parseMachinePaymentChallenge(response);
-  } catch (headerErr) {
-    try {
-      const body = await response.clone().json();
-      const parsed = normalizeChallenge(body.challenge);
-      if (parsed) return parsed;
-    } catch {
-    }
-    throw headerErr;
-  }
-}
-function buildMachinePaymentIdempotencyKey(challenge) {
-  const material = [
-    challenge.rail,
-    challenge.challengeId,
-    challenge.resource,
-    challenge.recipient.toLowerCase(),
-    challenge.asset.address.toLowerCase(),
-    challenge.amount.atomic,
-    challenge.network.chainId
-  ].join("|");
-  return `${challenge.rail}:${createHash("sha256").update(material).digest("hex").slice(0, 16)}`;
-}
-function encodeMachinePaymentProof(receipt) {
-  return encodeBase64Json({
-    rail: receipt.rail,
-    challengeId: receipt.challengeId,
-    paymentId: receipt.paymentId,
-    txHash: receipt.txHash,
-    settledVia: "haven",
-    payer: receipt.payer,
-    chainId: receipt.chainId
-  });
-}
 function createJsonRpcProvider(url) {
   return new ethers.JsonRpcProvider(url);
 }
@@ -870,9 +821,6 @@ function messageForState(label, status, paymentId, nextAction) {
 function sameAddress(a, b) {
   return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
 }
-function isMppRail(rail) {
-  return rail === "mpp" || Boolean(rail?.startsWith("mpp_"));
-}
 function decimalFromUsdcAtomic(value) {
   const amount = BigInt(value);
   const whole = amount / 1000000n;
@@ -974,7 +922,6 @@ var HavenClient = class {
   chainRpcs;
   inFlightX402 = /* @__PURE__ */ new Map();
   x402ReceiptCache = /* @__PURE__ */ new Map();
-  inFlightMachinePayments = /* @__PURE__ */ new Map();
   /**
    * Setup-time headers configured via `HavenClientConfig.defaultHeaders`.
    * Read-only after construction — use `withRequestContext` for per-call
@@ -1092,8 +1039,7 @@ var HavenClient = class {
         400
       );
     }
-    const agent = await this.getAgent();
-    const fundingTo = agent.delegateAddress;
+    const fundingTo = options.delegateAddress ?? (await this.getAgent()).delegateAddress;
     if (!fundingTo) {
       throw new HavenApiError("Authenticated agent has no delegate address registered.", 502);
     }
@@ -1102,13 +1048,25 @@ var HavenClient = class {
       url: paymentRequired.resource.url,
       payTo: fundingTo,
       merchantPayTo: option.payTo,
+      // #1360: this path ALWAYS means the EIP-3009 funding leg (payTo is the
+      // agent's own delegate EOA). Saying so explicitly turns a stale/rotated
+      // delegate address into the backend's LOUD shape-mismatch 400 instead
+      // of a silent reroute to the erc7710 settlement branch (the #1358
+      // review's open-budget misroute). Legacy-rail backends ignore the field.
+      settlementScheme: "eip3009",
       amount: x402AuthorizationAmount(option),
       asset: option.asset,
       network: option.network,
       description: paymentRequired.resource.description,
       idempotencyKey,
       // #1307: persisted so the settle leg can rehydrate it by payment_id.
-      ...options.mcpCallContext ? { mcpCallContext: options.mcpCallContext } : {}
+      ...options.mcpCallContext ? { mcpCallContext: options.mcpCallContext } : {},
+      // #1355: persisted so the SIGN leg can rehydrate it by payment_id — the
+      // local signer's context fetch then carries the 402 PaymentRequired and
+      // the agent passes only payment_id. Bounded: the backend rejects >64KB,
+      // so an oversized blob is omitted here (signer falls back to the
+      // caller-supplied copy) rather than failing the intent.
+      ...new TextEncoder().encode(JSON.stringify(paymentRequired)).length <= 65536 ? { paymentRequired } : {}
     });
     if (raw.status !== "pending_signature") {
       this.throwPaymentStateError("x402 payment", raw);
@@ -1240,6 +1198,17 @@ var HavenClient = class {
    * Get the agent identity tied to this API key.
    */
   async getAgent() {
+    if (this.agentInFlight) return this.agentInFlight;
+    const request = this.fetchAgent();
+    this.agentInFlight = request;
+    request.finally(() => {
+      this.agentInFlight = null;
+    }).catch(() => {
+    });
+    return request;
+  }
+  agentInFlight = null;
+  async fetchAgent() {
     const raw = await this.get("/machine-payments/agent");
     return {
       id: raw.id,
@@ -1438,6 +1407,7 @@ var HavenClient = class {
    */
   async getPostPurchaseAllowanceSummary(paymentId) {
     const unavailable = (detail) => ({
+      payment: null,
       allowance: null,
       warnings: [
         {
@@ -1446,27 +1416,38 @@ var HavenClient = class {
         }
       ]
     });
+    const [statusResult, agentResult, allowanceResult] = await Promise.allSettled([
+      this.getPaymentStatus(paymentId),
+      this.getAgent(),
+      this.getAllowances()
+    ]);
+    if (statusResult.status === "rejected") {
+      return unavailable(statusResult.reason instanceof Error ? statusResult.reason.message : String(statusResult.reason));
+    }
+    const status = statusResult.value;
+    if (agentResult.status === "rejected") {
+      return { ...unavailable(agentResult.reason instanceof Error ? agentResult.reason.message : String(agentResult.reason)), payment: status };
+    }
+    if (allowanceResult.status === "rejected") {
+      return { ...unavailable(allowanceResult.reason instanceof Error ? allowanceResult.reason.message : String(allowanceResult.reason)), payment: status };
+    }
     try {
-      const [status, agent, allowanceSummary] = await Promise.all([
-        this.getPaymentStatus(paymentId),
-        this.getAgent(),
-        this.getAllowances()
-      ]);
       const tokenAddress = status.asset ?? status.x402?.asset ?? null;
       if (!tokenAddress) {
-        return unavailable("the settled payment does not carry a resolvable token address");
+        return { ...unavailable("the settled payment does not carry a resolvable token address"), payment: status };
       }
-      const rail = agent.executionRail;
+      const rail = agentResult.value.executionRail;
       const source = rail === "delegation" ? "active_delegations" : "allowance_module";
-      const match = allowanceSummary.allowances.find(
+      const match = allowanceResult.value.allowances.find(
         (a) => a.tokenAddress.toLowerCase() === tokenAddress.toLowerCase()
       );
       if (!match) {
-        return unavailable("no allowance/budget row matches the settled token");
+        return { ...unavailable("no allowance/budget row matches the settled token"), payment: status };
       }
       const token = resolveTokenFromAddress(match.tokenAddress);
       const remainingDisplay = token ? `${formatAtomicAmount(safeBigInt(match.onchain.remaining), token.decimals)} ${match.tokenSymbol}` : void 0;
       return {
+        payment: status,
         allowance: {
           rail,
           remaining_atomic: match.onchain.remaining,
@@ -1514,6 +1495,7 @@ var HavenClient = class {
   async discoverTools(options = {}) {
     const params = new URLSearchParams();
     if (options.category) params.set("category", options.category);
+    if (options.search !== void 0) params.set("search", options.search);
     if (options.rail) params.set("rail", options.rail);
     const query = params.size > 0 ? `?${params.toString()}` : "";
     const raw = await this.get(`/catalog${query}`);
@@ -1553,10 +1535,11 @@ var HavenClient = class {
     return { receipt, verification: verifyPaymentReceipt(receipt) };
   }
   /**
-   * Rehydrate the x402/MPP resume-state bundle for a payment id.
+   * Rehydrate the x402 resume-state bundle for a payment id (#1328: the MPP
+   * resume-state variant retired along with the rest of the mpp_demo surface).
    *
    * The server returns stored protocol context only. The client still signs the
-   * merchant proof locally when resumeX402Payment() or resumeMppPayment() runs.
+   * merchant proof locally when resumeX402Payment() runs.
    */
   async getResumeState(paymentId) {
     return this.get(`/payments/${paymentId}/resume_state`);
@@ -1705,7 +1688,11 @@ var HavenClient = class {
       asset: option.asset,
       network: option.network,
       description: paymentRequired.resource.description,
-      idempotencyKey
+      idempotencyKey,
+      // #1360: same explicit funding-leg declaration as createX402Intent —
+      // this local-key path derives payTo from the key (never stale), but the
+      // declaration keeps both writers of the 3009 shape loud-by-default.
+      settlementScheme: "eip3009"
     });
     if (raw.success && raw.tx_hash) {
       const receipt2 = this.mapX402ReceiptFromAuthorization(paymentRequired, option, paymentHeader, raw);
@@ -1823,22 +1810,11 @@ var HavenClient = class {
     if (response.status !== 402) {
       return mcpSessionId ? this.surfaceMcpResult(response) : response;
     }
-    const machineChallengeHeader = response.headers.get("MACHINE-PAYMENT-CHALLENGE");
-    if (machineChallengeHeader) {
-      const challenge = await parseMachinePaymentChallengeResponse(response);
-      return this.fetchWithMachinePayment(url, requestInit, challenge);
-    }
     let paymentRequired;
     try {
       paymentRequired = await parsePaymentRequiredResponse(response);
     } catch {
-      let challenge;
-      try {
-        challenge = await parseMachinePaymentChallengeResponse(response);
-      } catch {
-        return response;
-      }
-      return this.fetchWithMachinePayment(url, requestInit, challenge);
+      return response;
     }
     if (!mcpSessionId && await responseHasBazaarExtension(response)) {
       mcpSessionId = await this.mcpInitialize(url, init);
@@ -1981,49 +1957,6 @@ var HavenClient = class {
       headers
     });
   }
-  /**
-   * Probe a paid MPP endpoint or inspect an existing challenge without creating
-   * a Haven payment or approval request.
-   */
-  async quoteMpp(challengeOrUrl, init, options = {}) {
-    if (typeof challengeOrUrl !== "string") {
-      const request2 = this.snapshotX402Request(challengeOrUrl.resource, init);
-      return this.buildMppQuote(challengeOrUrl, request2, options.idempotencyKey);
-    }
-    const request = this.snapshotX402Request(challengeOrUrl, init);
-    const response = await this.merchantFetch(challengeOrUrl, init);
-    if (response.status !== 402) {
-      throw new HavenApiError(
-        `Expected an MPP quote response with HTTP 402, got HTTP ${response.status}.`,
-        response.status || 400
-      );
-    }
-    const challenge = await parseMachinePaymentChallengeResponse(response);
-    return this.buildMppQuote(challenge, request, options.idempotencyKey);
-  }
-  /**
-   * Pay a previously inspected MPP quote and retry the exact captured request.
-   */
-  async payMppChallenge(quote, options = {}) {
-    const idempotencyKey = options.idempotencyKey ?? quote.idempotencyKey;
-    try {
-      const receipt = await this.authorizeMachinePayment(quote.challenge, { idempotencyKey });
-      return this.retryMppRequest(
-        quote.request.url,
-        this.requestInitFromSnapshot(quote.request),
-        quote.challenge,
-        receipt
-      );
-    } catch (err) {
-      this.attachResumeState(err, {
-        rail: "mpp",
-        challenge: quote.challenge,
-        idempotencyKey,
-        request: quote.request
-      });
-      throw err;
-    }
-  }
   async retryX402Request(url, initialInit, paymentRequired, receipt) {
     if (!receipt.accepted) {
       throw new HavenApiError("No accepted x402 option was recorded for payment retry", 500);
@@ -2288,151 +2221,13 @@ var HavenClient = class {
       return void 0;
     }
   }
-  async authorizeMachinePayment(challenge, options = {}) {
-    if (!this.delegateKey) {
-      throw new HavenSigningError(
-        "delegateKey is required for machine payments. Pass it in the HavenClient config."
-      );
-    }
-    if (challenge.rail !== "mpp_demo") {
-      throw new HavenApiError(`Unsupported machine payment rail: ${challenge.rail}`, 400);
-    }
-    const idempotencyKey = options.idempotencyKey ?? buildMachinePaymentIdempotencyKey(challenge);
-    const inFlight = this.inFlightMachinePayments.get(idempotencyKey);
-    if (inFlight) return inFlight;
-    const promise = this.authorizeMppDemoPayment(challenge, idempotencyKey);
-    this.inFlightMachinePayments.set(idempotencyKey, promise);
-    try {
-      return await promise;
-    } catch (err) {
-      this.attachResumeState(err, {
-        rail: "mpp",
-        challenge,
-        idempotencyKey
-      });
-      throw err;
-    } finally {
-      this.inFlightMachinePayments.delete(idempotencyKey);
-    }
-  }
-  async authorizeMppDemoPayment(challenge, idempotencyKey) {
-    const raw = await this.post(
-      "/machine-payments/authorize",
-      { challenge, idempotencyKey }
-    );
-    if (raw.success && raw.tx_hash) {
-      return this.mapMachinePaymentReceipt(challenge, raw, raw.tx_hash);
-    }
-    this.throwIfNonSignableAuthorizationState("Machine payment", raw);
-    if (!raw.sign_data?.hash) {
-      throw new HavenApiError("No sign_hash returned from machine payment authorization", 500, raw);
-    }
-    const sig = await this.signForData(raw.sign_data);
-    const execResult = await this.post(
-      `/payments/${raw.payment_id}/sign`,
-      { signature: sig }
-    );
-    if (execResult.status !== "confirmed" || !execResult.tx_hash) {
-      this.throwPaymentStateError("Machine payment", execResult);
-    }
-    return this.mapMachinePaymentReceipt(challenge, raw, execResult.tx_hash, execResult);
-  }
-  async resumeAuthorizedMpp(input) {
-    if (!this.delegateKey) {
-      throw new HavenSigningError(
-        "delegateKey is required for machine payments. Pass it in the HavenClient config."
-      );
-    }
-    const status = await this.getPaymentStatus(input.paymentId);
-    this.assertCanResumeMpp(status, input.challenge);
-    return this.mapMachinePaymentReceiptFromStatus(input.challenge, status);
-  }
-  async resumeMppPayment(input) {
-    const inputInit = "init" in input ? input.init : void 0;
-    const initialInit = inputInit ?? (input.request ? this.requestInitFromSnapshot(input.request) : void 0);
-    let challenge = input.challenge;
-    const url = input.url ?? input.request?.url;
-    if (!challenge) {
-      if (!url) {
-        throw new HavenApiError("MPP resume requires the original URL or a captured request snapshot.", 400);
-      }
-      const response = await this.merchantFetch(url, initialInit);
-      if (response.status !== 402) {
-        throw new HavenApiError("Expected the original MPP request to return HTTP 402 before resuming.", 400);
-      }
-      challenge = await parseMachinePaymentChallengeResponse(response);
-    }
-    const receipt = await this.resumeAuthorizedMpp({
-      paymentId: input.paymentId,
-      challenge,
-      idempotencyKey: input.idempotencyKey
-    });
-    return this.retryMppRequest(url ?? challenge.resource, initialInit, challenge, receipt);
-  }
-  async fetchWithMachinePayment(url, initialInit, challenge) {
-    const request = this.snapshotX402Request(url, initialInit);
-    const idempotencyKey = buildMachinePaymentIdempotencyKey(challenge);
-    let receipt;
-    try {
-      receipt = await this.authorizeMachinePayment(challenge, { idempotencyKey });
-    } catch (err) {
-      this.attachResumeState(err, {
-        rail: "mpp",
-        challenge,
-        idempotencyKey,
-        request
-      });
-      throw err;
-    }
-    return this.retryMppRequest(url, initialInit, challenge, receipt);
-  }
-  async retryMppRequest(url, initialInit, challenge, receipt) {
-    const retryHeaders = new Headers(initialInit?.headers);
-    retryHeaders.set("MACHINE-PAYMENT-PROOF", receipt.proofHeader);
-    const retryResponse = await this.merchantFetch(url, {
-      ...initialInit,
-      headers: retryHeaders
-    });
-    if (!retryResponse.ok) {
-      const merchant = await captureMerchantResponse(retryResponse);
-      await this.recordMerchantRetryRejected({
-        rail: receipt.rail,
-        paymentId: receipt.paymentId,
-        txHash: receipt.txHash,
-        resourceUrl: receipt.resourceUrl,
-        merchant,
-        details: {
-          challenge_id: receipt.challengeId
-        }
-      });
-      throw new HavenApiError(
-        "Machine payment retry failed after Haven sent the payment.",
-        merchant.merchant_status,
-        {
-          marker: "machine_payment_retry_rejected_after_payment",
-          payment_id: receipt.paymentId,
-          tx_hash: receipt.txHash,
-          resource_url: receipt.resourceUrl,
-          rail: receipt.rail,
-          ...merchant
-        }
-      );
-    }
-    await this.reportMachinePaymentEvidence({
-      paymentId: receipt.paymentId,
-      rail: receipt.rail,
-      txHash: receipt.txHash,
-      resourceUrl: receipt.resourceUrl,
-      merchantStatus: retryResponse.status,
-      challengePayload: challenge,
-      paymentProofHeaderName: "MACHINE-PAYMENT-PROOF",
-      paymentProofHeader: receipt.proofHeader,
-      protocolReceiptHeaderName: retryResponse.headers.has("Payment-Receipt") ? "Payment-Receipt" : retryResponse.headers.has("MACHINE-PAYMENT-RESPONSE") ? "MACHINE-PAYMENT-RESPONSE" : void 0,
-      protocolReceiptHeader: retryResponse.headers.get("Payment-Receipt") ?? retryResponse.headers.get("MACHINE-PAYMENT-RESPONSE") ?? void 0
-    });
-    await this.reportMerchantReceipt(receipt.paymentId, retryResponse);
-    return retryResponse;
-  }
+  // #1328: authorizeMachinePayment / authorizeMppDemoPayment / resumeAuthorizedMpp
+  // / resumeMppPayment / fetchWithMachinePayment / retryMppRequest (the
+  // MACHINE-PAYMENT-CHALLENGE / mpp_demo client surface) are retired — the
+  // backend's POST /machine-payments/authorize refuses unconditionally now,
+  // and MACHINE-PAYMENT-CHALLENGE was never produced by any other Haven
+  // surface. Use the x402 flow (authorizeX402 / fetch / quoteX402 / payX402Quote)
+  // for agent-to-merchant payments.
   assertCanResumeX402(status, paymentRequired, option) {
     if (status.rail !== "x402") {
       throw new HavenPaymentStateError(
@@ -2496,68 +2291,6 @@ var HavenClient = class {
       );
     }
   }
-  assertCanResumeMpp(status, challenge) {
-    if (!isMppRail(status.rail)) {
-      throw new HavenPaymentStateError(
-        `Payment ${status.paymentId} is ${status.rail}, not MPP.`,
-        409,
-        status
-      );
-    }
-    if (status.nextAction !== AgentPaymentNextAction.RetryOriginalX402Request) {
-      throw new HavenPaymentStateError(status.message, PAYMENT_STATE_STATUS_CODES[status.status] ?? 409, status);
-    }
-    if (!status.txHash) {
-      throw new HavenApiError(
-        `MPP payment ${status.paymentId} is ready to retry but has no Haven transaction hash.`,
-        502,
-        status,
-        status.paymentId
-      );
-    }
-    if (status.resourceUrl && status.resourceUrl !== challenge.resource) {
-      throw new HavenApiError(
-        "MPP resume request does not match the approved resource URL.",
-        409,
-        { status, challenge },
-        status.paymentId
-      );
-    }
-    if (status.merchantAddress && !sameAddress(status.merchantAddress, challenge.recipient)) {
-      throw new HavenApiError(
-        "MPP resume request does not match the approved merchant.",
-        409,
-        { status, challenge },
-        status.paymentId
-      );
-    }
-    if (status.chainId && status.chainId !== challenge.network.chainId) {
-      throw new HavenApiError(
-        "MPP resume request does not match the approved network.",
-        409,
-        { status, challenge },
-        status.paymentId
-      );
-    }
-    if (status.token && status.token !== challenge.asset.symbol) {
-      throw new HavenApiError(
-        "MPP resume request does not match the approved token.",
-        409,
-        { status, challenge },
-        status.paymentId
-      );
-    }
-    const approvedAmount = status.amount ? normalizeDecimal(status.amount) : "";
-    const requestedAmount = normalizeDecimal(challenge.amount.display);
-    if (approvedAmount && approvedAmount !== requestedAmount) {
-      throw new HavenApiError(
-        "MPP resume request does not match the approved amount.",
-        409,
-        { status, challenge },
-        status.paymentId
-      );
-    }
-  }
   mapX402ReceiptFromAuthorization(paymentRequired, option, paymentHeader, raw, execResult) {
     const txHash = execResult?.tx_hash ?? raw.tx_hash ?? "";
     const chainId = execResult?.chain_id ?? raw.chain_id ?? chainIdFromNetwork(option.network);
@@ -2664,53 +2397,6 @@ var HavenClient = class {
       this.x402ReceiptCache.set(idempotencyKey, { expiresAt, receipt });
     }
   }
-  mapMachinePaymentReceipt(challenge, raw, txHash, execResult) {
-    const receiptWithoutHeader = {
-      success: true,
-      rail: challenge.rail,
-      paymentId: raw.payment_id,
-      challengeId: challenge.challengeId,
-      txHash,
-      token: execResult?.token ?? raw.token ?? challenge.asset.symbol,
-      amount: execResult?.amount ?? raw.amount ?? challenge.amount.display,
-      to: execResult?.to ?? raw.to ?? challenge.recipient,
-      resourceUrl: raw.resource_url ?? challenge.resource,
-      explorerUrl: execResult?.explorer_url ?? raw.explorer_url ?? buildExplorerUrl(execResult?.chain_id ?? raw.chain_id ?? challenge.network.chainId, txHash),
-      payer: raw.payer ?? raw.safe_address,
-      chainId: execResult?.chain_id ?? raw.chain_id ?? challenge.network.chainId
-    };
-    return {
-      ...receiptWithoutHeader,
-      proofHeader: encodeMachinePaymentProof(receiptWithoutHeader)
-    };
-  }
-  mapMachinePaymentReceiptFromStatus(challenge, status) {
-    if (!status.txHash) {
-      throw new HavenApiError(
-        `MPP payment ${status.paymentId} is ready to retry but has no Haven transaction hash.`,
-        502,
-        status,
-        status.paymentId
-      );
-    }
-    const receiptWithoutHeader = {
-      success: true,
-      rail: challenge.rail,
-      paymentId: status.paymentId,
-      challengeId: challenge.challengeId,
-      txHash: status.txHash,
-      token: status.token || challenge.asset.symbol,
-      amount: status.amount || challenge.amount.display,
-      to: status.merchantAddress ?? challenge.recipient,
-      resourceUrl: status.resourceUrl ?? challenge.resource,
-      explorerUrl: explorerUrlOrEmpty(status.chainId || challenge.network.chainId, status.txHash),
-      chainId: status.chainId || challenge.network.chainId
-    };
-    return {
-      ...receiptWithoutHeader,
-      proofHeader: encodeMachinePaymentProof(receiptWithoutHeader)
-    };
-  }
   async recordMerchantRetryRejected(input) {
     try {
       await this.post("/machine-payments/reconciliation-events", {
@@ -2908,6 +2594,11 @@ var HavenClient = class {
       amountAtomic: x402AuthorizationAmount(option),
       amount: decimalFromUsdcAtomic(x402AuthorizationAmount(option)),
       token: token?.symbol ?? "USDC",
+      // #1351: null when the asset is unrecognised on this network — the
+      // `token` fallback above is a LABEL, not evidence of 6 decimals, and a
+      // human-denominated cap must fail closed rather than convert against a
+      // guess. Same resolution as `token`, so the two never disagree.
+      decimals: token?.decimals ?? null,
       asset: option.asset,
       network: option.network,
       chainId: chainIdOrNull(option.network),
@@ -2948,63 +2639,18 @@ var HavenClient = class {
       merchantAddress: input.accepted.payTo
     };
   }
-  buildMppQuote(challenge, request, idempotencyKey) {
-    return {
-      rail: "mpp",
-      paymentRail: challenge.rail,
-      idempotencyKey: idempotencyKey ?? buildMachinePaymentIdempotencyKey(challenge),
-      challenge,
-      request,
-      resourceUrl: challenge.resource,
-      description: challenge.description ?? null,
-      amountAtomic: challenge.amount.atomic,
-      amount: challenge.amount.display,
-      token: challenge.asset.symbol,
-      asset: challenge.asset.address,
-      network: challenge.network.name,
-      chainId: challenge.network.chainId,
-      merchantAddress: challenge.recipient,
-      expiresAt: challenge.expiresAt
-    };
-  }
-  buildMppResumeState(input) {
-    const quote = this.buildMppQuote(
-      input.challenge,
-      input.request ?? this.snapshotX402Request(input.challenge.resource),
-      input.idempotencyKey
-    );
-    return {
-      rail: "mpp",
-      paymentRail: quote.paymentRail,
-      paymentId: input.paymentId,
-      idempotencyKey: quote.idempotencyKey,
-      challenge: input.challenge,
-      url: input.request?.url ?? input.challenge.resource,
-      request: input.request,
-      resourceUrl: quote.resourceUrl,
-      description: quote.description,
-      amountAtomic: quote.amountAtomic,
-      amount: quote.amount,
-      token: quote.token,
-      asset: quote.asset,
-      network: quote.network,
-      chainId: quote.chainId,
-      merchantAddress: quote.merchantAddress,
-      expiresAt: quote.expiresAt
-    };
-  }
+  // #1328: attachResumeState's 'mpp' branch (buildMppQuote / buildMppResumeState
+  // / attachMppResumeState) is retired along with the rest of the MPP-demo
+  // client surface — every remaining caller passes rail: 'x402' only, so this
+  // is now a direct alias for attachX402ResumeState rather than a dispatcher.
   attachResumeState(err, input) {
-    if (input.rail === "x402") {
-      this.attachX402ResumeState(
-        err,
-        input.paymentRequired,
-        input.accepted,
-        input.idempotencyKey,
-        input.request
-      );
-      return;
-    }
-    this.attachMppResumeState(err, input.challenge, input.idempotencyKey, input.request);
+    this.attachX402ResumeState(
+      err,
+      input.paymentRequired,
+      input.accepted,
+      input.idempotencyKey,
+      input.request
+    );
   }
   attachX402ResumeState(err, paymentRequired, accepted, idempotencyKey, request) {
     if (!(err instanceof HavenPaymentStateError)) return;
@@ -3017,16 +2663,6 @@ var HavenClient = class {
       request
     });
   }
-  attachMppResumeState(err, challenge, idempotencyKey, request) {
-    if (!(err instanceof HavenPaymentStateError)) return;
-    if (!isMppRail(err.state.rail)) return;
-    err.resumeState = this.buildMppResumeState({
-      paymentId: err.state.paymentId,
-      challenge,
-      idempotencyKey,
-      request
-    });
-  }
   // ── Tool Execution (for agent frameworks) ────────────────────────
   /**
    * Execute a tool call by name and input.
@@ -3085,29 +2721,6 @@ var HavenClient = class {
         return this.toolError(err);
       }
     }
-    if (toolName === "authorize_machine_payment") {
-      const { challenge, idempotencyKey } = input;
-      try {
-        const receipt = await this.authorizeMachinePayment(challenge, { idempotencyKey });
-        return {
-          success: true,
-          payment_id: receipt.paymentId,
-          tx_hash: receipt.txHash,
-          token: receipt.token,
-          amount: receipt.amount,
-          to: receipt.to,
-          resource_url: receipt.resourceUrl,
-          explorer_url: receipt.explorerUrl,
-          proof_header: receipt.proofHeader,
-          rail: receipt.rail,
-          challenge_id: receipt.challengeId,
-          payer: receipt.payer,
-          chain_id: receipt.chainId
-        };
-      } catch (err) {
-        return this.toolError(err);
-      }
-    }
     if (toolName === "get_payment_status") {
       const { payment_id } = input;
       const result = await this.getPaymentStatus(payment_id);
@@ -3455,7 +3068,7 @@ var toolDescriptions = {
   payX402OneShot: {
     summary: "Fetch an x402 paid HTTP resource in a single call. Handles the full probe -> pay -> retry round trip and returns the merchant response.",
     selectionGuidance: "Prefer this over the quote+pay split when the agent just wants the paid resource and does not need to inspect the price first. If you already have a quote from haven_quote_x402, use haven_pay_x402_quote instead. Do not use for read-only allowance, budget, spend-limit, remaining-amount, reset-period, or what-can-I-spend questions; use the allowance lookup tool instead.",
-    behavior: "Calls the URL, parses any HTTP 402 x402 challenge, signs the EIP-3009 payment from the delegate wallet, asks Haven for a Safe AllowanceModule top-up if needed, then retries the original request with the X-PAYMENT header and returns the merchant response. If the resource returns an MPP machine-payment challenge instead of standard x402, the MPP payment path is used automatically. If the resource returns a non-402 status, returns it unchanged without contacting Haven.",
+    behavior: "Calls the URL, parses any HTTP 402 x402 challenge, signs the EIP-3009 payment from the delegate wallet, asks Haven for a Safe AllowanceModule top-up if needed, then retries the original request with the X-PAYMENT header and returns the merchant response. If the resource returns a non-402 status, returns it unchanged without contacting Haven.",
     nextActionGuidance: "If approval is needed, preserve the returned resume_state or paymentId and call the resume tool once nextAction=retry_original_x402_request. If the response carries phase=insufficient_funds and nextAction=fund_safe_or_raise_allowance, the payment cannot be retried until the originating Safe is funded or the agent allowance raised \u2014 stop and tell the user the shortfall reported on the response."
   },
   resumeX402: {
@@ -3463,29 +3076,17 @@ var toolDescriptions = {
     behavior: "Accepts either resume_state or payment_id, validates the original x402 details against the approved Haven funding, and retries the merchant request with the X-PAYMENT header. No new Haven approval is created.",
     nextActionGuidance: "Only use when get_payment_status returns nextAction=retry_original_x402_request; do not start a new merchant session."
   },
-  quoteMpp: {
-    summary: "Inspect a Haven MPP challenge or paid MPP URL without creating a Haven payment, signature, approval, or on-chain transaction.",
-    behavior: "Parses an MPP challenge envelope and returns a typed quote with rail tag, amount, asset, and merchant context. Pure read-only \u2014 Haven is not contacted.",
-    nextActionGuidance: "On success the returned quote is the input to haven_pay_mpp_challenge. Do not call the merchant again \u2014 Haven re-uses the captured request when paying."
-  },
-  payMpp: {
-    summary: "Pay an inspected MPP challenge. The delegate key signs locally; Haven only validates and relays signed, on-chain-constrained payment transactions.",
-    selectionGuidance: "Do not use this for read-only allowance, budget, spend-limit, remaining-amount, reset-period, or what-can-I-spend questions; use the allowance lookup tool instead.",
-    behavior: "Authorizes the payment through Haven within the on-chain allowance, signs the challenge proof, and returns the proof header for retrying the original paid resource.",
-    nextActionGuidance: "If approval is needed, preserve resume_state or payment_id and wait for nextAction=retry_original_x402_request before resuming."
-  },
-  resumeMpp: {
-    summary: "Resume an MPP payment after the Haven wallet owner approved the funding step.",
-    behavior: "Accepts either resume_state or payment_id and retries the original paid resource with the MPP proof header. No new Haven approval is created.",
-    nextActionGuidance: ""
-  },
+  // #1328: quoteMpp / payMpp / resumeMpp (the mpp_demo challenge/quote/resume
+  // fragments) are retired along with the client surface they described —
+  // MACHINE-PAYMENT-CHALLENGE was never produced by anything besides the now
+  // deleted `/demo/mpp/*` route. Use the x402 fragments above instead.
   getPaymentStatus: {
     summary: "Fetch structured Haven payment status, including phase and nextAction taxonomy for agent recovery.",
     behavior: "Accepts a payment intent or approval request id and returns the full state taxonomy (phase, nextAction, rail, amount, merchant, resource url, idempotency key, message).",
     nextActionGuidance: ""
   },
   getResumeState: {
-    summary: "Rehydrate stored x402 or MPP resume_state by payment_id.",
+    summary: "Rehydrate stored x402 resume_state by payment_id.",
     behavior: "Returns the context that the agent originally received in a pending-approval response, reconstructed from Haven's database. This is context only; signing still happens locally when a resume tool is called.",
     nextActionGuidance: ""
   },
@@ -3522,18 +3123,18 @@ var toolDescriptions = {
   discoverTools: {
     summary: "Step 1 of a purchase: discover payable services from Haven's curated merchant catalog \u2014 names, prices, and which pay tool to use next.",
     selectionGuidance: "Use this when the user asks what the agent can buy, pay for, or which paid services exist \u2014 or when you need a resource URL for a service the user described. Do NOT use for balance, budget, or spend-limit questions \u2014 use haven_get_allowances. Do NOT use to pay \u2014 each returned entry names the pay tool to use next.",
-    behavior: "Use each entry's suggested_tool field first \u2014 it names the exact next call. Read-only lookup against Haven's curated catalog; entries are periodically re-verified against the live merchant and degraded entries are flagged. Returns name, description, price, rail, resource URL, tool_name, tool_arguments, and suggested_tool. The catalog price (price_display/price_atomic, marked price_is_indicative) is a last-verified hint, NOT authoritative \u2014 the real price comes from the merchant's live 402 at pay time. Never creates a payment, signature, or approval.",
-    nextActionGuidance: "Pick an entry and pay it with the tool named in suggested_tool, passing the entry's resource_url, tool_name, and tool_arguments for MCP merchants. Confirm the price from the live pay-tool result (not the catalog), and pass max_amount when the user has a cap."
+    behavior: "Use each entry's suggested_tool field first \u2014 it names the exact next call. Read-only lookup against Haven's curated catalog; entries are periodically re-verified against the live merchant and degraded entries are flagged. Use category for a case-insensitive category filter (for example, VPN or vpn), or search for a product name, category, or description term. Returns name, description, price, rail, resource URL, tool_name, tool_arguments, and suggested_tool. The catalog price (price_display/price_atomic, marked price_is_indicative) is a last-verified hint, NOT authoritative \u2014 the real price comes from the merchant's live 402 at pay time. Never creates a payment, signature, or approval.",
+    nextActionGuidance: `Pick an entry and pay it with the tool named in suggested_tool, passing the entry's resource_url, tool_name, and tool_arguments for MCP merchants. Confirm the price from the live pay-tool result (not the catalog), and pass the user's cap as max_amount_human in whole tokens ("no more than 1 USDC" \u2192 max_amount_human: "1") \u2014 never convert it to atomic units by hand (#1351).`
   },
   sweep_delegate: {
     summary: "Sweep stranded USDC and/or ETH from the delegate wallet back to the originating Safe.",
-    selectionGuidance: "Use this when the user instructs you to recover stranded funds on the delegate wallet, or when a payment status returns nextAction=sweep_stranded_funds. Do NOT use for normal payments \u2014 use haven_pay_x402 or haven_pay_mpp_challenge. Do NOT use to read balances only \u2014 use haven_get_allowances.",
+    selectionGuidance: "Use this when the user instructs you to recover stranded funds on the delegate wallet, or when a payment status returns nextAction=sweep_stranded_funds. Do NOT use for normal payments \u2014 use haven_pay_x402. Do NOT use to read balances only \u2014 use haven_get_allowances.",
     behavior: "Reads the delegate EOA's on-chain USDC and ETH balances. For each non-zero balance, signs and submits a transfer from the delegate EOA to the originating Safe (hardcoded destination). The delegate key signs locally \u2014 Haven never sees it and the backend never constructs signed transactions (CASP/MiCA Red Line #2). Returns tx hashes and recovered amounts. Returns an empty transfers list when nothing is stranded.",
     nextActionGuidance: "If transfers is non-empty, confirm the amounts with the user. No further action required \u2014 funds are on their way back to the Safe."
   },
   send: {
     summary: "Send ETH or USDC directly from the agent's Haven wallet to a recipient address.",
-    selectionGuidance: "Use this for plain transfers \u2014 refunding a user, paying a freelancer, topping up a co-agent's wallet, or moving funds between addresses. Do NOT use for x402 paid endpoints (use haven_pay_x402 instead) or MPP merchant payments (use haven_pay_mpp_challenge). Do NOT use for read-only allowance, budget, or what-can-I-spend questions \u2014 use haven_get_allowances.",
+    selectionGuidance: "Use this for plain transfers \u2014 refunding a user, paying a freelancer, topping up a co-agent's wallet, or moving funds between addresses. Do NOT use for x402 paid endpoints \u2014 use haven_pay_x402 instead. Do NOT use for read-only allowance, budget, or what-can-I-spend questions \u2014 use haven_get_allowances.",
     behavior: "Sends the requested amount through the Safe AllowanceModule. Amounts within the remaining on-chain allowance for the asset execute automatically; amounts that exceed the allowance are queued as pending_approval for the wallet owner to approve in Haven. The agent's signing key signs the AllowanceModule transfer hash; Haven never receives the key.",
     nextActionGuidance: "If pending_approval is returned, preserve the payment_id and wait for the wallet owner to approve in Haven. Poll haven_get_payment_status until nextAction=none."
   }
@@ -3649,22 +3250,11 @@ var resumeX402Schema = {
   },
   required: ["payment_id", "url", "payTo", "amount", "asset", "network"]
 };
-var authorizeMachinePaymentSchema = {
-  type: "object",
-  properties: {
-    challenge: {
-      type: "object",
-      description: "Machine payment challenge returned by a Haven demo endpoint"
-    }
-  },
-  required: ["challenge"]
-};
 var MAKE_PAYMENT_DESCRIPTION = "Request and sign a payment from the user-controlled Safe within approved on-chain limits. For read-only allowance, budget, spend-limit, remaining-amount, or reset-period questions, use get_allowances instead of making a payment. Haven authenticates the agent, validates the signed intent, and relays the Safe AllowanceModule transaction; it does not hold keys or control funds. Gnosis Chain tokens: EURe, USDC.e, xDAI. Base tokens: USDC, ETH.";
 var GET_STATUS_DESCRIPTION = toolDescriptions.getPaymentStatus.summary + " Accepts payment intent IDs and approval request IDs. Returns the current status, phase, next_action, transaction hash if available, and payment details.";
 var GET_ALLOWANCES_DESCRIPTION = composeDescription(toolDescriptions.getAllowances);
 var AUTHORIZE_X402_DESCRIPTION = composeDescription(toolDescriptions.payX402) + " In this SDK tool set, the allowance lookup tool is get_allowances. When a paid API returns x402 payment requirements, use this tool to sign with the agent-owned delegate key and request a policy-limited Safe AllowanceModule top-up when needed. Haven relays signed transactions only; the agent key authorizes payment and on-chain limits enforce spend. If this returns pending_approval, tell the user it is waiting in Haven, preserve the original merchant/MCP session and x402 details, call get_payment_status later, and use resume_x402_payment only when next_action is retry_original_x402_request. Do not start a new merchant session or loop retries while approval is pending. Use the returned payment_header as the X-PAYMENT header on the retry request when doing a manual HTTP retry.";
 var RESUME_X402_DESCRIPTION = toolDescriptions.resumeX402.summary + " Use this only after get_payment_status returns next_action=retry_original_x402_request. It checks the approved payment, validates the original x402 details, and returns a merchant X-PAYMENT header without creating a new approval request or merchant session.";
-var AUTHORIZE_MACHINE_PAYMENT_DESCRIPTION = composeDescription(toolDescriptions.payMpp) + " In this SDK tool set, the allowance lookup tool is get_allowances. Currently scoped to the internal MPP demo rail. The agent signs the payment, Haven relays it within the on-chain allowance, and the tool returns a proof header for the retry request.";
 var SWEEP_DELEGATE_DESCRIPTION = composeDescription(toolDescriptions.sweep_delegate);
 var sweepDelegateSchema = {
   type: "object",
@@ -3698,11 +3288,6 @@ function claudeTools() {
       description: RESUME_X402_DESCRIPTION,
       input_schema: resumeX402Schema
     },
-    {
-      name: "authorize_machine_payment",
-      description: AUTHORIZE_MACHINE_PAYMENT_DESCRIPTION,
-      input_schema: authorizeMachinePaymentSchema
-    },
     {
       name: "haven_sweep_delegate",
       description: SWEEP_DELEGATE_DESCRIPTION,
@@ -3752,14 +3337,6 @@ function openaiTools() {
         parameters: resumeX402Schema
       }
     },
-    {
-      type: "function",
-      function: {
-        name: "authorize_machine_payment",
-        description: AUTHORIZE_MACHINE_PAYMENT_DESCRIPTION,
-        parameters: authorizeMachinePaymentSchema
-      }
-    },
     {
       type: "function",
       function: {
@@ -3835,10 +3412,13 @@ normal, not an error.
 
 1. \`mcp__haven__haven_discover_tools\` to find a payable service and its
    \`catalog_id\`.
-2. \`mcp__haven__haven_prepare_catalog_purchase\` with \`catalog_id\` and
-   \`max_amount\`. \`max_amount\` (atomic units) is REQUIRED on this tool, and
-   is best practice on every paid call below too \u2014 it caps what the LIVE
-   merchant quote may charge, checked before any funding intent is created.
+2. \`mcp__haven__haven_prepare_catalog_purchase\` with \`catalog_id\` and a
+   spending cap. A cap is REQUIRED on this tool and is best practice on every
+   paid call below too \u2014 it caps what the LIVE merchant quote may charge,
+   checked before any funding intent is created. Write it the way the user
+   said it: \`max_amount_human\` is whole tokens, so "no more than 1 USDC" is
+   \`max_amount_human: "1"\`. (\`max_amount\` is the atomic-unit form, where
+   "1" means 0.000001 USDC \u2014 do not convert by hand, and never send both.)
 3. Then FOLLOW THE RESPONSE'S GUIDANCE FIELDS: \`next_action\`, \`next_tool\`,
    and \`next_arguments\` name the exact next call \u2014 act on those first; the
    prose in this section is fallback and debugging detail. If the catalog
@@ -3846,9 +3426,11 @@ normal, not an error.
    \`mcp__haven__haven_pay_mcp_tool\` (merchant URL, tool name, arguments) as
    the manual fallback.
 
-**Signing:** \`mcp__haven-signer__haven_sign_x402\` with \`payment_id\` and
-\`payment_required\` ONLY \u2014 the local signer fetches the exact signing bytes
-itself, so never relay \`typed_data\` yourself. Fallback for an older signer
+**Signing:** \`mcp__haven-signer__haven_sign_x402\` with \`payment_id\` ONLY \u2014
+the local signer fetches the exact signing bytes AND \`payment_required\`
+itself, so never relay \`typed_data\` or the 402 blob yourself. If the signer
+reports its fetched context carried no \`payment_required\` (older backend),
+re-call with \`payment_required\` added verbatim. Fallback for an older signer
 or backend: re-run the quote/prepare tool with the SAME \`idempotency_key\`
 plus \`include_signing_payload=true\`, then pass \`payload_hash\`,
 \`x402_expected\` (the nested \`x402.expected\` object), and
@@ -3918,8 +3500,14 @@ present and surface \`message\` or \`error\` verbatim. Common cases:
 - \`pending_approval\`: queued for the user's approval (see above).
 - \`insufficient_funds\`: the Haven wallet doesn't hold enough of that token.
   Suggest the user add funds in the Haven dashboard.
-- \`PRICE_EXCEEDS_MAX\`: the live merchant price exceeded your \`max_amount\`.
-  No funds moved; ask the user before retrying with a higher cap.
+- \`PRICE_EXCEEDS_MAX\`: the live merchant price exceeded your cap. No funds
+  moved; ask the user before retrying with a higher one.
+- \`AMBIGUOUS_MAX_AMOUNT\`: you sent both \`max_amount\` and
+  \`max_amount_human\`. Nothing was contacted or spent \u2014 re-send with exactly
+  one (\`max_amount_human\` for a cap the user stated in tokens).
+- \`MAX_AMOUNT_UNCONVERTIBLE\`: \`max_amount_human\` does not fit this quote's
+  asset \u2014 unknown decimals, or more decimal places than the asset supports.
+  Round the cap, or send an exact atomic \`max_amount\`.
 - \`PAYMENT_WINDOW_EXPIRED\`: re-run the quote/prepare tool with the same
   \`idempotency_key\`, then sign the fresh payload.
 - \`MERCHANT_REJECTED_AFTER_FUNDING\`: the merchant refused the paid retry.
@@ -3938,10 +3526,12 @@ present and surface \`message\` or \`error\` verbatim. Common cases:
 ## Reporting after a purchase
 
 A settled \`mcp__haven__haven_settle_mcp_tool\` response carries
-\`agent_summary\` and the remaining post-purchase allowance in \`allowance\` \u2014
-report the amount paid and what is left from those fields directly. Do not
-call \`haven_get_agent\` or \`haven_get_allowances\` again just to report a
-purchase you already made.
+\`agent_summary.purchase_summary\` and the remaining post-purchase allowance
+in \`allowance\` \u2014 report the product, Haven-derived payment/transaction
+fields, and what is left from those fields directly. \`result\` is optional
+raw merchant evidence; never use it to decide whether the purchase was paid.
+Do not call \`haven_get_agent\` or \`haven_get_allowances\` again just to
+report a purchase you already made.
 
 ## Revoke
 
@@ -3952,7 +3542,7 @@ for that credential.
 var SKILL_FOLDER_NAME = "haven-pay";
 
 // src/node-version.ts
-var HAVEN_MINIMUM_NODE_VERSION = "24.0.0";
+var HAVEN_MINIMUM_NODE_VERSION = "22.0.0";
 function parseNodeVersion(value) {
   const match = value.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
   if (!match) return [0, 0, 0];
@@ -4139,6 +3729,6 @@ function sameUrl(a, b) {
   }
 }
 
-export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, DISCOVERY_MAX_BYTES, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_MD, HavenApiError, HavenClient, HavenError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, MerchantTimeoutError, RECEIPT_VERSION, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, SignerRefusalCode, TRANSFER_WITH_AUTHORIZATION_TYPES, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildMachinePaymentIdempotencyKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodeMachinePaymentProof, encodePaymentProof, havenTools, isSupportedNodeVersion, isSweepableChain, parseMachinePaymentChallenge, parseMachinePaymentChallengeResponse, parsePaymentRequired, parsePaymentRequiredResponse, sameUrl, selectPaymentOption, selectStandardPaymentOption, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, verifyPaymentReceipt, verifySignature, x402AuthorizationAmount };
+export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, DISCOVERY_MAX_BYTES, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_MD, HavenApiError, HavenClient, HavenError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, MerchantTimeoutError, RECEIPT_VERSION, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, SignerRefusalCode, TRANSFER_WITH_AUTHORIZATION_TYPES, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isSupportedNodeVersion, isSweepableChain, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectPaymentOption, selectStandardPaymentOption, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, verifyPaymentReceipt, verifySignature, x402AuthorizationAmount };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map