@haven_ai/sdk 0.1.24-alpha.0 → 0.1.26-alpha.0

package/dist/index.d.cts

@@ -1063,6 +1063,42 @@ declare class X402UnexpectedStatusError extends HavenApiError {
     readonly x402ErrorCode: "unexpected_non_402_status";
     constructor(message: string, statusCode: number);
 }
+/**
+ * #1521: the idempotency key resolved to a payment that has already settled,
+ * and the delegate can no longer fund a fresh authorization for it.
+ *
+ * This is the typed form of "you already bought this". It exists because the
+ * alternative was indefensible: the SDK used to mint a new EIP-3009
+ * authorization against the spent delegate and hand it back paired with the
+ * ORIGINAL payment's `txHash`, so the caller learned what had happened only
+ * from a merchant-side balance error that reads identically to a broken
+ * payment rail.
+ *
+ * `receipt` is the ORIGINAL payment — a real receipt for real settled funds,
+ * deliberately carrying no `paymentHeader`, because any header minted here
+ * would be exactly the unfundable artifact this error replaces.
+ */
+declare class X402AlreadySettledError extends HavenApiError {
+    readonly receipt: X402Receipt;
+    /**
+     * `settled` — the delegate was checked on-chain and cannot fund a fresh
+     * authorization, so this payment demonstrably completed.
+     * `unverifiable` — no `chainRpcs` entry for the chain, so fundability
+     * could not be established either way. Same refusal, weaker claim; say
+     * which, rather than assert what was not checked.
+     */
+    readonly basis: 'settled' | 'unverifiable';
+    readonly x402ErrorCode: "already_settled";
+    constructor(message: string, receipt: X402Receipt, 
+    /**
+     * `settled` — the delegate was checked on-chain and cannot fund a fresh
+     * authorization, so this payment demonstrably completed.
+     * `unverifiable` — no `chainRpcs` entry for the chain, so fundability
+     * could not be established either way. Same refusal, weaker claim; say
+     * which, rather than assert what was not checked.
+     */
+    basis: 'settled' | 'unverifiable');
+}
 declare class HavenPaymentStateError extends HavenApiError {
     readonly state: PaymentStatusResult;
     resumeState?: X402ResumeState;
@@ -1758,8 +1794,18 @@ declare class HavenClient {
      * balance — otherwise it rejects with "Payment verification failed". The
      * SDK's local path already does this (see authorizeStandardX402); the hosted
      * split flow regressed when the 5→3 collapse removed the incidental
-     * inter-call latency that used to mask it. No-op when the funding tx hash or
-     * a chain RPC (chainRpcs[chainId]) is unavailable.
+     * inter-call latency that used to mask it.
+     *
+     * **NOT a no-op when the funding tx hash is absent** (#1508). The WAIT is
+     * skipped without a hash or a chain RPC, but the `GET /payments/:id` read
+     * below runs UNCONDITIONALLY — it is how the fallback hash and the chainId
+     * are obtained. That distinction is load-bearing: this method must never be
+     * called on a scheme with no funding leg, because the read itself fails once
+     * the intent reaches a status the backend maps to a non-2xx (`submitted` is a
+     * 409), turning a settled payment into a reported error. The previous wording
+     * here said "No-op when the funding tx hash ... is unavailable", and the
+     * hosted erc7710 path was written against that promise — see
+     * `deliverMerchantPayment`'s `noFundingLeg` option.
      */
     ensureFundingConfirmed(paymentId: string, fundingTxHash?: string): Promise<void>;
     completeX402MerchantCall(input: {
@@ -1768,6 +1814,16 @@ declare class HavenClient {
         paymentId: string;
         paymentHeader: string;
         mcpTransport?: X402McpTransport;
+        /**
+         * #1508: the payment settles with NO funding leg (erc7710). This method was
+         * written for EIP-3009 and encodes that lifecycle in two places — the
+         * readiness gate wants `confirmed`, and a Haven funding tx hash is
+         * mandatory. Neither is reachable on a scheme where the MERCHANT redeems
+         * the delegation chain: the intent sits at `submitted` by design, and there
+         * is no Haven-submitted transaction at all. Set this to take the
+         * no-funding-leg path through both.
+         */
+        noFundingLeg?: boolean;
     }): Promise<{
         status: number;
         ok: boolean;
@@ -1805,6 +1861,25 @@ declare class HavenClient {
      * small propagation window as a trade-off for not configuring an RPC URL.
      */
     private waitForFundingTx;
+    /**
+     * Can the delegate EOA still fund an authorization for `amountAtomic`?
+     *
+     * #1521: the only question that separates a legitimate resume (funding
+     * confirmed, merchant never paid — the delegate still holds the money) from
+     * a replayed settled payment (funding confirmed, merchant paid, delegate
+     * spent). The intent's own `status: 'confirmed'` is identical in both.
+     *
+     * The balance is asked of the CHAIN rather than of Haven's bookkeeping on
+     * purpose: the merchant-settlement evidence record is written by this SDK
+     * *after* the merchant call, so a client that dies between the two leaves
+     * the backend believing the merchant was never paid — the exact case the
+     * discriminator has to get right. The chain cannot be behind in that way.
+     *
+     * Returns `null` — never a guess — when `chainRpcs` has no entry for the
+     * chain or the read fails. Callers must treat that as "unverifiable", not
+     * as "funded".
+     */
+    private delegateCanFund;
     private throwIfNonSignableAuthorizationState;
     private throwPaymentStateError;
     private paymentStateFromRaw;
@@ -2449,4 +2524,4 @@ declare function discoverMerchantMcpUrl(inputUrl: string): Promise<string | null
 /** Trailing-slash/percent-case echoes compare equal; unparseable never does. */
 declare function sameUrl(a: string, b: string): boolean;
 
-export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, type AgentNextStep, type AgentPaymentEnumSchema, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, type AgentPaymentSummary, type AgentPaymentWarning, AgentPaymentWarningCode, type AgentPurchaseSummary, type ClaudeTool, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, type HavenAgent, type HavenAgentAllowanceSummary, type HavenAgentReadiness, type HavenAgentSummary, type HavenAllowance, type HavenAllowanceSummary, HavenApiError, type HavenCatalogEntry, HavenClient, type HavenClientConfig, HavenError, type HavenPaymentReceipt, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, type MachinePaymentRail, MerchantTimeoutError, type OpenAITool, type PaymentFee, type PaymentIntent, type PaymentNextAction, type PaymentPhase, type PaymentReceipt, type PaymentRequest, type PaymentResult, type PaymentResumeState, type PaymentStatus, type PaymentStatusResult, type PendingApproval, type PostPurchaseAllowanceSummary, RECEIPT_VERSION, type ReceiptVerification, type ResumeAuthorizedX402Input, type ResumeX402PaymentInput, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, type SharedToolKey, type SignData, SignerRefusalCode, type SweepAuthorization, type SweepEip712Domain, type SweepEntry, type SweepExpectedAuth, type SweepPreparation, type SweepPrepareResponse, type SweepResult, type SweepSubmitResponse, type SweepSubmitResult, type SweepTypedData, TRANSFER_WITH_AUTHORIZATION_TYPES, type ToolDescription, type UnsupportedNodeVersionMessageOptions, type X402AuthorizationOptions, type X402Erc7710Settlement, type X402ExpectedAuth, type X402ExpectedContext, type X402Intent, type X402McpCallContext, type X402McpTransport, type X402MerchantCallContext, type X402PaymentHeaderContext, X402PaymentHeaderValidationError, type X402PaymentOption, type X402PaymentRequired, type X402Quote, type X402Receipt, type X402RequestSnapshot, type X402ResumeState, type X402SchemeSelection, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };
+export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, type AgentNextStep, type AgentPaymentEnumSchema, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, type AgentPaymentSummary, type AgentPaymentWarning, AgentPaymentWarningCode, type AgentPurchaseSummary, type ClaudeTool, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, type HavenAgent, type HavenAgentAllowanceSummary, type HavenAgentReadiness, type HavenAgentSummary, type HavenAllowance, type HavenAllowanceSummary, HavenApiError, type HavenCatalogEntry, HavenClient, type HavenClientConfig, HavenError, type HavenPaymentReceipt, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, type MachinePaymentRail, MerchantTimeoutError, type OpenAITool, type PaymentFee, type PaymentIntent, type PaymentNextAction, type PaymentPhase, type PaymentReceipt, type PaymentRequest, type PaymentResult, type PaymentResumeState, type PaymentStatus, type PaymentStatusResult, type PendingApproval, type PostPurchaseAllowanceSummary, RECEIPT_VERSION, type ReceiptVerification, type ResumeAuthorizedX402Input, type ResumeX402PaymentInput, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, type SharedToolKey, type SignData, SignerRefusalCode, type SweepAuthorization, type SweepEip712Domain, type SweepEntry, type SweepExpectedAuth, type SweepPreparation, type SweepPrepareResponse, type SweepResult, type SweepSubmitResponse, type SweepSubmitResult, type SweepTypedData, TRANSFER_WITH_AUTHORIZATION_TYPES, type ToolDescription, type UnsupportedNodeVersionMessageOptions, X402AlreadySettledError, type X402AuthorizationOptions, type X402Erc7710Settlement, type X402ExpectedAuth, type X402ExpectedContext, type X402Intent, type X402McpCallContext, type X402McpTransport, type X402MerchantCallContext, type X402PaymentHeaderContext, X402PaymentHeaderValidationError, type X402PaymentOption, type X402PaymentRequired, type X402Quote, type X402Receipt, type X402RequestSnapshot, type X402ResumeState, type X402SchemeSelection, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };

package/dist/index.d.ts

@@ -1063,6 +1063,42 @@ declare class X402UnexpectedStatusError extends HavenApiError {
     readonly x402ErrorCode: "unexpected_non_402_status";
     constructor(message: string, statusCode: number);
 }
+/**
+ * #1521: the idempotency key resolved to a payment that has already settled,
+ * and the delegate can no longer fund a fresh authorization for it.
+ *
+ * This is the typed form of "you already bought this". It exists because the
+ * alternative was indefensible: the SDK used to mint a new EIP-3009
+ * authorization against the spent delegate and hand it back paired with the
+ * ORIGINAL payment's `txHash`, so the caller learned what had happened only
+ * from a merchant-side balance error that reads identically to a broken
+ * payment rail.
+ *
+ * `receipt` is the ORIGINAL payment — a real receipt for real settled funds,
+ * deliberately carrying no `paymentHeader`, because any header minted here
+ * would be exactly the unfundable artifact this error replaces.
+ */
+declare class X402AlreadySettledError extends HavenApiError {
+    readonly receipt: X402Receipt;
+    /**
+     * `settled` — the delegate was checked on-chain and cannot fund a fresh
+     * authorization, so this payment demonstrably completed.
+     * `unverifiable` — no `chainRpcs` entry for the chain, so fundability
+     * could not be established either way. Same refusal, weaker claim; say
+     * which, rather than assert what was not checked.
+     */
+    readonly basis: 'settled' | 'unverifiable';
+    readonly x402ErrorCode: "already_settled";
+    constructor(message: string, receipt: X402Receipt, 
+    /**
+     * `settled` — the delegate was checked on-chain and cannot fund a fresh
+     * authorization, so this payment demonstrably completed.
+     * `unverifiable` — no `chainRpcs` entry for the chain, so fundability
+     * could not be established either way. Same refusal, weaker claim; say
+     * which, rather than assert what was not checked.
+     */
+    basis: 'settled' | 'unverifiable');
+}
 declare class HavenPaymentStateError extends HavenApiError {
     readonly state: PaymentStatusResult;
     resumeState?: X402ResumeState;
@@ -1758,8 +1794,18 @@ declare class HavenClient {
      * balance — otherwise it rejects with "Payment verification failed". The
      * SDK's local path already does this (see authorizeStandardX402); the hosted
      * split flow regressed when the 5→3 collapse removed the incidental
-     * inter-call latency that used to mask it. No-op when the funding tx hash or
-     * a chain RPC (chainRpcs[chainId]) is unavailable.
+     * inter-call latency that used to mask it.
+     *
+     * **NOT a no-op when the funding tx hash is absent** (#1508). The WAIT is
+     * skipped without a hash or a chain RPC, but the `GET /payments/:id` read
+     * below runs UNCONDITIONALLY — it is how the fallback hash and the chainId
+     * are obtained. That distinction is load-bearing: this method must never be
+     * called on a scheme with no funding leg, because the read itself fails once
+     * the intent reaches a status the backend maps to a non-2xx (`submitted` is a
+     * 409), turning a settled payment into a reported error. The previous wording
+     * here said "No-op when the funding tx hash ... is unavailable", and the
+     * hosted erc7710 path was written against that promise — see
+     * `deliverMerchantPayment`'s `noFundingLeg` option.
      */
     ensureFundingConfirmed(paymentId: string, fundingTxHash?: string): Promise<void>;
     completeX402MerchantCall(input: {
@@ -1768,6 +1814,16 @@ declare class HavenClient {
         paymentId: string;
         paymentHeader: string;
         mcpTransport?: X402McpTransport;
+        /**
+         * #1508: the payment settles with NO funding leg (erc7710). This method was
+         * written for EIP-3009 and encodes that lifecycle in two places — the
+         * readiness gate wants `confirmed`, and a Haven funding tx hash is
+         * mandatory. Neither is reachable on a scheme where the MERCHANT redeems
+         * the delegation chain: the intent sits at `submitted` by design, and there
+         * is no Haven-submitted transaction at all. Set this to take the
+         * no-funding-leg path through both.
+         */
+        noFundingLeg?: boolean;
     }): Promise<{
         status: number;
         ok: boolean;
@@ -1805,6 +1861,25 @@ declare class HavenClient {
      * small propagation window as a trade-off for not configuring an RPC URL.
      */
     private waitForFundingTx;
+    /**
+     * Can the delegate EOA still fund an authorization for `amountAtomic`?
+     *
+     * #1521: the only question that separates a legitimate resume (funding
+     * confirmed, merchant never paid — the delegate still holds the money) from
+     * a replayed settled payment (funding confirmed, merchant paid, delegate
+     * spent). The intent's own `status: 'confirmed'` is identical in both.
+     *
+     * The balance is asked of the CHAIN rather than of Haven's bookkeeping on
+     * purpose: the merchant-settlement evidence record is written by this SDK
+     * *after* the merchant call, so a client that dies between the two leaves
+     * the backend believing the merchant was never paid — the exact case the
+     * discriminator has to get right. The chain cannot be behind in that way.
+     *
+     * Returns `null` — never a guess — when `chainRpcs` has no entry for the
+     * chain or the read fails. Callers must treat that as "unverifiable", not
+     * as "funded".
+     */
+    private delegateCanFund;
     private throwIfNonSignableAuthorizationState;
     private throwPaymentStateError;
     private paymentStateFromRaw;
@@ -2449,4 +2524,4 @@ declare function discoverMerchantMcpUrl(inputUrl: string): Promise<string | null
 /** Trailing-slash/percent-case echoes compare equal; unparseable never does. */
 declare function sameUrl(a: string, b: string): boolean;
 
-export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, type AgentNextStep, type AgentPaymentEnumSchema, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, type AgentPaymentSummary, type AgentPaymentWarning, AgentPaymentWarningCode, type AgentPurchaseSummary, type ClaudeTool, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, type HavenAgent, type HavenAgentAllowanceSummary, type HavenAgentReadiness, type HavenAgentSummary, type HavenAllowance, type HavenAllowanceSummary, HavenApiError, type HavenCatalogEntry, HavenClient, type HavenClientConfig, HavenError, type HavenPaymentReceipt, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, type MachinePaymentRail, MerchantTimeoutError, type OpenAITool, type PaymentFee, type PaymentIntent, type PaymentNextAction, type PaymentPhase, type PaymentReceipt, type PaymentRequest, type PaymentResult, type PaymentResumeState, type PaymentStatus, type PaymentStatusResult, type PendingApproval, type PostPurchaseAllowanceSummary, RECEIPT_VERSION, type ReceiptVerification, type ResumeAuthorizedX402Input, type ResumeX402PaymentInput, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, type SharedToolKey, type SignData, SignerRefusalCode, type SweepAuthorization, type SweepEip712Domain, type SweepEntry, type SweepExpectedAuth, type SweepPreparation, type SweepPrepareResponse, type SweepResult, type SweepSubmitResponse, type SweepSubmitResult, type SweepTypedData, TRANSFER_WITH_AUTHORIZATION_TYPES, type ToolDescription, type UnsupportedNodeVersionMessageOptions, type X402AuthorizationOptions, type X402Erc7710Settlement, type X402ExpectedAuth, type X402ExpectedContext, type X402Intent, type X402McpCallContext, type X402McpTransport, type X402MerchantCallContext, type X402PaymentHeaderContext, X402PaymentHeaderValidationError, type X402PaymentOption, type X402PaymentRequired, type X402Quote, type X402Receipt, type X402RequestSnapshot, type X402ResumeState, type X402SchemeSelection, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };
+export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, type AgentNextStep, type AgentPaymentEnumSchema, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, type AgentPaymentSummary, type AgentPaymentWarning, AgentPaymentWarningCode, type AgentPurchaseSummary, type ClaudeTool, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, type HavenAgent, type HavenAgentAllowanceSummary, type HavenAgentReadiness, type HavenAgentSummary, type HavenAllowance, type HavenAllowanceSummary, HavenApiError, type HavenCatalogEntry, HavenClient, type HavenClientConfig, HavenError, type HavenPaymentReceipt, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, type MachinePaymentRail, MerchantTimeoutError, type OpenAITool, type PaymentFee, type PaymentIntent, type PaymentNextAction, type PaymentPhase, type PaymentReceipt, type PaymentRequest, type PaymentResult, type PaymentResumeState, type PaymentStatus, type PaymentStatusResult, type PendingApproval, type PostPurchaseAllowanceSummary, RECEIPT_VERSION, type ReceiptVerification, type ResumeAuthorizedX402Input, type ResumeX402PaymentInput, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, type SharedToolKey, type SignData, SignerRefusalCode, type SweepAuthorization, type SweepEip712Domain, type SweepEntry, type SweepExpectedAuth, type SweepPreparation, type SweepPrepareResponse, type SweepResult, type SweepSubmitResponse, type SweepSubmitResult, type SweepTypedData, TRANSFER_WITH_AUTHORIZATION_TYPES, type ToolDescription, type UnsupportedNodeVersionMessageOptions, X402AlreadySettledError, type X402AuthorizationOptions, type X402Erc7710Settlement, type X402ExpectedAuth, type X402ExpectedContext, type X402Intent, type X402McpCallContext, type X402McpTransport, type X402MerchantCallContext, type X402PaymentHeaderContext, X402PaymentHeaderValidationError, type X402PaymentOption, type X402PaymentRequired, type X402Quote, type X402Receipt, type X402RequestSnapshot, type X402ResumeState, type X402SchemeSelection, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };

package/dist/index.js

@@ -275,6 +275,17 @@ var X402UnexpectedStatusError = class extends HavenApiError {
     this.name = "X402UnexpectedStatusError";
   }
 };
+var X402AlreadySettledError = class extends HavenApiError {
+  constructor(message, receipt, basis) {
+    super(message, 409, void 0, receipt.paymentId);
+    this.receipt = receipt;
+    this.basis = basis;
+    this.name = "X402AlreadySettledError";
+  }
+  receipt;
+  basis;
+  x402ErrorCode = "already_settled";
+};
 var HavenPaymentStateError = class extends HavenApiError {
   constructor(message, statusCode, state, body) {
     super(message, statusCode, body, state.paymentId);
@@ -951,8 +962,8 @@ function createJsonRpcProvider(url) {
 function createWallet(privateKey, provider) {
   return new ethers.Wallet(privateKey, provider);
 }
-function createErc20Contract(address, abi, signer) {
-  return new ethers.Contract(address, abi, signer);
+function createErc20Contract(address, abi, runner) {
+  return new ethers.Contract(address, abi, runner);
 }
 
 // src/client.ts
@@ -1932,7 +1943,6 @@ var HavenClient = class {
     }
   }
   async authorizeStandardX402(paymentRequired, option, idempotencyKey) {
-    const paymentHeader = await this.createStandardX402Header(paymentRequired, option);
     const raw = await this.post("/x402", {
       url: paymentRequired.resource.url,
       payTo: this.delegateAddress,
@@ -1947,12 +1957,30 @@ var HavenClient = class {
       // declaration keeps both writers of the 3009 shape loud-by-default.
       settlementScheme: "eip3009"
     });
+    const state = this.paymentStateFromRaw("x402 payment", raw);
+    const executedReplay = raw.success && raw.tx_hash ? "idempotency-collision" : state?.nextAction === AgentPaymentNextAction.RetryOriginalX402Request ? "approval-resume" : null;
+    if (executedReplay) {
+      const canFund = await this.delegateCanFund(
+        raw.chain_id ?? state?.chainId ?? chainIdFromNetwork(option.network),
+        option.asset,
+        x402AuthorizationAmount(option)
+      );
+      const refuse = executedReplay === "idempotency-collision" ? canFund !== true : canFund === false;
+      if (refuse) {
+        const settledReceipt = state && executedReplay === "approval-resume" ? this.mapX402ReceiptFromStatus(paymentRequired, option, void 0, state) : this.mapX402ReceiptFromAuthorization(paymentRequired, option, void 0, raw);
+        throw new X402AlreadySettledError(
+          canFund === false ? "This x402 payment already settled \u2014 the delegate no longer holds the funds to authorize it again. To buy the same item a second time, pass a distinct `idempotencyKey`; the synthesised key intentionally collapses repeat calls for the same product within a 5-minute window so a retried request cannot pay twice." : "This x402 payment already settled, and whether the delegate can still fund a new authorization could not be verified (no `chainRpcs` entry for this chain). Refusing rather than issue an authorization that may be unfundable. To buy the same item a second time, pass a distinct `idempotencyKey`; to finish an interrupted payment, resume it by `paymentId`.",
+          settledReceipt,
+          canFund === false ? "settled" : "unverifiable"
+        );
+      }
+    }
+    const paymentHeader = await this.createStandardX402Header(paymentRequired, option);
     if (raw.success && raw.tx_hash) {
       const receipt2 = this.mapX402ReceiptFromAuthorization(paymentRequired, option, paymentHeader, raw);
       this.cacheX402Receipt(idempotencyKey, paymentHeader, receipt2);
       return receipt2;
     }
-    const state = this.paymentStateFromRaw("x402 payment", raw);
     if (state?.nextAction === AgentPaymentNextAction.RetryOriginalX402Request) {
       const receipt2 = this.mapX402ReceiptFromStatus(paymentRequired, option, paymentHeader, state);
       this.cacheX402Receipt(idempotencyKey, paymentHeader, receipt2);
@@ -2133,6 +2161,18 @@ var HavenClient = class {
     if (cached && cached.expiresAt > Date.now()) return cached.receipt;
     const status = await this.getPaymentStatus(input.paymentId);
     this.assertCanResumeX402(status, input.paymentRequired, option);
+    const canFund = await this.delegateCanFund(
+      status.chainId ?? chainIdFromNetwork(option.network),
+      option.asset,
+      x402AuthorizationAmount(option)
+    );
+    if (canFund === false) {
+      throw new X402AlreadySettledError(
+        `x402 payment ${status.paymentId} has already settled \u2014 the delegate no longer holds the funds to authorize it again, so there is nothing left to resume.`,
+        this.mapX402ReceiptFromStatus(input.paymentRequired, option, void 0, status),
+        "settled"
+      );
+    }
     const paymentHeader = await this.createStandardX402Header(input.paymentRequired, option);
     const receipt = this.mapX402ReceiptFromStatus(input.paymentRequired, option, paymentHeader, status);
     this.cacheX402Receipt(idempotencyKey, paymentHeader, receipt);
@@ -2463,8 +2503,18 @@ var HavenClient = class {
    * balance — otherwise it rejects with "Payment verification failed". The
    * SDK's local path already does this (see authorizeStandardX402); the hosted
    * split flow regressed when the 5→3 collapse removed the incidental
-   * inter-call latency that used to mask it. No-op when the funding tx hash or
-   * a chain RPC (chainRpcs[chainId]) is unavailable.
+   * inter-call latency that used to mask it.
+   *
+   * **NOT a no-op when the funding tx hash is absent** (#1508). The WAIT is
+   * skipped without a hash or a chain RPC, but the `GET /payments/:id` read
+   * below runs UNCONDITIONALLY — it is how the fallback hash and the chainId
+   * are obtained. That distinction is load-bearing: this method must never be
+   * called on a scheme with no funding leg, because the read itself fails once
+   * the intent reaches a status the backend maps to a non-2xx (`submitted` is a
+   * 409), turning a settled payment into a reported error. The previous wording
+   * here said "No-op when the funding tx hash ... is unavailable", and the
+   * hosted erc7710 path was written against that promise — see
+   * `deliverMerchantPayment`'s `noFundingLeg` option.
    */
   async ensureFundingConfirmed(paymentId, fundingTxHash) {
     const status = await this.getPaymentStatus(paymentId);
@@ -2473,8 +2523,10 @@ var HavenClient = class {
   async completeX402MerchantCall(input) {
     const evidenceContext = await this.resolveX402MerchantCompletionContext({
       paymentId: input.paymentId,
-      url: input.url
+      url: input.url,
+      noFundingLeg: input.noFundingLeg === true
     });
+    const fundingTxHash = evidenceContext.txHash;
     const shouldHandshakeMcp = isMcpUrl(input.url) || input.mcpTransport?.handshakeRequired === true;
     const x402Wallet = shouldHandshakeMcp ? await this.resolveX402WalletForMerchantCall() : this.x402PayerAddress();
     let mcpSessionId;
@@ -2498,33 +2550,37 @@ var HavenClient = class {
       body = text;
     }
     if (!surfaced.ok) {
-      await this.recordMerchantRetryRejected({
-        rail: "x402",
-        paymentId: evidenceContext.paymentId,
-        txHash: evidenceContext.txHash,
-        resourceUrl: evidenceContext.resourceUrl,
-        merchant: {
-          merchant_status: surfaced.status,
-          merchant_status_text: surfaced.statusText,
-          merchant_headers: Object.fromEntries(surfaced.headers.entries()),
-          merchant_body: text
-        },
-        details: {
-          merchant_to: evidenceContext.merchantAddress
-        }
-      });
+      if (!input.noFundingLeg && fundingTxHash) {
+        await this.recordMerchantRetryRejected({
+          rail: "x402",
+          paymentId: evidenceContext.paymentId,
+          txHash: fundingTxHash,
+          resourceUrl: evidenceContext.resourceUrl,
+          merchant: {
+            merchant_status: surfaced.status,
+            merchant_status_text: surfaced.statusText,
+            merchant_headers: Object.fromEntries(surfaced.headers.entries()),
+            merchant_body: text
+          },
+          details: {
+            merchant_to: evidenceContext.merchantAddress
+          }
+        });
+      }
     } else {
-      await this.reportMachinePaymentEvidence({
-        paymentId: evidenceContext.paymentId,
-        rail: "x402",
-        txHash: evidenceContext.txHash,
-        resourceUrl: evidenceContext.resourceUrl,
-        merchantStatus: surfaced.status,
-        paymentProofHeaderName: "X-PAYMENT",
-        paymentProofHeader: input.paymentHeader,
-        protocolReceiptHeaderName: protocolReceiptHeader ? "PAYMENT-RESPONSE" : void 0,
-        protocolReceiptHeader
-      });
+      if (!input.noFundingLeg && fundingTxHash) {
+        await this.reportMachinePaymentEvidence({
+          paymentId: evidenceContext.paymentId,
+          rail: "x402",
+          txHash: fundingTxHash,
+          resourceUrl: evidenceContext.resourceUrl,
+          merchantStatus: surfaced.status,
+          paymentProofHeaderName: "X-PAYMENT",
+          paymentProofHeader: input.paymentHeader,
+          protocolReceiptHeaderName: protocolReceiptHeader ? "PAYMENT-RESPONSE" : void 0,
+          protocolReceiptHeader
+        });
+      }
       await this.reportMerchantReceipt(evidenceContext.paymentId, surfaced);
     }
     return {
@@ -2570,11 +2626,11 @@ var HavenClient = class {
         status
       );
     }
-    const readyForMerchantCompletion = status.nextAction === AgentPaymentNextAction.RetryOriginalX402Request || status.kind === "payment_intent" && status.status === "confirmed" && status.phase === AgentPaymentPhase.PaymentConfirmed && status.nextAction === AgentPaymentNextAction.None;
+    const readyForMerchantCompletion = input.noFundingLeg ? status.kind === "payment_intent" && status.status === "submitted" : status.nextAction === AgentPaymentNextAction.RetryOriginalX402Request || status.kind === "payment_intent" && status.status === "confirmed" && status.phase === AgentPaymentPhase.PaymentConfirmed && status.nextAction === AgentPaymentNextAction.None;
     if (!readyForMerchantCompletion) {
       throw new HavenPaymentStateError(status.message, PAYMENT_STATE_STATUS_CODES[status.status] ?? 409, status);
     }
-    if (!status.txHash) {
+    if (!input.noFundingLeg && !status.txHash) {
       throw new HavenApiError(
         `x402 payment ${status.paymentId} is ready for merchant completion but has no Haven transaction hash.`,
         502,
@@ -2844,6 +2900,45 @@ var HavenClient = class {
       );
     }
   }
+  /**
+   * Can the delegate EOA still fund an authorization for `amountAtomic`?
+   *
+   * #1521: the only question that separates a legitimate resume (funding
+   * confirmed, merchant never paid — the delegate still holds the money) from
+   * a replayed settled payment (funding confirmed, merchant paid, delegate
+   * spent). The intent's own `status: 'confirmed'` is identical in both.
+   *
+   * The balance is asked of the CHAIN rather than of Haven's bookkeeping on
+   * purpose: the merchant-settlement evidence record is written by this SDK
+   * *after* the merchant call, so a client that dies between the two leaves
+   * the backend believing the merchant was never paid — the exact case the
+   * discriminator has to get right. The chain cannot be behind in that way.
+   *
+   * Returns `null` — never a guess — when `chainRpcs` has no entry for the
+   * chain or the read fails. Callers must treat that as "unverifiable", not
+   * as "funded".
+   */
+  async delegateCanFund(chainId, tokenAddress, amountAtomic, timeoutMs = 1e4) {
+    if (!chainId || !this.delegateAddress) return null;
+    const rpcUrl = this.chainRpcs[chainId];
+    if (!rpcUrl) return null;
+    try {
+      const provider = createJsonRpcProvider(rpcUrl);
+      const token = createErc20Contract(
+        tokenAddress,
+        ["function balanceOf(address) view returns (uint256)"],
+        provider
+      );
+      const balance = await Promise.race([
+        token.balanceOf(this.delegateAddress),
+        new Promise((resolve) => setTimeout(() => resolve(null), timeoutMs).unref?.())
+      ]);
+      if (balance === null) return null;
+      return balance >= BigInt(amountAtomic);
+    } catch {
+      return null;
+    }
+  }
   throwIfNonSignableAuthorizationState(label, raw) {
     if (raw.status === "pending_signature") return;
     this.throwPaymentStateError(label, raw);
@@ -4024,6 +4119,6 @@ function sameUrl(a, b) {
   }
 }
 
-export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, HavenApiError, HavenClient, HavenError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, MerchantTimeoutError, RECEIPT_VERSION, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, SignerRefusalCode, TRANSFER_WITH_AUTHORIZATION_TYPES, X402PaymentHeaderValidationError, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };
+export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, HavenApiError, HavenClient, HavenError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, MERCHANT_DISCOVERY_PATHS, MerchantTimeoutError, RECEIPT_VERSION, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, SignerRefusalCode, TRANSFER_WITH_AUTHORIZATION_TYPES, X402AlreadySettledError, X402PaymentHeaderValidationError, X402UnexpectedStatusError, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, decodeBase64Json, decodeBase64Utf8, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parsePaymentRequired, parsePaymentRequiredResponse, resolveTokenFromAddress, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map