@haven_ai/sdk 0.1.33-alpha.0 → 0.1.34-alpha.0

package/dist/index.cjs

@@ -617,6 +617,7 @@ function normalizePaymentRequired(value) {
   const resourceUrl = candidate.resource?.url ?? first.resource;
   if (!resourceUrl) return null;
   const resource = {
+    ...candidate.resource && typeof candidate.resource === "object" ? candidate.resource : {},
     url: resourceUrl,
     description: candidate.resource?.description ?? first.description,
     mimeType: candidate.resource?.mimeType ?? first.mimeType
@@ -691,6 +692,17 @@ function x402PaymentHeaderNamesFor(paymentHeader) {
 function x402PaymentHeaderNamesSent(paymentHeader) {
   return x402PaymentHeaderNamesFor(paymentHeader).join(", ");
 }
+function x402V2PaymentEnvelope(paymentRequired, accepted, payload) {
+  const resource = paymentRequired.resource;
+  const extensions = paymentRequired.extensions;
+  return {
+    x402Version: paymentRequired.x402Version,
+    ...resource && typeof resource === "object" && !Array.isArray(resource) ? { resource } : {},
+    accepted,
+    payload,
+    ...extensions && typeof extensions === "object" && !Array.isArray(extensions) ? { extensions } : {}
+  };
+}
 function parsePaymentRequired(response) {
   const v2Header = response.headers.get("PAYMENT-REQUIRED");
   if (v2Header) {
@@ -870,7 +882,15 @@ async function validateStandardX402PaymentHeader(paymentHeader, context) {
         throw new Error("context");
       }
     } else {
-      if (!hasOnlyKeys(decoded, ["x402Version", "accepted", "payload"])) throw new Error("shape");
+      if (!hasOnlyKeys(decoded, ["x402Version", "accepted", "payload"], ["resource", "extensions"])) {
+        throw new Error("shape");
+      }
+      if ("resource" in decoded && (!decoded.resource || typeof decoded.resource !== "object" || Array.isArray(decoded.resource))) {
+        throw new Error("shape");
+      }
+      if ("extensions" in decoded && (!decoded.extensions || typeof decoded.extensions !== "object" || Array.isArray(decoded.extensions))) {
+        throw new Error("shape");
+      }
       const accepted = selectStandardPaymentOption([decoded.accepted]);
       if (!accepted || !matchesHeaderContext(accepted, context)) throw new Error("context");
     }
@@ -922,8 +942,8 @@ async function validateStandardX402PaymentHeader(paymentHeader, context) {
     throw new X402PaymentHeaderValidationError();
   }
 }
-function hasOnlyKeys(value, allowed) {
-  return Object.keys(value).every((key) => allowed.includes(key)) && allowed.every((key) => key in value);
+function hasOnlyKeys(value, required, optional = []) {
+  return Object.keys(value).every((key) => required.includes(key) || optional.includes(key)) && required.every((key) => key in value);
 }
 function sameAddress2(left, right) {
   return left.toLowerCase() === right.toLowerCase();
@@ -2128,11 +2148,7 @@ var X402FundingLeg = class {
     );
     if (paymentRequired.x402Version < 2) return header;
     const payment = decodeBase64Json(header);
-    return encodeBase64Json({
-      x402Version: paymentRequired.x402Version,
-      accepted: option,
-      payload: payment.payload
-    });
+    return encodeBase64Json(x402V2PaymentEnvelope(paymentRequired, option, payment.payload));
   }
   // ── Receipt mapping ──────────────────────────────────────────────
   receiptFromAuthorization(paymentRequired, option, paymentHeader, raw, execResult) {
@@ -2343,6 +2359,16 @@ var X402Erc7710 = class {
     const amountAtomic = x402AuthorizationAmount(option);
     const raw = await this.post("/x402", {
       url: options.resourceUrl ?? paymentRequired.resource?.url,
+      // #2373: the full 402 challenge, persisted verbatim by the backend
+      // (#1355) so the settle handoff can echo its resource/extensions into
+      // the X-PAYMENT envelope (#2361). This scheme decomposes the challenge
+      // into the fields below for AUTHORITY; the stored copy exists for the
+      // echo, which cannot be reconstructed from the decomposition — omitting
+      // it is how every erc7710 payment failed a merchant that enforces the
+      // spec's extensions-echo MUST. Same ≤64KB guard and omission behaviour
+      // as the 3009 path (client.ts): an oversized challenge omits the field
+      // rather than failing the payment, and the settle echo then omits too.
+      ...new TextEncoder().encode(JSON.stringify(paymentRequired)).length <= 65536 ? { paymentRequired } : {},
       // payTo = the MERCHANT is what selects direct settlement server-side.
       // The explicit settlementScheme must AGREE with that shape (#1360) —
       // disagreement is a 400 by design, so that a stale delegate address
@@ -4369,8 +4395,14 @@ The paid call always obtains a fresh quote before it creates any intent. Then
 continue \`mcp__haven__haven_pay_mcp_tool\` \u2192
 \`mcp__haven-signer__haven_sign\` \u2192 \`mcp__haven__haven_submit\` \u2192
 \`mcp__haven-signer__haven_x402_sign_header\` \u2192
-\`mcp__haven__haven_complete_mcp_tool\`. Pass \`payment_required\`,
-\`arguments\`, and \`mcp_transport\` verbatim from the quote/prepare result.
+\`mcp__haven__haven_complete_mcp_tool\`. Call that last step with
+\`payment_id\` and the signer's \`payment_header\` ONLY. It does not take
+\`payment_required\`: Haven rehydrates the merchant call context
+(\`merchant_url\`, \`tool_name\`, \`arguments\`, \`mcp_transport\`) and the
+402 server-side from \`payment_id\`, exactly as at settle. Pass that context
+explicitly only as a version-skew fallback when Haven has no stored context
+for the id \u2014 \`merchant_url\` and \`tool_name\` both or none together, never
+just one.
 The returned \`expires_at\` is the signing window; if a tool returns
 \`PAYMENT_WINDOW_EXPIRED\`, re-run the same quote/prepare tool with the same
 \`idempotency_key\`. Do not call the merchant yourself \u2014 Haven completes the
@@ -4652,5 +4684,6 @@ exports.verifySignature = verifySignature;
 exports.x402AssetTransferMethod = x402AssetTransferMethod;
 exports.x402AuthorizationAmount = x402AuthorizationAmount;
 exports.x402FacilitatorAddresses = x402FacilitatorAddresses;
+exports.x402V2PaymentEnvelope = x402V2PaymentEnvelope;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map