@haven_ai/sdk 0.4.0-alpha.0 → 0.5.0-alpha.1

package/dist/index.js

@@ -1,464 +1,13 @@
-import { recoverTypedDataAddress, hashTypedData } from 'viem';
+import { selectStandardPaymentOption, buildX402IdempotencyKey, x402AuthorizationAmount, assertBoundDirectPaymentUserOp, HavenTypedDataRefusedError, assertOwnSettlementChild, parsePaymentRequiredResponse, x402PaymentHeaderNamesSent, SDK_CLIENT_IDENTITY, readClientUpdate, HAVEN_CLIENT_HEADER, resolveTokenFromAddress, isSweepableChain, sweepUsdcAddress, x402PaymentHeaderNamesFor, X402_PAYMENT_HEADER_NAMES, toStandardPaymentRequirements, decodeBase64Json, encodeBase64Json, x402V2PaymentEnvelope, selectX402SettlementScheme, selectErc7710PaymentOption, isErc7710Option, x402AssetTransferMethod, normalizePaymentRequired } from './chunk-KQ7JXKTV.js';
+export { DEFAULT_NEXT_TOOL_BY_ACTION, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_CLIENT_HEADER, HAVEN_MINIMUM_NODE_VERSION, HavenTypedDataRefusedError, NEXT_TOOL_SERVER_NAMES, NEXT_TOOL_SERVER_ROLES, SDK_CLIENT_IDENTITY, SDK_VERSION, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, TRANSFER_WITH_AUTHORIZATION_TYPES, TYPED_DATA_NOT_ALLOWED, X402PaymentHeaderValidationError, X402_LEGACY_PAYMENT_HEADER_NAME, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_PAYMENT_HEADER_NAME, X402_PAYMENT_HEADER_NAMES_SENT, X402_PAYMENT_REQUIRED_HEADER_NAME, X402_PAYMENT_RESPONSE_HEADER_NAME, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, assertBoundDirectPaymentUserOp, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, createNextStepBuilder, decodeBase64Json, decodeBase64Utf8, defaultNextToolFor, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenClientIdentity, isErc7710Option, isSupportedNodeVersion, isSweepableChain, normalizePaymentRequired, parseNextTool, parsePaymentRequired, parsePaymentRequiredResponse, readClientUpdate, renderNextTool, resolveTokenFromAddress, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses, x402V2PaymentEnvelope } from './chunk-KQ7JXKTV.js';
+import { HavenSigningError, HavenError, DEFAULT_CONFIRMATION_TIMEOUT_MS, HavenApiError, assertUserOpTypedDataBinding, AgentPaymentRail, AgentPaymentPhase, HavenTimeoutError, X402UnexpectedStatusError, X402AlreadySettledError, AgentPaymentWarningCode, MerchantTimeoutError, AgentPaymentNextAction, HavenPaymentStateError, HavenZeroSettlementHashError, chainIdForNetwork } from './chunk-GLNG2GF7.js';
+export { AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, CONNECTOR_PACKAGE_NAME, DEFAULT_CONFIRMATION_TIMEOUT_MS, DIRECT_SIGN_CONTEXT_VERSION, ENTRY_POINT_V07, HAVEN_CONNECTOR_CHANNEL, HYBRID_DELEGATOR_DOMAIN_NAME, HYBRID_DELEGATOR_DOMAIN_VERSION, HavenApiError, HavenError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, HavenUserOpBindingError, HavenZeroSettlementHashError, MerchantTimeoutError, PACKED_USER_OPERATION_FIELDS, ROOT_AUTHORITY, SIGNER_UPDATE_FALLBACK, SignerRefusalCode, X402AlreadySettledError, X402UnexpectedStatusError, assertUserOpTypedDataBinding, connectorRerunCommand, connectorSpec, deriveDelegateAccountAddress, isConnectorChannel, isPackedUserOperationTypedData, packedUserOperationHash, resolveConnectorChannel, signerUpdateFallback, verifySettlementChild } from './chunk-GLNG2GF7.js';
+import { hashTypedData } from 'viem';
 import { ethers } from 'ethers';
-import { createHash } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
 import { exact } from 'x402/schemes';
 import { privateKeyToAccount } from 'viem/accounts';
 
-// src/client.ts
-
-// src/connector-channel.ts
-var CONNECTOR_PACKAGE_NAME = "@haven_ai/connect";
-var HAVEN_CONNECTOR_CHANNEL = "alpha";
-var CHANNEL_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
-function isConnectorChannel(value) {
-  return CHANNEL_PATTERN.test(value);
-}
-function resolveConnectorChannel(raw, fallback = HAVEN_CONNECTOR_CHANNEL) {
-  const trimmed = (raw ?? "").trim();
-  if (trimmed === "") return fallback;
-  if (!isConnectorChannel(trimmed)) {
-    throw new Error(
-      `HAVEN_CONNECTOR_CHANNEL is set to ${JSON.stringify(raw)}, which is not a valid npm dist-tag (lowercase letter first, then letters, digits or hyphens). Refusing to start rather than fall back to the default channel, because falling back would hand out the production connector while looking configured.`
-    );
-  }
-  return trimmed;
-}
-function connectorSpec(channel = HAVEN_CONNECTOR_CHANNEL) {
-  return `${CONNECTOR_PACKAGE_NAME}@${channel}`;
-}
-function connectorRerunCommand(args, options) {
-  const channel = options?.channel ?? HAVEN_CONNECTOR_CHANNEL;
-  const flags = options?.npxFlags ? `${options.npxFlags} ` : "";
-  const command = `npx ${flags}${connectorSpec(channel)}`;
-  return args ? `${command} ${args}` : command;
-}
-
-// src/types.ts
-var DEFAULT_CONFIRMATION_TIMEOUT_MS = 9e4;
-var AgentPaymentPhase = {
-  /** The agent must sign and submit the prepared payment before Haven can relay it. */
-  AgentSignatureRequired: "agent_signature_required",
-  /** Haven has received the signed payment and the agent should poll for confirmation. */
-  PaymentSubmitted: "payment_submitted",
-  /** The direct payment is confirmed; the agent does not need to do more for this payment id. */
-  PaymentConfirmed: "payment_confirmed",
-  /**
-   * #2115: RETIRED wire value — no live rail produces it. It described the
-   * Safe rail's approval queue, which no longer exists. Kept so a stored value
-   * still typechecks; see `AgentPaymentPhaseDescriptions` below for the
-   * agent-visible wording, which this comment used to contradict.
-   */
-  UserApprovalRequired: "user_approval_required",
-  /** #2115: RETIRED wire value — no live rail produces it. Stop and tell the user. */
-  UserExecutionRequired: "user_execution_required",
-  /** #2115: RETIRED wire value — no live rail produces it. Stop and tell the user. */
-  WaitingForAdditionalApprovals: "waiting_for_additional_approvals",
-  /** The Haven funding leg was sent; the agent can continue the merchant/protocol leg. */
-  FundingSent: "funding_sent",
-  /** The payment was rejected and cannot proceed; the agent should stop and tell the user. */
-  Rejected: "rejected",
-  /** The payment expired before completion. */
-  Expired: "expired",
-  /** Haven could not complete the payment; the agent should stop and surface the failure. */
-  Failed: "failed",
-  /**
-   * Pre-flight check determined the delegate's existing balance plus the
-   * remaining on-chain budget cannot cover the requested amount, so no
-   * payment intent was created. The account must be funded or the agent's
-   * budget raised before retrying — #2115: the old wording contrasted this
-   * with `UserApprovalRequired` as if that were a live alternative, and named
-   * the retired rail's Safe and per-token allowance as the fix.
-   */
-  InsufficientFunds: "insufficient_funds",
-  /**
-   * Haven's funding leg (account → delegate, the #946 EIP-3009 bridge)
-   * confirmed on-chain, but the merchant rejected the x402 retry. The delegate
-   * wallet may hold stranded USDC that was never settled to the merchant. The
-   * agent should stop, tell the user, and wait for the sweep flow to reclaim
-   * the funds.
-   */
-  FundedButUnsettled: "funded_but_unsettled"
-};
-var AgentPaymentNextAction = {
-  /** Sign with the delegate key and submit the payment to Haven. */
-  SignAndSubmitPayment: "sign_and_submit_payment",
-  /** Poll getPaymentStatus later using this payment id. */
-  CheckStatusLater: "check_status_later",
-  /** No further agent action is required for this payment id. */
-  None: "none",
-  /**
-   * #2115: RETIRED wire value — no live rail produces it and nothing maps to
-   * it. Stop and tell the user rather than polling; no approval will arrive.
-   */
-  WaitForUserApproval: "wait_for_user_approval",
-  /** #2115: RETIRED wire value — no live rail produces it. Stop and tell the user rather than polling. */
-  WaitForUserToCompletePayment: "wait_for_user_to_complete_payment",
-  /** Resume this payment id and retry the original x402 request with the merchant payment header. */
-  RetryOriginalX402Request: "retry_original_x402_request",
-  /** Stop retrying this payment and tell the user what happened. */
-  StopAndTellUser: "stop_and_tell_user",
-  /** Ask again only if the user still wants the payment after expiry. */
-  RequestAgainIfUserStillWantsIt: "request_again_if_user_still_wants_it",
-  /** #1307: retry the SAME tool call, supplying the explicit context fields the server could not rehydrate. */
-  RetryWithExplicitContext: "retry_with_explicit_context",
-  /**
-   * The x402 funding/quote window expired. Re-quote the same logical merchant
-   * operation with the same idempotency key to stay double-charge-safe.
-   */
-  PaymentWindowExpired: "payment_window_expired",
-  /**
-   * Stop and tell the user that the originating account needs to be funded or
-   * the agent's per-token allowance needs to be raised before the payment
-   * can succeed. A user approval will not fix this state on its own.
-   *
-   * #2914: the account-vocabulary spelling, and the only one — the
-   * pre-#2907 `fund_safe_or_raise_allowance` wire value (and the
-   * `AgentPaymentNextActionAccountAlias` seam #2908 added to bridge it) are
-   * retired along with the rest of the #2908 compatibility window.
-   */
-  FundAccountOrRaiseAllowance: "fund_account_or_raise_allowance",
-  /**
-   * The delegate wallet may hold funds that were sent from the Safe but never
-   * settled to the merchant. The wallet owner should initiate a sweep to
-   * return those funds to the originating Safe.
-   */
-  SweepStrandedFunds: "sweep_stranded_funds",
-  /**
-   * #2970: a `submitted` erc7710 x402 intent whose settlement window has
-   * passed with no on-chain settlement evidence Haven could verify. Distinct
-   * from {@link CheckStatusLater}, which this REPLACES once the window is
-   * past — but it is not futile: Haven's settlement sweep (120s tick) scans
-   * each candidate over its own window plus a 120s clock-skew allowance, so
-   * it can still attribute the settlement for a short while after this value
-   * first appears. Poll {@link CheckStatusLater}'s tool
-   * (`haven_get_payment_status`) once more, roughly two minutes later; if it
-   * still shows no evidence, tell the user the goods were delivered but
-   * Haven holds no verified settlement evidence for this payment. If the
-   * agent holds the merchant's real settlement transaction hash (from
-   * `PAYMENT-RESPONSE`'s `transaction` field, or a prior settle/complete
-   * result's `settlement_tx_hash`), report it with the hosted
-   * `haven_report_settlement_evidence` tool instead of waiting —
-   * `haven_report_x402_outcome` takes no hash and refuses a non-`confirmed`
-   * intent.
-   */
-  AwaitingSettlementEvidence: "awaiting_settlement_evidence"
-};
-var AgentPaymentFailureCode = {
-  /** A merchant-authoritative x402 price exceeds the caller's pre-funding max_amount cap. */
-  PriceExceedsMax: "PRICE_EXCEEDS_MAX",
-  /** The x402 funding/quote window expired before the signer or hosted settle step could finish. */
-  PaymentWindowExpired: "PAYMENT_WINDOW_EXPIRED",
-  /** The merchant rejected the paid retry. On eip3009 the funding leg had succeeded (sweep);
-   *  on erc7710 there is no funding leg — nothing to sweep, follow the message (#2983). */
-  MerchantRejectedAfterFunding: "MERCHANT_REJECTED_AFTER_FUNDING",
-  /** #1300 review: funding is on-chain but the merchant never ANSWERED the
-   *  paid retry within the timeout. NOT proof of rejection — the merchant
-   *  may still settle late, so the guidance is verify-then-act. On eip3009
-   *  the funding leg had succeeded (verify-then-sweep); on erc7710 there is
-   *  no funding leg — nothing to sweep, follow the message (#3000). */
-  MerchantUnresponsiveAfterFunding: "MERCHANT_UNRESPONSIVE_AFTER_FUNDING",
-  /**
-   * #1307: the caller omitted merchant_url/tool_name (asking Haven to
-   * rehydrate the stored MCP merchant-call context by payment_id), but no
-   * usable context was stored for this intent — either it was never an
-   * MCP-tool quote, or the stored context is incomplete. The fallback is
-   * mechanical: re-send merchant_url, tool_name, arguments, and
-   * mcp_transport explicitly (the version-skew path).
-   */
-  MerchantCallContextUnavailable: "MERCHANT_CALL_CONTEXT_UNAVAILABLE",
-  /**
-   * #1351: the caller supplied BOTH the atomic `max_amount` and the
-   * human-denominated `max_amount_human` cap for one purchase. Haven refuses
-   * to guess which the user meant — the two differ by a factor of 10^decimals,
-   * so picking wrong is exactly the silent-overspend this cap exists to
-   * prevent. Rejected before any merchant probe, funding intent, or signature.
-   */
-  AmbiguousMaxAmount: "AMBIGUOUS_MAX_AMOUNT",
-  /**
-   * #1351: a human-denominated cap was supplied, but it cannot be converted to
-   * atomic units against THIS quote — either the quote's asset has no known
-   * decimals on its network, or the cap carries more fraction digits than the
-   * asset can represent (truncating it would silently change the user's cap).
-   * The fallback is the exact atomic `max_amount`.
-   */
-  MaxAmountUnconvertible: "MAX_AMOUNT_UNCONVERTIBLE",
-  /**
-   * #2979: the merchant answered a `tools/call` probe with its own
-   * machine-readable "cannot settle right now" refusal (HTTP 503,
-   * `{ error: 'merchant_not_ready', reason_code, ... }`) instead of a 402
-   * challenge — e.g. its settlement wallet is out of gas. No 402 was ever
-   * issued and no payment was created; this is honest and (per
-   * `retry_after_s`, when present) usually transient, unlike a permanent
-   * endpoint miss.
-   */
-  MerchantNotReady: "MERCHANT_NOT_READY"
-};
-var AgentPaymentRail = {
-  /** Standard Haven payment from the user's Safe through an approved delegate allowance. */
-  Direct: "direct",
-  /** x402 HTTP 402 payment flow with a Haven funding leg and merchant retry leg. */
-  X402: "x402",
-  /** Machine Payment Protocol family — categorical value used as a resume-state discriminator. */
-  Mpp: "mpp",
-  /** Haven internal MPP demo rail. Not for production traffic. */
-  MppDemo: "mpp_demo",
-  /** Crypto-settled MPP rail. */
-  MppCrypto: "mpp_crypto",
-  /** Stripe-deposit-backed MPP rail. */
-  StripeDeposit: "stripe_deposit",
-  /** Stripe Payment Token MPP rail. */
-  Spt: "spt"
-};
-var AGENT_PAYMENT_PHASE_VALUES = Object.values(AgentPaymentPhase);
-var AGENT_PAYMENT_NEXT_ACTION_VALUES = Object.values(AgentPaymentNextAction);
-var AGENT_PAYMENT_FAILURE_CODE_VALUES = Object.values(AgentPaymentFailureCode);
-var AGENT_PAYMENT_RAIL_VALUES = Object.values(AgentPaymentRail);
-var AgentPaymentPhaseDescriptions = {
-  [AgentPaymentPhase.AgentSignatureRequired]: "The agent must sign and submit the prepared payment before Haven can relay it.",
-  [AgentPaymentPhase.PaymentSubmitted]: "Haven has received the signed payment and the agent should poll for confirmation.",
-  [AgentPaymentPhase.PaymentConfirmed]: "The direct payment is confirmed; the agent does not need to do more for this payment id.",
-  [AgentPaymentPhase.UserApprovalRequired]: "Retired wire value: no live rail produces it. It described the Safe rail's approval queue, which no longer exists \u2014 an out-of-policy payment is declined before any money moves. If it is ever seen, stop and tell the user; no approval is pending.",
-  [AgentPaymentPhase.UserExecutionRequired]: "Retired wire value: no live rail produces it. Stop and tell the user.",
-  [AgentPaymentPhase.WaitingForAdditionalApprovals]: "Retired wire value: no live rail produces it. Stop and tell the user.",
-  [AgentPaymentPhase.FundingSent]: "The Haven funding leg was sent; the agent can continue the merchant/protocol leg.",
-  [AgentPaymentPhase.Rejected]: "The payment was rejected and cannot proceed; the agent should stop and tell the user.",
-  [AgentPaymentPhase.Expired]: "The payment expired before completion.",
-  [AgentPaymentPhase.Failed]: "Haven could not complete the payment; the agent should stop and surface the failure.",
-  [AgentPaymentPhase.InsufficientFunds]: "Pre-flight check determined the delegate balance plus the remaining on-chain budget cannot cover the requested amount, so no payment was created. The account must be funded or the agent budget raised before retrying.",
-  [AgentPaymentPhase.FundedButUnsettled]: "Haven's funding leg confirmed on-chain but the merchant rejected the x402 retry. The delegate wallet may hold stranded funds. The agent should stop and wait for the wallet owner to sweep the stranded funds back to the account."
-};
-var AgentPaymentNextActionDescriptions = {
-  [AgentPaymentNextAction.SignAndSubmitPayment]: "Sign with the delegate key and submit the payment to Haven.",
-  [AgentPaymentNextAction.CheckStatusLater]: "Poll getPaymentStatus later using this payment id.",
-  [AgentPaymentNextAction.None]: "No further agent action is required for this payment id.",
-  [AgentPaymentNextAction.WaitForUserApproval]: "Retired wire value: no live rail produces it, and nothing maps to it. It described a per-payment approval queue that no longer exists. If it is ever seen, stop and tell the user rather than polling \u2014 no approval will arrive.",
-  [AgentPaymentNextAction.WaitForUserToCompletePayment]: "Retired wire value: no live rail produces it. Stop and tell the user rather than polling.",
-  [AgentPaymentNextAction.RetryOriginalX402Request]: "Resume this payment id and retry the original x402 request with the merchant payment header.",
-  [AgentPaymentNextAction.StopAndTellUser]: "Stop retrying this payment and tell the user what happened.",
-  [AgentPaymentNextAction.RequestAgainIfUserStillWantsIt]: "Ask again only if the user still wants the payment after expiry.",
-  [AgentPaymentNextAction.PaymentWindowExpired]: "The x402 funding/quote window expired. Re-quote with the same idempotency key before asking the signer to build a merchant payment header again.",
-  [AgentPaymentNextAction.FundAccountOrRaiseAllowance]: "Stop and tell the user that the account needs to be funded or the agent budget raised before the payment can succeed.",
-  [AgentPaymentNextAction.RetryWithExplicitContext]: "Retry the same tool call, this time passing merchant_url, tool_name, arguments, and mcp_transport explicitly \u2014 the server had no stored context to rehydrate for this payment id.",
-  [AgentPaymentNextAction.SweepStrandedFunds]: "Tell the user that funds may be stranded in the delegate wallet and prompt them to initiate a sweep in Haven to return them to the originating account.",
-  [AgentPaymentNextAction.AwaitingSettlementEvidence]: "The settlement window passed with no verified on-chain evidence yet. If you hold the merchant's real settlement transaction hash, report it with haven_report_settlement_evidence. Otherwise, Haven's settlement sweep may still attribute it within about two minutes \u2014 poll getPaymentStatus once more, then tell the user the goods were delivered but unverified if it still shows nothing."
-};
-var AgentPaymentFailureCodeDescriptions = {
-  [AgentPaymentFailureCode.PriceExceedsMax]: "The merchant-authoritative x402 amount exceeds the caller's max_amount cap. No funding transfer was created; ask the user before retrying with a larger cap.",
-  [AgentPaymentFailureCode.PaymentWindowExpired]: "The x402 funding/quote window expired before the signer or hosted settle step could finish. Re-quote via haven_pay_mcp_tool with the same idempotency key to avoid duplicate funding.",
-  [AgentPaymentFailureCode.MerchantRejectedAfterFunding]: "The merchant rejected the paid retry. eip3009: the funding leg succeeded \u2014 stop retrying the merchant and reconcile stranded delegate funds with haven_sweep_delegate. erc7710: no funding leg, nothing to sweep \u2014 follow the message (re-quote later, or check haven_get_payment_status after the window first).",
-  [AgentPaymentFailureCode.MerchantUnresponsiveAfterFunding]: "The merchant did not answer the paid retry before the timeout. The merchant may still settle late. eip3009: the funding leg succeeded \u2014 check haven_get_payment_status, retry haven_complete_mcp_tool once, sweep only if no settlement appears. erc7710: no funding leg, nothing to sweep, and haven_complete_mcp_tool has no erc7710 branch \u2014 do not retry it; check haven_get_payment_status after the payment window and re-quote only if it shows no settlement.",
-  [AgentPaymentFailureCode.MerchantCallContextUnavailable]: "merchant_url/tool_name were omitted and no stored merchant call context is available for this payment_id. Re-send merchant_url, tool_name, arguments, and mcp_transport explicitly.",
-  [AgentPaymentFailureCode.AmbiguousMaxAmount]: "Both max_amount (atomic units) and max_amount_human (whole tokens) were supplied for one purchase. Nothing was contacted and nothing was spent. Re-send with exactly ONE: max_amount_human for a cap the user stated in tokens, max_amount for an exact atomic figure.",
-  [AgentPaymentFailureCode.MaxAmountUnconvertible]: "max_amount_human could not be converted to atomic units against this quote's asset \u2014 either its decimals are unknown to Haven or the cap has more decimal places than the asset supports. Nothing was spent. Round the cap, or re-send it as an exact atomic max_amount.",
-  [AgentPaymentFailureCode.MerchantNotReady]: 'The merchant refused the probe with its own "cannot settle right now" signal instead of a 402 challenge. No payment was created. Often transient \u2014 retry later (see retry_after_s in the message, if given) rather than treating this as a broken or wrong endpoint.'
-};
-var AgentPaymentWarningCode = {
-  /** No max_amount cap was supplied — the live quoted price was accepted as-is. */
-  MissingMaxAmount: "MISSING_MAX_AMOUNT",
-  /** The signing window closes soon; sign promptly or re-quote with the same idempotency key. */
-  QuoteExpiresSoon: "QUOTE_EXPIRES_SOON",
-  /** The merchant URL was resolved via discovery — pass the RESOLVED url forward. */
-  MerchantUrlDiscovered: "MERCHANT_URL_DISCOVERED",
-  /**
-   * #1306: the catalog's last-verified price_atomic differs from the LIVE
-   * merchant quote for a guided catalog purchase. The catalog price is only
-   * ever indicative; the live quote in the same response is authoritative.
-   */
-  CatalogPriceDiffers: "CATALOG_PRICE_DIFFERS",
-  /**
-   * #1306: the rail-aware allowance/budget pre-check could not be read (RPC
-   * failure, etc). `sufficient` is reported as null rather than a fabricated
-   * true/false — the on-chain policy remains the actual gate either way.
-   */
-  AllowanceCheckUnavailable: "ALLOWANCE_CHECK_UNAVAILABLE",
-  /**
-   * #1319: the delegation-rail read itself SUCCEEDED, but the remaining
-   * figure it returned is the #1145 fallback (the full configured budget)
-   * rather than a live ERC20PeriodTransferEnforcer read — `sufficient` is a
-   * real true/false, just computed from an optimistic number. Distinct from
-   * {@link AgentPaymentWarningCode.AllowanceCheckUnavailable}, which fires
-   * when the read failed outright and `sufficient` degrades to null. The
-   * on-chain policy re-checks at redemption either way; this only says the
-   * guidance shown here may be optimistic.
-   */
-  AllowanceReadOptimistic: "ALLOWANCE_READ_OPTIMISTIC",
-  /**
-   * #2991: the quote tools' `expected_settlement_scheme` prediction of what
-   * `haven_prepare_catalog_purchase` / `haven_pay_mcp_tool` will actually
-   * select could not be computed — the agent's execution rail could not be
-   * read from Haven, so `expected_settlement_scheme` is `null` rather than a
-   * guess. `accepted_scheme` (the merchant's offer) is unaffected.
-   */
-  X402SchemeUnknown: "X402_SCHEME_UNKNOWN",
-  /**
-   * #2968: the merchant answered 200 and handed over goods, but Haven holds NO
-   * on-chain evidence that the payment moved. `settled: false` beside this code
-   * is not a failure — it is the absence of proof, and the two must travel
-   * together so an agent can tell "the user has the goods" apart from "the
-   * money moved". Carries the intent's `expires_at`: after that instant the
-   * settlement can no longer land at all.
-   */
-  SettlementUnconfirmed: "SETTLEMENT_UNCONFIRMED"
-};
-var AgentPaymentRailDescriptions = {
-  [AgentPaymentRail.Direct]: "Standard Haven payment from the user-controlled account, redeeming the agent's on-chain budget delegation.",
-  [AgentPaymentRail.X402]: "x402 HTTP 402 payment flow with a Haven funding leg and merchant retry leg.",
-  [AgentPaymentRail.Mpp]: "Categorical MPP rail value used as a resume-state discriminator. Response bodies carry a granular mpp_* value instead.",
-  [AgentPaymentRail.MppDemo]: "Haven internal MPP demo rail. Not for production traffic.",
-  [AgentPaymentRail.MppCrypto]: "Crypto-settled MPP rail.",
-  [AgentPaymentRail.StripeDeposit]: "Stripe-deposit-backed MPP rail.",
-  [AgentPaymentRail.Spt]: "Stripe Payment Token MPP rail."
-};
-var AgentPaymentPhaseSchema = {
-  type: "string",
-  enum: AGENT_PAYMENT_PHASE_VALUES,
-  description: "Stable Haven agent payment state phase.",
-  "x-enumDescriptions": AgentPaymentPhaseDescriptions
-};
-var AgentPaymentNextActionSchema = {
-  type: "string",
-  enum: AGENT_PAYMENT_NEXT_ACTION_VALUES,
-  description: "Stable next action an agent should take for a Haven payment state.",
-  "x-enumDescriptions": AgentPaymentNextActionDescriptions
-};
-var AgentPaymentFailureCodeSchema = {
-  type: "string",
-  enum: AGENT_PAYMENT_FAILURE_CODE_VALUES,
-  description: "Stable machine-readable failure codes for Haven agent payment recovery paths.",
-  "x-enumDescriptions": AgentPaymentFailureCodeDescriptions
-};
-var AgentPaymentRailSchema = {
-  type: "string",
-  enum: AGENT_PAYMENT_RAIL_VALUES,
-  description: "Stable rail identifier for Haven agent payment states.",
-  "x-enumDescriptions": AgentPaymentRailDescriptions
-};
-var HavenError = class extends Error {
-  constructor(message, code, statusCode, paymentId) {
-    super(message);
-    this.code = code;
-    this.statusCode = statusCode;
-    this.paymentId = paymentId;
-    this.name = "HavenError";
-  }
-  code;
-  statusCode;
-  paymentId;
-};
-var HavenApiError = class extends HavenError {
-  constructor(message, statusCode, body, paymentId) {
-    super(message, "API_ERROR", statusCode, paymentId);
-    this.body = body;
-    this.name = "HavenApiError";
-  }
-  body;
-};
-var MerchantTimeoutError = class extends HavenApiError {
-  merchantErrorCode = "merchant_timeout";
-  constructor(message) {
-    super(message, 504);
-    this.name = "MerchantTimeoutError";
-  }
-};
-var X402UnexpectedStatusError = class extends HavenApiError {
-  x402ErrorCode = "unexpected_non_402_status";
-  /**
-   * #2979: `body` is the merchant's own JSON, when the non-402 response
-   * carried one — e.g. the demo merchant's `/mcp` readiness gate answers
-   * `503 { error: 'merchant_not_ready', reason_code, ... }`. Optional and
-   * best-effort: a non-JSON or unreadable body leaves this `undefined`, same
-   * as before this field existed. Consumers key on it (not on the message
-   * string) to distinguish an honest, machine-readable merchant refusal from
-   * a genuine "this is not the x402 endpoint" miss, which otherwise look
-   * identical — both are just "some non-402 status".
-   */
-  constructor(message, statusCode, body) {
-    super(message, statusCode, body);
-    this.name = "X402UnexpectedStatusError";
-  }
-};
-var X402AlreadySettledError = class extends HavenApiError {
-  constructor(message, receipt, basis) {
-    super(message, 409, void 0, receipt.paymentId);
-    this.receipt = receipt;
-    this.basis = basis;
-    this.name = "X402AlreadySettledError";
-  }
-  receipt;
-  basis;
-  x402ErrorCode = "already_settled";
-};
-var HavenPaymentStateError = class extends HavenApiError {
-  constructor(message, statusCode, state, body) {
-    super(message, statusCode, body, state.paymentId);
-    this.state = state;
-    this.name = "HavenPaymentStateError";
-  }
-  state;
-  resumeState;
-  get status() {
-    return this.state.status;
-  }
-  get phase() {
-    return this.state.phase;
-  }
-  get nextAction() {
-    return this.state.nextAction;
-  }
-};
-var HavenSigningError = class extends HavenError {
-  constructor(message) {
-    super(message, "SIGNING_ERROR");
-    this.name = "HavenSigningError";
-  }
-};
-var HavenZeroSettlementHashError = class extends HavenError {
-  constructor(paymentId) {
-    super(
-      "settlement_tx_hash is the zero hash (0x00\u202600), which is never a real settlement transaction \u2014 refused before any report was sent.",
-      "ZERO_SETTLEMENT_HASH",
-      400,
-      paymentId
-    );
-    this.name = "HavenZeroSettlementHashError";
-  }
-};
-var SignerRefusalCode = {
-  /** `SUPPORTED_X402_EXPECTED_VERSIONS` in `@haven_ai/signer` does not include the received version. */
-  UnsupportedExpectedContextVersion: "UNSUPPORTED_EXPECTED_CONTEXT_VERSION",
-  /** `SUPPORTED_SWEEP_BINDING_VERSIONS` in `@haven_ai/signer` does not include the received version. */
-  UnsupportedSweepBindingVersion: "UNSUPPORTED_SWEEP_BINDING_VERSION"
-};
-function signerUpdateFallback(channel = HAVEN_CONNECTOR_CHANNEL) {
-  return `Update @haven_ai/signer by rerunning \`${connectorRerunCommand(void 0, { channel })}\`, which reinstalls the pinned MCP runtime, then retry the same signing call. Nothing was signed or spent \u2014 the quote or payment this version came from is unaffected and does not need to be re-quoted.`;
-}
-var SIGNER_UPDATE_FALLBACK = signerUpdateFallback();
-var HavenUnsupportedSignerVersionError = class extends HavenError {
-  constructor(message, code, supportedVersions, receivedVersion, fallback) {
-    super(message, code);
-    this.supportedVersions = supportedVersions;
-    this.receivedVersion = receivedVersion;
-    this.fallback = fallback;
-    this.name = "HavenUnsupportedSignerVersionError";
-  }
-  supportedVersions;
-  receivedVersion;
-  fallback;
-};
-var HavenTimeoutError = class extends HavenError {
-  constructor(paymentId) {
-    super(
-      `Timed out waiting for payment ${paymentId} to confirm`,
-      "TIMEOUT",
-      void 0,
-      paymentId
-    );
-    this.name = "HavenTimeoutError";
-  }
-};
-
-// src/signer.ts
 function signHash(privateKey, hash) {
   try {
     const signingKey = new ethers.SigningKey(privateKey);
@@ -509,632 +58,43 @@ function verifySignature(hash, signature, expectedAddress) {
     return false;
   }
 }
-
-// src/base64.ts
-function normalizeBase64(value) {
-  const standard = value.replace(/-/g, "+").replace(/_/g, "/");
-  const remainder = standard.length % 4;
-  return remainder === 0 ? standard : standard + "=".repeat(4 - remainder);
-}
-function encodeBase64Utf8(value) {
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(value, "utf8").toString("base64");
-  }
-  const bytes = new TextEncoder().encode(value);
-  let binary = "";
-  for (let i = 0; i < bytes.length; i++) {
-    binary += String.fromCharCode(bytes[i]);
-  }
-  return btoa(binary);
-}
-function decodeBase64Utf8(value) {
-  const normalized = normalizeBase64(value);
-  if (typeof Buffer !== "undefined") {
-    return Buffer.from(normalized, "base64").toString("utf8");
-  }
-  const binary = atob(normalized);
-  const bytes = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i++) {
-    bytes[i] = binary.charCodeAt(i);
-  }
-  return new TextDecoder().decode(bytes);
-}
-function encodeBase64Json(value) {
-  return encodeBase64Utf8(JSON.stringify(value));
-}
-function decodeBase64Json(value, label) {
-  try {
-    return JSON.parse(decodeBase64Utf8(value));
-  } catch (err) {
-    if (label) throw new Error(`Failed to decode ${label}`);
-    throw err;
-  }
-}
-
-// src/sweep.ts
-var SWEEP_BASE_CHAIN_ID = 8453;
-var SWEEP_BASE_SEPOLIA_CHAIN_ID = 84532;
-var SWEEP_BASE_USDC_ADDRESS = "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913";
-var SWEEP_BASE_SEPOLIA_USDC_ADDRESS = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";
-var USDC_EIP712_DOMAIN_BY_CHAIN = {
-  [SWEEP_BASE_CHAIN_ID]: {
-    name: "USD Coin",
-    version: "2",
-    chainId: SWEEP_BASE_CHAIN_ID,
-    verifyingContract: SWEEP_BASE_USDC_ADDRESS
-  },
-  [SWEEP_BASE_SEPOLIA_CHAIN_ID]: {
-    name: "USDC",
-    version: "2",
-    chainId: SWEEP_BASE_SEPOLIA_CHAIN_ID,
-    verifyingContract: SWEEP_BASE_SEPOLIA_USDC_ADDRESS
-  }
-};
-var USDC_ADDRESS_BY_CHAIN = {
-  [SWEEP_BASE_CHAIN_ID]: SWEEP_BASE_USDC_ADDRESS,
-  [SWEEP_BASE_SEPOLIA_CHAIN_ID]: SWEEP_BASE_SEPOLIA_USDC_ADDRESS
-};
-var SWEEPABLE_CHAIN_IDS = Object.keys(USDC_ADDRESS_BY_CHAIN).map(Number);
-function isSweepableChain(chainId) {
-  return chainId in USDC_ADDRESS_BY_CHAIN;
-}
-var TRANSFER_WITH_AUTHORIZATION_TYPES = {
-  TransferWithAuthorization: [
-    { name: "from", type: "address" },
-    { name: "to", type: "address" },
-    { name: "value", type: "uint256" },
-    { name: "validAfter", type: "uint256" },
-    { name: "validBefore", type: "uint256" },
-    { name: "nonce", type: "bytes32" }
-  ]
-};
-function sweepUsdcAddress(chainId) {
-  const address = USDC_ADDRESS_BY_CHAIN[chainId];
-  if (!address) {
-    throw new HavenSigningError(
-      `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
-    );
-  }
-  return address;
-}
-function sweepUsdcDomain(chainId) {
-  const domain = USDC_EIP712_DOMAIN_BY_CHAIN[chainId];
-  if (!domain) {
-    throw new HavenSigningError(
-      `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
-    );
-  }
-  return domain;
-}
-function sameAddress(a, b) {
-  return a.toLowerCase() === b.toLowerCase();
-}
-function buildSweepTypedData(auth) {
-  const domain = sweepUsdcDomain(auth.chainId);
-  const expectedToken = sweepUsdcAddress(auth.chainId);
-  if (!sameAddress(auth.token, expectedToken)) {
-    throw new HavenSigningError(
-      `Sweep token ${auth.token} is not the canonical USDC contract for chain ${auth.chainId}.`
-    );
-  }
-  if (!/^0x[0-9a-fA-F]{64}$/.test(auth.nonce)) {
-    throw new HavenSigningError("Sweep nonce must be a 0x-prefixed 32-byte hex string.");
-  }
-  return {
-    domain,
-    types: TRANSFER_WITH_AUTHORIZATION_TYPES,
-    primaryType: "TransferWithAuthorization",
-    message: {
-      from: auth.from,
-      to: auth.to,
-      value: BigInt(auth.value),
-      validAfter: BigInt(auth.validAfter),
-      validBefore: BigInt(auth.validBefore),
-      nonce: auth.nonce
-    }
-  };
-}
-function buildSweepAuthorizationMessage(auth) {
-  return `Haven sweep authorization v1
-${stableStringify({
-    version: 1,
-    kind: "haven.sweep.authorization",
-    from: auth.from.toLowerCase(),
-    to: auth.to.toLowerCase(),
-    value: auth.value,
-    validAfter: auth.validAfter,
-    validBefore: auth.validBefore,
-    nonce: auth.nonce.toLowerCase(),
-    token: auth.token.toLowerCase(),
-    chainId: auth.chainId
-  })}`;
-}
-function stableStringify(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map((item) => stableStringify(item)).join(",")}]`;
-  const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
-}
-
-// src/x402.ts
-var BASE_USDC_ADDRESS = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
-var BASE_SEPOLIA_USDC_ADDRESS = "0x036cbd53842c5426634e7929541ec2318f3dcf7e";
-var STANDARD_X402_USDC_ADDRESSES = /* @__PURE__ */ new Set([BASE_USDC_ADDRESS, BASE_SEPOLIA_USDC_ADDRESS]);
-var X402_IDEMPOTENCY_BUCKET_MS = 3e5;
-var DECIMAL_ATOMIC_AMOUNT_RE = /^[0-9]+$/;
-var X402_PAYMENT_HEADER_MAX_LENGTH = 65536;
-var BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
-var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
-var SIGNATURE_RE = /^0x[0-9a-fA-F]{130}$/;
-var NONCE_RE = /^0x[0-9a-fA-F]{64}$/;
-var X402PaymentHeaderValidationError = class extends Error {
-  constructor() {
-    super("Invalid X-PAYMENT header.");
-    this.name = "X402PaymentHeaderValidationError";
-  }
-};
-function isPositiveDecimalAtomicAmount(value) {
-  return DECIMAL_ATOMIC_AMOUNT_RE.test(value) && BigInt(value) > 0n;
-}
-function optionAuthorizationAmount(option) {
-  return option.maxAmountRequired ?? option.amount;
-}
-var X402_MAX_AUTHORIZATION_WINDOW_SECONDS = 600;
-var X402_SETTLEMENT_FORWARD_MARGIN_SECONDS = 300;
-function clampAuthorizationWindow(seconds) {
-  const requested = typeof seconds === "number" && Number.isFinite(seconds) ? seconds : 30;
-  return Math.min(Math.max(Math.floor(requested), 1), X402_MAX_AUTHORIZATION_WINDOW_SECONDS);
-}
-function normalizePaymentOption(value) {
-  const candidate = value;
-  if (!candidate || typeof candidate !== "object" || typeof candidate.scheme !== "string" || typeof candidate.network !== "string" || typeof candidate.asset !== "string" || typeof candidate.payTo !== "string") {
-    return null;
-  }
-  const amount = typeof candidate.amount === "string" ? candidate.amount : typeof candidate.maxAmountRequired === "string" ? candidate.maxAmountRequired : null;
-  if (!amount) return null;
-  if (!isPositiveDecimalAtomicAmount(amount)) return null;
-  if (candidate.maxAmountRequired !== void 0 && (typeof candidate.maxAmountRequired !== "string" || !isPositiveDecimalAtomicAmount(candidate.maxAmountRequired))) {
-    return null;
-  }
-  return {
-    scheme: candidate.scheme,
-    network: candidate.network,
-    amount,
-    maxAmountRequired: candidate.maxAmountRequired,
-    resource: candidate.resource,
-    description: candidate.description,
-    mimeType: candidate.mimeType,
-    asset: candidate.asset,
-    payTo: candidate.payTo,
-    // Keep the merchant offer intact for v2 `accepted` matching. Only the
-    // signing conversion may cap its authorization lifetime (#3117).
-    // Retain legacy fallback behavior for missing or unusable timeouts.
-    // Integer, because the authorize body types it `integer` and the child's
-    // timestamp caveat is built from it — the old clamp floored, so keeping a
-    // fractional value here would 400 a merchant that used to work (#3117).
-    maxTimeoutSeconds: typeof candidate.maxTimeoutSeconds === "number" && Number.isFinite(candidate.maxTimeoutSeconds) && candidate.maxTimeoutSeconds >= 1 ? Math.floor(candidate.maxTimeoutSeconds) : clampAuthorizationWindow(candidate.maxTimeoutSeconds),
-    extra: candidate.extra
-  };
-}
-function normalizePaymentRequired(value) {
-  const candidate = value;
-  if (!candidate || typeof candidate !== "object" || typeof candidate.x402Version !== "number" || !Array.isArray(candidate.accepts)) {
-    return null;
-  }
-  const accepts = candidate.accepts.map((option) => normalizePaymentOption(option)).filter((option) => !!option && typeof option === "object");
-  if (accepts.length === 0) return null;
-  const first = accepts[0];
-  const resourceUrl = candidate.resource?.url ?? first.resource;
-  if (!resourceUrl) return null;
-  const resource = {
-    ...candidate.resource && typeof candidate.resource === "object" ? candidate.resource : {},
-    url: resourceUrl,
-    description: candidate.resource?.description ?? first.description,
-    mimeType: candidate.resource?.mimeType ?? first.mimeType
-  };
-  return {
-    x402Version: candidate.x402Version,
-    resource,
-    accepts,
-    error: candidate.error,
-    ...candidate.extensions && typeof candidate.extensions === "object" ? { extensions: candidate.extensions } : {}
-  };
-}
-var SUPPORTED_X402_NETWORKS = {
-  "eip155:100": "Gnosis Chain",
-  "eip155:8453": "Base",
-  "base": "Base",
-  "eip155:84532": "Base Sepolia",
-  "base-sepolia": "Base Sepolia"
-};
-var STANDARD_X402_NETWORKS = {
-  "eip155:8453": "base",
-  "base": "base",
-  "eip155:84532": "base-sepolia",
-  "base-sepolia": "base-sepolia"
-};
-var GNOSIS_TOKENS = {
-  "0x0000000000000000000000000000000000000000": { symbol: "xDAI", decimals: 18 },
-  "0xcb444e90d8198415266c6a2724b7900fb12fc56e": { symbol: "EURe", decimals: 18 },
-  "0x2a22f9c3b484c3629090feed35f17ff8f88f76f0": { symbol: "USDC.e", decimals: 6 }
-};
-var BASE_TOKENS = {
-  "0x0000000000000000000000000000000000000000": { symbol: "ETH", decimals: 18 },
-  "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913": { symbol: "USDC", decimals: 6 }
-};
-var BASE_SEPOLIA_TOKENS = {
-  "0x0000000000000000000000000000000000000000": { symbol: "ETH", decimals: 18 },
-  "0x036cbd53842c5426634e7929541ec2318f3dcf7e": { symbol: "USDC", decimals: 6 }
-};
-var ALL_TOKENS = {
-  ...GNOSIS_TOKENS,
-  ...BASE_TOKENS,
-  ...BASE_SEPOLIA_TOKENS
-};
-var NETWORK_TOKENS = {
-  "eip155:100": GNOSIS_TOKENS,
-  "eip155:8453": BASE_TOKENS,
-  "base": BASE_TOKENS,
-  "eip155:84532": BASE_SEPOLIA_TOKENS,
-  "base-sepolia": BASE_SEPOLIA_TOKENS
-};
-var X402_PAYMENT_HEADER_NAME = "PAYMENT-SIGNATURE";
-var X402_LEGACY_PAYMENT_HEADER_NAME = "X-PAYMENT";
-var X402_PAYMENT_REQUIRED_HEADER_NAME = "PAYMENT-REQUIRED";
-var X402_PAYMENT_RESPONSE_HEADER_NAME = "PAYMENT-RESPONSE";
-var X402_PAYMENT_HEADER_NAMES_SENT = `${X402_PAYMENT_HEADER_NAME}, ${X402_LEGACY_PAYMENT_HEADER_NAME}`;
-var X402_PAYMENT_HEADER_NAMES = [
-  X402_PAYMENT_HEADER_NAME,
-  X402_LEGACY_PAYMENT_HEADER_NAME
-];
-function x402PaymentHeaderNamesFor(paymentHeader) {
-  const both = [X402_PAYMENT_HEADER_NAME, X402_LEGACY_PAYMENT_HEADER_NAME];
-  let decoded;
-  try {
-    decoded = decodeBase64Json(paymentHeader);
-  } catch {
-    return both;
-  }
-  const accepted = decoded?.accepted;
-  if (!accepted || typeof accepted !== "object" || Array.isArray(accepted)) return both;
-  return isErc7710Option(accepted) ? [X402_PAYMENT_HEADER_NAME] : both;
-}
-function x402PaymentHeaderNamesSent(paymentHeader) {
-  return x402PaymentHeaderNamesFor(paymentHeader).join(", ");
-}
-function x402V2PaymentEnvelope(paymentRequired, accepted, payload) {
-  const resource = paymentRequired.resource;
-  const extensions = paymentRequired.extensions;
-  return {
-    x402Version: paymentRequired.x402Version,
-    ...resource && typeof resource === "object" && !Array.isArray(resource) ? { resource } : {},
-    accepted,
-    payload,
-    ...extensions && typeof extensions === "object" && !Array.isArray(extensions) ? { extensions } : {}
-  };
-}
-function parsePaymentRequired(response) {
-  const v2Header = response.headers.get("PAYMENT-REQUIRED");
-  if (v2Header) {
-    const parsed = normalizePaymentRequired(
-      decodeBase64Json(v2Header, "PAYMENT-REQUIRED header")
-    );
-    if (parsed) return parsed;
-  }
-  const v1Header = response.headers.get("X-PAYMENT");
-  if (v1Header) {
-    const parsed = normalizePaymentRequired(
-      decodeBase64Json(v1Header, "X-PAYMENT header")
-    );
-    if (parsed) return parsed;
-  }
-  throw new Error(
-    "No x402 payment headers found in 402 response. Expected PAYMENT-REQUIRED (v2) or X-PAYMENT (v1) header."
-  );
-}
-async function parsePaymentRequiredResponse(response) {
-  try {
-    return parsePaymentRequired(response);
-  } catch (headerErr) {
-    try {
-      const body = await response.clone().json();
-      const parsed = normalizePaymentRequired(body);
-      if (parsed) return parsed;
-    } catch {
-    }
-    throw headerErr;
-  }
-}
-function selectPaymentOption(accepts) {
-  if (!accepts || accepts.length === 0) return null;
-  for (const opt of accepts) {
-    if (opt.network in SUPPORTED_X402_NETWORKS) {
-      const networkTokens = NETWORK_TOKENS[opt.network];
-      if (networkTokens?.[opt.asset.toLowerCase()] && isPositiveDecimalAtomicAmount(optionAuthorizationAmount(opt))) {
-        return opt;
-      }
-    }
-  }
-  for (const opt of accepts) {
-    if (opt.network in SUPPORTED_X402_NETWORKS && isPositiveDecimalAtomicAmount(optionAuthorizationAmount(opt))) {
-      return opt;
-    }
-  }
-  return null;
-}
-var ERC7710_ASSET_TRANSFER_METHOD = "erc7710";
-function isEip3009ConstructibleOption(option) {
-  const rawMethod = option.extra?.assetTransferMethod;
-  if (rawMethod !== void 0 && rawMethod !== "eip3009") return false;
-  const rawFlow = option.extra?.paymentFlow;
-  if (rawFlow !== void 0 && rawFlow !== "authorization") return false;
-  return true;
-}
-function x402AssetTransferMethod(option) {
-  const raw = option.extra?.assetTransferMethod;
-  return typeof raw === "string" ? raw : null;
-}
-function isErc7710Option(option) {
-  return x402AssetTransferMethod(option) === ERC7710_ASSET_TRANSFER_METHOD;
-}
-function x402FacilitatorAddresses(option) {
-  const raw = option.extra?.facilitatorAddresses;
-  if (!Array.isArray(raw)) return null;
-  const addresses = raw.filter((a) => typeof a === "string" && ADDRESS_RE.test(a));
-  return addresses.length > 0 ? addresses : null;
-}
-function isPayableStandardOption(opt) {
-  return opt.scheme === "exact" && opt.network in STANDARD_X402_NETWORKS && STANDARD_X402_USDC_ADDRESSES.has(opt.asset.toLowerCase()) && isPositiveDecimalAtomicAmount(optionAuthorizationAmount(opt));
-}
-function selectStandardPaymentOption(accepts) {
-  if (!accepts || accepts.length === 0) return null;
-  for (const opt of accepts) {
-    if (opt === null || typeof opt !== "object") continue;
-    if (!isEip3009ConstructibleOption(opt)) continue;
-    if (isPayableStandardOption(opt)) return opt;
-  }
-  return null;
-}
-function selectErc7710PaymentOption(accepts) {
-  if (!accepts || accepts.length === 0) return null;
-  for (const opt of accepts) {
-    if (opt === null || typeof opt !== "object") continue;
-    if (isErc7710Option(opt) && isPayableStandardOption(opt)) return opt;
-    if (!isEip3009ConstructibleOption(opt)) continue;
-  }
-  return null;
-}
-function selectX402SettlementScheme(accepts, opts) {
-  if (opts.delegationRail) {
-    const preferred = selectErc7710PaymentOption(accepts);
-    if (preferred) {
-      return {
-        scheme: "erc7710",
-        option: preferred,
-        facilitatorAddresses: x402FacilitatorAddresses(preferred)
-      };
-    }
-  }
-  const fallback = selectStandardPaymentOption(accepts);
-  if (fallback) return { scheme: "eip3009", option: fallback, facilitatorAddresses: null };
-  return null;
-}
-function x402AuthorizationAmount(option) {
-  const amount = optionAuthorizationAmount(option);
-  if (!isPositiveDecimalAtomicAmount(amount)) {
-    throw new Error("Invalid x402 amount: must be a positive decimal atomic amount");
-  }
-  return amount;
-}
-function buildX402ExpectedMessage(context) {
-  const version = context.payerDelegate ? 3 : context.typedDataHash ? 2 : 1;
-  const payload = {
-    version,
-    kind: "haven.x402.expected",
-    paymentId: context.paymentId,
-    payloadHash: context.payloadHash.toLowerCase(),
-    resourceUrl: context.resourceUrl,
-    merchantTo: context.merchantTo.toLowerCase(),
-    amount: context.amount,
-    asset: context.asset.toLowerCase(),
-    network: context.network
-  };
-  if (context.expiresAt) {
-    payload.expiresAt = context.expiresAt;
-  }
-  if (context.typedDataHash) {
-    payload.typedDataHash = context.typedDataHash.toLowerCase();
-  }
-  if (context.payerDelegate) {
-    payload.payerDelegate = context.payerDelegate.toLowerCase();
-    if (context.payerAgentId) {
-      payload.payerAgentId = context.payerAgentId;
-    }
-  }
-  return `Haven x402 expected context v${version}
-${stableStringify2(payload)}`;
-}
-function toStandardPaymentRequirements(paymentRequired, option) {
-  const network = STANDARD_X402_NETWORKS[option.network];
-  if (!network) {
-    throw new Error(`x402 exact payments are not supported on ${option.network}`);
-  }
-  if (option.scheme !== "exact") {
-    throw new Error(`Unsupported x402 scheme: ${option.scheme}`);
-  }
-  if (!isEip3009ConstructibleOption(option)) {
-    throw new Error(
-      "Unsupported x402 payment requirements: this SDK constructs EIP-3009 authorization payments only. The merchant advertised a different extra.assetTransferMethod or an unrecognized extra.paymentFlow."
-    );
-  }
-  return {
-    scheme: "exact",
-    network,
-    maxAmountRequired: x402AuthorizationAmount(option),
-    resource: option.resource ?? paymentRequired.resource.url,
-    description: option.description ?? paymentRequired.resource.description ?? "Haven x402 payment",
-    mimeType: option.mimeType ?? paymentRequired.resource.mimeType ?? "application/octet-stream",
-    payTo: option.payTo,
-    asset: option.asset,
-    // Signing-only policy (#715/#3117): parsed and directly supplied options
-    // share this cap before the library computes validBefore. Keep the offer
-    // echoed in `accepted` unchanged. The forward margin (#1256) adds time
-    // for funding/retry, but does not guarantee a merchant timeout above the
-    // total bounded lifetime can pass facilitator verification.
-    maxTimeoutSeconds: clampAuthorizationWindow(option.maxTimeoutSeconds) + X402_SETTLEMENT_FORWARD_MARGIN_SECONDS,
-    extra: option.extra
-  };
-}
-async function validateStandardX402PaymentHeader(paymentHeader, context) {
-  try {
-    if (typeof paymentHeader !== "string" || paymentHeader.length === 0 || paymentHeader.length > X402_PAYMENT_HEADER_MAX_LENGTH || paymentHeader.length % 4 !== 0 || !BASE64_RE.test(paymentHeader)) {
-      throw new Error("wire");
-    }
-    const decoded = decodeBase64Json(paymentHeader);
-    if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) throw new Error("shape");
-    const version = decoded.x402Version;
-    const payload = decoded.payload;
-    if (version !== 1 && version !== 2 || !payload || typeof payload !== "object" || Array.isArray(payload)) {
-      throw new Error("shape");
-    }
-    if (version === 1) {
-      if (!hasOnlyKeys(decoded, ["x402Version", "scheme", "network", "payload"])) throw new Error("shape");
-      if (decoded.scheme !== "exact" || decoded.network !== standardX402WireNetwork(context.network)) {
-        throw new Error("context");
-      }
-    } else {
-      if (!hasOnlyKeys(decoded, ["x402Version", "accepted", "payload"], ["resource", "extensions"])) {
-        throw new Error("shape");
-      }
-      if ("resource" in decoded && (!decoded.resource || typeof decoded.resource !== "object" || Array.isArray(decoded.resource))) {
-        throw new Error("shape");
-      }
-      if ("extensions" in decoded && (!decoded.extensions || typeof decoded.extensions !== "object" || Array.isArray(decoded.extensions))) {
-        throw new Error("shape");
-      }
-      const accepted = selectStandardPaymentOption([decoded.accepted]);
-      if (!accepted || !matchesHeaderContext(accepted, context)) throw new Error("context");
-    }
-    const record = payload;
-    if (!hasOnlyKeys(record, ["signature", "authorization"])) throw new Error("shape");
-    if (typeof record.signature !== "string" || !SIGNATURE_RE.test(record.signature)) throw new Error("shape");
-    const authorization = record.authorization;
-    if (!authorization || typeof authorization !== "object" || Array.isArray(authorization)) throw new Error("shape");
-    const auth = authorization;
-    if (!hasOnlyKeys(auth, ["from", "to", "value", "validAfter", "validBefore", "nonce"])) throw new Error("shape");
-    if (typeof auth.from !== "string" || !ADDRESS_RE.test(auth.from) || typeof auth.to !== "string" || !ADDRESS_RE.test(auth.to) || typeof auth.value !== "string" || !isPositiveDecimalAtomicAmount(auth.value) || typeof auth.validAfter !== "string" || !DECIMAL_ATOMIC_AMOUNT_RE.test(auth.validAfter) || typeof auth.validBefore !== "string" || !DECIMAL_ATOMIC_AMOUNT_RE.test(auth.validBefore) || typeof auth.nonce !== "string" || !NONCE_RE.test(auth.nonce)) {
-      throw new Error("shape");
-    }
-    if (!sameAddress2(auth.from, context.payer) || !sameAddress2(auth.to, context.merchantTo) || auth.value !== context.amountAtomic) {
-      throw new Error("context");
-    }
-    const validAfter = BigInt(auth.validAfter);
-    const validBefore = BigInt(auth.validBefore);
-    const now = BigInt(Math.floor(Date.now() / 1e3));
-    if (validBefore <= now || validAfter > validBefore) throw new Error("expired");
-    const typedData = buildSweepTypedData({
-      from: auth.from,
-      to: auth.to,
-      value: auth.value,
-      validAfter: auth.validAfter,
-      validBefore: auth.validBefore,
-      nonce: auth.nonce,
-      token: context.asset,
-      chainId: context.chainId
-    });
-    const recovered = await recoverTypedDataAddress({
-      ...typedData,
-      // `buildSweepTypedData` keeps the public domain framework-neutral;
-      // viem brands contract addresses at this crypto call boundary only.
-      domain: {
-        ...typedData.domain,
-        verifyingContract: typedData.domain.verifyingContract
-      },
-      message: {
-        ...typedData.message,
-        from: typedData.message.from,
-        to: typedData.message.to,
-        nonce: typedData.message.nonce
-      },
-      signature: record.signature
-    });
-    if (!sameAddress2(recovered, context.payer)) throw new Error("recovery");
-  } catch {
-    throw new X402PaymentHeaderValidationError();
-  }
-}
-function hasOnlyKeys(value, required, optional = []) {
-  return Object.keys(value).every((key) => required.includes(key) || optional.includes(key)) && required.every((key) => key in value);
-}
-function sameAddress2(left, right) {
-  return left.toLowerCase() === right.toLowerCase();
-}
-function standardX402WireNetwork(network) {
-  return STANDARD_X402_NETWORKS[network] ?? null;
-}
-function matchesHeaderContext(option, context) {
-  if (option.scheme !== "exact" || !sameAddress2(option.payTo, context.merchantTo) || !sameAddress2(option.asset, context.asset) || option.network !== context.network || x402AuthorizationAmount(option) !== context.amountAtomic) return false;
-  return option.resource === void 0 || option.resource === context.resourceUrl;
-}
-function buildX402IdempotencyKey(paymentRequired, option, now = Date.now()) {
-  const bucket = Math.floor(now / X402_IDEMPOTENCY_BUCKET_MS);
-  const material = [
-    paymentRequired.resource.url,
-    paymentRequired.resource.description ?? "",
-    option.payTo.toLowerCase(),
-    option.asset.toLowerCase(),
-    x402AuthorizationAmount(option),
-    option.network,
-    bucket
-  ].join("|");
-  return `x402:${createHash("sha256").update(material).digest("hex").slice(0, 16)}`;
-}
-function encodePaymentProof(receipt) {
-  const payload = {
-    x402Version: 2,
-    resource: receipt.resourceUrl ? { url: receipt.resourceUrl } : void 0,
-    accepted: receipt.accepted,
-    payload: {
-      type: "haven_tx_hash",
-      txHash: receipt.txHash,
-      paymentId: receipt.paymentId,
-      settledVia: "haven",
-      payer: receipt.payer,
-      chainId: receipt.chainId
-    }
-  };
-  return encodeBase64Json(payload);
-}
-function resolveTokenFromAddress(address, network) {
-  const lower = address.toLowerCase();
-  if (network && network in NETWORK_TOKENS) {
-    return NETWORK_TOKENS[network][lower] ?? null;
-  }
-  return ALL_TOKENS[lower] ?? null;
-}
-function stableStringify2(value) {
-  if (value === null || typeof value !== "object") {
-    const primitive = JSON.stringify(value);
-    return primitive === void 0 ? "undefined" : primitive;
-  }
-  if (value instanceof Date) return JSON.stringify(value.toISOString());
-  if (Array.isArray(value)) return `[${value.map((item) => stableStringify2(item)).join(",")}]`;
-  const object = value;
-  return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify2(object[key])}`).join(",")}}`;
-}
 var DEFAULT_BASE_URL = "http://localhost:3001";
 var DEFAULT_REQUEST_TIMEOUT = 3e4;
+function withoutClientHeader(headers) {
+  const target = HAVEN_CLIENT_HEADER.toLowerCase();
+  return Object.fromEntries(Object.entries(headers).filter(([name]) => name.toLowerCase() !== target));
+}
 var HavenApiTransport = class {
   apiKey;
   baseUrl;
   requestTimeout;
   defaultHeaders;
+  clientIdentity;
   requestContext = new AsyncLocalStorage();
+  lastClientUpdate;
   constructor(config) {
     this.apiKey = config.apiKey;
     this.baseUrl = (config.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
     this.requestTimeout = config.requestTimeout ?? DEFAULT_REQUEST_TIMEOUT;
     this.defaultHeaders = { ...config.defaultHeaders ?? {} };
+    this.clientIdentity = config.clientIdentity ?? SDK_CLIENT_IDENTITY;
+  }
+  /**
+   * The newest `client_update` the backend sent (#3303): inside a
+   * `withRequestContext` dispatch, the one that dispatch's own requests
+   * received; outside one, the latest this transport has seen.
+   */
+  clientUpdate() {
+    const store = this.requestContext.getStore();
+    return store ? store.clientUpdate : this.lastClientUpdate;
+  }
+  recordClientUpdate(data) {
+    if (data === null || typeof data !== "object" || Array.isArray(data)) return;
+    const hint = readClientUpdate(data.client_update);
+    if (!hint) return;
+    this.lastClientUpdate = hint;
+    const store = this.requestContext.getStore();
+    if (store) store.clientUpdate = hint;
   }
   /** Run `fn` with extra headers scoped to its asynchronous Haven API work. */
   withRequestContext(headers, fn) {
@@ -1157,13 +117,19 @@ var HavenApiTransport = class {
         headers: {
           "Content-Type": "application/json",
           "Authorization": `Bearer ${this.apiKey}`,
-          ...this.defaultHeaders,
-          ...contextHeaders
+          ...withoutClientHeader(this.defaultHeaders),
+          ...withoutClientHeader(contextHeaders),
+          // Last, and any other spelling of it dropped above (fetch would
+          // JOIN `x-haven-client` and `X-Haven-Client` into one unparseable
+          // value), so neither `defaultHeaders` nor a dispatch context can
+          // misname the client; `clientIdentity` is the one way to set it.
+          [HAVEN_CLIENT_HEADER]: this.clientIdentity
         },
         body: body ? JSON.stringify(body) : void 0,
         signal: controller.signal
       });
       const data = await res.json();
+      this.recordClientUpdate(data);
       if (!res.ok) {
         const record = data;
         const errorText = typeof record.error === "string" ? record.error : void 0;
@@ -1265,13 +231,17 @@ function mapPaymentReceipt(raw) {
   const receipt = {
     id: raw.id,
     paymentId: raw.payment_id,
+    source: raw.rail,
     rail: raw.rail,
+    paymentProofStatus: raw.proof_status,
     proofStatus: raw.proof_status,
     txHash: raw.tx_hash,
     fundingTxHash: raw.funding_tx_hash ?? null,
     settlementTxHash: raw.settlement_tx_hash ?? null,
     chainId: raw.chain_id,
+    x402ResourceUrl: raw.resource_url,
     resourceUrl: raw.resource_url,
+    x402MerchantAddress: raw.merchant_address,
     merchantAddress: raw.merchant_address,
     payerAddress: raw.payer_address,
     parties: mapParties(raw.parties),
@@ -1295,6 +265,9 @@ function mapPaymentReceipt(raw) {
   if ("payment_intent_id" in raw) {
     receipt.paymentIntentId = raw.payment_intent_id ?? null;
   }
+  if (raw.scope) {
+    receipt.scope = { source: raw.scope.source, filter: raw.scope.filter };
+  }
   if ("approval_request_id" in raw) {
     receipt.approvalRequestId = raw.approval_request_id ?? null;
   }
@@ -1486,6 +459,10 @@ var MCP_NOTIFICATION_TIMEOUT = 1e4;
 var MCP_PROTOCOL_VERSION = "2025-06-18";
 var MCP_ACCEPT = "application/json, text/event-stream";
 var MCP_CLIENT_INFO = { name: "haven-sdk", version: "1" };
+var MCP_X402_PAYMENT_META_KEY = "x402/payment";
+var MCP_X402_PAYMENT_RESPONSE_META_KEY = "x402/payment-response";
+var X402_RETRY_REJECTED_STATUS = 402;
+var SESSION_NOT_FOUND_NEXT_ACTION = "reinitialize_then_retry_same_payment_header";
 var McpMerchantTransport = class {
   merchantTimeout;
   fetchImpl;
@@ -1581,7 +558,7 @@ var McpMerchantTransport = class {
       return response;
     }
     const message = selectJsonRpcResult(parseSseJsonRpcMessages(text));
-    if (!message) return response;
+    if (!message || !("result" in message || "error" in message)) return response;
     const body = "result" in message ? message.result : message;
     const headers = new Headers(response.headers);
     headers.set("content-type", "application/json");
@@ -1644,7 +621,57 @@ var McpMerchantTransport = class {
       if (send.includes(name)) headers.set(name, paymentHeader);
       else headers.delete(name);
     }
-    return this.fetch(url, { ...init, headers });
+    return this.fetch(url, withMcpPaymentMeta({ ...init, headers }, paymentHeader));
+  }
+  /**
+   * #3171: deliver the payment; if the merchant answers its unknown-session
+   * 404 WITH the settled-nothing recovery data, re-initialize once and resend
+   * the SAME header on the new session. The merchant's own guarantee (#1578:
+   * the session guard runs before its payment gate) is what makes the resend
+   * safe — a bare -32001, or any other 404, is returned to the caller
+   * untouched (body re-wrapped, since reading it consumed the stream). One
+   * recovery only: a second 404 is the answer.
+   */
+  async deliverPaymentRecoveringSession(url, init, paymentHeader, reinitialize) {
+    const first = await this.deliverPayment(url, init, paymentHeader);
+    if (first.status !== 404) return first;
+    let text;
+    try {
+      text = await first.clone().text();
+    } catch {
+      return first;
+    }
+    if (!sessionNotFoundRecovery(text)) return first;
+    const sessionId = await reinitialize();
+    if (!sessionId) return first;
+    return this.deliverPayment(url, this.withSessionHeaders(init, sessionId), paymentHeader);
+  }
+  /**
+   * #3118: read a native MCP payment-required tool result from a response
+   * WITHOUT consuming it — JSON or SSE framed. `undefined` for anything that
+   * is not an `isError: true` tool result carrying a valid `PaymentRequired`
+   * (structured content first, text fallback second), so an ordinary tool
+   * error, a successful result that merely resembles a challenge, or an
+   * unparseable body is never mistaken for a payment demand.
+   */
+  async extractToolResultChallenge(response, init) {
+    const toolResult = await this.readToolResult(response, init);
+    return toolResult ? extractMcpPaymentRequired(toolResult) : void 0;
+  }
+  /**
+   * #3118: the tool RESULT a response carries, read WITHOUT consuming it, or
+   * `undefined`. Only a JSON or SSE body is read at all (#3155 review S2):
+   * a non-402 answer used to be returned untouched, and buffering an
+   * arbitrary body — a streaming or binary paid resource — to look for a
+   * challenge would block the caller until the stream ended or the merchant
+   * timeout fired. A merchant that speaks JSON-RPC declares one of those two
+   * content types.
+   */
+  async readToolResult(response, init) {
+    if (init !== void 0 && !isJsonRpcToolsCallBody(init.body)) return void 0;
+    const contentType = (response.headers.get("content-type") ?? "").toLowerCase();
+    if (!contentType.includes("application/json") && !contentType.includes("text/event-stream")) return void 0;
+    return mcpToolResultOf(await this.readMessage(response));
   }
   async notifyInitialized(url, init, sessionId, wallet) {
     try {
@@ -1666,6 +693,106 @@ var McpMerchantTransport = class {
     }
   }
 };
+function mcpToolResultOf(value) {
+  if (!isRecord(value)) return void 0;
+  if ("jsonrpc" in value) {
+    return isRecord(value.result) ? value.result : void 0;
+  }
+  if ("isError" in value || Array.isArray(value.content) || isRecord(value._meta)) return value;
+  return void 0;
+}
+function extractMcpPaymentRequired(toolResult) {
+  if (toolResult.isError !== true) return void 0;
+  if (isRecord(toolResult.structuredContent)) {
+    const parsed = normalizePaymentRequired(toolResult.structuredContent);
+    if (parsed) return parsed;
+  }
+  if (Array.isArray(toolResult.content)) {
+    for (const item of toolResult.content) {
+      if (!isRecord(item) || item.type !== "text" || typeof item.text !== "string") continue;
+      let candidate;
+      try {
+        candidate = JSON.parse(item.text);
+      } catch {
+        continue;
+      }
+      const parsed = normalizePaymentRequired(candidate);
+      if (parsed) return parsed;
+    }
+  }
+  return void 0;
+}
+function mcpSettlementFromToolResult(toolResult) {
+  const meta = toolResult._meta;
+  if (!isRecord(meta)) return void 0;
+  const settlement = meta[MCP_X402_PAYMENT_RESPONSE_META_KEY];
+  if (!isRecord(settlement) || typeof settlement.success !== "boolean") return void 0;
+  return {
+    success: settlement.success,
+    ...typeof settlement.transaction === "string" ? { transaction: settlement.transaction } : {},
+    ...typeof settlement.network === "string" ? { network: settlement.network } : {},
+    ...typeof settlement.payer === "string" ? { payer: settlement.payer } : {},
+    ...typeof settlement.errorReason === "string" ? { errorReason: settlement.errorReason } : {}
+  };
+}
+function withMcpPaymentMeta(init, paymentHeader) {
+  const request = parseJsonRpcToolsCall(init.body);
+  if (!request) return init;
+  let envelope;
+  try {
+    envelope = decodeBase64Json(paymentHeader);
+  } catch {
+    return init;
+  }
+  if (!isRecord(envelope)) return init;
+  const params = request.params;
+  const existingMeta = isRecord(params._meta) ? params._meta : {};
+  return {
+    ...init,
+    body: JSON.stringify({
+      ...request,
+      params: { ...params, _meta: { ...existingMeta, [MCP_X402_PAYMENT_META_KEY]: envelope } }
+    })
+  };
+}
+function encodeMcpSettlementReceipt(settlement) {
+  return encodeBase64Json(settlement);
+}
+function parseJsonRpcToolsCall(body) {
+  if (typeof body !== "string") return void 0;
+  let request;
+  try {
+    request = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(request) || request.method !== "tools/call" || !isRecord(request.params)) return void 0;
+  return request;
+}
+function isJsonRpcToolsCallBody(body) {
+  return parseJsonRpcToolsCall(body) !== void 0;
+}
+function sessionNotFoundRecovery(body) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+  if (!isRecord(parsed) || !isRecord(parsed.error)) return void 0;
+  if (parsed.error.code !== -32001) return void 0;
+  const data = parsed.error.data;
+  if (!isRecord(data)) return void 0;
+  if (data.settled !== false || data.next_action !== SESSION_NOT_FOUND_NEXT_ACTION) return void 0;
+  return {
+    reason: typeof data.reason === "string" ? data.reason : "session_expired",
+    settled: false,
+    next_action: SESSION_NOT_FOUND_NEXT_ACTION
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
 async function captureMerchantResponse(response) {
   const merchant_body = await response.text().catch(() => "");
   return {
@@ -2035,7 +1162,7 @@ function chainIdFromNetwork(network) {
 function chainIdOrNull(network) {
   return chainIdFromNetwork(network) ?? null;
 }
-function sameAddress3(a, b) {
+function sameAddress(a, b) {
   return Boolean(a && b && a.toLowerCase() === b.toLowerCase());
 }
 function decimalFromUsdcAtomic(value) {
@@ -2238,7 +1365,7 @@ function assertCanResumeX402(status, paymentRequired, option) {
       status.paymentId
     );
   }
-  if (status.merchantAddress && !sameAddress3(status.merchantAddress, option.payTo)) {
+  if (status.merchantAddress && !sameAddress(status.merchantAddress, option.payTo)) {
     throw new HavenApiError(
       "x402 resume request does not match the approved merchant.",
       409,
@@ -2574,7 +1701,10 @@ var X402Erc7710 = class {
       );
     }
     const prepared = await this.prepare(paymentRequired, options);
-    const signature = await this.signForData(prepared.signData);
+    const signature = await this.signForData(
+      prepared.signData,
+      settlementExpectationFromQuote(prepared.settlement)
+    );
     const paymentHeader = await this.submit(prepared.paymentId, signature);
     return { ...prepared.settlement, paymentHeader };
   }
@@ -2689,6 +1819,21 @@ var X402Erc7710 = class {
     return settled.payment_header;
   }
 };
+function settlementExpectationFromQuote(settlement) {
+  const chainId = chainIdForNetwork(settlement.network);
+  if (chainId === void 0) {
+    throw new HavenSigningError(
+      `Refusing to sign the x402 settlement child: the merchant's network ${JSON.stringify(settlement.network)} is not one this SDK can verify a settlement child on.`
+    );
+  }
+  return {
+    merchantTo: settlement.merchantPayTo,
+    amount: settlement.amountAtomic,
+    asset: settlement.asset,
+    chainId,
+    ...settlement.facilitatorAddresses && settlement.facilitatorAddresses.length > 0 ? { redeemers: settlement.facilitatorAddresses } : {}
+  };
+}
 
 // src/tool-adapter.ts
 function toolX402PaymentRequired(input) {
@@ -2814,12 +1959,17 @@ var MerchantCompletion = class {
     if (!receipt.paymentHeader) {
       throw new HavenApiError("No x402 payment header was returned for payment retry", 500);
     }
-    const retryResponse = await this.merchantTransport.deliverPayment(
+    const retryResponse = await this.merchantTransport.deliverPaymentRecoveringSession(
       url,
       initialInit,
-      receipt.paymentHeader
+      receipt.paymentHeader,
+      () => this.merchantTransport.initialize(url, initialInit)
     );
-    if (!retryResponse.ok) {
+    const toolResult = retryResponse.ok ? await this.merchantTransport.readToolResult(retryResponse) : void 0;
+    const inBandChallenge = toolResult ? extractMcpPaymentRequired(toolResult) : void 0;
+    const metaSettlement = toolResult ? mcpSettlementFromToolResult(toolResult) : void 0;
+    const inBandRejection = inBandChallenge !== void 0 || metaSettlement?.success === false;
+    if (!retryResponse.ok || inBandRejection) {
       const merchant = await captureMerchantResponse(retryResponse);
       await this.recordRetryRejected({
         rail: "x402",
@@ -2834,7 +1984,7 @@ var MerchantCompletion = class {
       });
       throw new HavenApiError(
         "x402 retry failed after Haven funded the delegate wallet; reconciliation may be required.",
-        merchant.merchant_status,
+        inBandRejection ? X402_RETRY_REJECTED_STATUS : merchant.merchant_status,
         {
           marker: "x402_retry_rejected_after_funding",
           payment_id: receipt.paymentId,
@@ -2846,7 +1996,10 @@ var MerchantCompletion = class {
         }
       );
     }
-    const merchantSettlement = parseMerchantSettlement(retryResponse.headers.get("PAYMENT-RESPONSE"));
+    const headerReceipt = retryResponse.headers.get("PAYMENT-RESPONSE");
+    const protocolReceiptHeader = headerReceipt ?? (metaSettlement ? encodeMcpSettlementReceipt(metaSettlement) : void 0);
+    const protocolReceiptHeaderName = headerReceipt ? "PAYMENT-RESPONSE" : metaSettlement ? `_meta.${MCP_X402_PAYMENT_RESPONSE_META_KEY}` : void 0;
+    const merchantSettlement = parseMerchantSettlement(protocolReceiptHeader ?? null);
     if (receipt.merchant && merchantSettlement.settlementTxHash) {
       receipt.merchant.settlementTxHash = merchantSettlement.settlementTxHash;
       receipt.merchant.settlementExplorerUrl = buildExplorerUrl(
@@ -2864,8 +2017,8 @@ var MerchantCompletion = class {
       selectedPayment: receipt.accepted,
       paymentProofHeaderName: x402PaymentHeaderNamesSent(receipt.paymentHeader),
       paymentProofHeader: receipt.paymentHeader,
-      protocolReceiptHeaderName: "PAYMENT-RESPONSE",
-      protocolReceiptHeader: retryResponse.headers.get("PAYMENT-RESPONSE") ?? void 0
+      protocolReceiptHeaderName,
+      protocolReceiptHeader
     });
     await this.reportMerchantReceipt(receipt.paymentId, retryResponse);
     return retryResponse;
@@ -3277,7 +2430,7 @@ var HavenClient = class {
     this.erc7710 = new X402Erc7710({
       delegateKey: this.delegateKey,
       post: (path, body) => this.post(path, body),
-      signForData: (signData) => this.signForData(signData),
+      signForData: (signData, settlementExpectation) => this.signForData(signData, settlementExpectation),
       getAgent: () => this.getAgent()
     });
   }
@@ -3299,11 +2452,21 @@ var HavenClient = class {
   withRequestContext(headers, fn) {
     return this.havenApi.withRequestContext(headers, fn);
   }
+  /**
+   * The backend's newest `client_update` hint for this client (#3303): inside
+   * a `withRequestContext` dispatch, the one that dispatch's own requests
+   * received; outside one, the latest seen. Undefined when the client is
+   * current or the backend predates #3303.
+   */
+  clientUpdate() {
+    return this.havenApi.clientUpdate();
+  }
   // ── High-Level API ───────────────────────────────────────────────
   /**
    * Send a payment in one call.
    *
-   * Creates the intent, signs the hash, submits the signature,
+   * Creates the intent, signs its `sign_data` (a delegation-rail intent's
+   * EIP-712 typed data, after the #3271 UserOp binding check), submits the signature,
    * and polls until confirmed (or throws on failure/timeout).
    *
    * Requires `delegateKey` to be set in the client config.
@@ -3315,7 +2478,7 @@ var HavenClient = class {
       );
     }
     const intent = await this.createIntent(request);
-    const signature = this.sign(intent.signData.hash);
+    const signature = await this.signForData(intent.signData);
     await this.submitSignature(intent.paymentId, signature);
     return this.waitForConfirmation(intent.paymentId);
   }
@@ -3462,7 +2625,7 @@ var HavenClient = class {
    * (#834) — the backend refuses those intents with HTTP 410 before any
    * sign_data reaches a client, so encountering it here is a hard error too.
    */
-  async signForData(signData) {
+  async signForData(signData, settlementExpectation) {
     if (!this.delegateKey) {
       throw new HavenSigningError(
         "Cannot sign without a delegateKey. Pass the private key in HavenClient config, or sign externally."
@@ -3480,6 +2643,11 @@ var HavenClient = class {
           "sign_data.signature_scheme is eip712_userop but typed_data is missing \u2014 refusing to sign the bare hash (the account would reject it)."
         );
       }
+      assertUserOpTypedDataBinding(signData.typed_data, signData.hash);
+      assertBoundDirectPaymentUserOp(
+        signData.typed_data,
+        this.delegateAddress
+      );
       return signUserOpTypedDataForDelegation(this.delegateKey, signData.typed_data);
     }
     if (scheme === "eip712_delegation") {
@@ -3488,6 +2656,12 @@ var HavenClient = class {
           "sign_data.signature_scheme is eip712_delegation but typed_data is missing \u2014 refusing to sign the bare hash (the settlement would be rejected on redemption)."
         );
       }
+      if (!settlementExpectation) {
+        throw new HavenTypedDataRefusedError(
+          "Refusing to sign an x402 settlement child without an independent expectation of what it must pay (the merchant's 402). Pay erc7710 merchants through settleX402Erc7710(), which supplies it."
+        );
+      }
+      assertOwnSettlementChild(signData.typed_data, settlementExpectation, this.delegateAddress);
       return signSettlementDelegationTypedData(this.delegateKey, signData.typed_data);
     }
     if (scheme === void 0) {
@@ -3548,11 +2722,12 @@ var HavenClient = class {
     return this.accountReads.getAgentSummary();
   }
   /**
-   * Sweep stranded USDC and ETH from the delegate EOA back to the originating Safe.
+   * Sweep stranded USDC and ETH from the delegate EOA back to the agent's Haven account.
    *
    * The delegate key held by this client signs and submits the transfer transactions
    * directly — Haven's backend never handles the key or constructs signed txs
-   * (CASP/MiCA Red Line #2). Funds always go to the Safe linked to this agent.
+   * (CASP/MiCA Red Line #2). Funds always go to the Haven account linked to this agent
+   * (`accountAddress` from `getAgent()`).
    *
    * Requires `chainRpcs` to be set for the agent's chain in `HavenClientConfig`.
    */
@@ -3840,6 +3015,11 @@ var HavenClient = class {
     const request = snapshotX402Request(url, initialInit);
     const response = await this.merchantTransport.fetch(url, initialInit);
     if (response.status !== 402) {
+      const toolResultChallenge = await this.merchantTransport.extractToolResultChallenge(response, initialInit);
+      if (toolResultChallenge) {
+        const mcpTransport2 = await this.merchantTransport.detect(url, toolResultChallenge, response);
+        return buildX402Quote(toolResultChallenge, request, options.idempotencyKey, mcpTransport2);
+      }
       let body;
       try {
         body = await response.clone().json();
@@ -4006,10 +3186,11 @@ var HavenClient = class {
     return this.merchantCompletion.retryRequest(url ?? paymentRequired.resource.url, initialInit, paymentRequired, receipt);
   }
   /**
-   * Fetch wrapper that automatically handles HTTP 402 responses.
+   * Fetch wrapper that automatically handles HTTP 402 responses — and, since
+   * #3118, a native-MCP payment-required tool result answered under HTTP 200.
    *
-   * Works like the standard `fetch()` but intercepts 402 responses,
-   * pays via x402 through Haven, and retries the request.
+   * Works like the standard `fetch()` but intercepts 402 responses (or that
+   * tool-result challenge), pays via x402 through Haven, and retries the request.
    *
    * ```ts
    * const response = await haven.fetch('https://paid-api.com/data')
@@ -4017,8 +3198,9 @@ var HavenClient = class {
    * ```
    *
    * **MCP-over-x402 auto-handshake (issue #315):** when the endpoint is
-   * MCP-shaped — the URL path ends in `/mcp`, or the 402 body carries a
-   * Coinbase Bazaar `extensions.bazaar` block — the SDK runs the MCP
+   * MCP-shaped — the URL path ends in `/mcp`, or the 402 body (or, since
+   * #3118, the tool-result challenge) carries a Coinbase Bazaar
+   * `extensions.bazaar` block — the SDK runs the MCP
    * `initialize` handshake, threads the resulting `mcp-session-id`,
    * `Accept: application/json, text/event-stream`, and `x402-wallet` headers
    * through every request, and collapses SSE responses to the JSON-RPC
@@ -4036,16 +3218,23 @@ var HavenClient = class {
     let requestInit = withX402Wallet(init, x402PayerAddress(this.delegateAddress, this.x402Wallet));
     if (mcpSessionId) requestInit = this.merchantTransport.withSessionHeaders(requestInit, mcpSessionId);
     const response = await this.merchantTransport.fetch(url, requestInit);
-    if (response.status !== 402) {
-      return mcpSessionId ? this.merchantTransport.surfaceResult(response) : response;
-    }
     let paymentRequired;
-    try {
-      paymentRequired = await parsePaymentRequiredResponse(response);
-    } catch {
-      return response;
+    let nativeChallenge = false;
+    if (response.status !== 402) {
+      const toolResultChallenge = await this.merchantTransport.extractToolResultChallenge(response, requestInit);
+      if (!toolResultChallenge) {
+        return mcpSessionId ? this.merchantTransport.surfaceResult(response) : response;
+      }
+      paymentRequired = toolResultChallenge;
+      nativeChallenge = true;
+    } else {
+      try {
+        paymentRequired = await parsePaymentRequiredResponse(response);
+      } catch {
+        return response;
+      }
     }
-    if (!mcpSessionId && await this.merchantTransport.hasBazaarExtension(response)) {
+    if (!mcpSessionId && (paymentRequired.extensions?.bazaar != null || await this.merchantTransport.hasBazaarExtension(response))) {
       mcpSessionId = await this.merchantTransport.initialize(url, init);
       if (mcpSessionId) requestInit = this.merchantTransport.withSessionHeaders(requestInit, mcpSessionId);
     }
@@ -4067,7 +3256,7 @@ var HavenClient = class {
       throw err;
     }
     const retryResponse = await this.merchantCompletion.retryRequest(url, requestInit, paymentRequired, receipt);
-    return mcpSessionId ? this.merchantTransport.surfaceResult(retryResponse) : retryResponse;
+    return mcpSessionId || nativeChallenge ? this.merchantTransport.surfaceResult(retryResponse) : retryResponse;
   }
   /**
    * Deliver an already-signed x402 payment header to the merchant and return
@@ -4088,7 +3277,7 @@ var HavenClient = class {
    * collapses an SSE JSON-RPC response to its `result`.
    */
   /**
-   * Wait for a payment's Safe→delegate funding tx to reach ≥1 on-chain
+   * Wait for a payment's account→delegate funding tx to reach ≥1 on-chain
    * confirmation. The hosted x402 completion path MUST call this after funding
    * and before delivering the merchant payment header, so the merchant's
    * balanceOf(delegate) / transferWithAuthorization verification sees the funded
@@ -4127,10 +3316,13 @@ var HavenClient = class {
     }
     let requestInit = withX402Wallet(input.init, x402Wallet) ?? {};
     if (mcpSessionId) requestInit = this.merchantTransport.withSessionHeaders(requestInit, mcpSessionId);
-    const response = await this.merchantTransport.deliverPayment(input.url, requestInit, input.paymentHeader);
-    const surfaced = mcpSessionId ? await this.merchantTransport.surfaceResult(response) : response;
-    const protocolReceiptHeader = surfaced.headers.get("PAYMENT-RESPONSE") ?? void 0;
-    const settlement = parseMerchantSettlement(protocolReceiptHeader ?? null);
+    const response = await this.merchantTransport.deliverPaymentRecoveringSession(
+      input.url,
+      requestInit,
+      input.paymentHeader,
+      () => this.merchantTransport.initialize(input.url, input.init, x402Wallet)
+    );
+    const surfaced = await this.merchantTransport.surfaceResult(response);
     const text = await surfaced.text();
     let body;
     try {
@@ -4138,8 +3330,16 @@ var HavenClient = class {
     } catch {
       body = text;
     }
+    const toolResult = mcpToolResultOf(body);
+    const inBandChallenge = toolResult ? extractMcpPaymentRequired(toolResult) : void 0;
+    const metaSettlement = toolResult ? mcpSettlementFromToolResult(toolResult) : void 0;
+    const headerReceipt = surfaced.headers.get("PAYMENT-RESPONSE") ?? void 0;
+    const protocolReceiptHeaderName = headerReceipt ? "PAYMENT-RESPONSE" : metaSettlement ? `_meta.${MCP_X402_PAYMENT_RESPONSE_META_KEY}` : void 0;
+    const protocolReceiptHeader = headerReceipt ?? (metaSettlement ? encodeMcpSettlementReceipt(metaSettlement) : void 0);
+    const settlement = parseMerchantSettlement(protocolReceiptHeader ?? null);
+    const merchantAccepted = surfaced.ok && inBandChallenge === void 0 && metaSettlement?.success !== false;
     let evidenceOutcome;
-    if (!surfaced.ok) {
+    if (!merchantAccepted) {
       if (!input.noFundingLeg && fundingTxHash) {
         await this.merchantCompletion.recordRetryRejected({
           rail: "x402",
@@ -4169,7 +3369,7 @@ var HavenClient = class {
           merchantStatus: surfaced.status,
           paymentProofHeaderName: x402PaymentHeaderNamesSent(input.paymentHeader),
           paymentProofHeader: input.paymentHeader,
-          protocolReceiptHeaderName: protocolReceiptHeader ? "PAYMENT-RESPONSE" : void 0,
+          protocolReceiptHeaderName,
           protocolReceiptHeader
         });
       }
@@ -4177,9 +3377,10 @@ var HavenClient = class {
     }
     return {
       status: surfaced.status,
-      ok: surfaced.ok,
+      ok: merchantAccepted,
       body,
-      settlementTxHash: settlement.settlementTxHash ?? void 0,
+      // #3155 review S3: a transaction beside a rejection is not a settlement.
+      settlementTxHash: merchantAccepted ? settlement.settlementTxHash ?? void 0 : void 0,
       evidenceOutcome
     };
   }
@@ -4369,12 +3570,12 @@ var toolDescriptions = {
   payX402OneShot: {
     summary: "Fetch an x402 paid HTTP resource in a single call. Handles the full probe -> pay -> retry round trip and returns the merchant response.",
     selectionGuidance: "Prefer this over the quote+pay split when the agent just wants the paid resource and does not need to inspect the price first. If you already have a quote from haven_quote_x402, use haven_pay_x402_quote instead. Do not use for read-only allowance, budget, spend-limit, remaining-amount, reset-period, or what-can-I-spend questions; use the allowance lookup tool instead.",
-    behavior: "Calls the URL, parses any HTTP 402 x402 challenge, signs the payment locally, then retries the original request with the signed payment header (sent under PAYMENT-SIGNATURE, plus the legacy X-PAYMENT on the EIP-3009 path only) and returns the merchant response. Settlement is either direct account-to-merchant with no funding leg, or a bridge that first redeems the agent's budget delegation to fund the delegate wallet for an EIP-3009 authorization. A payment outside the on-chain budget is declined before any money moves; nothing is queued for a human to approve later. If the resource returns a non-402 status, returns it unchanged without contacting Haven.",
+    behavior: "Calls the URL, parses any HTTP 402 x402 challenge (or, since #3118, a native-MCP payment-required tool result under HTTP 200), signs the payment locally, then retries the original request with the signed payment header (sent under PAYMENT-SIGNATURE, plus the legacy X-PAYMENT on the EIP-3009 path only) and returns the merchant response. Settlement is either direct account-to-merchant with no funding leg, or a bridge that first redeems the agent's budget delegation to fund the delegate wallet for an EIP-3009 authorization. A payment outside the on-chain budget is declined before any money moves; nothing is queued for a human to approve later. If the resource returns a non-402 status with no payment-required tool result, returns it unchanged without contacting Haven.",
     nextActionGuidance: "Preserve the returned resume_state or paymentId \u2014 either identifies this payment if you need to ask about it later. This tool performs the merchant retry itself, so do not wait on a signal while the call is in flight. If the process crashes after this call and a later haven_get_payment_status reports nextAction=retry_original_x402_request, Haven's funding leg confirmed but no merchant response was ever recorded \u2014 call the resume tool with the preserved resume_state or payment_id instead of paying again. If the response carries phase=insufficient_funds and nextAction=fund_account_or_raise_allowance, the payment cannot be retried until the account is funded or the agent budget raised \u2014 stop and tell the user the shortfall reported on the response."
   },
   resumeX402: {
     summary: "Resume an x402 payment whose Haven-side authorization already succeeded but whose merchant retry did not complete.",
-    behavior: "Accepts either resume_state or payment_id, validates the original x402 details against the authorized Haven funding, and retries the merchant request with the signed payment header (sent under PAYMENT-SIGNATURE, plus the legacy X-PAYMENT on the EIP-3009 path only). No new Haven payment is created.",
+    behavior: "Accepts either resume_state or payment_id, validates the x402 details against the authorized funding, and retries the merchant request with the signed payment header (PAYMENT-SIGNATURE, plus legacy X-PAYMENT on EIP-3009 only; also params._meta on an MCP tools/call body). No new Haven payment is created.",
     nextActionGuidance: "Only call this after haven_get_payment_status reports nextAction=retry_original_x402_request \u2014 that means Haven's funding leg confirmed but no merchant response was ever recorded, most often because the process crashed between funding and the merchant retry. Any other nextAction reports a conflict instead of retrying, so do not call this speculatively. Do not start a new merchant session and do not pay again \u2014 that would pay twice for one resource."
   },
   // #1328: quoteMpp / payMpp / resumeMpp (the mpp_demo challenge/quote/resume
@@ -4413,8 +3614,8 @@ var toolDescriptions = {
   },
   listReceipts: {
     summary: "List machine-payment receipts, newest first, by page.",
-    selectionGuidance: "For transaction history or payment evidence; use the allowance tool instead for remaining allowance or what-can-I-spend questions.",
-    behavior: "Page: { receipts, total, hasMore, nextCursor }; total 0 = none exist (no indexing delay); hasMore = cut at limit, send nextCursor as cursor. parties.treasuryAccount is Haven's authoritative payer. protocolReceiptPayload is the merchant's PAYMENT-RESPONSE, relayed verbatim: merchant-controlled, unverified, not Haven's record; payer may differ from payerAddress. Proof header values are omitted.",
+    selectionGuidance: "This agent's payment evidence, not the wallet's transaction history (sweeps, funding legs, other agents); use the allowance tool instead for remaining allowance or what-can-I-spend questions.",
+    behavior: "Page { receipts, total, hasMore, nextCursor }; hasMore: pass nextCursor as cursor. parties.treasuryAccount is Haven's authoritative payer. protocolReceiptPayload is the merchant's PAYMENT-RESPONSE relayed verbatim: merchant-controlled, unverified, not Haven's record; payer may differ from payerAddress. Proof header values omitted.",
     nextActionGuidance: ""
   },
   verifyReceipt: {
@@ -4450,7 +3651,7 @@ var toolDescriptions = {
   send: {
     summary: "Send ETH or USDC directly from the agent's Haven wallet to a recipient address.",
     selectionGuidance: "Use this for plain transfers \u2014 refunding a user, paying a freelancer, topping up a co-agent's wallet, or moving funds between addresses. Do NOT use for x402 paid endpoints \u2014 use haven_pay_x402 instead. Do NOT use for read-only allowance, budget, or what-can-I-spend questions \u2014 use haven_get_allowances. Do NOT use to check whether funds are held before sending \u2014 use haven_check_funds.",
-    behavior: "Sends the requested amount by redeeming the agent's on-chain budget delegation, account to recipient with no funding leg. Budget, recipient and expiry are enforced on-chain while the transfer is prepared, so a request outside them is declined before any money moves and before the agent is asked to sign \u2014 it is never queued for a human to approve later. The agent's signing key signs the account's typed data; Haven never receives the key.",
+    behavior: "Sends the amount by redeeming the agent's on-chain budget delegation, account to recipient with no funding leg. Budget, recipient and expiry are enforced on-chain while the transfer is prepared, so a request outside them is declined before any money moves or any signing \u2014 never queued for a human to approve. The agent's signing key signs the account's typed data, refusing any that mismatches the payment's hash; Haven never receives the key.",
     nextActionGuidance: "On a decline, report the reason to the user and ask them to grant or raise the budget in Haven \u2014 there is nothing to poll and no approval will arrive. After a successful send, poll haven_get_payment_status until nextAction=none."
   },
   reportSettlementEvidence: {
@@ -5117,103 +4318,6 @@ for that credential.
 var SKILL_FOLDER_NAME = "haven-pay";
 var HAVEN_SKILL_BODY_MD = HAVEN_SKILL_MD.replace(/^---\n[\s\S]*?\n---\n+/, "");
 
-// src/next-step.ts
-var NEXT_TOOL_SERVER_NAMES = {
-  hosted: "haven",
-  signer: "haven-signer"
-};
-var NEXT_TOOL_SERVER_ROLES = {
-  haven: "hosted",
-  "haven-signer": "signer"
-};
-function renderNextTool(role, name) {
-  return `mcp__${NEXT_TOOL_SERVER_NAMES[role]}__${name}`;
-}
-function parseNextTool(literal) {
-  const m = /^mcp__([a-z0-9-]+)__([a-z0-9_]+)$/.exec(literal);
-  if (!m) return null;
-  const role = NEXT_TOOL_SERVER_ROLES[m[1]];
-  return { server: m[1], name: m[2], ...role ? { role } : {} };
-}
-var DEFAULT_NEXT_TOOL_BY_ACTION = {
-  check_status_later: "haven_get_payment_status",
-  sweep_stranded_funds: "haven_sweep_delegate"
-  // `retry_original_x402_request` is NOT here: its only live emitter
-  // (state-direct-recovery.ts, erc7710) names no tool on purpose — the retry
-  // is the agent's own HTTP call — so a default would contradict the site.
-};
-function defaultNextToolFor(action) {
-  return DEFAULT_NEXT_TOOL_BY_ACTION[action];
-}
-function createNextStepBuilder(targets) {
-  return function nextStep(input) {
-    const i = input;
-    const base = {
-      next_action: input.nextAction,
-      safe_to_continue: input.safeToContinue,
-      reason: input.reason
-    };
-    if (i.nextTool === null) {
-      return { ...base, next_tool_omitted_reason: i.nextToolOmittedReason ?? "no next tool" };
-    }
-    const target = targets[i.nextTool];
-    if (!target) {
-      return { ...base, next_tool_omitted_reason: `${i.nextTool} is not a registered next-step target` };
-    }
-    const problem = target.validate(i.nextArguments);
-    if (problem) {
-      return { ...base, next_tool_omitted_reason: `next_arguments do not parse under ${i.nextTool}: ${problem}` };
-    }
-    return {
-      ...base,
-      next_tool: renderNextTool(target.role, i.nextTool),
-      next_tool_server: NEXT_TOOL_SERVER_NAMES[target.role],
-      next_tool_name: i.nextTool,
-      next_tool_server_role: target.role,
-      next_arguments: i.nextArguments
-    };
-  };
-}
-
-// src/node-version.ts
-var HAVEN_MINIMUM_NODE_VERSION = "22.0.0";
-function parseNodeVersion(value) {
-  const match = value.trim().match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
-  if (!match) return [0, 0, 0];
-  return [Number(match[1] ?? 0), Number(match[2] ?? 0), Number(match[3] ?? 0)];
-}
-function compareNodeVersions(left, right) {
-  const leftParts = parseNodeVersion(left);
-  const rightParts = parseNodeVersion(right);
-  for (let i = 0; i < 3; i += 1) {
-    if (leftParts[i] !== rightParts[i]) return leftParts[i] > rightParts[i] ? 1 : -1;
-  }
-  return 0;
-}
-function isSupportedNodeVersion(nodeVersion = process.versions.node, minimumNodeVersion = HAVEN_MINIMUM_NODE_VERSION) {
-  return compareNodeVersions(nodeVersion, minimumNodeVersion) >= 0;
-}
-function unsupportedNodeVersionMessage(options) {
-  const nodeVersion = options.nodeVersion ?? process.versions.node;
-  const minimum = options.minimumNodeVersion ?? HAVEN_MINIMUM_NODE_VERSION;
-  const lines = [
-    `${options.subject} requires Node.js >=${minimum}, but this is Node.js ${nodeVersion}.`,
-    "",
-    "Upgrade Node, then try again:",
-    `  nvm install ${major(minimum)} && nvm use ${major(minimum)}      (nvm)`,
-    `  fnm install ${major(minimum)} && fnm use ${major(minimum)}      (fnm)`,
-    `  volta install node@${major(minimum)}                 (volta)`,
-    `  or download Node ${major(minimum)} from https://nodejs.org`,
-    "",
-    "If you use a version manager, check that the agent runtime launching Haven picks up the same version \u2014 upgrading your shell does not always change what a desktop app spawns."
-  ];
-  if (options.retryHint) lines.push("", options.retryHint);
-  return lines.join("\n");
-}
-function major(version) {
-  return String(parseNodeVersion(version)[0]);
-}
-
 // src/merchant-discovery.ts
 var MERCHANT_DISCOVERY_PATHS = ["/.well-known/haven-demo-merchant", "/"];
 var DISCOVERY_MAX_BYTES = 64 * 1024;
@@ -5258,6 +4362,6 @@ function sameUrl(a, b) {
   }
 }
 
-export { AGENT_APPROVAL_RELAY_JSON_SENTENCE, AGENT_APPROVAL_RELAY_PROSE_SENTENCE, AGENT_COMMAND_MODIFICATION_SENTENCE, AGENT_JSON_MODE_SENTENCE, AGENT_LOCAL_KEY_SENTENCE, AGENT_NETWORK_ACCESS_SENTENCE, AGENT_ONBOARDING_PROMPT, AGENT_PAYMENT_FAILURE_CODE_VALUES, AGENT_PAYMENT_NEXT_ACTION_VALUES, AGENT_PAYMENT_PHASE_VALUES, AGENT_PAYMENT_RAIL_VALUES, AGENT_README_SECTION_MD, AGENT_SECRET_HYGIENE_SENTENCE, AGENT_WIRING_COLLISION_RELAY_SENTENCE, AgentPaymentFailureCode, AgentPaymentFailureCodeDescriptions, AgentPaymentFailureCodeSchema, AgentPaymentNextAction, AgentPaymentNextActionDescriptions, AgentPaymentNextActionSchema, AgentPaymentPhase, AgentPaymentPhaseDescriptions, AgentPaymentPhaseSchema, AgentPaymentRail, AgentPaymentRailDescriptions, AgentPaymentRailSchema, AgentPaymentWarningCode, CONNECTOR_PACKAGE_NAME, DEFAULT_CONFIRMATION_TIMEOUT_MS, DEFAULT_NEXT_TOOL_BY_ACTION, DISCOVERY_MAX_BYTES, ERC7710_ASSET_TRANSFER_METHOD, HAVEN_AGENT_RUNBOOK_MD, HAVEN_CONNECTOR_CHANNEL, HAVEN_MINIMUM_NODE_VERSION, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, HavenApiError, HavenClient, HavenError, HavenInsecureRetryTargetError, HavenPaymentStateError, HavenSigningError, HavenTimeoutError, HavenUnsupportedSignerVersionError, HavenZeroSettlementHashError, INSECURE_RETRY_TARGET_CODE, MERCHANT_DISCOVERY_PATHS, MerchantTimeoutError, NEXT_TOOL_SERVER_NAMES, NEXT_TOOL_SERVER_ROLES, RECEIPT_VERSION, SIGNER_UPDATE_FALLBACK, SKILL_FOLDER_NAME, SWEEP_BASE_CHAIN_ID, SWEEP_BASE_SEPOLIA_CHAIN_ID, SWEEP_BASE_SEPOLIA_USDC_ADDRESS, SWEEP_BASE_USDC_ADDRESS, SignerRefusalCode, TRANSFER_WITH_AUTHORIZATION_TYPES, X402AlreadySettledError, X402PaymentHeaderValidationError, X402UnexpectedStatusError, X402_LEGACY_PAYMENT_HEADER_NAME, X402_MAX_AUTHORIZATION_WINDOW_SECONDS, X402_PAYMENT_HEADER_NAME, X402_PAYMENT_HEADER_NAMES_SENT, X402_PAYMENT_REQUIRED_HEADER_NAME, X402_PAYMENT_RESPONSE_HEADER_NAME, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS, addressFromKey, assertSecureX402RetryTarget, buildSweepAuthorizationMessage, buildSweepTypedData, buildX402ExpectedMessage, compareNodeVersions, composeDescription, connectorRerunCommand, connectorSpec, createNextStepBuilder, decodeBase64Json, decodeBase64Utf8, defaultNextToolFor, discoverMerchantMcpUrl, encodeBase64Json, encodeBase64Utf8, encodePaymentProof, havenTools, isConnectorChannel, isErc7710Option, isSecureX402RetryTarget, isSupportedNodeVersion, isSweepableChain, isZeroSettlementTxHash, normalizePaymentRequired, parseNextTool, parsePaymentRequired, parsePaymentRequiredResponse, readX402ReceiptPayer, renderNextTool, resolveConnectorChannel, resolveTokenFromAddress, resolveX402RetryTarget, sameUrl, selectErc7710PaymentOption, selectPaymentOption, selectStandardPaymentOption, selectX402SettlementScheme, signHash, signUserOpTypedDataForDelegation, signerUpdateFallback, sweepUsdcAddress, sweepUsdcDomain, toStandardPaymentRequirements, toolDescriptions, unsupportedNodeVersionMessage, validateStandardX402PaymentHeader, verifyPaymentReceipt, verifySignature, x402AssetTransferMethod, x402AuthorizationAmount, x402FacilitatorAddresses, x402V2PaymentEnvelope };
+export { AGENT_APPROVAL_RELAY_JSON_SENTENCE, AGENT_APPROVAL_RELAY_PROSE_SENTENCE, AGENT_COMMAND_MODIFICATION_SENTENCE, AGENT_JSON_MODE_SENTENCE, AGENT_LOCAL_KEY_SENTENCE, AGENT_NETWORK_ACCESS_SENTENCE, AGENT_ONBOARDING_PROMPT, AGENT_README_SECTION_MD, AGENT_SECRET_HYGIENE_SENTENCE, AGENT_WIRING_COLLISION_RELAY_SENTENCE, DISCOVERY_MAX_BYTES, HAVEN_AGENT_RUNBOOK_MD, HAVEN_SKILL_BODY_MD, HAVEN_SKILL_MD, HavenClient, HavenInsecureRetryTargetError, INSECURE_RETRY_TARGET_CODE, MERCHANT_DISCOVERY_PATHS, RECEIPT_VERSION, SKILL_FOLDER_NAME, addressFromKey, assertSecureX402RetryTarget, composeDescription, discoverMerchantMcpUrl, havenTools, isSecureX402RetryTarget, isZeroSettlementTxHash, readX402ReceiptPayer, resolveX402RetryTarget, sameUrl, signHash, signUserOpTypedDataForDelegation, toolDescriptions, verifyPaymentReceipt, verifySignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map