@haven_ai/sdk 0.6.0-alpha.0 → 0.8.0-alpha.0

package/dist/{chunk-CK4NLLMO.cjs → chunk-WJFDXCYP.cjs}

@@ -1,11 +1,13 @@
 'use strict';
 
-var chunkS42QSWJY_cjs = require('./chunk-S42QSWJY.cjs');
+var chunkHX34HOW4_cjs = require('./chunk-HX34HOW4.cjs');
 var viem = require('viem');
 var crypto = require('crypto');
+var secp256k1 = require('@noble/curves/secp256k1');
+var accounts = require('viem/accounts');
 
 var TYPED_DATA_NOT_ALLOWED = "TYPED_DATA_NOT_ALLOWED";
-var HavenTypedDataRefusedError = class extends chunkS42QSWJY_cjs.HavenSigningError {
+var HavenTypedDataRefusedError = class extends chunkHX34HOW4_cjs.HavenSigningError {
   constructor(message) {
     super(message);
     this.code = TYPED_DATA_NOT_ALLOWED;
@@ -46,7 +48,7 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
       `This signer only signs direct payments on chains the delegation rail has pinned contracts for (${[...DIRECT_PAYMENT_CHAIN_IDS].join(", ")}); this typed data names chain ${String(domain.chainId)}. Refusing.`
     );
   }
-  const ownAccount = chunkS42QSWJY_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkHX34HOW4_cjs.deriveDelegateAccountAddress(delegateAddress);
   const sender = typeof message.sender === "string" ? message.sender : "";
   if (sender.toLowerCase() !== ownAccount.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
@@ -76,9 +78,9 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
       "This UserOperation's execute() call does not re-encode to the exact callData bytes (trailing or non-canonical bytes). Refusing."
     );
   }
-  if (decoded.target.toLowerCase() !== chunkS42QSWJY_cjs.DELEGATION_MANAGER.toLowerCase()) {
+  if (decoded.target.toLowerCase() !== chunkHX34HOW4_cjs.DELEGATION_MANAGER.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
-      `This UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkS42QSWJY_cjs.DELEGATION_MANAGER}). A direct payment only ever redeems the agent's own budget delegation \u2014 refusing what looks like a self-call (e.g. transferOwnership, updateSigners, upgradeToAndCall) or a call to an unrelated contract.`
+      `This UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkHX34HOW4_cjs.DELEGATION_MANAGER}). A direct payment only ever redeems the agent's own budget delegation \u2014 refusing what looks like a self-call (e.g. transferOwnership, updateSigners, upgradeToAndCall) or a call to an unrelated contract.`
     );
   }
   if (decoded.value !== 0n) {
@@ -87,20 +89,20 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
     );
   }
   try {
-    chunkS42QSWJY_cjs.assertRedeemsOwnBudgetDelegation(decoded.callData, ownAccount);
+    chunkHX34HOW4_cjs.assertRedeemsOwnBudgetDelegation(decoded.callData, ownAccount);
   } catch (err) {
     throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
   }
 }
 function assertOwnSettlementChild(typedData, expectation, delegateAddress) {
   try {
-    chunkS42QSWJY_cjs.verifySettlementChild(typedData, {
+    chunkHX34HOW4_cjs.verifySettlementChild(typedData, {
       ...expectation,
-      delegatorAccount: chunkS42QSWJY_cjs.deriveDelegateAccountAddress(delegateAddress)
+      delegatorAccount: chunkHX34HOW4_cjs.deriveDelegateAccountAddress(delegateAddress)
     });
   } catch (err) {
     if (err instanceof HavenTypedDataRefusedError) throw err;
-    if (err instanceof chunkS42QSWJY_cjs.HavenSigningError) throw new HavenTypedDataRefusedError(err.message);
+    if (err instanceof chunkHX34HOW4_cjs.HavenSigningError) throw new HavenTypedDataRefusedError(err.message);
     throw new HavenTypedDataRefusedError(
       `Refusing to sign the x402 settlement child: it is malformed (${err instanceof Error ? err.message : String(err)}).`
     );
@@ -129,7 +131,7 @@ function assertFundingLegPaysDelegate(typedData, expected) {
   try {
     const { args: executeArgs } = viem.decodeFunctionData({ abi: EXECUTE_ABI, data: message.callData });
     const inner = executeArgs[0].callData;
-    const { args } = viem.decodeFunctionData({ abi: chunkS42QSWJY_cjs.REDEEM_DELEGATIONS_ABI, data: inner });
+    const { args } = viem.decodeFunctionData({ abi: chunkHX34HOW4_cjs.REDEEM_DELEGATIONS_ABI, data: inner });
     const executions = args[2];
     executionCallData = executions[0];
   } catch {
@@ -248,7 +250,7 @@ var TRANSFER_WITH_AUTHORIZATION_TYPES = {
 function sweepUsdcAddress(chainId) {
   const address = USDC_ADDRESS_BY_CHAIN[chainId];
   if (!address) {
-    throw new chunkS42QSWJY_cjs.HavenSigningError(
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
       `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
     );
   }
@@ -257,7 +259,7 @@ function sweepUsdcAddress(chainId) {
 function sweepUsdcDomain(chainId) {
   const domain = USDC_EIP712_DOMAIN_BY_CHAIN[chainId];
   if (!domain) {
-    throw new chunkS42QSWJY_cjs.HavenSigningError(
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
       `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
     );
   }
@@ -270,12 +272,12 @@ function buildSweepTypedData(auth) {
   const domain = sweepUsdcDomain(auth.chainId);
   const expectedToken = sweepUsdcAddress(auth.chainId);
   if (!sameAddress(auth.token, expectedToken)) {
-    throw new chunkS42QSWJY_cjs.HavenSigningError(
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
       `Sweep token ${auth.token} is not the canonical USDC contract for chain ${auth.chainId}.`
     );
   }
   if (!/^0x[0-9a-fA-F]{64}$/.test(auth.nonce)) {
-    throw new chunkS42QSWJY_cjs.HavenSigningError("Sweep nonce must be a 0x-prefixed 32-byte hex string.");
+    throw new chunkHX34HOW4_cjs.HavenSigningError("Sweep nonce must be a 0x-prefixed 32-byte hex string.");
   }
   return {
     domain,
@@ -396,7 +398,6 @@ function normalizePaymentRequired(value) {
   };
 }
 var SUPPORTED_X402_NETWORKS = {
-  "eip155:100": "Gnosis Chain",
   "eip155:8453": "Base",
   "base": "Base",
   "eip155:84532": "Base Sepolia",
@@ -408,11 +409,6 @@ var STANDARD_X402_NETWORKS = {
   "eip155:84532": "base-sepolia",
   "base-sepolia": "base-sepolia"
 };
-var GNOSIS_TOKENS = {
-  "0x0000000000000000000000000000000000000000": { symbol: "xDAI", decimals: 18 },
-  "0xcb444e90d8198415266c6a2724b7900fb12fc56e": { symbol: "EURe", decimals: 18 },
-  "0x2a22f9c3b484c3629090feed35f17ff8f88f76f0": { symbol: "USDC.e", decimals: 6 }
-};
 var BASE_TOKENS = {
   "0x0000000000000000000000000000000000000000": { symbol: "ETH", decimals: 18 },
   "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913": { symbol: "USDC", decimals: 6 }
@@ -422,12 +418,10 @@ var BASE_SEPOLIA_TOKENS = {
   "0x036cbd53842c5426634e7929541ec2318f3dcf7e": { symbol: "USDC", decimals: 6 }
 };
 var ALL_TOKENS = {
-  ...GNOSIS_TOKENS,
   ...BASE_TOKENS,
   ...BASE_SEPOLIA_TOKENS
 };
 var NETWORK_TOKENS = {
-  "eip155:100": GNOSIS_TOKENS,
   "eip155:8453": BASE_TOKENS,
   "base": BASE_TOKENS,
   "eip155:84532": BASE_SEPOLIA_TOKENS,
@@ -762,11 +756,15 @@ function encodePaymentProof(receipt) {
 }
 function resolveTokenFromAddress(address, network) {
   const lower = address.toLowerCase();
-  if (network && network in NETWORK_TOKENS) {
-    return NETWORK_TOKENS[network][lower] ?? null;
-  }
+  if (network) return NETWORK_TOKENS[network]?.[lower] ?? null;
   return ALL_TOKENS[lower] ?? null;
 }
+function resolveTokenBySymbol(chainId, symbol) {
+  const table = NETWORK_TOKENS[`eip155:${chainId}`];
+  if (!table) return null;
+  const hit = Object.entries(table).find(([, token]) => token.symbol === symbol);
+  return hit ? { ...hit[1] } : null;
+}
 function stableStringify2(value) {
   if (value === null || typeof value !== "object") {
     const primitive = JSON.stringify(value);
@@ -779,7 +777,7 @@ function stableStringify2(value) {
 }
 
 // src/client-identity.ts
-var SDK_VERSION = "0.6.0-alpha.0";
+var SDK_VERSION = "0.8.0-alpha.0";
 var HAVEN_CLIENT_HEADER = "X-Haven-Client";
 function havenClientIdentity(pkg, version) {
   return `${pkg}/${version}`;
@@ -801,6 +799,177 @@ function readClientUpdate(value) {
     notes_url: typeof v.notes_url === "string" ? v.notes_url : null
   };
 }
+var HALF_N = BigInt("0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0");
+function hexBytes(value, bytes, what) {
+  if (!/^0x[0-9a-fA-F]+$/.test(value) || value.length !== 2 + bytes * 2) {
+    throw new Error(`${what} must be a 0x-prefixed ${bytes}-byte hex string`);
+  }
+  return value.slice(2);
+}
+function addressFromKey(privateKey) {
+  try {
+    return accounts.privateKeyToAddress(`0x${hexBytes(privateKey, 32, "private key")}`);
+  } catch (err) {
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
+      `Invalid private key: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function signHash(privateKey, hash) {
+  try {
+    const { r, s, recovery } = secp256k1.secp256k1.sign(hexBytes(hash, 32, "hash"), hexBytes(privateKey, 32, "private key"), { lowS: true });
+    return viem.serializeSignature({
+      r: `0x${r.toString(16).padStart(64, "0")}`,
+      s: `0x${s.toString(16).padStart(64, "0")}`,
+      yParity: recovery
+    });
+  } catch (err) {
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
+      `Failed to sign hash: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+function verifySignature(hash, signature, expectedAddress) {
+  try {
+    const sig = hexBytes(signature, 65, "signature");
+    const hashHex = hexBytes(hash, 32, "hash");
+    if (BigInt(`0x${sig.slice(64, 128)}`) > HALF_N) return false;
+    const yParityOrV = Number.parseInt(sig.slice(128), 16);
+    const recoveryBit = yParityOrV === 0 || yParityOrV === 27 ? 0 : yParityOrV === 1 || yParityOrV === 28 ? 1 : -1;
+    if (recoveryBit < 0) return false;
+    const publicKey = secp256k1.secp256k1.Signature.fromCompact(sig.slice(0, 128)).addRecoveryBit(recoveryBit).recoverPublicKey(hashHex).toHex(false);
+    const recovered = accounts.publicKeyToAddress(`0x${publicKey}`);
+    return recovered.toLowerCase() === expectedAddress.toLowerCase();
+  } catch {
+    return false;
+  }
+}
+var TAX_DECLARATION_DOMAIN = { name: "x402 Tax Declaration", version: "1" };
+var TAX_DECLARATION_PRIMARY_TYPE = "TaxDeclaration";
+var TAX_DECLARATION_TYPES = {
+  TaxDeclaration: [
+    { name: "version", type: "string" },
+    { name: "jurisdiction", type: "string" },
+    { name: "taxableStatus", type: "string" },
+    { name: "taxId", type: "string" },
+    { name: "validUntil", type: "uint256" },
+    { name: "principalId", type: "string" },
+    { name: "principalAttributionHash", type: "string" }
+  ]
+};
+var X_TAX_DECLARATION_HEADER = "X-Tax-Declaration";
+function validateContent(content) {
+  if (typeof content !== "object" || content === null || Array.isArray(content)) {
+    throw new chunkHX34HOW4_cjs.HavenSigningError("Tax declaration content must be an object.");
+  }
+  const record = content;
+  for (const field of ["principalId", "principalAttributionHash"]) {
+    if (record[field] !== void 0) {
+      throw new TaxDeclarationRefusedError(
+        `Tax declaration content arrives with ${field} already set; that field is computed locally from the delegate key and the accepted payment option, never accepted from Haven.`
+      );
+    }
+  }
+  const allowed = /* @__PURE__ */ new Set(["version", "jurisdiction", "taxableStatus", "taxId", "validUntil"]);
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) {
+      throw new TaxDeclarationRefusedError(
+        `Tax declaration content carries an unknown field '${key}'; the signed shape is built locally from the \xA72.1 fields only.`
+      );
+    }
+  }
+  const strings = ["version", "jurisdiction", "taxableStatus", "taxId"];
+  for (const key of strings) {
+    if (typeof record[key] !== "string" || record[key].length === 0) {
+      throw new TaxDeclarationRefusedError(
+        `Tax declaration content field '${key}' must be a non-empty string.`
+      );
+    }
+  }
+  if (typeof record.validUntil !== "number" || !Number.isInteger(record.validUntil) || record.validUntil <= 0) {
+    throw new TaxDeclarationRefusedError(
+      "Tax declaration content field 'validUntil' must be a positive integer (milliseconds)."
+    );
+  }
+  return {
+    version: record.version,
+    jurisdiction: record.jurisdiction,
+    taxableStatus: record.taxableStatus,
+    taxId: record.taxId,
+    validUntil: record.validUntil
+  };
+}
+function jcsCanonicalBytes(value) {
+  const keys = Object.keys(value).sort();
+  const members = keys.map((key) => `${JSON.stringify(key)}:${JSON.stringify(value[key])}`);
+  return `{${members.join(",")}}`;
+}
+function principalAttributionHash(principalId) {
+  const canonical = jcsCanonicalBytes({ principalId });
+  const hex2 = crypto.createHash("sha256").update(canonical, "utf8").digest("hex");
+  return `sha-256:${hex2}`;
+}
+function taxPrincipalId(network, delegateAddress) {
+  if (network.startsWith("eip155:")) {
+    return `did:pkh:${network}:${delegateAddress}`;
+  }
+  const chainId = chunkHX34HOW4_cjs.chainIdForNetwork(network);
+  if (chainId === void 0) {
+    throw new TaxDeclarationRefusedError(
+      `The accepted payment option's network '${network}' is not a CAIP-2 eip155 chain this SDK can name; refusing to build a tax principal without the settlement network.`
+    );
+  }
+  return `did:pkh:eip155:${chainId}:${delegateAddress}`;
+}
+function buildSignedTaxDeclaration(input) {
+  const content = validateContent(input.content);
+  const principalId = taxPrincipalId(input.network, addressFromKeyForTax(input.delegateKey));
+  const attributionHash = principalAttributionHash(principalId);
+  const declaration = { ...content, principalId, principalAttributionHash: attributionHash };
+  const message = { ...declaration, validUntil: BigInt(declaration.validUntil) };
+  const digest = viem.hashTypedData({
+    domain: TAX_DECLARATION_DOMAIN,
+    types: TAX_DECLARATION_TYPES,
+    primaryType: TAX_DECLARATION_PRIMARY_TYPE,
+    message
+  });
+  const signature = signHash(input.delegateKey, digest);
+  return { declaration, signature };
+}
+function verifyTaxDeclarationSignature(declaration, signature, expectedAddress) {
+  const message = { ...declaration, validUntil: BigInt(declaration.validUntil) };
+  const digest = viem.hashTypedData({
+    domain: TAX_DECLARATION_DOMAIN,
+    types: TAX_DECLARATION_TYPES,
+    primaryType: TAX_DECLARATION_PRIMARY_TYPE,
+    message
+  });
+  return verifySignature(digest, signature, expectedAddress);
+}
+function encodeTaxDeclarationHeader(result) {
+  const json = JSON.stringify({ ...result.declaration, signature: result.signature });
+  return base64Url(json);
+}
+function base64Url(value) {
+  const standard = typeof Buffer !== "undefined" ? Buffer.from(value, "utf8").toString("base64") : btoa(String.fromCharCode(...new TextEncoder().encode(value)));
+  return standard.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function addressFromKeyForTax(delegateKey) {
+  try {
+    return addressFromKey(delegateKey);
+  } catch (err) {
+    throw new chunkHX34HOW4_cjs.HavenSigningError(
+      `Invalid delegate key for tax declaration signing: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
+var TaxDeclarationRefusedError = class extends chunkHX34HOW4_cjs.HavenSigningError {
+  code = "TAX_DECLARATION_REFUSED";
+  constructor(message) {
+    super(message);
+    this.name = "TaxDeclarationRefusedError";
+  }
+};
 
 // src/next-step.ts
 var NEXT_TOOL_SERVER_NAMES = {
@@ -946,10 +1115,10 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
   if (td?.primaryType !== "Delegation") {
     refuseTaskChild("it is not a Delegation payload", `primaryType was '${String(td?.primaryType)}'.`);
   }
-  if (!same(td.domain?.verifyingContract, chunkS42QSWJY_cjs.DELEGATION_MANAGER)) {
+  if (!same(td.domain?.verifyingContract, chunkHX34HOW4_cjs.DELEGATION_MANAGER)) {
     refuseTaskChild(
       "the EIP-712 domain names an unknown DelegationManager",
-      `Expected ${chunkS42QSWJY_cjs.DELEGATION_MANAGER}, got ${td.domain?.verifyingContract}.`
+      `Expected ${chunkHX34HOW4_cjs.DELEGATION_MANAGER}, got ${td.domain?.verifyingContract}.`
     );
   }
   if (td.domain?.name !== DELEGATION_DOMAIN_NAME || td.domain?.version !== DELEGATION_DOMAIN_VERSION) {
@@ -977,7 +1146,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected chain ${expected.chainId}; the child says ${td.domain?.chainId}.`
     );
   }
-  const ownAccount = chunkS42QSWJY_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkHX34HOW4_cjs.deriveDelegateAccountAddress(delegateAddress);
   const delegator = td.message?.delegator;
   if (typeof delegator !== "string" || !same(delegator, ownAccount)) {
     refuseTaskChild(
@@ -996,7 +1165,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
   if (typeof authority !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(authority)) {
     refuseTaskChild("its authority is not a 32-byte delegation hash", `Got ${String(authority)}.`);
   }
-  if (authority.toLowerCase() === chunkS42QSWJY_cjs.ROOT_AUTHORITY) {
+  if (authority.toLowerCase() === chunkHX34HOW4_cjs.ROOT_AUTHORITY) {
     refuseTaskChild(
       "it is a ROOT delegation, not a re-delegation of the agent budget",
       "A task budget always chains under the agent budget delegation."
@@ -1009,7 +1178,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
     );
   }
   const caveats = td.message?.caveats ?? [];
-  const transfer = findCaveat(caveats, chunkS42QSWJY_cjs.CAVEAT_ENFORCERS.erc20TransferAmount);
+  const transfer = findCaveat(caveats, chunkHX34HOW4_cjs.CAVEAT_ENFORCERS.erc20TransferAmount);
   if (!transfer) {
     refuseTaskChild(
       "it has no ERC-20 transfer-amount caveat",
@@ -1027,7 +1196,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected ${expected.maxAmountAtomic}; the child allows ${amount.toString()}.`
     );
   }
-  const timestamp = findCaveat(caveats, chunkS42QSWJY_cjs.CAVEAT_ENFORCERS.timestamp);
+  const timestamp = findCaveat(caveats, chunkHX34HOW4_cjs.CAVEAT_ENFORCERS.timestamp);
   if (!timestamp) {
     refuseTaskChild("it never expires", "A task-budget child without a timestamp caveat is open-ended.");
   }
@@ -1048,7 +1217,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected ${expected.expiresAt}; the child says ${beforeThreshold}.`
     );
   }
-  const calldata = findCaveat(caveats, chunkS42QSWJY_cjs.CAVEAT_ENFORCERS.allowedCalldata);
+  const calldata = findCaveat(caveats, chunkHX34HOW4_cjs.CAVEAT_ENFORCERS.allowedCalldata);
   if (expected.recipientAddress) {
     if (!calldata) {
       refuseTaskChild(
@@ -1085,7 +1254,7 @@ var DISABLE_DELEGATION_ABI = [
   {
     type: "function",
     name: "disableDelegation",
-    inputs: [{ name: "delegation", type: "tuple", components: chunkS42QSWJY_cjs.DELEGATION_TUPLE_COMPONENTS }],
+    inputs: [{ name: "delegation", type: "tuple", components: chunkHX34HOW4_cjs.DELEGATION_TUPLE_COMPONENTS }],
     outputs: [],
     stateMutability: "nonpayable"
   }
@@ -1104,7 +1273,7 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       `This signer only signs a task-budget close on chains the delegation rail has pinned contracts for (${[...DIRECT_PAYMENT_CHAIN_IDS].join(", ")}); this typed data names chain ${String(domain.chainId)}. Refusing.`
     );
   }
-  const ownAccount = chunkS42QSWJY_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkHX34HOW4_cjs.deriveDelegateAccountAddress(delegateAddress);
   const sender = typeof message.sender === "string" ? message.sender : "";
   if (sender.toLowerCase() !== ownAccount.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
@@ -1127,9 +1296,9 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       "This close UserOperation's execute() call does not re-encode to the exact callData bytes (trailing or non-canonical bytes). Refusing."
     );
   }
-  if (decoded.target.toLowerCase() !== chunkS42QSWJY_cjs.DELEGATION_MANAGER.toLowerCase()) {
+  if (decoded.target.toLowerCase() !== chunkHX34HOW4_cjs.DELEGATION_MANAGER.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
-      `This close UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkS42QSWJY_cjs.DELEGATION_MANAGER}). Refusing what looks like a self-call or a call to an unrelated contract.`
+      `This close UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkHX34HOW4_cjs.DELEGATION_MANAGER}). Refusing what looks like a self-call or a call to an unrelated contract.`
     );
   }
   if (decoded.value !== 0n) {
@@ -1166,7 +1335,7 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       `This close UserOperation disables a delegation granted to ${delegation.delegate}, not this signer's own account (${ownAccount}) \u2014 a task-budget child is always self-delegated. Refusing.`
     );
   }
-  if (delegation.authority.toLowerCase() === chunkS42QSWJY_cjs.ROOT_AUTHORITY) {
+  if (delegation.authority.toLowerCase() === chunkHX34HOW4_cjs.ROOT_AUTHORITY) {
     throw new HavenTypedDataRefusedError(
       "This close UserOperation disables a ROOT delegation, not a re-delegation of the agent budget. A task-budget child always chains under the agent budget delegation. Refusing."
     );
@@ -1226,8 +1395,12 @@ exports.SWEEP_BASE_CHAIN_ID = SWEEP_BASE_CHAIN_ID;
 exports.SWEEP_BASE_SEPOLIA_CHAIN_ID = SWEEP_BASE_SEPOLIA_CHAIN_ID;
 exports.SWEEP_BASE_SEPOLIA_USDC_ADDRESS = SWEEP_BASE_SEPOLIA_USDC_ADDRESS;
 exports.SWEEP_BASE_USDC_ADDRESS = SWEEP_BASE_USDC_ADDRESS;
+exports.TAX_DECLARATION_DOMAIN = TAX_DECLARATION_DOMAIN;
+exports.TAX_DECLARATION_PRIMARY_TYPE = TAX_DECLARATION_PRIMARY_TYPE;
+exports.TAX_DECLARATION_TYPES = TAX_DECLARATION_TYPES;
 exports.TRANSFER_WITH_AUTHORIZATION_TYPES = TRANSFER_WITH_AUTHORIZATION_TYPES;
 exports.TYPED_DATA_NOT_ALLOWED = TYPED_DATA_NOT_ALLOWED;
+exports.TaxDeclarationRefusedError = TaxDeclarationRefusedError;
 exports.X402PaymentHeaderValidationError = X402PaymentHeaderValidationError;
 exports.X402_LEGACY_PAYMENT_HEADER_NAME = X402_LEGACY_PAYMENT_HEADER_NAME;
 exports.X402_MAX_AUTHORIZATION_WINDOW_SECONDS = X402_MAX_AUTHORIZATION_WINDOW_SECONDS;
@@ -1237,11 +1410,14 @@ exports.X402_PAYMENT_HEADER_NAMES_SENT = X402_PAYMENT_HEADER_NAMES_SENT;
 exports.X402_PAYMENT_REQUIRED_HEADER_NAME = X402_PAYMENT_REQUIRED_HEADER_NAME;
 exports.X402_PAYMENT_RESPONSE_HEADER_NAME = X402_PAYMENT_RESPONSE_HEADER_NAME;
 exports.X402_SETTLEMENT_FORWARD_MARGIN_SECONDS = X402_SETTLEMENT_FORWARD_MARGIN_SECONDS;
+exports.X_TAX_DECLARATION_HEADER = X_TAX_DECLARATION_HEADER;
+exports.addressFromKey = addressFromKey;
 exports.assertBoundDirectPaymentUserOp = assertBoundDirectPaymentUserOp;
 exports.assertFundingLegPaysDelegate = assertFundingLegPaysDelegate;
 exports.assertOwnSettlementChild = assertOwnSettlementChild;
 exports.assertOwnTaskBudgetCloseUserOp = assertOwnTaskBudgetCloseUserOp;
 exports.assertOwnTaskChild = assertOwnTaskChild;
+exports.buildSignedTaxDeclaration = buildSignedTaxDeclaration;
 exports.buildSweepAuthorizationMessage = buildSweepAuthorizationMessage;
 exports.buildSweepTypedData = buildSweepTypedData;
 exports.buildX402ExpectedMessage = buildX402ExpectedMessage;
@@ -1254,6 +1430,7 @@ exports.defaultNextToolFor = defaultNextToolFor;
 exports.encodeBase64Json = encodeBase64Json;
 exports.encodeBase64Utf8 = encodeBase64Utf8;
 exports.encodePaymentProof = encodePaymentProof;
+exports.encodeTaxDeclarationHeader = encodeTaxDeclarationHeader;
 exports.hashDelegation = hashDelegation;
 exports.havenClientIdentity = havenClientIdentity;
 exports.isErc7710Option = isErc7710Option;
@@ -1264,23 +1441,29 @@ exports.normalizePaymentRequired = normalizePaymentRequired;
 exports.parseNextTool = parseNextTool;
 exports.parsePaymentRequired = parsePaymentRequired;
 exports.parsePaymentRequiredResponse = parsePaymentRequiredResponse;
+exports.principalAttributionHash = principalAttributionHash;
 exports.readClientUpdate = readClientUpdate;
 exports.renderNextTool = renderNextTool;
+exports.resolveTokenBySymbol = resolveTokenBySymbol;
 exports.resolveTokenFromAddress = resolveTokenFromAddress;
 exports.selectErc7710PaymentOption = selectErc7710PaymentOption;
 exports.selectPaymentOption = selectPaymentOption;
 exports.selectStandardPaymentOption = selectStandardPaymentOption;
 exports.selectX402SettlementScheme = selectX402SettlementScheme;
+exports.signHash = signHash;
 exports.sweepUsdcAddress = sweepUsdcAddress;
 exports.sweepUsdcDomain = sweepUsdcDomain;
+exports.taxPrincipalId = taxPrincipalId;
 exports.toStandardPaymentRequirements = toStandardPaymentRequirements;
 exports.unsupportedNodeVersionMessage = unsupportedNodeVersionMessage;
 exports.validateStandardX402PaymentHeader = validateStandardX402PaymentHeader;
+exports.verifySignature = verifySignature;
+exports.verifyTaxDeclarationSignature = verifyTaxDeclarationSignature;
 exports.x402AssetTransferMethod = x402AssetTransferMethod;
 exports.x402AuthorizationAmount = x402AuthorizationAmount;
 exports.x402FacilitatorAddresses = x402FacilitatorAddresses;
 exports.x402PaymentHeaderNamesFor = x402PaymentHeaderNamesFor;
 exports.x402PaymentHeaderNamesSent = x402PaymentHeaderNamesSent;
 exports.x402V2PaymentEnvelope = x402V2PaymentEnvelope;
-//# sourceMappingURL=chunk-CK4NLLMO.cjs.map
-//# sourceMappingURL=chunk-CK4NLLMO.cjs.map
+//# sourceMappingURL=chunk-WJFDXCYP.cjs.map
+//# sourceMappingURL=chunk-WJFDXCYP.cjs.map