@haven_ai/sdk 0.9.0-alpha.0 → 0.10.0-alpha.0

package/README.md

@@ -454,7 +454,7 @@ Hosted MCP and signer tools also return stable `code` values on recoverable x402
 | `PRICE_EXCEEDS_MAX` | The merchant-authoritative x402 price is above the caller's spending cap. No funding transfer was created. | Tell the user the live price exceeded the cap and retry only after they confirm a higher one. Payloads carry `next_action: stop_and_tell_user` and `retry_with_new_quote: true` — the latter means any retry needs a fresh quote, not that one should be attempted unattended. |
 | `AMBIGUOUS_MAX_AMOUNT` | Both `max_amount` (atomic units) and `max_amount_human` (whole tokens) were sent for one purchase. Nothing was contacted and nothing was spent. | Re-send with exactly one — `max_amount_human` for a cap the user stated in tokens, `max_amount` for an exact atomic figure. |
 | `MAX_AMOUNT_UNCONVERTIBLE` | `max_amount_human` could not be converted against this quote's asset — its decimals are unknown to Haven, or the cap has more decimal places than the asset supports. Nothing was spent. | Round the cap to the asset's decimals, or re-send it as an exact atomic `max_amount`. |
-| `MERCHANT_NOT_READY` | The merchant answered the quote probe with its own `503 { error: 'merchant_not_ready', reason_code, retry_after_s }` instead of a 402 — it cannot settle right now (e.g. its settlement wallet is out of gas). No payment was created. | Tell the user and retry later (`retry_after_s` in the message when given); do not treat it as a wrong endpoint. Payloads carry `next_action: stop_and_tell_user` and `retry_with_new_quote: true`. |
+| `MERCHANT_NOT_READY` | The merchant answered the quote probe with its own `503 { error: 'merchant_not_ready', reason_code, retry_after_s }` instead of a 402 — it cannot settle right now (e.g. its settlement wallet is out of gas). No payment was created. | Tell the user and retry later (`retry_after_s` in the message when given); do not treat it as a wrong endpoint. An out-of-gas refusal (`reason_code: settlement_wallet_out_of_gas`) needs the merchant's operator to top up its settlement wallet first; retrying before then is refused again. Payloads carry `next_action: stop_and_tell_user` and `retry_with_new_quote: true`. |
 | `PAYMENT_WINDOW_EXPIRED` | The funding/quote window closed before `haven_x402_sign_header`, `haven_submit`, or `haven_complete_mcp_tool` could finish. | Re-run `haven_pay_mcp_tool` with the same `idempotency_key`, then sign and complete the fresh quote. Payloads include `retry_with_new_quote: true`. |
 | `MERCHANT_REJECTED_AFTER_FUNDING` | The merchant rejected the paid retry. On eip3009 Haven's funding leg had succeeded; on erc7710 there is no funding leg (#2983). | eip3009: stop retrying the merchant and call `haven_sweep_delegate` so the user can recover stranded delegate USDC. erc7710: nothing to sweep — follow the message (re-quote later if the merchant declined to settle; otherwise check `haven_get_payment_status` after the payment window before re-quoting). |
 | `MERCHANT_UNRESPONSIVE_AFTER_FUNDING` | The merchant did not answer the paid retry before the timeout — NOT proof of rejection, the merchant may still settle late. On eip3009 Haven's funding leg had succeeded; on erc7710 there is no funding leg (#3000). | eip3009: check `haven_get_payment_status`, retry `haven_complete_mcp_tool` once, and only then call `haven_sweep_delegate` if no settlement appears. erc7710: nothing to sweep and `haven_complete_mcp_tool` has no erc7710 branch — do not retry it; check `haven_get_payment_status` after the payment window and re-quote only if it shows no settlement. |

package/dist/{base64-BZDPJ8M1.d.ts → base64-CiR5BJhk.d.cts}

@@ -1,4 +1,4 @@
-import { Q as AgentNextStep, Z as AgentPaymentNextAction, aL as X402PaymentOption, aK as X402ExpectedContext, X as X402PaymentRequired, I as HavenError, am as HavenSigningError } from './types-CrszUJ7Z.js';
+import { Q as AgentNextStep, Z as AgentPaymentNextAction, aM as X402PaymentOption, aL as X402ExpectedContext, X as X402PaymentRequired, I as HavenError, an as HavenSigningError } from './types-BKgqzvnk.cjs';
 import { PaymentRequirements } from 'x402/types';
 import { Hex, Address } from 'viem';
 
@@ -200,7 +200,7 @@ declare function buildSweepAuthorizationMessage(auth: SweepAuthorization): strin
  * This SDK's own version. Owned by `scripts/release-bump.mjs`, which rewrites
  * it with the package version on every release — never hand-edit it.
  */
-declare const SDK_VERSION = "0.9.0-alpha.0";
+declare const SDK_VERSION = "0.10.0-alpha.0";
 /** The request header every published Haven client sends. */
 declare const HAVEN_CLIENT_HEADER = "X-Haven-Client";
 /** `<package>/<version>` — the value of {@link HAVEN_CLIENT_HEADER}. */
@@ -846,6 +846,14 @@ declare function resolveTokenBySymbol(chainId: number, symbol: string): {
     decimals: number;
 } | null;
 
+/** The fixed domain tag. Changing it orphans every settlement not yet detected. */
+declare const X402_PAYMENT_NONCE_TAG = "haven-x402-payment-nonce:";
+/**
+ * Derive the EIP-3009 nonce for a Haven payment id. Same input, same output,
+ * on every surface that imports this — the signer, the SDK and the backend.
+ */
+declare function deriveX402PaymentNonce(paymentId: string): `0x${string}`;
+
 /**
  * #3271: the integrity check every client runs before signing a direct
  * delegation-rail payment's typed data.
@@ -1341,4 +1349,4 @@ declare function encodeBase64Json(value: unknown): string;
  */
 declare function decodeBase64Json<T>(value: string, label?: string): T;
 
-export { X402_PAYMENT_HEADER_NAMES_SENT as $, type SweepEip712Domain as A, type SweepExpectedAuth as B, CONNECTOR_PACKAGE_NAME as C, DEFAULT_NEXT_TOOL_BY_ACTION as D, ENTRY_POINT_V07 as E, type SweepPreparation as F, type SweepSubmitResult as G, type HavenClientUpdate as H, type SweepTypedData as I, TRANSFER_WITH_AUTHORIZATION_TYPES as J, TYPED_DATA_NOT_ALLOWED as K, type TaskBudgetCloseExpectation as L, MAX_TASK_BUDGET_TTL_SECONDS as M, NEXT_TOOL_SERVER_NAMES as N, type TaskChildExpectation as O, PACKED_USER_OPERATION_FIELDS as P, type TaskChildTypedData as Q, ROOT_AUTHORITY as R, type SweepPrepareResponse as S, TASK_SIGN_CONTEXT_VERSION as T, type UnsupportedNodeVersionMessageOptions as U, X402PaymentHeaderValidationError as V, type X402SchemeSelection as W, type X402PaymentHeaderContext as X, X402_LEGACY_PAYMENT_HEADER_NAME as Y, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as Z, X402_PAYMENT_HEADER_NAME as _, type SweepAuthorization as a, HYBRID_DELEGATOR_IMPLEMENTATION as a$, X402_PAYMENT_REQUIRED_HEADER_NAME as a0, X402_PAYMENT_RESPONSE_HEADER_NAME as a1, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as a2, assertBoundDirectPaymentUserOp as a3, assertOwnTaskBudgetCloseUserOp as a4, assertOwnTaskChild as a5, assertUserOpTypedDataBinding as a6, buildSweepAuthorizationMessage as a7, buildSweepTypedData as a8, buildX402ExpectedMessage as a9, renderNextTool as aA, resolveConnectorChannel as aB, resolveTokenBySymbol as aC, resolveTokenFromAddress as aD, selectErc7710PaymentOption as aE, selectPaymentOption as aF, selectStandardPaymentOption as aG, selectX402SettlementScheme as aH, sweepUsdcAddress as aI, sweepUsdcDomain as aJ, toStandardPaymentRequirements as aK, unsupportedNodeVersionMessage as aL, validateStandardX402PaymentHeader as aM, verifySettlementChild as aN, x402AssetTransferMethod as aO, x402AuthorizationAmount as aP, x402FacilitatorAddresses as aQ, x402PaymentHeaderNamesFor as aR, x402RetryHeadersFor as aS, x402V2PaymentEnvelope as aT, type DelegationForHashing as aU, CAVEAT_ENFORCERS as aV, CAVEAT_TYPEHASH as aW, DELEGATION_MANAGER as aX, DELEGATION_TYPEHASH as aY, DIRECT_PAYMENT_CHAIN_IDS as aZ, EXECUTE_ABI as a_, compareNodeVersions as aa, connectorRerunCommand as ab, connectorSpec as ac, connectorUpgradeCommand as ad, createNextStepBuilder as ae, decodeBase64Json as af, decodeBase64Utf8 as ag, defaultNextToolFor as ah, deriveDelegateAccountAddress as ai, encodeBase64Json as aj, encodeBase64Utf8 as ak, encodePaymentProof as al, hashDelegation as am, havenClientIdentity as an, isConnectorChannel as ao, isErc7710Option as ap, isPackedUserOperationTypedData as aq, isSupportedNodeVersion as ar, isSweepableChain as as, isTaskChildTypedData as at, normalizePaymentRequired as au, packedUserOperationHash as av, parseNextTool as aw, parsePaymentRequired as ax, parsePaymentRequiredResponse as ay, readClientUpdate as az, type SweepSubmitResponse as b, MAX_SETTLEMENT_WINDOW_SECONDS as b0, SIMPLE_FACTORY_ADDRESS as b1, type SettlementChildTypedData as b2, assertFundingLegPaysDelegate as b3, assertOwnSettlementChild as b4, chainIdForNetwork as b5, isSettlementChildTypedData as b6, DIRECT_SIGN_CONTEXT_VERSION as c, ERC7710_ASSET_TRANSFER_METHOD as d, HAVEN_CLIENT_HEADER as e, HAVEN_CONNECTOR_CHANNEL as f, HAVEN_MINIMUM_NODE_VERSION as g, HYBRID_DELEGATOR_DOMAIN_NAME as h, HYBRID_DELEGATOR_DOMAIN_VERSION as i, HavenTypedDataRefusedError as j, HavenUserOpBindingError as k, NEXT_TOOL_SERVER_ROLES as l, type NextStep as m, type NextStepArguments as n, type NextStepHandoff as o, type NextStepInput as p, type NextStepTarget as q, type NextStepTargets as r, type NextToolServerRole as s, SDK_CLIENT_IDENTITY as t, SDK_VERSION as u, SWEEP_BASE_CHAIN_ID as v, SWEEP_BASE_SEPOLIA_CHAIN_ID as w, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as x, SWEEP_BASE_USDC_ADDRESS as y, type SettlementChildExpectation as z };
+export { X402_PAYMENT_HEADER_NAMES_SENT as $, type SweepEip712Domain as A, type SweepExpectedAuth as B, CONNECTOR_PACKAGE_NAME as C, DEFAULT_NEXT_TOOL_BY_ACTION as D, ENTRY_POINT_V07 as E, type SweepPreparation as F, type SweepSubmitResult as G, type HavenClientUpdate as H, type SweepTypedData as I, TRANSFER_WITH_AUTHORIZATION_TYPES as J, TYPED_DATA_NOT_ALLOWED as K, type TaskBudgetCloseExpectation as L, MAX_TASK_BUDGET_TTL_SECONDS as M, NEXT_TOOL_SERVER_NAMES as N, type TaskChildExpectation as O, PACKED_USER_OPERATION_FIELDS as P, type TaskChildTypedData as Q, ROOT_AUTHORITY as R, type SweepPrepareResponse as S, TASK_SIGN_CONTEXT_VERSION as T, type UnsupportedNodeVersionMessageOptions as U, X402PaymentHeaderValidationError as V, type X402SchemeSelection as W, type X402PaymentHeaderContext as X, X402_LEGACY_PAYMENT_HEADER_NAME as Y, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as Z, X402_PAYMENT_HEADER_NAME as _, type SweepAuthorization as a, DIRECT_PAYMENT_CHAIN_IDS as a$, X402_PAYMENT_NONCE_TAG as a0, X402_PAYMENT_REQUIRED_HEADER_NAME as a1, X402_PAYMENT_RESPONSE_HEADER_NAME as a2, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as a3, assertBoundDirectPaymentUserOp as a4, assertOwnTaskBudgetCloseUserOp as a5, assertOwnTaskChild as a6, assertUserOpTypedDataBinding as a7, buildSweepAuthorizationMessage as a8, buildSweepTypedData as a9, parsePaymentRequiredResponse as aA, readClientUpdate as aB, renderNextTool as aC, resolveConnectorChannel as aD, resolveTokenBySymbol as aE, resolveTokenFromAddress as aF, selectErc7710PaymentOption as aG, selectPaymentOption as aH, selectStandardPaymentOption as aI, selectX402SettlementScheme as aJ, sweepUsdcAddress as aK, sweepUsdcDomain as aL, toStandardPaymentRequirements as aM, unsupportedNodeVersionMessage as aN, validateStandardX402PaymentHeader as aO, verifySettlementChild as aP, x402AssetTransferMethod as aQ, x402AuthorizationAmount as aR, x402FacilitatorAddresses as aS, x402PaymentHeaderNamesFor as aT, x402RetryHeadersFor as aU, x402V2PaymentEnvelope as aV, type DelegationForHashing as aW, CAVEAT_ENFORCERS as aX, CAVEAT_TYPEHASH as aY, DELEGATION_MANAGER as aZ, DELEGATION_TYPEHASH as a_, buildX402ExpectedMessage as aa, compareNodeVersions as ab, connectorRerunCommand as ac, connectorSpec as ad, connectorUpgradeCommand as ae, createNextStepBuilder as af, decodeBase64Json as ag, decodeBase64Utf8 as ah, defaultNextToolFor as ai, deriveDelegateAccountAddress as aj, deriveX402PaymentNonce as ak, encodeBase64Json as al, encodeBase64Utf8 as am, encodePaymentProof as an, hashDelegation as ao, havenClientIdentity as ap, isConnectorChannel as aq, isErc7710Option as ar, isPackedUserOperationTypedData as as, isSupportedNodeVersion as at, isSweepableChain as au, isTaskChildTypedData as av, normalizePaymentRequired as aw, packedUserOperationHash as ax, parseNextTool as ay, parsePaymentRequired as az, type SweepSubmitResponse as b, EXECUTE_ABI as b0, HYBRID_DELEGATOR_IMPLEMENTATION as b1, MAX_SETTLEMENT_WINDOW_SECONDS as b2, SIMPLE_FACTORY_ADDRESS as b3, type SettlementChildTypedData as b4, assertFundingLegPaysDelegate as b5, assertOwnSettlementChild as b6, chainIdForNetwork as b7, isSettlementChildTypedData as b8, DIRECT_SIGN_CONTEXT_VERSION as c, ERC7710_ASSET_TRANSFER_METHOD as d, HAVEN_CLIENT_HEADER as e, HAVEN_CONNECTOR_CHANNEL as f, HAVEN_MINIMUM_NODE_VERSION as g, HYBRID_DELEGATOR_DOMAIN_NAME as h, HYBRID_DELEGATOR_DOMAIN_VERSION as i, HavenTypedDataRefusedError as j, HavenUserOpBindingError as k, NEXT_TOOL_SERVER_ROLES as l, type NextStep as m, type NextStepArguments as n, type NextStepHandoff as o, type NextStepInput as p, type NextStepTarget as q, type NextStepTargets as r, type NextToolServerRole as s, SDK_CLIENT_IDENTITY as t, SDK_VERSION as u, SWEEP_BASE_CHAIN_ID as v, SWEEP_BASE_SEPOLIA_CHAIN_ID as w, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as x, SWEEP_BASE_USDC_ADDRESS as y, type SettlementChildExpectation as z };

package/dist/{base64-Cyxhsvqd.d.cts → base64-CxkinHPQ.d.ts}

@@ -1,4 +1,4 @@
-import { Q as AgentNextStep, Z as AgentPaymentNextAction, aL as X402PaymentOption, aK as X402ExpectedContext, X as X402PaymentRequired, I as HavenError, am as HavenSigningError } from './types-CrszUJ7Z.cjs';
+import { Q as AgentNextStep, Z as AgentPaymentNextAction, aM as X402PaymentOption, aL as X402ExpectedContext, X as X402PaymentRequired, I as HavenError, an as HavenSigningError } from './types-BKgqzvnk.js';
 import { PaymentRequirements } from 'x402/types';
 import { Hex, Address } from 'viem';
 
@@ -200,7 +200,7 @@ declare function buildSweepAuthorizationMessage(auth: SweepAuthorization): strin
  * This SDK's own version. Owned by `scripts/release-bump.mjs`, which rewrites
  * it with the package version on every release — never hand-edit it.
  */
-declare const SDK_VERSION = "0.9.0-alpha.0";
+declare const SDK_VERSION = "0.10.0-alpha.0";
 /** The request header every published Haven client sends. */
 declare const HAVEN_CLIENT_HEADER = "X-Haven-Client";
 /** `<package>/<version>` — the value of {@link HAVEN_CLIENT_HEADER}. */
@@ -846,6 +846,14 @@ declare function resolveTokenBySymbol(chainId: number, symbol: string): {
     decimals: number;
 } | null;
 
+/** The fixed domain tag. Changing it orphans every settlement not yet detected. */
+declare const X402_PAYMENT_NONCE_TAG = "haven-x402-payment-nonce:";
+/**
+ * Derive the EIP-3009 nonce for a Haven payment id. Same input, same output,
+ * on every surface that imports this — the signer, the SDK and the backend.
+ */
+declare function deriveX402PaymentNonce(paymentId: string): `0x${string}`;
+
 /**
  * #3271: the integrity check every client runs before signing a direct
  * delegation-rail payment's typed data.
@@ -1341,4 +1349,4 @@ declare function encodeBase64Json(value: unknown): string;
  */
 declare function decodeBase64Json<T>(value: string, label?: string): T;
 
-export { X402_PAYMENT_HEADER_NAMES_SENT as $, type SweepEip712Domain as A, type SweepExpectedAuth as B, CONNECTOR_PACKAGE_NAME as C, DEFAULT_NEXT_TOOL_BY_ACTION as D, ENTRY_POINT_V07 as E, type SweepPreparation as F, type SweepSubmitResult as G, type HavenClientUpdate as H, type SweepTypedData as I, TRANSFER_WITH_AUTHORIZATION_TYPES as J, TYPED_DATA_NOT_ALLOWED as K, type TaskBudgetCloseExpectation as L, MAX_TASK_BUDGET_TTL_SECONDS as M, NEXT_TOOL_SERVER_NAMES as N, type TaskChildExpectation as O, PACKED_USER_OPERATION_FIELDS as P, type TaskChildTypedData as Q, ROOT_AUTHORITY as R, type SweepPrepareResponse as S, TASK_SIGN_CONTEXT_VERSION as T, type UnsupportedNodeVersionMessageOptions as U, X402PaymentHeaderValidationError as V, type X402SchemeSelection as W, type X402PaymentHeaderContext as X, X402_LEGACY_PAYMENT_HEADER_NAME as Y, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as Z, X402_PAYMENT_HEADER_NAME as _, type SweepAuthorization as a, HYBRID_DELEGATOR_IMPLEMENTATION as a$, X402_PAYMENT_REQUIRED_HEADER_NAME as a0, X402_PAYMENT_RESPONSE_HEADER_NAME as a1, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as a2, assertBoundDirectPaymentUserOp as a3, assertOwnTaskBudgetCloseUserOp as a4, assertOwnTaskChild as a5, assertUserOpTypedDataBinding as a6, buildSweepAuthorizationMessage as a7, buildSweepTypedData as a8, buildX402ExpectedMessage as a9, renderNextTool as aA, resolveConnectorChannel as aB, resolveTokenBySymbol as aC, resolveTokenFromAddress as aD, selectErc7710PaymentOption as aE, selectPaymentOption as aF, selectStandardPaymentOption as aG, selectX402SettlementScheme as aH, sweepUsdcAddress as aI, sweepUsdcDomain as aJ, toStandardPaymentRequirements as aK, unsupportedNodeVersionMessage as aL, validateStandardX402PaymentHeader as aM, verifySettlementChild as aN, x402AssetTransferMethod as aO, x402AuthorizationAmount as aP, x402FacilitatorAddresses as aQ, x402PaymentHeaderNamesFor as aR, x402RetryHeadersFor as aS, x402V2PaymentEnvelope as aT, type DelegationForHashing as aU, CAVEAT_ENFORCERS as aV, CAVEAT_TYPEHASH as aW, DELEGATION_MANAGER as aX, DELEGATION_TYPEHASH as aY, DIRECT_PAYMENT_CHAIN_IDS as aZ, EXECUTE_ABI as a_, compareNodeVersions as aa, connectorRerunCommand as ab, connectorSpec as ac, connectorUpgradeCommand as ad, createNextStepBuilder as ae, decodeBase64Json as af, decodeBase64Utf8 as ag, defaultNextToolFor as ah, deriveDelegateAccountAddress as ai, encodeBase64Json as aj, encodeBase64Utf8 as ak, encodePaymentProof as al, hashDelegation as am, havenClientIdentity as an, isConnectorChannel as ao, isErc7710Option as ap, isPackedUserOperationTypedData as aq, isSupportedNodeVersion as ar, isSweepableChain as as, isTaskChildTypedData as at, normalizePaymentRequired as au, packedUserOperationHash as av, parseNextTool as aw, parsePaymentRequired as ax, parsePaymentRequiredResponse as ay, readClientUpdate as az, type SweepSubmitResponse as b, MAX_SETTLEMENT_WINDOW_SECONDS as b0, SIMPLE_FACTORY_ADDRESS as b1, type SettlementChildTypedData as b2, assertFundingLegPaysDelegate as b3, assertOwnSettlementChild as b4, chainIdForNetwork as b5, isSettlementChildTypedData as b6, DIRECT_SIGN_CONTEXT_VERSION as c, ERC7710_ASSET_TRANSFER_METHOD as d, HAVEN_CLIENT_HEADER as e, HAVEN_CONNECTOR_CHANNEL as f, HAVEN_MINIMUM_NODE_VERSION as g, HYBRID_DELEGATOR_DOMAIN_NAME as h, HYBRID_DELEGATOR_DOMAIN_VERSION as i, HavenTypedDataRefusedError as j, HavenUserOpBindingError as k, NEXT_TOOL_SERVER_ROLES as l, type NextStep as m, type NextStepArguments as n, type NextStepHandoff as o, type NextStepInput as p, type NextStepTarget as q, type NextStepTargets as r, type NextToolServerRole as s, SDK_CLIENT_IDENTITY as t, SDK_VERSION as u, SWEEP_BASE_CHAIN_ID as v, SWEEP_BASE_SEPOLIA_CHAIN_ID as w, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as x, SWEEP_BASE_USDC_ADDRESS as y, type SettlementChildExpectation as z };
+export { X402_PAYMENT_HEADER_NAMES_SENT as $, type SweepEip712Domain as A, type SweepExpectedAuth as B, CONNECTOR_PACKAGE_NAME as C, DEFAULT_NEXT_TOOL_BY_ACTION as D, ENTRY_POINT_V07 as E, type SweepPreparation as F, type SweepSubmitResult as G, type HavenClientUpdate as H, type SweepTypedData as I, TRANSFER_WITH_AUTHORIZATION_TYPES as J, TYPED_DATA_NOT_ALLOWED as K, type TaskBudgetCloseExpectation as L, MAX_TASK_BUDGET_TTL_SECONDS as M, NEXT_TOOL_SERVER_NAMES as N, type TaskChildExpectation as O, PACKED_USER_OPERATION_FIELDS as P, type TaskChildTypedData as Q, ROOT_AUTHORITY as R, type SweepPrepareResponse as S, TASK_SIGN_CONTEXT_VERSION as T, type UnsupportedNodeVersionMessageOptions as U, X402PaymentHeaderValidationError as V, type X402SchemeSelection as W, type X402PaymentHeaderContext as X, X402_LEGACY_PAYMENT_HEADER_NAME as Y, X402_MAX_AUTHORIZATION_WINDOW_SECONDS as Z, X402_PAYMENT_HEADER_NAME as _, type SweepAuthorization as a, DIRECT_PAYMENT_CHAIN_IDS as a$, X402_PAYMENT_NONCE_TAG as a0, X402_PAYMENT_REQUIRED_HEADER_NAME as a1, X402_PAYMENT_RESPONSE_HEADER_NAME as a2, X402_SETTLEMENT_FORWARD_MARGIN_SECONDS as a3, assertBoundDirectPaymentUserOp as a4, assertOwnTaskBudgetCloseUserOp as a5, assertOwnTaskChild as a6, assertUserOpTypedDataBinding as a7, buildSweepAuthorizationMessage as a8, buildSweepTypedData as a9, parsePaymentRequiredResponse as aA, readClientUpdate as aB, renderNextTool as aC, resolveConnectorChannel as aD, resolveTokenBySymbol as aE, resolveTokenFromAddress as aF, selectErc7710PaymentOption as aG, selectPaymentOption as aH, selectStandardPaymentOption as aI, selectX402SettlementScheme as aJ, sweepUsdcAddress as aK, sweepUsdcDomain as aL, toStandardPaymentRequirements as aM, unsupportedNodeVersionMessage as aN, validateStandardX402PaymentHeader as aO, verifySettlementChild as aP, x402AssetTransferMethod as aQ, x402AuthorizationAmount as aR, x402FacilitatorAddresses as aS, x402PaymentHeaderNamesFor as aT, x402RetryHeadersFor as aU, x402V2PaymentEnvelope as aV, type DelegationForHashing as aW, CAVEAT_ENFORCERS as aX, CAVEAT_TYPEHASH as aY, DELEGATION_MANAGER as aZ, DELEGATION_TYPEHASH as a_, buildX402ExpectedMessage as aa, compareNodeVersions as ab, connectorRerunCommand as ac, connectorSpec as ad, connectorUpgradeCommand as ae, createNextStepBuilder as af, decodeBase64Json as ag, decodeBase64Utf8 as ah, defaultNextToolFor as ai, deriveDelegateAccountAddress as aj, deriveX402PaymentNonce as ak, encodeBase64Json as al, encodeBase64Utf8 as am, encodePaymentProof as an, hashDelegation as ao, havenClientIdentity as ap, isConnectorChannel as aq, isErc7710Option as ar, isPackedUserOperationTypedData as as, isSupportedNodeVersion as at, isSweepableChain as au, isTaskChildTypedData as av, normalizePaymentRequired as aw, packedUserOperationHash as ax, parseNextTool as ay, parsePaymentRequired as az, type SweepSubmitResponse as b, EXECUTE_ABI as b0, HYBRID_DELEGATOR_IMPLEMENTATION as b1, MAX_SETTLEMENT_WINDOW_SECONDS as b2, SIMPLE_FACTORY_ADDRESS as b3, type SettlementChildTypedData as b4, assertFundingLegPaysDelegate as b5, assertOwnSettlementChild as b6, chainIdForNetwork as b7, isSettlementChildTypedData as b8, DIRECT_SIGN_CONTEXT_VERSION as c, ERC7710_ASSET_TRANSFER_METHOD as d, HAVEN_CLIENT_HEADER as e, HAVEN_CONNECTOR_CHANNEL as f, HAVEN_MINIMUM_NODE_VERSION as g, HYBRID_DELEGATOR_DOMAIN_NAME as h, HYBRID_DELEGATOR_DOMAIN_VERSION as i, HavenTypedDataRefusedError as j, HavenUserOpBindingError as k, NEXT_TOOL_SERVER_ROLES as l, type NextStep as m, type NextStepArguments as n, type NextStepHandoff as o, type NextStepInput as p, type NextStepTarget as q, type NextStepTargets as r, type NextToolServerRole as s, SDK_CLIENT_IDENTITY as t, SDK_VERSION as u, SWEEP_BASE_CHAIN_ID as v, SWEEP_BASE_SEPOLIA_CHAIN_ID as w, SWEEP_BASE_SEPOLIA_USDC_ADDRESS as x, SWEEP_BASE_USDC_ADDRESS as y, type SettlementChildExpectation as z };

package/dist/{chunk-ZDKNPNI3.cjs → chunk-22FJ4JQO.cjs}

@@ -1,13 +1,13 @@
 'use strict';
 
-var chunk4Z6ATE44_cjs = require('./chunk-4Z6ATE44.cjs');
+var chunkH37YVYZA_cjs = require('./chunk-H37YVYZA.cjs');
 var viem = require('viem');
 var crypto = require('crypto');
 var secp256k1 = require('@noble/curves/secp256k1');
 var accounts = require('viem/accounts');
 
 var TYPED_DATA_NOT_ALLOWED = "TYPED_DATA_NOT_ALLOWED";
-var HavenTypedDataRefusedError = class extends chunk4Z6ATE44_cjs.HavenSigningError {
+var HavenTypedDataRefusedError = class extends chunkH37YVYZA_cjs.HavenSigningError {
   constructor(message) {
     super(message);
     this.code = TYPED_DATA_NOT_ALLOWED;
@@ -48,7 +48,7 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
       `This signer only signs direct payments on chains the delegation rail has pinned contracts for (${[...DIRECT_PAYMENT_CHAIN_IDS].join(", ")}); this typed data names chain ${String(domain.chainId)}. Refusing.`
     );
   }
-  const ownAccount = chunk4Z6ATE44_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkH37YVYZA_cjs.deriveDelegateAccountAddress(delegateAddress);
   const sender = typeof message.sender === "string" ? message.sender : "";
   if (sender.toLowerCase() !== ownAccount.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
@@ -78,9 +78,9 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
       "This UserOperation's execute() call does not re-encode to the exact callData bytes (trailing or non-canonical bytes). Refusing."
     );
   }
-  if (decoded.target.toLowerCase() !== chunk4Z6ATE44_cjs.DELEGATION_MANAGER.toLowerCase()) {
+  if (decoded.target.toLowerCase() !== chunkH37YVYZA_cjs.DELEGATION_MANAGER.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
-      `This UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunk4Z6ATE44_cjs.DELEGATION_MANAGER}). A direct payment only ever redeems the agent's own budget delegation \u2014 refusing what looks like a self-call (e.g. transferOwnership, updateSigners, upgradeToAndCall) or a call to an unrelated contract.`
+      `This UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkH37YVYZA_cjs.DELEGATION_MANAGER}). A direct payment only ever redeems the agent's own budget delegation \u2014 refusing what looks like a self-call (e.g. transferOwnership, updateSigners, upgradeToAndCall) or a call to an unrelated contract.`
     );
   }
   if (decoded.value !== 0n) {
@@ -89,20 +89,20 @@ function assertBoundDirectPaymentUserOp(typedData, delegateAddress) {
     );
   }
   try {
-    chunk4Z6ATE44_cjs.assertRedeemsOwnBudgetDelegation(decoded.callData, ownAccount);
+    chunkH37YVYZA_cjs.assertRedeemsOwnBudgetDelegation(decoded.callData, ownAccount);
   } catch (err) {
     throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
   }
 }
 function assertOwnSettlementChild(typedData, expectation, delegateAddress) {
   try {
-    chunk4Z6ATE44_cjs.verifySettlementChild(typedData, {
+    chunkH37YVYZA_cjs.verifySettlementChild(typedData, {
       ...expectation,
-      delegatorAccount: chunk4Z6ATE44_cjs.deriveDelegateAccountAddress(delegateAddress)
+      delegatorAccount: chunkH37YVYZA_cjs.deriveDelegateAccountAddress(delegateAddress)
     });
   } catch (err) {
     if (err instanceof HavenTypedDataRefusedError) throw err;
-    if (err instanceof chunk4Z6ATE44_cjs.HavenSigningError) throw new HavenTypedDataRefusedError(err.message);
+    if (err instanceof chunkH37YVYZA_cjs.HavenSigningError) throw new HavenTypedDataRefusedError(err.message);
     throw new HavenTypedDataRefusedError(
       `Refusing to sign the x402 settlement child: it is malformed (${err instanceof Error ? err.message : String(err)}).`
     );
@@ -131,7 +131,7 @@ function assertFundingLegPaysDelegate(typedData, expected) {
   try {
     const { args: executeArgs } = viem.decodeFunctionData({ abi: EXECUTE_ABI, data: message.callData });
     const inner = executeArgs[0].callData;
-    const { args } = viem.decodeFunctionData({ abi: chunk4Z6ATE44_cjs.REDEEM_DELEGATIONS_ABI, data: inner });
+    const { args } = viem.decodeFunctionData({ abi: chunkH37YVYZA_cjs.REDEEM_DELEGATIONS_ABI, data: inner });
     const executions = args[2];
     executionCallData = executions[0];
   } catch {
@@ -250,7 +250,7 @@ var TRANSFER_WITH_AUTHORIZATION_TYPES = {
 function sweepUsdcAddress(chainId) {
   const address = USDC_ADDRESS_BY_CHAIN[chainId];
   if (!address) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
     );
   }
@@ -259,7 +259,7 @@ function sweepUsdcAddress(chainId) {
 function sweepUsdcDomain(chainId) {
   const domain = USDC_EIP712_DOMAIN_BY_CHAIN[chainId];
   if (!domain) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Sweep is not supported on chain ${chainId}. Supported: ${SWEEPABLE_CHAIN_IDS.join(", ")}.`
     );
   }
@@ -272,12 +272,12 @@ function buildSweepTypedData(auth) {
   const domain = sweepUsdcDomain(auth.chainId);
   const expectedToken = sweepUsdcAddress(auth.chainId);
   if (!sameAddress(auth.token, expectedToken)) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Sweep token ${auth.token} is not the canonical USDC contract for chain ${auth.chainId}.`
     );
   }
   if (!/^0x[0-9a-fA-F]{64}$/.test(auth.nonce)) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError("Sweep nonce must be a 0x-prefixed 32-byte hex string.");
+    throw new chunkH37YVYZA_cjs.HavenSigningError("Sweep nonce must be a 0x-prefixed 32-byte hex string.");
   }
   return {
     domain,
@@ -782,7 +782,7 @@ function stableStringify2(value) {
 }
 
 // src/client-identity.ts
-var SDK_VERSION = "0.9.0-alpha.0";
+var SDK_VERSION = "0.10.0-alpha.0";
 var HAVEN_CLIENT_HEADER = "X-Haven-Client";
 function havenClientIdentity(pkg, version) {
   return `${pkg}/${version}`;
@@ -815,7 +815,7 @@ function addressFromKey(privateKey) {
   try {
     return accounts.privateKeyToAddress(`0x${hexBytes(privateKey, 32, "private key")}`);
   } catch (err) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Invalid private key: ${err instanceof Error ? err.message : String(err)}`
     );
   }
@@ -829,7 +829,7 @@ function signHash(privateKey, hash) {
       yParity: recovery
     });
   } catch (err) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Failed to sign hash: ${err instanceof Error ? err.message : String(err)}`
     );
   }
@@ -865,7 +865,7 @@ var TAX_DECLARATION_TYPES = {
 var X_TAX_DECLARATION_HEADER = "X-Tax-Declaration";
 function validateContent(content) {
   if (typeof content !== "object" || content === null || Array.isArray(content)) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError("Tax declaration content must be an object.");
+    throw new chunkH37YVYZA_cjs.HavenSigningError("Tax declaration content must be an object.");
   }
   const record = content;
   for (const field of ["principalId", "principalAttributionHash"]) {
@@ -918,7 +918,7 @@ function taxPrincipalId(network, delegateAddress) {
   if (network.startsWith("eip155:")) {
     return `did:pkh:${network}:${delegateAddress}`;
   }
-  const chainId = chunk4Z6ATE44_cjs.chainIdForNetwork(network);
+  const chainId = chunkH37YVYZA_cjs.chainIdForNetwork(network);
   if (chainId === void 0) {
     throw new TaxDeclarationRefusedError(
       `The accepted payment option's network '${network}' is not a CAIP-2 eip155 chain this SDK can name; refusing to build a tax principal without the settlement network.`
@@ -963,18 +963,22 @@ function addressFromKeyForTax(delegateKey) {
   try {
     return addressFromKey(delegateKey);
   } catch (err) {
-    throw new chunk4Z6ATE44_cjs.HavenSigningError(
+    throw new chunkH37YVYZA_cjs.HavenSigningError(
       `Invalid delegate key for tax declaration signing: ${err instanceof Error ? err.message : String(err)}`
     );
   }
 }
-var TaxDeclarationRefusedError = class extends chunk4Z6ATE44_cjs.HavenSigningError {
+var TaxDeclarationRefusedError = class extends chunkH37YVYZA_cjs.HavenSigningError {
   code = "TAX_DECLARATION_REFUSED";
   constructor(message) {
     super(message);
     this.name = "TaxDeclarationRefusedError";
   }
 };
+var X402_PAYMENT_NONCE_TAG = "haven-x402-payment-nonce:";
+function deriveX402PaymentNonce(paymentId) {
+  return viem.keccak256(viem.concatHex([viem.toHex(X402_PAYMENT_NONCE_TAG), viem.toHex(paymentId)]));
+}
 
 // src/next-step.ts
 var NEXT_TOOL_SERVER_NAMES = {
@@ -1120,10 +1124,10 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
   if (td?.primaryType !== "Delegation") {
     refuseTaskChild("it is not a Delegation payload", `primaryType was '${String(td?.primaryType)}'.`);
   }
-  if (!same(td.domain?.verifyingContract, chunk4Z6ATE44_cjs.DELEGATION_MANAGER)) {
+  if (!same(td.domain?.verifyingContract, chunkH37YVYZA_cjs.DELEGATION_MANAGER)) {
     refuseTaskChild(
       "the EIP-712 domain names an unknown DelegationManager",
-      `Expected ${chunk4Z6ATE44_cjs.DELEGATION_MANAGER}, got ${td.domain?.verifyingContract}.`
+      `Expected ${chunkH37YVYZA_cjs.DELEGATION_MANAGER}, got ${td.domain?.verifyingContract}.`
     );
   }
   if (td.domain?.name !== DELEGATION_DOMAIN_NAME || td.domain?.version !== DELEGATION_DOMAIN_VERSION) {
@@ -1151,7 +1155,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected chain ${expected.chainId}; the child says ${td.domain?.chainId}.`
     );
   }
-  const ownAccount = chunk4Z6ATE44_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkH37YVYZA_cjs.deriveDelegateAccountAddress(delegateAddress);
   const delegator = td.message?.delegator;
   if (typeof delegator !== "string" || !same(delegator, ownAccount)) {
     refuseTaskChild(
@@ -1170,7 +1174,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
   if (typeof authority !== "string" || !/^0x[0-9a-fA-F]{64}$/.test(authority)) {
     refuseTaskChild("its authority is not a 32-byte delegation hash", `Got ${String(authority)}.`);
   }
-  if (authority.toLowerCase() === chunk4Z6ATE44_cjs.ROOT_AUTHORITY) {
+  if (authority.toLowerCase() === chunkH37YVYZA_cjs.ROOT_AUTHORITY) {
     refuseTaskChild(
       "it is a ROOT delegation, not a re-delegation of the agent budget",
       "A task budget always chains under the agent budget delegation."
@@ -1183,7 +1187,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
     );
   }
   const caveats = td.message?.caveats ?? [];
-  const transfer = findCaveat(caveats, chunk4Z6ATE44_cjs.CAVEAT_ENFORCERS.erc20TransferAmount);
+  const transfer = findCaveat(caveats, chunkH37YVYZA_cjs.CAVEAT_ENFORCERS.erc20TransferAmount);
   if (!transfer) {
     refuseTaskChild(
       "it has no ERC-20 transfer-amount caveat",
@@ -1201,7 +1205,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected ${expected.maxAmountAtomic}; the child allows ${amount.toString()}.`
     );
   }
-  const timestamp = findCaveat(caveats, chunk4Z6ATE44_cjs.CAVEAT_ENFORCERS.timestamp);
+  const timestamp = findCaveat(caveats, chunkH37YVYZA_cjs.CAVEAT_ENFORCERS.timestamp);
   if (!timestamp) {
     refuseTaskChild("it never expires", "A task-budget child without a timestamp caveat is open-ended.");
   }
@@ -1222,7 +1226,7 @@ function assertOwnTaskChild(typedData, expected, delegateAddress, now = Date.now
       `Expected ${expected.expiresAt}; the child says ${beforeThreshold}.`
     );
   }
-  const calldata = findCaveat(caveats, chunk4Z6ATE44_cjs.CAVEAT_ENFORCERS.allowedCalldata);
+  const calldata = findCaveat(caveats, chunkH37YVYZA_cjs.CAVEAT_ENFORCERS.allowedCalldata);
   if (expected.recipientAddress) {
     if (!calldata) {
       refuseTaskChild(
@@ -1259,7 +1263,7 @@ var DISABLE_DELEGATION_ABI = [
   {
     type: "function",
     name: "disableDelegation",
-    inputs: [{ name: "delegation", type: "tuple", components: chunk4Z6ATE44_cjs.DELEGATION_TUPLE_COMPONENTS }],
+    inputs: [{ name: "delegation", type: "tuple", components: chunkH37YVYZA_cjs.DELEGATION_TUPLE_COMPONENTS }],
     outputs: [],
     stateMutability: "nonpayable"
   }
@@ -1278,7 +1282,7 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       `This signer only signs a task-budget close on chains the delegation rail has pinned contracts for (${[...DIRECT_PAYMENT_CHAIN_IDS].join(", ")}); this typed data names chain ${String(domain.chainId)}. Refusing.`
     );
   }
-  const ownAccount = chunk4Z6ATE44_cjs.deriveDelegateAccountAddress(delegateAddress);
+  const ownAccount = chunkH37YVYZA_cjs.deriveDelegateAccountAddress(delegateAddress);
   const sender = typeof message.sender === "string" ? message.sender : "";
   if (sender.toLowerCase() !== ownAccount.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
@@ -1301,9 +1305,9 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       "This close UserOperation's execute() call does not re-encode to the exact callData bytes (trailing or non-canonical bytes). Refusing."
     );
   }
-  if (decoded.target.toLowerCase() !== chunk4Z6ATE44_cjs.DELEGATION_MANAGER.toLowerCase()) {
+  if (decoded.target.toLowerCase() !== chunkH37YVYZA_cjs.DELEGATION_MANAGER.toLowerCase()) {
     throw new HavenTypedDataRefusedError(
-      `This close UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunk4Z6ATE44_cjs.DELEGATION_MANAGER}). Refusing what looks like a self-call or a call to an unrelated contract.`
+      `This close UserOperation's execute() calls ${decoded.target}, not the DelegationManager (${chunkH37YVYZA_cjs.DELEGATION_MANAGER}). Refusing what looks like a self-call or a call to an unrelated contract.`
     );
   }
   if (decoded.value !== 0n) {
@@ -1340,7 +1344,7 @@ function assertOwnTaskBudgetCloseUserOp(typedData, expected, delegateAddress) {
       `This close UserOperation disables a delegation granted to ${delegation.delegate}, not this signer's own account (${ownAccount}) \u2014 a task-budget child is always self-delegated. Refusing.`
     );
   }
-  if (delegation.authority.toLowerCase() === chunk4Z6ATE44_cjs.ROOT_AUTHORITY) {
+  if (delegation.authority.toLowerCase() === chunkH37YVYZA_cjs.ROOT_AUTHORITY) {
     throw new HavenTypedDataRefusedError(
       "This close UserOperation disables a ROOT delegation, not a re-delegation of the agent budget. A task-budget child always chains under the agent budget delegation. Refusing."
     );
@@ -1412,6 +1416,7 @@ exports.X402_MAX_AUTHORIZATION_WINDOW_SECONDS = X402_MAX_AUTHORIZATION_WINDOW_SE
 exports.X402_PAYMENT_HEADER_NAME = X402_PAYMENT_HEADER_NAME;
 exports.X402_PAYMENT_HEADER_NAMES = X402_PAYMENT_HEADER_NAMES;
 exports.X402_PAYMENT_HEADER_NAMES_SENT = X402_PAYMENT_HEADER_NAMES_SENT;
+exports.X402_PAYMENT_NONCE_TAG = X402_PAYMENT_NONCE_TAG;
 exports.X402_PAYMENT_REQUIRED_HEADER_NAME = X402_PAYMENT_REQUIRED_HEADER_NAME;
 exports.X402_PAYMENT_RESPONSE_HEADER_NAME = X402_PAYMENT_RESPONSE_HEADER_NAME;
 exports.X402_SETTLEMENT_FORWARD_MARGIN_SECONDS = X402_SETTLEMENT_FORWARD_MARGIN_SECONDS;
@@ -1432,6 +1437,7 @@ exports.createNextStepBuilder = createNextStepBuilder;
 exports.decodeBase64Json = decodeBase64Json;
 exports.decodeBase64Utf8 = decodeBase64Utf8;
 exports.defaultNextToolFor = defaultNextToolFor;
+exports.deriveX402PaymentNonce = deriveX402PaymentNonce;
 exports.encodeBase64Json = encodeBase64Json;
 exports.encodeBase64Utf8 = encodeBase64Utf8;
 exports.encodePaymentProof = encodePaymentProof;
@@ -1471,5 +1477,5 @@ exports.x402PaymentHeaderNamesFor = x402PaymentHeaderNamesFor;
 exports.x402PaymentHeaderNamesSent = x402PaymentHeaderNamesSent;
 exports.x402RetryHeadersFor = x402RetryHeadersFor;
 exports.x402V2PaymentEnvelope = x402V2PaymentEnvelope;
-//# sourceMappingURL=chunk-ZDKNPNI3.cjs.map
-//# sourceMappingURL=chunk-ZDKNPNI3.cjs.map
+//# sourceMappingURL=chunk-22FJ4JQO.cjs.map
+//# sourceMappingURL=chunk-22FJ4JQO.cjs.map