@vapi-network/core 0.7.0 → 0.9.0

package/dist/router-client.js

@@ -4373,7 +4373,7 @@ function weierstrass(curveDef) {
   function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
     if (["recovered", "canonical"].some((k) => k in opts))
       throw new Error("sign() legacy options not supported");
-    const { hash: hash4, randomBytes: randomBytes5 } = CURVE;
+    const { hash: hash4, randomBytes: randomBytes9 } = CURVE;
     let { lowS, prehash, extraEntropy: ent } = opts;
     if (lowS == null)
       lowS = true;
@@ -4385,7 +4385,7 @@ function weierstrass(curveDef) {
     const d = normPrivateKeyToScalar(privateKey);
     const seedArgs = [int2octets(d), int2octets(h1int)];
     if (ent != null && ent !== false) {
-      const e3 = ent === true ? randomBytes5(Fp.BYTES) : ent;
+      const e3 = ent === true ? randomBytes9(Fp.BYTES) : ent;
       seedArgs.push(ensureBytes("extraEntropy", e3));
     }
     const seed = concatBytes3(...seedArgs);
@@ -28522,8 +28522,8 @@ function date4(params) {
 
 // src/agent-link.ts
 import { createHash } from "node:crypto";
-import { mkdir as mkdir2, open as open2, stat, unlink } from "node:fs/promises";
-import { dirname as dirname2 } from "node:path";
+import { mkdir as mkdir4, open as open3, stat as stat3, unlink as unlink2 } from "node:fs/promises";
+import { dirname as dirname3 } from "node:path";
 
 // ../../node_modules/.pnpm/viem@2.56.1_typescript@6.0.3_zod@4.5.4/node_modules/viem/_esm/utils/signature/hashMessage.js
 init_keccak256();
@@ -30917,12 +30917,14 @@ function uid(length = 11) {
 }
 
 // src/audit.ts
-import { appendFile, chmod, mkdir, readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
+import { appendFile, chmod, mkdir as mkdir3, readFile as readFile3 } from "node:fs/promises";
+import { join as join3 } from "node:path";
 
 // src/config.ts
+import { constants } from "node:fs";
+import { copyFile, mkdir as mkdir2, readFile as readFile2, rename as rename2, stat as stat2, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname as dirname2, join as join2 } from "node:path";
 
 // ../../node_modules/.pnpm/viem@2.56.1_typescript@6.0.3_zod@4.5.4/node_modules/viem/_esm/utils/abi/encodeEventTopics.js
 init_abi();
@@ -36625,6 +36627,225 @@ init_getAddress();
 init_isAddress();
 init_toHex();
 
+// src/atomic-file.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { link, mkdir, open as open2, readdir, readFile, rename, stat, unlink } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+var DEFAULT_LOCK_TIMEOUT_MS = 2e3;
+var LOCK_RETRY_MS = 20;
+var LOCK_STALE_AFTER_MS = 12e4;
+var LOCK_HEARTBEAT_MS = 3e4;
+var atomicFileTestHooks;
+var FileLockedError = class extends Error {
+  constructor(message = "Timed out waiting for the file lock.") {
+    super(message);
+    this.name = "FileLockedError";
+  }
+};
+async function withFileLock(lockPath, fn, options = {}) {
+  await mkdir(dirname(lockPath), { recursive: true, mode: 448 });
+  const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_LOCK_TIMEOUT_MS);
+  const ownerRecord = {
+    pid: process.pid,
+    token: randomBytes2(16).toString("hex")
+  };
+  const owner = JSON.stringify(ownerRecord);
+  const releasedOwner = JSON.stringify({ ...ownerRecord, released: true });
+  let handle;
+  while (handle === void 0) {
+    await atomicFileTestHooks?.beforeLockAttempt?.(lockPath);
+    try {
+      const candidate = await open2(lockPath, "wx", 384);
+      try {
+        await candidate.writeFile(owner, "utf8");
+        await candidate.sync();
+        await atomicFileTestHooks?.afterLockCreate?.(lockPath);
+        if (await lockTakeoverInProgress(lockPath)) {
+          await candidate.close();
+          await removeOwnedLock(lockPath, [owner]);
+          await removeAbandonedLockTombs(lockPath);
+          if (Date.now() >= deadline) {
+            throw new FileLockedError(options.lockedMessage);
+          }
+          await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+          continue;
+        }
+        handle = candidate;
+      } catch (error61) {
+        await candidate.close().catch(() => void 0);
+        await removeOwnedLock(lockPath, [owner]).catch(() => void 0);
+        throw error61;
+      }
+    } catch (error61) {
+      if (!hasCode(error61, "EEXIST")) throw error61;
+      await removeStaleLock(lockPath);
+      if (Date.now() >= deadline) {
+        throw new FileLockedError(options.lockedMessage);
+      }
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+    }
+  }
+  const ownedHandle = handle;
+  const heartbeat = setInterval(() => {
+    const time3 = /* @__PURE__ */ new Date();
+    void ownedHandle.utimes(time3, time3).catch(() => void 0);
+  }, LOCK_HEARTBEAT_MS);
+  heartbeat.unref();
+  try {
+    return await fn();
+  } finally {
+    clearInterval(heartbeat);
+    try {
+      await markLockReleased(ownedHandle, releasedOwner);
+    } finally {
+      try {
+        await ownedHandle.close();
+      } finally {
+        await removeOwnedLock(lockPath, [owner, releasedOwner]);
+      }
+    }
+  }
+}
+async function removeStaleLock(path) {
+  try {
+    const owner = await readFile(path, "utf8");
+    if (lockOwnerReleased(owner)) {
+      await removeOwnedLock(path, [owner]);
+      return;
+    }
+    const metadata = await stat(path);
+    if (Date.now() - metadata.mtimeMs <= LOCK_STALE_AFTER_MS) return;
+    const pid = lockOwnerPid(owner);
+    if (pid !== void 0 && processIsAlive(pid)) return;
+    await atomicFileTestHooks?.beforeStaleLockBreak?.(path);
+    await removeOwnedLock(path, [owner]);
+  } catch (error61) {
+    if (!hasCode(error61, "ENOENT")) throw error61;
+  }
+}
+async function removeOwnedLock(path, owners) {
+  const tombPath = `${path}.stale.${randomBytes2(16).toString("hex")}`;
+  try {
+    await rename(path, tombPath);
+  } catch (error61) {
+    if (hasCode(error61, "ENOENT")) {
+      await removeOwnedTombs(path, owners);
+      const currentOwner = await readFile(path, "utf8").catch(() => void 0);
+      if (currentOwner !== void 0 && owners.includes(currentOwner)) {
+        await removeOwnedLock(path, owners);
+      }
+      return;
+    }
+    throw error61;
+  }
+  let pendingError;
+  try {
+    const renamedOwner = await readFile(tombPath, "utf8");
+    if (!owners.includes(renamedOwner) && !lockOwnerReleased(renamedOwner)) {
+      await atomicFileTestHooks?.afterMismatchedLockRename?.(path);
+      const currentOwner = await readFile(tombPath, "utf8");
+      if (!lockOwnerReleased(currentOwner)) await restoreRenamedLock(path, tombPath);
+      await atomicFileTestHooks?.afterMismatchedLockRestore?.(path);
+    }
+  } catch (error61) {
+    pendingError = error61;
+  }
+  try {
+    await unlink(tombPath);
+  } catch (error61) {
+    if (!hasCode(error61, "ENOENT") && pendingError === void 0) {
+      pendingError = error61;
+    }
+  }
+  if (pendingError !== void 0) throw pendingError;
+}
+async function lockTakeoverInProgress(path) {
+  const prefix = `${basename(path)}.stale.`;
+  return (await readdir(dirname(path))).some((entry) => entry.startsWith(prefix));
+}
+async function removeAbandonedLockTombs(path) {
+  const directory = dirname(path);
+  const prefix = `${basename(path)}.stale.`;
+  for (const entry of await readdir(directory)) {
+    if (!entry.startsWith(prefix)) continue;
+    const tombPath = join(directory, entry);
+    const [metadata, owner] = await Promise.all([
+      stat(tombPath).catch(() => void 0),
+      readFile(tombPath, "utf8").catch(() => void 0)
+    ]);
+    if (metadata === void 0 || owner === void 0) continue;
+    const pid = lockOwnerPid(owner);
+    const abandoned = lockOwnerReleased(owner) || Date.now() - metadata.mtimeMs > LOCK_STALE_AFTER_MS && (pid === void 0 || !processIsAlive(pid));
+    if (!abandoned) continue;
+    await unlink(tombPath).catch((error61) => {
+      if (!hasCode(error61, "ENOENT")) throw error61;
+    });
+  }
+}
+async function removeOwnedTombs(path, owners) {
+  const directory = dirname(path);
+  const prefix = `${basename(path)}.stale.`;
+  for (const entry of await readdir(directory)) {
+    if (!entry.startsWith(prefix)) continue;
+    const tombPath = join(directory, entry);
+    const owner = await readFile(tombPath, "utf8").catch(() => void 0);
+    if (owner === void 0 || !owners.includes(owner)) continue;
+    await unlink(tombPath).catch((error61) => {
+      if (!hasCode(error61, "ENOENT")) throw error61;
+    });
+  }
+}
+async function restoreRenamedLock(path, tombPath) {
+  while (true) {
+    try {
+      await link(tombPath, path);
+      return;
+    } catch (error61) {
+      if (hasCode(error61, "ENOENT")) return;
+      if (!hasCode(error61, "EEXIST")) throw error61;
+      await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));
+    }
+  }
+}
+async function markLockReleased(handle, owner) {
+  const contents = Buffer.from(owner, "utf8");
+  await handle.write(contents, 0, contents.length, 0);
+  await handle.truncate(contents.length);
+  await handle.sync();
+}
+function lockOwnerPid(owner) {
+  try {
+    const value = JSON.parse(owner);
+    if (typeof value !== "object" || value === null) return void 0;
+    const pid = Reflect.get(value, "pid");
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function lockOwnerReleased(owner) {
+  try {
+    const value = JSON.parse(owner);
+    return typeof value === "object" && value !== null && Reflect.get(value, "released") === true;
+  } catch {
+    return false;
+  }
+}
+function processIsAlive(pid) {
+  if (atomicFileTestHooks?.isProcessAlive !== void 0) {
+    return atomicFileTestHooks.isProcessAlive(pid);
+  }
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error61) {
+    return hasCode(error61, "EPERM");
+  }
+}
+function hasCode(error61, code) {
+  return error61 instanceof Error && "code" in error61 && error61.code === code;
+}
+
 // src/x402-networks.ts
 var BASE_MAINNET_CAIP2 = "eip155:8453";
 var ARC_MAINNET_CAIP2 = "eip155:5042";
@@ -37044,6 +37265,12 @@ function createNetworkHttpTransport(rpcUrl, options = {}) {
 var DEFAULT_REGISTRY_URL = "https://api.vapinetwork.ai";
 var DEFAULT_DISCOVERY_URL = `${DEFAULT_REGISTRY_URL}/api/call/services`;
 var DEFAULT_MARKETPLACE_DISCOVERY_URL = `${DEFAULT_REGISTRY_URL}/api/call/discovery`;
+var DEFAULT_REGISTRY_FALLBACKS = [
+  {
+    discoveryUrl: DEFAULT_DISCOVERY_URL,
+    marketplaceDiscoveryUrl: DEFAULT_MARKETPLACE_DISCOVERY_URL
+  }
+];
 var DEFAULT_SPEND_CAPS = {
   perCallAtomic: "100000",
   perDayAtomic: "1000000"
@@ -37063,6 +37290,14 @@ var configSchema = external_exports.object({
     })
   ).optional(),
   allowPrivateNetwork: external_exports.boolean().default(false).optional(),
+  tasksEscrowDurationOverrides: external_exports.record(
+    external_exports.string().regex(/^\d+$/),
+    external_exports.object({
+      workDurationSeconds: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+      reviewWindowSeconds: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+    }).strict()
+  ).optional(),
+  tasksEscrowFactoryOverrides: external_exports.record(external_exports.string().regex(/^\d+$/), external_exports.string()).optional(),
   networks: external_exports.record(
     external_exports.string().refine((network) => isSupportedPaymentNetwork(network), {
       message: "Expected a supported eip155:<chainId> or Solana network identifier."
@@ -37081,6 +37316,17 @@ var configSchema = external_exports.object({
   spendCaps: spendCapsSchema,
   device: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/).optional()
 }).superRefine((config2, context) => {
+  for (const [chainId, factory] of Object.entries(config2.tasksEscrowFactoryOverrides ?? {})) {
+    try {
+      getAddress(factory);
+    } catch {
+      context.addIssue({
+        code: "custom",
+        path: ["tasksEscrowFactoryOverrides", chainId],
+        message: "Expected a valid EVM escrow factory address."
+      });
+    }
+  }
   for (const [network, configured] of Object.entries(config2.networks)) {
     if (isSolanaNetwork(network)) {
       if (configured.usdc !== NETWORKS[SOLANA_MAINNET_CAIP2].usdc) {
@@ -37110,31 +37356,307 @@ var configSchema = external_exports.object({
     }
   }
 });
-function getVapiPaths(directory = process.env.VAPI_HOME?.trim() || join(homedir(), ".vapi")) {
+function getVapiPaths(directory = process.env.VAPI_HOME?.trim() || join2(homedir(), ".vapi")) {
   return {
     directory,
-    agentsDir: join(directory, "agents"),
-    config: join(directory, "config.json"),
-    keystore: join(directory, "keystore.json"),
-    receipts: join(directory, "receipts.jsonl"),
-    searches: join(directory, "searches.jsonl"),
-    ledger: join(directory, "spend-ledger.json")
+    agentsDir: join2(directory, "agents"),
+    config: join2(directory, "config.json"),
+    keystore: join2(directory, "keystore.json"),
+    receipts: join2(directory, "receipts.jsonl"),
+    searches: join2(directory, "searches.jsonl"),
+    ledger: join2(directory, "spend-ledger.json")
   };
 }
 var getAgentCashPaths = getVapiPaths;
+async function migrateLegacyVapiHome(options = {}) {
+  const target = getVapiPaths(options.targetDirectory);
+  const legacyDirectory = options.legacyDirectory ?? join2(homedir(), ".vapi", "agent-cash");
+  if (legacyDirectory === target.directory || !await pathExists(legacyDirectory)) return [];
+  await mkdir2(target.directory, { recursive: true, mode: 448 });
+  const copied = [];
+  for (const filename of [
+    "config.json",
+    "keystore.json",
+    "receipts.jsonl",
+    "searches.jsonl",
+    "spend-ledger.json"
+  ]) {
+    const source = join2(legacyDirectory, filename);
+    const destination = join2(target.directory, filename);
+    try {
+      const copy = async () => await copyFile(source, destination, constants.COPYFILE_EXCL);
+      if (filename === "receipts.jsonl") {
+        await withFileLock(`${destination}.lock`, copy, {
+          lockedMessage: "The receipt journal is busy. Wait for the other vapi command to finish, then retry."
+        });
+      } else {
+        await copy();
+      }
+      copied.push(destination);
+    } catch (error61) {
+      if (isMissingFile(error61) || isAlreadyExists(error61)) continue;
+      throw error61;
+    }
+  }
+  if (copied.length > 0) {
+    const message = `Migrated legacy vAPI wallet files from ${legacyDirectory} to ${target.directory}; originals were kept.`;
+    (options.notice ?? ((value) => process.stderr.write(`${value}
+`)))(message);
+  }
+  return copied;
+}
+var LEGACY_REGISTRY_HOSTS = /* @__PURE__ */ new Map([
+  ["console.vapinetwork.ai", "api.vapinetwork.ai"],
+  ["console-staging.vapinetwork.ai", "api-staging.vapinetwork.ai"]
+]);
+var LEGACY_REGISTRY_PATHS = /* @__PURE__ */ new Map([
+  ["/api/network/services", "/api/call/services"],
+  ["/api/marketplace/discovery", "/api/call/discovery"]
+]);
+var REGISTRY_DOMAIN = "vapinetwork.ai";
+function rewriteLegacyRegistryUrl(value) {
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return value;
+  }
+  let rewritten = false;
+  const host = LEGACY_REGISTRY_HOSTS.get(url2.hostname.toLowerCase());
+  if (host) {
+    url2.hostname = host;
+    rewritten = true;
+  }
+  const hostname3 = url2.hostname.toLowerCase();
+  if (hostname3 === REGISTRY_DOMAIN || hostname3.endsWith(`.${REGISTRY_DOMAIN}`)) {
+    const path = LEGACY_REGISTRY_PATHS.get(url2.pathname.replace(/\/+$/, ""));
+    if (path) {
+      url2.pathname = path;
+      rewritten = true;
+    }
+  }
+  return rewritten ? url2.href : value;
+}
+function rewriteLegacyRegistryUrls(config2) {
+  const changes = [];
+  const rewrite = (field, from15) => {
+    const to = rewriteLegacyRegistryUrl(from15);
+    if (to !== from15) changes.push({ field, from: from15, to });
+    return to;
+  };
+  const next = {
+    ...config2,
+    discoveryUrl: rewrite("discoveryUrl", config2.discoveryUrl),
+    marketplaceDiscoveryUrl: rewrite("marketplaceDiscoveryUrl", config2.marketplaceDiscoveryUrl),
+    ...config2.registryFallbacks ? {
+      registryFallbacks: config2.registryFallbacks.map((fallback, index2) => ({
+        discoveryUrl: rewrite(
+          `registryFallbacks[${index2}].discoveryUrl`,
+          fallback.discoveryUrl
+        ),
+        marketplaceDiscoveryUrl: rewrite(
+          `registryFallbacks[${index2}].marketplaceDiscoveryUrl`,
+          fallback.marketplaceDiscoveryUrl
+        )
+      }))
+    } : {}
+  };
+  return changes.length === 0 ? { config: config2, changes } : { config: next, changes };
+}
+function formatLegacyRegistryRewrites(changes) {
+  return [
+    "Rewrote retired vAPI registry URLs in the local config:",
+    ...changes.map((change) => `  ${change.field}: ${change.from} -> ${change.to}`)
+  ].join("\n");
+}
+function getDefaultConfig(source = process.env, options = {}) {
+  const registry2 = registryEndpoints(source.VAPI_REGISTRY_URL?.trim() || DEFAULT_REGISTRY_URL);
+  const requested = new Set(options.networks ?? ["base"]);
+  const networks = {};
+  const tasksEscrowFactoryOverrides = tasksFactoryOverridesFromEnv(source);
+  if (requested.has("base") || requested.has(BASE_MAINNET_CAIP2)) {
+    networks[BASE_MAINNET_CAIP2] = {
+      rpcUrl: source.BASE_RPC_URL?.trim() || NETWORKS[BASE_MAINNET_CAIP2].publicRpcUrl,
+      usdc: NETWORKS[BASE_MAINNET_CAIP2].usdc
+    };
+  }
+  const arcMainnetRpcUrl = source.ARC_RPC_URL?.trim();
+  if (arcMainnetRpcUrl || requested.has("arc") || requested.has(ARC_MAINNET_CAIP2)) {
+    networks[ARC_MAINNET_CAIP2] = {
+      rpcUrl: arcMainnetRpcUrl || NETWORKS[ARC_MAINNET_CAIP2].publicRpcUrl,
+      usdc: NETWORKS[ARC_MAINNET_CAIP2].usdc
+    };
+  }
+  const arcTestnetRpcUrl = source.ARC_TESTNET_RPC_URL?.trim();
+  if (arcTestnetRpcUrl || requested.has("arc-testnet") || requested.has(ARC_TESTNET_CAIP2)) {
+    if (!arcTestnetRpcUrl) {
+      throw new Error(
+        "Arc testnet RPC is required. Set ARC_TESTNET_RPC_URL before enabling Arc testnet."
+      );
+    }
+    networks[ARC_TESTNET_CAIP2] = {
+      rpcUrl: arcTestnetRpcUrl,
+      usdc: NETWORKS[ARC_TESTNET_CAIP2].usdc
+    };
+  }
+  const solanaRpcUrl = source.SOLANA_RPC_URL?.trim();
+  if (solanaRpcUrl || requested.has("solana") || requested.has(SOLANA_MAINNET_CAIP2)) {
+    networks[SOLANA_MAINNET_CAIP2] = {
+      rpcUrl: solanaRpcUrl || NETWORKS[SOLANA_MAINNET_CAIP2].publicRpcUrl,
+      usdc: NETWORKS[SOLANA_MAINNET_CAIP2].usdc
+    };
+  }
+  return {
+    discoveryUrl: source.VAPI_DISCOVERY_URL?.trim() || registry2.discoveryUrl,
+    marketplaceDiscoveryUrl: source.VAPI_MARKETPLACE_DISCOVERY_URL?.trim() || registry2.marketplaceDiscoveryUrl,
+    registryFallbacks: DEFAULT_REGISTRY_FALLBACKS.map((fallback) => ({ ...fallback })),
+    allowPrivateNetwork: false,
+    tasksEscrowFactoryOverrides,
+    tasksEscrowDurationOverrides: tasksDurationOverridesFromEnv(source),
+    networks,
+    spendCaps: { ...DEFAULT_SPEND_CAPS }
+  };
+}
+async function loadConfig(path = getVapiPaths().config, source = process.env, options = {}) {
+  if (!process.env.VAPI_HOME?.trim() && path === getVapiPaths(join2(homedir(), ".vapi")).config) {
+    await migrateLegacyVapiHome({ targetDirectory: join2(homedir(), ".vapi") });
+  }
+  let raw;
+  try {
+    raw = await readFile2(path, "utf8");
+  } catch (error61) {
+    if (isMissingFile(error61)) return getDefaultConfig(source);
+    throw error61;
+  }
+  const parsed = configSchema.parse(JSON.parse(raw));
+  parsed.registryFallbacks ??= DEFAULT_REGISTRY_FALLBACKS.map((fallback) => ({ ...fallback }));
+  parsed.tasksEscrowFactoryOverrides ??= {};
+  const migrated = rewriteLegacyRegistryUrls(parsed);
+  const config2 = migrated.config;
+  config2.tasksEscrowFactoryOverrides ??= {};
+  if (migrated.changes.length > 0 && options.notice) {
+    options.notice(
+      `${formatLegacyRegistryRewrites(migrated.changes)}
+Run vapi init to write the new URLs to ${path}.`
+    );
+  }
+  const baseRpcUrl = source.BASE_RPC_URL?.trim();
+  const arcMainnetRpcUrl = source.ARC_RPC_URL?.trim();
+  const arcTestnetRpcUrl = source.ARC_TESTNET_RPC_URL?.trim();
+  const solanaRpcUrl = source.SOLANA_RPC_URL?.trim();
+  const discoveryUrl = source.VAPI_DISCOVERY_URL?.trim();
+  const marketplaceDiscoveryUrl = source.VAPI_MARKETPLACE_DISCOVERY_URL?.trim();
+  const registryUrl = source.VAPI_REGISTRY_URL?.trim();
+  Object.assign(config2.tasksEscrowFactoryOverrides, tasksFactoryOverridesFromEnv(source));
+  config2.tasksEscrowDurationOverrides ??= {};
+  for (const [chainId, overrides] of Object.entries(tasksDurationOverridesFromEnv(source))) {
+    config2.tasksEscrowDurationOverrides[chainId] = {
+      ...config2.tasksEscrowDurationOverrides[chainId],
+      ...overrides
+    };
+  }
+  if (config2.networks[BASE_MAINNET_CAIP2] && baseRpcUrl) {
+    config2.networks[BASE_MAINNET_CAIP2].rpcUrl = baseRpcUrl;
+  }
+  if (arcMainnetRpcUrl) {
+    const existing = config2.networks[ARC_MAINNET_CAIP2];
+    config2.networks[ARC_MAINNET_CAIP2] = {
+      ...existing ?? { usdc: NETWORKS[ARC_MAINNET_CAIP2].usdc },
+      rpcUrl: arcMainnetRpcUrl
+    };
+  }
+  if (arcTestnetRpcUrl) {
+    const existing = config2.networks[ARC_TESTNET_CAIP2];
+    config2.networks[ARC_TESTNET_CAIP2] = {
+      ...existing ?? { usdc: NETWORKS[ARC_TESTNET_CAIP2].usdc },
+      rpcUrl: arcTestnetRpcUrl
+    };
+  }
+  if (solanaRpcUrl) {
+    config2.networks[SOLANA_MAINNET_CAIP2] = {
+      rpcUrl: solanaRpcUrl,
+      usdc: config2.networks[SOLANA_MAINNET_CAIP2]?.usdc ?? NETWORKS[SOLANA_MAINNET_CAIP2].usdc
+    };
+  }
+  if (registryUrl) {
+    const registry2 = registryEndpoints(registryUrl);
+    config2.discoveryUrl = registry2.discoveryUrl;
+    config2.marketplaceDiscoveryUrl = registry2.marketplaceDiscoveryUrl;
+  }
+  if (discoveryUrl) config2.discoveryUrl = discoveryUrl;
+  if (marketplaceDiscoveryUrl) config2.marketplaceDiscoveryUrl = marketplaceDiscoveryUrl;
+  for (const [network, configured] of Object.entries(config2.networks)) {
+    configured.rpcUrl = configured.rpcUrl.trim();
+    configured.usdc = configured.usdc.trim();
+    if (isSolanaNetwork(network) && configured.usdc !== NETWORKS[SOLANA_MAINNET_CAIP2].usdc) {
+      throw new Error(`Network ${network} must use canonical Solana mainnet USDC.`);
+    }
+    if (!configured.rpcUrl) delete config2.networks[network];
+  }
+  return config2;
+}
+function tasksDurationOverridesFromEnv(source) {
+  const result = {};
+  for (const [name, raw] of Object.entries(source)) {
+    const match = /^VAPI_TASKS_(WORK_DURATION|REVIEW_WINDOW)_SECONDS_(\d+)$/.exec(name);
+    const value = raw?.trim();
+    if (!match || !value) continue;
+    const seconds = Number(value);
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(seconds) || seconds <= 0)
+      throw new Error(`Invalid trusted Tasks duration ${name}.`);
+    const entry = result[match[2]] ??= {};
+    if (match[1] === "WORK_DURATION") entry.workDurationSeconds = seconds;
+    else entry.reviewWindowSeconds = seconds;
+  }
+  return result;
+}
+function tasksFactoryOverridesFromEnv(source) {
+  const overrides = {};
+  for (const [name, raw] of Object.entries(source)) {
+    const match = /^VAPI_TASKS_ESCROW_FACTORY_(\d+)$/.exec(name);
+    const value = raw?.trim();
+    if (!match || !value) continue;
+    overrides[match[1]] = getAddress(value);
+  }
+  return overrides;
+}
+function registryEndpoints(baseUrl) {
+  const base = new URL(baseUrl);
+  base.search = "";
+  base.hash = "";
+  const prefix = base.pathname === "/" ? "" : base.pathname.replace(/\/+$/, "");
+  const discovery = new URL(base);
+  discovery.pathname = `${prefix}/api/call/services`;
+  const marketplace = new URL(base);
+  marketplace.pathname = `${prefix}/api/call/discovery`;
+  return { discoveryUrl: discovery.href, marketplaceDiscoveryUrl: marketplace.href };
+}
+async function pathExists(path) {
+  try {
+    await stat2(path);
+    return true;
+  } catch (error61) {
+    if (isMissingFile(error61)) return false;
+    throw error61;
+  }
+}
 function isMissingFile(error61) {
   return error61 instanceof Error && "code" in error61 && error61.code === "ENOENT";
 }
+function isAlreadyExists(error61) {
+  return error61 instanceof Error && "code" in error61 && error61.code === "EEXIST";
+}
 
 // src/audit.ts
 var AUDIT_FILE = "audit.log";
 function auditLogPath(home) {
-  return join2(home, AUDIT_FILE);
+  return join3(home, AUDIT_FILE);
 }
 async function appendAudit(home, record2, options = {}) {
   const entry = {
     time: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString(),
     event: record2.event,
+    ...record2.run === void 0 ? {} : { run: record2.run },
     ...record2.wallet === void 0 ? {} : { wallet: record2.wallet },
     ...record2.owner === void 0 ? {} : { owner: record2.owner },
     tty: record2.tty,
@@ -37142,15 +37664,19 @@ async function appendAudit(home, record2, options = {}) {
     ...record2.detail === void 0 ? {} : { detail: record2.detail }
   };
   const path = auditLogPath(home);
-  await mkdir(home, { recursive: true, mode: 448 });
+  await mkdir3(home, { recursive: true, mode: 448 });
   await appendFile(path, `${JSON.stringify(entry)}
 `, { encoding: "utf8", mode: 384 });
   await chmod(path, 384);
   return entry;
 }
 
+// src/device.ts
+var DEVICE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+
 // src/agent-link.ts
 var AGENT_LINK_REVOKED_MESSAGE = "This agent's link was revoked or has expired. Run vapi login to link it again.";
+var REMOTE_AGENT_TOKEN_EXPIRED_MESSAGE = "The Railway run's short-lived vAPI access token expired. Start a new Railway run from the owner machine.";
 var AgentLinkError = class extends Error {
   constructor(code, message) {
     super(message);
@@ -37160,7 +37686,12 @@ var AgentLinkError = class extends Error {
   code;
 };
 var DEFAULT_AGENT_SCOPES = ["mcp:call", "router.use"];
-var ALLOWED_AGENT_SCOPES = /* @__PURE__ */ new Set([...DEFAULT_AGENT_SCOPES, "call.publish"]);
+var ALLOWED_AGENT_SCOPES = /* @__PURE__ */ new Set([
+  ...DEFAULT_AGENT_SCOPES,
+  "call.publish",
+  "tasks:read",
+  "tasks:write"
+]);
 var publicFetch = createPublicFetch({ allowPrivateNetwork: false });
 var agentSecretAccounts = (wallet) => ({
   tokens: `vapi.agent.${wallet}.tokens`,
@@ -37184,8 +37715,8 @@ async function agentFetch(args, url2, init) {
 }
 async function resolveAgentAccessToken(args, options) {
   await args.wallets.reload();
-  const link = args.wallets.entry(args.wallet)?.link;
-  if (link === void 0 || !args.secrets.available) throw notLinkedError();
+  const link2 = args.wallets.entry(args.wallet)?.link;
+  if (link2 === void 0 || !args.secrets.available) throw notLinkedError();
   const accounts = agentSecretAccounts(args.wallet);
   const tokens = parseTokens(await safeGetSecret(args.secrets, accounts.tokens));
   if (tokens === void 0) throw notLinkedError();
@@ -37193,7 +37724,7 @@ async function resolveAgentAccessToken(args, options) {
   if (options.rejectedAccessToken === void 0 && tokens.expiresAt - 6e4 > now()) {
     return tokens.accessToken;
   }
-  return await withAgentCredentialLock(args.wallets, link.clientId, async () => {
+  return await withAgentCredentialLock(args.wallets, link2.clientId, async () => {
     await args.wallets.reload();
     const currentLink = args.wallets.entry(args.wallet)?.link;
     if (currentLink === void 0) throw notLinkedError();
@@ -37206,6 +37737,9 @@ async function resolveAgentAccessToken(args, options) {
     if (options.rejectedAccessToken === void 0 && current.expiresAt - 6e4 > now()) {
       return current.accessToken;
     }
+    if (current.refreshToken === void 0) {
+      throw new AgentLinkError("not_linked", REMOTE_AGENT_TOKEN_EXPIRED_MESSAGE);
+    }
     const response = await safeFetch(
       args.fetchImpl ?? publicFetch,
       apiEndpoint(currentLink.apiBase, "/oauth/token"),
@@ -37239,12 +37773,12 @@ async function resolveAgentAccessToken(args, options) {
 async function withAgentCredentialLock(wallets, clientId, operation) {
   const digest = createHash("sha256").update(clientId).digest("hex").slice(0, 24);
   const lockPath = `${wallets.registryPath}.${digest}.agent-link.lock`;
-  await mkdir2(dirname2(lockPath), { recursive: true, mode: 448 });
+  await mkdir4(dirname3(lockPath), { recursive: true, mode: 448 });
   const deadline = Date.now() + 3e4;
   let handle;
   while (!handle) {
     try {
-      handle = await open2(lockPath, "wx", 384);
+      handle = await open3(lockPath, "wx", 384);
     } catch (error61) {
       if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) throw error61;
       await removeStaleCredentialLock(lockPath);
@@ -37258,13 +37792,13 @@ async function withAgentCredentialLock(wallets, clientId, operation) {
     return await operation();
   } finally {
     await handle.close();
-    await unlink(lockPath).catch(() => void 0);
+    await unlink2(lockPath).catch(() => void 0);
   }
 }
 async function removeStaleCredentialLock(path) {
   try {
-    const metadata = await stat(path);
-    if (Date.now() - metadata.mtimeMs > 5 * 6e4) await unlink(path);
+    const metadata = await stat3(path);
+    if (Date.now() - metadata.mtimeMs > 5 * 6e4) await unlink2(path);
   } catch {
   }
 }
@@ -37293,12 +37827,18 @@ function parseTokens(value) {
   if (!isRecord(parsed)) return void 0;
   const accessToken = stringField(parsed, "accessToken");
   const refreshToken = stringField(parsed, "refreshToken");
+  const refreshable = parsed.refreshable;
   const expiresAt = numberField(parsed, "expiresAt");
   const scopes = parsed.scopes;
-  if (accessToken === void 0 || refreshToken === void 0 || expiresAt === void 0 || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string")) {
+  if (accessToken === void 0 || expiresAt === void 0 || !Array.isArray(scopes) || scopes.some((scope) => typeof scope !== "string") || (refreshToken === void 0 ? refreshable !== false : refreshable === false)) {
     return void 0;
   }
-  return { accessToken, refreshToken, expiresAt, scopes };
+  return {
+    accessToken,
+    ...refreshToken === void 0 ? {} : { refreshToken },
+    expiresAt,
+    scopes
+  };
 }
 function withBearer(init, accessToken) {
   const headers = new Headers(init?.headers);
@@ -37364,8 +37904,92 @@ function splitScopes(scope) {
 }
 
 // src/ceiling.ts
-import { randomBytes as randomBytes4 } from "node:crypto";
-import { open as open7, readFile as readFile5, stat as stat5, unlink as unlink5 } from "node:fs/promises";
+import { randomBytes as randomBytes7 } from "node:crypto";
+
+// src/account-movement-lock.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { mkdir as mkdir5, open as open4, readFile as readFile4, stat as stat4, unlink as unlink3 } from "node:fs/promises";
+import { join as join4 } from "node:path";
+var AccountMovementLockedError = class extends Error {
+  constructor(account) {
+    super(`Another capital movement is already running for account ${account}.`);
+    this.account = account;
+    this.name = "AccountMovementLockedError";
+  }
+  account;
+  code = "account_movement_locked";
+};
+async function withAccountMovementLock(home, account, timeoutMs, operation, signal) {
+  const directory = join4(home, "movements");
+  await mkdir5(directory, { recursive: true, mode: 448 });
+  const path = join4(directory, `.${account}.lock`);
+  const deadline = Date.now() + (timeoutMs ?? 2e3);
+  const owner = JSON.stringify({ pid: process.pid, token: randomBytes3(16).toString("hex") });
+  let handle;
+  while (handle === void 0) {
+    signal?.throwIfAborted();
+    try {
+      handle = await open4(path, "wx", 384);
+      await handle.writeFile(owner, "utf8");
+      await handle.sync();
+    } catch (error61) {
+      if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) throw error61;
+      await removeStaleLock2(path);
+      if (Date.now() >= deadline) throw new AccountMovementLockedError(account);
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  }
+  const ownedHandle = handle;
+  const heartbeat = setInterval(() => {
+    const time3 = /* @__PURE__ */ new Date();
+    void ownedHandle.utimes(time3, time3).catch(() => void 0);
+  }, 3e4);
+  heartbeat.unref();
+  try {
+    return await operation();
+  } finally {
+    clearInterval(heartbeat);
+    await ownedHandle.close();
+    await unlinkOwnedLock(path, owner);
+  }
+}
+async function removeStaleLock2(path) {
+  try {
+    const metadata = await stat4(path);
+    if (Date.now() - metadata.mtimeMs <= 12e4) return;
+    const owner = await readFile4(path, "utf8").catch(() => "");
+    const pid = lockOwnerPid2(owner);
+    if (pid !== void 0 && processIsAlive2(pid)) return;
+    await unlinkOwnedLock(path, owner);
+  } catch (error61) {
+    if (!isMissingFile(error61)) throw error61;
+  }
+}
+async function unlinkOwnedLock(path, owner) {
+  try {
+    if (await readFile4(path, "utf8") === owner) await unlink3(path);
+  } catch (error61) {
+    if (!isMissingFile(error61)) throw error61;
+  }
+}
+function lockOwnerPid2(owner) {
+  try {
+    const value = JSON.parse(owner);
+    if (typeof value !== "object" || value === null) return void 0;
+    const pid = Reflect.get(value, "pid");
+    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function processIsAlive2(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error61) {
+    return error61 instanceof Error && "code" in error61 && error61.code === "EPERM";
+  }
+}
 
 // src/authorization-state.ts
 var EIP3009_AUTHORIZATION_STATE_ABI = [
@@ -37429,9 +38053,47 @@ function missingAuthorization(receipt) {
   return `Receipt ${receipt.id} records no signed payment authorization, so nothing from that call can settle.`;
 }
 
-// src/receipts.ts
-import { mkdir as mkdir3, open as open3, readFile as readFile2, rename, writeFile } from "node:fs/promises";
-import { dirname as dirname3 } from "node:path";
+// src/movement.ts
+import { randomBytes as randomBytes6 } from "node:crypto";
+import { chmod as chmod3, mkdir as mkdir10, open as open9, readFile as readFile9, readdir as readdir3, rename as rename6, unlink as unlink7 } from "node:fs/promises";
+import { join as join5 } from "node:path";
+
+// src/allocation.ts
+var AllocationError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "AllocationError";
+  }
+  code;
+};
+function parseUsdCents(value) {
+  const raw = String(value);
+  if (!/^\d+(?:\.\d{1,2})?$/.test(raw)) {
+    throw new AllocationError("invalid_amount", "Enter a positive USDC amount in whole cents.");
+  }
+  const [whole = "0", fraction = ""] = raw.split(".");
+  const cents = BigInt(whole) * 100n + BigInt(fraction.padEnd(2, "0") || "0");
+  if (cents <= 0n) {
+    throw new AllocationError("invalid_amount", "Enter a positive USDC amount in whole cents.");
+  }
+  return cents;
+}
+
+// src/movement-open.ts
+function isOpenMovementLeg(leg, journalEvidence) {
+  if (leg.status === "sent" || leg.status === "cancelled") return false;
+  if (leg.restored === true) return true;
+  if (leg.status === "planned" || leg.status === "unknown") return true;
+  if (leg.status !== "failed") return false;
+  if (leg.retryable === true) return true;
+  return journalEvidence === "signed";
+}
+
+// src/spend-policy.ts
+import { randomBytes as randomBytes4 } from "node:crypto";
+import { mkdir as mkdir6, open as open5, readFile as readFile5, rename as rename3, stat as stat5, unlink as unlink4, writeFile as writeFile2 } from "node:fs/promises";
+import { dirname as dirname4 } from "node:path";
 
 // src/wallet-name.ts
 var DEFAULT_WALLET_NAME = "main";
@@ -37441,11 +38103,363 @@ var walletNameSchema = external_exports.string().regex(
   "A wallet name is 1 to 32 characters of lowercase letters, digits and dashes, starting with a letter or digit."
 );
 
+// src/spend-policy.ts
+var ledgerSchema = external_exports.object({
+  date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/),
+  spentAtomic: external_exports.string().regex(/^\d+$/)
+});
+var spendReservationSchema = external_exports.object({
+  id: external_exports.string().min(1),
+  amountAtomic: external_exports.string().regex(/^\d+$/),
+  kind: external_exports.enum(["payment", "escrow-funding", "dispute-fee"]).optional(),
+  taskKey: external_exports.string().optional()
+});
+var ledgerRowSchema = ledgerSchema.extend({
+  wallet: walletNameSchema.optional(),
+  reservations: external_exports.array(spendReservationSchema).optional()
+});
+var ledgerFileSchema = external_exports.union([
+  external_exports.object({ version: external_exports.literal(1), rows: external_exports.array(ledgerRowSchema) }),
+  ledgerRowSchema
+]);
+var SpendCapError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SpendCapError";
+  }
+  code;
+};
+function utcDateKey(now = /* @__PURE__ */ new Date()) {
+  return now.toISOString().slice(0, 10);
+}
+function sumTaskReservations(rows, wallet, taskKey, excludeReservationId) {
+  let total = 0n;
+  for (const row of rows) {
+    if (row.wallet !== wallet) continue;
+    for (const reservation of row.reservations ?? []) {
+      if (reservation.taskKey === taskKey && reservation.id !== excludeReservationId)
+        total += BigInt(reservation.amountAtomic);
+    }
+  }
+  return total;
+}
+async function readStoredSpendLedgerRows(path, now, allDays = false) {
+  let raw;
+  try {
+    raw = await readFile5(path, "utf8");
+  } catch (error61) {
+    if (isMissingFile(error61)) return [];
+    throw error61;
+  }
+  const parsed = ledgerFileSchema.parse(JSON.parse(raw));
+  const rows = "rows" in parsed ? parsed.rows : [parsed];
+  const today = utcDateKey(now);
+  return rows.filter((row) => allDays || row.date === today).map((row) => ({
+    date: row.date,
+    spentAtomic: row.spentAtomic,
+    wallet: row.wallet ?? DEFAULT_WALLET_NAME,
+    ...row.reservations === void 0 ? {} : { reservations: row.reservations }
+  }));
+}
+async function reserveSpend(amountAtomic, caps, options) {
+  if (amountAtomic < 0n) {
+    throw new Error("Spend amount cannot be negative.");
+  }
+  const kind = options?.kind ?? "payment";
+  let perDayAtomic;
+  if (kind === "escrow-funding" || kind === "dispute-fee") {
+    const maxPerTaskAtomic = options?.maxPerTaskAtomic;
+    if (maxPerTaskAtomic === void 0 || maxPerTaskAtomic < 0n) {
+      throw new Error("Escrow funding requires a non-negative per-task cap.");
+    }
+    if (amountAtomic > maxPerTaskAtomic) {
+      throw new SpendCapError(
+        "per_task_cap_exceeded",
+        `Escrow funding ${amountAtomic} atomic USDC exceeds the per-task cap ${maxPerTaskAtomic}. Refusing to sign.`
+      );
+    }
+    perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
+  } else {
+    const perCallAtomic = parseAtomicCap(caps.perCallAtomic, "per-call");
+    perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
+    if (amountAtomic > perCallAtomic) {
+      throw new SpendCapError(
+        "per_call_cap_exceeded",
+        `Payment quote ${amountAtomic} atomic USDC exceeds the per-call cap ${perCallAtomic}. Refusing to sign.`
+      );
+    }
+  }
+  const ledgerPath = options?.ledgerPath ?? getAgentCashPaths().ledger;
+  const now = options?.now ?? /* @__PURE__ */ new Date();
+  const wallet = options?.wallet ?? DEFAULT_WALLET_NAME;
+  return await withLedgerLock(ledgerPath, async () => {
+    const rows = await readStoredSpendLedgerRows(ledgerPath, now, true);
+    const today = utcDateKey(now);
+    const current = rows.find((row) => row.wallet === wallet && row.date === today);
+    if ((kind === "escrow-funding" || kind === "dispute-fee") && options?.taskKey !== void 0) {
+      const taskTotal = sumTaskReservations(
+        rows,
+        wallet,
+        options.taskKey,
+        options.reuseExistingEscrowReservation || options.resumeEscrowReservation ? options.reservationId : void 0
+      ) + amountAtomic;
+      if (taskTotal > options.maxPerTaskAtomic)
+        throw new SpendCapError(
+          "per_task_cap_exceeded",
+          `New spend ${amountAtomic} atomic USDC would raise the running total for task ${options.taskKey} and wallet ${wallet} to ${taskTotal}, above the per-task cap ${options.maxPerTaskAtomic}. Refusing to sign.`
+        );
+    }
+    if (options?.reservationId !== void 0) {
+      const existing = current?.reservations?.find(
+        (reservation) => reservation.id === options.reservationId
+      );
+      if (existing && options.reuseExistingEscrowReservation) {
+        if (kind !== "escrow-funding" && kind !== "dispute-fee" || existing.kind !== kind || existing.amountAtomic !== amountAtomic.toString() || existing.taskKey !== void 0 && existing.taskKey !== options.taskKey)
+          throw new Error(
+            `Spend reservation ${options.reservationId} does not match this funding.`
+          );
+        if (existing.taskKey === void 0 && options.taskKey !== void 0) {
+          existing.taskKey = options.taskKey;
+          await writeLedgerAtomically(ledgerPath, rows);
+        }
+        return {
+          date: current.date,
+          spentAtomic: current.spentAtomic,
+          reservationReused: true
+        };
+      }
+      if (existing) {
+        throw new Error(`Spend reservation ${options.reservationId} already exists.`);
+      }
+      if (options.resumeEscrowReservation) {
+        const resumed = options.resumeEscrowReservation;
+        const historical = rows.find((row) => row.wallet === wallet && row.date === resumed.date);
+        const stored = historical?.reservations?.find(
+          (reservation) => reservation.id === resumed.id
+        );
+        if (kind !== "escrow-funding" && kind !== "dispute-fee" || resumed.id !== options.reservationId || resumed.wallet !== wallet || resumed.amountAtomic !== amountAtomic.toString() || resumed.date >= utcDateKey(now) || resumed.exposed !== true || resumed.invalidated === true || stored !== void 0 && (stored.kind !== kind || stored.amountAtomic !== amountAtomic.toString() || stored.taskKey !== void 0 && stored.taskKey !== options.taskKey))
+          throw new Error(
+            `Spend reservation ${options.reservationId} does not match this funding.`
+          );
+        if (stored?.taskKey === void 0 && options.taskKey !== void 0) {
+          if (stored) stored.taskKey = options.taskKey;
+          else {
+            const reservation = {
+              id: resumed.id,
+              amountAtomic: resumed.amountAtomic,
+              kind,
+              taskKey: options.taskKey
+            };
+            if (historical)
+              historical.reservations = [...historical.reservations ?? [], reservation];
+            else
+              rows.push({
+                date: resumed.date,
+                spentAtomic: resumed.amountAtomic,
+                wallet,
+                reservations: [reservation]
+              });
+          }
+          await writeLedgerAtomically(ledgerPath, rows);
+        }
+        return {
+          date: resumed.date,
+          spentAtomic: current?.spentAtomic ?? "0",
+          reservationReused: true
+        };
+      }
+    }
+    const spentAtomic = current?.spentAtomic ?? "0";
+    const nextSpent = BigInt(spentAtomic) + amountAtomic;
+    if (nextSpent > perDayAtomic) {
+      throw new SpendCapError(
+        "per_day_cap_exceeded",
+        `${kind === "escrow-funding" ? "Escrow funding" : "Payment quote"} ${amountAtomic} atomic USDC would raise today's spend to ${nextSpent} for wallet ${wallet}, above the per-day cap ${perDayAtomic}. Refusing to sign.`
+      );
+    }
+    const reservationId = options?.reservationId ?? (options?.taskKey === void 0 ? void 0 : randomBytes4(16).toString("hex"));
+    const nextRow = {
+      date: utcDateKey(now),
+      spentAtomic: nextSpent.toString(),
+      wallet,
+      ...(current?.reservations?.length ?? 0) === 0 && reservationId === void 0 ? {} : {
+        reservations: [
+          ...current?.reservations ?? [],
+          ...reservationId === void 0 ? [] : [
+            {
+              id: reservationId,
+              amountAtomic: amountAtomic.toString(),
+              ...kind !== "payment" ? { kind } : {},
+              ...options?.taskKey === void 0 ? {} : { taskKey: options.taskKey }
+            }
+          ]
+        ]
+      }
+    };
+    const otherRows = rows.filter((row) => row.wallet !== wallet || row.date !== today).map((row) => {
+      if (row.wallet !== wallet || !options?.reuseExistingEscrowReservation || options.reservationId === void 0)
+        return row;
+      const previous = row.reservations?.find(
+        (reservation) => reservation.id === options.reservationId
+      );
+      if (!previous) return row;
+      if (kind !== "escrow-funding" && kind !== "dispute-fee" || previous.kind !== kind || previous.amountAtomic !== amountAtomic.toString() || previous.taskKey !== void 0 && previous.taskKey !== options.taskKey)
+        throw new Error(
+          `Spend reservation ${options.reservationId} does not match this funding.`
+        );
+      return {
+        ...row,
+        reservations: row.reservations.filter(
+          (reservation) => reservation.id !== options.reservationId
+        )
+      };
+    });
+    const nextRows = [...otherRows, nextRow].sort(
+      (a, b) => a.wallet.localeCompare(b.wallet) || a.date.localeCompare(b.date)
+    );
+    await writeLedgerAtomically(ledgerPath, nextRows);
+    return {
+      date: nextRow.date,
+      spentAtomic: nextRow.spentAtomic,
+      ...options?.reservationId === void 0 && reservationId !== void 0 ? { reservationId } : {}
+    };
+  });
+}
+async function releaseSpend(amountAtomic, options) {
+  if (amountAtomic < 0n) {
+    throw new Error("Spend amount cannot be negative.");
+  }
+  const ledgerPath = options.ledgerPath ?? getAgentCashPaths().ledger;
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const wallet = options.wallet ?? DEFAULT_WALLET_NAME;
+  return await withLedgerLock(ledgerPath, async () => {
+    const today = utcDateKey(now);
+    const rows = await readStoredSpendLedgerRows(ledgerPath, now, true);
+    const current = rows.find((row) => row.wallet === wallet && row.date === today);
+    if (options.reservedOn !== today && options.reservationId === void 0) {
+      return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
+    }
+    const reserved = rows.find((row) => row.wallet === wallet && row.date === options.reservedOn);
+    const reservation = options.reservationId === void 0 ? void 0 : reserved?.reservations?.find((candidate) => candidate.id === options.reservationId);
+    if (options.reservationId !== void 0 && reservation === void 0) {
+      return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
+    }
+    if (reservation !== void 0 && reservation.amountAtomic !== amountAtomic.toString()) {
+      throw new Error(`Spend reservation ${options.reservationId} has a different amount.`);
+    }
+    const spentAtomic = BigInt(reserved?.spentAtomic ?? "0");
+    const releasedAmount = reservation === void 0 ? amountAtomic : BigInt(reservation.amountAtomic);
+    const nextSpent = spentAtomic > releasedAmount ? spentAtomic - releasedAmount : 0n;
+    const remainingReservations = reserved?.reservations?.filter(
+      (candidate) => candidate.id !== options.reservationId
+    );
+    const nextRow = {
+      date: options.reservedOn,
+      spentAtomic: nextSpent.toString(),
+      wallet,
+      ...remainingReservations === void 0 || remainingReservations.length === 0 ? {} : { reservations: remainingReservations }
+    };
+    const nextRows = [
+      ...rows.filter((row) => row.wallet !== wallet || row.date !== options.reservedOn),
+      nextRow
+    ].sort((a, b) => a.wallet.localeCompare(b.wallet) || a.date.localeCompare(b.date));
+    await writeLedgerAtomically(ledgerPath, nextRows);
+    return {
+      date: today,
+      spentAtomic: options.reservedOn === today ? nextRow.spentAtomic : current?.spentAtomic ?? "0"
+    };
+  });
+}
+function parseAtomicCap(value, label) {
+  if (!/^\d+$/.test(value)) {
+    throw new Error(`Invalid ${label} spend cap ${JSON.stringify(value)}.`);
+  }
+  return BigInt(value);
+}
+async function writeLedgerAtomically(path, rows) {
+  const ledger = rows.length === 1 && rows[0].wallet === DEFAULT_WALLET_NAME ? {
+    date: rows[0].date,
+    spentAtomic: rows[0].spentAtomic,
+    ...rows[0].reservations === void 0 ? {} : { reservations: rows[0].reservations }
+  } : { version: 1, rows };
+  await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+  const temporaryPath = `${path}.${process.pid}.${randomBytes4(6).toString("hex")}.tmp`;
+  await writeFile2(temporaryPath, `${JSON.stringify(ledger, null, 2)}
+`, {
+    encoding: "utf8",
+    mode: 384,
+    flag: "wx"
+  });
+  await rename3(temporaryPath, path);
+}
+async function withLedgerLock(path, operation) {
+  await mkdir6(dirname4(path), { recursive: true, mode: 448 });
+  const lockPath = `${path}.lock`;
+  const deadline = Date.now() + 2e3;
+  let handle;
+  while (!handle) {
+    try {
+      handle = await open5(lockPath, "wx", 384);
+    } catch (error61) {
+      if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) {
+        throw error61;
+      }
+      await removeStaleLock3(lockPath);
+      if (Date.now() >= deadline) {
+        throw new Error("Timed out waiting for the spend ledger lock.");
+      }
+      await new Promise((resolve) => setTimeout(resolve, 20));
+    }
+  }
+  try {
+    return await operation();
+  } finally {
+    await handle.close();
+    await unlink4(lockPath).catch(() => void 0);
+  }
+}
+async function removeStaleLock3(path) {
+  try {
+    const metadata = await stat5(path);
+    if (Date.now() - metadata.mtimeMs > 3e4) {
+      await unlink4(path);
+    }
+  } catch (error61) {
+    if (!isMissingFile(error61)) {
+      throw error61;
+    }
+  }
+}
+
+// src/transfer-journal.ts
+import { readFile as readFile7 } from "node:fs/promises";
+
+// src/receipts.ts
+import { mkdir as mkdir7, open as open6, readFile as readFile6, rename as rename4, writeFile as writeFile3 } from "node:fs/promises";
+import { dirname as dirname5 } from "node:path";
+
+// src/agent-run.ts
+var RUN_ID_PATTERN = /^run_[0-9a-f]{24}$/;
+var runRefSchema = external_exports.strictObject({
+  id: external_exports.string().regex(RUN_ID_PATTERN),
+  swarm: external_exports.string().optional(),
+  member: external_exports.string().optional(),
+  parentRunId: external_exports.string().optional()
+});
+
 // src/receipts.ts
+var RECEIPT_JOURNAL_BUSY_MESSAGE = "The receipt journal is busy. Wait for the other vapi command to finish, then retry.";
+async function withReceiptJournalLock(path, operation) {
+  return await withFileLock(`${path}.lock`, operation, {
+    lockedMessage: RECEIPT_JOURNAL_BUSY_MESSAGE
+  });
+}
 var durationSchema = external_exports.number().nonnegative().finite();
 var receiptSchema = external_exports.strictObject({
   id: external_exports.string().min(1),
   timestamp: external_exports.iso.datetime(),
+  run: runRefSchema.optional(),
   kind: external_exports.literal("transfer").optional(),
   wallet: walletNameSchema.optional(),
   resourceUrl: external_exports.url(),
@@ -37552,20 +38566,22 @@ async function appendReceipt(receipt, path = getVapiPaths().receipts, options =
   const parsed = parseReceipt(
     receipt.wallet === void 0 && options.wallet !== void 0 ? { ...receipt, wallet: options.wallet } : receipt
   );
-  await mkdir3(dirname3(path), { recursive: true, mode: 448 });
-  const handle = await open3(path, "a", 384);
-  try {
-    await handle.writeFile(`${JSON.stringify(parsed)}
+  await withReceiptJournalLock(path, async () => {
+    await mkdir7(dirname5(path), { recursive: true, mode: 448 });
+    const handle = await open6(path, "a", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(parsed)}
 `, "utf8");
-  } finally {
-    await handle.close();
-  }
+    } finally {
+      await handle.close();
+    }
+  });
   return parsed;
 }
 async function readReceipts(path = getVapiPaths().receipts, options = {}) {
   let raw;
   try {
-    raw = await readFile2(path, "utf8");
+    raw = await readFile6(path, "utf8");
   } catch (error61) {
     if (isMissingFile(error61)) return [];
     throw error61;
@@ -37607,6 +38623,45 @@ function filterReceiptsByWallet(receipts, name) {
   return receipts.filter((receipt) => receiptWallet(receipt) === name);
 }
 
+// src/transfer-journal.ts
+async function readTransferJournal(home, from15, nonce) {
+  let raw;
+  try {
+    raw = await readFile7(getVapiPaths(home).receipts, "utf8");
+  } catch (error61) {
+    if (isMissingFile(error61)) return { signed: false };
+    throw error61;
+  }
+  let latest;
+  let request;
+  for (const [index2, line] of raw.split("\n").entries()) {
+    if (!line.trim()) continue;
+    let receipt;
+    try {
+      receipt = parseReceipt(JSON.parse(line));
+    } catch (error61) {
+      throw new Error(`Invalid receipt on JSONL line ${index2 + 1}.`, { cause: error61 });
+    }
+    if (receiptWallet(receipt) !== from15 || receipt.transfer?.nonce.toLowerCase() !== nonce.toLowerCase()) {
+      continue;
+    }
+    latest = receipt;
+    if (receipt.transfer.request !== void 0) request = receipt;
+  }
+  return {
+    signed: latest !== void 0,
+    ...latest === void 0 ? {} : { latest },
+    ...request === void 0 ? {} : { request },
+    ...request?.transfer?.request?.authorization.validBefore === void 0 ? {} : { validBefore: request.transfer.request.authorization.validBefore },
+    ...(latest?.transfer?.reservedOn ?? request?.transfer?.reservedOn) === void 0 ? {} : { reservedOn: latest?.transfer?.reservedOn ?? request?.transfer?.reservedOn }
+  };
+}
+
+// src/transfer.ts
+import { randomBytes as randomBytes5, randomUUID } from "node:crypto";
+import { mkdir as mkdir9, open as open8, stat as stat7, unlink as unlink6 } from "node:fs/promises";
+import { dirname as dirname6 } from "node:path";
+
 // src/siblings.ts
 var SiblingsError = class extends Error {
   constructor(code, message, status) {
@@ -37645,8 +38700,8 @@ async function fetchSiblings(args) {
   try {
     response = await withAgentCredentialLock(args.wallets, `wallet:${args.account}`, async () => {
       await args.wallets.reload();
-      const link = args.wallets.entry(args.account)?.link;
-      if (link === void 0 || new URL(link.apiBase).origin !== new URL(args.apiBase).origin) {
+      const link2 = args.wallets.entry(args.account)?.link;
+      if (link2 === void 0 || new URL(link2.apiBase).origin !== new URL(args.apiBase).origin) {
         throw new SiblingsError(
           "not_linked",
           "The selected account is not linked to this vAPI server."
@@ -37660,7 +38715,7 @@ async function fetchSiblings(args) {
           ...args.fetchImpl === void 0 ? {} : { fetchImpl: args.fetchImpl },
           ...args.now === void 0 ? {} : { now: args.now }
         },
-        new URL("/api/agents/self/siblings", new URL(link.apiBase).origin).toString(),
+        new URL("/api/agents/self/siblings", new URL(link2.apiBase).origin).toString(),
         { method: "GET", signal }
       );
     });
@@ -37699,6 +38754,20 @@ function invalidResponseError() {
   return new SiblingsError("invalid_response", "The vAPI siblings response was invalid.");
 }
 
+// src/wallet-store.ts
+import {
+  chmod as chmod2,
+  lstat,
+  mkdir as mkdir8,
+  open as open7,
+  readdir as readdir2,
+  readFile as readFile8,
+  rename as rename5,
+  stat as stat6,
+  unlink as unlink5,
+  writeFile as writeFile4
+} from "node:fs/promises";
+
 // ../../node_modules/.pnpm/@solana+errors@5.5.1_typescript@6.0.3/node_modules/@solana/errors/dist/index.node.mjs
 var SOLANA_ERROR__BLOCK_HEIGHT_EXCEEDED = 1;
 var SOLANA_ERROR__INVALID_NONCE = 2;
@@ -41618,6 +42687,62 @@ async function signModifyingAndPartialTransactionSigners(transactionMessage, mod
 }
 var o2 = globalThis.TextEncoder;
 
+// src/wallet-store.ts
+var agentLinkSchema = external_exports.object({
+  apiBase: external_exports.string(),
+  clientId: external_exports.string(),
+  owner: external_exports.custom((value) => typeof value === "string" && value.startsWith("0x")),
+  label: external_exports.string(),
+  scopes: external_exports.array(external_exports.string()),
+  linkedAt: external_exports.iso.datetime(),
+  routerBaseUrl: external_exports.string().optional()
+});
+var ROUTER_TOPUP_TIERS = [1, 5, 20, 50];
+var routerRefillSchema = external_exports.object({
+  belowUsd: external_exports.number().finite().min(0),
+  tierUsd: external_exports.union([external_exports.literal(1), external_exports.literal(5), external_exports.literal(20), external_exports.literal(50)])
+});
+var ceilingSweepPendingSchema = external_exports.strictObject({
+  owner: external_exports.string().regex(/^0x[0-9a-fA-F]{40}$/),
+  target: external_exports.string().regex(/^0x[0-9a-fA-F]{40}$/).optional(),
+  amountAtomic: external_exports.string().regex(/^\d+$/),
+  nonce: external_exports.string().regex(/^0x[0-9a-fA-F]{64}$/),
+  createdAt: external_exports.iso.datetime(),
+  status: external_exports.enum(["planned", "unknown"])
+});
+var walletEntrySchema = external_exports.object({
+  createdAt: external_exports.iso.datetime(),
+  label: external_exports.string().trim().min(1).max(80).optional(),
+  spendCaps: spendCapsSchema,
+  // On disk, null explicitly disables ceiling sweeps; an absent field is the
+  // backwards-compatible 5 USDC default and is not written during reads.
+  ceilingAtomic: external_exports.string().regex(/^\d+$/).nullable().optional(),
+  ceilingSweepAttemptedAt: external_exports.iso.datetime().optional(),
+  ceilingSweepPending: ceilingSweepPendingSchema.optional(),
+  routerRefill: routerRefillSchema.optional(),
+  link: agentLinkSchema.optional()
+});
+var walletRegistrySchema = external_exports.object({
+  version: external_exports.literal(1),
+  default: walletNameSchema.optional(),
+  wallets: external_exports.record(walletNameSchema, walletEntrySchema)
+});
+async function spendCapsForWallet(store, name = DEFAULT_WALLET_NAME) {
+  const entry = store.entry(name);
+  if (entry) return { ...entry.spendCaps };
+  return await readConfiguredSpendCaps(getVapiPaths(store.home).config);
+}
+async function readConfiguredSpendCaps(configPath) {
+  try {
+    const parsed = JSON.parse(await readFile8(configPath, "utf8"));
+    const caps = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "spendCaps") : void 0;
+    const result = spendCapsSchema.safeParse(caps);
+    if (result.success) return result.data;
+  } catch {
+  }
+  return { ...DEFAULT_SPEND_CAPS };
+}
+
 // ../../node_modules/.pnpm/@solana-program+token-2022@0.6.1_@solana+kit@5.5.1_typescript@6.0.3__@solana+sysvars@5.5.1_typescript@6.0.3_/node_modules/@solana-program/token-2022/dist/src/index.mjs
 var AccountState = /* @__PURE__ */ ((AccountState2) => {
   AccountState2[AccountState2["Uninitialized"] = 0] = "Uninitialized";
@@ -42627,6 +43752,104 @@ var ExactSvmScheme = class {
 var addressEncoder = getAddressEncoder();
 var compiledMessageDecoder = getCompiledTransactionMessageDecoder();
 
+// src/svm.ts
+var MAX_RPC_RESPONSE_BYTES = 4 * 1024 * 1024;
+function isSolanaAddress(value) {
+  try {
+    address(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readSolanaUsdcBalance(args) {
+  const accounts = await readSolanaUsdcAccounts(args);
+  return accounts.reduce((total, account) => total + account.amountAtomic, 0n);
+}
+async function readSolanaUsdcAccounts(args) {
+  if (!isSolanaAddress(args.address)) {
+    throw new Error(`Invalid Solana address: ${args.address}.`);
+  }
+  const rpcUrl = requireRpcUrl(args.network, args.configured);
+  const value = await solanaRpcCall(
+    rpcUrl,
+    "getTokenAccountsByOwner",
+    [
+      args.address,
+      { mint: args.configured.usdc },
+      { encoding: "jsonParsed", commitment: "confirmed" }
+    ],
+    rpcOptionsFrom(args)
+  );
+  return value.map((entry) => {
+    const info = entry.account.data.parsed.info;
+    if (!isSolanaAddress(entry.pubkey) || info.mint !== args.configured.usdc || info.owner !== args.address || info.tokenAmount.decimals !== USDC_DECIMALS || !/^\d+$/.test(info.tokenAmount.amount)) {
+      throw new Error("Solana RPC returned a malformed USDC token account.");
+    }
+    return { address: entry.pubkey, amountAtomic: BigInt(info.tokenAmount.amount) };
+  });
+}
+async function solanaRpcCall(rpcUrl, method, params, options) {
+  const fetchImpl = options.fetchImpl ?? createPublicFetch({
+    allowPrivateNetwork: options.allowPrivateNetwork ?? false,
+    ...options.lookup ? { lookup: options.lookup } : {}
+  });
+  const response = await fetchImpl(rpcUrl, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
+    redirect: "manual"
+  });
+  if (!response.ok) {
+    discardBody(response);
+    const rateLimit = response.status === 429 ? " (public RPC rate limit)" : "";
+    throw new Error(`Solana RPC ${method} failed with HTTP ${response.status}${rateLimit}.`);
+  }
+  const envelope = await readBoundedRpcJson(response);
+  if (!isRecord2(envelope) || envelope.jsonrpc !== "2.0") {
+    throw new Error(`Solana RPC ${method} returned an invalid JSON-RPC envelope.`);
+  }
+  if (envelope.error !== void 0) {
+    throw new Error(`Solana RPC ${method} failed: ${JSON.stringify(envelope.error)}.`);
+  }
+  const result = envelope.result;
+  if (isRecord2(result) && "value" in result) return result.value;
+  return result;
+}
+async function readBoundedRpcJson(response) {
+  if (!response.body) throw new Error("Solana RPC response body is empty.");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let length = 0;
+  while (true) {
+    const next = await reader.read();
+    if (next.done) break;
+    length += next.value.byteLength;
+    if (length > MAX_RPC_RESPONSE_BYTES) {
+      await reader.cancel();
+      throw new Error(`Solana RPC response exceeds ${MAX_RPC_RESPONSE_BYTES} bytes.`);
+    }
+    chunks.push(next.value);
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return JSON.parse(new TextDecoder().decode(bytes));
+}
+function rpcOptionsFrom(options) {
+  return {
+    allowPrivateNetwork: options.allowPrivateNetwork,
+    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
+    ...options.lookup ? { lookup: options.lookup } : {}
+  };
+}
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 // src/x402.ts
 var MAX_CHALLENGE_BYTES = 1048576;
 var MAX_UINT256 = (1n << 256n) - 1n;
@@ -42659,15 +43882,15 @@ var X402Error = class extends Error {
 function isValidPaymentId(value) {
   return typeof value === "string" && PAYMENT_ID_PATTERN.test(value);
 }
-function createPaymentId(randomBytes5 = fillRandomBytes) {
+function createPaymentId(randomBytes9 = fillRandomBytes) {
   const bytes = new Uint8Array(16);
-  randomBytes5(bytes);
+  randomBytes9(bytes);
   return `pay_${bytesToHex(bytes).slice(2)}`;
 }
 function buildPaymentExtensions(serverExtensions, options = {}) {
   const declaredBuilderCode = serverExtensions?.["builder-code"];
-  const builderInfo = isRecord2(declaredBuilderCode) ? declaredBuilderCode.info : void 0;
-  const serverBuilderInfo = isRecord2(builderInfo) ? builderInfo : void 0;
+  const builderInfo = isRecord3(declaredBuilderCode) ? declaredBuilderCode.info : void 0;
+  const serverBuilderInfo = isRecord3(builderInfo) ? builderInfo : void 0;
   const declaredServerCodes = serverBuilderInfo?.s;
   const serverCodes = typeof declaredServerCodes === "string" ? [declaredServerCodes] : Array.isArray(declaredServerCodes) ? declaredServerCodes : void 0;
   const validServerCodes = [];
@@ -42684,10 +43907,10 @@ function buildPaymentExtensions(serverExtensions, options = {}) {
       ...typeof appCode === "string" && BUILDER_CODE_PATTERN.test(appCode) ? { a: appCode } : {},
       s: [VAPI_BUILDER_CODE, ...validServerCodes]
     },
-    ...isRecord2(declaredBuilderCode) && declaredBuilderCode.schema !== void 0 ? { schema: declaredBuilderCode.schema } : {}
+    ...isRecord3(declaredBuilderCode) && declaredBuilderCode.schema !== void 0 ? { schema: declaredBuilderCode.schema } : {}
   };
   const paymentIdentifier = serverExtensions?.["payment-identifier"];
-  if (!isRecord2(paymentIdentifier)) {
+  if (!isRecord3(paymentIdentifier)) {
     return { ...serverExtensions, "builder-code": builderCode };
   }
   if (!isValidPaymentId(options.paymentId)) {
@@ -42696,7 +43919,7 @@ function buildPaymentExtensions(serverExtensions, options = {}) {
       "paymentId must be 16-128 characters containing only letters, digits, underscores, or hyphens."
     );
   }
-  const paymentInfo = isRecord2(paymentIdentifier.info) ? paymentIdentifier.info : {};
+  const paymentInfo = isRecord3(paymentIdentifier.info) ? paymentIdentifier.info : {};
   return {
     ...serverExtensions,
     "builder-code": builderCode,
@@ -42707,7 +43930,7 @@ function buildPaymentExtensions(serverExtensions, options = {}) {
   };
 }
 function parse402Challenge(challenge2, configuredNetworks, fallbackResourceUrl = "", requiredNetwork, expectedPayTo) {
-  if (!isRecord2(challenge2) || !Array.isArray(challenge2.accepts)) {
+  if (!isRecord3(challenge2) || !Array.isArray(challenge2.accepts)) {
     throw new X402Error("invalid_challenge", "x402 challenge has no accepts array.");
   }
   if (challenge2.x402Version !== void 0 && challenge2.x402Version !== 2) {
@@ -42716,7 +43939,7 @@ function parse402Challenge(challenge2, configuredNetworks, fallbackResourceUrl =
       `Unsupported x402 version: ${String(challenge2.x402Version)}.`
     );
   }
-  const candidates = challenge2.accepts.filter(isRecord2);
+  const candidates = challenge2.accepts.filter(isRecord3);
   const accepted = candidates.find((candidate) => {
     const network2 = readString(candidate, "network");
     const scheme = readString(candidate, "scheme");
@@ -42905,17 +44128,24 @@ function buildEip3009TypedData(args) {
   if (!Number.isSafeInteger(args.nowSeconds) || args.nowSeconds < 0) {
     throw new Error("nowSeconds must be a non-negative integer.");
   }
+  if (args.maximumValidBeforeSeconds !== void 0 && (!Number.isSafeInteger(args.maximumValidBeforeSeconds) || args.maximumValidBeforeSeconds <= args.nowSeconds)) {
+    throw new Error("The payment allowance has expired; no authorization was signed.");
+  }
   if (!isEvmPaymentRequirements(args.quote.accepted)) {
     throw new Error("EIP-3009 typed data can only be built for an EVM x402 quote.");
   }
   const accepted = args.quote.accepted;
   const windowSeconds = Math.min(MAX_AUTHORIZATION_WINDOW_SECONDS, accepted.maxTimeoutSeconds);
+  const validBefore = Math.min(
+    args.nowSeconds + windowSeconds,
+    args.maximumValidBeforeSeconds ?? Number.MAX_SAFE_INTEGER
+  );
   const authorization = {
     from: getAddress(args.from),
     to: accepted.payTo,
     value: args.quote.amountAtomic.toString(),
     validAfter: "0",
-    validBefore: (args.nowSeconds + windowSeconds).toString(),
+    validBefore: validBefore.toString(),
     nonce: args.nonce
   };
   return {
@@ -42941,7 +44171,7 @@ function buildEip3009TypedData(args) {
   };
 }
 async function buildX402Payment(args) {
-  const advertisesPaymentIdentifier = isRecord2(args.quote.extensions?.["payment-identifier"]);
+  const advertisesPaymentIdentifier = isRecord3(args.quote.extensions?.["payment-identifier"]);
   const paymentId = advertisesPaymentIdentifier ? args.paymentId ?? createPaymentId() : void 0;
   const extensions = buildPaymentExtensions(args.quote.extensions, { paymentId });
   if (isSvmPaymentRequirements(args.quote.accepted)) {
@@ -42986,7 +44216,8 @@ async function buildX402Payment(args) {
     from: args.signer.address,
     quote: args.quote,
     nonce,
-    nowSeconds: args.nowSeconds ?? Math.floor(Date.now() / 1e3)
+    nowSeconds: args.nowSeconds ?? Math.floor(Date.now() / 1e3),
+    ...args.maximumValidBeforeSeconds === void 0 ? {} : { maximumValidBeforeSeconds: args.maximumValidBeforeSeconds }
   });
   const signature = await args.signer.signTypedData(typedData);
   const payload = {
@@ -43009,6 +44240,7 @@ async function buildCompatibleX402Payment(args) {
     signer: args.account,
     quote: args.quote,
     ...args.nowSeconds === void 0 ? {} : { nowSeconds: args.nowSeconds },
+    ...args.maximumValidBeforeSeconds === void 0 ? {} : { maximumValidBeforeSeconds: args.maximumValidBeforeSeconds },
     ...args.nonce === void 0 ? {} : { nonce: args.nonce },
     ...args.fetchImpl === void 0 ? {} : { fetchImpl: args.fetchImpl },
     ...args.paymentId === void 0 ? {} : { paymentId: args.paymentId }
@@ -43068,7 +44300,7 @@ function parseSettlementResponse(headers) {
   }
 }
 function classifySettlement(value) {
-  if (!isRecord2(value) || typeof value.success !== "boolean") {
+  if (!isRecord3(value) || typeof value.success !== "boolean") {
     return "unknown";
   }
   return value.success ? "succeeded" : "rejected";
@@ -43164,12 +44396,12 @@ function canonicalTokenDomain(network, configured) {
   return configuredDomain;
 }
 function readBoundedJsonRecord(value) {
-  if (!isRecord2(value)) return null;
+  if (!isRecord3(value)) return null;
   const seen = /* @__PURE__ */ new WeakSet();
   const budget = { entries: 0 };
   try {
     const cloned = cloneBoundedJson(value, 0, seen, budget);
-    return isRecord2(cloned) ? cloned : null;
+    return isRecord3(cloned) ? cloned : null;
   } catch {
     return null;
   }
@@ -43178,7 +44410,7 @@ function readChallengeExtensions(value) {
   if (value === void 0) return void 0;
   const extensions = readBoundedJsonRecord(value);
   if (extensions) return extensions;
-  if (!isRecord2(value)) return void 0;
+  if (!isRecord3(value)) return void 0;
   const paymentExtensions = /* @__PURE__ */ Object.create(null);
   for (const name of ["builder-code", "payment-identifier"]) {
     const extension = readBoundedJsonRecord(value[name]);
@@ -43231,7 +44463,7 @@ function cloneBoundedJson(value, depth, seen, budget) {
 }
 function readResource(value, fallbackUrl) {
   if (typeof value === "string") return { url: value };
-  if (!isRecord2(value)) return { url: fallbackUrl };
+  if (!isRecord3(value)) return { url: fallbackUrl };
   const url2 = readString(value, "url") ?? fallbackUrl;
   return {
     url: url2,
@@ -43246,7 +44478,7 @@ function readString(value, key) {
   const field = value[key];
   return typeof field === "string" && field.length > 0 ? field : null;
 }
-function isRecord2(value) {
+function isRecord3(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeBase64Json(value) {
@@ -43262,421 +44494,6 @@ function encodeBase64Json(value) {
   return globalThis.btoa(binary);
 }
 
-// src/svm.ts
-var MAX_RPC_RESPONSE_BYTES = 4 * 1024 * 1024;
-function isSolanaAddress(value) {
-  try {
-    address(value);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function readSolanaUsdcBalance(args) {
-  const accounts = await readSolanaUsdcAccounts(args);
-  return accounts.reduce((total, account) => total + account.amountAtomic, 0n);
-}
-async function readSolanaUsdcAccounts(args) {
-  if (!isSolanaAddress(args.address)) {
-    throw new Error(`Invalid Solana address: ${args.address}.`);
-  }
-  const rpcUrl = requireRpcUrl(args.network, args.configured);
-  const value = await solanaRpcCall(
-    rpcUrl,
-    "getTokenAccountsByOwner",
-    [
-      args.address,
-      { mint: args.configured.usdc },
-      { encoding: "jsonParsed", commitment: "confirmed" }
-    ],
-    rpcOptionsFrom(args)
-  );
-  return value.map((entry) => {
-    const info = entry.account.data.parsed.info;
-    if (!isSolanaAddress(entry.pubkey) || info.mint !== args.configured.usdc || info.owner !== args.address || info.tokenAmount.decimals !== USDC_DECIMALS || !/^\d+$/.test(info.tokenAmount.amount)) {
-      throw new Error("Solana RPC returned a malformed USDC token account.");
-    }
-    return { address: entry.pubkey, amountAtomic: BigInt(info.tokenAmount.amount) };
-  });
-}
-async function solanaRpcCall(rpcUrl, method, params, options) {
-  const fetchImpl = options.fetchImpl ?? createPublicFetch({
-    allowPrivateNetwork: options.allowPrivateNetwork ?? false,
-    ...options.lookup ? { lookup: options.lookup } : {}
-  });
-  const response = await fetchImpl(rpcUrl, {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ jsonrpc: "2.0", id: 1, method, params }),
-    redirect: "manual"
-  });
-  if (!response.ok) {
-    discardBody(response);
-    const rateLimit = response.status === 429 ? " (public RPC rate limit)" : "";
-    throw new Error(`Solana RPC ${method} failed with HTTP ${response.status}${rateLimit}.`);
-  }
-  const envelope = await readBoundedRpcJson(response);
-  if (!isRecord3(envelope) || envelope.jsonrpc !== "2.0") {
-    throw new Error(`Solana RPC ${method} returned an invalid JSON-RPC envelope.`);
-  }
-  if (envelope.error !== void 0) {
-    throw new Error(`Solana RPC ${method} failed: ${JSON.stringify(envelope.error)}.`);
-  }
-  const result = envelope.result;
-  if (isRecord3(result) && "value" in result) return result.value;
-  return result;
-}
-async function readBoundedRpcJson(response) {
-  if (!response.body) throw new Error("Solana RPC response body is empty.");
-  const reader = response.body.getReader();
-  const chunks = [];
-  let length = 0;
-  while (true) {
-    const next = await reader.read();
-    if (next.done) break;
-    length += next.value.byteLength;
-    if (length > MAX_RPC_RESPONSE_BYTES) {
-      await reader.cancel();
-      throw new Error(`Solana RPC response exceeds ${MAX_RPC_RESPONSE_BYTES} bytes.`);
-    }
-    chunks.push(next.value);
-  }
-  const bytes = new Uint8Array(length);
-  let offset = 0;
-  for (const chunk of chunks) {
-    bytes.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return JSON.parse(new TextDecoder().decode(bytes));
-}
-function rpcOptionsFrom(options) {
-  return {
-    allowPrivateNetwork: options.allowPrivateNetwork,
-    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
-    ...options.lookup ? { lookup: options.lookup } : {}
-  };
-}
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-
-// src/sweep.ts
-var ERC20_ABI = [
-  {
-    type: "function",
-    name: "balanceOf",
-    stateMutability: "view",
-    inputs: [{ name: "account", type: "address" }],
-    outputs: [{ name: "balance", type: "uint256" }]
-  },
-  {
-    type: "function",
-    name: "transfer",
-    stateMutability: "nonpayable",
-    inputs: [
-      { name: "to", type: "address" },
-      { name: "amount", type: "uint256" }
-    ],
-    outputs: [{ name: "success", type: "bool" }]
-  }
-];
-async function readUsdcBalance(args) {
-  if (isSolanaNetwork(args.network)) {
-    return await readSolanaUsdcBalance({
-      network: args.network,
-      configured: args.configured,
-      address: args.address,
-      allowPrivateNetwork: args.allowPrivateNetwork,
-      ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {},
-      ...args.lookup ? { lookup: args.lookup } : {}
-    });
-  }
-  const client = createNetworkPublicClient(args.network, args.configured, {
-    allowPrivateNetwork: args.allowPrivateNetwork,
-    ...args.fetchImpl ? { fetch: args.fetchImpl } : {},
-    ...args.lookup ? { lookup: args.lookup } : {}
-  });
-  return await client.readContract({
-    address: getAddress(
-      usesUsdcGas(args.network) ? getNetworkDefinition(args.network).usdc : args.configured.usdc
-    ),
-    abi: ERC20_ABI,
-    functionName: "balanceOf",
-    args: [getAddress(args.address)]
-  });
-}
-
-// src/transfer.ts
-import { randomBytes as randomBytes3, randomUUID } from "node:crypto";
-import { mkdir as mkdir6, open as open6, stat as stat4, unlink as unlink4 } from "node:fs/promises";
-import { dirname as dirname5 } from "node:path";
-
-// src/spend-policy.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { mkdir as mkdir4, open as open4, readFile as readFile3, rename as rename2, stat as stat2, unlink as unlink2, writeFile as writeFile2 } from "node:fs/promises";
-import { dirname as dirname4 } from "node:path";
-var ledgerSchema = external_exports.object({
-  date: external_exports.string().regex(/^\d{4}-\d{2}-\d{2}$/),
-  spentAtomic: external_exports.string().regex(/^\d+$/)
-});
-var spendReservationSchema = external_exports.object({
-  id: external_exports.string().min(1),
-  amountAtomic: external_exports.string().regex(/^\d+$/)
-});
-var ledgerRowSchema = ledgerSchema.extend({
-  wallet: walletNameSchema.optional(),
-  reservations: external_exports.array(spendReservationSchema).optional()
-});
-var ledgerFileSchema = external_exports.union([
-  external_exports.object({ version: external_exports.literal(1), rows: external_exports.array(ledgerRowSchema) }),
-  ledgerRowSchema
-]);
-var SpendCapError = class extends Error {
-  constructor(code, message) {
-    super(message);
-    this.code = code;
-    this.name = "SpendCapError";
-  }
-  code;
-};
-function utcDateKey(now = /* @__PURE__ */ new Date()) {
-  return now.toISOString().slice(0, 10);
-}
-async function readStoredSpendLedgerRows(path, now) {
-  let raw;
-  try {
-    raw = await readFile3(path, "utf8");
-  } catch (error61) {
-    if (isMissingFile(error61)) return [];
-    throw error61;
-  }
-  const parsed = ledgerFileSchema.parse(JSON.parse(raw));
-  const rows = "rows" in parsed ? parsed.rows : [parsed];
-  const today = utcDateKey(now);
-  return rows.filter((row) => row.date === today).map((row) => ({
-    date: row.date,
-    spentAtomic: row.spentAtomic,
-    wallet: row.wallet ?? DEFAULT_WALLET_NAME,
-    ...row.reservations === void 0 ? {} : { reservations: row.reservations }
-  }));
-}
-async function reserveSpend(amountAtomic, caps, options) {
-  if (amountAtomic < 0n) {
-    throw new Error("Spend amount cannot be negative.");
-  }
-  const perCallAtomic = parseAtomicCap(caps.perCallAtomic, "per-call");
-  const perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
-  if (amountAtomic > perCallAtomic) {
-    throw new SpendCapError(
-      "per_call_cap_exceeded",
-      `Payment quote ${amountAtomic} atomic USDC exceeds the per-call cap ${perCallAtomic}. Refusing to sign.`
-    );
-  }
-  const ledgerPath = options?.ledgerPath ?? getAgentCashPaths().ledger;
-  const now = options?.now ?? /* @__PURE__ */ new Date();
-  const wallet = options?.wallet ?? DEFAULT_WALLET_NAME;
-  return await withLedgerLock(ledgerPath, async () => {
-    const rows = await readStoredSpendLedgerRows(ledgerPath, now);
-    const current = rows.find((row) => row.wallet === wallet);
-    if (options?.reservationId !== void 0) {
-      if (current?.reservations?.some((reservation) => reservation.id === options.reservationId)) {
-        throw new Error(`Spend reservation ${options.reservationId} already exists.`);
-      }
-    }
-    const spentAtomic = current?.spentAtomic ?? "0";
-    const nextSpent = BigInt(spentAtomic) + amountAtomic;
-    if (nextSpent > perDayAtomic) {
-      throw new SpendCapError(
-        "per_day_cap_exceeded",
-        `Payment quote ${amountAtomic} atomic USDC would raise today's spend to ${nextSpent} for wallet ${wallet}, above the per-day cap ${perDayAtomic}. Refusing to sign.`
-      );
-    }
-    const nextRow = {
-      date: utcDateKey(now),
-      spentAtomic: nextSpent.toString(),
-      wallet,
-      ...(current?.reservations?.length ?? 0) === 0 && options?.reservationId === void 0 ? {} : {
-        reservations: [
-          ...current?.reservations ?? [],
-          ...options?.reservationId === void 0 ? [] : [{ id: options.reservationId, amountAtomic: amountAtomic.toString() }]
-        ]
-      }
-    };
-    const nextRows = [...rows.filter((row) => row.wallet !== wallet), nextRow].sort(
-      (a, b) => a.wallet.localeCompare(b.wallet)
-    );
-    await writeLedgerAtomically(ledgerPath, nextRows);
-    return { date: nextRow.date, spentAtomic: nextRow.spentAtomic };
-  });
-}
-async function releaseSpend(amountAtomic, options) {
-  if (amountAtomic < 0n) {
-    throw new Error("Spend amount cannot be negative.");
-  }
-  const ledgerPath = options.ledgerPath ?? getAgentCashPaths().ledger;
-  const now = options.now ?? /* @__PURE__ */ new Date();
-  const wallet = options.wallet ?? DEFAULT_WALLET_NAME;
-  return await withLedgerLock(ledgerPath, async () => {
-    const today = utcDateKey(now);
-    const rows = await readStoredSpendLedgerRows(ledgerPath, now);
-    const current = rows.find((row) => row.wallet === wallet);
-    if (options.reservedOn !== today) {
-      return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
-    }
-    const reservation = options.reservationId === void 0 ? void 0 : current?.reservations?.find((candidate) => candidate.id === options.reservationId);
-    if (options.reservationId !== void 0 && reservation === void 0) {
-      return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
-    }
-    if (reservation !== void 0 && reservation.amountAtomic !== amountAtomic.toString()) {
-      throw new Error(`Spend reservation ${options.reservationId} has a different amount.`);
-    }
-    const spentAtomic = BigInt(current?.spentAtomic ?? "0");
-    const releasedAmount = reservation === void 0 ? amountAtomic : BigInt(reservation.amountAtomic);
-    const nextSpent = spentAtomic > releasedAmount ? spentAtomic - releasedAmount : 0n;
-    const remainingReservations = current?.reservations?.filter(
-      (candidate) => candidate.id !== options.reservationId
-    );
-    const nextRow = {
-      date: today,
-      spentAtomic: nextSpent.toString(),
-      wallet,
-      ...remainingReservations === void 0 || remainingReservations.length === 0 ? {} : { reservations: remainingReservations }
-    };
-    const nextRows = [...rows.filter((row) => row.wallet !== wallet), nextRow].sort(
-      (a, b) => a.wallet.localeCompare(b.wallet)
-    );
-    await writeLedgerAtomically(ledgerPath, nextRows);
-    return { date: nextRow.date, spentAtomic: nextRow.spentAtomic };
-  });
-}
-function parseAtomicCap(value, label) {
-  if (!/^\d+$/.test(value)) {
-    throw new Error(`Invalid ${label} spend cap ${JSON.stringify(value)}.`);
-  }
-  return BigInt(value);
-}
-async function writeLedgerAtomically(path, rows) {
-  const ledger = rows.length === 1 && rows[0].wallet === DEFAULT_WALLET_NAME ? {
-    date: rows[0].date,
-    spentAtomic: rows[0].spentAtomic,
-    ...rows[0].reservations === void 0 ? {} : { reservations: rows[0].reservations }
-  } : { version: 1, rows };
-  await mkdir4(dirname4(path), { recursive: true, mode: 448 });
-  const temporaryPath = `${path}.${process.pid}.${randomBytes2(6).toString("hex")}.tmp`;
-  await writeFile2(temporaryPath, `${JSON.stringify(ledger, null, 2)}
-`, {
-    encoding: "utf8",
-    mode: 384,
-    flag: "wx"
-  });
-  await rename2(temporaryPath, path);
-}
-async function withLedgerLock(path, operation) {
-  await mkdir4(dirname4(path), { recursive: true, mode: 448 });
-  const lockPath = `${path}.lock`;
-  const deadline = Date.now() + 2e3;
-  let handle;
-  while (!handle) {
-    try {
-      handle = await open4(lockPath, "wx", 384);
-    } catch (error61) {
-      if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) {
-        throw error61;
-      }
-      await removeStaleLock(lockPath);
-      if (Date.now() >= deadline) {
-        throw new Error("Timed out waiting for the spend ledger lock.");
-      }
-      await new Promise((resolve) => setTimeout(resolve, 20));
-    }
-  }
-  try {
-    return await operation();
-  } finally {
-    await handle.close();
-    await unlink2(lockPath).catch(() => void 0);
-  }
-}
-async function removeStaleLock(path) {
-  try {
-    const metadata = await stat2(path);
-    if (Date.now() - metadata.mtimeMs > 3e4) {
-      await unlink2(path);
-    }
-  } catch (error61) {
-    if (!isMissingFile(error61)) {
-      throw error61;
-    }
-  }
-}
-
-// src/wallet-store.ts
-import {
-  chmod as chmod2,
-  lstat,
-  mkdir as mkdir5,
-  open as open5,
-  readdir,
-  readFile as readFile4,
-  rename as rename3,
-  stat as stat3,
-  unlink as unlink3,
-  writeFile as writeFile3
-} from "node:fs/promises";
-var agentLinkSchema = external_exports.object({
-  apiBase: external_exports.string(),
-  clientId: external_exports.string(),
-  owner: external_exports.custom((value) => typeof value === "string" && value.startsWith("0x")),
-  label: external_exports.string(),
-  scopes: external_exports.array(external_exports.string()),
-  linkedAt: external_exports.iso.datetime(),
-  routerBaseUrl: external_exports.string().optional()
-});
-var ROUTER_TOPUP_TIERS = [1, 5, 20, 50];
-var routerRefillSchema = external_exports.object({
-  belowUsd: external_exports.number().finite().min(0),
-  tierUsd: external_exports.union([external_exports.literal(1), external_exports.literal(5), external_exports.literal(20), external_exports.literal(50)])
-});
-var ceilingSweepPendingSchema = external_exports.strictObject({
-  owner: external_exports.string().regex(/^0x[0-9a-fA-F]{40}$/),
-  amountAtomic: external_exports.string().regex(/^\d+$/),
-  nonce: external_exports.string().regex(/^0x[0-9a-fA-F]{64}$/),
-  createdAt: external_exports.iso.datetime(),
-  status: external_exports.enum(["planned", "unknown"])
-});
-var walletEntrySchema = external_exports.object({
-  createdAt: external_exports.iso.datetime(),
-  label: external_exports.string().trim().min(1).max(80).optional(),
-  spendCaps: spendCapsSchema,
-  // On disk, null explicitly disables ceiling sweeps; an absent field is the
-  // backwards-compatible 5 USDC default and is not written during reads.
-  ceilingAtomic: external_exports.string().regex(/^\d+$/).nullable().optional(),
-  ceilingSweepAttemptedAt: external_exports.iso.datetime().optional(),
-  ceilingSweepPending: ceilingSweepPendingSchema.optional(),
-  routerRefill: routerRefillSchema.optional(),
-  link: agentLinkSchema.optional()
-});
-var walletRegistrySchema = external_exports.object({
-  version: external_exports.literal(1),
-  default: walletNameSchema.optional(),
-  wallets: external_exports.record(walletNameSchema, walletEntrySchema)
-});
-async function spendCapsForWallet(store, name = DEFAULT_WALLET_NAME) {
-  const entry = store.entry(name);
-  if (entry) return { ...entry.spendCaps };
-  return await readConfiguredSpendCaps(getVapiPaths(store.home).config);
-}
-async function readConfiguredSpendCaps(configPath) {
-  try {
-    const parsed = JSON.parse(await readFile4(configPath, "utf8"));
-    const caps = typeof parsed === "object" && parsed !== null ? Reflect.get(parsed, "spendCaps") : void 0;
-    const result = spendCapsSchema.safeParse(caps);
-    if (result.success) return result.data;
-  } catch {
-  }
-  return { ...DEFAULT_SPEND_CAPS };
-}
-
 // src/transfer.ts
 var TransferError = class extends Error {
   constructor(code, message, options = {}) {
@@ -43731,6 +44548,9 @@ async function transferBetweenAccounts(args) {
     throw transferError("not_linked");
   }
   const fromAddress = getAddress(rawFromAddress);
+  if (args.expectedFromAddress !== void 0 && (!isAddress(args.expectedFromAddress, { strict: false }) || !sameAddress(fromAddress, args.expectedFromAddress))) {
+    throw transferError("account_address_mismatch");
+  }
   let siblingResult;
   try {
     siblingResult = await fetchSiblings({
@@ -43762,8 +44582,12 @@ async function transferBetweenAccounts(args) {
     owner: siblingResult.owner,
     siblings: siblingResult.siblings
   });
+  if (args.expectedToAddress !== void 0 && (!isAddress(args.expectedToAddress, { strict: false }) || !sameAddress(recipient.address, args.expectedToAddress))) {
+    throw transferError("account_address_mismatch");
+  }
   const purpose = args.purpose ?? "send";
-  if (purpose === "sweep" && recipient.toKind !== "owner") {
+  const isSweepTarget = recipient.toKind === "owner" || recipient.toKind === "account" && args.sweepParent !== void 0 && isAddress(args.sweepParent, { strict: false }) && getAddress(args.sweepParent) === getAddress(recipient.address);
+  if (purpose === "sweep" && !isSweepTarget) {
     throw transferError("sweep_not_owner");
   }
   const home = args.home ?? args.store.home;
@@ -43784,7 +44608,7 @@ async function transferBetweenAccounts(args) {
   if (args.resume !== void 0) {
     return await resumeTransfer(context, args.resume);
   }
-  const nonce = args.nonce ?? bytesToHex(randomBytes3(32));
+  const nonce = args.nonce ?? bytesToHex(randomBytes5(32));
   if (!NONCE_PATTERN.test(nonce)) {
     throw new TransferError(
       "authorization_invalid",
@@ -43806,7 +44630,9 @@ async function transferBetweenAccounts(args) {
       );
       reservedOn = reservation.date;
     } catch (error61) {
-      if (error61 instanceof SpendCapError) throw transferError(error61.code);
+      if (error61 instanceof SpendCapError && isTransferErrorCode(error61.code)) {
+        throw transferError(error61.code);
+      }
       throw transferError("network_error");
     }
   }
@@ -44009,8 +44835,8 @@ async function postRelay(context, request, options) {
       `wallet:${context.args.from}`,
       async () => {
         await context.args.store.reload();
-        const link = context.args.store.entry(context.args.from)?.link;
-        if (link === void 0 || safeOrigin(link.apiBase) !== safeOrigin(context.args.apiBase)) {
+        const link2 = context.args.store.entry(context.args.from)?.link;
+        if (link2 === void 0 || safeOrigin(link2.apiBase) !== safeOrigin(context.args.apiBase)) {
           throw transferError("not_linked");
         }
         return await agentFetch(
@@ -44167,7 +44993,7 @@ async function findTransferReceipt(context, nonce) {
   return [...receipts].reverse().find((candidate) => candidate.transfer?.nonce.toLowerCase() === nonce.toLowerCase());
 }
 async function withTransferLock(context, nonce, operation) {
-  await mkdir6(dirname5(context.receiptsPath), { recursive: true, mode: 448 });
+  await mkdir9(dirname6(context.receiptsPath), { recursive: true, mode: 448 });
   const lockPath = `${context.receiptsPath}.${context.args.from}.${nonce.toLowerCase()}.transfer.lock`;
   const requestTimeout = Math.max(0, context.args.timeoutMs ?? DEFAULT_TIMEOUT_MS);
   const deadline = Date.now() + Math.max(5e3, requestTimeout + 5e3);
@@ -44175,7 +45001,7 @@ async function withTransferLock(context, nonce, operation) {
   let handle;
   while (!handle) {
     try {
-      handle = await open6(lockPath, "wx", 384);
+      handle = await open8(lockPath, "wx", 384);
     } catch (error61) {
       if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) throw error61;
       await removeStaleTransferLock(lockPath, staleAfterMs);
@@ -44189,13 +45015,13 @@ async function withTransferLock(context, nonce, operation) {
     return await operation();
   } finally {
     await handle.close();
-    await unlink4(lockPath).catch(() => void 0);
+    await unlink6(lockPath).catch(() => void 0);
   }
 }
 async function removeStaleTransferLock(path, staleAfterMs) {
   try {
-    const metadata = await stat4(path);
-    if (Date.now() - metadata.mtimeMs > staleAfterMs) await unlink4(path);
+    const metadata = await stat7(path);
+    if (Date.now() - metadata.mtimeMs > staleAfterMs) await unlink6(path);
   } catch (error61) {
     if (!(error61 instanceof Error && "code" in error61 && error61.code === "ENOENT")) throw error61;
   }
@@ -44349,6 +45175,7 @@ function isTransferErrorCode(value) {
     "resume_not_found",
     "resume_mismatch",
     "signer_mismatch",
+    "account_address_mismatch",
     "signing_failed"
   ].includes(value);
 }
@@ -44360,7 +45187,7 @@ function transferError(code, options = {}) {
     unsupported: "This vAPI server does not relay transfers yet. No money moved.",
     recipient_not_allowed: "The recipient is not the owner or an active sibling account. No money moved.",
     ambiguous_recipient: "The sibling account name is ambiguous. No money moved.",
-    sweep_not_owner: "A sweep can only send funds to the owner. No money moved.",
+    sweep_not_owner: "A sweep can only send funds to the owner or its treasury. No money moved.",
     per_call_cap_exceeded: "The amount exceeds the sending account's per-call cap. No money moved.",
     per_day_cap_exceeded: "The amount exceeds the sending account's remaining daily cap. No money moved.",
     payer_mismatch: "The relay rejected the sending account. No money moved.",
@@ -44373,17 +45200,644 @@ function transferError(code, options = {}) {
     resume_not_found: "No resumable transfer was found for that nonce. No money moved.",
     resume_mismatch: "The resumed transfer does not match the original request. No money moved.",
     signer_mismatch: "The unlocked signer does not match the sending account. No money moved.",
+    account_address_mismatch: "The sending or recipient account no longer matches the address recorded by its movement. No money moved.",
     signing_failed: "The transfer authorization could not be signed. No money moved."
   };
   return new TransferError(code, messages[code], options);
 }
 
+// src/movement.ts
+var movementIdSchema = external_exports.string().regex(/^mv_[A-Za-z0-9_-]{8,128}$/);
+var nonceSchema = external_exports.string().regex(/^0x[0-9a-fA-F]{64}$/);
+var amountSchema = external_exports.string().regex(/^\d+\.\d{2}$/);
+var movementReasonSchema = external_exports.enum([
+  "distribute",
+  "allocate",
+  "rebalance",
+  "delegate",
+  "sweep",
+  "send"
+]);
+var movementPurposeSchema = external_exports.enum(["send", "sweep"]);
+var movementAddressSchema = external_exports.string().refine((value) => isAddress(value, { strict: false }));
+var movementLegSchema = external_exports.strictObject({
+  from: walletNameSchema,
+  to: external_exports.string().trim().min(1),
+  fromAddress: movementAddressSchema.optional(),
+  toAddress: movementAddressSchema.optional(),
+  amountUsd: amountSchema,
+  purpose: movementPurposeSchema,
+  nonce: nonceSchema,
+  status: external_exports.enum(["planned", "sent", "failed", "unknown", "cancelled"]),
+  txHash: external_exports.string().regex(/^0x[0-9a-fA-F]+$/).optional(),
+  reason: external_exports.string().min(1).optional(),
+  retryable: external_exports.boolean().optional(),
+  restored: external_exports.literal(true).optional(),
+  addressBindingSource: external_exports.enum(["journal", "terminal-review"]).optional()
+});
+var movementSchema = external_exports.strictObject({
+  v: external_exports.literal(2),
+  id: movementIdSchema,
+  reason: movementReasonSchema,
+  from: walletNameSchema,
+  // The only account a `sweep` leg may name besides the owner. Sweeps skip the
+  // spend caps, so the parent comes from the plan, never from a leg's `to`.
+  treasury: walletNameSchema.optional(),
+  network: external_exports.enum([BASE_MAINNET_CAIP2, ARC_MAINNET_CAIP2]),
+  createdAt: external_exports.iso.datetime(),
+  legs: external_exports.array(movementLegSchema).min(1)
+});
+var legacyMovementSchema = external_exports.strictObject({
+  v: external_exports.literal(1),
+  id: movementIdSchema,
+  reason: external_exports.literal("distribute"),
+  from: walletNameSchema,
+  network: external_exports.enum([BASE_MAINNET_CAIP2, ARC_MAINNET_CAIP2]),
+  createdAt: external_exports.iso.datetime(),
+  legs: external_exports.array(
+    external_exports.strictObject({
+      to: external_exports.string().trim().min(1),
+      amountUsd: amountSchema,
+      nonce: nonceSchema,
+      status: external_exports.enum(["planned", "sent", "failed", "unknown"]),
+      txHash: external_exports.string().regex(/^0x[0-9a-fA-F]+$/).optional(),
+      reason: external_exports.string().min(1).optional(),
+      retryable: external_exports.boolean().optional()
+    })
+  ).min(1)
+});
+var MovementError = class extends Error {
+  constructor(code, message, movementId) {
+    super(message);
+    this.code = code;
+    this.movementId = movementId;
+    this.name = "MovementError";
+  }
+  code;
+  movementId;
+};
+async function listUnfinishedMovements(options) {
+  const directory = movementsDirectory(options.home);
+  let names;
+  try {
+    names = await readdir3(directory);
+  } catch (error61) {
+    if (isMissingFile(error61)) return [];
+    throw error61;
+  }
+  const summaries = [];
+  for (const name of names.filter((candidate) => candidate.endsWith(".json")).sort()) {
+    const movement = parseMovement(JSON.parse(await readFile9(join5(directory, name), "utf8")));
+    if (options.from !== void 0 && !movement.legs.some((leg) => leg.from === options.from)) {
+      continue;
+    }
+    const pendingLegs = movement.legs.filter((leg) => leg.status === "planned").length;
+    const unknownLegs = movement.legs.filter((leg) => leg.status === "unknown").length;
+    if (!await movementHasOpenLeg(options.home, movement, options.from)) continue;
+    summaries.push({
+      id: movement.id,
+      from: movement.from,
+      network: movement.network,
+      createdAt: movement.createdAt,
+      pendingLegs,
+      unknownLegs
+    });
+  }
+  return summaries.sort(
+    (left, right) => left.createdAt.localeCompare(right.createdAt) || left.id.localeCompare(right.id)
+  );
+}
+async function movementHasOpenLeg(home, movement, from15) {
+  for (const leg of movement.legs) {
+    if (from15 !== void 0 && leg.from !== from15) continue;
+    if (isOpenMovementLeg(leg, "unsigned")) return true;
+    if (leg.status !== "failed") continue;
+    const journal = await readTransferJournal(home, leg.from, leg.nonce);
+    if (isOpenMovementLeg(leg, journal.signed ? "signed" : "unsigned")) return true;
+  }
+  return false;
+}
+async function readMovement(home, id) {
+  const safeId = parseMovementId(id);
+  try {
+    return parseMovement(
+      JSON.parse(await readFile9(join5(movementsDirectory(home), `${safeId}.json`), "utf8"))
+    );
+  } catch (error61) {
+    if (isMissingFile(error61)) {
+      throw new MovementError(
+        "movement_not_found",
+        `No movement named ${safeId} was found.`,
+        safeId
+      );
+    }
+    throw error61;
+  }
+}
+async function reconcileUnresolvedMovementsForAccountLocked(home, account, deps) {
+  for (const summary of await listUnfinishedMovements({ home, from: account })) {
+    let movement = await readMovement(home, summary.id);
+    try {
+      for (let index2 = 0; index2 < movement.legs.length; index2 += 1) {
+        const leg = movement.legs[index2];
+        if (leg?.from !== account || leg.status !== "planned" && !(leg.status === "failed" && leg.retryable === true)) {
+          continue;
+        }
+        const reconciled = await reconcileJournaledLeg(movement, index2, home);
+        if (reconciled !== movement) {
+          movement = reconciled;
+          await writeMovement(home, movement);
+        }
+      }
+      for (let index2 = 0; index2 < movement.legs.length; index2 += 1) {
+        const leg = movement.legs[index2];
+        if (leg?.from !== account || leg.status !== "unknown") continue;
+        movement = await resolveUnknownLeg(movement, index2, home, deps);
+      }
+      for (let index2 = 0; index2 < movement.legs.length; index2 += 1) {
+        const leg = movement.legs[index2];
+        if (leg?.from !== account || leg.status !== "failed") continue;
+        movement = await prepareFailedLeg(movement, index2, home, deps);
+      }
+    } catch {
+    }
+    if (await movementHasOpenLeg(home, movement, account)) return movement;
+  }
+  return void 0;
+}
+async function resolveUnknownLeg(movement, index2, home, deps) {
+  const leg = movement.legs[index2];
+  if (isExpiredRestoredReview(leg)) {
+    if (deps.replaceExpiredRestored !== true) {
+      await throwRestoredLegReview(movement, leg, deps);
+    }
+    const journal2 = await readTransferJournal(home, leg.from, leg.nonce);
+    await releaseExpiredReservation(leg, journal2, home, deps);
+    const bound = leg.fromAddress === void 0 || leg.toAddress === void 0 ? await bindLegAddresses(leg, deps) : leg;
+    movement = replaceLeg(
+      movement,
+      index2,
+      plannedLeg(bound, (deps.randomNonce ?? createMovementNonce)())
+    );
+    await writeMovement(home, movement);
+    return movement;
+  }
+  try {
+    const result = await callTransfer(movement, leg, deps, true);
+    if (result.status === "sent") {
+      movement = replaceLeg(movement, index2, sentLeg(leg, result.txHash));
+      await writeMovement(home, movement);
+      return movement;
+    }
+  } catch (error61) {
+    if (error61 instanceof TransferError || error61 instanceof SweepParentUnknownError) {
+    } else {
+      await reconcileCrash(movement, index2, home);
+      throw error61;
+    }
+  }
+  const journal = await readTransferJournal(home, leg.from, leg.nonce);
+  const state = await authorizationState(movement, leg, journal.validBefore, home, deps);
+  if (state === "settled") {
+    movement = replaceLeg(movement, index2, sentLeg(leg));
+  } else if (state === "expired") {
+    if (leg.restored === true && deps.replaceExpiredRestored !== true) {
+      movement = replaceLeg(movement, index2, restoredExpiredReviewLeg(leg));
+      await writeMovement(home, movement);
+      await throwRestoredLegReview(movement, movement.legs[index2], deps);
+    }
+    await releaseExpiredReservation(leg, journal, home, deps);
+    movement = replaceLeg(
+      movement,
+      index2,
+      plannedLeg(leg, (deps.randomNonce ?? createMovementNonce)())
+    );
+  }
+  await writeMovement(home, movement);
+  return movement;
+}
+async function reconcileJournaledLeg(movement, index2, home) {
+  const leg = movement.legs[index2];
+  const journal = await readTransferJournal(home, leg.from, leg.nonce);
+  if (journal.latest?.transfer?.status === "sent") {
+    return replaceLeg(
+      movement,
+      index2,
+      sentLeg(
+        leg,
+        journal.latest.transfer.txHash === null ? void 0 : journal.latest.transfer.txHash
+      )
+    );
+  }
+  return journal.signed ? replaceLeg(movement, index2, unknownLeg(leg)) : movement;
+}
+async function prepareFailedLeg(movement, index2, home, deps) {
+  const leg = movement.legs[index2];
+  if (leg.retryable === true) {
+    const reconciled = await reconcileJournaledLeg(movement, index2, home);
+    if (reconciled !== movement) {
+      await writeMovement(home, reconciled);
+      return reconciled;
+    }
+    return replaceLeg(movement, index2, plannedLeg(leg, leg.nonce, true));
+  }
+  const journal = await readTransferJournal(home, leg.from, leg.nonce);
+  if (!journal.signed) return movement;
+  const state = await authorizationState(movement, leg, journal.validBefore, home, deps);
+  if (state === "settled") {
+    movement = replaceLeg(movement, index2, sentLeg(leg));
+  } else if (state === "expired") {
+    if (leg.restored === true && deps.replaceExpiredRestored !== true) {
+      movement = replaceLeg(movement, index2, restoredExpiredReviewLeg(leg));
+      await writeMovement(home, movement);
+      await throwRestoredLegReview(movement, movement.legs[index2], deps);
+    }
+    await releaseExpiredReservation(leg, journal, home, deps);
+    movement = replaceLeg(
+      movement,
+      index2,
+      plannedLeg(leg, (deps.randomNonce ?? createMovementNonce)())
+    );
+  }
+  await writeMovement(home, movement);
+  return movement;
+}
+async function callTransfer(movement, leg, deps, resume) {
+  if (leg.fromAddress !== void 0 && leg.toAddress !== void 0) {
+    await assertLegAddressBinding(movement, leg, deps);
+  } else if (!resume) {
+    throw movementAddressUnboundError(movement);
+  }
+  const transfer = deps.transfer ?? transferBetweenAccounts;
+  const sweepParent = await readSweepParent(movement, leg, deps);
+  return await transfer({
+    store: deps.store,
+    secrets: deps.secrets,
+    apiBase: deps.apiBase,
+    from: leg.from,
+    to: leg.to,
+    amountUsd: leg.amountUsd,
+    network: movement.network,
+    purpose: leg.purpose,
+    expectedFromAddress: leg.fromAddress,
+    expectedToAddress: leg.toAddress,
+    ...sweepParent === void 0 ? {} : { sweepParent },
+    home: deps.home ?? deps.store.home,
+    ...resume ? { resume: leg.nonce } : { nonce: leg.nonce },
+    ...deps.unlock === void 0 ? {} : { unlock: deps.unlock },
+    ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
+    ...deps.now === void 0 ? {} : { now: deps.now },
+    ...deps.timeoutMs === void 0 ? {} : { timeoutMs: deps.timeoutMs },
+    ...deps.ledgerPath === void 0 ? {} : { ledgerPath: deps.ledgerPath }
+  });
+}
+async function reconcileCrash(movement, index2, home) {
+  const leg = movement.legs[index2];
+  const journal = await readTransferJournal(home, leg.from, leg.nonce);
+  let reconciled = leg;
+  if (journal.latest?.transfer?.status === "sent") {
+    reconciled = sentLeg(
+      leg,
+      journal.latest.transfer.txHash === null ? void 0 : journal.latest.transfer.txHash
+    );
+  } else if (journal.latest?.transfer?.status === "failed") {
+    reconciled = journalFailedLeg(leg, journal.latest.error?.code ?? "transfer_failed");
+  } else if (journal.signed) {
+    reconciled = unknownLeg(leg);
+  }
+  await writeMovement(home, replaceLeg(movement, index2, reconciled));
+}
+async function authorizationState(movement, leg, validBefore, home, deps) {
+  if (deps.authorizationState !== void 0) {
+    return await deps.authorizationState({
+      movement,
+      leg,
+      ...validBefore === void 0 ? {} : { validBefore }
+    });
+  }
+  const journal = await readTransferJournal(home, leg.from, leg.nonce);
+  const receipt = journal.request;
+  const request = receipt?.transfer?.request;
+  if (receipt === void 0 || request === void 0) {
+    throw new MovementError(
+      "invalid_movement",
+      `Movement ${movement.id} has no journaled authorization for nonce ${leg.nonce}.`,
+      movement.id
+    );
+  }
+  const config2 = await loadConfig(getVapiPaths(home).config);
+  const settlementReceipt = {
+    ...receipt,
+    authorization: {
+      from: request.authorization.from,
+      nonce: request.authorization.nonce,
+      validBefore: request.authorization.validBefore
+    }
+  };
+  return (await checkReceiptSettlement(settlementReceipt, config2, {
+    ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl }
+  })).state;
+}
+async function releaseExpiredReservation(leg, journal, home, deps) {
+  if (journal.reservedOn === void 0) return;
+  await releaseSpend(parseUsdCents(leg.amountUsd) * 10000n, {
+    reservedOn: journal.reservedOn,
+    ledgerPath: deps.ledgerPath ?? getVapiPaths(home).ledger,
+    now: new Date((deps.now ?? Date.now)()),
+    wallet: leg.from,
+    reservationId: leg.nonce.toLowerCase()
+  });
+}
+function sentLeg(leg, txHash) {
+  return {
+    from: leg.from,
+    to: leg.to,
+    ...legAddressBinding(leg),
+    amountUsd: leg.amountUsd,
+    purpose: leg.purpose,
+    nonce: leg.nonce,
+    status: "sent",
+    ...restoredMarker(leg),
+    ...txHash === void 0 || txHash === null ? {} : { txHash }
+  };
+}
+function unknownLeg(leg) {
+  return {
+    from: leg.from,
+    to: leg.to,
+    ...legAddressBinding(leg),
+    amountUsd: leg.amountUsd,
+    purpose: leg.purpose,
+    nonce: leg.nonce,
+    status: "unknown",
+    ...restoredMarker(leg)
+  };
+}
+function journalFailedLeg(leg, reason) {
+  return {
+    from: leg.from,
+    to: leg.to,
+    ...legAddressBinding(leg),
+    amountUsd: leg.amountUsd,
+    purpose: leg.purpose,
+    nonce: leg.nonce,
+    status: "failed",
+    reason,
+    ...restoredMarker(leg)
+  };
+}
+function plannedLeg(leg, nonce, preserveRestored = false) {
+  return {
+    from: leg.from,
+    to: leg.to,
+    ...legAddressBinding(leg),
+    amountUsd: leg.amountUsd,
+    purpose: leg.purpose,
+    nonce,
+    status: "planned",
+    ...preserveRestored ? restoredMarker(leg) : {}
+  };
+}
+function restoredExpiredReviewLeg(leg) {
+  return {
+    from: leg.from,
+    to: leg.to,
+    ...legAddressBinding(leg),
+    amountUsd: leg.amountUsd,
+    purpose: leg.purpose,
+    nonce: leg.nonce,
+    status: "unknown",
+    reason: "restored_nonce_expired",
+    restored: true
+  };
+}
+function restoredMarker(leg) {
+  return leg.restored === true ? { restored: true } : {};
+}
+function legAddressBinding(leg) {
+  return {
+    ...leg.fromAddress === void 0 ? {} : { fromAddress: leg.fromAddress },
+    ...leg.toAddress === void 0 ? {} : { toAddress: leg.toAddress },
+    ...leg.addressBindingSource === void 0 ? {} : { addressBindingSource: leg.addressBindingSource }
+  };
+}
+function isExpiredRestoredReview(leg) {
+  return leg.restored === true && leg.reason === "restored_nonce_expired";
+}
+async function throwRestoredLegReview(movement, leg, deps, kind = "expired") {
+  const address2 = await (deps.addressReader === void 0 ? deps.store.readAddress(leg.from) : deps.addressReader(leg.from));
+  const explorer = address2 === void 0 ? void 0 : explorerAddressUrl(movement.network, address2);
+  const addressHint = address2 ?? `account ${leg.from}`;
+  const explorerHint = explorer === void 0 ? "a block explorer" : explorer;
+  throw new MovementError(
+    "restored_leg_review",
+    `Movement ${movement.id} restored a ${leg.amountUsd} USDC transfer from ${leg.from} to ${leg.to}, ${kind === "expired" ? `but its saved authorization ${leg.nonce} has expired` : "that the backup recorded before it was signed"}. The original device may already have paid it with a later nonce, so nothing was signed. Check the balance with vapi balance --account ${leg.from}, then inspect ${addressHint} on ${explorerHint}. If the transfer was not paid, continue deliberately in a terminal with vapi accounts distribute --resume ${movement.id} --replace-expired-restored. This override is unavailable through MCP.`,
+    movement.id
+  );
+}
+function replaceLeg(movement, index2, leg) {
+  const legs = [...movement.legs];
+  legs[index2] = movementLegSchema.parse(leg);
+  return movementSchema.parse({ ...movement, legs });
+}
+function parseMovement(value) {
+  const current = movementSchema.safeParse(value);
+  if (current.success) return current.data;
+  const legacy = legacyMovementSchema.parse(value);
+  return movementSchema.parse({
+    ...legacy,
+    v: 2,
+    legs: legacy.legs.map((leg) => ({
+      ...leg,
+      from: legacy.from,
+      purpose: "send"
+    }))
+  });
+}
+async function bindLegAddresses(leg, deps) {
+  const fromAddress = await resolveAccountAddress(leg.from, deps);
+  if (fromAddress === void 0) {
+    throw new MovementError(
+      "invalid_movement",
+      `Cannot plan a movement from ${leg.from}: its local address is unavailable. Restore that account, then retry.`
+    );
+  }
+  const toAddress = await resolveRecipientAddress(leg.from, leg.to, deps);
+  if (toAddress === void 0) {
+    throw new MovementError(
+      "invalid_movement",
+      `Cannot plan a movement to ${leg.to}: its address is unavailable. Restore or relink that account, then retry.`
+    );
+  }
+  return { ...leg, fromAddress, toAddress };
+}
+async function assertLegAddressBinding(movement, leg, deps) {
+  if (leg.fromAddress === void 0 || leg.toAddress === void 0) {
+    throw movementAddressUnboundError(movement);
+  }
+  const fromAddress = await resolveAccountAddress(leg.from, deps);
+  if (fromAddress === void 0 || !sameAddress2(fromAddress, leg.fromAddress)) {
+    throw new MovementError(
+      "account_address_mismatch",
+      `Movement ${movement.id} bound sender ${leg.from} to ${leg.fromAddress}, but that name now resolves differently. Restore ${leg.from} to the recorded address before resuming, or wait for any signed authorization to expire and run vapi accounts distribute --cancel ${movement.id}.`,
+      movement.id
+    );
+  }
+  const toAddress = await resolveRecipientAddress(leg.from, leg.to, deps);
+  if (toAddress === void 0 || !sameAddress2(toAddress, leg.toAddress)) {
+    throw new MovementError(
+      "account_address_mismatch",
+      `Movement ${movement.id} bound recipient ${leg.to} to ${leg.toAddress}, but that name now resolves differently. Restore or relink ${leg.to} to the recorded address before resuming, or wait for any signed authorization to expire and run vapi accounts distribute --cancel ${movement.id}.`,
+      movement.id
+    );
+  }
+}
+function movementAddressUnboundError(movement) {
+  return new MovementError(
+    "movement_address_unbound",
+    `Movement ${movement.id} predates address binding, so vAPI cannot safely sign its planned leg. Check balances and the saved nonce, then create a new movement deliberately if no authorization can settle.`,
+    movement.id
+  );
+}
+async function resolveAccountAddress(account, deps) {
+  const raw = await (deps.addressReader ?? ((name) => deps.store.readAddress(name)))(account);
+  return raw !== void 0 && isAddress(raw, { strict: false }) ? getAddress(raw) : void 0;
+}
+async function resolveRecipientAddress(from15, recipient, deps) {
+  const requested = recipient.trim();
+  if (isAddress(requested, { strict: false })) return getAddress(requested);
+  if (requested === "owner") {
+    const owner = deps.store.entry(from15)?.link?.owner;
+    if (owner !== void 0 && isAddress(owner, { strict: false })) return getAddress(owner);
+  } else {
+    const account = walletNameSchema.safeParse(requested);
+    if (account.success) {
+      const local = await resolveAccountAddress(account.data, deps);
+      if (local !== void 0) return local;
+    }
+  }
+  const resolved = await deps.recipientAddressReader?.(from15, requested);
+  return resolved !== void 0 && isAddress(resolved, { strict: false }) ? getAddress(resolved) : void 0;
+}
+function sameAddress2(left, right) {
+  return isAddress(left, { strict: false }) && isAddress(right, { strict: false }) && getAddress(left) === getAddress(right);
+}
+var SweepParentUnknownError = class extends Error {
+};
+function isOwnerSweep(to) {
+  return to.trim() === "owner" || isAddress(to, { strict: false });
+}
+async function readSweepParent(movement, leg, deps) {
+  if (leg.purpose !== "sweep" || isOwnerSweep(leg.to)) return void 0;
+  if (movement.treasury === void 0 || leg.to !== movement.treasury) {
+    throw new SweepParentUnknownError();
+  }
+  const account = walletNameSchema.safeParse(leg.to);
+  if (!account.success) throw new SweepParentUnknownError();
+  const address2 = deps.addressReader === void 0 ? await deps.store.readAddress(account.data) : await deps.addressReader(account.data);
+  if (address2 === void 0 || !isAddress(address2, { strict: false })) {
+    throw new SweepParentUnknownError();
+  }
+  return address2;
+}
+function parseMovementId(value) {
+  const parsed = movementIdSchema.safeParse(value);
+  if (!parsed.success) throw new MovementError("invalid_movement", "The movement id is invalid.");
+  return parsed.data;
+}
+function movementsDirectory(home) {
+  return join5(home, "movements");
+}
+function createMovementNonce() {
+  return bytesToHex(randomBytes6(32));
+}
+async function writeMovement(home, movement) {
+  const parsed = movementSchema.parse(movement);
+  const directory = movementsDirectory(home);
+  await mkdir10(directory, { recursive: true, mode: 448 });
+  await chmod3(directory, 448);
+  const path = join5(directory, `${parsed.id}.json`);
+  const temporary = join5(
+    directory,
+    `.${parsed.id}.${process.pid}.${randomBytes6(6).toString("hex")}.tmp`
+  );
+  let handle;
+  try {
+    handle = await open9(temporary, "wx", 384);
+    await handle.writeFile(serializeMovement(parsed), "utf8");
+    await handle.sync();
+    await handle.close();
+    handle = void 0;
+    await rename6(temporary, path);
+    const directoryHandle = await open9(directory, "r");
+    try {
+      await directoryHandle.sync();
+    } finally {
+      await directoryHandle.close();
+    }
+  } catch (error61) {
+    await handle?.close().catch(() => void 0);
+    await unlink7(temporary).catch(() => void 0);
+    throw error61;
+  }
+}
+function serializeMovement(movement) {
+  return `${JSON.stringify(movementSchema.parse(movement), null, 2)}
+`;
+}
+
+// src/sweep.ts
+var ERC20_ABI = [
+  {
+    type: "function",
+    name: "balanceOf",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address" }],
+    outputs: [{ name: "balance", type: "uint256" }]
+  },
+  {
+    type: "function",
+    name: "transfer",
+    stateMutability: "nonpayable",
+    inputs: [
+      { name: "to", type: "address" },
+      { name: "amount", type: "uint256" }
+    ],
+    outputs: [{ name: "success", type: "bool" }]
+  }
+];
+async function readUsdcBalance(args) {
+  if (isSolanaNetwork(args.network)) {
+    return await readSolanaUsdcBalance({
+      network: args.network,
+      configured: args.configured,
+      address: args.address,
+      allowPrivateNetwork: args.allowPrivateNetwork,
+      ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {},
+      ...args.lookup ? { lookup: args.lookup } : {}
+    });
+  }
+  const client = createNetworkPublicClient(args.network, args.configured, {
+    allowPrivateNetwork: args.allowPrivateNetwork,
+    ...args.fetchImpl ? { fetch: args.fetchImpl } : {},
+    ...args.lookup ? { lookup: args.lookup } : {}
+  });
+  return await client.readContract({
+    address: getAddress(
+      usesUsdcGas(args.network) ? getNetworkDefinition(args.network).usdc : args.configured.usdc
+    ),
+    abi: ERC20_ABI,
+    functionName: "balanceOf",
+    args: [getAddress(args.address)]
+  });
+}
+
 // src/ceiling.ts
 var CEILING_SWEEP_MINIMUM_ATOMIC = 100000n;
 var CEILING_SWEEP_GUARD_MS = 10 * 60 * 1e3;
 var CEILING_SWEEP_TIMEOUT_MS = 1e4;
 function sweepTarget(account) {
-  return account.owner;
+  return account.parent?.address ?? account.owner;
 }
 async function sweepAboveCeiling(args) {
   try {
@@ -44410,6 +45864,25 @@ async function sweepAboveCeilingLocked(args) {
     if (caps.effectiveCeilingAtomic === null) {
       return skipped(args.account, "ceiling_off");
     }
+    const unresolvedMovement = await reconcileUnresolvedMovementsForAccountLocked(
+      auditHome,
+      args.account,
+      {
+        store: args.store,
+        secrets: args.secrets,
+        apiBase: args.apiBase,
+        home: auditHome,
+        ...args.transfer === void 0 ? {} : { transfer: args.transfer },
+        ...args.addressReader === void 0 ? {} : { addressReader: args.addressReader },
+        ...args.fetchImpl === void 0 ? {} : { fetchImpl: args.fetchImpl },
+        ...args.now === void 0 ? {} : { now: args.now },
+        ...args.timeoutMs === void 0 ? {} : { timeoutMs: args.timeoutMs }
+      }
+    );
+    if (unresolvedMovement !== void 0) {
+      await auditFailure(auditHome, args.account, void 0, "unfinished_movement", now);
+      return skipped(args.account, "unfinished_movement");
+    }
     const rawAddress = await (args.addressReader ?? ((account) => args.store.readAddress(account)))(
       args.account
     );
@@ -44436,12 +45909,12 @@ async function sweepAboveCeilingLocked(args) {
       }
       throw error61;
     }
-    const self = siblingResult.siblings.find((candidate) => candidate.self) ?? siblingResult.siblings.find((candidate) => sameAddress2(candidate.address, address2));
+    const self = siblingResult.siblings.find((candidate) => candidate.self) ?? siblingResult.siblings.find((candidate) => sameAddress3(candidate.address, address2));
     if (self?.status === "revoked") return skipped(args.account, "revoked");
     if (siblingResult.owner === null) return skipped(args.account, "no_known_owner");
     const serverOwner = siblingResult.owner;
     const linkedOwner = isAddress(entry.link.owner, { strict: false }) ? getAddress(entry.link.owner) : void 0;
-    if (linkedOwner === void 0 || !sameAddress2(linkedOwner, serverOwner)) {
+    if (linkedOwner === void 0 || !sameAddress3(linkedOwner, serverOwner)) {
       safeWarn(
         args.warn,
         `Refusing to sweep ${args.account}: its stored owner differs from the linked server owner.`
@@ -44469,12 +45942,30 @@ async function sweepAboveCeilingLocked(args) {
       CEILING_SWEEP_GUARD_MS
     );
     if (!claimed) return skipped(args.account, "throttled");
+    if (pending !== void 0) {
+      if (!sameAddress3(pending.owner, owner)) {
+        return {
+          account: args.account,
+          status: "unknown",
+          reason: "pending_owner_changed",
+          amountUsd: formatAtomicUsd(BigInt(pending.amountAtomic))
+        };
+      }
+    }
+    const parent = await args.resolveParent?.(args.account);
+    const target = sweepTarget({
+      account: args.account,
+      owner,
+      ...parent === void 0 ? {} : { parent }
+    });
     if (pending !== void 0) {
       const reconciled = await executePendingSweep({
         args,
         pending,
         address: address2,
         owner,
+        target,
+        sweepParent: parent?.address,
         readBalance: readBalance2
       });
       if (reconciled !== void 0) return reconciled;
@@ -44482,7 +45973,7 @@ async function sweepAboveCeilingLocked(args) {
     }
     await args.store.reload();
     const currentEntry = args.store.entry(args.account);
-    if (currentEntry?.link === void 0 || !sameOrigin(currentEntry.link.apiBase, args.apiBase) || !sameAddress2(currentEntry.link.owner, owner)) {
+    if (currentEntry?.link === void 0 || !sameOrigin(currentEntry.link.apiBase, args.apiBase) || !sameAddress3(currentEntry.link.owner, owner)) {
       return skipped(args.account, "not_linked");
     }
     const currentCeiling = args.store.ceilingCaps(args.account).effectiveCeilingAtomic;
@@ -44498,8 +45989,9 @@ async function sweepAboveCeilingLocked(args) {
     args.signal?.throwIfAborted();
     pending = {
       owner,
+      target,
       amountAtomic: amountAtomic.toString(),
-      nonce: (args.randomNonce ?? (() => bytesToHex(randomBytes4(32))))(),
+      nonce: (args.randomNonce ?? (() => bytesToHex(randomBytes7(32))))(),
       createdAt: new Date(now()).toISOString(),
       status: "planned"
     };
@@ -44513,6 +46005,8 @@ async function sweepAboveCeilingLocked(args) {
       pending: stored,
       address: address2,
       owner,
+      target,
+      sweepParent: parent?.address,
       readBalance: readBalance2
     }) ?? skipped(args.account, "below_threshold");
   } catch (error61) {
@@ -44522,22 +46016,28 @@ async function sweepAboveCeilingLocked(args) {
   }
 }
 async function executePendingSweep(input2) {
-  const { args, pending, address: address2, owner, readBalance: readBalance2 } = input2;
+  const {
+    args,
+    pending,
+    address: address2,
+    owner,
+    target: currentTarget,
+    sweepParent: currentSweepParent,
+    readBalance: readBalance2
+  } = input2;
   const now = args.now ?? Date.now;
   const auditHome = args.auditHome ?? args.store.home;
-  if (!sameAddress2(pending.owner, owner)) {
-    return {
-      account: args.account,
-      status: "unknown",
-      reason: "pending_owner_changed",
-      amountUsd: formatAtomicUsd(BigInt(pending.amountAtomic))
-    };
-  }
   const amountAtomic = BigInt(pending.amountAtomic);
   const amountUsd = formatAtomicUsd(amountAtomic);
-  const target = sweepTarget({ account: args.account, owner });
   const hasJournal = await hasTransferJournal(auditHome, args.account, pending.nonce);
   const resume = pending.status === "unknown" || hasJournal;
+  const storedTarget = getAddress(pending.target ?? owner);
+  if (!resume && !sameAddress3(storedTarget, currentTarget)) {
+    await clearPendingSweep(args.store, args.account, pending.nonce);
+    return void 0;
+  }
+  const target = resume ? storedTarget : currentTarget;
+  const sweepParent = resume ? !sameAddress3(target, owner) ? target : void 0 : currentSweepParent;
   try {
     const result = await (args.transfer ?? transferBetweenAccounts)({
       store: args.store,
@@ -44548,6 +46048,7 @@ async function executePendingSweep(input2) {
       amountUsd,
       network: "base",
       purpose: "sweep",
+      ...sweepParent === void 0 ? {} : { sweepParent },
       ...resume ? { resume: pending.nonce } : { nonce: pending.nonce },
       unlock: guardedSweepUnlock(args, address2, owner, amountAtomic, readBalance2),
       ...args.fetchImpl === void 0 ? {} : { fetchImpl: args.fetchImpl },
@@ -44685,7 +46186,7 @@ function guardedSweepUnlock(args, address2, owner, amountAtomic, readBalance2) {
     args.signal?.throwIfAborted();
     await args.store.reload();
     const entry = args.store.entry(account);
-    if (entry?.link === void 0 || !sameOrigin(entry.link.apiBase, args.apiBase) || !sameAddress2(entry.link.owner, owner)) {
+    if (entry?.link === void 0 || !sameOrigin(entry.link.apiBase, args.apiBase) || !sameAddress3(entry.link.owner, owner)) {
       throw new CeilingPolicyChangedError();
     }
     const ceiling = args.store.ceilingCaps(account).effectiveCeilingAtomic;
@@ -44751,77 +46252,17 @@ var CeilingPolicyChangedError = class extends Error {
   code = "policy_changed";
 };
 async function withCeilingSweepLock(args, operation) {
-  const path = `${args.store.registryPath}.${args.account}.ceiling.lock`;
-  const waitMs = args.timeoutMs ?? CEILING_SWEEP_TIMEOUT_MS;
-  const deadline = Date.now() + Math.max(0, waitMs);
-  const staleAfterMs = Math.max(12e4, waitMs * 3);
-  const owner = JSON.stringify({ pid: process.pid, token: randomBytes4(16).toString("hex") });
-  let handle;
-  while (handle === void 0) {
-    args.signal?.throwIfAborted();
-    try {
-      handle = await open7(path, "wx", 384);
-      await handle.writeFile(owner, "utf8");
-      await handle.sync();
-    } catch (error61) {
-      if (!(error61 instanceof Error && "code" in error61 && error61.code === "EEXIST")) throw error61;
-      await removeStaleSweepLock(path, staleAfterMs);
-      if (Date.now() >= deadline) throw new CeilingSweepTimeoutError();
-      await new Promise((resolve) => setTimeout(resolve, 20));
-    }
-  }
-  const ownedHandle = handle;
-  const heartbeat = setInterval(
-    () => {
-      const time3 = /* @__PURE__ */ new Date();
-      void ownedHandle.utimes(time3, time3).catch(() => void 0);
-    },
-    Math.min(3e4, Math.max(1e3, Math.floor(staleAfterMs / 3)))
-  );
-  heartbeat.unref();
   try {
-    return await operation();
-  } finally {
-    clearInterval(heartbeat);
-    await ownedHandle.close();
-    await unlinkOwnedSweepLock(path, owner);
-  }
-}
-async function removeStaleSweepLock(path, staleAfterMs) {
-  try {
-    const metadata = await stat5(path);
-    if (Date.now() - metadata.mtimeMs <= staleAfterMs) return;
-    const owner = await readFile5(path, "utf8").catch(() => "");
-    const pid = lockOwnerPid(owner);
-    if (pid !== void 0 && processIsAlive(pid)) return;
-    await unlinkOwnedSweepLock(path, owner);
-  } catch (error61) {
-    if (!isMissingFile(error61)) throw error61;
-  }
-}
-async function unlinkOwnedSweepLock(path, owner) {
-  try {
-    if (await readFile5(path, "utf8") === owner) await unlink5(path);
-  } catch (error61) {
-    if (!isMissingFile(error61)) throw error61;
-  }
-}
-function lockOwnerPid(owner) {
-  try {
-    const value = JSON.parse(owner);
-    if (typeof value !== "object" || value === null) return void 0;
-    const pid = Reflect.get(value, "pid");
-    return typeof pid === "number" && Number.isSafeInteger(pid) && pid > 0 ? pid : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function processIsAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
+    return await withAccountMovementLock(
+      args.store.home,
+      args.account,
+      args.timeoutMs ?? CEILING_SWEEP_TIMEOUT_MS,
+      operation,
+      args.signal
+    );
   } catch (error61) {
-    return error61 instanceof Error && "code" in error61 && error61.code === "EPERM";
+    if (error61 instanceof AccountMovementLockedError) throw new CeilingSweepTimeoutError();
+    throw error61;
   }
 }
 function defaultBalanceReader(args) {
@@ -44868,7 +46309,7 @@ function sameOrigin(left, right) {
     return false;
   }
 }
-function sameAddress2(left, right) {
+function sameAddress3(left, right) {
   return isAddress(left, { strict: false }) && isAddress(right, { strict: false }) && getAddress(left) === getAddress(right);
 }
 function safeWarn(warn, message) {
@@ -44903,11 +46344,160 @@ async function safeAppendAudit(home, record2, now) {
   await appendAudit(home, record2, { now: () => new Date(now()) }).catch(() => void 0);
 }
 
+// src/swarm.ts
+import { readdir as readdir4, readFile as readFile10, stat as stat8, unlink as unlink8 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+var SWARM_NAME_PATTERN = /^[a-z][a-z0-9-]{0,15}$/;
+var SWARM_ROLE_PATTERN = /^[a-z][a-z0-9]{0,7}$/;
+var atomicSchema = external_exports.string().regex(/^\d+$/);
+var addressSchema2 = external_exports.string().regex(/^0x[0-9a-fA-F]{40}$/);
+var capsSchema = external_exports.strictObject({ perCallAtomic: atomicSchema, perDayAtomic: atomicSchema });
+var movementIdSchema2 = external_exports.string().regex(/^mv_[A-Za-z0-9_-]{8,128}$/u);
+var amountUsdSchema = external_exports.string().regex(/^\d+\.\d{2}$/u);
+var setupFundingStatusSchema = external_exports.enum(["planned", "sent", "incomplete"]);
+var blockedFundingLegSchema = external_exports.strictObject({
+  to: external_exports.string().trim().min(1),
+  amountUsd: amountUsdSchema,
+  reason: external_exports.string().trim().min(1)
+});
+var setupFundingSchema = external_exports.strictObject({
+  amountUsd: amountUsdSchema,
+  from: walletNameSchema,
+  movementId: movementIdSchema2.optional(),
+  status: setupFundingStatusSchema,
+  policy: external_exports.strictObject({
+    strategy: external_exports.enum(["targets", "even", "weights"]),
+    movementId: movementIdSchema2.optional(),
+    status: setupFundingStatusSchema,
+    blocked: external_exports.array(blockedFundingLegSchema).optional()
+  }).optional()
+});
+var accountSteps = {
+  creating: external_exports.boolean().default(false),
+  created: external_exports.boolean(),
+  capped: external_exports.boolean(),
+  linked: external_exports.boolean()
+};
+var treasurySchema = external_exports.strictObject({
+  account: walletNameSchema,
+  // A planned account has no address until its vault derivation succeeds.
+  address: addressSchema2.optional(),
+  steps: external_exports.strictObject(accountSteps)
+}).refine(
+  (value) => !value.steps.created || value.address !== void 0,
+  "Created accounts require an address."
+);
+var memberSchema = external_exports.strictObject({
+  account: walletNameSchema,
+  address: addressSchema2.optional(),
+  role: external_exports.string().regex(SWARM_ROLE_PATTERN),
+  weight: external_exports.number().int().positive(),
+  targetAtomic: atomicSchema,
+  ceilingAtomic: atomicSchema.nullable(),
+  steps: external_exports.strictObject({ ...accountSteps, profiled: external_exports.boolean() })
+}).refine(
+  (value) => !value.steps.created || value.address !== void 0,
+  "Created accounts require an address."
+);
+var swarmFileSchema = external_exports.strictObject({
+  v: external_exports.literal(1),
+  name: external_exports.string().regex(SWARM_NAME_PATTERN),
+  device: external_exports.string().regex(DEVICE_NAME_PATTERN),
+  network: external_exports.enum([BASE_MAINNET_CAIP2, ARC_MAINNET_CAIP2]),
+  createdAt: external_exports.iso.datetime(),
+  treasury: treasurySchema,
+  members: external_exports.array(memberSchema),
+  setupFunding: setupFundingSchema.optional(),
+  policy: external_exports.strictObject({
+    strategy: external_exports.enum(["targets", "even", "weights"]),
+    treasuryCaps: capsSchema
+  })
+}).refine(
+  (value) => (/* @__PURE__ */ new Set([value.treasury.account, ...value.members.map((member) => member.account)])).size === value.members.length + 1,
+  "Swarm accounts must be unique."
+);
+var SwarmError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "SwarmError";
+  }
+  code;
+};
+function swarmsDirectory(home) {
+  return join6(home, "swarms");
+}
+function swarmFilePath(home, name) {
+  assertName(name);
+  return join6(swarmsDirectory(home), `${name}.json`);
+}
+async function readSwarm(home, name) {
+  const path = swarmFilePath(home, name);
+  try {
+    const swarm = parseSwarm(JSON.parse(await readFile10(path, "utf8")));
+    if (swarm.name !== name)
+      throw new SwarmError("invalid_swarm", "Swarm name does not match its file.");
+    return swarm;
+  } catch (error61) {
+    if (isMissingFile(error61)) throw new SwarmError("swarm_not_found", `No swarm named ${name}.`);
+    if (error61 instanceof SwarmError) throw error61;
+    throw new SwarmError("invalid_swarm", `Invalid swarm file for ${name}.`);
+  }
+}
+async function listSwarms(home) {
+  let files;
+  try {
+    files = await readdir4(swarmsDirectory(home));
+  } catch (error61) {
+    if (isMissingFile(error61)) return [];
+    throw error61;
+  }
+  return await Promise.all(
+    files.filter((file2) => file2.endsWith(".json")).sort().map((file2) => readSwarm(home, file2.slice(0, -5)))
+  );
+}
+function swarmParentResolver(home) {
+  return async (account) => {
+    const swarms = await listSwarms(home);
+    const matches = swarms.filter(
+      (swarm) => swarm.members.some((member) => member.account === account)
+    );
+    if (matches.length > 1)
+      throw new SwarmError(
+        "account_in_other_swarm",
+        `Account ${account} belongs to multiple swarms.`
+      );
+    const treasury = matches[0]?.treasury;
+    if (treasury === void 0) return void 0;
+    if (treasury.address === void 0)
+      throw new SwarmError("invalid_swarm", "The swarm treasury is not created yet.");
+    return { account: treasury.account, address: treasury.address };
+  };
+}
+function parseSwarm(value) {
+  const result = swarmFileSchema.safeParse(value);
+  if (!result.success) throw new SwarmError("invalid_swarm", "Invalid swarm state.");
+  return result.data;
+}
+function assertName(name) {
+  if (!SWARM_NAME_PATTERN.test(name))
+    throw new SwarmError(
+      "invalid_swarm",
+      "A swarm name must be 1 to 16 lowercase letters, digits or dashes, starting with a letter."
+    );
+}
+
 // src/x402-pay.ts
-import { randomUUID as randomUUID2 } from "node:crypto";
+import { randomBytes as randomBytes8, randomUUID as randomUUID2 } from "node:crypto";
+
+// src/run-budget.ts
+var RunBudgetError = class extends Error {
+  name = "RunBudgetError";
+  code = "run_budget_exceeded";
+};
 
 // src/support-report.ts
-var VAPI_CLIENT_VERSION = "0.7.0";
+var VAPI_CLIENT_VERSION = "0.9.0";
 
 // src/x402-pay.ts
 var X402PaymentError = class extends Error {
@@ -44926,6 +46516,7 @@ var X402PaymentError = class extends Error {
 };
 async function payRequest(args) {
   const startedAt = args.now ?? /* @__PURE__ */ new Date();
+  assertAllowanceCurrent(startedAt, args.allowanceExpiresAt);
   const nowMs = args.nowMs ?? (() => performance.now());
   const startedMs = nowMs();
   const receiptId = randomUUID2();
@@ -44965,8 +46556,10 @@ async function payRequest(args) {
         ...args.preferNetworks === void 0 ? {} : { preferNetworks: args.preferNetworks },
         ...args.paymentId === void 0 ? {} : { paymentId: args.paymentId },
         now: startedAt,
+        ...args.allowanceExpiresAt === void 0 ? {} : { allowanceExpiresAt: args.allowanceExpiresAt },
         nowMs,
         trace,
+        ...args.runBudget === void 0 ? {} : { runBudget: args.runBudget },
         ...args.ceilingSweep === void 0 ? {} : { ceilingSweep: args.ceilingSweep }
       });
       response = completed.response;
@@ -45000,6 +46593,8 @@ async function payRequest(args) {
   return { response, receipt };
 }
 async function completeX402Payment(args) {
+  const paymentTime = args.now ?? /* @__PURE__ */ new Date();
+  assertAllowanceCurrent(paymentTime, args.allowanceExpiresAt);
   const nowMs = args.nowMs ?? (() => performance.now());
   const trace = args.trace;
   const quoteStarted = args.quoteStartedMs ?? nowMs();
@@ -45022,11 +46617,29 @@ async function completeX402Payment(args) {
   if (trace) trace.capsApplied = true;
   assertMaximumAtomic(quote.amountAtomic, args.maxAtomic);
   assertMaxPrice(quote.amountAtomic, args.maxPriceUsd);
-  await reserveSpend(quote.amountAtomic, args.caps, {
+  const spendReservation = {
     ledgerPath: args.ledgerPath ?? getVapiPaths().ledger,
     now: args.now,
     ...args.wallet === void 0 ? {} : { wallet: args.wallet }
-  });
+  };
+  let reservationId;
+  let reservedOn;
+  if (args.runBudget === void 0) {
+    await reserveSpend(quote.amountAtomic, args.caps, spendReservation);
+  } else {
+    reservationId = args.paymentId ?? `x402_${randomBytes8(12).toString("hex")}`;
+    const reservation = await reserveSpend(quote.amountAtomic, args.caps, {
+      ...spendReservation,
+      reservationId
+    });
+    reservedOn = reservation.date;
+    try {
+      args.runBudget.reserve(quote.amountAtomic, reservationId);
+    } catch (error61) {
+      await releaseUnsentReservation(args, quote.amountAtomic, reservationId, reservedOn);
+      throw error61;
+    }
+  }
   const signStarted = nowMs();
   let payment;
   try {
@@ -45037,6 +46650,7 @@ async function completeX402Payment(args) {
         allowPrivateNetwork: args.config.allowPrivateNetwork ?? false
       }),
       ...args.now === void 0 ? {} : { nowSeconds: Math.floor(args.now.getTime() / 1e3) },
+      ...args.allowanceExpiresAt === void 0 ? {} : { maximumValidBeforeSeconds: Math.floor(args.allowanceExpiresAt.getTime() / 1e3) },
       ...args.paymentId === void 0 ? {} : { paymentId: args.paymentId }
     });
     const payer2 = isSvmPaymentRequirements(quote.accepted) ? args.account.solana?.address ?? args.account.address : args.account.address;
@@ -45048,6 +46662,17 @@ async function completeX402Payment(args) {
         trace.authorization = { from: from15, nonce, validBefore };
       }
     }
+  } catch (error61) {
+    if (args.runBudget !== void 0 && reservationId !== void 0 && reservedOn !== void 0) {
+      const released = await releaseUnsentReservation(
+        args,
+        quote.amountAtomic,
+        reservationId,
+        reservedOn
+      );
+      if (released) args.runBudget.release(reservationId);
+    }
+    throw error61;
   } finally {
     if (trace) trace.phases.signMs = elapsed(nowMs, signStarted);
   }
@@ -45182,6 +46807,26 @@ async function completeX402Payment(args) {
     paidAttempt.finish();
   }
 }
+function assertAllowanceCurrent(now, expiresAt) {
+  if (expiresAt === void 0 || now.getTime() < expiresAt.getTime()) return;
+  throw new Error(
+    `Remote allowance expired at ${expiresAt.toISOString()}. Start a new Railway run before paying.`
+  );
+}
+async function releaseUnsentReservation(args, amountAtomic, reservationId, reservedOn) {
+  try {
+    await releaseSpend(amountAtomic, {
+      reservedOn,
+      ledgerPath: args.ledgerPath ?? getVapiPaths().ledger,
+      now: args.now,
+      ...args.wallet === void 0 ? {} : { wallet: args.wallet },
+      reservationId
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function selectQuote(args) {
   const networks = toX402Networks(args.config.networks);
   const waitFor = args.challenge.waitFor.bind(args.challenge);
@@ -45276,6 +46921,9 @@ function sanitizeThrownError(error61, secrets) {
   if (error61 instanceof SpendCapError) {
     return new SpendCapError(error61.code, message);
   }
+  if (error61 instanceof RunBudgetError) {
+    return new RunBudgetError(message);
+  }
   if (error61 instanceof X402PaymentError) {
     return new X402PaymentError(error61.code, message, error61.possibleSettlement, {
       ...cause === void 0 ? {} : { cause },
@@ -45365,6 +47013,7 @@ function directReceipt(args, request, trace, receiptId, startedAt, latencyMs, re
     resourceUrl: request.url,
     method: request.method,
     source: args.source ?? "direct",
+    ...args.run === void 0 ? {} : { run: args.run },
     ...trace.quote ? { quote: trace.quote } : {},
     ...trace.payer && result.outcome !== "declined_policy" ? { payer: trace.payer } : {},
     ...trace.paymentId ? { paymentId: trace.paymentId } : {},
@@ -45392,7 +47041,7 @@ function receiptQuote(quote) {
   };
 }
 function paymentErrorOutcome(error61) {
-  if (error61 instanceof SpendCapError || error61 instanceof X402Error && error61.code === "max_price_exceeded") {
+  if (error61 instanceof SpendCapError || error61 instanceof RunBudgetError || error61 instanceof X402Error && error61.code === "max_price_exceeded") {
     return "declined_policy";
   }
   if (error61 instanceof X402PaymentError) {
@@ -45409,7 +47058,7 @@ function errorCode(error61) {
   return "request_failed";
 }
 function receiptSafeErrorMessage(error61) {
-  if (error61 instanceof SpendCapError || error61 instanceof X402Error || error61 instanceof X402PaymentError) {
+  if (error61 instanceof SpendCapError || error61 instanceof RunBudgetError || error61 instanceof X402Error || error61 instanceof X402PaymentError) {
     return error61.message;
   }
   return "The x402 request failed before it completed.";
@@ -45545,9 +47194,9 @@ async function buyRouterBalance(deps, tierUsd) {
   if (!isRouterTopupTier(tierUsd)) {
     throw new RouterClientError("http", "Router balance must use a $1, $5, $20, or $50 tier.");
   }
-  const { link, accessToken } = await purchaseCredentialSnapshot(deps);
+  const { link: link2, accessToken } = await purchaseCredentialSnapshot(deps);
   const { response, receipt } = await payRequest({
-    url: `${trimTrailingSlashes(link.apiBase)}/api/router/top-up/${tierUsd}`,
+    url: `${trimTrailingSlashes(link2.apiBase)}/api/router/top-up/${tierUsd}`,
     init: {
       method: "POST",
       headers: { authorization: `Bearer ${accessToken}`, accept: "application/json" }
@@ -45561,6 +47210,9 @@ async function buyRouterBalance(deps, tierUsd) {
     maxAtomic: BigInt(tierUsd) * 1000000n,
     preferNetworks: ["eip155:8453"],
     ...deps.now === void 0 ? {} : { now: deps.now },
+    ...deps.allowanceExpiresAt === void 0 ? {} : { allowanceExpiresAt: deps.allowanceExpiresAt },
+    ...deps.runBudget === void 0 ? {} : { runBudget: deps.runBudget },
+    ...deps.run === void 0 ? {} : { run: deps.run },
     source: "router.topup",
     ceilingSweep: {
       account: deps.wallet,
@@ -45568,10 +47220,11 @@ async function buyRouterBalance(deps, tierUsd) {
       run: async (signal) => await sweepAboveCeiling({
         store: deps.wallets,
         secrets: deps.secrets,
-        apiBase: link.apiBase,
+        apiBase: link2.apiBase,
         account: deps.wallet,
         config: deps.config,
         signal,
+        resolveParent: swarmParentResolver(deps.wallets.home),
         ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl },
         unlock: async () => deps.account
       })
@@ -45590,14 +47243,14 @@ async function buyRouterBalance(deps, tierUsd) {
     {
       event: "router.buy",
       wallet: deps.wallet,
-      owner: link.owner,
+      owner: link2.owner,
       tty: Boolean(process.stderr.isTTY),
       detail: `$${tierUsd} on ${receipt.quote?.network ?? "eip155:8453"}`
     },
     deps.now === void 0 ? {} : { now: () => deps.now }
   );
   try {
-    await ensureBalanceRouterKey(deps, link);
+    await ensureBalanceRouterKey(deps, link2);
   } catch {
     throw new RouterClientError(
       "http",
@@ -45636,7 +47289,12 @@ async function routerChat(deps, request) {
             config: deps.refill.config,
             caps,
             ...deps.refill.paths === void 0 ? {} : { paths: deps.refill.paths },
-            ...deps.refill.now === void 0 ? {} : { now: deps.refill.now }
+            ...deps.refill.now === void 0 ? {} : {
+              now: typeof deps.refill.now === "function" ? deps.refill.now() : deps.refill.now
+            },
+            ...deps.refill.allowanceExpiresAt === void 0 ? {} : { allowanceExpiresAt: deps.refill.allowanceExpiresAt },
+            ...deps.refill.runBudget === void 0 ? {} : { runBudget: deps.refill.runBudget },
+            ...deps.refill.run === void 0 ? {} : { run: deps.refill.run }
           },
           refill.tierUsd
         )).balance;
@@ -45648,6 +47306,7 @@ async function routerChat(deps, request) {
           tty: Boolean(process.stderr.isTTY),
           detail: refillDeclinedDetail(refillError)
         });
+        if (isRunBudgetError(refillError)) throw refillError;
       }
     }
     const mayHaveBalance = usage === void 0 || (balance?.remainingUsd ?? 0) > 0;
@@ -45755,8 +47414,8 @@ async function ensureBalanceRouterKey(deps, paidLink) {
     deps.wallets,
     `${paidLink.clientId}:router-balance-key`,
     async () => {
-      const link = await linkedWallet(deps);
-      if (!sameAgentLink(link, paidLink)) {
+      const link2 = await linkedWallet(deps);
+      if (!sameAgentLink(link2, paidLink)) {
         throw new RouterClientError(
           "http",
           "The agent link changed while fetching the Router balance key."
@@ -45775,7 +47434,7 @@ async function ensureBalanceRouterKey(deps, paidLink) {
         "/api/agents/self/router-balance-key",
         { method: "POST" },
         "The Router balance key request failed after payment.",
-        link
+        link2
       );
       if (!response.ok) {
         throw new RouterClientError(
@@ -45796,7 +47455,7 @@ async function ensureBalanceRouterKey(deps, paidLink) {
         );
       }
       const returnedBase = validRouterBaseUrl(parsed.data.router_base_url);
-      const expectedBase = validRouterBaseUrl(link.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL);
+      const expectedBase = validRouterBaseUrl(link2.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL);
       if (returnedBase !== expectedBase) {
         throw new RouterClientError(
           "http",
@@ -45815,8 +47474,8 @@ async function routerBalanceCredentialSnapshot(deps) {
   const observedLink = await linkedWallet(deps);
   try {
     return await withAgentCredentialLock(deps.wallets, observedLink.clientId, async () => {
-      const link = await linkedWallet(deps);
-      if (link.clientId !== observedLink.clientId) {
+      const link2 = await linkedWallet(deps);
+      if (link2.clientId !== observedLink.clientId) {
         throw new RouterClientError(
           "http",
           "The agent link changed while reading Router balance credentials."
@@ -45831,8 +47490,8 @@ async function routerBalanceCredentialSnapshot(deps) {
       }
       if (routerKey === void 0 || routerKey.length === 0) return void 0;
       return {
-        clientId: link.clientId,
-        routerBaseUrl: validRouterBaseUrl(link.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL),
+        clientId: link2.clientId,
+        routerBaseUrl: validRouterBaseUrl(link2.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL),
         routerKey
       };
     });
@@ -45847,8 +47506,8 @@ async function routerBalanceCredentialSnapshot(deps) {
 async function removeRejectedBalanceKey(deps, rejected) {
   if (!deps.secrets.available) return;
   await withAgentCredentialLock(deps.wallets, rejected.clientId, async () => {
-    const link = await linkedWallet(deps);
-    if (link.clientId !== rejected.clientId) return;
+    const link2 = await linkedWallet(deps);
+    if (link2.clientId !== rejected.clientId) return;
     const account = agentSecretAccounts(deps.wallet).routerBalance;
     if (await deps.secrets.get(account) === rejected.routerKey) {
       await deps.secrets.remove(account);
@@ -45897,16 +47556,20 @@ function budgetExhaustedError(resetsAt, status) {
 }
 function refillDeclinedDetail(error61) {
   if (error61 instanceof SpendCapError) return `${error61.name}: ${error61.code}`;
+  if (isRunBudgetError(error61)) return `RunBudgetError: ${error61.code}`;
   if (error61 instanceof RouterClientError) {
     return `${error61.name}: ${error61.code}${error61.status === void 0 ? "" : ` (${error61.status})`}`;
   }
   return "Error: Router balance refill failed.";
 }
+function isRunBudgetError(error61) {
+  return typeof error61 === "object" && error61 !== null && Reflect.get(error61, "code") === "run_budget_exceeded";
+}
 function isRouterTopupTier(value) {
   return ROUTER_TOPUP_TIERS.some((tier) => tier === value);
 }
 async function rotateRouterKey(deps) {
-  const link = await linkedWallet(deps);
+  const link2 = await linkedWallet(deps);
   if (!deps.secrets.available) {
     throw new Error(
       "No OS secret store is available on this machine, so the Router key cannot be stored safely."
@@ -45917,7 +47580,7 @@ async function rotateRouterKey(deps) {
     "/api/agents/self/router-key",
     { method: "POST" },
     "The vAPI Router key rotation request failed.",
-    link
+    link2
   );
   if (!response.ok) {
     throw new RouterClientError(
@@ -45932,9 +47595,9 @@ async function rotateRouterKey(deps) {
   }
   validRouterBaseUrl(parsed.data.router_base_url);
   try {
-    await withAgentCredentialLock(deps.wallets, link.clientId, async () => {
+    await withAgentCredentialLock(deps.wallets, link2.clientId, async () => {
       const currentLink = await linkedWallet(deps);
-      if (!sameAgentLink(currentLink, link)) {
+      if (!sameAgentLink(currentLink, link2)) {
         throw new RouterClientError("http", "The agent link changed during Router key rotation.");
       }
       const account = agentSecretAccounts(deps.wallet).routerStake;
@@ -45998,15 +47661,15 @@ async function routerCredentialSnapshot(deps) {
   const observedLink = await linkedWallet(deps);
   try {
     return await withAgentCredentialLock(deps.wallets, observedLink.clientId, async () => {
-      const link = await linkedWallet(deps);
-      if (link.clientId !== observedLink.clientId) {
+      const link2 = await linkedWallet(deps);
+      if (link2.clientId !== observedLink.clientId) {
         throw new RouterClientError(
           "http",
           "The agent link changed while reading Router credentials."
         );
       }
       return {
-        routerBaseUrl: validRouterBaseUrl(link.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL),
+        routerBaseUrl: validRouterBaseUrl(link2.routerBaseUrl ?? DEFAULT_ROUTER_BASE_URL),
         routerKey: await storedRouterKey(deps)
       };
     });
@@ -46027,9 +47690,9 @@ async function linkedWallet(deps) {
   } catch {
     throw new RouterClientError("http", "The wallet link could not be read.");
   }
-  const link = deps.wallets.entry(deps.wallet)?.link;
-  if (link === void 0) throw notLinkedError2();
-  return link;
+  const link2 = deps.wallets.entry(deps.wallet)?.link;
+  if (link2 === void 0) throw notLinkedError2();
+  return link2;
 }
 async function storedRouterKey(deps) {
   if (!deps.secrets.available) throw noRouterKeyError();
@@ -46046,7 +47709,7 @@ function sameAgentLink(left, right) {
   return left.apiBase === right.apiBase && left.clientId === right.clientId && left.owner === right.owner && left.label === right.label && left.linkedAt === right.linkedAt && left.routerBaseUrl === right.routerBaseUrl && left.scopes.length === right.scopes.length && left.scopes.every((scope, index2) => scope === right.scopes[index2]);
 }
 async function consoleRequest(deps, path, init, failureMessage, knownLink) {
-  const link = knownLink ?? await linkedWallet(deps);
+  const link2 = knownLink ?? await linkedWallet(deps);
   try {
     return await agentFetch(
       {
@@ -46055,7 +47718,7 @@ async function consoleRequest(deps, path, init, failureMessage, knownLink) {
         wallet: deps.wallet,
         ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl }
       },
-      `${trimTrailingSlashes(link.apiBase)}${path}`,
+      `${trimTrailingSlashes(link2.apiBase)}${path}`,
       init
     );
   } catch (error61) {
@@ -46066,7 +47729,7 @@ async function consoleRequest(deps, path, init, failureMessage, knownLink) {
   }
 }
 async function verifyAgentLink(deps) {
-  const link = await linkedWallet(deps);
+  const link2 = await linkedWallet(deps);
   try {
     await agentFetch(
       {
@@ -46075,7 +47738,7 @@ async function verifyAgentLink(deps) {
         wallet: deps.wallet,
         ...deps.fetchImpl === void 0 ? {} : { fetchImpl: deps.fetchImpl }
       },
-      `${trimTrailingSlashes(link.apiBase)}/api/agents/self/router`,
+      `${trimTrailingSlashes(link2.apiBase)}/api/agents/self/router`,
       { method: "GET" }
     );
   } catch (error61) {