@vapi-network/core 0.8.0 → 0.9.0

package/dist/index.js

@@ -39074,7 +39074,9 @@ function http(url2, config2 = {}) {
 // ../../node_modules/.pnpm/viem@2.56.1_typescript@6.0.3_zod@4.5.4/node_modules/viem/_esm/index.js
 init_getAddress();
 init_isAddress();
+init_toBytes();
 init_toHex();
+init_keccak256();
 
 // src/x402-networks.ts
 var BASE_MAINNET_CAIP2 = "eip155:8453";
@@ -46438,6 +46440,8 @@ var DEFAULT_SPEND_CAPS = {
   perCallAtomic: "100000",
   perDayAtomic: "1000000"
 };
+var DEFAULT_MAX_PER_TASK_USD = 100;
+var DEFAULT_AUTO_RELEASE_BELOW_USD = 25;
 var DEFAULT_CEILING_ATOMIC = 5000000n;
 var atomicString = external_exports.string().regex(/^\d+$/, "Expected non-negative atomic units.");
 var spendCapsSchema = external_exports.object({
@@ -46454,6 +46458,14 @@ var configSchema = external_exports.object({
     })
   ).optional(),
   allowPrivateNetwork: external_exports.boolean().default(false).optional(),
+  tasksEscrowDurationOverrides: external_exports.record(
+    external_exports.string().regex(/^\d+$/),
+    external_exports.object({
+      workDurationSeconds: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+      reviewWindowSeconds: external_exports.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional()
+    }).strict()
+  ).optional(),
+  tasksEscrowFactoryOverrides: external_exports.record(external_exports.string().regex(/^\d+$/), external_exports.string()).optional(),
   networks: external_exports.record(
     external_exports.string().refine((network) => isSupportedPaymentNetwork(network), {
       message: "Expected a supported eip155:<chainId> or Solana network identifier."
@@ -46472,6 +46484,17 @@ var configSchema = external_exports.object({
   spendCaps: spendCapsSchema,
   device: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,31}$/).optional()
 }).superRefine((config2, context) => {
+  for (const [chainId, factory] of Object.entries(config2.tasksEscrowFactoryOverrides ?? {})) {
+    try {
+      getAddress(factory);
+    } catch {
+      context.addIssue({
+        code: "custom",
+        path: ["tasksEscrowFactoryOverrides", chainId],
+        message: "Expected a valid EVM escrow factory address."
+      });
+    }
+  }
   for (const [network, configured] of Object.entries(config2.networks)) {
     if (isSolanaNetwork(network)) {
       if (configured.usdc !== NETWORKS[SOLANA_MAINNET_CAIP2].usdc) {
@@ -46634,6 +46657,7 @@ function getDefaultConfig(source = process.env, options = {}) {
   const registry2 = registryEndpoints(source.VAPI_REGISTRY_URL?.trim() || DEFAULT_REGISTRY_URL);
   const requested = new Set(options.networks ?? ["base"]);
   const networks = {};
+  const tasksEscrowFactoryOverrides = tasksFactoryOverridesFromEnv(source);
   if (requested.has("base") || requested.has(BASE_MAINNET_CAIP2)) {
     networks[BASE_MAINNET_CAIP2] = {
       rpcUrl: source.BASE_RPC_URL?.trim() || NETWORKS[BASE_MAINNET_CAIP2].publicRpcUrl,
@@ -46671,6 +46695,8 @@ function getDefaultConfig(source = process.env, options = {}) {
     marketplaceDiscoveryUrl: source.VAPI_MARKETPLACE_DISCOVERY_URL?.trim() || registry2.marketplaceDiscoveryUrl,
     registryFallbacks: DEFAULT_REGISTRY_FALLBACKS.map((fallback) => ({ ...fallback })),
     allowPrivateNetwork: false,
+    tasksEscrowFactoryOverrides,
+    tasksEscrowDurationOverrides: tasksDurationOverridesFromEnv(source),
     networks,
     spendCaps: { ...DEFAULT_SPEND_CAPS }
   };
@@ -46688,8 +46714,10 @@ async function loadConfig(path = getVapiPaths().config, source = process.env, op
   }
   const parsed = configSchema.parse(JSON.parse(raw));
   parsed.registryFallbacks ??= DEFAULT_REGISTRY_FALLBACKS.map((fallback) => ({ ...fallback }));
+  parsed.tasksEscrowFactoryOverrides ??= {};
   const migrated = rewriteLegacyRegistryUrls(parsed);
   const config2 = migrated.config;
+  config2.tasksEscrowFactoryOverrides ??= {};
   if (migrated.changes.length > 0 && options.notice) {
     options.notice(
       `${formatLegacyRegistryRewrites(migrated.changes)}
@@ -46703,6 +46731,14 @@ Run vapi init to write the new URLs to ${path}.`
   const discoveryUrl = source.VAPI_DISCOVERY_URL?.trim();
   const marketplaceDiscoveryUrl = source.VAPI_MARKETPLACE_DISCOVERY_URL?.trim();
   const registryUrl = source.VAPI_REGISTRY_URL?.trim();
+  Object.assign(config2.tasksEscrowFactoryOverrides, tasksFactoryOverridesFromEnv(source));
+  config2.tasksEscrowDurationOverrides ??= {};
+  for (const [chainId, overrides] of Object.entries(tasksDurationOverridesFromEnv(source))) {
+    config2.tasksEscrowDurationOverrides[chainId] = {
+      ...config2.tasksEscrowDurationOverrides[chainId],
+      ...overrides
+    };
+  }
   if (config2.networks[BASE_MAINNET_CAIP2] && baseRpcUrl) {
     config2.networks[BASE_MAINNET_CAIP2].rpcUrl = baseRpcUrl;
   }
@@ -46743,6 +46779,31 @@ Run vapi init to write the new URLs to ${path}.`
   }
   return config2;
 }
+function tasksDurationOverridesFromEnv(source) {
+  const result = {};
+  for (const [name, raw] of Object.entries(source)) {
+    const match = /^VAPI_TASKS_(WORK_DURATION|REVIEW_WINDOW)_SECONDS_(\d+)$/.exec(name);
+    const value = raw?.trim();
+    if (!match || !value) continue;
+    const seconds = Number(value);
+    if (!/^\d+$/.test(value) || !Number.isSafeInteger(seconds) || seconds <= 0)
+      throw new Error(`Invalid trusted Tasks duration ${name}.`);
+    const entry = result[match[2]] ??= {};
+    if (match[1] === "WORK_DURATION") entry.workDurationSeconds = seconds;
+    else entry.reviewWindowSeconds = seconds;
+  }
+  return result;
+}
+function tasksFactoryOverridesFromEnv(source) {
+  const overrides = {};
+  for (const [name, raw] of Object.entries(source)) {
+    const match = /^VAPI_TASKS_ESCROW_FACTORY_(\d+)$/.exec(name);
+    const value = raw?.trim();
+    if (!match || !value) continue;
+    overrides[match[1]] = getAddress(value);
+  }
+  return overrides;
+}
 function registryEndpoints(baseUrl) {
   const base = new URL(baseUrl);
   base.search = "";
@@ -46999,7 +47060,12 @@ var AgentLinkError = class extends Error {
   code;
 };
 var DEFAULT_AGENT_SCOPES = ["mcp:call", "router.use"];
-var ALLOWED_AGENT_SCOPES = /* @__PURE__ */ new Set([...DEFAULT_AGENT_SCOPES, "call.publish"]);
+var ALLOWED_AGENT_SCOPES = /* @__PURE__ */ new Set([
+  ...DEFAULT_AGENT_SCOPES,
+  "call.publish",
+  "tasks:read",
+  "tasks:write"
+]);
 var publicFetch = createPublicFetch({ allowPrivateNetwork: false });
 async function startDeviceLink(args) {
   if (args.device !== void 0 && !DEVICE_NAME_PATTERN.test(args.device)) {
@@ -72953,6 +73019,8 @@ var agentProfileShape = {
   instructions: external_exports.string().max(2e4),
   verifiedOnly: external_exports.boolean().default(true),
   approveAboveUsd: external_exports.number().min(0).default(0.5),
+  maxPerTaskUsd: external_exports.number().min(0).default(DEFAULT_MAX_PER_TASK_USD),
+  autoReleaseBelowUsd: external_exports.number().min(0).default(DEFAULT_AUTO_RELEASE_BELOW_USD),
   maxSteps: external_exports.number().int().min(1).max(50).default(12),
   paused: external_exports.boolean().default(false),
   grants: external_exports.array(external_exports.enum(AGENT_GRANTS)).default([]),
@@ -73113,7 +73181,9 @@ var ledgerSchema = external_exports.object({
 });
 var spendReservationSchema = external_exports.object({
   id: external_exports.string().min(1),
-  amountAtomic: external_exports.string().regex(/^\d+$/)
+  amountAtomic: external_exports.string().regex(/^\d+$/),
+  kind: external_exports.enum(["payment", "escrow-funding", "dispute-fee"]).optional(),
+  taskKey: external_exports.string().optional()
 });
 var ledgerRowSchema = ledgerSchema.extend({
   wallet: walletNameSchema.optional(),
@@ -73139,6 +73209,29 @@ async function readSpendLedger(path = getAgentCashPaths().ledger, now = /* @__PU
   const row = rows.find((candidate) => candidate.wallet === wallet);
   return { date: utcDateKey(now), spentAtomic: row?.spentAtomic ?? "0" };
 }
+async function escrowFundingDayRemainingAtomic(input2) {
+  const perDayAtomic = parseAtomicCap(input2.caps.perDayAtomic, "per-day");
+  const rows = await readStoredSpendLedgerRows(input2.ledgerPath, input2.now);
+  const row = rows.find((candidate) => candidate.wallet === input2.wallet);
+  const reserved = input2.reservationId ? row?.reservations?.find((candidate) => candidate.id === input2.reservationId) : void 0;
+  const remaining = perDayAtomic - BigInt(row?.spentAtomic ?? "0") + BigInt(reserved?.amountAtomic ?? "0");
+  return remaining > 0n ? remaining : 0n;
+}
+async function taskReservedAtomic(input2) {
+  const rows = await readStoredSpendLedgerRows(input2.ledgerPath, input2.now, true);
+  return sumTaskReservations(rows, input2.wallet, input2.taskKey, input2.excludeReservationId);
+}
+function sumTaskReservations(rows, wallet, taskKey, excludeReservationId) {
+  let total = 0n;
+  for (const row of rows) {
+    if (row.wallet !== wallet) continue;
+    for (const reservation of row.reservations ?? []) {
+      if (reservation.taskKey === taskKey && reservation.id !== excludeReservationId)
+        total += BigInt(reservation.amountAtomic);
+    }
+  }
+  return total;
+}
 async function readSpendLedgerRows(path = getAgentCashPaths().ledger, now = /* @__PURE__ */ new Date()) {
   return (await readStoredSpendLedgerRows(path, now)).map(({ date: date5, spentAtomic, wallet }) => ({
     date: date5,
@@ -73146,7 +73239,7 @@ async function readSpendLedgerRows(path = getAgentCashPaths().ledger, now = /* @
     wallet
   }));
 }
-async function readStoredSpendLedgerRows(path, now) {
+async function readStoredSpendLedgerRows(path, now, allDays = false) {
   let raw;
   try {
     raw = await readFile13(path, "utf8");
@@ -73157,7 +73250,7 @@ async function readStoredSpendLedgerRows(path, now) {
   const parsed = ledgerFileSchema.parse(JSON.parse(raw));
   const rows = "rows" in parsed ? parsed.rows : [parsed];
   const today = utcDateKey(now);
-  return rows.filter((row) => row.date === today).map((row) => ({
+  return rows.filter((row) => allDays || row.date === today).map((row) => ({
     date: row.date,
     spentAtomic: row.spentAtomic,
     wallet: row.wallet ?? DEFAULT_WALLET_NAME,
@@ -73168,49 +73261,164 @@ async function reserveSpend(amountAtomic, caps, options) {
   if (amountAtomic < 0n) {
     throw new Error("Spend amount cannot be negative.");
   }
-  const perCallAtomic = parseAtomicCap(caps.perCallAtomic, "per-call");
-  const perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
-  if (amountAtomic > perCallAtomic) {
-    throw new SpendCapError(
-      "per_call_cap_exceeded",
-      `Payment quote ${amountAtomic} atomic USDC exceeds the per-call cap ${perCallAtomic}. Refusing to sign.`
-    );
+  const kind = options?.kind ?? "payment";
+  let perDayAtomic;
+  if (kind === "escrow-funding" || kind === "dispute-fee") {
+    const maxPerTaskAtomic = options?.maxPerTaskAtomic;
+    if (maxPerTaskAtomic === void 0 || maxPerTaskAtomic < 0n) {
+      throw new Error("Escrow funding requires a non-negative per-task cap.");
+    }
+    if (amountAtomic > maxPerTaskAtomic) {
+      throw new SpendCapError(
+        "per_task_cap_exceeded",
+        `Escrow funding ${amountAtomic} atomic USDC exceeds the per-task cap ${maxPerTaskAtomic}. Refusing to sign.`
+      );
+    }
+    perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
+  } else {
+    const perCallAtomic = parseAtomicCap(caps.perCallAtomic, "per-call");
+    perDayAtomic = parseAtomicCap(caps.perDayAtomic, "per-day");
+    if (amountAtomic > perCallAtomic) {
+      throw new SpendCapError(
+        "per_call_cap_exceeded",
+        `Payment quote ${amountAtomic} atomic USDC exceeds the per-call cap ${perCallAtomic}. Refusing to sign.`
+      );
+    }
   }
   const ledgerPath = options?.ledgerPath ?? getAgentCashPaths().ledger;
   const now = options?.now ?? /* @__PURE__ */ new Date();
   const wallet = options?.wallet ?? DEFAULT_WALLET_NAME;
   return await withLedgerLock(ledgerPath, async () => {
-    const rows = await readStoredSpendLedgerRows(ledgerPath, now);
-    const current = rows.find((row) => row.wallet === wallet);
+    const rows = await readStoredSpendLedgerRows(ledgerPath, now, true);
+    const today = utcDateKey(now);
+    const current = rows.find((row) => row.wallet === wallet && row.date === today);
+    if ((kind === "escrow-funding" || kind === "dispute-fee") && options?.taskKey !== void 0) {
+      const taskTotal = sumTaskReservations(
+        rows,
+        wallet,
+        options.taskKey,
+        options.reuseExistingEscrowReservation || options.resumeEscrowReservation ? options.reservationId : void 0
+      ) + amountAtomic;
+      if (taskTotal > options.maxPerTaskAtomic)
+        throw new SpendCapError(
+          "per_task_cap_exceeded",
+          `New spend ${amountAtomic} atomic USDC would raise the running total for task ${options.taskKey} and wallet ${wallet} to ${taskTotal}, above the per-task cap ${options.maxPerTaskAtomic}. Refusing to sign.`
+        );
+    }
     if (options?.reservationId !== void 0) {
-      if (current?.reservations?.some((reservation) => reservation.id === options.reservationId)) {
+      const existing = current?.reservations?.find(
+        (reservation) => reservation.id === options.reservationId
+      );
+      if (existing && options.reuseExistingEscrowReservation) {
+        if (kind !== "escrow-funding" && kind !== "dispute-fee" || existing.kind !== kind || existing.amountAtomic !== amountAtomic.toString() || existing.taskKey !== void 0 && existing.taskKey !== options.taskKey)
+          throw new Error(
+            `Spend reservation ${options.reservationId} does not match this funding.`
+          );
+        if (existing.taskKey === void 0 && options.taskKey !== void 0) {
+          existing.taskKey = options.taskKey;
+          await writeLedgerAtomically(ledgerPath, rows);
+        }
+        return {
+          date: current.date,
+          spentAtomic: current.spentAtomic,
+          reservationReused: true
+        };
+      }
+      if (existing) {
         throw new Error(`Spend reservation ${options.reservationId} already exists.`);
       }
+      if (options.resumeEscrowReservation) {
+        const resumed = options.resumeEscrowReservation;
+        const historical = rows.find((row) => row.wallet === wallet && row.date === resumed.date);
+        const stored = historical?.reservations?.find(
+          (reservation) => reservation.id === resumed.id
+        );
+        if (kind !== "escrow-funding" && kind !== "dispute-fee" || resumed.id !== options.reservationId || resumed.wallet !== wallet || resumed.amountAtomic !== amountAtomic.toString() || resumed.date >= utcDateKey(now) || resumed.exposed !== true || resumed.invalidated === true || stored !== void 0 && (stored.kind !== kind || stored.amountAtomic !== amountAtomic.toString() || stored.taskKey !== void 0 && stored.taskKey !== options.taskKey))
+          throw new Error(
+            `Spend reservation ${options.reservationId} does not match this funding.`
+          );
+        if (stored?.taskKey === void 0 && options.taskKey !== void 0) {
+          if (stored) stored.taskKey = options.taskKey;
+          else {
+            const reservation = {
+              id: resumed.id,
+              amountAtomic: resumed.amountAtomic,
+              kind,
+              taskKey: options.taskKey
+            };
+            if (historical)
+              historical.reservations = [...historical.reservations ?? [], reservation];
+            else
+              rows.push({
+                date: resumed.date,
+                spentAtomic: resumed.amountAtomic,
+                wallet,
+                reservations: [reservation]
+              });
+          }
+          await writeLedgerAtomically(ledgerPath, rows);
+        }
+        return {
+          date: resumed.date,
+          spentAtomic: current?.spentAtomic ?? "0",
+          reservationReused: true
+        };
+      }
     }
     const spentAtomic = current?.spentAtomic ?? "0";
     const nextSpent = BigInt(spentAtomic) + amountAtomic;
     if (nextSpent > perDayAtomic) {
       throw new SpendCapError(
         "per_day_cap_exceeded",
-        `Payment quote ${amountAtomic} atomic USDC would raise today's spend to ${nextSpent} for wallet ${wallet}, above the per-day cap ${perDayAtomic}. Refusing to sign.`
+        `${kind === "escrow-funding" ? "Escrow funding" : "Payment quote"} ${amountAtomic} atomic USDC would raise today's spend to ${nextSpent} for wallet ${wallet}, above the per-day cap ${perDayAtomic}. Refusing to sign.`
       );
     }
+    const reservationId = options?.reservationId ?? (options?.taskKey === void 0 ? void 0 : randomBytes10(16).toString("hex"));
     const nextRow = {
       date: utcDateKey(now),
       spentAtomic: nextSpent.toString(),
       wallet,
-      ...(current?.reservations?.length ?? 0) === 0 && options?.reservationId === void 0 ? {} : {
+      ...(current?.reservations?.length ?? 0) === 0 && reservationId === void 0 ? {} : {
         reservations: [
           ...current?.reservations ?? [],
-          ...options?.reservationId === void 0 ? [] : [{ id: options.reservationId, amountAtomic: amountAtomic.toString() }]
+          ...reservationId === void 0 ? [] : [
+            {
+              id: reservationId,
+              amountAtomic: amountAtomic.toString(),
+              ...kind !== "payment" ? { kind } : {},
+              ...options?.taskKey === void 0 ? {} : { taskKey: options.taskKey }
+            }
+          ]
         ]
       }
     };
-    const nextRows = [...rows.filter((row) => row.wallet !== wallet), nextRow].sort(
-      (a, b) => a.wallet.localeCompare(b.wallet)
+    const otherRows = rows.filter((row) => row.wallet !== wallet || row.date !== today).map((row) => {
+      if (row.wallet !== wallet || !options?.reuseExistingEscrowReservation || options.reservationId === void 0)
+        return row;
+      const previous = row.reservations?.find(
+        (reservation) => reservation.id === options.reservationId
+      );
+      if (!previous) return row;
+      if (kind !== "escrow-funding" && kind !== "dispute-fee" || previous.kind !== kind || previous.amountAtomic !== amountAtomic.toString() || previous.taskKey !== void 0 && previous.taskKey !== options.taskKey)
+        throw new Error(
+          `Spend reservation ${options.reservationId} does not match this funding.`
+        );
+      return {
+        ...row,
+        reservations: row.reservations.filter(
+          (reservation) => reservation.id !== options.reservationId
+        )
+      };
+    });
+    const nextRows = [...otherRows, nextRow].sort(
+      (a, b) => a.wallet.localeCompare(b.wallet) || a.date.localeCompare(b.date)
     );
     await writeLedgerAtomically(ledgerPath, nextRows);
-    return { date: nextRow.date, spentAtomic: nextRow.spentAtomic };
+    return {
+      date: nextRow.date,
+      spentAtomic: nextRow.spentAtomic,
+      ...options?.reservationId === void 0 && reservationId !== void 0 ? { reservationId } : {}
+    };
   });
 }
 async function releaseSpend(amountAtomic, options) {
@@ -73222,35 +73430,40 @@ async function releaseSpend(amountAtomic, options) {
   const wallet = options.wallet ?? DEFAULT_WALLET_NAME;
   return await withLedgerLock(ledgerPath, async () => {
     const today = utcDateKey(now);
-    const rows = await readStoredSpendLedgerRows(ledgerPath, now);
-    const current = rows.find((row) => row.wallet === wallet);
-    if (options.reservedOn !== today) {
+    const rows = await readStoredSpendLedgerRows(ledgerPath, now, true);
+    const current = rows.find((row) => row.wallet === wallet && row.date === today);
+    if (options.reservedOn !== today && options.reservationId === void 0) {
       return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
     }
-    const reservation = options.reservationId === void 0 ? void 0 : current?.reservations?.find((candidate) => candidate.id === options.reservationId);
+    const reserved = rows.find((row) => row.wallet === wallet && row.date === options.reservedOn);
+    const reservation = options.reservationId === void 0 ? void 0 : reserved?.reservations?.find((candidate) => candidate.id === options.reservationId);
     if (options.reservationId !== void 0 && reservation === void 0) {
       return { date: today, spentAtomic: current?.spentAtomic ?? "0" };
     }
     if (reservation !== void 0 && reservation.amountAtomic !== amountAtomic.toString()) {
       throw new Error(`Spend reservation ${options.reservationId} has a different amount.`);
     }
-    const spentAtomic = BigInt(current?.spentAtomic ?? "0");
+    const spentAtomic = BigInt(reserved?.spentAtomic ?? "0");
     const releasedAmount = reservation === void 0 ? amountAtomic : BigInt(reservation.amountAtomic);
     const nextSpent = spentAtomic > releasedAmount ? spentAtomic - releasedAmount : 0n;
-    const remainingReservations = current?.reservations?.filter(
+    const remainingReservations = reserved?.reservations?.filter(
       (candidate) => candidate.id !== options.reservationId
     );
     const nextRow = {
-      date: today,
+      date: options.reservedOn,
       spentAtomic: nextSpent.toString(),
       wallet,
       ...remainingReservations === void 0 || remainingReservations.length === 0 ? {} : { reservations: remainingReservations }
     };
-    const nextRows = [...rows.filter((row) => row.wallet !== wallet), nextRow].sort(
-      (a, b) => a.wallet.localeCompare(b.wallet)
-    );
+    const nextRows = [
+      ...rows.filter((row) => row.wallet !== wallet || row.date !== options.reservedOn),
+      nextRow
+    ].sort((a, b) => a.wallet.localeCompare(b.wallet) || a.date.localeCompare(b.date));
     await writeLedgerAtomically(ledgerPath, nextRows);
-    return { date: nextRow.date, spentAtomic: nextRow.spentAtomic };
+    return {
+      date: today,
+      spentAtomic: options.reservedOn === today ? nextRow.spentAtomic : current?.spentAtomic ?? "0"
+    };
   });
 }
 function parseAtomicCap(value, label) {
@@ -73547,7 +73760,9 @@ async function transferBetweenAccounts(args) {
       );
       reservedOn = reservation.date;
     } catch (error61) {
-      if (error61 instanceof SpendCapError) throw transferError(error61.code);
+      if (error61 instanceof SpendCapError && isTransferErrorCode(error61.code)) {
+        throw transferError(error61.code);
+      }
       throw transferError("network_error");
     }
   }
@@ -76685,7 +76900,7 @@ function createRunBudget(args) {
 import { mkdir as mkdir15, writeFile as writeFile8 } from "node:fs/promises";
 import { arch, platform, release } from "node:os";
 import { join as join13 } from "node:path";
-var VAPI_CLIENT_VERSION = "0.8.0";
+var VAPI_CLIENT_VERSION = "0.9.0";
 async function createSupportReport(options) {
   const message = options.message.trim();
   if (!message) throw new Error("Support report message must not be empty.");
@@ -77687,6 +77902,115 @@ async function responseJson(response) {
   }
 }
 
+// src/tasks/canonical-json.ts
+function canonicalizeJson(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") {
+    return value;
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("Value is not JSON serializable");
+    }
+    return value;
+  }
+  if (Array.isArray(value)) {
+    return value.map(canonicalizeJson);
+  }
+  if (typeof value === "object") {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      throw new Error("Value is not JSON serializable");
+    }
+    return Object.fromEntries(
+      Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, item]) => [key, canonicalizeJson(item)])
+    );
+  }
+  throw new Error("Value is not JSON serializable");
+}
+function canonicalJson(value) {
+  return JSON.stringify(canonicalizeJson(value));
+}
+
+// src/tasks/delivery-manifest.ts
+import { createHash as createHash2 } from "node:crypto";
+var sha256Schema = external_exports.string().regex(/^[0-9a-fA-F]{64}$/).transform((digest) => digest.toLowerCase());
+var deliveryManifestSchema = external_exports.object({
+  files: external_exports.array(
+    external_exports.object({
+      fileId: external_exports.uuid(),
+      fileName: external_exports.string().min(1).max(255),
+      sha256: sha256Schema,
+      sizeBytes: external_exports.number().int().positive()
+    }).strict()
+  ).min(1).max(20),
+  noteSha256: sha256Schema
+}).strict().superRefine((manifest, context) => {
+  if (new Set(manifest.files.map((file2) => file2.fileId)).size !== manifest.files.length) {
+    context.addIssue({ code: "custom", path: ["files"], message: "File ids must be unique" });
+  }
+});
+function freezeDeliveryManifest(input2) {
+  const parsed = deliveryManifestSchema.parse(input2);
+  const manifest = deliveryManifestSchema.parse({
+    ...parsed,
+    files: [...parsed.files].sort((left, right) => left.fileId.localeCompare(right.fileId))
+  });
+  return {
+    manifest,
+    manifestHash: keccak256(toBytes(canonicalJson(manifest)))
+  };
+}
+async function sha256Hex(bytes) {
+  return createHash2("sha256").update(bytes).digest("hex");
+}
+async function prepareDeliveryManifest(files, note) {
+  if (files.length === 0) {
+    throw new Error("Upload at least one delivery file.");
+  }
+  const noteSha256 = await sha256Hex(new TextEncoder().encode(note));
+  return freezeDeliveryManifest({ files, noteSha256 });
+}
+
+// src/tasks/verbs.ts
+var TASKS_CLIENT_VERBS = [
+  "search",
+  "show",
+  "post",
+  "propose",
+  "submit",
+  "award",
+  "sign",
+  "fund",
+  "deliver",
+  "release",
+  "refund",
+  "dispute",
+  "counter-evidence",
+  "resolve-unmatched",
+  "message",
+  "thread",
+  "watch",
+  "status"
+];
+
+// src/funding-policy.ts
+function decideFunding(input2) {
+  validateAmount(input2.amountUsd);
+  if (input2.amountUsd > input2.maxPerTaskUsd) return { ok: false, reason: "policy.perTask" };
+  if (input2.amountUsd > input2.dayRemainingUsd) return { ok: false, reason: "policy.perDay" };
+  if (input2.amountUsd > input2.approveAboveUsd) return { approval: true };
+  return { ok: true };
+}
+function decideRelease(input2) {
+  validateAmount(input2.amountUsd);
+  return input2.amountUsd < input2.autoReleaseBelowUsd ? { auto: true } : { approval: true };
+}
+function validateAmount(amountUsd) {
+  if (!Number.isFinite(amountUsd) || amountUsd < 0) {
+    throw new Error("Task amount must be a finite, non-negative USD number.");
+  }
+}
+
 // src/searches.ts
 import { mkdir as mkdir16, open as open11, readFile as readFile16 } from "node:fs/promises";
 import { dirname as dirname10 } from "node:path";
@@ -77867,6 +78191,351 @@ function dedupeProvenance(values) {
   });
 }
 
+// src/docs.ts
+var DEFAULT_DOCS_ORIGIN = "https://docs.vapinetwork.ai";
+var DOCS_URL_ENV = "VAPI_DOCS_URL";
+var DOCS_RESPONSE_MAX_BYTES = 2 * 1024 * 1024;
+var SEARCH_TIMEOUT_MS = 15e3;
+var READ_TIMEOUT_MS = 15e3;
+var ASK_TIMEOUT_MS = 6e4;
+var MAX_REDIRECTS = 5;
+var REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+var DocsError = class extends Error {
+  constructor(code, message, options) {
+    super(message, options);
+    this.code = code;
+  }
+  code;
+  name = "DocsError";
+};
+var publicFetch3 = createPublicFetch({ allowPrivateNetwork: false });
+function resolveDocsOrigin(env = process.env) {
+  const configured = env[DOCS_URL_ENV]?.trim() || DEFAULT_DOCS_ORIGIN;
+  let url2;
+  try {
+    url2 = new URL(configured);
+  } catch (cause) {
+    throw new DocsError("host_not_allowed", `The configured docs origin is invalid.`, { cause });
+  }
+  if (url2.protocol !== "https:" || url2.username || url2.password || url2.pathname !== "/" || url2.search || url2.hash) {
+    throw new DocsError(
+      "host_not_allowed",
+      "The configured docs origin must be an HTTPS origin without credentials, a path, a query, or a fragment."
+    );
+  }
+  return url2.origin;
+}
+async function searchDocs(query, options = {}) {
+  const normalized = nonEmpty(query, "Search query");
+  if (options.limit !== void 0 && (!Number.isSafeInteger(options.limit) || options.limit < 1)) {
+    throw new DocsError("invalid_input", "Search limit must be a positive integer.");
+  }
+  const origin = resolveDocsOrigin(options.env);
+  const { text: body } = await requestText(
+    new URL("/~gitbook/mcp", origin),
+    {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream"
+      },
+      body: JSON.stringify({
+        jsonrpc: "2.0",
+        id: 1,
+        method: "tools/call",
+        params: { name: "searchDocumentation", arguments: { query: normalized } }
+      })
+    },
+    {
+      operation: "search",
+      origin,
+      timeoutMs: options.timeoutMs ?? SEARCH_TIMEOUT_MS,
+      fetchImpl: options.fetchImpl
+    }
+  );
+  const payload = parseSearchEnvelope(body);
+  const blocks = searchTextBlocks(payload);
+  const results = blocks.flatMap((block) => {
+    const parsed = parseSearchBlock(block);
+    return parsed === void 0 ? [] : [parsed];
+  });
+  return { results: options.limit === void 0 ? results : results.slice(0, options.limit) };
+}
+async function readDocs(pageUrlOrPath, options = {}) {
+  const input2 = nonEmpty(pageUrlOrPath, "Documentation page");
+  const origin = resolveDocsOrigin(options.env);
+  const page = docsPagePath(input2, origin);
+  const requestOptions = {
+    operation: "read",
+    origin,
+    timeoutMs: options.timeoutMs ?? READ_TIMEOUT_MS,
+    fetchImpl: options.fetchImpl
+  };
+  const found = await readFirstMarkdown(page, requestOptions);
+  if (found !== void 0) return found;
+  const { url: canonical } = await requestText(
+    page,
+    { method: "HEAD" },
+    { ...requestOptions, notFoundOn404: true }
+  );
+  if (canonical.pathname !== page.pathname) {
+    const moved = await readFirstMarkdown(canonical, requestOptions);
+    if (moved !== void 0) return moved;
+  }
+  throw new DocsError("not_found", `Documentation page not found: ${page.href}`);
+}
+async function readFirstMarkdown(page, options) {
+  const path = page.pathname.replace(/\/+$/u, "");
+  const candidates = path ? [`${path}.md`, `${path}/readme.md`] : ["/readme.md"];
+  for (const pathname of candidates) {
+    const candidate = new URL(page);
+    candidate.pathname = pathname;
+    try {
+      const { text: markdown, url: url2 } = await requestText(
+        candidate,
+        { method: "GET", headers: { accept: "text/markdown" } },
+        { ...options, notFoundOn404: true }
+      );
+      if (!markdown.trimStart().startsWith("# Page Not Found")) {
+        return { url: url2.href, markdown };
+      }
+    } catch (error61) {
+      if (!(error61 instanceof DocsError && error61.code === "not_found")) throw error61;
+    }
+  }
+  return void 0;
+}
+async function askDocs(question, options = {}) {
+  const normalized = nonEmpty(question, "Question");
+  const origin = resolveDocsOrigin(options.env);
+  const url2 = new URL("/readme.md", origin);
+  url2.searchParams.set("ask", normalized);
+  const { text: markdown } = await requestText(
+    url2,
+    { method: "GET", headers: { accept: "text/markdown" } },
+    {
+      operation: "ask",
+      origin,
+      timeoutMs: options.timeoutMs ?? ASK_TIMEOUT_MS,
+      fetchImpl: options.fetchImpl
+    }
+  );
+  return parseAnswer(markdown);
+}
+function nonEmpty(value, label) {
+  const normalized = value.trim();
+  if (!normalized) throw new DocsError("invalid_input", `${label} must not be empty.`);
+  return normalized;
+}
+function docsPagePath(value, origin) {
+  let url2;
+  try {
+    url2 = new URL(value, `${origin}/`);
+  } catch (cause) {
+    throw new DocsError("invalid_input", "Documentation page must be a docs URL or path.", {
+      cause
+    });
+  }
+  if (url2.origin !== origin || url2.username || url2.password) {
+    throw new DocsError(
+      "host_not_allowed",
+      `Documentation pages must use the configured docs origin ${origin}.`
+    );
+  }
+  url2.search = "";
+  url2.hash = "";
+  url2.pathname = url2.pathname.replace(/\/+$/u, "").replace(/(?:\/readme)?\.md$/iu, "") || "/";
+  return url2;
+}
+async function requestText(requestUrl, init, options) {
+  if (!Number.isSafeInteger(options.timeoutMs) || options.timeoutMs < 1) {
+    throw new DocsError("invalid_input", "Documentation request timeout must be positive.");
+  }
+  assertAllowedUrl(requestUrl, options.origin);
+  const controller = new AbortController();
+  const timeoutError = new DocsError(
+    "timeout",
+    `The documentation ${options.operation} request timed out.`
+  );
+  let timer;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => {
+      controller.abort(timeoutError);
+      reject(timeoutError);
+    }, options.timeoutMs);
+  });
+  let url2 = requestUrl;
+  try {
+    let response;
+    for (let hops = 0; ; hops += 1) {
+      response = await Promise.race([
+        (options.fetchImpl ?? publicFetch3)(url2, {
+          ...init,
+          redirect: "manual",
+          signal: controller.signal
+        }),
+        timeout
+      ]);
+      if (response.url) assertAllowedUrl(new URL(response.url), options.origin);
+      const location = response.headers.get("location");
+      if (init.method !== "GET" && init.method !== "HEAD" || !REDIRECT_STATUSES.has(response.status) || !location) {
+        break;
+      }
+      if (hops === MAX_REDIRECTS) {
+        throw new DocsError(
+          "bad_response",
+          `The documentation ${options.operation} request redirected too many times.`
+        );
+      }
+      await response.body?.cancel();
+      const next = new URL(location, url2);
+      assertAllowedUrl(next, options.origin);
+      url2 = next;
+    }
+    if (options.notFoundOn404 && response.status === 404) {
+      throw new DocsError("not_found", `Documentation page not found: ${url2.href}`);
+    }
+    if (!response.ok) {
+      throw new DocsError(
+        "bad_response",
+        `The documentation ${options.operation} request returned HTTP ${response.status}.`
+      );
+    }
+    return { text: await Promise.race([readCappedText(response), timeout]), url: url2 };
+  } catch (error61) {
+    if (error61 instanceof DocsError) throw error61;
+    if (controller.signal.aborted) throw timeoutError;
+    throw new DocsError("bad_response", `The documentation ${options.operation} request failed.`, {
+      cause: error61
+    });
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function assertAllowedUrl(url2, origin) {
+  if (url2.origin !== origin || url2.username || url2.password) {
+    throw new DocsError(
+      "host_not_allowed",
+      `Documentation requests may only contact the configured docs origin ${origin}.`
+    );
+  }
+}
+async function readCappedText(response) {
+  const contentLength = response.headers.get("content-length");
+  if (contentLength !== null && Number(contentLength) > DOCS_RESPONSE_MAX_BYTES) {
+    throw responseTooLarge();
+  }
+  if (response.body === null) return "";
+  const reader = response.body.getReader();
+  const chunks = [];
+  let size5 = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size5 += value.byteLength;
+      if (size5 > DOCS_RESPONSE_MAX_BYTES) {
+        await reader.cancel();
+        throw responseTooLarge();
+      }
+      chunks.push(value);
+    }
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(size5);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return new TextDecoder().decode(bytes);
+}
+function responseTooLarge() {
+  return new DocsError(
+    "bad_response",
+    `The documentation response exceeded ${DOCS_RESPONSE_MAX_BYTES} bytes.`
+  );
+}
+function parseSearchEnvelope(body) {
+  const trimmed = body.trim();
+  if (!trimmed) throw invalidSearchResponse();
+  if (trimmed.startsWith("{")) return parseJson2(trimmed);
+  const records = [];
+  let data = [];
+  for (const line of body.split(/\r?\n/u)) {
+    if (line === "") {
+      if (data.length > 0) records.push(data.join("\n"));
+      data = [];
+    } else if (line.startsWith("data:")) {
+      data.push(line.slice(5).trimStart());
+    }
+  }
+  if (data.length > 0) records.push(data.join("\n"));
+  for (const record2 of records) {
+    try {
+      return JSON.parse(record2);
+    } catch {
+    }
+  }
+  throw invalidSearchResponse();
+}
+function parseJson2(value) {
+  try {
+    return JSON.parse(value);
+  } catch (cause) {
+    throw new DocsError("bad_response", "The documentation search response was invalid JSON.", {
+      cause
+    });
+  }
+}
+function searchTextBlocks(payload) {
+  const envelope = asRecord(payload);
+  const rpcError = asRecord(envelope?.error);
+  if (rpcError !== void 0) {
+    const message = typeof rpcError.message === "string" ? `: ${rpcError.message}` : "";
+    throw new DocsError("bad_response", `The documentation search returned an error${message}`);
+  }
+  const result = asRecord(envelope?.result);
+  if (!Array.isArray(result?.content)) throw invalidSearchResponse();
+  return result.content.flatMap((item) => {
+    const block = asRecord(item);
+    return block?.type === "text" && typeof block.text === "string" ? [block.text] : [];
+  });
+}
+function parseSearchBlock(block) {
+  const match = /^Title:\s*([^\r\n]+)\r?\nLink:\s*([^\r\n]+)\r?\nContent:\s*([\s\S]*)$/u.exec(
+    block.trim()
+  );
+  if (!match) return void 0;
+  const title = match[1].trim();
+  const url2 = match[2].trim();
+  const excerpt = match[3].trim();
+  return title && url2 && excerpt ? { title, url: url2, excerpt } : void 0;
+}
+function invalidSearchResponse() {
+  return new DocsError("bad_response", "The documentation search response was invalid.");
+}
+function parseAnswer(markdown) {
+  const heading = /^# Sources:\s*$/gmu;
+  const matches = [...markdown.matchAll(heading)];
+  const last = matches.at(-1);
+  if (last?.index === void 0) return { answer: markdown.trimEnd(), sources: [] };
+  const answer = markdown.slice(0, last.index).trimEnd();
+  const sourceText = markdown.slice(last.index + last[0].length).trim();
+  const sources = sourceText.split(/\r?\n/u).flatMap((line) => {
+    const linked = /^\s*(?:[-*]|\d+\.)\s+\[([^\]]+)\]\((https?:\/\/[^)\s]+)\)\s*$/u.exec(line);
+    if (linked) return [{ title: linked[1].trim(), url: linked[2] }];
+    const bare = /^\s*(?:[-*]|\d+\.)\s+(https?:\/\/\S+)\s*$/u.exec(line);
+    if (!bare) return [];
+    return [{ title: bare[1], url: bare[1] }];
+  });
+  return { answer, sources };
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+
 // src/distribute.ts
 var DistributeError = class extends Error {
   constructor(code, message, movementId) {
@@ -78425,7 +79094,7 @@ function csvCell(value) {
 }
 
 // src/swarm-capital.ts
-import { createHash as createHash2, randomBytes as randomBytes15 } from "node:crypto";
+import { createHash as createHash3, randomBytes as randomBytes15 } from "node:crypto";
 import { readFile as readFile17, unlink as unlink12 } from "node:fs/promises";
 import { join as join14 } from "node:path";
 var movementIdSchema3 = external_exports.string().regex(/^mv_[A-Za-z0-9_-]{8,128}$/u);
@@ -78497,7 +79166,7 @@ var resumableSwarmReasons = /* @__PURE__ */ new Set([
   "sweep"
 ]);
 function treasuryRequestMovementId(swarm, requestId) {
-  const digest = createHash2("sha256").update(`${swarm}
+  const digest = createHash3("sha256").update(`${swarm}
 ${requestId}`).digest("hex").slice(0, 24);
   return movementIdSchema3.parse(`mv_${digest}`);
 }
@@ -80556,9 +81225,12 @@ export {
   CEILING_SWEEP_TIMEOUT_MS,
   DEFAULT_AGENT_TOOLS,
   DEFAULT_ARC_GAS_HEADROOM_ATOMIC,
+  DEFAULT_AUTO_RELEASE_BELOW_USD,
   DEFAULT_CEILING_ATOMIC,
   DEFAULT_DISCOVERY_URL,
+  DEFAULT_DOCS_ORIGIN,
   DEFAULT_MARKETPLACE_DISCOVERY_URL,
+  DEFAULT_MAX_PER_TASK_USD,
   DEFAULT_REGISTRY_FALLBACKS,
   DEFAULT_REGISTRY_URL,
   DEFAULT_SPEND_CAPS,
@@ -80568,6 +81240,7 @@ export {
   DISCOVERY_CATEGORIES,
   DiscoveryCatalogError,
   DistributeError,
+  DocsError,
   EIP3009_AUTHORIZATION_STATE_ABI,
   EIP3009_AUTHORIZATION_TYPES,
   ERC20_ABI,
@@ -80611,6 +81284,7 @@ export {
   SpendPolicy,
   SwarmError,
   SweepGasError,
+  TASKS_CLIENT_VERBS,
   TransferError,
   USDC_DECIMALS,
   VAPI_BUILDER_CODE,
@@ -80637,6 +81311,7 @@ export {
   appendReceipt,
   appendSearchEvent,
   areSamePaymentNetwork,
+  askDocs,
   assertMaxPrice,
   assertPublicUrl,
   assertSIWxChallengeBoundToOrigin,
@@ -80674,6 +81349,8 @@ export {
   createRunId,
   createSIWxMessage,
   createSupportReport,
+  decideFunding,
+  decideRelease,
   decodePaymentRequiredHeader,
   deleteSwarmFile,
   deriveEvmPrivateKey,
@@ -80694,6 +81371,7 @@ export {
   encryptPrivateKey,
   ensureDeviceName,
   entropyToPhrase,
+  escrowFundingDayRemainingAtomic,
   executeMovement,
   executionModeSchema,
   explorerAddressUrl,
@@ -80778,12 +81456,14 @@ export {
   phraseToSeed,
   pinnedLookup,
   planAllocation,
+  prepareDeliveryManifest,
   promptForSecret,
   protectVault,
   provenanceSchema,
   readAgentProfile,
   readAuditLog,
   readDelegationRecord,
+  readDocs,
   readKeystoreAddress,
   readKeystoreVersion,
   readMovement,
@@ -80813,6 +81493,7 @@ export {
   roleGrants,
   runRefSchema,
   scheduleCeilingSweep,
+  searchDocs,
   searchServicesResponseSchema,
   secretStore,
   secretsAllowed,
@@ -80820,6 +81501,7 @@ export {
   serviceSummarySchema,
   serviceTierSchema,
   setupSwarm,
+  sha256Hex,
   slugifyDeviceName,
   spendCapsForWallet,
   spendCapsSchema,
@@ -80838,6 +81520,7 @@ export {
   sweepBack,
   sweepSolanaUsdc,
   sweepTarget,
+  taskReservedAtomic,
   transferBetweenAccounts,
   treasuryRequestMovementId,
   unlockKeystore,