agentwallet-mcp 1.13.5 → 1.13.6

package/build/index.js

@@ -13,14 +13,14 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { z } from 'zod';
 import { assertPublicUrl, safeFetch, finalUrlOf } from './ssrf-guard.js';
-import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, } from './x402-payment.js';
+import { deriveX402Payment, isWithinCap, lookupTrustedDecimals, assertDeclaredDecimals, nativeDecimals, SOLANA_CHAIN_IDS, assetLabel, autopayAssetAllowed, autopayEnvCap, effectiveAutopayCap, maxAuthWindowSeconds, parseDecimalPins, approvalRefusal, authorizationResource, resolveNetworkChainId, normalizeRawAmount, parseAutopayAssets, assetSupportsExact, } from './x402-payment.js';
 import { createHash } from 'node:crypto';
 import { isLocalMode, getLocalAddress, localWalletRecord, localSend, localNativeBalance, localTokenBalance, localSignMessage, resolveRpcUrl, } from './local-wallet.js';
 import { localSignAuthorization, localEthCall, localGetCode, localSignPermit2Upto } from './local-wallet.js';
 import { WRAPPED_NATIVE } from './wrapped-native.js';
-import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, PERMIT2_ADDRESS, } from './x402-permit2.js';
+import { buildUptoAuthorization, uptoPayload, permit2AllowanceCalldata, permit2ApproveCalldata, decodeUint, permit2Address, } from './x402-permit2.js';
 import { assessTokenRisk } from './token-risk.js';
-import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, } from './x402-eip3009.js';
+import { isLegacyAgentWalletAccept, requiredAmount, buildAuthorization, buildPaymentPayload, buildPaymentPayloadRaw, paymentHeaderFor, parsePaymentRequired, parseSettlement, pickOption, knownTokenDomain, parseEip7702Delegation, erc1271ProbeCalldata, classifyErc1271Probe, settlementVerdict, legacyReceiptAllowed, } from './x402-eip3009.js';
 import { isSolanaLocalMode, getSolanaAddress, solanaWalletRecord, localSolBalance, localSplBalance, localSolTransfer, localSplTransfer, resolveSolanaRpc, mintDecimalsStrict, } from './local-solana.js';
 /** True when either chain family is running non-custodially. */
 function anyLocalMode() {
@@ -232,7 +232,7 @@ async function api(path, method = 'GET', body, extraHeaders) {
     // redirect is refused instead of followed, so a request body is never
     // replayed to another origin and another origin's answer is never returned
     // as the API's (2026-10-04 audit).
-    const options = { method, headers, redirect: 'manual' };
+    const options = { method, headers, redirect: 'manual', signal: AbortSignal.timeout(API_TIMEOUT_MS) };
     if (body && method !== 'GET') {
         options.body = JSON.stringify(body);
     }
@@ -426,7 +426,8 @@ function isValidAddress(address) {
 }
 // ─── Guard helpers ──────────────────────────────────────────────
 /** Request headers the caller may not set on pay_x402: Host would rename the TLS peer, the rest belong to the client. */
-const FORBIDDEN_REQUEST_HEADERS = new Set(['host', 'content-length', 'transfer-encoding', 'connection', 'upgrade', 'expect', 'te', 'trailer', 'keep-alive']);
+const FORBIDDEN_REQUEST_HEADERS = new Set(['host', 'content-length', 'transfer-encoding', 'connection', 'upgrade', 'expect', 'te', 'trailer', 'keep-alive',
+    'x-payment', 'payment-signature', 'x-payment-response', 'payment-response']); // the payment headers are the tool's own to set
 /** Authorizations signed in this process, keyed by endpoint and requirement, kept until they expire. */
 const signingInFlight = new Map();
 const signedPayments = new Map();
@@ -450,6 +451,7 @@ function redactUrl(u) {
     }
 }
 const API_MAX_RESPONSE_CHARS = 8 * 1024 * 1024;
+const API_TIMEOUT_MS = 60_000; // a hosted hop that hangs must not hold a signing gate open
 /* Error text from the local signing path with every URL reduced to its origin
    and viem's "URL:" / "Request body:" lines dropped: an RPC endpoint carries
    its API key in the path or query, and a tool result is the agent's context
@@ -458,7 +460,7 @@ function redactRpcSecrets(err) {
     const e = err;
     let msg = e?.shortMessage ? [e.shortMessage, e.details].filter(Boolean).join(' ') : String(e?.message ?? err);
     msg = msg.split(/\r?\n/).filter(l => !/^\s*(URL|Request body|Request Arguments|Raw Call Arguments)\s*:/i.test(l)).join('\n').trim();
-    return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)\]]+/gi, (u) => redactUrl(u));
+    return msg.replace(/[a-z][a-z0-9+.-]*:\/\/[^\s"'<>)]+/gi, (u) => redactUrl(u)); // brackets stay in: IPv6 hosts
 }
 /**
  * Decimals to scale a human amount by. Always the token's own value (registry,
@@ -531,7 +533,7 @@ function formatUnits(raw, decimals) {
     const frac = padded.slice(padded.length - decimals);
     // Trim trailing zeros but keep at least one decimal
     const trimmed = frac.replace(/0+$/, '') || '0';
-    return `${whole}.${trimmed}`;
+    return decimals === 0 ? whole : `${whole}.${trimmed}`; // a 0-decimal amount has no fraction, so it round-trips through parseUnits
 }
 /**
  * Pad an address to 32 bytes (64 hex chars) for ABI encoding.
@@ -577,7 +579,7 @@ function resolveChainId(network) {
 const AddressSchema = z.string().regex(/^(0x[a-fA-F0-9]{40}|[1-9A-HJ-NP-Za-km-z]{32,44})$/, 'Must be a 0x-prefixed 40-hex EVM address or a base58 Solana address');
 const server = new McpServer({
     name: 'agentwallet',
-    version: '1.13.5',
+    version: '1.13.6',
 }, {
     instructions: `AgentWallet gives AI agents their own blockchain wallets. ${anyLocalMode()
         ? 'This server runs in LOCAL (self-custody) mode: the operator supplied the key, signing happens in this process, and the only spend guards are the AGENTWALLET_MAX_TX_* environment caps. There is no server-side pause, daily limit or approval email; pause_wallet, unpause_wallet and delete_wallet are refused.'
@@ -946,7 +948,7 @@ server.tool('approve_token', 'Approve a spender contract to transfer ERC-20 toke
     // Asset risk rides along with the approval (issue #13). It never blocks; it is the
     // caller's call. Skipped for Permit2, which only moves what a signature allows.
     let risk = null;
-    if (spender.toLowerCase() !== PERMIT2_ADDRESS.toLowerCase() && process.env.AGENTWALLET_TOKEN_RISK !== '0') {
+    if (spender.toLowerCase() !== permit2Address(chain_id).toLowerCase() && process.env.AGENTWALLET_TOKEN_RISK !== '0') {
         try {
             risk = await assessTokenRisk(chain_id, token, (to, data) => ethCallHex(chain_id, to, data));
         }
@@ -1175,11 +1177,17 @@ async function ethCallHex(chainId, to, data) {
  * rather than guess.
  */
 async function resolveTokenDomain(chainId, asset, extra) {
-    if (extra?.name && extra?.version)
-        return { name: String(extra.name), version: String(extra.version) };
     const known = knownTokenDomain(chainId, asset);
-    if (known)
+    const declared = (typeof extra?.name === 'string' && typeof extra?.version === 'string') ? { name: extra.name, version: extra.version } : null;
+    if (known) {
+        // A registry token's domain is known; a 402 declaring a different one would only yield a signature the token rejects.
+        if (declared && (declared.name !== known.name || declared.version !== known.version)) {
+            throw new Error(`x402: the endpoint declared EIP-712 domain "${serverText(declared.name)}"/"${serverText(declared.version)}" for ${asset} on chain ${chainId}, but that token's domain is "${known.name}"/"${known.version}"; refusing to sign under a domain the token would reject.`);
+        }
         return known;
+    }
+    if (declared)
+        return declared;
     let name = '', version = '';
     try {
         name = decodeAbiString(await ethCallHex(chainId, asset, '0x06fdde03')); // name()
@@ -1215,7 +1223,7 @@ async function signAuthorization(walletId, chainId, asset, domain, auth, approva
 /** Sign a Permit2 upto authorization with whichever custody mode is active. */
 async function signPermit2(walletId, chainId, auth, approvalId) {
     const r = (await api(`/wallets/${walletId}/x402/permit2`, 'POST', {
-        chain_id: chainId, asset: auth.permitted.token, amount: auth.permitted.amount, spender: auth.spender, permit2: PERMIT2_ADDRESS,
+        chain_id: chainId, asset: auth.permitted.token, amount: auth.permitted.amount, spender: auth.spender, permit2: permit2Address(chainId),
         nonce: auth.nonce, deadline: auth.deadline, to: auth.witness.to, facilitator: auth.witness.facilitator, valid_after: auth.witness.validAfter,
         ...(approvalId ? { approval_id: approvalId } : {}),
     }, { 'X-AGW-SKIP-X402': 'true' }));
@@ -1340,7 +1348,8 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             payment_required: true,
             payment_made: false,
             error: picked.reason,
-            offered: accepts.map(a => ({ scheme: a.scheme, network: a.network, amount: requiredAmount(a), asset: a.asset ?? a.extra?.token ?? null })),
+            offered: accepts.slice(0, 10).map(a => ({ scheme: serverText(a.scheme), network: serverText(a.network), amount: serverText(requiredAmount(a)), asset: serverText(a.asset ?? a.extra?.token ?? null) })),
+            server_text_is_untrusted: true,
         });
     }
     const option = picked.option;
@@ -1370,6 +1379,20 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             error: assetPolicy.reason,
         });
     }
+    // Step 3c: The tx-hash receipt flow (an on-chain transfer, final the moment
+    // it is broadcast) is only for AgentWallet's own paywalls: the API host or
+    // the origins in AGENTWALLET_LEGACY_PAYWALL_ORIGINS. Any other host sending
+    // the legacy shape gets the standard flow (2026-10-04 round 2). And an
+    // "exact" requirement in a token with no EIP-3009 can never settle, so it
+    // is refused before an approval could be consumed for it.
+    const legacyReceipt = isLegacyAgentWalletAccept(option) && legacyReceiptAllowed(servedFrom, API_BASE, process.env.AGENTWALLET_LEGACY_PAYWALL_ORIGINS);
+    if (!isUpto && !isSolanaChain(chainId) && tokenAddress && !legacyReceipt && !assetSupportsExact(chainId, tokenAddress)) {
+        return jsonResponse({
+            status: 402, payment_required: true, payment_made: false,
+            required_amount: amount, token: tokenLabel, token_address: tokenAddress, network: option.network, chain_id: chainId, pay_to: option.payTo,
+            error: `${tokenLabel} on chain ${chainId} does not implement EIP-3009, so an "exact" x402 payment in it cannot settle; nothing was signed. The endpoint would need an "upto" option or a USDC requirement.`,
+        });
+    }
     // Step 4: Hard per-payment cap, ALWAYS applied. If the caller omits max_payment
     // we fall back to AGENTWALLET_MAX_AUTOPAY (default "1"). Above the cap a hosted
     // wallet can ask its owner instead of refusing: an approval is created, the
@@ -1384,7 +1407,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
             status: 402, payment_required: true, payment_made: false,
             required_amount: amount, max_allowed: effectiveMax, cap_source: capSource, token: tokenLabel,
             ...(clamped ? { max_payment_ignored: `max_payment ${max_payment} exceeds the operator ceiling AGENTWALLET_MAX_AUTOPAY=${effectiveMax}; only the operator can raise it.` } : {}),
-            network: option.network, chain_id: chainId, pay_to: option.payTo, description: option.description,
+            network: option.network, chain_id: chainId, pay_to: option.payTo, description: serverText(option.description), server_text_is_untrusted: true,
         };
         const wantApproval = request_approval ?? (process.env.AGENTWALLET_APPROVALS !== '0');
         if (approval_id) {
@@ -1428,7 +1451,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     // usage; the payer broadcasts nothing and pays no gas for either. AgentWallet's
     // own paywalls (verified by receipt), native-asset requests and Solana still use
     // a broadcast transfer proved by hash.
-    const standardExact = !isUpto && !isSolanaChain(chainId) && Boolean(tokenAddress) && !isLegacyAgentWalletAccept(option);
+    const standardExact = !isUpto && !isSolanaChain(chainId) && Boolean(tokenAddress) && !legacyReceipt;
     let headerName = 'X-PAYMENT';
     let paymentHeader = '';
     let txHash = null;
@@ -1456,82 +1479,89 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     let releaseSigning = () => { };
     if (!(cachedAuth && cachedAuth.until > Date.now())) {
         const mine = new Promise(r => { releaseSigning = r; });
-        // Released when the signature is cached, or after 30 s if this call throws first, so a failure never wedges the key.
-        signingInFlight.set(cacheKey, Promise.race([mine, new Promise(r => setTimeout(r, 30_000).unref())]));
-    }
-    if (cachedAuth && cachedAuth.until > Date.now()) {
-        // Same endpoint, same requirement, still inside the window: re-send the
-        // earlier signature. Its nonce is single-use, so a server that already
-        // settled it cannot settle it again, and one that never did now can.
-        ({ headerName, paymentHeader, txHash, authorization, uptoAuth, payer } = cachedAuth);
-        authorizationReused = true;
-    }
-    else if (isUpto) {
-        payer = await payerAddress(wallet_id);
-        payerDelegationInfo = await payerDelegation(chainId, payer);
-        const allowance = decodeUint(await ethCallHex(chainId, tokenAddress, permit2AllowanceCalldata(payer)));
-        if (allowance < BigInt(rawAmount)) {
-            if (process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1' && assetPolicy.via === 'stablecoin') {
-                // Approve exactly this payment's maximum, never unlimited (2026-10-04 audit).
-                const r = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: permit2ApproveCalldata(rawAmount), chain_id: chainId }, skip));
-                permit2ApprovalTx = String(r?.tx_hash || '');
-                await new Promise(res => setTimeout(res, 4000));
-            }
-            else {
-                return jsonResponse({
-                    status: 402, payment_required: true, payment_made: false, permit2_approval_needed: true,
-                    token: tokenLabel, token_address: tokenAddress, chain_id: chainId, payer, permit2: PERMIT2_ADDRESS,
-                    error: `This endpoint uses the x402 "upto" scheme, which settles through Permit2. Wallet ${payer} has not approved ` +
-                        `${tokenLabel} to Permit2 on chain ${chainId}. Call approve_permit2 once for this token (a normal transaction that needs gas), ` +
-                        `or set AGENTWALLET_PERMIT2_AUTO_APPROVE=1, then call pay_x402 again.`,
-                });
-            }
-        }
-        uptoAuth = buildUptoAuthorization(payer, option);
-        const signature = await signPermit2(wallet_id, chainId, uptoAuth, approvalUsed);
-        const payload = buildPaymentPayloadRaw(x402Version, option, uptoPayload(uptoAuth, signature), paymentInfo.resource, paymentInfo.extensions);
-        const h = paymentHeaderFor(x402Version, payload);
-        headerName = h.name;
-        paymentHeader = h.value;
-    }
-    else if (standardExact) {
-        payer = await payerAddress(wallet_id);
-        payerDelegationInfo = await payerDelegation(chainId, payer);
-        const domain = await resolveTokenDomain(chainId, tokenAddress, option.extra);
-        authorization = buildAuthorization(payer, option);
-        const signature = await signAuthorization(wallet_id, chainId, tokenAddress, domain, authorization, approvalUsed);
-        const payload = buildPaymentPayload(x402Version, option, authorization, signature, paymentInfo.resource, paymentInfo.extensions);
-        const h = paymentHeaderFor(x402Version, payload);
-        headerName = h.name;
-        paymentHeader = h.value;
+        // Released in the finally below, whatever path this call takes. A timer
+        // used to stand in for that and opened the gate under a slow signer, so
+        // a second call signed a second nonce (2026-10-04 round 2); every
+        // network hop inside the gate carries its own timeout instead.
+        signingInFlight.set(cacheKey, mine);
     }
-    else {
-        let txResult;
-        if (isSolanaChain(chainId)) {
-            txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', tokenAddress
-                ? { to: option.payTo, value: rawAmount, token_mint: tokenAddress, token_decimals: trustedDecimals, chain_id: chainId }
-                : { to: option.payTo, value: rawAmount, chain_id: chainId }));
+    try {
+        if (cachedAuth && cachedAuth.until > Date.now()) {
+            // Same endpoint, same requirement, still inside the window: re-send the
+            // earlier signature. Its nonce is single-use, so a server that already
+            // settled it cannot settle it again, and one that never did now can.
+            ({ headerName, paymentHeader, txHash, authorization, uptoAuth, payer } = cachedAuth);
+            authorizationReused = true;
+        }
+        else if (isUpto) {
+            payer = await payerAddress(wallet_id);
+            payerDelegationInfo = await payerDelegation(chainId, payer);
+            const allowance = decodeUint(await ethCallHex(chainId, tokenAddress, permit2AllowanceCalldata(payer, chainId)));
+            if (allowance < BigInt(rawAmount)) {
+                if (process.env.AGENTWALLET_PERMIT2_AUTO_APPROVE === '1' && assetPolicy.via === 'stablecoin') {
+                    // Approve exactly this payment's maximum, never unlimited (2026-10-04 audit).
+                    const r = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: permit2ApproveCalldata(rawAmount, chainId), chain_id: chainId }, skip));
+                    permit2ApprovalTx = String(r?.tx_hash || '');
+                    await new Promise(res => setTimeout(res, 4000));
+                }
+                else {
+                    return jsonResponse({
+                        status: 402, payment_required: true, payment_made: false, permit2_approval_needed: true,
+                        token: tokenLabel, token_address: tokenAddress, chain_id: chainId, payer, permit2: permit2Address(chainId),
+                        error: `This endpoint uses the x402 "upto" scheme, which settles through Permit2. Wallet ${payer} has not approved ` +
+                            `${tokenLabel} to Permit2 on chain ${chainId}. Call approve_permit2 once for this token (a normal transaction that needs gas), ` +
+                            `or set AGENTWALLET_PERMIT2_AUTO_APPROVE=1, then call pay_x402 again.`,
+                    });
+                }
+            }
+            uptoAuth = buildUptoAuthorization(payer, option);
+            const signature = await signPermit2(wallet_id, chainId, uptoAuth, approvalUsed);
+            const payload = buildPaymentPayloadRaw(x402Version, option, uptoPayload(uptoAuth, signature), paymentInfo.resource, paymentInfo.extensions);
+            const h = paymentHeaderFor(x402Version, payload);
+            headerName = h.name;
+            paymentHeader = h.value;
         }
-        else if (tokenAddress) {
-            const calldata = '0xa9059cbb' + padAddress(option.payTo) + encodeUint256(rawAmount);
-            txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: calldata, chain_id: chainId }));
+        else if (standardExact) {
+            payer = await payerAddress(wallet_id);
+            payerDelegationInfo = await payerDelegation(chainId, payer);
+            const domain = await resolveTokenDomain(chainId, tokenAddress, option.extra);
+            authorization = buildAuthorization(payer, option);
+            const signature = await signAuthorization(wallet_id, chainId, tokenAddress, domain, authorization, approvalUsed);
+            const payload = buildPaymentPayload(x402Version, option, authorization, signature, paymentInfo.resource, paymentInfo.extensions);
+            const h = paymentHeaderFor(x402Version, payload);
+            headerName = h.name;
+            paymentHeader = h.value;
         }
         else {
-            txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: option.payTo, value: rawAmount, data: '', chain_id: chainId }));
+            let txResult;
+            if (isSolanaChain(chainId)) {
+                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', tokenAddress
+                    ? { to: option.payTo, value: rawAmount, token_mint: tokenAddress, token_decimals: trustedDecimals, chain_id: chainId }
+                    : { to: option.payTo, value: rawAmount, chain_id: chainId }));
+            }
+            else if (tokenAddress) {
+                const calldata = '0xa9059cbb' + padAddress(option.payTo) + encodeUint256(rawAmount);
+                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: tokenAddress, value: '0', data: calldata, chain_id: chainId }));
+            }
+            else {
+                txResult = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: option.payTo, value: rawAmount, data: '', chain_id: chainId }));
+            }
+            txHash = String(txResult.tx_hash || txResult.signature || '');
+            if (!txHash)
+                throw new Error('x402: the payment transaction returned no hash.');
+            paymentHeader = Buffer.from(JSON.stringify({ x402Version, scheme: option.scheme, network: option.network, payload: { txHash } })).toString('base64');
         }
-        txHash = String(txResult.tx_hash || txResult.signature || '');
-        if (!txHash)
-            throw new Error('x402: the payment transaction returned no hash.');
-        paymentHeader = Buffer.from(JSON.stringify({ x402Version, scheme: option.scheme, network: option.network, payload: { txHash } })).toString('base64');
-    }
-    if (!authorizationReused) {
-        const until = authorization ? Number(authorization.validBefore) * 1000
-            : uptoAuth ? Number(uptoAuth.deadline) * 1000
-                : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
-        signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until });
-    }
-    releaseSigning();
-    signingInFlight.delete(cacheKey);
+        if (!authorizationReused) {
+            const until = authorization ? Number(authorization.validBefore) * 1000
+                : uptoAuth ? Number(uptoAuth.deadline) * 1000
+                    : Date.now() + maxAuthWindowSeconds() * 1000; // a broadcast transfer: the hash stays valid, re-sending it never pays twice
+            signedPayments.set(cacheKey, { headerName, paymentHeader, txHash, authorization, uptoAuth, payer, until });
+        }
+    }
+    finally {
+        releaseSigning();
+        signingInFlight.delete(cacheKey);
+    }
     // Step 6: Retry with the payment header and read the settlement receipt.
     const retryHeaders = { ...reqHeaders, [headerName]: paymentHeader };
     const retryOptions = {
@@ -1542,7 +1572,19 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     if (reqBody && method !== 'GET') {
         retryOptions.body = reqBody;
     }
-    const retryRes = await safeFetch(url, retryOptions);
+    let retryRes;
+    try {
+        retryRes = await safeFetch(url, retryOptions);
+    }
+    catch (e) {
+        // The authorization has already been handed over; say so instead of a bare transport error.
+        return jsonResponse({
+            status: 0, payment_required: true, payment_made: null, payment_outcome: 'unknown',
+            error: `The paid request could not be completed: ${e.message}. The authorization was already sent; it stays cached, and calling pay_x402 again with the same URL inside its window re-sends the same one rather than signing a new one.`,
+            authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore } : (uptoAuth ? { scheme: 'upto', nonce: uptoAuth.nonce, deadline: uptoAuth.deadline } : null),
+            tx_hash: txHash ?? null, amount, token: tokenLabel, pay_to: option.payTo, chain_id: chainId,
+        });
+    }
     const retryText = await retryRes.text();
     let retryParsed;
     try {
@@ -1557,6 +1599,7 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     let retryError = null;
     const retryServedFrom = finalUrlOf(retryRes, url);
     const retryCrossOrigin = new URL(retryServedFrom).origin !== new URL(url).origin;
+    const verdict = settlementVerdict(retryRes.status, settlement, retryCrossOrigin);
     if (retryCrossOrigin) {
         retryError = `The paid request was redirected to another origin (${new URL(retryServedFrom).origin}); the payment header is never forwarded across origins, so this response did not see the payment.`;
     }
@@ -1569,10 +1612,11 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
     return jsonResponse({
         status: retryRes.status,
         payment_required: true,
-        // Paid means the endpoint accepted the payment: a settlement receipt, or a success status after the payment header.
-        // A 4xx other than 402 (bad body, auth) means the request failed for another reason; the authorization was
-        // sent but the facilitator normally does not settle a failed request, so it is not reported as paid.
-        payment_made: !retryCrossOrigin && (Boolean(settlement?.success) || (retryRes.status >= 200 && retryRes.status < 300)),
+        // Paid means a success status after the payment header and no server-reported settlement failure. A 402 or
+        // any other non-2xx is not paid whatever the settlement header claims (a server could send success:true on a
+        // 402 and mislead the agent, 2026-10-04 round 2); the facilitator does not settle a failed request.
+        payment_made: verdict.payment_made,
+        payment_outcome: verdict.outcome,
         authorization_reused: authorizationReused,
         retry_error: retryError,
         payment_method: isUpto ? 'permit2-upto-authorization' : (standardExact ? 'eip3009-authorization' : 'onchain-transfer'),
@@ -1587,9 +1631,10 @@ server.tool('pay_x402', 'Handle an x402 payment flow. Fetches a URL, and if the
         pay_to: option.payTo,
         payer,
         payer_delegation: payerDelegationInfo,
-        // txHash is ours (we broadcast it); settlement.transaction is the server's
-        // claim and is surfaced only when it is shaped like a real hash.
-        tx_hash: txHash ?? (looksLikeTxHash(settlement?.transaction) ? settlement?.transaction : null) ?? null,
+        // tx_hash is only ever ours (we broadcast it). The server's claimed hash
+        // is kept apart and unverified: it is not evidence the payment settled.
+        tx_hash: txHash ?? null,
+        server_claimed_tx_hash: looksLikeTxHash(settlement?.transaction) ? settlement?.transaction : null,
         settlement_reported_by_server: settlement,
         authorization: authorization ? { nonce: authorization.nonce, valid_before: authorization.validBefore }
             : (uptoAuth ? { scheme: 'upto', max_amount: amount, nonce: uptoAuth.nonce, deadline: uptoAuth.deadline, facilitator: uptoAuth.witness.facilitator } : null),
@@ -1613,13 +1658,13 @@ server.tool('approve_permit2', 'One-time ERC-20 approval of a token to the Permi
 }, async ({ wallet_id, token, chain_id, amount }) => {
     if (isSolanaChain(chain_id))
         throw new Error('Permit2 is an EVM contract; there is nothing to approve on Solana.');
-    let data = permit2ApproveCalldata();
+    let data = permit2ApproveCalldata(undefined, chain_id);
     if (amount !== undefined) {
         const raw = parseUnits(amount, await resolveTrustedDecimals(chain_id, token));
-        data = '0x095ea7b3' + padAddress(PERMIT2_ADDRESS) + encodeUint256(raw);
+        data = permit2ApproveCalldata(raw, chain_id);
     }
     const result = (await api(`/wallets/${wallet_id}/send`, 'POST', { to: token, value: '0', data, chain_id }));
-    return jsonResponse({ ...result, token, spender: PERMIT2_ADDRESS, amount: amount ?? 'unlimited', note: 'Permit2 only transfers what a signed authorization allows; the allowance itself moves nothing.' });
+    return jsonResponse({ ...result, token, spender: permit2Address(chain_id), amount: amount ?? 'unlimited', note: 'Permit2 only transfers what a signed authorization allows; the allowance itself moves nothing.' });
 });
 // ─── Tool: check_token_risk ─────────────────────────────────────
 server.tool('check_token_risk', 'Assess an ERC-20 token before approving or swapping it: honeypot, taxes, owner powers, verified source, ' +

package/build/local-solana.js

@@ -416,15 +416,23 @@ export async function localSplTransfer(mintStr, to, rawAmount, decimals, chainId
     const destAta = associatedTokenAddress(recipient, mint, tokenProgram);
     const tx = new Transaction();
     const destInfo = await conn.getAccountInfo(destAta);
-    if (destInfo && !destInfo.owner.equals(tokenProgram)) {
-        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is already occupied by an account the token program does not own, so no token account can be created there.`);
+    // The associated-account program creates into an address that already holds
+    // plain SOL (system-owned, no data): it tops up the rent, allocates and
+    // assigns. Only an address holding something else cannot become the token
+    // account (2026-10-04 round 2; the 1.13.5 refusal of any occupant let anyone
+    // block a recipient for the price of the rent-exempt minimum).
+    const prefunded = destInfo !== null && destInfo.owner.equals(SystemProgram.programId) && destInfo.data.length === 0;
+    if (destInfo && !destInfo.owner.equals(tokenProgram) && !prefunded) {
+        throw new Error(`Refusing to send: the recipient's token account address ${destAta.toBase58()} is occupied by an account owned by ${destInfo.owner.toBase58()}, so no token account can be created there.`);
     }
-    if (!destInfo) {
+    if (!destInfo || prefunded) {
         // Creating the recipient's token account costs the payer rent in SOL, an
         // outflow the SOL cap must see (0.002 SOL a time adds up over many sends).
-        // Rent follows the account's real size, which for Token-2022 is above 165.
+        // Rent follows the account's real size, which for Token-2022 is above 165;
+        // SOL already sitting at the address reduces what the payer tops up.
         const rent = await conn.getMinimumBalanceForRentExemption(ataSize);
-        assertWithinSolCap(BigInt(rent));
+        const shortfall = Math.max(0, rent - (destInfo?.lamports ?? 0));
+        assertWithinSolCap(BigInt(shortfall));
         tx.add(createAtaIdempotentIx(payer.publicKey, destAta, recipient, mint, tokenProgram));
     }
     tx.add(transferCheckedIx(tokenProgram, sourceAta, mint, destAta, payer.publicKey, BigInt(rawAmount), decimals));
@@ -471,11 +479,12 @@ async function assertRecipientIsWallet(conn, recipient) {
         }
         throw new Error(`Refusing to send to ${recipient.toBase58()}: it is an account owned by the SPL token program, not a wallet.`);
     }
-    // Everything else that exists must be a plain system account: a program's
-    // data or buffer account, an address lookup table, a stake or vote account
-    // is owned by its program and nothing can ever sign for it as a wallet
-    // (2026-10-04 audit). A program-derived vault that holds tokens is still
-    // system-owned, so this costs nothing legitimate.
+    // Everything else that exists must be system-owned: a program's data or
+    // buffer account, an address lookup table, a stake or vote account is owned
+    // by its program and nothing can ever sign for it as a wallet (2026-10-04
+    // audit). A program-derived vault that holds tokens is system-owned and
+    // passes; so does a durable-nonce account (system-owned, 80 bytes), whose
+    // authority can withdraw what lands there.
     if (!info.owner.equals(SystemProgram.programId)) {
         throw new Error(`Refusing to send to ${recipient.toBase58()}: it is owned by program ${info.owner.toBase58()}, not a wallet. Pass a wallet address.`);
     }

package/build/local-wallet.js

@@ -271,7 +271,7 @@ export function classifyDecimalsError(err) {
     const e = err;
     const code = typeof e?.code === 'number' ? e.code : NaN;
     const text = [e?.message, e?.details, e?.shortMessage].filter(Boolean).join(' ');
-    const hasRevertData = typeof e?.data === 'string' && /^0x[0-9a-fA-F]*$/.test(e.data);
+    const hasRevertData = typeof e?.data === 'string' && /^0x[0-9a-fA-F]+$/.test(e.data); // "0x" alone is not revert data
     if (code === 3)
         return 'not-a-token'; // the JSON-RPC "execution error" code
     if ((code === -32000 || code === -32603 || code === -32015) && (/revert/i.test(text) || hasRevertData))
@@ -295,7 +295,12 @@ export function permit2AddressFor(chainId) { return PERMIT2_BY_CHAIN[chainId] ||
    table does not know, and is refused rather than let through as "a router"
    (2026-10-04 audit). approve, permit (2 shapes), transferFrom (2), lockdown,
    permitTransferFrom (2), permitWitnessTransferFrom (2), invalidateNonces/UnorderedNonces. */
-const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516', '0d58b1db', 'cc53287f', '30f28b7a', 'edd9444b', '137c29fe', 'fe8ec1a7', '3ff9dcb1', '0d58b1db']);
+const PERMIT2_SELECTORS = new Set(['87517c45', '2b67b570', '2a2d80d1', '36c78516', '0d58b1db', 'cc53287f', '30f28b7a', 'edd9444b', '137c29fe', 'fe8ec1a7', '3ff9dcb1', '65d9723c']);
+/* ERC-721 / ERC-1155 approvals and transfers. A collection declines decimals()
+   and so read as "not a token" to the cap, which let setApprovalForAll to an
+   attacker through uncapped (2026-10-04 round 2, verified on a live
+   collection). Nothing prices an NFT, so these are refused outright. */
+const NFT_SELECTORS = new Set(['a22cb465', '42842e0e', 'b88d4fde', 'f242432a', '2eb2c2d6']);
 const CAP_LAYOUTS = {
     a9059cbb: { amountIndex: 1, what: 'token transfer' }, // transfer(address,uint256)
     '23b872dd': { amountIndex: 2, what: 'token transfer' }, // transferFrom(address,address,uint256)
@@ -359,6 +364,10 @@ async function assertWithinTokenCap(chainId, to, data, valueWei = 0n) {
                 `or deposit/withdraw on the chain's wrapped-native contract, ` +
                 `or ask the operator, who alone can set AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1.`);
         }
+        if (NFT_SELECTORS.has(selector)) {
+            throw new Error(`Blocked by local guard: calldata selector 0x${selector} is an NFT approval or transfer (ERC-721/1155) aimed at ${to}; AGENTWALLET_MAX_TX_TOKEN cannot price it, ` +
+                `so it is refused rather than let through uncapped. Only the operator can allow it (AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1).`);
+        }
         if (PERMIT2_SELECTORS.has(selector)) {
             throw new Error(`Blocked by local guard: calldata selector 0x${selector} is a Permit2 function aimed at ${to}, which is not the Permit2 deployment this guard knows for chain ${chainId}; ` +
                 `refused rather than let through uncapped. Only the operator can allow it (AGENTWALLET_ALLOW_UNKNOWN_TOKEN_CALLS=1).`);

package/build/x402-eip3009.d.ts

@@ -158,6 +158,16 @@ export declare function paymentHeaderFor(x402Version: number, payload: Record<st
 };
 /** v2 servers put the requirements in PAYMENT-REQUIRED; v1 servers put them in the JSON body. */
 export declare function parsePaymentRequired(getHeader: (name: string) => string | null | undefined, body: unknown): X402PaymentRequired | null;
+export declare function sanitizeRequired(req: X402PaymentRequired): X402PaymentRequired;
+/** What the paid retry proved. The server's own claim never makes a refused request "paid". */
+export declare function settlementVerdict(status: number, settlement: {
+    success?: unknown;
+} | null, crossOrigin: boolean): {
+    payment_made: boolean;
+    outcome: 'paid' | 'refused' | 'server_reports_failure' | 'not_delivered';
+};
+/** The tx-hash receipt flow is for AgentWallet's own paywalls: the API host, or origins the operator lists. */
+export declare function legacyReceiptAllowed(finalUrl: string, apiBase: string, extraOrigins: string | undefined): boolean;
 export declare function parseSettlement(getHeader: (name: string) => string | null | undefined): X402Settlement | null;
 /**
  * Choose which accepts[] entry to pay. `exact` (EIP-3009, gasless for the

package/build/x402-eip3009.js

@@ -178,12 +178,77 @@ function decodeBase64Json(v) {
 export function parsePaymentRequired(getHeader, body) {
     const fromHeader = decodeBase64Json(getHeader('PAYMENT-REQUIRED') ?? getHeader('payment-required'));
     if (fromHeader && Array.isArray(fromHeader.accepts))
-        return fromHeader;
+        return sanitizeRequired(fromHeader);
     if (body && typeof body === 'object' && Array.isArray(body.accepts)) {
-        return body;
+        return sanitizeRequired(body);
     }
     return null;
 }
+/* Only entries shaped like requirements survive: plain objects whose scheme,
+   network and payTo are strings. A null entry, or an array where an address
+   should be, used to reach the pickers and surface a raw TypeError or a
+   coerced value (2026-10-04 round 2). Numeric amounts are kept as strings. */
+const MAX_ACCEPTS = 64; // a bound on the picker's work, well above anything a real server lists
+export function sanitizeRequired(req) {
+    const str = (v) => (typeof v === 'string' ? v : typeof v === 'number' && Number.isFinite(v) ? String(v) : undefined);
+    const accepts = [];
+    for (const a of req.accepts.slice(0, MAX_ACCEPTS)) {
+        if (!a || typeof a !== 'object' || Array.isArray(a))
+            continue;
+        const o = a;
+        const scheme = str(o.scheme), network = str(o.network), payTo = str(o.payTo);
+        if (scheme === undefined || network === undefined || payTo === undefined)
+            continue;
+        const extraIn = (o.extra && typeof o.extra === 'object' && !Array.isArray(o.extra)) ? o.extra : undefined;
+        const extra = extraIn ? { ...extraIn } : undefined;
+        if (extra)
+            for (const k of ['token', 'name', 'version', 'facilitatorAddress', 'spender', 'permit2']) {
+                if (k in extra && typeof extra[k] !== 'string')
+                    delete extra[k];
+            }
+        const out = { ...o, scheme, network, payTo };
+        for (const k of ['amount', 'maxAmountRequired', 'asset', 'description', 'resource', 'mimeType']) {
+            const v = str(o[k]);
+            if (v === undefined)
+                delete out[k];
+            else
+                out[k] = v;
+        }
+        if (extra)
+            out.extra = extra;
+        else
+            delete out.extra;
+        accepts.push(out);
+    }
+    return { ...req, accepts };
+}
+/** What the paid retry proved. The server's own claim never makes a refused request "paid". */
+export function settlementVerdict(status, settlement, crossOrigin) {
+    if (crossOrigin)
+        return { payment_made: false, outcome: 'not_delivered' };
+    if (status < 200 || status >= 300)
+        return { payment_made: false, outcome: 'refused' };
+    if (settlement && settlement.success === false)
+        return { payment_made: false, outcome: 'server_reports_failure' };
+    return { payment_made: true, outcome: 'paid' };
+}
+/** The tx-hash receipt flow is for AgentWallet's own paywalls: the API host, or origins the operator lists. */
+export function legacyReceiptAllowed(finalUrl, apiBase, extraOrigins) {
+    try {
+        const origin = new URL(finalUrl).origin;
+        if (origin === new URL(apiBase).origin)
+            return true;
+        return (extraOrigins || '').split(',').map(s => s.trim()).filter(Boolean).some(o => { try {
+            return new URL(o).origin === origin;
+        }
+        catch {
+            return false;
+        } });
+    }
+    catch {
+        return false;
+    }
+}
 export function parseSettlement(getHeader) {
     return (decodeBase64Json(getHeader('PAYMENT-RESPONSE') ?? getHeader('payment-response'))
         ?? decodeBase64Json(getHeader('X-PAYMENT-RESPONSE') ?? getHeader('x-payment-response')));
@@ -201,7 +266,7 @@ export function pickOption(accepts, resolveChainId, preferChain) {
     const upto = onChain.filter(a => isUptoPayable(a));
     const payable = [...exact, ...upto];
     if (payable.length === 0) {
-        const schemes = Array.from(new Set(accepts.map(a => a.scheme))).join(', ') || 'none';
+        const schemes = Array.from(new Set(accepts.map(a => String(a.scheme).slice(0, 40)))).slice(0, 10).join(', ') || 'none';
         const reason = accepts.some(a => a.scheme === 'upto')
             ? 'This endpoint offers the x402 "upto" scheme without an extra.facilitatorAddress (or without an asset), so the ' +
                 'Permit2 authorization cannot be bound to a facilitator. AgentWallet will not approximate it with an upfront transfer. ' +

package/build/x402-payment.d.ts

@@ -40,11 +40,13 @@ export declare const TRUSTED_DECIMALS: Record<number, Record<string, number>>;
  * would happily label 5 ETH as "5 USDC". The stable flag decides whether
  * AGENTWALLET_MAX_AUTOPAY (denominated in dollars) can price the asset at all.
  */
+export declare function assetSupportsExact(chainId: number, asset: string): boolean;
 export declare const KNOWN_ASSETS: ReadonlyArray<{
     chainId: number;
     address: string;
     symbol: string;
     stable: boolean;
+    exact?: boolean;
 }>;
 /** Symbol of the chain's native asset, or "native" for a chain this build does not know. */
 export declare function nativeSymbol(chainId: number): string;

package/build/x402-payment.js

@@ -58,15 +58,25 @@ export const TRUSTED_DECIMALS = {
  * would happily label 5 ETH as "5 USDC". The stable flag decides whether
  * AGENTWALLET_MAX_AUTOPAY (denominated in dollars) can price the asset at all.
  */
+/* exact: false marks a stablecoin that does not implement EIP-3009 (checked on
+   chain 2026-10-04: USDT, DAI and USDbC have no authorizationState), so an
+   "exact" x402 requirement naming it can never settle; such assets still work
+   for "upto" through Permit2. Absent means true. */
+export function assetSupportsExact(chainId, asset) {
+    const key = asset.toLowerCase();
+    const hit = KNOWN_ASSETS.find(a => a.chainId === chainId && a.address === key);
+    return hit ? hit.exact !== false : true;
+}
 export const KNOWN_ASSETS = [
     { chainId: 1, address: '0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48', symbol: 'USDC', stable: true },
-    { chainId: 1, address: '0xdac17f958d2ee523a2206206994597c13d831ec7', symbol: 'USDT', stable: true },
-    { chainId: 1, address: '0x6b175474e89094c44da98b954eedeac495271d0f', symbol: 'DAI', stable: true },
+    { chainId: 1, address: '0xdac17f958d2ee523a2206206994597c13d831ec7', symbol: 'USDT', stable: true, exact: false },
+    { chainId: 1, address: '0x6b175474e89094c44da98b954eedeac495271d0f', symbol: 'DAI', stable: true, exact: false },
     { chainId: 8453, address: '0x833589fcd6edb6e08f4c7c32d4f71b54bda02913', symbol: 'USDC', stable: true },
-    { chainId: 8453, address: '0xd9aaec86b65d86f6a7b5b1b0c42ffa531710b6ca', symbol: 'USDbC', stable: true },
+    { chainId: 8453, address: '0xd9aaec86b65d86f6a7b5b1b0c42ffa531710b6ca', symbol: 'USDbC', stable: true, exact: false },
     { chainId: 8453, address: '0x4200000000000000000000000000000000000006', symbol: 'WETH', stable: false },
     { chainId: 137, address: '0x3c499c542cef5e3811e1192ce70d8cc03d5c3359', symbol: 'USDC', stable: true },
-    { chainId: 137, address: '0xc2132d05d31c914a87c6611c10748aeb04b58e8f', symbol: 'USDT', stable: true },
+    { chainId: 137, address: '0xc2132d05d31c914a87c6611c10748aeb04b58e8f', symbol: 'USDT0', stable: true, exact: false },
+    { chainId: 43114, address: '0xb97ef9ef8734c71904d8002f8b6bc66dd9c48a6e', symbol: 'USDC', stable: true },
     { chainId: 42161, address: '0xaf88d065e77c8cc2239327c5edb3a432268e5831', symbol: 'USDC', stable: true },
     { chainId: 10, address: '0x0b2c639c533813f4aa9d7837caf62653d097ff85', symbol: 'USDC', stable: true },
     { chainId: 900, address: 'EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v', symbol: 'USDC', stable: true },
@@ -79,7 +89,7 @@ const NATIVE_SYMBOL = {
 };
 function assetKey(chainId, asset) {
     // EVM addresses are case-insensitive hex; SPL mints are case-sensitive base58.
-    return `${chainId}:${asset.startsWith('0x') ? asset.toLowerCase() : asset}`;
+    return `${chainId}:${/^0x/i.test(asset) ? asset.toLowerCase() : asset}`;
 }
 const KNOWN_BY_KEY = new Map(KNOWN_ASSETS.map(a => [assetKey(a.chainId, a.address), a]));
 /** Symbol of the chain's native asset, or "native" for a chain this build does not know. */
@@ -119,13 +129,13 @@ export function parseAutopayAssets(raw) {
         const m = e.match(/^(\d+):(.+)$/);
         const chainId = m ? parseInt(m[1], 10) : null;
         const a = (m ? m[2] : e).trim();
-        return { chainId, asset: a.startsWith('0x') ? a.toLowerCase() : a };
+        return { chainId, asset: /^0x/i.test(a) ? a.toLowerCase() : a };
     });
 }
 export function autopayAssetAllowed(chainId, asset) {
     if (isStableAsset(chainId, asset))
         return { allowed: true, via: 'stablecoin' };
-    const wanted = asset ? (asset.startsWith('0x') ? asset.toLowerCase() : asset) : 'native';
+    const wanted = asset ? (/^0x/i.test(asset) ? asset.toLowerCase() : asset) : 'native';
     const hit = parseAutopayAssets(process.env.AGENTWALLET_AUTOPAY_ASSETS).some(e => e.asset === wanted && (e.chainId === null || e.chainId === chainId));
     if (hit)
         return { allowed: true, via: 'allowlist' };

package/build/x402-permit2.d.ts

@@ -1,5 +1,6 @@
 import type { X402Requirement } from './x402-eip3009.js';
 export declare const PERMIT2_ADDRESS: "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+export declare function permit2Address(chainId: number): `0x${string}`;
 export declare const X402_UPTO_PERMIT2_PROXY: "0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002";
 /** EIP-712 types. Referenced types must follow the primary type in alphabetical order (TokenPermissions, Witness). */
 export declare const UPTO_PERMIT2_WITNESS_TYPES: {
@@ -62,7 +63,7 @@ export declare function uptoTypedData(chainId: number, auth: UptoPermit2Authoriz
     domain: {
         name: string;
         chainId: number;
-        verifyingContract: "0x000000000022D473030F116dDEE9F6B43aC78BA3";
+        verifyingContract: `0x${string}`;
     };
     types: {
         readonly PermitWitnessTransferFrom: readonly [{
@@ -118,7 +119,7 @@ export declare function uptoTypedData(chainId: number, auth: UptoPermit2Authoriz
 /** The payload object that goes under `payload` in the x402 payment. */
 export declare function uptoPayload(auth: UptoPermit2Authorization, signature: string): Record<string, unknown>;
 /** allowance(owner, Permit2) calldata. */
-export declare function permit2AllowanceCalldata(owner: string): `0x${string}`;
+export declare function permit2AllowanceCalldata(owner: string, chainId?: number): `0x${string}`;
 /** approve(Permit2, amount) calldata; unlimited only when no amount is given. */
-export declare function permit2ApproveCalldata(amountRaw?: string): `0x${string}`;
+export declare function permit2ApproveCalldata(amountRaw?: string, chainId?: number): `0x${string}`;
 export declare function decodeUint(hex: string): bigint;

package/build/x402-permit2.js

@@ -10,6 +10,9 @@
 import { randomBytes } from 'node:crypto';
 import { maxAuthWindowSeconds } from './x402-payment.js';
 export const PERMIT2_ADDRESS = '0x000000000022D473030F116dDEE9F6B43aC78BA3';
+/** Chains whose Permit2 is not at the canonical address (zkSync Era runs its own deployment). */
+const PERMIT2_BY_CHAIN = { 324: '0x0000000000225e31D15943971F47aD3022F714Fa' };
+export function permit2Address(chainId) { return PERMIT2_BY_CHAIN[chainId] ?? PERMIT2_ADDRESS; }
 export const X402_UPTO_PERMIT2_PROXY = '0x4020A4f3b7b90ccA423B9fabCc0CE57C6C240002';
 /** EIP-712 types. Referenced types must follow the primary type in alphabetical order (TokenPermissions, Witness). */
 export const UPTO_PERMIT2_WITNESS_TYPES = {
@@ -64,7 +67,7 @@ export function buildUptoAuthorization(from, req, nowSeconds = Math.floor(Date.n
 }
 export function uptoTypedData(chainId, auth) {
     return {
-        domain: { name: 'Permit2', chainId, verifyingContract: PERMIT2_ADDRESS },
+        domain: { name: 'Permit2', chainId, verifyingContract: permit2Address(chainId) },
         types: UPTO_PERMIT2_WITNESS_TYPES,
         primaryType: 'PermitWitnessTransferFrom',
         message: {
@@ -82,13 +85,15 @@ export function uptoPayload(auth, signature) {
 }
 function pad(addr) { return addr.replace(/^0x/, '').toLowerCase().padStart(64, '0'); }
 /** allowance(owner, Permit2) calldata. */
-export function permit2AllowanceCalldata(owner) {
-    return ('0xdd62ed3e' + pad(owner) + pad(PERMIT2_ADDRESS));
+export function permit2AllowanceCalldata(owner, chainId = 8453) {
+    return ('0xdd62ed3e' + pad(owner) + pad(permit2Address(chainId)));
 }
 /** approve(Permit2, amount) calldata; unlimited only when no amount is given. */
-export function permit2ApproveCalldata(amountRaw) {
+export function permit2ApproveCalldata(amountRaw, chainId = 8453) {
+    if (amountRaw !== undefined && (!/^\d+$/.test(amountRaw) || BigInt(amountRaw) > (1n << 256n) - 1n))
+        throw new Error(`Permit2 approval amount "${amountRaw}" is not a uint256.`);
     const word = amountRaw === undefined ? 'f'.repeat(64) : BigInt(amountRaw).toString(16).padStart(64, '0');
-    return ('0x095ea7b3' + pad(PERMIT2_ADDRESS) + word);
+    return ('0x095ea7b3' + pad(permit2Address(chainId)) + word);
 }
 export function decodeUint(hex) {
     const h = (hex || '').replace(/^0x/, '');

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "agentwallet-mcp",
   "mcpName": "io.github.hifriendbot/agentwallet",
-  "version": "1.13.5",
+  "version": "1.13.6",
   "description": "MCP server for AgentWallet: self-custody local signing on EVM and Solana, or hosted wallets. Sign, broadcast, pay x402 invoices, and accept x402 payments.",
   "type": "module",
   "main": "build/index.js",
@@ -16,7 +16,7 @@
   "scripts": {
     "build": "tsc",
     "start": "node build/index.js",
-    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs",
+    "test": "node test/x402-payment.test.mjs && node test/eip3009.test.mjs && node test/permit2-risk.test.mjs && node test/token-cap.test.mjs && node test/spl-cap.test.mjs && node test/unknown-decimals-cap.test.mjs && node test/decimals-range-cap.test.mjs && node test/local-mode.test.mjs && node test/ssrf-guard.test.mjs && node test/x402-policy.test.mjs && node test/local-guard-shape.test.mjs && node test/allowance-total-cap.test.mjs && node test/autopay-scheme.test.mjs && node test/spl-recipient-guard.test.mjs && node test/approval-binding.test.mjs && node test/ata-rent-size.test.mjs && node test/final-url-guard.test.mjs && node test/audit-1135.test.mjs && node test/local-no-autopay.test.mjs && node test/audit-1136.test.mjs",
     "prepublishOnly": "npm run build"
   },
   "keywords": [