@haven_ai/mcp 0.1.2-alpha → 0.1.4-alpha

package/dist/index.d.cts

@@ -7,7 +7,11 @@ interface HavenCredentialFile {
     delegateKey: string;
     agentId?: string;
     safeAddress?: string;
+    delegateAddress?: string;
+    chainId?: number;
+    network?: string;
     apiUrl?: string;
+    allowanceSummary?: readonly HavenCredentialAllowance[];
     /**
      * Absolute path the credentials were loaded from, if any. Set when the
      * caller pointed at a JSON file via `--credentials` or `HAVEN_CREDENTIALS`;
@@ -17,6 +21,18 @@ interface HavenCredentialFile {
      * credential path was supplied.
      */
     sourcePath?: string;
+    identityPath?: string;
+    signerPath?: string;
+}
+interface HavenCredentialAllowance {
+    token: string;
+    amount: string;
+    resetMinutes: number | null;
+}
+interface HavenCredentialSource {
+    credentialsPath?: string;
+    identityPath?: string;
+    signerPath?: string;
 }
 /**
  * Load Haven agent credentials for the MCP server.
@@ -34,10 +50,16 @@ interface HavenCredentialFile {
  * The values still live only in the agent operator's process environment;
  * Haven's backend never sees the delegate key either way.
  */
-declare function loadCredentials(path?: string | undefined): Promise<HavenCredentialFile>;
+declare function loadCredentials(source?: string | HavenCredentialSource | undefined): Promise<HavenCredentialFile>;
 
 type HavenMcpToolName = 'haven_quote_x402' | 'haven_pay_x402_quote' | 'haven_resume_x402_payment' | 'haven_quote_mpp' | 'haven_pay_mpp_challenge' | 'haven_resume_mpp_payment' | 'haven_get_payment_status' | 'haven_get_resume_state' | 'haven_get_agent' | 'haven_get_allowances' | 'haven_list_receipts';
 declare const toolSchemas: Record<HavenMcpToolName, z.ZodRawShape>;
+/**
+ * MCP tool descriptions, composed from the shared semantic source in
+ * `@haven_ai/sdk`'s `tool-descriptions.ts`. Keeping both the SDK tool-calling
+ * surface and the MCP surface pointed at the same prose source means new
+ * guidance lands in both places at once and a parity test can catch drift.
+ */
 declare const toolDescriptions: Record<HavenMcpToolName, string>;
 interface ToolSuccess<T> {
     success: true;
@@ -58,8 +80,107 @@ interface ToolFailure {
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
 declare function createToolHandlers(haven: HavenClient): Record<HavenMcpToolName, (input: unknown) => Promise<ToolPayload>>;
 
+/**
+ * First-launch consent gate for the Haven MCP server.
+ *
+ * Why this exists (option A of issue #163): an agent runtime that loads a
+ * Haven credential file is about to expose Haven payment tools to a model.
+ * Before the server starts taking JSON-RPC calls we want the operator to
+ * acknowledge — exactly once per credential + tool set — what those tools
+ * can do and what the on-chain allowance cap actually is. The on-chain
+ * AllowanceModule remains the policy primitive; this gate is informational
+ * rather than enforcement.
+ *
+ * Resolution:
+ *   - `HAVEN_MCP_ACK=<hash>` env var matching the current consent hash → pass.
+ *   - `HAVEN_MCP_ACK=skip` → pass (intended for CI / scripted setups).
+ *   - sidecar file `<credentials>.ack.json` containing `{ ack: <hash> }` → pass.
+ *   - `--ack` CLI flag → write the sidecar file, print the consent block, pass.
+ *   - otherwise → print the consent block to stderr and exit non-zero.
+ *
+ * The hash binds the api-key prefix to the registered tool set and the
+ * agent's current allowance summary, so a configuration change re-triggers
+ * the prompt.
+ */
+interface ConsentInput {
+    apiKeyPrefix: string;
+    /** Haven API base URL the credential will hit. */
+    apiUrl?: string;
+    /** Agent identity from the credential file, when present. */
+    agentId?: string;
+    /** Haven wallet (Safe) the agent spends from. */
+    safeAddress?: string;
+    /** Agent's delegate EOA — the local signer. */
+    delegateAddress?: string;
+    /** Chain the agent operates on. */
+    chainId?: number;
+    toolNames: readonly HavenMcpToolName[];
+    allowanceSummary: readonly {
+        token: string;
+        amount: string;
+        resetMinutes: number | null;
+    }[];
+}
+interface ConsentDecision {
+    /** True if the gate is satisfied and the server may start. */
+    ok: boolean;
+    /** Hash representing the current consent surface. */
+    hash: string;
+    /** Reason the gate accepted (or rejected) the run. */
+    reason: 'env_var_match' | 'env_var_skip' | 'ack_file_match' | 'wrote_ack_file' | 'env_var_mismatch' | 'no_acknowledgement';
+}
+interface ConsentOptions {
+    /** Path to the credential file; used to locate the sidecar `<path>.ack.json`. */
+    credentialsPath?: string;
+    /** When true, write the sidecar file with the current hash and accept. */
+    writeAck?: boolean;
+    /** Override the environment lookup (testing). */
+    env?: Record<string, string | undefined>;
+    /** Override the writable stream the consent block is printed to (testing). */
+    out?: {
+        write: (chunk: string) => unknown;
+    };
+}
+declare function computeConsentHash(input: ConsentInput): string;
+declare function renderConsentBlock(input: ConsentInput, hash: string): string;
+/** Resolve the consent gate. Does not exit the process; the caller decides. */
+declare function ensureConsent(input: ConsentInput, options?: ConsentOptions): Promise<ConsentDecision>;
+interface CredentialIdentitySeed {
+    apiKey: string;
+    apiUrl?: string;
+    agentId?: string;
+    /** Safe address from the credential file, used as a fallback. */
+    safeAddress?: string;
+    /** Delegate address from the credential file, used before live allowance metadata is available. */
+    delegateAddress?: string;
+    /** Chain from the credential file, used as a fallback. */
+    chainId?: number;
+    /** Intended agent budget from the setup flow, used before on-chain approval is visible. */
+    allowanceSummary?: readonly {
+        token: string;
+        amount: string;
+        resetMinutes: number | null;
+    }[];
+}
+/**
+ * Build the consent input from credential identity plus a live allowance
+ * lookup. The on-chain (or configured) allowance is what the operator
+ * actually cares about — that's the real spend ceiling — but we also bind
+ * the hash to the Haven wallet / delegate / chain so a credential swap
+ * cannot quietly reuse a prior sidecar acknowledgement.
+ *
+ * If `getAllowances()` fails (e.g. backend unreachable on first launch) we
+ * fall through to whatever identity fields the credential file provided,
+ * so the operator at least sees the tool list and the api-key prefix.
+ */
+declare function consentInputFromClient(haven: HavenClient, seed: CredentialIdentitySeed, toolNames: readonly HavenMcpToolName[]): Promise<ConsentInput>;
+/** Convenience: the canonical tool list registered by the server. */
+declare function registeredToolNames(): HavenMcpToolName[];
+
 interface HavenMcpServerOptions {
     credentialsPath?: string;
+    identityPath?: string;
+    signerPath?: string;
     credentials?: HavenCredentialFile;
     /**
      * When true, write the consent sidecar file (`<credentials>.ack.json`)
@@ -75,6 +196,18 @@ interface HavenMcpServerOptions {
 }
 declare function createHavenClient(options?: HavenMcpServerOptions): Promise<HavenClient>;
 declare function createHavenMcpServer(options?: HavenMcpServerOptions): Promise<McpServer>;
+/**
+ * Build an MCP server bound to the supplied Haven client.
+ *
+ * Each tool dispatch is wrapped in `haven.withRequestContext` so every
+ * Haven API request the dispatch issues carries `X-Haven-MCP-Tool: <name>`
+ * — and *only* that dispatch's requests see the header. The SDK uses an
+ * `AsyncLocalStorage` for the context, so two tool calls running
+ * concurrently cannot leak headers into each other and the backend
+ * `agent_tool_invocations` rows are always attributed to the right tool.
+ */
+declare const MCP_NAME = "@haven_ai/mcp";
+declare const MCP_VERSION = "0.1.4-alpha";
 declare function runStdioServer(options?: HavenMcpServerOptions): Promise<void>;
 
-export { type HavenCredentialFile, type HavenMcpServerOptions, type HavenMcpToolName, type ToolFailure, type ToolPayload, type ToolSuccess, createHavenClient, createHavenMcpServer, createToolHandlers, loadCredentials, runStdioServer, toolDescriptions, toolSchemas };
+export { type ConsentDecision, type ConsentInput, type ConsentOptions, type CredentialIdentitySeed, type HavenCredentialAllowance, type HavenCredentialFile, type HavenCredentialSource, type HavenMcpServerOptions, type HavenMcpToolName, MCP_NAME, MCP_VERSION, type ToolFailure, type ToolPayload, type ToolSuccess, computeConsentHash, consentInputFromClient, createHavenClient, createHavenMcpServer, createToolHandlers, ensureConsent, loadCredentials, registeredToolNames, renderConsentBlock, runStdioServer, toolDescriptions, toolSchemas };

package/dist/index.d.ts

@@ -7,7 +7,11 @@ interface HavenCredentialFile {
     delegateKey: string;
     agentId?: string;
     safeAddress?: string;
+    delegateAddress?: string;
+    chainId?: number;
+    network?: string;
     apiUrl?: string;
+    allowanceSummary?: readonly HavenCredentialAllowance[];
     /**
      * Absolute path the credentials were loaded from, if any. Set when the
      * caller pointed at a JSON file via `--credentials` or `HAVEN_CREDENTIALS`;
@@ -17,6 +21,18 @@ interface HavenCredentialFile {
      * credential path was supplied.
      */
     sourcePath?: string;
+    identityPath?: string;
+    signerPath?: string;
+}
+interface HavenCredentialAllowance {
+    token: string;
+    amount: string;
+    resetMinutes: number | null;
+}
+interface HavenCredentialSource {
+    credentialsPath?: string;
+    identityPath?: string;
+    signerPath?: string;
 }
 /**
  * Load Haven agent credentials for the MCP server.
@@ -34,10 +50,16 @@ interface HavenCredentialFile {
  * The values still live only in the agent operator's process environment;
  * Haven's backend never sees the delegate key either way.
  */
-declare function loadCredentials(path?: string | undefined): Promise<HavenCredentialFile>;
+declare function loadCredentials(source?: string | HavenCredentialSource | undefined): Promise<HavenCredentialFile>;
 
 type HavenMcpToolName = 'haven_quote_x402' | 'haven_pay_x402_quote' | 'haven_resume_x402_payment' | 'haven_quote_mpp' | 'haven_pay_mpp_challenge' | 'haven_resume_mpp_payment' | 'haven_get_payment_status' | 'haven_get_resume_state' | 'haven_get_agent' | 'haven_get_allowances' | 'haven_list_receipts';
 declare const toolSchemas: Record<HavenMcpToolName, z.ZodRawShape>;
+/**
+ * MCP tool descriptions, composed from the shared semantic source in
+ * `@haven_ai/sdk`'s `tool-descriptions.ts`. Keeping both the SDK tool-calling
+ * surface and the MCP surface pointed at the same prose source means new
+ * guidance lands in both places at once and a parity test can catch drift.
+ */
 declare const toolDescriptions: Record<HavenMcpToolName, string>;
 interface ToolSuccess<T> {
     success: true;
@@ -58,8 +80,107 @@ interface ToolFailure {
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
 declare function createToolHandlers(haven: HavenClient): Record<HavenMcpToolName, (input: unknown) => Promise<ToolPayload>>;
 
+/**
+ * First-launch consent gate for the Haven MCP server.
+ *
+ * Why this exists (option A of issue #163): an agent runtime that loads a
+ * Haven credential file is about to expose Haven payment tools to a model.
+ * Before the server starts taking JSON-RPC calls we want the operator to
+ * acknowledge — exactly once per credential + tool set — what those tools
+ * can do and what the on-chain allowance cap actually is. The on-chain
+ * AllowanceModule remains the policy primitive; this gate is informational
+ * rather than enforcement.
+ *
+ * Resolution:
+ *   - `HAVEN_MCP_ACK=<hash>` env var matching the current consent hash → pass.
+ *   - `HAVEN_MCP_ACK=skip` → pass (intended for CI / scripted setups).
+ *   - sidecar file `<credentials>.ack.json` containing `{ ack: <hash> }` → pass.
+ *   - `--ack` CLI flag → write the sidecar file, print the consent block, pass.
+ *   - otherwise → print the consent block to stderr and exit non-zero.
+ *
+ * The hash binds the api-key prefix to the registered tool set and the
+ * agent's current allowance summary, so a configuration change re-triggers
+ * the prompt.
+ */
+interface ConsentInput {
+    apiKeyPrefix: string;
+    /** Haven API base URL the credential will hit. */
+    apiUrl?: string;
+    /** Agent identity from the credential file, when present. */
+    agentId?: string;
+    /** Haven wallet (Safe) the agent spends from. */
+    safeAddress?: string;
+    /** Agent's delegate EOA — the local signer. */
+    delegateAddress?: string;
+    /** Chain the agent operates on. */
+    chainId?: number;
+    toolNames: readonly HavenMcpToolName[];
+    allowanceSummary: readonly {
+        token: string;
+        amount: string;
+        resetMinutes: number | null;
+    }[];
+}
+interface ConsentDecision {
+    /** True if the gate is satisfied and the server may start. */
+    ok: boolean;
+    /** Hash representing the current consent surface. */
+    hash: string;
+    /** Reason the gate accepted (or rejected) the run. */
+    reason: 'env_var_match' | 'env_var_skip' | 'ack_file_match' | 'wrote_ack_file' | 'env_var_mismatch' | 'no_acknowledgement';
+}
+interface ConsentOptions {
+    /** Path to the credential file; used to locate the sidecar `<path>.ack.json`. */
+    credentialsPath?: string;
+    /** When true, write the sidecar file with the current hash and accept. */
+    writeAck?: boolean;
+    /** Override the environment lookup (testing). */
+    env?: Record<string, string | undefined>;
+    /** Override the writable stream the consent block is printed to (testing). */
+    out?: {
+        write: (chunk: string) => unknown;
+    };
+}
+declare function computeConsentHash(input: ConsentInput): string;
+declare function renderConsentBlock(input: ConsentInput, hash: string): string;
+/** Resolve the consent gate. Does not exit the process; the caller decides. */
+declare function ensureConsent(input: ConsentInput, options?: ConsentOptions): Promise<ConsentDecision>;
+interface CredentialIdentitySeed {
+    apiKey: string;
+    apiUrl?: string;
+    agentId?: string;
+    /** Safe address from the credential file, used as a fallback. */
+    safeAddress?: string;
+    /** Delegate address from the credential file, used before live allowance metadata is available. */
+    delegateAddress?: string;
+    /** Chain from the credential file, used as a fallback. */
+    chainId?: number;
+    /** Intended agent budget from the setup flow, used before on-chain approval is visible. */
+    allowanceSummary?: readonly {
+        token: string;
+        amount: string;
+        resetMinutes: number | null;
+    }[];
+}
+/**
+ * Build the consent input from credential identity plus a live allowance
+ * lookup. The on-chain (or configured) allowance is what the operator
+ * actually cares about — that's the real spend ceiling — but we also bind
+ * the hash to the Haven wallet / delegate / chain so a credential swap
+ * cannot quietly reuse a prior sidecar acknowledgement.
+ *
+ * If `getAllowances()` fails (e.g. backend unreachable on first launch) we
+ * fall through to whatever identity fields the credential file provided,
+ * so the operator at least sees the tool list and the api-key prefix.
+ */
+declare function consentInputFromClient(haven: HavenClient, seed: CredentialIdentitySeed, toolNames: readonly HavenMcpToolName[]): Promise<ConsentInput>;
+/** Convenience: the canonical tool list registered by the server. */
+declare function registeredToolNames(): HavenMcpToolName[];
+
 interface HavenMcpServerOptions {
     credentialsPath?: string;
+    identityPath?: string;
+    signerPath?: string;
     credentials?: HavenCredentialFile;
     /**
      * When true, write the consent sidecar file (`<credentials>.ack.json`)
@@ -75,6 +196,18 @@ interface HavenMcpServerOptions {
 }
 declare function createHavenClient(options?: HavenMcpServerOptions): Promise<HavenClient>;
 declare function createHavenMcpServer(options?: HavenMcpServerOptions): Promise<McpServer>;
+/**
+ * Build an MCP server bound to the supplied Haven client.
+ *
+ * Each tool dispatch is wrapped in `haven.withRequestContext` so every
+ * Haven API request the dispatch issues carries `X-Haven-MCP-Tool: <name>`
+ * — and *only* that dispatch's requests see the header. The SDK uses an
+ * `AsyncLocalStorage` for the context, so two tool calls running
+ * concurrently cannot leak headers into each other and the backend
+ * `agent_tool_invocations` rows are always attributed to the right tool.
+ */
+declare const MCP_NAME = "@haven_ai/mcp";
+declare const MCP_VERSION = "0.1.4-alpha";
 declare function runStdioServer(options?: HavenMcpServerOptions): Promise<void>;
 
-export { type HavenCredentialFile, type HavenMcpServerOptions, type HavenMcpToolName, type ToolFailure, type ToolPayload, type ToolSuccess, createHavenClient, createHavenMcpServer, createToolHandlers, loadCredentials, runStdioServer, toolDescriptions, toolSchemas };
+export { type ConsentDecision, type ConsentInput, type ConsentOptions, type CredentialIdentitySeed, type HavenCredentialAllowance, type HavenCredentialFile, type HavenCredentialSource, type HavenMcpServerOptions, type HavenMcpToolName, MCP_NAME, MCP_VERSION, type ToolFailure, type ToolPayload, type ToolSuccess, computeConsentHash, consentInputFromClient, createHavenClient, createHavenMcpServer, createToolHandlers, ensureConsent, loadCredentials, registeredToolNames, renderConsentBlock, runStdioServer, toolDescriptions, toolSchemas };

package/dist/index.js

@@ -1,15 +1,24 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { HavenPaymentStateError, HavenSigningError, HavenApiError, AgentPaymentNextAction, HavenError, HavenClient } from '@haven_ai/sdk';
-import { readFile, mkdir, writeFile } from 'fs/promises';
+import { composeDescription, toolDescriptions as toolDescriptions$1, HavenPaymentStateError, HavenSigningError, HavenApiError, AgentPaymentNextAction, HavenError, HavenClient } from '@haven_ai/sdk';
+import { readFile, stat, mkdir, writeFile } from 'fs/promises';
 import { z } from 'zod/v3';
 import { createHash } from 'crypto';
 import { resolve, dirname } from 'path';
 
 // src/server.ts
-async function loadCredentials(path = process.env.HAVEN_CREDENTIALS) {
-  if (path) {
-    return loadCredentialsFromFile(path);
+async function loadCredentials(source = process.env.HAVEN_CREDENTIALS) {
+  if (typeof source === "string") {
+    return loadCredentialsFromFile(source);
+  }
+  if (source?.credentialsPath) {
+    return loadCredentialsFromFile(source.credentialsPath);
+  }
+  if (source?.identityPath || source?.signerPath) {
+    if (!source.identityPath || !source.signerPath) {
+      throw new Error("Haven split credentials require both --identity and --signer paths.");
+    }
+    return loadCredentialsFromSplitFiles(source.identityPath, source.signerPath);
   }
   const envCreds = loadCredentialsFromEnv();
   if (envCreds) return envCreds;
@@ -24,6 +33,7 @@ async function loadCredentialsFromFile(path) {
   } catch (err) {
     throw new Error(`Could not read Haven credentials at ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
+  await warnIfCredentialFilePermissive(path);
   let raw;
   try {
     raw = JSON.parse(rawText);
@@ -43,10 +53,57 @@ async function loadCredentialsFromFile(path) {
     delegateKey,
     agentId: stringField(raw.agent_id ?? raw.agentId),
     safeAddress: stringField(raw.safe_address ?? raw.safeAddress),
+    delegateAddress: stringField(raw.delegate_address ?? raw.delegateAddress),
+    chainId: numberField(raw.chain_id ?? raw.chainId),
+    network: stringField(raw.network),
     apiUrl: stringField(raw.api_url ?? raw.apiUrl),
+    allowanceSummary: allowanceSummaryField(raw.allowance_summary ?? raw.allowanceSummary ?? raw.agent_budget ?? raw.agentBudget),
     sourcePath: path
   };
 }
+async function loadCredentialsFromSplitFiles(identityPath, signerPath) {
+  const identity = await readJsonFile(identityPath, "Haven identity credentials");
+  const signer = await readJsonFile(signerPath, "Haven signer credentials");
+  await warnIfCredentialFilePermissive(identityPath);
+  await warnIfCredentialFilePermissive(signerPath);
+  const apiKey = stringField(identity.api_key ?? identity.apiKey);
+  const delegateKey = stringField(signer.delegate_key ?? signer.delegateKey);
+  if (!apiKey) {
+    throw new Error("Haven identity credentials are missing api_key.");
+  }
+  if (!delegateKey) {
+    throw new Error("Haven signer credentials are missing delegate_key.");
+  }
+  return {
+    apiKey,
+    delegateKey,
+    agentId: stringField(identity.agent_id ?? identity.agentId ?? signer.agent_id ?? signer.agentId),
+    safeAddress: stringField(identity.safe_address ?? identity.safeAddress ?? signer.safe_address ?? signer.safeAddress),
+    delegateAddress: stringField(signer.delegate_address ?? signer.delegateAddress ?? identity.delegate_address ?? identity.delegateAddress),
+    chainId: numberField(identity.chain_id ?? identity.chainId ?? signer.chain_id ?? signer.chainId),
+    network: stringField(identity.network ?? signer.network),
+    apiUrl: stringField(identity.api_url ?? identity.apiUrl),
+    allowanceSummary: allowanceSummaryField(
+      identity.allowance_summary ?? identity.allowanceSummary ?? identity.agent_budget ?? identity.agentBudget
+    ),
+    sourcePath: identityPath,
+    identityPath,
+    signerPath
+  };
+}
+async function readJsonFile(path, label) {
+  let rawText;
+  try {
+    rawText = await readFile(path, "utf8");
+  } catch (err) {
+    throw new Error(`Could not read ${label} at ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    return JSON.parse(rawText);
+  } catch {
+    throw new Error(`${label} must be JSON.`);
+  }
+}
 function loadCredentialsFromEnv() {
   const apiKey = stringField(process.env.HAVEN_API_KEY);
   const delegateKey = stringField(process.env.HAVEN_DELEGATE_KEY);
@@ -62,12 +119,54 @@ function loadCredentialsFromEnv() {
     delegateKey,
     agentId: stringField(process.env.HAVEN_AGENT_ID),
     safeAddress: stringField(process.env.HAVEN_SAFE_ADDRESS),
+    chainId: numberField(process.env.HAVEN_CHAIN_ID),
+    network: stringField(process.env.HAVEN_NETWORK),
     apiUrl: stringField(process.env.HAVEN_API_URL)
   };
 }
 function stringField(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
+function numberField(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  if (typeof value === "string" && value.trim() && /^\d+$/.test(value.trim())) return Number(value.trim());
+  return void 0;
+}
+function allowanceSummaryField(value) {
+  if (!Array.isArray(value)) return void 0;
+  const allowances = value.flatMap((item) => {
+    if (!item || typeof item !== "object") return [];
+    const raw = item;
+    const token = stringField(raw.token ?? raw.token_symbol ?? raw.tokenSymbol);
+    const amount = stringField(raw.amount ?? raw.allowance_amount ?? raw.allowanceAmount);
+    const reset = raw.resetMinutes ?? raw.reset_minutes ?? raw.reset_period_min ?? raw.resetPeriodMin;
+    if (!token || !amount) return [];
+    return [{
+      token,
+      amount,
+      resetMinutes: reset === null ? null : numberField(reset) ?? null
+    }];
+  });
+  return allowances.length > 0 ? allowances : void 0;
+}
+async function warnIfCredentialFilePermissive(path, log = (message) => process.stderr.write(`${message}
+`), platform = process.platform) {
+  if (platform === "win32") return;
+  let mode;
+  try {
+    const stats = await stat(path);
+    mode = stats.mode;
+  } catch {
+    return;
+  }
+  const groupOrOther = mode & 63;
+  if (groupOrOther !== 0) {
+    const octal = (mode & 511).toString(8).padStart(4, "0");
+    log(
+      `haven-mcp: warning: credential file at ${path} is readable beyond the owner (mode ${octal}). Run: chmod 600 ${path}`
+    );
+  }
+}
 var headersSchema = z.record(z.string(), z.string()).optional();
 var toolSchemas = {
   haven_quote_x402: {
@@ -114,17 +213,17 @@ var toolSchemas = {
   }
 };
 var toolDescriptions = {
-  haven_quote_x402: "Inspect an HTTP 402 x402 paid resource without creating a Haven payment, signature, approval, or on-chain transaction.",
-  haven_pay_x402_quote: "Pay a previously inspected x402 quote. The delegate key signs locally; Haven only validates and relays signed, on-chain-constrained payment transactions. If approval is needed, preserve the returned resume_state and wait for nextAction=retry_original_x402_request before resuming.",
-  haven_resume_x402_payment: "Resume an x402 payment after the Haven wallet owner approved the funding step. Accepts either resume_state or payment_id. Only use when get status returns nextAction=retry_original_x402_request; do not start a new merchant session.",
-  haven_quote_mpp: "Inspect a Haven MPP challenge or paid MPP URL without creating a Haven payment, signature, approval, or on-chain transaction.",
-  haven_pay_mpp_challenge: "Pay a previously inspected MPP challenge. The delegate key signs locally; Haven only validates and relays signed, on-chain-constrained payment transactions. If approval is needed, preserve resume_state or payment_id.",
-  haven_resume_mpp_payment: "Resume an MPP payment after the Haven wallet owner approved the funding step. Accepts either resume_state or payment_id and retries the original paid resource.",
-  haven_get_payment_status: "Fetch structured Haven payment status, including phase and nextAction taxonomy for agent recovery.",
-  haven_get_resume_state: "Rehydrate stored x402/MPP resume_state by payment_id. This returns context only; signing still happens locally when a resume tool is called.",
-  haven_get_agent: "Return the authenticated agent identity, Haven wallet, delegate address, chain, and status.",
-  haven_get_allowances: "Return configured and on-chain allowance state for the authenticated agent. On-chain allowance is the real spend gate.",
-  haven_list_receipts: "List recent machine-payment receipts/evidence for bookkeeping. Proof header values are not returned."
+  haven_quote_x402: composeDescription(toolDescriptions$1.quoteX402),
+  haven_pay_x402_quote: composeDescription(toolDescriptions$1.payX402),
+  haven_resume_x402_payment: composeDescription(toolDescriptions$1.resumeX402),
+  haven_quote_mpp: composeDescription(toolDescriptions$1.quoteMpp),
+  haven_pay_mpp_challenge: composeDescription(toolDescriptions$1.payMpp),
+  haven_resume_mpp_payment: composeDescription(toolDescriptions$1.resumeMpp),
+  haven_get_payment_status: composeDescription(toolDescriptions$1.getPaymentStatus),
+  haven_get_resume_state: composeDescription(toolDescriptions$1.getResumeState),
+  haven_get_agent: composeDescription(toolDescriptions$1.getAgent),
+  haven_get_allowances: composeDescription(toolDescriptions$1.getAllowances),
+  haven_list_receipts: composeDescription(toolDescriptions$1.listReceipts)
 };
 function createToolHandlers(haven) {
   return {
@@ -420,10 +519,10 @@ async function writeAckFile(path, hash) {
   );
 }
 async function consentInputFromClient(haven, seed, toolNames) {
-  let allowanceSummary = [];
+  let allowanceSummary = seed.allowanceSummary ?? [];
   let safeAddress = seed.safeAddress;
-  let delegateAddress;
-  let chainId;
+  let delegateAddress = seed.delegateAddress;
+  let chainId = seed.chainId;
   try {
     const summary = await haven.getAllowances();
     const list = isAllowanceSummary(summary) ? summary.allowances : Array.isArray(summary) ? summary : [];
@@ -432,11 +531,12 @@ async function consentInputFromClient(haven, seed, toolNames) {
       delegateAddress = summary.delegateAddress;
       chainId = typeof summary.chainId === "number" ? summary.chainId : chainId;
     }
-    allowanceSummary = list.map((a) => ({
+    const liveAllowanceSummary = list.map((a) => ({
       token: a.tokenSymbol ?? "UNKNOWN",
       amount: a.onchain?.amount ?? a.configuredAmount ?? "0",
       resetMinutes: typeof a.onchain?.resetTimeMin === "number" ? a.onchain.resetTimeMin : typeof a.resetPeriodMin === "number" ? a.resetPeriodMin : null
     }));
+    allowanceSummary = liveAllowanceSummary;
   } catch {
   }
   return {
@@ -466,7 +566,12 @@ async function createHavenClient(options = {}) {
   return client;
 }
 async function resolveHavenClient(options = {}) {
-  const credentials = options.credentials ?? await loadCredentials(options.credentialsPath);
+  const credentialSource = options.credentialsPath || options.identityPath || options.signerPath ? {
+    credentialsPath: options.credentialsPath,
+    identityPath: options.identityPath,
+    signerPath: options.signerPath
+  } : void 0;
+  const credentials = options.credentials ?? await loadCredentials(credentialSource);
   const client = new HavenClient({
     apiKey: credentials.apiKey,
     delegateKey: credentials.delegateKey,
@@ -478,10 +583,12 @@ async function createHavenMcpServer(options = {}) {
   const haven = await createHavenClient(options);
   return buildMcpServer(haven);
 }
+var MCP_NAME = "@haven_ai/mcp";
+var MCP_VERSION = "0.1.4-alpha";
 function buildMcpServer(haven) {
   const server = new McpServer({
-    name: "@haven_ai/mcp",
-    version: "0.1.0-alpha"
+    name: MCP_NAME,
+    version: MCP_VERSION
   });
   const handlers = createToolHandlers(haven);
   const registerTool = server.tool.bind(server);
@@ -521,11 +628,14 @@ async function runConsentGate(haven, credentials, options) {
       apiKey: credentials.apiKey,
       apiUrl: credentials.apiUrl,
       agentId: credentials.agentId,
-      safeAddress: credentials.safeAddress
+      safeAddress: credentials.safeAddress,
+      delegateAddress: credentials.delegateAddress,
+      chainId: credentials.chainId,
+      allowanceSummary: credentials.allowanceSummary
     },
     toolNames
   );
-  const credentialsPath = options.credentialsPath ?? credentials.sourcePath;
+  const credentialsPath = options.identityPath ?? options.credentialsPath ?? credentials.sourcePath;
   return ensureConsent(input, {
     credentialsPath,
     writeAck: options.writeAck
@@ -543,6 +653,6 @@ function toMcpResult(payload) {
   };
 }
 
-export { createHavenClient, createHavenMcpServer, createToolHandlers, loadCredentials, runStdioServer, toolDescriptions, toolSchemas };
+export { MCP_NAME, MCP_VERSION, computeConsentHash, consentInputFromClient, createHavenClient, createHavenMcpServer, createToolHandlers, ensureConsent, loadCredentials, registeredToolNames, renderConsentBlock, runStdioServer, toolDescriptions, toolSchemas };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map