@haven_ai/signer 0.0.0-dev.202609242134.f497e3b → 0.0.0-dev.202609250737.3bd5a51

package/README.md

@@ -61,7 +61,7 @@ It exposes four stdio MCP tools, all sign-only:
 
 | Tool | Does | Emits |
 |---|---|---|
-| `haven_sign` | Sign one payment. Preferred form is `{ payment_id }` alone — the signer fetches the exact payload itself. Signs only Haven-prepared payloads (#3272): a direct-payment `PackedUserOperation` from this signer's own delegate account whose only call redeems a delegation made to that account, an erc7710 settlement child or EIP-3009 funding leg against a Haven-signed context (which it records and binds); other typed data is refused (`TYPED_DATA_NOT_ALLOWED`) | `{ signature }` or `{ signature, x402_binding }` |
+| `haven_sign` | Sign one payment. Preferred form is `{ payment_id }` alone — the signer fetches the exact payload itself. Signs only Haven-prepared payloads (#3272, #3281): a direct-payment `PackedUserOperation` from this signer's own delegate account whose only call redeems a delegation made to that account, or — against a Haven-signed context, which it records and binds — an EIP-3009 funding leg of that same shape paying this signer's own delegate EOA, or an erc7710 settlement child from this signer's own account; other typed data is refused (`TYPED_DATA_NOT_ALLOWED`) | `{ signature }` or `{ signature, x402_binding }` |
 | `haven_sign_x402` | One-shot x402: funding signature **and** the merchant header in a single local call (`haven_sign` + `haven_x402_sign_header`). `{ payment_id }` alone is the preferred call | `{ signature, x402_binding, payment_header, accepted }` |
 | `haven_x402_sign_header` | Build + sign the EIP-3009 merchant payment header, only when the fresh merchant `payment_required` matches the recorded `x402_binding` | `{ payment_header, accepted }` |
 | `haven_sign_sweep_delegate` | Sign a Haven-prepared gasless EIP-3009 sweep that recovers stranded funds from the delegate wallet back to your own account. Never broadcasts | `{ signature }` |
@@ -105,8 +105,11 @@ it signs whatever typed data it is handed. The allowlist lives in the MCP tool
 layer: `haven_sign` signs typed data only when it is a bound direct-payment
 `PackedUserOperation` (below) or an x402 payload against a Haven-signed context,
 refuses anything else with `TYPED_DATA_NOT_ALLOWED`, and answers a bare
-`payload_hash` with `BARE_HASH_REFUSED`. An embedder that calls the core
-directly owns that check itself.
+`payload_hash` with `BARE_HASH_REFUSED`. An embedder that calls
+`signDelegationTypedData` directly owns that check itself. The core's
+`signX402FundingTypedData` is not a verbatim primitive: since #3281 it runs
+the x402 shape checks itself (a guarded funding leg or a verified settlement
+child only), whoever calls it.
 
 **The unbound-branch allowlist (#3272).** Without an x402 context, `haven_sign`
 signs typed data only when ALL of these hold; otherwise it refuses, with no
@@ -144,9 +147,13 @@ operation, never that Haven prepared it — provenance is `payment_id` (below).
 It runs whether the typed data arrived as a tool argument or by the
 `payment_id` fetch; a fetched direct context that is not a
 `PackedUserOperation` at all is refused by the same check. The x402 EIP-3009
-bridge's funding leg keeps its own digest check against the Haven-signed
-expected context in this signer (the SDK's `signForData` runs this binding
-check there too). The check exists because this typed data is
+bridge's funding leg is checked against the Haven-signed expected context AND,
+since #3281, by this same binding check against the declared UserOp hash, the
+direct-payment allowlist and a recipient pin (a transfer of the quoted amount
+to this signer's own delegate EOA). A settlement child must be re-delegated
+from this signer's own account, never a ROOT grant. Anything else on the x402
+arm is `TYPED_DATA_NOT_ALLOWED`, however validly Haven's binding key declared
+it. The check exists because this typed data is
 multi-KB and can reach the signer through a language model relaying it by
 hand: one corrupted character used to produce a valid-looking signature over
 the wrong digest, surfacing only as an opaque `AA24 signature error` from the
@@ -431,7 +438,10 @@ audit write (disk full, read-only, two appends racing at the bound) is
 reported on stderr and never fails the signing call that already produced
 its signature — so the consent block's
 "appended for every signing operation" is a best-effort promise since #3172,
-kept unchanged in text because editing it moves the consent hash. The
+kept unchanged in text (editing consent copy does NOT move the consent hash —
+that covers identity, tool names and the surface version, as the consent
+screen section above already says; #3279 rewords the block without
+re-prompting anyone). The
 credential check itself is unchanged in wording and still judges a symlinked
 credential by its target. The
 `payload_hash` argument itself is bounded on the tool schema to a 32-byte hash

package/dist/cli.cjs

@@ -619,12 +619,13 @@ var SIGN_X402_DESCRIPTION = [
 ].join(" ");
 var SIGN_SWEEP_DELEGATE_DESCRIPTION = [
   "Sign a Haven-prepared gasless USDC sweep that recovers stranded funds from the delegate",
-  "wallet back to your Haven wallet. The delegate key never leaves this process and this tool",
-  "never broadcasts \u2014 it returns only an EIP-3009 signature that Haven's relayer submits and",
+  "wallet back to the agent's account (Haven wallet). The delegate key never leaves this process and this",
+  "tool never broadcasts \u2014 it returns only an EIP-3009 signature that Haven's relayer submits and",
   "pays gas for. Pass the authorization and expected_auth returned by the hosted",
-  "haven_sweep_delegate tool. The signer verifies Haven authored the authorization and that it",
-  "pays out to your own Safe before signing, then returns { signature } to hand back to",
-  "mcp__haven__haven_sweep_delegate to complete recovery."
+  "haven_sweep_delegate tool. The signer verifies Haven authored the authorization; the",
+  "destination is checked against the agent's account (Haven wallet) from the local credential",
+  "when the credential carries one, and otherwise rests on Haven's binding signature. Then it",
+  "returns { signature } to hand back to mcp__haven__haven_sweep_delegate to complete recovery."
 ].join(" ");
 var toolDescriptions = {
   haven_sign: SIGN_DESCRIPTION,
@@ -633,7 +634,17 @@ var toolDescriptions = {
   haven_sign_sweep_delegate: SIGN_SWEEP_DELEGATE_DESCRIPTION
 };
 async function signFundingLeg(signer, expected, typedData) {
-  return signer.signX402FundingTypedData(typedData, expected);
+  try {
+    return await signer.signX402FundingTypedData(typedData, expected);
+  } catch (err) {
+    if (err instanceof edge.HavenTypedDataRefusedError && !(err instanceof HavenTypedDataNotAllowedError)) {
+      throw new HavenTypedDataNotAllowedError(err.message);
+    }
+    if (err instanceof edge.HavenUserOpBindingError) {
+      throw new HavenUserOpBindingRefusedError(err.message);
+    }
+    throw err;
+  }
 }
 function toExpectedX402(raw) {
   return {
@@ -809,7 +820,8 @@ function createToolHandlers(signer, options = {}) {
       const result = await signer.signSweepAuthorization({
         authorization: args.authorization,
         expectedAuth: args.expected_auth,
-        // Cross-check `to` against the Safe in the local credential when present.
+        // Cross-check `to` against the agent's account (Haven wallet) from the
+        // local credential, when the credential carries one.
         expectedSafe: options.audit?.accountAddress
       });
       await auditSigning(
@@ -1028,8 +1040,8 @@ function renderSignerConsentBlock(input, hash) {
   lines.push("payload from Haven, authenticated with the agent credential stored next to");
   lines.push("this signer's key file - it never sends the key, a signature, or anything");
   lines.push("else outbound, and it cannot show a live allowance summary.");
-  lines.push("On-chain Safe rules remain the real spend gate, and the wallet owner can");
-  lines.push("pause or revoke agent authority outside this signer.");
+  lines.push("The agent's signed budget delegation is the real spend gate, and the wallet");
+  lines.push("owner can pause or revoke agent authority outside this signer.");
   lines.push("");
   lines.push("Tools this signer will expose to your agent runtime (one line each; the");
   lines.push("full agent-facing descriptions are what the runtime sees):");
@@ -1220,7 +1232,7 @@ function createEdgeSigner(delegateKey, options = {}) {
             `Refusing to sign the x402 settlement child: this signer cannot map the network '${expected.network}' to a chain id, so it cannot check which chain the child is scoped to. Update @haven_ai/signer.`
           );
         }
-        edge.verifySettlementChild(typedData, {
+        edge.assertOwnSettlementChild(typedData, {
           merchantTo: expected.merchantTo,
           amount: expected.amount,
           asset: expected.asset,
@@ -1230,7 +1242,21 @@ function createEdgeSigner(delegateKey, options = {}) {
           // signed another" class this file exists to catch (#1455 review).
           chainId: settlementChainId,
           expiresAt: expected.expiresAt
+        }, delegateAddress);
+      } else if (edge.isPackedUserOperationTypedData(typedData)) {
+        edge.assertUserOpTypedDataBinding(typedData, expected.payloadHash);
+        edge.assertBoundDirectPaymentUserOp(typedData, delegateAddress);
+        edge.assertFundingLegPaysDelegate(typedData, {
+          delegateAddress,
+          asset: expected.asset,
+          amount: expected.amount
         });
+      } else {
+        throw new edge.HavenTypedDataRefusedError(
+          `This signer's x402 arm signs only a funding-leg PackedUserOperation or an erc7710 settlement Delegation; this typed data is '${String(
+            typedData.primaryType
+          )}'. Refusing, even though its digest is bound by the expected context.`
+        );
       }
       const account = accounts.privateKeyToAccount(delegateKey);
       const signature = await account.signTypedData(
@@ -1314,7 +1340,7 @@ function createEdgeSigner(delegateKey, options = {}) {
       }
       if (expectedSafe && !sameAddress(authorization.to, expectedSafe)) {
         throw new edge.HavenSigningError(
-          "Sweep authorization `to` does not match the Safe in the local credential."
+          "Sweep authorization `to` does not match the agent's account (Haven wallet) in the local credential."
         );
       }
       const typedData = edge.buildSweepTypedData(authorization);
@@ -1637,7 +1663,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.0.0-dev.202609242134.f497e3b";
+var SIGNER_VERSION = "0.0.0-dev.202609250737.3bd5a51";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {