@haven_ai/signer 0.1.17-alpha.0 → 0.1.18-alpha.0

package/dist/cli.cjs

@@ -56,8 +56,9 @@ var sweepAuthorizationSchema = v3.z.object({
   token: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "token must be a 0x address"),
   chainId: v3.z.number().int().positive()
 });
+var bindingVersionSchema = v3.z.number().int().positive();
 var sweepExpectedAuthSchema = v3.z.object({
-  version: v3.z.literal(1),
+  version: bindingVersionSchema,
   message: v3.z.string().min(1),
   signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
   signer: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "signer must be a 0x address")
@@ -75,8 +76,13 @@ var x402ExpectedSchema = v3.z.object({
   // Omitting it used to fail downstream with a cryptic "authentication message is
   // invalid" — making it required surfaces a clear INVALID_INPUT at the boundary.
   expires_at: v3.z.string().min(1),
+  // #1138: present on a delegation-rail (v2) context. It commits to the EIP-712
+  // typed data the account validates; the signer refuses to raw-sign the bare
+  // hash when it is present, and refuses to sign typed data when it is absent.
+  typed_data_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "typed_data_hash must be a 0x-prefixed hex string").optional(),
   auth: v3.z.object({
-    version: v3.z.literal(1),
+    // Open at the boundary, enforced in the signer — see bindingVersionSchema.
+    version: bindingVersionSchema,
     message: v3.z.string().min(1),
     signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
     signer: v3.z.string().min(1)
@@ -97,7 +103,10 @@ var toolSchemas = {
     // Pass x402.expected from hosted haven_pay_x402_quote when this hash funds
     // a standard x402 merchant retry. The signer records it locally and returns
     // an opaque x402_binding for the later header-signing step.
-    x402_expected: x402ExpectedSchema.optional()
+    x402_expected: x402ExpectedSchema.optional(),
+    // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
+    // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
+    typed_data: v3.z.record(v3.z.string(), v3.z.unknown()).optional()
   },
   haven_x402_sign_header: {
     // The parsed HTTP 402 PaymentRequired from the merchant. Typed as an object
@@ -111,7 +120,10 @@ var toolSchemas = {
     // One-shot x402 signing: funding hash + merchant header in one local call.
     payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string"),
     x402_expected: x402ExpectedSchema,
-    payment_required: v3.z.record(v3.z.string(), v3.z.unknown())
+    payment_required: v3.z.record(v3.z.string(), v3.z.unknown()),
+    // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
+    // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
+    typed_data: v3.z.record(v3.z.string(), v3.z.unknown()).optional()
   }
 };
 var SIGN_DESCRIPTION = [
@@ -119,7 +131,9 @@ var SIGN_DESCRIPTION = [
   "this process. Pass the payload_hash returned by haven_pay or haven_pay_x402_quote.",
   "For x402, also pass x402_expected from haven_pay_x402_quote; the signer records it locally",
   "and returns { signature, x402_binding }. x402_expected includes expires_at; sign before that",
-  "window closes. Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
+  "window closes. DELEGATION-RAIL accounts: when the hosted result carries typed_data, pass it too \u2014",
+  "the account validates that EIP-712 payload, not payload_hash, and signing is refused without it.",
+  "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. For plain SafeTransfer payments, just pass payload_hash and",
   "relay the returned signature via mcp__haven__haven_submit."
 ].join(" ");
@@ -139,7 +153,10 @@ var SIGN_X402_DESCRIPTION = [
   "X-PAYMENT header in a single local call (equivalent to haven_sign followed by",
   "haven_x402_sign_header). The delegate key never leaves this process. From the haven_pay_mcp_tool",
   "result pass payload_hash, x402_expected (the nested x402.expected object \u2014 passing the whole x402",
-  "object is also accepted and unwrapped for you), and payment_required (verbatim). Returns",
+  "object is also accepted and unwrapped for you), and payment_required (verbatim). On a",
+  "delegation-rail account the result also carries typed_data \u2014 pass that verbatim too; the signer",
+  "signs it instead of payload_hash and refuses the bare hash when the context commits to typed data.",
+  "Returns",
   "{ signature, x402_binding, payment_header, accepted }; hand signature + payment_header to",
   "mcp__haven__haven_settle_mcp_tool to fund and settle in one hosted call. The header is built now (before",
   "funding confirms), so its short validity window starts here \u2014 call mcp__haven__haven_settle_mcp_tool promptly,",
@@ -161,10 +178,22 @@ var toolDescriptions = {
   haven_sign_x402: SIGN_X402_DESCRIPTION,
   haven_sign_sweep_delegate: SIGN_SWEEP_DELEGATE_DESCRIPTION
 };
+async function signFundingLeg(signer, expected, payloadHash, typedData) {
+  if (!expected.typedDataHash) {
+    return signer.signX402FundingHash(payloadHash, expected);
+  }
+  if (!typedData) {
+    throw new sdk.HavenSigningError(
+      "This x402 funding intent is on the delegation rail: it commits to EIP-712 typed data, which was not supplied. Pass sign_data.typed_data from haven_pay_mcp_tool / haven_pay_x402_quote verbatim \u2014 the bare payload_hash is not what the account validates."
+    );
+  }
+  return signer.signX402FundingTypedData(typedData, expected);
+}
 function toExpectedX402(raw) {
   return {
     paymentId: raw.payment_id,
     payloadHash: raw.payload_hash,
+    typedDataHash: raw.typed_data_hash,
     resourceUrl: raw.resource_url,
     merchantTo: raw.merchant_to,
     amount: raw.amount,
@@ -179,7 +208,7 @@ function createToolHandlers(signer, options = {}) {
     haven_sign: async (input) => runTool(async () => {
       const args = parse("haven_sign", coerceX402Expected(input));
       const x402Expected = args.x402_expected ? toExpectedX402(args.x402_expected) : null;
-      const result = x402Expected ? signer.signX402FundingHash(args.payload_hash, x402Expected) : null;
+      const result = x402Expected ? await signFundingLeg(signer, x402Expected, args.payload_hash, args.typed_data) : null;
       if (!result) {
         const signature = signer.signPaymentHash(args.payload_hash);
         await auditSigning("haven_sign", args.payload_hash);
@@ -202,7 +231,12 @@ function createToolHandlers(signer, options = {}) {
     }),
     haven_sign_x402: async (input) => runTool(async () => {
       const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
-      const funding = signer.signX402FundingHash(args.payload_hash, toExpectedX402(args.x402_expected));
+      const funding = await signFundingLeg(
+        signer,
+        toExpectedX402(args.x402_expected),
+        args.payload_hash,
+        args.typed_data
+      );
       const header = await signer.buildX402PaymentHeader(
         args.payment_required,
         funding.x402Binding
@@ -456,12 +490,28 @@ function createEdgeSigner(delegateKey, options = {}) {
       return signAndVerify(hash);
     },
     signX402FundingHash(hash, expected) {
-      assertExpectedBinding(hash, expected, options.x402BindingSigner);
+      assertExpectedBinding(hash, expected, options.x402BindingSigner, "hash");
       const signature = signAndVerify(hash);
       const x402Binding = crypto.randomUUID();
       x402Bindings.set(x402Binding, { ...expected });
       return { signature, x402Binding };
     },
+    async signX402FundingTypedData(typedData, expected) {
+      assertExpectedBinding(expected.payloadHash, expected, options.x402BindingSigner, "typed-data");
+      const digest = viem.hashTypedData(typedData);
+      if (digest.toLowerCase() !== expected.typedDataHash?.toLowerCase()) {
+        throw new sdk.HavenSigningError(
+          "x402 typed data does not match the digest Haven committed to in the expected context. Refusing to sign \u2014 the payload was altered in transit or Haven declared a different one."
+        );
+      }
+      const account = accounts.privateKeyToAccount(delegateKey);
+      const signature = await account.signTypedData(
+        typedData
+      );
+      const x402Binding = crypto.randomUUID();
+      x402Bindings.set(x402Binding, { ...expected });
+      return { signature, x402Binding };
+    },
     async buildX402PaymentHeader(paymentRequired, x402Binding) {
       const expected = x402Bindings.get(x402Binding);
       if (!expected) {
@@ -558,8 +608,13 @@ function assertSweepBinding(authorization, expectedAuth, trustedSigner) {
       "Sweep binding verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing sweep authorizations."
     );
   }
+  assertSupportedBindingVersion(
+    expectedAuth.version,
+    SUPPORTED_SWEEP_BINDING_VERSIONS,
+    "sweep authorization binding"
+  );
   const message = sdk.buildSweepAuthorizationMessage(authorization);
-  if (expectedAuth.version !== 1 || expectedAuth.message !== message) {
+  if (expectedAuth.message !== message) {
     throw new sdk.HavenSigningError("Sweep authorization binding does not match the authorization being signed.");
   }
   if (!sameAddress(expectedAuth.signer, trustedSigner)) {
@@ -593,16 +648,43 @@ function assertExpectedShape(expected) {
     throw new sdk.HavenSigningError("x402 expected funding context is required before signing a merchant header.");
   }
 }
-function assertExpectedBinding(payloadHash, expected, trustedSigner) {
+var SUPPORTED_X402_EXPECTED_VERSIONS = [1, 2];
+var SUPPORTED_SWEEP_BINDING_VERSIONS = [1];
+function assertSupportedBindingVersion(received, supported, context) {
+  if (supported.includes(received)) return;
+  const highest = Math.max(...supported);
+  const ceiling = received > highest ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 rerun the Haven connector (\`npx @haven_ai/connect@alpha\`), which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
+  throw new sdk.HavenSigningError(
+    `${ceiling} Nothing was signed. Do not rewrite the version field to a supported value: it is part of the Haven-signed binding message, so changing it invalidates the signature and would misrepresent what Haven authorised.`
+  );
+}
+function assertExpectedBinding(payloadHash, expected, trustedSigner, mode = "hash") {
   assertExpectedShape(expected);
   if (!trustedSigner) {
     throw new sdk.HavenSigningError(
       "x402 expected-context verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing x402 funding hashes."
     );
   }
+  if (expected.auth) {
+    assertSupportedBindingVersion(
+      expected.auth.version,
+      SUPPORTED_X402_EXPECTED_VERSIONS,
+      "x402 expected context"
+    );
+  }
   if (expected.payloadHash.toLowerCase() !== payloadHash.toLowerCase()) {
     throw new sdk.HavenSigningError("x402 expected context does not match the funding hash being signed.");
   }
+  if (mode === "hash" && expected.typedDataHash) {
+    throw new sdk.HavenSigningError(
+      "This x402 funding intent commits to EIP-712 typed data, so its bare hash must not be raw-signed \u2014 the account would reject that signature on-chain. Sign sign_data.typed_data instead."
+    );
+  }
+  if (mode === "typed-data" && !expected.typedDataHash) {
+    throw new sdk.HavenSigningError(
+      "Refusing to sign typed data under an expected context that does not commit to it. Haven must return a v2 x402 expected context (with typedDataHash) for a delegation-rail intent."
+    );
+  }
   const message = sdk.buildX402ExpectedMessage({
     paymentId: expected.paymentId,
     payloadHash: expected.payloadHash,
@@ -611,9 +693,11 @@ function assertExpectedBinding(payloadHash, expected, trustedSigner) {
     amount: expected.amount,
     asset: expected.asset,
     network: expected.network,
-    expiresAt: expected.expiresAt
+    expiresAt: expected.expiresAt,
+    typedDataHash: expected.typedDataHash
   });
-  if (expected.auth?.version !== 1 || expected.auth.message !== message) {
+  const expectedVersion = expected.typedDataHash ? 2 : 1;
+  if (expected.auth?.version !== expectedVersion || expected.auth.message !== message) {
     throw new sdk.HavenSigningError("x402 expected context authentication message is invalid.");
   }
   if (!sameAddress(expected.auth.signer, trustedSigner)) {
@@ -731,7 +815,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.17-alpha.0";
+var SIGNER_VERSION = "0.1.18-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   if (options.delegateKey) {
     return {