@haven_ai/signer 0.1.17-alpha.0 → 0.1.19-alpha.0

package/dist/cli.cjs

@@ -7,11 +7,11 @@ var crypto = require('crypto');
 var promises = require('fs/promises');
 var os = require('os');
 var path = require('path');
-var sdk = require('@haven_ai/sdk');
-var v3 = require('zod/v3');
 var viem = require('viem');
 var accounts = require('viem/accounts');
 var schemes = require('x402/schemes');
+var sdk = require('@haven_ai/sdk');
+var v3 = require('zod/v3');
 
 function defaultSigningAuditPath(credentialsPath) {
   if (credentialsPath) return path.resolve(`${credentialsPath}.signer-audit.jsonl`);
@@ -46,6 +46,300 @@ function stableStringify(value) {
   const object = value;
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
 }
+function createEdgeSigner(delegateKey, options = {}) {
+  let delegateAddress;
+  try {
+    delegateAddress = sdk.addressFromKey(delegateKey);
+  } catch (err) {
+    throw new sdk.HavenSigningError(
+      `Invalid delegate key: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const x402Bindings = /* @__PURE__ */ new Map();
+  function signAndVerify(hash) {
+    const signature = sdk.signHash(delegateKey, hash);
+    if (!sdk.verifySignature(hash, signature, delegateAddress)) {
+      throw new sdk.HavenSigningError(
+        "Local signature verification failed \u2014 recovered address does not match the delegate key."
+      );
+    }
+    return signature;
+  }
+  return {
+    delegateAddress,
+    signPaymentHash(hash) {
+      return signAndVerify(hash);
+    },
+    async signDelegationTypedData(typedData) {
+      const account = accounts.privateKeyToAccount(delegateKey);
+      return account.signTypedData(typedData);
+    },
+    signX402FundingHash(hash, expected) {
+      assertExpectedBinding(hash, expected, options.x402BindingSigner, "hash");
+      const signature = signAndVerify(hash);
+      const x402Binding = crypto.randomUUID();
+      x402Bindings.set(x402Binding, { ...expected });
+      return { signature, x402Binding };
+    },
+    async signX402FundingTypedData(typedData, expected) {
+      assertExpectedBinding(expected.payloadHash, expected, options.x402BindingSigner, "typed-data");
+      const digest = viem.hashTypedData(typedData);
+      if (digest.toLowerCase() !== expected.typedDataHash?.toLowerCase()) {
+        throw new sdk.HavenSigningError(
+          "x402 typed data does not match the digest Haven committed to in the expected context. Refusing to sign \u2014 the payload was altered in transit or Haven declared a different one. The most common cause is the typed data being truncated or reshaped while being copied between tool calls (#1255): re-run the hosted quote and pass its typed_data_b64 string through UNCHANGED instead of re-emitting the nested JSON."
+        );
+      }
+      const account = accounts.privateKeyToAccount(delegateKey);
+      const signature = await account.signTypedData(
+        typedData
+      );
+      const x402Binding = crypto.randomUUID();
+      x402Bindings.set(x402Binding, { ...expected });
+      return { signature, x402Binding };
+    },
+    async buildX402PaymentHeader(paymentRequired, x402Binding) {
+      const expected = x402Bindings.get(x402Binding);
+      if (!expected) {
+        throw new sdk.HavenSigningError(
+          "x402 funding binding is required before signing a merchant header. Sign the hosted funding hash with x402_expected first."
+        );
+      }
+      try {
+        assertX402PaymentWindowOpen(expected);
+      } catch (err) {
+        x402Bindings.delete(x402Binding);
+        throw err;
+      }
+      const option = sdk.selectStandardPaymentOption(paymentRequired.accepts);
+      if (!option) {
+        throw new sdk.HavenApiError(
+          "No compatible payment option found in x402 requirements. Haven supports standard x402 exact payments on Base USDC.",
+          400
+        );
+      }
+      assertX402MatchesExpected(paymentRequired, option, expected);
+      const account = accounts.privateKeyToAccount(delegateKey);
+      const requirements = sdk.toStandardPaymentRequirements(paymentRequired, option);
+      const header = await schemes.exact.evm.createPaymentHeader(
+        account,
+        paymentRequired.x402Version,
+        requirements
+      );
+      if (paymentRequired.x402Version < 2) {
+        x402Bindings.delete(x402Binding);
+        return { paymentHeader: header, accepted: option };
+      }
+      try {
+        const payment = sdk.decodeBase64Json(header);
+        const wrapped = sdk.encodeBase64Json({
+          x402Version: paymentRequired.x402Version,
+          accepted: option,
+          payload: payment.payload
+        });
+        return { paymentHeader: wrapped, accepted: option };
+      } finally {
+        x402Bindings.delete(x402Binding);
+      }
+    },
+    async signSweepAuthorization({
+      authorization,
+      expectedAuth,
+      expectedSafe
+    }) {
+      assertSweepBinding(authorization, expectedAuth, options.x402BindingSigner);
+      if (!sameAddress(authorization.from, delegateAddress)) {
+        throw new sdk.HavenSigningError(
+          "Sweep authorization `from` does not match this delegate address."
+        );
+      }
+      if (expectedSafe && !sameAddress(authorization.to, expectedSafe)) {
+        throw new sdk.HavenSigningError(
+          "Sweep authorization `to` does not match the Safe in the local credential."
+        );
+      }
+      const typedData = sdk.buildSweepTypedData(authorization);
+      const viemTypedData = {
+        domain: {
+          ...typedData.domain,
+          verifyingContract: typedData.domain.verifyingContract
+        },
+        types: typedData.types,
+        primaryType: typedData.primaryType,
+        message: {
+          ...typedData.message,
+          from: typedData.message.from,
+          to: typedData.message.to,
+          nonce: typedData.message.nonce
+        }
+      };
+      const account = accounts.privateKeyToAccount(delegateKey);
+      const signature = await account.signTypedData(viemTypedData);
+      const recovered = await viem.recoverTypedDataAddress({ ...viemTypedData, signature });
+      if (!sameAddress(recovered, delegateAddress)) {
+        throw new sdk.HavenSigningError(
+          "Local sweep signature verification failed \u2014 recovered address does not match the delegate key."
+        );
+      }
+      return { signature };
+    }
+  };
+}
+function assertSweepBinding(authorization, expectedAuth, trustedSigner) {
+  if (!expectedAuth || typeof expectedAuth !== "object") {
+    throw new sdk.HavenSigningError("Sweep authorization binding is required before signing.");
+  }
+  if (!trustedSigner) {
+    throw new sdk.HavenSigningError(
+      "Sweep binding verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing sweep authorizations."
+    );
+  }
+  assertSupportedBindingVersion(
+    expectedAuth.version,
+    SUPPORTED_SWEEP_BINDING_VERSIONS,
+    "sweep authorization binding"
+  );
+  const message = sdk.buildSweepAuthorizationMessage(authorization);
+  if (expectedAuth.message !== message) {
+    throw new sdk.HavenSigningError("Sweep authorization binding does not match the authorization being signed.");
+  }
+  if (!sameAddress(expectedAuth.signer, trustedSigner)) {
+    throw new sdk.HavenSigningError("Sweep authorization binding was not signed by the configured Haven signer.");
+  }
+  if (!sdk.verifySignature(viem.hashMessage(message), expectedAuth.signature, trustedSigner)) {
+    throw new sdk.HavenSigningError("Sweep authorization binding signature could not be verified.");
+  }
+}
+function assertX402MatchesExpected(paymentRequired, option, expected) {
+  assertExpectedShape(expected);
+  const headerResource = option.resource ?? paymentRequired.resource.url;
+  if (headerResource !== expected.resourceUrl) {
+    throw new sdk.HavenSigningError("x402 payment_required resource does not match the funded intent.");
+  }
+  if (!sameAddress(option.payTo, expected.merchantTo)) {
+    throw new sdk.HavenSigningError("x402 merchant recipient does not match the funded intent.");
+  }
+  if (sdk.x402AuthorizationAmount(option) !== expected.amount) {
+    throw new sdk.HavenSigningError("x402 amount does not match the funded intent.");
+  }
+  if (!sameAddress(option.asset, expected.asset)) {
+    throw new sdk.HavenSigningError("x402 asset does not match the funded intent.");
+  }
+  if (option.network !== expected.network) {
+    throw new sdk.HavenSigningError("x402 network does not match the funded intent.");
+  }
+}
+function assertExpectedShape(expected) {
+  if (!expected || typeof expected !== "object") {
+    throw new sdk.HavenSigningError("x402 expected funding context is required before signing a merchant header.");
+  }
+}
+var SUPPORTED_X402_EXPECTED_VERSIONS = [1, 2];
+var SUPPORTED_SWEEP_BINDING_VERSIONS = [1];
+function assertSupportedBindingVersion(received, supported, context) {
+  if (supported.includes(received)) return;
+  const highest = Math.max(...supported);
+  const ceiling = received > highest ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 rerun the Haven connector (\`npx @haven_ai/connect@alpha\`), which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
+  throw new sdk.HavenSigningError(
+    `${ceiling} Nothing was signed. Do not rewrite the version field to a supported value: it is part of the Haven-signed binding message, so changing it invalidates the signature and would misrepresent what Haven authorised.`
+  );
+}
+function assertExpectedBinding(payloadHash, expected, trustedSigner, mode = "hash") {
+  assertExpectedShape(expected);
+  if (!trustedSigner) {
+    throw new sdk.HavenSigningError(
+      "x402 expected-context verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing x402 funding hashes."
+    );
+  }
+  if (expected.auth) {
+    assertSupportedBindingVersion(
+      expected.auth.version,
+      SUPPORTED_X402_EXPECTED_VERSIONS,
+      "x402 expected context"
+    );
+  }
+  if (expected.payloadHash.toLowerCase() !== payloadHash.toLowerCase()) {
+    throw new sdk.HavenSigningError("x402 expected context does not match the funding hash being signed.");
+  }
+  if (mode === "hash" && expected.typedDataHash) {
+    throw new sdk.HavenSigningError(
+      "This x402 funding intent commits to EIP-712 typed data, so its bare hash must not be raw-signed \u2014 the account would reject that signature on-chain. Sign sign_data.typed_data instead."
+    );
+  }
+  if (mode === "typed-data" && !expected.typedDataHash) {
+    throw new sdk.HavenSigningError(
+      "Refusing to sign typed data under an expected context that does not commit to it. Haven must return a v2 x402 expected context (with typedDataHash) for a delegation-rail intent."
+    );
+  }
+  const message = sdk.buildX402ExpectedMessage({
+    paymentId: expected.paymentId,
+    payloadHash: expected.payloadHash,
+    resourceUrl: expected.resourceUrl,
+    merchantTo: expected.merchantTo,
+    amount: expected.amount,
+    asset: expected.asset,
+    network: expected.network,
+    expiresAt: expected.expiresAt,
+    typedDataHash: expected.typedDataHash
+  });
+  const expectedVersion = expected.typedDataHash ? 2 : 1;
+  if (expected.auth?.version !== expectedVersion || expected.auth.message !== message) {
+    throw new sdk.HavenSigningError("x402 expected context authentication message is invalid.");
+  }
+  if (!sameAddress(expected.auth.signer, trustedSigner)) {
+    throw new sdk.HavenSigningError("x402 expected context was not signed by the configured Haven signer.");
+  }
+  if (!sdk.verifySignature(viem.hashMessage(message), expected.auth.signature, trustedSigner)) {
+    throw new sdk.HavenSigningError("x402 expected context signature could not be verified.");
+  }
+}
+function assertX402PaymentWindowOpen(expected) {
+  if (!expected.expiresAt) return;
+  const expiresAtMs = Date.parse(expected.expiresAt);
+  if (Number.isNaN(expiresAtMs)) {
+    throw new sdk.HavenSigningError("x402 expected context expiresAt is not a valid ISO timestamp.");
+  }
+  if (expiresAtMs <= Date.now()) {
+    throw new sdk.HavenError(
+      "The x402 payment window expired before the merchant header could be signed. Re-quote with haven_pay_mcp_tool using the same idempotency_key before trying again.",
+      sdk.AgentPaymentFailureCode.PaymentWindowExpired,
+      410,
+      expected.paymentId
+    );
+  }
+}
+function sameAddress(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
+
+// src/capabilities.ts
+var SIGNER_CAPABILITY_KEY = "haven/signer-compatibility";
+function signerCompatibility() {
+  return {
+    x402_expected_context_versions: [...SUPPORTED_X402_EXPECTED_VERSIONS],
+    sweep_binding_versions: [...SUPPORTED_SWEEP_BINDING_VERSIONS]
+  };
+}
+function signerCapabilityAdvertisement() {
+  return { experimental: { [SIGNER_CAPABILITY_KEY]: signerCompatibility() } };
+}
+function signerInstructions() {
+  const compatibility = signerCompatibility();
+  return [
+    "Haven edge signer: sign-only tools bound to the local delegate key. It performs no",
+    "network I/O and never emits the key.",
+    "",
+    "Version compatibility (check this BEFORE signing, not after):",
+    `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
+    `- sweep authorization binding versions supported: ${compatibility.sweep_binding_versions.join(", ")}`,
+    "",
+    "Haven quote and prepare results report the expected-context version they will emit",
+    "(signer_compatibility.x402_expected_context_version). If that version is not in the list",
+    "above, this signer is out of date: STOP before signing, and tell the user to update",
+    "@haven_ai/signer by rerunning `npx @haven_ai/connect@alpha`, which reinstalls the pinned",
+    "MCP runtime. Do not edit the version field to a supported value \u2014 it is part of the",
+    "Haven-signed binding message, so changing it invalidates the signature."
+  ].join("\n");
+}
 var sweepAuthorizationSchema = v3.z.object({
   from: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "from must be a 0x address"),
   to: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "to must be a 0x address"),
@@ -56,8 +350,9 @@ var sweepAuthorizationSchema = v3.z.object({
   token: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "token must be a 0x address"),
   chainId: v3.z.number().int().positive()
 });
+var bindingVersionSchema = v3.z.number().int().positive();
 var sweepExpectedAuthSchema = v3.z.object({
-  version: v3.z.literal(1),
+  version: bindingVersionSchema,
   message: v3.z.string().min(1),
   signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
   signer: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "signer must be a 0x address")
@@ -75,8 +370,13 @@ var x402ExpectedSchema = v3.z.object({
   // Omitting it used to fail downstream with a cryptic "authentication message is
   // invalid" — making it required surfaces a clear INVALID_INPUT at the boundary.
   expires_at: v3.z.string().min(1),
+  // #1138: present on a delegation-rail (v2) context. It commits to the EIP-712
+  // typed data the account validates; the signer refuses to raw-sign the bare
+  // hash when it is present, and refuses to sign typed data when it is absent.
+  typed_data_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "typed_data_hash must be a 0x-prefixed hex string").optional(),
   auth: v3.z.object({
-    version: v3.z.literal(1),
+    // Open at the boundary, enforced in the signer — see bindingVersionSchema.
+    version: bindingVersionSchema,
     message: v3.z.string().min(1),
     signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
     signer: v3.z.string().min(1)
@@ -97,7 +397,19 @@ var toolSchemas = {
     // Pass x402.expected from hosted haven_pay_x402_quote when this hash funds
     // a standard x402 merchant retry. The signer records it locally and returns
     // an opaque x402_binding for the later header-signing step.
-    x402_expected: x402ExpectedSchema.optional()
+    x402_expected: x402ExpectedSchema.optional(),
+    // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
+    // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
+    typed_data: v3.z.record(v3.z.string(), v3.z.unknown()).optional(),
+    // #1255: the same payload as ONE opaque base64 string, exactly as returned
+    // by the hosted tools. Preferred over typed_data when both are present —
+    // an agent re-emitting multi-KB nested JSON between tool calls is the
+    // failure mode this field removes (a truncated/reshaped payload fails the
+    // digest check and the payment refuses, correctly but pointlessly).
+    // Bounded: a realistic redemption payload is ~10KB encoded; 256KB is
+    // generous headroom while keeping the offline signer from materializing
+    // arbitrarily large caller input.
+    typed_data_b64: v3.z.string().min(1).max(262144).optional()
   },
   haven_x402_sign_header: {
     // The parsed HTTP 402 PaymentRequired from the merchant. Typed as an object
@@ -111,7 +423,12 @@ var toolSchemas = {
     // One-shot x402 signing: funding hash + merchant header in one local call.
     payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string"),
     x402_expected: x402ExpectedSchema,
-    payment_required: v3.z.record(v3.z.string(), v3.z.unknown())
+    payment_required: v3.z.record(v3.z.string(), v3.z.unknown()),
+    // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
+    // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
+    typed_data: v3.z.record(v3.z.string(), v3.z.unknown()).optional(),
+    // #1255: see haven_sign.typed_data_b64 — the copy-through-safe form.
+    typed_data_b64: v3.z.string().min(1).max(262144).optional()
   }
 };
 var SIGN_DESCRIPTION = [
@@ -119,7 +436,10 @@ var SIGN_DESCRIPTION = [
   "this process. Pass the payload_hash returned by haven_pay or haven_pay_x402_quote.",
   "For x402, also pass x402_expected from haven_pay_x402_quote; the signer records it locally",
   "and returns { signature, x402_binding }. x402_expected includes expires_at; sign before that",
-  "window closes. Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
+  "window closes. DELEGATION-RAIL accounts: when the hosted result carries typed_data_b64, pass that",
+  "single string through UNCHANGED (preferred \u2014 never re-type the nested typed_data JSON yourself);",
+  "the account validates that EIP-712 payload, not payload_hash, and signing is refused without it.",
+  "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. For plain SafeTransfer payments, just pass payload_hash and",
   "relay the returned signature via mcp__haven__haven_submit."
 ].join(" ");
@@ -139,7 +459,11 @@ var SIGN_X402_DESCRIPTION = [
   "X-PAYMENT header in a single local call (equivalent to haven_sign followed by",
   "haven_x402_sign_header). The delegate key never leaves this process. From the haven_pay_mcp_tool",
   "result pass payload_hash, x402_expected (the nested x402.expected object \u2014 passing the whole x402",
-  "object is also accepted and unwrapped for you), and payment_required (verbatim). Returns",
+  "object is also accepted and unwrapped for you), and payment_required (verbatim). On a",
+  "delegation-rail account the result also carries typed_data_b64 \u2014 pass that single string through",
+  "UNCHANGED (preferred over re-typing the nested typed_data JSON); the signer",
+  "signs it instead of payload_hash and refuses the bare hash when the context commits to typed data.",
+  "Returns",
   "{ signature, x402_binding, payment_header, accepted }; hand signature + payment_header to",
   "mcp__haven__haven_settle_mcp_tool to fund and settle in one hosted call. The header is built now (before",
   "funding confirms), so its short validity window starts here \u2014 call mcp__haven__haven_settle_mcp_tool promptly,",
@@ -161,10 +485,22 @@ var toolDescriptions = {
   haven_sign_x402: SIGN_X402_DESCRIPTION,
   haven_sign_sweep_delegate: SIGN_SWEEP_DELEGATE_DESCRIPTION
 };
+async function signFundingLeg(signer, expected, payloadHash, typedData) {
+  if (!expected.typedDataHash) {
+    return signer.signX402FundingHash(payloadHash, expected);
+  }
+  if (!typedData) {
+    throw new sdk.HavenSigningError(
+      "This x402 funding intent is on the delegation rail: it commits to EIP-712 typed data, which was not supplied. Pass typed_data_b64 from haven_pay_mcp_tool / haven_pay_x402_quote through unchanged (or typed_data verbatim) \u2014 the bare payload_hash is not what the account validates."
+    );
+  }
+  return signer.signX402FundingTypedData(typedData, expected);
+}
 function toExpectedX402(raw) {
   return {
     paymentId: raw.payment_id,
     payloadHash: raw.payload_hash,
+    typedDataHash: raw.typed_data_hash,
     resourceUrl: raw.resource_url,
     merchantTo: raw.merchant_to,
     amount: raw.amount,
@@ -174,13 +510,35 @@ function toExpectedX402(raw) {
     auth: raw.auth
   };
 }
+function resolveTypedData(args) {
+  if (!args.typed_data_b64) return args.typed_data;
+  try {
+    const decoded = JSON.parse(
+      Buffer.from(args.typed_data_b64, "base64").toString("utf8")
+    );
+    if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+      throw new Error("decoded value is not an object");
+    }
+    return decoded;
+  } catch (err) {
+    throw new sdk.HavenSigningError(
+      `typed_data_b64 did not decode to a JSON object. Pass the exact string returned by the hosted Haven tool, unchanged \u2014 do not re-encode, trim, or reformat it. Underlying error: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+}
 function createToolHandlers(signer, options = {}) {
   return {
     haven_sign: async (input) => runTool(async () => {
       const args = parse("haven_sign", coerceX402Expected(input));
+      const typedData = resolveTypedData(args);
       const x402Expected = args.x402_expected ? toExpectedX402(args.x402_expected) : null;
-      const result = x402Expected ? signer.signX402FundingHash(args.payload_hash, x402Expected) : null;
+      const result = x402Expected ? await signFundingLeg(signer, x402Expected, args.payload_hash, typedData) : null;
       if (!result) {
+        if (typedData) {
+          const signature2 = await signer.signDelegationTypedData(typedData);
+          await auditSigning("haven_sign", args.payload_hash);
+          return { signature: signature2 };
+        }
         const signature = signer.signPaymentHash(args.payload_hash);
         await auditSigning("haven_sign", args.payload_hash);
         return { signature };
@@ -202,7 +560,12 @@ function createToolHandlers(signer, options = {}) {
     }),
     haven_sign_x402: async (input) => runTool(async () => {
       const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
-      const funding = signer.signX402FundingHash(args.payload_hash, toExpectedX402(args.x402_expected));
+      const funding = await signFundingLeg(
+        signer,
+        toExpectedX402(args.x402_expected),
+        args.payload_hash,
+        resolveTypedData(args)
+      );
       const header = await signer.buildX402PaymentHeader(
         args.payment_required,
         funding.x402Binding
@@ -431,216 +794,6 @@ async function writeAckFile(path$1, hash) {
     "utf8"
   );
 }
-function createEdgeSigner(delegateKey, options = {}) {
-  let delegateAddress;
-  try {
-    delegateAddress = sdk.addressFromKey(delegateKey);
-  } catch (err) {
-    throw new sdk.HavenSigningError(
-      `Invalid delegate key: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-  const x402Bindings = /* @__PURE__ */ new Map();
-  function signAndVerify(hash) {
-    const signature = sdk.signHash(delegateKey, hash);
-    if (!sdk.verifySignature(hash, signature, delegateAddress)) {
-      throw new sdk.HavenSigningError(
-        "Local signature verification failed \u2014 recovered address does not match the delegate key."
-      );
-    }
-    return signature;
-  }
-  return {
-    delegateAddress,
-    signPaymentHash(hash) {
-      return signAndVerify(hash);
-    },
-    signX402FundingHash(hash, expected) {
-      assertExpectedBinding(hash, expected, options.x402BindingSigner);
-      const signature = signAndVerify(hash);
-      const x402Binding = crypto.randomUUID();
-      x402Bindings.set(x402Binding, { ...expected });
-      return { signature, x402Binding };
-    },
-    async buildX402PaymentHeader(paymentRequired, x402Binding) {
-      const expected = x402Bindings.get(x402Binding);
-      if (!expected) {
-        throw new sdk.HavenSigningError(
-          "x402 funding binding is required before signing a merchant header. Sign the hosted funding hash with x402_expected first."
-        );
-      }
-      try {
-        assertX402PaymentWindowOpen(expected);
-      } catch (err) {
-        x402Bindings.delete(x402Binding);
-        throw err;
-      }
-      const option = sdk.selectStandardPaymentOption(paymentRequired.accepts);
-      if (!option) {
-        throw new sdk.HavenApiError(
-          "No compatible payment option found in x402 requirements. Haven supports standard x402 exact payments on Base USDC.",
-          400
-        );
-      }
-      assertX402MatchesExpected(paymentRequired, option, expected);
-      const account = accounts.privateKeyToAccount(delegateKey);
-      const requirements = sdk.toStandardPaymentRequirements(paymentRequired, option);
-      const header = await schemes.exact.evm.createPaymentHeader(
-        account,
-        paymentRequired.x402Version,
-        requirements
-      );
-      if (paymentRequired.x402Version < 2) {
-        x402Bindings.delete(x402Binding);
-        return { paymentHeader: header, accepted: option };
-      }
-      try {
-        const payment = sdk.decodeBase64Json(header);
-        const wrapped = sdk.encodeBase64Json({
-          x402Version: paymentRequired.x402Version,
-          accepted: option,
-          payload: payment.payload
-        });
-        return { paymentHeader: wrapped, accepted: option };
-      } finally {
-        x402Bindings.delete(x402Binding);
-      }
-    },
-    async signSweepAuthorization({
-      authorization,
-      expectedAuth,
-      expectedSafe
-    }) {
-      assertSweepBinding(authorization, expectedAuth, options.x402BindingSigner);
-      if (!sameAddress(authorization.from, delegateAddress)) {
-        throw new sdk.HavenSigningError(
-          "Sweep authorization `from` does not match this delegate address."
-        );
-      }
-      if (expectedSafe && !sameAddress(authorization.to, expectedSafe)) {
-        throw new sdk.HavenSigningError(
-          "Sweep authorization `to` does not match the Safe in the local credential."
-        );
-      }
-      const typedData = sdk.buildSweepTypedData(authorization);
-      const viemTypedData = {
-        domain: {
-          ...typedData.domain,
-          verifyingContract: typedData.domain.verifyingContract
-        },
-        types: typedData.types,
-        primaryType: typedData.primaryType,
-        message: {
-          ...typedData.message,
-          from: typedData.message.from,
-          to: typedData.message.to,
-          nonce: typedData.message.nonce
-        }
-      };
-      const account = accounts.privateKeyToAccount(delegateKey);
-      const signature = await account.signTypedData(viemTypedData);
-      const recovered = await viem.recoverTypedDataAddress({ ...viemTypedData, signature });
-      if (!sameAddress(recovered, delegateAddress)) {
-        throw new sdk.HavenSigningError(
-          "Local sweep signature verification failed \u2014 recovered address does not match the delegate key."
-        );
-      }
-      return { signature };
-    }
-  };
-}
-function assertSweepBinding(authorization, expectedAuth, trustedSigner) {
-  if (!expectedAuth || typeof expectedAuth !== "object") {
-    throw new sdk.HavenSigningError("Sweep authorization binding is required before signing.");
-  }
-  if (!trustedSigner) {
-    throw new sdk.HavenSigningError(
-      "Sweep binding verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing sweep authorizations."
-    );
-  }
-  const message = sdk.buildSweepAuthorizationMessage(authorization);
-  if (expectedAuth.version !== 1 || expectedAuth.message !== message) {
-    throw new sdk.HavenSigningError("Sweep authorization binding does not match the authorization being signed.");
-  }
-  if (!sameAddress(expectedAuth.signer, trustedSigner)) {
-    throw new sdk.HavenSigningError("Sweep authorization binding was not signed by the configured Haven signer.");
-  }
-  if (!sdk.verifySignature(viem.hashMessage(message), expectedAuth.signature, trustedSigner)) {
-    throw new sdk.HavenSigningError("Sweep authorization binding signature could not be verified.");
-  }
-}
-function assertX402MatchesExpected(paymentRequired, option, expected) {
-  assertExpectedShape(expected);
-  const headerResource = option.resource ?? paymentRequired.resource.url;
-  if (headerResource !== expected.resourceUrl) {
-    throw new sdk.HavenSigningError("x402 payment_required resource does not match the funded intent.");
-  }
-  if (!sameAddress(option.payTo, expected.merchantTo)) {
-    throw new sdk.HavenSigningError("x402 merchant recipient does not match the funded intent.");
-  }
-  if (sdk.x402AuthorizationAmount(option) !== expected.amount) {
-    throw new sdk.HavenSigningError("x402 amount does not match the funded intent.");
-  }
-  if (!sameAddress(option.asset, expected.asset)) {
-    throw new sdk.HavenSigningError("x402 asset does not match the funded intent.");
-  }
-  if (option.network !== expected.network) {
-    throw new sdk.HavenSigningError("x402 network does not match the funded intent.");
-  }
-}
-function assertExpectedShape(expected) {
-  if (!expected || typeof expected !== "object") {
-    throw new sdk.HavenSigningError("x402 expected funding context is required before signing a merchant header.");
-  }
-}
-function assertExpectedBinding(payloadHash, expected, trustedSigner) {
-  assertExpectedShape(expected);
-  if (!trustedSigner) {
-    throw new sdk.HavenSigningError(
-      "x402 expected-context verifier is not configured. Set HAVEN_X402_BINDING_SIGNER before signing x402 funding hashes."
-    );
-  }
-  if (expected.payloadHash.toLowerCase() !== payloadHash.toLowerCase()) {
-    throw new sdk.HavenSigningError("x402 expected context does not match the funding hash being signed.");
-  }
-  const message = sdk.buildX402ExpectedMessage({
-    paymentId: expected.paymentId,
-    payloadHash: expected.payloadHash,
-    resourceUrl: expected.resourceUrl,
-    merchantTo: expected.merchantTo,
-    amount: expected.amount,
-    asset: expected.asset,
-    network: expected.network,
-    expiresAt: expected.expiresAt
-  });
-  if (expected.auth?.version !== 1 || expected.auth.message !== message) {
-    throw new sdk.HavenSigningError("x402 expected context authentication message is invalid.");
-  }
-  if (!sameAddress(expected.auth.signer, trustedSigner)) {
-    throw new sdk.HavenSigningError("x402 expected context was not signed by the configured Haven signer.");
-  }
-  if (!sdk.verifySignature(viem.hashMessage(message), expected.auth.signature, trustedSigner)) {
-    throw new sdk.HavenSigningError("x402 expected context signature could not be verified.");
-  }
-}
-function assertX402PaymentWindowOpen(expected) {
-  if (!expected.expiresAt) return;
-  const expiresAtMs = Date.parse(expected.expiresAt);
-  if (Number.isNaN(expiresAtMs)) {
-    throw new sdk.HavenSigningError("x402 expected context expiresAt is not a valid ISO timestamp.");
-  }
-  if (expiresAtMs <= Date.now()) {
-    throw new sdk.HavenError(
-      "The x402 payment window expired before the merchant header could be signed. Re-quote with haven_pay_mcp_tool using the same idempotency_key before trying again.",
-      sdk.AgentPaymentFailureCode.PaymentWindowExpired,
-      410,
-      expected.paymentId
-    );
-  }
-}
-function sameAddress(a, b) {
-  return a.toLowerCase() === b.toLowerCase();
-}
 async function loadSignerCredentials(path = process.env.HAVEN_CREDENTIALS) {
   if (path) return loadFromFile(path);
   const envKey = stringField(process.env.HAVEN_DELEGATE_KEY);
@@ -731,8 +884,9 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.17-alpha.0";
+var SIGNER_VERSION = "0.1.19-alpha.0";
 async function resolveSignerRuntime(options = {}) {
+  assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {
     return {
       signer: createEdgeSigner(options.delegateKey, {
@@ -749,7 +903,13 @@ async function resolveSignerRuntime(options = {}) {
   };
 }
 function buildSignerMcpServer(signer, options = {}) {
-  const server = new mcp_js.McpServer({ name: SIGNER_NAME, version: SIGNER_VERSION });
+  const server = new mcp_js.McpServer(
+    { name: SIGNER_NAME, version: SIGNER_VERSION },
+    {
+      capabilities: signerCapabilityAdvertisement(),
+      instructions: signerInstructions()
+    }
+  );
   const credentialsPath = options.credentials?.sourcePath;
   const handlers = createToolHandlers(signer, {
     audit: {
@@ -770,6 +930,14 @@ function buildSignerMcpServer(signer, options = {}) {
   }
   return server;
 }
+function assertSupportedNodeVersion(nodeVersion = process.versions.node) {
+  if (sdk.isSupportedNodeVersion(nodeVersion)) return;
+  const err = new Error(
+    sdk.unsupportedNodeVersionMessage({ subject: "The Haven signer", nodeVersion })
+  );
+  err.code = "HAVEN_SIGNER_UNSUPPORTED_NODE";
+  throw err;
+}
 async function runSignerStdioServer(options = {}) {
   const { signer, credentials } = await resolveSignerRuntime(options);
   if (!options.skipConsent) {