@haven_ai/signer 0.1.19-alpha.0 → 0.1.21-alpha.0

package/dist/cli.cjs

@@ -325,8 +325,10 @@ function signerCapabilityAdvertisement() {
 function signerInstructions() {
   const compatibility = signerCompatibility();
   return [
-    "Haven edge signer: sign-only tools bound to the local delegate key. It performs no",
-    "network I/O and never emits the key.",
+    "Haven edge signer: sign-only tools bound to the local delegate key. It never emits the",
+    "key. Its one network capability is an authenticated READ of a signing context from",
+    "Haven by payment_id \u2014 pass payment_id to haven_sign / haven_sign_x402 (preferred for",
+    "delegation-rail x402) instead of relaying bulky typed-data payloads yourself.",
     "",
     "Version compatibility (check this BEFORE signing, not after):",
     `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
@@ -340,6 +342,55 @@ function signerInstructions() {
     "Haven-signed binding message, so changing it invalidates the signature."
   ].join("\n");
 }
+async function loadHavenIdentity(credentialsPath) {
+  if (!credentialsPath) return null;
+  try {
+    const raw = JSON.parse(
+      await promises.readFile(path.join(path.dirname(credentialsPath), "identity.json"), "utf8")
+    );
+    const apiKey = typeof raw.api_key === "string" ? raw.api_key : void 0;
+    const apiUrl = typeof raw.api_url === "string" ? raw.api_url : void 0;
+    if (!apiKey || !apiUrl) return null;
+    return { apiKey, apiUrl: apiUrl.replace(/\/+$/, "") };
+  } catch {
+    return null;
+  }
+}
+async function fetchX402SignContext(identity, paymentId, fetchImpl = fetch) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/x402/${encodeURIComponent(paymentId)}/sign-context`,
+      { headers: { Authorization: `Bearer ${identity.apiKey}` } }
+    );
+  } catch (err) {
+    throw new sdk.HavenSigningError(
+      `Could not reach Haven to fetch the signing context for ${paymentId}: ${err instanceof Error ? err.message : String(err)}. Retry, or pass typed_data_b64 from the quote result instead.`
+    );
+  }
+  const body = await response.json().catch(() => ({}));
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new sdk.HavenSigningError(
+      `Haven refused the signing-context fetch for ${paymentId}: ${detail}` + (response.status === 404 ? " \u2014 check the payment_id came from this agent\u2019s own quote." : response.status === 410 ? " Re-run the quote with the same idempotency key, then sign the fresh payment_id." : "")
+    );
+  }
+  const signData = body.sign_data;
+  const x402Expected = body.x402_expected;
+  if (!signData || typeof signData.hash !== "string" || !signData.typed_data || typeof signData.typed_data !== "object" || !x402Expected) {
+    throw new sdk.HavenSigningError(
+      "The Haven sign-context response is missing sign_data.typed_data or x402_expected \u2014 the backend may predate #1263. Pass typed_data_b64 from the quote result instead."
+    );
+  }
+  return {
+    paymentId: String(body.payment_id ?? paymentId),
+    payloadHash: signData.hash,
+    typedData: signData.typed_data,
+    x402Expected
+  };
+}
+
+// src/tools.ts
 var sweepAuthorizationSchema = v3.z.object({
   from: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "from must be a 0x address"),
   to: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "to must be a 0x address"),
@@ -357,7 +408,7 @@ var sweepExpectedAuthSchema = v3.z.object({
   signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
   signer: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "signer must be a 0x address")
 });
-var x402ExpectedSchema = v3.z.object({
+var x402ExpectedShape = {
   payment_id: v3.z.string().min(1),
   payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string"),
   resource_url: v3.z.string().url(),
@@ -381,7 +432,8 @@ var x402ExpectedSchema = v3.z.object({
     signature: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "signature must be a 0x-prefixed hex string"),
     signer: v3.z.string().min(1)
   })
-});
+};
+var x402ExpectedSchema = v3.z.object(x402ExpectedShape);
 var toolSchemas = {
   haven_sign_sweep_delegate: {
     // The authorization fields prepared by Haven's POST /sweep/prepare. Passed
@@ -392,8 +444,14 @@ var toolSchemas = {
     expected_auth: sweepExpectedAuthSchema
   },
   haven_sign: {
+    // #1263: THE preferred x402 input — the signer fetches the exact signing
+    // payload + expected context from Haven itself (authenticated with the
+    // locally-stored agent credential), so no bulky bytes ever cross the
+    // model. Pass payment_id ALONE for a delegation-rail x402 funding intent.
+    payment_id: v3.z.string().min(1).optional(),
     // The unsigned hash from haven_pay / haven_pay_x402_quote (payload_hash).
-    payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string"),
+    // Optional when payment_id is supplied (the fetch carries it).
+    payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string").optional(),
     // Pass x402.expected from hosted haven_pay_x402_quote when this hash funds
     // a standard x402 merchant retry. The signer records it locally and returns
     // an opaque x402_binding for the later header-signing step.
@@ -420,9 +478,13 @@ var toolSchemas = {
     x402_binding: v3.z.string().min(1)
   },
   haven_sign_x402: {
+    // #1263: preferred — pass payment_id (plus payment_required) and the
+    // signer fetches the exact signing payload + expected context itself.
+    payment_id: v3.z.string().min(1).optional(),
     // One-shot x402 signing: funding hash + merchant header in one local call.
-    payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string"),
-    x402_expected: x402ExpectedSchema,
+    // Both optional when payment_id is supplied (the fetch carries them).
+    payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string").optional(),
+    x402_expected: x402ExpectedSchema.optional(),
     payment_required: v3.z.record(v3.z.string(), v3.z.unknown()),
     // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
     // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
@@ -436,9 +498,10 @@ var SIGN_DESCRIPTION = [
   "this process. Pass the payload_hash returned by haven_pay or haven_pay_x402_quote.",
   "For x402, also pass x402_expected from haven_pay_x402_quote; the signer records it locally",
   "and returns { signature, x402_binding }. x402_expected includes expires_at; sign before that",
-  "window closes. DELEGATION-RAIL accounts: when the hosted result carries typed_data_b64, pass that",
-  "single string through UNCHANGED (preferred \u2014 never re-type the nested typed_data JSON yourself);",
-  "the account validates that EIP-712 payload, not payload_hash, and signing is refused without it.",
+  "window closes. DELEGATION-RAIL x402 accounts (#1263): pass payment_id ALONE (preferred) \u2014 this",
+  "signer fetches the exact signing payload and expected context from Haven itself, so nothing",
+  "bulky ever crosses your context. Fallback: pass typed_data_b64 through UNCHANGED (never re-type",
+  "the nested typed_data JSON); the account validates that EIP-712 payload, not payload_hash.",
   "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. For plain SafeTransfer payments, just pass payload_hash and",
   "relay the returned signature via mcp__haven__haven_submit."
@@ -458,11 +521,12 @@ var SIGN_X402_DESCRIPTION = [
   "One-shot x402 signing for the fast 3-call flow: sign the funding hash AND build the EIP-3009",
   "X-PAYMENT header in a single local call (equivalent to haven_sign followed by",
   "haven_x402_sign_header). The delegate key never leaves this process. From the haven_pay_mcp_tool",
-  "result pass payload_hash, x402_expected (the nested x402.expected object \u2014 passing the whole x402",
-  "object is also accepted and unwrapped for you), and payment_required (verbatim). On a",
-  "delegation-rail account the result also carries typed_data_b64 \u2014 pass that single string through",
-  "UNCHANGED (preferred over re-typing the nested typed_data JSON); the signer",
-  "signs it instead of payload_hash and refuses the bare hash when the context commits to typed data.",
+  "result pass payment_id and payment_required \u2014 PREFERRED (#1263): this signer fetches the exact",
+  "signing payload and expected context from Haven itself, so nothing bulky crosses your context.",
+  "Fallback for older backends: pass payload_hash, x402_expected (the nested x402.expected object \u2014",
+  "passing the whole x402 object is also accepted and unwrapped for you), and typed_data_b64",
+  "through UNCHANGED; the signer",
+  "signs the typed data instead of payload_hash and refuses the bare hash when the context commits to typed data.",
   "Returns",
   "{ signature, x402_binding, payment_header, accepted }; hand signature + payment_header to",
   "mcp__haven__haven_settle_mcp_tool to fund and settle in one hosted call. The header is built now (before",
@@ -510,6 +574,15 @@ function toExpectedX402(raw) {
     auth: raw.auth
   };
 }
+function parseFetchedExpected(fetched) {
+  const parsed = v3.z.object(x402ExpectedShape).safeParse(fetched.x402Expected);
+  if (!parsed.success) {
+    throw new sdk.HavenSigningError(
+      `The Haven sign-context response carried a malformed x402_expected \u2014 the backend may predate #1263. Pass payload_hash + x402_expected from the quote result instead. Underlying: ${parsed.error.issues[0]?.message ?? "schema mismatch"}`
+    );
+  }
+  return parsed.data;
+}
 function resolveTypedData(args) {
   if (!args.typed_data_b64) return args.typed_data;
   try {
@@ -527,23 +600,51 @@ function resolveTypedData(args) {
   }
 }
 function createToolHandlers(signer, options = {}) {
+  async function resolveSignContext(args) {
+    if (!args.payment_id) return null;
+    const identity = await options.signContext?.loadIdentity() ?? null;
+    if (!identity) {
+      throw new sdk.HavenSigningError(
+        "payment_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run `npx @haven_ai/connect@alpha` to restore it, or pass typed_data_b64 from the quote result instead."
+      );
+    }
+    const ctx = await fetchX402SignContext(
+      identity,
+      args.payment_id,
+      options.signContext?.fetchImpl
+    );
+    if (args.payload_hash && args.payload_hash.toLowerCase() !== ctx.payloadHash.toLowerCase()) {
+      throw new sdk.HavenSigningError(
+        `The supplied payload_hash does not match the signing context Haven serves for payment ${args.payment_id}. Pass payment_id alone, or check which quote the hash came from.`
+      );
+    }
+    return ctx;
+  }
   return {
     haven_sign: async (input) => runTool(async () => {
       const args = parse("haven_sign", coerceX402Expected(input));
-      const typedData = resolveTypedData(args);
-      const x402Expected = args.x402_expected ? toExpectedX402(args.x402_expected) : null;
-      const result = x402Expected ? await signFundingLeg(signer, x402Expected, args.payload_hash, typedData) : null;
+      const fetched = await resolveSignContext(args);
+      const typedData = fetched?.typedData ?? resolveTypedData(args);
+      const payloadHash = fetched?.payloadHash ?? args.payload_hash;
+      if (!payloadHash) {
+        throw new sdk.HavenSigningError(
+          "Pass payment_id (preferred for delegation-rail x402) or payload_hash."
+        );
+      }
+      const expectedRaw = fetched ? parseFetchedExpected(fetched) : args.x402_expected;
+      const x402Expected = expectedRaw ? toExpectedX402(expectedRaw) : null;
+      const result = x402Expected ? await signFundingLeg(signer, x402Expected, payloadHash, typedData) : null;
       if (!result) {
         if (typedData) {
           const signature2 = await signer.signDelegationTypedData(typedData);
-          await auditSigning("haven_sign", args.payload_hash);
+          await auditSigning("haven_sign", payloadHash);
           return { signature: signature2 };
         }
-        const signature = signer.signPaymentHash(args.payload_hash);
-        await auditSigning("haven_sign", args.payload_hash);
+        const signature = signer.signPaymentHash(payloadHash);
+        await auditSigning("haven_sign", payloadHash);
         return { signature };
       }
-      await auditSigning("haven_sign", args.payload_hash);
+      await auditSigning("haven_sign", payloadHash);
       return { signature: result.signature, x402_binding: result.x402Binding };
     }),
     haven_x402_sign_header: async (input) => runTool(async () => {
@@ -560,17 +661,25 @@ function createToolHandlers(signer, options = {}) {
     }),
     haven_sign_x402: async (input) => runTool(async () => {
       const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
+      const fetched = await resolveSignContext(args);
+      const payloadHash = fetched?.payloadHash ?? args.payload_hash;
+      const expectedRaw = fetched ? parseFetchedExpected(fetched) : args.x402_expected;
+      if (!payloadHash || !expectedRaw) {
+        throw new sdk.HavenSigningError(
+          "Pass payment_id (preferred \u2014 the signer fetches the signing context itself) or payload_hash + x402_expected from the quote result."
+        );
+      }
       const funding = await signFundingLeg(
         signer,
-        toExpectedX402(args.x402_expected),
-        args.payload_hash,
-        resolveTypedData(args)
+        toExpectedX402(expectedRaw),
+        payloadHash,
+        fetched?.typedData ?? resolveTypedData(args)
       );
       const header = await signer.buildX402PaymentHeader(
         args.payment_required,
         funding.x402Binding
       );
-      await auditSigning("haven_sign_x402", args.payload_hash);
+      await auditSigning("haven_sign_x402", payloadHash);
       await auditSigning("haven_sign_x402", hashPayloadForAudit(args.payment_required));
       return {
         signature: funding.signature,
@@ -683,6 +792,7 @@ function normalizeError(err) {
 
 // src/consent.ts
 var SIGNER_ACK_ENV = "HAVEN_SIGNER_ACK";
+var SIGNER_CONSENT_SURFACE_VERSION = 2;
 function computeSignerConsentHash(input) {
   const identity = [
     input.delegateAddress.toLowerCase(),
@@ -693,7 +803,8 @@ function computeSignerConsentHash(input) {
   ].join("|");
   const toolCanonical = [...input.toolNames].sort().join(",");
   return crypto.createHash("sha256").update(`${identity}
-${toolCanonical}`).digest("hex").slice(0, 16);
+${toolCanonical}
+surface:v${SIGNER_CONSENT_SURFACE_VERSION}`).digest("hex").slice(0, 16);
 }
 function renderSignerConsentBlock(input, hash) {
   const lines = [
@@ -711,7 +822,10 @@ function renderSignerConsentBlock(input, hash) {
   lines.push("");
   lines.push("This local signer holds the delegate key on this machine and signs");
   lines.push("payment payloads or x402 merchant headers for the delegate address above.");
-  lines.push("It does not call the Haven API, so it cannot show a live allowance summary.");
+  lines.push("Its one network use is a read-only fetch of a pending payment's signing");
+  lines.push("payload from Haven, authenticated with the agent credential stored next to");
+  lines.push("this signer's key file - it never sends the key, a signature, or anything");
+  lines.push("else outbound, and it cannot show a live allowance summary.");
   lines.push("On-chain Safe rules remain the real spend gate, and the wallet owner can");
   lines.push("pause or revoke agent authority outside this signer.");
   lines.push("");
@@ -884,7 +998,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.19-alpha.0";
+var SIGNER_VERSION = "0.1.21-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {
@@ -917,6 +1031,14 @@ function buildSignerMcpServer(signer, options = {}) {
       delegateAddress: signer.delegateAddress,
       safeAddress: options.credentials?.safeAddress,
       chainId: options.credentials?.chainId
+    },
+    // #1263: the payment_id signing path — the ONLY network call this server
+    // can make, an authenticated read of a signing context from Haven, using
+    // the agent identity the connector stores next to the signer credential.
+    // The signer CORE stays network-free; fetched bytes still pass the same
+    // binding verification + digest re-derivation as tool-argument bytes.
+    signContext: {
+      loadIdentity: () => loadHavenIdentity(credentialsPath)
     }
   });
   const registerTool = server.tool.bind(server);