@haven_ai/signer 0.1.22-alpha.0 → 0.1.23-alpha.0

package/dist/cli.cjs

@@ -393,11 +393,13 @@ async function fetchX402SignContext(identity, paymentId, fetchImpl = fetch) {
       "The Haven sign-context response is missing sign_data.typed_data or x402_expected \u2014 the backend may predate #1263. Pass typed_data_b64 from the quote result instead."
     );
   }
+  const paymentRequired = body.payment_required;
   return {
     paymentId: String(body.payment_id ?? paymentId),
     payloadHash: signData.hash,
     typedData: signData.typed_data,
-    x402Expected
+    x402Expected,
+    paymentRequired: paymentRequired && typeof paymentRequired === "object" && !Array.isArray(paymentRequired) ? paymentRequired : null
   };
 }
 
@@ -496,7 +498,11 @@ var toolSchemas = {
     // Both optional when payment_id is supplied (the fetch carries them).
     payload_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "payload_hash must be a 0x-prefixed hex string").optional(),
     x402_expected: x402ExpectedSchema.optional(),
-    payment_required: v3.z.record(v3.z.string(), v3.z.unknown()),
+    // #1355: optional when payment_id is supplied — the signer's context fetch
+    // carries the stored 402 PaymentRequired, so `{ payment_id }` alone is the
+    // preferred call. Still required (via the runtime check in the handler)
+    // for the quote-based fallback path without a payment_id.
+    payment_required: v3.z.record(v3.z.string(), v3.z.unknown()).optional(),
     // #1138: delegation-rail intents sign THIS, not payload_hash. Object-typed
     // (not z.unknown()) so MCP clients embed it as JSON rather than a string.
     typed_data: v3.z.record(v3.z.string(), v3.z.unknown()).optional(),
@@ -532,8 +538,10 @@ var SIGN_X402_DESCRIPTION = [
   "One-shot x402 signing for the fast 3-call flow: sign the funding hash AND build the EIP-3009",
   "X-PAYMENT header in a single local call (equivalent to haven_sign followed by",
   "haven_x402_sign_header). The delegate key never leaves this process. From the haven_pay_mcp_tool",
-  "result pass payment_id and payment_required \u2014 PREFERRED (#1263): this signer fetches the exact",
-  "signing payload and expected context from Haven itself, so nothing bulky crosses your context.",
+  "result pass JUST payment_id \u2014 PREFERRED (#1263, #1355): this signer fetches the exact signing",
+  "payload, expected context, and merchant payment_required from Haven itself, so nothing bulky",
+  "crosses your context. If the signer reports the context carried no payment_required (older",
+  "backend), re-call with payment_id plus payment_required verbatim from the pay result.",
   "Fallback for older backends: pass payload_hash, x402_expected (the nested x402.expected object \u2014",
   "passing the whole x402 object is also accepted and unwrapped for you), and typed_data_b64",
   "through UNCHANGED; the signer",
@@ -686,12 +694,18 @@ function createToolHandlers(signer, options = {}) {
         payloadHash,
         fetched?.typedData ?? resolveTypedData(args)
       );
+      const paymentRequired = fetched?.paymentRequired ?? args.payment_required;
+      if (!paymentRequired) {
+        throw new sdk.HavenSigningError(
+          fetched ? "The Haven sign-context for this payment_id carried no payment_required (backend predates #1355). Pass payment_required from the pay result explicitly, verbatim." : "payment_required is required on the quote-based path (no payment_id to fetch it by). Pass it verbatim from the quote result."
+        );
+      }
       const header = await signer.buildX402PaymentHeader(
-        args.payment_required,
+        paymentRequired,
         funding.x402Binding
       );
       await auditSigning("haven_sign_x402", payloadHash);
-      await auditSigning("haven_sign_x402", hashPayloadForAudit(args.payment_required));
+      await auditSigning("haven_sign_x402", hashPayloadForAudit(paymentRequired));
       return {
         signature: funding.signature,
         x402_binding: funding.x402Binding,
@@ -1020,7 +1034,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.22-alpha.0";
+var SIGNER_VERSION = "0.1.23-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {