@haven_ai/signer 0.1.23-alpha.2 → 0.1.25-alpha.0

package/dist/cli.cjs

@@ -46,6 +46,134 @@ function stableStringify(value) {
   const object = value;
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
 }
+var DELEGATION_MANAGER = "0xdb9B1e94B5b69Df7e401DDbedE43491141047dB3";
+var CAVEAT_ENFORCERS = {
+  erc20TransferAmount: "0xf100b0819427117EcF76Ed94B358B1A5b5C6D2Fc",
+  allowedCalldata: "0xc2b0d624c1c4319760C96503BA27C347F3260f55",
+  timestamp: "0x1046bb45C8d673d4ea75321280DB34899413c069"};
+var MAX_SETTLEMENT_WINDOW_SECONDS = 600;
+function isSettlementChildTypedData(value) {
+  const td = value;
+  return !!td && td.primaryType === "Delegation" && typeof td.domain?.verifyingContract === "string" && Array.isArray(td.message?.caveats);
+}
+function same(a, b) {
+  return !!a && !!b && a.toLowerCase() === b.toLowerCase();
+}
+function hex(value) {
+  return value.startsWith("0x") ? value.slice(2).toLowerCase() : value.toLowerCase();
+}
+function slice(terms, start, end) {
+  const body = hex(terms);
+  return end === void 0 ? body.slice(start * 2) : body.slice(start * 2, end * 2);
+}
+function findCaveat(caveats, enforcer) {
+  return caveats.find((c) => same(c.enforcer, enforcer));
+}
+function refuse(what, detail) {
+  throw new sdk.HavenSigningError(
+    `Refusing to sign the x402 settlement child: ${what}. ${detail} The signature on this child is what lets a merchant pull from the treasury, so it is verified locally against the Haven-signed expected context rather than trusted.`
+  );
+}
+function chainIdForNetwork(network) {
+  if (!network) return void 0;
+  const caip = /^eip155:(\d+)$/.exec(network);
+  if (caip) return Number(caip[1]);
+  if (network === "base") return 8453;
+  if (network === "base-sepolia") return 84532;
+  return void 0;
+}
+function verifySettlementChild(typedData, expected, now = Date.now()) {
+  if (typedData.primaryType !== "Delegation") {
+    refuse("it is not a Delegation payload", `primaryType was '${typedData.primaryType}'.`);
+  }
+  if (!same(typedData.domain?.verifyingContract, DELEGATION_MANAGER)) {
+    refuse(
+      "the EIP-712 domain names an unknown DelegationManager",
+      `Expected ${DELEGATION_MANAGER}, got ${typedData.domain?.verifyingContract}.`
+    );
+  }
+  const domainChain = Number(typedData.domain?.chainId);
+  if (!Number.isFinite(domainChain) || domainChain !== expected.chainId) {
+    refuse(
+      "it is scoped to the wrong chain",
+      `The expected context says chain ${expected.chainId}; the child says ${typedData.domain?.chainId}.`
+    );
+  }
+  const caveats = typedData.message?.caveats ?? [];
+  if (caveats.length === 0) {
+    refuse("it carries no caveats at all", "An unconstrained delegation is not a payment.");
+  }
+  const transfer = findCaveat(caveats, CAVEAT_ENFORCERS.erc20TransferAmount);
+  if (!transfer) {
+    refuse(
+      "it has no ERC-20 transfer-amount caveat",
+      "Without it the delegation is not bounded to an amount."
+    );
+  }
+  const token = `0x${slice(transfer.terms, 0, 20)}`;
+  if (!same(token, expected.asset)) {
+    refuse("it spends a different token", `Expected ${expected.asset}, child pins ${token}.`);
+  }
+  const amount = BigInt(`0x${slice(transfer.terms, 20, 52)}`);
+  if (amount !== BigInt(expected.amount)) {
+    refuse(
+      "the amount does not match",
+      `The expected context says ${expected.amount}; the child allows ${amount.toString()}.`
+    );
+  }
+  const calldata = findCaveat(caveats, CAVEAT_ENFORCERS.allowedCalldata);
+  if (!calldata) {
+    refuse(
+      "it has no payee pin",
+      "Without an allowed-calldata caveat the merchant could redeem it to any address."
+    );
+  }
+  const startIndex = BigInt(`0x${slice(calldata.terms, 0, 32)}`);
+  if (startIndex !== 4n) {
+    refuse(
+      "the payee pin points at the wrong calldata offset",
+      `Expected offset 4 (the transfer's \`to\` word), got ${startIndex.toString()}.`
+    );
+  }
+  const paddedPayee = slice(calldata.terms, 32, 64);
+  if (paddedPayee.slice(0, 24) !== "0".repeat(24)) {
+    refuse("the pinned payee is not a plain address", "Its 32-byte word is not a padded address.");
+  }
+  const payee = `0x${paddedPayee.slice(24)}`;
+  if (!same(payee, expected.merchantTo)) {
+    refuse(
+      "it pays a different address than Haven declared",
+      `The expected context says ${expected.merchantTo}; the child pins ${payee}.`
+    );
+  }
+  const timestamp = findCaveat(caveats, CAVEAT_ENFORCERS.timestamp);
+  if (!timestamp) {
+    refuse("it never expires", "A settlement child without a timestamp caveat is open-ended.");
+  }
+  const beforeThreshold = Number(BigInt(`0x${slice(timestamp.terms, 16, 32)}`));
+  if (beforeThreshold <= 0) {
+    refuse("its expiry is unset", "The timestamp caveat has no upper bound.");
+  }
+  const nowSec = Math.floor(now / 1e3);
+  if (beforeThreshold <= nowSec) {
+    refuse("it has already expired", `Expiry ${beforeThreshold} is not in the future.`);
+  }
+  if (beforeThreshold > nowSec + MAX_SETTLEMENT_WINDOW_SECONDS) {
+    refuse(
+      "its window is longer than a settlement may live",
+      `Expiry is ${beforeThreshold - nowSec}s out; the ceiling is ${MAX_SETTLEMENT_WINDOW_SECONDS}s.`
+    );
+  }
+  if (expected.expiresAt) {
+    const declared = Math.floor(Date.parse(expected.expiresAt) / 1e3);
+    if (Number.isFinite(declared) && beforeThreshold > declared) {
+      refuse(
+        "it outlives the payment window Haven declared",
+        `The expected context expires at ${expected.expiresAt}; the child lives to ${beforeThreshold}.`
+      );
+    }
+  }
+}
 function createEdgeSigner(delegateKey, options = {}) {
   let delegateAddress;
   try {
@@ -89,6 +217,25 @@ function createEdgeSigner(delegateKey, options = {}) {
           "x402 typed data does not match the digest Haven committed to in the expected context. Refusing to sign \u2014 the payload was altered in transit or Haven declared a different one. The most common cause is the typed data being truncated or reshaped while being copied between tool calls (#1255): re-run the hosted quote and pass its typed_data_b64 string through UNCHANGED instead of re-emitting the nested JSON."
         );
       }
+      if (isSettlementChildTypedData(typedData)) {
+        const settlementChainId = chainIdForNetwork(expected.network);
+        if (settlementChainId === void 0) {
+          throw new sdk.HavenSigningError(
+            `Refusing to sign the x402 settlement child: this signer cannot map the network '${expected.network}' to a chain id, so it cannot check which chain the child is scoped to. Update @haven_ai/signer.`
+          );
+        }
+        verifySettlementChild(typedData, {
+          merchantTo: expected.merchantTo,
+          amount: expected.amount,
+          asset: expected.asset,
+          // From the SIGNED network, not the payload's own claim. Passing
+          // Number(typedData.domain.chainId) here made the check compare a
+          // value to itself — vacuous, and precisely the "declared one thing,
+          // signed another" class this file exists to catch (#1455 review).
+          chainId: settlementChainId,
+          expiresAt: expected.expiresAt
+        });
+      }
       const account = accounts.privateKeyToAccount(delegateKey);
       const signature = await account.signTypedData(
         typedData
@@ -655,6 +802,11 @@ function createToolHandlers(signer, options = {}) {
       const result = x402Expected ? await signFundingLeg(signer, x402Expected, payloadHash, typedData) : null;
       if (!result) {
         if (typedData) {
+          if (isSettlementChildTypedData(typedData)) {
+            throw new sdk.HavenSigningError(
+              "Refusing to sign a delegation payload with no expected context. This typed data is a DELEGATION \u2014 signing it grants a third party authority to move funds \u2014 so it is only ever signed against a Haven-signed context that the caveats are verified against. Call this tool with { payment_id } instead (the signer then fetches and verifies the context itself), or use haven_sign_x402."
+            );
+          }
           const signature2 = await signer.signDelegationTypedData(typedData);
           await auditSigning("haven_sign", payloadHash);
           return { signature: signature2 };
@@ -1034,7 +1186,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.23-alpha.2";
+var SIGNER_VERSION = "0.1.25-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {