@haven_ai/signer 0.1.28-alpha.0 → 0.1.30-alpha.0

package/dist/cli.cjs

@@ -204,6 +204,7 @@ function createEdgeSigner(delegateKey, options = {}) {
     },
     signX402FundingHash(hash, expected) {
       assertExpectedBinding(hash, expected, options.x402BindingSigner, "hash");
+      assertPayerMatchesDelegate(expected, delegateAddress, options.agentId);
       const signature = signAndVerify(hash);
       const x402Binding = crypto.randomUUID();
       x402Bindings.set(x402Binding, { ...expected });
@@ -211,6 +212,7 @@ function createEdgeSigner(delegateKey, options = {}) {
     },
     async signX402FundingTypedData(typedData, expected) {
       assertExpectedBinding(expected.payloadHash, expected, options.x402BindingSigner, "typed-data");
+      assertPayerMatchesDelegate(expected, delegateAddress, options.agentId);
       const digest = viem.hashTypedData(typedData);
       if (digest.toLowerCase() !== expected.typedDataHash?.toLowerCase()) {
         throw new sdk.HavenSigningError(
@@ -380,7 +382,7 @@ function assertExpectedShape(expected) {
     throw new sdk.HavenSigningError("x402 expected funding context is required before signing a merchant header.");
   }
 }
-var SUPPORTED_X402_EXPECTED_VERSIONS = [1, 2];
+var SUPPORTED_X402_EXPECTED_VERSIONS = [1, 2, 3];
 var SUPPORTED_SWEEP_BINDING_VERSIONS = [1];
 function assertSupportedBindingVersion(received, supported, context) {
   if (supported.includes(received)) return;
@@ -433,9 +435,11 @@ function assertExpectedBinding(payloadHash, expected, trustedSigner, mode = "has
     asset: expected.asset,
     network: expected.network,
     expiresAt: expected.expiresAt,
-    typedDataHash: expected.typedDataHash
+    typedDataHash: expected.typedDataHash,
+    payerDelegate: expected.payerDelegate,
+    payerAgentId: expected.payerAgentId
   });
-  const expectedVersion = expected.typedDataHash ? 2 : 1;
+  const expectedVersion = expected.payerDelegate ? 3 : expected.typedDataHash ? 2 : 1;
   if (expected.auth?.version !== expectedVersion || expected.auth.message !== message) {
     throw new sdk.HavenSigningError("x402 expected context authentication message is invalid.");
   }
@@ -446,6 +450,15 @@ function assertExpectedBinding(payloadHash, expected, trustedSigner, mode = "has
     throw new sdk.HavenSigningError("x402 expected context signature could not be verified.");
   }
 }
+function assertPayerMatchesDelegate(expected, delegateAddress, localAgentId) {
+  if (!expected.payerDelegate) return;
+  if (sameAddress(expected.payerDelegate, delegateAddress)) return;
+  const quoteAgent = expected.payerAgentId ?? "unknown";
+  const localAgent = localAgentId ?? "unknown";
+  throw new sdk.HavenSigningError(
+    `This quote belongs to a DIFFERENT agent: the quote was created for agent ${quoteAgent} (delegate ${expected.payerDelegate}), but this signer holds agent ${localAgent} (delegate ${delegateAddress}). A long-lived host is holding stale credentials \u2014 its session authenticates as the old agent while the signer on disk belongs to the new one. Nothing was signed. Restart the host so it re-reads its wiring, then re-quote.`
+  );
+}
 function assertX402PaymentWindowOpen(expected) {
   if (!expected.expiresAt) return;
   const expiresAtMs = Date.parse(expected.expiresAt);
@@ -585,6 +598,11 @@ var x402ExpectedShape = {
   // typed data the account validates; the signer refuses to raw-sign the bare
   // hash when it is present, and refuses to sign typed data when it is absent.
   typed_data_hash: v3.z.string().regex(/^0x[0-9a-fA-F]+$/, "typed_data_hash must be a 0x-prefixed hex string").optional(),
+  // #1690: present on a v3 context. The delegate this quote was created FOR —
+  // the signer refuses to sign when it is not its own. Inside the Haven-signed
+  // message, so stripping it here would only break the binding signature.
+  payer_delegate: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "payer_delegate must be a 0x-prefixed address").optional(),
+  payer_agent_id: v3.z.string().min(1).optional(),
   auth: v3.z.object({
     // Open at the boundary, enforced in the signer — see bindingVersionSchema.
     version: bindingVersionSchema,
@@ -731,6 +749,8 @@ function toExpectedX402(raw) {
     paymentId: raw.payment_id,
     payloadHash: raw.payload_hash,
     typedDataHash: raw.typed_data_hash,
+    payerDelegate: raw.payer_delegate,
+    payerAgentId: raw.payer_agent_id,
     resourceUrl: raw.resource_url,
     merchantTo: raw.merchant_to,
     amount: raw.amount,
@@ -1186,7 +1206,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.28-alpha.0";
+var SIGNER_VERSION = "0.1.30-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {
@@ -1199,7 +1219,11 @@ async function resolveSignerRuntime(options = {}) {
   const creds = await loadSignerCredentials(options.credentialsPath);
   return {
     signer: createEdgeSigner(creds.delegateKey, {
-      x402BindingSigner: options.x402BindingSigner ?? creds.x402BindingSigner ?? process.env.HAVEN_X402_BINDING_SIGNER
+      x402BindingSigner: options.x402BindingSigner ?? creds.x402BindingSigner ?? process.env.HAVEN_X402_BINDING_SIGNER,
+      // #1690: the signer's own agent id, so a payer-mismatch refusal can name
+      // both sides. The bare-delegateKey path above has no credential file and
+      // therefore no agent id — the guard still works there, on addresses.
+      agentId: creds.agentId
     }),
     credentials: creds
   };