@haven_ai/signer 0.1.37-alpha.0 → 0.2.1-alpha.0

package/dist/index.d.cts

@@ -282,6 +282,17 @@ declare function signerInstructions(): string;
 interface SignerCredentials {
     delegateKey: string;
     agentId?: string;
+    /**
+     * The Haven account (smart account) the agent spends from — #2908, the
+     * account-vocabulary name. Same value as `safeAddress`.
+     */
+    accountAddress?: string;
+    /**
+     * @deprecated #2908 — same value as {@link SignerCredentials.accountAddress}.
+     * Removed from this shape in the release after the one carrying #2908
+     * (#2914). The credential-FILE keys it was read from are a different
+     * matter — see `readAccountAddressField`.
+     */
     safeAddress?: string;
     chainId?: number;
     network?: string;
@@ -289,6 +300,23 @@ interface SignerCredentials {
     /** Absolute path the key was loaded from, if a file was used. */
     sourcePath?: string;
 }
+interface RawCredentialFile {
+    delegate_key?: unknown;
+    delegateKey?: unknown;
+    agent_id?: unknown;
+    agentId?: unknown;
+    /** #2908: what `@haven_ai/connect` writes from this release on. */
+    account_address?: unknown;
+    /** Pre-#2908 spelling — read PERMANENTLY, see `readAccountAddressField`. */
+    safe_address?: unknown;
+    /** Pre-#2908 spelling — read PERMANENTLY, see `readAccountAddressField`. */
+    safeAddress?: unknown;
+    chain_id?: unknown;
+    chainId?: unknown;
+    network?: unknown;
+    x402_binding_signer?: unknown;
+    x402BindingSigner?: unknown;
+}
 /**
  * Resolve the delegate key for the edge signer.
  *
@@ -301,6 +329,30 @@ interface SignerCredentials {
  * `delegate_key` and ignore the rest.
  */
 declare function loadSignerCredentials(path?: string | undefined): Promise<SignerCredentials>;
+/**
+ * The account address off a credential FILE: `account_address` (what
+ * `@haven_ai/connect` writes from #2908 on) first, then the two pre-#2908
+ * spellings.
+ *
+ * The two old fallbacks are PERMANENT, not part of the one-release naming
+ * window (#2906, decision 2a): a credential file on disk was written once and
+ * never rewrites itself, so a signer that stopped reading `safe_address`
+ * would silently lose the address for every agent connected before this
+ * release — the consent hash would change and the spend-context prompt would
+ * say "not provided". Two lines, kept for as long as the file format exists.
+ *
+ * Exported for the mutation tests: dropping `account_address` fails the
+ * new-shape test, dropping either old key fails the old-shape test.
+ */
+declare function readAccountAddressField(raw: Pick<RawCredentialFile, 'account_address' | 'safe_address' | 'safeAddress'>): string | undefined;
+/**
+ * The account address off the process environment, new name first:
+ * `HAVEN_ACCOUNT_ADDRESS` (the survivor, decided on #2906) then the two
+ * names the dashboard handoff emitted before #2908 — `HAVEN_WALLET_ADDRESS`
+ * and `HAVEN_SAFE_ADDRESS`. Unlike the file fallbacks these two ARE
+ * window-scoped: they are dropped at #2914, one release after this one.
+ */
+declare function readAccountAddressEnv(env: NodeJS.ProcessEnv): string | undefined;
 /**
  * Warn (best-effort, POSIX only) when the credential file is readable beyond
  * its owner. Mirrors `@haven_ai/mcp`'s check — the delegate key is the most
@@ -368,9 +420,17 @@ interface ToolFailure {
     /**
      * #1309: precise recovery guidance as DATA, not just prose inside `message`
      * — the same text the hosted quote's advisory `signer_compatibility.fallback`
-     * carries when the refusal is an out-of-date signer.
+     * carries when the refusal is an out-of-date signer. #3001 reuses this same
+     * field for every sign-context refusal (`'typed_data_b64'`).
      */
     fallback?: string;
+    /**
+     * #3001: present on `SIGN_CONTEXT_REFUSED` — the HTTP status the backend
+     * answered the `/x402/:id/sign-context` fetch with (404, 410, …).
+     */
+    http_status?: number;
+    /** #3001: the backend's own `error_code` on `SIGN_CONTEXT_REFUSED` (`expired`, `already_executed`, `not_signable`, `sign_context_unavailable`). */
+    backend_error_code?: string;
 }
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
 interface ToolHandlerOptions {
@@ -416,7 +476,7 @@ declare function renderSignerConsentBlock(input: SignerConsentInput, hash: strin
 declare function ensureSignerConsent(input: SignerConsentInput, options?: SignerConsentOptions): Promise<SignerConsentDecision>;
 
 declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.1.37-alpha.0";
+declare const SIGNER_VERSION = "0.2.1-alpha.0";
 interface SignerOptions {
     /** Path to a Haven credential JSON file (delegate_key is read from it). */
     credentialsPath?: string;
@@ -481,4 +541,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { type EdgeSigner, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };
+export { type EdgeSigner, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };

package/dist/index.d.ts

@@ -282,6 +282,17 @@ declare function signerInstructions(): string;
 interface SignerCredentials {
     delegateKey: string;
     agentId?: string;
+    /**
+     * The Haven account (smart account) the agent spends from — #2908, the
+     * account-vocabulary name. Same value as `safeAddress`.
+     */
+    accountAddress?: string;
+    /**
+     * @deprecated #2908 — same value as {@link SignerCredentials.accountAddress}.
+     * Removed from this shape in the release after the one carrying #2908
+     * (#2914). The credential-FILE keys it was read from are a different
+     * matter — see `readAccountAddressField`.
+     */
     safeAddress?: string;
     chainId?: number;
     network?: string;
@@ -289,6 +300,23 @@ interface SignerCredentials {
     /** Absolute path the key was loaded from, if a file was used. */
     sourcePath?: string;
 }
+interface RawCredentialFile {
+    delegate_key?: unknown;
+    delegateKey?: unknown;
+    agent_id?: unknown;
+    agentId?: unknown;
+    /** #2908: what `@haven_ai/connect` writes from this release on. */
+    account_address?: unknown;
+    /** Pre-#2908 spelling — read PERMANENTLY, see `readAccountAddressField`. */
+    safe_address?: unknown;
+    /** Pre-#2908 spelling — read PERMANENTLY, see `readAccountAddressField`. */
+    safeAddress?: unknown;
+    chain_id?: unknown;
+    chainId?: unknown;
+    network?: unknown;
+    x402_binding_signer?: unknown;
+    x402BindingSigner?: unknown;
+}
 /**
  * Resolve the delegate key for the edge signer.
  *
@@ -301,6 +329,30 @@ interface SignerCredentials {
  * `delegate_key` and ignore the rest.
  */
 declare function loadSignerCredentials(path?: string | undefined): Promise<SignerCredentials>;
+/**
+ * The account address off a credential FILE: `account_address` (what
+ * `@haven_ai/connect` writes from #2908 on) first, then the two pre-#2908
+ * spellings.
+ *
+ * The two old fallbacks are PERMANENT, not part of the one-release naming
+ * window (#2906, decision 2a): a credential file on disk was written once and
+ * never rewrites itself, so a signer that stopped reading `safe_address`
+ * would silently lose the address for every agent connected before this
+ * release — the consent hash would change and the spend-context prompt would
+ * say "not provided". Two lines, kept for as long as the file format exists.
+ *
+ * Exported for the mutation tests: dropping `account_address` fails the
+ * new-shape test, dropping either old key fails the old-shape test.
+ */
+declare function readAccountAddressField(raw: Pick<RawCredentialFile, 'account_address' | 'safe_address' | 'safeAddress'>): string | undefined;
+/**
+ * The account address off the process environment, new name first:
+ * `HAVEN_ACCOUNT_ADDRESS` (the survivor, decided on #2906) then the two
+ * names the dashboard handoff emitted before #2908 — `HAVEN_WALLET_ADDRESS`
+ * and `HAVEN_SAFE_ADDRESS`. Unlike the file fallbacks these two ARE
+ * window-scoped: they are dropped at #2914, one release after this one.
+ */
+declare function readAccountAddressEnv(env: NodeJS.ProcessEnv): string | undefined;
 /**
  * Warn (best-effort, POSIX only) when the credential file is readable beyond
  * its owner. Mirrors `@haven_ai/mcp`'s check — the delegate key is the most
@@ -368,9 +420,17 @@ interface ToolFailure {
     /**
      * #1309: precise recovery guidance as DATA, not just prose inside `message`
      * — the same text the hosted quote's advisory `signer_compatibility.fallback`
-     * carries when the refusal is an out-of-date signer.
+     * carries when the refusal is an out-of-date signer. #3001 reuses this same
+     * field for every sign-context refusal (`'typed_data_b64'`).
      */
     fallback?: string;
+    /**
+     * #3001: present on `SIGN_CONTEXT_REFUSED` — the HTTP status the backend
+     * answered the `/x402/:id/sign-context` fetch with (404, 410, …).
+     */
+    http_status?: number;
+    /** #3001: the backend's own `error_code` on `SIGN_CONTEXT_REFUSED` (`expired`, `already_executed`, `not_signable`, `sign_context_unavailable`). */
+    backend_error_code?: string;
 }
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
 interface ToolHandlerOptions {
@@ -416,7 +476,7 @@ declare function renderSignerConsentBlock(input: SignerConsentInput, hash: strin
 declare function ensureSignerConsent(input: SignerConsentInput, options?: SignerConsentOptions): Promise<SignerConsentDecision>;
 
 declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.1.37-alpha.0";
+declare const SIGNER_VERSION = "0.2.1-alpha.0";
 interface SignerOptions {
     /** Path to a Haven credential JSON file (delegate_key is read from it). */
     credentialsPath?: string;
@@ -481,4 +541,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { type EdgeSigner, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };
+export { type EdgeSigner, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };

package/dist/index.js

@@ -501,10 +501,12 @@ async function loadSignerCredentials(path = process.env.HAVEN_CREDENTIALS) {
   if (path) return loadFromFile(path);
   const envKey = stringField(process.env.HAVEN_DELEGATE_KEY);
   if (envKey) {
+    const accountAddress = readAccountAddressEnv(process.env);
     return {
       delegateKey: envKey,
       agentId: stringField(process.env.HAVEN_AGENT_ID),
-      safeAddress: stringField(process.env.HAVEN_SAFE_ADDRESS),
+      accountAddress,
+      safeAddress: accountAddress,
       chainId: chainIdField(process.env.HAVEN_CHAIN_ID, "HAVEN_CHAIN_ID"),
       network: stringField(process.env.HAVEN_NETWORK),
       x402BindingSigner: stringField(process.env.HAVEN_X402_BINDING_SIGNER)
@@ -534,10 +536,12 @@ async function loadFromFile(path) {
   if (!delegateKey) {
     throw new Error("Haven credentials are missing delegate_key \u2014 the edge signer needs it to sign.");
   }
+  const accountAddress = readAccountAddressField(raw);
   return {
     delegateKey,
     agentId: stringField(raw.agent_id ?? raw.agentId),
-    safeAddress: stringField(raw.safe_address ?? raw.safeAddress),
+    accountAddress,
+    safeAddress: accountAddress,
     chainId: chainIdField(raw.chain_id ?? raw.chainId, "chain_id"),
     network: stringField(raw.network),
     x402BindingSigner: stringField(
@@ -546,6 +550,12 @@ async function loadFromFile(path) {
     sourcePath: path
   };
 }
+function readAccountAddressField(raw) {
+  return stringField(raw.account_address ?? raw.safe_address ?? raw.safeAddress);
+}
+function readAccountAddressEnv(env) {
+  return stringField(env.HAVEN_ACCOUNT_ADDRESS ?? env.HAVEN_WALLET_ADDRESS ?? env.HAVEN_SAFE_ADDRESS);
+}
 function stringField(value) {
   return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
@@ -617,6 +627,49 @@ function stableStringify(value) {
   const object = value;
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
 }
+var HavenSignContextError = class extends HavenSigningError {
+  /**
+   * #3001 / #3010 review: the recovery path, when signing OTHER bytes is
+   * actually a remedy — a transport failure (timeout, unreachable) or a
+   * body this signer could not read. `typed_data_b64` is NOT in the default
+   * quote result since #1272: obtain it by re-running the SAME quote tool
+   * with the SAME idempotency_key plus `include_signing_payload: true`.
+   * Absent on a backend REFUSAL: an expired, executed or unsignable intent
+   * cannot be rescued by re-signing its bytes.
+   */
+  fallback;
+  /**
+   * #3001: `AgentPaymentNextAction` values the signer already emits — the
+   * version-mismatch refusal's `stop_and_tell_user` for the classes where
+   * retrying the same call cannot help, and `payment_window_expired` (with
+   * `retry_with_new_quote`) for the backend's 410 `expired`, exactly as the
+   * plain `HavenError` branch already does for that code.
+   */
+  next_action;
+  retry_with_new_quote;
+  /** Present only for `SIGN_CONTEXT_REFUSED` (the backend's HTTP status). */
+  http_status;
+  /** Present only for `SIGN_CONTEXT_REFUSED`: the backend's own `error_code`. */
+  backend_error_code;
+  constructor(message, code, refusal) {
+    super(message);
+    this.code = code;
+    this.name = "HavenSignContextError";
+    if (code === "SIGN_CONTEXT_REFUSED") {
+      this.http_status = refusal?.httpStatus;
+      this.backend_error_code = refusal?.errorCode;
+      if (refusal?.httpStatus === 410 || refusal?.errorCode === "expired") {
+        this.next_action = AgentPaymentNextAction.PaymentWindowExpired;
+        this.retry_with_new_quote = true;
+      } else {
+        this.next_action = AgentPaymentNextAction.StopAndTellUser;
+      }
+    } else {
+      this.fallback = "typed_data_b64";
+      this.next_action = AgentPaymentNextAction.StopAndTellUser;
+    }
+  }
+};
 async function loadHavenIdentity(credentialsPath) {
   if (!credentialsPath) return null;
   try {
@@ -631,30 +684,50 @@ async function loadHavenIdentity(credentialsPath) {
     return null;
   }
 }
-async function fetchX402SignContext(identity, paymentId, fetchImpl = fetch) {
+var SIGN_CONTEXT_TIMEOUT_MS = 15e3;
+async function fetchX402SignContext(identity, paymentId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS) {
   let response;
   try {
     response = await fetchImpl(
       `${identity.apiUrl}/x402/${encodeURIComponent(paymentId)}/sign-context`,
-      { headers: { Authorization: `Bearer ${identity.apiKey}` } }
+      {
+        headers: { Authorization: `Bearer ${identity.apiKey}` },
+        signal: AbortSignal.timeout(timeoutMs)
+      }
     );
   } catch (err) {
-    throw new HavenSigningError(
-      `Could not reach Haven to fetch the signing context for ${paymentId}: ${err instanceof Error ? err.message : String(err)}. Retry, or pass typed_data_b64 from the quote result instead.`
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the signing-context fetch for ${paymentId} within ${timeoutMs} ms. Retry, or pass typed_data_b64 from the quote result instead.` : `Could not reach Haven to fetch the signing context for ${paymentId}: ${err instanceof Error ? err.message : String(err)}. Retry, or pass typed_data_b64 from the quote result instead.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE"
     );
   }
-  const body = await response.json().catch(() => ({}));
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the signing context for ${paymentId} within ${timeoutMs} ms. Retry, or pass typed_data_b64 from the quote result instead.`,
+        "SIGN_CONTEXT_TIMEOUT"
+      );
+    }
+    body = {};
+  }
   if (!response.ok) {
     const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
-    throw new HavenSigningError(
-      `Haven refused the signing-context fetch for ${paymentId}: ${detail}` + (response.status === 404 ? " \u2014 check the payment_id came from this agent\u2019s own quote." : response.status === 410 ? " Re-run the quote with the same idempotency key, then sign the fresh payment_id." : "")
+    throw new HavenSignContextError(
+      `Haven refused the signing-context fetch for ${paymentId}: ${detail}` + (response.status === 404 ? " \u2014 check the payment_id came from this agent\u2019s own quote." : response.status === 410 ? " Re-run the quote with the same idempotency key, then sign the fresh payment_id." : ""),
+      "SIGN_CONTEXT_REFUSED",
+      { httpStatus: response.status, errorCode: typeof body.error_code === "string" ? body.error_code : void 0 }
     );
   }
   const signData = body.sign_data;
   const x402Expected = body.x402_expected;
   if (!signData || typeof signData.hash !== "string" || !signData.typed_data || typeof signData.typed_data !== "object" || !x402Expected) {
-    throw new HavenSigningError(
-      "The Haven sign-context response is missing sign_data.typed_data or x402_expected \u2014 the backend may predate #1263. Pass typed_data_b64 from the quote result instead."
+    throw new HavenSignContextError(
+      "The Haven sign-context response is missing sign_data.typed_data or x402_expected \u2014 the backend may predate #1263. Pass typed_data_b64 from the quote result instead.",
+      "SIGN_CONTEXT_MALFORMED"
     );
   }
   const paymentRequired = body.payment_required;
@@ -1085,6 +1158,18 @@ function normalizeError(err) {
       next_action: AgentPaymentNextAction.StopAndTellUser
     };
   }
+  if (err instanceof HavenSignContextError) {
+    return {
+      success: false,
+      code: err.code,
+      message: err.message,
+      next_action: err.next_action,
+      ...err.fallback !== void 0 ? { fallback: err.fallback } : {},
+      ...err.retry_with_new_quote ? { retry_with_new_quote: true } : {},
+      ...err.http_status !== void 0 ? { http_status: err.http_status } : {},
+      ...err.backend_error_code !== void 0 ? { backend_error_code: err.backend_error_code } : {}
+    };
+  }
   if (err instanceof HavenSigningError) {
     return { success: false, code: err.code, message: err.message };
   }
@@ -1231,7 +1316,7 @@ async function writeAckFile(path, hash) {
   );
 }
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.1.37-alpha.0";
+var SIGNER_VERSION = "0.2.1-alpha.0";
 async function resolveEdgeSigner(options = {}) {
   const { signer } = await resolveSignerRuntime(options);
   return signer;
@@ -1270,7 +1355,7 @@ function buildSignerMcpServer(signer, options = {}) {
     audit: {
       auditPath: options.auditPath ?? defaultSigningAuditPath(credentialsPath),
       delegateAddress: signer.delegateAddress,
-      safeAddress: options.credentials?.safeAddress,
+      safeAddress: options.credentials?.accountAddress ?? options.credentials?.safeAddress,
       chainId: options.credentials?.chainId
     },
     // #1263: the payment_id signing path — the ONLY network call this server
@@ -1320,7 +1405,7 @@ async function runSignerConsentGate(signer, credentials, options) {
   return ensureSignerConsent(
     {
       delegateAddress: signer.delegateAddress,
-      safeAddress: credentials?.safeAddress,
+      safeAddress: credentials?.accountAddress ?? credentials?.safeAddress,
       agentId: credentials?.agentId,
       chainId: credentials?.chainId,
       network: credentials?.network,
@@ -1341,6 +1426,6 @@ function toMcpResult(payload) {
   };
 }
 
-export { SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };
+export { SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map