@haven_ai/signer 0.5.0-alpha.1 → 0.6.0-alpha.0

package/README.md

@@ -61,7 +61,7 @@ It exposes four stdio MCP tools, all sign-only:
 
 | Tool | Does | Emits |
 |---|---|---|
-| `haven_sign` | Sign one payment. Preferred form is `{ payment_id }` alone — the signer fetches the exact payload itself. Signs only Haven-prepared payloads (#3272, #3281): a direct-payment `PackedUserOperation` from this signer's own delegate account whose only call redeems a delegation made to that account, or — against a Haven-signed context, which it records and binds — an EIP-3009 funding leg of that same shape paying this signer's own delegate EOA, or an erc7710 settlement child from this signer's own account; other typed data is refused (`TYPED_DATA_NOT_ALLOWED`) | `{ signature }` or `{ signature, x402_binding }` |
+| `haven_sign` | Sign one payment, or (#3329) one task-budget open/close. Preferred form is `{ payment_id }` alone for a payment, or `{ task_budget_id }` alone (mutually exclusive with `payment_id`) for a task-budget open/close — the signer fetches the exact payload itself either way. Signs only Haven-prepared payloads (#3272, #3281, #3329): a direct-payment `PackedUserOperation` from this signer's own delegate account whose only call redeems a delegation made to that account EITHER directly OR through a self-delegated task-budget child under it (the two-link `[task child, budget]` chain), or — against a Haven-signed context, which it records and binds — an EIP-3009 funding leg of that same shape paying this signer's own delegate EOA, or an erc7710 settlement child from this signer's own account; other typed data is refused (`TYPED_DATA_NOT_ALLOWED`) | `{ signature }`, `{ signature, x402_binding }`, or `{ signature, task_budget_id, purpose }` |
 | `haven_sign_x402` | One-shot x402: funding signature **and** the merchant header in a single local call (`haven_sign` + `haven_x402_sign_header`). `{ payment_id }` alone is the preferred call | `{ signature, x402_binding, payment_header, accepted }` |
 | `haven_x402_sign_header` | Build + sign the EIP-3009 merchant payment header, only when the fresh merchant `payment_required` matches the recorded `x402_binding` | `{ payment_header, accepted }` |
 | `haven_sign_sweep_delegate` | Sign a Haven-prepared gasless EIP-3009 sweep that recovers stranded funds from the delegate wallet back to your own account. Never broadcasts | `{ signature }` |
@@ -121,8 +121,10 @@ sender is THIS signer's own delegate account (the counterfactual
 HybridDeleGator for the delegate key, derived offline — `delegate-account.ts` in `@haven_ai/sdk`);
 and its `callData` is a single `execute` to the DelegationManager calling
 `redeemDelegations`, whose arguments are decoded too (`redemption-guard.ts` in `@haven_ai/sdk`):
-exactly one delegation (a single grant, never an empty or multi-link chain)
-made to this signer's own account by a different account, `SingleDefault` mode, and canonical
+exactly one of two chain shapes (#3329) — a single grant made to this signer's own account by a
+different account, or a two-link `[task child, budget]` chain whose leaf is self-delegated by this
+signer's own account — never an empty chain or any other multi-link shape,
+`SingleDefault` mode, and canonical
 encoding at every level. The argument check matters: an EMPTY permission
 context makes the DelegationManager run the execution as the account itself,
 which would reach `transferOwnership`. A delegate-wallet `TransferWithAuthorization` or `Permit`,

package/dist/cli.cjs

@@ -256,6 +256,13 @@ var HavenSignContextError = class extends edge.HavenSigningError {
           nextTool: null,
           nextToolOmittedReason: "re-run the hosted quote tool you called with the same idempotency_key; which one depends on the flow"
         });
+      } else if (flow === "task") {
+        this.next_action = edge.AgentPaymentNextAction.StopAndTellUser;
+        step = signerRefusalStep({
+          nextAction: edge.AgentPaymentNextAction.StopAndTellUser,
+          nextTool: null,
+          nextToolOmittedReason: `re-check this task budget's status (id ${paymentId}) with the hosted Haven server before retrying`
+        });
       } else {
         this.next_action = edge.AgentPaymentNextAction.StopAndTellUser;
         step = signerRefusalStep({
@@ -264,6 +271,13 @@ var HavenSignContextError = class extends edge.HavenSigningError {
           nextArguments: { payment_id: paymentId }
         });
       }
+    } else if (flow === "task") {
+      this.next_action = edge.AgentPaymentNextAction.StopAndTellUser;
+      step = signerRefusalStep({
+        nextAction: edge.AgentPaymentNextAction.StopAndTellUser,
+        nextTool: null,
+        nextToolOmittedReason: "retry the same haven_sign call with the same task_budget_id"
+      });
     } else {
       this.fallback = "typed_data_b64";
       this.next_action = edge.AgentPaymentNextAction.StopAndTellUser;
@@ -432,6 +446,116 @@ async function fetchDirectSignContext(identity, paymentId, fetchImpl = fetch, ti
     clientUpdate: edge.readClientUpdate(body.client_update)
   };
 }
+var SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS = [1];
+async function fetchTaskBudgetSignContext(identity, taskBudgetId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS, clientIdentity) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/task-budgets/${encodeURIComponent(taskBudgetId)}/sign-context`,
+      {
+        headers: signContextHeaders(identity, clientIdentity),
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the task-budget signing-context fetch for ${taskBudgetId} within ${timeoutMs} ms. Retry.` : `Could not reach Haven to fetch the task-budget signing context for ${taskBudgetId}: ${err instanceof Error ? err.message : String(err)}.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the task-budget signing context for ${taskBudgetId} within ${timeoutMs} ms. Retry.`,
+        "SIGN_CONTEXT_TIMEOUT",
+        void 0,
+        taskBudgetId,
+        "task"
+      );
+    }
+    body = {};
+  }
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new HavenSignContextError(
+      `Haven refused the task-budget signing-context fetch for ${taskBudgetId}: ${detail}`,
+      "SIGN_CONTEXT_REFUSED",
+      refusalOf(response.status, body),
+      taskBudgetId,
+      "task"
+    );
+  }
+  const purpose = body.purpose;
+  const typedData = body.typed_data;
+  const version = body.task_sign_context_version;
+  const expected = body.expected;
+  const malformed = (detail) => {
+    throw new HavenSignContextError(
+      `The Haven task-budget sign-context response for ${taskBudgetId} is malformed: ${detail}.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  };
+  if (typeof version !== "number" || !SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS.includes(version)) {
+    throw new HavenSignContextError(
+      `The Haven task-budget sign-context response is version ${String(version)}, which this signer does not support (supported: ${SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS.join(", ")}). Update @haven_ai/signer.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  }
+  if (!typedData || typeof typedData !== "object") return malformed("missing typed_data");
+  if (!expected || typeof expected !== "object") return malformed("missing expected");
+  const e = expected;
+  if (purpose === "open") {
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.token_address !== "string" || typeof e.max_amount_atomic !== "string" || e.recipient_address !== null && typeof e.recipient_address !== "string" || typeof e.expires_at !== "number" || typeof e.parent_delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose open");
+    }
+    return {
+      purpose: "open",
+      taskBudgetId: String(body.task_budget_id ?? taskBudgetId),
+      typedData,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        tokenAddress: e.token_address,
+        maxAmountAtomic: e.max_amount_atomic,
+        recipientAddress: e.recipient_address ?? null,
+        expiresAt: e.expires_at,
+        parentDelegationHash: e.parent_delegation_hash
+      }
+    };
+  }
+  if (purpose === "close") {
+    const userOpHash = body.user_op_hash;
+    if (typeof userOpHash !== "string") return malformed("missing user_op_hash for purpose close");
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose close");
+    }
+    return {
+      purpose: "close",
+      taskBudgetId: String(body.task_budget_id ?? taskBudgetId),
+      typedData,
+      userOpHash,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        delegationHash: e.delegation_hash
+      }
+    };
+  }
+  return malformed(`unknown purpose '${String(purpose)}'`);
+}
 
 // src/tools.ts
 var USEROP_BINDING_MISMATCH = "USEROP_BINDING_MISMATCH";
@@ -554,7 +678,14 @@ var toolSchemas = {
     // Bounded: a realistic redemption payload is ~10KB encoded; 256KB is
     // generous headroom while keeping the offline signer from materializing
     // arbitrarily large caller input.
-    typed_data_b64: v3.z.string().min(1).max(262144).optional()
+    typed_data_b64: v3.z.string().min(1).max(262144).optional(),
+    // #3329: sign a task budget's own child delegation (purpose `open`) or
+    // its early-close UserOp (purpose `close`) — the signer fetches the
+    // exact typed data and expectation itself, exactly like payment_id.
+    // Mutually exclusive with payment_id / payload_hash (checked in the
+    // handler, since Zod's object-level refine on a raw shape used by
+    // several call sites is not the shape this schema is composed as).
+    task_budget_id: v3.z.string().min(1).optional()
   },
   haven_x402_sign_header: {
     // The parsed HTTP 402 PaymentRequired from the merchant. Typed as an object
@@ -604,7 +735,11 @@ var SIGN_DESCRIPTION = [
   "intent against a Haven-signed context \u2014 never an arbitrary typed_data payload, however it is shaped.",
   "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. A bare payload_hash with no payment_id, typed_data",
-  "or x402_expected is REFUSED (BARE_HASH_REFUSED): a hash carries nothing this signer can verify."
+  "or x402_expected is REFUSED (BARE_HASH_REFUSED): a hash carries nothing this signer can verify.",
+  "TASK BUDGETS (#3329): pass task_budget_id ALONE \u2014 mutually exclusive with payment_id and",
+  "payload_hash \u2014 to sign a task budget\u2019s own child delegation (opening it) or its early-close",
+  "UserOp; this signer fetches the exact typed data itself. Result then carries next_tool_name",
+  "(haven_submit) and next_arguments { task_budget_id, signature } instead of x402_binding."
 ].join(" ");
 var X402_SIGN_HEADER_DESCRIPTION = [
   "Build and sign the EIP-3009 merchant payment header for the merchant leg of an x402 payment.",
@@ -768,9 +903,84 @@ function createToolHandlers(signer, options = {}) {
       throw err;
     }
   }
+  async function signTaskBudget(taskBudgetId) {
+    const identity = await options.signContext?.loadIdentity() ?? null;
+    if (!identity) {
+      throw new edge.HavenSigningError(
+        `task_budget_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run \`${edge.connectorRerunCommand()}\` to restore it.`
+      );
+    }
+    const ctx = await fetchTaskBudgetSignContext(
+      identity,
+      taskBudgetId,
+      options.signContext?.fetchImpl,
+      void 0,
+      options.signContext?.clientIdentity
+    );
+    let signature;
+    if (ctx.purpose === "open") {
+      try {
+        edge.assertOwnTaskChild(
+          ctx.typedData,
+          {
+            chainId: ctx.expected.chainId,
+            tokenAddress: ctx.expected.tokenAddress,
+            maxAmountAtomic: ctx.expected.maxAmountAtomic,
+            recipientAddress: ctx.expected.recipientAddress,
+            expiresAt: ctx.expected.expiresAt,
+            parentDelegationHash: ctx.expected.parentDelegationHash
+          },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof edge.HavenTypedDataRefusedError) throw err;
+        throw new edge.HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    } else {
+      try {
+        edge.assertUserOpTypedDataBinding(ctx.typedData, ctx.userOpHash);
+      } catch (err) {
+        if (err instanceof edge.HavenUserOpBindingError) throw new HavenUserOpBindingRefusedError(err.message);
+        throw err;
+      }
+      try {
+        edge.assertOwnTaskBudgetCloseUserOp(
+          ctx.typedData,
+          { delegationHash: ctx.expected.delegationHash },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof edge.HavenTypedDataRefusedError) throw err;
+        throw new edge.HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    }
+    await auditSigning("haven_sign", viem.hashTypedData(ctx.typedData));
+    return {
+      signature,
+      task_budget_id: ctx.taskBudgetId,
+      purpose: ctx.purpose,
+      next_tool_name: "haven_submit",
+      next_tool_server_role: "hosted",
+      next_arguments: { task_budget_id: ctx.taskBudgetId, signature }
+    };
+  }
   return {
     haven_sign: async (input) => runTool(async () => {
       const args = parse("haven_sign", coerceX402Expected(input));
+      if (args.task_budget_id) {
+        if (args.payment_id || args.payload_hash) {
+          throw new v3.z.ZodError([
+            {
+              code: v3.z.ZodIssueCode.custom,
+              path: ["task_budget_id"],
+              message: "task_budget_id is mutually exclusive with payment_id / payload_hash \u2014 pass exactly one."
+            }
+          ]);
+        }
+        return signTaskBudget(args.task_budget_id);
+      }
       const resolved = await resolveSignContext(args, { allowDirectFallback: true });
       const typedData = resolved?.ctx.typedData ?? resolveTypedData(args);
       const payloadHash = resolved?.ctx.payloadHash ?? args.payload_hash;
@@ -1041,7 +1251,7 @@ function normalizeError(err) {
 
 // src/consent.ts
 var toolSummaries = {
-  haven_sign: "signs one Haven-prepared payment (a direct-payment UserOp from your own account whose only call redeems a delegation made to it, or an x402 funding intent against a Haven-signed context)",
+  haven_sign: "signs a Haven-prepared payment, task-budget open, or task-budget close (a UserOp from your own account whose only call redeems a delegation made to it, directly or through a self-delegated task-budget child, or an x402 funding intent against a Haven-signed context)",
   haven_x402_sign_header: "builds and signs the EIP-3009 merchant payment header for an x402 payment",
   haven_sign_x402: "the two above in one call: funding payload + merchant header",
   haven_sign_sweep_delegate: "signs a Haven-prepared gasless sweep of stranded funds back to your own account"
@@ -1573,7 +1783,8 @@ function signerCompatibility() {
   return {
     x402_expected_context_versions: [...SUPPORTED_X402_EXPECTED_VERSIONS],
     sweep_binding_versions: [...SUPPORTED_SWEEP_BINDING_VERSIONS],
-    direct_sign_context_versions: [...SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS]
+    direct_sign_context_versions: [...SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS],
+    task_sign_context_versions: [...SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS]
   };
 }
 function signerCapabilityAdvertisement() {
@@ -1592,6 +1803,7 @@ function signerInstructions() {
     `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
     `- sweep authorization binding versions supported: ${compatibility.sweep_binding_versions.join(", ")}`,
     `- direct-payment (haven_send / haven_pay) sign-context versions supported: ${compatibility.direct_sign_context_versions.join(", ")} \u2014 pass payment_id alone to haven_sign; this signer fetches the exact bytes`,
+    `- task-budget sign-context versions supported: ${compatibility.task_sign_context_versions.join(", ")} \u2014 pass task_budget_id alone to haven_sign; this signer fetches the exact bytes`,
     "",
     "Haven quote and prepare results report the expected-context version they will emit",
     "(signer_compatibility.x402_expected_context_version). If that version is not in the list",
@@ -1709,7 +1921,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.5.0-alpha.1";
+var SIGNER_VERSION = "0.6.0-alpha.0";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {