@haven_ai/signer 0.8.1-alpha.0 → 0.9.0-alpha.0

package/dist/index.d.cts

@@ -9,9 +9,11 @@ import { z } from 'zod';
  * The edge signer core.
  *
  * Holds the delegate key in this process and exposes the signing operations a
- * hosted-MCP flow needs — five, none of them a raw-hash primitive (#3169): each
+ * hosted-MCP flow needs — six, none of them a raw-hash primitive (#3169): each
  * takes a payload something can check — a Haven binding verified here, typed
- * data the account validates on-chain, or a sweep authorization. It performs no network I/O and never
+ * data the account validates on-chain, a sweep authorization, or (since
+ * #3728) an EIP-4361 SIWX message composed in-package from grammar-validated
+ * challenge fields. It performs no network I/O and never
  * returns the key — only signatures and the standard x402 header. See
  * docs/architecture/07-edge-signer.md.
  */
@@ -51,6 +53,18 @@ interface EdgeSigner {
      * relayer broadcasts it and pays gas. Never broadcasts — pure signing.
      */
     signSweepAuthorization(input: SweepSignatureInput): Promise<SweepSignatureResult>;
+    /**
+     * Sign an EIP-4361 (SIWE) message with EIP-191 `personal_sign` (#3728) —
+     * the x402 Sign-In-With-X extension. The message ALWAYS reaches this method
+     * composed in-package by the tool layer (`siwx.ts`) from grammar-validated
+     * challenge fields, with the address taken from this key — never a
+     * caller-supplied string, hash or byte payload. The name is deliberately
+     * SIWX-scoped, not a generic `signMessage`: the delegate key's EIP-191
+     * surface on this interface stays single-purpose. Breaking for
+     * out-of-package `EdgeSigner` implementers (open question in #3728,
+     * decided: acceptable — the only implementation is `createEdgeSigner`).
+     */
+    signSiwxMessage(message: string): Promise<string>;
 }
 interface SweepSignatureInput {
     /** The authorization fields prepared by the backend. */
@@ -280,6 +294,12 @@ declare function signerCompatibility(): SignerCompatibility;
 declare function signerCapabilityAdvertisement(): {
     experimental: Record<string, SignerCompatibility>;
 };
+interface SignerIdentity {
+    /** The credential file's `agent_id`, or `HAVEN_AGENT_ID`; absent when neither is set. */
+    agentId?: string;
+    /** The delegate key's address — always known, since the signer holds the key. */
+    delegateAddress?: string;
+}
 /**
  * The agent-readable half: MCP `instructions`, which clients surface to the
  * model. The machine-readable capability above is the precise statement, but
@@ -289,8 +309,11 @@ declare function signerCapabilityAdvertisement(): {
  * It names the same fix as #1143 so an agent that hits either surface — the
  * handshake here or the signing-time error there — tells the user the same
  * thing.
+ *
+ * Since #3738 it also states the agent id and delegate address this signer is
+ * bound to, when `identity` is given.
  */
-declare function signerInstructions(): string;
+declare function signerInstructions(identity?: SignerIdentity): string;
 
 /**
  * The edge signer's own credential requires *only* `delegate_key` — unlike
@@ -458,12 +481,26 @@ interface SigningAuditEntry {
      */
     safe_address?: string;
     chain_id?: number;
+    /**
+     * #3728, additive like `safe_address`/`chain_id`: present on SIWX entries
+     * only — the challenge domain and nonce the composed message committed to.
+     * The `payload_hash` already pins the exact composed message (its sha256,
+     * pre-signature), so an entry is replayable without these; they make a
+     * sign-in row scannable without re-deriving the message. No existing key
+     * renamed (#2914).
+     */
+    domain?: string;
+    nonce?: string;
 }
 interface SigningAuditContext {
     delegateAddress: string;
     accountAddress?: string;
     chainId?: number;
     auditPath?: string;
+    /** #3728, SIWX entries only: the challenge domain, emitted onto the row. */
+    domain?: string;
+    /** #3728, SIWX entries only: the challenge nonce, emitted onto the row. */
+    nonce?: string;
 }
 declare function defaultSigningAuditPath(credentialsPath?: string): string;
 declare function appendSigningAuditEntry(entry: SigningAuditEntry, path: string, options?: AppendAuditOptions): Promise<void>;
@@ -510,7 +547,7 @@ declare const SIGNER_HOSTED_HANDOFF_SHAPES: {
  * `server.ts` re-exports them, so the package's public API is unchanged.
  */
 declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.8.1-alpha.0";
+declare const SIGNER_VERSION = "0.9.0-alpha.0";
 /**
  * #3419: the marker the tool layer prefixes the undeclared-argument refusal
  * with. The strict re-parse lives in THIS module (`parseStrictFor`, below) —
@@ -528,7 +565,7 @@ declare const UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
  * and pair with the hosted server's construct/relay tools (#183). They sign;
  * they never call the Haven API and never emit the key.
  */
-type SignerToolName = 'haven_sign' | 'haven_x402_sign_header' | 'haven_sign_x402' | 'haven_sign_sweep_delegate';
+type SignerToolName = 'haven_sign' | 'haven_sign_siwx' | 'haven_x402_sign_header' | 'haven_sign_x402' | 'haven_sign_sweep_delegate';
 declare const toolSchemas: {
     readonly haven_sign_sweep_delegate: {
         readonly authorization: z$1.ZodObject<{
@@ -725,6 +762,10 @@ declare const toolSchemas: {
         readonly typed_data: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>>;
         readonly typed_data_b64: z$1.ZodOptional<z$1.ZodString>;
     };
+    readonly haven_sign_siwx: {
+        readonly url: z$1.ZodString;
+        readonly challenge: z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>;
+    };
 };
 declare const toolDescriptions: Record<SignerToolName, string>;
 interface ToolSuccess<T> {
@@ -891,4 +932,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerIdentity, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };

package/dist/index.d.ts

@@ -9,9 +9,11 @@ import { z } from 'zod';
  * The edge signer core.
  *
  * Holds the delegate key in this process and exposes the signing operations a
- * hosted-MCP flow needs — five, none of them a raw-hash primitive (#3169): each
+ * hosted-MCP flow needs — six, none of them a raw-hash primitive (#3169): each
  * takes a payload something can check — a Haven binding verified here, typed
- * data the account validates on-chain, or a sweep authorization. It performs no network I/O and never
+ * data the account validates on-chain, a sweep authorization, or (since
+ * #3728) an EIP-4361 SIWX message composed in-package from grammar-validated
+ * challenge fields. It performs no network I/O and never
  * returns the key — only signatures and the standard x402 header. See
  * docs/architecture/07-edge-signer.md.
  */
@@ -51,6 +53,18 @@ interface EdgeSigner {
      * relayer broadcasts it and pays gas. Never broadcasts — pure signing.
      */
     signSweepAuthorization(input: SweepSignatureInput): Promise<SweepSignatureResult>;
+    /**
+     * Sign an EIP-4361 (SIWE) message with EIP-191 `personal_sign` (#3728) —
+     * the x402 Sign-In-With-X extension. The message ALWAYS reaches this method
+     * composed in-package by the tool layer (`siwx.ts`) from grammar-validated
+     * challenge fields, with the address taken from this key — never a
+     * caller-supplied string, hash or byte payload. The name is deliberately
+     * SIWX-scoped, not a generic `signMessage`: the delegate key's EIP-191
+     * surface on this interface stays single-purpose. Breaking for
+     * out-of-package `EdgeSigner` implementers (open question in #3728,
+     * decided: acceptable — the only implementation is `createEdgeSigner`).
+     */
+    signSiwxMessage(message: string): Promise<string>;
 }
 interface SweepSignatureInput {
     /** The authorization fields prepared by the backend. */
@@ -280,6 +294,12 @@ declare function signerCompatibility(): SignerCompatibility;
 declare function signerCapabilityAdvertisement(): {
     experimental: Record<string, SignerCompatibility>;
 };
+interface SignerIdentity {
+    /** The credential file's `agent_id`, or `HAVEN_AGENT_ID`; absent when neither is set. */
+    agentId?: string;
+    /** The delegate key's address — always known, since the signer holds the key. */
+    delegateAddress?: string;
+}
 /**
  * The agent-readable half: MCP `instructions`, which clients surface to the
  * model. The machine-readable capability above is the precise statement, but
@@ -289,8 +309,11 @@ declare function signerCapabilityAdvertisement(): {
  * It names the same fix as #1143 so an agent that hits either surface — the
  * handshake here or the signing-time error there — tells the user the same
  * thing.
+ *
+ * Since #3738 it also states the agent id and delegate address this signer is
+ * bound to, when `identity` is given.
  */
-declare function signerInstructions(): string;
+declare function signerInstructions(identity?: SignerIdentity): string;
 
 /**
  * The edge signer's own credential requires *only* `delegate_key` — unlike
@@ -458,12 +481,26 @@ interface SigningAuditEntry {
      */
     safe_address?: string;
     chain_id?: number;
+    /**
+     * #3728, additive like `safe_address`/`chain_id`: present on SIWX entries
+     * only — the challenge domain and nonce the composed message committed to.
+     * The `payload_hash` already pins the exact composed message (its sha256,
+     * pre-signature), so an entry is replayable without these; they make a
+     * sign-in row scannable without re-deriving the message. No existing key
+     * renamed (#2914).
+     */
+    domain?: string;
+    nonce?: string;
 }
 interface SigningAuditContext {
     delegateAddress: string;
     accountAddress?: string;
     chainId?: number;
     auditPath?: string;
+    /** #3728, SIWX entries only: the challenge domain, emitted onto the row. */
+    domain?: string;
+    /** #3728, SIWX entries only: the challenge nonce, emitted onto the row. */
+    nonce?: string;
 }
 declare function defaultSigningAuditPath(credentialsPath?: string): string;
 declare function appendSigningAuditEntry(entry: SigningAuditEntry, path: string, options?: AppendAuditOptions): Promise<void>;
@@ -510,7 +547,7 @@ declare const SIGNER_HOSTED_HANDOFF_SHAPES: {
  * `server.ts` re-exports them, so the package's public API is unchanged.
  */
 declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.8.1-alpha.0";
+declare const SIGNER_VERSION = "0.9.0-alpha.0";
 /**
  * #3419: the marker the tool layer prefixes the undeclared-argument refusal
  * with. The strict re-parse lives in THIS module (`parseStrictFor`, below) —
@@ -528,7 +565,7 @@ declare const UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
  * and pair with the hosted server's construct/relay tools (#183). They sign;
  * they never call the Haven API and never emit the key.
  */
-type SignerToolName = 'haven_sign' | 'haven_x402_sign_header' | 'haven_sign_x402' | 'haven_sign_sweep_delegate';
+type SignerToolName = 'haven_sign' | 'haven_sign_siwx' | 'haven_x402_sign_header' | 'haven_sign_x402' | 'haven_sign_sweep_delegate';
 declare const toolSchemas: {
     readonly haven_sign_sweep_delegate: {
         readonly authorization: z$1.ZodObject<{
@@ -725,6 +762,10 @@ declare const toolSchemas: {
         readonly typed_data: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>>;
         readonly typed_data_b64: z$1.ZodOptional<z$1.ZodString>;
     };
+    readonly haven_sign_siwx: {
+        readonly url: z$1.ZodString;
+        readonly challenge: z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>;
+    };
 };
 declare const toolDescriptions: Record<SignerToolName, string>;
 interface ToolSuccess<T> {
@@ -891,4 +932,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerIdentity, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };