feat(protocol): add personal server registration signing

[tnunamak]

Summary

• Re-stage the personal server registration and PS Lite owner-binding signing helpers directly against SDK main.
• Keeps protocol typed-data builders separate from Account-origin signing helpers.
• Adds package import validation for the new deep ESM subpaths.

Context

PR #147 was validated by unity-surfaces via @opendatalabs/vana-sdk@3.0.1-pr.147.f9fcf43, but it was merged into an intermediate branch and is not currently in the SDK main release path. This PR makes the same validated changes mergeable to main so Unity can later replace the PR prerelease with a normal SDK release.

Validation

• npm run build:sdk
• npm --workspace @opendatalabs/vana-sdk test -- --run (47 files, 656 tests)

Follow-up after release

Once this lands and publishes a normal @opendatalabs/vana-sdk release, update unity-surfaces away from 3.0.1-pr.147.f9fcf43 and remove the temporary pnpm override if no longer needed.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
vana-console	Ignored		May 14, 2026 4:31pm
vana-rbac-auditor	Ignored		May 14, 2026 4:31pm
vana-vibes-demo	Ignored		May 14, 2026 4:31pm

[tnunamak]

Unity is already consuming the validated PR prerelease @opendatalabs/vana-sdk@3.0.1-pr.147.f9fcf43 on dev for app-dev/account-dev.

Follow-up to remove that prerelease after this lands and publishes a normal SDK release is tracked here: https://github.com/vana-com/unity-surfaces/issues/63

[github-actions]

Findings

• Medium: packages/vana-sdk/src/account/personal-server-registration.ts:223 and line 296 trust Account-returned typedData without checking it matches the returned/fallback signer or the original request. If Account returns stale or mismatched typed data, the SDK can return or create a signature whose signer does not match typedData.message.ownerAddress, making the registration unusable. Validate typedData.message.ownerAddress, serverAddress, publicKey, serverUrl, and domain before returning or fallback-signing it.

• Low: packages/vana-sdk/scripts/validate-package-imports.ts:7 only validates two of the new deep ESM subpaths. The PR also adds protocol/personal-server-lite-owner-binding and account/personal-server-lite-owner-binding; include those in imports so packaging regressions for those exports are caught.

Validation

I attempted the targeted Vitest files and npm --workspace @opendatalabs/vana-sdk run typecheck, but this checkout is missing dev dependencies (vitest and @types/node), so local verification could not complete.

[tnunamak]

Addressed the automated review findings in 1e0eb06:

• Account helper now validates returned typedData against the expected signer, requested server fields, expected primary type/types, and requested domain before returning or fallback-signing it.
• Package import validation now covers both PS Lite owner-binding deep subpaths.

Validation after the patch:

• npm --workspace @opendatalabs/vana-sdk test -- --run src/account/personal-server-registration.test.ts
• npm --workspace @opendatalabs/vana-sdk run typecheck
• npm --workspace @opendatalabs/vana-sdk run validate:package-imports
• npm --workspace @opendatalabs/vana-sdk test -- --run
• npm run validate

GitHub CI is green on Node 20 and 22 after the patch.

[github-actions]

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀