@haven_ai/signer 0.5.0-alpha.1 → 0.7.0-alpha.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash } from 'crypto';
 import { recoverTypedDataAddress, hashTypedData, hashMessage } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
-import { createNextStepBuilder, addressFromKey, HavenSigningError, buildSweepTypedData, selectStandardPaymentOption, HavenApiError, toStandardPaymentRequirements, decodeBase64Json, encodeBase64Json, x402V2PaymentEnvelope, isSettlementChildTypedData, chainIdForNetwork, assertOwnSettlementChild, isPackedUserOperationTypedData, assertUserOpTypedDataBinding, assertBoundDirectPaymentUserOp, assertFundingLegPaysDelegate, HavenTypedDataRefusedError, buildSweepAuthorizationMessage, verifySignature, x402AuthorizationAmount, SignerRefusalCode, connectorRerunCommand, SIGNER_UPDATE_FALLBACK, HavenUnsupportedSignerVersionError, buildX402ExpectedMessage, DIRECT_SIGN_CONTEXT_VERSION, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, HavenUserOpBindingError, readClientUpdate, HAVEN_CLIENT_HEADER } from '@haven_ai/sdk/edge';
+import { createNextStepBuilder, addressFromKey, HavenSigningError, buildSweepTypedData, selectStandardPaymentOption, HavenApiError, toStandardPaymentRequirements, decodeBase64Json, encodeBase64Json, x402V2PaymentEnvelope, isSettlementChildTypedData, chainIdForNetwork, assertOwnSettlementChild, isPackedUserOperationTypedData, assertUserOpTypedDataBinding, assertBoundDirectPaymentUserOp, assertFundingLegPaysDelegate, HavenTypedDataRefusedError, buildSweepAuthorizationMessage, verifySignature, x402AuthorizationAmount, SignerRefusalCode, connectorUpgradeCommand, SIGNER_UPDATE_FALLBACK, HavenUnsupportedSignerVersionError, buildX402ExpectedMessage, TASK_SIGN_CONTEXT_VERSION, DIRECT_SIGN_CONTEXT_VERSION, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, HavenUserOpBindingError, connectorRerunCommand, assertOwnTaskChild, assertOwnTaskBudgetCloseUserOp, assertOwnSubBudgetChild, assertOwnSubBudgetCloseUserOp, readClientUpdate, HAVEN_CLIENT_HEADER } from '@haven_ai/sdk/edge';
 export { deriveDelegateAccountAddress } from '@haven_ai/sdk/edge';
 import { stat, lstat, chmod, readFile, mkdir, rename, appendFile, writeFile } from 'fs/promises';
 import { resolve, dirname, join } from 'path';
@@ -254,7 +254,7 @@ function assertSupportedBindingVersion(received, supported, context) {
   const highest = Math.max(...supported);
   const outOfDate = received > highest;
   const code = context === "x402 expected context" ? SignerRefusalCode.UnsupportedExpectedContextVersion : SignerRefusalCode.UnsupportedSweepBindingVersion;
-  const ceiling = outOfDate ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 rerun the Haven connector (\`${connectorRerunCommand()}\`), which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
+  const ceiling = outOfDate ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 run \`${connectorUpgradeCommand()}\`, then the repair line it prints, which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
   const fallback = outOfDate ? SIGNER_UPDATE_FALLBACK : `This ${context} version (${received}) is older than what this signer enforces (${supported.join(", ")}) \u2014 updating @haven_ai/signer will not restore it. Nothing was signed or spent; stop and tell the user rather than retrying.`;
   throw new HavenUnsupportedSignerVersionError(
     `${ceiling} Nothing was signed. Do not rewrite the version field to a supported value: it is part of the Haven-signed binding message, so changing it invalidates the signature and would misrepresent what Haven declared.`,
@@ -433,7 +433,7 @@ var HavenSignContextError = class extends HavenSigningError {
   /**
    * #3303: on a 426 `client_outdated` refusal, the backend's update hint —
    * this signer is below the minimum the deployment set, and
-   * `client_update.upgrade_command` is what updates it.
+   * `client_update.upgrade_command` starts the update (#3412: for the signer, the doctor, then its repair line).
    */
   client_update;
   constructor(message, code, refusal, paymentId, flow = "x402") {
@@ -450,7 +450,7 @@ var HavenSignContextError = class extends HavenSigningError {
         step = signerRefusalStep({
           nextAction: AgentPaymentNextAction.StopAndTellUser,
           nextTool: null,
-          nextToolOmittedReason: `this signer is below the minimum version Haven accepts \u2014 tell the user to run ${refusal.clientUpdate?.upgrade_command ?? "the connector again"}, restart the agent runtime, then retry the same haven_sign / haven_sign_x402 call`
+          nextToolOmittedReason: `this signer is below the minimum version Haven accepts \u2014 tell the user to run ${refusal.clientUpdate?.upgrade_command ?? connectorUpgradeCommand()} and the repair line it prints, restart the agent runtime, then retry the same haven_sign / haven_sign_x402 call`
         });
       } else if (flow === "direct" && refusal?.httpStatus === 404) {
         this.fallback = "typed_data_b64";
@@ -475,6 +475,13 @@ var HavenSignContextError = class extends HavenSigningError {
           nextTool: null,
           nextToolOmittedReason: "re-run the hosted quote tool you called with the same idempotency_key; which one depends on the flow"
         });
+      } else if (flow === "task") {
+        this.next_action = AgentPaymentNextAction.StopAndTellUser;
+        step = signerRefusalStep({
+          nextAction: AgentPaymentNextAction.StopAndTellUser,
+          nextTool: null,
+          nextToolOmittedReason: `re-check this task budget's status (id ${paymentId}) with the hosted Haven server before retrying`
+        });
       } else {
         this.next_action = AgentPaymentNextAction.StopAndTellUser;
         step = signerRefusalStep({
@@ -483,6 +490,13 @@ var HavenSignContextError = class extends HavenSigningError {
           nextArguments: { payment_id: paymentId }
         });
       }
+    } else if (flow === "task") {
+      this.next_action = AgentPaymentNextAction.StopAndTellUser;
+      step = signerRefusalStep({
+        nextAction: AgentPaymentNextAction.StopAndTellUser,
+        nextTool: null,
+        nextToolOmittedReason: "retry the same haven_sign call with the same task_budget_id"
+      });
     } else {
       this.fallback = "typed_data_b64";
       this.next_action = AgentPaymentNextAction.StopAndTellUser;
@@ -651,6 +665,229 @@ async function fetchDirectSignContext(identity, paymentId, fetchImpl = fetch, ti
     clientUpdate: readClientUpdate(body.client_update)
   };
 }
+var SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS = [TASK_SIGN_CONTEXT_VERSION];
+var SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS = [1];
+async function fetchSubBudgetSignContext(identity, subBudgetId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS, clientIdentity) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/sub-budgets/${encodeURIComponent(subBudgetId)}/sign-context`,
+      {
+        headers: signContextHeaders(identity, clientIdentity),
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the sub-budget signing-context fetch for ${subBudgetId} within ${timeoutMs} ms. Retry.` : `Could not reach Haven to fetch the sub-budget signing context for ${subBudgetId}: ${err instanceof Error ? err.message : String(err)}.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the sub-budget signing context for ${subBudgetId} within ${timeoutMs} ms. Retry.`,
+        "SIGN_CONTEXT_TIMEOUT",
+        void 0,
+        subBudgetId,
+        "task"
+      );
+    }
+    body = {};
+  }
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new HavenSignContextError(
+      `Haven refused the sub-budget signing-context fetch for ${subBudgetId}: ${detail}`,
+      "SIGN_CONTEXT_REFUSED",
+      refusalOf(response.status, body),
+      subBudgetId,
+      "task"
+    );
+  }
+  const purpose = body.purpose;
+  const typedData = body.typed_data;
+  const version = body.sub_budget_sign_context_version;
+  const expected = body.expected;
+  const malformed = (detail) => {
+    throw new HavenSignContextError(
+      `The Haven sub-budget sign-context response for ${subBudgetId} is malformed: ${detail}.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  };
+  if (typeof version !== "number" || !SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS.includes(version)) {
+    throw new HavenSignContextError(
+      `The Haven sub-budget sign-context response is version ${String(version)}, which this signer does not support (supported: ${SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS.join(", ")}). Update @haven_ai/signer.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  }
+  if (!typedData || typeof typedData !== "object") return malformed("missing typed_data");
+  if (!expected || typeof expected !== "object") return malformed("missing expected");
+  const e = expected;
+  if (purpose === "open") {
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.token_address !== "string" || typeof e.period_amount_atomic !== "string" || typeof e.period_duration_seconds !== "number" || typeof e.start_date !== "number" || e.recipient_address !== null && typeof e.recipient_address !== "string" || typeof e.expires_at !== "number" || typeof e.parent_delegation_hash !== "string" || typeof e.child_delegate_account !== "string") {
+      return malformed("expected is missing a required field for purpose open");
+    }
+    return {
+      purpose: "open",
+      subBudgetId: String(body.sub_budget_id ?? subBudgetId),
+      typedData,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        tokenAddress: e.token_address,
+        periodAmountAtomic: e.period_amount_atomic,
+        periodDurationSeconds: e.period_duration_seconds,
+        startDate: e.start_date,
+        recipientAddress: e.recipient_address ?? null,
+        expiresAt: e.expires_at,
+        parentDelegationHash: e.parent_delegation_hash,
+        childDelegateAccount: e.child_delegate_account
+      }
+    };
+  }
+  if (purpose === "close") {
+    const userOpHash = body.user_op_hash;
+    if (typeof userOpHash !== "string") return malformed("missing user_op_hash for purpose close");
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose close");
+    }
+    return {
+      purpose: "close",
+      subBudgetId: String(body.sub_budget_id ?? subBudgetId),
+      typedData,
+      userOpHash,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        delegationHash: e.delegation_hash
+      }
+    };
+  }
+  return malformed(`unknown purpose '${String(purpose)}'`);
+}
+async function fetchTaskBudgetSignContext(identity, taskBudgetId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS, clientIdentity) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/task-budgets/${encodeURIComponent(taskBudgetId)}/sign-context`,
+      {
+        headers: signContextHeaders(identity, clientIdentity),
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the task-budget signing-context fetch for ${taskBudgetId} within ${timeoutMs} ms. Retry.` : `Could not reach Haven to fetch the task-budget signing context for ${taskBudgetId}: ${err instanceof Error ? err.message : String(err)}.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the task-budget signing context for ${taskBudgetId} within ${timeoutMs} ms. Retry.`,
+        "SIGN_CONTEXT_TIMEOUT",
+        void 0,
+        taskBudgetId,
+        "task"
+      );
+    }
+    body = {};
+  }
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new HavenSignContextError(
+      `Haven refused the task-budget signing-context fetch for ${taskBudgetId}: ${detail}`,
+      "SIGN_CONTEXT_REFUSED",
+      refusalOf(response.status, body),
+      taskBudgetId,
+      "task"
+    );
+  }
+  const purpose = body.purpose;
+  const typedData = body.typed_data;
+  const version = body.task_sign_context_version;
+  const expected = body.expected;
+  const malformed = (detail) => {
+    throw new HavenSignContextError(
+      `The Haven task-budget sign-context response for ${taskBudgetId} is malformed: ${detail}.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  };
+  if (typeof version !== "number" || !SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS.includes(version)) {
+    throw new HavenSignContextError(
+      `The Haven task-budget sign-context response is version ${String(version)}, which this signer does not support (supported: ${SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS.join(", ")}). Update @haven_ai/signer.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      taskBudgetId,
+      "task"
+    );
+  }
+  if (!typedData || typeof typedData !== "object") return malformed("missing typed_data");
+  if (!expected || typeof expected !== "object") return malformed("missing expected");
+  const e = expected;
+  if (purpose === "open") {
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.token_address !== "string" || typeof e.max_amount_atomic !== "string" || e.recipient_address !== null && typeof e.recipient_address !== "string" || typeof e.expires_at !== "number" || typeof e.parent_delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose open");
+    }
+    return {
+      purpose: "open",
+      taskBudgetId: String(body.task_budget_id ?? taskBudgetId),
+      typedData,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        tokenAddress: e.token_address,
+        maxAmountAtomic: e.max_amount_atomic,
+        recipientAddress: e.recipient_address ?? null,
+        expiresAt: e.expires_at,
+        parentDelegationHash: e.parent_delegation_hash
+      }
+    };
+  }
+  if (purpose === "close") {
+    const userOpHash = body.user_op_hash;
+    if (typeof userOpHash !== "string") return malformed("missing user_op_hash for purpose close");
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose close");
+    }
+    return {
+      purpose: "close",
+      taskBudgetId: String(body.task_budget_id ?? taskBudgetId),
+      typedData,
+      userOpHash,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        delegationHash: e.delegation_hash
+      }
+    };
+  }
+  return malformed(`unknown purpose '${String(purpose)}'`);
+}
 
 // src/capabilities.ts
 var SIGNER_CAPABILITY_KEY = "haven/signer-compatibility";
@@ -658,7 +895,8 @@ function signerCompatibility() {
   return {
     x402_expected_context_versions: [...SUPPORTED_X402_EXPECTED_VERSIONS],
     sweep_binding_versions: [...SUPPORTED_SWEEP_BINDING_VERSIONS],
-    direct_sign_context_versions: [...SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS]
+    direct_sign_context_versions: [...SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS],
+    task_sign_context_versions: [...SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS]
   };
 }
 function signerCapabilityAdvertisement() {
@@ -677,12 +915,13 @@ function signerInstructions() {
     `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
     `- sweep authorization binding versions supported: ${compatibility.sweep_binding_versions.join(", ")}`,
     `- direct-payment (haven_send / haven_pay) sign-context versions supported: ${compatibility.direct_sign_context_versions.join(", ")} \u2014 pass payment_id alone to haven_sign; this signer fetches the exact bytes`,
+    `- task-budget sign-context versions supported: ${compatibility.task_sign_context_versions.join(", ")} \u2014 pass task_budget_id alone to haven_sign; this signer fetches the exact bytes`,
     "",
     "Haven quote and prepare results report the expected-context version they will emit",
     "(signer_compatibility.x402_expected_context_version). If that version is not in the list",
     "above, this signer is out of date: STOP before signing, and tell the user to update",
-    `@haven_ai/signer by rerunning \`${connectorRerunCommand()}\`, which reinstalls the pinned`,
-    "MCP runtime. Do not edit the version field to a supported value \u2014 it is part of the",
+    `@haven_ai/signer: run \`${connectorUpgradeCommand()}\`, then the repair line it prints,`,
+    "which reinstalls the pinned MCP runtime. Do not edit the version field to a supported value \u2014 it is part of the",
     "Haven-signed binding message, so changing it invalidates the signature.",
     "",
     "A version-mismatch refusal from haven_sign / haven_sign_x402 / haven_sign_sweep_delegate is",
@@ -690,7 +929,13 @@ function signerInstructions() {
     "fallback fields alongside the message, so you can branch on it directly. Every signer",
     "refusal also carries the next-step family: next_tool_name + next_tool_server_role when a",
     "hosted tool follows (resolve the role against your own server names), else",
-    "next_tool_omitted_reason saying why not."
+    "next_tool_omitted_reason saying why not.",
+    "",
+    "An undeclared top-level argument is refused, not stripped: haven_sign answers",
+    "UNSUPPORTED_ARGUMENT with unknown_arguments, signer_version and fallback (the update",
+    "command) instead of dropping the key and answering the generic signing error \u2014 if you see",
+    "that refusal, this signer predates the argument form you sent. Update the signer; nothing",
+    "was signed, fetched or audited."
   ].join("\n");
 }
 var OWNER_ONLY_MODE = 384;
@@ -909,6 +1154,9 @@ var HavenBareHashRefusedError = class extends HavenSigningError {
 };
 
 // src/tools.ts
+var SIGNER_NAME = "@haven_ai/signer";
+var SIGNER_VERSION = "0.7.0-alpha.0";
+var UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
 var USEROP_BINDING_MISMATCH = "USEROP_BINDING_MISMATCH";
 var HavenUserOpBindingRefusedError = class extends HavenSigningError {
   next_action = AgentPaymentNextAction.StopAndTellUser;
@@ -1029,7 +1277,20 @@ var toolSchemas = {
     // Bounded: a realistic redemption payload is ~10KB encoded; 256KB is
     // generous headroom while keeping the offline signer from materializing
     // arbitrarily large caller input.
-    typed_data_b64: z$1.string().min(1).max(262144).optional()
+    typed_data_b64: z$1.string().min(1).max(262144).optional(),
+    // #3329: sign a task budget's own child delegation (purpose `open`) or
+    // its early-close UserOp (purpose `close`) — the signer fetches the
+    // exact typed data and expectation itself, exactly like payment_id.
+    // Mutually exclusive with payment_id / payload_hash (checked in the
+    // handler, since Zod's object-level refine on a raw shape used by
+    // several call sites is not the shape this schema is composed as).
+    task_budget_id: z$1.string().min(1).optional(),
+    // #3330: sign a sub-budget's own child delegation or its early-close
+    // UserOp — same fetch-verify-sign channel as task_budget_id, against
+    // `GET /sub-budgets/:id/sign-context`. Mutually exclusive with
+    // payment_id / payload_hash AND with task_budget_id (checked in the
+    // handler).
+    sub_budget_id: z$1.string().min(1).optional()
   },
   haven_x402_sign_header: {
     // The parsed HTTP 402 PaymentRequired from the merchant. Typed as an object
@@ -1079,7 +1340,11 @@ var SIGN_DESCRIPTION = [
   "intent against a Haven-signed context \u2014 never an arbitrary typed_data payload, however it is shaped.",
   "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. A bare payload_hash with no payment_id, typed_data",
-  "or x402_expected is REFUSED (BARE_HASH_REFUSED): a hash carries nothing this signer can verify."
+  "or x402_expected is REFUSED (BARE_HASH_REFUSED): a hash carries nothing this signer can verify.",
+  "TASK BUDGETS (#3329): pass task_budget_id ALONE \u2014 mutually exclusive with payment_id and",
+  "payload_hash \u2014 to sign a task budget\u2019s own child delegation (opening it) or its early-close",
+  "UserOp; this signer fetches the exact typed data itself. Result then carries next_tool_name",
+  "(haven_submit) and next_arguments { task_budget_id, signature } instead of x402_binding."
 ].join(" ");
 var X402_SIGN_HEADER_DESCRIPTION = [
   "Build and sign the EIP-3009 merchant payment header for the merchant leg of an x402 payment.",
@@ -1243,9 +1508,172 @@ function createToolHandlers(signer, options = {}) {
       throw err;
     }
   }
+  async function signTaskBudget(taskBudgetId) {
+    const identity = await options.signContext?.loadIdentity() ?? null;
+    if (!identity) {
+      throw new HavenSigningError(
+        `task_budget_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run \`${connectorRerunCommand()}\` to restore it.`
+      );
+    }
+    const ctx = await fetchTaskBudgetSignContext(
+      identity,
+      taskBudgetId,
+      options.signContext?.fetchImpl,
+      void 0,
+      options.signContext?.clientIdentity
+    );
+    let signature;
+    if (ctx.purpose === "open") {
+      try {
+        assertOwnTaskChild(
+          ctx.typedData,
+          {
+            chainId: ctx.expected.chainId,
+            tokenAddress: ctx.expected.tokenAddress,
+            maxAmountAtomic: ctx.expected.maxAmountAtomic,
+            recipientAddress: ctx.expected.recipientAddress,
+            expiresAt: ctx.expected.expiresAt,
+            parentDelegationHash: ctx.expected.parentDelegationHash
+          },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    } else {
+      try {
+        assertUserOpTypedDataBinding(ctx.typedData, ctx.userOpHash);
+      } catch (err) {
+        if (err instanceof HavenUserOpBindingError) throw new HavenUserOpBindingRefusedError(err.message);
+        throw err;
+      }
+      try {
+        assertOwnTaskBudgetCloseUserOp(
+          ctx.typedData,
+          { delegationHash: ctx.expected.delegationHash },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    }
+    await auditSigning("haven_sign", hashTypedData(ctx.typedData));
+    return {
+      signature,
+      task_budget_id: ctx.taskBudgetId,
+      purpose: ctx.purpose,
+      next_tool_name: "haven_submit",
+      next_tool_server_role: "hosted",
+      next_arguments: { task_budget_id: ctx.taskBudgetId, signature }
+    };
+  }
+  async function signSubBudget(subBudgetId) {
+    const identity = await options.signContext?.loadIdentity() ?? null;
+    if (!identity) {
+      throw new HavenSigningError(
+        `sub_budget_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run \`${connectorRerunCommand()}\` to restore it.`
+      );
+    }
+    const ctx = await fetchSubBudgetSignContext(
+      identity,
+      subBudgetId,
+      options.signContext?.fetchImpl,
+      void 0,
+      options.signContext?.clientIdentity
+    );
+    let signature;
+    if (ctx.purpose === "open") {
+      try {
+        assertOwnSubBudgetChild(
+          ctx.typedData,
+          {
+            chainId: ctx.expected.chainId,
+            tokenAddress: ctx.expected.tokenAddress,
+            periodAmountAtomic: ctx.expected.periodAmountAtomic,
+            periodDurationSeconds: ctx.expected.periodDurationSeconds,
+            startDate: ctx.expected.startDate,
+            recipientAddress: ctx.expected.recipientAddress,
+            expiresAt: ctx.expected.expiresAt,
+            parentDelegationHash: ctx.expected.parentDelegationHash,
+            delegateAccount: ctx.expected.delegateAccount,
+            childDelegateAccount: ctx.expected.childDelegateAccount
+          },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    } else {
+      try {
+        assertUserOpTypedDataBinding(ctx.typedData, ctx.userOpHash);
+      } catch (err) {
+        if (err instanceof HavenUserOpBindingError) throw new HavenUserOpBindingRefusedError(err.message);
+        throw err;
+      }
+      try {
+        assertOwnSubBudgetCloseUserOp(
+          ctx.typedData,
+          { delegationHash: ctx.expected.delegationHash },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    }
+    await auditSigning("haven_sign", hashTypedData(ctx.typedData));
+    return {
+      signature,
+      sub_budget_id: ctx.subBudgetId,
+      purpose: ctx.purpose,
+      next_tool_name: "haven_submit",
+      next_tool_server_role: "hosted",
+      next_arguments: { sub_budget_id: ctx.subBudgetId, signature }
+    };
+  }
   return {
     haven_sign: async (input) => runTool(async () => {
-      const args = parse("haven_sign", coerceX402Expected(input));
+      const args = parseStrictFor("haven_sign", coerceX402Expected(input));
+      if (args.task_budget_id) {
+        if (args.payment_id || args.payload_hash) {
+          throw new z$1.ZodError([
+            {
+              code: z$1.ZodIssueCode.custom,
+              path: ["task_budget_id"],
+              message: "task_budget_id is mutually exclusive with payment_id / payload_hash \u2014 pass exactly one."
+            }
+          ]);
+        }
+        if (args.sub_budget_id) {
+          throw new z$1.ZodError([
+            {
+              code: z$1.ZodIssueCode.custom,
+              path: ["sub_budget_id"],
+              message: "task_budget_id is mutually exclusive with sub_budget_id \u2014 pass exactly one."
+            }
+          ]);
+        }
+        return signTaskBudget(args.task_budget_id);
+      }
+      if (args.sub_budget_id) {
+        if (args.payment_id || args.payload_hash) {
+          throw new z$1.ZodError([
+            {
+              code: z$1.ZodIssueCode.custom,
+              path: ["sub_budget_id"],
+              message: "sub_budget_id is mutually exclusive with payment_id / payload_hash \u2014 pass exactly one."
+            }
+          ]);
+        }
+        return signSubBudget(args.sub_budget_id);
+      }
       const resolved = await resolveSignContext(args, { allowDirectFallback: true });
       const typedData = resolved?.ctx.typedData ?? resolveTypedData(args);
       const payloadHash = resolved?.ctx.payloadHash ?? args.payload_hash;
@@ -1288,7 +1716,7 @@ function createToolHandlers(signer, options = {}) {
       return { signature: result.signature, x402_binding: result.x402Binding, ...clientUpdateField(resolved) };
     }),
     haven_x402_sign_header: async (input) => runTool(async () => {
-      const args = parse("haven_x402_sign_header", coercePaymentRequired(input));
+      const args = parseStrictFor("haven_x402_sign_header", coercePaymentRequired(input));
       const result = await signer.buildX402PaymentHeader(
         args.payment_required,
         args.x402_binding
@@ -1300,7 +1728,7 @@ function createToolHandlers(signer, options = {}) {
       return { payment_header: result.paymentHeader, accepted: result.accepted };
     }),
     haven_sign_x402: async (input) => runTool(async () => {
-      const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
+      const args = parseStrictFor("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
       const resolved = await resolveSignContext(args, { allowDirectFallback: false });
       const fetched = resolved?.kind === "x402" ? resolved.ctx : void 0;
       const payloadHash = fetched?.payloadHash ?? args.payload_hash;
@@ -1336,7 +1764,7 @@ function createToolHandlers(signer, options = {}) {
       };
     }),
     haven_sign_sweep_delegate: async (input) => runTool(async () => {
-      const args = parse("haven_sign_sweep_delegate", input);
+      const args = parseStrictFor("haven_sign_sweep_delegate", input);
       const result = await signer.signSweepAuthorization({
         authorization: args.authorization,
         expectedAuth: args.expected_auth,
@@ -1369,8 +1797,18 @@ function createToolHandlers(signer, options = {}) {
     }
   }
 }
-function parse(name, input) {
-  return z$1.object(toolSchemas[name]).parse(input ?? {});
+function parseStrictFor(name, input) {
+  const result = z$1.object(toolSchemas[name]).strict().safeParse(input ?? {});
+  if (result.success) return result.data;
+  const topLevelUnknown = result.error.issues.flatMap(
+    (issue) => issue.code === "unrecognized_keys" && issue.path.length === 0 ? issue.keys : []
+  );
+  if (topLevelUnknown.length === 0) throw result.error;
+  const unknown = [...new Set(topLevelUnknown)];
+  const err = new Error(
+    `${UNSUPPORTED_ARGUMENT_MARKER} ${name} does not accept ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 this signer predates that argument form. Nothing was signed or fetched.`
+  );
+  throw err;
 }
 function coerceX402Expected(input) {
   if (!input || typeof input !== "object") return input;
@@ -1409,6 +1847,25 @@ async function runTool(fn) {
   }
 }
 function normalizeError(err) {
+  if (err instanceof Error && err.message.startsWith(UNSUPPORTED_ARGUMENT_MARKER)) {
+    const unknown = [...err.message.matchAll(/"([^"]+)"/g)].map((m) => m[1]);
+    return {
+      success: false,
+      code: "UNSUPPORTED_ARGUMENT",
+      message: err.message.replace(`${UNSUPPORTED_ARGUMENT_MARKER} `, ""),
+      unknown_arguments: unknown,
+      signer_version: SIGNER_VERSION,
+      fallback: connectorUpgradeCommand(),
+      next_action: AgentPaymentNextAction.StopAndTellUser,
+      ...nextStepWireFields(
+        signerRefusalStep({
+          nextAction: AgentPaymentNextAction.StopAndTellUser,
+          nextTool: null,
+          nextToolOmittedReason: `update @haven_ai/signer: run ${connectorUpgradeCommand()} and the repair line it prints, then repeat the same call`
+        })
+      )
+    };
+  }
   if (err instanceof z$1.ZodError) {
     return {
       success: false,
@@ -1430,7 +1887,9 @@ function normalizeError(err) {
       ...nextStepWireFields(signerRefusalStep({
         nextAction: AgentPaymentNextAction.StopAndTellUser,
         nextTool: null,
-        nextToolOmittedReason: "update @haven_ai/signer by re-running the connector, then repeat the same call"
+        // #3412: the upgrade command, not "re-run the connector" — a bare re-run
+        // stops at "Missing --setup" on an existing install.
+        nextToolOmittedReason: `update @haven_ai/signer: run ${connectorUpgradeCommand()} and the repair line it prints, then repeat the same call`
       }))
     };
   }
@@ -1516,7 +1975,7 @@ function normalizeError(err) {
 
 // src/consent.ts
 var toolSummaries = {
-  haven_sign: "signs one Haven-prepared payment (a direct-payment UserOp from your own account whose only call redeems a delegation made to it, or an x402 funding intent against a Haven-signed context)",
+  haven_sign: "signs a Haven-prepared payment, task-budget open, or task-budget close (a UserOp from your own account whose only call redeems a delegation made to it, directly or through a self-delegated task-budget child, or an x402 funding intent against a Haven-signed context)",
   haven_x402_sign_header: "builds and signs the EIP-3009 merchant payment header for an x402 payment",
   haven_sign_x402: "the two above in one call: funding payload + merchant header",
   haven_sign_sweep_delegate: "signs a Haven-prepared gasless sweep of stranded funds back to your own account"
@@ -1645,8 +2104,6 @@ async function writeAckFile(path, hash) {
     "utf8"
   );
 }
-var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.5.0-alpha.1";
 async function resolveEdgeSigner(options = {}) {
   const { signer } = await resolveSignerRuntime(options);
   return signer;
@@ -1701,12 +2158,14 @@ function buildSignerMcpServer(signer, options = {}) {
       clientIdentity: havenClientIdentity(SIGNER_NAME, SIGNER_VERSION)
     }
   });
-  const registerTool = server.tool.bind(server);
+  const registerTool = server.registerTool.bind(server);
   for (const name of Object.keys(toolSchemas)) {
     registerTool(
       name,
-      toolDescriptions[name],
-      toolSchemas[name],
+      {
+        description: toolDescriptions[name],
+        inputSchema: z.object(toolSchemas[name]).passthrough()
+      },
       async (args) => toMcpResult(await handlers[name](args))
     );
   }
@@ -1760,6 +2219,6 @@ function toMcpResult(payload) {
   };
 }
 
-export { AUDIT_ROTATE_BYTES, OWNER_ONLY_MODE, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, OWNER_ONLY_MODE, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, UNSUPPORTED_ARGUMENT_MARKER, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map