@haven_ai/signer 0.6.0-alpha.0 → 0.7.0-alpha.0

package/dist/index.d.cts

@@ -488,6 +488,26 @@ declare const SIGNER_HOSTED_HANDOFF_SHAPES: {
     };
 };
 
+/**
+ * The signer's wire identity. Declared HERE, in the tools/handlers module —
+ * `server.ts` (the MCP wiring) imports them from this module, keeping the
+ * import graph one-directional (tools.ts ← server.ts, never the reverse);
+ * `server.ts` re-exports them, so the package's public API is unchanged.
+ */
+declare const SIGNER_NAME = "@haven_ai/signer";
+declare const SIGNER_VERSION = "0.7.0-alpha.0";
+/**
+ * #3419: the marker the tool layer prefixes the undeclared-argument refusal
+ * with. The strict re-parse lives in THIS module (`parseStrictFor`, below) —
+ * the same module as the `normalizeError` branch that shapes the refusal — so
+ * the marker, the message and the structured fields are one unit and cannot
+ * drift. The registration in `server.ts` is passthrough (the issue's "schema
+ * that keeps unknown keys"): the SDK layer lets an undeclared key through and
+ * the tool layer refuses it here, where the full structured refusal
+ * (`UNSUPPORTED_ARGUMENT` with `unknown_arguments`, `signer_version`,
+ * `fallback`) is still expressible as JSON on the result.
+ */
+declare const UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
 /**
  * Local signer tool set. These run on the agent's machine, next to the key,
  * and pair with the hosted server's construct/relay tools (#183). They sign;
@@ -612,6 +632,7 @@ declare const toolSchemas: {
         readonly typed_data: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>>;
         readonly typed_data_b64: z$1.ZodOptional<z$1.ZodString>;
         readonly task_budget_id: z$1.ZodOptional<z$1.ZodString>;
+        readonly sub_budget_id: z$1.ZodOptional<z$1.ZodString>;
     };
     readonly haven_x402_sign_header: {
         readonly payment_required: z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>;
@@ -727,6 +748,14 @@ interface ToolFailure {
      * field for every sign-context refusal (`'typed_data_b64'`).
      */
     fallback?: string;
+    /**
+     * #3419: present on `UNSUPPORTED_ARGUMENT` — the undeclared top-level
+     * argument names the caller sent (the strict schema's `unrecognized_keys`),
+     * so an agent can see exactly what this signer does not accept.
+     */
+    unknown_arguments?: string[];
+    /** #3419: present on `UNSUPPORTED_ARGUMENT` — this signer's own package version. */
+    signer_version?: string;
     /**
      * #3001: present on `SIGN_CONTEXT_REFUSED` — the HTTP status the backend
      * answered the sign-context fetch with (404, 410, …) — the x402 fetch, or
@@ -735,7 +764,7 @@ interface ToolFailure {
     http_status?: number;
     /** #3001: the backend's own `error_code` on `SIGN_CONTEXT_REFUSED` (`expired`, `already_executed`, `not_signable`, `sign_context_unavailable`, and since #3303 `client_outdated`). */
     backend_error_code?: string;
-    /** #3303: on `client_outdated`, the backend's update hint — `upgrade_command` is what updates this signer. */
+    /** #3303: on `client_outdated`, the backend's update hint — `upgrade_command` starts the update (the doctor, then its repair line — #3412). */
     client_update?: HavenClientUpdate;
 }
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
@@ -783,8 +812,6 @@ declare function computeSignerConsentHash(input: SignerConsentInput): string;
 declare function renderSignerConsentBlock(input: SignerConsentInput, hash: string): string;
 declare function ensureSignerConsent(input: SignerConsentInput, options?: SignerConsentOptions): Promise<SignerConsentDecision>;
 
-declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.6.0-alpha.0";
 interface SignerOptions {
     /** Path to a Haven credential JSON file (delegate_key is read from it). */
     credentialsPath?: string;
@@ -849,4 +876,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };

package/dist/index.d.ts

@@ -488,6 +488,26 @@ declare const SIGNER_HOSTED_HANDOFF_SHAPES: {
     };
 };
 
+/**
+ * The signer's wire identity. Declared HERE, in the tools/handlers module —
+ * `server.ts` (the MCP wiring) imports them from this module, keeping the
+ * import graph one-directional (tools.ts ← server.ts, never the reverse);
+ * `server.ts` re-exports them, so the package's public API is unchanged.
+ */
+declare const SIGNER_NAME = "@haven_ai/signer";
+declare const SIGNER_VERSION = "0.7.0-alpha.0";
+/**
+ * #3419: the marker the tool layer prefixes the undeclared-argument refusal
+ * with. The strict re-parse lives in THIS module (`parseStrictFor`, below) —
+ * the same module as the `normalizeError` branch that shapes the refusal — so
+ * the marker, the message and the structured fields are one unit and cannot
+ * drift. The registration in `server.ts` is passthrough (the issue's "schema
+ * that keeps unknown keys"): the SDK layer lets an undeclared key through and
+ * the tool layer refuses it here, where the full structured refusal
+ * (`UNSUPPORTED_ARGUMENT` with `unknown_arguments`, `signer_version`,
+ * `fallback`) is still expressible as JSON on the result.
+ */
+declare const UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
 /**
  * Local signer tool set. These run on the agent's machine, next to the key,
  * and pair with the hosted server's construct/relay tools (#183). They sign;
@@ -612,6 +632,7 @@ declare const toolSchemas: {
         readonly typed_data: z$1.ZodOptional<z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>>;
         readonly typed_data_b64: z$1.ZodOptional<z$1.ZodString>;
         readonly task_budget_id: z$1.ZodOptional<z$1.ZodString>;
+        readonly sub_budget_id: z$1.ZodOptional<z$1.ZodString>;
     };
     readonly haven_x402_sign_header: {
         readonly payment_required: z$1.ZodRecord<z$1.ZodString, z$1.ZodUnknown>;
@@ -727,6 +748,14 @@ interface ToolFailure {
      * field for every sign-context refusal (`'typed_data_b64'`).
      */
     fallback?: string;
+    /**
+     * #3419: present on `UNSUPPORTED_ARGUMENT` — the undeclared top-level
+     * argument names the caller sent (the strict schema's `unrecognized_keys`),
+     * so an agent can see exactly what this signer does not accept.
+     */
+    unknown_arguments?: string[];
+    /** #3419: present on `UNSUPPORTED_ARGUMENT` — this signer's own package version. */
+    signer_version?: string;
     /**
      * #3001: present on `SIGN_CONTEXT_REFUSED` — the HTTP status the backend
      * answered the sign-context fetch with (404, 410, …) — the x402 fetch, or
@@ -735,7 +764,7 @@ interface ToolFailure {
     http_status?: number;
     /** #3001: the backend's own `error_code` on `SIGN_CONTEXT_REFUSED` (`expired`, `already_executed`, `not_signable`, `sign_context_unavailable`, and since #3303 `client_outdated`). */
     backend_error_code?: string;
-    /** #3303: on `client_outdated`, the backend's update hint — `upgrade_command` is what updates this signer. */
+    /** #3303: on `client_outdated`, the backend's update hint — `upgrade_command` starts the update (the doctor, then its repair line — #3412). */
     client_update?: HavenClientUpdate;
 }
 type ToolPayload<T = unknown> = ToolSuccess<T> | ToolFailure;
@@ -783,8 +812,6 @@ declare function computeSignerConsentHash(input: SignerConsentInput): string;
 declare function renderSignerConsentBlock(input: SignerConsentInput, hash: string): string;
 declare function ensureSignerConsent(input: SignerConsentInput, options?: SignerConsentOptions): Promise<SignerConsentDecision>;
 
-declare const SIGNER_NAME = "@haven_ai/signer";
-declare const SIGNER_VERSION = "0.6.0-alpha.0";
 interface SignerOptions {
     /** Path to a Haven credential JSON file (delegate_key is read from it). */
     credentialsPath?: string;
@@ -849,4 +876,4 @@ declare function assertSupportedNodeVersion(nodeVersion?: string): void;
 declare function runSignerStdioServer(options?: SignerOptions): Promise<void>;
 declare function runSignerConsentGate(signer: EdgeSigner, credentials: SignerCredentials | undefined, options: SignerOptions): Promise<SignerConsentDecision>;
 
-export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, type AppendAuditOptions, type EdgeSigner, OWNER_ONLY_MODE, type PermissionLog, type PermissiveFile, type ResolvedSignerRuntime, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, type SignerCompatibility, type SignerConsentDecision, type SignerConsentInput, type SignerConsentOptions, type SignerCredentials, type SignerOptions, type SignerToolName, type SigningAuditContext, type SigningAuditEntry, type TightenOutcome, type ToolFailure, type ToolPayload, type ToolSuccess, UNSUPPORTED_ARGUMENT_MARKER, type X402ExpectedPayment, type X402FundingSignatureResult, type X402HeaderResult, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };

package/dist/index.js

@@ -1,7 +1,7 @@
 import { randomUUID, createHash } from 'crypto';
 import { recoverTypedDataAddress, hashTypedData, hashMessage } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
-import { createNextStepBuilder, addressFromKey, HavenSigningError, buildSweepTypedData, selectStandardPaymentOption, HavenApiError, toStandardPaymentRequirements, decodeBase64Json, encodeBase64Json, x402V2PaymentEnvelope, isSettlementChildTypedData, chainIdForNetwork, assertOwnSettlementChild, isPackedUserOperationTypedData, assertUserOpTypedDataBinding, assertBoundDirectPaymentUserOp, assertFundingLegPaysDelegate, HavenTypedDataRefusedError, buildSweepAuthorizationMessage, verifySignature, x402AuthorizationAmount, SignerRefusalCode, connectorRerunCommand, SIGNER_UPDATE_FALLBACK, HavenUnsupportedSignerVersionError, buildX402ExpectedMessage, DIRECT_SIGN_CONTEXT_VERSION, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, HavenUserOpBindingError, assertOwnTaskChild, assertOwnTaskBudgetCloseUserOp, readClientUpdate, HAVEN_CLIENT_HEADER } from '@haven_ai/sdk/edge';
+import { createNextStepBuilder, addressFromKey, HavenSigningError, buildSweepTypedData, selectStandardPaymentOption, HavenApiError, toStandardPaymentRequirements, decodeBase64Json, encodeBase64Json, x402V2PaymentEnvelope, isSettlementChildTypedData, chainIdForNetwork, assertOwnSettlementChild, isPackedUserOperationTypedData, assertUserOpTypedDataBinding, assertBoundDirectPaymentUserOp, assertFundingLegPaysDelegate, HavenTypedDataRefusedError, buildSweepAuthorizationMessage, verifySignature, x402AuthorizationAmount, SignerRefusalCode, connectorUpgradeCommand, SIGNER_UPDATE_FALLBACK, HavenUnsupportedSignerVersionError, buildX402ExpectedMessage, TASK_SIGN_CONTEXT_VERSION, DIRECT_SIGN_CONTEXT_VERSION, AgentPaymentNextAction, HavenError, AgentPaymentFailureCode, havenClientIdentity, isSupportedNodeVersion, unsupportedNodeVersionMessage, HavenUserOpBindingError, connectorRerunCommand, assertOwnTaskChild, assertOwnTaskBudgetCloseUserOp, assertOwnSubBudgetChild, assertOwnSubBudgetCloseUserOp, readClientUpdate, HAVEN_CLIENT_HEADER } from '@haven_ai/sdk/edge';
 export { deriveDelegateAccountAddress } from '@haven_ai/sdk/edge';
 import { stat, lstat, chmod, readFile, mkdir, rename, appendFile, writeFile } from 'fs/promises';
 import { resolve, dirname, join } from 'path';
@@ -254,7 +254,7 @@ function assertSupportedBindingVersion(received, supported, context) {
   const highest = Math.max(...supported);
   const outOfDate = received > highest;
   const code = context === "x402 expected context" ? SignerRefusalCode.UnsupportedExpectedContextVersion : SignerRefusalCode.UnsupportedSweepBindingVersion;
-  const ceiling = outOfDate ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 rerun the Haven connector (\`${connectorRerunCommand()}\`), which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
+  const ceiling = outOfDate ? `This signer is out of date: it supports ${context} versions up to ${highest}, and Haven sent version ${received}. Update @haven_ai/signer \u2014 run \`${connectorUpgradeCommand()}\`, then the repair line it prints, which reinstalls the pinned MCP runtime.` : `Unsupported ${context} version ${received}: this signer supports ${supported.join(", ")}.`;
   const fallback = outOfDate ? SIGNER_UPDATE_FALLBACK : `This ${context} version (${received}) is older than what this signer enforces (${supported.join(", ")}) \u2014 updating @haven_ai/signer will not restore it. Nothing was signed or spent; stop and tell the user rather than retrying.`;
   throw new HavenUnsupportedSignerVersionError(
     `${ceiling} Nothing was signed. Do not rewrite the version field to a supported value: it is part of the Haven-signed binding message, so changing it invalidates the signature and would misrepresent what Haven declared.`,
@@ -433,7 +433,7 @@ var HavenSignContextError = class extends HavenSigningError {
   /**
    * #3303: on a 426 `client_outdated` refusal, the backend's update hint —
    * this signer is below the minimum the deployment set, and
-   * `client_update.upgrade_command` is what updates it.
+   * `client_update.upgrade_command` starts the update (#3412: for the signer, the doctor, then its repair line).
    */
   client_update;
   constructor(message, code, refusal, paymentId, flow = "x402") {
@@ -450,7 +450,7 @@ var HavenSignContextError = class extends HavenSigningError {
         step = signerRefusalStep({
           nextAction: AgentPaymentNextAction.StopAndTellUser,
           nextTool: null,
-          nextToolOmittedReason: `this signer is below the minimum version Haven accepts \u2014 tell the user to run ${refusal.clientUpdate?.upgrade_command ?? "the connector again"}, restart the agent runtime, then retry the same haven_sign / haven_sign_x402 call`
+          nextToolOmittedReason: `this signer is below the minimum version Haven accepts \u2014 tell the user to run ${refusal.clientUpdate?.upgrade_command ?? connectorUpgradeCommand()} and the repair line it prints, restart the agent runtime, then retry the same haven_sign / haven_sign_x402 call`
         });
       } else if (flow === "direct" && refusal?.httpStatus === 404) {
         this.fallback = "typed_data_b64";
@@ -665,7 +665,120 @@ async function fetchDirectSignContext(identity, paymentId, fetchImpl = fetch, ti
     clientUpdate: readClientUpdate(body.client_update)
   };
 }
-var SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS = [1];
+var SUPPORTED_TASK_SIGN_CONTEXT_VERSIONS = [TASK_SIGN_CONTEXT_VERSION];
+var SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS = [1];
+async function fetchSubBudgetSignContext(identity, subBudgetId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS, clientIdentity) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/sub-budgets/${encodeURIComponent(subBudgetId)}/sign-context`,
+      {
+        headers: signContextHeaders(identity, clientIdentity),
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the sub-budget signing-context fetch for ${subBudgetId} within ${timeoutMs} ms. Retry.` : `Could not reach Haven to fetch the sub-budget signing context for ${subBudgetId}: ${err instanceof Error ? err.message : String(err)}.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the sub-budget signing context for ${subBudgetId} within ${timeoutMs} ms. Retry.`,
+        "SIGN_CONTEXT_TIMEOUT",
+        void 0,
+        subBudgetId,
+        "task"
+      );
+    }
+    body = {};
+  }
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new HavenSignContextError(
+      `Haven refused the sub-budget signing-context fetch for ${subBudgetId}: ${detail}`,
+      "SIGN_CONTEXT_REFUSED",
+      refusalOf(response.status, body),
+      subBudgetId,
+      "task"
+    );
+  }
+  const purpose = body.purpose;
+  const typedData = body.typed_data;
+  const version = body.sub_budget_sign_context_version;
+  const expected = body.expected;
+  const malformed = (detail) => {
+    throw new HavenSignContextError(
+      `The Haven sub-budget sign-context response for ${subBudgetId} is malformed: ${detail}.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  };
+  if (typeof version !== "number" || !SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS.includes(version)) {
+    throw new HavenSignContextError(
+      `The Haven sub-budget sign-context response is version ${String(version)}, which this signer does not support (supported: ${SUPPORTED_SUB_BUDGET_SIGN_CONTEXT_VERSIONS.join(", ")}). Update @haven_ai/signer.`,
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      subBudgetId,
+      "task"
+    );
+  }
+  if (!typedData || typeof typedData !== "object") return malformed("missing typed_data");
+  if (!expected || typeof expected !== "object") return malformed("missing expected");
+  const e = expected;
+  if (purpose === "open") {
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.token_address !== "string" || typeof e.period_amount_atomic !== "string" || typeof e.period_duration_seconds !== "number" || typeof e.start_date !== "number" || e.recipient_address !== null && typeof e.recipient_address !== "string" || typeof e.expires_at !== "number" || typeof e.parent_delegation_hash !== "string" || typeof e.child_delegate_account !== "string") {
+      return malformed("expected is missing a required field for purpose open");
+    }
+    return {
+      purpose: "open",
+      subBudgetId: String(body.sub_budget_id ?? subBudgetId),
+      typedData,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        tokenAddress: e.token_address,
+        periodAmountAtomic: e.period_amount_atomic,
+        periodDurationSeconds: e.period_duration_seconds,
+        startDate: e.start_date,
+        recipientAddress: e.recipient_address ?? null,
+        expiresAt: e.expires_at,
+        parentDelegationHash: e.parent_delegation_hash,
+        childDelegateAccount: e.child_delegate_account
+      }
+    };
+  }
+  if (purpose === "close") {
+    const userOpHash = body.user_op_hash;
+    if (typeof userOpHash !== "string") return malformed("missing user_op_hash for purpose close");
+    if (typeof e.delegate_account !== "string" || typeof e.chain_id !== "number" || typeof e.delegation_hash !== "string") {
+      return malformed("expected is missing a required field for purpose close");
+    }
+    return {
+      purpose: "close",
+      subBudgetId: String(body.sub_budget_id ?? subBudgetId),
+      typedData,
+      userOpHash,
+      expected: {
+        delegateAccount: e.delegate_account,
+        chainId: e.chain_id,
+        delegationHash: e.delegation_hash
+      }
+    };
+  }
+  return malformed(`unknown purpose '${String(purpose)}'`);
+}
 async function fetchTaskBudgetSignContext(identity, taskBudgetId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS, clientIdentity) {
   let response;
   try {
@@ -807,8 +920,8 @@ function signerInstructions() {
     "Haven quote and prepare results report the expected-context version they will emit",
     "(signer_compatibility.x402_expected_context_version). If that version is not in the list",
     "above, this signer is out of date: STOP before signing, and tell the user to update",
-    `@haven_ai/signer by rerunning \`${connectorRerunCommand()}\`, which reinstalls the pinned`,
-    "MCP runtime. Do not edit the version field to a supported value \u2014 it is part of the",
+    `@haven_ai/signer: run \`${connectorUpgradeCommand()}\`, then the repair line it prints,`,
+    "which reinstalls the pinned MCP runtime. Do not edit the version field to a supported value \u2014 it is part of the",
     "Haven-signed binding message, so changing it invalidates the signature.",
     "",
     "A version-mismatch refusal from haven_sign / haven_sign_x402 / haven_sign_sweep_delegate is",
@@ -816,7 +929,13 @@ function signerInstructions() {
     "fallback fields alongside the message, so you can branch on it directly. Every signer",
     "refusal also carries the next-step family: next_tool_name + next_tool_server_role when a",
     "hosted tool follows (resolve the role against your own server names), else",
-    "next_tool_omitted_reason saying why not."
+    "next_tool_omitted_reason saying why not.",
+    "",
+    "An undeclared top-level argument is refused, not stripped: haven_sign answers",
+    "UNSUPPORTED_ARGUMENT with unknown_arguments, signer_version and fallback (the update",
+    "command) instead of dropping the key and answering the generic signing error \u2014 if you see",
+    "that refusal, this signer predates the argument form you sent. Update the signer; nothing",
+    "was signed, fetched or audited."
   ].join("\n");
 }
 var OWNER_ONLY_MODE = 384;
@@ -1035,6 +1154,9 @@ var HavenBareHashRefusedError = class extends HavenSigningError {
 };
 
 // src/tools.ts
+var SIGNER_NAME = "@haven_ai/signer";
+var SIGNER_VERSION = "0.7.0-alpha.0";
+var UNSUPPORTED_ARGUMENT_MARKER = "HavenSignerUnsupportedArgument:";
 var USEROP_BINDING_MISMATCH = "USEROP_BINDING_MISMATCH";
 var HavenUserOpBindingRefusedError = class extends HavenSigningError {
   next_action = AgentPaymentNextAction.StopAndTellUser;
@@ -1162,7 +1284,13 @@ var toolSchemas = {
     // Mutually exclusive with payment_id / payload_hash (checked in the
     // handler, since Zod's object-level refine on a raw shape used by
     // several call sites is not the shape this schema is composed as).
-    task_budget_id: z$1.string().min(1).optional()
+    task_budget_id: z$1.string().min(1).optional(),
+    // #3330: sign a sub-budget's own child delegation or its early-close
+    // UserOp — same fetch-verify-sign channel as task_budget_id, against
+    // `GET /sub-budgets/:id/sign-context`. Mutually exclusive with
+    // payment_id / payload_hash AND with task_budget_id (checked in the
+    // handler).
+    sub_budget_id: z$1.string().min(1).optional()
   },
   haven_x402_sign_header: {
     // The parsed HTTP 402 PaymentRequired from the merchant. Typed as an object
@@ -1443,9 +1571,76 @@ function createToolHandlers(signer, options = {}) {
       next_arguments: { task_budget_id: ctx.taskBudgetId, signature }
     };
   }
+  async function signSubBudget(subBudgetId) {
+    const identity = await options.signContext?.loadIdentity() ?? null;
+    if (!identity) {
+      throw new HavenSigningError(
+        `sub_budget_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run \`${connectorRerunCommand()}\` to restore it.`
+      );
+    }
+    const ctx = await fetchSubBudgetSignContext(
+      identity,
+      subBudgetId,
+      options.signContext?.fetchImpl,
+      void 0,
+      options.signContext?.clientIdentity
+    );
+    let signature;
+    if (ctx.purpose === "open") {
+      try {
+        assertOwnSubBudgetChild(
+          ctx.typedData,
+          {
+            chainId: ctx.expected.chainId,
+            tokenAddress: ctx.expected.tokenAddress,
+            periodAmountAtomic: ctx.expected.periodAmountAtomic,
+            periodDurationSeconds: ctx.expected.periodDurationSeconds,
+            startDate: ctx.expected.startDate,
+            recipientAddress: ctx.expected.recipientAddress,
+            expiresAt: ctx.expected.expiresAt,
+            parentDelegationHash: ctx.expected.parentDelegationHash,
+            delegateAccount: ctx.expected.delegateAccount,
+            childDelegateAccount: ctx.expected.childDelegateAccount
+          },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    } else {
+      try {
+        assertUserOpTypedDataBinding(ctx.typedData, ctx.userOpHash);
+      } catch (err) {
+        if (err instanceof HavenUserOpBindingError) throw new HavenUserOpBindingRefusedError(err.message);
+        throw err;
+      }
+      try {
+        assertOwnSubBudgetCloseUserOp(
+          ctx.typedData,
+          { delegationHash: ctx.expected.delegationHash },
+          signer.delegateAddress
+        );
+      } catch (err) {
+        if (err instanceof HavenTypedDataRefusedError) throw err;
+        throw new HavenTypedDataRefusedError(err instanceof Error ? err.message : String(err));
+      }
+      signature = await signer.signDelegationTypedData(ctx.typedData);
+    }
+    await auditSigning("haven_sign", hashTypedData(ctx.typedData));
+    return {
+      signature,
+      sub_budget_id: ctx.subBudgetId,
+      purpose: ctx.purpose,
+      next_tool_name: "haven_submit",
+      next_tool_server_role: "hosted",
+      next_arguments: { sub_budget_id: ctx.subBudgetId, signature }
+    };
+  }
   return {
     haven_sign: async (input) => runTool(async () => {
-      const args = parse("haven_sign", coerceX402Expected(input));
+      const args = parseStrictFor("haven_sign", coerceX402Expected(input));
       if (args.task_budget_id) {
         if (args.payment_id || args.payload_hash) {
           throw new z$1.ZodError([
@@ -1456,8 +1651,29 @@ function createToolHandlers(signer, options = {}) {
             }
           ]);
         }
+        if (args.sub_budget_id) {
+          throw new z$1.ZodError([
+            {
+              code: z$1.ZodIssueCode.custom,
+              path: ["sub_budget_id"],
+              message: "task_budget_id is mutually exclusive with sub_budget_id \u2014 pass exactly one."
+            }
+          ]);
+        }
         return signTaskBudget(args.task_budget_id);
       }
+      if (args.sub_budget_id) {
+        if (args.payment_id || args.payload_hash) {
+          throw new z$1.ZodError([
+            {
+              code: z$1.ZodIssueCode.custom,
+              path: ["sub_budget_id"],
+              message: "sub_budget_id is mutually exclusive with payment_id / payload_hash \u2014 pass exactly one."
+            }
+          ]);
+        }
+        return signSubBudget(args.sub_budget_id);
+      }
       const resolved = await resolveSignContext(args, { allowDirectFallback: true });
       const typedData = resolved?.ctx.typedData ?? resolveTypedData(args);
       const payloadHash = resolved?.ctx.payloadHash ?? args.payload_hash;
@@ -1500,7 +1716,7 @@ function createToolHandlers(signer, options = {}) {
       return { signature: result.signature, x402_binding: result.x402Binding, ...clientUpdateField(resolved) };
     }),
     haven_x402_sign_header: async (input) => runTool(async () => {
-      const args = parse("haven_x402_sign_header", coercePaymentRequired(input));
+      const args = parseStrictFor("haven_x402_sign_header", coercePaymentRequired(input));
       const result = await signer.buildX402PaymentHeader(
         args.payment_required,
         args.x402_binding
@@ -1512,7 +1728,7 @@ function createToolHandlers(signer, options = {}) {
       return { payment_header: result.paymentHeader, accepted: result.accepted };
     }),
     haven_sign_x402: async (input) => runTool(async () => {
-      const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
+      const args = parseStrictFor("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
       const resolved = await resolveSignContext(args, { allowDirectFallback: false });
       const fetched = resolved?.kind === "x402" ? resolved.ctx : void 0;
       const payloadHash = fetched?.payloadHash ?? args.payload_hash;
@@ -1548,7 +1764,7 @@ function createToolHandlers(signer, options = {}) {
       };
     }),
     haven_sign_sweep_delegate: async (input) => runTool(async () => {
-      const args = parse("haven_sign_sweep_delegate", input);
+      const args = parseStrictFor("haven_sign_sweep_delegate", input);
       const result = await signer.signSweepAuthorization({
         authorization: args.authorization,
         expectedAuth: args.expected_auth,
@@ -1581,8 +1797,18 @@ function createToolHandlers(signer, options = {}) {
     }
   }
 }
-function parse(name, input) {
-  return z$1.object(toolSchemas[name]).parse(input ?? {});
+function parseStrictFor(name, input) {
+  const result = z$1.object(toolSchemas[name]).strict().safeParse(input ?? {});
+  if (result.success) return result.data;
+  const topLevelUnknown = result.error.issues.flatMap(
+    (issue) => issue.code === "unrecognized_keys" && issue.path.length === 0 ? issue.keys : []
+  );
+  if (topLevelUnknown.length === 0) throw result.error;
+  const unknown = [...new Set(topLevelUnknown)];
+  const err = new Error(
+    `${UNSUPPORTED_ARGUMENT_MARKER} ${name} does not accept ${unknown.map((k) => `"${k}"`).join(", ")} \u2014 this signer predates that argument form. Nothing was signed or fetched.`
+  );
+  throw err;
 }
 function coerceX402Expected(input) {
   if (!input || typeof input !== "object") return input;
@@ -1621,6 +1847,25 @@ async function runTool(fn) {
   }
 }
 function normalizeError(err) {
+  if (err instanceof Error && err.message.startsWith(UNSUPPORTED_ARGUMENT_MARKER)) {
+    const unknown = [...err.message.matchAll(/"([^"]+)"/g)].map((m) => m[1]);
+    return {
+      success: false,
+      code: "UNSUPPORTED_ARGUMENT",
+      message: err.message.replace(`${UNSUPPORTED_ARGUMENT_MARKER} `, ""),
+      unknown_arguments: unknown,
+      signer_version: SIGNER_VERSION,
+      fallback: connectorUpgradeCommand(),
+      next_action: AgentPaymentNextAction.StopAndTellUser,
+      ...nextStepWireFields(
+        signerRefusalStep({
+          nextAction: AgentPaymentNextAction.StopAndTellUser,
+          nextTool: null,
+          nextToolOmittedReason: `update @haven_ai/signer: run ${connectorUpgradeCommand()} and the repair line it prints, then repeat the same call`
+        })
+      )
+    };
+  }
   if (err instanceof z$1.ZodError) {
     return {
       success: false,
@@ -1642,7 +1887,9 @@ function normalizeError(err) {
       ...nextStepWireFields(signerRefusalStep({
         nextAction: AgentPaymentNextAction.StopAndTellUser,
         nextTool: null,
-        nextToolOmittedReason: "update @haven_ai/signer by re-running the connector, then repeat the same call"
+        // #3412: the upgrade command, not "re-run the connector" — a bare re-run
+        // stops at "Missing --setup" on an existing install.
+        nextToolOmittedReason: `update @haven_ai/signer: run ${connectorUpgradeCommand()} and the repair line it prints, then repeat the same call`
       }))
     };
   }
@@ -1857,8 +2104,6 @@ async function writeAckFile(path, hash) {
     "utf8"
   );
 }
-var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.6.0-alpha.0";
 async function resolveEdgeSigner(options = {}) {
   const { signer } = await resolveSignerRuntime(options);
   return signer;
@@ -1913,12 +2158,14 @@ function buildSignerMcpServer(signer, options = {}) {
       clientIdentity: havenClientIdentity(SIGNER_NAME, SIGNER_VERSION)
     }
   });
-  const registerTool = server.tool.bind(server);
+  const registerTool = server.registerTool.bind(server);
   for (const name of Object.keys(toolSchemas)) {
     registerTool(
       name,
-      toolDescriptions[name],
-      toolSchemas[name],
+      {
+        description: toolDescriptions[name],
+        inputSchema: z.object(toolSchemas[name]).passthrough()
+      },
       async (args) => toMcpResult(await handlers[name](args))
     );
   }
@@ -1972,6 +2219,6 @@ function toMcpResult(payload) {
   };
 }
 
-export { AUDIT_ROTATE_BYTES, OWNER_ONLY_MODE, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
+export { AUDIT_ROTATE_BYTES, OWNER_ONLY_MODE, SIGNER_ACK_ENV, SIGNER_CAPABILITY_KEY, SIGNER_HOSTED_HANDOFF_SHAPES, SIGNER_NAME, SIGNER_VERSION, SUPPORTED_SWEEP_BINDING_VERSIONS, SUPPORTED_X402_EXPECTED_VERSIONS, UNSUPPORTED_ARGUMENT_MARKER, appendSigningAuditEntry, assertSupportedBindingVersion, assertSupportedNodeVersion, assertX402MatchesExpected, buildSignerMcpServer, computeSignerConsentHash, createEdgeSigner, createSigningAuditEntry, createToolHandlers, defaultSigningAuditPath, ensureSignerConsent, hashPayloadForAudit, loadSignerCredentials, permissiveMode, readAccountAddressEnv, readAccountAddressField, renderSignerConsentBlock, resolveEdgeSigner, resolveSignerRuntime, runSignerConsentGate, runSignerStdioServer, signerCapabilityAdvertisement, signerCompatibility, signerInstructions, tightenIfFilePermissive, toolDescriptions, toolSchemas, warnIfCredentialFilePermissive, warnIfFilePermissive };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map