@haven_ai/signer 0.0.0-dev.202609232125.72f3d20 → 0.0.0-dev.202609241802.ea320de

package/README.md

@@ -70,7 +70,8 @@ The `initialize` handshake advertises which binding versions this signer
 understands, under `capabilities.experimental['haven/signer-compatibility']`
 and in the MCP `instructions` string. Both are **derived** from
 `SUPPORTED_X402_EXPECTED_VERSIONS` / `SUPPORTED_SWEEP_BINDING_VERSIONS` in
-`src/core.ts` — the same constants the signing path enforces — so this README
+`src/core.ts` and `SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS` in
+`src/sign-context.ts` (#3271) — the same constants the signing path enforces — so this README
 deliberately does not restate the numbers. Read them from the handshake, or
 from those constants.
 
@@ -102,6 +103,27 @@ verifies something before it signs, and `haven_sign` called with a bare
 `payload_hash` answers `BARE_HASH_REFUSED` with a typed next step instead of a
 signature.
 
+**Direct payments (#3271).** A direct payment (`POST /payments`, surfaced as
+`haven_send` / `haven_pay`) is signed as the account's EIP-712
+`PackedUserOperation`, and Haven returns both that typed data and
+`payload_hash` — the ERC-4337 v0.7 UserOperation hash of the same operation.
+Before `haven_sign` signs one, it recomputes that hash from the typed data's
+own domain, types and message and refuses (`USEROP_BINDING_MISMATCH`) unless
+it equals `payload_hash` exactly, in the HybridDeleGator domain of the typed
+data's own sender, against the v0.7 EntryPoint. This is a **corruption**
+check: the caller supplies both values, so it proves they describe the same
+operation, never that Haven prepared it — provenance is `payment_id` (below).
+It runs whether the typed data arrived as a tool argument or by the
+`payment_id` fetch; a fetched direct context that is not a
+`PackedUserOperation` at all is refused by the same check. The x402 EIP-3009
+bridge's funding leg keeps its own digest check against the Haven-signed
+expected context in this signer (the SDK's `signForData` runs this binding
+check there too). The check exists because this typed data is
+multi-KB and can reach the signer through a language model relaying it by
+hand: one corrupted character used to produce a valid-looking signature over
+the wrong digest, surfacing only as an opaque `AA24 signature error` from the
+bundler, after the signature was already produced.
+
 ## Startup, CLI options and the consent screen (#3173)
 
 **Startup cost.** The signer loads `@haven_ai/sdk/edge` — the ethers-free
@@ -195,6 +217,10 @@ funding confirms — so relay it promptly.
 
 ## What the signer refuses to sign
 
+(`USEROP_BINDING_MISMATCH`, the #3271 direct-payment refusal, is described
+under [Two ways to use it](#two-ways-to-use-it) and in the
+[refusal table](#sign-context-refusal-codes).)
+
 These are local, independent checks. They do not trust Haven's assertion about
 what a payload means; they re-derive it.
 
@@ -239,7 +265,8 @@ what a payload means; they re-derive it.
 ## Sign-context refusal codes
 
 `{ payment_id }` calls (`haven_sign` / `haven_sign_x402`) fetch the exact
-signing payload from Haven (`GET /x402/:id/sign-context`, see
+signing payload from Haven (`GET /x402/:id/sign-context`, and for a direct
+payment `GET /payments/:id/sign-context` — see the #3271 paragraph below and
 [Custody](#custody)). Every refusal on that fetch is a `HavenSignContextError`
 (#3001) — a `HavenSigningError` subclass, so `instanceof HavenSigningError`
 still holds everywhere it did before, but structured like the version-mismatch
@@ -252,24 +279,44 @@ refusal class — `fallback`, `retry_with_new_quote`, `http_status`,
 names); every other row carries `next_tool_omitted_reason` with the exact
 remedy. `message` is unchanged.
 
+**#3271: `haven_sign` (never `haven_sign_x402`) has one escape from this
+table.** When the x402 fetch answers `SIGN_CONTEXT_REFUSED` with
+`http_status: 409` and `backend_error_code: 'sign_context_unavailable'` — this
+`payment_id` names a direct payment, not an x402 intent — `haven_sign` fetches
+`GET /payments/:id/sign-context` instead, same auth header, timeout and
+refusal structuring. That second fetch's own refusals reuse the codes in the
+table below with direct-payment remedies: no quote to re-run, and the
+`typed_data_b64` relay from the `haven_send` / `haven_pay` result is the
+fallback. A 409 `sign_context_unavailable` from the direct route too (an
+x402 row the x402 route could not serve, or a direct row with no stored
+signing payload) surfaces the x402 route's own refusal instead. `haven_sign_x402` never takes this branch: a direct payment
+carries no x402 context to fund a merchant retry with, so it surfaces the
+409 unchanged.
+
 | `code` | When | `next_action` | `fallback` | extra |
 |---|---|---|---|---|
 | `SIGN_CONTEXT_TIMEOUT` | The fetch (or its body read) did not finish within `SIGN_CONTEXT_TIMEOUT_MS` | `stop_and_tell_user` | `typed_data_b64` | — |
 | `SIGN_CONTEXT_UNREACHABLE` | The fetch failed before any response (DNS, connection refused, TLS, …) | `stop_and_tell_user` | `typed_data_b64` | — |
-| `SIGN_CONTEXT_MALFORMED` | The response body was missing `sign_data.typed_data` or `x402_expected` (a pre-#1263 backend) | `stop_and_tell_user` | `typed_data_b64` | — |
-| `SIGN_CONTEXT_REFUSED` (410 / `expired`) | The quote's window closed | `payment_window_expired` | — | `retry_with_new_quote: true`, `http_status`, `backend_error_code: 'expired'` |
-| `SIGN_CONTEXT_REFUSED` (other) | Unknown `payment_id` (404), `already_executed` / `not_signable` / `sign_context_unavailable` (409) | `stop_and_tell_user` | — | `http_status`, `backend_error_code` |
+| `SIGN_CONTEXT_MALFORMED` | The response body was missing `sign_data.typed_data` / `x402_expected` (a pre-#1263 backend), or — on the direct-payment fetch — an unsupported `direct_sign_context_version` or a `signature_scheme` other than `eip712_userop` | `stop_and_tell_user` | `typed_data_b64` | — |
+| `SIGN_CONTEXT_REFUSED` (x402: 410 or `expired`; direct: `expired` only) | x402: the quote's window closed. Direct: the payment's window closed — call `haven_send` / `haven_pay` again with the same `idempotency_key` | `payment_window_expired` | — | x402 only: `retry_with_new_quote: true`; both: `http_status`, and `backend_error_code: 'expired'` when the backend sent one |
+| `SIGN_CONTEXT_REFUSED` (404, direct fetch) | The `payment_id` is not this agent's, or the backend predates #3271 and has no direct route | `stop_and_tell_user` | `typed_data_b64` | `http_status`, `backend_error_code` |
+| `SIGN_CONTEXT_REFUSED` (other) | Unknown `payment_id` (404, x402 fetch), `already_executed` / `not_signable` (409), a bare 410 retired-rail tombstone (direct fetch) — or `sign_context_unavailable` (409): always on `haven_sign_x402`; on `haven_sign` only when neither route can serve the row | `stop_and_tell_user` | — | `http_status`, `backend_error_code` |
+| `USEROP_BINDING_MISMATCH` | A direct payment's `PackedUserOperation` typed data (from the direct fetch, or a tool argument) does not recompute to its own `payload_hash`, or a fetched direct context is not a `PackedUserOperation` — see [Two ways to use it](#two-ways-to-use-it) above | `stop_and_tell_user` | — | no `http_status` — this is a local recomputation, not a backend refusal |
 
 `fallback: 'typed_data_b64'` appears only where signing OTHER bytes is a
-remedy — a transport failure or a body this signer could not read. It is
-**not** in the default quote result since #1272: obtain it by re-running the
-SAME quote tool with the SAME `idempotency_key` plus
-`include_signing_payload: true`, then pass `typed_data_b64` (plus
-`payload_hash` / `x402_expected`) instead of `payment_id`. A backend REFUSAL
+remedy — a transport failure or a body this signer could not read, plus one
+backend refusal: a 404 from the direct-payment fetch (an older backend with
+no direct route, #3271). For x402 it is **not** in the default quote result
+since #1272: obtain it by re-running the SAME quote tool with the SAME
+`idempotency_key` plus `include_signing_payload: true`, then pass
+`typed_data_b64` (plus `payload_hash` / `x402_expected`) instead of
+`payment_id`. A direct payment's `haven_send` / `haven_pay` result always
+carries `payload_hash` + `typed_data_b64`. Any other backend REFUSAL
 carries no fallback: an expired, executed or unsignable intent cannot be
-rescued by re-signing its bytes — an expired one is re-quoted (the same
+rescued by re-signing its bytes — an expired x402 one is re-quoted (the same
 `payment_window_expired` + `retry_with_new_quote` the signer emits for
-`PAYMENT_WINDOW_EXPIRED`), the rest stop. These codes are signer-local,
+`PAYMENT_WINDOW_EXPIRED`), an expired direct one is re-sent with the same
+`idempotency_key` (no `retry_with_new_quote`), the rest stop. These codes are signer-local,
 not part of `@haven_ai/sdk`'s `AgentPaymentFailureCode` taxonomy, since they
 describe a local fetch failure, not a payment-domain outcome, and never reach
 the backend's REST/OpenAPI surface — only this package's MCP tool responses.
@@ -280,19 +327,23 @@ The delegate key is read from `HAVEN_DELEGATE_KEY` or a `--credentials` file's
 `delegate_key` (with a permissive-file warning). It stays in this process, and
 is never transmitted.
 
-**The signer makes at most one kind of network call, on one path, and it is a
-read.** Since [#1263](https://github.com/d-hinders/Haven-AI/issues/1263) the
-`{ payment_id }` form of `haven_sign` and `haven_sign_x402` performs an
-authenticated, read-only `GET /x402/:payment_id/sign-context` against Haven, so
-that agents never have to relay multi-KB EIP-712 payloads through a model's
-context window. **Only the Bearer API key goes out; the delegate key is never
-part of that request or its response.** Since #2985 that read is bounded:
-it aborts after `SIGN_CONTEXT_TIMEOUT_MS` (15 s) and reports a
-`HavenSignContextError` naming the timeout and the `typed_data_b64` fallback,
-so a hung backend cannot hang the signer — and the agent — past the funding
-window. Every refusal on this fetch (timeout, unreachable host, a non-ok
-backend response, a malformed body) is structured the same way, not just
-prose — see [Sign-context refusal codes](#sign-context-refusal-codes) below.
+**The signer makes at most two kinds of network call, both reads.** Since
+[#1263](https://github.com/d-hinders/Haven-AI/issues/1263) the `{ payment_id }`
+form of `haven_sign` and `haven_sign_x402` performs an authenticated,
+read-only `GET /x402/:payment_id/sign-context` against Haven, so that agents
+never have to relay multi-KB EIP-712 payloads through a model's context
+window. Since #3271, `haven_sign` (never `haven_sign_x402`) falls back to a
+second read — `GET /payments/:payment_id/sign-context` — only when that first
+fetch answers the backend's 409 `sign_context_unavailable`, i.e. this
+`payment_id` names a direct payment rather than an x402 intent. **Only the
+Bearer API key goes out on either read; the delegate key is never part of
+either request or response.** Since #2985 both reads are bounded: each aborts
+after `SIGN_CONTEXT_TIMEOUT_MS` (15 s) and reports a `HavenSignContextError`
+naming the timeout and the `typed_data_b64` fallback, so a hung backend cannot
+hang the signer — and the agent — past the funding window. Every refusal on
+either fetch (timeout, unreachable host, a non-ok backend response, a
+malformed body) is structured the same way, not just prose — see
+[Sign-context refusal codes](#sign-context-refusal-codes) below.
 Nothing else in the package reaches the
 network: `haven_x402_sign_header` and `haven_sign_sweep_delegate` never fetch,
 the library surface above (`createEdgeSigner` and its six signing methods, over

package/dist/cli.cjs

@@ -289,6 +289,7 @@ function stableStringify(value) {
   const object = value;
   return `{${Object.keys(object).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(object[key])}`).join(",")}}`;
 }
+var DIRECT_RELAY_FALLBACK = "call haven_sign with payload_hash and typed_data_b64 from the haven_send / haven_pay result, passed through unchanged";
 var HavenSignContextError = class extends edge.HavenSigningError {
   /**
    * #3001 / #3010 review: the recovery path, when signing OTHER bytes is
@@ -296,24 +297,31 @@ var HavenSignContextError = class extends edge.HavenSigningError {
    * body this signer could not read. `typed_data_b64` is NOT in the default
    * quote result since #1272: obtain it by re-running the SAME quote tool
    * with the SAME idempotency_key plus `include_signing_payload: true`.
-   * Absent on a backend REFUSAL: an expired, executed or unsignable intent
-   * cannot be rescued by re-signing its bytes.
+   * Absent on a backend REFUSAL (an expired, executed or unsignable intent
+   * cannot be rescued by re-signing its bytes) — with one #3271 exception: a
+   * 404 from the DIRECT fetch (an older backend with no direct route), where
+   * the `haven_send` / `haven_pay` result's relay fields still work.
    */
   fallback;
   /**
    * #3001: `AgentPaymentNextAction` values the signer already emits — the
    * version-mismatch refusal's `stop_and_tell_user` for the classes where
    * retrying the same call cannot help, and `payment_window_expired` (with
-   * `retry_with_new_quote`) for the backend's 410 `expired`, exactly as the
-   * plain `HavenError` branch already does for that code.
+   * `retry_with_new_quote`) for the x402 fetch's 410 / `expired`, exactly as
+   * the plain `HavenError` branch already does for that code. On the direct
+   * fetch (#3271) only `error_code: 'expired'` means an expired window, with
+   * no `retry_with_new_quote`; a bare 410 there is a retired-rail tombstone.
    */
   next_action;
   /**
    * #3103 (epic #3105, decisions 1 and 3): the typed next step beside the
    * action. A refusal Haven made (`SIGN_CONTEXT_REFUSED`, not expired) names
-   * the hosted status read with the payment id; a transport failure or a
+   * the hosted status read with the payment id — except a 404 from the direct
+   * fetch (#3271), which names none and points at the `typed_data_b64`
+   * relay; a transport failure or a
    * malformed body names no tool — the remedy is re-running the SAME quote
-   * tool with `include_signing_payload: true` — and an expired window names
+   * tool with `include_signing_payload: true` (x402), or the payment
+   * result's `typed_data_b64` relay (direct, #3271) — and an expired window names
    * none either (which quote tool depends on the flow). Never null: a step
    * with no tool carries `next_tool_omitted_reason`. Additive: the class is
    * not exported from the package index — the published surface is the
@@ -331,7 +339,7 @@ var HavenSignContextError = class extends edge.HavenSigningError {
   http_status;
   /** Present only for `SIGN_CONTEXT_REFUSED`: the backend's own `error_code`. */
   backend_error_code;
-  constructor(message, code, refusal, paymentId) {
+  constructor(message, code, refusal, paymentId, flow = "x402") {
     super(message);
     this.code = code;
     this.name = "HavenSignContextError";
@@ -339,7 +347,22 @@ var HavenSignContextError = class extends edge.HavenSigningError {
     if (code === "SIGN_CONTEXT_REFUSED") {
       this.http_status = refusal?.httpStatus;
       this.backend_error_code = refusal?.errorCode;
-      if (refusal?.httpStatus === 410 || refusal?.errorCode === "expired") {
+      if (flow === "direct" && refusal?.httpStatus === 404) {
+        this.fallback = "typed_data_b64";
+        this.next_action = edge.AgentPaymentNextAction.StopAndTellUser;
+        step = signerRefusalStep({
+          nextAction: edge.AgentPaymentNextAction.StopAndTellUser,
+          nextTool: null,
+          nextToolOmittedReason: DIRECT_RELAY_FALLBACK
+        });
+      } else if (flow === "direct" && refusal?.errorCode === "expired") {
+        this.next_action = edge.AgentPaymentNextAction.PaymentWindowExpired;
+        step = signerRefusalStep({
+          nextAction: edge.AgentPaymentNextAction.PaymentWindowExpired,
+          nextTool: null,
+          nextToolOmittedReason: "call haven_send / haven_pay again with the same idempotency_key \u2014 the expired payment frees it"
+        });
+      } else if (flow === "x402" && (refusal?.httpStatus === 410 || refusal?.errorCode === "expired")) {
         this.next_action = edge.AgentPaymentNextAction.PaymentWindowExpired;
         this.retry_with_new_quote = true;
         step = signerRefusalStep({
@@ -361,7 +384,7 @@ var HavenSignContextError = class extends edge.HavenSigningError {
       step = signerRefusalStep({
         nextAction: edge.AgentPaymentNextAction.StopAndTellUser,
         nextTool: null,
-        nextToolOmittedReason: "re-run the SAME hosted quote tool with the same idempotency_key and include_signing_payload: true, then pass its typed_data_b64 to this signer"
+        nextToolOmittedReason: flow === "direct" ? DIRECT_RELAY_FALLBACK : "re-run the SAME hosted quote tool with the same idempotency_key and include_signing_payload: true, then pass its typed_data_b64 to this signer"
       });
     }
     Object.assign(this, nextStepWireFields(step));
@@ -443,8 +466,89 @@ async function fetchX402SignContext(identity, paymentId, fetchImpl = fetch, time
     paymentRequired: paymentRequired && typeof paymentRequired === "object" && !Array.isArray(paymentRequired) ? paymentRequired : null
   };
 }
+var SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS = [edge.DIRECT_SIGN_CONTEXT_VERSION];
+async function fetchDirectSignContext(identity, paymentId, fetchImpl = fetch, timeoutMs = SIGN_CONTEXT_TIMEOUT_MS) {
+  let response;
+  try {
+    response = await fetchImpl(
+      `${identity.apiUrl}/payments/${encodeURIComponent(paymentId)}/sign-context`,
+      {
+        headers: { Authorization: `Bearer ${identity.apiKey}` },
+        signal: AbortSignal.timeout(timeoutMs)
+      }
+    );
+  } catch (err) {
+    const timedOut = err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError");
+    throw new HavenSignContextError(
+      timedOut ? `Haven did not answer the direct-payment signing-context fetch for ${paymentId} within ${timeoutMs} ms. Retry, or pass typed_data_b64 from the payment result instead.` : `Could not reach Haven to fetch the direct-payment signing context for ${paymentId}: ${err instanceof Error ? err.message : String(err)}. Retry, or pass typed_data_b64 from the payment result instead.`,
+      timedOut ? "SIGN_CONTEXT_TIMEOUT" : "SIGN_CONTEXT_UNREACHABLE",
+      void 0,
+      paymentId,
+      "direct"
+    );
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch (err) {
+    if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+      throw new HavenSignContextError(
+        `Haven did not finish sending the direct-payment signing context for ${paymentId} within ${timeoutMs} ms. Retry, or pass typed_data_b64 from the payment result instead.`,
+        "SIGN_CONTEXT_TIMEOUT",
+        void 0,
+        paymentId,
+        "direct"
+      );
+    }
+    body = {};
+  }
+  if (!response.ok) {
+    const detail = typeof body.error === "string" ? body.error : `HTTP ${response.status}`;
+    throw new HavenSignContextError(
+      `Haven refused the direct-payment signing-context fetch for ${paymentId}: ${detail}` + (response.status === 404 ? " \u2014 either the payment_id is not from this agent\u2019s own POST /payments call, or this Haven backend predates #3271. Pass payload_hash and typed_data_b64 from the haven_send / haven_pay result, unchanged, instead." : body.error_code === "expired" ? " The payment window has expired; call haven_send / haven_pay again with the same idempotency_key." : ""),
+      "SIGN_CONTEXT_REFUSED",
+      { httpStatus: response.status, errorCode: typeof body.error_code === "string" ? body.error_code : void 0 },
+      paymentId,
+      "direct"
+    );
+  }
+  const signData = body.sign_data;
+  const version = body.direct_sign_context_version;
+  if (!signData || typeof signData.hash !== "string" || !signData.typed_data || typeof signData.typed_data !== "object" || signData.signature_scheme !== "eip712_userop" || typeof version !== "number" || !SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS.includes(version)) {
+    throw new HavenSignContextError(
+      typeof version === "number" && !SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS.includes(version) ? `The Haven direct-payment sign-context response is version ${version}, which this signer does not support (supported: ${SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS.join(", ")}). Update @haven_ai/signer.` : "The Haven direct-payment sign-context response is missing sign_data.typed_data, or its signature_scheme is not 'eip712_userop' \u2014 the backend may predate #3271. Pass typed_data_b64 from the payment result instead.",
+      "SIGN_CONTEXT_MALFORMED",
+      void 0,
+      paymentId,
+      "direct"
+    );
+  }
+  return {
+    paymentId: String(body.payment_id ?? paymentId),
+    payloadHash: signData.hash,
+    typedData: signData.typed_data,
+    status: typeof body.status === "string" ? body.status : "pending_signature",
+    expiresAt: typeof body.expires_at === "string" ? body.expires_at : void 0
+  };
+}
 
 // src/tools.ts
+var USEROP_BINDING_MISMATCH = "USEROP_BINDING_MISMATCH";
+var HavenUserOpBindingRefusedError = class extends edge.HavenSigningError {
+  next_action = edge.AgentPaymentNextAction.StopAndTellUser;
+  step;
+  /** `message`: the SDK's `HavenUserOpBindingError.message` verbatim — it already names the mismatch and the remedy. */
+  constructor(message) {
+    super(message);
+    this.code = USEROP_BINDING_MISMATCH;
+    this.name = "HavenUserOpBindingRefusedError";
+    this.step = signerRefusalStep({
+      nextAction: edge.AgentPaymentNextAction.StopAndTellUser,
+      nextTool: null,
+      nextToolOmittedReason: "call haven_sign again with payment_id alone (preferred), or with typed_data copied unchanged from the payment result"
+    });
+  }
+};
 var sweepAuthorizationSchema = v3.z.object({
   from: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "from must be a 0x address"),
   to: v3.z.string().regex(/^0x[0-9a-fA-F]{40}$/, "to must be a 0x address"),
@@ -565,8 +669,13 @@ var SIGN_DESCRIPTION = [
   "and returns { signature, x402_binding }. x402_expected includes expires_at; sign before that",
   "window closes. DELEGATION-RAIL x402 accounts (#1263): pass payment_id ALONE (preferred) \u2014 this",
   "signer fetches the exact signing payload and expected context from Haven itself, so nothing",
-  "bulky ever crosses your context. Fallback: pass typed_data_b64 through UNCHANGED (never re-type",
-  "the nested typed_data JSON); the account validates that EIP-712 payload, not payload_hash.",
+  "bulky ever crosses your context. DIRECT payments (#3271, haven_send / haven_pay): payment_id",
+  "ALONE also works here \u2014 the signer fetches the exact PackedUserOperation typed data and its",
+  "payload_hash from Haven and checks them against each other before signing, so a payload corrupted",
+  "in transit is refused (USEROP_BINDING_MISMATCH) instead of producing a bad signature. Fallback for",
+  "either flow: pass typed_data_b64 through UNCHANGED (never re-type the nested typed_data JSON); the",
+  "account validates that EIP-712 payload, not payload_hash. On a direct payment the same binding",
+  "check runs on the relayed payload too.",
   "Next: call mcp__haven__haven_submit with signature, then pass x402_binding",
   "to mcp__haven-signer__haven_x402_sign_header. A bare payload_hash with no payment_id, typed_data",
   "or x402_expected is REFUSED (BARE_HASH_REFUSED): a hash carries nothing this signer can verify."
@@ -679,7 +788,14 @@ function resolveTypedData(args) {
   }
 }
 function createToolHandlers(signer, options = {}) {
-  async function resolveSignContext(args) {
+  function checkPayloadHashMatch(suppliedHash, fetchedHash, paymentId) {
+    if (suppliedHash && suppliedHash.toLowerCase() !== fetchedHash.toLowerCase()) {
+      throw new edge.HavenSigningError(
+        `The supplied payload_hash does not match the signing context Haven serves for payment ${paymentId}. Pass payment_id alone, or check which quote the hash came from.`
+      );
+    }
+  }
+  async function resolveSignContext(args, opts) {
     if (!args.payment_id) return null;
     const identity = await options.signContext?.loadIdentity() ?? null;
     if (!identity) {
@@ -687,30 +803,39 @@ function createToolHandlers(signer, options = {}) {
         `payment_id signing needs the agent identity (identity.json next to the signer credentials), which this signer could not load. Re-run \`${edge.connectorRerunCommand()}\` to restore it, or pass typed_data_b64 from the quote result instead.`
       );
     }
-    const ctx = await fetchX402SignContext(
-      identity,
-      args.payment_id,
-      options.signContext?.fetchImpl
-    );
-    if (args.payload_hash && args.payload_hash.toLowerCase() !== ctx.payloadHash.toLowerCase()) {
-      throw new edge.HavenSigningError(
-        `The supplied payload_hash does not match the signing context Haven serves for payment ${args.payment_id}. Pass payment_id alone, or check which quote the hash came from.`
-      );
+    try {
+      const ctx = await fetchX402SignContext(identity, args.payment_id, options.signContext?.fetchImpl);
+      checkPayloadHashMatch(args.payload_hash, ctx.payloadHash, args.payment_id);
+      return { kind: "x402", ctx };
+    } catch (err) {
+      if (opts.allowDirectFallback && err instanceof HavenSignContextError && err.http_status === 409 && err.backend_error_code === "sign_context_unavailable") {
+        let ctx;
+        try {
+          ctx = await fetchDirectSignContext(identity, args.payment_id, options.signContext?.fetchImpl);
+        } catch (directErr) {
+          if (directErr instanceof HavenSignContextError && directErr.http_status === 409 && directErr.backend_error_code === "sign_context_unavailable") {
+            throw err;
+          }
+          throw directErr;
+        }
+        checkPayloadHashMatch(args.payload_hash, ctx.payloadHash, args.payment_id);
+        return { kind: "direct", ctx };
+      }
+      throw err;
     }
-    return ctx;
   }
   return {
     haven_sign: async (input) => runTool(async () => {
       const args = parse("haven_sign", coerceX402Expected(input));
-      const fetched = await resolveSignContext(args);
-      const typedData = fetched?.typedData ?? resolveTypedData(args);
-      const payloadHash = fetched?.payloadHash ?? args.payload_hash;
+      const resolved = await resolveSignContext(args, { allowDirectFallback: true });
+      const typedData = resolved?.ctx.typedData ?? resolveTypedData(args);
+      const payloadHash = resolved?.ctx.payloadHash ?? args.payload_hash;
       if (!payloadHash) {
         throw new edge.HavenSigningError(
-          "Pass payment_id (preferred for delegation-rail x402) or payload_hash."
+          "Pass payment_id (preferred for delegation-rail x402 or direct payments) or payload_hash."
         );
       }
-      const expectedRaw = fetched ? parseFetchedExpected(fetched) : args.x402_expected;
+      const expectedRaw = resolved?.kind === "x402" ? parseFetchedExpected(resolved.ctx) : resolved?.kind === "direct" ? null : args.x402_expected;
       const x402Expected = expectedRaw ? toExpectedX402(expectedRaw) : null;
       const result = x402Expected ? await signFundingLeg(signer, x402Expected, payloadHash, typedData) : null;
       if (!result) {
@@ -720,6 +845,16 @@ function createToolHandlers(signer, options = {}) {
               "Refusing to sign a delegation payload with no expected context. This typed data is a DELEGATION \u2014 signing it grants a third party authority to move funds \u2014 so it is only ever signed against a Haven-signed context that the caveats are verified against. Call this tool with { payment_id } instead (the signer then fetches and verifies the context itself), or use haven_sign_x402."
             );
           }
+          if (resolved?.kind === "direct" || edge.isPackedUserOperationTypedData(typedData)) {
+            try {
+              edge.assertUserOpTypedDataBinding(typedData, payloadHash);
+            } catch (err) {
+              if (err instanceof edge.HavenUserOpBindingError) {
+                throw new HavenUserOpBindingRefusedError(err.message);
+              }
+              throw err;
+            }
+          }
           const signature = await signer.signDelegationTypedData(typedData);
           await auditSigning("haven_sign", payloadHash);
           return { signature };
@@ -743,7 +878,8 @@ function createToolHandlers(signer, options = {}) {
     }),
     haven_sign_x402: async (input) => runTool(async () => {
       const args = parse("haven_sign_x402", coerceX402Expected(coercePaymentRequired(input)));
-      const fetched = await resolveSignContext(args);
+      const resolved = await resolveSignContext(args, { allowDirectFallback: false });
+      const fetched = resolved?.kind === "x402" ? resolved.ctx : void 0;
       const payloadHash = fetched?.payloadHash ?? args.payload_hash;
       const expectedRaw = fetched ? parseFetchedExpected(fetched) : args.x402_expected;
       if (!payloadHash || !expectedRaw) {
@@ -883,6 +1019,15 @@ function normalizeError(err) {
       ...nextStepWireFields(err.step)
     };
   }
+  if (err instanceof HavenUserOpBindingRefusedError) {
+    return {
+      success: false,
+      code: err.code,
+      message: err.message,
+      next_action: err.next_action,
+      ...nextStepWireFields(err.step)
+    };
+  }
   if (err instanceof HavenSignContextError) {
     return {
       success: false,
@@ -1467,7 +1612,8 @@ var SIGNER_CAPABILITY_KEY = "haven/signer-compatibility";
 function signerCompatibility() {
   return {
     x402_expected_context_versions: [...SUPPORTED_X402_EXPECTED_VERSIONS],
-    sweep_binding_versions: [...SUPPORTED_SWEEP_BINDING_VERSIONS]
+    sweep_binding_versions: [...SUPPORTED_SWEEP_BINDING_VERSIONS],
+    direct_sign_context_versions: [...SUPPORTED_DIRECT_SIGN_CONTEXT_VERSIONS]
   };
 }
 function signerCapabilityAdvertisement() {
@@ -1478,12 +1624,14 @@ function signerInstructions() {
   return [
     "Haven edge signer: sign-only tools bound to the local delegate key. It never emits the",
     "key. Its one network capability is an authenticated READ of a signing context from",
-    "Haven by payment_id \u2014 pass payment_id to haven_sign / haven_sign_x402 (preferred for",
-    "delegation-rail x402) instead of relaying bulky typed-data payloads yourself.",
+    "Haven by payment_id \u2014 pass payment_id to haven_sign (preferred for both a direct payment,",
+    "#3271, and delegation-rail x402) or haven_sign_x402 (x402 only) instead of relaying bulky",
+    "typed-data payloads yourself.",
     "",
     "Version compatibility (check this BEFORE signing, not after):",
     `- x402 expected-context versions supported: ${compatibility.x402_expected_context_versions.join(", ")}`,
     `- sweep authorization binding versions supported: ${compatibility.sweep_binding_versions.join(", ")}`,
+    `- direct-payment (haven_send / haven_pay) sign-context versions supported: ${compatibility.direct_sign_context_versions.join(", ")} \u2014 pass payment_id alone to haven_sign; this signer fetches the exact bytes`,
     "",
     "Haven quote and prepare results report the expected-context version they will emit",
     "(signer_compatibility.x402_expected_context_version). If that version is not in the list",
@@ -1601,7 +1749,7 @@ async function warnIfCredentialFilePermissive(path, log = (message) => process.s
 
 // src/server.ts
 var SIGNER_NAME = "@haven_ai/signer";
-var SIGNER_VERSION = "0.0.0-dev.202609232125.72f3d20";
+var SIGNER_VERSION = "0.0.0-dev.202609241802.ea320de";
 async function resolveSignerRuntime(options = {}) {
   assertSupportedNodeVersion(options.nodeVersion);
   if (options.delegateKey) {
@@ -1639,8 +1787,9 @@ function buildSignerMcpServer(signer, options = {}) {
       accountAddress: options.credentials?.accountAddress,
       chainId: options.credentials?.chainId
     },
-    // #1263: the payment_id signing path — the ONLY network call this server
-    // can make, an authenticated read of a signing context from Haven, using
+    // #1263: the payment_id signing path — the ONLY network path this server
+    // has: up to two authenticated reads of a signing context from Haven (x402,
+    // then direct for haven_sign, #3271), using
     // the agent identity the connector stores next to the signer credential.
     // The signer CORE stays network-free; fetched bytes still pass the same
     // binding verification + digest re-derivation as tool-argument bytes.