@paybond/kit 0.10.0 → 0.11.0

package/dist/sep2828-signature.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Verifies SEP-2828 MCP decision/outcome record signatures before evidence mapping.
+ *
+ * Uses Ed25519-over-SHA-256(JCS-style canonical JSON with signature fields stripped),
+ * matching Paybond Kit audit-export verification and SEP-2787 detached signatures.
+ */
+/** Verifies a single SEP-2828 decision or outcome record signature. */
+export declare function verifySep2828RecordSignature(record: Record<string, unknown>): void;
+/** Verifies signatures and backLink / decisionDigest pairing before mapping to evidence. */
+export declare function verifySep2828ReceiptPair(decision: Record<string, unknown>, outcome: Record<string, unknown>): void;

package/dist/sep2828-signature.js

@@ -0,0 +1,134 @@
+/**
+ * Verifies SEP-2828 MCP decision/outcome record signatures before evidence mapping.
+ *
+ * Uses Ed25519-over-SHA-256(JCS-style canonical JSON with signature fields stripped),
+ * matching Paybond Kit audit-export verification and SEP-2787 detached signatures.
+ */
+import { createHash } from "node:crypto";
+import { verify as ed25519Verify } from "@noble/ed25519";
+import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
+import { normalizeJson } from "./json-digest.js";
+const SIGNATURE_KEYS = new Set([
+    "signature",
+    "ed25519_signature_hex",
+    "message_digest_sha256_hex",
+    "signing_public_key_ed25519_hex",
+]);
+const ASSERTED_BLOCKS = ["issuerAsserted", "receiptAsserted"];
+function readObject(value) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return value;
+    }
+    return undefined;
+}
+function stripDigestPrefix(digest) {
+    return digest.replace(/^(sha256|blake3):/i, "");
+}
+function canonicalJsonBytes(value) {
+    const normalized = normalizeJson(value);
+    return new TextEncoder().encode(JSON.stringify(normalized));
+}
+function sha256Hex(data) {
+    const digest = createHash("sha256").update(Buffer.from(data)).digest();
+    return Buffer.from(digest).toString("hex");
+}
+function hexToBytes(hex) {
+    const trimmed = hex.trim();
+    if (trimmed.length % 2 !== 0) {
+        throw new Error("invalid hex length");
+    }
+    const out = new Uint8Array(trimmed.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = Number.parseInt(trimmed.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function stripSignatureFields(record) {
+    const out = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (SIGNATURE_KEYS.has(key)) {
+            continue;
+        }
+        if (ASSERTED_BLOCKS.includes(key)) {
+            const asserted = readObject(value);
+            if (!asserted) {
+                continue;
+            }
+            const stripped = {};
+            for (const [innerKey, innerValue] of Object.entries(asserted)) {
+                if (!SIGNATURE_KEYS.has(innerKey)) {
+                    stripped[innerKey] = innerValue;
+                }
+            }
+            if (Object.keys(stripped).length > 0) {
+                out[key] = stripped;
+            }
+            continue;
+        }
+        out[key] = value;
+    }
+    return out;
+}
+function extractSignatureMaterial(record) {
+    for (const blockName of ASSERTED_BLOCKS) {
+        const block = readObject(record[blockName]);
+        if (!block) {
+            continue;
+        }
+        const signature = block.ed25519_signature_hex ?? block.signature;
+        const publicKey = block.signing_public_key_ed25519_hex;
+        if (typeof signature === "string" && signature.length > 0 && typeof publicKey === "string" && publicKey.length > 0) {
+            return { signatureHex: signature.trim(), publicKeyHex: publicKey.trim() };
+        }
+    }
+    const signature = record.ed25519_signature_hex ?? record.signature;
+    const publicKey = record.signing_public_key_ed25519_hex;
+    if (typeof signature === "string" && signature.length > 0 && typeof publicKey === "string" && publicKey.length > 0) {
+        return { signatureHex: signature.trim(), publicKeyHex: publicKey.trim() };
+    }
+    throw new Error("SEP-2828 record missing ed25519 signature and signing_public_key_ed25519_hex");
+}
+/** Verifies a single SEP-2828 decision or outcome record signature. */
+export function verifySep2828RecordSignature(record) {
+    ensureEd25519Sha512Sync();
+    const { signatureHex, publicKeyHex } = extractSignatureMaterial(record);
+    const digest = hexToBytes(sha256Hex(canonicalJsonBytes(stripSignatureFields(record))));
+    const signature = hexToBytes(signatureHex);
+    const publicKey = hexToBytes(publicKeyHex);
+    if (!ed25519Verify(signature, digest, publicKey)) {
+        throw new Error("SEP-2828 record signature verification failed");
+    }
+}
+function recordContentDigestHex(record) {
+    return sha256Hex(canonicalJsonBytes(stripSignatureFields(record)));
+}
+/** Verifies signatures and backLink / decisionDigest pairing before mapping to evidence. */
+export function verifySep2828ReceiptPair(decision, outcome) {
+    verifySep2828RecordSignature(decision);
+    verifySep2828RecordSignature(outcome);
+    const decisionBackLink = readObject(decision.backLink);
+    const outcomeBackLink = readObject(outcome.backLink);
+    if (!decisionBackLink || !outcomeBackLink) {
+        throw new Error("SEP-2828 decision and outcome records must both include backLink");
+    }
+    const decisionDigest = decisionBackLink.attestationDigest;
+    const outcomeDigest = outcomeBackLink.attestationDigest;
+    if (typeof decisionDigest !== "string" || decisionDigest.length === 0) {
+        throw new Error("SEP-2828 decision backLink.attestationDigest is required");
+    }
+    if (decisionDigest !== outcomeDigest) {
+        throw new Error("SEP-2828 decision and outcome backLink.attestationDigest must match");
+    }
+    const outcomeDerived = readObject(outcome.outcomeDerived);
+    if (!outcomeDerived) {
+        throw new Error("SEP-2828 outcome record must include outcomeDerived");
+    }
+    const expectedDecisionDigest = stripDigestPrefix(recordContentDigestHex(decision));
+    const decisionDigestField = outcomeDerived.decisionDigest;
+    if (typeof decisionDigestField !== "string" || decisionDigestField.length === 0) {
+        throw new Error("SEP-2828 outcomeDerived.decisionDigest is required for pairing");
+    }
+    if (stripDigestPrefix(decisionDigestField) !== expectedDecisionDigest) {
+        throw new Error("SEP-2828 outcomeDerived.decisionDigest does not match signed decision record");
+    }
+}

package/dist/solutions/api.d.ts

@@ -0,0 +1,22 @@
+import { PaybondPolicy } from "../policy/load.js";
+import { type VerticalPolicyOptions } from "../policy/policy-api.js";
+import { getSolutionSmokeDefaults, loadSolutionManifest, type SolutionId, type SolutionSmokeDefaults } from "./catalog.js";
+export type PaybondSolutionBundle = {
+    id: SolutionId;
+    title: string;
+    policy: PaybondPolicy;
+    smokeDefaults: SolutionSmokeDefaults;
+    completionPreset: string;
+    vendorPack?: string;
+    operations: string[];
+};
+/** Programmatic solution bundle API (`paybond.solution.*`). */
+export declare const paybondSolutionPresets: {
+    readonly travel: (options?: VerticalPolicyOptions) => PaybondSolutionBundle;
+    readonly shopping: (options?: VerticalPolicyOptions) => PaybondSolutionBundle;
+    readonly saas: (options?: VerticalPolicyOptions) => PaybondSolutionBundle;
+    readonly aws: (options?: VerticalPolicyOptions) => PaybondSolutionBundle;
+    readonly loadManifest: typeof loadSolutionManifest;
+    readonly smokeDefaults: typeof getSolutionSmokeDefaults;
+};
+export type PaybondSolutionPresets = typeof paybondSolutionPresets;

package/dist/solutions/api.js

@@ -0,0 +1,40 @@
+import { paybondPolicyPresets } from "../policy/policy-api.js";
+import { getSolutionSmokeDefaults, loadSolutionManifest } from "./catalog.js";
+function listSideEffectingOperations(document) {
+    return Object.entries(document.tools)
+        .filter(([, entry]) => entry.side_effecting)
+        .map(([toolName, entry]) => entry.operation?.trim() || toolName);
+}
+function resolveSolutionBundle(solutionId, options) {
+    const manifest = loadSolutionManifest(solutionId);
+    const policy = options === undefined
+        ? paybondPolicyPresets[solutionId]()
+        : paybondPolicyPresets[solutionId](options);
+    const document = policy.document;
+    return {
+        id: solutionId,
+        title: manifest.title,
+        policy,
+        smokeDefaults: getSolutionSmokeDefaults(solutionId),
+        completionPreset: manifest.completion_preset,
+        ...(manifest.vendor_pack ? { vendorPack: manifest.vendor_pack } : {}),
+        operations: listSideEffectingOperations(document),
+    };
+}
+/** Programmatic solution bundle API (`paybond.solution.*`). */
+export const paybondSolutionPresets = {
+    travel(options) {
+        return resolveSolutionBundle("travel", options);
+    },
+    shopping(options) {
+        return resolveSolutionBundle("shopping", options);
+    },
+    saas(options) {
+        return resolveSolutionBundle("saas", options);
+    },
+    aws(options) {
+        return resolveSolutionBundle("aws", options);
+    },
+    loadManifest: loadSolutionManifest,
+    smokeDefaults: getSolutionSmokeDefaults,
+};

package/dist/solutions/catalog.d.ts

@@ -0,0 +1,34 @@
+export type SolutionPolicyDefault = {
+    domain: string;
+    guardrails: string[];
+};
+export type SolutionSmokeManifest = {
+    result_body: Record<string, unknown>;
+    evidence_preset: string;
+};
+export type SolutionManifest = {
+    id: string;
+    title: string;
+    policy_default: SolutionPolicyDefault;
+    primary_operation: string;
+    completion_preset: string;
+    vendor_pack?: string;
+    smoke: SolutionSmokeManifest;
+};
+export type SolutionSmokeDefaults = {
+    operation: string;
+    requestedSpendCents: number;
+    evidencePreset: string;
+    resultBody: Record<string, unknown>;
+};
+declare const KNOWN_SOLUTION_IDS: readonly ["travel", "shopping", "saas", "aws"];
+export type SolutionId = (typeof KNOWN_SOLUTION_IDS)[number];
+/** True when `value` is a bundled solution id (travel, shopping, saas, aws). */
+export declare function isKnownSolutionId(value: string): value is SolutionId;
+/** List bundled solution ids shipped with Paybond Kit. */
+export declare function listSolutionIds(): SolutionId[];
+/** Load a bundled solution manifest from disk. */
+export declare function loadSolutionManifest(solutionId: string): SolutionManifest;
+/** Resolve CLI smoke defaults from a bundled solution manifest. */
+export declare function getSolutionSmokeDefaults(solutionId: string): SolutionSmokeDefaults;
+export {};

package/dist/solutions/catalog.js

@@ -0,0 +1,129 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const KNOWN_SOLUTION_IDS = ["travel", "shopping", "saas", "aws"];
+const MODULE_DIR = dirname(fileURLToPath(import.meta.url));
+function solutionCandidatePaths(solutionId) {
+    const fileName = `${solutionId}.json`;
+    const roots = [
+        join(MODULE_DIR, "../../solutions"),
+        join(MODULE_DIR, "../../../solutions"),
+        join(MODULE_DIR, "../../../../kit/solutions"),
+    ];
+    return roots.map((root) => join(root, fileName));
+}
+function parseSolutionManifest(raw, sourceLabel) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`invalid solution manifest at ${sourceLabel}`);
+    }
+    const record = raw;
+    const smoke = record.smoke;
+    if (!smoke || typeof smoke !== "object" || Array.isArray(smoke)) {
+        throw new Error(`solution manifest ${sourceLabel} missing smoke block`);
+    }
+    const smokeRecord = smoke;
+    const resultBody = smokeRecord.result_body;
+    if (!resultBody || typeof resultBody !== "object" || Array.isArray(resultBody)) {
+        throw new Error(`solution manifest ${sourceLabel} missing smoke.result_body object`);
+    }
+    const evidencePreset = smokeRecord.evidence_preset;
+    if (typeof evidencePreset !== "string" || !evidencePreset.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing smoke.evidence_preset`);
+    }
+    const policyDefault = record.policy_default;
+    if (!policyDefault || typeof policyDefault !== "object" || Array.isArray(policyDefault)) {
+        throw new Error(`solution manifest ${sourceLabel} missing policy_default block`);
+    }
+    const policyDefaultRecord = policyDefault;
+    const domain = policyDefaultRecord.domain;
+    const guardrails = policyDefaultRecord.guardrails;
+    if (typeof domain !== "string" || !domain.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing policy_default.domain`);
+    }
+    if (!Array.isArray(guardrails) || guardrails.some((entry) => typeof entry !== "string")) {
+        throw new Error(`solution manifest ${sourceLabel} missing policy_default.guardrails`);
+    }
+    const id = record.id;
+    const title = record.title;
+    const primaryOperation = record.primary_operation;
+    const completionPreset = record.completion_preset;
+    if (typeof id !== "string" || !id.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing id`);
+    }
+    if (typeof title !== "string" || !title.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing title`);
+    }
+    if (typeof primaryOperation !== "string" || !primaryOperation.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing primary_operation`);
+    }
+    if (typeof completionPreset !== "string" || !completionPreset.trim()) {
+        throw new Error(`solution manifest ${sourceLabel} missing completion_preset`);
+    }
+    const vendorPack = record.vendor_pack;
+    if (vendorPack !== undefined && (typeof vendorPack !== "string" || !vendorPack.trim())) {
+        throw new Error(`solution manifest ${sourceLabel} has invalid vendor_pack`);
+    }
+    return {
+        id: id.trim(),
+        title: title.trim(),
+        policy_default: {
+            domain: domain.trim(),
+            guardrails: guardrails.map((entry) => entry.trim()),
+        },
+        primary_operation: primaryOperation.trim(),
+        completion_preset: completionPreset.trim(),
+        ...(vendorPack ? { vendor_pack: vendorPack.trim() } : {}),
+        smoke: {
+            result_body: resultBody,
+            evidence_preset: evidencePreset.trim(),
+        },
+    };
+}
+/** True when `value` is a bundled solution id (travel, shopping, saas, aws). */
+export function isKnownSolutionId(value) {
+    return KNOWN_SOLUTION_IDS.includes(value.trim());
+}
+/** List bundled solution ids shipped with Paybond Kit. */
+export function listSolutionIds() {
+    return [...KNOWN_SOLUTION_IDS];
+}
+/** Load a bundled solution manifest from disk. */
+export function loadSolutionManifest(solutionId) {
+    const trimmed = solutionId.trim();
+    if (!isKnownSolutionId(trimmed)) {
+        throw new Error(`unknown solution: ${trimmed}`);
+    }
+    let lastError;
+    for (const candidate of solutionCandidatePaths(trimmed)) {
+        try {
+            const raw = JSON.parse(readFileSync(candidate, "utf8"));
+            const manifest = parseSolutionManifest(raw, candidate);
+            if (manifest.id !== trimmed) {
+                throw new Error(`manifest id "${manifest.id}" does not match file name "${trimmed}"`);
+            }
+            return manifest;
+        }
+        catch (err) {
+            lastError = err;
+        }
+    }
+    throw new Error(`solution manifest not found for: ${trimmed} (${solutionCandidatePaths(trimmed).join(", ")}): ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+}
+function resolveRequestedSpendCents(resultBody) {
+    const costCents = resultBody.cost_cents;
+    if (typeof costCents === "number" && Number.isFinite(costCents) && costCents >= 0) {
+        return Math.trunc(costCents);
+    }
+    throw new Error("solution smoke.result_body must include non-negative cost_cents");
+}
+/** Resolve CLI smoke defaults from a bundled solution manifest. */
+export function getSolutionSmokeDefaults(solutionId) {
+    const manifest = loadSolutionManifest(solutionId);
+    const resultBody = { ...manifest.smoke.result_body };
+    return {
+        operation: manifest.primary_operation,
+        requestedSpendCents: resolveRequestedSpendCents(resultBody),
+        evidencePreset: manifest.smoke.evidence_preset,
+        resultBody,
+    };
+}

package/dist/solutions/index.d.ts

@@ -0,0 +1,2 @@
+export { getSolutionSmokeDefaults, isKnownSolutionId, listSolutionIds, loadSolutionManifest, type SolutionId, type SolutionManifest, type SolutionPolicyDefault, type SolutionSmokeDefaults, type SolutionSmokeManifest, } from "./catalog.js";
+export { paybondSolutionPresets, type PaybondSolutionBundle, type PaybondSolutionPresets, } from "./api.js";

package/dist/solutions/index.js

@@ -0,0 +1,2 @@
+export { getSolutionSmokeDefaults, isKnownSolutionId, listSolutionIds, loadSolutionManifest, } from "./catalog.js";
+export { paybondSolutionPresets, } from "./api.js";

package/dist/template-init.d.ts

@@ -0,0 +1,54 @@
+import type { PolicyPresetId } from "./policy/presets.js";
+export type TemplateId = "travel-agent" | "vercel-shopping-agent" | "openai-agents-demo" | "openai-shopping-agent" | "claude-agents-demo" | "mcp-coding-agent" | "procurement-agent" | "invoice-agent" | "aws-operator";
+export type TemplateManifestEntry = {
+    id: TemplateId;
+    repo: string;
+    title: string;
+    language: "typescript" | "python";
+    framework: string;
+    preset: PolicyPresetId | null;
+    primary_operation: string;
+    requested_spend_cents: number;
+    evidence_preset: string;
+    smoke_result_body: Record<string, unknown>;
+};
+type TemplateManifest = {
+    version: number;
+    templates: TemplateManifestEntry[];
+};
+export type TemplateFramework = "generic" | "langgraph" | "vercel-ai" | "openai-agents" | "claude-agents" | "mcp";
+/** Normalize CLI `--framework` values to bundled template framework ids. */
+export declare function normalizeTemplateFramework(raw: string): TemplateFramework;
+/** Load the bundled starter-template manifest shipped with @paybond/kit. */
+export declare function loadTemplateManifest(): Promise<TemplateManifest>;
+/** Normalize template id or repo slug to a canonical template id. */
+export declare function normalizeTemplateId(raw: string): TemplateId;
+/** List bundled starter templates for CLI and docs. */
+export declare function listTemplateEntries(): Promise<TemplateManifestEntry[]>;
+export declare function resolveTemplateEntry(templateId: TemplateId): Promise<TemplateManifestEntry>;
+/** Resolve a bundled template and optionally validate `--framework`. */
+export declare function resolveTemplateForInit(input: {
+    templateId: TemplateId;
+    framework?: string;
+}): Promise<TemplateManifestEntry>;
+export type CopyTemplateOptions = {
+    cwd: string;
+    templateId: TemplateId;
+    framework?: string;
+    force?: boolean;
+    writeStdout?: (line: string) => void;
+};
+export type CopyTemplateResult = {
+    template_id: TemplateId;
+    repo: string;
+    title: string;
+    language: TemplateManifestEntry["language"];
+    framework: string;
+    preset: PolicyPresetId | null;
+    files: string[];
+    smoke_command: string;
+};
+/** Copy a bundled starter template tree into the target directory. */
+export declare function copyTemplateToDirectory(options: CopyTemplateOptions): Promise<CopyTemplateResult>;
+export declare function templateInitUsage(): string;
+export {};

package/dist/template-init.js

@@ -0,0 +1,203 @@
+import { access, cp, readFile, readdir } from "node:fs/promises";
+import { constants } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const TEMPLATE_FRAMEWORK_ALIASES = {
+    generic: "generic",
+    langgraph: "langgraph",
+    "vercel-ai": "vercel-ai",
+    vercel: "vercel-ai",
+    openai: "openai-agents",
+    "openai-agents": "openai-agents",
+    claude: "claude-agents",
+    "claude-agents": "claude-agents",
+    mcp: "mcp",
+};
+/** Normalize CLI `--framework` values to bundled template framework ids. */
+export function normalizeTemplateFramework(raw) {
+    const normalized = TEMPLATE_FRAMEWORK_ALIASES[raw.trim().toLowerCase()];
+    if (!normalized) {
+        throw new Error(`invalid --framework for template init: ${raw}`);
+    }
+    return normalized;
+}
+function frameworkForEntry(entry) {
+    return normalizeTemplateFramework(entry.framework);
+}
+const TEMPLATE_ALIASES = {
+    "travel-agent": "travel-agent",
+    "paybond-travel-agent": "travel-agent",
+    "vercel-shopping-agent": "vercel-shopping-agent",
+    "paybond-vercel-shopping-agent": "vercel-shopping-agent",
+    "openai-agents-demo": "openai-agents-demo",
+    "paybond-openai-agents-demo": "openai-agents-demo",
+    "openai-shopping-agent": "openai-shopping-agent",
+    "claude-agents-demo": "claude-agents-demo",
+    "paybond-claude-agents-demo": "claude-agents-demo",
+    "mcp-coding-agent": "mcp-coding-agent",
+    "paybond-mcp-coding-agent": "mcp-coding-agent",
+    "procurement-agent": "procurement-agent",
+    "paybond-procurement-agent": "procurement-agent",
+    "invoice-agent": "invoice-agent",
+    "paybond-invoice-agent": "invoice-agent",
+    "aws-operator": "aws-operator",
+    "paybond-aws-operator": "aws-operator",
+};
+function moduleDir() {
+    return dirname(fileURLToPath(import.meta.url));
+}
+function resolveTemplatesRoots() {
+    const dir = moduleDir();
+    return [
+        join(dir, "../templates"),
+        join(dir, "../../templates"),
+        join(dir, "../../../kit/ts/templates"),
+    ];
+}
+async function firstExistingDir(candidates) {
+    for (const candidate of candidates) {
+        try {
+            await access(candidate, constants.F_OK);
+            return candidate;
+        }
+        catch {
+            // try next
+        }
+    }
+    throw new Error("bundled Paybond templates directory not found");
+}
+let cachedManifest = null;
+/** Load the bundled starter-template manifest shipped with @paybond/kit. */
+export async function loadTemplateManifest() {
+    if (cachedManifest) {
+        return cachedManifest;
+    }
+    const root = await firstExistingDir(resolveTemplatesRoots());
+    const raw = await readFile(join(root, "manifest.json"), "utf8");
+    cachedManifest = JSON.parse(raw);
+    return cachedManifest;
+}
+/** Normalize template id or repo slug to a canonical template id. */
+export function normalizeTemplateId(raw) {
+    const normalized = TEMPLATE_ALIASES[raw.trim().toLowerCase()];
+    if (!normalized) {
+        throw new Error(`invalid --template: ${raw}`);
+    }
+    return normalized;
+}
+/** List bundled starter templates for CLI and docs. */
+export async function listTemplateEntries() {
+    const manifest = await loadTemplateManifest();
+    return [...manifest.templates];
+}
+export async function resolveTemplateEntry(templateId) {
+    const manifest = await loadTemplateManifest();
+    const entry = manifest.templates.find((candidate) => candidate.id === templateId);
+    if (!entry) {
+        throw new Error(`unknown template: ${templateId}`);
+    }
+    return entry;
+}
+/** Resolve a bundled template and optionally validate `--framework`. */
+export async function resolveTemplateForInit(input) {
+    const entry = await resolveTemplateEntry(input.templateId);
+    if (input.framework) {
+        const normalized = normalizeTemplateFramework(input.framework);
+        if (frameworkForEntry(entry) !== normalized) {
+            throw new Error(`template ${entry.id} uses framework ${entry.framework}; --framework ${input.framework} does not match`);
+        }
+    }
+    return entry;
+}
+function smokeCommandForEntry(entry) {
+    const resultBody = JSON.stringify(entry.smoke_result_body);
+    return [
+        "paybond agent sandbox smoke",
+        "--policy-file paybond.policy.yaml",
+        `--operation ${entry.primary_operation}`,
+        `--requested-spend-cents ${entry.requested_spend_cents}`,
+        `--evidence-preset ${entry.evidence_preset}`,
+        `--result-body '${resultBody}'`,
+        "--format json",
+    ].join(" ");
+}
+async function pathExists(path) {
+    try {
+        await access(path, constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Copy a bundled starter template tree into the target directory. */
+export async function copyTemplateToDirectory(options) {
+    const entry = await resolveTemplateForInit({
+        templateId: options.templateId,
+        framework: options.framework,
+    });
+    const templatesRoot = await firstExistingDir(resolveTemplatesRoots());
+    const sourceDir = join(templatesRoot, entry.repo);
+    try {
+        await access(sourceDir, constants.F_OK);
+    }
+    catch {
+        throw new Error(`template source missing: ${entry.repo}`);
+    }
+    const writeStdout = options.writeStdout;
+    const copied = [];
+    const entries = await readdir(sourceDir, { withFileTypes: true });
+    for (const dirent of entries) {
+        const relativePath = dirent.name;
+        const sourcePath = join(sourceDir, relativePath);
+        const targetPath = join(options.cwd, relativePath);
+        if (await pathExists(targetPath) && !options.force) {
+            throw new Error(`${relativePath} already exists (pass --force to overwrite)`);
+        }
+        await cp(sourcePath, targetPath, {
+            recursive: true,
+            force: options.force ?? false,
+            errorOnExist: !options.force,
+        });
+        copied.push(relativePath);
+        writeStdout?.(`Created ${relativePath}`);
+    }
+    const smokeCommand = smokeCommandForEntry(entry);
+    writeStdout?.("");
+    writeStdout?.("Ready to run:");
+    writeStdout?.("  paybond login");
+    if (entry.language === "python") {
+        writeStdout?.("  pip install -r requirements.txt");
+    }
+    else {
+        writeStdout?.("  npm install");
+    }
+    writeStdout?.(`  ${entry.language === "typescript" ? "npm run smoke" : smokeCommand}`);
+    return {
+        template_id: entry.id,
+        repo: entry.repo,
+        title: entry.title,
+        language: entry.language,
+        framework: entry.framework,
+        preset: entry.preset,
+        files: copied,
+        smoke_command: smokeCommand,
+    };
+}
+export function templateInitUsage() {
+    return [
+        "Usage: paybond init [--template <id>|--repo <slug>] [--framework <name>] [--force]",
+        "       paybond init [--solution ...] [--framework ...]  (wizard scaffold)",
+        "",
+        "Templates:",
+        "  travel-agent, vercel-shopping-agent, openai-agents-demo, openai-shopping-agent,",
+        "  claude-agents-demo, mcp-coding-agent, procurement-agent, invoice-agent, aws-operator",
+        "",
+        "Frameworks (with --template): generic|langgraph|vercel-ai|openai|openai-agents|claude-agents|mcp",
+        "",
+        "Examples:",
+        "  paybond init --template travel-agent --framework langgraph",
+        "  paybond init --template paybond-vercel-shopping-agent --force",
+        "  paybond init --solution travel --framework langgraph --non-interactive",
+    ].join("\n");
+}

package/dist/vercel-ai/config.d.ts

@@ -0,0 +1,15 @@
+import type { ToolSet } from "ai";
+import type { PaybondAgentRun } from "../agent/run.js";
+import { paybondVercelToolApproval, type PaybondVercelToolApprovalOptions } from "./tool-approval.js";
+/** Vercel AI SDK runner config: guarded tools plus centralized `toolApproval`. */
+export type PaybondVercelAgentConfig<TOOLS extends ToolSet = ToolSet> = {
+    tools: TOOLS;
+    toolApproval: ReturnType<typeof paybondVercelToolApproval<TOOLS>>;
+};
+export type PaybondVercelAgentConfigOptions = PaybondVercelToolApprovalOptions;
+/**
+ * Framework runner helper for Vercel AI SDK `generateText` / `streamText`.
+ *
+ * Returns guarded `tools` and a `toolApproval` bridge for Harbor pre-checks.
+ */
+export declare function createPaybondVercelAgentConfig<TOOLS extends ToolSet>(run: PaybondAgentRun, tools: TOOLS, options?: PaybondVercelAgentConfigOptions): PaybondVercelAgentConfig<TOOLS>;

package/dist/vercel-ai/config.js

@@ -0,0 +1,13 @@
+import { paybondVercelToolApproval, } from "./tool-approval.js";
+import { paybondVercelWrapTools } from "./wrap-tools.js";
+/**
+ * Framework runner helper for Vercel AI SDK `generateText` / `streamText`.
+ *
+ * Returns guarded `tools` and a `toolApproval` bridge for Harbor pre-checks.
+ */
+export function createPaybondVercelAgentConfig(run, tools, options) {
+    return {
+        tools: paybondVercelWrapTools(run, tools),
+        toolApproval: paybondVercelToolApproval(run, options),
+    };
+}

package/dist/vercel-ai/index.d.ts

@@ -0,0 +1,4 @@
+export { createPaybondVercelAgentConfig, type PaybondVercelAgentConfig, type PaybondVercelAgentConfigOptions, } from "./config.js";
+export { mapPaybondDecisionToVercelToolApproval, paybondVercelToolApproval, type PaybondVercelToolApprovalOptions, } from "./tool-approval.js";
+export { paybondVercelWrapTools } from "./wrap-tools.js";
+export { runVercelAiSandboxDemo, type RunVercelAiSandboxDemoInput, type RunVercelAiSandboxDemoResult, } from "./sandbox-demo.js";