@paybond/kit 0.10.0 → 0.11.1

package/dist/langgraph/sandbox-demo.d.ts

@@ -0,0 +1,40 @@
+import type { Paybond } from "../index.js";
+export type RunLangGraphSandboxDemoInput = {
+    paybond: Paybond;
+    operation?: string;
+    requestedSpendCents?: number;
+    evidencePreset?: string;
+    toolCallId?: string;
+};
+export type RunLangGraphSandboxDemoResult = {
+    bind: {
+        run_id: string;
+        tenant_id: string;
+        intent_id: string;
+        capability_token: string;
+        operation: string;
+        sandbox_lifecycle_status?: string;
+    };
+    authorization: {
+        allow: boolean;
+        audit_id?: string;
+        decision_id?: string;
+    };
+    tool_message: {
+        content: string;
+        status: string;
+        name: string;
+        tool_call_id: string;
+    };
+    evidence: {
+        submitted: boolean;
+        sandbox_lifecycle_status?: string;
+        predicate_passed?: boolean | null;
+        intent_state?: string;
+    };
+    intent_state?: string;
+};
+/**
+ * No-LLM LangGraph sandbox demo: `ToolNode` + Paybond interceptor + auto-evidence.
+ */
+export declare function runLangGraphSandboxDemo(input: RunLangGraphSandboxDemoInput): Promise<RunLangGraphSandboxDemoResult>;

package/dist/langgraph/sandbox-demo.js

@@ -0,0 +1,96 @@
+import { AIMessage } from "@langchain/core/messages";
+import { tool } from "@langchain/core/tools";
+import { z } from "zod";
+import { createPaybondToolRegistry } from "../agent/registry.js";
+import { paybondToolNode } from "./tool-node.js";
+async function executePaidTool(args) {
+    return { status: "completed", cost_cents: args.estimatedPriceCents };
+}
+/**
+ * No-LLM LangGraph sandbox demo: `ToolNode` + Paybond interceptor + auto-evidence.
+ */
+export async function runLangGraphSandboxDemo(input) {
+    const operation = (input.operation ?? "paid-tool").trim();
+    const requestedSpendCents = input.requestedSpendCents ?? 100;
+    const evidencePreset = (input.evidencePreset ?? "cost_and_completion").trim();
+    const toolCallId = (input.toolCallId ?? "langgraph-demo-1").trim();
+    const registry = createPaybondToolRegistry({
+        defaultDeny: true,
+        sideEffecting: {
+            [operation]: {
+                operation,
+                evidencePreset,
+                spendCents: (args) => typeof args === "object" &&
+                    args !== null &&
+                    "estimatedPriceCents" in args &&
+                    typeof args.estimatedPriceCents === "number"
+                    ? args.estimatedPriceCents
+                    : requestedSpendCents,
+                evidenceMapper: (result) => {
+                    const payload = result;
+                    return {
+                        status: payload.status,
+                        cost_cents: payload.cost_cents,
+                    };
+                },
+            },
+        },
+    });
+    const run = await input.paybond.agentRun.bind({
+        bootstrap: {
+            kind: "sandbox",
+            operation,
+            requestedSpendCents,
+            completionPreset: evidencePreset,
+        },
+        registry,
+    });
+    const paidTool = tool(executePaidTool, {
+        name: operation,
+        description: `Paid operation ${operation}`,
+        schema: z.object({
+            estimatedPriceCents: z.number().int().nonnegative(),
+        }),
+    });
+    const node = paybondToolNode([paidTool], run);
+    const fakeAi = new AIMessage({
+        content: "",
+        tool_calls: [
+            {
+                name: operation,
+                args: { estimatedPriceCents: requestedSpendCents },
+                id: toolCallId,
+                type: "tool_call",
+            },
+        ],
+    });
+    const out = await node.invoke([fakeAi]);
+    const messages = Array.isArray(out) ? out : out.messages;
+    const toolMessage = messages[messages.length - 1];
+    const sandboxStatus = run.binding.sandbox?.sandboxLifecycleStatus;
+    return {
+        bind: {
+            run_id: run.runId,
+            tenant_id: run.tenantId,
+            intent_id: run.intentId,
+            capability_token: run.capabilityToken,
+            operation,
+            sandbox_lifecycle_status: sandboxStatus,
+        },
+        authorization: {
+            allow: toolMessage.status !== "error",
+        },
+        tool_message: {
+            content: String(toolMessage.content),
+            status: String(toolMessage.status ?? "success"),
+            name: String(toolMessage.name ?? operation),
+            tool_call_id: String(toolMessage.tool_call_id ?? toolCallId),
+        },
+        evidence: {
+            submitted: toolMessage.status !== "error",
+            sandbox_lifecycle_status: sandboxStatus,
+            predicate_passed: toolMessage.status !== "error" ? true : null,
+        },
+        intent_state: sandboxStatus,
+    };
+}

package/dist/langgraph/tool-node.d.ts

@@ -0,0 +1,10 @@
+import type { DynamicTool, StructuredToolInterface } from "@langchain/core/tools";
+import type { RunnableToolLike } from "@langchain/core/runnables";
+import { ToolNode, type ToolNodeOptions } from "@langchain/langgraph/prebuilt";
+import type { PaybondAgentRun } from "../agent/run.js";
+type LangGraphTool = StructuredToolInterface | DynamicTool | RunnableToolLike;
+/**
+ * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ */
+export declare function paybondToolNode(tools: LangGraphTool[], run: PaybondAgentRun, options?: ToolNodeOptions): ToolNode;
+export {};

package/dist/langgraph/tool-node.js

@@ -0,0 +1,38 @@
+import { ToolNode } from "@langchain/langgraph/prebuilt";
+import { normalizeLangGraphHookResult, paybondAwrapToolCall, } from "./awrap-tool-call.js";
+/**
+ * `ToolNode` subclass that runs {@link paybondAwrapToolCall} before each tool invocation.
+ *
+ * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; this wrapper provides the
+ * same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
+ */
+class PaybondGuardedToolNode extends ToolNode {
+    awrap;
+    constructor(tools, run, options) {
+        super(tools, options);
+        this.awrap = paybondAwrapToolCall(run);
+    }
+    async runTool(call, config, state) {
+        const request = {
+            tool_call: {
+                name: call.name,
+                id: call.id,
+                args: (call.args ?? {}),
+            },
+        };
+        const execute = async (req) => super.runTool({
+            ...call,
+            name: req.tool_call.name,
+            id: req.tool_call.id ?? call.id,
+            args: req.tool_call.args ?? call.args,
+        }, config, state);
+        const result = await this.awrap(request, execute);
+        return normalizeLangGraphHookResult(call, result);
+    }
+}
+/**
+ * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ */
+export function paybondToolNode(tools, run, options) {
+    return new PaybondGuardedToolNode(tools, run, options);
+}

package/dist/login.js

@@ -4,6 +4,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { runCli } from "./cli/router.js";
+import { requireSecureGatewayUrl } from "./gateway-url.js";
 const DEFAULT_GATEWAY = "https://api.paybond.ai";
 const DEFAULT_ENV_FILE = ".env.local";
 const CLIENT_ID = "paybond-kit-cli";
@@ -124,6 +125,12 @@ export function parseArgs(argv) {
     if (!gateway.trim()) {
         throw new PaybondLoginError("invalid --gateway");
     }
+    try {
+        gateway = requireSecureGatewayUrl(gateway);
+    }
+    catch (err) {
+        throw new PaybondLoginError(err instanceof Error ? err.message : String(err));
+    }
     return { envFile, gateway, environment, noOpen, force };
 }
 function envKeyPattern() {

package/dist/mcp/index.d.ts

@@ -0,0 +1 @@
+export { createPaybondMcpToolSurface, type PaybondMcpToolSurface, type PaybondMcpToolSurfaceOptions, } from "./tool-surface.js";

package/dist/mcp/index.js

@@ -0,0 +1 @@
+export { createPaybondMcpToolSurface, } from "./tool-surface.js";

package/dist/mcp/tool-surface.d.ts

@@ -0,0 +1,25 @@
+import type { PaybondAgentRun } from "../agent/run.js";
+import { type McpInstallFormat, type McpServerEntry } from "../cli/mcp-install.js";
+import type { McpToolPolicyConfig } from "../cli/mcp-policy.js";
+export type PaybondMcpToolSurfaceOptions = {
+    /** Env file referenced by `PAYBOND_ENV_FILE` in the MCP host config (default `.env.local`). */
+    envFile?: string;
+    /** Override stdio server launch command (default: package-local `paybond-mcp-server`). */
+    serverCommand?: string[];
+    /** Optional MCP tool exposure policy for the stdio server process. */
+    toolPolicy?: McpToolPolicyConfig | null;
+};
+/** Stdio MCP host configuration derived from `paybond mcp install` patterns. */
+export type PaybondMcpToolSurface = {
+    serverConfig: McpServerEntry;
+    /** Serialize host config as JSON (Claude Desktop, generic) or TOML (Codex). */
+    installPayload: (format?: McpInstallFormat) => string;
+};
+/**
+ * Framework runner helper for external MCP hosts (Claude Desktop, Codex, generic stdio).
+ *
+ * The bound {@link PaybondAgentRun} establishes tenant/intent context for your app;
+ * the returned `serverConfig` is the stdio entry coding-agent hosts consume via
+ * `PAYBOND_ENV_FILE` (never raw API keys in host config files).
+ */
+export declare function createPaybondMcpToolSurface(_run: PaybondAgentRun, options?: PaybondMcpToolSurfaceOptions): PaybondMcpToolSurface;

package/dist/mcp/tool-surface.js

@@ -0,0 +1,17 @@
+import { buildMcpServerEntry, defaultMcpServerCommand, serializeMcpInstallPayload, } from "../cli/mcp-install.js";
+/**
+ * Framework runner helper for external MCP hosts (Claude Desktop, Codex, generic stdio).
+ *
+ * The bound {@link PaybondAgentRun} establishes tenant/intent context for your app;
+ * the returned `serverConfig` is the stdio entry coding-agent hosts consume via
+ * `PAYBOND_ENV_FILE` (never raw API keys in host config files).
+ */
+export function createPaybondMcpToolSurface(_run, options) {
+    const envFile = options?.envFile?.trim() || ".env.local";
+    const serverCommand = options?.serverCommand ?? defaultMcpServerCommand();
+    const serverConfig = buildMcpServerEntry(envFile, serverCommand, options?.toolPolicy);
+    return {
+        serverConfig,
+        installPayload: (format = "json") => serializeMcpInstallPayload(format, serverConfig),
+    };
+}

package/dist/mcp-capability-token-cache.d.ts

@@ -0,0 +1,24 @@
+export declare const MCP_CAPABILITY_TOKEN_TTL_ENV = "PAYBOND_MCP_CAPABILITY_TOKEN_TTL_SEC";
+export declare const MCP_CAPABILITY_TOKEN_CACHE_MAX_ENV = "PAYBOND_MCP_CAPABILITY_TOKEN_CACHE_MAX";
+export declare const DEFAULT_MCP_CAPABILITY_TOKEN_TTL_SEC = 900;
+export declare const DEFAULT_MCP_CAPABILITY_TOKEN_CACHE_MAX = 64;
+/** MCP tools that mint or return funded intent capability tokens from Harbor. */
+export declare const MCP_CAPABILITY_TOKEN_STORE_TOOLS: readonly ["paybond_bootstrap_sandbox_guardrail", "paybond_create_intent", "paybond_create_spend_intent", "paybond_fund_intent"];
+export type McpCapabilityTokenStoreTool = (typeof MCP_CAPABILITY_TOKEN_STORE_TOOLS)[number];
+/** Return true when an MCP tool response may populate the runtime token cache. */
+export declare function mcpToolStoresCapabilityToken(toolName: string): boolean;
+export type McpCapabilityTokenCacheConfig = {
+    ttlSec: number;
+    maxEntries: number;
+};
+export declare class McpCapabilityTokenCache {
+    private readonly ttlSec;
+    private readonly maxEntries;
+    private readonly entries;
+    constructor(config?: McpCapabilityTokenCacheConfig);
+    store(intentId: string, token: string): void;
+    resolve(intentId: string): string | undefined;
+    private evictExpired;
+    private evictOverflow;
+}
+export declare function parseMcpCapabilityTokenCacheConfig(env?: Record<string, string | undefined>): McpCapabilityTokenCacheConfig;

package/dist/mcp-capability-token-cache.js

@@ -0,0 +1,101 @@
+export const MCP_CAPABILITY_TOKEN_TTL_ENV = "PAYBOND_MCP_CAPABILITY_TOKEN_TTL_SEC";
+export const MCP_CAPABILITY_TOKEN_CACHE_MAX_ENV = "PAYBOND_MCP_CAPABILITY_TOKEN_CACHE_MAX";
+export const DEFAULT_MCP_CAPABILITY_TOKEN_TTL_SEC = 900;
+export const DEFAULT_MCP_CAPABILITY_TOKEN_CACHE_MAX = 64;
+const MIN_MCP_CAPABILITY_TOKEN_TTL_SEC = 60;
+const MAX_MCP_CAPABILITY_TOKEN_TTL_SEC = 86_400;
+const MIN_MCP_CAPABILITY_TOKEN_CACHE_MAX = 1;
+const MAX_MCP_CAPABILITY_TOKEN_CACHE_MAX = 512;
+/** MCP tools that mint or return funded intent capability tokens from Harbor. */
+export const MCP_CAPABILITY_TOKEN_STORE_TOOLS = [
+    "paybond_bootstrap_sandbox_guardrail",
+    "paybond_create_intent",
+    "paybond_create_spend_intent",
+    "paybond_fund_intent",
+];
+const MCP_CAPABILITY_TOKEN_STORE_TOOL_SET = new Set(MCP_CAPABILITY_TOKEN_STORE_TOOLS);
+/** Return true when an MCP tool response may populate the runtime token cache. */
+export function mcpToolStoresCapabilityToken(toolName) {
+    return MCP_CAPABILITY_TOKEN_STORE_TOOL_SET.has(toolName.trim());
+}
+export class McpCapabilityTokenCache {
+    ttlSec;
+    maxEntries;
+    entries = new Map();
+    constructor(config) {
+        this.ttlSec = config?.ttlSec ?? DEFAULT_MCP_CAPABILITY_TOKEN_TTL_SEC;
+        this.maxEntries = config?.maxEntries ?? DEFAULT_MCP_CAPABILITY_TOKEN_CACHE_MAX;
+    }
+    store(intentId, token) {
+        const key = intentId.trim();
+        const value = token.trim();
+        if (!key || !value) {
+            return;
+        }
+        this.evictExpired();
+        this.entries.set(key, { token: value, storedAtMs: Date.now() });
+        this.evictOverflow();
+    }
+    resolve(intentId) {
+        this.evictExpired();
+        const key = String(intentId).trim();
+        const entry = this.entries.get(key);
+        if (!entry) {
+            return undefined;
+        }
+        if (Date.now() - entry.storedAtMs > this.ttlSec * 1000) {
+            this.entries.delete(key);
+            return undefined;
+        }
+        this.entries.delete(key);
+        this.entries.set(key, entry);
+        return entry.token;
+    }
+    evictExpired() {
+        const now = Date.now();
+        const ttlMs = this.ttlSec * 1000;
+        for (const [key, entry] of this.entries) {
+            if (now - entry.storedAtMs > ttlMs) {
+                this.entries.delete(key);
+            }
+        }
+    }
+    evictOverflow() {
+        while (this.entries.size > this.maxEntries) {
+            const oldest = this.entries.keys().next().value;
+            if (oldest === undefined) {
+                break;
+            }
+            this.entries.delete(oldest);
+        }
+    }
+}
+export function parseMcpCapabilityTokenCacheConfig(env = process.env) {
+    const ttlRaw = env[MCP_CAPABILITY_TOKEN_TTL_ENV]?.trim();
+    const maxRaw = env[MCP_CAPABILITY_TOKEN_CACHE_MAX_ENV]?.trim();
+    let ttlSec = DEFAULT_MCP_CAPABILITY_TOKEN_TTL_SEC;
+    if (ttlRaw) {
+        const parsed = Number.parseFloat(ttlRaw);
+        if (!Number.isFinite(parsed)) {
+            throw new Error(`invalid ${MCP_CAPABILITY_TOKEN_TTL_ENV} (expected a number of seconds)`);
+        }
+        if (parsed < MIN_MCP_CAPABILITY_TOKEN_TTL_SEC ||
+            parsed > MAX_MCP_CAPABILITY_TOKEN_TTL_SEC) {
+            throw new Error(`invalid ${MCP_CAPABILITY_TOKEN_TTL_ENV} (expected ${MIN_MCP_CAPABILITY_TOKEN_TTL_SEC}-${MAX_MCP_CAPABILITY_TOKEN_TTL_SEC} seconds)`);
+        }
+        ttlSec = parsed;
+    }
+    let maxEntries = DEFAULT_MCP_CAPABILITY_TOKEN_CACHE_MAX;
+    if (maxRaw) {
+        const parsed = Number.parseInt(maxRaw, 10);
+        if (!Number.isInteger(parsed)) {
+            throw new Error(`invalid ${MCP_CAPABILITY_TOKEN_CACHE_MAX_ENV} (expected an integer)`);
+        }
+        if (parsed < MIN_MCP_CAPABILITY_TOKEN_CACHE_MAX ||
+            parsed > MAX_MCP_CAPABILITY_TOKEN_CACHE_MAX) {
+            throw new Error(`invalid ${MCP_CAPABILITY_TOKEN_CACHE_MAX_ENV} (expected ${MIN_MCP_CAPABILITY_TOKEN_CACHE_MAX}-${MAX_MCP_CAPABILITY_TOKEN_CACHE_MAX})`);
+        }
+        maxEntries = parsed;
+    }
+    return { ttlSec, maxEntries };
+}

package/dist/mcp-evidence-policy.d.ts

@@ -0,0 +1,48 @@
+import { type CompletionEvidenceValidationReport } from "./completion-validate-evidence.js";
+export type McpEvidencePolicy = "strict" | "off";
+export declare const MCP_EVIDENCE_POLICY_ENV = "PAYBOND_MCP_EVIDENCE_POLICY";
+export declare const DEFAULT_MCP_EVIDENCE_POLICY: McpEvidencePolicy;
+export declare const EVIDENCE_SUBMIT_TOOL_NAMES: Set<string>;
+export declare class McpEvidencePolicyError extends Error {
+    constructor(message: string);
+}
+export declare function parseMcpEvidencePolicy(raw: string | undefined): McpEvidencePolicy;
+export declare function completionEvidenceValidationOk(report: CompletionEvidenceValidationReport): boolean;
+export declare function evidenceValidationGateKey(input: {
+    presetId: string;
+    vendorPayload?: Record<string, unknown>;
+    canonicalPayload?: Record<string, unknown>;
+}): string;
+export declare function extractHarborEvidenceValidationInput(body: Record<string, unknown>, completionPresetId?: string): {
+    presetId: string;
+    vendorPayload?: Record<string, unknown>;
+    canonicalPayload?: Record<string, unknown>;
+};
+export declare function extractSandboxGuardrailValidationInput(input: {
+    payload?: Record<string, unknown>;
+    completionPresetId?: string;
+}): {
+    presetId: string;
+    vendorPayload?: Record<string, unknown>;
+    canonicalPayload?: Record<string, unknown>;
+};
+export declare class McpEvidenceValidationGate {
+    readonly policy: McpEvidencePolicy;
+    private readonly passes;
+    constructor(policy?: McpEvidencePolicy);
+    recordPass(gateKey: string): void;
+    hasPass(gateKey: string): boolean;
+    requirePass(input: {
+        presetId: string;
+        vendorPayload?: Record<string, unknown>;
+        canonicalPayload?: Record<string, unknown>;
+    }): void;
+    validateAndRecord(input: {
+        presetId: string;
+        vendorPayload?: Record<string, unknown>;
+        canonicalPayload?: Record<string, unknown>;
+        frozenVendorApiVersion?: string;
+        frozenVendorSchemaDigestHex?: string;
+        frozenCanonicalSchemaDigestHex?: string;
+    }): CompletionEvidenceValidationReport;
+}

package/dist/mcp-evidence-policy.js

@@ -0,0 +1,117 @@
+import { validateCompletionEvidence, } from "./completion-validate-evidence.js";
+import { jsonValueDigest } from "./json-digest.js";
+export const MCP_EVIDENCE_POLICY_ENV = "PAYBOND_MCP_EVIDENCE_POLICY";
+export const DEFAULT_MCP_EVIDENCE_POLICY = "strict";
+export const EVIDENCE_SUBMIT_TOOL_NAMES = new Set([
+    "paybond_submit_evidence",
+    "paybond_submit_spend_evidence",
+    "paybond_submit_sandbox_guardrail_evidence",
+]);
+export class McpEvidencePolicyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "McpEvidencePolicyError";
+    }
+}
+export function parseMcpEvidencePolicy(raw) {
+    const value = (raw ?? "").trim().toLowerCase();
+    if (!value) {
+        return DEFAULT_MCP_EVIDENCE_POLICY;
+    }
+    if (value === "strict" || value === "off") {
+        return value;
+    }
+    throw new Error("invalid PAYBOND_MCP_EVIDENCE_POLICY (expected strict|off)");
+}
+export function completionEvidenceValidationOk(report) {
+    return report.drift_kinds.length === 0;
+}
+export function evidenceValidationGateKey(input) {
+    const presetId = input.presetId.trim();
+    if (!presetId) {
+        throw new Error("completion preset id is required for evidence validation");
+    }
+    const digest = jsonValueDigest({
+        preset_id: presetId,
+        vendor_payload: input.vendorPayload,
+        canonical_payload: input.canonicalPayload,
+    });
+    return Buffer.from(digest).toString("hex");
+}
+export function extractHarborEvidenceValidationInput(body, completionPresetId) {
+    let presetId = (completionPresetId ?? "").trim();
+    if (!presetId) {
+        for (const key of ["completion_preset_id", "completion_preset"]) {
+            const raw = body[key];
+            if (typeof raw === "string" && raw.trim()) {
+                presetId = raw.trim();
+                break;
+            }
+        }
+    }
+    const vendorRaw = body.vendor_payload;
+    const vendorPayload = vendorRaw !== undefined && typeof vendorRaw === "object" && vendorRaw !== null && !Array.isArray(vendorRaw)
+        ? vendorRaw
+        : undefined;
+    const payloadRaw = body.payload;
+    const canonicalPayload = payloadRaw !== undefined && typeof payloadRaw === "object" && payloadRaw !== null && !Array.isArray(payloadRaw)
+        ? payloadRaw
+        : undefined;
+    return { presetId, vendorPayload, canonicalPayload };
+}
+export function extractSandboxGuardrailValidationInput(input) {
+    const presetId = (input.completionPresetId ?? "").trim();
+    return {
+        presetId,
+        vendorPayload: input.payload,
+        canonicalPayload: input.payload,
+    };
+}
+export class McpEvidenceValidationGate {
+    policy;
+    passes = new Set();
+    constructor(policy = DEFAULT_MCP_EVIDENCE_POLICY) {
+        this.policy = policy;
+    }
+    recordPass(gateKey) {
+        this.passes.add(gateKey);
+    }
+    hasPass(gateKey) {
+        return this.passes.has(gateKey);
+    }
+    requirePass(input) {
+        if (this.policy === "off") {
+            return;
+        }
+        const presetId = input.presetId.trim();
+        if (!presetId) {
+            return;
+        }
+        const gateKey = evidenceValidationGateKey({
+            presetId,
+            vendorPayload: input.vendorPayload,
+            canonicalPayload: input.canonicalPayload,
+        });
+        if (!this.hasPass(gateKey)) {
+            throw new McpEvidencePolicyError("completion evidence was not pre-validated; call paybond_validate_completion_evidence with the same preset and payload before submit (Harbor remains authoritative at submit time)");
+        }
+    }
+    validateAndRecord(input) {
+        const report = validateCompletionEvidence({
+            presetId: input.presetId,
+            vendorPayload: input.vendorPayload,
+            canonicalPayload: input.canonicalPayload,
+            frozenVendorApiVersion: input.frozenVendorApiVersion,
+            frozenVendorSchemaDigestHex: input.frozenVendorSchemaDigestHex,
+            frozenCanonicalSchemaDigestHex: input.frozenCanonicalSchemaDigestHex,
+        });
+        if (completionEvidenceValidationOk(report)) {
+            this.recordPass(evidenceValidationGateKey({
+                presetId: input.presetId,
+                vendorPayload: input.vendorPayload,
+                canonicalPayload: input.canonicalPayload,
+            }));
+        }
+        return report;
+    }
+}

package/dist/mcp-policy-reload.d.ts

@@ -0,0 +1,79 @@
+import { type PaybondPolicyReloadOptions, type PaybondPolicyReloadResult, type PolicyReloadHandle } from "./policy/reload.js";
+import type { PaybondPolicySnapshot } from "./policy/snapshot.js";
+import { type PolicyEffectiveResolveClient } from "./policy/load-effective.js";
+import { type PolicyRemoteValidateClient } from "./policy/validate-remote.js";
+export declare const MCP_POLICY_FILE_ENV = "PAYBOND_POLICY_FILE";
+export declare const MCP_POLICY_RELOAD_ENV = "PAYBOND_POLICY_RELOAD";
+export declare const MCP_POLICY_RELOAD_ALLOW_LOOSEN_ENV = "PAYBOND_POLICY_RELOAD_ALLOW_LOOSEN";
+export type McpPolicyReloadMode = "off" | "watch" | "poll";
+export type McpPolicyReloadConfig = {
+    policyFile: string;
+    reloadMode: McpPolicyReloadMode;
+    allowLoosen?: boolean;
+    watchDebounceMs?: number;
+    pollIntervalMs?: number;
+};
+export type McpPolicySpendGateInput = {
+    toolName?: string;
+    operation: string;
+    allowedTools: readonly string[];
+    arguments?: unknown;
+    requestedSpendCents?: number;
+};
+export type McpPolicySpendGateResult = {
+    operation: string;
+    requestedSpendCents: number;
+    policyDigest?: string;
+};
+export type McpPolicyReloadStatus = {
+    enabled: boolean;
+    policy_file?: string;
+    policy_digest?: string;
+    policy_loaded_at?: string;
+    reload_mode: McpPolicyReloadMode;
+    last_reload_at?: string;
+    last_reload_error?: string;
+};
+export declare class McpPolicyReloadError extends Error {
+    constructor(message: string);
+}
+/** Gateway adapter for MCP poll reload with remote validation. */
+export type McpPolicyGatewayClient = PolicyRemoteValidateClient & PolicyEffectiveResolveClient;
+export declare function createMcpPolicyGatewayAdapter(client: {
+    postJSON(path: string, payload: Record<string, unknown>, extraHeaders?: Record<string, string>): Promise<Record<string, unknown>>;
+}): McpPolicyGatewayClient;
+export declare function parseMcpPolicyReloadMode(raw: string | undefined): McpPolicyReloadMode;
+export declare function parseMcpPolicyReloadConfig(env: Record<string, string | undefined>): McpPolicyReloadConfig | null;
+/**
+ * Long-lived MCP policy gate: versioned snapshot, safe reload, and spend-gate registry checks.
+ */
+export declare class McpPolicyReloadGate implements PolicyReloadHandle {
+    readonly config: McpPolicyReloadConfig;
+    private _snapshot?;
+    private _inFlightCount;
+    private _lastAllowedTools;
+    private _controller?;
+    private _reloadDefaults;
+    readonly policyFilePath: string;
+    lastReloadAt?: string;
+    lastReloadError?: string;
+    private constructor();
+    static open(config: McpPolicyReloadConfig, options?: {
+        gateway?: McpPolicyGatewayClient;
+    }): Promise<McpPolicyReloadGate>;
+    get currentSnapshot(): PaybondPolicySnapshot | undefined;
+    get policyDigest(): string | undefined;
+    get inFlightCount(): number;
+    get registry(): import("./index.js").PaybondToolRegistry;
+    applyPolicySnapshot(snapshot: PaybondPolicySnapshot): void;
+    reloadPolicy(options?: PaybondPolicyReloadOptions): Promise<PaybondPolicyReloadResult>;
+    beginToolCall(): void;
+    endToolCall(): void;
+    /**
+     * Enforce paybond.policy.yaml registry rules before Harbor spend authorization.
+     * Pins policy_digest for the current MCP tool invocation.
+     */
+    assertSpendGate(input: McpPolicySpendGateInput): McpPolicySpendGateResult;
+    status(): McpPolicyReloadStatus;
+    stop(): void;
+}