@paybond/kit 0.11.10 → 0.12.0

package/dist/x402-funding.js

@@ -0,0 +1,124 @@
+const DEFAULT_MAX_ATTEMPTS = 30;
+const DEFAULT_INTERVAL_MS = 2_000;
+const FUND_REQUEST_BODY = {};
+const TERMINAL_X402_FUNDING_STATUSES = new Set([
+    "authorization_failed",
+    "capture_failed",
+    "void_failed",
+]);
+/** Raised when x402 funding cannot complete (missing challenge, terminal rail status, unexpected HTTP). */
+export class PaybondX402FundingFailedError extends Error {
+    intentId;
+    lastResult;
+    constructor(message, init) {
+        super(message, { cause: init.cause });
+        this.name = "PaybondX402FundingFailedError";
+        this.intentId = init.intentId;
+        this.lastResult = init.lastResult;
+    }
+}
+/** Raised when polling exhausts `maxAttempts` before Harbor returns a funded capability token. */
+export class PaybondX402FundingPendingError extends Error {
+    intentId;
+    lastResult;
+    attempts;
+    constructor(message, init) {
+        super(message);
+        this.name = "PaybondX402FundingPendingError";
+        this.intentId = init.intentId;
+        this.lastResult = init.lastResult;
+        this.attempts = init.attempts;
+    }
+}
+/** Canonical `/fund` request envelope for Gateway `POST /harbor/intents/{intentId}/fund`. */
+export function buildX402FundRequestEnvelope(intentId) {
+    const trimmed = intentId.trim();
+    if (!trimmed) {
+        throw new Error("fundWithX402: intentId is required");
+    }
+    return {
+        intentId: trimmed,
+        method: "POST",
+        path: `/harbor/intents/${trimmed}/fund`,
+        body: FUND_REQUEST_BODY,
+    };
+}
+function isFundingComplete(result) {
+    if (result.capabilityToken?.trim()) {
+        return true;
+    }
+    return result.statusCode === 200 && result.funded;
+}
+function isTerminalFundingFailure(result) {
+    const status = result.funding?.status?.trim();
+    return status !== undefined && TERMINAL_X402_FUNDING_STATUSES.has(status);
+}
+function failureMessage(result) {
+    const status = result.funding?.status ?? result.state;
+    return `x402 funding failed for intent ${result.intentId} (status=${status})`;
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Orchestrate x402 `/fund`: handle 402 signing, retry with `payment-signature`, and poll 202 until funded.
+ */
+export async function executeFundWithX402(params) {
+    const intentId = params.intentId.trim();
+    if (!intentId) {
+        throw new Error("fundWithX402: intentId is required");
+    }
+    const maxAttempts = Math.max(1, params.pollOptions?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    const intervalMs = Math.max(0, params.pollOptions?.intervalMs ?? DEFAULT_INTERVAL_MS);
+    const envelope = buildX402FundRequestEnvelope(intentId);
+    let paymentSignature;
+    let result = await params.fund({ recognitionProof: params.recognitionProof });
+    if (result.statusCode === 402) {
+        if (!result.paymentRequired?.trim()) {
+            throw new PaybondX402FundingFailedError("x402 fund challenge missing payment-required header", { intentId, lastResult: result });
+        }
+        paymentSignature = (await params.signPayment(result.paymentRequired)).trim();
+        if (!paymentSignature) {
+            throw new PaybondX402FundingFailedError("x402 signPayment returned an empty payment signature", {
+                intentId,
+                lastResult: result,
+            });
+        }
+        const retryProof = await params.issueRecognitionProof(envelope);
+        result = await params.fund({
+            recognitionProof: retryProof,
+            paymentSignature,
+        });
+    }
+    if (isTerminalFundingFailure(result)) {
+        throw new PaybondX402FundingFailedError(failureMessage(result), { intentId, lastResult: result });
+    }
+    if (isFundingComplete(result)) {
+        return result;
+    }
+    let attempts = 0;
+    while (result.statusCode === 202 || (!isFundingComplete(result) && result.statusCode === 200)) {
+        attempts += 1;
+        if (attempts > maxAttempts) {
+            throw new PaybondX402FundingPendingError(`x402 funding still pending after ${maxAttempts} poll attempt(s) for intent ${intentId}`, { intentId, lastResult: result, attempts: maxAttempts });
+        }
+        if (intervalMs > 0) {
+            await sleep(intervalMs);
+        }
+        const pollProof = await params.issueRecognitionProof(envelope);
+        result = await params.fund({
+            recognitionProof: pollProof,
+            ...(paymentSignature ? { paymentSignature } : {}),
+        });
+        if (isTerminalFundingFailure(result)) {
+            throw new PaybondX402FundingFailedError(failureMessage(result), { intentId, lastResult: result });
+        }
+        if (isFundingComplete(result)) {
+            return result;
+        }
+    }
+    if (isFundingComplete(result)) {
+        return result;
+    }
+    throw new PaybondX402FundingFailedError(`unexpected x402 fund response HTTP ${result.statusCode} for intent ${intentId}`, { intentId, lastResult: result });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.10",
+  "version": "0.12.0",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",
@@ -46,6 +46,14 @@
       "types": "./dist/mcp/index.d.ts",
       "import": "./dist/mcp/index.js"
     },
+    "./mastra": {
+      "types": "./dist/mastra/index.d.ts",
+      "import": "./dist/mastra/index.js"
+    },
+    "./cloudflare-agents": {
+      "types": "./dist/cloudflare-agents/index.d.ts",
+      "import": "./dist/cloudflare-agents/index.js"
+    },
     "./policy": {
       "types": "./dist/policy/index.d.ts",
       "import": "./dist/policy/index.js"
@@ -124,6 +132,8 @@
     "@anthropic-ai/claude-agent-sdk": ">=0.2.100",
     "@langchain/core": ">=0.3.0",
     "@langchain/langgraph": ">=0.2.50",
+    "@mastra/core": ">=1.0.0",
+    "agents": ">=0.10.0",
     "@openai/agents": ">=0.12.0",
     "ai": ">=4.0.0",
     "zod": "^3.25.32 || ^4.2.0"
@@ -138,6 +148,12 @@
     "@langchain/langgraph": {
       "optional": true
     },
+    "@mastra/core": {
+      "optional": true
+    },
+    "agents": {
+      "optional": true
+    },
     "@openai/agents": {
       "optional": true
     },
@@ -155,13 +171,15 @@
     "ajv": "^8.17.1",
     "blake3": "^2.1.7",
     "uuid": "^14.0.0",
-    "zod": "^4.4.3"
+    "zod": "^3.25.32 || ^4.2.0"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.197",
     "@langchain/core": "^1.2.1",
     "@langchain/langgraph": "^1.4.7",
     "@langchain/langgraph-sdk": "^1.9.25",
+    "@mastra/core": "^1.49.0",
+    "agents": "^0.17.3",
     "@openai/agents": "^0.12.0",
     "@types/node": "^22.10.0",
     "ai": "^7.0.4",

package/templates/manifest.json

@@ -13,7 +13,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.11.11",
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
         "zod": "^4.2.0"
@@ -33,7 +33,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.11.11",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -52,7 +52,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.11.11",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -71,7 +71,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.11.11",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -90,13 +90,32 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.11.11",
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
         "zod": "^4.2.0"
       },
       "demo_import": "@paybond/kit/claude-agents",
       "demo_export": "runClaudeAgentsSandboxDemo"
     },
+    {
+      "id": "mastra-travel-agent",
+      "repo": "paybond-mastra-travel-agent",
+      "title": "Travel booking agent (Mastra)",
+      "language": "typescript",
+      "framework": "mastra",
+      "preset": "travel",
+      "primary_operation": "travel.book_hotel",
+      "requested_spend_cents": 18700,
+      "evidence_preset": "cost_and_completion",
+      "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
+      "dependencies": {
+        "@paybond/kit": "^0.11.11",
+        "@mastra/core": "^1.49.0",
+        "zod": "^4.2.0"
+      },
+      "demo_import": "@paybond/kit/mastra",
+      "demo_export": "runMastraSandboxDemo"
+    },
     {
       "id": "mcp-coding-agent",
       "repo": "paybond-mcp-coding-agent",
@@ -110,7 +129,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10"
+        "@paybond/kit": "^0.11.11"
       },
       "mcp_tool_policy": "spend-write"
     },
@@ -127,7 +146,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12000 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10"
+        "@paybond/kit": "^0.11.11"
       },
       "demo_mode": "generic"
     },
@@ -143,7 +162,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.10"
+        "@paybond/kit": "^0.11.11"
       },
       "demo_mode": "generic"
     },
@@ -159,7 +178,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "python_dependencies": {
-        "paybond-kit": ">=0.11.10",
+        "paybond-kit": ">=0.11.11",
         "langgraph": ">=1.2.0"
       },
       "demo_import": "paybond_kit.langgraph_sandbox_demo",

package/templates/openai-shopping-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "openai-shopping-agent",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.10.tgz",
-      "integrity": "sha512-RURqB5veDSVtWgeIsmgWI1+CgSyAudhZjhbRt6M9EOVbFF/47yYQLGIXbnqrxpthfV98jPE35p+4k0qtKLw/mw==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -180,7 +180,7 @@
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
         "uuid": "^14.0.0",
-        "zod": "^4.4.3"
+        "zod": "^3.25.32 || ^4.2.0"
       },
       "bin": {
         "paybond": "dist/cli.js",
@@ -195,7 +195,9 @@
         "@anthropic-ai/claude-agent-sdk": ">=0.2.100",
         "@langchain/core": ">=0.3.0",
         "@langchain/langgraph": ">=0.2.50",
+        "@mastra/core": ">=1.0.0",
         "@openai/agents": ">=0.12.0",
+        "agents": ">=0.10.0",
         "ai": ">=4.0.0",
         "zod": "^3.25.32 || ^4.2.0"
       },
@@ -209,9 +211,15 @@
         "@langchain/langgraph": {
           "optional": true
         },
+        "@mastra/core": {
+          "optional": true
+        },
         "@openai/agents": {
           "optional": true
         },
+        "agents": {
+          "optional": true
+        },
         "ai": {
           "optional": true
         },
@@ -798,9 +806,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/templates/openai-shopping-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.10",
+    "@paybond/kit": "^0.11.11",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },

package/templates/paybond-aws-operator/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-aws-operator",
       "dependencies": {
-        "@paybond/kit": "^0.11.10"
+        "@paybond/kit": "^0.12.0"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.10.tgz",
-      "integrity": "sha512-RURqB5veDSVtWgeIsmgWI1+CgSyAudhZjhbRt6M9EOVbFF/47yYQLGIXbnqrxpthfV98jPE35p+4k0qtKLw/mw==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -58,7 +58,7 @@
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
         "uuid": "^14.0.0",
-        "zod": "^4.4.3"
+        "zod": "^3.25.32 || ^4.2.0"
       },
       "bin": {
         "paybond": "dist/cli.js",
@@ -73,7 +73,9 @@
         "@anthropic-ai/claude-agent-sdk": ">=0.2.100",
         "@langchain/core": ">=0.3.0",
         "@langchain/langgraph": ">=0.2.50",
+        "@mastra/core": ">=1.0.0",
         "@openai/agents": ">=0.12.0",
+        "agents": ">=0.10.0",
         "ai": ">=4.0.0",
         "zod": "^3.25.32 || ^4.2.0"
       },
@@ -87,9 +89,15 @@
         "@langchain/langgraph": {
           "optional": true
         },
+        "@mastra/core": {
+          "optional": true
+        },
         "@openai/agents": {
           "optional": true
         },
+        "agents": {
+          "optional": true
+        },
         "ai": {
           "optional": true
         },

package/templates/paybond-aws-operator/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --result-body '{\"status\":\"completed\",\"cost_cents\":12500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.10"
+    "@paybond/kit": "^0.11.11"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-claude-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-claude-agents-demo",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
-        "@paybond/kit": "^0.11.10",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -260,9 +260,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.10",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.10.tgz",
-      "integrity": "sha512-RURqB5veDSVtWgeIsmgWI1+CgSyAudhZjhbRt6M9EOVbFF/47yYQLGIXbnqrxpthfV98jPE35p+4k0qtKLw/mw==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -271,7 +271,7 @@
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
         "uuid": "^14.0.0",
-        "zod": "^4.4.3"
+        "zod": "^3.25.32 || ^4.2.0"
       },
       "bin": {
         "paybond": "dist/cli.js",
@@ -286,7 +286,9 @@
         "@anthropic-ai/claude-agent-sdk": ">=0.2.100",
         "@langchain/core": ">=0.3.0",
         "@langchain/langgraph": ">=0.2.50",
+        "@mastra/core": ">=1.0.0",
         "@openai/agents": ">=0.12.0",
+        "agents": ">=0.10.0",
         "ai": ">=4.0.0",
         "zod": "^3.25.32 || ^4.2.0"
       },
@@ -300,9 +302,15 @@
         "@langchain/langgraph": {
           "optional": true
         },
+        "@mastra/core": {
+          "optional": true
+        },
         "@openai/agents": {
           "optional": true
         },
+        "agents": {
+          "optional": true
+        },
         "ai": {
           "optional": true
         },
@@ -846,9 +854,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

package/templates/paybond-claude-agents-demo/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.10",
+    "@paybond/kit": "^0.11.11",
     "@anthropic-ai/claude-agent-sdk": "^0.2.100",
     "zod": "^4.2.0"
   },

package/templates/paybond-invoice-agent/requirements.txt

@@ -1,2 +1,2 @@
-paybond-kit>=0.11.10
+paybond-kit>=0.11.11
 langgraph>=1.2.0

package/templates/paybond-mastra-travel-agent/.env.example

@@ -0,0 +1,3 @@
+# Copy to .env.local after paybond login
+PAYBOND_API_KEY=
+PAYBOND_GATEWAY_URL=https://api.paybond.ai

package/templates/paybond-mastra-travel-agent/.github/workflows/smoke.yml

@@ -0,0 +1,20 @@
+name: smoke
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+      - run: npm ci
+      - run: npm run smoke
+        env:
+          PAYBOND_API_KEY: ${{ secrets.PAYBOND_SANDBOX_API_KEY }}