@paybond/kit 0.11.10 → 0.12.0

package/dist/cloudflare-agents/peer.js

@@ -0,0 +1,20 @@
+import { createRequire } from "node:module";
+let cachedAgents;
+/**
+ * Lazily resolve the optional `agents` peer dependency (Cloudflare Agents SDK).
+ *
+ * Importing `@paybond/kit/cloudflare-agents` must not require the SDK installed —
+ * the peer is only needed when adapter functions or the sandbox demo actually run.
+ */
+export function loadCloudflareAgentsSdk() {
+    if (cachedAgents === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedAgents = require("agents");
+        }
+        catch (err) {
+            throw new Error('The Cloudflare Agents integration requires the optional peer dependency "agents"; install it with: npm install agents', { cause: err });
+        }
+    }
+    return cachedAgents;
+}

package/dist/cloudflare-agents/sandbox-demo.d.ts

@@ -0,0 +1,36 @@
+import type { Paybond } from "../index.js";
+export type RunCloudflareAgentsSandboxDemoInput = {
+    paybond: Paybond;
+    operation?: string;
+    requestedSpendCents?: number;
+    evidencePreset?: string;
+    toolCallId?: string;
+};
+export type RunCloudflareAgentsSandboxDemoResult = {
+    bind: {
+        run_id: string;
+        tenant_id: string;
+        intent_id: string;
+        capability_token: string;
+        operation: string;
+        sandbox_lifecycle_status?: string;
+    };
+    authorization: {
+        allow: boolean;
+        audit_id?: string;
+        decision_id?: string;
+    };
+    execute: {
+        tool_result?: unknown;
+        evidence?: {
+            submitted: boolean;
+            sandbox_lifecycle_status?: string;
+            predicate_passed?: boolean | null;
+        };
+    };
+};
+/**
+ * No-LLM Cloudflare Agents sandbox demo: wrapped AI SDK `tool()` execute + auto-evidence.
+ * Requires optional peer `ai` (Cloudflare Agents `getTools()` uses AI SDK tools).
+ */
+export declare function runCloudflareAgentsSandboxDemo(input: RunCloudflareAgentsSandboxDemoInput): Promise<RunCloudflareAgentsSandboxDemoResult>;

package/dist/cloudflare-agents/sandbox-demo.js

@@ -0,0 +1,89 @@
+import { tool } from "ai";
+import { z } from "zod";
+import { createPaybondToolRegistry } from "../agent/registry.js";
+import { createPaybondCloudflareAgentsConfig } from "./config.js";
+async function executePaidTool(args) {
+    return { status: "completed", cost_cents: args.estimatedPriceCents };
+}
+/**
+ * No-LLM Cloudflare Agents sandbox demo: wrapped AI SDK `tool()` execute + auto-evidence.
+ * Requires optional peer `ai` (Cloudflare Agents `getTools()` uses AI SDK tools).
+ */
+export async function runCloudflareAgentsSandboxDemo(input) {
+    const operation = (input.operation ?? "paid-tool").trim();
+    const requestedSpendCents = input.requestedSpendCents ?? 100;
+    const evidencePreset = (input.evidencePreset ?? "cost_and_completion").trim();
+    const toolCallId = (input.toolCallId ?? "cloudflare-agents-demo-1").trim();
+    const registry = createPaybondToolRegistry({
+        defaultDeny: true,
+        sideEffecting: {
+            [operation]: {
+                operation,
+                evidencePreset,
+                spendCents: (args) => typeof args === "object" &&
+                    args !== null &&
+                    "estimatedPriceCents" in args &&
+                    typeof args.estimatedPriceCents === "number"
+                    ? args.estimatedPriceCents
+                    : requestedSpendCents,
+                evidenceMapper: (result) => {
+                    const payload = result;
+                    return {
+                        status: payload.status,
+                        cost_cents: payload.cost_cents,
+                    };
+                },
+            },
+        },
+    });
+    const run = await input.paybond.agentRun.bind({
+        bootstrap: {
+            kind: "sandbox",
+            operation,
+            requestedSpendCents,
+            completionPreset: evidencePreset,
+        },
+        registry,
+    });
+    const rawTools = {
+        [operation]: tool({
+            description: `Paid operation ${operation}`,
+            inputSchema: z.object({
+                estimatedPriceCents: z.number().int().nonnegative(),
+            }),
+            execute: async (inputData) => executePaidTool(inputData),
+        }),
+    };
+    const { tools } = createPaybondCloudflareAgentsConfig(run, rawTools);
+    const guardedTool = tools[operation];
+    if (!guardedTool || typeof guardedTool.execute !== "function") {
+        throw new Error("Cloudflare Agents sandbox demo missing guarded tool execute handler");
+    }
+    const toolResult = await guardedTool.execute({ estimatedPriceCents: requestedSpendCents }, {
+        toolCallId,
+        messages: [],
+        context: {},
+    });
+    const sandboxStatus = run.binding.sandbox?.sandboxLifecycleStatus;
+    return {
+        bind: {
+            run_id: run.runId,
+            tenant_id: run.tenantId,
+            intent_id: run.intentId,
+            capability_token: run.capabilityToken,
+            operation,
+            sandbox_lifecycle_status: sandboxStatus,
+        },
+        authorization: {
+            allow: true,
+        },
+        execute: {
+            tool_result: toolResult,
+            evidence: {
+                submitted: true,
+                sandbox_lifecycle_status: sandboxStatus,
+                predicate_passed: true,
+            },
+        },
+    };
+}

package/dist/completion-catalog-digest.d.ts

@@ -1,2 +1,2 @@
 /** Generated by kit/scripts/sync-completion-catalog.mjs — do not edit. */
-export declare const BUNDLED_COMPLETION_CATALOG_SHA256_HEX: "6b3fc4f2c568bd9de61e96c18b345c815a4ffea73fc1212f2e6fe601817a8483";
+export declare const BUNDLED_COMPLETION_CATALOG_SHA256_HEX: "a738febc9ee8b5b66f05991c4582ba24e6857cdc574196b0aeefc5c77e192ea9";

package/dist/completion-catalog-digest.js

@@ -1,2 +1,2 @@
 /** Generated by kit/scripts/sync-completion-catalog.mjs — do not edit. */
-export const BUNDLED_COMPLETION_CATALOG_SHA256_HEX = "6b3fc4f2c568bd9de61e96c18b345c815a4ffea73fc1212f2e6fe601817a8483";
+export const BUNDLED_COMPLETION_CATALOG_SHA256_HEX = "a738febc9ee8b5b66f05991c4582ba24e6857cdc574196b0aeefc5c77e192ea9";

package/dist/completion-init.js

@@ -100,7 +100,7 @@ function evidenceFieldComments(preset) {
     if (required.length > 0) {
         lines.push(`// Required evidence fields: ${required.join(", ")}`);
     }
-    lines.push("// Sandbox: bootstrap with completionPreset to evaluate a strong Harbor predicate on evidence submit.", "// Production: publish the managed template head, then create intents with policy_binding (signing v5).", `//   paybond policy templates`, `//   paybond policy preview --template ${preset.harbor_template_id} --parameters-file parameters.json --evidence-file evidence.json`);
+    lines.push("// Sandbox: bootstrap with completionPreset to evaluate a strong Harbor predicate on evidence submit.", "// Production: publish the managed template head, then create intents with policy_binding (signing v7).", `//   paybond policy templates`, `//   paybond policy preview --template ${preset.harbor_template_id} --parameters-file parameters.json --evidence-file evidence.json`);
     return lines;
 }
 function typescriptTemplate(preset) {
@@ -178,11 +178,16 @@ ${buildTsFieldLines(preset.evidence_schema).join("\n")}
 ${vendorPackHelpers}
 ${buildFn}
 
-// Production: use buildSignedCreateIntentBodyWithPolicyBinding from @paybond/kit after publishing ${preset.harbor_template_id}.
+// Production (signing v7): publish managed template head for ${preset.harbor_template_id}, then:
+// import { PaybondPolicy } from "@paybond/kit";
+// const policy = await PaybondPolicy.load("./paybond.policy.yaml");
+// const created = await paybond.intents.createWithPolicyBinding(
+//   policy.toIntentCreateInput({ principalDid, principalSigningSeed, payeeDid, payeeSigningSeed, deadlineRfc3339, settlementRail: "stripe_connect", recognitionProof, publishedPolicyHead }),
+// );
 export const policyBindingStub = {
   template_id: HARBOR_TEMPLATE_ID,
   parameters: completionTemplateParameters,
-  // head_seq and digest_hex are assigned after: paybond policy publish ...
+  // version_seq and head_digest are assigned after publishing the managed template head.
 };
 
 const DEFAULT_OPERATION = "paid_tool.operation";

package/dist/dev/offline-gateway.d.ts

@@ -1,6 +1,7 @@
 /**
  * In-process offline Gateway mock for `paybond dev --offline`.
- * Simulates sandbox capability bootstrap, verify, evidence, and settlement completion.
+ * Simulates sandbox capability bootstrap, verify, evidence, settlement completion,
+ * and an optional x402 `/fund` state machine for Harbor intent funding smoke.
  */
 export declare const OFFLINE_DEV_INTENT_ID = "00000000-0000-4000-8000-000000000001";
 export declare const OFFLINE_DEV_TENANT_ID = "tenant-dev-offline";

package/dist/dev/offline-gateway.js

@@ -1,9 +1,12 @@
 /**
  * In-process offline Gateway mock for `paybond dev --offline`.
- * Simulates sandbox capability bootstrap, verify, evidence, and settlement completion.
+ * Simulates sandbox capability bootstrap, verify, evidence, settlement completion,
+ * and an optional x402 `/fund` state machine for Harbor intent funding smoke.
  */
+import { X402FundStateMachine } from "./x402-fund-mock.js";
 export const OFFLINE_DEV_INTENT_ID = "00000000-0000-4000-8000-000000000001";
 export const OFFLINE_DEV_TENANT_ID = "tenant-dev-offline";
+const HARBOR_FUND_PATH = /^\/harbor\/intents\/([^/]+)\/fund$/;
 /** Synthetic sandbox API key shape accepted by offline mocks (never validated remotely). */
 export const OFFLINE_SANDBOX_API_KEY = "paybond_sk_sandbox_0123456789abcdef0123456789abcdef_" +
     "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
@@ -15,18 +18,46 @@ export function isProductionApiKey(apiKey) {
 }
 export const DEV_WIREMOCK_DEFAULT_PORT = 18089;
 export const DEV_WIREMOCK_CONTAINER_NAME = "paybond-dev-wiremock";
-function jsonResponse(body, status = 200) {
+function jsonResponse(body, status = 200, extraHeaders = {}) {
     return new Response(JSON.stringify(body), {
         status,
-        headers: { "content-type": "application/json" },
+        headers: { "content-type": "application/json", ...extraHeaders },
     });
 }
+function readRequestHeader(init, name) {
+    if (!init?.headers) {
+        return undefined;
+    }
+    const headers = new Headers(init.headers);
+    return headers.get(name) ?? undefined;
+}
+function parseHarborFundPath(url) {
+    try {
+        const pathname = new URL(url).pathname;
+        const match = pathname.match(HARBOR_FUND_PATH);
+        return match?.[1] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
 /** Build a fetch implementation that stubs Gateway routes for local dev smoke. */
 export function createOfflineDevGatewayFetch(options = {}) {
     const allowVerify = options.allowVerify ?? true;
+    const x402FundState = new X402FundStateMachine();
     return (async (input, init) => {
         const url = input.toString();
+        const method = (init?.method ?? "GET").toUpperCase();
         const body = init?.body ? JSON.parse(String(init.body)) : {};
+        const harborFundIntentId = method === "POST" ? parseHarborFundPath(url) : null;
+        if (harborFundIntentId) {
+            const paymentSignature = readRequestHeader(init, "payment-signature");
+            const mock = x402FundState.next(harborFundIntentId, OFFLINE_DEV_TENANT_ID, paymentSignature);
+            if (mock) {
+                return jsonResponse(mock.body, mock.status, mock.headers);
+            }
+            return jsonResponse({}, 404);
+        }
         if (url.endsWith("/v1/auth/principal")) {
             return jsonResponse({
                 tenant_id: OFFLINE_DEV_TENANT_ID,

package/dist/dev/x402-fund-mock.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Deterministic x402 `/fund` sequence for WireMock and offline dev gateway mocks.
+ * Simulates Harbor: 402 challenge → 202 pending → 200 funded with capability token.
+ */
+export declare const X402_DEV_WIREMOCK_INTENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+export declare const X402_DEV_WIREMOCK_TENANT_ID = "dry-run-tenant";
+export declare const X402_DEV_PAYMENT_REQUIRED = "{\"asset\":\"usdc\",\"network\":\"base\",\"amount\":\"0.02\",\"payTo\":\"0xabc1230000000000000000000000000000000000\"}";
+export declare const X402_DEV_CAPABILITY_TOKEN = "cap-x402-dev-mock-1";
+export type X402FundMockPhase = "challenge" | "pending" | "funded";
+export type X402FundMockResponse = {
+    status: number;
+    headers: Record<string, string>;
+    body: Record<string, unknown>;
+    phase: X402FundMockPhase;
+};
+/** Build the 402 payment challenge response body. */
+export declare function buildX402FundChallengeBody(intentId: string, tenantId: string): Record<string, unknown>;
+/** Build the 202 authorization_pending response body. */
+export declare function buildX402FundPendingBody(intentId: string, tenantId: string): Record<string, unknown>;
+/** Build the 200 funded response body with capability token. */
+export declare function buildX402FundSuccessBody(intentId: string, tenantId: string, capabilityToken?: string): Record<string, unknown>;
+/** In-memory x402 fund sequence keyed by intent id (one sequence per intent). */
+export declare class X402FundStateMachine {
+    private readonly phases;
+    reset(intentId?: string): void;
+    /** Advance the mock fund sequence for ``intentId`` and return the next Harbor-shaped response. */
+    next(intentId: string, tenantId: string, paymentSignature: string | undefined): X402FundMockResponse | null;
+}

package/dist/dev/x402-fund-mock.js

@@ -0,0 +1,124 @@
+/**
+ * Deterministic x402 `/fund` sequence for WireMock and offline dev gateway mocks.
+ * Simulates Harbor: 402 challenge → 202 pending → 200 funded with capability token.
+ */
+export const X402_DEV_WIREMOCK_INTENT_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+export const X402_DEV_WIREMOCK_TENANT_ID = "dry-run-tenant";
+export const X402_DEV_PAYMENT_REQUIRED = '{"asset":"usdc","network":"base","amount":"0.02","payTo":"0xabc1230000000000000000000000000000000000"}';
+export const X402_DEV_CAPABILITY_TOKEN = "cap-x402-dev-mock-1";
+function fundingBase(intentId) {
+    return {
+        settlement_rail: "x402_usdc_base",
+        harbor_fund_endpoint: `/harbor/intents/${intentId}/fund`,
+        payment_session_id: `paymentSession_${intentId}`,
+        payment_url: `https://pay.coinbase.com/payment-sessions/paymentSession_${intentId}`,
+        asset: "usdc",
+        network: "base",
+        capture_expires_at: "2027-12-31T23:59:59Z",
+        refund_expires_at: "2028-01-31T23:59:59Z",
+    };
+}
+function intentShell(intentId, tenantId, extra) {
+    return {
+        intent_id: intentId,
+        tenant: tenantId,
+        settlement_rail: "x402_usdc_base",
+        currency: "usd",
+        amount_cents: 2000,
+        ...extra,
+    };
+}
+/** Build the 402 payment challenge response body. */
+export function buildX402FundChallengeBody(intentId, tenantId) {
+    return intentShell(intentId, tenantId, {
+        state: "open",
+        funded: false,
+        funding: {
+            ...fundingBase(intentId),
+            status: "created",
+        },
+    });
+}
+/** Build the 202 authorization_pending response body. */
+export function buildX402FundPendingBody(intentId, tenantId) {
+    return intentShell(intentId, tenantId, {
+        state: "open",
+        funded: false,
+        funding: {
+            ...fundingBase(intentId),
+            status: "authorization_pending",
+            authorization_id: `auth_${intentId}`,
+            source_address: "0xsource0000000000000000000000000000000001",
+        },
+    });
+}
+/** Build the 200 funded response body with capability token. */
+export function buildX402FundSuccessBody(intentId, tenantId, capabilityToken = X402_DEV_CAPABILITY_TOKEN) {
+    return intentShell(intentId, tenantId, {
+        state: "funded",
+        funded: true,
+        capability_token: capabilityToken,
+        funding: {
+            ...fundingBase(intentId),
+            status: "authorization_succeeded",
+            authorization_id: `auth_${intentId}`,
+            source_address: "0xsource0000000000000000000000000000000001",
+        },
+    });
+}
+/** In-memory x402 fund sequence keyed by intent id (one sequence per intent). */
+export class X402FundStateMachine {
+    phases = new Map();
+    reset(intentId) {
+        if (intentId === undefined) {
+            this.phases.clear();
+            return;
+        }
+        this.phases.delete(intentId);
+    }
+    /** Advance the mock fund sequence for ``intentId`` and return the next Harbor-shaped response. */
+    next(intentId, tenantId, paymentSignature) {
+        const trimmedIntent = intentId.trim();
+        if (!trimmedIntent) {
+            return null;
+        }
+        const phase = this.phases.get(trimmedIntent) ?? "challenge";
+        const hasSignature = Boolean(paymentSignature?.trim());
+        if (phase === "challenge" && !hasSignature) {
+            this.phases.set(trimmedIntent, "pending");
+            return {
+                status: 402,
+                headers: {
+                    "content-type": "application/json",
+                    "payment-required": X402_DEV_PAYMENT_REQUIRED,
+                },
+                body: buildX402FundChallengeBody(trimmedIntent, tenantId),
+                phase: "challenge",
+            };
+        }
+        if (phase === "pending" && hasSignature) {
+            this.phases.set(trimmedIntent, "funded");
+            return {
+                status: 202,
+                headers: {
+                    "content-type": "application/json",
+                    "payment-response": "simulated-x402-payment-response",
+                },
+                body: buildX402FundPendingBody(trimmedIntent, tenantId),
+                phase: "pending",
+            };
+        }
+        if (phase === "funded" && hasSignature) {
+            return {
+                status: 200,
+                headers: {
+                    "content-type": "application/json",
+                    "payment-response": "simulated-x402-payment-response",
+                },
+                body: buildX402FundSuccessBody(trimmedIntent, tenantId),
+                phase: "funded",
+            };
+        }
+        return null;
+    }
+}