@paybond/kit 0.11.11 → 0.12.0

package/dist/mpp-funding.js

@@ -0,0 +1,192 @@
+import { buildX402FundRequestEnvelope, } from "./x402-funding.js";
+const DEFAULT_MAX_ATTEMPTS = 30;
+const DEFAULT_INTERVAL_MS = 2_000;
+const TERMINAL_MPP_FUNDING_STATUSES = new Set([
+    "authorization_failed",
+    "capture_failed",
+    "void_failed",
+    "credential_rejected",
+    "payment_failed",
+    "charge_failed",
+    "session_open_failed",
+]);
+const MPP_CHARGE_EXPECTED = { intent: "charge", method: "stripe" };
+const MPP_SESSION_EXPECTED = { intent: "session", method: "tempo" };
+/** Raised when MPP funding cannot complete (missing challenge, terminal rail status, unexpected HTTP). */
+export class PaybondMppFundingFailedError extends Error {
+    intentId;
+    lastResult;
+    constructor(message, init) {
+        super(message, { cause: init.cause });
+        this.name = "PaybondMppFundingFailedError";
+        this.intentId = init.intentId;
+        this.lastResult = init.lastResult;
+    }
+}
+/** Raised when polling exhausts `maxAttempts` before Harbor returns a funded capability token. */
+export class PaybondMppFundingPendingError extends Error {
+    intentId;
+    lastResult;
+    attempts;
+    constructor(message, init) {
+        super(message);
+        this.name = "PaybondMppFundingPendingError";
+        this.intentId = init.intentId;
+        this.lastResult = init.lastResult;
+        this.attempts = init.attempts;
+    }
+}
+/**
+ * Parses a `WWW-Authenticate: Payment …` challenge into structured parameters.
+ *
+ * @throws Error when the value is empty or does not start with the Payment scheme.
+ */
+export function parsePaymentAuthChallenge(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        throw new Error("Payment Auth challenge must be non-empty");
+    }
+    if (!/^payment\b/i.test(trimmed)) {
+        throw new Error("expected Payment Auth challenge");
+    }
+    const params = {};
+    const afterScheme = trimmed.replace(/^payment\s+/i, "");
+    const paramRe = /([a-zA-Z_][\w-]*)=(?:"([^"]*)"|([^,\s]+))/g;
+    let match;
+    while ((match = paramRe.exec(afterScheme)) !== null) {
+        params[match[1].toLowerCase()] = match[2] ?? match[3] ?? "";
+    }
+    return {
+        raw: trimmed,
+        id: params.id,
+        realm: params.realm,
+        method: params.method,
+        intent: params.intent,
+        request: params.request,
+    };
+}
+function selectMppPaymentChallenge(wwwAuthenticate, expected) {
+    if (!wwwAuthenticate?.length) {
+        throw new Error("MPP fund challenge missing WWW-Authenticate Payment header");
+    }
+    for (const header of wwwAuthenticate) {
+        const parsed = parsePaymentAuthChallenge(header);
+        if (parsed.intent === expected.intent && parsed.method === expected.method) {
+            return parsed.raw;
+        }
+    }
+    if (wwwAuthenticate.length === 1) {
+        const parsed = parsePaymentAuthChallenge(wwwAuthenticate[0]);
+        if (parsed.intent !== expected.intent || parsed.method !== expected.method) {
+            throw new Error(`MPP fund challenge intent/method mismatch: expected intent=${expected.intent} method=${expected.method}, got intent=${parsed.intent ?? "unknown"} method=${parsed.method ?? "unknown"}`);
+        }
+        return parsed.raw;
+    }
+    throw new Error(`MPP fund challenge missing Payment Auth header for intent=${expected.intent} method=${expected.method}`);
+}
+/** Selects the Stripe MPP charge challenge from `WWW-Authenticate` values. */
+export function selectMppChargeChallenge(wwwAuthenticate) {
+    return selectMppPaymentChallenge(wwwAuthenticate, MPP_CHARGE_EXPECTED);
+}
+/** Selects the Tempo MPP session challenge from `WWW-Authenticate` values. */
+export function selectMppSessionChallenge(wwwAuthenticate) {
+    return selectMppPaymentChallenge(wwwAuthenticate, MPP_SESSION_EXPECTED);
+}
+/** Canonical `/fund` request envelope for Gateway `POST /harbor/intents/{intentId}/fund`. */
+export function buildMppFundRequestEnvelope(intentId) {
+    return buildX402FundRequestEnvelope(intentId);
+}
+function isFundingComplete(result) {
+    if (result.capabilityToken?.trim()) {
+        return true;
+    }
+    return result.statusCode === 200 && result.funded;
+}
+function isTerminalFundingFailure(result) {
+    const status = result.funding?.status?.trim();
+    return status !== undefined && TERMINAL_MPP_FUNDING_STATUSES.has(status);
+}
+function failureMessage(result) {
+    const status = result.funding?.status ?? result.state;
+    return `MPP funding failed for intent ${result.intentId} (status=${status})`;
+}
+async function sleep(ms) {
+    await new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Orchestrate MPP `/fund`: handle 402 Payment Auth challenges, retry with credentials, poll until funded.
+ *
+ * Wallet and SPT secrets stay app-owned — pass injectable `createPaymentCredential` and
+ * `issueRecognitionProof` callbacks; Paybond never stores MPP signing material.
+ */
+export async function executeFundWithMpp(params) {
+    const intentId = params.intentId.trim();
+    if (!intentId) {
+        throw new Error("fundWithMpp: intentId is required");
+    }
+    const maxAttempts = Math.max(1, params.pollOptions?.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
+    const intervalMs = Math.max(0, params.pollOptions?.intervalMs ?? DEFAULT_INTERVAL_MS);
+    const envelope = buildMppFundRequestEnvelope(intentId);
+    let paymentAuthorization;
+    let result = await params.fund({ recognitionProof: params.recognitionProof });
+    if (result.statusCode === 402) {
+        const challenge = params.selectChallenge(result.wwwAuthenticate);
+        paymentAuthorization = (await params.createPaymentCredential(challenge)).trim();
+        if (!paymentAuthorization) {
+            throw new PaybondMppFundingFailedError("MPP createPaymentCredential returned an empty credential", {
+                intentId,
+                lastResult: result,
+            });
+        }
+        const retryProof = await params.issueRecognitionProof(envelope);
+        result = await params.fund({
+            recognitionProof: retryProof,
+            paymentAuthorization,
+        });
+    }
+    if (isTerminalFundingFailure(result)) {
+        throw new PaybondMppFundingFailedError(failureMessage(result), { intentId, lastResult: result });
+    }
+    if (isFundingComplete(result)) {
+        return result;
+    }
+    let attempts = 0;
+    while (result.statusCode === 202 || (!isFundingComplete(result) && result.statusCode === 200)) {
+        attempts += 1;
+        if (attempts > maxAttempts) {
+            throw new PaybondMppFundingPendingError(`MPP funding still pending after ${maxAttempts} poll attempt(s) for intent ${intentId}`, { intentId, lastResult: result, attempts: maxAttempts });
+        }
+        if (intervalMs > 0) {
+            await sleep(intervalMs);
+        }
+        const pollProof = await params.issueRecognitionProof(envelope);
+        result = await params.fund({
+            recognitionProof: pollProof,
+            ...(paymentAuthorization ? { paymentAuthorization } : {}),
+        });
+        if (isTerminalFundingFailure(result)) {
+            throw new PaybondMppFundingFailedError(failureMessage(result), { intentId, lastResult: result });
+        }
+        if (isFundingComplete(result)) {
+            return result;
+        }
+    }
+    if (isFundingComplete(result)) {
+        return result;
+    }
+    throw new PaybondMppFundingFailedError(`unexpected MPP fund response HTTP ${result.statusCode} for intent ${intentId}`, { intentId, lastResult: result });
+}
+/** One-shot Stripe MPP charge funding through Payment Auth semantics. */
+export async function executeFundWithMppCharge(params) {
+    return executeFundWithMpp({
+        ...params,
+        selectChallenge: selectMppChargeChallenge,
+    });
+}
+/** Tempo MPP session funding through Payment Auth semantics. */
+export async function executeFundWithMppSession(params) {
+    return executeFundWithMpp({
+        ...params,
+        selectChallenge: selectMppSessionChallenge,
+    });
+}

package/dist/payment-transport.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Payment Auth transport headers for MPP funding through the Paybond Gateway.
+ *
+ * Kit callers send `x-paybond-payment-authorization: Payment <credential>` so
+ * `Authorization: Bearer` remains available for Paybond tenant authentication.
+ * The gateway translates this to `Authorization: Payment` when forwarding to Harbor.
+ */
+/** Gateway-facing Payment Auth credential header (avoids clashing with Bearer auth). */
+export declare const PAYBOND_PAYMENT_AUTHORIZATION_HEADER = "x-paybond-payment-authorization";
+/** Payment Auth response headers propagated by the gateway from Harbor. */
+export declare const PAYMENT_TRANSPORT_RESPONSE_HEADERS: readonly ["www-authenticate", "payment-receipt", "cache-control"];
+/**
+ * Normalizes a Payment Auth credential for HTTP headers.
+ *
+ * Accepts either a raw credential token or a value already prefixed with `Payment `.
+ */
+export declare function formatPaymentAuthorizationValue(credential: string): string;
+/** Header entry for gateway Harbor fund/verify retries. */
+export declare function paymentAuthorizationGatewayHeader(credential: string): Record<string, string>;
+/**
+ * Appends `Authorization: Payment …` for direct Harbor calls that already carry Bearer auth.
+ */
+export declare function appendDirectHarborPaymentAuthorization(headers: Headers, credential: string): void;
+export type FundPaymentTransportHeaders = {
+    wwwAuthenticate?: string[];
+    paymentReceipt?: string;
+    cacheControl?: string;
+};
+/** Reads Payment Auth transport headers from a fund response. */
+export declare function readFundPaymentTransportHeaders(headers: Headers): FundPaymentTransportHeaders;

package/dist/payment-transport.js

@@ -0,0 +1,56 @@
+/**
+ * Payment Auth transport headers for MPP funding through the Paybond Gateway.
+ *
+ * Kit callers send `x-paybond-payment-authorization: Payment <credential>` so
+ * `Authorization: Bearer` remains available for Paybond tenant authentication.
+ * The gateway translates this to `Authorization: Payment` when forwarding to Harbor.
+ */
+/** Gateway-facing Payment Auth credential header (avoids clashing with Bearer auth). */
+export const PAYBOND_PAYMENT_AUTHORIZATION_HEADER = "x-paybond-payment-authorization";
+/** Payment Auth response headers propagated by the gateway from Harbor. */
+export const PAYMENT_TRANSPORT_RESPONSE_HEADERS = [
+    "www-authenticate",
+    "payment-receipt",
+    "cache-control",
+];
+/**
+ * Normalizes a Payment Auth credential for HTTP headers.
+ *
+ * Accepts either a raw credential token or a value already prefixed with `Payment `.
+ */
+export function formatPaymentAuthorizationValue(credential) {
+    const trimmed = credential.trim();
+    if (!trimmed) {
+        throw new Error("payment authorization credential must be non-empty");
+    }
+    if (/^payment\s+/i.test(trimmed)) {
+        return trimmed;
+    }
+    return `Payment ${trimmed}`;
+}
+/** Header entry for gateway Harbor fund/verify retries. */
+export function paymentAuthorizationGatewayHeader(credential) {
+    return {
+        [PAYBOND_PAYMENT_AUTHORIZATION_HEADER]: formatPaymentAuthorizationValue(credential),
+    };
+}
+/**
+ * Appends `Authorization: Payment …` for direct Harbor calls that already carry Bearer auth.
+ */
+export function appendDirectHarborPaymentAuthorization(headers, credential) {
+    headers.append("authorization", formatPaymentAuthorizationValue(credential));
+}
+/** Reads Payment Auth transport headers from a fund response. */
+export function readFundPaymentTransportHeaders(headers) {
+    const wwwAuthenticate = [];
+    headers.forEach((value, key) => {
+        if (key.toLowerCase() === "www-authenticate") {
+            wwwAuthenticate.push(value);
+        }
+    });
+    return {
+        wwwAuthenticate: wwwAuthenticate.length > 0 ? wwwAuthenticate : undefined,
+        paymentReceipt: headers.get("payment-receipt") ?? undefined,
+        cacheControl: headers.get("cache-control") ?? undefined,
+    };
+}

package/dist/policy/intent-spec.js

@@ -1,5 +1,6 @@
 import { PaybondToolRegistryValidationError } from "../agent/types.js";
 import { resolveCompletionPreset, contractSnapshotForPreset } from "../completion-resolve.js";
+import { validateUsdDenominatedSettlement } from "../mpp-commercial.js";
 import { policyToToolRegistry } from "./registry.js";
 /** Raised when policy intent fields cannot be aligned to a Harbor create payload. */
 export class PaybondPolicyIntentSpecError extends Error {
@@ -142,6 +143,7 @@ export function policyToIntentCreateInput(document, overrides) {
     const allowedTools = resolveAllowedHarborOperations(document, registry, overrides.allowedTools);
     const policyBinding = resolvePolicyBindingRef(document, overrides.publishedPolicyHead, overrides.policyBinding);
     const { budget, currency, amountCents } = resolveBudgetFields(document, overrides);
+    validateUsdDenominatedSettlement(overrides.settlementRail, currency);
     const completionPresetId = overrides.completionPresetId ??
         resolveEvidencePresetForOperations(registry, allowedTools);
     const resolvedPreset = resolveCompletionPreset(completionPresetId);

package/dist/principal-intent.d.ts

@@ -3,7 +3,7 @@
  * Matches `crates/harbor-intent-escrow/src/signing.rs` (`intent_creation_sign_bytes_raw`).
  */
 /** Tenant-configured settlement rail names. Clients may request a rail, not a destination. */
-export type SettlementRail = "stripe_connect" | "stripe_ach_debit" | "x402_usdc_base";
+export type SettlementRail = "stripe_connect" | "stripe_ach_debit" | "stripe_mpp" | "x402_usdc_base";
 export type CompletionContractSnapshot = {
     completionPresetId: string;
     vendorContractProvider?: string;

package/dist/principal-intent.js

@@ -6,7 +6,8 @@ import { sign, getPublicKey } from "@noble/ed25519";
 import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
 import { COMPLETION_CONTRACT_SIGN_VERSION, concatBytes, encodeBincodeString, encodeBincodeUuid, encodeFixed32, encodeU8, encodeVarintI64, encodeVarintU32, } from "./bincode-wire.js";
-const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "stripe_ach_debit", "x402_usdc_base"]);
+import { validateUsdDenominatedSettlement } from "./mpp-commercial.js";
+const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "stripe_ach_debit", "stripe_mpp", "x402_usdc_base"]);
 function validateSettlementRail(value) {
     if (!SETTLEMENT_RAIL_VALUES.has(value)) {
         throw new Error(`settlementRail must be one of ${[...SETTLEMENT_RAIL_VALUES].join(", ")}`);
@@ -171,6 +172,7 @@ export function buildSignedCreateIntentBodyWithPolicyBinding(params) {
         throw new Error("allowedTools must be non-empty");
     }
     const settlementRail = validateSettlementRail(params.settlementRail);
+    validateUsdDenominatedSettlement(settlementRail, params.currency);
     const predicateRef = params.predicateRef ?? "";
     const head = params.publishedPolicyHead;
     if (head.templateId !== params.policyBinding.templateId || head.versionSeq !== params.policyBinding.versionSeq) {
@@ -248,6 +250,7 @@ export function buildSignedCreateIntentBody(params) {
         throw new Error("allowedTools must be non-empty");
     }
     const settlementRail = validateSettlementRail(params.settlementRail);
+    validateUsdDenominatedSettlement(settlementRail, params.currency);
     const predicateRef = params.predicateRef ?? "";
     ensureEd25519Sha512Sync();
     const payeePub = getPublicKey(params.payeeSigningSeed);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.11",
+  "version": "0.12.0",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",

package/templates/openai-shopping-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "openai-shopping-agent",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -806,9 +806,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/templates/paybond-aws-operator/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-aws-operator",
       "dependencies": {
-        "@paybond/kit": "^0.11.11"
+        "@paybond/kit": "^0.12.0"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-claude-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-claude-agents-demo",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -260,9 +260,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -854,9 +854,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

package/templates/paybond-mastra-travel-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-mastra-travel-agent",
       "dependencies": {
         "@mastra/core": "^1.49.0",
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -278,9 +278,9 @@
       }
     },
     "node_modules/@mastra/core": {
-      "version": "1.49.0",
-      "resolved": "https://registry.npmjs.org/@mastra/core/-/core-1.49.0.tgz",
-      "integrity": "sha512-ZZGiPY317qIMv4qpSdxpOdEz9IbBiFJEexDBN0ALV7vK5yAAbT7AlN40SZEObc8bVxpjnI8jZTcEZQZGsQ8PmQ==",
+      "version": "1.50.0",
+      "resolved": "https://registry.npmjs.org/@mastra/core/-/core-1.50.0.tgz",
+      "integrity": "sha512-gccYBkLk7jjXl13YnjvPVgnvWcedNTzHdqku5xd3pAt/zsxAbnXrNlBRn3vjcdb8DKVC6U6HXMogpM65/kqjMA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@a2a-js/sdk": "~0.3.13",
@@ -412,9 +412,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -1390,9 +1390,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"

package/templates/paybond-mcp-coding-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-mcp-coding-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.11"
+        "@paybond/kit": "^0.12.0"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-openai-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-openai-agents-demo",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -806,9 +806,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.27",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.27.tgz",
-      "integrity": "sha512-1yrb/+w6HWQJrUCLkJ2IF5jNIPvvFkblV5RNOYl6bV+OA6p9GLcMpHFFGTosSvHvcAUibuUukRqhlYI4z32C7Q==",
+      "version": "4.12.28",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.28.tgz",
+      "integrity": "sha512-YwUvVpSF7m1yOblFPrU3Hbo8XhPheBoiyfGuII6z19LnOr6JpDnyyp7LFNrfV56wS8tpvtBFGRISHN02pDdLOA==",
       "license": "MIT",
       "optional": true,
       "engines": {

package/templates/paybond-procurement-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-procurement-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.11"
+        "@paybond/kit": "^0.12.0"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-travel-agent/package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -178,9 +178,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -358,9 +358,9 @@
       "license": "MIT"
     },
     "node_modules/langsmith": {
-      "version": "0.7.15",
-      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.7.15.tgz",
-      "integrity": "sha512-huRfzLKcREE+ABkqKEriXK8Ax9V+xuV3d3x4PINEGi+hi4qyTvB4Nc2dpLSyfW/Ioj6+6d7T8majjWCe7mXc8A==",
+      "version": "0.7.16",
+      "resolved": "https://registry.npmjs.org/langsmith/-/langsmith-0.7.16.tgz",
+      "integrity": "sha512-Cn4PL7ujYQwxAOotesBhOuF2xsEIcW6mwKW41SXhu3WyjmU0R+ywCdbHYMSYh6QCaLg9pTluJMw2+L5ApyrZHg==",
       "license": "MIT",
       "dependencies": {
         "p-queue": "6.6.2"

package/templates/paybond-vercel-shopping-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-vercel-shopping-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.11",
+        "@paybond/kit": "^0.12.0",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -104,9 +104,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.11",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.11.tgz",
-      "integrity": "sha512-WHqh6PKUYPRvFV0ID3QixMJGRwmgNoq13mueHqJnGrj8erEt3FwQo49Z0IXovTWAJcsW+3+v8SkKp4/UAz93fg==",
+      "version": "0.12.0",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.0.tgz",
+      "integrity": "sha512-iAluOkqE8aINum1GF/LkR6Oi04xH9cNCZDJRF5BBFUQMqcNUpN1g/zNQK78jIGVlwcssexnLmiet31Z0NJ5jbg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",