@paybond/kit 0.11.11 → 0.12.1

package/completion-presets/catalog.json

@@ -950,7 +950,8 @@
       },
       "scope": "tool_completion",
       "rail_hints": [
-        "x402_usdc_base"
+        "x402_usdc_base",
+        "stripe_mpp"
       ],
       "forbidden_evidence_fields": [
         "payment_session_id",
@@ -1063,7 +1064,8 @@
       },
       "scope": "tool_completion",
       "rail_hints": [
-        "x402_usdc_base"
+        "x402_usdc_base",
+        "stripe_mpp"
       ],
       "forbidden_evidence_fields": [
         "payment_session_id",
@@ -1158,7 +1160,8 @@
       },
       "scope": "tool_completion",
       "rail_hints": [
-        "x402_usdc_base"
+        "x402_usdc_base",
+        "stripe_mpp"
       ],
       "forbidden_evidence_fields": [
         "payment_session_id",
@@ -1269,7 +1272,8 @@
       },
       "scope": "tool_completion",
       "rail_hints": [
-        "x402_usdc_base"
+        "x402_usdc_base",
+        "stripe_mpp"
       ],
       "forbidden_evidence_fields": [
         "payment_session_id",
@@ -1390,7 +1394,8 @@
       },
       "scope": "tool_completion",
       "rail_hints": [
-        "x402_usdc_base"
+        "x402_usdc_base",
+        "stripe_mpp"
       ],
       "forbidden_evidence_fields": [
         "payment_session_id",

package/completion-presets/catalog.sha256

@@ -1 +1 @@
-df9c8e9ad04e10b682dd7877460528896216d832486e88af6c9039bad402b264
+a738febc9ee8b5b66f05991c4582ba24e6857cdc574196b0aeefc5c77e192ea9

package/dist/agent/evidence.d.ts

@@ -3,7 +3,17 @@ export type BuiltAutoEvidence = {
     payload: Record<string, unknown>;
     vendorPayload?: Record<string, unknown>;
 };
+/**
+ * Reject Stripe funding webhook envelopes before they become completion evidence.
+ *
+ * Funding webhooks (`payment_intent.succeeded`, `charge.*`, event envelopes) fund Harbor
+ * intents; tool-completion evidence must use SDK charge/result shapes (or mapped
+ * {@link mapStripeToolResultToEvidence} outputs), not webhook bodies.
+ */
+export declare function assertToolResultNotFundingWebhook(toolResult: unknown): void;
 /**
  * Build canonical evidence payloads from a tool result using the completion catalog.
+ *
+ * Fail-closed: Stripe funding webhook-shaped tool results are rejected before mapping.
  */
 export declare function buildAutoEvidencePayload(entry: Pick<PaybondSideEffectingToolEntry, "evidencePreset" | "evidenceMapper">, toolResult: unknown, ctx: PaybondToolCallContext): Record<string, unknown>;

package/dist/agent/evidence.js

@@ -1,15 +1,31 @@
 import { getCompletionPreset, } from "../completion-catalog.js";
 import { isVendorPack, mapVendorEvidenceToCanonical, resolveCompletionPreset, } from "../completion-resolve.js";
+import { assertNotStripeFundingWebhook } from "../stripe-commerce/evidence.js";
 function assertEvidenceRecord(value, message) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         throw new Error(message);
     }
     return value;
 }
+/**
+ * Reject Stripe funding webhook envelopes before they become completion evidence.
+ *
+ * Funding webhooks (`payment_intent.succeeded`, `charge.*`, event envelopes) fund Harbor
+ * intents; tool-completion evidence must use SDK charge/result shapes (or mapped
+ * {@link mapStripeToolResultToEvidence} outputs), not webhook bodies.
+ */
+export function assertToolResultNotFundingWebhook(toolResult) {
+    if (typeof toolResult === "object" && toolResult !== null && !Array.isArray(toolResult)) {
+        assertNotStripeFundingWebhook(toolResult);
+    }
+}
 /**
  * Build canonical evidence payloads from a tool result using the completion catalog.
+ *
+ * Fail-closed: Stripe funding webhook-shaped tool results are rejected before mapping.
  */
 export function buildAutoEvidencePayload(entry, toolResult, ctx) {
+    assertToolResultNotFundingWebhook(toolResult);
     if (entry.evidenceMapper) {
         return assertEvidenceRecord(entry.evidenceMapper(toolResult, ctx), "evidenceMapper must return a JSON object payload");
     }

package/dist/agent/index.d.ts

@@ -1,3 +1,4 @@
+export { PaybondAgentFacade, createPaybondAgentCallable, type GetAgentReceiptInput, type PaybondAgentCallable, } from "./receipt-client.js";
 export { createGuardedAgent, createGuardedAgentRunner, type CreateGuardedAgentInput, type CreateGuardedAgentResult, type CreateGuardedAgentResultBase, type GuardedAgentFramework, } from "./guarded-agent.js";
 export { createPaybondAgent, resolveAgentPolicySource, toPaybondAgentResult, wrapPaybondTools, type PaybondAgentHooks, type PaybondAgentInput, type PaybondAgentResult, type PaybondInstrumentInput, type PaybondWrapToolsOptions, } from "./facade.js";
 export { PaybondInstrumentBuilder, PaybondInstrumented, PaybondInstrumentRuntime, PaybondLazyContextError, PaybondUnboundContextError, discoverPolicyFromAgent, discoverToolNames, discoverToolsFromAgent, inlinePolicyToDocument, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, isInlinePolicy, isInstrumentableAgentObject, readPaybondAgentInstrumentation, type PaybondAgentInstrumentation, type PaybondInlinePolicy, type PaybondInstrumentAgentOptions, type PaybondInstrumentAttachInput, type PaybondInstrumentBinding, type PaybondInstrumentContext, type PaybondInstrumentContextInput, type PaybondInstrumentContextProvider, } from "./instrument.js";
@@ -5,9 +6,9 @@ export { formatPaybondAttachEnvSnippet, openPaybondAttachBundle, PAYBOND_ATTACH_
 export { createPaybondGenericAgentConfig, createPaybondGenericInputGuard, type PaybondGenericAgentConfig, } from "./generic-runner.js";
 export { runGenericSandboxDemo, type RunGenericSandboxDemoInput, type RunGenericSandboxDemoResult, } from "./generic-sandbox-demo.js";
 export { PaybondFrameworkAdapter, createGenericToolExecutor, createToolInputGuardAdapter, paybondGenericToolExecutorAdapter, paybondToolInputGuardAdapter, type PaybondGenericToolCall, type PaybondGenericToolDefinition, type PaybondGenericWrappedToolDefinition, type PaybondToolInputGuardAdapter, } from "./adapter.js";
-export { buildAutoEvidencePayload, type BuiltAutoEvidence } from "./evidence.js";
+export { assertToolResultNotFundingWebhook, buildAutoEvidencePayload, type BuiltAutoEvidence, } from "./evidence.js";
 export { PaybondToolInterceptor } from "./interceptor.js";
 export { PaybondToolRegistry, createPaybondToolRegistry, } from "./registry.js";
 export { PaybondAgentRun, PaybondAgentRunFacade, type PaybondAgentRunHost, } from "./run.js";
 export { agentRegistryDocumentToConfig, buildSmokeRegistry, loadAgentRegistryFile, parseAgentRegistryText, validateAgentRegistryDocument, type AgentRegistryFileDocument, type AgentRegistryValidationResult, } from "./registry-file.js";
-export { PaybondAgentRunBindError, PaybondAutoEvidenceError, PaybondAutoEvidenceSubmitError, PaybondEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, type PaybondAgentRunBindInput, type PaybondAuthorizeToolCallInput, type PaybondEvidenceMapper, type PaybondInterceptEvidenceResult, type PaybondInterceptWrapExecuteInput, type PaybondInterceptWrapExecuteResult, type PaybondRunBinding, type PaybondRunBindingAttachInput, type PaybondRunBindingSandboxBootstrapInput, type PaybondRunProductionEvidenceCredentials, type PaybondRunGuard, type PaybondSideEffectingToolEntry, type PaybondSideEffectingToolPolicy, type PaybondSpendResolver, type PaybondToolCallContext, type PaybondToolInputGuardAllowDecision, type PaybondToolInputGuardApprovalRequiredDecision, type PaybondToolInputGuardDecision, type PaybondToolInputGuardDenyDecision, type PaybondToolRegistryConfig, type PaybondToolResolution, type PaybondTraceEvent, type PaybondTraceSink, } from "./types.js";
+export { PaybondAgentRunBindError, PaybondAutoEvidenceError, PaybondAutoEvidenceSubmitError, PaybondEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, type PaybondAgentRunBindInput, type PaybondAuthorizeToolCallInput, type PaybondEvidenceMapper, type PaybondExternalAttestationMapper, type PaybondInterceptEvidenceResult, type PaybondInterceptWrapExecuteInput, type PaybondInterceptWrapExecuteResult, type PaybondRunBinding, type PaybondRunBindingAttachInput, type PaybondRunBindingSandboxBootstrapInput, type PaybondRunProductionEvidenceCredentials, type PaybondRunGuard, type PaybondSideEffectingToolEntry, type PaybondSideEffectingToolPolicy, type PaybondSpendResolver, type PaybondToolCallContext, type PaybondToolInputGuardAllowDecision, type PaybondToolInputGuardApprovalRequiredDecision, type PaybondToolInputGuardDecision, type PaybondToolInputGuardDenyDecision, type PaybondToolRegistryConfig, type PaybondToolResolution, type PaybondTraceEvent, type PaybondTraceSink, } from "./types.js";

package/dist/agent/index.js

@@ -1,3 +1,4 @@
+export { PaybondAgentFacade, createPaybondAgentCallable, } from "./receipt-client.js";
 export { createGuardedAgent, createGuardedAgentRunner, } from "./guarded-agent.js";
 export { createPaybondAgent, resolveAgentPolicySource, toPaybondAgentResult, wrapPaybondTools, } from "./facade.js";
 export { PaybondInstrumentBuilder, PaybondInstrumented, PaybondInstrumentRuntime, PaybondLazyContextError, PaybondUnboundContextError, discoverPolicyFromAgent, discoverToolNames, discoverToolsFromAgent, inlinePolicyToDocument, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, isInlinePolicy, isInstrumentableAgentObject, readPaybondAgentInstrumentation, } from "./instrument.js";
@@ -5,7 +6,7 @@ export { formatPaybondAttachEnvSnippet, openPaybondAttachBundle, PAYBOND_ATTACH_
 export { createPaybondGenericAgentConfig, createPaybondGenericInputGuard, } from "./generic-runner.js";
 export { runGenericSandboxDemo, } from "./generic-sandbox-demo.js";
 export { createGenericToolExecutor, createToolInputGuardAdapter, paybondGenericToolExecutorAdapter, paybondToolInputGuardAdapter, } from "./adapter.js";
-export { buildAutoEvidencePayload } from "./evidence.js";
+export { assertToolResultNotFundingWebhook, buildAutoEvidencePayload, } from "./evidence.js";
 export { PaybondToolInterceptor } from "./interceptor.js";
 export { PaybondToolRegistry, createPaybondToolRegistry, } from "./registry.js";
 export { PaybondAgentRun, PaybondAgentRunFacade, } from "./run.js";

package/dist/agent/interceptor.d.ts

@@ -21,4 +21,13 @@ export declare class PaybondToolInterceptor {
     wrapExecute<TResult>(input: PaybondInterceptWrapExecuteInput<TResult>): Promise<PaybondInterceptWrapExecuteResult<TResult>>;
     private resolveSideEffectingCall;
     private submitAutoEvidence;
+    /**
+     * Composes an unsigned Agent Receipt Standard draft (Phase 1) after a successful
+     * authorize → execute → evidence cycle. Never signed or persisted here; Phase 2 covers
+     * compose/sign/persist. Best-effort: returns `undefined` instead of throwing whenever
+     * required receipt fields (agent context, principal/operator DID, policy template, pinned
+     * policy digest, or a Harbor decision id) are unavailable on this binding or call.
+     */
+    private buildReceiptDraft;
+    private resolveToolExternalAttestations;
 }

package/dist/agent/interceptor.js

@@ -2,6 +2,8 @@ import { evictExpiredAuthorizationCache, takeValidCachedAuthorization, } from ".
 import { buildAutoEvidencePayload } from "./evidence.js";
 import { signHarborEvidenceSubmitRecognitionProof } from "../agent-recognition.js";
 import { signPayeeEvidenceBinding } from "../payee-evidence.js";
+import { AGENT_RECEIPT_KIND_V1, AGENT_RECEIPT_SCHEMA_VERSION, AGENT_RECEIPT_SCOPE_ACTION, AGENT_RECEIPT_SIGNING_ALGORITHM_ED25519, AGENT_RECEIPT_VERSION_V1, actionReceiptId, agentReceiptMessageDigestSha256Hex, valueDigestSha256Hex, } from "../agent-receipt.js";
+import { resolveExternalAttestations, } from "../agent-receipt-external-attestations.js";
 import { PaybondAutoEvidenceSubmitError, PaybondUnregisteredSideEffectingToolError, } from "./types.js";
 export { PaybondAutoEvidenceSubmitError, PaybondEvidenceSubmitError } from "./types.js";
 function nowRfc3339Seconds() {
@@ -27,6 +29,8 @@ function mapSandboxEvidenceResult(result) {
         intentId: result.intent_id,
         predicatePassed: result.predicate_passed ?? undefined,
         sandboxLifecycleStatus: result.sandbox_lifecycle_status,
+        payloadDigestSha256Hex: result.payload_digest?.trim().toLowerCase() || undefined,
+        artifactsDigestSha256Hex: result.artifacts_digest?.trim().toLowerCase() || undefined,
     };
 }
 function isSpendApprovalRequiredError(err) {
@@ -227,11 +231,14 @@ export class PaybondToolInterceptor {
             });
             const evidencePolicyDigest = cached?.policyDigest ?? pinnedDigest;
             let auth;
+            let authorizedAtMs;
             if (cached) {
                 auth = cached.auth;
+                authorizedAtMs = cached.cachedAtMs;
             }
             else {
                 auth = await this.binding.guard.assertSpendAuthorized(resolved.authInput);
+                authorizedAtMs = Date.now();
                 this.emitTrace({
                     type: "spend_authorized",
                     runId: this.binding.runId,
@@ -266,6 +273,12 @@ export class PaybondToolInterceptor {
                     });
                 }
                 const evidenceId = evidenceIdempotencyKey(this.binding.intentId, toolCallId);
+                const externalAttestations = this.resolveToolExternalAttestations(resolved.entry, toolResult, {
+                    toolName,
+                    toolCallId,
+                    operation: resolved.operation,
+                    arguments: input.arguments,
+                });
                 const evidence = await this.submitAutoEvidence({
                     entry: resolved.entry,
                     toolName,
@@ -276,6 +289,7 @@ export class PaybondToolInterceptor {
                     toolResult,
                     auth,
                     evidenceId,
+                    externalAttestations,
                 });
                 this.emitTrace({
                     type: "evidence_submitted",
@@ -287,8 +301,27 @@ export class PaybondToolInterceptor {
                     evidencePreset: resolved.entry.evidencePreset,
                     sandboxLifecycleStatus: evidence.sandboxLifecycleStatus,
                     predicatePassed: evidence.predicatePassed,
+                    externalAttestations,
                     recordedAt: traceTimestamp(),
                 });
+                const receiptDraft = this.buildReceiptDraft({
+                    toolName: resolved.toolName,
+                    toolCallId: resolved.toolCallId,
+                    operation: resolved.operation,
+                    arguments: input.arguments,
+                    agentSubject: resolved.authInput.agentSubject,
+                    requestedSpendCents: resolved.requestedSpendCents,
+                    currency: resolved.authInput.currency,
+                    vendorId: resolved.authInput.vendorId,
+                    entry: resolved.entry,
+                    auth,
+                    authorizedAtMs,
+                    policyDigest: evidencePolicyDigest,
+                    executeStartedAt,
+                    toolResult,
+                    evidence,
+                    externalAttestations,
+                });
                 return {
                     toolResult,
                     authorization: {
@@ -298,6 +331,7 @@ export class PaybondToolInterceptor {
                         policyDigest: evidencePolicyDigest,
                     },
                     evidence,
+                    receiptDraft,
                 };
             }
             catch (err) {
@@ -344,6 +378,7 @@ export class PaybondToolInterceptor {
                     : Math.min(requestedSpendCents, sandboxSpend);
         }
         requestedSpendCents ??= 0;
+        const agentContext = this.binding.agentContext;
         return {
             toolName,
             toolCallId,
@@ -359,9 +394,12 @@ export class PaybondToolInterceptor {
                 taskId: input.taskId,
                 workflowId: input.workflowId,
                 currency: input.currency,
-                agentSubject: input.agentSubject,
+                agentSubject: input.agentSubject ?? agentContext?.operatorDid,
                 approvalToken: input.approvalToken,
                 idempotencyKey: input.idempotencyKey,
+                modelFamily: agentContext?.modelFamily,
+                configHashHex: agentContext?.configHashHex,
+                promptHashHex: agentContext?.promptHashHex,
             },
         };
     }
@@ -392,6 +430,7 @@ export class PaybondToolInterceptor {
                         tool_call_id: options.toolCallId,
                         evidence_preset: options.entry.evidencePreset,
                         decision_id: options.auth.decisionId,
+                        external_attestations: options.externalAttestations ?? [],
                     },
                     idempotencyKey,
                 });
@@ -420,6 +459,8 @@ export class PaybondToolInterceptor {
             const result = await this.host.harbor.submitEvidence(this.binding.intentId, wire, {
                 idempotencyKey,
                 recognitionProof,
+                agentReceiptAttestations: options.externalAttestations ?? [],
+                agentReceiptSourceRunId: this.binding.runId,
             });
             const resultRecord = result;
             const intentState = typeof resultRecord.intent_state === "string"
@@ -432,11 +473,19 @@ export class PaybondToolInterceptor {
                 : typeof resultRecord.predicatePassed === "boolean"
                     ? resultRecord.predicatePassed
                     : undefined;
+            const payloadDigestSha256Hex = typeof resultRecord.payload_digest === "string"
+                ? resultRecord.payload_digest.trim().toLowerCase() || undefined
+                : undefined;
+            const artifactsDigestSha256Hex = typeof resultRecord.artifacts_digest === "string"
+                ? resultRecord.artifacts_digest.trim().toLowerCase() || undefined
+                : undefined;
             return {
                 submitted: true,
                 intentId: this.binding.intentId,
                 intentState,
                 predicatePassed,
+                payloadDigestSha256Hex,
+                artifactsDigestSha256Hex,
             };
         }
         catch (err) {
@@ -446,4 +495,135 @@ export class PaybondToolInterceptor {
             throw new PaybondAutoEvidenceSubmitError(options.toolResult, err);
         }
     }
+    /**
+     * Composes an unsigned Agent Receipt Standard draft (Phase 1) after a successful
+     * authorize → execute → evidence cycle. Never signed or persisted here; Phase 2 covers
+     * compose/sign/persist. Best-effort: returns `undefined` instead of throwing whenever
+     * required receipt fields (agent context, principal/operator DID, policy template, pinned
+     * policy digest, or a Harbor decision id) are unavailable on this binding or call.
+     */
+    buildReceiptDraft(options) {
+        try {
+            const agentContext = this.binding.agentContext;
+            if (!agentContext?.operatorDid || !agentContext.principalDid || !agentContext.policyTemplateId) {
+                return undefined;
+            }
+            if (!agentContext.configHashHex || !agentContext.promptHashHex) {
+                return undefined;
+            }
+            if (!options.auth.decisionId || !options.policyDigest) {
+                return undefined;
+            }
+            const actorSubject = options.agentSubject ?? agentContext.operatorDid;
+            const bareDigest = options.policyDigest.startsWith("sha256:")
+                ? options.policyDigest.slice("sha256:".length)
+                : options.policyDigest;
+            const completedAtMs = Date.now();
+            const argumentsDigest = valueDigestSha256Hex(options.arguments);
+            let resultDigest;
+            try {
+                resultDigest = valueDigestSha256Hex(options.toolResult);
+            }
+            catch {
+                resultDigest = undefined;
+            }
+            const harborState = options.evidence.intentState ?? options.evidence.sandboxLifecycleStatus ?? "evidence_submitted";
+            let merchant;
+            let evidenceBlock;
+            const payeeDid = this.binding.productionEvidence?.payeeDid;
+            if (payeeDid && options.evidence.payloadDigestSha256Hex) {
+                merchant = {
+                    payee_did: payeeDid,
+                    vendor_id: options.vendorId,
+                };
+                evidenceBlock = {
+                    completion_preset_id: options.entry.evidencePreset,
+                    payload_digest_sha256_hex: options.evidence.payloadDigestSha256Hex,
+                    artifacts_digest_sha256_hex: options.evidence.artifactsDigestSha256Hex,
+                    predicate_passed: options.evidence.predicatePassed ?? false,
+                    payee_did: payeeDid,
+                };
+            }
+            const draft = {
+                schema_version: AGENT_RECEIPT_SCHEMA_VERSION,
+                kind: AGENT_RECEIPT_KIND_V1,
+                receipt_version: AGENT_RECEIPT_VERSION_V1,
+                scope: AGENT_RECEIPT_SCOPE_ACTION,
+                receipt_id: actionReceiptId(this.binding.intentId, options.toolCallId),
+                issued_at: new Date(completedAtMs).toISOString(),
+                tenant_id: this.binding.tenantId,
+                authorization: {
+                    principal_did: agentContext.principalDid,
+                    actor_subject: actorSubject,
+                    agent: {
+                        operator_did: agentContext.operatorDid,
+                        model_family: agentContext.modelFamily,
+                        model_instance_id: agentContext.modelInstanceId,
+                        config_hash_sha256_hex: agentContext.configHashHex,
+                        prompt_hash_sha256_hex: agentContext.promptHashHex,
+                    },
+                    decision_id: options.auth.decisionId,
+                    audit_id: options.auth.auditId,
+                    policy: {
+                        template_id: agentContext.policyTemplateId,
+                        content_digest_sha256_hex: bareDigest,
+                    },
+                    authorized_at: new Date(options.authorizedAtMs).toISOString(),
+                    requested_spend_cents: options.requestedSpendCents,
+                    currency: options.currency ?? "usd",
+                },
+                execution: {
+                    run_id: this.binding.runId,
+                    tool_call_id: options.toolCallId,
+                    tool_name: options.toolName,
+                    operation: options.operation,
+                    arguments_digest_sha256_hex: argumentsDigest,
+                    result_digest_sha256_hex: resultDigest,
+                    outcome: "executed",
+                    started_at: new Date(options.executeStartedAt).toISOString(),
+                    completed_at: new Date(completedAtMs).toISOString(),
+                    duration_ms: completedAtMs - options.executeStartedAt,
+                },
+                merchant,
+                evidence: evidenceBlock,
+                outcome: {
+                    harbor_state: harborState,
+                    spend_reservation_outcome: "consumed",
+                    predicate_passed: options.evidence.predicatePassed ?? undefined,
+                },
+                references: {
+                    intent_id: this.binding.intentId,
+                    settlement_receipt_id: null,
+                },
+                external_attestations: options.externalAttestations ?? [],
+                signing_algorithm: AGENT_RECEIPT_SIGNING_ALGORITHM_ED25519,
+                message_digest_sha256_hex: "",
+                signing_public_key_ed25519_hex: "",
+                ed25519_signature_hex: "",
+            };
+            draft.message_digest_sha256_hex = agentReceiptMessageDigestSha256Hex(draft);
+            return draft;
+        }
+        catch {
+            // Draft composition is always best-effort; never fails tool execution (Phase 1).
+            return undefined;
+        }
+    }
+    resolveToolExternalAttestations(entry, toolResult, ctx) {
+        const mapper = entry.externalAttestationMapper;
+        if (!mapper) {
+            return [];
+        }
+        try {
+            const mapped = mapper(toolResult, ctx);
+            if (!mapped) {
+                return [];
+            }
+            const inputs = Array.isArray(mapped) ? mapped : [mapped];
+            return resolveExternalAttestations(inputs);
+        }
+        catch {
+            return [];
+        }
+    }
 }

package/dist/agent/receipt-client.d.ts

@@ -0,0 +1,64 @@
+import { type AgentReceiptV1 } from "../agent-receipt.js";
+import type { PaybondGenericWrappedToolDefinition } from "./adapter.js";
+import type { PaybondAgentInput, PaybondAgentResult } from "./facade.js";
+export type VerifyAgentReceiptV1Result = {
+    valid: boolean;
+    kind: string;
+    receipt_id: string;
+    tenant_id: string;
+    receipt: AgentReceiptV1;
+};
+type AgentReceiptProtocolClient = {
+    getAgentReceiptV1ByID(receiptId: string): Promise<AgentReceiptV1>;
+    getAgentReceiptV1ByIntentToolCall(init: {
+        intentId: string;
+        toolCallId: string;
+    }): Promise<AgentReceiptV1>;
+    verifyAgentReceiptV1(receipt: AgentReceiptV1 | Record<string, unknown>): Promise<VerifyAgentReceiptV1Result>;
+};
+export type GetAgentReceiptInput = {
+    receiptId: string;
+    intentId?: never;
+    toolCallId?: never;
+} | {
+    intentId: string;
+    toolCallId: string;
+    receiptId?: never;
+};
+/**
+ * Callable `paybond.agent({...})` surface with receipt helpers attached.
+ *
+ * The generic framework (the default when `framework` is omitted or `"generic"`)
+ * normalizes a `{ name: execute }` record or `{ name, execute }[]` into
+ * middleware-wrapped tools, so `result.tools` is a
+ * {@link PaybondGenericWrappedToolDefinition} array regardless of the input shape.
+ * Framework-native paths (`vercel-ai`, `openai-agents`, `langgraph`, ...) preserve
+ * the caller's tool shape, so `result.tools` matches the input tools type.
+ */
+export type PaybondAgentCallable = {
+    <TTools = unknown>(input: PaybondAgentInput<TTools> & {
+        framework?: "generic";
+    }): Promise<PaybondAgentResult<PaybondGenericWrappedToolDefinition[]>>;
+    <TTools>(input: PaybondAgentInput<TTools>): Promise<PaybondAgentResult<TTools>>;
+    getReceipt(input: GetAgentReceiptInput): Promise<AgentReceiptV1>;
+    verifyReceipt(receipt: AgentReceiptV1, options?: {
+        offline?: boolean;
+    }): Promise<VerifyAgentReceiptV1Result | AgentReceiptV1>;
+};
+/** Tenant-bound agent quickstart plus receipt fetch/verify helpers. */
+export declare class PaybondAgentFacade {
+    private readonly protocol;
+    private readonly invokeAgent?;
+    constructor(protocol: AgentReceiptProtocolClient, invokeAgent?: ((input: PaybondAgentInput) => Promise<PaybondAgentResult>) | undefined);
+    /** Fetch a signed `paybond.agent_receipt_v1` by receipt id or intent/tool-call lookup. */
+    getReceipt(input: GetAgentReceiptInput): Promise<AgentReceiptV1>;
+    /** Verify a signed agent receipt via Gateway or locally with {@link verifyAgentReceiptV1}. */
+    verifyReceipt(receipt: AgentReceiptV1, options?: {
+        offline?: boolean;
+    }): Promise<VerifyAgentReceiptV1Result | AgentReceiptV1>;
+    /** Opinionated quickstart: resolve policy presets and wire framework tools. */
+    call(input: PaybondAgentInput): Promise<PaybondAgentResult>;
+}
+/** Callable `paybond.agent({...})` surface with receipt helpers attached. */
+export declare function createPaybondAgentCallable(protocol: AgentReceiptProtocolClient, invokeAgent: (input: PaybondAgentInput) => Promise<PaybondAgentResult>): PaybondAgentCallable;
+export {};

package/dist/agent/receipt-client.js

@@ -0,0 +1,45 @@
+import { verifyAgentReceiptV1, } from "../agent-receipt.js";
+/** Tenant-bound agent quickstart plus receipt fetch/verify helpers. */
+export class PaybondAgentFacade {
+    protocol;
+    invokeAgent;
+    constructor(protocol, invokeAgent) {
+        this.protocol = protocol;
+        this.invokeAgent = invokeAgent;
+    }
+    /** Fetch a signed `paybond.agent_receipt_v1` by receipt id or intent/tool-call lookup. */
+    async getReceipt(input) {
+        if ("receiptId" in input && input.receiptId?.trim()) {
+            return this.protocol.getAgentReceiptV1ByID(input.receiptId.trim());
+        }
+        if (input.intentId?.trim() && input.toolCallId?.trim()) {
+            return this.protocol.getAgentReceiptV1ByIntentToolCall({
+                intentId: input.intentId.trim(),
+                toolCallId: input.toolCallId.trim(),
+            });
+        }
+        throw new Error("getReceipt requires receiptId or intentId + toolCallId");
+    }
+    /** Verify a signed agent receipt via Gateway or locally with {@link verifyAgentReceiptV1}. */
+    async verifyReceipt(receipt, options) {
+        if (options?.offline) {
+            return verifyAgentReceiptV1(receipt);
+        }
+        return this.protocol.verifyAgentReceiptV1(receipt);
+    }
+    /** Opinionated quickstart: resolve policy presets and wire framework tools. */
+    async call(input) {
+        if (!this.invokeAgent) {
+            throw new Error("paybond.agent() requires a hosted Paybond session");
+        }
+        return this.invokeAgent(input);
+    }
+}
+/** Callable `paybond.agent({...})` surface with receipt helpers attached. */
+export function createPaybondAgentCallable(protocol, invokeAgent) {
+    const facade = new PaybondAgentFacade(protocol, invokeAgent);
+    const callable = ((input) => facade.call(input));
+    callable.getReceipt = facade.getReceipt.bind(facade);
+    callable.verifyReceipt = facade.verifyReceipt.bind(facade);
+    return callable;
+}

package/dist/agent/registry.js

@@ -32,6 +32,7 @@ function normalizeSideEffecting(sideEffecting) {
             spendCents: policy.spendCents,
             evidencePreset,
             evidenceMapper: policy.evidenceMapper,
+            externalAttestationMapper: policy.externalAttestationMapper,
         });
     }
     return entries;

package/dist/agent/run.d.ts

@@ -2,6 +2,7 @@ import { PaybondToolInterceptor } from "./interceptor.js";
 import { PaybondToolRegistry } from "./registry.js";
 import { PaybondRunBinding, PaybondAgentRunBindInput, PaybondRunGuard } from "./types.js";
 import type { PaybondPolicySnapshot } from "../policy/snapshot.js";
+import { type AgentReceiptExternalAttestationV1 } from "../agent-receipt.js";
 import { type PaybondPolicyReloadFailedEvent, type PaybondPolicyReloadOptions, type PaybondPolicyReloadedEvent, type PaybondPolicyReloadResult } from "../policy/reload.js";
 type SandboxBootstrapResult = {
     tenant_id: string;
@@ -16,6 +17,8 @@ type SandboxGuardrailEvidenceResult = {
     intent_id: string;
     sandbox_lifecycle_status: string;
     predicate_passed?: boolean | null;
+    payload_digest?: string;
+    artifacts_digest?: string;
 };
 export type PaybondSubmitProductionEvidenceInput = {
     intentId: string;
@@ -31,6 +34,8 @@ type AgentRunHarbor = {
     submitEvidence(intentId: string, evidenceBody: Record<string, unknown>, options: {
         idempotencyKey?: string;
         recognitionProof: Record<string, unknown>;
+        agentReceiptAttestations?: AgentReceiptExternalAttestationV1[];
+        agentReceiptSourceRunId?: string;
     }): Promise<Record<string, unknown>>;
 };
 type AgentRunGuardrails = {

package/dist/agent/run.js

@@ -1,5 +1,6 @@
 import { PaybondToolInterceptor } from "./interceptor.js";
 import { PaybondAgentRunBindError, } from "./types.js";
+import { configHashSha256Hex, promptHashSha256Hex, } from "../agent-receipt.js";
 import { reloadPolicyOnRun, } from "../policy/reload.js";
 import { PaybondPolicyReloadController } from "../policy/watcher.js";
 import { resolveDevTraceSink } from "../dev/trace-buffer.js";
@@ -45,6 +46,55 @@ function normalizeProductionEvidence(raw, sandbox) {
         agentRecognitionSigningSeed: raw.agentRecognitionSigningSeed,
     };
 }
+/** Strips the leading `sha256:` scheme from a policy snapshot digest, if present. */
+function bareDigestHex(digest) {
+    if (!digest) {
+        return undefined;
+    }
+    const trimmed = digest.trim();
+    return trimmed.startsWith("sha256:") ? trimmed.slice("sha256:".length) : trimmed;
+}
+/**
+ * Resolves optional Agent Receipt Standard agent context at bind time: auto-computes
+ * `config_hash_hex` from {@link PaybondRunAgentContextInput.configHashMaterials} (per spec,
+ * `sha256(JCS({ system_prompt, tools_manifest, policy_snapshot_id }))`) and `prompt_hash_hex`
+ * from {@link PaybondRunAgentContextInput.normalizedUserPrompt} when precomputed hashes are not
+ * supplied directly. Raw prompt text is hashed here and discarded; only the digest is retained.
+ */
+function resolveAgentContext(input, snapshot) {
+    if (!input) {
+        return undefined;
+    }
+    const modelFamily = input.modelFamily.trim();
+    if (!modelFamily) {
+        throw new PaybondAgentRunBindError("agentContext.modelFamily must be non-empty");
+    }
+    let configHashHex = input.configHashHex?.trim().toLowerCase();
+    if (!configHashHex && input.configHashMaterials) {
+        const policySnapshotId = input.configHashMaterials.policySnapshotId?.trim() || bareDigestHex(snapshot?.digest);
+        if (!policySnapshotId) {
+            throw new PaybondAgentRunBindError("agentContext.configHashMaterials.policySnapshotId is required when no policySnapshot is bound");
+        }
+        configHashHex = configHashSha256Hex({
+            system_prompt: input.configHashMaterials.systemPrompt,
+            tools_manifest: input.configHashMaterials.toolsManifest,
+            policy_snapshot_id: policySnapshotId,
+        });
+    }
+    let promptHashHex = input.promptHashHex?.trim().toLowerCase();
+    if (!promptHashHex && input.normalizedUserPrompt !== undefined) {
+        promptHashHex = promptHashSha256Hex(input.normalizedUserPrompt);
+    }
+    return {
+        modelFamily,
+        modelInstanceId: input.modelInstanceId?.trim() || undefined,
+        configHashHex,
+        promptHashHex,
+        principalDid: input.principalDid?.trim() || undefined,
+        operatorDid: input.operatorDid?.trim() || undefined,
+        policyTemplateId: input.policyTemplateId?.trim() || undefined,
+    };
+}
 function assertExclusiveBindMode(input) {
     const hasBootstrap = input.bootstrap !== undefined;
     const hasAttach = input.attach !== undefined;
@@ -268,6 +318,7 @@ export class PaybondAgentRun {
         const registry = snapshot?.registry ?? input.registry;
         registry.validateForBind(allowedTools);
         const guard = paybond.spendGuard(intentId, capabilityToken);
+        const agentContext = resolveAgentContext(input.agentContext, snapshot);
         const binding = {
             runId,
             tenantId,
@@ -280,6 +331,7 @@ export class PaybondAgentRun {
             productionEvidence,
             policySnapshot: snapshot,
             onTrace: input.traceSink ?? input.onTrace ?? resolveDevTraceSink(),
+            agentContext,
         };
         const policyFilePath = input.policyFile?.trim();
         const run = new PaybondAgentRun(binding, paybond, snapshot, policyFilePath);