@paybond/kit 0.11.2 → 0.11.3

package/dist/agent/facade.d.ts

@@ -1,4 +1,4 @@
-import type { ClaudeAgentsConfig } from "../claude-agents/index.js";
+import type { ClaudeAgentsConfig } from "../claude-agents/config.js";
 import type { PaybondLangGraphHooks } from "../langgraph/config.js";
 import { createOpenAIAgentsAdapter } from "../openai-agents/index.js";
 import type { PaybondPolicy } from "../policy/load.js";

package/dist/agent/facade.js

@@ -1,4 +1,4 @@
-import { createPaybondClaudeAgentsConfig } from "../claude-agents/index.js";
+import { createPaybondClaudeAgentsConfig } from "../claude-agents/config.js";
 import { createPaybondOpenAIAgentsConfig } from "../openai-agents/index.js";
 import { isKnownPolicyPresetId, resolvePolicyPresetPath } from "../policy/presets.js";
 import { createPaybondVercelAgentConfig } from "../vercel-ai/config.js";

package/dist/agent/guarded-agent.d.ts

@@ -6,7 +6,7 @@ import type { PolicyValidatorOptions } from "../policy/validate.js";
 import { paybondVercelToolApproval } from "../vercel-ai/tool-approval.js";
 import { type PaybondLangGraphAwrapToolCall } from "../langgraph/awrap-tool-call.js";
 import { paybondToolNode } from "../langgraph/tool-node.js";
-import { type ClaudeAgentsConfig } from "../claude-agents/index.js";
+import { type ClaudeAgentsConfig } from "../claude-agents/config.js";
 import type { PaybondToolRegistry } from "./registry.js";
 import type { PaybondAgentRunHost } from "./run.js";
 import { PaybondAgentRun } from "./run.js";

package/dist/agent/guarded-agent.js

@@ -2,7 +2,7 @@ import { createOpenAIAgentsAdapter, createPaybondOpenAIAgentsConfig, } from "../
 import { PaybondPolicy } from "../policy/load.js";
 import { createPaybondVercelAgentConfig } from "../vercel-ai/config.js";
 import { createPaybondLangGraphHooks } from "../langgraph/config.js";
-import { createPaybondClaudeAgentsConfig, } from "../claude-agents/index.js";
+import { createPaybondClaudeAgentsConfig, } from "../claude-agents/config.js";
 import { createPaybondGenericAgentConfig, } from "./generic-runner.js";
 import { PaybondAgentRun } from "./run.js";
 async function resolvePolicy(source) {

package/dist/claude-agents/config.d.ts

@@ -1,4 +1,4 @@
-import { createSdkMcpServer, type SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
+import type { SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
 import type { PaybondAgentRun } from "../agent/run.js";
 /** Pre-built SDK tool from `tool()` in `@anthropic-ai/claude-agent-sdk`. */
 export type ClaudeAgentSdkTool = SdkMcpToolDefinition;
@@ -9,7 +9,7 @@ export type PaybondClaudeAgentsConfigOptions = {
     serverVersion?: string;
 };
 export type ClaudeAgentsConfig = {
-    mcpServer: ReturnType<typeof createSdkMcpServer>;
+    mcpServer: ReturnType<typeof import("@anthropic-ai/claude-agent-sdk").createSdkMcpServer>;
     allowedTools: string[];
     /** Same tool array as input — side-effecting handlers are wrapped in-place. */
     agentTools: ClaudeAgentSdkTool[];

package/dist/claude-agents/config.js

@@ -1,6 +1,26 @@
-import { createSdkMcpServer, } from "@anthropic-ai/claude-agent-sdk";
+import { createRequire } from "node:module";
 import { PaybondAutoEvidenceSubmitError, PaybondUnregisteredSideEffectingToolError, } from "../agent/types.js";
 import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, } from "../index.js";
+let cachedClaudeAgentSdk;
+/**
+ * Lazily resolve the optional `@anthropic-ai/claude-agent-sdk` peer dependency.
+ *
+ * Importing this module must not require the peer to be installed, so the Paybond barrel
+ * can load for consumers of other frameworks. The peer is only needed when the Claude Agents
+ * config is actually built.
+ */
+function loadClaudeAgentSdk() {
+    if (cachedClaudeAgentSdk === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedClaudeAgentSdk = require("@anthropic-ai/claude-agent-sdk");
+        }
+        catch (err) {
+            throw new Error('The Claude Agents integration requires the optional peer dependency "@anthropic-ai/claude-agent-sdk"; install it with: npm install @anthropic-ai/claude-agent-sdk', { cause: err });
+        }
+    }
+    return cachedClaudeAgentSdk;
+}
 function claudeMcpAllowedToolName(serverName, toolName) {
     return `mcp__${serverName}__${toolName}`;
 }
@@ -127,6 +147,7 @@ function wrapClaudeAgentSdkTool(run, sdkTool) {
  * into an in-process MCP server for `query({ options: { mcpServers, allowedTools } })`.
  */
 export function createPaybondClaudeAgentsConfig(run, tools, options) {
+    const { createSdkMcpServer } = loadClaudeAgentSdk();
     const sdkTools = assertClaudeAgentSdkTools(tools);
     const serverName = options?.serverName?.trim() || "paybond";
     for (const sdkTool of sdkTools) {

package/dist/cli/commands/agent.js

@@ -1,6 +1,7 @@
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
-import { PaybondAgentRun, PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/index.js";
+import { PaybondAgentRun } from "../../agent/run.js";
+import { PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/types.js";
 import { runGenericSandboxDemo } from "../../agent/generic-sandbox-demo.js";
 import { loadRunClaudeAgentsSandboxDemo, loadRunLangGraphSandboxDemo, loadRunOpenAIAgentsSandboxDemo, loadRunVercelAiSandboxDemo, } from "../agent/demo-loaders.js";
 import { buildSmokeRegistry, loadAgentRegistryFile, validateAgentRegistryDocument, } from "../../agent/registry-file.js";

package/dist/langgraph/awrap-tool-call.d.ts

@@ -1,5 +1,5 @@
-import { ToolMessage } from "@langchain/core/messages";
-import { type Command } from "@langchain/langgraph";
+import type { ToolMessage } from "@langchain/core/messages";
+import type { Command } from "@langchain/langgraph";
 import type { PaybondAgentRun } from "../agent/run.js";
 /** LangGraph `ToolCallRequest`-compatible shape used by Paybond interceptors. */
 export type PaybondLangGraphToolCallRequest = {

package/dist/langgraph/awrap-tool-call.js

@@ -1,7 +1,41 @@
-import { ToolMessage } from "@langchain/core/messages";
-import { isCommand } from "@langchain/langgraph";
+import { createRequire } from "node:module";
 import { PaybondAutoEvidenceSubmitError, PaybondUnregisteredSideEffectingToolError, } from "../agent/types.js";
 import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, } from "../index.js";
+let cachedCoreMessages;
+let cachedLangGraph;
+function missingLangGraphPeerError(err) {
+    return new Error('The LangGraph integration requires the optional peer dependencies "@langchain/core" and "@langchain/langgraph"; install them with: npm install @langchain/core @langchain/langgraph', { cause: err });
+}
+/**
+ * Lazily resolve `@langchain/core/messages`; importing this module must not require the peer.
+ */
+function loadCoreMessages() {
+    if (cachedCoreMessages === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedCoreMessages = require("@langchain/core/messages");
+        }
+        catch (err) {
+            throw missingLangGraphPeerError(err);
+        }
+    }
+    return cachedCoreMessages;
+}
+/**
+ * Lazily resolve `@langchain/langgraph`; importing this module must not require the peer.
+ */
+function loadLangGraph() {
+    if (cachedLangGraph === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedLangGraph = require("@langchain/langgraph");
+        }
+        catch (err) {
+            throw missingLangGraphPeerError(err);
+        }
+    }
+    return cachedLangGraph;
+}
 function toolCallFields(request) {
     const call = request.tool_call;
     return {
@@ -11,6 +45,7 @@ function toolCallFields(request) {
     };
 }
 function denyToolMessage(name, toolCallId, content) {
+    const { ToolMessage } = loadCoreMessages();
     return new ToolMessage({
         content,
         name: name || "unknown",
@@ -19,9 +54,11 @@ function denyToolMessage(name, toolCallId, content) {
     });
 }
 function isToolMessage(value) {
-    return value instanceof ToolMessage;
+    return value instanceof loadCoreMessages().ToolMessage;
 }
 export function normalizeLangGraphHookResult(call, result) {
+    const { isCommand } = loadLangGraph();
+    const { ToolMessage } = loadCoreMessages();
     if (isToolMessage(result) || isCommand(result)) {
         return result;
     }

package/dist/langgraph/tool-node.d.ts

@@ -1,10 +1,13 @@
 import type { DynamicTool, StructuredToolInterface } from "@langchain/core/tools";
 import type { RunnableToolLike } from "@langchain/core/runnables";
-import { ToolNode, type ToolNodeOptions } from "@langchain/langgraph/prebuilt";
+import type { ToolNode, ToolNodeOptions } from "@langchain/langgraph/prebuilt";
 import type { PaybondAgentRun } from "../agent/run.js";
 type LangGraphTool = StructuredToolInterface | DynamicTool | RunnableToolLike;
 /**
  * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ *
+ * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; the returned subclass provides
+ * the same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
  */
 export declare function paybondToolNode(tools: LangGraphTool[], run: PaybondAgentRun, options?: ToolNodeOptions): ToolNode;
 export {};

package/dist/langgraph/tool-node.js

@@ -1,38 +1,56 @@
-import { ToolNode } from "@langchain/langgraph/prebuilt";
+import { createRequire } from "node:module";
 import { normalizeLangGraphHookResult, paybondAwrapToolCall, } from "./awrap-tool-call.js";
+let cachedPrebuilt;
 /**
- * `ToolNode` subclass that runs {@link paybondAwrapToolCall} before each tool invocation.
+ * Lazily resolve the optional `@langchain/langgraph` peer dependency.
  *
- * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; this wrapper provides the
- * same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
+ * Importing this module must not require the peer to be installed, so the Paybond barrel
+ * can load for consumers of other frameworks. The peer is only needed when a guarded
+ * LangGraph `ToolNode` is actually constructed.
  */
-class PaybondGuardedToolNode extends ToolNode {
-    awrap;
-    constructor(tools, run, options) {
-        super(tools, options);
-        this.awrap = paybondAwrapToolCall(run);
-    }
-    async runTool(call, config, state) {
-        const request = {
-            tool_call: {
-                name: call.name,
-                id: call.id,
-                args: (call.args ?? {}),
-            },
-        };
-        const execute = async (req) => super.runTool({
-            ...call,
-            name: req.tool_call.name,
-            id: req.tool_call.id ?? call.id,
-            args: req.tool_call.args ?? call.args,
-        }, config, state);
-        const result = await this.awrap(request, execute);
-        return normalizeLangGraphHookResult(call, result);
+function loadLangGraphPrebuilt() {
+    if (cachedPrebuilt === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedPrebuilt = require("@langchain/langgraph/prebuilt");
+        }
+        catch (err) {
+            throw new Error('The LangGraph integration requires the optional peer dependencies "@langchain/core" and "@langchain/langgraph"; install them with: npm install @langchain/core @langchain/langgraph', { cause: err });
+        }
     }
+    return cachedPrebuilt;
 }
 /**
  * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ *
+ * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; the returned subclass provides
+ * the same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
  */
 export function paybondToolNode(tools, run, options) {
+    const { ToolNode: ToolNodeCtor } = loadLangGraphPrebuilt();
+    class PaybondGuardedToolNode extends ToolNodeCtor {
+        awrap;
+        constructor(guardedTools, guardedRun, guardedOptions) {
+            super(guardedTools, guardedOptions);
+            this.awrap = paybondAwrapToolCall(guardedRun);
+        }
+        async runTool(call, config, state) {
+            const request = {
+                tool_call: {
+                    name: call.name,
+                    id: call.id,
+                    args: (call.args ?? {}),
+                },
+            };
+            const execute = async (req) => super.runTool({
+                ...call,
+                name: req.tool_call.name,
+                id: req.tool_call.id ?? call.id,
+                args: req.tool_call.args ?? call.args,
+            }, config, state);
+            const result = await this.awrap(request, execute);
+            return normalizeLangGraphHookResult(call, result);
+        }
+    }
     return new PaybondGuardedToolNode(tools, run, options);
 }

package/dist/mcp-server.js

@@ -13,7 +13,7 @@ import { McpCapabilityTokenCache, mcpToolStoresCapabilityToken, parseMcpCapabili
 import { createMcpPolicyGatewayAdapter, McpPolicyReloadGate, parseMcpPolicyReloadConfig, } from "./mcp-policy-reload.js";
 import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.11.2";
+const SERVER_VERSION = "0.11.3";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
 const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";

package/dist/openai-agents/index.d.ts

@@ -1,4 +1,4 @@
-import { ToolGuardrailFunctionOutputFactory, type FunctionTool, type RunConfig, type ToolInputGuardrailDefinition } from "@openai/agents";
+import type { FunctionTool, RunConfig, ToolInputGuardrailDefinition } from "@openai/agents";
 import { type PaybondAgentRun, type PaybondToolInputGuardDecision } from "../agent/index.js";
 export type PaybondOpenAIAgentsAdapterOptions = {
     /**
@@ -11,7 +11,7 @@ declare function isFunctionTool(value: unknown): value is FunctionTool;
 /** Detect OpenAI Agents SDK function tools (`type: "function"`). */
 export { isFunctionTool as isOpenAIFunctionTool };
 /** Map a framework-neutral Paybond decision to OpenAI tool guardrail output. */
-export declare function mapPaybondDecisionToOpenAIToolGuardrail(decision: PaybondToolInputGuardDecision): ReturnType<typeof ToolGuardrailFunctionOutputFactory.allow>;
+export declare function mapPaybondDecisionToOpenAIToolGuardrail(decision: PaybondToolInputGuardDecision): ReturnType<typeof import("@openai/agents").ToolGuardrailFunctionOutputFactory.allow>;
 /** RunConfig fragment enabling Paybond verify before OpenAI approval interruptions. */
 export declare const paybondOpenAIAgentsRunConfig: Pick<RunConfig, "toolExecution">;
 /** Translate Paybond middleware into OpenAI Agents SDK tool input guardrails. */

package/dist/openai-agents/index.js

@@ -1,5 +1,25 @@
-import { defineToolInputGuardrail, ToolGuardrailFunctionOutputFactory, } from "@openai/agents";
+import { createRequire } from "node:module";
 import { createToolInputGuardAdapter, } from "../agent/index.js";
+let cachedOpenAIAgents;
+/**
+ * Lazily resolve the optional `@openai/agents` peer dependency.
+ *
+ * Importing this module must not require the peer to be installed, so consumers of
+ * other frameworks (LangGraph, Vercel AI, etc.) can load the Paybond barrel without it.
+ * The peer is only needed when the OpenAI Agents adapter functions actually run.
+ */
+function loadOpenAIAgents() {
+    if (cachedOpenAIAgents === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedOpenAIAgents = require("@openai/agents");
+        }
+        catch (err) {
+            throw new Error('The OpenAI Agents integration requires the optional peer dependency "@openai/agents"; install it with: npm install @openai/agents', { cause: err });
+        }
+    }
+    return cachedOpenAIAgents;
+}
 function parseToolArguments(raw) {
     if (!raw.trim()) {
         return {};
@@ -17,6 +37,7 @@ function isFunctionTool(value) {
 export { isFunctionTool as isOpenAIFunctionTool };
 /** Map a framework-neutral Paybond decision to OpenAI tool guardrail output. */
 export function mapPaybondDecisionToOpenAIToolGuardrail(decision) {
+    const { ToolGuardrailFunctionOutputFactory } = loadOpenAIAgents();
     if (decision.kind === "allow") {
         return ToolGuardrailFunctionOutputFactory.allow({
             paybond: {
@@ -37,6 +58,7 @@ export function mapPaybondDecisionToOpenAIToolGuardrail(decision) {
     });
 }
 function buildPaybondInputGuardrail(run, toolName) {
+    const { defineToolInputGuardrail } = loadOpenAIAgents();
     const guard = createToolInputGuardAdapter(run);
     return defineToolInputGuardrail({
         name: `paybond_spend_${toolName}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",
@@ -53,6 +53,7 @@
   },
   "files": [
     "dist",
+    "policy",
     "completion-presets",
     "solutions",
     "templates",
@@ -109,7 +110,7 @@
   },
   "scripts": {
     "clean": "node ./scripts/clean-dist.mjs",
-    "build": "npm run clean && tsc -p tsconfig.json && node ../scripts/sync-completion-catalog.mjs && node ../scripts/sync-dev-trace-ui.mjs && node ./scripts/generate-templates.mjs",
+    "build": "npm run clean && tsc -p tsconfig.json && node ../scripts/sync-completion-catalog.mjs && node ../scripts/sync-policy-presets.mjs && node ../scripts/sync-dev-trace-ui.mjs && node ./scripts/generate-templates.mjs",
     "cli": "node dist/cli.js",
     "cli:dev": "npm run build --silent && node dist/cli.js",
     "generate:cli-contract": "node ../cli-parity/generate.mjs",

package/policy/presets/aws.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: aws-operator-v1
+default_deny: true
+
+tools:
+  aws.ec2.start_instance:
+    side_effecting: true
+    max_spend_cents: 50000
+    evidence_preset: cost_and_completion
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - aws.ec2.start_instance
+  budget:
+    currency: usd
+    max_spend_usd: 500

package/policy/presets/domain/aws.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: aws-operator-v1
+default_deny: true
+
+tools:
+  aws.ec2.start_instance:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - aws.ec2.start_instance

package/policy/presets/domain/saas.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: saas-agent-v1
+default_deny: true
+
+tools:
+  saas.provision_seat:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  saas.list_plans:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - saas.provision_seat

package/policy/presets/domain/shopping.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: shopping-agent-v1
+default_deny: true
+
+tools:
+  commerce.checkout:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  search.products:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - commerce.checkout

package/policy/presets/domain/travel.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: travel-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  search.web:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - travel.book_hotel

package/policy/presets/guardrails/default-aws.yaml

@@ -0,0 +1,8 @@
+tools:
+  aws.ec2.start_instance:
+    max_spend_cents: 50000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 500

package/policy/presets/guardrails/default-saas.yaml

@@ -0,0 +1,8 @@
+tools:
+  saas.provision_seat:
+    max_spend_cents: 5000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 50

package/policy/presets/guardrails/default-shopping.yaml

@@ -0,0 +1,8 @@
+tools:
+  commerce.checkout:
+    max_spend_cents: 10000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 100

package/policy/presets/guardrails/default-travel.yaml

@@ -0,0 +1,8 @@
+tools:
+  travel.book_hotel:
+    max_spend_cents: 20000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 200

package/policy/presets/read-only.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: read-only-agent-v1
+default_deny: true
+
+tools:
+  search.web:
+    side_effecting: false
+
+  search.products:
+    side_effecting: false
+
+  saas.list_plans:
+    side_effecting: false
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - search.web
+    - search.products
+    - saas.list_plans
+    - aws.ec2.describe_instances

package/policy/presets/saas.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: saas-agent-v1
+default_deny: true
+
+tools:
+  saas.provision_seat:
+    side_effecting: true
+    max_spend_cents: 5000
+    evidence_preset: cost_and_completion
+
+  saas.list_plans:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - saas.provision_seat
+  budget:
+    currency: usd
+    max_spend_usd: 50

package/policy/presets/shopping.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: shopping-agent-v1
+default_deny: true
+
+tools:
+  commerce.checkout:
+    side_effecting: true
+    max_spend_cents: 10000
+    evidence_preset: cost_and_completion
+
+  search.products:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - commerce.checkout
+  budget:
+    currency: usd
+    max_spend_usd: 100

package/policy/presets/strict.yaml

@@ -0,0 +1,16 @@
+version: 1
+name: strict-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    max_spend_cents: 1000
+    evidence_preset: cost_and_completion
+
+intent:
+  allowed_tools:
+    - travel.book_hotel
+  budget:
+    currency: usd
+    max_spend_usd: 10

package/policy/presets/travel.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: travel-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    max_spend_cents: 20000
+    evidence_preset: cost_and_completion
+
+  search.web:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - travel.book_hotel
+  budget:
+    currency: usd
+    max_spend_usd: 200

package/templates/manifest.json

@@ -13,7 +13,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
         "zod": "^4.2.0"
@@ -33,7 +33,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -52,7 +52,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -71,7 +71,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -90,7 +90,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
         "zod": "^4.2.0"
       },
@@ -110,7 +110,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "mcp_tool_policy": "spend-write"
     },
@@ -127,7 +127,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12000 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "demo_mode": "generic"
     },
@@ -143,7 +143,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "demo_mode": "generic"
     },
@@ -159,7 +159,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "python_dependencies": {
-        "paybond-kit": ">=0.11.2",
+        "paybond-kit": ">=0.11.3",
         "langgraph": ">=1.2.0"
       },
       "demo_import": "paybond_kit.langgraph_sandbox_demo",

package/templates/openai-shopping-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "openai-shopping-agent",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-ogdppjWoUaT8z3Sl7LekZE5dvPj6hhAeBjjorVxI1gW5TE0Q0uwlwvfzDMiyJ4YnoXBfDkxEUNRJ8umpUasEeA==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-+hOAHp78nZGHM5cCOe+kaNNM6hItnkv8ick9CBKHxKe5k9B/EYFS0LKiKsRCBcJnVF3VRf5340j3mT3D2M3W4Q==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/openai-shopping-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2",
+    "@paybond/kit": "^0.11.3",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },

package/templates/paybond-aws-operator/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-aws-operator",
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-KHqslvzEv2y5lCQ6YAiIBuyudY7wmajrN08tPXVJFq7HLbdyzEvvIuQ715vAv0nI4LTUBEp/67xGkoHGPe/l0w==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-elKVrvovb54TgitThi8oPFqGkcRiP6lGQyzoenEf/khNWaAuEv7k5SJiZMOT5aDoUy+pb4Ovs31QAXtHxcrhAg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-aws-operator/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":12500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2"
+    "@paybond/kit": "^0.11.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-claude-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-claude-agents-demo",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -260,9 +260,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-OPx3cfzQrljMNdCwQqymnAoIxxgvLHYhlSX82U2qc5ZtVLKT/ib5QtskhbRA0zjlH82nHuKiBdZSe65nZk6dJw==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-4gCmDuFlYNg6jESOTlhVuV5ZFS7Tg7qLPqxGlfFBGYs+m+sAV2md1rln3rxWpbaSK5M11mhDSPq6g9zHpjvwOA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-claude-agents-demo/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2",
+    "@paybond/kit": "^0.11.3",
     "@anthropic-ai/claude-agent-sdk": "^0.2.100",
     "zod": "^4.2.0"
   },

package/templates/paybond-invoice-agent/requirements.txt

@@ -1,2 +1,2 @@
-paybond-kit>=0.11.2
+paybond-kit>=0.11.3
 langgraph>=1.2.0

package/templates/paybond-mcp-coding-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-mcp-coding-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-UdRXP545JtF1H1ktZzqQCfYeSXmdkG6wLcTyE06/AEp/EJkEnEqpVtg9vP+U/IRYYONXA2yzM0ctEVROSld6oQ==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-AlsBZDOnrC3n0/NHII+QWO4Iotg1H3TksQ1iGLskxM1XPQ7W+d83bzc2Yags7DDr/jfTyMy3ItNlVpRPZC7wNw==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-mcp-coding-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation deploy.preview --requested-spend-cents 500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2"
+    "@paybond/kit": "^0.11.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-openai-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-openai-agents-demo",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-EOgjB45nyErS4GyU4JVrCY0JWIxZ5Ymp4ZlRLuJB9plqA4Pnh/shTi2lF0Oh1Oq98/4W0Vk2E+LJC+emS5v0mQ==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-NlUW7qqYhLeA5BtjcDrtpJnv1/qwpGU4xXOFYmdbNJb9dyR6GytYATBsuWQ3ZtSfNAI6//u5gg3AocaKIjWEwg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-openai-agents-demo/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":2900}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2",
+    "@paybond/kit": "^0.11.3",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },

package/templates/paybond-procurement-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-procurement-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.2"
+        "@paybond/kit": "^0.11.3"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-FuY5SAso14RF+QHCOFhQsNU9aqFi3RveemWypzsDr+I9sY7VJra9KRWxTUw9vgLNrCZNkPCYKFaj6KFudph/qw==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-ZkQmWkHcC+4NugPGZjiwdFx8LiL8c7h5iVZOz/SMsaljYfrvn2+r169mRknzsKeo0rOkf16mWSxa66RWNmV9RQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-procurement-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation procurement.submit_po --requested-spend-cents 12000 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":12000}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2"
+    "@paybond/kit": "^0.11.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-travel-agent/package-lock.json

@@ -8,7 +8,7 @@
       "dependencies": {
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -178,9 +178,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-qsklp8fV/5q1o5/LsJja4+v1UhU7vLhwXcieHs2U7DHYI3d0IrotlgoG/vK22Ol0SUW0jVF7ncJh9MShLxvnsw==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-O+NW0/6+ybT8xBXhybSrXNfOzJZahTNjOovcIfAfiiCEkTGpXrWFhOw3IJbOmoqLhdBK8NE5OG3pCiatmNZcLQ==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-travel-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2",
+    "@paybond/kit": "^0.11.3",
     "@langchain/core": "^1.2.1",
     "@langchain/langgraph": "^1.4.7",
     "zod": "^4.2.0"

package/templates/paybond-vercel-shopping-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-vercel-shopping-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.2",
+        "@paybond/kit": "^0.11.3",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -104,9 +104,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.2",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.2.tgz",
-      "integrity": "sha512-BfumFFZrxAv5WhH2mg1dkuB28E+x1kf4ib8gaDMYqOynvpgNEgytAziSDvn8pEGdQfWwmhf0vLeMEqtrjcszzw==",
+      "version": "0.11.3",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.3.tgz",
+      "integrity": "sha512-fPSNotqz+kGpKWlk2tqFXwJi9PnYgHjIGGKp5Ts0+eiN028ZNumyzQX+oTGb6X5C/xBJ7Axe/aAtDyYhfSVrdg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-vercel-shopping-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.2",
+    "@paybond/kit": "^0.11.3",
     "ai": "^5.0.0",
     "zod": "^4.2.0"
   },