@paybond/kit 0.11.4 → 0.11.6

package/dist/index.js

@@ -6,6 +6,7 @@ import { buildSignedCreateIntentBody, buildSignedCreateIntentBodyWithPolicyBindi
 import { signPayeeEvidenceBinding } from "./payee-evidence.js";
 import { PaybondAgentRunFacade, PaybondInstrumentBuilder, createGuardedAgent, createGuardedAgentRunner, createPaybondAgent, createPaybondToolRegistry, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, resolveAgentPolicySource, wrapPaybondTools, } from "./agent/index.js";
 import { GatewayAgentRunTraceReporter, } from "./agent/gateway-trace-reporter.js";
+import { fetchWithGatewayRetries, gatewayRetryDelayMs, shouldRetryGatewayResponse, } from "./gateway-retry.js";
 import { parsePolicyRemoteValidateResponse, policyValidateQueryString, } from "./policy/validate-remote.js";
 import { parsePolicyEffectiveResolveResponse, } from "./policy/load-effective.js";
 import { paybondPolicyPresets } from "./policy/policy-api.js";
@@ -187,19 +188,6 @@ function protocolHTTPErrorMessage(prefix, statusCode, bodyText) {
 function normalizeBase(url) {
     return requireSecureGatewayUrl(url);
 }
-function backoffMs(attempt) {
-    const base = 200 * 2 ** attempt;
-    const jitter = Math.random() * 100;
-    return Math.min(base + jitter, 5000);
-}
-function parseRetryAfterSeconds(v) {
-    if (!v)
-        return null;
-    const n = Number.parseFloat(v.trim());
-    if (!Number.isFinite(n))
-        return null;
-    return Math.min(n, 30);
-}
 function normalizeExpectedEnvironment(value) {
     if (value === undefined)
         return null;
@@ -462,16 +450,17 @@ export class HarborClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -494,16 +483,17 @@ export class HarborClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 if (retryBodyText !== undefined) {
                     init = {
                         ...init,
@@ -804,28 +794,7 @@ export class GatewayHarborClient {
         return headers;
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries)
-                    throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     async postJSON(path, payload, extraHeaders) {
         return this.requestJSON("POST", path, payload, extraHeaders);
@@ -1052,28 +1021,7 @@ export class PaybondGuardrails {
         return headers;
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries)
-                    throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     async postJSON(path, payload, options) {
         const url = `${this.base}${path.replace(/^\/+/, "")}`;
@@ -1108,15 +1056,17 @@ export class PaybondGuardrails {
         if (input.completionPreset !== undefined) {
             payload.completion_preset = input.completionPreset;
         }
-        if (input.templateId !== undefined) {
-            payload.template_id = input.templateId;
-        }
-        if (input.parameters !== undefined) {
-            payload.parameters = input.parameters;
+        else {
+            if (input.templateId !== undefined) {
+                payload.template_id = input.templateId;
+            }
+            if (input.parameters !== undefined) {
+                payload.parameters = input.parameters;
+            }
         }
         const { res, text, url } = await this.postJSON("/v1/sandbox/guardrails/bootstrap", payload, { idempotencyKey: input.idempotencyKey });
         if (!res.ok) {
-            throw new HarborHttpError(`Gateway sandbox guardrail bootstrap HTTP ${res.status}: ${text}`, {
+            throw new HarborHttpError(`Gateway sandbox guardrail bootstrap HTTP ${res.status}`, {
                 statusCode: res.status,
                 url,
                 bodyText: text,
@@ -1151,7 +1101,7 @@ export class PaybondGuardrails {
         }
         const { res, text, url } = await this.postJSON(`/v1/sandbox/guardrails/${encodeURIComponent(input.intentId)}/evidence`, payload, { idempotencyKey: input.idempotencyKey });
         if (!res.ok) {
-            throw new HarborHttpError(`Gateway sandbox guardrail evidence HTTP ${res.status}: ${text}`, {
+            throw new HarborHttpError(`Gateway sandbox guardrail evidence HTTP ${res.status}`, {
                 statusCode: res.status,
                 url,
                 bodyText: text,
@@ -1431,16 +1381,17 @@ export class GatewaySignalClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1592,16 +1543,17 @@ export class GatewayFraudClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1873,16 +1825,17 @@ export class GatewayA2AClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1942,29 +1895,7 @@ export class GatewayProtocolClient {
         this.maxRetries = Math.max(1, init?.maxRetries ?? 3);
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries) {
-                    throw e;
-                }
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     headers(extra) {
         const headers = new Headers(extra);
@@ -2130,15 +2061,13 @@ async function resolveGatewayTenantId(gatewayBaseUrl, apiKey, principalPath, max
             if (attempt + 1 >= maxRetries) {
                 throw e;
             }
-            await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+            await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
             continue;
         }
         const text = await res.text();
         if (!res.ok) {
             if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             throw new GatewayAuthError(`gateway principal HTTP ${res.status}`, {

package/dist/mcp-server.js

@@ -13,7 +13,7 @@ import { McpCapabilityTokenCache, mcpToolStoresCapabilityToken, parseMcpCapabili
 import { createMcpPolicyGatewayAdapter, McpPolicyReloadGate, parseMcpPolicyReloadConfig, } from "./mcp-policy-reload.js";
 import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.11.4";
+const SERVER_VERSION = "0.11.6";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
 const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";

package/dist/policy/sandbox-bootstrap.js

@@ -59,12 +59,13 @@ export function policySandboxBootstrap(document, options = {}) {
         completionPreset: evidencePreset,
         metadata: options.metadata,
         idempotencyKey: options.idempotencyKey,
-        templateId: preset.harbor_template_id,
-        parameters: preset.parameters,
     };
     // Gateway rejects requests that include both completion_preset and evidence_schema.
+    // Gateway also rejects completion_preset and template_id together — catalog resolves the template.
     if (!evidencePreset.trim()) {
         bootstrap.evidenceSchema = options.evidenceSchema ?? preset.evidence_schema;
+        bootstrap.templateId = preset.harbor_template_id;
+        bootstrap.parameters = preset.parameters;
     }
     else if (options.evidenceSchema !== undefined) {
         throw new PaybondPolicySandboxBootstrapError("completion_preset and evidenceSchema are mutually exclusive for sandbox bootstrap");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.4",
+  "version": "0.11.6",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",
@@ -117,6 +117,7 @@
     "test": "vitest run",
     "pack:dry-run": "npm pack --dry-run",
     "verify:release": "node ./scripts/verify-release.mjs",
+    "verify:template-locks": "node ./scripts/verify-template-lock-integrity.mjs",
     "prepack": "npm run build"
   },
   "peerDependencies": {
@@ -153,7 +154,8 @@
     "@noble/secp256k1": "^2.2.3",
     "ajv": "^8.17.1",
     "blake3": "^2.1.7",
-    "uuid": "^14.0.0"
+    "uuid": "^14.0.0",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.197",

package/templates/manifest.json

@@ -13,7 +13,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
         "zod": "^4.2.0"
@@ -33,7 +33,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -52,7 +52,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -71,7 +71,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -90,7 +90,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
         "zod": "^4.2.0"
       },
@@ -110,7 +110,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4"
+        "@paybond/kit": "^0.11.6"
       },
       "mcp_tool_policy": "spend-write"
     },
@@ -127,7 +127,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12000 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4"
+        "@paybond/kit": "^0.11.6"
       },
       "demo_mode": "generic"
     },
@@ -143,7 +143,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.4"
+        "@paybond/kit": "^0.11.6"
       },
       "demo_mode": "generic"
     },
@@ -159,7 +159,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "python_dependencies": {
-        "paybond-kit": ">=0.11.4",
+        "paybond-kit": ">=0.11.6",
         "langgraph": ">=1.2.0"
       },
       "demo_import": "paybond_kit.langgraph_sandbox_demo",

package/templates/openai-shopping-agent/README.md

@@ -10,7 +10,7 @@ cd openai-shopping-agent
 cp .env.example .env.local
 paybond login
 npm install
-npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":4500}' --format json
+npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --result-body '{"status":"completed","cost_cents":4500}' --format json
 ```
 
 ## Run the demo

package/templates/openai-shopping-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "openai-shopping-agent",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.4.tgz",
-      "integrity": "sha512-x2eZuv8IDvZtPNiYl0N5Ik3gnXb9JLiNNbrLphLfEzVO3ItpWeIWziRfB0flgXjva+P2jziAzwTXUKjeSHrfpQ==",
+      "version": "0.11.6",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.6.tgz",
+      "integrity": "sha512-j4MYl0iqP2XG7Y2vshOxN+tC9ZdJCjlM9burdol2z6b2r45/IpgpA2qiy0L21uLo0qaB+Q9wakoPMIlmnS1Tsg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -179,7 +179,8 @@
         "@noble/secp256k1": "^2.2.3",
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
-        "uuid": "^14.0.0"
+        "uuid": "^14.0.0",
+        "zod": "^4.4.3"
       },
       "bin": {
         "paybond": "dist/cli.js",

package/templates/openai-shopping-agent/package.json

@@ -5,10 +5,10 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "start": "node dist/index.js",
-    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
+    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.4",
+    "@paybond/kit": "^0.11.6",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },

package/templates/paybond-aws-operator/README.md

@@ -10,7 +10,7 @@ cd paybond-aws-operator
 cp .env.example .env.local
 paybond login
 npm install
-npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":12500}' --format json
+npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --result-body '{"status":"completed","cost_cents":12500}' --format json
 ```
 
 ## Run the demo

package/templates/paybond-aws-operator/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-aws-operator",
       "dependencies": {
-        "@paybond/kit": "^0.11.4"
+        "@paybond/kit": "^0.11.6"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.4.tgz",
-      "integrity": "sha512-+DWUtlEkl7EGPnqyQxHDlYC4wKdsIDKzmjyML7spbbVt7NBRJu86KuaXUYICPCAySf19gJu84zxUk3FkAAfeBg==",
+      "version": "0.11.6",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.6.tgz",
+      "integrity": "sha512-j4MYl0iqP2XG7Y2vshOxN+tC9ZdJCjlM9burdol2z6b2r45/IpgpA2qiy0L21uLo0qaB+Q9wakoPMIlmnS1Tsg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -57,7 +57,8 @@
         "@noble/secp256k1": "^2.2.3",
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
-        "uuid": "^14.0.0"
+        "uuid": "^14.0.0",
+        "zod": "^4.4.3"
       },
       "bin": {
         "paybond": "dist/cli.js",
@@ -200,6 +201,15 @@
       "bin": {
         "uuid": "dist-node/bin/uuid"
       }
+    },
+    "node_modules/zod": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.4.3.tgz",
+      "integrity": "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==",
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/colinhacks"
+      }
     }
   }
 }

package/templates/paybond-aws-operator/package.json

@@ -5,10 +5,10 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "start": "node dist/index.js",
-    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":12500}' --format json"
+    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --result-body '{\"status\":\"completed\",\"cost_cents\":12500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.4"
+    "@paybond/kit": "^0.11.6"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-claude-agents-demo/README.md

@@ -10,7 +10,7 @@ cd paybond-claude-agents-demo
 cp .env.example .env.local
 paybond login
 npm install
-npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":18700}' --format json
+npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --result-body '{"status":"completed","cost_cents":18700}' --format json
 ```
 
 ## Run the demo

package/templates/paybond-claude-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-claude-agents-demo",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
-        "@paybond/kit": "^0.11.4",
+        "@paybond/kit": "^0.11.6",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -260,9 +260,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.4",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.4.tgz",
-      "integrity": "sha512-c7Rmv+0kWljW1Nov8e9gthOMLYUPyBG4GhRKUxmAO87tGNZZmL7Q/kAPpbehsNLgkJPc6QOb7xRiBk9EvOWjXg==",
+      "version": "0.11.6",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.6.tgz",
+      "integrity": "sha512-j4MYl0iqP2XG7Y2vshOxN+tC9ZdJCjlM9burdol2z6b2r45/IpgpA2qiy0L21uLo0qaB+Q9wakoPMIlmnS1Tsg==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -270,7 +270,8 @@
         "@noble/secp256k1": "^2.2.3",
         "ajv": "^8.17.1",
         "blake3": "^2.1.7",
-        "uuid": "^14.0.0"
+        "uuid": "^14.0.0",
+        "zod": "^4.4.3"
       },
       "bin": {
         "paybond": "dist/cli.js",

package/templates/paybond-claude-agents-demo/package.json

@@ -5,10 +5,10 @@
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "start": "node dist/index.js",
-    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
+    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.4",
+    "@paybond/kit": "^0.11.6",
     "@anthropic-ai/claude-agent-sdk": "^0.2.100",
     "zod": "^4.2.0"
   },

package/templates/paybond-invoice-agent/.github/workflows/smoke.yml

@@ -14,6 +14,6 @@ jobs:
           python-version: "3.11"
       - uses: actions/checkout@v4
       - run: pip install -r requirements.txt
-      - run: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":2900}' --format json
+      - run: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --result-body '{"status":"completed","cost_cents":2900}' --format json
         env:
           PAYBOND_API_KEY: ${{ secrets.PAYBOND_SANDBOX_API_KEY }}

package/templates/paybond-invoice-agent/README.md

@@ -10,7 +10,7 @@ cd paybond-invoice-agent
 cp .env.example .env.local
 paybond-kit-login
 pip install -r requirements.txt
-npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":2900}' --format json
+npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --result-body '{"status":"completed","cost_cents":2900}' --format json
 ```
 
 ## Run the demo

package/templates/paybond-invoice-agent/package.json

@@ -1,6 +1,6 @@
 {
   "private": true,
   "scripts": {
-    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --evidence-preset cost_and_completion --result-body '{\"status\":\"completed\",\"cost_cents\":2900}' --format json"
+    "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --result-body '{\"status\":\"completed\",\"cost_cents\":2900}' --format json"
   }
 }

package/templates/paybond-invoice-agent/requirements.txt

@@ -1,2 +1,2 @@
-paybond-kit>=0.11.4
+paybond-kit>=0.11.6
 langgraph>=1.2.0

package/templates/paybond-mcp-coding-agent/README.md

@@ -10,7 +10,7 @@ cd paybond-mcp-coding-agent
 cp .env.example .env.local
 paybond login
 npm install
-npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation deploy.preview --requested-spend-cents 500 --evidence-preset cost_and_completion --result-body '{"status":"completed","cost_cents":500}' --format json
+npm run smoke   # or: paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation deploy.preview --requested-spend-cents 500 --result-body '{"status":"completed","cost_cents":500}' --format json
 ```
 
 ## Run the demo