@paybond/kit 0.11.5 → 0.11.7

package/dist/index.js

@@ -6,6 +6,7 @@ import { buildSignedCreateIntentBody, buildSignedCreateIntentBodyWithPolicyBindi
 import { signPayeeEvidenceBinding } from "./payee-evidence.js";
 import { PaybondAgentRunFacade, PaybondInstrumentBuilder, createGuardedAgent, createGuardedAgentRunner, createPaybondAgent, createPaybondToolRegistry, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, resolveAgentPolicySource, wrapPaybondTools, } from "./agent/index.js";
 import { GatewayAgentRunTraceReporter, } from "./agent/gateway-trace-reporter.js";
+import { fetchWithGatewayRetries, gatewayRetryDelayMs, shouldRetryGatewayResponse, } from "./gateway-retry.js";
 import { parsePolicyRemoteValidateResponse, policyValidateQueryString, } from "./policy/validate-remote.js";
 import { parsePolicyEffectiveResolveResponse, } from "./policy/load-effective.js";
 import { paybondPolicyPresets } from "./policy/policy-api.js";
@@ -187,19 +188,6 @@ function protocolHTTPErrorMessage(prefix, statusCode, bodyText) {
 function normalizeBase(url) {
     return requireSecureGatewayUrl(url);
 }
-function backoffMs(attempt) {
-    const base = 200 * 2 ** attempt;
-    const jitter = Math.random() * 100;
-    return Math.min(base + jitter, 5000);
-}
-function parseRetryAfterSeconds(v) {
-    if (!v)
-        return null;
-    const n = Number.parseFloat(v.trim());
-    if (!Number.isFinite(n))
-        return null;
-    return Math.min(n, 30);
-}
 function normalizeExpectedEnvironment(value) {
     if (value === undefined)
         return null;
@@ -462,16 +450,17 @@ export class HarborClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -494,16 +483,17 @@ export class HarborClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 if (retryBodyText !== undefined) {
                     init = {
                         ...init,
@@ -804,28 +794,7 @@ export class GatewayHarborClient {
         return headers;
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries)
-                    throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     async postJSON(path, payload, extraHeaders) {
         return this.requestJSON("POST", path, payload, extraHeaders);
@@ -1052,28 +1021,7 @@ export class PaybondGuardrails {
         return headers;
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries)
-                    throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     async postJSON(path, payload, options) {
         const url = `${this.base}${path.replace(/^\/+/, "")}`;
@@ -1118,7 +1066,7 @@ export class PaybondGuardrails {
         }
         const { res, text, url } = await this.postJSON("/v1/sandbox/guardrails/bootstrap", payload, { idempotencyKey: input.idempotencyKey });
         if (!res.ok) {
-            throw new HarborHttpError(`Gateway sandbox guardrail bootstrap HTTP ${res.status}: ${text}`, {
+            throw new HarborHttpError(`Gateway sandbox guardrail bootstrap HTTP ${res.status}`, {
                 statusCode: res.status,
                 url,
                 bodyText: text,
@@ -1153,7 +1101,7 @@ export class PaybondGuardrails {
         }
         const { res, text, url } = await this.postJSON(`/v1/sandbox/guardrails/${encodeURIComponent(input.intentId)}/evidence`, payload, { idempotencyKey: input.idempotencyKey });
         if (!res.ok) {
-            throw new HarborHttpError(`Gateway sandbox guardrail evidence HTTP ${res.status}: ${text}`, {
+            throw new HarborHttpError(`Gateway sandbox guardrail evidence HTTP ${res.status}`, {
                 statusCode: res.status,
                 url,
                 bodyText: text,
@@ -1433,16 +1381,17 @@ export class GatewaySignalClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1594,16 +1543,17 @@ export class GatewayFraudClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1875,16 +1825,17 @@ export class GatewayA2AClient {
                 lastErr = e;
                 if (attempt + 1 >= this.maxRetries)
                     throw e;
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
                 continue;
             }
             if ([429, 500, 502, 503, 504].includes(res.status)) {
                 if (attempt + 1 >= this.maxRetries) {
                     return res;
                 }
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                if (!(await shouldRetryGatewayResponse(res))) {
+                    return res;
+                }
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             return res;
@@ -1944,29 +1895,7 @@ export class GatewayProtocolClient {
         this.maxRetries = Math.max(1, init?.maxRetries ?? 3);
     }
     async fetchWithRetries(url, init) {
-        let lastErr;
-        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
-            let res;
-            try {
-                res = await fetch(url, init);
-            }
-            catch (e) {
-                lastErr = e;
-                if (attempt + 1 >= this.maxRetries) {
-                    throw e;
-                }
-                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
-                continue;
-            }
-            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
-                continue;
-            }
-            return res;
-        }
-        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+        return fetchWithGatewayRetries(url, init, this.maxRetries);
     }
     headers(extra) {
         const headers = new Headers(extra);
@@ -2132,15 +2061,13 @@ async function resolveGatewayTenantId(gatewayBaseUrl, apiKey, principalPath, max
             if (attempt + 1 >= maxRetries) {
                 throw e;
             }
-            await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+            await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, null)));
             continue;
         }
         const text = await res.text();
         if (!res.ok) {
             if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < maxRetries) {
-                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
-                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
-                await new Promise((r) => setTimeout(r, delayMs));
+                await new Promise((r) => setTimeout(r, gatewayRetryDelayMs(attempt, res.headers.get("retry-after"))));
                 continue;
             }
             throw new GatewayAuthError(`gateway principal HTTP ${res.status}`, {
@@ -2397,7 +2324,7 @@ export class Paybond {
 }
 export { normalizeJson, jsonValueDigest } from "./json-digest.js";
 export { buildSignedCreateIntentBody, buildSignedCreateIntentBodyWithPolicyBinding, intentCreationSignBytesRaw, intentCreationSignBytesWithPolicyBinding, } from "./principal-intent.js";
-export { artifactsDigest, signPayeeEvidenceBinding } from "./payee-evidence.js";
+export { artifactsDigest, evidenceSignBytesV1, signPayeeEvidenceBinding, } from "./payee-evidence.js";
 export { AGENT_RECOGNITION_GATEWAY_VERIFIER_ID, AGENT_RECOGNITION_PROOF_KIND_V1, AGENT_RECOGNITION_PURPOSE_EVIDENCE_SUBMIT, newAgentRecognitionRequestEnvelope, signAgentRecognitionProofV1, signHarborEvidenceSubmitRecognitionProof, } from "./agent-recognition.js";
 export { validateCompletionEvidence, } from "./completion-validate-evidence.js";
 export { completionSchemaDigestHex, computeVendorContractDigests, verifyVendorContract, verifyCatalogVendorContracts, } from "./completion-contract-digest.js";

package/dist/mcp-server.js

@@ -5,7 +5,7 @@ import fs from "node:fs/promises";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { requireSecureGatewayUrl } from "./gateway-url.js";
-import { runCli } from "./cli/router.js";
+import { deprecatedAliasWarning } from "./cli/automation.js";
 import { redactSensitiveFields } from "./cli/redact.js";
 import { MCP_TOOL_ALLOWLIST_ENV, MCP_TOOL_POLICY_ENV, mergeMcpToolPolicy, parseMcpToolAllowlist, parseMcpToolPolicy, resolveMcpToolPolicy, toolAllowedByPolicy, } from "./cli/mcp-policy.js";
 import { MCP_EVIDENCE_POLICY_ENV, McpEvidenceValidationGate, completionEvidenceValidationOk, extractHarborEvidenceValidationInput, extractSandboxGuardrailValidationInput, parseMcpEvidencePolicy, } from "./mcp-evidence-policy.js";
@@ -13,7 +13,7 @@ import { McpCapabilityTokenCache, mcpToolStoresCapabilityToken, parseMcpCapabili
 import { createMcpPolicyGatewayAdapter, McpPolicyReloadGate, parseMcpPolicyReloadConfig, } from "./mcp-policy-reload.js";
 import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.11.5";
+const SERVER_VERSION = "0.11.7";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
 const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";
@@ -1697,12 +1697,11 @@ invokedFromCLI().then((invoked) => {
     if (!invoked) {
         return;
     }
-    runCli(["mcp", "serve", ...process.argv.slice(2)]).then((code) => {
-        process.exitCode = code;
-    }, (err) => {
-        process.stderr.write(`${formatError(err)}\n`);
-        process.exitCode = 1;
-    });
+    const aliasWarning = deprecatedAliasWarning(process.argv[1]);
+    if (aliasWarning) {
+        process.stderr.write(`${aliasWarning}\n`);
+    }
+    process.exitCode = main(process.argv.slice(2));
 }, (err) => {
     process.stderr.write(`${formatError(err)}\n`);
     process.exitCode = 1;

package/dist/payee-evidence.d.ts

@@ -3,6 +3,15 @@
  */
 /** BLAKE3 digest of concatenated artifact hashes (empty list matches Harbor / `paybond-evidence`). */
 export declare function artifactsDigest(artifactHashes32: Uint8Array[]): Uint8Array;
+/** Canonical EvidenceSignV1 signing bytes (matches `paybond-evidence` / gateway binwire). */
+export declare function evidenceSignBytesV1(input: {
+    tenantId: string;
+    intentId: string;
+    payeeDid: string;
+    payload: Record<string, unknown>;
+    artifactsBlake3Hex: string[];
+    submittedAtRfc3339: string;
+}): Uint8Array;
 export type SignPayeeEvidenceParams = {
     tenantId: string;
     intentId: string;

package/dist/payee-evidence.js

@@ -18,6 +18,18 @@ export function artifactsDigest(artifactHashes32) {
 function encodeEvidenceSignV1(input) {
     return concatBytes(encodeU8(EVIDENCE_SIGN_VERSION), encodeBincodeString(input.tenantId), encodeBincodeUuid(input.intentId), encodeBincodeString(input.payeeDid), encodeFixed32(input.payloadDigest), encodeFixed32(input.artifactsDigest), encodeBincodeString(input.submittedAtRfc3339));
 }
+/** Canonical EvidenceSignV1 signing bytes (matches `paybond-evidence` / gateway binwire). */
+export function evidenceSignBytesV1(input) {
+    const artifactBin = input.artifactsBlake3Hex.map((h) => hexToBytes(h));
+    return encodeEvidenceSignV1({
+        tenantId: input.tenantId,
+        intentId: input.intentId,
+        payeeDid: input.payeeDid,
+        payloadDigest: jsonValueDigest(input.payload),
+        artifactsDigest: artifactsDigest(artifactBin),
+        submittedAtRfc3339: input.submittedAtRfc3339,
+    });
+}
 function bytesToBase64(bytes) {
     let binary = "";
     for (let i = 0; i < bytes.length; i++)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.5",
+  "version": "0.11.7",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",
@@ -117,6 +117,7 @@
     "test": "vitest run",
     "pack:dry-run": "npm pack --dry-run",
     "verify:release": "node ./scripts/verify-release.mjs",
+    "verify:template-locks": "node ./scripts/verify-template-lock-integrity.mjs",
     "prepack": "npm run build"
   },
   "peerDependencies": {

package/templates/manifest.json

@@ -13,7 +13,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "@langchain/core": "^1.2.1",
         "@langchain/langgraph": "^1.4.7",
         "zod": "^4.2.0"
@@ -33,7 +33,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "ai": "^5.0.0",
         "zod": "^4.2.0"
       },
@@ -52,7 +52,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -71,7 +71,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 4500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "@openai/agents": "^0.4.0",
         "zod": "^4.2.0"
       },
@@ -90,7 +90,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 18700 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
         "zod": "^4.2.0"
       },
@@ -110,7 +110,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5"
+        "@paybond/kit": "^0.11.7"
       },
       "mcp_tool_policy": "spend-write"
     },
@@ -127,7 +127,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12000 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5"
+        "@paybond/kit": "^0.11.7"
       },
       "demo_mode": "generic"
     },
@@ -143,7 +143,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 12500 },
       "dependencies": {
-        "@paybond/kit": "^0.11.5"
+        "@paybond/kit": "^0.11.7"
       },
       "demo_mode": "generic"
     },
@@ -159,7 +159,7 @@
       "evidence_preset": "cost_and_completion",
       "smoke_result_body": { "status": "completed", "cost_cents": 2900 },
       "python_dependencies": {
-        "paybond-kit": ">=0.11.5",
+        "paybond-kit": ">=0.11.7",
         "langgraph": ">=1.2.0"
       },
       "demo_import": "paybond_kit.langgraph_sandbox_demo",

package/templates/openai-shopping-agent/package-lock.json

@@ -7,7 +7,7 @@
       "name": "openai-shopping-agent",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.5.tgz",
-      "integrity": "sha512-Xaw0LnF/0iP7tEYqrNk/KtIjAFhBvVPezIItKeU30IZfIEnaW8iPMryw74r0IatL9uby2Ax06Icid1N5u8IaSg==",
+      "version": "0.11.7",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.7.tgz",
+      "integrity": "sha512-wAVwT7CklrzUKjK+qVKbrxT88hW9xvDBg2tDUl75b2xt57kf9Bv8K0z+fdA0HTgGpJGdjuQRuYbzeSIAiWUgNA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -829,9 +829,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {

package/templates/openai-shopping-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation commerce.checkout --requested-spend-cents 4500 --result-body '{\"status\":\"completed\",\"cost_cents\":4500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.5",
+    "@paybond/kit": "^0.11.7",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },

package/templates/paybond-aws-operator/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-aws-operator",
       "dependencies": {
-        "@paybond/kit": "^0.11.5"
+        "@paybond/kit": "^0.11.7"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.5.tgz",
-      "integrity": "sha512-rU45zNsuIKzkL1YhHu5q9Mg79GSoiYg5fii+Rv4jk/4y9MDQfvn+MZAUR52Uzr71z1vBkqBo3NxgSmtQDtNDew==",
+      "version": "0.11.7",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.7.tgz",
+      "integrity": "sha512-wAVwT7CklrzUKjK+qVKbrxT88hW9xvDBg2tDUl75b2xt57kf9Bv8K0z+fdA0HTgGpJGdjuQRuYbzeSIAiWUgNA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-aws-operator/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation aws.ec2.start_instance --requested-spend-cents 12500 --result-body '{\"status\":\"completed\",\"cost_cents\":12500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.5"
+    "@paybond/kit": "^0.11.7"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-claude-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-claude-agents-demo",
       "dependencies": {
         "@anthropic-ai/claude-agent-sdk": "^0.2.100",
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -260,9 +260,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.5.tgz",
-      "integrity": "sha512-7rWc4Qn9s1ufEsL5XcqptmgYt/+kMnp+rWvLWOsG+kif9hgjPwVwq5OfEhiWFmwFxKaseBvY95KDPcHDJgmP5A==",
+      "version": "0.11.7",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.7.tgz",
+      "integrity": "sha512-wAVwT7CklrzUKjK+qVKbrxT88hW9xvDBg2tDUl75b2xt57kf9Bv8K0z+fdA0HTgGpJGdjuQRuYbzeSIAiWUgNA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -875,9 +875,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
         "safer-buffer": ">= 2.1.2 < 3.0.0"

package/templates/paybond-claude-agents-demo/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation travel.book_hotel --requested-spend-cents 18700 --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.5",
+    "@paybond/kit": "^0.11.7",
     "@anthropic-ai/claude-agent-sdk": "^0.2.100",
     "zod": "^4.2.0"
   },

package/templates/paybond-invoice-agent/requirements.txt

@@ -1,2 +1,2 @@
-paybond-kit>=0.11.5
+paybond-kit>=0.11.7
 langgraph>=1.2.0

package/templates/paybond-mcp-coding-agent/package-lock.json

@@ -6,7 +6,7 @@
     "": {
       "name": "paybond-mcp-coding-agent",
       "dependencies": {
-        "@paybond/kit": "^0.11.5"
+        "@paybond/kit": "^0.11.7"
       },
       "devDependencies": {
         "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.5.tgz",
-      "integrity": "sha512-2FMq8b++6AmgcICEfUzYnW3w2FqAjgbT9b0bslW0Fm9e5QNGbc7HwcXkVVzqJGqPySs4Ht8NtePrdEuliT0TXA==",
+      "version": "0.11.7",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.7.tgz",
+      "integrity": "sha512-wAVwT7CklrzUKjK+qVKbrxT88hW9xvDBg2tDUl75b2xt57kf9Bv8K0z+fdA0HTgGpJGdjuQRuYbzeSIAiWUgNA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",

package/templates/paybond-mcp-coding-agent/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation deploy.preview --requested-spend-cents 500 --result-body '{\"status\":\"completed\",\"cost_cents\":500}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.5"
+    "@paybond/kit": "^0.11.7"
   },
   "devDependencies": {
     "@types/node": "^22.10.1",

package/templates/paybond-openai-agents-demo/package-lock.json

@@ -7,7 +7,7 @@
       "name": "paybond-openai-agents-demo",
       "dependencies": {
         "@openai/agents": "^0.4.0",
-        "@paybond/kit": "^0.11.5",
+        "@paybond/kit": "^0.11.7",
         "zod": "^4.2.0"
       },
       "devDependencies": {
@@ -169,9 +169,9 @@
       }
     },
     "node_modules/@paybond/kit": {
-      "version": "0.11.5",
-      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.5.tgz",
-      "integrity": "sha512-zDczNvZilk/4F1GBxCrExbSItw+E0ZlSvhSVLx9HQb8p2pYnKoA7ceapxuzXPKAc46grFyj6sXTKKob7qMtDyQ==",
+      "version": "0.11.7",
+      "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.11.7.tgz",
+      "integrity": "sha512-wAVwT7CklrzUKjK+qVKbrxT88hW9xvDBg2tDUl75b2xt57kf9Bv8K0z+fdA0HTgGpJGdjuQRuYbzeSIAiWUgNA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@noble/ed25519": "^2.2.1",
@@ -829,9 +829,9 @@
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.2.tgz",
-      "integrity": "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "optional": true,
       "dependencies": {

package/templates/paybond-openai-agents-demo/package.json

@@ -8,7 +8,7 @@
     "smoke": "paybond agent sandbox smoke --policy-file paybond.policy.yaml --operation saas.provision_seat --requested-spend-cents 2900 --result-body '{\"status\":\"completed\",\"cost_cents\":2900}' --format json"
   },
   "dependencies": {
-    "@paybond/kit": "^0.11.5",
+    "@paybond/kit": "^0.11.7",
     "@openai/agents": "^0.4.0",
     "zod": "^4.2.0"
   },