@paybond/kit 0.12.2 → 0.12.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/dist/mcp-server.d.ts +4 -0
  2. package/dist/mcp-server.js +44 -3
  3. package/package.json +1 -1
  4. package/templates/openai-shopping-agent/package-lock.json +4 -4
  5. package/templates/paybond-aws-operator/package-lock.json +4 -4
  6. package/templates/paybond-claude-agents-demo/package-lock.json +4 -4
  7. package/templates/paybond-mastra-travel-agent/package-lock.json +4 -4
  8. package/templates/paybond-mcp-coding-agent/package-lock.json +4 -4
  9. package/templates/paybond-openai-agents-demo/package-lock.json +4 -4
  10. package/templates/paybond-procurement-agent/package-lock.json +4 -4
  11. package/templates/paybond-shopify-shopping-agent/package-lock.json +4 -4
  12. package/templates/paybond-stripe-agent-demo/package-lock.json +4 -4
  13. package/templates/paybond-travel-agent/package-lock.json +4 -4
  14. package/templates/paybond-vercel-shopping-agent/package-lock.json +4 -4
package/dist/mcp-server.d.ts CHANGED
@@ -38,11 +38,15 @@ export type PaybondMCPSettings = {
38
38
  capabilityTokenCache?: McpCapabilityTokenCacheConfig;
39
39
  };
40
40
  export declare function formatMcpStdioFrame(response: JSONRPCResponse): string;
41
+ /** Newline-delimited JSON-RPC frame used by mcp-proxy and recent MCP SDKs. */
42
+ export declare function formatMcpNdjsonFrame(response: JSONRPCResponse): string;
41
43
  export declare class PaybondMCPServer {
42
44
  private readonly runtime;
43
45
  private readonly tools;
44
46
  private readonly toolPolicy;
45
47
  private initialized;
48
+ /** Framing negotiated from the first successfully parsed stdin message. */
49
+ private stdioFraming;
46
50
  constructor(settings: PaybondMCPSettings);
47
51
  listResourceTemplates(): Array<Record<string, unknown>>;
48
52
  readResource(uri: string): Promise<{
package/dist/mcp-server.js CHANGED
@@ -15,7 +15,7 @@ import { verifyAgentReceiptV1FromJSON } from "./agent-receipt.js";
15
15
  import { agentReceiptResourceTemplateDefinition, agentReceiptResourceUri, MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE, parseAgentReceiptResourceUri, } from "./mcp-receipt-resource.js";
16
16
  import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
17
17
  const SERVER_NAME = "Paybond MCP";
18
- const SERVER_VERSION = "0.12.2";
18
+ const SERVER_VERSION = "0.12.3";
19
19
  const MCP_PROTOCOL_VERSION = "2025-11-25";
20
20
  const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
21
21
  const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";
@@ -904,11 +904,17 @@ export function formatMcpStdioFrame(response) {
904
904
  const body = JSON.stringify(response);
905
905
  return `Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n\r\n${body}`;
906
906
  }
907
+ /** Newline-delimited JSON-RPC frame used by mcp-proxy and recent MCP SDKs. */
908
+ export function formatMcpNdjsonFrame(response) {
909
+ return `${JSON.stringify(response)}\n`;
910
+ }
907
911
  export class PaybondMCPServer {
908
912
  runtime;
909
913
  tools;
910
914
  toolPolicy;
911
915
  initialized = false;
916
+ /** Framing negotiated from the first successfully parsed stdin message. */
917
+ stdioFraming = "content-length";
912
918
  constructor(settings) {
913
919
  if (!settings.apiKey.trim()) {
914
920
  throw new Error("PAYBOND_API_KEY is required");
@@ -1109,7 +1115,11 @@ export class PaybondMCPServer {
1109
1115
  runStdio() {
1110
1116
  let buffer = Buffer.alloc(0);
1111
1117
  process.stdin.on("data", (chunk) => {
1112
- buffer = Buffer.concat([buffer, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf8")]);
1118
+ buffer = Buffer.concat([
1119
+ buffer,
1120
+ Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk, "utf8"),
1121
+ ]);
1122
+ // Prefer Content-Length frames when present (LSP-style MCP hosts).
1113
1123
  while (true) {
1114
1124
  const headerEnd = buffer.indexOf("\r\n\r\n");
1115
1125
  if (headerEnd < 0) {
@@ -1131,8 +1141,36 @@ export class PaybondMCPServer {
1131
1141
  }
1132
1142
  const body = buffer.subarray(bodyStart, frameEnd).toString("utf8");
1133
1143
  buffer = buffer.subarray(frameEnd);
1144
+ this.stdioFraming = "content-length";
1134
1145
  void this.handleLine(body);
1135
1146
  }
1147
+ // Do not let NDJSON parsing consume an in-progress Content-Length frame.
1148
+ const preview = buffer
1149
+ .subarray(0, Math.min(buffer.length, 64))
1150
+ .toString("utf8")
1151
+ .trimStart()
1152
+ .toLowerCase();
1153
+ if (preview.startsWith("content-length:")) {
1154
+ return;
1155
+ }
1156
+ // Newline-delimited JSON-RPC (mcp-proxy / recent MCP SDKs).
1157
+ while (true) {
1158
+ const newline = buffer.indexOf("\n");
1159
+ if (newline < 0) {
1160
+ break;
1161
+ }
1162
+ const rawLine = buffer
1163
+ .subarray(0, newline)
1164
+ .toString("utf8")
1165
+ .replace(/\r$/, "");
1166
+ buffer = buffer.subarray(newline + 1);
1167
+ const line = rawLine.trim();
1168
+ if (!line.startsWith("{")) {
1169
+ continue;
1170
+ }
1171
+ this.stdioFraming = "ndjson";
1172
+ void this.handleLine(line);
1173
+ }
1136
1174
  });
1137
1175
  process.stdin.on("end", () => {
1138
1176
  if (buffer.length > 0) {
@@ -1156,7 +1194,10 @@ export class PaybondMCPServer {
1156
1194
  }
1157
1195
  }
1158
1196
  writeResponse(response) {
1159
- process.stdout.write(formatMcpStdioFrame(response));
1197
+ const frame = this.stdioFraming === "ndjson"
1198
+ ? formatMcpNdjsonFrame(response)
1199
+ : formatMcpStdioFrame(response);
1200
+ process.stdout.write(frame);
1160
1201
  }
1161
1202
  buildTools(settings) {
1162
1203
  const tools = [
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@paybond/kit",
3
- "version": "0.12.2",
3
+ "version": "0.12.3",
4
4
  "mcpName": "io.github.nonameuserd/paybond",
5
5
  "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
6
6
  "license": "Apache-2.0",
package/templates/openai-shopping-agent/package-lock.json CHANGED
@@ -7,7 +7,7 @@
7
7
  "name": "openai-shopping-agent",
8
8
  "dependencies": {
9
9
  "@openai/agents": "^0.4.0",
10
- "@paybond/kit": "^0.12.2",
10
+ "@paybond/kit": "^0.12.3",
11
11
  "zod": "^4.2.0"
12
12
  },
13
13
  "devDependencies": {
@@ -169,9 +169,9 @@
169
169
  }
170
170
  },
171
171
  "node_modules/@paybond/kit": {
172
- "version": "0.12.2",
173
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
174
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
172
+ "version": "0.12.3",
173
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
174
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
175
175
  "license": "Apache-2.0",
176
176
  "dependencies": {
177
177
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-aws-operator/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-aws-operator",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.2"
9
+ "@paybond/kit": "^0.12.3"
10
10
  },
11
11
  "devDependencies": {
12
12
  "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
47
47
  }
48
48
  },
49
49
  "node_modules/@paybond/kit": {
50
- "version": "0.12.2",
51
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
52
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
50
+ "version": "0.12.3",
51
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
52
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
53
53
  "license": "Apache-2.0",
54
54
  "dependencies": {
55
55
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-claude-agents-demo/package-lock.json CHANGED
@@ -7,7 +7,7 @@
7
7
  "name": "paybond-claude-agents-demo",
8
8
  "dependencies": {
9
9
  "@anthropic-ai/claude-agent-sdk": "^0.2.100",
10
- "@paybond/kit": "^0.12.2",
10
+ "@paybond/kit": "^0.12.3",
11
11
  "zod": "^4.2.0"
12
12
  },
13
13
  "devDependencies": {
@@ -260,9 +260,9 @@
260
260
  }
261
261
  },
262
262
  "node_modules/@paybond/kit": {
263
- "version": "0.12.2",
264
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
265
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
263
+ "version": "0.12.3",
264
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
265
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
266
266
  "license": "Apache-2.0",
267
267
  "dependencies": {
268
268
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-mastra-travel-agent/package-lock.json CHANGED
@@ -7,7 +7,7 @@
7
7
  "name": "paybond-mastra-travel-agent",
8
8
  "dependencies": {
9
9
  "@mastra/core": "^1.49.0",
10
- "@paybond/kit": "^0.12.2",
10
+ "@paybond/kit": "^0.12.3",
11
11
  "zod": "^4.2.0"
12
12
  },
13
13
  "devDependencies": {
@@ -412,9 +412,9 @@
412
412
  }
413
413
  },
414
414
  "node_modules/@paybond/kit": {
415
- "version": "0.12.2",
416
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
417
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
415
+ "version": "0.12.3",
416
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
417
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
418
418
  "license": "Apache-2.0",
419
419
  "dependencies": {
420
420
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-mcp-coding-agent/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-mcp-coding-agent",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.2"
9
+ "@paybond/kit": "^0.12.3"
10
10
  },
11
11
  "devDependencies": {
12
12
  "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
47
47
  }
48
48
  },
49
49
  "node_modules/@paybond/kit": {
50
- "version": "0.12.2",
51
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
52
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
50
+ "version": "0.12.3",
51
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
52
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
53
53
  "license": "Apache-2.0",
54
54
  "dependencies": {
55
55
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-openai-agents-demo/package-lock.json CHANGED
@@ -7,7 +7,7 @@
7
7
  "name": "paybond-openai-agents-demo",
8
8
  "dependencies": {
9
9
  "@openai/agents": "^0.4.0",
10
- "@paybond/kit": "^0.12.2",
10
+ "@paybond/kit": "^0.12.3",
11
11
  "zod": "^4.2.0"
12
12
  },
13
13
  "devDependencies": {
@@ -169,9 +169,9 @@
169
169
  }
170
170
  },
171
171
  "node_modules/@paybond/kit": {
172
- "version": "0.12.2",
173
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
174
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
172
+ "version": "0.12.3",
173
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
174
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
175
175
  "license": "Apache-2.0",
176
176
  "dependencies": {
177
177
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-procurement-agent/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-procurement-agent",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.2"
9
+ "@paybond/kit": "^0.12.3"
10
10
  },
11
11
  "devDependencies": {
12
12
  "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
47
47
  }
48
48
  },
49
49
  "node_modules/@paybond/kit": {
50
- "version": "0.12.2",
51
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
52
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
50
+ "version": "0.12.3",
51
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
52
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
53
53
  "license": "Apache-2.0",
54
54
  "dependencies": {
55
55
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-shopify-shopping-agent/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-shopify-shopping-agent",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.2"
9
+ "@paybond/kit": "^0.12.3"
10
10
  },
11
11
  "devDependencies": {
12
12
  "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
47
47
  }
48
48
  },
49
49
  "node_modules/@paybond/kit": {
50
- "version": "0.12.2",
51
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
52
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
50
+ "version": "0.12.3",
51
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
52
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
53
53
  "license": "Apache-2.0",
54
54
  "dependencies": {
55
55
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-stripe-agent-demo/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-stripe-agent-demo",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.1"
9
+ "@paybond/kit": "^0.12.2"
10
10
  },
11
11
  "devDependencies": {
12
12
  "@types/node": "^22.10.1",
@@ -47,9 +47,9 @@
47
47
  }
48
48
  },
49
49
  "node_modules/@paybond/kit": {
50
- "version": "0.12.1",
51
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.1.tgz",
52
- "integrity": "sha512-dwLMq8MkuLiuWQrXy1AtFR++tom14hkpKYGe4koiPyGKu2LQyOHtresZQ6IDoC7HAUSyDWEilg0maAPslKnm+Q==",
50
+ "version": "0.12.2",
51
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
52
+ "integrity": "sha512-oUCxOWvlTYe4W8dhsAT3we1ocuhSm1erILVD0BWNlUt11KkcViw0ifwcoYdj1dxUpISEcD+QjOVQUJ0g+kkAUw==",
53
53
  "license": "Apache-2.0",
54
54
  "dependencies": {
55
55
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-travel-agent/package-lock.json CHANGED
@@ -8,7 +8,7 @@
8
8
  "dependencies": {
9
9
  "@langchain/core": "^1.2.1",
10
10
  "@langchain/langgraph": "^1.4.7",
11
- "@paybond/kit": "^0.12.2",
11
+ "@paybond/kit": "^0.12.3",
12
12
  "zod": "^4.2.0"
13
13
  },
14
14
  "devDependencies": {
@@ -178,9 +178,9 @@
178
178
  }
179
179
  },
180
180
  "node_modules/@paybond/kit": {
181
- "version": "0.12.2",
182
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
183
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
181
+ "version": "0.12.3",
182
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
183
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
184
184
  "license": "Apache-2.0",
185
185
  "dependencies": {
186
186
  "@noble/ed25519": "^2.2.1",
package/templates/paybond-vercel-shopping-agent/package-lock.json CHANGED
@@ -6,7 +6,7 @@
6
6
  "": {
7
7
  "name": "paybond-vercel-shopping-agent",
8
8
  "dependencies": {
9
- "@paybond/kit": "^0.12.2",
9
+ "@paybond/kit": "^0.12.3",
10
10
  "ai": "^5.0.0",
11
11
  "zod": "^4.2.0"
12
12
  },
@@ -104,9 +104,9 @@
104
104
  }
105
105
  },
106
106
  "node_modules/@paybond/kit": {
107
- "version": "0.12.2",
108
- "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.2.tgz",
109
- "integrity": "sha512-so7XNbfEfUH2XZZ9JBHmWST2kjQXaoptyhi8p5rPllMO//8LT5lxpar0R028qAZKxU1y8cbj4kBMXy4lR0m05w==",
107
+ "version": "0.12.3",
108
+ "resolved": "https://registry.npmjs.org/@paybond/kit/-/kit-0.12.3.tgz",
109
+ "integrity": "sha512-D2HRZbUoAdJnlGaPYkvAeCs9hKqPxW7CRFjcST+TC+feSvbZzLmZ8KyF6YZb7oQSp0qBeovWwDGKBRoxgD50bg==",
110
110
  "license": "Apache-2.0",
111
111
  "dependencies": {
112
112
  "@noble/ed25519": "^2.2.1",