@paybond/kit 0.12.4 → 0.12.6

package/dist/agent-receipt.js

@@ -14,10 +14,19 @@ export const AGENT_RECEIPT_SIGNING_KEYS_WELL_KNOWN_PATH = "/.well-known/agent-re
 export const PAYBOND_AGENT_RECEIPT_ATTESTATIONS_HEADER = "x-paybond-agent-receipt-attestations";
 /** Optional agent run id bound to the attestation header for server-side audit. */
 export const PAYBOND_AGENT_RECEIPT_SOURCE_RUN_HEADER = "x-paybond-agent-run-id";
+/** AP2 signed-mandate digest kind promoted into authorization.mandate_digest_sha256_hex. */
+export const EXTERNAL_ATTESTATION_KIND_AGENT_MANDATE_V1 = "agent_mandate_v1";
+export const SETTLEMENT_OUTCOME_SETTLED = "SETTLED";
+export const SETTLEMENT_OUTCOME_PENDING_FINALITY = "PENDING_FINALITY";
+export const SETTLEMENT_OUTCOME_REVERSED = "REVERSED";
+export const SETTLEMENT_OUTCOME_FAILED = "FAILED";
 const SCOPE_TOKEN_RE = /^[a-z0-9][a-z0-9._:/-]{0,127}$/;
 const HEX64_RE = /^[0-9a-f]{64}$/;
 const CURRENCY_RE = /^[a-z]{3}$/;
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+export const AGENT_RECEIPT_VALIDITY_TIER_OPERATIONAL = "operational";
+export const AGENT_RECEIPT_VALIDITY_TIER_PRIMARY = "primary";
+export const AGENT_RECEIPT_VALIDITY_TIER_ATTESTED = "attested";
 function sha256Hex(data) {
     return createHash("sha256").update(data).digest("hex");
 }
@@ -125,9 +134,10 @@ function normalizeReceipt(receipt) {
         throw new Error("agent receipt: tenant_id is required");
     }
     const authorization = normalizeAuthorization(receipt.authorization);
-    const outcome = normalizeOutcome(receipt.outcome);
     const references = normalizeReferences(receipt.references);
     const externalAttestations = normalizeExternalAttestations(receipt.external_attestations ?? []);
+    verifyMandateAuthorizationConsistency(authorization, externalAttestations);
+    const outcome = normalizeOutcome(receipt.outcome, scope);
     let execution;
     if (scope === AGENT_RECEIPT_SCOPE_ACTION) {
         if (!receipt.execution) {
@@ -151,6 +161,7 @@ function normalizeReceipt(receipt) {
         outcome,
         references,
         external_attestations: externalAttestations,
+        continuity: receipt.continuity ? normalizeContinuity(receipt.continuity, execution) : undefined,
         operator_attestation: receipt.operator_attestation
             ? normalizeOperatorAttestation(receipt.operator_attestation)
             : undefined,
@@ -162,6 +173,32 @@ function normalizeReceipt(receipt) {
     verifyReceiptId(normalized);
     return normalized;
 }
+function normalizeContinuity(continuity, execution) {
+    const runId = continuity.run_id.trim().toLowerCase();
+    if (!UUID_RE.test(runId)) {
+        throw new Error("agent receipt: continuity.run_id must be a canonical UUID");
+    }
+    if (!Number.isInteger(continuity.sequence_number) || continuity.sequence_number < 1) {
+        throw new Error("agent receipt: continuity.sequence_number must be an integer >= 1");
+    }
+    const prev = continuity.prev_message_digest_sha256_hex?.trim().toLowerCase() ?? "";
+    if (continuity.sequence_number === 1) {
+        if (prev) {
+            throw new Error("agent receipt: continuity.sequence_number 1 must not set prev_message_digest_sha256_hex");
+        }
+    }
+    else {
+        requireHex64(prev, "continuity.prev_message_digest_sha256_hex");
+    }
+    if (execution && execution.run_id !== runId) {
+        throw new Error("agent receipt: continuity.run_id must match execution.run_id");
+    }
+    return {
+        ...(prev ? { prev_message_digest_sha256_hex: prev } : {}),
+        sequence_number: continuity.sequence_number,
+        run_id: runId,
+    };
+}
 function normalizeOperatorAttestation(attestation) {
     const operatorDid = attestation.operator_did.trim();
     if (!operatorDid) {
@@ -190,6 +227,20 @@ function normalizeAuthorization(authorization) {
     if (authorization.requested_spend_cents < 0) {
         throw new Error("agent receipt: requested_spend_cents must be non-negative");
     }
+    let mandateDigest;
+    if (authorization.mandate_digest_sha256_hex) {
+        mandateDigest = authorization.mandate_digest_sha256_hex.trim().toLowerCase();
+        requireHex64(mandateDigest, "mandate_digest_sha256_hex");
+    }
+    const mandateReferenceId = authorization.mandate_reference_id?.trim() || undefined;
+    if (mandateReferenceId && !mandateDigest) {
+        throw new Error("agent receipt: mandate_reference_id requires mandate_digest_sha256_hex");
+    }
+    let zkPolicyProofDigest;
+    if (authorization.zk_policy_proof_digest_sha256_hex) {
+        zkPolicyProofDigest = authorization.zk_policy_proof_digest_sha256_hex.trim().toLowerCase();
+        requireHex64(zkPolicyProofDigest, "zk_policy_proof_digest_sha256_hex");
+    }
     return {
         principal_did: principalDid,
         actor_subject: actorSubject,
@@ -201,6 +252,9 @@ function normalizeAuthorization(authorization) {
         requested_spend_cents: authorization.requested_spend_cents,
         currency,
         reason_codes: normalizeScopeSet(authorization.reason_codes, "reason_codes"),
+        ...(mandateDigest ? { mandate_digest_sha256_hex: mandateDigest } : {}),
+        ...(mandateReferenceId ? { mandate_reference_id: mandateReferenceId } : {}),
+        ...(zkPolicyProofDigest ? { zk_policy_proof_digest_sha256_hex: zkPolicyProofDigest } : {}),
     };
 }
 function normalizeAgent(agent) {
@@ -255,6 +309,11 @@ function normalizeExecution(execution) {
     if ((execution.duration_ms ?? 0) < 0) {
         throw new Error("agent receipt: duration_ms must be non-negative");
     }
+    let teeAttestationDigest;
+    if (execution.tee_attestation_digest_sha256_hex) {
+        teeAttestationDigest = execution.tee_attestation_digest_sha256_hex.trim().toLowerCase();
+        requireHex64(teeAttestationDigest, "tee_attestation_digest_sha256_hex");
+    }
     return {
         run_id: parseUuid(execution.run_id, "run_id"),
         tool_call_id: toolCallId,
@@ -266,6 +325,7 @@ function normalizeExecution(execution) {
         started_at: formatRfc3339Seconds(execution.started_at),
         completed_at: formatRfc3339Seconds(execution.completed_at),
         duration_ms: execution.duration_ms,
+        ...(teeAttestationDigest ? { tee_attestation_digest_sha256_hex: teeAttestationDigest } : {}),
     };
 }
 function normalizeMerchant(merchant) {
@@ -321,7 +381,7 @@ function normalizePayment(payment) {
         funding_receipt_digest_sha256_hex: fundingDigest,
     };
 }
-function normalizeOutcome(outcome) {
+function normalizeOutcome(outcome, scope) {
     const harborState = normalizeScopeToken(outcome.harbor_state, "harbor_state");
     let spendReservationOutcome;
     if (outcome.spend_reservation_outcome) {
@@ -331,12 +391,49 @@ function normalizeOutcome(outcome) {
         }
         spendReservationOutcome = normalized;
     }
+    let settlementOutcome;
+    if (outcome.settlement_outcome) {
+        const normalized = outcome.settlement_outcome.trim();
+        if (![
+            SETTLEMENT_OUTCOME_SETTLED,
+            SETTLEMENT_OUTCOME_PENDING_FINALITY,
+            SETTLEMENT_OUTCOME_REVERSED,
+            SETTLEMENT_OUTCOME_FAILED,
+        ].includes(normalized)) {
+            throw new Error("agent receipt: settlement_outcome must be SETTLED, PENDING_FINALITY, REVERSED, or FAILED");
+        }
+        if (scope !== AGENT_RECEIPT_SCOPE_INTENT_TERMINAL) {
+            throw new Error("agent receipt: settlement_outcome is only valid for intent_terminal scope");
+        }
+        settlementOutcome = normalized;
+    }
     return {
         harbor_state: harborState,
         spend_reservation_outcome: spendReservationOutcome,
         predicate_passed: outcome.predicate_passed,
+        ...(settlementOutcome ? { settlement_outcome: settlementOutcome } : {}),
     };
 }
+function verifyMandateAuthorizationConsistency(authorization, attestations) {
+    const digest = authorization.mandate_digest_sha256_hex?.trim().toLowerCase() ?? "";
+    const refId = authorization.mandate_reference_id?.trim() ?? "";
+    if (!digest && !refId) {
+        return;
+    }
+    if (!digest) {
+        throw new Error("agent receipt: mandate_reference_id requires mandate_digest_sha256_hex");
+    }
+    requireHex64(digest, "mandate_digest_sha256_hex");
+    const matched = attestations.find((entry) => entry.kind.trim() === EXTERNAL_ATTESTATION_KIND_AGENT_MANDATE_V1 &&
+        entry.digest_sha256_hex.trim().toLowerCase() === digest);
+    if (!matched) {
+        throw new Error(`agent receipt: mandate_digest_sha256_hex must match an external_attestations entry of kind ${EXTERNAL_ATTESTATION_KIND_AGENT_MANDATE_V1}`);
+    }
+    const attestationRef = matched.reference_id?.trim() ?? "";
+    if (refId && refId !== attestationRef) {
+        throw new Error("agent receipt: mandate_reference_id must match the matching external_attestations reference_id");
+    }
+}
 function normalizeReferences(references) {
     if ((references.ledger_seq ?? 0) < 0) {
         throw new Error("agent receipt: ledger_seq must be non-negative");
@@ -426,6 +523,17 @@ function marshalCanonicalAgentReceipt(receipt) {
         ...(receipt.authorization.reason_codes?.length
             ? { reason_codes: receipt.authorization.reason_codes }
             : {}),
+        ...(receipt.authorization.mandate_digest_sha256_hex
+            ? { mandate_digest_sha256_hex: receipt.authorization.mandate_digest_sha256_hex }
+            : {}),
+        ...(receipt.authorization.mandate_reference_id
+            ? { mandate_reference_id: receipt.authorization.mandate_reference_id }
+            : {}),
+        ...(receipt.authorization.zk_policy_proof_digest_sha256_hex
+            ? {
+                zk_policy_proof_digest_sha256_hex: receipt.authorization.zk_policy_proof_digest_sha256_hex,
+            }
+            : {}),
     };
     const payload = {
         schema_version: receipt.schema_version,
@@ -451,6 +559,11 @@ function marshalCanonicalAgentReceipt(receipt) {
             started_at: receipt.execution.started_at,
             completed_at: receipt.execution.completed_at,
             ...(receipt.execution.duration_ms ? { duration_ms: receipt.execution.duration_ms } : {}),
+            ...(receipt.execution.tee_attestation_digest_sha256_hex
+                ? {
+                    tee_attestation_digest_sha256_hex: receipt.execution.tee_attestation_digest_sha256_hex,
+                }
+                : {}),
         };
     }
     if (receipt.merchant) {
@@ -495,6 +608,9 @@ function marshalCanonicalAgentReceipt(receipt) {
         ...(receipt.outcome.predicate_passed !== undefined
             ? { predicate_passed: receipt.outcome.predicate_passed }
             : {}),
+        ...(receipt.outcome.settlement_outcome
+            ? { settlement_outcome: receipt.outcome.settlement_outcome }
+            : {}),
     };
     payload.references = {
         intent_id: receipt.references.intent_id,
@@ -503,6 +619,15 @@ function marshalCanonicalAgentReceipt(receipt) {
     };
     payload.external_attestations =
         receipt.external_attestations.length > 0 ? receipt.external_attestations : null;
+    if (receipt.continuity) {
+        payload.continuity = {
+            ...(receipt.continuity.prev_message_digest_sha256_hex
+                ? { prev_message_digest_sha256_hex: receipt.continuity.prev_message_digest_sha256_hex }
+                : {}),
+            sequence_number: receipt.continuity.sequence_number,
+            run_id: receipt.continuity.run_id,
+        };
+    }
     return new TextEncoder().encode(JSON.stringify(payload));
 }
 /** Returns canonical signing bytes for a normalized receipt body. */
@@ -531,10 +656,165 @@ function allowsOperatorPublicKeyHex(operatorPublicKeyHex, trustedOperatorPublicK
     const normalized = operatorPublicKeyHex.trim().toLowerCase();
     return trustedOperatorPublicKeys.some((value) => value.trim().toLowerCase() === normalized);
 }
+function normalizeValidityTier(value) {
+    const normalized = (value ?? "").trim().toLowerCase();
+    switch (normalized) {
+        case "":
+        case AGENT_RECEIPT_VALIDITY_TIER_OPERATIONAL:
+            return AGENT_RECEIPT_VALIDITY_TIER_OPERATIONAL;
+        case AGENT_RECEIPT_VALIDITY_TIER_PRIMARY:
+            return AGENT_RECEIPT_VALIDITY_TIER_PRIMARY;
+        case AGENT_RECEIPT_VALIDITY_TIER_ATTESTED:
+            return AGENT_RECEIPT_VALIDITY_TIER_ATTESTED;
+        default:
+            throw new Error(`agent receipt: unknown validity_tier ${JSON.stringify(value)}`);
+    }
+}
+function requirePrimaryValidity(receipt) {
+    if (!receipt.evidence) {
+        throw new Error("agent receipt: primary validity requires evidence");
+    }
+    const digest = receipt.evidence.payee_signature_digest_sha256_hex?.trim().toLowerCase() ?? "";
+    if (!digest) {
+        throw new Error("agent receipt: primary validity requires evidence.payee_signature_digest_sha256_hex");
+    }
+    requireHex64(digest, "evidence.payee_signature_digest_sha256_hex");
+    if (receipt.payment && receipt.payment.intent_id !== receipt.references.intent_id) {
+        throw new Error("agent receipt: primary validity: payment.intent_id must match references.intent_id");
+    }
+    if (receipt.merchant &&
+        receipt.merchant.payee_did.trim() !== "" &&
+        receipt.evidence.payee_did.trim() !== "" &&
+        receipt.merchant.payee_did.trim() !== receipt.evidence.payee_did.trim()) {
+        throw new Error("agent receipt: primary validity: evidence.payee_did must match merchant.payee_did");
+    }
+}
+function requireAttestedValidity(receipt, trustedOperatorPublicKeys) {
+    if (!receipt.operator_attestation) {
+        throw new Error("agent receipt: attested validity requires operator_attestation");
+    }
+    if (!allowsOperatorPublicKeyHex(receipt.operator_attestation.signing_public_key_ed25519_hex, trustedOperatorPublicKeys)) {
+        throw new Error("agent receipt: attested validity requires operator_attestation signing key in the configured tenant operator registry");
+    }
+}
+/** Returns the highest validity tier met under the given registry options. */
+export function achievedValidityTier(receipt, options = {}) {
+    try {
+        requirePrimaryValidity(receipt);
+    }
+    catch {
+        return AGENT_RECEIPT_VALIDITY_TIER_OPERATIONAL;
+    }
+    if (receipt.operator_attestation &&
+        allowsOperatorPublicKeyHex(receipt.operator_attestation.signing_public_key_ed25519_hex, options.trustedOperatorPublicKeys)) {
+        return AGENT_RECEIPT_VALIDITY_TIER_ATTESTED;
+    }
+    return AGENT_RECEIPT_VALIDITY_TIER_PRIMARY;
+}
+/**
+ * Builds the next continuity link from a prior signed action receipt for the same run.
+ * When `prior` is omitted, returns sequence 1 with no prev digest.
+ */
+export function continuityFromPrior(runId, prior) {
+    const normalizedRunId = runId.trim().toLowerCase();
+    if (!UUID_RE.test(normalizedRunId)) {
+        throw new Error("agent receipt: continuity.run_id must be a canonical UUID");
+    }
+    if (!prior) {
+        return {
+            sequence_number: 1,
+            run_id: normalizedRunId,
+        };
+    }
+    let priorRunId = normalizedRunId;
+    if (prior.continuity?.run_id?.trim()) {
+        priorRunId = prior.continuity.run_id.trim().toLowerCase();
+    }
+    else if (prior.execution?.run_id?.trim()) {
+        priorRunId = prior.execution.run_id.trim().toLowerCase();
+    }
+    if (priorRunId !== normalizedRunId) {
+        throw new Error("agent receipt: continuity prior run_id mismatch");
+    }
+    const prevDigest = prior.message_digest_sha256_hex.trim().toLowerCase();
+    requireHex64(prevDigest, "prior message_digest_sha256_hex");
+    const seq = prior.continuity && prior.continuity.sequence_number > 0
+        ? prior.continuity.sequence_number + 1
+        : 2;
+    return {
+        prev_message_digest_sha256_hex: prevDigest,
+        sequence_number: seq,
+        run_id: normalizedRunId,
+    };
+}
+/**
+ * Validates an ordered set of action receipts that declare continuity.
+ * Receipts without continuity are ignored. Broken links fail closed.
+ */
+export function verifyContinuityChain(receipts) {
+    const linked = receipts
+        .filter((receipt) => receipt.continuity != null)
+        .map((receipt) => normalizeReceipt(receipt))
+        .sort((a, b) => {
+        const aRun = a.continuity?.run_id ?? "";
+        const bRun = b.continuity?.run_id ?? "";
+        if (aRun === bRun) {
+            return (a.continuity?.sequence_number ?? 0) - (b.continuity?.sequence_number ?? 0);
+        }
+        return aRun < bRun ? -1 : 1;
+    });
+    if (linked.length === 0) {
+        return;
+    }
+    const prevByRun = new Map();
+    for (const item of linked) {
+        const continuity = item.continuity;
+        if (!continuity) {
+            continue;
+        }
+        const prior = prevByRun.get(continuity.run_id);
+        if (!prior) {
+            if (continuity.sequence_number !== 1 || continuity.prev_message_digest_sha256_hex) {
+                throw new Error(`agent receipt: continuity chain for run ${continuity.run_id} must start at sequence_number 1 without prev digest`);
+            }
+            prevByRun.set(continuity.run_id, item);
+            continue;
+        }
+        const expectedSeq = (prior.continuity?.sequence_number ?? 1) + 1;
+        if (continuity.sequence_number !== expectedSeq) {
+            throw new Error(`agent receipt: continuity chain sequence gap for run ${continuity.run_id}: got ${continuity.sequence_number} want ${expectedSeq}`);
+        }
+        if (continuity.prev_message_digest_sha256_hex !== prior.message_digest_sha256_hex) {
+            throw new Error(`agent receipt: continuity chain digest mismatch for run ${continuity.run_id} sequence ${continuity.sequence_number}`);
+        }
+        prevByRun.set(continuity.run_id, item);
+    }
+}
+function verifyContinuityExpectedPrior(receipt, expectedPriorMessageDigestHex) {
+    const expected = expectedPriorMessageDigestHex?.trim().toLowerCase() ?? "";
+    if (!expected) {
+        return;
+    }
+    if (!receipt.continuity) {
+        throw new Error("agent receipt: continuity is required when an expected prior digest is configured");
+    }
+    if (receipt.continuity.sequence_number < 2) {
+        throw new Error("agent receipt: continuity: expected prior digest requires sequence_number > 1");
+    }
+    if (receipt.continuity.prev_message_digest_sha256_hex !== expected) {
+        throw new Error("agent receipt: continuity: prev_message_digest_sha256_hex does not match expected prior digest");
+    }
+}
 /** Validates structure, receipt_id derivation, digest, and detached Ed25519 signature. */
 export async function verifyAgentReceiptV1(receipt, options = {}) {
     ensureEd25519Sha512Sync();
+    const requiredTier = normalizeValidityTier(options.requiredValidityTier);
+    const verifyOperatorAgainstRegistry = options.verifyOperatorAgainstRegistry === true ||
+        requiredTier === AGENT_RECEIPT_VALIDITY_TIER_ATTESTED
+        ? true
+        : options.verifyOperatorAgainstRegistry;
     const normalized = normalizeReceipt(receipt);
+    verifyContinuityExpectedPrior(normalized, options.expectedPriorMessageDigestHex);
     if (!allowsSigningPublicKeyHex(normalized.signing_public_key_ed25519_hex, options.expectedSigningPublicKeys)) {
         throw new Error("agent receipt: signing_public_key_ed25519_hex is not in the configured trusted key set");
     }
@@ -557,7 +837,17 @@ export async function verifyAgentReceiptV1(receipt, options = {}) {
     if (!valid) {
         throw new Error("agent receipt: ed25519 signature verification failed");
     }
-    await verifyOperatorAttestation(normalized, digest, options);
+    await verifyOperatorAttestation(normalized, digest, {
+        ...options,
+        verifyOperatorAgainstRegistry,
+    });
+    if (requiredTier === AGENT_RECEIPT_VALIDITY_TIER_PRIMARY) {
+        requirePrimaryValidity(normalized);
+    }
+    else if (requiredTier === AGENT_RECEIPT_VALIDITY_TIER_ATTESTED) {
+        requirePrimaryValidity(normalized);
+        requireAttestedValidity(normalized, options.trustedOperatorPublicKeys);
+    }
     return normalized;
 }
 /** Validate raw JSON (schema + forbidden fields) then verify signature. */
@@ -583,7 +873,10 @@ async function verifyOperatorAttestation(receipt, gatewayDigest, options = {}) {
     if (attestation.message_digest_sha256_hex !== receipt.message_digest_sha256_hex) {
         throw new Error("agent receipt: operator_attestation message_digest_sha256_hex must match gateway digest");
     }
-    if (options.verifyOperatorAgainstRegistry &&
+    const enforceRegistry = options.verifyOperatorAgainstRegistry === true ||
+        (options.verifyOperatorAgainstRegistry !== false &&
+            options.trustMode === "tenant_registry");
+    if (enforceRegistry &&
         !allowsOperatorPublicKeyHex(attestation.signing_public_key_ed25519_hex, options.trustedOperatorPublicKeys)) {
         throw new Error("agent receipt: operator_attestation signing key is not in the configured tenant operator registry");
     }

package/dist/claude-agents/config.d.ts

@@ -1,13 +1,32 @@
 import type { SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
 import type { PaybondAgentRun } from "../agent/run.js";
-/** Pre-built SDK tool from `tool()` in `@anthropic-ai/claude-agent-sdk`. */
-export type ClaudeAgentSdkTool = SdkMcpToolDefinition;
+/**
+ * Pre-built SDK tool from `tool()` in `@anthropic-ai/claude-agent-sdk`.
+ *
+ * Uses `any` for the schema param to match `createSdkMcpServer({ tools })`, which
+ * accepts heterogeneous `SdkMcpToolDefinition<any>[]` (per-tool schemas differ).
+ */
+export type ClaudeAgentSdkTool = SdkMcpToolDefinition<any>;
+/** Built-in Claude Agent SDK tools that execute outside Paybond MCP and stay unguarded. */
+export declare const CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES: readonly ["Read", "Write", "Edit", "Bash", "Glob", "Grep", "WebFetch", "WebSearch", "NotebookEdit", "Task"];
+export type ClaudeAgentSdkBuiltinToolName = (typeof CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES)[number];
 export type PaybondClaudeAgentsConfigOptions = {
     /** MCP server name; defaults to `"paybond"`. */
     serverName?: string;
     /** Optional version passed to `createSdkMcpServer`. */
     serverVersion?: string;
+    /**
+     * When true (default), emit a console warning if `queryAllowedTools` includes built-in SDK tools
+     * that bypass Paybond Harbor verify and auto-evidence.
+     */
+    warnOnUnguardedBuiltins?: boolean;
+    /** `allowedTools` passed to Claude Agent SDK `query()` — used for built-in coverage warnings. */
+    queryAllowedTools?: readonly string[];
 };
+/** Returns built-in SDK tool names present in a query `allowedTools` list. */
+export declare function findUnguardedClaudeBuiltinTools(queryAllowedTools: readonly string[] | undefined): ClaudeAgentSdkBuiltinToolName[];
+/** Warn once per process when built-in Claude SDK tools remain enabled alongside Paybond MCP tools. */
+export declare function warnOnUnguardedClaudeBuiltinTools(queryAllowedTools: readonly string[] | undefined): void;
 export type ClaudeAgentsConfig = {
     mcpServer: ReturnType<typeof import("@anthropic-ai/claude-agent-sdk").createSdkMcpServer>;
     allowedTools: string[];

package/dist/claude-agents/config.js

@@ -21,6 +21,40 @@ function loadClaudeAgentSdk() {
     }
     return cachedClaudeAgentSdk;
 }
+/** Built-in Claude Agent SDK tools that execute outside Paybond MCP and stay unguarded. */
+export const CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES = [
+    "Read",
+    "Write",
+    "Edit",
+    "Bash",
+    "Glob",
+    "Grep",
+    "WebFetch",
+    "WebSearch",
+    "NotebookEdit",
+    "Task",
+];
+let claudeBuiltinToolsWarningEmitted = false;
+/** Returns built-in SDK tool names present in a query `allowedTools` list. */
+export function findUnguardedClaudeBuiltinTools(queryAllowedTools) {
+    if (!queryAllowedTools?.length) {
+        return [];
+    }
+    const allowed = new Set(queryAllowedTools);
+    return CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES.filter((name) => allowed.has(name));
+}
+/** Warn once per process when built-in Claude SDK tools remain enabled alongside Paybond MCP tools. */
+export function warnOnUnguardedClaudeBuiltinTools(queryAllowedTools) {
+    const unguarded = findUnguardedClaudeBuiltinTools(queryAllowedTools);
+    if (unguarded.length === 0 || claudeBuiltinToolsWarningEmitted) {
+        return;
+    }
+    claudeBuiltinToolsWarningEmitted = true;
+    console.warn(`[paybond/claude-agents] Unguarded Claude Agent SDK built-in tools remain enabled (${unguarded.join(", ")}). ` +
+        "Paybond governs only custom tools registered via tool() in the Paybond MCP server. " +
+        "Remove built-ins from allowedTools or restrict the agent to mcp__paybond__* tools. " +
+        "See https://docs.paybond.ai/kit/claude-agents#built-in-sdk-tools");
+}
 function claudeMcpAllowedToolName(serverName, toolName) {
     return `mcp__${serverName}__${toolName}`;
 }
@@ -150,6 +184,9 @@ export function createPaybondClaudeAgentsConfig(run, tools, options) {
     const { createSdkMcpServer } = loadClaudeAgentSdk();
     const sdkTools = assertClaudeAgentSdkTools(tools);
     const serverName = options?.serverName?.trim() || "paybond";
+    if (options?.warnOnUnguardedBuiltins !== false) {
+        warnOnUnguardedClaudeBuiltinTools(options?.queryAllowedTools);
+    }
     for (const sdkTool of sdkTools) {
         wrapClaudeAgentSdkTool(run, sdkTool);
     }

package/dist/claude-agents/index.d.ts

@@ -1,2 +1,2 @@
-export { createPaybondClaudeAgentsConfig, type ClaudeAgentSdkTool, type ClaudeAgentsConfig, type PaybondClaudeAgentsConfigOptions, } from "./config.js";
+export { CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES, createPaybondClaudeAgentsConfig, findUnguardedClaudeBuiltinTools, type ClaudeAgentSdkBuiltinToolName, type ClaudeAgentSdkTool, type ClaudeAgentsConfig, type PaybondClaudeAgentsConfigOptions, warnOnUnguardedClaudeBuiltinTools, } from "./config.js";
 export { runClaudeAgentsSandboxDemo, type RunClaudeAgentsSandboxDemoInput, type RunClaudeAgentsSandboxDemoResult, } from "./sandbox-demo.js";

package/dist/claude-agents/index.js

@@ -1,2 +1,2 @@
-export { createPaybondClaudeAgentsConfig, } from "./config.js";
+export { CLAUDE_AGENT_SDK_BUILTIN_TOOL_NAMES, createPaybondClaudeAgentsConfig, findUnguardedClaudeBuiltinTools, warnOnUnguardedClaudeBuiltinTools, } from "./config.js";
 export { runClaudeAgentsSandboxDemo, } from "./sandbox-demo.js";

package/dist/cli/agent/demo-loaders.d.ts

@@ -2,5 +2,6 @@ export declare function loadRunVercelAiSandboxDemo(): Promise<typeof import("../
 export declare function loadRunLangGraphSandboxDemo(): Promise<typeof import("../../langgraph/sandbox-demo.js").runLangGraphSandboxDemo>;
 export declare function loadRunClaudeAgentsSandboxDemo(): Promise<typeof import("../../claude-agents/sandbox-demo.js").runClaudeAgentsSandboxDemo>;
 export declare function loadRunOpenAIAgentsSandboxDemo(): Promise<typeof import("../../openai-agents/sandbox-demo.js").runOpenAIAgentsSandboxDemo>;
+export declare function loadRunGoogleAdkSandboxDemo(): Promise<typeof import("../../google-adk/sandbox-demo.js").runGoogleAdkSandboxDemo>;
 export declare function loadRunMastraSandboxDemo(): Promise<typeof import("../../mastra/sandbox-demo.js").runMastraSandboxDemo>;
 export declare function loadRunCloudflareAgentsSandboxDemo(): Promise<typeof import("../../cloudflare-agents/sandbox-demo.js").runCloudflareAgentsSandboxDemo>;

package/dist/cli/agent/demo-loaders.js

@@ -64,6 +64,18 @@ export async function loadRunOpenAIAgentsSandboxDemo() {
         throw err;
     }
 }
+export async function loadRunGoogleAdkSandboxDemo() {
+    try {
+        const mod = await import("../../google-adk/sandbox-demo.js");
+        return mod.runGoogleAdkSandboxDemo;
+    }
+    catch (err) {
+        if (isMissingModuleError(err, "@google/adk")) {
+            throw missingPeerDependencyError("@google/adk", "google-adk");
+        }
+        throw err;
+    }
+}
 export async function loadRunMastraSandboxDemo() {
     try {
         const mod = await import("../../mastra/sandbox-demo.js");

package/dist/cli/command-spec.js

@@ -86,6 +86,9 @@ export const COMMAND_PATHS = [
     "agent demo generic smoke",
     "agent demo claude-agents smoke",
     "agent demo crewai smoke",
+    "agent demo pydantic-ai smoke",
+    "agent demo google-adk smoke",
+    "agent demo microsoft-agent-framework smoke",
     "agent demo openai-agents smoke",
     "agent demo mastra smoke",
     "agent demo cloudflare-agents smoke",
@@ -378,7 +381,10 @@ export const COMMAND_EXAMPLES = {
         "paybond init agent-middleware --framework mastra --out paybond-mastra.ts",
         "paybond init agent-middleware --framework cloudflare-agents --out paybond-cloudflare-agents.ts",
         "paybond init agent-middleware --framework mcp --out paybond-mcp.ts",
-        "paybond init agent-middleware --framework crewai --out paybond_crewai.py"
+        "paybond init agent-middleware --framework crewai --out paybond_crewai.py",
+        "paybond init agent-middleware --framework pydantic-ai --out paybond_pydantic_ai.py",
+        "paybond init agent-middleware --framework google-adk --out paybond_google_adk.py",
+        "paybond init agent-middleware --framework microsoft-agent-framework --out paybond_microsoft_agent_framework.py"
     ],
     "agent run bind": [
         "paybond agent run bind --policy-file paybond.policy.yaml --format json",
@@ -430,6 +436,15 @@ export const COMMAND_EXAMPLES = {
     "agent demo crewai smoke": [
         "paybond agent demo crewai smoke --operation procurement.submit_po --requested-spend-cents 12000 --evidence-preset cost_and_completion --format json"
     ],
+    "agent demo pydantic-ai smoke": [
+        "paybond agent demo pydantic-ai smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
+    "agent demo google-adk smoke": [
+        "paybond agent demo google-adk smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
+    "agent demo microsoft-agent-framework smoke": [
+        "paybond agent demo microsoft-agent-framework smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
     "agent demo openai-agents smoke": [
         "paybond agent demo openai-agents smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
     ],

package/dist/cli/commands/agent.d.ts

@@ -17,5 +17,9 @@ export declare function handleAgentDemoMastraSmoke(ctx: CliContext, argv: string
 export declare function handleAgentDemoCloudflareAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoClaudeAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoMcpSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoCrewaiSmoke(_ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoPydanticAiSmoke(_ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoMicrosoftAgentFrameworkSmoke(_ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoOpenAIAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoGoogleAdkSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgent(ctx: CliContext, group: string, subcommand: string, argv: string[]): Promise<CommandResult>;