@paybond/kit 0.5.0 → 0.6.0

package/README.md

@@ -111,7 +111,7 @@ Advanced exports:
 
 `allowedTools` values are your own tool or operation names, not a Paybond-owned catalog. Harbor enforces string matching against whatever names you chose when creating the intent.
 
-`settlementRail` on intent creation is only a rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
+`settlementRail` on intent creation is a principal-signed rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
 
 The protocol-v2 surface is trust-first: signed mandates, recognition proofs, and receipts work across supported settlement adapters instead of treating any single rail as the product boundary.
 

package/dist/index.d.ts

@@ -946,8 +946,8 @@ export declare class ServiceAccountFraudSession {
 }
 /**
  * Parameters for {@link PaybondIntents.create} (tenant is taken from the bound Harbor client).
- * `settlementRail`, when set, requests one allowed rail; Harbor still resolves the destination
- * from tenant-owned settlement config.
+ * `settlementRail` is principal-signed and requests one allowed rail; Harbor still resolves the
+ * destination from tenant-owned settlement config.
  */
 export type PaybondCreateIntentParams = Omit<BuildSignedCreateIntentParams, "tenantId" | "intentId"> & {
     intentId?: string;
@@ -962,7 +962,7 @@ export declare class PaybondIntents {
     constructor(harbor: HarborClient);
     /**
      * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be
-     * 32 bytes. `settlementRail` only requests an allowed rail; destinations stay server-owned.
+     * 32 bytes. `settlementRail` is signed as the requested rail; destinations stay server-owned.
      */
     create(params: PaybondCreateIntentParams & {
         idempotencyKey?: string;

package/dist/index.js

@@ -1537,7 +1537,7 @@ export class PaybondIntents {
     }
     /**
      * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be
-     * 32 bytes. `settlementRail` only requests an allowed rail; destinations stay server-owned.
+     * 32 bytes. `settlementRail` is signed as the requested rail; destinations stay server-owned.
      */
     async create(params) {
         const { idempotencyKey, intentId: maybeIntentId, ...fields } = params;

package/dist/mcp-server.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { GatewayAuthError, GatewayFraudClient, GatewaySignalClient, HarborHttpError, ServiceAccountHarborSession, SignalHttpError, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.5.0";
+const SERVER_VERSION = "0.6.0";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_HARBOR_ACCESS_PATH = "/v1/auth/harbor-access";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";

package/dist/principal-intent.d.ts

@@ -17,6 +17,7 @@ export declare function intentCreationSignBytesRaw(input: {
     predicate: Record<string, unknown>;
     predicateRef: string;
     allowedTools: string[];
+    settlementRail: SettlementRail;
 }): Uint8Array;
 export type BuildSignedCreateIntentParams = {
     tenantId: string;
@@ -32,11 +33,11 @@ export type BuildSignedCreateIntentParams = {
     deadlineRfc3339: string;
     allowedTools: string[];
     predicateRef?: string;
-    /** Optional rail request for the new intent. Harbor resolves the destination server-side. */
-    settlementRail?: SettlementRail;
+    /** Rail request for the new intent. Harbor resolves the destination server-side. */
+    settlementRail: SettlementRail;
 };
 /**
  * Build a Harbor `POST /intents` JSON body with principal Ed25519 detached signature.
- * `settlementRail` only requests an allowed rail; destinations remain tenant-owned server-side.
+ * `settlementRail` is included in the signature; destinations remain tenant-owned server-side.
  */
 export declare function buildSignedCreateIntentBody(params: BuildSignedCreateIntentParams): Record<string, unknown>;

package/dist/principal-intent.js

@@ -49,15 +49,15 @@ function allowedToolsDigest(tools) {
         .filter((v, i, a) => a.indexOf(v) === i);
     return jsonValueDigest(sorted);
 }
-/** Bincode payload for principal intent creation (wire format revision byte `2`). */
+/** Bincode payload for principal intent creation (wire format revision byte `4`). */
 function encodeIntentCreationSign(input) {
-    const version = new Uint8Array([2]);
+    const version = new Uint8Array([4]);
     const intentBytes = parseUuid(input.intentId);
     if (intentBytes.length !== 16) {
         throw new Error("intentId must be a UUID string");
     }
     // Serde `Uuid` + bincode uses a u64 length prefix (16) before the raw 16 bytes (matches Rust).
-    return concatBytes(version, encodeBincodeString(input.tenantId), encodeU64(16), intentBytes, encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest);
+    return concatBytes(version, encodeBincodeString(input.tenantId), encodeU64(16), intentBytes, encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest, encodeBincodeString(input.settlementRail));
 }
 export function intentCreationSignBytesRaw(input) {
     const budgetDigest = jsonValueDigest(input.budget);
@@ -77,6 +77,7 @@ export function intentCreationSignBytesRaw(input) {
         predicateDslDigest,
         predicateRef: input.predicateRef,
         allowedToolsDigest: allowedDigest,
+        settlementRail: input.settlementRail,
     });
 }
 function bytesToBase64(bytes) {
@@ -87,7 +88,7 @@ function bytesToBase64(bytes) {
 }
 /**
  * Build a Harbor `POST /intents` JSON body with principal Ed25519 detached signature.
- * `settlementRail` only requests an allowed rail; destinations remain tenant-owned server-side.
+ * `settlementRail` is included in the signature; destinations remain tenant-owned server-side.
  */
 export function buildSignedCreateIntentBody(params) {
     if (params.principalSigningSeed.length !== 32) {
@@ -96,9 +97,7 @@ export function buildSignedCreateIntentBody(params) {
     if (params.allowedTools.length === 0) {
         throw new Error("allowedTools must be non-empty");
     }
-    const settlementRail = params.settlementRail
-        ? validateSettlementRail(params.settlementRail)
-        : undefined;
+    const settlementRail = validateSettlementRail(params.settlementRail);
     const predicateRef = params.predicateRef ?? "";
     const msg = intentCreationSignBytesRaw({
         tenantId: params.tenantId,
@@ -113,6 +112,7 @@ export function buildSignedCreateIntentBody(params) {
         predicate: params.predicate,
         predicateRef,
         allowedTools: params.allowedTools,
+        settlementRail,
     });
     const sig = sign(msg, params.principalSigningSeed);
     const pub = getPublicKey(params.principalSigningSeed);
@@ -128,15 +128,13 @@ export function buildSignedCreateIntentBody(params) {
         evidence_schema: params.evidenceSchema,
         deadline: params.deadlineRfc3339,
         predicate_dsl: params.predicate,
-        signing_version: 2,
+        settlement_rail: settlementRail,
+        signing_version: 4,
         policy_binding: null,
         allowed_tools: params.allowedTools,
     };
     if (predicateRef.trim() !== "") {
         body.predicate_ref = predicateRef;
     }
-    if (settlementRail) {
-        body.settlement_rail = settlementRail;
-    }
     return body;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Paybond Kit for TypeScript: tenant-bound Harbor sessions, capability verification, and signed intent/evidence flows.",
   "license": "Apache-2.0",
   "type": "module",