@paybond/kit 0.5.0 → 0.6.1

package/README.md

@@ -111,7 +111,7 @@ Advanced exports:
 
 `allowedTools` values are your own tool or operation names, not a Paybond-owned catalog. Harbor enforces string matching against whatever names you chose when creating the intent.
 
-`settlementRail` on intent creation is only a rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
+`settlementRail` on intent creation is a principal-signed rail request. Stripe destinations and x402 receive addresses stay tenant-owned server-side config and are never supplied by the SDK caller.
 
 The protocol-v2 surface is trust-first: signed mandates, recognition proofs, and receipts work across supported settlement adapters instead of treating any single rail as the product boundary.
 

package/dist/ed25519-sync.d.ts

@@ -0,0 +1 @@
+export declare function ensureEd25519Sha512Sync(): void;

package/dist/ed25519-sync.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+import { etc } from "@noble/ed25519";
+export function ensureEd25519Sha512Sync() {
+    if (etc.sha512Sync) {
+        return;
+    }
+    etc.sha512Sync = (...messages) => {
+        const hash = createHash("sha512");
+        for (const message of messages) {
+            hash.update(message);
+        }
+        return new Uint8Array(hash.digest());
+    };
+}

package/dist/index.d.ts

@@ -792,8 +792,8 @@ export declare class HarborClient {
      */
     getLedgerAuthority(): Promise<Record<string, unknown>>;
     /**
-     * `GET /ledger/v1/events` — paginated append-only history; `afterSeq` is an exclusive cursor.
-     * `limit` is clamped to 1…256 to match Harbor.
+     * `GET /ledger/v1/events` - protected Harbor append-only history for trusted clients.
+     * `afterSeq` is an exclusive cursor; `limit` is clamped to 1..256 to match Harbor.
      */
     getLedgerEvents(options?: {
         afterSeq?: number;
@@ -946,14 +946,17 @@ export declare class ServiceAccountFraudSession {
 }
 /**
  * Parameters for {@link PaybondIntents.create} (tenant is taken from the bound Harbor client).
- * `settlementRail`, when set, requests one allowed rail; Harbor still resolves the destination
- * from tenant-owned settlement config.
+ * `settlementRail` is principal-signed and requests one allowed rail; Harbor still resolves the
+ * destination from tenant-owned settlement config.
  */
 export type PaybondCreateIntentParams = Omit<BuildSignedCreateIntentParams, "tenantId" | "intentId"> & {
     intentId?: string;
 };
 /** Parameters for {@link PaybondIntents.submitEvidence} (tenant is taken from the bound Harbor client). */
-export type PaybondSubmitEvidenceParams = Omit<SignPayeeEvidenceParams, "tenantId">;
+export type PaybondSubmitEvidenceParams = Omit<SignPayeeEvidenceParams, "tenantId" | "artifactsBlake3Hex" | "submittedAtRfc3339"> & {
+    artifactsBlake3Hex?: string[];
+    submittedAtRfc3339?: string;
+};
 /**
  * Ergonomic intent helpers: principal-signed intent create, x402 funding, and payee-signed evidence.
  */
@@ -962,7 +965,7 @@ export declare class PaybondIntents {
     constructor(harbor: HarborClient);
     /**
      * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be
-     * 32 bytes. `settlementRail` only requests an allowed rail; destinations stay server-owned.
+     * 32 bytes. `settlementRail` is signed as the requested rail; destinations stay server-owned.
      */
     create(params: PaybondCreateIntentParams & {
         idempotencyKey?: string;

package/dist/index.js

@@ -613,8 +613,8 @@ export class HarborClient {
         return body;
     }
     /**
-     * `GET /ledger/v1/events` — paginated append-only history; `afterSeq` is an exclusive cursor.
-     * `limit` is clamped to 1…256 to match Harbor.
+     * `GET /ledger/v1/events` - protected Harbor append-only history for trusted clients.
+     * `afterSeq` is an exclusive cursor; `limit` is clamped to 1..256 to match Harbor.
      */
     async getLedgerEvents(options) {
         const afterSeq = Math.max(0, Math.floor(options?.afterSeq ?? 0));
@@ -1527,6 +1527,9 @@ export class ServiceAccountFraudSession {
         await Promise.resolve();
     }
 }
+function nowRfc3339Seconds() {
+    return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
 /**
  * Ergonomic intent helpers: principal-signed intent create, x402 funding, and payee-signed evidence.
  */
@@ -1537,7 +1540,7 @@ export class PaybondIntents {
     }
     /**
      * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be
-     * 32 bytes. `settlementRail` only requests an allowed rail; destinations stay server-owned.
+     * 32 bytes. `settlementRail` is signed as the requested rail; destinations stay server-owned.
      */
     async create(params) {
         const { idempotencyKey, intentId: maybeIntentId, ...fields } = params;
@@ -1562,9 +1565,11 @@ export class PaybondIntents {
      * Sign payee evidence and POST it. `payeeSigningSeed` must be 32 bytes.
      */
     async submitEvidence(params) {
-        const { idempotencyKey, ...rest } = params;
+        const { idempotencyKey, artifactsBlake3Hex = [], submittedAtRfc3339 = nowRfc3339Seconds(), ...rest } = params;
         const wire = signPayeeEvidenceBinding({
             tenantId: this.harbor.tenantId,
+            artifactsBlake3Hex,
+            submittedAtRfc3339,
             ...rest,
         });
         return this.harbor.submitEvidence(rest.intentId, wire, { idempotencyKey });

package/dist/mcp-server.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { GatewayAuthError, GatewayFraudClient, GatewaySignalClient, HarborHttpError, ServiceAccountHarborSession, SignalHttpError, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.5.0";
+const SERVER_VERSION = "0.6.0";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_HARBOR_ACCESS_PATH = "/v1/auth/harbor-access";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";

package/dist/payee-evidence.js

@@ -4,6 +4,7 @@
 import { sign, getPublicKey } from "@noble/ed25519";
 import { createHash } from "blake3";
 import { parse as parseUuid } from "uuid";
+import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
 function concatBytes(...parts) {
     const n = parts.reduce((a, p) => a + p.length, 0);
@@ -65,6 +66,7 @@ export function signPayeeEvidenceBinding(params) {
     if (params.payeeSigningSeed.length !== 32) {
         throw new Error("payeeSigningSeed must be 32 bytes");
     }
+    ensureEd25519Sha512Sync();
     const artifactBin = params.artifactsBlake3Hex.map((h) => hexToBytes(h));
     const payloadDigest = jsonValueDigest(params.payload);
     const artDigest = artifactsDigest(artifactBin);

package/dist/principal-intent.d.ts

@@ -17,6 +17,7 @@ export declare function intentCreationSignBytesRaw(input: {
     predicate: Record<string, unknown>;
     predicateRef: string;
     allowedTools: string[];
+    settlementRail: SettlementRail;
 }): Uint8Array;
 export type BuildSignedCreateIntentParams = {
     tenantId: string;
@@ -32,11 +33,11 @@ export type BuildSignedCreateIntentParams = {
     deadlineRfc3339: string;
     allowedTools: string[];
     predicateRef?: string;
-    /** Optional rail request for the new intent. Harbor resolves the destination server-side. */
-    settlementRail?: SettlementRail;
+    /** Rail request for the new intent. Harbor resolves the destination server-side. */
+    settlementRail: SettlementRail;
 };
 /**
  * Build a Harbor `POST /intents` JSON body with principal Ed25519 detached signature.
- * `settlementRail` only requests an allowed rail; destinations remain tenant-owned server-side.
+ * `settlementRail` is included in the signature; destinations remain tenant-owned server-side.
  */
 export declare function buildSignedCreateIntentBody(params: BuildSignedCreateIntentParams): Record<string, unknown>;

package/dist/principal-intent.js

@@ -4,6 +4,7 @@
  */
 import { sign, getPublicKey } from "@noble/ed25519";
 import { parse as parseUuid } from "uuid";
+import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
 const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "x402_usdc_base"]);
 function validateSettlementRail(value) {
@@ -49,15 +50,15 @@ function allowedToolsDigest(tools) {
         .filter((v, i, a) => a.indexOf(v) === i);
     return jsonValueDigest(sorted);
 }
-/** Bincode payload for principal intent creation (wire format revision byte `2`). */
+/** Bincode payload for principal intent creation (wire format revision byte `4`). */
 function encodeIntentCreationSign(input) {
-    const version = new Uint8Array([2]);
+    const version = new Uint8Array([4]);
     const intentBytes = parseUuid(input.intentId);
     if (intentBytes.length !== 16) {
         throw new Error("intentId must be a UUID string");
     }
     // Serde `Uuid` + bincode uses a u64 length prefix (16) before the raw 16 bytes (matches Rust).
-    return concatBytes(version, encodeBincodeString(input.tenantId), encodeU64(16), intentBytes, encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest);
+    return concatBytes(version, encodeBincodeString(input.tenantId), encodeU64(16), intentBytes, encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest, encodeBincodeString(input.settlementRail));
 }
 export function intentCreationSignBytesRaw(input) {
     const budgetDigest = jsonValueDigest(input.budget);
@@ -77,6 +78,7 @@ export function intentCreationSignBytesRaw(input) {
         predicateDslDigest,
         predicateRef: input.predicateRef,
         allowedToolsDigest: allowedDigest,
+        settlementRail: input.settlementRail,
     });
 }
 function bytesToBase64(bytes) {
@@ -87,7 +89,7 @@ function bytesToBase64(bytes) {
 }
 /**
  * Build a Harbor `POST /intents` JSON body with principal Ed25519 detached signature.
- * `settlementRail` only requests an allowed rail; destinations remain tenant-owned server-side.
+ * `settlementRail` is included in the signature; destinations remain tenant-owned server-side.
  */
 export function buildSignedCreateIntentBody(params) {
     if (params.principalSigningSeed.length !== 32) {
@@ -96,10 +98,9 @@ export function buildSignedCreateIntentBody(params) {
     if (params.allowedTools.length === 0) {
         throw new Error("allowedTools must be non-empty");
     }
-    const settlementRail = params.settlementRail
-        ? validateSettlementRail(params.settlementRail)
-        : undefined;
+    const settlementRail = validateSettlementRail(params.settlementRail);
     const predicateRef = params.predicateRef ?? "";
+    ensureEd25519Sha512Sync();
     const msg = intentCreationSignBytesRaw({
         tenantId: params.tenantId,
         intentId: params.intentId,
@@ -113,6 +114,7 @@ export function buildSignedCreateIntentBody(params) {
         predicate: params.predicate,
         predicateRef,
         allowedTools: params.allowedTools,
+        settlementRail,
     });
     const sig = sign(msg, params.principalSigningSeed);
     const pub = getPublicKey(params.principalSigningSeed);
@@ -128,15 +130,13 @@ export function buildSignedCreateIntentBody(params) {
         evidence_schema: params.evidenceSchema,
         deadline: params.deadlineRfc3339,
         predicate_dsl: params.predicate,
-        signing_version: 2,
+        settlement_rail: settlementRail,
+        signing_version: 4,
         policy_binding: null,
         allowed_tools: params.allowedTools,
     };
     if (predicateRef.trim() !== "") {
         body.predicate_ref = predicateRef;
     }
-    if (settlementRail) {
-        body.settlement_rail = settlementRail;
-    }
     return body;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "description": "Paybond Kit for TypeScript: tenant-bound Harbor sessions, capability verification, and signed intent/evidence flows.",
   "license": "Apache-2.0",
   "type": "module",