@paybond/kit 0.6.0 → 0.6.1

package/dist/ed25519-sync.d.ts

@@ -0,0 +1 @@
+export declare function ensureEd25519Sha512Sync(): void;

package/dist/ed25519-sync.js

@@ -0,0 +1,14 @@
+import { createHash } from "node:crypto";
+import { etc } from "@noble/ed25519";
+export function ensureEd25519Sha512Sync() {
+    if (etc.sha512Sync) {
+        return;
+    }
+    etc.sha512Sync = (...messages) => {
+        const hash = createHash("sha512");
+        for (const message of messages) {
+            hash.update(message);
+        }
+        return new Uint8Array(hash.digest());
+    };
+}

package/dist/index.d.ts

@@ -792,8 +792,8 @@ export declare class HarborClient {
      */
     getLedgerAuthority(): Promise<Record<string, unknown>>;
     /**
-     * `GET /ledger/v1/events` — paginated append-only history; `afterSeq` is an exclusive cursor.
-     * `limit` is clamped to 1…256 to match Harbor.
+     * `GET /ledger/v1/events` - protected Harbor append-only history for trusted clients.
+     * `afterSeq` is an exclusive cursor; `limit` is clamped to 1..256 to match Harbor.
      */
     getLedgerEvents(options?: {
         afterSeq?: number;
@@ -953,7 +953,10 @@ export type PaybondCreateIntentParams = Omit<BuildSignedCreateIntentParams, "ten
     intentId?: string;
 };
 /** Parameters for {@link PaybondIntents.submitEvidence} (tenant is taken from the bound Harbor client). */
-export type PaybondSubmitEvidenceParams = Omit<SignPayeeEvidenceParams, "tenantId">;
+export type PaybondSubmitEvidenceParams = Omit<SignPayeeEvidenceParams, "tenantId" | "artifactsBlake3Hex" | "submittedAtRfc3339"> & {
+    artifactsBlake3Hex?: string[];
+    submittedAtRfc3339?: string;
+};
 /**
  * Ergonomic intent helpers: principal-signed intent create, x402 funding, and payee-signed evidence.
  */

package/dist/index.js

@@ -613,8 +613,8 @@ export class HarborClient {
         return body;
     }
     /**
-     * `GET /ledger/v1/events` — paginated append-only history; `afterSeq` is an exclusive cursor.
-     * `limit` is clamped to 1…256 to match Harbor.
+     * `GET /ledger/v1/events` - protected Harbor append-only history for trusted clients.
+     * `afterSeq` is an exclusive cursor; `limit` is clamped to 1..256 to match Harbor.
      */
     async getLedgerEvents(options) {
         const afterSeq = Math.max(0, Math.floor(options?.afterSeq ?? 0));
@@ -1527,6 +1527,9 @@ export class ServiceAccountFraudSession {
         await Promise.resolve();
     }
 }
+function nowRfc3339Seconds() {
+    return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
 /**
  * Ergonomic intent helpers: principal-signed intent create, x402 funding, and payee-signed evidence.
  */
@@ -1562,9 +1565,11 @@ export class PaybondIntents {
      * Sign payee evidence and POST it. `payeeSigningSeed` must be 32 bytes.
      */
     async submitEvidence(params) {
-        const { idempotencyKey, ...rest } = params;
+        const { idempotencyKey, artifactsBlake3Hex = [], submittedAtRfc3339 = nowRfc3339Seconds(), ...rest } = params;
         const wire = signPayeeEvidenceBinding({
             tenantId: this.harbor.tenantId,
+            artifactsBlake3Hex,
+            submittedAtRfc3339,
             ...rest,
         });
         return this.harbor.submitEvidence(rest.intentId, wire, { idempotencyKey });

package/dist/payee-evidence.js

@@ -4,6 +4,7 @@
 import { sign, getPublicKey } from "@noble/ed25519";
 import { createHash } from "blake3";
 import { parse as parseUuid } from "uuid";
+import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
 function concatBytes(...parts) {
     const n = parts.reduce((a, p) => a + p.length, 0);
@@ -65,6 +66,7 @@ export function signPayeeEvidenceBinding(params) {
     if (params.payeeSigningSeed.length !== 32) {
         throw new Error("payeeSigningSeed must be 32 bytes");
     }
+    ensureEd25519Sha512Sync();
     const artifactBin = params.artifactsBlake3Hex.map((h) => hexToBytes(h));
     const payloadDigest = jsonValueDigest(params.payload);
     const artDigest = artifactsDigest(artifactBin);

package/dist/principal-intent.js

@@ -4,6 +4,7 @@
  */
 import { sign, getPublicKey } from "@noble/ed25519";
 import { parse as parseUuid } from "uuid";
+import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
 const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "x402_usdc_base"]);
 function validateSettlementRail(value) {
@@ -99,6 +100,7 @@ export function buildSignedCreateIntentBody(params) {
     }
     const settlementRail = validateSettlementRail(params.settlementRail);
     const predicateRef = params.predicateRef ?? "";
+    ensureEd25519Sha512Sync();
     const msg = intentCreationSignBytesRaw({
         tenantId: params.tenantId,
         intentId: params.intentId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Paybond Kit for TypeScript: tenant-bound Harbor sessions, capability verification, and signed intent/evidence flows.",
   "license": "Apache-2.0",
   "type": "module",