@paybond/kit 0.9.8 → 0.11.0

package/dist/principal-intent.js

@@ -3,9 +3,9 @@
  * Matches `crates/harbor-intent-escrow/src/signing.rs` (`intent_creation_sign_bytes_raw`).
  */
 import { sign, getPublicKey } from "@noble/ed25519";
-import { parse as parseUuid } from "uuid";
 import { ensureEd25519Sha512Sync } from "./ed25519-sync.js";
 import { jsonValueDigest } from "./json-digest.js";
+import { COMPLETION_CONTRACT_SIGN_VERSION, concatBytes, encodeBincodeString, encodeBincodeUuid, encodeFixed32, encodeU8, encodeVarintI64, encodeVarintU32, } from "./bincode-wire.js";
 const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "stripe_ach_debit", "x402_usdc_base"]);
 function validateSettlementRail(value) {
     if (!SETTLEMENT_RAIL_VALUES.has(value)) {
@@ -13,33 +13,6 @@ function validateSettlementRail(value) {
     }
     return value;
 }
-function concatBytes(...parts) {
-    const n = parts.reduce((a, p) => a + p.length, 0);
-    const out = new Uint8Array(n);
-    let o = 0;
-    for (const p of parts) {
-        out.set(p, o);
-        o += p.length;
-    }
-    return out;
-}
-function encodeU64(n) {
-    if (!Number.isInteger(n) || n < 0) {
-        throw new Error("encodeU64: expected non-negative integer");
-    }
-    const b = new Uint8Array(8);
-    new DataView(b.buffer).setBigUint64(0, BigInt(n), true);
-    return b;
-}
-function encodeI64(n) {
-    const b = new Uint8Array(8);
-    new DataView(b.buffer).setBigInt64(0, BigInt(n), true);
-    return b;
-}
-function encodeBincodeString(s) {
-    const utf8 = new TextEncoder().encode(s);
-    return concatBytes(encodeU64(utf8.length), utf8);
-}
 function dslDigest(predicate) {
     return jsonValueDigest(predicate);
 }
@@ -50,22 +23,75 @@ function allowedToolsDigest(tools) {
         .filter((v, i, a) => a.indexOf(v) === i);
     return jsonValueDigest(sorted);
 }
-/** Bincode payload for principal intent creation (wire format revision byte `4`). */
+function encodeU32(n) {
+    return encodeVarintU32(n);
+}
+function encodeBincodeFixed32(bytes) {
+    return encodeFixed32(bytes);
+}
+/** Bincode payload for optional completion contract tail (wire format revision byte `2`). */
+function encodeCompletionContractSignV1(input) {
+    return concatBytes(encodeU8(COMPLETION_CONTRACT_SIGN_VERSION), encodeBincodeString(input.completionPresetId), encodeBincodeString(input.vendorContractProvider), encodeBincodeString(input.vendorApiVersion), encodeBincodeFixed32(input.vendorSchemaDigest), encodeBincodeFixed32(input.canonicalSchemaDigest));
+}
+function digestHexToBytes(hexValue) {
+    if (!hexValue || hexValue.trim() === "") {
+        return new Uint8Array(32);
+    }
+    const trimmed = hexValue.trim().toLowerCase().replace(/^0x/, "");
+    if (!/^[0-9a-f]{64}$/.test(trimmed)) {
+        throw new Error("digest hex must be a 64-character hex string");
+    }
+    const out = new Uint8Array(32);
+    for (let i = 0; i < 32; i += 1) {
+        out[i] = Number.parseInt(trimmed.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function appendCompletionContractSignExtension(base, snapshot) {
+    const extension = encodeCompletionContractSignV1({
+        completionPresetId: snapshot.completionPresetId,
+        vendorContractProvider: snapshot.vendorContractProvider ?? "",
+        vendorApiVersion: snapshot.vendorApiVersion ?? "",
+        vendorSchemaDigest: digestHexToBytes(snapshot.vendorSchemaDigestHex),
+        canonicalSchemaDigest: digestHexToBytes(snapshot.canonicalSchemaDigestHex),
+    });
+    return concatBytes(base, extension);
+}
 function encodeIntentCreationSign(input) {
-    const version = new Uint8Array([4]);
-    const intentBytes = parseUuid(input.intentId);
-    if (intentBytes.length !== 16) {
-        throw new Error("intentId must be a UUID string");
+    const base = concatBytes(encodeU8(input.version), encodeBincodeString(input.tenantId), encodeBincodeUuid(input.intentId), encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeVarintI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest, encodeBincodeString(input.settlementRail));
+    if (input.version === 4) {
+        return base;
+    }
+    if (input.version === 6) {
+        if (input.payeePubkey === undefined) {
+            throw new Error("payeePubkey is required for signing version 6");
+        }
+        return concatBytes(base, encodeBincodeFixed32(input.payeePubkey));
+    }
+    if (input.policyTemplateId === undefined ||
+        input.policyVersionSeq === undefined ||
+        input.policyContentDigest === undefined) {
+        throw new Error("policy binding fields are required for signing version 5 or 7");
     }
-    // Serde `Uuid` + bincode uses a u64 length prefix (16) before the raw 16 bytes (matches Rust).
-    return concatBytes(version, encodeBincodeString(input.tenantId), encodeU64(16), intentBytes, encodeBincodeString(input.principalDid), encodeBincodeString(input.payeeDid), encodeI64(input.amountCents), encodeBincodeString(input.currency), encodeBincodeString(input.deadlineRfc3339), input.budgetDigest, input.evidenceSchemaDigest, input.predicateDslDigest, encodeBincodeString(input.predicateRef), input.allowedToolsDigest, encodeBincodeString(input.settlementRail));
+    const withPolicy = concatBytes(base, encodeBincodeString(input.policyTemplateId), encodeU32(input.policyVersionSeq), encodeBincodeFixed32(input.policyContentDigest));
+    if (input.version === 5) {
+        return withPolicy;
+    }
+    if (input.payeePubkey === undefined) {
+        throw new Error("payeePubkey is required for signing version 7");
+    }
+    return concatBytes(withPolicy, encodeBincodeFixed32(input.payeePubkey));
 }
 export function intentCreationSignBytesRaw(input) {
+    if (input.payeePubkeyBytes.length !== 32) {
+        throw new Error("payeePubkeyBytes must be 32 bytes");
+    }
     const budgetDigest = jsonValueDigest(input.budget);
     const evidenceSchemaDigest = jsonValueDigest(input.evidenceSchema);
     const predicateDslDigest = dslDigest(input.predicate);
     const allowedDigest = allowedToolsDigest(input.allowedTools);
-    return encodeIntentCreationSign({
+    const base = encodeIntentCreationSign({
+        version: 6,
         tenantId: input.tenantId,
         intentId: input.intentId,
         principalDid: input.principalDid,
@@ -79,7 +105,127 @@ export function intentCreationSignBytesRaw(input) {
         predicateRef: input.predicateRef,
         allowedToolsDigest: allowedDigest,
         settlementRail: input.settlementRail,
+        payeePubkey: input.payeePubkeyBytes,
     });
+    if (!input.completionContract) {
+        return base;
+    }
+    return appendCompletionContractSignExtension(base, input.completionContract);
+}
+function parseDigestHex(hexValue) {
+    const trimmed = hexValue.trim().toLowerCase().replace(/^0x/, "");
+    if (!/^[0-9a-f]{64}$/.test(trimmed)) {
+        throw new Error("policyContentDigestHex must be a 64-character hex string");
+    }
+    const out = new Uint8Array(32);
+    for (let i = 0; i < 32; i += 1) {
+        out[i] = Number.parseInt(trimmed.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Bincode payload for managed-policy intent creation (wire format revision byte `5`). */
+export function intentCreationSignBytesWithPolicyBinding(input) {
+    if (input.payeePubkeyBytes.length !== 32) {
+        throw new Error("payeePubkeyBytes must be 32 bytes");
+    }
+    const budgetDigest = jsonValueDigest(input.budget);
+    const evidenceSchemaDigest = jsonValueDigest(input.evidenceSchema);
+    const predicateDslDigest = dslDigest(input.materializedPredicate);
+    const allowedDigest = allowedToolsDigest(input.allowedTools);
+    const base = encodeIntentCreationSign({
+        version: 7,
+        tenantId: input.tenantId,
+        intentId: input.intentId,
+        principalDid: input.principalDid,
+        payeeDid: input.payeeDid,
+        amountCents: input.amountCents,
+        currency: input.currency,
+        deadlineRfc3339: input.deadlineRfc3339,
+        budgetDigest,
+        evidenceSchemaDigest,
+        predicateDslDigest,
+        predicateRef: input.predicateRef,
+        allowedToolsDigest: allowedDigest,
+        settlementRail: input.settlementRail,
+        policyTemplateId: input.policyBinding.templateId,
+        policyVersionSeq: input.policyBinding.versionSeq,
+        policyContentDigest: parseDigestHex(input.policyContentDigestHex),
+        payeePubkey: input.payeePubkeyBytes,
+    });
+    if (!input.completionContract) {
+        return base;
+    }
+    return appendCompletionContractSignExtension(base, input.completionContract);
+}
+/**
+ * Build a Harbor `POST /intents` JSON body with signing v5 and a published managed-policy head.
+ */
+export function buildSignedCreateIntentBodyWithPolicyBinding(params) {
+    if (params.principalSigningSeed.length !== 32) {
+        throw new Error("principalSigningSeed must be 32 bytes");
+    }
+    if (params.payeeSigningSeed.length !== 32) {
+        throw new Error("payeeSigningSeed must be 32 bytes");
+    }
+    if (params.allowedTools.length === 0) {
+        throw new Error("allowedTools must be non-empty");
+    }
+    const settlementRail = validateSettlementRail(params.settlementRail);
+    const predicateRef = params.predicateRef ?? "";
+    const head = params.publishedPolicyHead;
+    if (head.templateId !== params.policyBinding.templateId || head.versionSeq !== params.policyBinding.versionSeq) {
+        throw new Error("publishedPolicyHead must match policyBinding template_id and version_seq");
+    }
+    ensureEd25519Sha512Sync();
+    const payeePub = getPublicKey(params.payeeSigningSeed);
+    const msg = intentCreationSignBytesWithPolicyBinding({
+        tenantId: params.tenantId,
+        intentId: params.intentId,
+        principalDid: params.principalDid,
+        payeeDid: params.payeeDid,
+        payeePubkeyBytes: payeePub,
+        amountCents: params.amountCents,
+        currency: params.currency,
+        deadlineRfc3339: params.deadlineRfc3339,
+        budget: params.budget,
+        evidenceSchema: params.evidenceSchema,
+        materializedPredicate: head.materializedPredicate,
+        predicateRef,
+        allowedTools: params.allowedTools,
+        settlementRail,
+        policyBinding: params.policyBinding,
+        policyContentDigestHex: head.policyContentDigestHex,
+        completionContract: params.completionContract,
+    });
+    const sig = sign(msg, params.principalSigningSeed);
+    const pub = getPublicKey(params.principalSigningSeed);
+    const body = {
+        intent_id: params.intentId,
+        principal_did: params.principalDid,
+        principal_pubkey: bytesToBase64(pub),
+        principal_signature: bytesToBase64(sig),
+        payee_did: params.payeeDid,
+        payee_pubkey: bytesToBase64(payeePub),
+        budget: params.budget,
+        currency: params.currency,
+        amount_cents: params.amountCents,
+        evidence_schema: params.evidenceSchema,
+        deadline: params.deadlineRfc3339,
+        settlement_rail: settlementRail,
+        signing_version: 7,
+        policy_binding: {
+            template_id: params.policyBinding.templateId,
+            version_seq: params.policyBinding.versionSeq,
+        },
+        allowed_tools: params.allowedTools,
+    };
+    if (predicateRef.trim() !== "") {
+        body.predicate_ref = predicateRef;
+    }
+    if (params.completionPresetId?.trim()) {
+        body.completion_preset_id = params.completionPresetId.trim();
+    }
+    return body;
 }
 function bytesToBase64(bytes) {
     let binary = "";
@@ -95,17 +241,22 @@ export function buildSignedCreateIntentBody(params) {
     if (params.principalSigningSeed.length !== 32) {
         throw new Error("principalSigningSeed must be 32 bytes");
     }
+    if (params.payeeSigningSeed.length !== 32) {
+        throw new Error("payeeSigningSeed must be 32 bytes");
+    }
     if (params.allowedTools.length === 0) {
         throw new Error("allowedTools must be non-empty");
     }
     const settlementRail = validateSettlementRail(params.settlementRail);
     const predicateRef = params.predicateRef ?? "";
     ensureEd25519Sha512Sync();
+    const payeePub = getPublicKey(params.payeeSigningSeed);
     const msg = intentCreationSignBytesRaw({
         tenantId: params.tenantId,
         intentId: params.intentId,
         principalDid: params.principalDid,
         payeeDid: params.payeeDid,
+        payeePubkeyBytes: payeePub,
         amountCents: params.amountCents,
         currency: params.currency,
         deadlineRfc3339: params.deadlineRfc3339,
@@ -115,6 +266,7 @@ export function buildSignedCreateIntentBody(params) {
         predicateRef,
         allowedTools: params.allowedTools,
         settlementRail,
+        completionContract: params.completionContract,
     });
     const sig = sign(msg, params.principalSigningSeed);
     const pub = getPublicKey(params.principalSigningSeed);
@@ -124,6 +276,7 @@ export function buildSignedCreateIntentBody(params) {
         principal_pubkey: bytesToBase64(pub),
         principal_signature: bytesToBase64(sig),
         payee_did: params.payeeDid,
+        payee_pubkey: bytesToBase64(payeePub),
         budget: params.budget,
         currency: params.currency,
         amount_cents: params.amountCents,
@@ -131,12 +284,15 @@ export function buildSignedCreateIntentBody(params) {
         deadline: params.deadlineRfc3339,
         predicate_dsl: params.predicate,
         settlement_rail: settlementRail,
-        signing_version: 4,
+        signing_version: 6,
         policy_binding: null,
         allowed_tools: params.allowedTools,
     };
     if (predicateRef.trim() !== "") {
         body.predicate_ref = predicateRef;
     }
+    if (params.completionPresetId?.trim()) {
+        body.completion_preset_id = params.completionPresetId.trim();
+    }
     return body;
 }

package/dist/project-init.d.ts

@@ -0,0 +1,34 @@
+import type { PolicyPresetId } from "./policy/presets.js";
+import { type SolutionId } from "./solutions/catalog.js";
+export type ProjectInitSolution = SolutionId | "mcp-server";
+export type ProjectInitFramework = "openai" | "langgraph" | "mcp" | "generic";
+export type ProjectInitLanguage = "typescript" | "python";
+export type ProjectInitOptions = {
+    cwd: string;
+    solution?: ProjectInitSolution;
+    maxSpendUsd?: number;
+    framework?: ProjectInitFramework;
+    language?: ProjectInitLanguage;
+    nonInteractive?: boolean;
+    force?: boolean;
+    writeStdout?: (line: string) => void;
+    prompt?: (question: string) => Promise<string>;
+};
+export type ProjectInitResult = {
+    solution: ProjectInitSolution;
+    preset_id: PolicyPresetId;
+    max_spend_usd: number;
+    framework: ProjectInitFramework;
+    language: ProjectInitLanguage;
+    files: string[];
+    smoke_command: string;
+};
+declare function usage(): string;
+export type ProjectInitArgv = Omit<ProjectInitOptions, "cwd"> & {
+    template?: string;
+    help?: boolean;
+};
+export declare function parseProjectInitArgv(argv: string[]): ProjectInitArgv | "help";
+/** Run the interactive or flag-driven project scaffold wizard. */
+export declare function runProjectInit(options: ProjectInitOptions): Promise<ProjectInitResult>;
+export { usage as projectInitUsage };