@paybond/kit 0.11.10 → 0.12.0

package/dist/mastra/config.js

@@ -0,0 +1,58 @@
+function resolveMastraToolCallId(context, fallback) {
+    if (typeof context === "object" && context !== null) {
+        const record = context;
+        const agent = record.agent;
+        if (typeof agent === "object" && agent !== null) {
+            const toolCallId = agent.toolCallId;
+            if (typeof toolCallId === "string" && toolCallId.trim()) {
+                return toolCallId.trim();
+            }
+        }
+        const direct = record.toolCallId;
+        if (typeof direct === "string" && direct.trim()) {
+            return direct.trim();
+        }
+    }
+    return fallback;
+}
+function wrapMastraTool(run, tool) {
+    const toolName = tool.id.trim();
+    if (typeof tool.execute !== "function" || !run.registry.isSideEffecting(toolName)) {
+        return tool;
+    }
+    const originalExecute = tool.execute.bind(tool);
+    return {
+        ...tool,
+        execute: async (inputData, context) => {
+            const toolCallId = resolveMastraToolCallId(context, globalThis.crypto.randomUUID());
+            const wrapped = await run.interceptor.wrapExecute({
+                toolName,
+                toolCallId,
+                arguments: inputData,
+                approvalToken: run.getApprovalToken(toolCallId),
+                execute: () => originalExecute(inputData, context),
+            });
+            return wrapped.toolResult;
+        },
+    };
+}
+/**
+ * Wrap side-effecting Mastra tools with Paybond `wrapExecute` so Harbor verify,
+ * spend finalize, and auto-evidence run after successful execution.
+ *
+ * Read-only tools pass through unchanged.
+ */
+export function paybondMastraWrapTools(run, tools) {
+    return tools.map((tool) => wrapMastraTool(run, tool));
+}
+/**
+ * Framework runner helper for Mastra `createTool({ execute })` definitions.
+ *
+ * Preserves schema, id, and description; replaces `execute` only on
+ * side-effecting registry tools.
+ */
+export function createPaybondMastraConfig(run, tools) {
+    return {
+        tools: paybondMastraWrapTools(run, tools),
+    };
+}

package/dist/mastra/index.d.ts

@@ -0,0 +1,2 @@
+export { createPaybondMastraConfig, paybondMastraWrapTools, type MastraToolLike, type PaybondMastraConfig, } from "./config.js";
+export { runMastraSandboxDemo, type RunMastraSandboxDemoInput, type RunMastraSandboxDemoResult, } from "./sandbox-demo.js";

package/dist/mastra/index.js

@@ -0,0 +1,2 @@
+export { createPaybondMastraConfig, paybondMastraWrapTools, } from "./config.js";
+export { runMastraSandboxDemo, } from "./sandbox-demo.js";

package/dist/mastra/peer.d.ts

@@ -0,0 +1,11 @@
+type MastraToolsModule = typeof import("@mastra/core/tools");
+/**
+ * Lazily resolve the optional `@mastra/core` peer dependency.
+ *
+ * Importing `@paybond/kit/mastra` must not require Mastra installed — the peer
+ * is only needed when adapter functions or the sandbox demo actually run.
+ */
+export declare function loadMastraTools(): MastraToolsModule;
+/** Re-export {@link loadMastraTools} as `createTool` for sandbox demos. */
+export declare function loadMastraCreateTool(): MastraToolsModule["createTool"];
+export {};

package/dist/mastra/peer.js

@@ -0,0 +1,24 @@
+import { createRequire } from "node:module";
+let cachedMastraTools;
+/**
+ * Lazily resolve the optional `@mastra/core` peer dependency.
+ *
+ * Importing `@paybond/kit/mastra` must not require Mastra installed — the peer
+ * is only needed when adapter functions or the sandbox demo actually run.
+ */
+export function loadMastraTools() {
+    if (cachedMastraTools === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedMastraTools = require("@mastra/core/tools");
+        }
+        catch (err) {
+            throw new Error('The Mastra integration requires the optional peer dependency "@mastra/core"; install it with: npm install @mastra/core', { cause: err });
+        }
+    }
+    return cachedMastraTools;
+}
+/** Re-export {@link loadMastraTools} as `createTool` for sandbox demos. */
+export function loadMastraCreateTool() {
+    return loadMastraTools().createTool;
+}

package/dist/mastra/sandbox-demo.d.ts

@@ -0,0 +1,36 @@
+import type { Paybond } from "../index.js";
+export type RunMastraSandboxDemoInput = {
+    paybond: Paybond;
+    operation?: string;
+    requestedSpendCents?: number;
+    evidencePreset?: string;
+    toolCallId?: string;
+};
+export type RunMastraSandboxDemoResult = {
+    bind: {
+        run_id: string;
+        tenant_id: string;
+        intent_id: string;
+        capability_token: string;
+        operation: string;
+        sandbox_lifecycle_status?: string;
+    };
+    authorization: {
+        allow: boolean;
+        audit_id?: string;
+        decision_id?: string;
+    };
+    execute: {
+        tool_result?: unknown;
+        evidence?: {
+            submitted: boolean;
+            sandbox_lifecycle_status?: string;
+            predicate_passed?: boolean | null;
+        };
+    };
+};
+/**
+ * No-LLM Mastra sandbox demo: wrapped `createTool` execute + auto-evidence.
+ * Requires optional peer `@mastra/core`.
+ */
+export declare function runMastraSandboxDemo(input: RunMastraSandboxDemoInput): Promise<RunMastraSandboxDemoResult>;

package/dist/mastra/sandbox-demo.js

@@ -0,0 +1,87 @@
+import { z } from "zod";
+import { createPaybondToolRegistry } from "../agent/registry.js";
+import { createPaybondMastraConfig } from "./config.js";
+import { loadMastraCreateTool } from "./peer.js";
+async function executePaidTool(args) {
+    return { status: "completed", cost_cents: args.estimatedPriceCents };
+}
+/**
+ * No-LLM Mastra sandbox demo: wrapped `createTool` execute + auto-evidence.
+ * Requires optional peer `@mastra/core`.
+ */
+export async function runMastraSandboxDemo(input) {
+    const operation = (input.operation ?? "paid-tool").trim();
+    const requestedSpendCents = input.requestedSpendCents ?? 100;
+    const evidencePreset = (input.evidencePreset ?? "cost_and_completion").trim();
+    const toolCallId = (input.toolCallId ?? "mastra-demo-1").trim();
+    const registry = createPaybondToolRegistry({
+        defaultDeny: true,
+        sideEffecting: {
+            [operation]: {
+                operation,
+                evidencePreset,
+                spendCents: (args) => typeof args === "object" &&
+                    args !== null &&
+                    "estimatedPriceCents" in args &&
+                    typeof args.estimatedPriceCents === "number"
+                    ? args.estimatedPriceCents
+                    : requestedSpendCents,
+                evidenceMapper: (result) => {
+                    const payload = result;
+                    return {
+                        status: payload.status,
+                        cost_cents: payload.cost_cents,
+                    };
+                },
+            },
+        },
+    });
+    const run = await input.paybond.agentRun.bind({
+        bootstrap: {
+            kind: "sandbox",
+            operation,
+            requestedSpendCents,
+            completionPreset: evidencePreset,
+        },
+        registry,
+    });
+    const createTool = loadMastraCreateTool();
+    const rawTools = [
+        createTool({
+            id: operation,
+            description: `Paid operation ${operation}`,
+            inputSchema: z.object({
+                estimatedPriceCents: z.number().int().nonnegative(),
+            }),
+            execute: async (inputData) => executePaidTool(inputData),
+        }),
+    ];
+    const { tools } = createPaybondMastraConfig(run, rawTools);
+    const guardedTool = tools[0];
+    if (!guardedTool?.execute) {
+        throw new Error("Mastra sandbox demo missing guarded tool execute handler");
+    }
+    const toolResult = await guardedTool.execute({ estimatedPriceCents: requestedSpendCents }, { toolCallId });
+    const sandboxStatus = run.binding.sandbox?.sandboxLifecycleStatus;
+    return {
+        bind: {
+            run_id: run.runId,
+            tenant_id: run.tenantId,
+            intent_id: run.intentId,
+            capability_token: run.capabilityToken,
+            operation,
+            sandbox_lifecycle_status: sandboxStatus,
+        },
+        authorization: {
+            allow: true,
+        },
+        execute: {
+            tool_result: toolResult,
+            evidence: {
+                submitted: true,
+                sandbox_lifecycle_status: sandboxStatus,
+                predicate_passed: true,
+            },
+        },
+    };
+}

package/dist/mcp/index.d.ts

@@ -1 +1,2 @@
 export { createPaybondMcpToolSurface, type PaybondMcpToolSurface, type PaybondMcpToolSurfaceOptions, } from "./tool-surface.js";
+export { runMcpSandboxDemo, type RunMcpSandboxDemoInput, type RunMcpSandboxDemoResult, } from "./sandbox-demo.js";

package/dist/mcp/index.js

@@ -1 +1,2 @@
 export { createPaybondMcpToolSurface, } from "./tool-surface.js";
+export { runMcpSandboxDemo, } from "./sandbox-demo.js";

package/dist/mcp/sandbox-demo.d.ts

@@ -0,0 +1,38 @@
+import type { Paybond } from "../index.js";
+export type RunMcpSandboxDemoInput = {
+    paybond: Paybond;
+    apiKey: string;
+    gatewayBaseUrl: string;
+    operation?: string;
+    requestedSpendCents?: number;
+    evidencePreset?: string;
+};
+export type RunMcpSandboxDemoResult = {
+    bind: {
+        run_id: string;
+        tenant_id: string;
+        intent_id: string;
+        capability_token: string;
+        operation: string;
+        sandbox_lifecycle_status?: string;
+    };
+    authorization: {
+        allow: boolean;
+        audit_id?: string;
+        decision_id?: string;
+    };
+    tool_result: {
+        status: string;
+        cost_cents: number;
+    };
+    evidence: {
+        submitted: boolean;
+        sandbox_lifecycle_status?: string;
+        predicate_passed?: boolean | null;
+    };
+};
+/**
+ * No-LLM MCP sandbox demo: agent-run bind + in-process `PaybondMCPServer.callTool`
+ * for authorize and evidence (no stdio subprocess).
+ */
+export declare function runMcpSandboxDemo(input: RunMcpSandboxDemoInput): Promise<RunMcpSandboxDemoResult>;

package/dist/mcp/sandbox-demo.js

@@ -0,0 +1,112 @@
+import { createPaybondToolRegistry } from "../agent/registry.js";
+import { PaybondMCPServer } from "../mcp-server.js";
+function readStructuredContent(result) {
+    const structured = result.structuredContent;
+    return typeof structured === "object" && structured !== null
+        ? structured
+        : undefined;
+}
+/**
+ * No-LLM MCP sandbox demo: agent-run bind + in-process `PaybondMCPServer.callTool`
+ * for authorize and evidence (no stdio subprocess).
+ */
+export async function runMcpSandboxDemo(input) {
+    const operation = (input.operation ?? "paid-tool").trim();
+    const requestedSpendCents = input.requestedSpendCents ?? 100;
+    const evidencePreset = (input.evidencePreset ?? "cost_and_completion").trim();
+    const registry = createPaybondToolRegistry({
+        defaultDeny: true,
+        sideEffecting: {
+            [operation]: {
+                operation,
+                evidencePreset,
+                spendCents: requestedSpendCents,
+            },
+        },
+    });
+    const run = await input.paybond.agentRun.bind({
+        bootstrap: {
+            kind: "sandbox",
+            operation,
+            requestedSpendCents,
+            completionPreset: evidencePreset,
+        },
+        registry,
+    });
+    const server = new PaybondMCPServer({
+        gatewayBaseUrl: input.gatewayBaseUrl,
+        apiKey: input.apiKey,
+    });
+    const authorizeResult = await server.callTool("paybond_authorize_agent_spend", {
+        intent_id: run.intentId,
+        token: run.capabilityToken,
+        operation,
+        requested_spend_cents: requestedSpendCents,
+    });
+    if (authorizeResult.isError) {
+        const message = authorizeResult.content[0]?.type === "text"
+            ? authorizeResult.content[0].text
+            : "paybond_authorize_agent_spend failed";
+        throw new Error(message);
+    }
+    const authorizationBody = readStructuredContent(authorizeResult) ?? {};
+    const toolResult = {
+        status: "completed",
+        cost_cents: requestedSpendCents,
+    };
+    const validationResult = await server.callTool("paybond_validate_completion_evidence", {
+        preset_id: evidencePreset,
+        vendor_payload: toolResult,
+        canonical_payload: toolResult,
+    });
+    if (validationResult.isError) {
+        const message = validationResult.content[0]?.type === "text"
+            ? validationResult.content[0].text
+            : "paybond_validate_completion_evidence failed";
+        throw new Error(message);
+    }
+    const validationBody = readStructuredContent(validationResult) ?? {};
+    if (validationBody.ok !== true) {
+        throw new Error("paybond_validate_completion_evidence did not pass");
+    }
+    const evidenceResult = await server.callTool("paybond_submit_sandbox_guardrail_evidence", {
+        intent_id: run.intentId,
+        payload: toolResult,
+        operation,
+        requested_spend_cents: requestedSpendCents,
+        completion_preset_id: evidencePreset,
+    });
+    if (evidenceResult.isError) {
+        const message = evidenceResult.content[0]?.type === "text"
+            ? evidenceResult.content[0].text
+            : "paybond_submit_sandbox_guardrail_evidence failed";
+        throw new Error(message);
+    }
+    const evidenceBody = readStructuredContent(evidenceResult) ?? {};
+    const sandboxStatus = typeof evidenceBody.sandbox_lifecycle_status === "string"
+        ? evidenceBody.sandbox_lifecycle_status
+        : run.binding.sandbox?.sandboxLifecycleStatus;
+    return {
+        bind: {
+            run_id: run.runId,
+            tenant_id: run.tenantId,
+            intent_id: run.intentId,
+            capability_token: run.capabilityToken,
+            operation,
+            sandbox_lifecycle_status: sandboxStatus,
+        },
+        authorization: {
+            allow: authorizationBody.allow === true,
+            audit_id: typeof authorizationBody.audit_id === "string" ? authorizationBody.audit_id : undefined,
+            decision_id: typeof authorizationBody.decision_id === "string"
+                ? authorizationBody.decision_id
+                : undefined,
+        },
+        tool_result: toolResult,
+        evidence: {
+            submitted: true,
+            sandbox_lifecycle_status: sandboxStatus,
+            predicate_passed: typeof evidenceBody.predicate_passed === "boolean" ? evidenceBody.predicate_passed : true,
+        },
+    };
+}

package/dist/mcp-receipt-resource.d.ts

@@ -0,0 +1,10 @@
+/** MCP resource URI helpers for tenant-bound agent receipt handoff. */
+export declare const MCP_AGENT_RECEIPT_RESOURCE_SCHEME = "paybond";
+export declare const MCP_AGENT_RECEIPT_RESOURCE_HOST = "receipt";
+export declare const MCP_AGENT_RECEIPT_RESOURCE_URI_TEMPLATE = "paybond://receipt/{receipt_id}";
+export declare const MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE = "application/json";
+/** Parse `paybond://receipt/{receipt_id}` into a canonical receipt id. */
+export declare function parseAgentReceiptResourceUri(uri: string): string;
+/** Build the MCP resource URI for one signed agent receipt id. */
+export declare function agentReceiptResourceUri(receiptId: string): string;
+export declare function agentReceiptResourceTemplateDefinition(): Record<string, unknown>;

package/dist/mcp-receipt-resource.js

@@ -0,0 +1,32 @@
+/** MCP resource URI helpers for tenant-bound agent receipt handoff. */
+export const MCP_AGENT_RECEIPT_RESOURCE_SCHEME = "paybond";
+export const MCP_AGENT_RECEIPT_RESOURCE_HOST = "receipt";
+export const MCP_AGENT_RECEIPT_RESOURCE_URI_TEMPLATE = "paybond://receipt/{receipt_id}";
+export const MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE = "application/json";
+const RECEIPT_URI_RE = /^paybond:\/\/receipt\/([0-9a-f]{64}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i;
+/** Parse `paybond://receipt/{receipt_id}` into a canonical receipt id. */
+export function parseAgentReceiptResourceUri(uri) {
+    const trimmed = uri.trim();
+    const match = RECEIPT_URI_RE.exec(trimmed);
+    if (!match) {
+        throw new Error(`unsupported resource URI ${trimmed}; expected ${MCP_AGENT_RECEIPT_RESOURCE_URI_TEMPLATE}`);
+    }
+    return match[1].toLowerCase();
+}
+/** Build the MCP resource URI for one signed agent receipt id. */
+export function agentReceiptResourceUri(receiptId) {
+    const normalized = receiptId.trim().toLowerCase();
+    if (!RECEIPT_URI_RE.test(`paybond://receipt/${normalized}`)) {
+        throw new Error("receipt_id must be a lowercase SHA-256 hex digest or canonical UUID");
+    }
+    return `paybond://receipt/${normalized}`;
+}
+export function agentReceiptResourceTemplateDefinition() {
+    return {
+        uriTemplate: MCP_AGENT_RECEIPT_RESOURCE_URI_TEMPLATE,
+        name: "paybond_agent_receipt",
+        title: "Paybond Agent Receipt",
+        description: "Signed paybond.agent_receipt_v1 JSON fetched tenant-bound from Gateway GET /protocol/v2/agent-receipts/{receipt_id}.",
+        mimeType: MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE,
+    };
+}

package/dist/mcp-server.d.ts

@@ -44,6 +44,12 @@ export declare class PaybondMCPServer {
     private readonly toolPolicy;
     private initialized;
     constructor(settings: PaybondMCPSettings);
+    listResourceTemplates(): Array<Record<string, unknown>>;
+    readResource(uri: string): Promise<{
+        uri: string;
+        mimeType: string;
+        text: string;
+    }>;
     listTools(): Array<Record<string, unknown>>;
     callTool(name: string, args?: Record<string, unknown>): Promise<MCPCallToolResult>;
     handleMessage(message: JSONRPCRequest): Promise<JSONRPCResponse | null>;

package/dist/mcp-server.js

@@ -11,9 +11,10 @@ import { MCP_TOOL_ALLOWLIST_ENV, MCP_TOOL_POLICY_ENV, mergeMcpToolPolicy, parseM
 import { MCP_EVIDENCE_POLICY_ENV, McpEvidenceValidationGate, completionEvidenceValidationOk, extractHarborEvidenceValidationInput, extractSandboxGuardrailValidationInput, parseMcpEvidencePolicy, } from "./mcp-evidence-policy.js";
 import { McpCapabilityTokenCache, mcpToolStoresCapabilityToken, parseMcpCapabilityTokenCacheConfig, } from "./mcp-capability-token-cache.js";
 import { createMcpPolicyGatewayAdapter, McpPolicyReloadGate, parseMcpPolicyReloadConfig, } from "./mcp-policy-reload.js";
+import { agentReceiptResourceTemplateDefinition, agentReceiptResourceUri, MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE, parseAgentReceiptResourceUri, } from "./mcp-receipt-resource.js";
 import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.11.10";
+const SERVER_VERSION = "0.12.0";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
 const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";
@@ -160,6 +161,25 @@ const TOOL_SELECTION_METADATA = {
             tenant_id: { type: "string" },
         }),
     },
+    paybond_list_audit_exports: {
+        title: "List Audit Exports",
+        annotations: readOnlyToolAnnotations("List Audit Exports"),
+        outputSchema: outputObjectSchema({
+            tenant_realm_id: { type: "string" },
+            jobs: {
+                type: "array",
+                items: { type: "object", additionalProperties: true },
+            },
+            next_cursor: { type: "string" },
+        }),
+    },
+    paybond_get_audit_export: {
+        title: "Get Audit Export",
+        annotations: readOnlyToolAnnotations("Get Audit Export"),
+        outputSchema: outputObjectSchema({
+            job: { type: "object", additionalProperties: true },
+        }),
+    },
     paybond_get_reputation_receipt: {
         title: "Get Reputation Receipt",
         annotations: readOnlyToolAnnotations("Get Reputation Receipt"),
@@ -665,6 +685,20 @@ class PaybondMCPRuntime {
             "x-tenant-id": await this.tenantId(),
         });
     }
+    async listAuditExports(init) {
+        const params = new URLSearchParams({
+            limit: String(Math.max(1, Math.min(intArg(init.limit ?? 50, "limit"), 200))),
+        });
+        if (init.cursor?.trim()) {
+            params.set("cursor", init.cursor.trim());
+        }
+        const body = await this.gateway.getJSON(`/v1/compliance/audit-exports?${params.toString()}`);
+        return body;
+    }
+    async getAuditExport(jobId, init) {
+        const query = init?.issueDownload ? "?issue_download=1" : "";
+        return this.gateway.getJSON(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}${query}`);
+    }
     async getA2AAgentCard() {
         return this.gateway.getJSON("/.well-known/agent-card.json");
     }
@@ -813,6 +847,22 @@ class PaybondMCPRuntime {
             "x-tenant-id": await this.tenantId(),
         });
     }
+    async getAgentReceiptV1(receiptId) {
+        const normalized = receiptId.trim().toLowerCase();
+        const body = await this.gateway.getJSON(`/protocol/v2/agent-receipts/${encodeURIComponent(normalized)}`, {
+            "x-tenant-id": await this.tenantId(),
+        });
+        const expectedTenant = await this.tenantId();
+        const echoedTenant = String(body.tenant_id ?? "").trim();
+        if (echoedTenant !== expectedTenant) {
+            throw new Error(`tenant mismatch: expected=${expectedTenant} gateway=${echoedTenant}`);
+        }
+        const echoedReceipt = String(body.receipt_id ?? "").trim().toLowerCase();
+        if (echoedReceipt !== normalized) {
+            throw new Error(`receipt mismatch: requested=${normalized} gateway=${echoedReceipt}`);
+        }
+        return body;
+    }
     async createHarborIntent(init) {
         return this.gateway.postJSON("/harbor/intents", init.body, gatewayMutationHeaders(await this.tenantId(), init.recognitionProof, optionalMutationHeaders(init.idempotencyKey)));
     }
@@ -863,6 +913,18 @@ export class PaybondMCPServer {
         this.runtime = new PaybondMCPRuntime(settings);
         this.tools = this.buildTools(settings).filter((tool) => toolAllowedByPolicy(tool.name, tool.annotations, this.toolPolicy));
     }
+    listResourceTemplates() {
+        return [agentReceiptResourceTemplateDefinition()];
+    }
+    async readResource(uri) {
+        const receiptId = parseAgentReceiptResourceUri(uri);
+        const receipt = await this.runtime.getAgentReceiptV1(receiptId);
+        return {
+            uri: agentReceiptResourceUri(receiptId),
+            mimeType: MCP_AGENT_RECEIPT_RESOURCE_MIME_TYPE,
+            text: JSON.stringify(receipt, null, 2),
+        };
+    }
     listTools() {
         return this.tools.map((tool) => ({
             name: tool.name,
@@ -940,6 +1002,10 @@ export class PaybondMCPServer {
                             tools: {
                                 listChanged: false,
                             },
+                            resources: {
+                                subscribe: false,
+                                listChanged: false,
+                            },
                         },
                         serverInfo: {
                             name: SERVER_NAME,
@@ -969,6 +1035,34 @@ export class PaybondMCPServer {
                         tools: this.listTools(),
                     },
                 };
+            case "resources/list":
+                return {
+                    jsonrpc: "2.0",
+                    id: message.id,
+                    result: {
+                        resources: [],
+                    },
+                };
+            case "resources/templates/list":
+                return {
+                    jsonrpc: "2.0",
+                    id: message.id,
+                    result: {
+                        resourceTemplates: this.listResourceTemplates(),
+                    },
+                };
+            case "resources/read": {
+                const params = ensureObject(message.params, "resources/read params");
+                const uri = stringArg(params.uri, "uri");
+                const contents = await this.readResource(uri);
+                return {
+                    jsonrpc: "2.0",
+                    id: message.id,
+                    result: {
+                        contents: [contents],
+                    },
+                };
+            }
             case "tools/call": {
                 const params = ensureObject(message.params, "tools/call params");
                 const name = stringArg(params.name, "name");
@@ -1238,6 +1332,35 @@ export class PaybondMCPServer {
                 }, ["intent_id"]),
                 call: async (args) => this.runtime.getIntent(uuidArg(args.intent_id, "intent_id")),
             },
+            {
+                name: "paybond_list_audit_exports",
+                description: "List tenant-scoped compliance audit export jobs through the gateway operator view.",
+                inputSchema: objectSchema({
+                    limit: { type: "integer", minimum: 1, maximum: 200 },
+                    cursor: { type: "string" },
+                }),
+                call: async (args) => this.runtime.listAuditExports({
+                    limit: args.limit === undefined ? undefined : intArg(args.limit, "limit"),
+                    cursor: optionalString(args.cursor),
+                }),
+            },
+            {
+                name: "paybond_get_audit_export",
+                description: "Fetch one tenant-scoped compliance audit export job detail through the gateway operator view.",
+                inputSchema: objectSchema({
+                    job_id: {
+                        type: "string",
+                        description: "Compliance audit export job identifier.",
+                    },
+                    issue_download: {
+                        type: "boolean",
+                        description: "When true, request a bundle download token for ready exports.",
+                    },
+                }, ["job_id"]),
+                call: async (args) => this.runtime.getAuditExport(stringArg(args.job_id, "job_id"), {
+                    issueDownload: args.issue_download === true,
+                }),
+            },
             {
                 name: "paybond_get_reputation_receipt",
                 description: "Fetch the signed Signal receipt for one operator DID.",

package/dist/mpp-commercial.d.ts

@@ -0,0 +1,19 @@
+/**
+ * MPP commercial denomination helpers for Paybond MVP.
+ *
+ * Paybond intent commercial fields remain USD-denominated (`amount_cents`, `currency`).
+ * Tempo session deposits use USDC base units (6 decimals): `amount_cents * 10_000`.
+ */
+import type { SettlementRail } from "./principal-intent.js";
+/** USDC uses 6 decimal places; one USD cent maps to 10_000 base units. */
+export declare const USDC_BASE_UNITS_PER_USD_CENT = 10000;
+/** Rails that require USD-denominated commercial intent fields for MVP. */
+export declare const USD_DENOMINATED_SETTLEMENT_RAILS: Set<SettlementRail>;
+/**
+ * Rejects non-USD intents on rails that remain USD-denominated for MVP.
+ */
+export declare function validateUsdDenominatedSettlement(settlementRail: SettlementRail, currency: string): void;
+/**
+ * Converts Paybond USD cents to Tempo USDC base units.
+ */
+export declare function usdCentsToUsdcBaseUnits(amountCents: number): bigint;