@paybond/kit 0.11.10 → 0.12.0

package/dist/audit/exports.d.ts

@@ -0,0 +1,72 @@
+import { type AuditExportCreateFilter, type AuditExportJobGetResponse, type AuditExportListPage, type AuditVerifyResult } from "./wire.js";
+export type AuditExportsGateway = {
+    getJson(path: string): Promise<Record<string, unknown>>;
+    postJson?(path: string, body: Record<string, unknown>): Promise<Record<string, unknown>>;
+    deleteJson?(path: string): Promise<Record<string, unknown>>;
+};
+export type GatewayAuditExportsClientOptions = {
+    staticGatewayBearerToken: string;
+    maxRetries?: number;
+};
+/**
+ * Gateway-backed compliance audit export client for `GET /v1/compliance/audit-exports`.
+ */
+export declare class GatewayAuditExportsClient implements AuditExportsGateway {
+    private readonly tenantId;
+    private readonly base;
+    private readonly bearerToken;
+    private readonly maxRetries;
+    constructor(gatewayBaseUrl: string, tenantId: string, options: GatewayAuditExportsClientOptions);
+    getJson(path: string): Promise<Record<string, unknown>>;
+    postJson(path: string, body: Record<string, unknown>): Promise<Record<string, unknown>>;
+    deleteJson(path: string): Promise<Record<string, unknown>>;
+    private requestJSON;
+}
+export type PaybondAuditExportsListParams = {
+    limit?: number;
+    cursor?: string;
+};
+export type PaybondAuditExportsGetParams = {
+    issueDownload?: boolean;
+};
+export type PaybondAuditExportsCreateParams = {
+    filter: AuditExportCreateFilter;
+    /** Defaults to `standard` when omitted. */
+    disclosureTier?: "standard" | "extended";
+    /** Bundle retention in hours (gateway default 168, max 720). */
+    retentionHours?: number;
+};
+/**
+ * SDK surface for compliance audit export jobs and local bundle verification.
+ */
+export declare class PaybondAuditExports {
+    private readonly gateway;
+    constructor(gateway: AuditExportsGateway);
+    /** Wrap an existing gateway client (CLI, tests, or custom transport). */
+    static fromGateway(gateway: AuditExportsGateway): PaybondAuditExports;
+    /** Open a tenant-bound audit exports client from gateway credentials. */
+    static open(gatewayBaseUrl: string, tenantId: string, options: GatewayAuditExportsClientOptions): PaybondAuditExports;
+    list(params?: PaybondAuditExportsListParams): Promise<AuditExportListPage>;
+    get(jobId: string, params?: PaybondAuditExportsGetParams): Promise<AuditExportJobGetResponse>;
+    /**
+     * Create a compliance audit export job (`POST /v1/compliance/audit-exports`).
+     * Tenant scope comes from the API key — never pass a tenant id.
+     */
+    create(params: PaybondAuditExportsCreateParams): Promise<AuditExportJobGetResponse>;
+    delete(jobId: string): Promise<{
+        job_id: string;
+        deleted: true;
+    }>;
+    /**
+     * Verify a signed audit export manifest object or a local bundle path.
+     * Bundle verification requires filesystem access; use SDK/CLI rather than MCP.
+     */
+    verify(manifestOrPath: Record<string, unknown> | string, options?: {
+        cwd?: string;
+    }): Promise<AuditVerifyResult>;
+}
+/** Namespace wrapper attached to {@link Paybond} as `paybond.audit.exports`. */
+export declare class PaybondAudit {
+    readonly exports: PaybondAuditExports;
+    constructor(exports: PaybondAuditExports);
+}

package/dist/audit/exports.js

@@ -0,0 +1,185 @@
+import { parseAuditExportJobGet, parseAuditExportList, } from "./wire.js";
+import { auditVerifyResult, verifyAuditBundleLocal } from "./verify.js";
+import process from "node:process";
+function normalizeBase(url) {
+    return url.replace(/\/+$/, "");
+}
+function backoffMs(attempt) {
+    return Math.min(1000 * 2 ** attempt, 8000);
+}
+function parseRetryAfterSeconds(value) {
+    if (!value?.trim()) {
+        return null;
+    }
+    const seconds = Number.parseInt(value.trim(), 10);
+    return Number.isFinite(seconds) && seconds >= 0 ? seconds : null;
+}
+function delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Gateway-backed compliance audit export client for `GET /v1/compliance/audit-exports`.
+ */
+export class GatewayAuditExportsClient {
+    tenantId;
+    base;
+    bearerToken;
+    maxRetries;
+    constructor(gatewayBaseUrl, tenantId, options) {
+        this.tenantId = tenantId;
+        this.base = `${normalizeBase(gatewayBaseUrl)}/`;
+        this.bearerToken = options.staticGatewayBearerToken.trim();
+        this.maxRetries = Math.max(1, options.maxRetries ?? 3);
+    }
+    async getJson(path) {
+        return this.requestJSON("GET", path);
+    }
+    async postJson(path, body) {
+        return this.requestJSON("POST", path, body);
+    }
+    async deleteJson(path) {
+        return this.requestJSON("DELETE", path);
+    }
+    async requestJSON(method, path, body) {
+        const url = `${this.base}${path.replace(/^\//, "")}`;
+        let lastErr;
+        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+            let res;
+            try {
+                const headers = {
+                    accept: "application/json",
+                    authorization: `Bearer ${this.bearerToken}`,
+                };
+                const init = { method, headers };
+                if (method === "POST") {
+                    headers["content-type"] = "application/json";
+                    init.body = JSON.stringify(body ?? {});
+                }
+                res = await fetch(url, init);
+            }
+            catch (err) {
+                lastErr = err;
+                if (attempt + 1 >= this.maxRetries) {
+                    throw err;
+                }
+                await delay(backoffMs(attempt));
+                continue;
+            }
+            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
+                const retryAfter = parseRetryAfterSeconds(res.headers.get("retry-after"));
+                await delay(retryAfter != null ? retryAfter * 1000 : backoffMs(attempt));
+                continue;
+            }
+            const text = await res.text();
+            if (!res.ok) {
+                throw new Error(`Gateway ${method} ${path} HTTP ${res.status}: ${text}`);
+            }
+            if (!text.trim()) {
+                return {};
+            }
+            const parsed = JSON.parse(text);
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new Error(`Gateway ${method} ${path} returned non-object JSON`);
+            }
+            return parsed;
+        }
+        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+    }
+}
+function buildAuditExportCreateBody(params) {
+    const filter = {};
+    const f = params.filter;
+    if (f.time_start?.trim()) {
+        filter.time_start = f.time_start.trim();
+    }
+    if (f.time_end?.trim()) {
+        filter.time_end = f.time_end.trim();
+    }
+    if (f.intent_id?.trim()) {
+        filter.intent_id = f.intent_id.trim();
+    }
+    if (f.case_id?.trim()) {
+        filter.case_id = f.case_id.trim();
+    }
+    if (f.operator_did?.trim()) {
+        filter.operator_did = f.operator_did.trim();
+    }
+    if (f.includes && f.includes.length > 0) {
+        filter.includes = [...f.includes];
+    }
+    const body = {
+        filter,
+        disclosure_tier: params.disclosureTier ?? "standard",
+    };
+    if (params.retentionHours != null && params.retentionHours > 0) {
+        body.retention_hours = params.retentionHours;
+    }
+    return body;
+}
+/**
+ * SDK surface for compliance audit export jobs and local bundle verification.
+ */
+export class PaybondAuditExports {
+    gateway;
+    constructor(gateway) {
+        this.gateway = gateway;
+    }
+    /** Wrap an existing gateway client (CLI, tests, or custom transport). */
+    static fromGateway(gateway) {
+        return new PaybondAuditExports(gateway);
+    }
+    /** Open a tenant-bound audit exports client from gateway credentials. */
+    static open(gatewayBaseUrl, tenantId, options) {
+        return new PaybondAuditExports(new GatewayAuditExportsClient(gatewayBaseUrl, tenantId, options));
+    }
+    async list(params) {
+        const search = new URLSearchParams();
+        const limit = params?.limit ?? 50;
+        search.set("limit", String(Math.max(1, Math.min(limit, 200))));
+        if (params?.cursor?.trim()) {
+            search.set("cursor", params.cursor.trim());
+        }
+        const body = await this.gateway.getJson(`/v1/compliance/audit-exports?${search.toString()}`);
+        return parseAuditExportList(body);
+    }
+    async get(jobId, params) {
+        const query = params?.issueDownload ? "?issue_download=1" : "";
+        const body = await this.gateway.getJson(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}${query}`);
+        return parseAuditExportJobGet(body);
+    }
+    /**
+     * Create a compliance audit export job (`POST /v1/compliance/audit-exports`).
+     * Tenant scope comes from the API key — never pass a tenant id.
+     */
+    async create(params) {
+        if (!this.gateway.postJson) {
+            throw new Error("audit export create is not supported by this gateway adapter");
+        }
+        const body = await this.gateway.postJson("/v1/compliance/audit-exports", buildAuditExportCreateBody(params));
+        return parseAuditExportJobGet(body);
+    }
+    async delete(jobId) {
+        if (!this.gateway.deleteJson) {
+            throw new Error("audit export delete is not supported by this gateway adapter");
+        }
+        await this.gateway.deleteJson(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}`);
+        return { job_id: jobId, deleted: true };
+    }
+    /**
+     * Verify a signed audit export manifest object or a local bundle path.
+     * Bundle verification requires filesystem access; use SDK/CLI rather than MCP.
+     */
+    async verify(manifestOrPath, options) {
+        if (typeof manifestOrPath === "string") {
+            return verifyAuditBundleLocal(manifestOrPath, options?.cwd ?? process.cwd());
+        }
+        return auditVerifyResult(manifestOrPath);
+    }
+}
+/** Namespace wrapper attached to {@link Paybond} as `paybond.audit.exports`. */
+export class PaybondAudit {
+    exports;
+    constructor(exports) {
+        this.exports = exports;
+    }
+}

package/dist/audit/index.d.ts

@@ -0,0 +1,3 @@
+export { GatewayAuditExportsClient, PaybondAudit, PaybondAuditExports, type AuditExportsGateway, type GatewayAuditExportsClientOptions, type PaybondAuditExportsCreateParams, type PaybondAuditExportsGetParams, type PaybondAuditExportsListParams, } from "./exports.js";
+export { auditVerifyResult, buildManifestCore, manifestCoreBytes, readManifestFromBundle, verifyAuditBundleLocal, verifyAuditManifest, MANIFEST_CORE_FIELD_ORDER, } from "./verify.js";
+export { parseAuditExportJobGet, parseAuditExportList, type AuditExportCreateFilter, type AuditExportJobDetail, type AuditExportJobGetResponse, type AuditExportJobSummary, type AuditExportListPage, type AuditVerifyResult, } from "./wire.js";

package/dist/audit/index.js

@@ -0,0 +1,3 @@
+export { GatewayAuditExportsClient, PaybondAudit, PaybondAuditExports, } from "./exports.js";
+export { auditVerifyResult, buildManifestCore, manifestCoreBytes, readManifestFromBundle, verifyAuditBundleLocal, verifyAuditManifest, MANIFEST_CORE_FIELD_ORDER, } from "./verify.js";
+export { parseAuditExportJobGet, parseAuditExportList, } from "./wire.js";

package/dist/audit/verify.d.ts

@@ -0,0 +1,8 @@
+import type { AuditVerifyResult } from "./wire.js";
+export declare const MANIFEST_CORE_FIELD_ORDER: readonly ["schema_version", "kind", "tenant_realm_id", "job_id", "generated_at_rfc3339", "gateway_build_version", "score_model_version", "disclosure_tier", "redaction_profile", "checkpoint_last_ledger_seq", "export_filter", "artifacts"];
+export declare function buildManifestCore(manifest: Record<string, unknown>): Record<string, unknown>;
+export declare function manifestCoreBytes(manifest: Record<string, unknown>): Uint8Array;
+export declare function verifyAuditManifest(manifest: Record<string, unknown>): boolean;
+export declare function auditVerifyResult(manifest: Record<string, unknown>, path?: string): AuditVerifyResult;
+export declare function readManifestFromBundle(bundlePath: string, cwd: string): Promise<string>;
+export declare function verifyAuditBundleLocal(path: string, cwd: string): Promise<AuditVerifyResult>;

package/dist/audit/verify.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { spawn } from "node:child_process";
+import { verify as ed25519Verify } from "@noble/ed25519";
+import { ensureEd25519Sha512Sync } from "../ed25519-sync.js";
+export const MANIFEST_CORE_FIELD_ORDER = [
+    "schema_version",
+    "kind",
+    "tenant_realm_id",
+    "job_id",
+    "generated_at_rfc3339",
+    "gateway_build_version",
+    "score_model_version",
+    "disclosure_tier",
+    "redaction_profile",
+    "checkpoint_last_ledger_seq",
+    "export_filter",
+    "artifacts",
+];
+export function buildManifestCore(manifest) {
+    const core = {};
+    for (const key of MANIFEST_CORE_FIELD_ORDER) {
+        if (key === "checkpoint_last_ledger_seq") {
+            if (!(key in manifest)) {
+                continue;
+            }
+            const value = manifest[key];
+            if (value === 0 || value === null) {
+                continue;
+            }
+            core[key] = value;
+            continue;
+        }
+        if (key in manifest) {
+            core[key] = manifest[key];
+        }
+    }
+    return core;
+}
+export function manifestCoreBytes(manifest) {
+    const core = buildManifestCore(manifest);
+    return new TextEncoder().encode(JSON.stringify(core));
+}
+function hexToBytes(hex) {
+    const normalized = hex.trim();
+    const out = new Uint8Array(normalized.length / 2);
+    for (let i = 0; i < out.length; i += 1) {
+        out[i] = Number.parseInt(normalized.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+function bytesToHex(bytes) {
+    return Array.from(bytes)
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+export function verifyAuditManifest(manifest) {
+    const coreBytes = manifestCoreBytes(manifest);
+    const digest = createHash("sha256").update(coreBytes).digest();
+    const expected = String(manifest.signed_payload_sha256_hex ?? "").trim().toLowerCase();
+    if (bytesToHex(new Uint8Array(digest)) !== expected) {
+        return false;
+    }
+    const signatureHex = String(manifest.ed25519_signature_hex ?? "").trim();
+    const publicKeyHex = String(manifest.signing_public_key_ed25519_hex ?? "").trim();
+    if (!signatureHex || !publicKeyHex) {
+        return false;
+    }
+    ensureEd25519Sha512Sync();
+    return ed25519Verify(hexToBytes(signatureHex), digest, hexToBytes(publicKeyHex));
+}
+export function auditVerifyResult(manifest, path) {
+    return {
+        verified: verifyAuditManifest(manifest),
+        manifest_kind: String(manifest.kind ?? ""),
+        tenant_realm_id: String(manifest.tenant_realm_id ?? ""),
+        job_id: String(manifest.job_id ?? ""),
+        ...(path ? { path } : {}),
+    };
+}
+export async function readManifestFromBundle(bundlePath, cwd) {
+    if (bundlePath.endsWith(".zip")) {
+        const result = await new Promise((resolvePromise) => {
+            const child = spawn("unzip", ["-p", bundlePath, "manifest.json"], { cwd });
+            let stdout = "";
+            let stderr = "";
+            child.stdout.on("data", (chunk) => {
+                stdout += String(chunk);
+            });
+            child.stderr.on("data", (chunk) => {
+                stderr += String(chunk);
+            });
+            child.on("close", (code) => resolvePromise({ code, stdout, stderr }));
+            child.on("error", () => resolvePromise({ code: 127, stdout: "", stderr: "unzip not found" }));
+        });
+        if (result.code !== 0 || !result.stdout.trim()) {
+            throw new Error(result.stderr.trim() || "unable to read manifest.json from ZIP bundle");
+        }
+        return result.stdout;
+    }
+    const manifestPath = bundlePath.endsWith("manifest.json")
+        ? bundlePath
+        : `${bundlePath.replace(/\/+$/, "")}/manifest.json`;
+    return readFile(manifestPath, "utf8");
+}
+export async function verifyAuditBundleLocal(path, cwd) {
+    const manifestRaw = await readManifestFromBundle(path, cwd);
+    const manifest = JSON.parse(manifestRaw);
+    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+        throw new Error("manifest.json must be a JSON object");
+    }
+    return auditVerifyResult(manifest, path);
+}

package/dist/audit/wire.d.ts

@@ -0,0 +1,54 @@
+/** Wire types for Gateway `GET /v1/compliance/audit-exports` responses. */
+export type AuditExportJobSummary = Readonly<{
+    id: string;
+    status: string;
+    disclosure_tier: string;
+    created_at: string;
+    expires_at: string;
+    manifest_sha256: string;
+    bundle_sha256: string;
+    bundle_size_bytes: number;
+}>;
+export type AuditExportListPage = Readonly<{
+    tenant_realm_id: string;
+    jobs: ReadonlyArray<AuditExportJobSummary>;
+    next_cursor?: string;
+}>;
+export type AuditExportCreateFilter = Readonly<{
+    time_start?: string;
+    time_end?: string;
+    intent_id?: string;
+    case_id?: string;
+    operator_did?: string;
+    includes?: ReadonlyArray<string>;
+}>;
+export type AuditExportJobDetail = Readonly<{
+    id: string;
+    status: string;
+    tenant_realm_id: string;
+    disclosure_tier: string;
+    created_at: string;
+    expires_at: string;
+    error: string;
+    manifest_sha256: string;
+    bundle_sha256: string;
+    download_token?: string;
+    /** Present on `POST /v1/compliance/audit-exports` create responses. */
+    bundle_size_bytes?: number;
+    download_token_expires?: string;
+    download_path?: string;
+}>;
+export type AuditExportJobGetResponse = Readonly<{
+    job: AuditExportJobDetail;
+}>;
+export type AuditVerifyResult = Readonly<{
+    verified: boolean;
+    manifest_kind: string;
+    tenant_realm_id: string;
+    job_id: string;
+    path?: string;
+}>;
+/** Parses list response from `GET /v1/compliance/audit-exports`. */
+export declare function parseAuditExportList(json: unknown): AuditExportListPage;
+/** Parses job detail from `GET /v1/compliance/audit-exports/{id}`. */
+export declare function parseAuditExportJobGet(json: unknown): AuditExportJobGetResponse;

package/dist/audit/wire.js

@@ -0,0 +1,80 @@
+/** Wire types for Gateway `GET /v1/compliance/audit-exports` responses. */
+function assertJsonObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("Expected JSON object");
+    }
+}
+function readString(value, field) {
+    if (typeof value !== "string") {
+        throw new Error(`Invalid ${field}`);
+    }
+    return value;
+}
+function readNumber(value, field) {
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new Error(`Invalid ${field}`);
+    }
+    return value;
+}
+function extractNextCursor(body) {
+    const cursor = body.next_cursor ?? body.nextCursor;
+    if (typeof cursor === "string" && cursor.trim()) {
+        return cursor.trim();
+    }
+    return undefined;
+}
+/** Parses list response from `GET /v1/compliance/audit-exports`. */
+export function parseAuditExportList(json) {
+    assertJsonObject(json);
+    const tenantRealmId = readString(json.tenant_realm_id, "tenant_realm_id");
+    const jobsRaw = json.jobs ?? json.items ?? json.exports;
+    if (!Array.isArray(jobsRaw)) {
+        throw new Error("Invalid export list: jobs");
+    }
+    const jobs = jobsRaw.map((row) => {
+        assertJsonObject(row);
+        return {
+            id: readString(row.id ?? row.job_id, "jobs[].id"),
+            status: readString(row.status, "jobs[].status"),
+            disclosure_tier: readString(row.disclosure_tier, "jobs[].disclosure_tier"),
+            created_at: readString(row.created_at, "jobs[].created_at"),
+            expires_at: readString(row.expires_at, "jobs[].expires_at"),
+            manifest_sha256: typeof row.manifest_sha256 === "string" ? row.manifest_sha256 : "",
+            bundle_sha256: typeof row.bundle_sha256 === "string" ? row.bundle_sha256 : "",
+            bundle_size_bytes: readNumber(row.bundle_size_bytes ?? 0, "jobs[].bundle_size_bytes"),
+        };
+    });
+    const nextCursor = extractNextCursor(json);
+    return nextCursor ? { tenant_realm_id: tenantRealmId, jobs, next_cursor: nextCursor } : { tenant_realm_id: tenantRealmId, jobs };
+}
+/** Parses job detail from `GET /v1/compliance/audit-exports/{id}`. */
+export function parseAuditExportJobGet(json) {
+    assertJsonObject(json);
+    const jobRaw = json.job ?? json;
+    assertJsonObject(jobRaw);
+    const bundleSize = typeof jobRaw.bundle_size_bytes === "number" && Number.isFinite(jobRaw.bundle_size_bytes)
+        ? jobRaw.bundle_size_bytes
+        : undefined;
+    const downloadTokenExpires = typeof jobRaw.download_token_expires === "string" && jobRaw.download_token_expires
+        ? jobRaw.download_token_expires
+        : typeof jobRaw.download_token_expires_at === "string" && jobRaw.download_token_expires_at
+            ? jobRaw.download_token_expires_at
+            : undefined;
+    const downloadPath = typeof jobRaw.download_path === "string" && jobRaw.download_path ? jobRaw.download_path : undefined;
+    const job = {
+        id: readString(jobRaw.id ?? jobRaw.job_id, "job.id"),
+        status: readString(jobRaw.status, "job.status"),
+        tenant_realm_id: readString(jobRaw.tenant_realm_id, "job.tenant_realm_id"),
+        disclosure_tier: readString(jobRaw.disclosure_tier, "job.disclosure_tier"),
+        created_at: typeof jobRaw.created_at === "string" ? jobRaw.created_at : "",
+        expires_at: readString(jobRaw.expires_at, "job.expires_at"),
+        error: typeof jobRaw.error === "string" ? jobRaw.error : "",
+        manifest_sha256: typeof jobRaw.manifest_sha256 === "string" ? jobRaw.manifest_sha256 : "",
+        bundle_sha256: typeof jobRaw.bundle_sha256 === "string" ? jobRaw.bundle_sha256 : "",
+        download_token: typeof jobRaw.download_token === "string" && jobRaw.download_token ? jobRaw.download_token : undefined,
+        bundle_size_bytes: bundleSize,
+        download_token_expires: downloadTokenExpires,
+        download_path: downloadPath,
+    };
+    return { job };
+}

package/dist/cli/agent/demo-loaders.d.ts

@@ -2,3 +2,5 @@ export declare function loadRunVercelAiSandboxDemo(): Promise<typeof import("../
 export declare function loadRunLangGraphSandboxDemo(): Promise<typeof import("../../langgraph/sandbox-demo.js").runLangGraphSandboxDemo>;
 export declare function loadRunClaudeAgentsSandboxDemo(): Promise<typeof import("../../claude-agents/sandbox-demo.js").runClaudeAgentsSandboxDemo>;
 export declare function loadRunOpenAIAgentsSandboxDemo(): Promise<typeof import("../../openai-agents/sandbox-demo.js").runOpenAIAgentsSandboxDemo>;
+export declare function loadRunMastraSandboxDemo(): Promise<typeof import("../../mastra/sandbox-demo.js").runMastraSandboxDemo>;
+export declare function loadRunCloudflareAgentsSandboxDemo(): Promise<typeof import("../../cloudflare-agents/sandbox-demo.js").runCloudflareAgentsSandboxDemo>;

package/dist/cli/agent/demo-loaders.js

@@ -64,3 +64,27 @@ export async function loadRunOpenAIAgentsSandboxDemo() {
         throw err;
     }
 }
+export async function loadRunMastraSandboxDemo() {
+    try {
+        const mod = await import("../../mastra/sandbox-demo.js");
+        return mod.runMastraSandboxDemo;
+    }
+    catch (err) {
+        if (isMissingModuleError(err, "@mastra/core")) {
+            throw missingPeerDependencyError("@mastra/core", "mastra");
+        }
+        throw err;
+    }
+}
+export async function loadRunCloudflareAgentsSandboxDemo() {
+    try {
+        const mod = await import("../../cloudflare-agents/sandbox-demo.js");
+        return mod.runCloudflareAgentsSandboxDemo;
+    }
+    catch (err) {
+        if (isMissingModuleError(err, "ai")) {
+            throw missingPeerDependencyError("ai", "cloudflare-agents");
+        }
+        throw err;
+    }
+}

package/dist/cli/agent/production-evidence.d.ts

@@ -12,6 +12,17 @@ export declare function resolveProductionEvidenceFromCli(input: {
     agentRecognitionKeyId?: string;
     agentRecognitionSigningSeedHex?: string;
 }): Promise<PaybondRunProductionEvidenceCredentials>;
+export type AgentRecognitionCredentials = {
+    agentRecognitionKeyId: string;
+    agentRecognitionSigningSeed: Uint8Array;
+};
+/** Resolve agent recognition signing credentials from CLI flags and APP_* env fallbacks. */
+export declare function resolveAgentRecognitionFromCli(input: {
+    cwd: string;
+    envFile: string;
+    agentRecognitionKeyId?: string;
+    agentRecognitionSigningSeedHex?: string;
+}): Promise<AgentRecognitionCredentials>;
 export declare function productionEvidenceToPersisted(credentials: PaybondRunProductionEvidenceCredentials): PersistedProductionEvidence;
 /** Re-supply signing seeds at tool execute (or other re-attach) time; metadata comes from the run store. */
 export declare function resolveProductionEvidenceForReattach(input: {

package/dist/cli/agent/production-evidence.js

@@ -65,6 +65,23 @@ export async function resolveProductionEvidenceFromCli(input) {
         agentRecognitionSigningSeed: parseSeed32Hex(agentRecognitionSigningSeedHex, "--agent-recognition-signing-seed-hex"),
     };
 }
+/** Resolve agent recognition signing credentials from CLI flags and APP_* env fallbacks. */
+export async function resolveAgentRecognitionFromCli(input) {
+    const agentRecognitionKeyId = input.agentRecognitionKeyId?.trim() ||
+        (await readConfiguredEnvValue(input.cwd, input.envFile, "APP_AGENT_RECOGNITION_KEY_ID"));
+    const agentRecognitionSigningSeedHex = input.agentRecognitionSigningSeedHex?.trim() ||
+        (await readConfiguredEnvValue(input.cwd, input.envFile, "APP_AGENT_RECOGNITION_SEED_HEX"));
+    if (!agentRecognitionKeyId) {
+        throw new CliError("Harbor intent mutation requires --agent-recognition-key-id or APP_AGENT_RECOGNITION_KEY_ID", { category: "usage", code: "cli.agent.recognition_incomplete" });
+    }
+    if (!agentRecognitionSigningSeedHex) {
+        throw new CliError("Harbor intent mutation requires --agent-recognition-signing-seed-hex or APP_AGENT_RECOGNITION_SEED_HEX", { category: "usage", code: "cli.agent.recognition_incomplete" });
+    }
+    return {
+        agentRecognitionKeyId,
+        agentRecognitionSigningSeed: parseSeed32Hex(agentRecognitionSigningSeedHex, "--agent-recognition-signing-seed-hex"),
+    };
+}
 export function productionEvidenceToPersisted(credentials) {
     return {
         payee_did: credentials.payeeDid,

package/dist/cli/audit-export.d.ts

@@ -1,7 +1,2 @@
-export declare const MANIFEST_CORE_FIELD_ORDER: readonly ["schema_version", "kind", "tenant_realm_id", "job_id", "generated_at_rfc3339", "gateway_build_version", "score_model_version", "disclosure_tier", "redaction_profile", "checkpoint_last_ledger_seq", "export_filter", "artifacts"];
-export declare function buildManifestCore(manifest: Record<string, unknown>): Record<string, unknown>;
-export declare function manifestCoreBytes(manifest: Record<string, unknown>): Uint8Array;
-export declare function verifyAuditManifest(manifest: Record<string, unknown>): boolean;
-export declare function auditVerifyResult(manifest: Record<string, unknown>, path: string): Record<string, unknown>;
-export declare function readManifestFromBundle(bundlePath: string, cwd: string): Promise<string>;
-export declare function verifyAuditBundleLocal(path: string, cwd: string): Promise<Record<string, unknown>>;
+/** @deprecated Import from `../audit/verify.js` instead. */
+export { auditVerifyResult, buildManifestCore, manifestCoreBytes, readManifestFromBundle, verifyAuditBundleLocal, verifyAuditManifest, MANIFEST_CORE_FIELD_ORDER, } from "../audit/verify.js";