@paybond/kit 0.11.10 → 0.12.0

package/dist/cli/audit-export.js

@@ -1,120 +1,2 @@
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { spawn } from "node:child_process";
-import { verify as ed25519Verify } from "@noble/ed25519";
-import { ensureEd25519Sha512Sync } from "../ed25519-sync.js";
-import { CliError } from "./types.js";
-export const MANIFEST_CORE_FIELD_ORDER = [
-    "schema_version",
-    "kind",
-    "tenant_realm_id",
-    "job_id",
-    "generated_at_rfc3339",
-    "gateway_build_version",
-    "score_model_version",
-    "disclosure_tier",
-    "redaction_profile",
-    "checkpoint_last_ledger_seq",
-    "export_filter",
-    "artifacts",
-];
-export function buildManifestCore(manifest) {
-    const core = {};
-    for (const key of MANIFEST_CORE_FIELD_ORDER) {
-        if (key === "checkpoint_last_ledger_seq") {
-            if (!(key in manifest)) {
-                continue;
-            }
-            const value = manifest[key];
-            if (value === 0 || value === null) {
-                continue;
-            }
-            core[key] = value;
-            continue;
-        }
-        if (key in manifest) {
-            core[key] = manifest[key];
-        }
-    }
-    return core;
-}
-export function manifestCoreBytes(manifest) {
-    const core = buildManifestCore(manifest);
-    return new TextEncoder().encode(JSON.stringify(core));
-}
-function hexToBytes(hex) {
-    const normalized = hex.trim();
-    const out = new Uint8Array(normalized.length / 2);
-    for (let i = 0; i < out.length; i += 1) {
-        out[i] = Number.parseInt(normalized.slice(i * 2, i * 2 + 2), 16);
-    }
-    return out;
-}
-function bytesToHex(bytes) {
-    return Array.from(bytes)
-        .map((byte) => byte.toString(16).padStart(2, "0"))
-        .join("");
-}
-export function verifyAuditManifest(manifest) {
-    const coreBytes = manifestCoreBytes(manifest);
-    const digest = createHash("sha256").update(coreBytes).digest();
-    const expected = String(manifest.signed_payload_sha256_hex ?? "").trim().toLowerCase();
-    if (bytesToHex(new Uint8Array(digest)) !== expected) {
-        return false;
-    }
-    const signatureHex = String(manifest.ed25519_signature_hex ?? "").trim();
-    const publicKeyHex = String(manifest.signing_public_key_ed25519_hex ?? "").trim();
-    if (!signatureHex || !publicKeyHex) {
-        return false;
-    }
-    ensureEd25519Sha512Sync();
-    return ed25519Verify(hexToBytes(signatureHex), digest, hexToBytes(publicKeyHex));
-}
-export function auditVerifyResult(manifest, path) {
-    return {
-        verified: verifyAuditManifest(manifest),
-        manifest_kind: String(manifest.kind ?? ""),
-        tenant_realm_id: String(manifest.tenant_realm_id ?? ""),
-        job_id: String(manifest.job_id ?? ""),
-        path,
-    };
-}
-export async function readManifestFromBundle(bundlePath, cwd) {
-    if (bundlePath.endsWith(".zip")) {
-        const result = await new Promise((resolvePromise) => {
-            const child = spawn("unzip", ["-p", bundlePath, "manifest.json"], { cwd });
-            let stdout = "";
-            let stderr = "";
-            child.stdout.on("data", (chunk) => {
-                stdout += String(chunk);
-            });
-            child.stderr.on("data", (chunk) => {
-                stderr += String(chunk);
-            });
-            child.on("close", (code) => resolvePromise({ code, stdout, stderr }));
-            child.on("error", () => resolvePromise({ code: 127, stdout: "", stderr: "unzip not found" }));
-        });
-        if (result.code !== 0 || !result.stdout.trim()) {
-            throw new CliError(result.stderr.trim() || "unable to read manifest.json from ZIP bundle", {
-                category: "validation",
-                code: "cli.audit.bundle_read_failed",
-            });
-        }
-        return result.stdout;
-    }
-    const manifestPath = bundlePath.endsWith("manifest.json")
-        ? bundlePath
-        : `${bundlePath.replace(/\/+$/, "")}/manifest.json`;
-    return readFile(manifestPath, "utf8");
-}
-export async function verifyAuditBundleLocal(path, cwd) {
-    const manifestRaw = await readManifestFromBundle(path, cwd);
-    const manifest = JSON.parse(manifestRaw);
-    if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
-        throw new CliError("manifest.json must be a JSON object", {
-            category: "validation",
-            code: "cli.audit.invalid_manifest",
-        });
-    }
-    return auditVerifyResult(manifest, path);
-}
+/** @deprecated Import from `../audit/verify.js` instead. */
+export { auditVerifyResult, buildManifestCore, manifestCoreBytes, readManifestFromBundle, verifyAuditBundleLocal, verifyAuditManifest, MANIFEST_CORE_FIELD_ORDER, } from "../audit/verify.js";

package/dist/cli/command-spec.js

@@ -73,7 +73,11 @@ export const COMMAND_PATHS = [
     "agent demo langgraph smoke",
     "agent demo generic smoke",
     "agent demo claude-agents smoke",
+    "agent demo crewai smoke",
     "agent demo openai-agents smoke",
+    "agent demo mastra smoke",
+    "agent demo cloudflare-agents smoke",
+    "agent demo mcp smoke",
     "audit exports list",
     "audit exports get",
     "audit exports verify",
@@ -292,10 +296,12 @@ export const COMMAND_EXAMPLES = {
         "paybond signal fraud --did did:example:alice"
     ],
     "receipts get": [
-        "paybond receipts get receipt-123"
+        "paybond receipts get receipt-123",
+        "paybond receipts get sha256:abc... --kind agent --format json"
     ],
     "receipts verify": [
-        "paybond receipts verify receipt-123"
+        "paybond receipts verify receipt-123",
+        "paybond receipts verify sha256:abc... --kind agent --format json"
     ],
     "mandates verify": [
         "paybond mandates verify --body mandate.json"
@@ -312,7 +318,10 @@ export const COMMAND_EXAMPLES = {
     "init agent-middleware": [
         "paybond init agent-middleware",
         "paybond init agent-middleware --framework claude-agents --out paybond-claude-agents.ts",
-        "paybond init agent-middleware --framework openai --out paybond-agent-middleware.ts"
+        "paybond init agent-middleware --framework mastra --out paybond-mastra.ts",
+        "paybond init agent-middleware --framework cloudflare-agents --out paybond-cloudflare-agents.ts",
+        "paybond init agent-middleware --framework mcp --out paybond-mcp.ts",
+        "paybond init agent-middleware --framework crewai --out paybond_crewai.py"
     ],
     "agent run bind": [
         "paybond agent run bind --policy-file paybond.policy.yaml --format json",
@@ -361,9 +370,21 @@ export const COMMAND_EXAMPLES = {
     "agent demo claude-agents smoke": [
         "paybond agent demo claude-agents smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
     ],
+    "agent demo crewai smoke": [
+        "paybond agent demo crewai smoke --operation procurement.submit_po --requested-spend-cents 12000 --evidence-preset cost_and_completion --format json"
+    ],
     "agent demo openai-agents smoke": [
         "paybond agent demo openai-agents smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
     ],
+    "agent demo mastra smoke": [
+        "paybond agent demo mastra smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
+    "agent demo cloudflare-agents smoke": [
+        "paybond agent demo cloudflare-agents smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
+    "agent demo mcp smoke": [
+        "paybond agent demo mcp smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
+    ],
     "audit exports list": [
         "paybond audit exports list --format json"
     ],
@@ -503,7 +524,10 @@ export const COMPLETIONS = {
         "ach_vendor_webhook",
         "x402_paid_api_ok",
         "x402_delivery_receipt",
-        "x402_cost_and_completion"
+        "x402_cost_and_completion",
+        "x402_saas_api_purchase",
+        "x402_travel_booking",
+        "invoice_payment_confirmed"
     ],
     "policy preview preset": [
         "api_response_ok",
@@ -519,7 +543,10 @@ export const COMPLETIONS = {
         "ach_vendor_webhook",
         "x402_paid_api_ok",
         "x402_delivery_receipt",
-        "x402_cost_and_completion"
+        "x402_cost_and_completion",
+        "x402_saas_api_purchase",
+        "x402_travel_booking",
+        "invoice_payment_confirmed"
     ],
     "guardrails bootstrap completion-preset": [
         "api_response_ok",
@@ -535,7 +562,10 @@ export const COMPLETIONS = {
         "ach_vendor_webhook",
         "x402_paid_api_ok",
         "x402_delivery_receipt",
-        "x402_cost_and_completion"
+        "x402_cost_and_completion",
+        "x402_saas_api_purchase",
+        "x402_travel_booking",
+        "invoice_payment_confirmed"
     ]
 };
 export const COMPLETION_PRESET_IDS = [
@@ -552,7 +582,10 @@ export const COMPLETION_PRESET_IDS = [
     "ach_vendor_webhook",
     "x402_paid_api_ok",
     "x402_delivery_receipt",
-    "x402_cost_and_completion"
+    "x402_cost_and_completion",
+    "x402_saas_api_purchase",
+    "x402_travel_booking",
+    "invoice_payment_confirmed"
 ];
 export const WORKFLOWS = [
     {
@@ -614,7 +647,7 @@ export const WORKFLOWS = [
 ];
 export const DOCS_BASE_URL = "https://docs.paybond.ai/kit";
 export const COMPLETION_SCRIPTS = {
-    "bash": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n_paybond_completion() {\n  local cur prev words cword\n  COMPREPLY=()\n  cur=\"${COMP_WORDS[COMP_CWORD]}\"\n  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"\n\n  if [[ $COMP_CWORD -eq 1 ]]; then\n    COMPREPLY=($(compgen -W \"onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\" -- \"$cur\"))\n    return 0\n  fi\n\n  case \"${COMP_WORDS[1]}\" in\n      init) COMPREPLY=($(compgen -W \"guardrail completion agent-middleware\" -- \"$cur\")) ;;\n      mcp) COMPREPLY=($(compgen -W \"serve install verify-config tools\" -- \"$cur\")) ;;\n      dev) COMPREPLY=($(compgen -W \"smoke trace loop up\" -- \"$cur\")) ;;\n      config) COMPREPLY=($(compgen -W \"get set unset list\" -- \"$cur\")) ;;\n      keys) COMPREPLY=($(compgen -W \"list create rotate revoke\" -- \"$cur\")) ;;\n      intents) COMPREPLY=($(compgen -W \"list get create fund evidence settlement-confirm\" -- \"$cur\")) ;;\n      guardrails) COMPREPLY=($(compgen -W \"bootstrap evidence\" -- \"$cur\")) ;;\n      spend) COMPREPLY=($(compgen -W \"authorize\" -- \"$cur\")) ;;\n      signal) COMPREPLY=($(compgen -W \"reputation portfolio fraud\" -- \"$cur\")) ;;\n      receipts) COMPREPLY=($(compgen -W \"get verify\" -- \"$cur\")) ;;\n      mandates) COMPREPLY=($(compgen -W \"verify import\" -- \"$cur\")) ;;\n      a2a) COMPREPLY=($(compgen -W \"card contracts\" -- \"$cur\")) ;;\n      policy) COMPREPLY=($(compgen -W \"init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\" -- \"$cur\")) ;;\n      agent) COMPREPLY=($(compgen -W \"run tool registry sandbox production\" -- \"$cur\")) ;;\n      audit) COMPREPLY=($(compgen -W \"exports\" -- \"$cur\")) ;;\n      completion) COMPREPLY=($(compgen -W \"bash zsh fish\" -- \"$cur\")) ;;\n      init completion preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      policy preview preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      guardrails bootstrap completion-preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n    *) ;;\n  esac\n}\ncomplete -F _paybond_completion paybond\n",
-    "zsh": "#compdef paybond\n# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n\n_paybond() {\n  local -a commands\n  commands=(\n    'onboarding' 'help' 'examples' 'completion' 'login' 'init' 'mcp' 'doctor' 'dev' 'version' 'diagnose' 'config' 'whoami' 'keys' 'intents' 'guardrails' 'spend' 'signal' 'receipts' 'mandates' 'a2a' 'policy' 'audit' 'agent'\n  )\n  _arguments -C \\\n    '(--gateway)--gateway[Gateway base URL]:url:' \\\n    '(--env-file)--env-file[Local secrets file]:path:_files' \\\n    '(--format)--format[Output format]:(table json)' \\\n    '(--color)--color[Color mode]:(auto always never)' \\\n    '--no-color[Disable color output]' \\\n    '1: :->command' \\\n    '*::arg:->args'\n\n  case $state in\n    command)\n      _describe -t commands 'paybond commands' commands\n      ;;\n    args)\n      case $words[1] in\n    'init:subcommand:(guardrail completion agent-middleware)'\n    'mcp:subcommand:(serve install verify-config tools)'\n    'dev:subcommand:(smoke trace loop up)'\n    'config:subcommand:(get set unset list)'\n    'keys:subcommand:(list create rotate revoke)'\n    'intents:subcommand:(list get create fund evidence settlement-confirm)'\n    'guardrails:subcommand:(bootstrap evidence)'\n    'spend:subcommand:(authorize)'\n    'signal:subcommand:(reputation portfolio fraud)'\n    'receipts:subcommand:(get verify)'\n    'mandates:subcommand:(verify import)'\n    'a2a:subcommand:(card contracts)'\n    'policy:subcommand:(init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence)'\n    'agent:subcommand:(run tool registry sandbox production)'\n    'audit:subcommand:(exports)'\n    'completion:subcommand:(bash zsh fish)'\n    'init completion preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'policy preview preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'guardrails bootstrap completion-preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n      esac\n      ;;\n  esac\n}\n\ncompdef _paybond paybond\n",
-    "fish": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\ncomplete -c paybond -f\ncomplete -c paybond -l gateway -d 'Gateway base URL'\ncomplete -c paybond -l env-file -d 'Local secrets file' -r\ncomplete -c paybond -l format -d 'Output format' -xa 'table json'\ncomplete -c paybond -l color -d 'Color mode' -xa 'auto always never'\ncomplete -c paybond -l no-color -d 'Disable color output'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'onboarding'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'help'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'examples'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'completion'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'login'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'init'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mcp'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'doctor'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'dev'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'version'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'diagnose'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'config'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'whoami'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'keys'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'intents'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'guardrails'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'spend'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'signal'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'receipts'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mandates'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'a2a'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'policy'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'audit'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'agent'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'guardrail'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'agent-middleware'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'serve'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'install'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'verify-config'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'smoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'trace'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'loop'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'up'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'set'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'unset'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'rotate'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'revoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'fund'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'settlement-confirm'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'bootstrap'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from spend' -a 'authorize'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'reputation'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'portfolio'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'fraud'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'import'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'card'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'contracts'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'init'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'templates'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'preview'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-mcp-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-x402-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'run'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'tool'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'registry'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'sandbox'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'production'\ncomplete -c paybond -n '__fish_seen_subcommand_from audit' -a 'exports'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'bash'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'zsh'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'fish'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_cost_and_completion'\n"
+    "bash": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n_paybond_completion() {\n  local cur prev words cword\n  COMPREPLY=()\n  cur=\"${COMP_WORDS[COMP_CWORD]}\"\n  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"\n\n  if [[ $COMP_CWORD -eq 1 ]]; then\n    COMPREPLY=($(compgen -W \"onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\" -- \"$cur\"))\n    return 0\n  fi\n\n  case \"${COMP_WORDS[1]}\" in\n      init) COMPREPLY=($(compgen -W \"guardrail completion agent-middleware\" -- \"$cur\")) ;;\n      mcp) COMPREPLY=($(compgen -W \"serve install verify-config tools\" -- \"$cur\")) ;;\n      dev) COMPREPLY=($(compgen -W \"smoke trace loop up\" -- \"$cur\")) ;;\n      config) COMPREPLY=($(compgen -W \"get set unset list\" -- \"$cur\")) ;;\n      keys) COMPREPLY=($(compgen -W \"list create rotate revoke\" -- \"$cur\")) ;;\n      intents) COMPREPLY=($(compgen -W \"list get create fund evidence settlement-confirm\" -- \"$cur\")) ;;\n      guardrails) COMPREPLY=($(compgen -W \"bootstrap evidence\" -- \"$cur\")) ;;\n      spend) COMPREPLY=($(compgen -W \"authorize\" -- \"$cur\")) ;;\n      signal) COMPREPLY=($(compgen -W \"reputation portfolio fraud\" -- \"$cur\")) ;;\n      receipts) COMPREPLY=($(compgen -W \"get verify\" -- \"$cur\")) ;;\n      mandates) COMPREPLY=($(compgen -W \"verify import\" -- \"$cur\")) ;;\n      a2a) COMPREPLY=($(compgen -W \"card contracts\" -- \"$cur\")) ;;\n      policy) COMPREPLY=($(compgen -W \"init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\" -- \"$cur\")) ;;\n      agent) COMPREPLY=($(compgen -W \"run tool registry sandbox production\" -- \"$cur\")) ;;\n      audit) COMPREPLY=($(compgen -W \"exports\" -- \"$cur\")) ;;\n      completion) COMPREPLY=($(compgen -W \"bash zsh fish\" -- \"$cur\")) ;;\n      init completion preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\" -- \"$cur\")) ;;\n      policy preview preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\" -- \"$cur\")) ;;\n      guardrails bootstrap completion-preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\" -- \"$cur\")) ;;\n    *) ;;\n  esac\n}\ncomplete -F _paybond_completion paybond\n",
+    "zsh": "#compdef paybond\n# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n\n_paybond() {\n  local -a commands\n  commands=(\n    'onboarding' 'help' 'examples' 'completion' 'login' 'init' 'mcp' 'doctor' 'dev' 'version' 'diagnose' 'config' 'whoami' 'keys' 'intents' 'guardrails' 'spend' 'signal' 'receipts' 'mandates' 'a2a' 'policy' 'audit' 'agent'\n  )\n  _arguments -C \\\n    '(--gateway)--gateway[Gateway base URL]:url:' \\\n    '(--env-file)--env-file[Local secrets file]:path:_files' \\\n    '(--format)--format[Output format]:(table json)' \\\n    '(--color)--color[Color mode]:(auto always never)' \\\n    '--no-color[Disable color output]' \\\n    '1: :->command' \\\n    '*::arg:->args'\n\n  case $state in\n    command)\n      _describe -t commands 'paybond commands' commands\n      ;;\n    args)\n      case $words[1] in\n    'init:subcommand:(guardrail completion agent-middleware)'\n    'mcp:subcommand:(serve install verify-config tools)'\n    'dev:subcommand:(smoke trace loop up)'\n    'config:subcommand:(get set unset list)'\n    'keys:subcommand:(list create rotate revoke)'\n    'intents:subcommand:(list get create fund evidence settlement-confirm)'\n    'guardrails:subcommand:(bootstrap evidence)'\n    'spend:subcommand:(authorize)'\n    'signal:subcommand:(reputation portfolio fraud)'\n    'receipts:subcommand:(get verify)'\n    'mandates:subcommand:(verify import)'\n    'a2a:subcommand:(card contracts)'\n    'policy:subcommand:(init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence)'\n    'agent:subcommand:(run tool registry sandbox production)'\n    'audit:subcommand:(exports)'\n    'completion:subcommand:(bash zsh fish)'\n    'init completion preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed)'\n    'policy preview preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed)'\n    'guardrails bootstrap completion-preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed)'\n      esac\n      ;;\n  esac\n}\n\ncompdef _paybond paybond\n",
+    "fish": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion x402_saas_api_purchase x402_travel_booking invoice_payment_confirmed\ncomplete -c paybond -f\ncomplete -c paybond -l gateway -d 'Gateway base URL'\ncomplete -c paybond -l env-file -d 'Local secrets file' -r\ncomplete -c paybond -l format -d 'Output format' -xa 'table json'\ncomplete -c paybond -l color -d 'Color mode' -xa 'auto always never'\ncomplete -c paybond -l no-color -d 'Disable color output'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'onboarding'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'help'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'examples'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'completion'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'login'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'init'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mcp'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'doctor'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'dev'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'version'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'diagnose'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'config'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'whoami'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'keys'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'intents'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'guardrails'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'spend'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'signal'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'receipts'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mandates'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'a2a'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'policy'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'audit'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'agent'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'guardrail'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'agent-middleware'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'serve'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'install'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'verify-config'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'smoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'trace'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'loop'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'up'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'set'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'unset'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'rotate'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'revoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'fund'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'settlement-confirm'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'bootstrap'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from spend' -a 'authorize'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'reputation'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'portfolio'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'fraud'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'import'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'card'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'contracts'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'init'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'templates'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'preview'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-mcp-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-x402-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'run'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'tool'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'registry'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'sandbox'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'production'\ncomplete -c paybond -n '__fish_seen_subcommand_from audit' -a 'exports'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'bash'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'zsh'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'fish'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_saas_api_purchase'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'invoice_payment_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_saas_api_purchase'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'invoice_payment_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_saas_api_purchase'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'invoice_payment_confirmed'\n"
 };

package/dist/cli/commands/agent.d.ts

@@ -13,6 +13,9 @@ export declare function handleAgentProductionAttachSmoke(ctx: CliContext, argv:
 export declare function handleAgentDemoVercelAiSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoLanggraphSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoGenericSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoMastraSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoCloudflareAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoClaudeAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentDemoMcpSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoOpenAIAgentsSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgent(ctx: CliContext, group: string, subcommand: string, argv: string[]): Promise<CommandResult>;

package/dist/cli/commands/agent.js

@@ -4,7 +4,8 @@ import { PaybondAgentRun } from "../../agent/run.js";
 import { PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/types.js";
 import { resolveCliGatewayErrorMessage } from "../http-error-message.js";
 import { runGenericSandboxDemo } from "../../agent/generic-sandbox-demo.js";
-import { loadRunClaudeAgentsSandboxDemo, loadRunLangGraphSandboxDemo, loadRunOpenAIAgentsSandboxDemo, loadRunVercelAiSandboxDemo, } from "../agent/demo-loaders.js";
+import { runMcpSandboxDemo } from "../../mcp/sandbox-demo.js";
+import { loadRunClaudeAgentsSandboxDemo, loadRunCloudflareAgentsSandboxDemo, loadRunLangGraphSandboxDemo, loadRunMastraSandboxDemo, loadRunOpenAIAgentsSandboxDemo, loadRunVercelAiSandboxDemo, } from "../agent/demo-loaders.js";
 import { buildSmokeRegistry, loadAgentRegistryFile, validateAgentRegistryDocument, } from "../../agent/registry-file.js";
 import { createPaybondToolRegistry } from "../../agent/registry.js";
 import { devTraceStepsFromEvents, devTraceUrl, findDevTraceEventForRun, resolveDevTraceSink, recordSmokeTraceEvent, } from "../../dev/trace-buffer.js";
@@ -1128,6 +1129,80 @@ export async function handleAgentDemoGenericSmoke(ctx, argv) {
         };
     });
 }
+export async function handleAgentDemoMastraSmoke(ctx, argv) {
+    const productionFlag = consumeBooleanFlag(argv, "--production");
+    const operationFlag = consumeFlag(productionFlag.rest, "--operation");
+    const spendFlag = consumeFlag(operationFlag.rest, "--requested-spend-cents");
+    const presetFlag = consumeFlag(spendFlag.rest, "--evidence-preset");
+    if (!operationFlag.value || !spendFlag.value || !presetFlag.value) {
+        throw agentCliError("agent demo mastra smoke requires --operation, --requested-spend-cents, and --evidence-preset", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const requestedSpendCents = parseRequiredNonNegativeInt(spendFlag.value, "--requested-spend-cents");
+    return withPaybondAgentCli(ctx, productionFlag.present, async (session) => {
+        const runMastraSandboxDemo = await loadRunMastraSandboxDemo();
+        const demo = await runMastraSandboxDemo({
+            paybond: session.paybond,
+            operation: operationFlag.value,
+            requestedSpendCents,
+            evidencePreset: presetFlag.value,
+        });
+        if (!demo.authorization.allow) {
+            throw agentCliError("Mastra sandbox demo authorization did not pass", {
+                code: "cli.agent.authorization_denied",
+                exitCode: 3,
+                category: "forbidden",
+                details: { authorization: demo.authorization },
+            });
+        }
+        if (!demo.execute.tool_result) {
+            throw agentCliError("Mastra sandbox demo did not produce a paid tool result", {
+                code: "cli.agent.tool_execute_failed",
+                details: { execute: demo.execute },
+            });
+        }
+        return {
+            data: demo,
+            warnings: session.warnings,
+        };
+    });
+}
+export async function handleAgentDemoCloudflareAgentsSmoke(ctx, argv) {
+    const productionFlag = consumeBooleanFlag(argv, "--production");
+    const operationFlag = consumeFlag(productionFlag.rest, "--operation");
+    const spendFlag = consumeFlag(operationFlag.rest, "--requested-spend-cents");
+    const presetFlag = consumeFlag(spendFlag.rest, "--evidence-preset");
+    if (!operationFlag.value || !spendFlag.value || !presetFlag.value) {
+        throw agentCliError("agent demo cloudflare-agents smoke requires --operation, --requested-spend-cents, and --evidence-preset", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const requestedSpendCents = parseRequiredNonNegativeInt(spendFlag.value, "--requested-spend-cents");
+    return withPaybondAgentCli(ctx, productionFlag.present, async (session) => {
+        const runCloudflareAgentsSandboxDemo = await loadRunCloudflareAgentsSandboxDemo();
+        const demo = await runCloudflareAgentsSandboxDemo({
+            paybond: session.paybond,
+            operation: operationFlag.value,
+            requestedSpendCents,
+            evidencePreset: presetFlag.value,
+        });
+        if (!demo.authorization.allow) {
+            throw agentCliError("Cloudflare Agents sandbox demo authorization did not pass", {
+                code: "cli.agent.authorization_denied",
+                exitCode: 3,
+                category: "forbidden",
+                details: { authorization: demo.authorization },
+            });
+        }
+        if (!demo.execute.tool_result) {
+            throw agentCliError("Cloudflare Agents sandbox demo did not produce a paid tool result", {
+                code: "cli.agent.tool_execute_failed",
+                details: { execute: demo.execute },
+            });
+        }
+        return {
+            data: demo,
+            warnings: session.warnings,
+        };
+    });
+}
 export async function handleAgentDemoClaudeAgentsSmoke(ctx, argv) {
     const productionFlag = consumeBooleanFlag(argv, "--production");
     const runtimeFlag = consumeFlag(productionFlag.rest, "--runtime");
@@ -1170,6 +1245,46 @@ export async function handleAgentDemoClaudeAgentsSmoke(ctx, argv) {
         };
     });
 }
+export async function handleAgentDemoMcpSmoke(ctx, argv) {
+    const productionFlag = consumeBooleanFlag(argv, "--production");
+    const operationFlag = consumeFlag(productionFlag.rest, "--operation");
+    const spendFlag = consumeFlag(operationFlag.rest, "--requested-spend-cents");
+    const presetFlag = consumeFlag(spendFlag.rest, "--evidence-preset");
+    if (!operationFlag.value || !spendFlag.value || !presetFlag.value) {
+        throw agentCliError("agent demo mcp smoke requires --operation, --requested-spend-cents, and --evidence-preset", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const requestedSpendCents = parseRequiredNonNegativeInt(spendFlag.value, "--requested-spend-cents");
+    return withPaybondAgentCli(ctx, productionFlag.present, async (session) => {
+        const demo = await runMcpSandboxDemo({
+            paybond: session.paybond,
+            apiKey: session.apiKey,
+            gatewayBaseUrl: ctx.globals.gateway,
+            operation: operationFlag.value,
+            requestedSpendCents,
+            evidencePreset: presetFlag.value,
+        });
+        if (!demo.authorization.allow) {
+            throw agentCliError("MCP sandbox demo authorization did not pass", {
+                code: "cli.agent.authorization_denied",
+                exitCode: 3,
+                category: "forbidden",
+                details: { authorization: demo.authorization },
+            });
+        }
+        if (!demo.evidence.submitted) {
+            throw agentCliError("MCP sandbox demo did not submit evidence", {
+                code: "cli.agent.evidence_failed",
+                exitCode: 5,
+                category: "gateway",
+                details: { tool_result: demo.tool_result },
+            });
+        }
+        return {
+            data: demo,
+            warnings: session.warnings,
+        };
+    });
+}
 export async function handleAgentDemoOpenAIAgentsSmoke(ctx, argv) {
     const productionFlag = consumeBooleanFlag(argv, "--production");
     const operationFlag = consumeFlag(productionFlag.rest, "--operation");
@@ -1351,6 +1466,33 @@ export async function handleAgent(ctx, group, subcommand, argv) {
         }
         return handleAgentDemoOpenAIAgentsSmoke(ctx, argv.slice(1));
     }
+    if (group === "demo" && subcommand === "mcp") {
+        if (argv[0] !== "smoke") {
+            throw agentCliError("agent demo mcp requires smoke subcommand", {
+                code: "cli.usage.unknown_command",
+                category: "usage",
+            });
+        }
+        return handleAgentDemoMcpSmoke(ctx, argv.slice(1));
+    }
+    if (group === "demo" && subcommand === "mastra") {
+        if (argv[0] !== "smoke") {
+            throw agentCliError("agent demo mastra requires smoke subcommand", {
+                code: "cli.usage.unknown_command",
+                category: "usage",
+            });
+        }
+        return handleAgentDemoMastraSmoke(ctx, argv.slice(1));
+    }
+    if (group === "demo" && subcommand === "cloudflare-agents") {
+        if (argv[0] !== "smoke") {
+            throw agentCliError("agent demo cloudflare-agents requires smoke subcommand", {
+                code: "cli.usage.unknown_command",
+                category: "usage",
+            });
+        }
+        return handleAgentDemoCloudflareAgentsSmoke(ctx, argv.slice(1));
+    }
     throw agentCliError(`unknown agent subcommand: agent ${group} ${subcommand}`, {
         code: "cli.usage.unknown_command",
         category: "usage",