@paybond/kit 0.11.11 → 0.12.0

package/dist/audit/exports.js

@@ -34,22 +34,28 @@ export class GatewayAuditExportsClient {
     async getJson(path) {
         return this.requestJSON("GET", path);
     }
+    async postJson(path, body) {
+        return this.requestJSON("POST", path, body);
+    }
     async deleteJson(path) {
         return this.requestJSON("DELETE", path);
     }
-    async requestJSON(method, path) {
+    async requestJSON(method, path, body) {
         const url = `${this.base}${path.replace(/^\//, "")}`;
         let lastErr;
         for (let attempt = 0; attempt < this.maxRetries; attempt++) {
             let res;
             try {
-                res = await fetch(url, {
-                    method,
-                    headers: {
-                        accept: "application/json",
-                        authorization: `Bearer ${this.bearerToken}`,
-                    },
-                });
+                const headers = {
+                    accept: "application/json",
+                    authorization: `Bearer ${this.bearerToken}`,
+                };
+                const init = { method, headers };
+                if (method === "POST") {
+                    headers["content-type"] = "application/json";
+                    init.body = JSON.stringify(body ?? {});
+                }
+                res = await fetch(url, init);
             }
             catch (err) {
                 lastErr = err;
@@ -80,6 +86,36 @@ export class GatewayAuditExportsClient {
         throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
     }
 }
+function buildAuditExportCreateBody(params) {
+    const filter = {};
+    const f = params.filter;
+    if (f.time_start?.trim()) {
+        filter.time_start = f.time_start.trim();
+    }
+    if (f.time_end?.trim()) {
+        filter.time_end = f.time_end.trim();
+    }
+    if (f.intent_id?.trim()) {
+        filter.intent_id = f.intent_id.trim();
+    }
+    if (f.case_id?.trim()) {
+        filter.case_id = f.case_id.trim();
+    }
+    if (f.operator_did?.trim()) {
+        filter.operator_did = f.operator_did.trim();
+    }
+    if (f.includes && f.includes.length > 0) {
+        filter.includes = [...f.includes];
+    }
+    const body = {
+        filter,
+        disclosure_tier: params.disclosureTier ?? "standard",
+    };
+    if (params.retentionHours != null && params.retentionHours > 0) {
+        body.retention_hours = params.retentionHours;
+    }
+    return body;
+}
 /**
  * SDK surface for compliance audit export jobs and local bundle verification.
  */
@@ -111,6 +147,17 @@ export class PaybondAuditExports {
         const body = await this.gateway.getJson(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}${query}`);
         return parseAuditExportJobGet(body);
     }
+    /**
+     * Create a compliance audit export job (`POST /v1/compliance/audit-exports`).
+     * Tenant scope comes from the API key — never pass a tenant id.
+     */
+    async create(params) {
+        if (!this.gateway.postJson) {
+            throw new Error("audit export create is not supported by this gateway adapter");
+        }
+        const body = await this.gateway.postJson("/v1/compliance/audit-exports", buildAuditExportCreateBody(params));
+        return parseAuditExportJobGet(body);
+    }
     async delete(jobId) {
         if (!this.gateway.deleteJson) {
             throw new Error("audit export delete is not supported by this gateway adapter");

package/dist/audit/index.d.ts

@@ -1,3 +1,3 @@
-export { GatewayAuditExportsClient, PaybondAudit, PaybondAuditExports, type AuditExportsGateway, type GatewayAuditExportsClientOptions, type PaybondAuditExportsGetParams, type PaybondAuditExportsListParams, } from "./exports.js";
+export { GatewayAuditExportsClient, PaybondAudit, PaybondAuditExports, type AuditExportsGateway, type GatewayAuditExportsClientOptions, type PaybondAuditExportsCreateParams, type PaybondAuditExportsGetParams, type PaybondAuditExportsListParams, } from "./exports.js";
 export { auditVerifyResult, buildManifestCore, manifestCoreBytes, readManifestFromBundle, verifyAuditBundleLocal, verifyAuditManifest, MANIFEST_CORE_FIELD_ORDER, } from "./verify.js";
-export { parseAuditExportJobGet, parseAuditExportList, type AuditExportJobDetail, type AuditExportJobGetResponse, type AuditExportJobSummary, type AuditExportListPage, type AuditVerifyResult, } from "./wire.js";
+export { parseAuditExportJobGet, parseAuditExportList, type AuditExportCreateFilter, type AuditExportJobDetail, type AuditExportJobGetResponse, type AuditExportJobSummary, type AuditExportListPage, type AuditVerifyResult, } from "./wire.js";

package/dist/audit/wire.d.ts

@@ -14,6 +14,14 @@ export type AuditExportListPage = Readonly<{
     jobs: ReadonlyArray<AuditExportJobSummary>;
     next_cursor?: string;
 }>;
+export type AuditExportCreateFilter = Readonly<{
+    time_start?: string;
+    time_end?: string;
+    intent_id?: string;
+    case_id?: string;
+    operator_did?: string;
+    includes?: ReadonlyArray<string>;
+}>;
 export type AuditExportJobDetail = Readonly<{
     id: string;
     status: string;
@@ -25,6 +33,10 @@ export type AuditExportJobDetail = Readonly<{
     manifest_sha256: string;
     bundle_sha256: string;
     download_token?: string;
+    /** Present on `POST /v1/compliance/audit-exports` create responses. */
+    bundle_size_bytes?: number;
+    download_token_expires?: string;
+    download_path?: string;
 }>;
 export type AuditExportJobGetResponse = Readonly<{
     job: AuditExportJobDetail;

package/dist/audit/wire.js

@@ -52,17 +52,29 @@ export function parseAuditExportJobGet(json) {
     assertJsonObject(json);
     const jobRaw = json.job ?? json;
     assertJsonObject(jobRaw);
+    const bundleSize = typeof jobRaw.bundle_size_bytes === "number" && Number.isFinite(jobRaw.bundle_size_bytes)
+        ? jobRaw.bundle_size_bytes
+        : undefined;
+    const downloadTokenExpires = typeof jobRaw.download_token_expires === "string" && jobRaw.download_token_expires
+        ? jobRaw.download_token_expires
+        : typeof jobRaw.download_token_expires_at === "string" && jobRaw.download_token_expires_at
+            ? jobRaw.download_token_expires_at
+            : undefined;
+    const downloadPath = typeof jobRaw.download_path === "string" && jobRaw.download_path ? jobRaw.download_path : undefined;
     const job = {
         id: readString(jobRaw.id ?? jobRaw.job_id, "job.id"),
         status: readString(jobRaw.status, "job.status"),
         tenant_realm_id: readString(jobRaw.tenant_realm_id, "job.tenant_realm_id"),
         disclosure_tier: readString(jobRaw.disclosure_tier, "job.disclosure_tier"),
-        created_at: readString(jobRaw.created_at, "job.created_at"),
+        created_at: typeof jobRaw.created_at === "string" ? jobRaw.created_at : "",
         expires_at: readString(jobRaw.expires_at, "job.expires_at"),
         error: typeof jobRaw.error === "string" ? jobRaw.error : "",
         manifest_sha256: typeof jobRaw.manifest_sha256 === "string" ? jobRaw.manifest_sha256 : "",
         bundle_sha256: typeof jobRaw.bundle_sha256 === "string" ? jobRaw.bundle_sha256 : "",
         download_token: typeof jobRaw.download_token === "string" && jobRaw.download_token ? jobRaw.download_token : undefined,
+        bundle_size_bytes: bundleSize,
+        download_token_expires: downloadTokenExpires,
+        download_path: downloadPath,
     };
     return { job };
 }

package/dist/cli/command-spec.js

@@ -296,10 +296,12 @@ export const COMMAND_EXAMPLES = {
         "paybond signal fraud --did did:example:alice"
     ],
     "receipts get": [
-        "paybond receipts get receipt-123"
+        "paybond receipts get receipt-123",
+        "paybond receipts get sha256:abc... --kind agent --format json"
     ],
     "receipts verify": [
-        "paybond receipts verify receipt-123"
+        "paybond receipts verify receipt-123",
+        "paybond receipts verify sha256:abc... --kind agent --format json"
     ],
     "mandates verify": [
         "paybond mandates verify --body mandate.json"

package/dist/cli/commands/discovery.js

@@ -7,10 +7,8 @@ import { consumeBooleanFlag, consumeFlag } from "../globals.js";
 import { CliError } from "../types.js";
 export async function handleSignal(ctx, subcommand, argv) {
     return withGateway(ctx, async (gateway) => {
-        const principal = await gateway.getJson("/v1/auth/principal");
-        const tenantId = String(principal.tenant_id ?? "");
         if (subcommand === "portfolio") {
-            const body = await gateway.getJson(`/signal/v1/tenants/${encodeURIComponent(tenantId)}/portfolio/summary`);
+            const body = await gateway.getJson("/signal/v1/portfolio/summary");
             return { data: body };
         }
         const didFlag = consumeFlag(argv, "--did");
@@ -18,11 +16,11 @@ export async function handleSignal(ctx, subcommand, argv) {
             throw new CliError(`signal ${subcommand} requires --did`, { category: "usage", code: "cli.usage.missing_did" });
         }
         if (subcommand === "reputation") {
-            const body = await gateway.getJson(`/signal/v1/tenants/${encodeURIComponent(tenantId)}/reputation/${encodeURIComponent(didFlag.value)}`);
+            const body = await gateway.getJson(`/reputation/${encodeURIComponent(didFlag.value)}`);
             return { data: body };
         }
         if (subcommand === "fraud") {
-            const body = await gateway.getJson(`/fraud/v1/tenants/${encodeURIComponent(tenantId)}/assessments/${encodeURIComponent(didFlag.value)}`);
+            const body = await gateway.getJson(`/signal/v1/operators/${encodeURIComponent(didFlag.value)}/review-status`);
             return { data: body };
         }
         throw new CliError(`unknown signal subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
@@ -30,10 +28,23 @@ export async function handleSignal(ctx, subcommand, argv) {
 }
 export async function handleReceipts(ctx, subcommand, argv) {
     return withGateway(ctx, async (gateway) => {
+        const kindFlag = consumeFlag(argv, "--kind");
+        const kind = (kindFlag.value ?? "protocol").trim().toLowerCase();
         const receiptId = argv[0];
         if (!receiptId) {
             throw new CliError(`receipts ${subcommand} requires <receipt_id>`, { category: "usage", code: "cli.usage.missing_receipt_id" });
         }
+        if (kind === "agent") {
+            if (subcommand === "get") {
+                const body = await gateway.getJson(`/protocol/v2/agent-receipts/${encodeURIComponent(receiptId)}`);
+                return { data: body };
+            }
+            if (subcommand === "verify") {
+                const fetched = await gateway.getJson(`/protocol/v2/agent-receipts/${encodeURIComponent(receiptId)}`);
+                const body = await gateway.postJson("/protocol/v2/agent-receipts/verify", fetched);
+                return { data: body };
+            }
+        }
         if (subcommand === "get") {
             const body = await gateway.getJson(`/protocol/v2/receipts/${encodeURIComponent(receiptId)}`);
             return { data: body };
@@ -55,7 +66,7 @@ export async function handleMandates(ctx, subcommand, argv) {
             return { data: body };
         }
         if (subcommand === "import") {
-            const body = await gateway.postJson("/protocol/v2/mandates/import", payload);
+            const body = await gateway.postJson("/protocol/v2/mandates", payload);
             return { data: body };
         }
         throw new CliError(`unknown mandates subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });

package/dist/cli/help.d.ts

@@ -1,3 +1,3 @@
-export declare const ROOT_HELP = "Usage: paybond [--global-flags] <command> [<subcommand> ...] [args]\n\nGlobal flags:\n  --gateway <url>         Gateway base URL (default: https://api.paybond.ai)\n  --env-file <path>       Local secrets file (default: .env.local)\n  --format table|json     Human table or JSON envelope output (default: table)\n  --json <fields>         Field-selectable JSON for list/read commands (plain JSON; use --format json for envelope)\n  --jq <expr>             jq-style filter for list/read command output\n  --profile <name>        Named credential profile from the Paybond CLI config file\n  --request-id <id>       Correlation ID for Gateway calls and JSON output\n  --yes                   Skip confirmation for destructive operations\n  --no-open               Do not open a browser for device login\n  --color auto|always|never Colorize human table output and help text (default: auto)\n  --no-color              Disable color output (also honors NO_COLOR)\n\nCommands:\n  onboarding              Guided, non-destructive first-run checks\n  help                    Detailed help for a command\n  examples                Copy-paste examples from the command spec\n  completion bash|zsh|fish Shell completion scripts\n  login                   Sandbox device login\n  init                    Interactive first-run scaffold (solution, spend cap, framework, owned policy files)\n  init guardrail|completion|agent-middleware\n                          Scaffold sandbox guardrail, completion evidence, or agent middleware integration files\n  mcp serve|install|verify-config|tools MCP server and host configuration\n  doctor                  Validate local runtime, credentials, and optional agent setup\n  dev smoke|trace|loop|up\n                          Local sandbox developer loop: travel smoke, trace dashboard, WireMock up, and guided setup\n  version                 Print package version (use --verbose for runtime details)\n  diagnose                Emit a redacted support bundle with --redacted\n  config get|set|unset|list\n                          Manage CLI configuration values\n  whoami                  Resolve the authenticated principal and tenant realm\n  keys list|create|rotate|revoke\n                          Manage tenant service-account API keys\n  intents list|get|create|fund|evidence|settlement-confirm\n                          Harbor intent workflows\n  guardrails bootstrap|evidence\n                          Sandbox guardrail helpers\n  spend authorize         Authorize delegated spend for a tool call\n  signal reputation|portfolio|fraud\n                          Signal summaries and fraud reads\n  receipts get|verify\n                          Protocol settlement receipts\n  mandates verify|import\n                          Agent mandate verification and import\n  a2a card|contracts\n                          Agent card discovery and task contracts\n  policy init|init-org|extend|presets list|presets show|validate-tools|templates|preview|import-mcp-receipt|import-x402-receipt|validate-evidence\n                          Scaffold and validate paybond.policy.yaml (including enterprise org inheritance), browse policy presets and solutions, list completion presets, preview Harbor templates, and import receipts\n  agent run bind|status|trace|reload-policy|tool execute|validate|registry validate|sandbox smoke\n                          Agent middleware: bind runs, reload policy, execute tools, validate registry, sandbox smoke\n  audit exports list|get|verify|delete\n                          Compliance audit export jobs and local bundle verification\n\nGetting started:\n  Sandbox setup\n    Authenticate, validate the runtime, and confirm tenant context.\n    $ paybond login\n    $ paybond doctor --format json\n    Next: paybond whoami\n  Agent + MCP host\n    Preview MCP host config and list tools exposed to agents.\n    $ paybond mcp install --host claude --scope local\n    $ paybond mcp verify-config --host claude\n    $ paybond mcp tools\n    Next: paybond doctor --agent\n  Paid-tool guardrail\n    Scaffold a sandbox guardrail integration file for your agent runtime.\n    $ paybond init guardrail\n    $ paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100\n    Next: paybond spend authorize --help\n  Policy-driven agent sandbox\n    Validate and smoke-test agent middleware from a versioned paybond.policy.yaml file.\n    $ paybond policy init --out paybond.policy.yaml\n    $ paybond policy validate-tools --file paybond.policy.yaml\n    $ paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n    Next: paybond policy validate-tools --help\n  Agent middleware sandbox\n    Bind a sandbox run and execute a guarded tool with auto-evidence.\n    $ paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n    Next: paybond agent run bind --help\n  Completion preset\n    Scaffold catalog-aligned completion evidence for Harbor release predicates.\n    $ paybond init completion --preset api_response_ok\n    $ paybond policy templates\n    $ paybond policy preview --preset api_response_ok --evidence-file evidence.json\n    Next: paybond policy preview --help\n\nDocumentation: https://docs.paybond.ai/kit\n\nLearn more:\n  paybond help <command>     Detailed help for a command\n  paybond examples           Copy-paste command examples\n  paybond onboarding         Guided first-run checks\n  paybond completion <shell> Shell completions (bash|zsh|fish)\n\nLegacy aliases: paybond-kit-login, paybond-init, paybond-kit-init, paybond-mcp-server\n";
+export declare const ROOT_HELP = "Usage: paybond [--global-flags] <command> [<subcommand> ...] [args]\n\nGlobal flags:\n  --gateway <url>         Gateway base URL (default: https://api.paybond.ai)\n  --env-file <path>       Local secrets file (default: .env.local)\n  --format table|json     Human table or JSON envelope output (default: table)\n  --json <fields>         Field-selectable JSON for list/read commands (plain JSON; use --format json for envelope)\n  --jq <expr>             jq-style filter for list/read command output\n  --profile <name>        Named credential profile from the Paybond CLI config file\n  --request-id <id>       Correlation ID for Gateway calls and JSON output\n  --yes                   Skip confirmation for destructive operations\n  --no-open               Do not open a browser for device login\n  --color auto|always|never Colorize human table output and help text (default: auto)\n  --no-color              Disable color output (also honors NO_COLOR)\n\nCommands:\n  onboarding              Guided, non-destructive first-run checks\n  help                    Detailed help for a command\n  examples                Copy-paste examples from the command spec\n  completion bash|zsh|fish Shell completion scripts\n  login                   Sandbox device login\n  init                    Interactive first-run scaffold (solution, spend cap, framework, owned policy files)\n  init guardrail|completion|agent-middleware\n                          Scaffold sandbox guardrail, completion evidence, or agent middleware integration files\n  mcp serve|install|verify-config|tools MCP server and host configuration\n  doctor                  Validate local runtime, credentials, and optional agent setup\n  dev smoke|trace|loop|up\n                          Local sandbox developer loop: travel smoke, trace dashboard, WireMock up, and guided setup\n  version                 Print package version (use --verbose for runtime details)\n  diagnose                Emit a redacted support bundle with --redacted\n  config get|set|unset|list\n                          Manage CLI configuration values\n  whoami                  Resolve the authenticated principal and tenant realm\n  keys list|create|rotate|revoke\n                          Manage tenant service-account API keys\n  intents list|get|create|fund|evidence|settlement-confirm\n                          Harbor intent workflows\n  guardrails bootstrap|evidence\n                          Sandbox guardrail helpers\n  spend authorize         Authorize delegated spend for a tool call\n  signal reputation|portfolio|fraud\n                          Signal summaries and fraud reads\n  receipts get|verify\n                          Protocol settlement and agent action receipts (--kind agent)\n  mandates verify|import\n                          Agent mandate verification and import\n  a2a card|contracts\n                          Agent card discovery and task contracts\n  policy init|init-org|extend|presets list|presets show|validate-tools|templates|preview|import-mcp-receipt|import-x402-receipt|validate-evidence\n                          Scaffold and validate paybond.policy.yaml (including enterprise org inheritance), browse policy presets and solutions, list completion presets, preview Harbor templates, and import receipts\n  agent run bind|status|trace|reload-policy|tool execute|validate|registry validate|sandbox smoke\n                          Agent middleware: bind runs, reload policy, execute tools, validate registry, sandbox smoke\n  audit exports list|get|verify|delete\n                          Compliance audit export jobs and local bundle verification\n\nGetting started:\n  Sandbox setup\n    Authenticate, validate the runtime, and confirm tenant context.\n    $ paybond login\n    $ paybond doctor --format json\n    Next: paybond whoami\n  Agent + MCP host\n    Preview MCP host config and list tools exposed to agents.\n    $ paybond mcp install --host claude --scope local\n    $ paybond mcp verify-config --host claude\n    $ paybond mcp tools\n    Next: paybond doctor --agent\n  Paid-tool guardrail\n    Scaffold a sandbox guardrail integration file for your agent runtime.\n    $ paybond init guardrail\n    $ paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100\n    Next: paybond spend authorize --help\n  Policy-driven agent sandbox\n    Validate and smoke-test agent middleware from a versioned paybond.policy.yaml file.\n    $ paybond policy init --out paybond.policy.yaml\n    $ paybond policy validate-tools --file paybond.policy.yaml\n    $ paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n    Next: paybond policy validate-tools --help\n  Agent middleware sandbox\n    Bind a sandbox run and execute a guarded tool with auto-evidence.\n    $ paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n    Next: paybond agent run bind --help\n  Completion preset\n    Scaffold catalog-aligned completion evidence for Harbor release predicates.\n    $ paybond init completion --preset api_response_ok\n    $ paybond policy templates\n    $ paybond policy preview --preset api_response_ok --evidence-file evidence.json\n    Next: paybond policy preview --help\n\nDocumentation: https://docs.paybond.ai/kit\n\nLearn more:\n  paybond help <command>     Detailed help for a command\n  paybond examples           Copy-paste command examples\n  paybond onboarding         Guided first-run checks\n  paybond completion <shell> Shell completions (bash|zsh|fish)\n\nLegacy aliases: paybond-kit-login, paybond-init, paybond-kit-init, paybond-mcp-server\n";
 export declare const COMMAND_HELP: Record<string, string>;
 export declare function helpForCommand(path: string): string;

package/dist/cli/help.js

@@ -1,5 +1,5 @@
 // Generated by kit/cli-parity/generate.mjs — do not edit by hand.
-export const ROOT_HELP = "Usage: paybond [--global-flags] <command> [<subcommand> ...] [args]\n\nGlobal flags:\n  --gateway <url>         Gateway base URL (default: https://api.paybond.ai)\n  --env-file <path>       Local secrets file (default: .env.local)\n  --format table|json     Human table or JSON envelope output (default: table)\n  --json <fields>         Field-selectable JSON for list/read commands (plain JSON; use --format json for envelope)\n  --jq <expr>             jq-style filter for list/read command output\n  --profile <name>        Named credential profile from the Paybond CLI config file\n  --request-id <id>       Correlation ID for Gateway calls and JSON output\n  --yes                   Skip confirmation for destructive operations\n  --no-open               Do not open a browser for device login\n  --color auto|always|never Colorize human table output and help text (default: auto)\n  --no-color              Disable color output (also honors NO_COLOR)\n\nCommands:\n  onboarding              Guided, non-destructive first-run checks\n  help                    Detailed help for a command\n  examples                Copy-paste examples from the command spec\n  completion bash|zsh|fish Shell completion scripts\n  login                   Sandbox device login\n  init                    Interactive first-run scaffold (solution, spend cap, framework, owned policy files)\n  init guardrail|completion|agent-middleware\n                          Scaffold sandbox guardrail, completion evidence, or agent middleware integration files\n  mcp serve|install|verify-config|tools MCP server and host configuration\n  doctor                  Validate local runtime, credentials, and optional agent setup\n  dev smoke|trace|loop|up\n                          Local sandbox developer loop: travel smoke, trace dashboard, WireMock up, and guided setup\n  version                 Print package version (use --verbose for runtime details)\n  diagnose                Emit a redacted support bundle with --redacted\n  config get|set|unset|list\n                          Manage CLI configuration values\n  whoami                  Resolve the authenticated principal and tenant realm\n  keys list|create|rotate|revoke\n                          Manage tenant service-account API keys\n  intents list|get|create|fund|evidence|settlement-confirm\n                          Harbor intent workflows\n  guardrails bootstrap|evidence\n                          Sandbox guardrail helpers\n  spend authorize         Authorize delegated spend for a tool call\n  signal reputation|portfolio|fraud\n                          Signal summaries and fraud reads\n  receipts get|verify\n                          Protocol settlement receipts\n  mandates verify|import\n                          Agent mandate verification and import\n  a2a card|contracts\n                          Agent card discovery and task contracts\n  policy init|init-org|extend|presets list|presets show|validate-tools|templates|preview|import-mcp-receipt|import-x402-receipt|validate-evidence\n                          Scaffold and validate paybond.policy.yaml (including enterprise org inheritance), browse policy presets and solutions, list completion presets, preview Harbor templates, and import receipts\n  agent run bind|status|trace|reload-policy|tool execute|validate|registry validate|sandbox smoke\n                          Agent middleware: bind runs, reload policy, execute tools, validate registry, sandbox smoke\n  audit exports list|get|verify|delete\n                          Compliance audit export jobs and local bundle verification\n\nGetting started:\n  Sandbox setup\n    Authenticate, validate the runtime, and confirm tenant context.\n    $ paybond login\n    $ paybond doctor --format json\n    Next: paybond whoami\n  Agent + MCP host\n    Preview MCP host config and list tools exposed to agents.\n    $ paybond mcp install --host claude --scope local\n    $ paybond mcp verify-config --host claude\n    $ paybond mcp tools\n    Next: paybond doctor --agent\n  Paid-tool guardrail\n    Scaffold a sandbox guardrail integration file for your agent runtime.\n    $ paybond init guardrail\n    $ paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100\n    Next: paybond spend authorize --help\n  Policy-driven agent sandbox\n    Validate and smoke-test agent middleware from a versioned paybond.policy.yaml file.\n    $ paybond policy init --out paybond.policy.yaml\n    $ paybond policy validate-tools --file paybond.policy.yaml\n    $ paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n    Next: paybond policy validate-tools --help\n  Agent middleware sandbox\n    Bind a sandbox run and execute a guarded tool with auto-evidence.\n    $ paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n    Next: paybond agent run bind --help\n  Completion preset\n    Scaffold catalog-aligned completion evidence for Harbor release predicates.\n    $ paybond init completion --preset api_response_ok\n    $ paybond policy templates\n    $ paybond policy preview --preset api_response_ok --evidence-file evidence.json\n    Next: paybond policy preview --help\n\nDocumentation: https://docs.paybond.ai/kit\n\nLearn more:\n  paybond help <command>     Detailed help for a command\n  paybond examples           Copy-paste command examples\n  paybond onboarding         Guided first-run checks\n  paybond completion <shell> Shell completions (bash|zsh|fish)\n\nLegacy aliases: paybond-kit-login, paybond-init, paybond-kit-init, paybond-mcp-server\n";
+export const ROOT_HELP = "Usage: paybond [--global-flags] <command> [<subcommand> ...] [args]\n\nGlobal flags:\n  --gateway <url>         Gateway base URL (default: https://api.paybond.ai)\n  --env-file <path>       Local secrets file (default: .env.local)\n  --format table|json     Human table or JSON envelope output (default: table)\n  --json <fields>         Field-selectable JSON for list/read commands (plain JSON; use --format json for envelope)\n  --jq <expr>             jq-style filter for list/read command output\n  --profile <name>        Named credential profile from the Paybond CLI config file\n  --request-id <id>       Correlation ID for Gateway calls and JSON output\n  --yes                   Skip confirmation for destructive operations\n  --no-open               Do not open a browser for device login\n  --color auto|always|never Colorize human table output and help text (default: auto)\n  --no-color              Disable color output (also honors NO_COLOR)\n\nCommands:\n  onboarding              Guided, non-destructive first-run checks\n  help                    Detailed help for a command\n  examples                Copy-paste examples from the command spec\n  completion bash|zsh|fish Shell completion scripts\n  login                   Sandbox device login\n  init                    Interactive first-run scaffold (solution, spend cap, framework, owned policy files)\n  init guardrail|completion|agent-middleware\n                          Scaffold sandbox guardrail, completion evidence, or agent middleware integration files\n  mcp serve|install|verify-config|tools MCP server and host configuration\n  doctor                  Validate local runtime, credentials, and optional agent setup\n  dev smoke|trace|loop|up\n                          Local sandbox developer loop: travel smoke, trace dashboard, WireMock up, and guided setup\n  version                 Print package version (use --verbose for runtime details)\n  diagnose                Emit a redacted support bundle with --redacted\n  config get|set|unset|list\n                          Manage CLI configuration values\n  whoami                  Resolve the authenticated principal and tenant realm\n  keys list|create|rotate|revoke\n                          Manage tenant service-account API keys\n  intents list|get|create|fund|evidence|settlement-confirm\n                          Harbor intent workflows\n  guardrails bootstrap|evidence\n                          Sandbox guardrail helpers\n  spend authorize         Authorize delegated spend for a tool call\n  signal reputation|portfolio|fraud\n                          Signal summaries and fraud reads\n  receipts get|verify\n                          Protocol settlement and agent action receipts (--kind agent)\n  mandates verify|import\n                          Agent mandate verification and import\n  a2a card|contracts\n                          Agent card discovery and task contracts\n  policy init|init-org|extend|presets list|presets show|validate-tools|templates|preview|import-mcp-receipt|import-x402-receipt|validate-evidence\n                          Scaffold and validate paybond.policy.yaml (including enterprise org inheritance), browse policy presets and solutions, list completion presets, preview Harbor templates, and import receipts\n  agent run bind|status|trace|reload-policy|tool execute|validate|registry validate|sandbox smoke\n                          Agent middleware: bind runs, reload policy, execute tools, validate registry, sandbox smoke\n  audit exports list|get|verify|delete\n                          Compliance audit export jobs and local bundle verification\n\nGetting started:\n  Sandbox setup\n    Authenticate, validate the runtime, and confirm tenant context.\n    $ paybond login\n    $ paybond doctor --format json\n    Next: paybond whoami\n  Agent + MCP host\n    Preview MCP host config and list tools exposed to agents.\n    $ paybond mcp install --host claude --scope local\n    $ paybond mcp verify-config --host claude\n    $ paybond mcp tools\n    Next: paybond doctor --agent\n  Paid-tool guardrail\n    Scaffold a sandbox guardrail integration file for your agent runtime.\n    $ paybond init guardrail\n    $ paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100\n    Next: paybond spend authorize --help\n  Policy-driven agent sandbox\n    Validate and smoke-test agent middleware from a versioned paybond.policy.yaml file.\n    $ paybond policy init --out paybond.policy.yaml\n    $ paybond policy validate-tools --file paybond.policy.yaml\n    $ paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n    Next: paybond policy validate-tools --help\n  Agent middleware sandbox\n    Bind a sandbox run and execute a guarded tool with auto-evidence.\n    $ paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n    Next: paybond agent run bind --help\n  Completion preset\n    Scaffold catalog-aligned completion evidence for Harbor release predicates.\n    $ paybond init completion --preset api_response_ok\n    $ paybond policy templates\n    $ paybond policy preview --preset api_response_ok --evidence-file evidence.json\n    Next: paybond policy preview --help\n\nDocumentation: https://docs.paybond.ai/kit\n\nLearn more:\n  paybond help <command>     Detailed help for a command\n  paybond examples           Copy-paste command examples\n  paybond onboarding         Guided first-run checks\n  paybond completion <shell> Shell completions (bash|zsh|fish)\n\nLegacy aliases: paybond-kit-login, paybond-init, paybond-kit-init, paybond-mcp-server\n";
 export const COMMAND_HELP = {
     "onboarding": "Usage: paybond onboarding [--host claude|codex|openai|generic]\n\nRuns a guided, non-destructive first-run workflow: runtime check, login status, guardrail file status, MCP config preview, and doctor.\n\nExamples:\n  $ paybond onboarding\n  $ paybond onboarding --host claude --format json\n\nDocs: https://docs.paybond.ai/kit/coding-agent-setup\n\nNext: paybond login",
     "help": "Usage: paybond help [<command> [<subcommand> ...]]\n\nShows detailed help for a command path. Without arguments, prints root help.\n\nExamples:\n  $ paybond help\n  $ paybond help login\n  $ paybond help mcp install",
@@ -53,8 +53,8 @@ export const COMMAND_HELP = {
     "signal reputation": "Usage: paybond signal reputation --did <did>\n\nExamples:\n  $ paybond signal reputation --did did:example:alice",
     "signal portfolio": "Usage: paybond signal portfolio\n\nExamples:\n  $ paybond signal portfolio",
     "signal fraud": "Usage: paybond signal fraud --did <did>\n\nExamples:\n  $ paybond signal fraud --did did:example:alice",
-    "receipts get": "Usage: paybond receipts get <receipt_id>\n\nExamples:\n  $ paybond receipts get receipt-123",
-    "receipts verify": "Usage: paybond receipts verify <receipt_id>\n\nExamples:\n  $ paybond receipts verify receipt-123",
+    "receipts get": "Usage: paybond receipts get <receipt_id> [--kind protocol|agent]\n\nFetch a signed protocol settlement receipt (default) or agent action receipt (--kind agent).\n\nExamples:\n  $ paybond receipts get receipt-123\n  $ paybond receipts get sha256:abc... --kind agent --format json",
+    "receipts verify": "Usage: paybond receipts verify <receipt_id> [--kind protocol|agent]\n\nVerify a protocol settlement receipt (default) or agent action receipt (--kind agent) via Gateway offline verify.\n\nExamples:\n  $ paybond receipts verify receipt-123\n  $ paybond receipts verify sha256:abc... --kind agent --format json",
     "mandates verify": "Usage: paybond mandates verify --body <json-file>\n\nExamples:\n  $ paybond mandates verify --body mandate.json",
     "mandates import": "Usage: paybond mandates import --body <json-file>\n\nExamples:\n  $ paybond mandates import --body mandate.json",
     "a2a card": "Usage: paybond a2a card\n\nExamples:\n  $ paybond a2a card",

package/dist/completion-catalog-digest.d.ts

@@ -1,2 +1,2 @@
 /** Generated by kit/scripts/sync-completion-catalog.mjs — do not edit. */
-export declare const BUNDLED_COMPLETION_CATALOG_SHA256_HEX: "df9c8e9ad04e10b682dd7877460528896216d832486e88af6c9039bad402b264";
+export declare const BUNDLED_COMPLETION_CATALOG_SHA256_HEX: "a738febc9ee8b5b66f05991c4582ba24e6857cdc574196b0aeefc5c77e192ea9";

package/dist/completion-catalog-digest.js

@@ -1,2 +1,2 @@
 /** Generated by kit/scripts/sync-completion-catalog.mjs — do not edit. */
-export const BUNDLED_COMPLETION_CATALOG_SHA256_HEX = "df9c8e9ad04e10b682dd7877460528896216d832486e88af6c9039bad402b264";
+export const BUNDLED_COMPLETION_CATALOG_SHA256_HEX = "a738febc9ee8b5b66f05991c4582ba24e6857cdc574196b0aeefc5c77e192ea9";

package/dist/index.d.ts

@@ -4,12 +4,13 @@
  */
 import { type BuildSignedCreateIntentParams, type BuildSignedCreateIntentWithPolicyBindingParams, type SettlementRail } from "./principal-intent.js";
 import { type SignPayeeEvidenceParams } from "./payee-evidence.js";
-import { PaybondAgentRunFacade, PaybondInstrumentBuilder, PaybondInstrumentRuntime, PaybondToolRegistry, type CreateGuardedAgentInput, type CreateGuardedAgentResult, type PaybondAgentInput, type PaybondAgentResult, type PaybondInlinePolicy, type PaybondInstrumentAgentOptions, type PaybondInstrumentInput, type PaybondInstrumented, type PaybondToolRegistryConfig, type PaybondWrapToolsOptions } from "./agent/index.js";
+import { PaybondAgentRunFacade, type PaybondAgentCallable, PaybondInstrumentBuilder, PaybondInstrumentRuntime, PaybondToolRegistry, type CreateGuardedAgentInput, type CreateGuardedAgentResult, type PaybondInlinePolicy, type PaybondInstrumentAgentOptions, type PaybondInstrumentInput, type PaybondInstrumented, type PaybondToolRegistryConfig, type PaybondWrapToolsOptions } from "./agent/index.js";
 import { GatewayAgentRunTraceReporter } from "./agent/gateway-trace-reporter.js";
 import { PaybondAudit } from "./audit/index.js";
 import { type PolicyRemoteValidateOptions, type PolicyRemoteValidateResult } from "./policy/validate-remote.js";
 import { type PolicyEffectiveResolveResult } from "./policy/load-effective.js";
 import { type FundRequestEnvelope, type PaymentRequired, type X402FundPollOptions } from "./x402-funding.js";
+import { type MppFundPollOptions, type PaymentAuthChallenge } from "./mpp-funding.js";
 export type SpendScope = {
     scope_type: string;
     scope_key: string;
@@ -43,6 +44,13 @@ export type PaybondSpendAuthorizationInput = {
     agentSubject?: string;
     approvalToken?: string;
     idempotencyKey?: string;
+    /**
+     * Agent Receipt Standard context (Phase 1): forwarded to Gateway `/verify` on every call for
+     * audit correlation. See `go/gateway/internal/spendauth/types.go` `VerifyRequest`.
+     */
+    modelFamily?: string;
+    configHashHex?: string;
+    promptHashHex?: string;
 };
 export type SubmitEvidenceResult = {
     intentId: string;
@@ -54,6 +62,12 @@ export type IntentFundingResult = {
     settlementRail: SettlementRail;
     harborFundEndpoint?: string;
     status?: string;
+    /** MPP Payment Auth challenge `intent` (`charge` or `session`). */
+    intent?: string;
+    /** MPP Payment Auth challenge `method` (`stripe` or `tempo`). */
+    method?: string;
+    /** MPP Payment Auth challenge id from `WWW-Authenticate: Payment`. */
+    challengeId?: string;
     paymentSessionId?: string;
     paymentUrl?: string;
     stripePaymentIntentId?: string;
@@ -69,6 +83,22 @@ export type IntentFundingResult = {
     bankName?: string;
     asset?: string;
     network?: string;
+    /** MPP settlement asset (e.g. `usdc`). */
+    settlementAsset?: string;
+    /** MPP settlement network (e.g. `tempo`). */
+    settlementNetwork?: string;
+    /** Tempo session channel id (`stripe_mpp` session funding). */
+    channelId?: string;
+    /** Tempo session protocol version (e.g. `v2`). */
+    sessionProtocol?: string;
+    /** Required Tempo deposit in USDC base units. */
+    depositAmountBaseUnits?: string;
+    acceptedCumulativeBaseUnits?: string;
+    pendingCumulativeBaseUnits?: string;
+    descriptorHash?: string;
+    lastVoucherAt?: string;
+    lastSettleTxHash?: string;
+    channelStatus?: string;
     authorizationId?: string;
     captureId?: string;
     voidId?: string;
@@ -94,6 +124,12 @@ export type FundIntentResult = {
     statusCode: 200 | 202 | 402;
     paymentRequired?: string;
     paymentResponse?: string;
+    /** Payment Auth challenges from `WWW-Authenticate` (MPP charge/session). */
+    wwwAuthenticate?: string[];
+    /** Payment Auth receipt from `Payment-Receipt` when Harbor confirms payment progress. */
+    paymentReceipt?: string;
+    /** Cache policy echoed from Harbor (`Cache-Control`). */
+    cacheControl?: string;
     intentId: string;
     tenant: string;
     state: string;
@@ -722,6 +758,7 @@ export type VerifyProtocolReceiptV1Result = {
     tenant_id: string;
     receipt: ProtocolAuthorizationReceiptV1 | ProtocolSettlementReceiptV1 | Record<string, unknown>;
 };
+export type { VerifyAgentReceiptV1Result } from "./agent/receipt-client.js";
 export declare class A2AHttpError extends Error {
     readonly statusCode: number;
     readonly url: string;
@@ -900,6 +937,7 @@ export declare class HarborClient {
      */
     fundIntent(intentId: string, options?: {
         paymentSignature?: string;
+        paymentAuthorization?: string;
         idempotencyKey?: string;
     }): Promise<FundIntentResult>;
     /**
@@ -1009,6 +1047,7 @@ export declare class GatewayHarborClient {
     createIntent(body: Record<string, unknown>, options: GatewayHarborMutationOptions): Promise<Record<string, unknown>>;
     fundIntent(intentId: string, options: GatewayHarborMutationOptions & {
         paymentSignature?: string;
+        paymentAuthorization?: string;
     }): Promise<FundIntentResult>;
     submitEvidence(intentId: string, evidenceBody: Record<string, unknown>, options: GatewayHarborMutationOptions): Promise<SubmitEvidenceResult>;
     /** Recognition-gated Gateway Harbor settlement confirmation. */
@@ -1127,6 +1166,12 @@ export declare class GatewayProtocolClient {
     }): Promise<ImportAgentMandateV1Result>;
     getSettlementReceiptV1(receiptId: string): Promise<ProtocolSettlementReceiptV1>;
     verifyProtocolReceiptV1(receipt: ProtocolAuthorizationReceiptV1 | ProtocolSettlementReceiptV1 | Record<string, unknown>): Promise<VerifyProtocolReceiptV1Result>;
+    getAgentReceiptV1ByID(receiptId: string): Promise<import("./agent-receipt.js").AgentReceiptV1>;
+    getAgentReceiptV1ByIntentToolCall(init: {
+        intentId: string;
+        toolCallId: string;
+    }): Promise<import("./agent-receipt.js").AgentReceiptV1>;
+    verifyAgentReceiptV1(receipt: import("./agent-receipt.js").AgentReceiptV1 | Record<string, unknown>): Promise<import("./agent/receipt-client.js").VerifyAgentReceiptV1Result>;
     createHarborIntent(init: {
         body: Record<string, unknown>;
         recognitionProof: AgentRecognitionProofV1 | Record<string, unknown>;
@@ -1234,6 +1279,7 @@ export declare class PaybondIntents {
         intentId: string;
         recognitionProof: AgentRecognitionProofV1 | Record<string, unknown>;
         paymentSignature?: string;
+        paymentAuthorization?: string;
         idempotencyKey?: string;
     }): Promise<FundIntentResult>;
     /**
@@ -1249,6 +1295,36 @@ export declare class PaybondIntents {
         pollOptions?: X402FundPollOptions;
         idempotencyKey?: string;
     }): Promise<FundIntentResult>;
+    /**
+     * One-shot Stripe MPP charge fund flow: create Payment Auth credentials from 402 challenges,
+     * retry with `paymentAuthorization`, and poll until funded.
+     *
+     * MPP wallet and SPT secrets stay app-owned — pass injectable `createPaymentCredential` and
+     * `issueRecognitionProof` callbacks.
+     */
+    fundWithMppCharge(params: {
+        intentId: string;
+        recognitionProof: AgentRecognitionProofV1 | Record<string, unknown>;
+        createPaymentCredential: (challenge: PaymentAuthChallenge) => Promise<string>;
+        issueRecognitionProof: (envelope: FundRequestEnvelope) => Promise<AgentRecognitionProofV1 | Record<string, unknown>>;
+        pollOptions?: MppFundPollOptions;
+        idempotencyKey?: string;
+    }): Promise<FundIntentResult>;
+    /**
+     * Tempo MPP session fund flow: open a session channel deposit via Payment Auth credentials,
+     * retry with `paymentAuthorization`, and poll until the intent is funded.
+     *
+     * MPP wallet and SPT secrets stay app-owned — pass injectable `createPaymentCredential` and
+     * `issueRecognitionProof` callbacks.
+     */
+    fundWithMppSession(params: {
+        intentId: string;
+        recognitionProof: AgentRecognitionProofV1 | Record<string, unknown>;
+        createPaymentCredential: (challenge: PaymentAuthChallenge) => Promise<string>;
+        issueRecognitionProof: (envelope: FundRequestEnvelope) => Promise<AgentRecognitionProofV1 | Record<string, unknown>>;
+        pollOptions?: MppFundPollOptions;
+        idempotencyKey?: string;
+    }): Promise<FundIntentResult>;
     /**
      * Sign payee evidence and POST it. `payeeSigningSeed` must be 32 bytes.
      */
@@ -1274,6 +1350,7 @@ export declare class Paybond {
     readonly intents: PaybondIntents;
     readonly audit: PaybondAudit;
     readonly agentRun: PaybondAgentRunFacade;
+    readonly agent: PaybondAgentCallable;
     private constructor();
     /** Open a tenant-bound hosted Paybond session from a service-account API key. */
     static open(init: PaybondOpenOptions): Promise<Paybond>;
@@ -1318,11 +1395,6 @@ export declare class Paybond {
     instrumentMCP<TTools>(input: Omit<PaybondInstrumentInput<TTools>, "framework"> & {
         tools: TTools;
     }): Promise<PaybondInstrumented<TTools> | PaybondInstrumentRuntime<TTools>>;
-    /**
-     * Opinionated quickstart: resolve named policy presets (for example `travel`) or file paths,
-     * then instrument tools for the selected framework.
-     */
-    agent<TTools>(input: PaybondAgentInput<TTools>): Promise<PaybondAgentResult<TTools>>;
     /** Wrap tools for an existing bound run without reloading policy. */
     wrapTools(run: import("./agent/run.js").PaybondAgentRun, tools: unknown, options?: PaybondWrapToolsOptions): unknown;
     /**
@@ -1342,10 +1414,14 @@ export { buildSignedCreateIntentBody, buildSignedCreateIntentBodyWithPolicyBindi
 export { artifactsDigest, evidenceSignBytesV1, signPayeeEvidenceBinding, type SignPayeeEvidenceParams, } from "./payee-evidence.js";
 export { AGENT_RECOGNITION_GATEWAY_VERIFIER_ID, AGENT_RECOGNITION_PROOF_KIND_V1, AGENT_RECOGNITION_PURPOSE_CREATE, AGENT_RECOGNITION_PURPOSE_FUND, AGENT_RECOGNITION_PURPOSE_EVIDENCE_SUBMIT, newAgentRecognitionRequestEnvelope, signAgentRecognitionProofV1, signHarborCreateRecognitionProof, signHarborFundRecognitionProof, signHarborEvidenceSubmitRecognitionProof, signHarborSettlementConfirmRecognitionProof, type SignAgentRecognitionProofV1Params, type SignedAgentRecognitionProofV1, } from "./agent-recognition.js";
 export { executeFundWithX402, buildX402FundRequestEnvelope, PaybondX402FundingFailedError, PaybondX402FundingPendingError, type FundRequestEnvelope, type PaymentRequired, type X402FundPollOptions, } from "./x402-funding.js";
+export { executeFundWithMpp, executeFundWithMppCharge, executeFundWithMppSession, buildMppFundRequestEnvelope, parsePaymentAuthChallenge, selectMppChargeChallenge, selectMppSessionChallenge, PaybondMppFundingFailedError, PaybondMppFundingPendingError, type MppFundPollOptions, type ParsedPaymentAuthChallenge, type PaymentAuthChallenge, } from "./mpp-funding.js";
 export { validateCompletionEvidence, type CompletionEvidenceValidationReport, } from "./completion-validate-evidence.js";
 export { completionSchemaDigestHex, computeVendorContractDigests, verifyVendorContract, verifyCatalogVendorContracts, type VendorContract, type VendorContractDigests, } from "./completion-contract-digest.js";
 export { contractSnapshotForPreset, mapVendorEvidenceToCanonical, resolveCompletionPreset, } from "./completion-resolve.js";
-export { PaybondAgentRun, PaybondAgentRunBindError, PaybondAgentRunFacade, PaybondEvidenceSubmitError, PaybondFrameworkAdapter, PaybondToolInterceptor, PaybondToolRegistry, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, buildAutoEvidencePayload, createGenericToolExecutor, createGuardedAgent, createGuardedAgentRunner, createPaybondAgent, createPaybondGenericAgentConfig, createPaybondGenericInputGuard, createPaybondToolRegistry, createToolInputGuardAdapter, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, paybondGenericToolExecutorAdapter, paybondToolInputGuardAdapter, resolveAgentPolicySource, toPaybondAgentResult, wrapPaybondTools, PaybondInstrumentBuilder, PaybondInstrumented, PaybondInstrumentRuntime, PaybondLazyContextError, PaybondUnboundContextError, discoverPolicyFromAgent, discoverToolNames, discoverToolsFromAgent, inlinePolicyToDocument, isInlinePolicy, isInstrumentableAgentObject, readPaybondAgentInstrumentation, type CreateGuardedAgentInput, type CreateGuardedAgentResult, type GuardedAgentFramework, type PaybondAgentHooks, type PaybondAgentInput, type PaybondAgentResult, type PaybondAgentRunBindInput, type PaybondAuthorizeToolCallInput, type PaybondEvidenceMapper, type PaybondGenericAgentConfig, type PaybondGenericToolCall, type PaybondGenericToolDefinition, type PaybondGenericWrappedToolDefinition, type PaybondInlinePolicy, type PaybondAgentInstrumentation, type PaybondInstrumentAgentOptions, type PaybondInstrumentBinding, type PaybondInstrumentContext, type PaybondInstrumentContextInput, type PaybondInstrumentContextProvider, type PaybondInstrumentInput, type PaybondInterceptEvidenceResult, type PaybondInterceptWrapExecuteInput, type PaybondInterceptWrapExecuteResult, type PaybondRunBinding, type PaybondRunBindingAttachInput, type PaybondRunBindingSandboxBootstrapInput, type PaybondRunGuard, type PaybondSideEffectingToolEntry, type PaybondSideEffectingToolPolicy, type PaybondSpendResolver, type PaybondToolCallContext, type PaybondToolInputGuardAllowDecision, type PaybondToolInputGuardApprovalRequiredDecision, type PaybondToolInputGuardDecision, type PaybondToolInputGuardDenyDecision, type PaybondToolInputGuardAdapter, type PaybondToolRegistryConfig, type PaybondToolResolution, type PaybondWrapToolsOptions, } from "./agent/index.js";
+export { PaybondAgentRun, PaybondAgentRunBindError, PaybondAgentRunFacade, PaybondEvidenceSubmitError, PaybondFrameworkAdapter, PaybondToolInterceptor, PaybondToolRegistry, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, buildAutoEvidencePayload, createGenericToolExecutor, createGuardedAgent, createGuardedAgentRunner, createPaybondAgent, createPaybondGenericAgentConfig, createPaybondGenericInputGuard, createPaybondToolRegistry, createToolInputGuardAdapter, instrumentPaybondAgent, instrumentPaybondClaudeAgents, instrumentPaybondLangGraph, instrumentPaybondMCP, instrumentPaybondOpenAI, instrumentPaybondVercel, paybondGenericToolExecutorAdapter, paybondToolInputGuardAdapter, resolveAgentPolicySource, toPaybondAgentResult, wrapPaybondTools, PaybondInstrumentBuilder, PaybondInstrumented, PaybondInstrumentRuntime, PaybondLazyContextError, PaybondUnboundContextError, discoverPolicyFromAgent, discoverToolNames, discoverToolsFromAgent, inlinePolicyToDocument, isInlinePolicy, isInstrumentableAgentObject, readPaybondAgentInstrumentation, type CreateGuardedAgentInput, type CreateGuardedAgentResult, type GuardedAgentFramework, type PaybondAgentHooks, type PaybondAgentInput, type PaybondAgentResult, type PaybondAgentRunBindInput, type PaybondAuthorizeToolCallInput, type PaybondEvidenceMapper, type PaybondExternalAttestationMapper, type PaybondGenericAgentConfig, type PaybondGenericToolCall, type PaybondGenericToolDefinition, type PaybondGenericWrappedToolDefinition, type PaybondInlinePolicy, type PaybondAgentInstrumentation, type PaybondInstrumentAgentOptions, type PaybondInstrumentBinding, type PaybondInstrumentContext, type PaybondInstrumentContextInput, type PaybondInstrumentContextProvider, type PaybondInstrumentInput, type PaybondInterceptEvidenceResult, type PaybondInterceptWrapExecuteInput, type PaybondInterceptWrapExecuteResult, type PaybondRunBinding, type PaybondRunBindingAttachInput, type PaybondRunBindingSandboxBootstrapInput, type PaybondRunGuard, type PaybondSideEffectingToolEntry, type PaybondSideEffectingToolPolicy, type PaybondSpendResolver, type PaybondToolCallContext, type PaybondToolInputGuardAllowDecision, type PaybondToolInputGuardApprovalRequiredDecision, type PaybondToolInputGuardDecision, type PaybondToolInputGuardDenyDecision, type PaybondToolInputGuardAdapter, type PaybondToolRegistryConfig, type PaybondToolResolution, type PaybondWrapToolsOptions, } from "./agent/index.js";
 export { PaybondAudit, PaybondAuditExports, GatewayAuditExportsClient, parseAuditExportList, parseAuditExportJobGet, verifyAuditManifest, verifyAuditBundleLocal, type AuditExportJobDetail, type AuditExportJobGetResponse, type AuditExportJobSummary, type AuditExportListPage, type AuditVerifyResult, type AuditExportsGateway, } from "./audit/index.js";
 export { PaybondPolicy, composePolicyLayers, composeBundledPresetDefault, domain, guardrails, paybondPolicyPresets, resolveComposedPresetDocument, type LayeredPolicyPresetId, type PaybondPolicyPresets, type PolicyGuardrailLayer, type PolicyPresetId, type VerticalPolicyOptions, } from "./policy/index.js";
 export { getSolutionSmokeDefaults, isKnownSolutionId, listSolutionIds, loadSolutionManifest, paybondSolutionPresets, type PaybondSolutionBundle, type PaybondSolutionPresets, type SolutionId, type SolutionManifest, type SolutionSmokeDefaults, } from "./solutions/index.js";
+export { appendDirectHarborPaymentAuthorization, formatPaymentAuthorizationValue, PAYBOND_PAYMENT_AUTHORIZATION_HEADER, PAYMENT_TRANSPORT_RESPONSE_HEADERS, paymentAuthorizationGatewayHeader, readFundPaymentTransportHeaders, type FundPaymentTransportHeaders, } from "./payment-transport.js";
+export { AGENT_RECEIPT_KIND_V1, AGENT_RECEIPT_SCHEMA_VERSION, AGENT_RECEIPT_SCOPE_ACTION, AGENT_RECEIPT_SCOPE_INTENT_TERMINAL, AGENT_RECEIPT_SIGNING_ALGORITHM_ED25519, AGENT_RECEIPT_VERSION_V1, AGENT_RECEIPT_WELL_KNOWN_PATH, actionReceiptId, canonicalAgentReceiptBytes, configHashSha256Hex, promptHashSha256Hex, valueDigestSha256Hex, verifyAgentReceiptV1, type AgentReceiptAgentV1, type AgentReceiptAuthorizationV1, type AgentReceiptEvidenceV1, type AgentReceiptExecutionV1, type AgentReceiptExternalAttestationV1, type AgentReceiptMerchantV1, type AgentReceiptOutcomeV1, type AgentReceiptPaymentV1, type AgentReceiptPolicyV1, type AgentReceiptReferencesV1, type AgentReceiptV1, type ConfigHashInput, } from "./agent-receipt.js";
+export { AGENT_RECEIPT_EXTERNAL_SOURCE_SEP2828, AGENT_RECEIPT_EXTERNAL_SOURCE_X402, partnerRecordDigestSha256Hex, resolveExternalAttestations, sep2828RecordsToExternalAttestations, x402ReceiptToExternalAttestations, type PaybondExternalAttestationInput, } from "./agent-receipt-external-attestations.js";