@paybond/kit 0.11.6 → 0.11.9

package/README.md

@@ -70,7 +70,7 @@ npx -p @paybond/kit paybond agent sandbox smoke \
   --format json
 ```
 
-With `--policy-file`, Kit sends `completion_preset` from the tool's `evidence_preset` and omits `evidence_schema` and `template_id` (Gateway rejects conflicting bootstrap fields). Requires `@paybond/kit` 0.11.6+.
+With `--policy-file`, Kit sends `completion_preset` from the tool's `evidence_preset` and omits `evidence_schema` and `template_id` (Gateway rejects conflicting bootstrap fields). Requires `@paybond/kit` 0.11.9+.
 
 `agent sandbox smoke` only requires `@paybond/kit`. Framework demo commands (`agent demo vercel-ai smoke`, etc.) load their optional peers on demand.
 

package/dist/cli/agent-harbor-evidence-smoke-checklist.d.ts

@@ -0,0 +1,7 @@
+import type { GlobalOptions } from "./types.js";
+/** Build human-readable harbor proxy evidence smoke checklist lines for `--format table`. */
+export declare function formatAgentHarborEvidenceSmokeChecklist(options: {
+    intentId: string;
+    evidence: Record<string, unknown>;
+    globals: GlobalOptions;
+}): string[];

package/dist/cli/agent-harbor-evidence-smoke-checklist.js

@@ -0,0 +1,23 @@
+import { colorize, shouldUseColor } from "./color.js";
+/** Build human-readable harbor proxy evidence smoke checklist lines for `--format table`. */
+export function formatAgentHarborEvidenceSmokeChecklist(options) {
+    const useColor = shouldUseColor(options.globals);
+    const mark = (line) => {
+        if (line.startsWith("✓") || line === "Success") {
+            return colorize(line, "green", useColor);
+        }
+        return line;
+    };
+    const lines = [];
+    const intentId = options.intentId.trim();
+    if (intentId) {
+        lines.push(mark(`✓ Intent ${intentId}`));
+    }
+    lines.push(mark("✓ POST /harbor/intents/{id}/evidence (Kit payee + recognition proof)"));
+    const predicatePassed = options.evidence.predicate_passed ?? options.evidence.predicatePassed;
+    if (predicatePassed === true) {
+        lines.push(mark("✓ Harbor accepted evidence (no recognition replay at upstream)"));
+    }
+    lines.push(mark("Success"));
+    return lines;
+}

package/dist/cli/agent-production-attach-smoke-checklist.d.ts

@@ -0,0 +1,7 @@
+import type { GlobalOptions } from "./types.js";
+/** Build human-readable production attach smoke checklist lines for `--format table`. */
+export declare function formatAgentProductionAttachSmokeChecklist(options: {
+    bind: Record<string, unknown>;
+    execute: Record<string, unknown>;
+    globals: GlobalOptions;
+}): string[];

package/dist/cli/agent-production-attach-smoke-checklist.js

@@ -0,0 +1,30 @@
+import { colorize, shouldUseColor } from "./color.js";
+/** Build human-readable production attach smoke checklist lines for `--format table`. */
+export function formatAgentProductionAttachSmokeChecklist(options) {
+    const useColor = shouldUseColor(options.globals);
+    const mark = (line) => {
+        if (line.startsWith("✓") || line === "Success") {
+            return colorize(line, "green", useColor);
+        }
+        return line;
+    };
+    const lines = [];
+    const intentId = String(options.bind.intent_id ?? "").trim();
+    if (intentId) {
+        lines.push(mark(`✓ Production attach bound (${intentId})`));
+    }
+    const operation = String(options.bind.operation ?? "").trim();
+    if (operation) {
+        lines.push(mark(`✓ Tool call: ${operation}`));
+    }
+    const authorization = options.execute.authorization;
+    if (authorization?.allow) {
+        lines.push(mark("✓ Spend approved"));
+    }
+    const evidence = options.execute.evidence;
+    if (evidence?.submitted) {
+        lines.push(mark("✓ Harbor evidence submitted (/harbor/* + recognition)"));
+    }
+    lines.push(mark("Success"));
+    return lines;
+}

package/dist/cli/command-spec.js

@@ -67,6 +67,8 @@ export const COMMAND_PATHS = [
     "agent tool validate",
     "agent registry validate",
     "agent sandbox smoke",
+    "agent production attach smoke",
+    "agent harbor evidence smoke",
     "agent demo vercel-ai smoke",
     "agent demo langgraph smoke",
     "agent demo generic smoke",
@@ -341,6 +343,12 @@ export const COMMAND_EXAMPLES = {
         "paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json",
         "paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json"
     ],
+    "agent production attach smoke": [
+        "paybond agent production attach smoke --attach-intent-id <intent-id> --capability-token <token> --operation paid-tool --requested-spend-cents 100 --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json"
+    ],
+    "agent harbor evidence smoke": [
+        "paybond agent harbor evidence smoke --intent-id <intent-id> --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json"
+    ],
     "agent demo vercel-ai smoke": [
         "paybond agent demo vercel-ai smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json"
     ],
@@ -470,7 +478,8 @@ export const COMPLETIONS = {
         "run",
         "tool",
         "registry",
-        "sandbox"
+        "sandbox",
+        "production"
     ],
     "audit": [
         "exports"
@@ -605,7 +614,7 @@ export const WORKFLOWS = [
 ];
 export const DOCS_BASE_URL = "https://docs.paybond.ai/kit";
 export const COMPLETION_SCRIPTS = {
-    "bash": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n_paybond_completion() {\n  local cur prev words cword\n  COMPREPLY=()\n  cur=\"${COMP_WORDS[COMP_CWORD]}\"\n  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"\n\n  if [[ $COMP_CWORD -eq 1 ]]; then\n    COMPREPLY=($(compgen -W \"onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\" -- \"$cur\"))\n    return 0\n  fi\n\n  case \"${COMP_WORDS[1]}\" in\n      init) COMPREPLY=($(compgen -W \"guardrail completion agent-middleware\" -- \"$cur\")) ;;\n      mcp) COMPREPLY=($(compgen -W \"serve install verify-config tools\" -- \"$cur\")) ;;\n      dev) COMPREPLY=($(compgen -W \"smoke trace loop up\" -- \"$cur\")) ;;\n      config) COMPREPLY=($(compgen -W \"get set unset list\" -- \"$cur\")) ;;\n      keys) COMPREPLY=($(compgen -W \"list create rotate revoke\" -- \"$cur\")) ;;\n      intents) COMPREPLY=($(compgen -W \"list get create fund evidence settlement-confirm\" -- \"$cur\")) ;;\n      guardrails) COMPREPLY=($(compgen -W \"bootstrap evidence\" -- \"$cur\")) ;;\n      spend) COMPREPLY=($(compgen -W \"authorize\" -- \"$cur\")) ;;\n      signal) COMPREPLY=($(compgen -W \"reputation portfolio fraud\" -- \"$cur\")) ;;\n      receipts) COMPREPLY=($(compgen -W \"get verify\" -- \"$cur\")) ;;\n      mandates) COMPREPLY=($(compgen -W \"verify import\" -- \"$cur\")) ;;\n      a2a) COMPREPLY=($(compgen -W \"card contracts\" -- \"$cur\")) ;;\n      policy) COMPREPLY=($(compgen -W \"init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\" -- \"$cur\")) ;;\n      agent) COMPREPLY=($(compgen -W \"run tool registry sandbox\" -- \"$cur\")) ;;\n      audit) COMPREPLY=($(compgen -W \"exports\" -- \"$cur\")) ;;\n      completion) COMPREPLY=($(compgen -W \"bash zsh fish\" -- \"$cur\")) ;;\n      init completion preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      policy preview preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      guardrails bootstrap completion-preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n    *) ;;\n  esac\n}\ncomplete -F _paybond_completion paybond\n",
-    "zsh": "#compdef paybond\n# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n\n_paybond() {\n  local -a commands\n  commands=(\n    'onboarding' 'help' 'examples' 'completion' 'login' 'init' 'mcp' 'doctor' 'dev' 'version' 'diagnose' 'config' 'whoami' 'keys' 'intents' 'guardrails' 'spend' 'signal' 'receipts' 'mandates' 'a2a' 'policy' 'audit' 'agent'\n  )\n  _arguments -C \\\n    '(--gateway)--gateway[Gateway base URL]:url:' \\\n    '(--env-file)--env-file[Local secrets file]:path:_files' \\\n    '(--format)--format[Output format]:(table json)' \\\n    '(--color)--color[Color mode]:(auto always never)' \\\n    '--no-color[Disable color output]' \\\n    '1: :->command' \\\n    '*::arg:->args'\n\n  case $state in\n    command)\n      _describe -t commands 'paybond commands' commands\n      ;;\n    args)\n      case $words[1] in\n    'init:subcommand:(guardrail completion agent-middleware)'\n    'mcp:subcommand:(serve install verify-config tools)'\n    'dev:subcommand:(smoke trace loop up)'\n    'config:subcommand:(get set unset list)'\n    'keys:subcommand:(list create rotate revoke)'\n    'intents:subcommand:(list get create fund evidence settlement-confirm)'\n    'guardrails:subcommand:(bootstrap evidence)'\n    'spend:subcommand:(authorize)'\n    'signal:subcommand:(reputation portfolio fraud)'\n    'receipts:subcommand:(get verify)'\n    'mandates:subcommand:(verify import)'\n    'a2a:subcommand:(card contracts)'\n    'policy:subcommand:(init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence)'\n    'agent:subcommand:(run tool registry sandbox)'\n    'audit:subcommand:(exports)'\n    'completion:subcommand:(bash zsh fish)'\n    'init completion preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'policy preview preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'guardrails bootstrap completion-preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n      esac\n      ;;\n  esac\n}\n\ncompdef _paybond paybond\n",
-    "fish": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\ncomplete -c paybond -f\ncomplete -c paybond -l gateway -d 'Gateway base URL'\ncomplete -c paybond -l env-file -d 'Local secrets file' -r\ncomplete -c paybond -l format -d 'Output format' -xa 'table json'\ncomplete -c paybond -l color -d 'Color mode' -xa 'auto always never'\ncomplete -c paybond -l no-color -d 'Disable color output'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'onboarding'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'help'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'examples'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'completion'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'login'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'init'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mcp'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'doctor'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'dev'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'version'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'diagnose'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'config'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'whoami'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'keys'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'intents'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'guardrails'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'spend'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'signal'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'receipts'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mandates'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'a2a'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'policy'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'audit'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'agent'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'guardrail'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'agent-middleware'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'serve'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'install'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'verify-config'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'smoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'trace'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'loop'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'up'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'set'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'unset'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'rotate'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'revoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'fund'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'settlement-confirm'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'bootstrap'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from spend' -a 'authorize'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'reputation'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'portfolio'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'fraud'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'import'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'card'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'contracts'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'init'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'templates'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'preview'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-mcp-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-x402-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'run'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'tool'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'registry'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'sandbox'\ncomplete -c paybond -n '__fish_seen_subcommand_from audit' -a 'exports'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'bash'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'zsh'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'fish'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_cost_and_completion'\n"
+    "bash": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n_paybond_completion() {\n  local cur prev words cword\n  COMPREPLY=()\n  cur=\"${COMP_WORDS[COMP_CWORD]}\"\n  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"\n\n  if [[ $COMP_CWORD -eq 1 ]]; then\n    COMPREPLY=($(compgen -W \"onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\" -- \"$cur\"))\n    return 0\n  fi\n\n  case \"${COMP_WORDS[1]}\" in\n      init) COMPREPLY=($(compgen -W \"guardrail completion agent-middleware\" -- \"$cur\")) ;;\n      mcp) COMPREPLY=($(compgen -W \"serve install verify-config tools\" -- \"$cur\")) ;;\n      dev) COMPREPLY=($(compgen -W \"smoke trace loop up\" -- \"$cur\")) ;;\n      config) COMPREPLY=($(compgen -W \"get set unset list\" -- \"$cur\")) ;;\n      keys) COMPREPLY=($(compgen -W \"list create rotate revoke\" -- \"$cur\")) ;;\n      intents) COMPREPLY=($(compgen -W \"list get create fund evidence settlement-confirm\" -- \"$cur\")) ;;\n      guardrails) COMPREPLY=($(compgen -W \"bootstrap evidence\" -- \"$cur\")) ;;\n      spend) COMPREPLY=($(compgen -W \"authorize\" -- \"$cur\")) ;;\n      signal) COMPREPLY=($(compgen -W \"reputation portfolio fraud\" -- \"$cur\")) ;;\n      receipts) COMPREPLY=($(compgen -W \"get verify\" -- \"$cur\")) ;;\n      mandates) COMPREPLY=($(compgen -W \"verify import\" -- \"$cur\")) ;;\n      a2a) COMPREPLY=($(compgen -W \"card contracts\" -- \"$cur\")) ;;\n      policy) COMPREPLY=($(compgen -W \"init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\" -- \"$cur\")) ;;\n      agent) COMPREPLY=($(compgen -W \"run tool registry sandbox production\" -- \"$cur\")) ;;\n      audit) COMPREPLY=($(compgen -W \"exports\" -- \"$cur\")) ;;\n      completion) COMPREPLY=($(compgen -W \"bash zsh fish\" -- \"$cur\")) ;;\n      init completion preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      policy preview preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n      guardrails bootstrap completion-preset) COMPREPLY=($(compgen -W \"api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\" -- \"$cur\")) ;;\n    *) ;;\n  esac\n}\ncomplete -F _paybond_completion paybond\n",
+    "zsh": "#compdef paybond\n# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n\n_paybond() {\n  local -a commands\n  commands=(\n    'onboarding' 'help' 'examples' 'completion' 'login' 'init' 'mcp' 'doctor' 'dev' 'version' 'diagnose' 'config' 'whoami' 'keys' 'intents' 'guardrails' 'spend' 'signal' 'receipts' 'mandates' 'a2a' 'policy' 'audit' 'agent'\n  )\n  _arguments -C \\\n    '(--gateway)--gateway[Gateway base URL]:url:' \\\n    '(--env-file)--env-file[Local secrets file]:path:_files' \\\n    '(--format)--format[Output format]:(table json)' \\\n    '(--color)--color[Color mode]:(auto always never)' \\\n    '--no-color[Disable color output]' \\\n    '1: :->command' \\\n    '*::arg:->args'\n\n  case $state in\n    command)\n      _describe -t commands 'paybond commands' commands\n      ;;\n    args)\n      case $words[1] in\n    'init:subcommand:(guardrail completion agent-middleware)'\n    'mcp:subcommand:(serve install verify-config tools)'\n    'dev:subcommand:(smoke trace loop up)'\n    'config:subcommand:(get set unset list)'\n    'keys:subcommand:(list create rotate revoke)'\n    'intents:subcommand:(list get create fund evidence settlement-confirm)'\n    'guardrails:subcommand:(bootstrap evidence)'\n    'spend:subcommand:(authorize)'\n    'signal:subcommand:(reputation portfolio fraud)'\n    'receipts:subcommand:(get verify)'\n    'mandates:subcommand:(verify import)'\n    'a2a:subcommand:(card contracts)'\n    'policy:subcommand:(init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence)'\n    'agent:subcommand:(run tool registry sandbox production)'\n    'audit:subcommand:(exports)'\n    'completion:subcommand:(bash zsh fish)'\n    'init completion preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'policy preview preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n    'guardrails bootstrap completion-preset:subcommand:(api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion)'\n      esac\n      ;;\n  esac\n}\n\ncompdef _paybond paybond\n",
+    "fish": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor dev version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a policy audit agent\n# init: guardrail completion agent-middleware\n# mcp: serve install verify-config tools\n# dev: smoke trace loop up\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# policy: init validate-tools templates preview import-mcp-receipt import-x402-receipt validate-evidence\n# agent: run tool registry sandbox production\n# audit: exports\n# completion: bash zsh fish\n# init completion preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# policy preview preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\n# guardrails bootstrap completion-preset: api_response_ok webhook_confirmed artifact_attested cost_and_completion sandbox_permissive stripe_charge vendor_webhook_confirmed stripe_webhook_payment ach_paid_api_ok ach_travel_booking ach_vendor_webhook x402_paid_api_ok x402_delivery_receipt x402_cost_and_completion\ncomplete -c paybond -f\ncomplete -c paybond -l gateway -d 'Gateway base URL'\ncomplete -c paybond -l env-file -d 'Local secrets file' -r\ncomplete -c paybond -l format -d 'Output format' -xa 'table json'\ncomplete -c paybond -l color -d 'Color mode' -xa 'auto always never'\ncomplete -c paybond -l no-color -d 'Disable color output'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'onboarding'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'help'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'examples'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'completion'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'login'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'init'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mcp'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'doctor'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'dev'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'version'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'diagnose'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'config'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'whoami'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'keys'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'intents'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'guardrails'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'spend'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'signal'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'receipts'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mandates'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'a2a'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'policy'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'audit'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'agent'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'guardrail'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'agent-middleware'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'serve'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'install'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'verify-config'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'smoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'trace'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'loop'\ncomplete -c paybond -n '__fish_seen_subcommand_from dev' -a 'up'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'set'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'unset'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'rotate'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'revoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'fund'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'settlement-confirm'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'bootstrap'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from spend' -a 'authorize'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'reputation'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'portfolio'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'fraud'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'import'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'card'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'contracts'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'init'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'templates'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'preview'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-mcp-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'import-x402-receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy' -a 'validate-evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'run'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'tool'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'registry'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'sandbox'\ncomplete -c paybond -n '__fish_seen_subcommand_from agent' -a 'production'\ncomplete -c paybond -n '__fish_seen_subcommand_from audit' -a 'exports'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'bash'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'zsh'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'fish'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from init completion preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from policy preview preset' -a 'x402_cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'api_response_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'artifact_attested'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'cost_and_completion'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'sandbox_permissive'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_charge'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'vendor_webhook_confirmed'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'stripe_webhook_payment'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_travel_booking'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'ach_vendor_webhook'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_paid_api_ok'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_delivery_receipt'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails bootstrap completion-preset' -a 'x402_cost_and_completion'\n"
 };

package/dist/cli/commands/agent.d.ts

@@ -8,6 +8,8 @@ export declare function handleAgentToolExecute(ctx: CliContext, argv: string[]):
 export declare function handleAgentToolValidate(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentRegistryValidate(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentSandboxSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentHarborEvidenceSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleAgentProductionAttachSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoVercelAiSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoLanggraphSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleAgentDemoGenericSmoke(ctx: CliContext, argv: string[]): Promise<CommandResult>;

package/dist/cli/commands/agent.js

@@ -2,14 +2,18 @@ import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 import { PaybondAgentRun } from "../../agent/run.js";
 import { PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/types.js";
+import { resolveCliGatewayErrorMessage } from "../http-error-message.js";
 import { runGenericSandboxDemo } from "../../agent/generic-sandbox-demo.js";
 import { loadRunClaudeAgentsSandboxDemo, loadRunLangGraphSandboxDemo, loadRunOpenAIAgentsSandboxDemo, loadRunVercelAiSandboxDemo, } from "../agent/demo-loaders.js";
 import { buildSmokeRegistry, loadAgentRegistryFile, validateAgentRegistryDocument, } from "../../agent/registry-file.js";
 import { createPaybondToolRegistry } from "../../agent/registry.js";
 import { devTraceStepsFromEvents, devTraceUrl, findDevTraceEventForRun, resolveDevTraceSink, recordSmokeTraceEvent, } from "../../dev/trace-buffer.js";
-import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, } from "../../index.js";
+import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, signHarborEvidenceSubmitRecognitionProof, signPayeeEvidenceBinding, } from "../../index.js";
 import { readJsonBody } from "../automation.js";
 import { formatAgentSandboxSmokeChecklist } from "../agent-sandbox-smoke-checklist.js";
+import { formatAgentProductionAttachSmokeChecklist } from "../agent-production-attach-smoke-checklist.js";
+import { formatAgentHarborEvidenceSmokeChecklist } from "../agent-harbor-evidence-smoke-checklist.js";
+import { PAYBOND_ATTACH_INTENT_ID_ENV, PAYBOND_CAPABILITY_TOKEN_ENV, } from "../../agent/attach-bundle.js";
 import { appendSmokeDeepLinkChecklistLines, buildAgentSandboxSmokeDeepLinks, } from "../smoke-deep-links.js";
 import { appendAgentRunEnvVars } from "../agent/env-write.js";
 import { productionEvidenceToPersisted, resolveProductionEvidenceForReattach, resolveProductionEvidenceFromCli, } from "../agent/production-evidence.js";
@@ -257,6 +261,7 @@ export async function handleAgentRunBind(ctx, argv) {
         let policySnapshot;
         let resolvedOperation = operationFlag.value?.trim() ?? "";
         let resolvedCompletionPreset = presetFlag.value?.trim();
+        let attachSmokeCompletionPreset;
         if (policyFlag.value) {
             try {
                 const resolved = await resolveAgentPolicyBind({
@@ -302,6 +307,13 @@ export async function handleAgentRunBind(ctx, argv) {
             registry = buildSmokeRegistry(operationFlag.value, preset);
             defaultDeny = true;
         }
+        else if (operationFlag.value?.trim() && !registryFlag.value) {
+            const preset = presetFlag.value?.trim() || "cost_and_completion";
+            registry = buildSmokeRegistry(operationFlag.value.trim(), preset);
+            defaultDeny = true;
+            resolvedOperation = operationFlag.value.trim();
+            attachSmokeCompletionPreset = preset;
+        }
         else {
             registry = createPaybondToolRegistry({ defaultDeny: false, sideEffecting: {} });
         }
@@ -400,7 +412,9 @@ export async function handleAgentRunBind(ctx, argv) {
             sandbox: Boolean(sandbox),
             sandbox_lifecycle_status: sandbox?.sandboxLifecycleStatus,
             requested_spend_cents: sandbox?.requestedSpendCents,
-            completion_preset: resolvedCompletionPreset || (!registryPath && !policyPath && !hasAttach ? "cost_and_completion" : undefined),
+            completion_preset: resolvedCompletionPreset ||
+                attachSmokeCompletionPreset ||
+                (!registryPath && !policyPath && !hasAttach ? "cost_and_completion" : undefined),
             registry_file: registryPath ?? policyPath,
             default_deny: defaultDeny,
             policy_digest: run.policyDigest,
@@ -412,7 +426,9 @@ export async function handleAgentRunBind(ctx, argv) {
             created_at: new Date().toISOString(),
         });
         registerGatewayAgentRun(session.paybond, run, {
-            completionPreset: resolvedCompletionPreset || (!registryPath && !policyPath && !hasAttach ? "cost_and_completion" : undefined),
+            completionPreset: resolvedCompletionPreset ||
+                attachSmokeCompletionPreset ||
+                (!registryPath && !policyPath && !hasAttach ? "cost_and_completion" : undefined),
         });
         if (writeEnvFlag.present) {
             const envFile = envOutFlag.value ?? ctx.globals.envFile;
@@ -813,6 +829,185 @@ export async function handleAgentSandboxSmoke(ctx, argv) {
         throw err;
     }
 }
+function nowRfc3339Seconds() {
+    return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+export async function handleAgentHarborEvidenceSmoke(ctx, argv) {
+    const intentFlag = consumeFlag(argv, "--intent-id");
+    const payeeDidFlag = consumeFlag(intentFlag.rest, "--payee-did");
+    const payeeSeedFlag = consumeFlag(payeeDidFlag.rest, "--payee-signing-seed-hex");
+    const recognitionKeyFlag = consumeFlag(payeeSeedFlag.rest, "--agent-recognition-key-id");
+    const recognitionSeedFlag = consumeFlag(recognitionKeyFlag.rest, "--agent-recognition-signing-seed-hex");
+    const idempotencyFlag = consumeFlag(recognitionSeedFlag.rest, "--idempotency-key");
+    const intentId = intentFlag.value?.trim() ||
+        process.env[PAYBOND_ATTACH_INTENT_ID_ENV]?.trim() ||
+        process.env.PAYBOND_HARBOR_EVIDENCE_INTENT_ID?.trim();
+    if (!intentId) {
+        throw agentCliError("agent harbor evidence smoke requires --intent-id (or PAYBOND_ATTACH_INTENT_ID / PAYBOND_HARBOR_EVIDENCE_INTENT_ID)", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const resultParsed = await parseInlineJson(idempotencyFlag.rest, "--result-body", "--result-file");
+    const payload = resultParsed.payload;
+    if (Object.keys(payload).length === 0) {
+        throw agentCliError("agent harbor evidence smoke requires --result-body or --result-file", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    return withPaybondAgentCli(ctx, true, async (session) => {
+        const productionEvidence = await resolveProductionEvidenceFromCli({
+            cwd: ctx.cwd,
+            envFile: ctx.globals.envFile,
+            payeeDid: payeeDidFlag.value,
+            payeeSigningSeedHex: payeeSeedFlag.value,
+            agentRecognitionKeyId: recognitionKeyFlag.value,
+            agentRecognitionSigningSeedHex: recognitionSeedFlag.value,
+        });
+        const tenantId = session.paybond.harbor.tenantId;
+        const submittedAtRfc3339 = nowRfc3339Seconds();
+        const wire = signPayeeEvidenceBinding({
+            tenantId,
+            intentId,
+            payeeDid: productionEvidence.payeeDid,
+            payload,
+            artifactsBlake3Hex: [],
+            submittedAtRfc3339,
+            payeeSigningSeed: productionEvidence.payeeSigningSeed,
+        });
+        const recognitionProof = signHarborEvidenceSubmitRecognitionProof({
+            tenantId,
+            intentId,
+            evidenceBody: wire,
+            keyId: productionEvidence.agentRecognitionKeyId,
+            signingSeed: productionEvidence.agentRecognitionSigningSeed,
+        });
+        const evidence = await session.paybond.harbor.submitEvidence(intentId, wire, {
+            idempotencyKey: idempotencyFlag.value?.trim(),
+            recognitionProof,
+        });
+        const evidenceRecord = evidence;
+        const checklistLines = formatAgentHarborEvidenceSmokeChecklist({
+            intentId,
+            evidence: evidenceRecord,
+            globals: ctx.globals,
+        });
+        return {
+            data: {
+                intent_id: intentId,
+                harbor_path: `/harbor/intents/${intentId}/evidence`,
+                evidence: evidenceRecord,
+                checklist_lines: checklistLines,
+            },
+            warnings: session.warnings,
+        };
+    });
+}
+export async function handleAgentProductionAttachSmoke(ctx, argv) {
+    const attachIntentFlag = consumeFlag(argv, "--attach-intent-id");
+    const capabilityFlag = consumeFlag(attachIntentFlag.rest, "--capability-token");
+    const operationFlag = consumeFlag(capabilityFlag.rest, "--operation");
+    const spendFlag = consumeFlag(operationFlag.rest, "--requested-spend-cents");
+    const policyFlag = consumeFlag(spendFlag.rest, "--policy-file");
+    const payeeDidFlag = consumeFlag(policyFlag.rest, "--payee-did");
+    const payeeSeedFlag = consumeFlag(payeeDidFlag.rest, "--payee-signing-seed-hex");
+    const recognitionKeyFlag = consumeFlag(payeeSeedFlag.rest, "--agent-recognition-key-id");
+    const recognitionSeedFlag = consumeFlag(recognitionKeyFlag.rest, "--agent-recognition-signing-seed-hex");
+    const attachIntentId = attachIntentFlag.value?.trim() ||
+        process.env[PAYBOND_ATTACH_INTENT_ID_ENV]?.trim();
+    const capabilityToken = capabilityFlag.value?.trim() ||
+        process.env[PAYBOND_CAPABILITY_TOKEN_ENV]?.trim();
+    if (!attachIntentId || !capabilityToken) {
+        throw agentCliError("agent production attach smoke requires --attach-intent-id and --capability-token (or PAYBOND_ATTACH_INTENT_ID and PAYBOND_CAPABILITY_TOKEN)", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const resolvedOperation = operationFlag.value?.trim();
+    if (!resolvedOperation) {
+        throw agentCliError("agent production attach smoke requires --operation", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const resultParsed = await parseInlineJson(recognitionSeedFlag.rest, "--result-body", "--result-file");
+    const resultBody = resultParsed.payload;
+    if (Object.keys(resultBody).length === 0) {
+        throw agentCliError("agent production attach smoke requires --result-body or --result-file", { code: "cli.usage.missing_args", category: "usage" });
+    }
+    const bindArgv = [
+        "--production",
+        "--attach-intent-id",
+        attachIntentId,
+        "--capability-token",
+        capabilityToken,
+        "--operation",
+        resolvedOperation,
+    ];
+    if (spendFlag.value?.trim()) {
+        bindArgv.push("--requested-spend-cents", spendFlag.value.trim());
+    }
+    if (policyFlag.value?.trim()) {
+        bindArgv.push("--policy-file", policyFlag.value.trim());
+    }
+    if (payeeDidFlag.value?.trim()) {
+        bindArgv.push("--payee-did", payeeDidFlag.value.trim());
+    }
+    if (payeeSeedFlag.value?.trim()) {
+        bindArgv.push("--payee-signing-seed-hex", payeeSeedFlag.value.trim());
+    }
+    if (recognitionKeyFlag.value?.trim()) {
+        bindArgv.push("--agent-recognition-key-id", recognitionKeyFlag.value.trim());
+    }
+    if (recognitionSeedFlag.value?.trim()) {
+        bindArgv.push("--agent-recognition-signing-seed-hex", recognitionSeedFlag.value.trim());
+    }
+    const bindResult = await handleAgentRunBind(ctx, bindArgv);
+    const runId = String(bindResult.data.run_id ?? "");
+    const storedForExecute = await loadAgentRunContext(ctx.cwd, runId);
+    const executeArgv = [
+        "--production",
+        "--run-id",
+        runId,
+        "--operation",
+        resolvedOperation,
+        "--tool-call-id",
+        "prod-attach-smoke-1",
+        "--result-body",
+        JSON.stringify(resultBody),
+    ];
+    if (storedForExecute.requested_spend_cents != null) {
+        executeArgv.push("--requested-spend-cents", String(storedForExecute.requested_spend_cents));
+    }
+    else if (spendFlag.value?.trim()) {
+        executeArgv.push("--requested-spend-cents", spendFlag.value.trim());
+    }
+    if (payeeSeedFlag.value?.trim()) {
+        executeArgv.push("--payee-signing-seed-hex", payeeSeedFlag.value.trim());
+    }
+    if (recognitionSeedFlag.value?.trim()) {
+        executeArgv.push("--agent-recognition-signing-seed-hex", recognitionSeedFlag.value.trim());
+    }
+    try {
+        const executeResult = await handleAgentToolExecute(ctx, executeArgv);
+        const checklistLines = formatAgentProductionAttachSmokeChecklist({
+            bind: bindResult.data,
+            execute: executeResult.data,
+            globals: ctx.globals,
+        });
+        return {
+            data: {
+                bind: bindResult.data,
+                execute: executeResult.data,
+                checklist_lines: checklistLines,
+            },
+            warnings: bindResult.warnings,
+        };
+    }
+    catch (err) {
+        if (err instanceof CliError) {
+            throw new CliError(err.message, {
+                category: err.category,
+                code: err.code,
+                exitCode: err.exitCode,
+                details: {
+                    ...(err.details ?? {}),
+                    bind: bindResult.data,
+                },
+            });
+        }
+        throw err;
+    }
+}
 export async function handleAgentDemoVercelAiSmoke(ctx, argv) {
     const productionFlag = consumeBooleanFlag(argv, "--production");
     const operationFlag = consumeFlag(productionFlag.rest, "--operation");
@@ -1044,7 +1239,7 @@ function mapToolExecuteError(err, partial) {
         });
     }
     if (err instanceof PaybondAutoEvidenceSubmitError) {
-        return agentCliError(err.message, {
+        return agentCliError(resolveCliGatewayErrorMessage(err), {
             code: "cli.agent.evidence_failed",
             exitCode: 5,
             category: "gateway",
@@ -1093,6 +1288,24 @@ export async function handleAgent(ctx, group, subcommand, argv) {
     if (group === "sandbox" && subcommand === "smoke") {
         return handleAgentSandboxSmoke(ctx, argv);
     }
+    if (group === "production" && subcommand === "attach") {
+        if (argv[0] !== "smoke") {
+            throw agentCliError("agent production attach requires smoke subcommand", {
+                code: "cli.usage.unknown_command",
+                category: "usage",
+            });
+        }
+        return handleAgentProductionAttachSmoke(ctx, argv.slice(1));
+    }
+    if (group === "harbor" && subcommand === "evidence") {
+        if (argv[0] !== "smoke") {
+            throw agentCliError("agent harbor evidence requires smoke subcommand", {
+                code: "cli.usage.unknown_command",
+                category: "usage",
+            });
+        }
+        return handleAgentHarborEvidenceSmoke(ctx, argv.slice(1));
+    }
     if (group === "demo" && subcommand === "vercel-ai") {
         if (argv[0] !== "smoke") {
             throw agentCliError("agent demo vercel-ai requires smoke subcommand", {

package/dist/cli/commands/setup.d.ts

@@ -6,7 +6,17 @@ export declare function handleInitWizard(ctx: CliContext, argv: string[]): Promi
 export declare function handleInitGuardrail(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleInitAgentMiddleware(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleInitCompletion(ctx: CliContext, argv: string[]): Promise<CommandResult>;
-export declare function handleMcpServe(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function mcpServeArgvMatches(argv: string[]): boolean;
+/** Run the blocking MCP stdio server. Must not run through the async CLI dispatcher. */
+export declare function runMcpServeCommandSync(argv: string[], writers: {
+    stdout: {
+        write(chunk: string): boolean;
+    };
+    stderr: {
+        write(chunk: string): boolean;
+    };
+}): number;
+export declare function handleMcpServe(_ctx: CliContext, _argv: string[]): Promise<CommandResult>;
 export declare function handleMcpTools(ctx: CliContext): Promise<CommandResult>;
 export declare function handleMcpInstall(ctx: CliContext, argv: string[]): Promise<CommandResult>;
 export declare function handleMcpVerifyConfig(ctx: CliContext, argv: string[]): Promise<CommandResult>;

package/dist/cli/commands/setup.js

@@ -7,7 +7,8 @@ import { assertApiKeyShape, resolveApiKey, resolvedDefaultsForDoctor } from "../
 import { runAgentMiddlewareDoctorCheck } from "../doctor-agent-middleware.js";
 import { packageVersion, runAgentMcpChecks } from "../doctor-agent.js";
 import { runCompletionCatalogDoctorChecks } from "../../doctor-completion.js";
-import { consumeBooleanFlag, consumeFlag } from "../globals.js";
+import { consumeBooleanFlag, consumeFlag, parseCliArgv } from "../globals.js";
+import { helpForCommand } from "../help.js";
 import { maskApiKey, redactConfigValue } from "../redact.js";
 import { mergeMcpToolPolicy, parseMcpToolAllowlist, parseMcpToolPolicy, resolveMcpToolPolicy, } from "../mcp-policy.js";
 import { parseMcpInstallFormat, parseMcpInstallHost, parseMcpInstallScope, planMcpInstall, } from "../mcp-install.js";
@@ -197,16 +198,48 @@ export async function handleInitCompletion(ctx, argv) {
         },
     };
 }
-export async function handleMcpServe(ctx, argv) {
-    if (argv.length > 0 && argv[0] !== "--help" && argv[0] !== "-h") {
-        throw new CliError(`unexpected arguments: ${argv.join(" ")}`, { category: "usage", code: "cli.usage.unexpected_args" });
+export function mcpServeArgvMatches(argv) {
+    try {
+        const { command } = parseCliArgv(argv);
+        return command.length >= 2 && command[0] === "mcp" && command[1] === "serve";
     }
-    ctx.stderr.write("Starting Paybond MCP stdio server (stdout is reserved for MCP JSON-RPC).\n");
-    const code = runMcpServerMain([]);
-    if (code !== 0) {
-        throw new CliError("mcp serve failed", { category: "internal", code: "cli.mcp.serve_failed", exitCode: code });
+    catch {
+        return false;
+    }
+}
+function isMcpServeHelpCommand(command) {
+    return command.length === 0 || command.includes("--help") || command.includes("-h");
+}
+/** Run the blocking MCP stdio server. Must not run through the async CLI dispatcher. */
+export function runMcpServeCommandSync(argv, writers) {
+    let command;
+    try {
+        ({ command } = parseCliArgv(argv));
     }
-    return { data: { started: true } };
+    catch (err) {
+        const message = err instanceof CliError ? err.message : String(err);
+        writers.stderr.write(`${message}\n`);
+        return err instanceof CliError ? err.exitCode : 1;
+    }
+    if (isMcpServeHelpCommand(command)) {
+        const helpPath = command.filter((part) => part !== "--help" && part !== "-h").join(" ") || "mcp serve";
+        writers.stdout.write(`${helpForCommand(helpPath)}\n`);
+        return 0;
+    }
+    const rest = command.slice(2);
+    if (rest.length > 0 && rest[0] !== "--help" && rest[0] !== "-h") {
+        writers.stderr.write(`unexpected arguments: ${rest.join(" ")}\n`);
+        return 2;
+    }
+    writers.stderr.write("Starting Paybond MCP stdio server (stdout is reserved for MCP JSON-RPC).\n");
+    const code = runMcpServerMain([]);
+    return code;
+}
+export async function handleMcpServe(_ctx, _argv) {
+    throw new CliError("mcp serve must run via the sync CLI entrypoint (not the async dispatcher)", {
+        category: "internal",
+        code: "cli.mcp.serve_async_forbidden",
+    });
 }
 export async function handleMcpTools(ctx) {
     const server = new PaybondMCPServer({ gatewayBaseUrl: ctx.globals.gateway, apiKey: "paybond_sk_sandbox_redacted_redacted_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" });

package/dist/cli/help.js

@@ -68,6 +68,8 @@ export const COMMAND_HELP = {
     "agent tool validate": "Usage: paybond agent tool validate --run-id <id> --operation <name> [--requested-spend-cents <n>] [--arguments <json>]\n\nAuthorize-only dry run (no execute, no evidence). Useful for agents checking budget before side effects.\n\nExamples:\n  $ paybond agent tool validate --run-id run-123 --operation travel.book_hotel --requested-spend-cents 18700 --format json\n\nDocs: https://docs.paybond.ai/kit/agent-middleware",
     "agent registry validate": "Usage: paybond agent registry validate --file <path>\n\nValidate a registry YAML/JSON file before bind (evidence_preset required on side-effecting tools).\n\nExamples:\n  $ paybond agent registry validate --file ./paybond.agent.registry.yaml --format json\n\nDocs: https://docs.paybond.ai/kit/agent-middleware",
     "agent sandbox smoke": "Usage: paybond agent sandbox smoke [--production] [--preset <id> | --policy-file <path> [--operation <name>] [--requested-spend-cents <n>]] | (--operation <name> --requested-spend-cents <n> --evidence-preset <id>) --result-body <json>|--result-file <path>\n\nOne-shot end-to-end sandbox lifecycle: bind, tool execute, combined result. With --policy-file, completion_preset is derived from each tool's evidence_preset in YAML — do not pass --evidence-preset (Gateway rejects conflicting bootstrap fields).\n\nExamples:\n  $ paybond agent sandbox smoke --preset travel --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n  $ paybond agent sandbox smoke --policy-file paybond.policy.yaml --result-body '{\"status\":\"completed\",\"cost_cents\":18700}' --format json\n  $ paybond agent sandbox smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n\nDocs: https://docs.paybond.ai/kit/quickstart-agent",
+    "agent production attach smoke": "Usage: paybond agent production attach smoke --attach-intent-id <id> --capability-token <token> --operation <name> [--requested-spend-cents <n>] [--policy-file <path>] [--payee-did <did> --payee-signing-seed-hex <hex> --agent-recognition-key-id <id> --agent-recognition-signing-seed-hex <hex>] --result-body <json>|--result-file <path>\n\nOne-shot production attach lifecycle against live /harbor/* with agent recognition proofs: bind an existing funded intent, execute a guarded tool, and submit Kit-signed payee evidence. Requires production credentials (flags or PAYBOND_ATTACH_INTENT_ID, PAYBOND_CAPABILITY_TOKEN, APP_PAYEE_*, APP_AGENT_RECOGNITION_*). Not a substitute for sandbox smoke — run in staging before production attach rollouts.\n\nExamples:\n  $ paybond agent production attach smoke --attach-intent-id <intent-id> --capability-token <token> --operation paid-tool --requested-spend-cents 100 --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n\nDocs: https://docs.paybond.ai/kit/production-attach",
+    "agent harbor evidence smoke": "Usage: paybond agent harbor evidence smoke --intent-id <id> [--payee-did <did> --payee-signing-seed-hex <hex> --agent-recognition-key-id <id> --agent-recognition-signing-seed-hex <hex>] [--idempotency-key <key>] --result-body <json>|--result-file <path>\n\nSingle POST /harbor/intents/{id}/evidence with Kit-signed payee evidence and agent recognition proof. Use in staging with Harbor SEC-003 enforcement on to confirm gateway proxy + Harbor nonce semantics (no double-claim replay). Requires a funded intent not yet in evidence_submitted state.\n\nExamples:\n  $ paybond agent harbor evidence smoke --intent-id <intent-id> --result-body '{\"status\":\"ok\",\"cost_cents\":100}' --format json\n\nDocs: https://docs.paybond.ai/kit/production-attach",
     "agent demo vercel-ai smoke": "Usage: paybond agent demo vercel-ai smoke [--production] --operation <name> --requested-spend-cents <n> --evidence-preset <id>\n\nBundled no-LLM Vercel AI SDK sandbox demo: toolApproval, wrapped execute, and auto-evidence via MockLanguageModelV4.\n\nExamples:\n  $ paybond agent demo vercel-ai smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json\n\nDocs: https://docs.paybond.ai/kit/vercel-ai",
     "agent demo langgraph smoke": "Usage: paybond agent demo langgraph smoke [--production] [--runtime typescript|python] --operation <name> --requested-spend-cents <n> --evidence-preset <id>\n\nBundled no-LLM LangGraph sandbox demo: ToolNode interceptor, authorize, execute, and auto-evidence.\n\nExamples:\n  $ paybond agent demo langgraph smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json\n\nDocs: https://docs.paybond.ai/kit/langgraph",
     "agent demo generic smoke": "Usage: paybond agent demo generic smoke [--production] [--runtime typescript|python] --operation <name> --requested-spend-cents <n> --evidence-preset <id>\n\nBundled no-LLM agent-agnostic sandbox demo: createPaybondGenericAgentConfig, wrapped execute, and auto-evidence.\n\nExamples:\n  $ paybond agent demo generic smoke --operation paid-tool --requested-spend-cents 100 --evidence-preset cost_and_completion --format json\n\nDocs: https://docs.paybond.ai/kit/agent-agnostic",