@paybond/kit 0.2.1 → 0.4.0

package/dist/index.js

@@ -2,7 +2,7 @@
  * Paybond Kit — TypeScript Harbor client with tenant binding, retries, optional upstream JWT,
  * and gateway service-account token exchange (`POST /v1/auth/harbor-access`).
  */
-import { buildSignedCreateIntentBody } from "./principal-intent.js";
+import { buildSignedCreateIntentBody, } from "./principal-intent.js";
 import { signPayeeEvidenceBinding } from "./payee-evidence.js";
 /**
  * Structured HTTP failure from Harbor with operator-facing diagnostics.
@@ -47,6 +47,60 @@ export class SignalHttpError extends Error {
         this.bodyText = init.bodyText;
     }
 }
+const agentRecognitionProofHeader = "x-paybond-agent-recognition-proof";
+export class A2AHttpError extends Error {
+    statusCode;
+    url;
+    bodyText;
+    constructor(message, init) {
+        super(message);
+        this.name = "A2AHttpError";
+        this.statusCode = init.statusCode;
+        this.url = init.url;
+        this.bodyText = init.bodyText;
+    }
+}
+export class ProtocolHttpError extends Error {
+    statusCode;
+    url;
+    bodyText;
+    errorCode;
+    errorMessage;
+    constructor(message, init) {
+        super(message);
+        this.name = "ProtocolHttpError";
+        this.statusCode = init.statusCode;
+        this.url = init.url;
+        this.bodyText = init.bodyText;
+        const parsed = parseGatewayErrorEnvelope(init.bodyText);
+        this.errorCode = init.errorCode ?? parsed.errorCode;
+        this.errorMessage = init.errorMessage ?? parsed.errorMessage;
+    }
+}
+function parseGatewayErrorEnvelope(text) {
+    if (!text.trim().startsWith("{")) {
+        return {};
+    }
+    try {
+        const body = JSON.parse(text);
+        if (body === null || Array.isArray(body) || typeof body !== "object") {
+            return {};
+        }
+        const errorCode = typeof body.error === "string" && body.error.trim() ? body.error.trim() : undefined;
+        const errorMessage = typeof body.message === "string" && body.message.trim() ? body.message.trim() : undefined;
+        return { errorCode, errorMessage };
+    }
+    catch {
+        return {};
+    }
+}
+function protocolHTTPErrorMessage(prefix, statusCode, bodyText) {
+    const parsed = parseGatewayErrorEnvelope(bodyText);
+    if (parsed.errorCode) {
+        return `${prefix} HTTP ${statusCode} (${parsed.errorCode}): ${parsed.errorMessage ?? bodyText}`;
+    }
+    return `${prefix} HTTP ${statusCode}: ${bodyText}`;
+}
 function normalizeBase(url) {
     return url.trim().replace(/\/+$/, "");
 }
@@ -292,7 +346,7 @@ export class HarborClient {
         }
         throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
     }
-    async fetchWithRetries(url, init, { retryBody }) {
+    async fetchWithRetries(url, init, { retryBody, retryBodyText, }) {
         let lastErr;
         for (let attempt = 0; attempt < this.maxRetries; attempt++) {
             let res;
@@ -318,10 +372,18 @@ export class HarborClient {
                 const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
                 const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
                 await new Promise((r) => setTimeout(r, delayMs));
-                init = {
-                    ...init,
-                    body: JSON.stringify(retryBody),
-                };
+                if (retryBodyText !== undefined) {
+                    init = {
+                        ...init,
+                        body: retryBodyText,
+                    };
+                }
+                else if (retryBody !== undefined) {
+                    init = {
+                        ...init,
+                        body: JSON.stringify(retryBody),
+                    };
+                }
                 continue;
             }
             return res;
@@ -403,6 +465,79 @@ export class HarborClient {
         }
         return JSON.parse(text);
     }
+    /**
+     * POST `/intents/{intentId}/fund` for x402 / USDC-on-Base funding.
+     *
+     * Harbor returns:
+     * - `402` with `paymentRequired` details when a facilitator or wallet must sign
+     * - `202` while authorization is pending
+     * - `200` once the intent is funded and any capability token is available
+     *
+     * @throws HarborHttpError for non-funding HTTP errors
+     * @throws Error when Harbor echoes a different tenant or intent than requested
+     */
+    async fundIntent(intentId, options) {
+        const url = `${this.base}intents/${intentId}/fund`;
+        const headers = {
+            "x-tenant-id": this.tenantId,
+        };
+        if (options?.idempotencyKey?.trim()) {
+            headers["idempotency-key"] = options.idempotencyKey.trim();
+        }
+        if (options?.paymentSignature?.trim()) {
+            headers["payment-signature"] = options.paymentSignature.trim();
+        }
+        const res = await this.fetchWithRetries(url, {
+            method: "POST",
+            headers,
+            body: "",
+        }, { retryBodyText: "" });
+        const text = await res.text();
+        if (![200, 202, 402].includes(res.status)) {
+            throw new HarborHttpError(`Harbor fund intent HTTP ${res.status}: ${text}`, {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+            });
+        }
+        const body = assertJSONObject(JSON.parse(text));
+        const tenant = String(body.tenant ?? "");
+        if (tenant !== this.tenantId) {
+            throw new Error(`fund tenant mismatch: client=${this.tenantId} harbor=${tenant}`);
+        }
+        const echoedIntentId = String(body.intent_id ?? "");
+        if (echoedIntentId !== intentId) {
+            throw new Error(`fund intent mismatch: requested=${intentId} harbor=${echoedIntentId}`);
+        }
+        if (typeof body.state !== "string" || !body.state.trim()) {
+            throw new Error("fund response missing state");
+        }
+        if (typeof body.currency !== "string" || !body.currency.trim()) {
+            throw new Error("fund response missing currency");
+        }
+        const amountCents = Number(body.amount_cents);
+        if (!Number.isFinite(amountCents)) {
+            throw new Error("fund response missing amount_cents");
+        }
+        return {
+            statusCode: res.status,
+            paymentRequired: res.headers.get("payment-required") ?? undefined,
+            paymentResponse: res.headers.get("payment-response") ?? undefined,
+            intentId: echoedIntentId,
+            tenant,
+            state: body.state,
+            settlementRail: readSettlementRailValue(body.settlement_rail, "fund settlement_rail"),
+            currency: body.currency,
+            amountCents,
+            funded: Boolean(body.funded),
+            capabilityToken: typeof body.capability_token === "string" && body.capability_token.trim()
+                ? body.capability_token
+                : undefined,
+            funding: body.funding === undefined || body.funding === null
+                ? undefined
+                : parseIntentFundingResult(body.funding),
+        };
+    }
     /**
      * POST `/intents/{intentId}/evidence` with a signed evidence JSON body.
      *
@@ -523,12 +658,71 @@ export class HarborClient {
     }
 }
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
+const SETTLEMENT_RAIL_VALUES = new Set(["stripe_connect", "x402_usdc_base"]);
 function assertJSONObject(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value)) {
         throw new Error("expected JSON object");
     }
     return value;
 }
+function readSettlementRailValue(value, field) {
+    if (typeof value !== "string" || !SETTLEMENT_RAIL_VALUES.has(value)) {
+        throw new Error(`invalid ${field}`);
+    }
+    return value;
+}
+function readStringArrayValue(value, field) {
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) {
+        throw new Error(`invalid ${field}`);
+    }
+    return [...value];
+}
+function parseIntentFundingResult(value) {
+    const body = assertJSONObject(value);
+    const onchainRaw = body.onchain_transaction_hashes;
+    const onchain = onchainRaw === undefined || onchainRaw === null
+        ? undefined
+        : (() => {
+            const parsed = assertJSONObject(onchainRaw);
+            return {
+                authorizations: parsed.authorizations === undefined
+                    ? undefined
+                    : readStringArrayValue(parsed.authorizations, "funding.onchain_transaction_hashes.authorizations"),
+                captures: parsed.captures === undefined
+                    ? undefined
+                    : readStringArrayValue(parsed.captures, "funding.onchain_transaction_hashes.captures"),
+                voids: parsed.voids === undefined
+                    ? undefined
+                    : readStringArrayValue(parsed.voids, "funding.onchain_transaction_hashes.voids"),
+                refunds: parsed.refunds === undefined
+                    ? undefined
+                    : readStringArrayValue(parsed.refunds, "funding.onchain_transaction_hashes.refunds"),
+            };
+        })();
+    const readOptionalString = (field) => {
+        const raw = body[field];
+        return typeof raw === "string" && raw.trim() ? raw : undefined;
+    };
+    return {
+        settlementRail: readSettlementRailValue(body.settlement_rail, "funding.settlement_rail"),
+        harborFundEndpoint: readOptionalString("harbor_fund_endpoint"),
+        status: readOptionalString("status"),
+        paymentSessionId: readOptionalString("payment_session_id"),
+        paymentUrl: readOptionalString("payment_url"),
+        asset: readOptionalString("asset"),
+        network: readOptionalString("network"),
+        authorizationId: readOptionalString("authorization_id"),
+        captureId: readOptionalString("capture_id"),
+        voidId: readOptionalString("void_id"),
+        refundId: readOptionalString("refund_id"),
+        sourceAddress: readOptionalString("source_address"),
+        targetAddress: readOptionalString("target_address"),
+        authorizationExpiresAt: readOptionalString("authorization_expires_at"),
+        captureExpiresAt: readOptionalString("capture_expires_at"),
+        refundExpiresAt: readOptionalString("refund_expires_at"),
+        onchainTransactionHashes: onchain,
+    };
+}
 /**
  * Tenant-bound reader for gateway Signal routes.
  */
@@ -630,6 +824,21 @@ export class GatewaySignalClient {
         this.assertTenant(body, url);
         return body;
     }
+    async getSignedPortfolioArtifact(scoreVersion) {
+        const url = `${this.base}signal/v1/portfolio/signed-export${this.scoreQuery(scoreVersion)}`;
+        const res = await this.fetchGetWithRetries(url);
+        const text = await res.text();
+        if (!res.ok) {
+            throw new SignalHttpError(`Signal signed portfolio artifact HTTP ${res.status}: ${text}`, {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+            });
+        }
+        const body = assertJSONObject(JSON.parse(text));
+        this.assertTenant(body, url);
+        return body;
+    }
     async getOperatorExplanation(operatorDid, scoreVersion) {
         const enc = encodeURIComponent(operatorDid);
         const url = `${this.base}signal/v1/operators/${enc}/explanation${this.scoreQuery(scoreVersion)}`;
@@ -675,6 +884,273 @@ export class GatewaySignalClient {
         return body;
     }
 }
+/**
+ * Public or optionally authenticated reader for the gateway's A2A discovery surface.
+ */
+export class GatewayA2AClient {
+    base;
+    bearerToken;
+    maxRetries;
+    constructor(gatewayBaseUrl, options) {
+        this.base = normalizeBase(gatewayBaseUrl) + "/";
+        this.bearerToken = options?.staticGatewayBearerToken?.trim() || undefined;
+        this.maxRetries = Math.max(1, options?.maxRetries ?? 3);
+    }
+    async fetchGetWithRetries(url) {
+        let lastErr;
+        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+            let res;
+            try {
+                const headers = new Headers({
+                    accept: "application/json",
+                });
+                if (this.bearerToken) {
+                    headers.set("authorization", `Bearer ${this.bearerToken}`);
+                }
+                res = await fetch(url, {
+                    method: "GET",
+                    headers,
+                });
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt + 1 >= this.maxRetries)
+                    throw e;
+                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                continue;
+            }
+            if ([429, 500, 502, 503, 504].includes(res.status)) {
+                if (attempt + 1 >= this.maxRetries) {
+                    return res;
+                }
+                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
+                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
+                await new Promise((r) => setTimeout(r, delayMs));
+                continue;
+            }
+            return res;
+        }
+        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+    }
+    async getAgentCard() {
+        const url = `${this.base}.well-known/agent-card.json`;
+        const res = await this.fetchGetWithRetries(url);
+        const text = await res.text();
+        if (!res.ok) {
+            throw new A2AHttpError(`A2A agent card HTTP ${res.status}: ${text}`, {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+            });
+        }
+        return assertJSONObject(JSON.parse(text));
+    }
+    async getTaskContracts() {
+        const url = `${this.base}protocol/v2/a2a/task-contracts`;
+        const res = await this.fetchGetWithRetries(url);
+        const text = await res.text();
+        if (!res.ok) {
+            throw new A2AHttpError(`A2A task contracts HTTP ${res.status}: ${text}`, {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+            });
+        }
+        return assertJSONObject(JSON.parse(text));
+    }
+    async getTaskContract(contractId) {
+        const enc = encodeURIComponent(contractId);
+        const url = `${this.base}protocol/v2/a2a/task-contracts/${enc}`;
+        const res = await this.fetchGetWithRetries(url);
+        const text = await res.text();
+        if (!res.ok) {
+            throw new A2AHttpError(`A2A task contract HTTP ${res.status}: ${text}`, {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+            });
+        }
+        return assertJSONObject(JSON.parse(text));
+    }
+}
+export class GatewayProtocolClient {
+    tenantId;
+    base;
+    staticGatewayBearerToken;
+    maxRetries;
+    constructor(gatewayBaseUrl, tenantId, init) {
+        this.base = `${normalizeBase(gatewayBaseUrl)}/`;
+        this.tenantId = tenantId.trim();
+        this.staticGatewayBearerToken = init?.staticGatewayBearerToken?.trim() || null;
+        this.maxRetries = Math.max(1, init?.maxRetries ?? 3);
+    }
+    async fetchWithRetries(url, init) {
+        let lastErr;
+        for (let attempt = 0; attempt < this.maxRetries; attempt++) {
+            let res;
+            try {
+                res = await fetch(url, init);
+            }
+            catch (e) {
+                lastErr = e;
+                if (attempt + 1 >= this.maxRetries) {
+                    throw e;
+                }
+                await new Promise((r) => setTimeout(r, backoffMs(attempt)));
+                continue;
+            }
+            if ([429, 500, 502, 503, 504].includes(res.status) && attempt + 1 < this.maxRetries) {
+                const raSec = parseRetryAfterSeconds(res.headers.get("retry-after"));
+                const delayMs = raSec != null ? raSec * 1000 : backoffMs(attempt);
+                await new Promise((r) => setTimeout(r, delayMs));
+                continue;
+            }
+            return res;
+        }
+        throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+    }
+    headers(extra) {
+        const headers = new Headers(extra);
+        headers.set("accept", "application/json");
+        headers.set("x-tenant-id", this.tenantId);
+        if (this.staticGatewayBearerToken) {
+            headers.set("authorization", `Bearer ${this.staticGatewayBearerToken}`);
+        }
+        return headers;
+    }
+    async postJSON(path, payload, extraHeaders) {
+        const url = `${this.base}${path.replace(/^\/+/, "")}`;
+        const res = await this.fetchWithRetries(url, {
+            method: "POST",
+            headers: this.headers({
+                "content-type": "application/json",
+                ...(extraHeaders ?? {}),
+            }),
+            body: JSON.stringify(payload),
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            const parsed = parseGatewayErrorEnvelope(text);
+            throw new ProtocolHttpError(protocolHTTPErrorMessage(`gateway POST ${path}`, res.status, text), {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+                errorCode: parsed.errorCode,
+                errorMessage: parsed.errorMessage,
+            });
+        }
+        return assertJSONObject(JSON.parse(text));
+    }
+    async importAgentMandateV1(init) {
+        const url = `${this.base}protocol/v2/mandates`;
+        const res = await this.fetchWithRetries(url, {
+            method: "POST",
+            headers: this.headers({ "content-type": "application/json" }),
+            body: JSON.stringify({
+                signed_mandate: init.signedMandate,
+                intent_id: init.intentId,
+                transport_binding: init.transportBinding ?? {},
+                recognition_proof: init.recognitionProof,
+            }),
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            const parsed = parseGatewayErrorEnvelope(text);
+            throw new ProtocolHttpError(protocolHTTPErrorMessage("protocol mandate import", res.status, text), {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+                errorCode: parsed.errorCode,
+                errorMessage: parsed.errorMessage,
+            });
+        }
+        const body = assertJSONObject(JSON.parse(text));
+        if (String(body.intent_id ?? "").trim() !== init.intentId) {
+            throw new Error(`protocol intent mismatch: requested=${init.intentId} gateway=${String(body.intent_id ?? "")}`);
+        }
+        if (String(body.mandate?.authorization?.tenant_id ?? "").trim() !== this.tenantId) {
+            throw new Error(`protocol mandate tenant mismatch: client=${this.tenantId} gateway=${String(body.mandate?.authorization?.tenant_id ?? "")}`);
+        }
+        return body;
+    }
+    async getSettlementReceiptV1(receiptId) {
+        const enc = encodeURIComponent(receiptId);
+        const url = `${this.base}protocol/v2/receipts/${enc}`;
+        const res = await this.fetchWithRetries(url, {
+            method: "GET",
+            headers: this.headers(),
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            const parsed = parseGatewayErrorEnvelope(text);
+            throw new ProtocolHttpError(protocolHTTPErrorMessage("protocol settlement receipt", res.status, text), {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+                errorCode: parsed.errorCode,
+                errorMessage: parsed.errorMessage,
+            });
+        }
+        const body = assertJSONObject(JSON.parse(text));
+        if (String(body.receipt_id ?? "").trim() !== receiptId) {
+            throw new Error(`protocol receipt mismatch: requested=${receiptId} gateway=${String(body.receipt_id ?? "")}`);
+        }
+        if (String(body.tenant_id ?? "").trim() !== this.tenantId) {
+            throw new Error(`protocol receipt tenant mismatch: client=${this.tenantId} gateway=${String(body.tenant_id ?? "")}`);
+        }
+        return body;
+    }
+    async verifyProtocolReceiptV1(receipt) {
+        const url = `${this.base}protocol/v2/receipts/verify`;
+        const res = await this.fetchWithRetries(url, {
+            method: "POST",
+            headers: this.headers({ "content-type": "application/json" }),
+            body: JSON.stringify(receipt),
+        });
+        const text = await res.text();
+        if (!res.ok) {
+            const parsed = parseGatewayErrorEnvelope(text);
+            throw new ProtocolHttpError(protocolHTTPErrorMessage("protocol receipt verify", res.status, text), {
+                statusCode: res.status,
+                url,
+                bodyText: text,
+                errorCode: parsed.errorCode,
+                errorMessage: parsed.errorMessage,
+            });
+        }
+        return assertJSONObject(JSON.parse(text));
+    }
+    async createHarborIntent(init) {
+        return this.postJSON("/harbor/intents", init.body, gatewayMutationHeaders(init.recognitionProof, {
+            ...(init.idempotencyKey?.trim() ? { "idempotency-key": init.idempotencyKey.trim() } : {}),
+        }));
+    }
+    async fundHarborIntent(init) {
+        return this.postJSON(`/harbor/intents/${encodeURIComponent(init.intentId)}/fund`, {}, gatewayMutationHeaders(init.recognitionProof, {
+            ...(init.paymentSignature?.trim() ? { "payment-signature": init.paymentSignature.trim() } : {}),
+            ...(init.idempotencyKey?.trim() ? { "idempotency-key": init.idempotencyKey.trim() } : {}),
+        }));
+    }
+    async submitHarborEvidence(init) {
+        return this.postJSON(`/harbor/intents/${encodeURIComponent(init.intentId)}/evidence`, init.body, gatewayMutationHeaders(init.recognitionProof, {
+            ...(init.idempotencyKey?.trim() ? { "idempotency-key": init.idempotencyKey.trim() } : {}),
+        }));
+    }
+    async confirmHarborSettlement(init) {
+        return this.postJSON(`/harbor/intents/${encodeURIComponent(init.intentId)}/settlement/confirm`, init.body, gatewayMutationHeaders(init.recognitionProof, {
+            ...(init.idempotencyKey?.trim() ? { "idempotency-key": init.idempotencyKey.trim() } : {}),
+        }));
+    }
+}
+function gatewayMutationHeaders(recognitionProof, headers) {
+    return {
+        ...(headers ?? {}),
+        [agentRecognitionProofHeader]: encodeRecognitionProofHeader(recognitionProof),
+    };
+}
+function encodeRecognitionProofHeader(proof) {
+    return Buffer.from(JSON.stringify(proof), "utf8").toString("base64url");
+}
 async function resolveGatewayTenantId(gatewayBaseUrl, apiKey, principalPath, maxRetries) {
     const base = normalizeBase(gatewayBaseUrl);
     const path = principalPath.startsWith("/") ? principalPath : `/${principalPath}`;
@@ -743,7 +1219,7 @@ export class ServiceAccountSignalSession {
     }
 }
 /**
- * Ergonomic intent helpers: principal-signed intent create and payee-signed evidence.
+ * Ergonomic intent helpers: principal-signed intent create, x402 funding, and payee-signed evidence.
  */
 export class PaybondIntents {
     harbor;
@@ -751,7 +1227,8 @@ export class PaybondIntents {
         this.harbor = harbor;
     }
     /**
-     * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be 32 bytes.
+     * Build a principal-signed `POST /intents` body and submit it. `principalSigningSeed` must be
+     * 32 bytes. `settlementRail` only requests an allowed rail; destinations stay server-owned.
      */
     async create(params) {
         const { idempotencyKey, intentId: maybeIntentId, ...fields } = params;
@@ -763,6 +1240,15 @@ export class PaybondIntents {
         });
         return this.harbor.createIntent(body, { idempotencyKey });
     }
+    /**
+     * Advance Harbor `/intents/{id}/fund` for x402 / USDC-on-Base intents.
+     */
+    async fund(params) {
+        return this.harbor.fundIntent(params.intentId, {
+            paymentSignature: params.paymentSignature,
+            idempotencyKey: params.idempotencyKey,
+        });
+    }
     /**
      * Sign payee evidence and POST it. `payeeSigningSeed` must be 32 bytes.
      */
@@ -781,12 +1267,16 @@ export class PaybondIntents {
 export class Paybond {
     harbor;
     signal;
+    a2a;
+    protocol;
     intents;
     session;
-    constructor(session, signal) {
+    constructor(session, signal, a2a, protocol) {
         this.session = session;
         this.harbor = session.harbor;
         this.signal = signal;
+        this.a2a = a2a;
+        this.protocol = protocol;
         this.intents = new PaybondIntents(session.harbor);
     }
     /** Open a tenant-bound session via gateway `harbor-access` exchange. */
@@ -796,7 +1286,15 @@ export class Paybond {
             staticGatewayBearerToken: init.apiKey,
             maxRetries: init.maxRetries ?? 3,
         });
-        return new Paybond(session, signal);
+        const a2a = new GatewayA2AClient(init.gatewayBaseUrl, {
+            staticGatewayBearerToken: init.apiKey,
+            maxRetries: init.maxRetries ?? 3,
+        });
+        const protocol = new GatewayProtocolClient(init.gatewayBaseUrl, session.harbor.tenantId, {
+            staticGatewayBearerToken: init.apiKey,
+            maxRetries: init.maxRetries ?? 3,
+        });
+        return new Paybond(session, signal, a2a, protocol);
     }
     async rotateHarborToken() {
         await this.session.rotateHarborToken();

package/dist/mcp-server.d.ts

@@ -0,0 +1,50 @@
+#!/usr/bin/env node
+type JSONRPCID = string | number | null;
+type JSONRPCRequest = {
+    jsonrpc?: unknown;
+    id?: JSONRPCID;
+    method?: unknown;
+    params?: unknown;
+};
+type JSONRPCResponse = {
+    jsonrpc: "2.0";
+    id: JSONRPCID;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+};
+type MCPCallToolResult = {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    structuredContent?: Record<string, unknown>;
+    isError?: boolean;
+};
+export type PaybondMCPSettings = {
+    gatewayBaseUrl: string;
+    apiKey: string;
+    harborBaseUrl?: string;
+    harborAccessPath?: string;
+    principalPath?: string;
+    maxRetries?: number;
+    clockSkewSeconds?: number;
+};
+export declare class PaybondMCPServer {
+    private readonly runtime;
+    private readonly tools;
+    private initialized;
+    constructor(settings: PaybondMCPSettings);
+    listTools(): Array<Record<string, unknown>>;
+    callTool(name: string, args?: Record<string, unknown>): Promise<MCPCallToolResult>;
+    handleMessage(message: JSONRPCRequest): Promise<JSONRPCResponse | null>;
+    runStdio(): void;
+    private handleLine;
+    private writeResponse;
+    private buildTools;
+}
+export declare function settingsFromEnv(env?: Record<string, string | undefined>): PaybondMCPSettings;
+export declare function main(argv?: string[]): number;
+export {};