@paybond/kit 0.9.8 → 0.10.0

package/dist/cli/command-spec.js

@@ -0,0 +1,330 @@
+// Generated by kit/cli-parity/generate.mjs — do not edit by hand.
+export const COMMAND_PATHS = [
+    "onboarding",
+    "help",
+    "examples",
+    "completion",
+    "login",
+    "init guardrail",
+    "mcp serve",
+    "mcp install",
+    "mcp verify-config",
+    "mcp tools",
+    "doctor",
+    "version",
+    "diagnose",
+    "config get",
+    "config set",
+    "config unset",
+    "config list",
+    "whoami",
+    "keys list",
+    "keys create",
+    "keys rotate",
+    "keys revoke",
+    "intents list",
+    "intents get",
+    "intents create",
+    "intents fund",
+    "intents evidence",
+    "intents settlement-confirm",
+    "guardrails bootstrap",
+    "guardrails evidence",
+    "spend authorize",
+    "signal reputation",
+    "signal portfolio",
+    "signal fraud",
+    "receipts get",
+    "receipts verify",
+    "mandates verify",
+    "mandates import",
+    "a2a card",
+    "a2a contracts",
+    "audit exports list",
+    "audit exports get",
+    "audit exports verify",
+    "audit exports delete"
+];
+export const GLOBAL_FLAG_NAMES = [
+    "--gateway",
+    "--env-file",
+    "--format",
+    "--json",
+    "--jq",
+    "--profile",
+    "--request-id",
+    "--yes",
+    "--no-open",
+    "--color",
+    "--no-color"
+];
+export const COMMAND_EXAMPLES = {
+    "onboarding": [
+        "paybond onboarding",
+        "paybond onboarding --host claude --format json"
+    ],
+    "help": [
+        "paybond help",
+        "paybond help login",
+        "paybond help mcp install"
+    ],
+    "examples": [
+        "paybond examples",
+        "paybond examples doctor"
+    ],
+    "completion": [
+        "paybond completion bash >> ~/.bashrc",
+        "paybond completion zsh >> ~/.zshrc",
+        "paybond completion fish | source"
+    ],
+    "login": [
+        "paybond login",
+        "paybond login --no-open --format json"
+    ],
+    "init guardrail": [
+        "paybond init guardrail",
+        "paybond init guardrail --framework openai --out guard.ts"
+    ],
+    "mcp serve": [
+        "paybond mcp serve"
+    ],
+    "mcp install": [
+        "paybond mcp install --host claude",
+        "paybond mcp install --host generic --scope project --tool-policy readonly"
+    ],
+    "mcp verify-config": [
+        "paybond mcp verify-config --host claude",
+        "paybond mcp verify-config --host generic --config .paybond/mcp.json"
+    ],
+    "mcp tools": [
+        "paybond mcp tools"
+    ],
+    "doctor": [
+        "paybond doctor",
+        "paybond doctor --agent --format json"
+    ],
+    "version": [
+        "paybond version",
+        "paybond version --verbose --format json"
+    ],
+    "diagnose": [
+        "paybond diagnose --redacted",
+        "paybond diagnose --redacted --format json"
+    ],
+    "config get": [
+        "paybond config get gateway"
+    ],
+    "config set": [
+        "paybond config set gateway https://api.paybond.ai"
+    ],
+    "config unset": [
+        "paybond config unset gateway"
+    ],
+    "config list": [
+        "paybond config list --format json"
+    ],
+    "whoami": [
+        "paybond whoami",
+        "paybond whoami --format json"
+    ],
+    "keys list": [
+        "paybond keys list --format json"
+    ],
+    "keys create": [
+        "paybond keys create --name ci-bot --role operator"
+    ],
+    "keys rotate": [
+        "paybond keys rotate key-123 --yes"
+    ],
+    "keys revoke": [
+        "paybond keys revoke key-123 --yes"
+    ],
+    "intents list": [
+        "paybond intents list --limit 10"
+    ],
+    "intents get": [
+        "paybond intents get intent-123"
+    ],
+    "intents create": [
+        "paybond intents create --body intent.json"
+    ],
+    "intents fund": [
+        "paybond intents fund intent-123"
+    ],
+    "intents evidence": [
+        "paybond intents evidence intent-123 --body evidence.json"
+    ],
+    "intents settlement-confirm": [
+        "paybond intents settlement-confirm intent-123"
+    ],
+    "guardrails bootstrap": [
+        "paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100"
+    ],
+    "guardrails evidence": [
+        "paybond guardrails evidence --intent-id intent-123 --body evidence.json"
+    ],
+    "spend authorize": [
+        "paybond spend authorize --intent-id intent-123 --token cap --operation paid-tool"
+    ],
+    "signal reputation": [
+        "paybond signal reputation --did did:example:alice"
+    ],
+    "signal portfolio": [
+        "paybond signal portfolio"
+    ],
+    "signal fraud": [
+        "paybond signal fraud --did did:example:alice"
+    ],
+    "receipts get": [
+        "paybond receipts get receipt-123"
+    ],
+    "receipts verify": [
+        "paybond receipts verify receipt-123"
+    ],
+    "mandates verify": [
+        "paybond mandates verify --body mandate.json"
+    ],
+    "mandates import": [
+        "paybond mandates import --body mandate.json"
+    ],
+    "a2a card": [
+        "paybond a2a card"
+    ],
+    "a2a contracts": [
+        "paybond a2a contracts"
+    ],
+    "audit exports list": [
+        "paybond audit exports list --format json"
+    ],
+    "audit exports get": [
+        "paybond audit exports get job-123"
+    ],
+    "audit exports verify": [
+        "paybond audit exports verify ./bundle"
+    ],
+    "audit exports delete": [
+        "paybond audit exports delete job-123 --yes"
+    ]
+};
+export const COMPLETIONS = {
+    "top_level": [
+        "onboarding",
+        "help",
+        "examples",
+        "completion",
+        "login",
+        "init",
+        "mcp",
+        "doctor",
+        "version",
+        "diagnose",
+        "config",
+        "whoami",
+        "keys",
+        "intents",
+        "guardrails",
+        "spend",
+        "signal",
+        "receipts",
+        "mandates",
+        "a2a",
+        "audit"
+    ],
+    "init": [
+        "guardrail"
+    ],
+    "mcp": [
+        "serve",
+        "install",
+        "verify-config",
+        "tools"
+    ],
+    "config": [
+        "get",
+        "set",
+        "unset",
+        "list"
+    ],
+    "keys": [
+        "list",
+        "create",
+        "rotate",
+        "revoke"
+    ],
+    "intents": [
+        "list",
+        "get",
+        "create",
+        "fund",
+        "evidence",
+        "settlement-confirm"
+    ],
+    "guardrails": [
+        "bootstrap",
+        "evidence"
+    ],
+    "spend": [
+        "authorize"
+    ],
+    "signal": [
+        "reputation",
+        "portfolio",
+        "fraud"
+    ],
+    "receipts": [
+        "get",
+        "verify"
+    ],
+    "mandates": [
+        "verify",
+        "import"
+    ],
+    "a2a": [
+        "card",
+        "contracts"
+    ],
+    "audit": [
+        "exports"
+    ],
+    "completion": [
+        "bash",
+        "zsh",
+        "fish"
+    ]
+};
+export const WORKFLOWS = [
+    {
+        "title": "Sandbox setup",
+        "description": "Authenticate, validate the runtime, and confirm tenant context.",
+        "examples": [
+            "paybond login",
+            "paybond doctor --format json"
+        ],
+        "next": "paybond whoami"
+    },
+    {
+        "title": "Agent + MCP host",
+        "description": "Preview MCP host config and list tools exposed to agents.",
+        "examples": [
+            "paybond mcp install --host claude --scope local",
+            "paybond mcp verify-config --host claude",
+            "paybond mcp tools"
+        ],
+        "next": "paybond doctor --agent"
+    },
+    {
+        "title": "Paid-tool guardrail",
+        "description": "Scaffold a sandbox guardrail integration file for your agent runtime.",
+        "examples": [
+            "paybond init guardrail",
+            "paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100"
+        ],
+        "next": "paybond spend authorize --help"
+    }
+];
+export const DOCS_BASE_URL = "https://docs.paybond.ai/kit";
+export const COMPLETION_SCRIPTS = {
+    "bash": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a audit\n# init: guardrail\n# mcp: serve install verify-config tools\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# audit: exports\n# completion: bash zsh fish\n_paybond_completion() {\n  local cur prev words cword\n  COMPREPLY=()\n  cur=\"${COMP_WORDS[COMP_CWORD]}\"\n  prev=\"${COMP_WORDS[COMP_CWORD-1]}\"\n\n  if [[ $COMP_CWORD -eq 1 ]]; then\n    COMPREPLY=($(compgen -W \"onboarding help examples completion login init mcp doctor version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a audit\" -- \"$cur\"))\n    return 0\n  fi\n\n  case \"${COMP_WORDS[1]}\" in\n      init) COMPREPLY=($(compgen -W \"guardrail\" -- \"$cur\")) ;;\n      mcp) COMPREPLY=($(compgen -W \"serve install verify-config tools\" -- \"$cur\")) ;;\n      config) COMPREPLY=($(compgen -W \"get set unset list\" -- \"$cur\")) ;;\n      keys) COMPREPLY=($(compgen -W \"list create rotate revoke\" -- \"$cur\")) ;;\n      intents) COMPREPLY=($(compgen -W \"list get create fund evidence settlement-confirm\" -- \"$cur\")) ;;\n      guardrails) COMPREPLY=($(compgen -W \"bootstrap evidence\" -- \"$cur\")) ;;\n      spend) COMPREPLY=($(compgen -W \"authorize\" -- \"$cur\")) ;;\n      signal) COMPREPLY=($(compgen -W \"reputation portfolio fraud\" -- \"$cur\")) ;;\n      receipts) COMPREPLY=($(compgen -W \"get verify\" -- \"$cur\")) ;;\n      mandates) COMPREPLY=($(compgen -W \"verify import\" -- \"$cur\")) ;;\n      a2a) COMPREPLY=($(compgen -W \"card contracts\" -- \"$cur\")) ;;\n      audit) COMPREPLY=($(compgen -W \"exports\" -- \"$cur\")) ;;\n      completion) COMPREPLY=($(compgen -W \"bash zsh fish\" -- \"$cur\")) ;;\n    *) ;;\n  esac\n}\ncomplete -F _paybond_completion paybond\n",
+    "zsh": "#compdef paybond\n# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a audit\n# init: guardrail\n# mcp: serve install verify-config tools\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# audit: exports\n# completion: bash zsh fish\n\n_paybond() {\n  local -a commands\n  commands=(\n    'onboarding' 'help' 'examples' 'completion' 'login' 'init' 'mcp' 'doctor' 'version' 'diagnose' 'config' 'whoami' 'keys' 'intents' 'guardrails' 'spend' 'signal' 'receipts' 'mandates' 'a2a' 'audit'\n  )\n  _arguments -C \\\n    '(--gateway)--gateway[Gateway base URL]:url:' \\\n    '(--env-file)--env-file[Local secrets file]:path:_files' \\\n    '(--format)--format[Output format]:(table json)' \\\n    '(--color)--color[Color mode]:(auto always never)' \\\n    '--no-color[Disable color output]' \\\n    '1: :->command' \\\n    '*::arg:->args'\n\n  case $state in\n    command)\n      _describe -t commands 'paybond commands' commands\n      ;;\n    args)\n      case $words[1] in\n    'init:subcommand:(guardrail)'\n    'mcp:subcommand:(serve install verify-config tools)'\n    'config:subcommand:(get set unset list)'\n    'keys:subcommand:(list create rotate revoke)'\n    'intents:subcommand:(list get create fund evidence settlement-confirm)'\n    'guardrails:subcommand:(bootstrap evidence)'\n    'spend:subcommand:(authorize)'\n    'signal:subcommand:(reputation portfolio fraud)'\n    'receipts:subcommand:(get verify)'\n    'mandates:subcommand:(verify import)'\n    'a2a:subcommand:(card contracts)'\n    'audit:subcommand:(exports)'\n    'completion:subcommand:(bash zsh fish)'\n      esac\n      ;;\n  esac\n}\n\ncompdef _paybond paybond\n",
+    "fish": "# Generated by kit/cli-parity/generate.mjs — do not edit by hand.\n# # top_level: onboarding help examples completion login init mcp doctor version diagnose config whoami keys intents guardrails spend signal receipts mandates a2a audit\n# init: guardrail\n# mcp: serve install verify-config tools\n# config: get set unset list\n# keys: list create rotate revoke\n# intents: list get create fund evidence settlement-confirm\n# guardrails: bootstrap evidence\n# spend: authorize\n# signal: reputation portfolio fraud\n# receipts: get verify\n# mandates: verify import\n# a2a: card contracts\n# audit: exports\n# completion: bash zsh fish\ncomplete -c paybond -f\ncomplete -c paybond -l gateway -d 'Gateway base URL'\ncomplete -c paybond -l env-file -d 'Local secrets file' -r\ncomplete -c paybond -l format -d 'Output format' -xa 'table json'\ncomplete -c paybond -l color -d 'Color mode' -xa 'auto always never'\ncomplete -c paybond -l no-color -d 'Disable color output'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'onboarding'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'help'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'examples'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'completion'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'login'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'init'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mcp'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'doctor'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'version'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'diagnose'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'config'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'whoami'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'keys'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'intents'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'guardrails'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'spend'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'signal'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'receipts'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'mandates'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'a2a'\ncomplete -c paybond -n '__fish_use_subcommand' -a 'audit'\ncomplete -c paybond -n '__fish_seen_subcommand_from init' -a 'guardrail'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'serve'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'install'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'verify-config'\ncomplete -c paybond -n '__fish_seen_subcommand_from mcp' -a 'tools'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'set'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'unset'\ncomplete -c paybond -n '__fish_seen_subcommand_from config' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'rotate'\ncomplete -c paybond -n '__fish_seen_subcommand_from keys' -a 'revoke'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'list'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'create'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'fund'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from intents' -a 'settlement-confirm'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'bootstrap'\ncomplete -c paybond -n '__fish_seen_subcommand_from guardrails' -a 'evidence'\ncomplete -c paybond -n '__fish_seen_subcommand_from spend' -a 'authorize'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'reputation'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'portfolio'\ncomplete -c paybond -n '__fish_seen_subcommand_from signal' -a 'fraud'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'get'\ncomplete -c paybond -n '__fish_seen_subcommand_from receipts' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'verify'\ncomplete -c paybond -n '__fish_seen_subcommand_from mandates' -a 'import'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'card'\ncomplete -c paybond -n '__fish_seen_subcommand_from a2a' -a 'contracts'\ncomplete -c paybond -n '__fish_seen_subcommand_from audit' -a 'exports'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'bash'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'zsh'\ncomplete -c paybond -n '__fish_seen_subcommand_from completion' -a 'fish'\n"
+};

package/dist/cli/commands/discovery.d.ts

@@ -0,0 +1,8 @@
+import { commandPath, type CliContext } from "../context.js";
+import { type CommandResult } from "../types.js";
+export declare function handleSignal(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleReceipts(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleMandates(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleA2a(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleAuditExports(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export { commandPath };

package/dist/cli/commands/discovery.js

@@ -0,0 +1,194 @@
+import { resolveJsonBody } from "../body.js";
+import { verifyAuditBundleLocal } from "../audit-export.js";
+import { buildListQueryParams, extractNextCursor, partialResultsWarning, writeAtomicFileAsync, } from "../automation.js";
+import { commandPath, gatewayUrl, requireConfirmation, withGateway } from "../context.js";
+import { consumeBooleanFlag, consumeFlag } from "../globals.js";
+import { CliError } from "../types.js";
+export async function handleSignal(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        const principal = await gateway.getJson("/v1/auth/principal");
+        const tenantId = String(principal.tenant_id ?? "");
+        if (subcommand === "portfolio") {
+            const body = await gateway.getJson(`/signal/v1/tenants/${encodeURIComponent(tenantId)}/portfolio/summary`);
+            return { data: body };
+        }
+        const didFlag = consumeFlag(argv, "--did");
+        if (!didFlag.value) {
+            throw new CliError(`signal ${subcommand} requires --did`, { category: "usage", code: "cli.usage.missing_did" });
+        }
+        if (subcommand === "reputation") {
+            const body = await gateway.getJson(`/signal/v1/tenants/${encodeURIComponent(tenantId)}/reputation/${encodeURIComponent(didFlag.value)}`);
+            return { data: body };
+        }
+        if (subcommand === "fraud") {
+            const body = await gateway.getJson(`/fraud/v1/tenants/${encodeURIComponent(tenantId)}/assessments/${encodeURIComponent(didFlag.value)}`);
+            return { data: body };
+        }
+        throw new CliError(`unknown signal subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleReceipts(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        const receiptId = argv[0];
+        if (!receiptId) {
+            throw new CliError(`receipts ${subcommand} requires <receipt_id>`, { category: "usage", code: "cli.usage.missing_receipt_id" });
+        }
+        if (subcommand === "get") {
+            const body = await gateway.getJson(`/protocol/v2/receipts/${encodeURIComponent(receiptId)}`);
+            return { data: body };
+        }
+        if (subcommand === "verify") {
+            const body = await gateway.postJson("/protocol/v2/receipts/verify", { receipt_id: receiptId });
+            return { data: body };
+        }
+        throw new CliError(`unknown receipts subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleMandates(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        const { payload } = await resolveJsonBody(argv, {
+            missingMessage: `mandates ${subcommand} requires --body <json-file> or --stdin`,
+        });
+        if (subcommand === "verify") {
+            const body = await gateway.postJson("/protocol/v2/mandates/verify", payload);
+            return { data: body };
+        }
+        if (subcommand === "import") {
+            const body = await gateway.postJson("/protocol/v2/mandates/import", payload);
+            return { data: body };
+        }
+        throw new CliError(`unknown mandates subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleA2a(ctx, subcommand, argv) {
+    return withGateway(ctx, async (gateway) => {
+        if (subcommand === "card") {
+            const body = await gateway.getJson("/.well-known/agent-card.json");
+            return { data: body };
+        }
+        if (subcommand === "contracts") {
+            const contractFlag = consumeFlag(argv, "--contract-id");
+            if (contractFlag.value) {
+                const body = await gateway.getJson(`/protocol/v2/a2a/task-contracts/${encodeURIComponent(contractFlag.value)}`);
+                return { data: body };
+            }
+            const limitFlag = consumeFlag(argv, "--limit");
+            const cursorFlag = consumeFlag(argv, "--cursor");
+            const params = buildListQueryParams(limitFlag.value, cursorFlag.value);
+            const body = await gateway.getJson(`/protocol/v2/a2a/task-contracts?${params.toString()}`);
+            const nextCursor = extractNextCursor(body);
+            const warnings = partialResultsWarning(nextCursor) ? [partialResultsWarning(nextCursor)] : undefined;
+            if (nextCursor && !body.next_cursor) {
+                body.next_cursor = nextCursor;
+            }
+            return { data: body, warnings };
+        }
+        throw new CliError(`unknown a2a subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export async function handleAuditExports(ctx, subcommand, argv) {
+    if (subcommand === "verify") {
+        const path = argv[0];
+        if (!path) {
+            throw new CliError("audit exports verify requires <path>", { category: "usage", code: "cli.usage.missing_path" });
+        }
+        try {
+            const data = await verifyAuditBundleLocal(path, ctx.cwd);
+            return { data };
+        }
+        catch (err) {
+            if (err instanceof CliError) {
+                throw err;
+            }
+            throw new CliError(err instanceof Error ? err.message : String(err), {
+                category: "validation",
+                code: "cli.audit.verify_failed",
+            });
+        }
+    }
+    return withGateway(ctx, async (gateway) => {
+        if (subcommand === "list") {
+            const limitFlag = consumeFlag(argv, "--limit");
+            const cursorFlag = consumeFlag(argv, "--cursor");
+            const params = buildListQueryParams(limitFlag.value, cursorFlag.value, { limit: "50" });
+            const body = await gateway.getJson(`/v1/compliance/audit-exports?${params.toString()}`);
+            const exports = Array.isArray(body.jobs)
+                ? body.jobs
+                : Array.isArray(body.items)
+                    ? body.items
+                    : Array.isArray(body.exports)
+                        ? body.exports
+                        : [];
+            const nextCursor = extractNextCursor(body);
+            const warnings = partialResultsWarning(nextCursor) ? [partialResultsWarning(nextCursor)] : undefined;
+            const data = {
+                exports: exports.map((item) => {
+                    const row = item;
+                    return {
+                        job_id: String(row.job_id ?? row.id ?? ""),
+                        status: String(row.status ?? ""),
+                        created_at: String(row.created_at ?? ""),
+                        expires_at: row.expires_at ? String(row.expires_at) : null,
+                        scope: row.scope ? String(row.scope) : undefined,
+                    };
+                }),
+            };
+            if (nextCursor) {
+                data.next_cursor = nextCursor;
+            }
+            return { data, warnings };
+        }
+        const jobId = argv[0];
+        if (!jobId) {
+            throw new CliError(`audit exports ${subcommand} requires <job_id>`, { category: "usage", code: "cli.usage.missing_job_id" });
+        }
+        if (subcommand === "get") {
+            const issueDownload = consumeBooleanFlag(argv.slice(1), "--issue-download").present;
+            const outputFlag = consumeFlag(argv.slice(1), "--output");
+            const query = issueDownload ? "?issue_download=1" : "";
+            const body = await gateway.getJson(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}${query}`);
+            if (outputFlag.value) {
+                const job = (body.job ?? body);
+                const token = String(job.download_token ?? "");
+                if (!token) {
+                    throw new CliError("audit exports get --output requires a ready export with --issue-download", {
+                        category: "validation",
+                        code: "cli.audit.missing_download_token",
+                    });
+                }
+                const bundleUrl = gatewayUrl(ctx.globals.gateway, `/v1/compliance/audit-exports/${encodeURIComponent(jobId)}/bundle?token=${encodeURIComponent(token)}`);
+                const apiKey = await import("../credentials.js").then((mod) => mod.resolveApiKey(ctx.globals, ctx.cwd));
+                const response = await ctx.fetch(bundleUrl, {
+                    headers: {
+                        authorization: `Bearer ${apiKey}`,
+                        "x-request-id": ctx.globals.requestId,
+                    },
+                });
+                if (!response.ok) {
+                    throw new CliError(`failed to download audit export bundle (${response.status})`, {
+                        category: "gateway",
+                        code: "cli.audit.bundle_download_failed",
+                        exitCode: 5,
+                    });
+                }
+                const bytes = new Uint8Array(await response.arrayBuffer());
+                await writeAtomicFileAsync(outputFlag.value, bytes, 0o600);
+                return {
+                    data: {
+                        job_id: jobId,
+                        output: outputFlag.value,
+                        bytes_written: bytes.byteLength,
+                    },
+                };
+            }
+            return { data: body };
+        }
+        if (subcommand === "delete") {
+            requireConfirmation(ctx.globals, "delete audit export job");
+            await gateway.deleteJson(`/v1/compliance/audit-exports/${encodeURIComponent(jobId)}`);
+            return { data: { job_id: jobId, deleted: true } };
+        }
+        throw new CliError(`unknown audit exports subcommand: ${subcommand}`, { category: "usage", code: "cli.usage.unknown_command" });
+    });
+}
+export { commandPath };

package/dist/cli/commands/setup.d.ts

@@ -0,0 +1,15 @@
+import { commandPath, type CliContext } from "../context.js";
+import { type CommandResult } from "../types.js";
+declare function readJsonFile(filePath: string): Promise<Record<string, unknown>>;
+export declare function handleLogin(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleInitGuardrail(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleMcpServe(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleMcpTools(ctx: CliContext): Promise<CommandResult>;
+export declare function handleMcpInstall(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleMcpVerifyConfig(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleDoctor(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleConfig(ctx: CliContext, subcommand: string, argv: string[]): Promise<CommandResult>;
+export declare function handleWhoami(ctx: CliContext): Promise<CommandResult>;
+export declare function handleVersion(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export declare function handleDiagnose(ctx: CliContext, argv: string[]): Promise<CommandResult>;
+export { readJsonFile, commandPath };