@paybond/kit 0.9.8 → 0.10.0

package/dist/cli/doctor-agent.js

@@ -0,0 +1,311 @@
+import { spawn } from "node:child_process";
+import { access } from "node:fs/promises";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { defaultMcpInstallFormat, defaultMcpServerCommand, parseMcpInstallHost, planMcpInstall, } from "./mcp-install.js";
+import { validateMcpToolSchema } from "./mcp-policy.js";
+import { validateMcpHostConfig } from "./mcp-verify-config.js";
+const require = createRequire(import.meta.url);
+const packageJson = require("../../package.json");
+export function packageVersion() {
+    return packageJson.version;
+}
+export function encodeMcpMessage(payload) {
+    const body = JSON.stringify(payload);
+    return Buffer.from(`Content-Length: ${Buffer.byteLength(body, "utf8")}\r\n\r\n${body}`, "utf8");
+}
+function consumeMcpMessages(raw) {
+    const messages = [];
+    let offset = 0;
+    while (true) {
+        const headerEnd = raw.indexOf("\r\n\r\n", offset);
+        if (headerEnd < 0) {
+            return { messages, remainder: raw.subarray(offset) };
+        }
+        const headerText = raw.subarray(offset, headerEnd).toString("ascii");
+        const contentLength = Number.parseInt(headerText
+            .split("\r\n")
+            .find((line) => line.toLowerCase().startsWith("content-length:"))
+            ?.split(":", 2)[1]
+            ?.trim() ?? "", 10);
+        if (!Number.isFinite(contentLength) || contentLength <= 0) {
+            throw new Error("MCP response missing Content-Length");
+        }
+        const bodyStart = headerEnd + 4;
+        const bodyEnd = bodyStart + contentLength;
+        if (raw.length < bodyEnd) {
+            return { messages, remainder: raw.subarray(offset) };
+        }
+        const body = raw.subarray(bodyStart, bodyEnd).toString("utf8");
+        const parsed = JSON.parse(body);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("MCP response was not a JSON object");
+        }
+        messages.push(parsed);
+        offset = bodyEnd;
+        if (offset >= raw.length) {
+            return { messages, remainder: Buffer.alloc(0) };
+        }
+    }
+}
+async function readMcpMessage(stream, deadlineMs, rawBuffer) {
+    const started = Date.now();
+    while (true) {
+        const joined = Buffer.concat(rawBuffer);
+        const { messages, remainder } = consumeMcpMessages(joined);
+        rawBuffer.length = 0;
+        if (remainder.length > 0) {
+            rawBuffer.push(remainder);
+        }
+        if (messages[0]) {
+            return messages[0];
+        }
+        if (Date.now() - started > deadlineMs) {
+            throw new Error("timed out waiting for MCP response");
+        }
+        const chunk = await new Promise((resolve, reject) => {
+            const onData = (data) => {
+                cleanup();
+                resolve(data);
+            };
+            const onEnd = () => {
+                cleanup();
+                resolve(null);
+            };
+            const onError = (err) => {
+                cleanup();
+                reject(err);
+            };
+            const cleanup = () => {
+                stream.off("data", onData);
+                stream.off("end", onEnd);
+                stream.off("error", onError);
+            };
+            stream.once("data", onData);
+            stream.once("end", onEnd);
+            stream.once("error", onError);
+        });
+        if (!chunk) {
+            throw new Error("MCP server closed stdout before responding");
+        }
+        rawBuffer.push(chunk);
+        if (Buffer.concat(rawBuffer).length > 1_048_576) {
+            throw new Error("MCP stdout buffer too large");
+        }
+    }
+}
+function stdoutIsMcpPure(rawStdout) {
+    if (rawStdout.length === 0) {
+        return true;
+    }
+    try {
+        const { messages, remainder } = consumeMcpMessages(rawStdout);
+        if (remainder.toString("utf8").trim()) {
+            return false;
+        }
+        return messages.length > 0;
+    }
+    catch {
+        return false;
+    }
+}
+export async function runAgentMcpChecks(input) {
+    const checks = [];
+    const installHost = parseMcpInstallHost(input.host ?? "generic");
+    const format = defaultMcpInstallFormat(installHost);
+    const plan = planMcpInstall({
+        host: installHost,
+        scope: "local",
+        format,
+        envFile: input.envFile,
+        cwd: input.cwd,
+        home: process.env.HOME ?? process.env.USERPROFILE ?? input.cwd,
+        serverCommand: input.serverCommand ?? defaultMcpServerCommand(),
+    });
+    const configResult = validateMcpHostConfig({
+        host: installHost,
+        format,
+        payload: plan.payload,
+        cwd: input.cwd,
+        expectedEnvFile: input.envFile,
+    });
+    checks.push({
+        name: "mcp_host_config",
+        ok: configResult.ok,
+        message: configResult.message,
+        details: { host: installHost, format },
+    });
+    const envPath = path.isAbsolute(input.envFile)
+        ? path.resolve(input.envFile)
+        : path.resolve(input.cwd, input.envFile);
+    let envOk = false;
+    try {
+        await access(envPath);
+        envOk = true;
+    }
+    catch {
+        envOk = false;
+    }
+    checks.push({
+        name: "mcp_env_resolution",
+        ok: envOk,
+        message: envOk ? envPath : `env file not found: ${envPath}`,
+        details: { env_file: input.envFile, resolved: envPath },
+    });
+    if (!envOk) {
+        checks.push({ name: "mcp_launch", ok: false, message: "skipped (env file missing)" }, { name: "mcp_initialize", ok: false, message: "skipped (env file missing)" }, { name: "mcp_tools_list", ok: false, message: "skipped (env file missing)" }, { name: "mcp_tool_schemas", ok: false, message: "skipped (env file missing)" }, { name: "mcp_stdout_purity", ok: false, message: "skipped (env file missing)" });
+        return checks;
+    }
+    const command = input.serverCommand ?? defaultMcpServerCommand();
+    const env = {
+        ...process.env,
+        PAYBOND_ENV_FILE: envPath,
+    };
+    delete env.PAYBOND_API_KEY;
+    return await new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn(command[0], command.slice(1), {
+                cwd: input.cwd,
+                env,
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            resolve([
+                { name: "mcp_launch", ok: false, message: `unable to launch MCP server: ${err instanceof Error ? err.message : String(err)}` },
+                { name: "mcp_initialize", ok: false, message: "skipped (launch failed)" },
+                { name: "mcp_tools_list", ok: false, message: "skipped (launch failed)" },
+                { name: "mcp_tool_schemas", ok: false, message: "skipped (probe failed)" },
+                { name: "mcp_stdout_purity", ok: false, message: "skipped (launch failed)" },
+            ]);
+            return;
+        }
+        const timeoutMs = input.timeoutMs ?? 10_000;
+        const stderrChunks = [];
+        const rawStdout = [];
+        child.stderr?.on("data", (chunk) => {
+            stderrChunks.push(chunk);
+        });
+        child.stdout?.on("data", (chunk) => {
+            rawStdout.push(chunk);
+        });
+        void (async () => {
+            try {
+                if (!child.stdin || !child.stdout) {
+                    throw new Error("MCP server stdio pipes unavailable");
+                }
+                checks.push({
+                    name: "mcp_launch",
+                    ok: true,
+                    message: `launched ${command.join(" ")}`,
+                });
+                child.stdin.write(encodeMcpMessage({
+                    jsonrpc: "2.0",
+                    id: 1,
+                    method: "initialize",
+                    params: {
+                        protocolVersion: "2025-11-25",
+                        capabilities: {},
+                        clientInfo: { name: "paybond-doctor", version: packageVersion() },
+                    },
+                }));
+                const initResponse = await readMcpMessage(child.stdout, timeoutMs, rawStdout);
+                if (initResponse.error) {
+                    checks.push({
+                        name: "mcp_initialize",
+                        ok: false,
+                        message: "MCP initialize failed",
+                        details: { error: initResponse.error },
+                    });
+                    checks.push({ name: "mcp_tools_list", ok: false, message: "skipped (initialize failed)" }, { name: "mcp_tool_schemas", ok: false, message: "skipped (initialize failed)" }, { name: "mcp_stdout_purity", ok: false, message: "skipped (initialize failed)" });
+                    resolve(checks);
+                    return;
+                }
+                const serverInfo = initResponse.result?.serverInfo;
+                const initOk = Boolean(serverInfo && typeof serverInfo === "object");
+                checks.push({
+                    name: "mcp_initialize",
+                    ok: initOk,
+                    message: initOk ? "MCP initialize succeeded" : "MCP initialize response missing serverInfo",
+                    details: initOk
+                        ? {
+                            server_name: serverInfo.name,
+                            server_version: serverInfo.version,
+                        }
+                        : undefined,
+                });
+                if (!initOk) {
+                    checks.push({ name: "mcp_tools_list", ok: false, message: "skipped (initialize failed)" }, { name: "mcp_tool_schemas", ok: false, message: "skipped (initialize failed)" }, { name: "mcp_stdout_purity", ok: false, message: "skipped (initialize failed)" });
+                    resolve(checks);
+                    return;
+                }
+                child.stdin.write(encodeMcpMessage({
+                    jsonrpc: "2.0",
+                    method: "notifications/initialized",
+                }));
+                child.stdin.write(encodeMcpMessage({
+                    jsonrpc: "2.0",
+                    id: 2,
+                    method: "tools/list",
+                    params: {},
+                }));
+                const toolsResponse = await readMcpMessage(child.stdout, timeoutMs, rawStdout);
+                if (toolsResponse.error) {
+                    checks.push({
+                        name: "mcp_tools_list",
+                        ok: false,
+                        message: "MCP tools/list failed",
+                        details: { error: toolsResponse.error },
+                    });
+                    checks.push({ name: "mcp_tool_schemas", ok: false, message: "skipped (tools/list failed)" }, { name: "mcp_stdout_purity", ok: false, message: "skipped (tools/list failed)" });
+                    resolve(checks);
+                    return;
+                }
+                const tools = toolsResponse.result?.tools;
+                const toolCount = Array.isArray(tools) ? tools.length : 0;
+                checks.push({
+                    name: "mcp_tools_list",
+                    ok: toolCount > 0,
+                    message: `${toolCount} tools listed`,
+                    details: { tool_count: toolCount },
+                });
+                const schemaErrors = [];
+                if (Array.isArray(tools)) {
+                    for (const tool of tools) {
+                        if (tool && typeof tool === "object" && !Array.isArray(tool)) {
+                            schemaErrors.push(...validateMcpToolSchema(tool));
+                        }
+                    }
+                }
+                checks.push({
+                    name: "mcp_tool_schemas",
+                    ok: toolCount > 0 && schemaErrors.length === 0,
+                    message: schemaErrors.length === 0 ? "all listed tools have valid schemas" : schemaErrors[0],
+                    details: { invalid_count: schemaErrors.length, errors: schemaErrors.slice(0, 5) },
+                });
+                const pure = stdoutIsMcpPure(Buffer.concat(rawStdout));
+                checks.push({
+                    name: "mcp_stdout_purity",
+                    ok: pure,
+                    message: pure ? "stdout contains only MCP-framed JSON-RPC" : "stdout contains non-MCP material",
+                });
+                resolve(checks);
+            }
+            catch (err) {
+                const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
+                const suffix = stderr ? `: ${stderr}` : "";
+                checks.push({
+                    name: "mcp_initialize",
+                    ok: false,
+                    message: `MCP stdio probe failed: ${err instanceof Error ? err.message : String(err)}${suffix}`,
+                });
+                checks.push({ name: "mcp_tools_list", ok: false, message: "skipped (probe failed)" }, { name: "mcp_tool_schemas", ok: false, message: "skipped (probe failed)" }, { name: "mcp_stdout_purity", ok: false, message: "skipped (probe failed)" });
+                resolve(checks);
+            }
+            finally {
+                child.kill("SIGTERM");
+            }
+        })();
+    });
+}

package/dist/cli/envelope.d.ts

@@ -0,0 +1,14 @@
+import type { CliEnvelope, CliErrorShape, CommandResult, GlobalOptions, Writable } from "./types.js";
+export declare function mergeWarnings(result: CommandResult, extra?: string[]): string[];
+export declare function prepareCommandOutput(command: string, globals: GlobalOptions, result: CommandResult): {
+    data: unknown;
+    warnings: string[];
+    automationPlain: boolean;
+};
+export declare function successEnvelope<T>(command: string, globals: GlobalOptions, result: CommandResult<T> | {
+    data: T;
+    warnings?: string[];
+}): CliEnvelope<T>;
+export declare function failureEnvelope(command: string, globals: GlobalOptions, error: CliErrorShape): CliEnvelope<null>;
+export declare function writeEnvelope<T>(stdout: Writable, envelope: CliEnvelope<T>): void;
+export declare function writeTableLines(stdout: Writable, lines: string[]): void;

package/dist/cli/envelope.js

@@ -0,0 +1,46 @@
+import { applyAutomationTransforms } from "./automation.js";
+export function mergeWarnings(result, extra = []) {
+    const merged = [...(result.warnings ?? []), ...extra];
+    return [...new Set(merged)];
+}
+export function prepareCommandOutput(command, globals, result) {
+    const warnings = mergeWarnings(result);
+    const automationRequested = Boolean(globals.jsonFields || globals.jqExpr);
+    const data = applyAutomationTransforms(command, result.data, {
+        jsonFields: globals.jsonFields,
+        jqExpr: globals.jqExpr,
+    });
+    return {
+        data,
+        warnings,
+        automationPlain: automationRequested && globals.format !== "json",
+    };
+}
+export function successEnvelope(command, globals, result) {
+    return {
+        ok: true,
+        command,
+        data: result.data,
+        warnings: result.warnings ?? [],
+        request_id: globals.requestId,
+        error: null,
+    };
+}
+export function failureEnvelope(command, globals, error) {
+    return {
+        ok: false,
+        command,
+        data: null,
+        warnings: [],
+        request_id: globals.requestId,
+        error,
+    };
+}
+export function writeEnvelope(stdout, envelope) {
+    stdout.write(`${JSON.stringify(envelope, null, 2)}\n`);
+}
+export function writeTableLines(stdout, lines) {
+    for (const line of lines) {
+        stdout.write(`${line}\n`);
+    }
+}

package/dist/cli/globals.d.ts

@@ -0,0 +1,22 @@
+import { type GlobalOptions } from "./types.js";
+export declare const DEFAULT_GATEWAY = "https://api.paybond.ai";
+export declare const DEFAULT_ENV_FILE = ".env.local";
+export declare const TENANT_OVERRIDE_FLAGS: readonly ["--tenant-id", "--tenant", "--tenant_id"];
+export declare function rejectsTenantOverrideFlag(arg: string): boolean;
+export declare function parseRequiredNonNegativeInt(raw: string, field: string): number;
+export declare function parseOptionalNonNegativeInt(raw: string | undefined, field: string): number;
+export declare function defaultGlobalOptions(): GlobalOptions;
+export type ParsedCliArgv = {
+    globals: GlobalOptions;
+    command: string[];
+};
+export declare function parseCliArgv(argv: string[]): ParsedCliArgv;
+export declare function consumeFlag(argv: string[], flag: string): {
+    present: boolean;
+    value?: string;
+    rest: string[];
+};
+export declare function consumeBooleanFlag(argv: string[], flag: string): {
+    present: boolean;
+    rest: string[];
+};

package/dist/cli/globals.js

@@ -0,0 +1,238 @@
+import { generateRequestId } from "./request-id.js";
+import { parseColorMode, resolveColorModeFromEnv } from "./color.js";
+import { formatUnknownGlobalFlagMessage } from "./suggest.js";
+import { CliError } from "./types.js";
+export const DEFAULT_GATEWAY = "https://api.paybond.ai";
+export const DEFAULT_ENV_FILE = ".env.local";
+export const TENANT_OVERRIDE_FLAGS = ["--tenant-id", "--tenant", "--tenant_id"];
+export function rejectsTenantOverrideFlag(arg) {
+    for (const flag of TENANT_OVERRIDE_FLAGS) {
+        if (arg === flag || arg.startsWith(`${flag}=`)) {
+            return true;
+        }
+    }
+    return false;
+}
+export function parseRequiredNonNegativeInt(raw, field) {
+    const text = raw.trim();
+    if (!text) {
+        throw new CliError(`invalid ${field} (expected non-negative integer)`, {
+            category: "validation",
+            code: "cli.validation.invalid_integer",
+        });
+    }
+    const value = Number(text);
+    if (!Number.isInteger(value) || value < 0) {
+        throw new CliError(`invalid ${field} (expected non-negative integer)`, {
+            category: "validation",
+            code: "cli.validation.invalid_integer",
+        });
+    }
+    return value;
+}
+export function parseOptionalNonNegativeInt(raw, field) {
+    if (!raw?.trim()) {
+        return 0;
+    }
+    return parseRequiredNonNegativeInt(raw, field);
+}
+const GLOBAL_FLAGS = new Set([
+    "--gateway",
+    "--env-file",
+    "--format",
+    "--json",
+    "--jq",
+    "--profile",
+    "--request-id",
+    "--yes",
+    "--no-open",
+    "--color",
+    "--no-color",
+]);
+export function defaultGlobalOptions() {
+    return {
+        gateway: DEFAULT_GATEWAY,
+        envFile: DEFAULT_ENV_FILE,
+        format: "table",
+        color: resolveColorModeFromEnv(),
+        requestId: generateRequestId(),
+        yes: false,
+        noOpen: false,
+    };
+}
+function parseFormat(raw) {
+    const value = raw.trim().toLowerCase();
+    if (value === "table" || value === "json") {
+        return value;
+    }
+    throw new CliError("invalid --format (expected table|json)", { category: "usage", code: "cli.usage.invalid_format" });
+}
+function readFlagValue(argv, index, flag) {
+    const arg = argv[index];
+    if (arg.startsWith(`${flag}=`)) {
+        return { value: arg.slice(flag.length + 1), consumed: 1 };
+    }
+    const next = argv[index + 1];
+    if (!next || next.startsWith("-")) {
+        throw new CliError(`missing value for ${flag}`, { category: "usage", code: "cli.usage.missing_flag_value" });
+    }
+    return { value: next, consumed: 2 };
+}
+export function parseCliArgv(argv) {
+    for (const arg of argv) {
+        if (rejectsTenantOverrideFlag(arg)) {
+            throw new CliError("tenant scope comes from authenticated credentials; do not pass --tenant-id", {
+                category: "usage",
+                code: "cli.usage.tenant_override_forbidden",
+            });
+        }
+    }
+    const globals = defaultGlobalOptions();
+    const command = [];
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            command.push(arg);
+            i += 1;
+            continue;
+        }
+        if (arg === "--yes") {
+            globals.yes = true;
+            i += 1;
+            continue;
+        }
+        if (arg === "--no-open") {
+            globals.noOpen = true;
+            i += 1;
+            continue;
+        }
+        if (arg === "--no-color") {
+            globals.color = "never";
+            i += 1;
+            continue;
+        }
+        if (arg === "--color" || arg.startsWith("--color=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--color");
+            try {
+                globals.color = parseColorMode(value);
+            }
+            catch (err) {
+                throw new CliError(err instanceof Error ? err.message : String(err), {
+                    category: "usage",
+                    code: "cli.usage.invalid_color",
+                });
+            }
+            i += consumed;
+            continue;
+        }
+        if (arg === "--gateway" || arg.startsWith("--gateway=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--gateway");
+            if (!value.trim()) {
+                throw new CliError("invalid --gateway", { category: "usage", code: "cli.usage.invalid_gateway" });
+            }
+            globals.gateway = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg === "--env-file" || arg.startsWith("--env-file=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--env-file");
+            if (!value.trim()) {
+                throw new CliError("invalid --env-file", { category: "usage", code: "cli.usage.invalid_env_file" });
+            }
+            globals.envFile = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg === "--format" || arg.startsWith("--format=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--format");
+            globals.format = parseFormat(value);
+            i += consumed;
+            continue;
+        }
+        if (arg === "--profile" || arg.startsWith("--profile=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--profile");
+            if (!value.trim()) {
+                throw new CliError("invalid --profile", { category: "usage", code: "cli.usage.invalid_profile" });
+            }
+            globals.profile = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg === "--request-id" || arg.startsWith("--request-id=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--request-id");
+            if (!value.trim()) {
+                throw new CliError("invalid --request-id", { category: "usage", code: "cli.usage.invalid_request_id" });
+            }
+            globals.requestId = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg === "--json" || arg.startsWith("--json=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--json");
+            if (!value.trim()) {
+                throw new CliError("invalid --json (expected comma-separated field names)", {
+                    category: "usage",
+                    code: "cli.usage.invalid_json_fields",
+                });
+            }
+            globals.jsonFields = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg === "--jq" || arg.startsWith("--jq=")) {
+            const { value, consumed } = readFlagValue(argv, i, "--jq");
+            if (!value.trim()) {
+                throw new CliError("invalid --jq (expected filter expression)", { category: "usage", code: "cli.usage.invalid_jq" });
+            }
+            globals.jqExpr = value.trim();
+            i += consumed;
+            continue;
+        }
+        if (arg.startsWith("--") && !GLOBAL_FLAGS.has(arg.split("=")[0])) {
+            if (command.length === 0) {
+                throw new CliError(formatUnknownGlobalFlagMessage(arg), {
+                    category: "usage",
+                    code: "cli.usage.unknown_flag",
+                });
+            }
+        }
+        command.push(arg);
+        i += 1;
+    }
+    return { globals, command };
+}
+export function consumeFlag(argv, flag) {
+    const rest = [];
+    let present = false;
+    let value;
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === flag) {
+            present = true;
+            const next = argv[i + 1];
+            if (!next || next.startsWith("-")) {
+                throw new CliError(`missing value for ${flag}`, { category: "usage", code: "cli.usage.missing_flag_value" });
+            }
+            value = next;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith(`${flag}=`)) {
+            present = true;
+            value = arg.slice(flag.length + 1);
+            continue;
+        }
+        rest.push(arg);
+    }
+    return { present, value, rest };
+}
+export function consumeBooleanFlag(argv, flag) {
+    const rest = argv.filter((arg) => {
+        if (arg === flag) {
+            return false;
+        }
+        return true;
+    });
+    return { present: argv.length !== rest.length, rest };
+}

package/dist/cli/help.d.ts

@@ -0,0 +1,3 @@
+export declare const ROOT_HELP = "Usage: paybond [--global-flags] <command> [<subcommand> ...] [args]\n\nGlobal flags:\n  --gateway <url>         Gateway base URL (default: https://api.paybond.ai)\n  --env-file <path>       Local secrets file (default: .env.local)\n  --format table|json     Human table or JSON envelope output (default: table)\n  --json <fields>         Field-selectable JSON for list/read commands (plain JSON; use --format json for envelope)\n  --jq <expr>             jq-style filter for list/read command output\n  --profile <name>        Named credential profile from the Paybond CLI config file\n  --request-id <id>       Correlation ID for Gateway calls and JSON output\n  --yes                   Skip confirmation for destructive operations\n  --no-open               Do not open a browser for device login\n  --color auto|always|never Colorize human table output and help text (default: auto)\n  --no-color              Disable color output (also honors NO_COLOR)\n\nCommands:\n  onboarding              Guided, non-destructive first-run checks\n  help                    Detailed help for a command\n  examples                Copy-paste examples from the command spec\n  completion bash|zsh|fish Shell completion scripts\n  login                   Sandbox device login\n  init guardrail          Scaffold a sandbox paid-tool guardrail integration file\n  mcp serve|install|verify-config|tools MCP server and host configuration\n  doctor                  Validate local runtime, credentials, and optional agent setup\n  version                 Print package version (use --verbose for runtime details)\n  diagnose                Emit a redacted support bundle with --redacted\n  config get|set|unset|list\n                          Manage CLI configuration values\n  whoami                  Resolve the authenticated principal and tenant realm\n  keys list|create|rotate|revoke\n                          Manage tenant service-account API keys\n  intents list|get|create|fund|evidence|settlement-confirm\n                          Harbor intent workflows\n  guardrails bootstrap|evidence\n                          Sandbox guardrail helpers\n  spend authorize         Authorize delegated spend for a tool call\n  signal reputation|portfolio|fraud\n                          Signal summaries and fraud reads\n  receipts get|verify\n                          Protocol settlement receipts\n  mandates verify|import\n                          Agent mandate verification and import\n  a2a card|contracts\n                          Agent card discovery and task contracts\n  audit exports list|get|verify|delete\n                          Compliance audit export jobs and local bundle verification\n\nGetting started:\n  Sandbox setup\n    Authenticate, validate the runtime, and confirm tenant context.\n    $ paybond login\n    $ paybond doctor --format json\n    Next: paybond whoami\n  Agent + MCP host\n    Preview MCP host config and list tools exposed to agents.\n    $ paybond mcp install --host claude --scope local\n    $ paybond mcp verify-config --host claude\n    $ paybond mcp tools\n    Next: paybond doctor --agent\n  Paid-tool guardrail\n    Scaffold a sandbox guardrail integration file for your agent runtime.\n    $ paybond init guardrail\n    $ paybond guardrails bootstrap --operation paid-tool --requested-spend-cents 100\n    Next: paybond spend authorize --help\n\nDocumentation: https://docs.paybond.ai/kit\n\nLearn more:\n  paybond help <command>     Detailed help for a command\n  paybond examples           Copy-paste command examples\n  paybond onboarding         Guided first-run checks\n  paybond completion <shell> Shell completions (bash|zsh|fish)\n\nLegacy aliases: paybond-kit-login, paybond-init, paybond-kit-init, paybond-mcp-server\n";
+export declare const COMMAND_HELP: Record<string, string>;
+export declare function helpForCommand(path: string): string;