12Docs
CLI reference
Every bounded command and flag, grouped by purpose. One binary, no account creation; bounded <cmd> --help prints the same with an example block.
Install
curl -fsSL https://get.bounded.sh/install.sh | shGlobal flags: --json (structured output on commands that implement it; in CLI 0.0.51,bounded verify still emits its human proof report even when this flag is present), --quiet (minimal output), --env (production default, or staging; also BOUNDED_ENV). No login step: bounded.json records the project defaults, and the selected key source, usually ~/.bounded/credentials (or BOUNDED_PRIVATE_KEY), is your account (Auth).
Policy lifecycle
| Command | Does | Key flags |
|---|---|---|
init | Write starter policy.json plus public bounded.json | --force |
verify [policy.json] | Run the Z3 proof engine, print the report + counterexamples | --app-id (defaults to bounded.json), --operation, --constants |
deploy [policy.json] | Validate, compile, and push the policy | --app-id (defaults to bounded.json) | --create --name | --environment, --protocol, --constants |
bounded init # scaffold policy.json + bounded.json
bounded verify # prove the local policy first
bounded deploy --create --name my-app # gate again, create app + record appId
# after each policy change:
bounded verify
bounded deploy # server re-runs the blocking proof gateverify --operation
Default is verifyForDeploy (prove the whole policy). The others probe one expression:
| --operation | Needs | Proves |
|---|---|---|
verifyForDeploy | , | every obligation for the whole policy |
checkTautology | --expression | the expression is always true |
checkContradiction | --expression | the expression is always false |
checkSatisfiability | --expression | the expression can be true |
checkImplication | --rule + --property | the rule implies the property |
--constants / --environment
--constants NAME=value (repeatable or comma-separated) does CLI-side substitution for the legacy @constants.NAME token, for one-off CI overrides; prefer an in-policy constants block (Policy reference). --environment <name> selects an entry from the policy’s environments block: it overlays that env’s constants, targets its appId, and strips the block before shipping a normal policy.
Identity & teams
| Command | Does |
|---|---|
whoami | Show address, environment, key source (creates the key on first run) |
link | Bind the keypair to an email account via an OAuth device flow. Flags: --no-browser, --email <addr> for headless OTP approval, --timeout <dur> (default 10m). |
share <wallet|email> --role developer|admin|viewer|billing --app-id <id> | Add a collaborator. Wallet → direct; email → resolved to an auto-provisioned wallet so the invitee needs no wallet.policy is a legacy alias for developer. Owner only. |
unshare <wallet> --app-id <id> | Remove a collaborator (owner only) |
collaborators --app-id <id> | List collaborators (alias: shares) |
Data plane
All data subcommands use bounded.json appId by default; pass --app-id <id> to override. Writes go through the realtime worker, which enforces the deployed policy atomically.
| Command | Does |
|---|---|
data set | Write one document |
data set-many | Atomic all-or-nothing batch (--from-json) |
data get | Read a doc, or list/filter a collection |
data get-many | Batch-read paths from a JSON array |
data query | Run a named policy query |
data aggregate | Grouped count/sum/avg/min/max |
data search | Full-text search a collection |
bounded data set --path agents/a1/spend/a --data '{"amount":60}'
bounded data set-many --from-json bundle.json
bounded data get --path agents/a1/spend --filter '{"amount":{"$gt":10}}' --sort amount:desc --limit 20
bounded data aggregate --path agents/a1/spend --group category --sum amount
bounded data search --path notes --query "shipping"data get flags (collection reads)
| Flag | Meaning |
|---|---|
--filter '{...}' | MongoDB-style filter, e.g. {"amount":{"$gt":10}} |
--sort field:asc|desc | repeatable sort spec |
--limit N | page size |
--cursor <tok> | pagination cursor from a prior page's nextCursor |
--prompt "..." | natural-language filter evaluated server-side |
--include-subpaths | also walk nested sub-collections |
--shape '{...}' | resolve related docs inline |
data aggregate: --group (repeatable) + at least one of --count, --sum F, --avg F, --min F, --max F; optional --filter. data search: --query (required), optional --fields a,b, --limit, --cursor. On set / set-many, --skip-preflight is an onchain-only flag (skips RPC preflight simulation; no effect on the realtime data plane).
Functions & live
bounded functions deploy <name> --entry <file> \
--auth '<rule>' [--timeout <sec>] [--secret NAME] [--act-as <address>]
printf '%s' "$VALUE" | bounded secret put NAME --value-stdin --app-id <id>
bounded functions list
bounded functions invoke <name> [--data '<json>']
bounded functions logs <name>bounded live deploy <module>.live.ts # upload source; prints version (etag)Full guides: Functions and Realtime & live.