@aifinpay/mcp 2.12.1 → 2.12.2

package/README.md

@@ -4,8 +4,8 @@ AiFinPay MCP server for persistent agent identity, Agent Passport resolution,
 route discovery and non-signing settlement invoices. Canonical domain:
 **aifinpay.io**.
 
-Version **2.12.1** is prepared in this checkout, on the published agent 2.9.0
-and canonical skill 2.10.2 (AiFinPay/skill 48285cf, published 2026-10-19). The separate canonical producer's final immutable
+Version **2.12.2** is prepared in this checkout, on the published agent 2.9.0
+and canonical skill 2.11.0 (AiFinPay/skill 0490615, published 2026-10-22). The separate canonical producer's final immutable
 source pin is a required handoff, not a moving-branch substitution.
 The published baseline checked2026-10-04 was MCP2.5.0. Package publication and
 real registry dependency/lock refresh remain release gates; a source-cohort
@@ -227,10 +227,13 @@ client missing from this table can be reported with its exact name.
 ## Link the agent to its owner's dashboard
 
 The owner sees the agent's balance, payments and receipts at
-https://dash.aifinpay.io → My Agents. There, **Claim via MCP** generates a
-one-time URL; pass it to `agent_claim_self`. The tool contacts only AiFinPay
-origins, signs only the claim challenge for this agent's own address, and moves
-no funds. The owner-selected payment family must be confirmed successfully;
+https://dash.aifinpay.io → My Agents. There, **Link an agent → Claim via MCP**
+generates a one-time URL; pass it to `agent_claim_self`, which redeems it with
+a POST to `/api/auth/claim`. Opening the URL in a browser, or pasting it into a
+chat that has no AiFinPay MCP, links nothing; such an agent is linked by signed
+message in My Agents instead, as is an account with 2FA on. The tool contacts
+only AiFinPay origins, signs only the claim challenge for this agent's own
+address, and moves no funds. The owner-selected payment family must be confirmed successfully;
 the second wallet is best-effort. Use the selected wallet's Fund panel for
 available networks and assets; binding does not activate a disabled network.
 Offer this to the owner after `init` (step 4 above): from then on the owner

package/dist/tools/agent-claim-self.d.ts

@@ -4,17 +4,25 @@ import type { ToolContext } from "../server.js";
  * autonomously by signing a claim challenge with its own key.
  *
  * Flow (executed inside the tool, no copy-paste between UIs):
- *   1. User signs in to /login on aifinpay.io → gets a magic-link
- *      email with URL like `https://aifinpay.io/api/auth/verify?token=…`
- *   2. User pastes that URL to the agent: "claim yourself on my account
- *      using this magic link"
- *   3. Agent calls this tool with the magic_link_url
- *   4. Tool hits the magic link → server issues session cookie
+ *   1. The owner opens dash.aifinpay.io → My Agents → Link an agent →
+ *      Claim via MCP and generates a one-time URL (POST /api/me/claim-url),
+ *      e.g. `https://dash.aifinpay.io/api/auth/verify?token=…`
+ *   2. The owner gives that URL to the agent: "link yourself to my account"
+ *   3. Agent calls this tool with the URL as magic_link_url
+ *   4. Tool POSTs the token to /api/auth/claim → server answers with a
+ *      ten-minute agent-claim grant cookie (not a session)
  *   5. Tool requests a challenge for the owner-selected payment family
  *   6. Tool signs only that address's claim (EIP-191 or Ed25519)
  *   7. Tool POSTs to /api/me/agents/claim → server verifies signature →
  *      agent attached to user's watchlist
  *
+ * Step 4 used to GET the URL. The backend redeems a claim link on that GET
+ * only when the request carries no browser Sec-Fetch headers, so a runtime
+ * whose fetch adds them was sent to the confirm page and linked nothing.
+ * The POST route is told apart by its own path and the link's flow. A
+ * backend without it (404/405) still gets the GET, so this works against any
+ * deployment.
+ *
  * Optional `label` field gives the agent a friendly name in the user's UI.
  *
  * Security model:
@@ -57,7 +65,6 @@ export declare function runAgentClaimSelf(ctx: ToolContext, args: Record<string,
         text: string;
     }[];
 } | {
-    isError?: undefined;
     content: {
         type: string;
         text: string;

package/dist/tools/agent-claim-self.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-claim-self.d.ts","sourceRoot":"","sources":["../../src/tools/agent-claim-self.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,kBAAkB;IAE9B,IAAI;IACJ,WAAW;IAMX,WAAW;QACT,IAAI;QACJ,UAAU;YACR,cAAc;gBACZ,IAAI;gBACJ,WAAW;;YAKb,KAAK;gBACH,IAAI;gBACJ,WAAW;;;QAGf,QAAQ;;IAGV,WAAW;QAAI,YAAY;QAAS,aAAa;QAAS,eAAe;;IACzE,YAAY;QAAI,IAAI;;EAEvB;AAqED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;GAyKtF"}
+{"version":3,"file":"agent-claim-self.d.ts","sourceRoot":"","sources":["../../src/tools/agent-claim-self.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,kBAAkB;IAE9B,IAAI;IACJ,WAAW;IAOX,WAAW;QACT,IAAI;QACJ,UAAU;YACR,cAAc;gBACZ,IAAI;gBACJ,WAAW;;YAKb,KAAK;gBACH,IAAI;gBACJ,WAAW;;;QAGf,QAAQ;;IAGV,WAAW;QAAI,YAAY;QAAS,aAAa;QAAS,eAAe;;IACzE,YAAY;QAAI,IAAI;;EAEvB;AAmGD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;GAqLtF"}

package/dist/tools/agent-claim-self.js

@@ -4,17 +4,25 @@ import { payChain } from "../pay-chains.js";
  * autonomously by signing a claim challenge with its own key.
  *
  * Flow (executed inside the tool, no copy-paste between UIs):
- *   1. User signs in to /login on aifinpay.io → gets a magic-link
- *      email with URL like `https://aifinpay.io/api/auth/verify?token=…`
- *   2. User pastes that URL to the agent: "claim yourself on my account
- *      using this magic link"
- *   3. Agent calls this tool with the magic_link_url
- *   4. Tool hits the magic link → server issues session cookie
+ *   1. The owner opens dash.aifinpay.io → My Agents → Link an agent →
+ *      Claim via MCP and generates a one-time URL (POST /api/me/claim-url),
+ *      e.g. `https://dash.aifinpay.io/api/auth/verify?token=…`
+ *   2. The owner gives that URL to the agent: "link yourself to my account"
+ *   3. Agent calls this tool with the URL as magic_link_url
+ *   4. Tool POSTs the token to /api/auth/claim → server answers with a
+ *      ten-minute agent-claim grant cookie (not a session)
  *   5. Tool requests a challenge for the owner-selected payment family
  *   6. Tool signs only that address's claim (EIP-191 or Ed25519)
  *   7. Tool POSTs to /api/me/agents/claim → server verifies signature →
  *      agent attached to user's watchlist
  *
+ * Step 4 used to GET the URL. The backend redeems a claim link on that GET
+ * only when the request carries no browser Sec-Fetch headers, so a runtime
+ * whose fetch adds them was sent to the confirm page and linked nothing.
+ * The POST route is told apart by its own path and the link's flow. A
+ * backend without it (404/405) still gets the GET, so this works against any
+ * deployment.
+ *
  * Optional `label` field gives the agent a friendly name in the user's UI.
  *
  * Security model:
@@ -29,15 +37,16 @@ export function agentClaimSelfTool() {
         name: "agent_claim_self",
         description: "Link this agent to its owner's AiFinPay dashboard, so the owner sees the agent's " +
             "balance, payments and receipts. Offer this after creating a wallet. The owner " +
-            "generates a one-time URL at https://dash.aifinpay.io → My Agents → Claim via MCP " +
-            "and pastes it here; the tool signs only an AiFinPay claim challenge for this " +
+            "generates a one-time URL at https://dash.aifinpay.io → My Agents → Link an agent → " +
+            "Claim via MCP and gives it to you; pass it here. Do not open the URL in a browser " +
+            "tool: that links nothing. The tool signs only an AiFinPay claim challenge for this " +
             "agent's own address and moves no funds.",
         inputSchema: {
             type: "object",
             properties: {
                 magic_link_url: {
                     type: "string",
-                    description: "The one-time URL from My Agents → Claim via MCP. Looks like " +
+                    description: "The one-time URL from My Agents → Link an agent → Claim via MCP. Looks like " +
                         "https://dash.aifinpay.io/api/auth/verify?token=… — single use, " +
                         "expires 15 minutes after it was generated.",
                 },
@@ -115,16 +124,44 @@ function challengeIsWellFormed(message, address) {
         return false;
     return /^[0-9a-f]{32}$/.test(message.slice(prefix.length));
 }
+/**
+ * The token of a one-time claim URL. Accepts the shape the dashboard hands
+ * out (`/api/auth/verify?token=<hex>`) and `/api/auth/claim/<hex>`. The token
+ * is sent in a POST body, never back in a URL.
+ */
+function claimToken(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return null;
+    }
+    const fromQuery = parsed.pathname.replace(/\/+$/, "") === "/api/auth/verify" ? parsed.searchParams.get("token") : null;
+    const fromPath = parsed.pathname.match(/^\/api\/auth\/claim\/([^/]+)\/?$/)?.[1] ?? null;
+    const token = fromQuery ?? fromPath;
+    return token && /^[A-Za-z0-9_-]{1,256}$/.test(token) ? token : null;
+}
+/** Why the link gave no grant, without echoing the token or server text. */
+function linkRefused(status, code) {
+    const text = code === "claim_link_2fa_account"
+        ? "This AiFinPay account has two-factor sign-in on, so a one-time URL cannot link an agent. " +
+            "Ask the owner to link this wallet by signed message in My Agents (call agent_address for the address)."
+        : `The one-time URL gave no claim grant (HTTP ${status}). It works once and for 15 minutes; ` +
+            "ask the owner for a new one in My Agents → Link an agent → Claim via MCP.";
+    return { isError: true, content: [{ type: "text", text }] };
+}
 export async function runAgentClaimSelf(ctx, args) {
     const magicLinkUrl = typeof args.magic_link_url === "string" ? args.magic_link_url : "";
     const label = typeof args.label === "string" ? args.label : null;
-    if (!magicLinkUrl || !magicLinkUrl.includes("/api/auth/verify?token=")) {
+    const token = claimToken(magicLinkUrl);
+    if (!magicLinkUrl || !token) {
         return {
             isError: true,
             content: [
                 {
                     type: "text",
-                    text: "magic_link_url required — should look like https://aifinpay.io/api/auth/verify?token=…",
+                    text: "magic_link_url required — should look like https://dash.aifinpay.io/api/auth/verify?token=…",
                 },
             ],
         };
@@ -146,27 +183,41 @@ export async function runAgentClaimSelf(ctx, args) {
             content: [{ type: "text", text: "magic_link_url is not a valid URL" }],
         };
     }
-    // ── 1. Establish session by hitting the magic link ─────────────────
+    // ── 1. Redeem the link for a claim grant ───────────────────────────
     let setCookie = null;
     try {
-        const res = await fetch(magicLinkUrl, { redirect: "manual" });
-        setCookie = res.headers.get("set-cookie");
-        if (!setCookie) {
-            return {
-                isError: true,
-                content: [
-                    {
-                        type: "text",
-                        text: `Magic link did not return a session cookie (HTTP ${res.status}). Link may be expired or already used.`,
-                    },
-                ],
-            };
+        const res = await fetch(`${apiBase}/api/auth/claim`, {
+            method: "POST",
+            redirect: "error", // a redirect would leave the origin we vetted
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ token }),
+        });
+        if (res.status === 404 || res.status === 405) {
+            // A backend from before /api/auth/claim: the URL itself is the claim.
+            const legacy = await fetch(magicLinkUrl, { redirect: "manual" });
+            setCookie = legacy.headers.get("set-cookie");
+            if (!setCookie)
+                return linkRefused(legacy.status, null);
+        }
+        else {
+            setCookie = res.headers.get("set-cookie");
+            if (!res.ok || !setCookie) {
+                let code = null;
+                try {
+                    const body = (await res.json());
+                    code = typeof body?.error === "string" ? body.error : null;
+                }
+                catch {
+                    /* not JSON */
+                }
+                return linkRefused(res.status, code);
+            }
         }
     }
     catch {
         return {
             isError: true,
-            content: [{ type: "text", text: "Failed to fetch magic link; no claim was completed." }],
+            content: [{ type: "text", text: "Failed to reach AiFinPay to redeem the link; no claim was completed." }],
         };
     }
     // Some setups split multiple cookies; grab the session one we care about.

package/dist/tools/agent-claim-self.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-claim-self.js","sourceRoot":"","sources":["../../src/tools/agent-claim-self.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,mFAAmF;YACnF,gFAAgF;YAChF,mFAAmF;YACnF,+EAA+E;YAC/E,yCAAyC;QAC3C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,8DAA8D;wBAC9D,iEAAiE;wBACjE,4CAA4C;iBAC/C;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6DAA6D;iBAC3E;aACF;YACD,QAAQ,EAAE,CAAC,gBAAgB,CAAC;SAC7B;QACD,4EAA4E;QAC5E,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;QAClF,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,gBAAgB;AAEhB,MAAM,qBAAqB,GAAG;IAC5B,qBAAqB;IACrB,yBAAyB;IACzB,0BAA0B;IAC1B,yBAAyB;CAC1B,CAAC;AAEF,0EAA0E;AAC1E,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAC;IACvC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACxC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAQ;IAC7B,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,CACL,mBAAmB,MAAM,oCAAoC;YAC7D,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,KAAK,IAAI,OAAO,GAAG,CAAC;IACrD,MAAM,OAAO,GACX,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAA6B;IACrF,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,IAAI,CAAC,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;QACvE,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,wFAAwF;iBAC/F;aACF;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,4CAA4C;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,oDAAoD,GAAG,CAAC,MAAM,yCAAyC;qBAC9G;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qDAAqD,EAAE,CAAC;SACzF,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,SAAS;SAC3B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;IAExC,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,KAAkF;QAElF,eAAe;QACf,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,0BAA0B,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO,EAAE,8CAA8C;YACjE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;YACrE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAgE,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/G,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;QACjF,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,EAAE,EAAE,KAAc;gBAClB,MAAM,EAAE,oFAAoF;aAC7F,CAAC;QACJ,CAAC;QACD,IAAI,UAA6D,CAAC;QAClE,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QAC1E,CAAC;QACD,YAAY;QACZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,sBAAsB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO,EAAE,8CAA8C;YACjE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;YACrE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAsE,CAAC;QAClG,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,WAAW,GACf,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ;YACrC,CAAC,aAAa,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,KAAK,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAClG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,MAAe;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC7C,SAAS,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACjD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA6C,CAAC;YACtE,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7F,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;oBACE,EAAE,EAAE,IAAI;oBACR,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBAChD,eAAe,EAAE,cAAc;oBAC/B,aAAa,EAAE,QAAQ,CAAC,IAAI;oBAC5B,eAAe,EAAE,OAAO;oBACxB,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,MAAM,GAAG;oBACpE,cAAc,EAAE,OAAO;oBACvB,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,MAAM,GAAG;oBACzE,KAAK,EAAE,KAAK,IAAI,IAAI;oBACpB,IAAI,EAAE,2CAA2C,kBAAkB,CAAC,cAAc,CAAC,0HAA0H;iBAC9M,EACD,IAAI,EACJ,CAAC,CACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agent-claim-self.js","sourceRoot":"","sources":["../../src/tools/agent-claim-self.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,mFAAmF;YACnF,gFAAgF;YAChF,qFAAqF;YACrF,oFAAoF;YACpF,qFAAqF;YACrF,yCAAyC;QAC3C,WAAW,EAAE;YACX,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACV,cAAc,EAAE;oBACd,IAAI,EAAE,QAAQ;oBACd,WAAW,EACT,8EAA8E;wBAC9E,iEAAiE;wBACjE,4CAA4C;iBAC/C;gBACD,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,6DAA6D;iBAC3E;aACF;YACD,QAAQ,EAAE,CAAC,gBAAgB,CAAC;SAC7B;QACD,4EAA4E;QAC5E,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;QAClF,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,8EAA8E;AAC9E,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,gBAAgB;AAEhB,MAAM,qBAAqB,GAAG;IAC5B,qBAAqB;IACrB,yBAAyB;IACzB,0BAA0B;IAC1B,yBAAyB;CAC1B,CAAC;AAEF,0EAA0E;AAC1E,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC/C,IAAI,CAAC,GAAG;QAAE,OAAO,qBAAqB,CAAC;IACvC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACxC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,GAAQ;IAC7B,MAAM,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,CACL,mBAAmB,MAAM,oCAAoC;YAC7D,YAAY,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CACtF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,qBAAqB,CAAC,OAAgB,EAAE,OAAe;IAC9D,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,MAAM,GAAG,kBAAkB,KAAK,IAAI,OAAO,GAAG,CAAC;IACrD,MAAM,OAAO,GACX,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GACb,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IACxF,MAAM,KAAK,GAAG,SAAS,IAAI,QAAQ,CAAC;IACpC,OAAO,KAAK,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,MAAc,EAAE,IAAmB;IACtD,MAAM,IAAI,GACR,IAAI,KAAK,wBAAwB;QAC/B,CAAC,CAAC,2FAA2F;YAC3F,wGAAwG;QAC1G,CAAC,CAAC,8CAA8C,MAAM,uCAAuC;YAC3F,2EAA2E,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAgB,EAAE,IAA6B;IACrF,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EAAE,6FAA6F;iBACpG;aACF;SACF,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,4CAA4C;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,iBAAiB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO,EAAE,8CAA8C;YACjE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7C,sEAAsE;YACtE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjE,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS;gBAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC1B,IAAI,IAAI,GAAkB,IAAI,CAAC;gBAC/B,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;oBACvD,IAAI,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC7D,CAAC;gBAAC,MAAM,CAAC;oBACP,cAAc;gBAChB,CAAC;gBACD,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sEAAsE,EAAE,CAAC;SAC1G,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,MAAM,YAAY,GAAG,SAAS;SAC3B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC;IACjD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC;IAExC,KAAK,UAAU,QAAQ,CACrB,OAAe,EACf,KAAkF;QAElF,eAAe;QACf,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,0BAA0B,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO,EAAE,8CAA8C;YACjE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;YACrE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAgE,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,OAAO,EAAE,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,EAAE,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/G,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;QACjF,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;YAChD,OAAO;gBACL,EAAE,EAAE,KAAc;gBAClB,MAAM,EAAE,oFAAoF;aAC7F,CAAC;QACJ,CAAC;QACD,IAAI,UAA6D,CAAC;QAClE,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;QAC1E,CAAC;QACD,YAAY;QACZ,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,sBAAsB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO,EAAE,8CAA8C;YACjE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,YAAY,EAAE;YACrE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,UAAU,EAAE,CAAC;SAC9E,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAsE,CAAC;QAClG,MAAM,aAAa,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACtE,MAAM,WAAW,GACf,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ;YACrC,CAAC,aAAa,KAAK,SAAS;gBAC1B,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE;gBAC1D,CAAC,CAAC,EAAE,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,KAAK,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;QAClG,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,UAAU,WAAW,CAAC,MAAe;QACxC,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC7C,SAAS,EAAE,MAAM,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;iBACpE,CAAC,CAAC,CAAC;YACN,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YACjD,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAA6C,CAAC;YACtE,OAAO,MAAM,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAC7C,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;aAC7F,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,aAAa,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,kBAAkB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;SACzG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,MAAM,cAAc,GAAG,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,OAAO;QACL,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;oBACE,EAAE,EAAE,IAAI;oBACR,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBAChD,eAAe,EAAE,cAAc;oBAC/B,aAAa,EAAE,QAAQ,CAAC,IAAI;oBAC5B,eAAe,EAAE,OAAO;oBACxB,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,SAAS,CAAC,MAAM,GAAG;oBACpE,cAAc,EAAE,OAAO;oBACvB,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,YAAY,CAAC,MAAM,GAAG;oBACzE,KAAK,EAAE,KAAK,IAAI,IAAI;oBACpB,IAAI,EAAE,2CAA2C,kBAAkB,CAAC,cAAc,CAAC,0HAA0H;iBAC9M,EACD,IAAI,EACJ,CAAC,CACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aifinpay/mcp",
-  "version": "2.12.1",
+  "version": "2.12.2",
   "mcpName": "io.github.daochild/aifinpay",
   "description": "AiFinPay MCP: persistent local agent wallets, owner-configured EVM and Solana payment adapters, durable budgets and receipt recovery.",
   "type": "module",
@@ -77,7 +77,7 @@
   "bugs": "https://github.com/AiFinPay/sdk/issues",
   "dependencies": {
     "@aifinpay/agent": "^2.9.0",
-    "@aifinpay/skill": "^2.10.2",
+    "@aifinpay/skill": "^2.11.0",
     "@modelcontextprotocol/sdk": "^1.32.1",
     "bs58": "^6.0.0",
     "tweetnacl": "^1.0.3"

package/skills/SKILL.md

@@ -6,7 +6,7 @@ description: Pay for x402-gated APIs and sites as an agent (AIFP-1 on an owner-s
   wallet, payment history, prepaid quotas and Agent Passport records through
   the AiFinPay MCP server or SDK.
 license: MIT
-version: 2.10.2
+version: 2.11.0
 author: AiFinPay Support
 metadata:
   hermes:
@@ -61,7 +61,7 @@ your language. There is no "install together" scenario.
 
 ## Version and release status
 
-Release target: MCP **2.11.3**, Node SDK **2.9.0**, Python **2.7.0**.
+Release target: MCP **2.12.1**, Node SDK **2.9.0**, Python **2.7.1**.
 This skill describes that coordinated package cohort. Check the installed
 versions before using its additional-network instructions; a release target
 does not establish npm/PyPI publication or production network activation.
@@ -71,7 +71,7 @@ Published packages remain usable within their documented capabilities.
 
 | Surface | Can it pay? |
 |---|---|
-| MCP `@aifinpay/mcp` 2.11.x | `payable_fetch`, only with a persistent wallet and every owner limit set; it is always listed and, until then, answers with the setup checklist instead of signing. `payment_setup_status` is the read-only checklist with one `next_step` and, from 2.11.3, `funding`: the amount to fund at today's rate. Polygon is the default; other networks require explicit `AIFINPAY_PAY_CHAIN`. The merchant and backend must authorize and serve that network. `scope: "merchant"` buys a site-wide batch. |
+| MCP `@aifinpay/mcp` 2.12.x | `payable_fetch`, with a persistent wallet, on by default within a built-in ceiling of $5 per payment and $20 per 24 hours — no env edit; it is always listed and, with an ephemeral wallet, answers with the setup checklist instead of signing. `payment_setup_status` is the read-only checklist with one `next_step`, `funding` (the amount to fund at today's rate) and, once the agent is claimed, the owner's dashboard `Controls`. Polygon is the default; other networks require explicit `AIFINPAY_PAY_CHAIN`. The merchant and backend must authorize and serve that network. `scope: "merchant"` buys a site-wide batch. On 2.11.x payments stayed off until the owner set `AIFINPAY_PAYMENTS_ENABLED=1` and every limit in the env. |
 | Node `@aifinpay/agent` 2.8.x | `fetchPaid` with a v14 journal, gas cap and owner budgets. Select another network with `v14.chain`; select a pinned stablecoin with `v14.asset`. Native payments require an independent native/USD rate. |
 | Python `aifinpay-agent` 2.7.x | `agent.fetch_paid(url, allowed_origins=…, max_amount_usd=…, daily_amount_usd=…)`; use explicit `chain` and the chain's native gas cap for another network, or a pinned stablecoin `asset`. `agent.recover_paid(journal_path)` recovers the original transaction. |
 
@@ -166,71 +166,74 @@ or event log alone does not prove a valid paid request.
 
 # AiFinPay agent workflow
 
-Use the tools actually returned by MCP tools/list. MCP 2.11.0 exposes
+Use the tools actually returned by MCP tools/list. MCP 2.12.1 exposes
 agent_address, agent_reload, agent_claim_self, agent_history, agent_quota,
 agent_passport_resolve, settlement_routes, settlement_invoice,
 deployment_info, `payment_setup_status` and `payable_fetch`. `payable_fetch`
-is listed from the first start; until the owner has enabled payments and set
-every limit it returns the same checklist as `payment_setup_status` and signs
-nothing. With AIFINPAY_MODE=dev it also exposes dev_payment_quote. Never tell
-a user a payment was sent because a quote or invoice was created.
+is listed from the first start and pays by default from a persistent wallet,
+within the built-in ceiling; with an ephemeral wallet, or when the owner
+switched payments off with `AIFINPAY_PAYMENTS_ENABLED=0`, it returns the same
+checklist as `payment_setup_status` and signs nothing. With AIFINPAY_MODE=dev
+it also exposes dev_payment_quote. Never tell a user a payment was sent
+because a quote or invoice was created.
 
 `settlement_routes` lists the AIFP-1 v1.4 routes first (Polygon and Base,
 `live: true` when served) and the older splitter v1.3 routes under
 `legacy_v13`. Only the v1.4 section says whether `payable_fetch` can pay; a
 v1.3 route marked not live does not mean the network is disabled.
 
-## First payment in five steps
-
-A fresh install reaches its first payment in five steps. Each one is a
-single tool call or command; signing happens only in step 5, and only after
-the owner has set every limit in step 4. Do not improvise around a missing
-step — no key handling of your own, no funding of an ephemeral address.
-
-1. **Read the price.** `GET` the resource. The `402` names the merchant
-   (`merchant_id`), the price per request and the smallest batch (for
-   example `$0.10` for 200 standard requests).
-2. **Check the setup.** Call `payment_setup_status`. It returns the wallet
-   (`persistent` or ephemeral), `payments_enabled`, which owner limits are
-   set, the balance when the RPC answers, `funding` (what a persistent wallet
-   needs, priced now), `ready`, and `next_step` — the one thing still
-   missing. Follow `next_step`; do not skip ahead.
-3. **Persistent wallet.** If `wallet.persistent` is false, run the exact
-   command in `next_step` (it is `npx @aifinpay/mcp init`, prefixed with
-   `AIFINPAY_HOME=…` when the server uses its own wallet directory — keep
-   that prefix, or the server will not see the keystore). Without a terminal
-   init does not prompt: it generates the passphrase, writes the keystore and
-   prints one JSON document with `addresses` and an `env` block. Put that
-   `env` into the `aifinpay` server entry of the MCP client config (the
-   passphrase is only there — the output is a secret, and a second run never
-   reprints it), then call `agent_reload`: it reads the keystore and switches
-   this server to the persistent wallet. If init answers that a keystore
-   already exists and cannot be opened, do not delete or replace it: follow
-   its `next_step` and start a new wallet directory. Never fund an ephemeral
-   address.
-4. **Fund and enable.** Tell the owner `addresses.evm` and the amount: the
-   batch price in the pay chain's native currency at today's rate plus the
-   gas cap. Take it from `payment_setup_status` — its `funding` field prices
-   the smallest batch now and adds the owner's gas cap into `amount`. The
-   rate moves (on 2026-10-19 one `$0.10` batch was 1.08 POL), so never
-   quote a remembered number; if `funding` has a `rate_error` and no
-   `amount`, ask the owner to fund "the batch price in POL at today's rate
-   plus the gas cap" and name no number. When the owner confirms funding,
-   they add the payment settings from "Paying with payable_fetch" below —
-   with their real origin, and USD values that are a ceiling they will not
-   need to revisit (the working limits are set in the dashboard, see "After
-   creating a wallet") — to the same `env`. **Limits are read only when the server starts**:
-   `agent_reload` re-reads the keystore and nothing else, so after the env
-   changes the client has to restart the `aifinpay` MCP server (restart the
-   client, or disable and re-enable the server in it). Until that restart
-   `payment_setup_status` keeps reporting `payments_enabled: false`; that is
-   expected, not a refusal — say so, ask the owner for the restart, and stop.
-   After it, `payment_setup_status` reports `ready: true`. Funding, origins
-   and limits are the owner's decisions; never choose them yourself.
-5. **Pay.** `payable_fetch({"url":"<origin><path>"})` (add
+## First payment in four steps
+
+A fresh install reaches its first payment in four steps. Each one is a
+single tool call or command; signing happens only in the last step, and only
+from a persistent wallet. Nobody edits the MCP client config to enable
+payments: they are on from the first start, within the built-in ceiling ($5
+per payment, $20 per 24 hours). Do not improvise around a missing step — no
+key handling of your own, no funding of an ephemeral address.
+
+1. **Init.** Call `payment_setup_status`. It returns the wallet (`persistent`
+   or ephemeral), `payments_enabled`, the limits in force with their source
+   (`default` or `env`), the balance when the RPC answers, `funding` (what a
+   persistent wallet needs, priced now), `dashboard` (whether the agent is
+   linked and, if so, the owner's Controls), `ready`, and `next_step` — the
+   one thing still missing. Follow `next_step`; do not skip ahead. If
+   `wallet.persistent` is false, run the exact command in `next_step` (it is
+   `npx @aifinpay/mcp init`, prefixed with `AIFINPAY_HOME=…` when the server
+   uses its own wallet directory — keep that prefix, or the server will not
+   see the keystore). Without a terminal init does not prompt: it generates
+   the passphrase, writes the keystore and prints one JSON document with
+   `addresses` and an `env` block. Put that `env` into the `aifinpay` server
+   entry of the MCP client config (the passphrase is only there — the output
+   is a secret, and a second run never reprints it), then call
+   `agent_reload`: it reads the keystore, switches this server to the
+   persistent wallet and turns the payment journal on in the same connection
+   — no restart. If init answers that a keystore already exists and cannot
+   be opened, do not delete or replace it: follow its `next_step` and start
+   a new wallet directory. Never fund an ephemeral address.
+2. **Fund.** Tell the owner `addresses.evm` and the amount: the batch price
+   in the pay chain's native currency at today's rate plus the gas cap. Take
+   it from `payment_setup_status` — its `funding` field prices the smallest
+   batch now and adds the gas cap into `amount`. The rate moves (on
+   2026-10-19 one `$0.10` batch was 1.08 POL), so never quote a remembered
+   number; if `funding` has a `rate_error` and no `amount`, ask the owner to
+   fund "the batch price in POL at today's rate plus the gas cap" and name
+   no number. Funding is the owner's decision; never choose the amount
+   yourself.
+3. **Link.** Offer the dashboard (see "After creating a wallet"): the owner
+   generates a one-time URL at https://dash.aifinpay.io → My Agents → Claim
+   via MCP and pastes it; call `agent_claim_self`. From then on the owner
+   sets the working limits in Controls and `payment_setup_status` shows them
+   in `dashboard`. The owner may skip this for a first test; the ceiling
+   still applies.
+4. **Pay.** `payable_fetch({"url":"<origin><path>"})` (add
    `"scope":"merchant"` for a site-wide batch) buys the batch and returns the
    content with the receipt summary. Later requests reuse the batch.
 
+If `payment_setup_status` reports `payments_enabled: false`, the owner set
+`AIFINPAY_PAYMENTS_ENABLED=0` in the server's env: say so and stop — only the
+owner removes it, and the server has to be restarted afterwards (env is read
+at start; `agent_reload` does not read it).
+
 ## "Buy access for this site"
 
 The owner can start with one sentence — "buy access for this site", "get me
@@ -252,17 +255,18 @@ into ratersapp.com", "купи доступ до цього сайту". Handle
    separate, in the selected network's native currency. Use the display rules
    in "Transaction display" below.
 4. **Check readiness.** Call `payment_setup_status`. If it is not `ready`,
-   follow its `next_step` through "First payment in five steps" above: a
-   persistent wallet first, then the owner's funding and environment block
-   with this origin in `AIFINPAY_GATEWAY_ORIGINS` (and
-   `AIFINPAY_GATEWAY_PATH_MODE=direct` when the 402 comes from the site
-   itself) — and stop until the owner has done their part. Env changes take
-   effect only after the client restarts the `aifinpay` server; `agent_reload`
-   does not read them. Adding a site, raising a limit and funding the wallet
-   are the owner's decisions; never make them on your own initiative.
+   follow its `next_step` through "First payment in four steps" above: a
+   persistent wallet first, then the owner's funding — and stop until the
+   owner has done their part. No environment block is needed: without an
+   owner allowlist, MCP 2.12.1 pays only a merchant that verified this very
+   site with AiFinPay. Raising a limit and funding the wallet are the owner's
+   decisions; never make them on your own initiative.
 5. **Buy.** `payable_fetch({"url":"<origin><path>","scope":"merchant"})`, where
    the path is what the owner wants to read, or a standard resource from the
-   discovery document.
+   discovery document. If it answers "Not paid: merchant … has not verified
+   its site" or "is verified for X, not Y", nothing was paid: tell the owner
+   the site's AiFinPay merchant has not verified this site, and stop. Do not
+   look for another way to pay it.
 6. **Report and reuse.** Give the amount, the transaction hash with its
    explorer link, the receipt id and the remaining units. Later requests to any
    path on that origin go through `payable_fetch` and spend the same batch, with
@@ -278,27 +282,39 @@ default `scope`.
 
 ## Paying with payable_fetch
 
-The owner configures these MCP environment values once (example values; the
-USD ones are a ceiling, not a budget):
+Nothing has to be configured to pay. The MCP server pays by default from a
+persistent wallet within a built-in ceiling — **$5 per payment, $20 per
+rolling 24 hours**, gas capped at 0.3 POL on Polygon — and only to a merchant
+that verified the very site being fetched with AiFinPay (on the hosted
+gateway, any verified merchant). The payee is the merchant the AiFinPay quote
+names, never an address a `402` claims. The day-to-day limits —
+per-payment cap, daily cap, pause, allowed merchants — are the dashboard
+**Controls** once the agent is claimed (see "After creating a wallet" below);
+the backend enforces them on every quote and payment, with no env change and
+no server restart. A payment has to pass both.
+
+The env values are optional overrides the owner may set in the MCP client
+config (read when the server starts; the client then restarts the server):
 
 ```json
 {
-  "AIFINPAY_PAYMENTS_ENABLED": "1",
+  "AIFINPAY_MAX_USD": "2",
+  "AIFINPAY_DAILY_USD": "10",
   "AIFINPAY_GATEWAY_ORIGINS": "https://merchant.example",
-  "AIFINPAY_GATEWAY_PATH_MODE": "direct",
-  "AIFINPAY_MAX_USD": "5",
-  "AIFINPAY_DAILY_USD": "20",
   "AIFINPAY_MAX_GAS_POL": "0.3"
 }
 ```
 
-`AIFINPAY_MAX_USD` and `AIFINPAY_DAILY_USD` are the ceiling the SDK requires
-before it signs with the owner's key: set once, high enough not to need
-revisiting, and left alone. The day-to-day limits — per-payment cap, daily
-cap, pause, allowed sites — are the dashboard **Controls** once the agent is
-claimed (see "After creating a wallet" below); the backend enforces them on
-every quote and payment, with no env change and no server restart. A payment
-has to pass both. The smallest batch is **$0.10 plus gas** on **Polygon**;
+Every override only narrows. `AIFINPAY_MAX_USD` / `AIFINPAY_DAILY_USD` can
+lower the ceiling, never raise it: a value above $5 / $20 stops the server at
+start with a message that points to the dashboard, and is never silently
+clipped. A higher limit is a dashboard decision, or the Node SDK with its own
+budgets. `AIFINPAY_GATEWAY_ORIGINS` narrows the sites to exact https origins;
+`AIFINPAY_GATEWAY_PATH_MODE` is inferred from the origin (`gateway` for
+gateway.aifinpay.io, `direct` elsewhere) unless set. `AIFINPAY_PAYMENTS_ENABLED=0`
+switches payments off. Never ask the owner to add any of these to pay; only
+mention them when the owner asks for a different ceiling or a site allowlist.
+The smallest batch is **$0.10 plus gas** on **Polygon**;
 `AIFINPAY_MAX_USD` only has to be at or above the batch. The gas cap has to cover the
 worst-case fee: at ~280 gwei that is about 0.10 POL for a POL payment and
 0.21 POL for USDC, and a lower cap refuses before anything is signed. The fee
@@ -389,10 +405,11 @@ Once the agent is claimed, the dashboard is where the owner manages its
 working limits: **Controls** on the agent's page sets the per-payment cap, the
 daily cap, pause and the allowed sites, and the backend enforces that policy
 on every `/v1/quote` and `/v1/pay` for the claimed agent — no env change, no
-server restart. The env values (`AIFINPAY_MAX_USD`, `AIFINPAY_DAILY_USD`, the
-gas cap, the origins) stay as the ceiling the SDK requires before it signs;
-they do not replace the dashboard, and the dashboard does not replace them —
-a payment has to pass both. Dashboard controls do not reach transactions sent
+server restart; `payment_setup_status` reads them back as `dashboard`. The
+MCP's local ceiling ($5 per payment and $20 per day, or the owner's
+`AIFINPAY_MAX_USD` / `AIFINPAY_DAILY_USD`) stays underneath; it does not
+replace the dashboard, and the dashboard does not replace it — a payment has
+to pass both. Dashboard controls do not reach transactions sent
 directly outside AiFinPay. After `agent_claim_self`, point the owner at
 Controls rather than at the config file when they want to change a limit.