@cmdoss/suipay-mcp 0.2.1 → 0.2.2-dev.1

package/dist/http-BnIjiwcR.d.ts

@@ -1,1149 +0,0 @@
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';
-
-/**
- * Resolve which grant policy target may pay a seller offer's targetHash (WS7.6).
- *
- * SINGLE SOURCE — consent validation and MCP pay MUST use this helper.
- * Never inline "find policy by hash" in tools or consent UI.
- *
- * Seller offer carries targetHash only (no buyer policyId). Buyer authority
- * is the OAuth grant snapshot of policies/targets at consent time.
- */
-type GrantLifecycleStatus = 'pending' | 'active' | 'paused' | 'revoked' | 'expired';
-type PolicyLifecycleStatus = 'draft' | 'active' | 'paused' | 'revoked';
-interface GrantTargetBinding {
-    /** 32-byte hex target hash. */
-    targetHash: string;
-    /** Optional per-target ceiling (atomic units). */
-    maxPerPayment?: string;
-    /**
-     * The address this target pays, when the authority source records one.
-     * Carried for callers that want to pin the payee before signing; target
-     * resolution itself matches on {@link targetHash} alone, because the offer's
-     * `payTo` is what the settlement actually pays.
-     */
-    recipient?: string;
-}
-interface GrantPolicyBinding {
-    /** Off-chain policy id (for audit). */
-    policyId: string;
-    /** On-chain policy id (u64) inside SpendAccount. */
-    onChainPolicyId: number | string;
-    status: PolicyLifecycleStatus;
-    targets: readonly GrantTargetBinding[];
-}
-/**
- * Immutable snapshot of buyer authority for one OAuth grant.
- * Pool/grant object ids come from finalized on-chain objects (or fake in WS6B).
- */
-interface GrantSnapshot {
-    grantId: string;
-    status: GrantLifecycleStatus;
-    grantObjectId: string | null;
-    poolObjectId: string;
-    coinType: string;
-    delegateAddress: string;
-    policies: readonly GrantPolicyBinding[];
-    /**
-     * `open` = open-recipient (no allowlist, caps required); `scoped` / omit = policy-bound.
-     */
-    accessMode?: 'scoped' | 'open';
-    /** Grant-level max per payment (atomic); used for open and as a grant ceiling. */
-    maxPerPayment?: string | null;
-    /** Grant-level session cap (atomic); open requires a positive value. */
-    sessionCap?: string | null;
-}
-type ResolveGrantTargetResult = {
-    ok: true;
-    policyId: string;
-    onChainPolicyId: number | string;
-    targetHash: string;
-    maxPerPayment?: string;
-    poolObjectId: string;
-    grantObjectId: string;
-    coinType: string;
-    delegateAddress: string;
-} | {
-    ok: false;
-    reason: string;
-};
-/**
- * Pick the policy target that matches offer.targetHash under an active grant.
- * Pause/revoke of grant or policy fails closed without decrypting the delegate.
- */
-declare function resolveGrantTarget(snapshot: GrantSnapshot, offerTargetHash: string): ResolveGrantTargetResult;
-
-/**
- * Public authorization facts exposed to authenticated MCP clients.
- *
- * This shape is descriptive only. Payment authorization continues to use the
- * immutable on-chain GrantSnapshot; callers must never derive spend authority
- * from this object.
- */
-interface McpAccessProfile {
-    id: string;
-    name: string;
-    status: 'active' | 'disabled';
-}
-interface McpAccessTarget {
-    serviceId: string;
-    /** Friendly seller service name (live catalog), or serviceId if unresolved. */
-    name: string;
-    endpointId: string;
-    method: string;
-    path: string;
-    targetHash: string;
-    maxPerPayment: string;
-}
-interface McpAccessPolicy {
-    id: string;
-    name: string;
-    status: 'draft' | 'active' | 'paused' | 'revoked';
-    asset: string;
-    coinType: string;
-    totalCap: string;
-    spent: string;
-    maxPerPayment: string;
-    expiresAt: string | null;
-    targets: McpAccessTarget[];
-}
-interface McpAccessContext {
-    accessMode: 'scoped' | 'open';
-    grant: {
-        id: string;
-        status: 'pending' | 'active' | 'paused' | 'revoked' | 'expired';
-        sessionCap: string | null;
-        sessionSpent: string;
-        expiresAt: string | null;
-    };
-    profiles: McpAccessProfile[];
-    policies: McpAccessPolicy[];
-}
-
-/**
- * Shared vocabulary for both 402 dialects.
- *
- * The central claim of this PoC is that MPP and x402 are two encodings of one
- * payment offer, not two payment systems. Everything below the dialect codecs
- * therefore speaks in these types; only `mpp.ts` and `x402.ts` know about
- * headers and JSON bodies.
- */
-
-/** Payment intent on a signed offer. Default / omitted = one-shot charge. */
-type PaymentIntent = 'charge' | 'subscription';
-/** Proof of settlement, returned alongside the resource. */
-interface Receipt {
-    challengeId: string;
-    /** On-chain transaction digest. */
-    txDigest: string;
-    network: string;
-    payer: string;
-    /** Gross amount settled (atomic units). */
-    amount: string;
-    asset: string;
-    status: 'settled';
-    /**
-     * Canonical requestDigest this settlement paid for. Bound to `txDigest` so
-     * a receipt proves one specific HTTP request was settled on chain.
-     */
-    requestDigest?: string;
-    /** Seller net proceeds (atomic units). Explicit fee semantics; PoC equals amount. */
-    netAmount?: string;
-    /** Facilitator platform fee (atomic units). PoC is `"0"`. */
-    platformFee?: string;
-    /** Payment intent when settled via a non-charge flow (e.g. subscription). */
-    intent?: PaymentIntent;
-    /** Subscription mandate object id when intent=subscription. */
-    mandateId?: string;
-    /** Clock-derived period index that was charged (subscription). */
-    periodIndex?: string;
-    /**
-     * Canonical payment_key hex when settlement opened a RefundVault (refundable).
-     * Used as the durable delivery-success key and operator-refund identity.
-     */
-    paymentKey?: string;
-    /** Shared vault object id when refundable. */
-    vaultId?: string;
-    /** Pinned refund beneficiary from VaultOpened when refundable. */
-    refundTo?: string;
-    /**
-     * Canonical `GrantCap` object id this settlement drew against (shared_pool
-     * rail only). `padObjectId` form — the SAME identity the session receipt
-     * ledger keys by (`sessionIdForGrant`), so the durable projection and the
-     * session ledger converge on one grant id. Absent for non-shared_pool rails
-     * and refundable-vault settlements, which carry no PaymentMade grant.
-     */
-    grantId?: string;
-    /**
-     * Canonical `SpendAccount` object id the grant draws from (shared_pool rail
-     * only). Absent wherever `grantId` is.
-     */
-    poolId?: string;
-}
-/** Which encoding a message used. Recorded so the provider can answer in kind. */
-type Dialect = 'mpp' | 'x402';
-
-/**
- * Canonical settlement and payment-list rows.
- *
- * The gateway HTTP handlers project into these shapes; they do not own them.
- * Wire codecs stay in `src/protocol`. Owner/control-plane rows live here so
- * `buyer-control` never imports types from `gateway/app`.
- */
-
-/**
- * The canonical `/v1/settlements` wire row. Both settlement sources — the live
- * in-memory feed and the durable read model — normalize to this shape so the
- * response is byte-stable regardless of whether a read model (DATABASE_URL) is
- * configured. Consumers (MCP `receipts` tool, buyer/seller console) read
- * `receipt.txDigest`; a source that returns its own native shape breaks them.
- */
-interface SettlementDTO {
-    at: string;
-    resourceId?: string;
-    recipient: string;
-    dialect?: Dialect;
-    receipt: {
-        challengeId: string;
-        txDigest: string;
-        network: string;
-        payer: string;
-        amount: string;
-        asset: string;
-        status: 'settled';
-    };
-    /**
-     * Present only on the live in-memory feed. The read model dedups on
-     * (network, digest), so a durable row is never a replay — the field is
-     * omitted there rather than asserted false. Consumers must treat absent as
-     * not-replayed.
-     */
-    replayed?: boolean;
-}
-
-/**
- * Authenticated MCP request context (remote Streamable HTTP).
- * Bearer is required on /mcp; tools enforce scope from the resolved grant.
- */
-
-/**
- * Read/prepare-only shared-pool context for an authenticated MCP bearer.
- *
- * Non-custodial: the gateway holds NO key that can spend. There is deliberately
- * no `decryptDelegateSeed` and no forwarded `sponsorAuthorization` here — the
- * `pay` tool only PREPARES an unsigned `spend_account::settle_policy_payment` transaction from the
- * immutable grant snapshot (`prepareSpendAccountPayment`), and the client that
- * holds the delegate key signs locally and submits. Only signatures ever reach
- * the gateway. See docs/design/mcp-non-custodial-signing.md and ADR-0013 §3.
- */
-interface McpSpendAccountPayAuth {
-    snapshot: GrantSnapshot;
-    packageId: string;
-    /**
-     * Re-verify the paying authority against a FRESH graph + injected clock at
-     * prepare time. Throws on drift/expiry so the pay tool refuses to hand back a
-     * signing request for a grant that just went paused/revoked/expired. Optional:
-     * absent for legacy/local paths.
-     */
-    assertLive?: () => Promise<void>;
-}
-interface McpAuthContext {
-    grantId: string;
-    buyerAccountId: string;
-    /** Space-separated scopes from the access token. */
-    scope: string;
-    /** Public, descriptive policy context. Never used as payment authority. */
-    access?: McpAccessContext;
-    /**
-     * When present, `pay` prepares unsigned spend_account::settle_policy_payment bytes for the
-     * client-held delegate key to sign locally — no server-side decrypt or
-     * signing. Stdio local V1 profile path remains when absent.
-     */
-    spendAccountPay?: McpSpendAccountPayAuth;
-    /**
-     * Server-scoped receipts reader, built by the /mcp route from the verified
-     * bearer's connection. The `receipts` tool calls this instead of hitting the
-     * global settlement feed with a forwarded credential — the bearer never
-     * enters the tool surface, and scoping is enforced server-side. Absent for
-     * local stdio (no connection, no settlement source).
-     */
-    listReceipts?: (challengeId?: string) => Promise<SettlementDTO[]>;
-}
-
-interface McpConfig {
-    consoleUrl: string;
-    gatewayUrl: string;
-    rpcUrl: string;
-    network: 'testnet' | 'mainnet' | 'devnet' | 'localnet';
-    packageId: string;
-    recipient: string;
-    coinType: string;
-    sponsorUrl: string;
-    minFunded: bigint;
-    minMaxPerPayment: bigint;
-    label: string;
-}
-declare function loadMcpConfig(env?: NodeJS.ProcessEnv): McpConfig;
-
-/**
- * Grant-scoped read ergonomics for a delegate agent.
- *
- * Two kinds of read, mirroring the epic's public/private split:
- *
- *   1. Enriched-context reads ({@link createReader}) — the private,
- *      off-chain-enriched projections behind P2's signed routes
- *      (`GET /v1/delegate/{balance,policies,receipts}`). Each request is signed
- *      with the four `x-suipay-*` headers (via the P0-backed signing helper),
- *      so the gateway resolves the caller's grant and returns ONLY that grant's
- *      state. Non-2xx responses are classified, never swallowed.
- *
- *   2. Direct on-chain reads ({@link readPublicGrantState} /
- *      {@link readPublicSpendAccountState}) — the PUBLIC on-chain facts (delegate, caps,
- *      spend, policy ids, pause/revoke, pool balance) read straight from a
- *      `getObject` projection with no signature. Public data stays public.
- *
- * The read client never spends and never holds the private key: money still
- * moves only through the delegate's own on-chain `spend_account::settle_policy_payment`.
- */
-
-/**
- * Fetch the Move JSON contents of an object. Wire this to
- * `client.core.getObject({ objectId, include: { json: true } })` and return its
- * `object.json`. `null` for a missing object. Injected so the reader is pure and
- * testable with fakes and depends on no Sui client at load time.
- */
-type GetObjectJson = (objectId: string) => Promise<Record<string, unknown> | null | undefined>;
-
-/**
- * Non-MCP SDK/REST delegated-signer payer (Phase C1).
- *
- * MPP pay-then-prove over `spend_account::settle_policy_payment` with a bring-your-own
- * delegated key. Mirrors packages/mcp/src/spend-account-pay.ts but:
- *   - gas: agent-provided coins (default when configured) OR sponsored gas
- *     gated by sponsor personal-message challenge (Phase C2 / ADR-0008)
- *   - never enables x402 transaction-submit for shared_pool (stays gated)
- *
- * Order is load-bearing on the money path (no step may run before the prior):
- *   1. Bound the offer FIRST — the gateway secret's HMAC over it, the agent's
- *      own SpendIntent, or both; at least one is required. Nothing else
- *      (ledger, capability, hashing) runs before this.
- *   2. Request-binding + offer-expiry checks.
- *   3. ATOMIC reserve on the REQUIRED payment-attempt ledger (payment_id).
- *      - reserved  -> this attempt owns the id; may proceed to build/sign
- *      - done      -> return validated prior ok/ambiguous (no re-sign)
- *      - in_flight -> another attempt is mid-flight; return ambiguous (no sign)
- *      Reserve failure fails closed: never sign without a durable claim.
- *   4. Execution-capability check (submitter present). After reserve so a
- *      prior done result is never lost when capability is unavailable.
- *   5. Derive payment_id_hash / terms_hash.
- *   6. Build the full executable pay transaction (real shared-object versions).
- *   7. Validate-before-sign (built tx encodes exactly the intended pay; gas may differ).
- *   8. Sign, 9. execute, 10. complete(ledger) with terminal ok/ambiguous, settle.
- *
- * Exactly-once for concurrent pay() on the same payment_id is the ledger
- * reserve CAS (memory: sync check-and-insert; Postgres: INSERT ON CONFLICT).
- * Settlement single-use on chain is the pool-scoped payment_id_hash replay
- * marker inside pay. The durable ChallengeStore is a delivery/proof CAS
- * (prevents a second proof/delivery for the same challenge), not the money
- * CAS (see ADR-0002).
- */
-
-type DelegatedPayStatus = 'ok' | 'failed' | 'ambiguous';
-/**
- * Closed set of caller-visible error codes. Never surface a gateway-controlled
- * header, token, or body string as `code`.
- */
-declare const DELEGATED_PAY_ERROR_CODES: {
-    readonly OFFER_SECRET_REQUIRED: "OFFER_SECRET_REQUIRED";
-    readonly CHALLENGE_TAMPERED: "CHALLENGE_TAMPERED";
-    readonly CHALLENGE_EXPIRED: "CHALLENGE_EXPIRED";
-    readonly MALFORMED_CHALLENGE: "MALFORMED_CHALLENGE";
-    readonly POLICY_REJECTED: "POLICY_REJECTED";
-    readonly GRANT_DENIED: "GRANT_DENIED";
-    readonly BUILD_FAILED: "BUILD_FAILED";
-    readonly TX_MISMATCH: "TX_MISMATCH";
-    readonly SIGN_FAILED: "SIGN_FAILED";
-    readonly EXECUTE_UNAVAILABLE: "EXECUTE_UNAVAILABLE";
-    readonly EXECUTE_AMBIGUOUS: "EXECUTE_AMBIGUOUS";
-    readonly FINALITY_AMBIGUOUS: "FINALITY_AMBIGUOUS";
-    readonly FINALIZATION_TIMEOUT: "FINALIZATION_TIMEOUT";
-    readonly SETTLEMENT_REJECTED: "SETTLEMENT_REJECTED";
-    readonly PROOF_PRESENTATION_FAILED: "PROOF_PRESENTATION_FAILED";
-    readonly GATEWAY_REFUSED: "GATEWAY_REFUSED";
-    readonly UNSUPPORTED_REQUEST: "UNSUPPORTED_REQUEST";
-    readonly IDEMPOTENT_PRIOR: "IDEMPOTENT_PRIOR";
-    readonly PAYMENT_LEDGER_REQUIRED: "PAYMENT_LEDGER_REQUIRED";
-    readonly SHARED_OBJECT_RESOLVE_FAILED: "SHARED_OBJECT_RESOLVE_FAILED";
-    /** Atomic reserve or complete could not be persisted; never sign unprotected. */
-    readonly PAYMENT_LEDGER_FAILED: "PAYMENT_LEDGER_FAILED";
-    /** Another attempt holds the in-flight reservation for this payment_id. */
-    readonly PAYMENT_ATTEMPT_IN_FLIGHT: "PAYMENT_ATTEMPT_IN_FLIGHT";
-    /** Platform sponsor challenge/create/execute failed or returned unusable data. */
-    readonly SPONSOR_UNAVAILABLE: "SPONSOR_UNAVAILABLE";
-    /** Sponsored bytes did not reconstruct the intended pay. */
-    readonly SPONSORED_TX_MISMATCH: "SPONSORED_TX_MISMATCH";
-    /** Personal-message signature is required for sponsored gas. */
-    readonly PERSONAL_MESSAGE_SIGN_REQUIRED: "PERSONAL_MESSAGE_SIGN_REQUIRED";
-    /** Resource answered a non-402 4xx (or other non-2xx client class): rejected. */
-    readonly RESOURCE_REJECTED: "RESOURCE_REJECTED";
-    /** Resource answered a non-402 5xx: temporarily unavailable, not a rejection. */
-    readonly RESOURCE_UNAVAILABLE: "RESOURCE_UNAVAILABLE";
-    /** No finality reader configured: refuse to sign a pay we cannot confirm. */
-    readonly FINALITY_UNAVAILABLE: "FINALITY_UNAVAILABLE";
-    /**
-     * The settlement hop's offer prices something other than the terms that were
-     * verified at prepare. Distinct from TX_MISMATCH: the transaction bytes were
-     * never in question — the *offer they would be built from* moved between the
-     * hop that was checked and the hop that would sign.
-     */
-    readonly PREPARED_OFFER_DIVERGED: "PREPARED_OFFER_DIVERGED";
-    /**
-     * The pre-sign check could not run to a verdict (e.g. the unsigned getObject
-     * read was unreachable). "Could not verify" is not "verified and it failed":
-     * reporting an RPC outage as tampering sends an operator hunting a security
-     * incident that did not happen.
-     */
-    readonly PREPARED_VERIFY_UNAVAILABLE: "PREPARED_VERIFY_UNAVAILABLE";
-    /**
-     * The offer prices something other than what the caller said it was buying.
-     * Distinct from POLICY_REJECTED, which is the grant's opinion: this is the
-     * AGENT's own ceiling, and it is the check that does not need the gateway's
-     * secret to be meaningful.
-     */
-    readonly SPEND_INTENT_VIOLATED: "SPEND_INTENT_VIOLATED";
-};
-type DelegatedPayErrorCode = (typeof DELEGATED_PAY_ERROR_CODES)[keyof typeof DELEGATED_PAY_ERROR_CODES];
-/**
- * Classification of a resource's non-402 response. Distinguishes a resource
- * served without payment (`unpaid_ok`, a 2xx) from a client-side refusal
- * (`rejected`, a non-2xx below 500) and a transient outage (`unavailable`, a
- * 5xx) — so a caller never mistakes a 503 for "already paid / ok". Absent on a
- * 402-driven pay outcome, which the `status`/`code`/`paid` fields describe.
- */
-type DelegatedPayResponseClass = 'unpaid_ok' | 'rejected' | 'unavailable';
-/**
- * The settled effects of a finality-confirmed pay, so a caller need not do a
- * separate on-chain read to learn what moved. `spend_account::settle_policy_payment` debits exactly
- * `amount` of `coinType` to `recipient` from the grant's pool, and a `success`
- * finality confirms that transfer executed — so these are the settled effects,
- * not merely the intended ones. Present only on a settled (`paid`) result.
- */
-interface DelegatedPaySettlement {
-    /** Finality-confirmed settlement status (only `success` reaches a paid result). */
-    status: 'success';
-    /** The settling transaction digest. */
-    txDigest: string;
-    /** Atomic units debited to the recipient (the offer amount the pay enforced). */
-    amount: string;
-    /** The paid recipient (the offer/target payTo the pay debited to). */
-    recipient: string;
-    /** Coin type settled. */
-    coinType: string;
-    /** Off-chain asset id of the offer. */
-    asset: string;
-    /** Grant object that authorized the draw. */
-    grantObjectId: string;
-    /** Pool object the draw debited. */
-    poolObjectId: string;
-}
-interface DelegatedPayResult {
-    /**
-     * How resolved the outcome is: `ok` = settled AND delivered; `ambiguous` =
-     * something after the signature is unresolved, so reconcile rather than retry;
-     * `failed` = nothing was signed, or the chain rejected the settlement.
-     */
-    status: DelegatedPayStatus;
-    /**
-     * Did money leave the grant?
-     *
-     * - `true` — settlement was finality-confirmed `success`. {@link settlement}
-     *   carries the confirmed effects.
-     * - `false` — nothing was signed, or the chain rejected the settlement. The
-     *   money is still in the pool.
-     * - `'unknown'` — a signature left this process and execute/finality did not
-     *   resolve. The money may have moved. A caller that treats this as `false`
-     *   and retries will pay twice. `if (!result.paid)` is false for `'unknown'`.
-     */
-    paid: boolean | 'unknown';
-    body?: unknown;
-    receipt?: Receipt | null;
-    /** Closed-set code only; never a gateway header/body string. */
-    code?: DelegatedPayErrorCode;
-    /** Resource HTTP status for a non-402 outcome (preserved, not swallowed). */
-    httpStatus?: number;
-    /** Classification of a non-402 outcome; see {@link DelegatedPayResponseClass}. */
-    responseClass?: DelegatedPayResponseClass;
-    /** Caller-safe detail only; never raw RPC/gateway exception text. */
-    detail?: string;
-    /**
-     * On-chain digest when known. For digestless ambiguity after a possible
-     * broadcast, set to {@link BROADCAST_UNKNOWN}.
-     */
-    txDigest?: string;
-    /** payment_id = offer.challengeId; reconcile key on ambiguous outcomes. */
-    paymentId?: string;
-    /**
-     * Settled effects (amount/recipient/status) of a finality-confirmed pay.
-     * Present on every `paid` result, including a settled pay whose delivery then
-     * failed — that is exactly the case where a caller cannot afford to guess.
-     */
-    settlement?: DelegatedPaySettlement;
-}
-/**
- * Non-secret connection manifest produced at authorize-agent success.
- * Enough for the agent to resolve grant/policy/target without owner SIWS.
- */
-interface DelegatedSignerConnectionManifest {
-    network: string;
-    packageId: string;
-    poolObjectId: string;
-    grantObjectId: string;
-    coinType: string;
-    delegateAddress: string;
-    /** Off-chain grant id for audit; optional. */
-    grantId?: string;
-    status?: GrantSnapshot['status'];
-    policies: GrantSnapshot['policies'];
-    /** Grant-level per-signer ceiling (GrantCap max_per_payment). */
-    maxPerPayment?: string;
-    /** Grant-level session cap. Required positive for open surface. */
-    sessionCap?: string;
-    /** `open` = full access (no allowlist); omit/scoped = policy-bound. */
-    accessMode?: 'scoped' | 'open';
-}
-/** Signer callback: address + sign over full transaction bytes (base64). */
-interface DelegatedKeySigner {
-    address: string;
-    signTransaction(txBytes: string): Promise<string>;
-    /**
-     * Personal-message signature (Sui IntentScope.PersonalMessage). Required
-     * for the sponsored-gas personal-message path; not used when the agent supplies gas.
-     */
-    signPersonalMessage?(message: Uint8Array): Promise<string>;
-}
-/**
- * Platform gas sponsorship client for BYO personal-message (ADR-0008). The payer obtains
- * a single-use nonce, signs the domain-separated personal-message over the pre-sponsor
- * kind hash, then create+execute the sponsored pay. Does not enable x402
- * transaction-submit for shared_pool.
- */
-interface SponsoredGasClient {
-    /** Gateway origin hosting /api/sponsor (no trailing slash). */
-    sponsorUrl: string;
-    fetchImpl?: typeof fetch;
-}
-type DelegatedSignerInput = DelegatedKeySigner | Ed25519Keypair | (() => Promise<DelegatedKeySigner> | DelegatedKeySigner);
-/**
- * Authority for one payment. Prefer an in-process snapshot/manifest; a
- * read-only fetch callback may load the same shape from a connection
- * manifest or a read endpoint the agent is allowed to call.
- */
-type GrantResolutionSource = GrantSnapshot | DelegatedSignerConnectionManifest | (() => Promise<GrantSnapshot | DelegatedSignerConnectionManifest>);
-interface DelegatedPayerSession {
-    /** Package id of the published shared_pool module (must match offer). */
-    packageId: string;
-    /** Network as offer.network expects, e.g. `sui:testnet`. */
-    network: string;
-    /** Grant + pool + policies for resolveGrantTarget. */
-    authority: GrantResolutionSource;
-    /** BYO delegated key (keypair or sign callback). Never platform-custodied. */
-    signer: DelegatedSignerInput;
-    /**
-     * Optional re-check immediately before sign (pause/revoke race). Throw to
-     * abort. When absent, request-time snapshot is the only pre-sign gate.
-     */
-    assertLive?: () => Promise<void>;
-}
-/** Gas coin ref for a complete executable transaction. */
-interface GasPaymentRef {
-    objectId: string;
-    version: string | number | bigint;
-    digest: string;
-}
-interface AgentGasInput {
-    budget?: string | number | bigint;
-    price?: string | number | bigint;
-    payment: GasPaymentRef[];
-    /** Defaults to the delegate (sender). */
-    owner?: string;
-}
-/**
- * Inputs for building a complete executable spend_account::settle_policy_payment transaction
- * (sender + gas + move call). Not kind-only bytes.
- *
- * Pool and grant must carry real initial shared versions from chain (not a
- * hard-coded "1"). Mirror SpendAccountChain.buildPayKind / MCP production path
- * which resolve via getObject / tx.object + client.
- */
-interface BuildPayTxInput {
-    packageId: string;
-    delegate: string;
-    coinType: string;
-    poolObjectId: string;
-    grantObjectId: string;
-    /** Real initial shared version of the pool object (from chain). */
-    poolInitialSharedVersion: string;
-    /** Real initial shared version of the grant object (from chain). */
-    grantInitialSharedVersion: string;
-    /**
-     * Initial shared version of the system Clock (0x6). Defaults to genesis
-     * version "1" when omitted.
-     */
-    clockInitialSharedVersion?: string;
-    policyId: number | string;
-    targetHash: string;
-    amount: string;
-    paymentIdHash: Uint8Array;
-    termsHash: Uint8Array;
-    gas: AgentGasInput;
-}
-/**
- * Result of an atomic payment-id reserve (exactly-once attempt claim).
- *
- * - reserved: this caller owns the attempt; only then may build/sign/execute
- * - in_flight: another attempt is mid-flight (or complete never landed); do not sign
- * - done: a terminal ok/ambiguous is recorded; return validated prior
- */
-type PaymentAttemptReserveResult = {
-    state: 'reserved';
-} | {
-    state: 'in_flight';
-    prior?: DelegatedPayResult;
-} | {
-    state: 'done';
-    prior: DelegatedPayResult;
-};
-/**
- * Durable ledger of payment attempts keyed by payment_id (offer.challengeId).
- * REQUIRED on the pay path. Exactly-once is reserve-before-sign:
- *   reserve (atomic) -> build/validate/sign/execute only if reserved -> complete
- * Persistence failure fails closed (never sign without a durable claim).
- */
-interface PaymentAttemptLedger {
-    /**
-     * Atomically claim paymentId for this attempt, or report prior/in-flight.
-     * Must not interleave another reserve for the same id between check and claim
-     * (memory: sync Map check-and-insert; Postgres: INSERT ON CONFLICT DO NOTHING).
-     */
-    reserve(paymentId: string, fingerprint: string): Promise<PaymentAttemptReserveResult>;
-    /**
-     * Write the terminal ok/ambiguous result for a reserved payment_id.
-     * After complete, further reserve() calls return state:'done' with prior.
-     * Throws on persistence failure (caller must not swallow).
-     */
-    complete(paymentId: string, result: DelegatedPayResult): Promise<void>;
-    /**
-     * Drop an in-flight reservation when no sign/execute happened (clean abort).
-     * No-op when the row is already terminal. Optional; missing release leaves
-     * in_flight so retries stay fail-closed (ambiguous, no re-sign).
-     */
-    release?(paymentId: string): Promise<void>;
-}
-/**
- * Resolve real initial shared versions for pool + grant from chain.
- * Production should call getObject (or SpendAccountChain-equivalent resolution).
- */
-type ResolveSharedObjectVersions = (ids: {
-    poolObjectId: string;
-    grantObjectId: string;
-    clockObjectId?: string;
-}) => Promise<{
-    poolInitialSharedVersion: string;
-    grantInitialSharedVersion: string;
-    clockInitialSharedVersion?: string;
-}>;
-interface DelegatedPayerDeps {
-    fetchImpl?: typeof fetch;
-    now?: () => number;
-    /**
-     * The gateway's HMAC secret, when the caller legitimately holds one — an
-     * operator running its own gateway, or a test. Present: offer digests are
-     * verified client-side before any ledger, capability, hash, build, or sign.
-     *
-     * Optional, because an external agent must never be given it: it is the
-     * secret that authenticates the gateway to itself, and handing it out makes
-     * every holder able to forge offers for every other. An agent without it
-     * supplies a {@link SpendIntent} instead. One of the two is REQUIRED — with
-     * neither, nothing bounds what the offer may charge, and payment is refused
-     * before any ledger, hash, build, or sign.
-     */
-    offerSecret?: string;
-    /**
-     * REQUIRED payment-attempt ledger. Absent ledger refuses to pay (config
-     * error) rather than run an unprotected re-sign/rebroadcast path.
-     */
-    paymentLedger: PaymentAttemptLedger;
-    /**
-     * Build a COMPLETE executable pay transaction (delegate sender, gas,
-     * real move call). Default uses {@link buildSpendAccountPayTx} with
-     * {@link gas}. Must never return kind-only non-executable bytes.
-     */
-    buildPayTx?: (input: BuildPayTxInput) => Promise<{
-        txBytes: string;
-    }>;
-    /**
-     * Agent-owned gas payment objects for the default full-tx builder.
-     * Required when buildPayTx is not injected and sponsor is not set.
-     * When both `gas` and `sponsor` are set, `gasMode` selects the path
-     * (default: agent gas when `gas` is present, else sponsored).
-     */
-    gas?: AgentGasInput;
-    /**
-     * Sponsored-gas path gated by sponsor personal-message challenge (Phase C2).
-     * Alternative to agent-provided gas. Keep agent gas as the other option.
-     */
-    sponsor?: SponsoredGasClient;
-    /**
-     * Force gas path when both agent gas and sponsor are configured.
-     * Default: `'agent'` when `gas` has payment objects, else `'sponsored'`.
-     */
-    gasMode?: 'agent' | 'sponsored';
-    /**
-     * Resolve real initial shared versions for pool/grant. Required for the
-     * default full-tx builder when {@link sharedObjectVersions} is not set.
-     * Mirror SpendAccountChain.buildPayKind (getObject Shared owner / tx.object).
-     */
-    resolveSharedObjectVersions?: ResolveSharedObjectVersions;
-    /**
-     * Pre-resolved pool/grant initial shared versions (tests / offline inject).
-     * When set, skips {@link resolveSharedObjectVersions}.
-     */
-    sharedObjectVersions?: {
-        poolInitialSharedVersion: string;
-        grantInitialSharedVersion: string;
-        clockInitialSharedVersion?: string;
-    };
-    /** Submit signed full transaction bytes; returns the broadcast digest. */
-    executeTx?: (txBytes: string, signature: string) => Promise<{
-        digest: string;
-    }>;
-    /**
-     * Confirm on-chain settlement of a broadcast digest: `success`/`failed`, or
-     * `null` while not yet observed. REQUIRED on any pay that reaches settlement —
-     * a pay is refused (`FINALITY_UNAVAILABLE`) before signing when this is absent,
-     * so a settled tx is never mis-reported as a false `FINALIZATION_TIMEOUT`.
-     */
-    getFinalizedTx?: (digest: string) => Promise<{
-        status: 'success' | 'failed';
-        reason?: string;
-    } | null>;
-    /**
-     * Await the proof-presentation delivery before returning (DEFAULT `true` —
-     * today's behavior: the result carries the delivered `body` + `receipt`). Set
-     * `false` to return `paid:true` with the digest + settlement summary as soon
-     * as settlement is finality-confirmed, skipping the (possibly slow, e.g.
-     * ~13s Walrus blob-publish) delivery fetch — the caller presents the proof and
-     * fetches the body later. Non-breaking: only an explicit `false` changes flow.
-     */
-    awaitDelivery?: boolean;
-    /**
-     * Server-side logger for internal exception detail. Never surfaces to the
-     * caller result (error hygiene).
-     */
-    logError?: (message: string, detail?: unknown) => void;
-}
-interface DelegatedPayerConfig {
-    /** Gateway origin the resource URL must match. */
-    gatewayUrl: string;
-}
-/**
- * The agent's own statement of what it is buying, checked against the offer
- * before anything else happens.
- *
- * This is the input that lets an agent hold nothing but its key and a gateway
- * URL. The offer HMAC ({@link DelegatedPayerDeps.offerSecret}) proves an offer
- * came from the party that minted it — which, on this path, is the same gateway
- * the agent is paying and reached over TLS at an origin the payer already pins.
- * A gateway that wanted to overcharge never needed to forge its own offer; it
- * could simply mint an honest one for the wrong amount. So the HMAC was never
- * the check that protected the agent from its counterparty, and requiring the
- * agent to hold the gateway's secret to perform it bought nothing while making
- * every agent able to forge offers for every other.
- *
- * What does protect the agent is a ceiling it set itself, which no gateway can
- * see or change. That is this.
- */
-interface SpendIntent {
-    /** Inclusive per-payment ceiling in atomic units, as a decimal string. */
-    maxAmount: string;
-    /** The coin type the agent is willing to spend. */
-    asset: string;
-    /**
-     * The exact recipient the agent expects to pay. Optional: an agent buying
-     * from a catalog usually learns `payTo` from the offer itself. When it does
-     * know, pinning it here is the strongest single check available, because
-     * recipient substitution — not overspend — is the attack the caps do not stop.
-     */
-    recipient?: string;
-}
-
-/**
- * Agent-held settlement wiring for the `pay` tool.
- *
- * The gateway prepares (it holds no key). Settlement needs the delegate key, so
- * it can only happen in the process that holds one. This module answers a single
- * question for a given grant: *is this process that grant's agent, and is it
- * configured to settle?* Any "no" returns null and `pay` falls back to handing
- * back unsigned bytes — the pre-existing behavior.
- *
- * Two conditions gate it, and the first is the security one:
- *
- * 1. **The persisted key must be the key the grant names.** A hosted gateway
- *    running this same tool code either holds no credentials file (null) or
- *    holds one for some unrelated key (address mismatch → null). It can only
- *    settle by already possessing the grant's delegate seed — which is exactly
- *    the custody ADR-0015 removed, not a state a flag protects against.
- * 2. **The settlement dependencies must all be present.** A half-configured
- *    settler is worse than none: it would sign and then fail to confirm. Missing
- *    anything → null, prepare-only.
- *
- * The key is read, never minted. See `loadLocalSigner`.
- */
-
-/** Everything `pay` needs to settle rather than prepare. */
-interface AgentHeldSettlement {
-    signer: DelegatedKeySigner;
-    getObjectJson: GetObjectJson;
-    payerDeps: DelegatedPayerDeps;
-}
-/**
- * Resolve agent-held settlement for one grant, or null to stay prepare-only.
- * Injectable so `createServer` can be driven without touching disk,
- * chain, or environment.
- */
-type AgentHeldResolver = (cfg: McpConfig, spendAccountPay: McpSpendAccountPayAuth) => AgentHeldSettlement | null;
-/** Test seam: drop the process ledger so suites do not share reservations. */
-declare function resetAgentHeldProcessLedger(): void;
-declare function resolveAgentHeldSettlement(cfg: McpConfig, spendAccountPay: McpSpendAccountPayAuth, env?: NodeJS.ProcessEnv): AgentHeldSettlement | null;
-
-/**
- * Canonical live-trace contract.
- *
- * One owner module for every observable MCP / payment / chain fact the live
- * audience view renders. No emitter invents its own event shape: emitters call
- * TraceSink.emit with a TraceEventInput, the dispatcher sanitizes it, and the
- * store persists an append-only TraceEventRecord.
- *
- * Two rules shape everything here:
- *
- *  1. A trace event is *observation*, never authority. It is emitted after a
- *     canonical decision returns and can never authorize the next step.
- *  2. The database event id is the canonical display order and is a bigserial.
- *     Outside the store it is always a decimal string — a JavaScript number
- *     silently loses precision past 2^53 and would corrupt SSE resume.
- */
-
-type TraceSource = 'mcp_wire' | 'suipay' | 'sui';
-type TraceStatus = 'started' | 'ok' | 'warning' | 'error' | 'ambiguous';
-type TraceEventKind = 'mcp_connected' | 'tools_listed' | 'tool_called' | 'tool_result' | 'tool_error' | 'challenge_received' | 'authority_matched' | 'authority_revalidated' | 'sponsor_requested' | 'transaction_sponsored' | 'delegate_signed' | 'transaction_submitted' | 'payment_finalized' | 'proof_presented' | 'upstream_delivered' | 'upstream_delivery_failed' | 'settlement_projected' | 'settlement_projection_failed' | 'receipt_issued' | 'payment_failed' | 'payment_ambiguous';
-interface TraceEventInput {
-    traceId: string;
-    requestId: string | null;
-    buyerAccountId: string;
-    connectionId: string;
-    at: string;
-    source: TraceSource;
-    kind: TraceEventKind;
-    status: TraceStatus;
-    summary: string;
-    publicPayload: Record<string, unknown>;
-    technicalPayload?: Record<string, unknown>;
-}
-/**
- * Correlation constraints an emitter can attach to one event.
- *
- * `requireSoleActiveRunForBuyer` is the server-side (ADR-0011) fallback's
- * atomicity guard: the event is persisted only if, at append time, that buyer
- * still has exactly one active run. It closes the window between selecting the
- * sole run and appending to it — a second run opening in between makes the
- * append fail closed rather than land on a run that is no longer sole.
- */
-interface TraceEmitOptions {
-    requireSoleActiveRunForBuyer?: string;
-}
-interface TraceSink {
-    emit(event: TraceEventInput, options?: TraceEmitOptions): Promise<void>;
-}
-type TraceRunEndReason = 'completed' | 'idle' | 'superseded' | 'event_cap' | 'byte_cap' | 'shutdown';
-interface TraceRun {
-    id: string;
-    buyerAccountId: string;
-    connectionId: string;
-    clientName: string | null;
-    startedAt: string;
-    lastEventAt: string;
-    endedAt: string | null;
-    endReason: TraceRunEndReason | null;
-    /** Persisted events accepted into this run. */
-    eventCount: number;
-    /** Serialized sanitized payload bytes accepted into this run. */
-    payloadBytes: number;
-}
-/** Run selection for one authenticated OAuth connection (implemented in context.ts). */
-interface TraceRunResolver {
-    resolveRun(input: {
-        buyerAccountId: string;
-        connectionId: string;
-        jsonRpcMethod: string | null;
-        clientName: string | null;
-        now: number;
-    }): Promise<TraceRun>;
-}
-
-/**
- * Transparent MCP wire proxy.
- *
- * This module is the *only* place in the system that parses MCP methods and
- * JSON-RPC ids. The gateway authenticates and hands over a run manager and a
- * sink; it never sniffs an MCP body a second time. Payment code emits domain
- * facts, never wire facts. That single-owner rule is what stops two subsystems
- * from disagreeing about which tool call a payment belongs to.
- *
- * Transparency is the top invariant, and it is structural rather than
- * best-effort:
- *
- *  - With no runtime, this file is a pass-through and does not touch the
- *    request or the response at all.
- *  - With a runtime, observation reads `Request.clone()` and `Response.clone()`
- *    only. The exact `Response` instance the handler produced is what the caller
- *    receives, so byte equality is by construction, not by careful copying.
- *  - Response observation is started and deliberately not awaited. A trace
- *    store that hangs cannot hold an MCP response open.
- *  - The request side cannot be fire-and-forget — the proxy must know the run
- *    and the JSON-RPC ids before the handler runs — so it is bounded instead:
- *    one deadline over envelope parsing plus run selection, and the same byte
- *    cap the response observer uses. A hung store or an oversized body costs
- *    the trace, never the request.
- *  - Every observation path is wrapped: a hostile body, a failing run manager or
- *    a throwing sink degrades to "no trace", never to a changed response.
- *
- * Volume control lives here too. One `tool_called` per JSON-RPC id and one
- * terminal `tool_result` / `tool_error` per id — never one row per SSE frame.
- */
-
-/** Everything the proxy needs to attribute wire facts to one owned run. */
-interface McpTraceRuntime {
-    buyerAccountId: string;
-    connectionId: string;
-    runs: TraceRunResolver;
-    sink: TraceSink;
-    /**
-     * HMAC secret for signed cross-request context. Supplied by the composition
-     * root so a published SDK never reads a gateway-only environment variable.
-     * Absent means internal hops carry no correlation and the gateway simply
-     * emits no linked events.
-     */
-    secret?: string | null;
-    /** Injected clock; tests pin it, production leaves it out. */
-    now?: () => number;
-}
-/** The proxy-resolved context handed down to payment code (Task 5 seams). */
-interface McpTraceContext {
-    traceId: string;
-    requestId: string | null;
-}
-interface McpTraceHooks {
-    runtime: McpTraceRuntime;
-    context: McpTraceContext;
-    sink: TraceSink;
-}
-/** One JSON-RPC message read off the request side. */
-interface McpEnvelopeEntry {
-    method: string | null;
-    jsonRpcId: string | number | null;
-    /** Canonical, header-safe request id. `null` for notifications. */
-    requestId: string | null;
-    toolName: string | null;
-    toolArguments: unknown;
-    clientName: string | null;
-    clientVersion: string | null;
-    protocolVersion: string | null;
-}
-interface McpEnvelope {
-    batch: boolean;
-    entries: McpEnvelopeEntry[];
-    /** First entry's method — what run selection keys on. */
-    method: string | null;
-    requestId: string | null;
-    clientName: string | null;
-}
-/**
- * Canonical MCP request id.
- *
- * JSON-RPC allows both `7` and `"7"` as distinct ids, and they must stay
- * distinct: correlating a payment to the wrong tool call is worse than not
- * correlating it. Numbers keep their JSON form under `n:`; strings are
- * base64url-encoded under `s:` so an id containing newlines, colons or quotes
- * survives being carried in an HTTP header without escaping games.
- */
-declare function canonicalMcpRequestId(id: unknown): string | null;
-/**
- * Read the JSON-RPC envelope from a request **clone**.
- *
- * The caller owns cloning; this consumes the body it is given. An unparsable,
- * bodiless or over-cap request yields an empty envelope rather than an error — a
- * malformed request is the transport's problem to answer, not tracing's problem
- * to block.
- */
-declare function inspectMcpEnvelope(request: Request, maxBytes?: number): Promise<McpEnvelope>;
-interface TraceMcpHttpRequestInput {
-    request: Request;
-    /**
-     * The real MCP handler. Receives the untouched original request, plus the
-     * resolved trace context when tracing is live.
-     */
-    handle: (request: Request, hooks?: McpTraceHooks) => Promise<Response>;
-    runtime?: McpTraceRuntime | null;
-    /** Cap on bytes read for observation, request and response. Never unbounded. */
-    maxObservedBytes?: number;
-    /**
-     * Deadline for envelope parsing plus run selection, the only trace work that
-     * happens before the handler. Past it the exchange proceeds untraced.
-     */
-    runSetupTimeoutMs?: number;
-}
-/**
- * Wrap one MCP HTTP exchange in observation.
- *
- * The response returned here is the exact object `handle` produced. Nothing on
- * the observation path can change it, delay it, or prevent it.
- */
-declare function traceMcpHttpRequest(input: TraceMcpHttpRequestInput): Promise<Response>;
-
-/**
- * Transport-neutral SuiPay MCP server + tool registry.
- * Used by stdio (index.ts) and Streamable HTTP (http.ts).
- * Remote HTTP passes McpAuthContext so tools enforce OAuth scope + shared-pool pay.
- */
-
-declare const PACKAGE_NAME = "@cmdoss/suipay-mcp";
-declare const TOOLS: readonly [{
-    readonly name: "access_context";
-    readonly description: "Inspect profiles, policies, service targets, spend caps, usage, and lifecycle state enforced for this authenticated SuiPay session. Call before choosing a paid service.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {};
-    };
-}, {
-    readonly name: "pay";
-    readonly description: "Pay a HTTP resource via shared_pool. The gateway PREPARES an unsigned transaction (it never holds the delegate key). Only a process that holds the delegate key the grant names can settle: it verifies the prepared kind (target, amount, recipient, grant.delegate) and settles through the same path as direct signer mode. Every other process returns a signingRequest to sign locally. Pass recipient and/or maxAmount to state who you intend to pay and what you will spend; both are checked before anything is signed or handed back. Local V1 allowance pay is retired. Use method POST with json to pay for a JSON request body; the body you send is bound into the offer, so it cannot be changed after signing.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly url: {
-                readonly type: "string";
-                readonly description: "Full gateway resource URL.";
-            };
-            readonly method: {
-                readonly type: "string";
-                readonly enum: readonly ["GET", "POST"];
-                readonly description: "HTTP method of the paid request. Defaults to GET.";
-            };
-            readonly json: {
-                readonly type: "object";
-                readonly description: "JSON request body for a POST. Sent as application/json and bound to the payment.";
-            };
-            readonly recipient: {
-                readonly type: "string";
-                readonly description: "Sui address you expect to be paid. The payment is refused, unsigned, if the prepared transaction pays anyone else.";
-            };
-            readonly maxAmount: {
-                readonly type: "string";
-                readonly description: "Atomic ceiling you will spend on this call. The payment is refused, unsigned, if the offer costs more.";
-            };
-        };
-        readonly required: readonly ["url"];
-    };
-}, {
-    readonly name: "discover";
-    readonly description: "Search SuiPay gateway resources.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly query: {
-                readonly type: "string";
-                readonly description: "Optional service search terms.";
-            };
-        };
-    };
-}, {
-    readonly name: "receipts";
-    readonly description: "List SuiPay settlement receipts, optionally filtered by challenge id.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly challengeId: {
-                readonly type: "string";
-                readonly description: "Optional payment challenge id.";
-            };
-        };
-    };
-}, {
-    readonly name: "suipay_login";
-    readonly description: "Mint or reuse the local delegate key (version-2, mode 0600) and open the console with the public address only so the owner can bind a spend-account grant. Stdio only; hosted /mcp never holds a spendable key.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly label: {
-                readonly type: "string";
-                readonly description: "Label shown in SuiPay console.";
-            };
-            readonly gatewayResourceUrl: {
-                readonly type: "string";
-                readonly description: "Gateway resource URL whose 402 defines recipient, asset, and package.";
-            };
-        };
-    };
-}, {
-    readonly name: "suipay_logout";
-    readonly description: "Remove the local delegate-key credentials file. Missing file is success. Force clears a corrupt file without printing the seed.";
-    readonly inputSchema: {
-        readonly type: "object";
-        readonly properties: {
-            readonly force: {
-                readonly type: "boolean";
-                readonly description: "Remove local credentials even if the file is unreadable.";
-            };
-        };
-    };
-}];
-/**
- * Create a Server with the public SuiPay tool surface registered.
- *
- * `trace` is the proxy-resolved run for this HTTP exchange. It is threaded into
- * tool dependencies so payment code can emit *domain* events, and nothing else:
- * this wrapper deliberately emits no tool lifecycle of its own, because the
- * proxy observes the actual JSON-RPC wire and a second source would double-count
- * every call and disagree on ids.
- */
-interface McpServerOptions {
-    /**
-     * How `pay` finds an agent-held delegate key for the authenticated grant.
-     * Defaults to the persisted local key (`resolveAgentHeldSettlement`), which
-     * returns null on any process that does not hold the key the grant names — so
-     * the default is prepare-only everywhere except the agent's own machine.
-     * Injectable for tests; there is no way to make it hand over a key the grant
-     * does not already authorize.
-     */
-    resolveAgentHeld?: AgentHeldResolver;
-}
-declare function createServer(cfg: McpConfig, auth?: McpAuthContext, trace?: McpTraceHooks, options?: McpServerOptions): Server;
-
-/**
- * Streamable HTTP transport for SuiPay MCP.
- * Stateless per-request (sessionIdGenerator undefined) — same public tools as stdio.
- * Auth context is required for remote gateway /mcp (bearer resolved upstream).
- *
- * The optional trace runtime turns on live observation. It is a pure wrapper:
- * `traceMcpHttpRequest` reads clones and returns the transport's own Response,
- * so passing a runtime cannot change what an MCP client sees.
- */
-
-/**
- * Handle one MCP Streamable HTTP request (initialize, tools/list, tools/call, …).
- * Creates a fresh transport+server pair per request (stateless mode).
- */
-declare function handleSuipayMcpHttpRequest(req: Request, cfg: McpConfig, auth?: McpAuthContext, trace?: McpTraceRuntime | null, options?: McpServerOptions): Promise<Response>;
-
-export { type AgentHeldResolver as A, type Dialect as D, type GrantSnapshot as G, type McpConfig as M, PACKAGE_NAME as P, type SpendIntent as S, type TraceSink as T, type DelegatedKeySigner as a, type GetObjectJson as b, type DelegatedPayerSession as c, type DelegatedPayerConfig as d, type DelegatedPayerDeps as e, type DelegatedPayResult as f, type AgentHeldSettlement as g, type McpEnvelope as h, type McpEnvelopeEntry as i, type McpServerOptions as j, type McpTraceContext as k, type McpTraceHooks as l, type McpTraceRuntime as m, TOOLS as n, canonicalMcpRequestId as o, createServer as p, handleSuipayMcpHttpRequest as q, inspectMcpEnvelope as r, loadMcpConfig as s, resetAgentHeldProcessLedger as t, resolveAgentHeldSettlement as u, resolveGrantTarget as v, traceMcpHttpRequest as w };