@cmdoss/suipay-mcp 1.0.1

package/dist/chunk-772CHNGT.js

@@ -0,0 +1,3879 @@
+// src/http.ts
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+
+// src/server.ts
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// ../../src/oauth/scopes.ts
+var OAUTH_SCOPES_SUPPORTED = [
+  "suipay:discover",
+  "suipay:receipts",
+  "suipay:pay",
+  "suipay:policy:read"
+];
+var SUPPORTED_SET = new Set(OAUTH_SCOPES_SUPPORTED);
+var OAUTH_DEFAULT_SCOPE = OAUTH_SCOPES_SUPPORTED.join(" ");
+function parseScopeString(scope) {
+  if (!scope?.trim()) return [];
+  return scope.trim().split(/\s+/).filter(Boolean);
+}
+function scopeAllows(grantedScope, required) {
+  const set = new Set(parseScopeString(grantedScope));
+  return set.has(required);
+}
+var BUYER_ACTION_SCOPES = {
+  read_access: "suipay:policy:read",
+  list_payers: "suipay:policy:read",
+  pay: "suipay:pay",
+  read_receipts: "suipay:receipts",
+  discover: "suipay:discover"
+};
+var MCP_TOOL_ACTIONS = {
+  access_context: "read_access",
+  pay: "pay",
+  discover: "discover",
+  receipts: "read_receipts",
+  // Login/logout are local-stdio flows; remote HTTP still requires discover.
+  suipay_login: "discover",
+  suipay_logout: "discover"
+};
+function scopeForMcpTool(toolName) {
+  const action = MCP_TOOL_ACTIONS[toolName];
+  return action ? BUYER_ACTION_SCOPES[action] : void 0;
+}
+
+// src/auth-context.ts
+function toolAllowedByScope(toolName, grantedScope) {
+  const required = scopeForMcpTool(toolName);
+  if (!required) {
+    return { ok: true };
+  }
+  if (!scopeAllows(grantedScope, required)) {
+    return { ok: false, required };
+  }
+  return { ok: true };
+}
+
+// ../../src/allowance/chain-sui.ts
+import { SuiGrpcClient } from "@mysten/sui/grpc";
+import { Transaction, coinWithBalance } from "@mysten/sui/transactions";
+import { fromBase64, normalizeSuiAddress, toBase64 } from "@mysten/sui/utils";
+
+// ../../src/chain/grpc-finality.ts
+function isGrpcTxNotFound(err) {
+  const code = err?.code;
+  return code === 5 || code === "NOT_FOUND";
+}
+async function fetchGrpcTransaction(client, digest, include = {
+  events: true,
+  effects: true,
+  transaction: true
+}) {
+  try {
+    return await client.getTransaction({
+      digest,
+      include
+    });
+  } catch (err) {
+    if (isGrpcTxNotFound(err)) return null;
+    throw err;
+  }
+}
+
+// ../../src/allowance/chain-sui.ts
+var ALLOWANCE_MODULE = "allowance";
+function createSuiAllowanceChain(options) {
+  const network = options.network ?? "testnet";
+  const client = options.client ?? new SuiGrpcClient({
+    network,
+    baseUrl: options.url ?? `https://fullnode.${network}.sui.io:443`
+  });
+  const packageId = normalizeSuiAddress(options.packageId);
+  const target = (fn) => `${packageId}::${ALLOWANCE_MODULE}::${fn}`;
+  async function build(tx) {
+    return { txBytes: toBase64(await tx.build({ client })) };
+  }
+  return {
+    network: `sui:${network}`,
+    packageId,
+    client,
+    async buildCreateTx(req) {
+      const tx = new Transaction();
+      tx.setSender(req.owner);
+      const funding = coinWithBalance({ type: req.coinType, balance: BigInt(req.funding) });
+      tx.moveCall({
+        target: target("create_and_share"),
+        typeArguments: [req.coinType],
+        arguments: [
+          funding,
+          tx.pure.address(req.delegate),
+          tx.pure.address(req.recipient),
+          tx.pure.u64(BigInt(req.maxPerPayment))
+        ]
+      });
+      return build(tx);
+    },
+    async buildPayTx(req) {
+      const tx = new Transaction();
+      tx.setSender(req.delegate);
+      tx.moveCall({
+        target: target("pay"),
+        typeArguments: [req.coinType],
+        arguments: [
+          // The shared allowance object; its version is resolved at build time.
+          tx.object(req.allowanceId),
+          tx.pure.u64(BigInt(req.expectedNonce)),
+          tx.pure.u64(BigInt(req.amount)),
+          tx.pure.vector("u8", Array.from(req.paymentIdHash)),
+          tx.pure.vector("u8", Array.from(req.termsHash))
+        ]
+      });
+      return build(tx);
+    },
+    async buildPayTxKind(req) {
+      const tx = new Transaction();
+      tx.setSender(req.delegate);
+      tx.moveCall({
+        target: target("pay"),
+        typeArguments: [req.coinType],
+        arguments: [
+          tx.object(req.allowanceId),
+          tx.pure.u64(BigInt(req.expectedNonce)),
+          tx.pure.u64(BigInt(req.amount)),
+          tx.pure.vector("u8", Array.from(req.paymentIdHash)),
+          tx.pure.vector("u8", Array.from(req.termsHash))
+        ]
+      });
+      return { kindBytes: toBase64(await tx.build({ client, onlyTransactionKind: true })) };
+    },
+    async buildTopUpTx(req) {
+      const tx = new Transaction();
+      tx.setSender(req.owner);
+      const funding = coinWithBalance({ type: req.coinType, balance: BigInt(req.amount) });
+      tx.moveCall({
+        target: target("top_up"),
+        typeArguments: [req.coinType],
+        arguments: [tx.object(req.allowanceId), funding]
+      });
+      return build(tx);
+    },
+    async buildPauseTx(req) {
+      return build(manageTx(req, target("pause")));
+    },
+    async buildResumeTx(req) {
+      return build(manageTx(req, target("resume")));
+    },
+    async buildRevokeTx(req) {
+      return build(manageTx(req, target("revoke_and_refund")));
+    },
+    async inspectPay(txBytes, expected) {
+      let data;
+      try {
+        data = Transaction.from(fromBase64(txBytes)).getData();
+      } catch (err) {
+        return { ok: false, reason: `undecodable transaction: ${errText(err)}` };
+      }
+      if (!data.sender) return { ok: false, reason: "transaction has no sender" };
+      const want = `${normalizeSuiAddress(expected.packageId)}::${ALLOWANCE_MODULE}::pay`;
+      const hit = data.commands.some((c) => {
+        const mc = c.$kind === "MoveCall" ? c.MoveCall : void 0;
+        if (!mc) return false;
+        return `${normalizeSuiAddress(mc.package)}::${mc.module}::${mc.function}` === want;
+      });
+      if (!hit) return { ok: false, reason: `transaction does not call ${want}` };
+      return { ok: true, sender: normalizeSuiAddress(data.sender) };
+    },
+    async execute(txBytes, signature) {
+      let digest;
+      try {
+        const submitted = await client.core.executeTransaction({
+          transaction: fromBase64(txBytes),
+          signatures: [signature]
+        });
+        if (submitted.FailedTransaction) {
+          return {
+            status: "rejected",
+            reason: executionError(submitted.FailedTransaction.status)
+          };
+        }
+        digest = submitted.Transaction.digest;
+      } catch (err) {
+        const text2 = errText(err);
+        if (isDeterministicRejection(text2)) return { status: "rejected", reason: text2 };
+        return { status: "ambiguous", reason: text2 };
+      }
+      try {
+        const result = await client.core.waitForTransaction({
+          digest,
+          include: { events: true, effects: true },
+          timeout: 6e4
+        });
+        const finalized = result.Transaction ?? result.FailedTransaction;
+        if (!finalized.status.success) {
+          return { status: "rejected", reason: executionError(finalized.status) };
+        }
+        const events = (finalized.events ?? []).map(parseAllowanceEvent).filter((e) => e !== null);
+        return { status: "ok", txDigest: digest, events };
+      } catch (err) {
+        return { status: "ambiguous", reason: errText(err), txDigest: digest };
+      }
+    },
+    async readAllowance(id) {
+      const { object } = await client.core.getObject({
+        objectId: id,
+        include: { json: true }
+      });
+      if (!object.json) return null;
+      const f = object.json;
+      return {
+        id,
+        owner: normalizeSuiAddress(String(f.owner)),
+        delegate: normalizeSuiAddress(String(f.delegate)),
+        recipient: normalizeSuiAddress(String(f.recipient)),
+        balance: readBalance(f.funds),
+        maxPerPayment: String(f.max_per_payment),
+        nextNonce: String(f.next_nonce),
+        paused: Boolean(f.paused),
+        revoked: Boolean(f.revoked),
+        coinType: coinTypeArg(object.type)
+      };
+    },
+    async listPayments(id) {
+      const target2 = normalizeSuiAddress(id);
+      const out = [];
+      let after = null;
+      for (let page = 0; page < 20; page++) {
+        const res = await client.core.listEvents({
+          filter: { eventType: `${packageId}::${ALLOWANCE_MODULE}::PaymentMade` },
+          after,
+          order: "ascending"
+        });
+        for (const ev of res.events) {
+          const parsed = parseAllowanceEvent(ev);
+          if (parsed?.kind === "paid" && normalizeSuiAddress(parsed.allowance) === target2) out.push(parsed);
+        }
+        if (!res.hasNextPage) return out;
+        if (!res.endCursor) {
+          throw new Error("gRPC event query returned no continuation cursor");
+        }
+        after = res.endCursor;
+      }
+      throw new Error("gRPC event query exceeded the 20-page scan limit");
+    },
+    async getFinalizedTx(txDigest) {
+      const result = await fetchGrpcTransaction(client, txDigest, {
+        events: true,
+        effects: true,
+        transaction: true,
+        protoJson: true
+      });
+      if (!result) return null;
+      const finalized = result.Transaction ?? result.FailedTransaction;
+      if (!finalized) {
+        throw new Error("finality reader: response has no Transaction variant");
+      }
+      if (finalized.digest != null && String(finalized.digest) !== txDigest) {
+        throw new Error("finality reader: response digest does not match request");
+      }
+      const proto = result.protoJson;
+      const checkpoint = proto?.checkpoint == null ? null : String(proto.checkpoint);
+      const sender = finalized.transaction?.sender ? normalizeSuiAddress(finalized.transaction.sender) : "";
+      const success = finalized.status?.success;
+      if (success !== true && success !== false) {
+        throw new Error("finality reader: response has no success status");
+      }
+      if (success === false) {
+        return {
+          status: "failed",
+          txDigest,
+          checkpoint,
+          reason: executionError(finalized.status)
+        };
+      }
+      const events = (finalized.events ?? []).map((e) => parseAllowanceEvent(e)).filter((e) => e !== null);
+      return { status: "success", txDigest, checkpoint, sender, events };
+    }
+  };
+  function manageTx(req, fn) {
+    const tx = new Transaction();
+    tx.setSender(req.owner);
+    tx.moveCall({ target: fn, typeArguments: [req.coinType], arguments: [tx.object(req.allowanceId)] });
+    return tx;
+  }
+}
+function readBalance(funds) {
+  if (typeof funds === "string") return funds;
+  if (funds && typeof funds === "object") {
+    const v = funds;
+    if (v.value != null) return String(v.value);
+    if (v.fields?.value != null) return String(v.fields.value);
+  }
+  return "0";
+}
+function coinTypeArg(objectType) {
+  if (!objectType) return "";
+  const lt = objectType.indexOf("<");
+  const gt = objectType.lastIndexOf(">");
+  return lt >= 0 && gt > lt ? prefix0x(objectType.slice(lt + 1, gt)) : "";
+}
+function parseAllowanceEvent(ev) {
+  const j = ev.json;
+  if (!j) return null;
+  if (ev.eventType.endsWith(`::${ALLOWANCE_MODULE}::PaymentMade`)) {
+    return {
+      kind: "paid",
+      allowance: normalizeSuiAddress(String(j.allowance)),
+      payer: normalizeSuiAddress(String(j.payer)),
+      recipient: normalizeSuiAddress(String(j.recipient)),
+      amount: String(j.amount),
+      nonce: String(j.nonce),
+      remaining: String(j.remaining),
+      paymentIdHash: hexOf(j.payment_id_hash),
+      termsHash: hexOf(j.terms_hash),
+      coinType: prefix0x(String(j.coin_type))
+    };
+  }
+  if (ev.eventType.endsWith(`::${ALLOWANCE_MODULE}::AllowanceCreated`)) {
+    return {
+      kind: "created",
+      allowance: normalizeSuiAddress(String(j.allowance)),
+      owner: normalizeSuiAddress(String(j.owner)),
+      delegate: normalizeSuiAddress(String(j.delegate)),
+      recipient: normalizeSuiAddress(String(j.recipient)),
+      funded: String(j.funded),
+      maxPerPayment: String(j.max_per_payment),
+      coinType: prefix0x(String(j.coin_type))
+    };
+  }
+  if (ev.eventType.endsWith(`::${ALLOWANCE_MODULE}::AllowanceToppedUp`)) {
+    return { kind: "toppedUp", allowance: normalizeSuiAddress(String(j.allowance)), amount: String(j.amount), balance: String(j.balance) };
+  }
+  if (ev.eventType.endsWith(`::${ALLOWANCE_MODULE}::AllowancePauseSet`)) {
+    return { kind: "pauseSet", allowance: normalizeSuiAddress(String(j.allowance)), paused: Boolean(j.paused) };
+  }
+  if (ev.eventType.endsWith(`::${ALLOWANCE_MODULE}::AllowanceRevoked`)) {
+    return { kind: "revoked", allowance: normalizeSuiAddress(String(j.allowance)), refunded: String(j.refunded) };
+  }
+  return null;
+}
+function hexOf(raw) {
+  if (Array.isArray(raw)) return Buffer.from(raw).toString("hex");
+  if (typeof raw === "string") return Buffer.from(raw, "base64").toString("hex");
+  return "";
+}
+function prefix0x(coinType) {
+  return `0x${coinType.replace(/^0x/, "")}`;
+}
+function isDeterministicRejection(text2) {
+  return /invalid signature|signature is not valid|objectnotfound|insufficient|balance|gas|dependent package|invaliduserinput|object is not available|abort/i.test(
+    text2
+  );
+}
+function errText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function executionError(status) {
+  return status.error?.message ?? "transaction execution failed";
+}
+
+// ../../src/buyer-control/chain.ts
+import { bcs } from "@mysten/sui/bcs";
+import { SuiGrpcClient as SuiGrpcClient2 } from "@mysten/sui/grpc";
+import { Transaction as Transaction2, coinWithBalance as coinWithBalance2 } from "@mysten/sui/transactions";
+import {
+  normalizeStructTag as normalizeStructTag3,
+  normalizeSuiAddress as normalizeSuiAddress2,
+  toBase64 as toBase642
+} from "@mysten/sui/utils";
+
+// ../../src/chain/address.ts
+function hexOf2(address) {
+  return address.trim().replace(/^0x/i, "").toLowerCase();
+}
+function isZeroAddress(address) {
+  const hex = hexOf2(address);
+  return hex.length === 0 || /^0+$/.test(hex);
+}
+
+// ../../src/policy/target.ts
+import { createHash } from "crypto";
+import { normalizeStructTag as normalizeStructTag2 } from "@mysten/sui/utils";
+
+// ../../src/assets/testnet.ts
+import { normalizeStructTag } from "@mysten/sui/utils";
+
+// ../../src/policy/target.ts
+function targetHashBytes(hexHash) {
+  if (!/^[0-9a-f]{64}$/i.test(hexHash)) {
+    throw new Error("targetHash must be 32-byte hex.");
+  }
+  return Uint8Array.from(Buffer.from(hexHash, "hex"));
+}
+
+// ../../src/buyer-control/chain.ts
+var MODULE = "shared_pool";
+var SUI_COIN_TYPE = "0x2::sui::SUI";
+function isSuiCoinType(coinType) {
+  try {
+    return normalizeStructTag3(coinType) === normalizeStructTag3(SUI_COIN_TYPE);
+  } catch {
+    return /::sui::SUI$/i.test(coinType);
+  }
+}
+var SUI_CLOCK = "0x6";
+function createSharedPoolChain(options) {
+  const network = options.network ?? "testnet";
+  const rpcUrl = options.url ?? `https://fullnode.${network}.sui.io:443`;
+  const client = options.client ?? new SuiGrpcClient2({
+    network,
+    baseUrl: rpcUrl
+  });
+  const packageId = normalizeSuiAddress2(options.packageId);
+  const target = (fn) => `${packageId}::${MODULE}::${fn}`;
+  async function kindBytes(tx) {
+    return {
+      kindBytes: toBase642(await tx.build({ client, onlyTransactionKind: true }))
+    };
+  }
+  async function fundingCoin(tx, owner, coinType, amount) {
+    if (!isSuiCoinType(coinType)) {
+      return coinWithBalance2({ type: coinType, balance: amount });
+    }
+    const listed = await client.core.listCoins({
+      owner,
+      coinType: SUI_COIN_TYPE
+    });
+    const coins = [...listed.objects ?? []].sort(
+      (a, b) => BigInt(b.balance) > BigInt(a.balance) ? 1 : -1
+    );
+    const picked = [];
+    let total = 0n;
+    for (const c of coins) {
+      if (BigInt(c.balance) <= 0n) continue;
+      picked.push(c);
+      total += BigInt(c.balance);
+      if (total >= amount) break;
+    }
+    if (total < amount || picked.length === 0) {
+      throw new Error(
+        `owner has insufficient SUI for funding (need ${amount}, have ${total})`
+      );
+    }
+    const primary = tx.objectRef({
+      objectId: picked[0].objectId,
+      version: picked[0].version,
+      digest: picked[0].digest
+    });
+    if (picked.length > 1) {
+      tx.mergeCoins(
+        primary,
+        picked.slice(1).map(
+          (c) => tx.objectRef({
+            objectId: c.objectId,
+            version: c.version,
+            digest: c.digest
+          })
+        )
+      );
+    }
+    const [split] = tx.splitCoins(primary, [amount]);
+    return split;
+  }
+  return {
+    packageId,
+    client,
+    network: `sui:${network}`,
+    async readPoolBalance(poolObjectId) {
+      const { object } = await client.core.getObject({
+        objectId: poolObjectId,
+        include: { json: true }
+      });
+      const json = object?.json;
+      if (!json || typeof json !== "object") {
+        throw new Error("pool object has no Move json contents");
+      }
+      const funds = json.funds;
+      if (typeof funds === "string" && /^\d+$/.test(funds)) return funds;
+      if (typeof funds === "number" && Number.isFinite(funds)) {
+        return String(Math.trunc(funds));
+      }
+      if (funds && typeof funds === "object") {
+        const v = typeof funds.fields?.value === "string" ? funds.fields.value : typeof funds.value === "string" ? funds.value : null;
+        if (v && /^\d+$/.test(v)) return v;
+      }
+      throw new Error("could not parse SharedPool.funds balance");
+    },
+    async buildCreatePoolKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const funding = await fundingCoin(
+        tx,
+        input.owner,
+        input.coinType,
+        BigInt(input.funding)
+      );
+      tx.moveCall({
+        target: target("create_pool"),
+        typeArguments: [input.coinType],
+        arguments: [funding]
+      });
+      return kindBytes(tx);
+    },
+    async buildTopUpKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const funding = await fundingCoin(
+        tx,
+        input.owner,
+        input.coinType,
+        BigInt(input.amount)
+      );
+      tx.moveCall({
+        target: target("top_up"),
+        typeArguments: [input.coinType],
+        arguments: [tx.object(input.poolObjectId), funding]
+      });
+      return kindBytes(tx);
+    },
+    async buildWithdrawKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("withdraw"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.u64(BigInt(input.amount))
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildPausePoolKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("pause_pool"),
+        typeArguments: [input.coinType],
+        arguments: [tx.object(input.poolObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildResumePoolKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("resume_pool"),
+        typeArguments: [input.coinType],
+        arguments: [tx.object(input.poolObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildCreatePolicyKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const targetResults = input.targets.map((t) => {
+        const hash = targetHashBytes(t.targetHash);
+        return tx.moveCall({
+          target: target("make_target"),
+          arguments: [
+            tx.pure.vector("u8", Array.from(hash)),
+            tx.pure.address(t.recipient),
+            tx.pure.u64(BigInt(t.maxPerPayment))
+          ]
+        });
+      });
+      const targetsVec = tx.makeMoveVec({
+        type: `${packageId}::${MODULE}::PolicyTarget`,
+        elements: targetResults
+      });
+      const expires = input.expiresAtMs === void 0 || input.expiresAtMs === null ? 0n : BigInt(input.expiresAtMs);
+      tx.moveCall({
+        target: target("create_policy"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          targetsVec,
+          tx.pure.u64(BigInt(input.totalCap)),
+          tx.pure.u64(BigInt(input.maxPerPayment)),
+          tx.pure.u64(expires)
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildPausePolicyKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("pause_policy"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.u64(BigInt(input.onChainPolicyId))
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildResumePolicyKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("resume_policy"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.u64(BigInt(input.onChainPolicyId))
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildRevokePolicyKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("revoke_policy"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.u64(BigInt(input.onChainPolicyId))
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildCreateGrantKind(input) {
+      if (!input.onChainPolicyIds.length) {
+        throw new Error("create_grant requires at least one on-chain policy id");
+      }
+      if (!input.maxPerPayment || BigInt(input.maxPerPayment) <= 0n) {
+        throw new Error("create_grant requires a non-zero max_per_payment");
+      }
+      if (!input.sessionCap || BigInt(input.sessionCap) <= 0n) {
+        throw new Error("create_grant requires a non-zero session_cap");
+      }
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const expires = input.expiresAtMs === void 0 || input.expiresAtMs === null ? 0n : BigInt(input.expiresAtMs);
+      tx.moveCall({
+        target: target("create_grant"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.address(input.delegate),
+          tx.pure.u64(BigInt(input.sessionCap)),
+          tx.pure.u64(BigInt(input.maxPerPayment)),
+          tx.pure.u64(expires),
+          tx.pure.vector(
+            "u64",
+            input.onChainPolicyIds.map((id) => BigInt(id))
+          )
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildCreateSpendGrantKind(input) {
+      if (!input.onChainPolicyIds.length) {
+        throw new Error(
+          "create_spend_grant requires at least one on-chain policy id"
+        );
+      }
+      if (input.sessionCap !== null && input.sessionCap <= 0n) {
+        throw new Error(
+          "create_spend_grant session_cap must be null or > 0"
+        );
+      }
+      if (input.maxPerPayment !== null && input.maxPerPayment <= 0n) {
+        throw new Error(
+          "create_spend_grant max_per_payment must be null or > 0"
+        );
+      }
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const expires = input.expiresAtMs === void 0 || input.expiresAtMs === null ? 0n : BigInt(input.expiresAtMs);
+      tx.moveCall({
+        target: target("create_spend_grant"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.address(input.delegate),
+          tx.pure.option("u64", input.sessionCap),
+          tx.pure.option("u64", input.maxPerPayment),
+          tx.pure.u64(expires),
+          tx.pure.vector(
+            "u64",
+            input.onChainPolicyIds.map((id) => BigInt(id))
+          )
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildCreateOpenGrantKind(input) {
+      if (input.sessionCap == null || input.sessionCap <= 0n) {
+        throw new Error("create_open_grant session_cap must be > 0");
+      }
+      if (input.maxPerPayment == null || input.maxPerPayment <= 0n) {
+        throw new Error("create_open_grant max_per_payment must be > 0");
+      }
+      const expires = BigInt(input.expiresAtMs);
+      if (expires <= 0n) {
+        throw new Error(
+          "create_open_grant expires_at_ms must be a finite future expiry (> 0)"
+        );
+      }
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("create_open_grant"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.address(input.delegate),
+          tx.pure.u64(input.sessionCap),
+          tx.pure.u64(input.maxPerPayment),
+          tx.pure.u64(expires),
+          tx.object(input.clockId ?? SUI_CLOCK)
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildPayOpenKind(input) {
+      if (!input.termsHash || input.termsHash.length === 0) {
+        throw new Error("termsHash must be non-empty for shared_pool::pay_open");
+      }
+      if (!input.paymentIdHash || input.paymentIdHash.length === 0) {
+        throw new Error(
+          "paymentIdHash must be non-empty for shared_pool::pay_open"
+        );
+      }
+      if (!input.recipient || isZeroAddress(input.recipient)) {
+        throw new Error("pay_open recipient must be a non-zero address");
+      }
+      if (!input.amount || BigInt(input.amount) <= 0n) {
+        throw new Error("pay_open amount must be > 0");
+      }
+      const hash = targetHashBytes(input.targetHash);
+      const tx = new Transaction2();
+      tx.setSender(input.delegate);
+      tx.moveCall({
+        target: target("pay_open"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.object(input.grantObjectId),
+          tx.pure.address(input.recipient),
+          tx.pure.u64(BigInt(input.amount)),
+          tx.pure.vector("u8", Array.from(input.paymentIdHash)),
+          tx.pure.vector("u8", Array.from(input.termsHash)),
+          tx.pure.vector("u8", Array.from(hash)),
+          tx.object(input.clockId ?? SUI_CLOCK)
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildPauseGrantKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("pause_grant"),
+        arguments: [tx.object(input.grantObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildResumeGrantKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("resume_grant"),
+        arguments: [tx.object(input.grantObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildRevokeGrantKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("revoke_grant"),
+        arguments: [tx.object(input.grantObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildRevokeOpenGrantKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      tx.moveCall({
+        target: target("revoke_open_grant"),
+        typeArguments: [input.coinType],
+        arguments: [tx.object(input.grantObjectId)]
+      });
+      return kindBytes(tx);
+    },
+    async buildTightenGrantKind(input) {
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const expires = input.newExpiresAtMs === void 0 || input.newExpiresAtMs === null ? 0n : BigInt(input.newExpiresAtMs);
+      tx.moveCall({
+        target: target("tighten_grant"),
+        arguments: [
+          tx.object(input.grantObjectId),
+          tx.pure.u64(BigInt(input.newSessionCap)),
+          tx.pure.u64(expires)
+        ]
+      });
+      return kindBytes(tx);
+    },
+    async buildPayKind(input) {
+      if (!input.termsHash || input.termsHash.length === 0) {
+        throw new Error("termsHash must be non-empty for shared_pool::pay");
+      }
+      if (!input.paymentIdHash || input.paymentIdHash.length === 0) {
+        throw new Error("paymentIdHash must be non-empty for shared_pool::pay");
+      }
+      const hash = targetHashBytes(input.targetHash);
+      const tx = new Transaction2();
+      tx.setSender(input.delegate);
+      tx.moveCall({
+        target: target("pay"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.object(input.grantObjectId),
+          tx.pure.u64(BigInt(input.policyId)),
+          tx.pure.vector("u8", Array.from(hash)),
+          tx.pure.u64(BigInt(input.amount)),
+          tx.pure.vector("u8", Array.from(input.paymentIdHash)),
+          tx.pure.vector("u8", Array.from(input.termsHash)),
+          tx.object(input.clockId ?? SUI_CLOCK)
+        ]
+      });
+      return kindBytes(tx);
+    }
+  };
+}
+var SUI_NETWORKS = ["testnet", "devnet", "localnet", "mainnet"];
+function toGrpcNetwork(network) {
+  const short = (network ?? "testnet").replace(/^sui:/, "");
+  if (!SUI_NETWORKS.includes(short)) {
+    throw new Error(
+      `unsupported Sui network "${network}" (expected one of ${SUI_NETWORKS.join(", ")})`
+    );
+  }
+  return short;
+}
+function createSharedPoolFinalityReader(options) {
+  const network = toGrpcNetwork(options.network);
+  const client = options.client ?? new SuiGrpcClient2({
+    network,
+    baseUrl: options.url ?? `https://fullnode.${network}.sui.io:443`
+  });
+  return {
+    async getFinalizedTx(digest) {
+      const result = await fetchGrpcTransaction(client, digest, {
+        events: true,
+        effects: true,
+        transaction: true
+      });
+      if (!result) return null;
+      const finalized = result.Transaction ?? result.FailedTransaction;
+      if (!finalized) {
+        throw new Error("finality reader: response has no Transaction variant");
+      }
+      if (finalized.digest != null && String(finalized.digest) !== digest) {
+        throw new Error("finality reader: response digest does not match request");
+      }
+      const success = finalized.status?.success;
+      if (success !== true && success !== false) {
+        throw new Error("finality reader: response has no success status");
+      }
+      if (success === false) {
+        return {
+          status: "failed",
+          txDigest: digest,
+          reason: finalized.status.error?.message ?? "shared_pool transaction failed on chain"
+        };
+      }
+      const sender = finalized.transaction?.sender ? normalizeSuiAddress2(String(finalized.transaction.sender)) : void 0;
+      const moveCalls = (finalized.transaction?.commands ?? []).map((c) => {
+        const mc = c && typeof c === "object" && "MoveCall" in c ? c.MoveCall : void 0;
+        return mc ? `${normalizeSuiAddress2(mc.package)}::${mc.module}::${mc.function}` : null;
+      }).filter((t) => t !== null);
+      const objectIds = (finalized.effects?.changedObjects ?? []).filter((o) => o.idOperation === "Created").map((o) => normalizeSuiAddress2(o.objectId));
+      const events = (finalized.events ?? []).map((e) => ({
+        // Spread the on-chain payload FIRST so a field named `type`/`kind` in
+        // the event json can never shadow the derived event type - reconcile
+        // matches on `type`, so a shadowed value would misroute the event.
+        ...e.json ?? {},
+        type: e.eventType,
+        kind: e.eventType.split("::").pop() ?? e.eventType
+      }));
+      return {
+        status: "success",
+        txDigest: digest,
+        sender,
+        moveCalls,
+        objectIds,
+        events
+      };
+    }
+  };
+}
+
+// ../../src/protocol/challenge.ts
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
+var SIGNED_FIELDS_V1 = [
+  "challengeId",
+  "resource",
+  "amount",
+  "asset",
+  "decimals",
+  "network",
+  "payTo",
+  "packageId",
+  "issuedAt",
+  "expiresAt"
+];
+var SIGNED_FIELDS_V2 = [
+  ...SIGNED_FIELDS_V1,
+  "digestVersion",
+  "settlementRail",
+  "serviceId",
+  "serviceRevision",
+  "targetHash",
+  "authorizationEpoch",
+  "method",
+  "path",
+  "netAmount",
+  "platformFee",
+  // Offer-pinned sponsor gas for shared_pool x402 (omit-when-absent).
+  // Appended so pre-existing v2 digests without these fields stay byte-identical.
+  "sponsorGasOwner",
+  "sponsorGasBudget",
+  "sponsorGasPrice",
+  "sponsorGasPayment"
+];
+var SIGNED_FIELDS_V3 = [
+  ...SIGNED_FIELDS_V2,
+  "bodyHash",
+  "contentType",
+  "intent",
+  "periodMs",
+  "periodCount",
+  "refundable",
+  "refundWindowMs",
+  "decideWindowMs",
+  // payment_key identity - omit-when-absent so non-refundable digests stay
+  // byte-identical; when present they are gateway-authenticated under HMAC.
+  "chainId",
+  "paymentSalt",
+  "refundTo",
+  "settlementRef"
+];
+var BODY_HASH_RE = /^[A-Za-z0-9_-]{43}$/;
+var CONTENT_TYPE_RE = /^[a-z0-9!#$%&'*+.^_`|~-]+\/[a-z0-9!#$%&'*+.^_`|~-]+(?:; ?[a-z0-9!#$%&'*+.^_`|~-]+=(?:[a-zA-Z0-9!#$%&'*+.^_`|~-]+|"[^"\n\r]*"))*$/;
+function isBodyHash(value) {
+  return typeof value === "string" && BODY_HASH_RE.test(value);
+}
+function isOfferContentType(value) {
+  return typeof value === "string" && value.length <= 255 && CONTENT_TYPE_RE.test(value);
+}
+
+// ../../src/protocol/request-digest.ts
+import { createHash as createHash2 } from "crypto";
+function hashRequestBody(body) {
+  const bytes = body == null ? new Uint8Array() : typeof body === "string" ? new TextEncoder().encode(body) : body;
+  return createHash2("sha256").update(bytes).digest("base64url");
+}
+
+// ../../src/protocol/paid-http-request.ts
+var MAX_PAID_BODY_BYTES = 65536;
+var MAX_PAID_RESPONSE_BYTES = 16 * 1024 * 1024;
+var MAX_UNMANAGED_RESPONSE_BYTES = 256 * 1024 * 1024;
+var MCP_JSON_CONTENT_TYPE = "application/json";
+var EMPTY_BODY = new Uint8Array();
+function assertPaidUrl(url) {
+  if (typeof url !== "string" || url.trim() === "") {
+    throw new Error("paid request url is required");
+  }
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new Error(`paid request url must be an absolute URL, got ${url}`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error("paid request url must be an http(s) URL");
+  }
+  return url;
+}
+function assertPaidMethod(method) {
+  if (method === void 0 || method === null) return "GET";
+  if (typeof method !== "string") {
+    throw new Error("paid request method must be a string");
+  }
+  const upper = method.trim().toUpperCase();
+  if (upper === "GET" || upper === "POST") return upper;
+  throw new Error(`paid request method must be GET or POST, got ${method}`);
+}
+function normalizeContentType(value) {
+  const normalized = value.trim().toLowerCase().replace(/\s*;\s*/g, "; ").replace(/\s*=\s*/g, "=");
+  if (!isOfferContentType(normalized)) {
+    throw new Error(`paid request content type is malformed: ${value}`);
+  }
+  return normalized;
+}
+function toBytes(body) {
+  return typeof body === "string" ? new TextEncoder().encode(body) : body;
+}
+function assertWithinCap(bytes) {
+  if (bytes.byteLength > MAX_PAID_BODY_BYTES) {
+    throw new Error(
+      `paid request body is ${bytes.byteLength} bytes; too large, max is ${MAX_PAID_BODY_BYTES}`
+    );
+  }
+  return bytes;
+}
+function freeze(request) {
+  return Object.freeze(request);
+}
+function normalizePaidHttpRequest(input) {
+  const url = assertPaidUrl(input.url);
+  const method = assertPaidMethod(input.method);
+  if (input.body !== void 0 && input.body !== null && typeof input.body !== "string" && !(input.body instanceof Uint8Array)) {
+    throw new Error("paid request body must be a string, Uint8Array, or null");
+  }
+  if (method === "GET") {
+    const hasBody = input.body !== void 0 && input.body !== null && toBytes(input.body).byteLength > 0;
+    if (hasBody) {
+      throw new Error("a paid GET request must not carry a body");
+    }
+    if (input.contentType !== void 0 && input.contentType !== null) {
+      throw new Error("a paid GET request must not declare a content type");
+    }
+    return freeze({
+      url,
+      method,
+      body: EMPTY_BODY,
+      contentType: null,
+      bodyHash: hashRequestBody(null)
+    });
+  }
+  const body = assertWithinCap(
+    input.body === void 0 || input.body === null ? EMPTY_BODY : toBytes(input.body)
+  );
+  const contentType = input.contentType === void 0 || input.contentType === null ? null : normalizeContentType(input.contentType);
+  return freeze({
+    url,
+    method,
+    body,
+    contentType,
+    bodyHash: hashRequestBody(body)
+  });
+}
+function canonicalJson(value, seen = /* @__PURE__ */ new Set()) {
+  if (value === null) return "null";
+  const type = typeof value;
+  if (type === "boolean") return value ? "true" : "false";
+  if (type === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("json value must be finite; NaN and Infinity are not payable");
+    }
+    return JSON.stringify(value);
+  }
+  if (type === "string") return JSON.stringify(value);
+  if (type === "bigint") {
+    throw new Error("json value must not contain a bigint");
+  }
+  if (type === "undefined" || type === "function" || type === "symbol") {
+    throw new Error(`json value must not contain ${type}`);
+  }
+  const object = value;
+  if (seen.has(object)) {
+    throw new Error("json value must not be cyclic");
+  }
+  seen.add(object);
+  try {
+    if (Array.isArray(object)) {
+      return `[${object.map((item) => canonicalJson(item, seen)).join(",")}]`;
+    }
+    const entries = Object.entries(object).sort(
+      ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+    );
+    return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item, seen)}`).join(",")}}`;
+  } finally {
+    seen.delete(object);
+  }
+}
+function isPlainJsonObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) && Object.getPrototypeOf(value) !== null && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(Object.getPrototypeOf(value)) === null);
+}
+function normalizeMcpPaidHttpRequest(input) {
+  const method = assertPaidMethod(input.method);
+  if (method === "GET") {
+    if (input.json !== void 0) {
+      throw new Error("a paid GET request must not carry json");
+    }
+    return normalizePaidHttpRequest({ url: input.url, method });
+  }
+  if (!isPlainJsonObject(input.json)) {
+    throw new Error("paid POST json must be a JSON object");
+  }
+  return normalizePaidHttpRequest({
+    url: input.url,
+    method,
+    body: canonicalJson(input.json),
+    contentType: MCP_JSON_CONTENT_TYPE
+  });
+}
+
+// src/auth.ts
+import { homedir } from "os";
+import { join } from "path";
+import {
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  chmodSync,
+  unlinkSync,
+  existsSync,
+  fsyncSync,
+  openSync,
+  closeSync,
+  writeSync
+} from "fs";
+import { Ed25519Keypair } from "@mysten/sui/keypairs/ed25519";
+import { fromBase64 as fromBase642 } from "@mysten/sui/utils";
+import { bytesToHex } from "@noble/hashes/utils";
+function credsDir() {
+  return join(homedir(), ".suipay");
+}
+function credsPath() {
+  return join(credsDir(), "credentials.json");
+}
+var HEX64 = /^[0-9a-fA-F]{64}$/;
+var ADDR = /^0x[0-9a-fA-F]{64}$/;
+function isValid(obj) {
+  if (!obj || typeof obj !== "object") return false;
+  const c = obj;
+  return typeof c.delegatePrivateKey === "string" && HEX64.test(c.delegatePrivateKey) && typeof c.delegatePublicKeyHex === "string" && HEX64.test(c.delegatePublicKeyHex) && typeof c.delegateAddress === "string" && ADDR.test(c.delegateAddress) && typeof c.ownerAddress === "string" && ADDR.test(c.ownerAddress) && typeof c.allowanceId === "string" && ADDR.test(c.allowanceId) && typeof c.packageId === "string" && ADDR.test(c.packageId) && typeof c.recipient === "string" && ADDR.test(c.recipient) && typeof c.coinType === "string" && c.coinType.length > 0 && typeof c.gatewayUrl === "string" && typeof c.network === "string" && typeof c.maxPerPayment === "string" && /^\d+$/.test(c.maxPerPayment) && typeof c.createdAt === "string" && c.version === 1;
+}
+function loadCreds() {
+  const path = credsPath();
+  if (!existsSync(path)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error(`credentials file at ${path} is not valid JSON - refusing to continue`);
+  }
+  if (!isValid(parsed)) {
+    throw new Error(`credentials file at ${path} failed schema validation - refusing to continue`);
+  }
+  return parsed;
+}
+function clearCreds() {
+  const path = credsPath();
+  try {
+    unlinkSync(path);
+  } catch (error2) {
+    if (error2.code === "ENOENT") return;
+    throw new Error(`could not remove credentials at ${path}`);
+  }
+}
+function walletFromSeedHex(seedHex) {
+  const kp = Ed25519Keypair.fromSecretKey(Uint8Array.from(Buffer.from(seedHex, "hex")));
+  return {
+    address: kp.getPublicKey().toSuiAddress(),
+    async signTransaction(txBytes) {
+      const { signature } = await kp.signTransaction(fromBase642(txBytes));
+      return signature;
+    }
+  };
+}
+function walletFromEnvSecret(raw) {
+  const key = raw.trim();
+  if (!key) throw new Error("SUI_SECRET_KEY is set but empty");
+  let kp;
+  try {
+    kp = /^(0x)?[0-9a-fA-F]{64}$/.test(key) ? Ed25519Keypair.fromSecretKey(Uint8Array.from(Buffer.from(key.replace(/^0x/, ""), "hex"))) : Ed25519Keypair.fromSecretKey(key);
+  } catch {
+    throw new Error("SUI_SECRET_KEY is malformed (expected 64-hex or suiprivkey1\u2026 Ed25519 secret)");
+  }
+  return {
+    address: kp.getPublicKey().toSuiAddress(),
+    async signTransaction(txBytes) {
+      const { signature } = await kp.signTransaction(fromBase642(txBytes));
+      return signature;
+    }
+  };
+}
+function loadPaymentProfile() {
+  const creds = loadCreds();
+  if (!creds) return null;
+  const seed = Uint8Array.from(Buffer.from(creds.delegatePrivateKey, "hex"));
+  const kp = Ed25519Keypair.fromSecretKey(seed);
+  const pubHex = bytesToHex(kp.getPublicKey().toRawBytes());
+  if (pubHex !== creds.delegatePublicKeyHex.toLowerCase()) {
+    throw new Error("credentials file tampered: stored public key does not match the private key");
+  }
+  if (kp.getPublicKey().toSuiAddress() !== creds.delegateAddress) {
+    throw new Error("credentials file tampered: stored delegate address does not match the private key");
+  }
+  const env = process.env.SUI_SECRET_KEY;
+  if (env !== void 0) {
+    const wallet = walletFromEnvSecret(env);
+    if (wallet.address !== creds.delegateAddress) {
+      throw new Error("SUI_SECRET_KEY does not match the stored delegate address - refusing to sign");
+    }
+    return { creds, wallet, source: "secret-key" };
+  }
+  return { creds, wallet: walletFromSeedHex(creds.delegatePrivateKey), source: "credentials" };
+}
+
+// src/shared-pool-pay.ts
+import { setTimeout as delay2 } from "timers/promises";
+import { Transaction as Transaction4 } from "@mysten/sui/transactions";
+import {
+  fromBase64 as fromBase644,
+  normalizeStructTag as normalizeStructTag5,
+  normalizeSuiAddress as normalizeSuiAddress4,
+  toBase64 as toBase643
+} from "@mysten/sui/utils";
+import { Ed25519Keypair as Ed25519Keypair2 } from "@mysten/sui/keypairs/ed25519";
+
+// ../../src/policy/grant-target.ts
+function normalizeHash(hex) {
+  return hex.replace(/^0x/i, "").toLowerCase();
+}
+function grantAuthorityUsable(snapshot) {
+  if (snapshot.status === "paused") {
+    return { ok: false, reason: "grant is paused" };
+  }
+  if (snapshot.status === "revoked") {
+    return { ok: false, reason: "grant is revoked" };
+  }
+  if (snapshot.status === "expired") {
+    return { ok: false, reason: "grant is expired" };
+  }
+  if (snapshot.status !== "active") {
+    return { ok: false, reason: `grant status is ${snapshot.status}` };
+  }
+  if (!snapshot.grantObjectId?.trim()) {
+    return { ok: false, reason: "grant is not finalized (missing grantObjectId)" };
+  }
+  if (!snapshot.poolObjectId?.trim()) {
+    return { ok: false, reason: "poolObjectId is required" };
+  }
+  return {
+    ok: true,
+    grantObjectId: snapshot.grantObjectId,
+    poolObjectId: snapshot.poolObjectId
+  };
+}
+function resolveGrantTarget(snapshot, offerTargetHash) {
+  if (!offerTargetHash?.trim()) {
+    return { ok: false, reason: "offer.targetHash is required" };
+  }
+  const wanted = normalizeHash(offerTargetHash);
+  if (!/^[0-9a-f]{64}$/.test(wanted)) {
+    return { ok: false, reason: "offer.targetHash must be 32-byte hex" };
+  }
+  const usable = grantAuthorityUsable(snapshot);
+  if (!usable.ok) {
+    return usable;
+  }
+  const hits = [];
+  for (const policy2 of snapshot.policies) {
+    if (policy2.status !== "active") continue;
+    for (const target of policy2.targets) {
+      if (normalizeHash(target.targetHash) === wanted) {
+        hits.push({
+          policyId: policy2.policyId,
+          onChainPolicyId: policy2.onChainPolicyId,
+          maxPerPayment: target.maxPerPayment
+        });
+      }
+    }
+  }
+  if (hits.length > 1) {
+    return {
+      ok: false,
+      reason: `target hash resolves to ${hits.length} active policies (EPolicyConflict)`
+    };
+  }
+  if (hits.length === 1) {
+    const hit = hits[0];
+    return {
+      ok: true,
+      policyId: hit.policyId,
+      onChainPolicyId: hit.onChainPolicyId,
+      targetHash: wanted,
+      maxPerPayment: hit.maxPerPayment,
+      poolObjectId: usable.poolObjectId,
+      grantObjectId: usable.grantObjectId,
+      coinType: snapshot.coinType,
+      delegateAddress: snapshot.delegateAddress
+    };
+  }
+  return {
+    ok: false,
+    reason: "no active policy in grant snapshot matches offer.targetHash"
+  };
+}
+
+// ../../src/protocol/terms.ts
+import { createHash as createHash3 } from "crypto";
+function paymentIdHash(challengeId) {
+  if (typeof challengeId !== "string" || !challengeId.trim()) {
+    throw new Error("challengeId is required for paymentIdHash");
+  }
+  return createHash3("sha256").update(challengeId, "utf8").digest();
+}
+function termsHash(offer) {
+  if (typeof offer.digest !== "string" || !offer.digest.trim()) {
+    throw new Error("offer.digest is required for termsHash");
+  }
+  return createHash3("sha256").update(offer.digest, "utf8").digest();
+}
+
+// ../../src/protocol/rail.ts
+var SETTLEMENT_RAILS = [
+  "direct",
+  "allowance",
+  "shared_pool",
+  "auth_capture",
+  "subscription"
+];
+var DIALECT_ORDER = ["mpp", "x402"];
+function isSettlementRail(value) {
+  return typeof value === "string" && SETTLEMENT_RAILS.includes(value);
+}
+function assertSettlementRail(value) {
+  if (!isSettlementRail(value)) {
+    throw new Error(
+      `invalid settlement rail: ${String(value)} (expected ${SETTLEMENT_RAILS.join(" | ")})`
+    );
+  }
+  return value;
+}
+function isDialect(value) {
+  return value === "mpp" || value === "x402";
+}
+function isDialectMode(value) {
+  return value === "transaction" || value === "finalized-proof";
+}
+function dialectsFromModes(modes) {
+  return DIALECT_ORDER.filter((d) => modes[d] != null);
+}
+function dialectMode(authority, dialect) {
+  const mode = authority.dialectModes[dialect];
+  if (!mode) {
+    throw new Error(
+      `${authority.rail} has no dialectMode for ${dialect} (ceiling: ${authority.supportedDialects.join(",")})`
+    );
+  }
+  return mode;
+}
+function createSettlementRailAuthority(input) {
+  assertSettlementRail(input.rail);
+  if (typeof input.packageId !== "string" || !input.packageId.trim()) {
+    throw new Error("packageId is required");
+  }
+  if (typeof input.module !== "string" || !input.module.trim()) {
+    throw new Error("module is required");
+  }
+  if (typeof input.payFunction !== "string" || !input.payFunction.trim()) {
+    throw new Error("payFunction is required");
+  }
+  const keys = Object.keys(input.dialectModes ?? {});
+  if (!keys.length) {
+    throw new Error("dialectModes must be non-empty");
+  }
+  for (const d of keys) {
+    if (!isDialect(d)) {
+      throw new Error(`unknown dialect in dialectModes: ${String(d)}`);
+    }
+    const mode = input.dialectModes[d];
+    if (!isDialectMode(mode)) {
+      throw new Error(
+        `invalid dialectMode for ${d}: ${String(mode)}`
+      );
+    }
+  }
+  const dialectModes = Object.freeze({ ...input.dialectModes });
+  const supportedDialects = Object.freeze(
+    dialectsFromModes(dialectModes)
+  );
+  const proofMode = dialectModes.mpp ?? dialectModes.x402 ?? "transaction";
+  return Object.freeze({
+    rail: input.rail,
+    packageId: input.packageId.trim(),
+    module: input.module.trim(),
+    payFunction: input.payFunction.trim(),
+    dialectModes,
+    supportedDialects,
+    proofMode
+  });
+}
+function defaultAuthorityForRail(rail, packageId, opts) {
+  switch (rail) {
+    case "shared_pool": {
+      const dual = opts?.enableSharedPoolX402 === true;
+      return createSettlementRailAuthority({
+        rail: "shared_pool",
+        packageId,
+        module: "shared_pool",
+        payFunction: "pay",
+        dialectModes: dual ? { mpp: "finalized-proof", x402: "transaction" } : { mpp: "finalized-proof" }
+      });
+    }
+    case "allowance":
+      return createSettlementRailAuthority({
+        rail: "allowance",
+        packageId,
+        module: "allowance",
+        payFunction: "pay",
+        dialectModes: {
+          mpp: "finalized-proof",
+          x402: "transaction"
+        }
+      });
+    case "subscription":
+      return createSettlementRailAuthority({
+        rail: "subscription",
+        packageId,
+        module: "subscription",
+        payFunction: "charge",
+        dialectModes: {
+          mpp: "transaction",
+          x402: "transaction"
+        }
+      });
+    case "direct":
+      return createSettlementRailAuthority({
+        rail: "direct",
+        packageId,
+        module: "payment",
+        payFunction: "pay",
+        dialectModes: {
+          mpp: "transaction",
+          x402: "transaction"
+        }
+      });
+    case "auth_capture":
+      return createSettlementRailAuthority({
+        rail: "auth_capture",
+        packageId,
+        module: "auth_capture",
+        payFunction: "authorize",
+        dialectModes: {
+          x402: "transaction"
+        }
+      });
+    default: {
+      const _exhaustive = rail;
+      throw new Error(`unhandled rail: ${String(_exhaustive)}`);
+    }
+  }
+}
+
+// ../../src/protocol/auth-params.ts
+var TOKEN = /^[A-Za-z0-9!#$%&'*+\-.^_`|~]+$/;
+function formatAuthParams(params) {
+  return Object.entries(params).map(([k, v]) => `${k}=${TOKEN.test(v) ? v : quote(v)}`).join(", ");
+}
+function quote(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function parseAuthHeader(header) {
+  const trimmed = header.trim();
+  const firstSpace = trimmed.indexOf(" ");
+  if (firstSpace === -1) return null;
+  const scheme = trimmed.slice(0, firstSpace);
+  if (!TOKEN.test(scheme)) return null;
+  const params = parseParams(trimmed.slice(firstSpace + 1));
+  return params === null ? null : { scheme, params };
+}
+function parseParams(input) {
+  const params = {};
+  let i = 0;
+  const skipSpace = () => {
+    while (i < input.length && (input[i] === " " || input[i] === "	")) i++;
+  };
+  skipSpace();
+  while (i < input.length) {
+    const keyStart = i;
+    while (i < input.length && input[i] !== "=") i++;
+    if (i >= input.length) return null;
+    const key = input.slice(keyStart, i).trim();
+    if (!TOKEN.test(key)) return null;
+    i++;
+    let value;
+    if (input[i] === '"') {
+      i++;
+      let out = "";
+      let closed = false;
+      while (i < input.length) {
+        const ch = input[i];
+        if (ch === "\\" && i + 1 < input.length) {
+          out += input[i + 1];
+          i += 2;
+          continue;
+        }
+        if (ch === '"') {
+          i++;
+          closed = true;
+          break;
+        }
+        out += ch;
+        i++;
+      }
+      if (!closed) return null;
+      value = out;
+    } else {
+      const start = i;
+      while (i < input.length && input[i] !== ",") i++;
+      value = input.slice(start, i).trim();
+    }
+    params[key] = value;
+    skipSpace();
+    if (i < input.length) {
+      if (input[i] !== ",") return null;
+      i++;
+      skipSpace();
+    }
+  }
+  return params;
+}
+
+// ../../src/protocol/mpp.ts
+var MPP_SCHEME = "Payment";
+var MPP_METHOD = "sui.charge";
+var MPP_CHALLENGE_HEADER = "WWW-Authenticate";
+var MPP_CREDENTIAL_HEADER = "Authorization";
+var MPP_RECEIPT_HEADER = "Payment-Receipt";
+function decodeChallenge(header) {
+  const parsed = parseAuthHeader(header);
+  if (!parsed || parsed.scheme !== MPP_SCHEME) return null;
+  const p = parsed.params;
+  if (p.method !== MPP_METHOD) return null;
+  const required = [
+    "challenge",
+    "amount",
+    "asset",
+    "decimals",
+    "network",
+    "recipient",
+    "package",
+    "resource",
+    "issued",
+    "expires",
+    "digest"
+  ];
+  if (required.some((k) => !p[k])) return null;
+  const issuedAt = Date.parse(p.issued);
+  const expiresAt = Date.parse(p.expires);
+  const decimals = Number(p.decimals);
+  if (Number.isNaN(issuedAt) || Number.isNaN(expiresAt) || Number.isNaN(decimals)) return null;
+  const offer = {
+    challengeId: p.challenge,
+    resource: p.resource,
+    description: p.description ?? "",
+    mimeType: p.type ?? "application/json",
+    amount: p.amount,
+    asset: p.asset,
+    decimals,
+    network: p.network,
+    payTo: p.recipient,
+    packageId: p.package,
+    issuedAt,
+    expiresAt,
+    digest: p.digest
+  };
+  if (p.net_amount !== void 0) offer.netAmount = p.net_amount;
+  if (p.platform_fee !== void 0) offer.platformFee = p.platform_fee;
+  if (p.digest_version !== void 0) {
+    const v = Number(p.digest_version);
+    if (v === 1 || v === 2 || v === 3) offer.digestVersion = v;
+  }
+  if (p.settlement_rail === "direct" || p.settlement_rail === "allowance" || p.settlement_rail === "shared_pool" || p.settlement_rail === "auth_capture" || p.settlement_rail === "subscription") {
+    offer.settlementRail = p.settlement_rail;
+  }
+  if (p.service_id !== void 0) offer.serviceId = p.service_id;
+  if (p.service_revision !== void 0) {
+    const rev = Number(p.service_revision);
+    if (Number.isFinite(rev)) offer.serviceRevision = rev;
+  }
+  if (p.target_hash !== void 0) offer.targetHash = p.target_hash;
+  if (p.authorization_epoch !== void 0) {
+    const epoch = Number(p.authorization_epoch);
+    if (Number.isFinite(epoch)) offer.authorizationEpoch = epoch;
+  }
+  if (p.http_method !== void 0) offer.method = p.http_method;
+  if (p.http_path !== void 0) offer.path = p.http_path;
+  if (p.body_hash !== void 0) {
+    if (!isBodyHash(p.body_hash)) return null;
+    offer.bodyHash = p.body_hash;
+  }
+  if (p.content_type !== void 0) {
+    if (!isOfferContentType(p.content_type)) return null;
+    offer.contentType = p.content_type;
+  }
+  if (p.intent === "charge" || p.intent === "subscription") offer.intent = p.intent;
+  if (p.period_ms !== void 0) {
+    const ms = Number(p.period_ms);
+    if (Number.isFinite(ms)) offer.periodMs = ms;
+  }
+  if (p.period_count !== void 0) {
+    const count = Number(p.period_count);
+    if (Number.isFinite(count)) offer.periodCount = count;
+  }
+  if (p.refundable === "true") offer.refundable = true;
+  else if (p.refundable === "false") offer.refundable = false;
+  if (p.refund_window_ms !== void 0) {
+    const ms = Number(p.refund_window_ms);
+    if (Number.isFinite(ms)) offer.refundWindowMs = ms;
+  }
+  if (p.decide_window_ms !== void 0) {
+    const ms = Number(p.decide_window_ms);
+    if (Number.isFinite(ms)) offer.decideWindowMs = ms;
+  }
+  if (p.chain_id !== void 0) {
+    const id = Number(p.chain_id);
+    if (Number.isFinite(id)) offer.chainId = id;
+  }
+  if (p.payment_salt !== void 0) offer.paymentSalt = p.payment_salt;
+  if (p.refund_to !== void 0) offer.refundTo = p.refund_to;
+  if (p.sponsor_gas_owner !== void 0) {
+    offer.sponsorGasOwner = p.sponsor_gas_owner;
+  }
+  if (p.sponsor_gas_budget !== void 0) {
+    offer.sponsorGasBudget = p.sponsor_gas_budget;
+  }
+  if (p.sponsor_gas_price !== void 0) {
+    offer.sponsorGasPrice = p.sponsor_gas_price;
+  }
+  if (p.sponsor_gas_payment !== void 0) {
+    offer.sponsorGasPayment = p.sponsor_gas_payment;
+  }
+  return offer;
+}
+function encodeProof(proof) {
+  return `${MPP_SCHEME} ${formatAuthParams({
+    method: MPP_METHOD,
+    challenge: proof.challengeId,
+    payer: proof.payer,
+    offer: Buffer.from(JSON.stringify(proof.offer), "utf8").toString("base64url"),
+    digest: proof.txDigest
+  })}`;
+}
+function decodeReceipt(header) {
+  const parsed = parseAuthHeader(`X ${header}`);
+  if (!parsed) return null;
+  const p = parsed.params;
+  if (!p.challenge || !p.tx_digest || !p.payer || !p.amount || !p.asset || !p.network) return null;
+  const receipt = {
+    challengeId: p.challenge,
+    txDigest: p.tx_digest,
+    network: p.network,
+    payer: p.payer,
+    amount: p.amount,
+    asset: p.asset,
+    status: "settled"
+  };
+  if (p.request_digest) receipt.requestDigest = p.request_digest;
+  if (p.net_amount !== void 0) receipt.netAmount = p.net_amount;
+  if (p.platform_fee !== void 0) receipt.platformFee = p.platform_fee;
+  if (p.intent === "charge" || p.intent === "subscription") receipt.intent = p.intent;
+  if (p.mandate_id !== void 0) receipt.mandateId = p.mandate_id;
+  if (p.period_index !== void 0) receipt.periodIndex = p.period_index;
+  return receipt;
+}
+
+// ../../src/protocol/x402.ts
+var X402_VERSION = 2;
+var X402_SCHEME = "exact";
+var X402_SCHEME_AUTH_CAPTURE = "auth-capture";
+var X402_CREDENTIAL_HEADER = "X-PAYMENT";
+var X402_RECEIPT_HEADER = "X-PAYMENT-RESPONSE";
+function toAccept(offer, authority) {
+  const auth = authority ?? defaultAuthorityForRail(offer.settlementRail ?? "direct", offer.packageId);
+  const suipay = {
+    challengeId: offer.challengeId,
+    packageId: offer.packageId,
+    module: auth.module,
+    function: auth.payFunction,
+    decimals: offer.decimals,
+    issuedAt: offer.issuedAt,
+    expiresAt: offer.expiresAt,
+    digest: offer.digest
+  };
+  if (offer.netAmount !== void 0) suipay.netAmount = offer.netAmount;
+  if (offer.platformFee !== void 0) suipay.platformFee = offer.platformFee;
+  if (offer.digestVersion !== void 0) suipay.digestVersion = offer.digestVersion;
+  if (offer.settlementRail !== void 0) suipay.settlementRail = offer.settlementRail;
+  if (offer.serviceId !== void 0) suipay.serviceId = offer.serviceId;
+  if (offer.serviceRevision !== void 0) suipay.serviceRevision = offer.serviceRevision;
+  if (offer.targetHash !== void 0) suipay.targetHash = offer.targetHash;
+  if (offer.authorizationEpoch !== void 0) {
+    suipay.authorizationEpoch = offer.authorizationEpoch;
+  }
+  if (offer.method !== void 0) suipay.method = offer.method;
+  if (offer.path !== void 0) suipay.path = offer.path;
+  if (offer.bodyHash !== void 0) suipay.bodyHash = offer.bodyHash;
+  if (offer.contentType !== void 0) suipay.contentType = offer.contentType;
+  if (offer.intent !== void 0) suipay.intent = offer.intent;
+  if (offer.periodMs !== void 0) suipay.periodMs = offer.periodMs;
+  if (offer.periodCount !== void 0) suipay.periodCount = offer.periodCount;
+  if (offer.refundable !== void 0) suipay.refundable = offer.refundable;
+  if (offer.refundWindowMs !== void 0) suipay.refundWindowMs = offer.refundWindowMs;
+  if (offer.decideWindowMs !== void 0) suipay.decideWindowMs = offer.decideWindowMs;
+  if (offer.chainId !== void 0) suipay.chainId = offer.chainId;
+  if (offer.paymentSalt !== void 0) suipay.paymentSalt = offer.paymentSalt;
+  if (offer.refundTo !== void 0) suipay.refundTo = offer.refundTo;
+  if (offer.sponsorGasOwner !== void 0) {
+    suipay.sponsorGasOwner = offer.sponsorGasOwner;
+  }
+  if (offer.sponsorGasBudget !== void 0) {
+    suipay.sponsorGasBudget = offer.sponsorGasBudget;
+  }
+  if (offer.sponsorGasPrice !== void 0) {
+    suipay.sponsorGasPrice = offer.sponsorGasPrice;
+  }
+  if (offer.sponsorGasPayment !== void 0) {
+    suipay.sponsorGasPayment = offer.sponsorGasPayment;
+  }
+  const scheme = offer.settlementRail === "auth_capture" ? X402_SCHEME_AUTH_CAPTURE : X402_SCHEME;
+  return {
+    scheme,
+    network: offer.network,
+    amount: offer.amount,
+    asset: offer.asset,
+    payTo: offer.payTo,
+    maxTimeoutSeconds: Math.max(1, Math.round((offer.expiresAt - offer.issuedAt) / 1e3)),
+    extra: { suipay }
+  };
+}
+function decodeChallenge2(body) {
+  const b = body;
+  if (!b || typeof b !== "object" || !Array.isArray(b.accepts) || !b.resource) return null;
+  const accept = b.accepts.find(
+    (a) => (a?.scheme === X402_SCHEME || a?.scheme === X402_SCHEME_AUTH_CAPTURE) && a?.extra?.suipay
+  );
+  if (!accept) return null;
+  return fromAccept(accept, b.resource);
+}
+function fromAccept(accept, resource) {
+  const s = accept.extra?.suipay;
+  if (!s || !s.challengeId || !s.packageId || !s.digest) return null;
+  if (!accept.amount || !accept.asset || !accept.payTo || !accept.network) return null;
+  const offer = {
+    challengeId: s.challengeId,
+    resource: resource.url,
+    description: resource.description ?? "",
+    mimeType: resource.mimeType ?? "application/json",
+    amount: accept.amount,
+    asset: accept.asset,
+    decimals: s.decimals,
+    network: accept.network,
+    payTo: accept.payTo,
+    packageId: s.packageId,
+    issuedAt: s.issuedAt,
+    expiresAt: s.expiresAt,
+    digest: s.digest
+  };
+  if (s.netAmount !== void 0) offer.netAmount = s.netAmount;
+  if (s.platformFee !== void 0) offer.platformFee = s.platformFee;
+  if (s.digestVersion === 1 || s.digestVersion === 2 || s.digestVersion === 3) {
+    offer.digestVersion = s.digestVersion;
+  }
+  if (s.settlementRail !== void 0 && isSettlementRail(s.settlementRail)) {
+    offer.settlementRail = s.settlementRail;
+  }
+  if (s.serviceId !== void 0) offer.serviceId = s.serviceId;
+  if (s.serviceRevision !== void 0) offer.serviceRevision = s.serviceRevision;
+  if (s.targetHash !== void 0) offer.targetHash = s.targetHash;
+  if (s.authorizationEpoch !== void 0) offer.authorizationEpoch = s.authorizationEpoch;
+  if (s.method !== void 0) offer.method = s.method;
+  if (s.path !== void 0) offer.path = s.path;
+  if (s.bodyHash !== void 0) {
+    if (!isBodyHash(s.bodyHash)) return null;
+    offer.bodyHash = s.bodyHash;
+  }
+  if (s.contentType !== void 0) {
+    if (!isOfferContentType(s.contentType)) return null;
+    offer.contentType = s.contentType;
+  }
+  if (s.intent === "charge" || s.intent === "subscription") offer.intent = s.intent;
+  if (s.periodMs !== void 0) offer.periodMs = s.periodMs;
+  if (s.periodCount !== void 0) offer.periodCount = s.periodCount;
+  if (s.refundable !== void 0) offer.refundable = s.refundable;
+  if (s.refundWindowMs !== void 0) offer.refundWindowMs = s.refundWindowMs;
+  if (s.decideWindowMs !== void 0) offer.decideWindowMs = s.decideWindowMs;
+  if (s.chainId !== void 0) offer.chainId = s.chainId;
+  if (s.paymentSalt !== void 0) offer.paymentSalt = s.paymentSalt;
+  if (s.refundTo !== void 0) offer.refundTo = s.refundTo;
+  if (s.sponsorGasOwner !== void 0) offer.sponsorGasOwner = s.sponsorGasOwner;
+  if (s.sponsorGasBudget !== void 0) {
+    offer.sponsorGasBudget = s.sponsorGasBudget;
+  }
+  if (s.sponsorGasPrice !== void 0) offer.sponsorGasPrice = s.sponsorGasPrice;
+  if (s.sponsorGasPayment !== void 0) {
+    offer.sponsorGasPayment = s.sponsorGasPayment;
+  }
+  return offer;
+}
+function encodeCredential(cred) {
+  const payload = {
+    x402Version: X402_VERSION,
+    resource: {
+      url: cred.offer.resource,
+      description: cred.offer.description,
+      mimeType: cred.offer.mimeType
+    },
+    accepted: toAccept(cred.offer),
+    payload: {
+      challengeId: cred.challengeId,
+      payer: cred.payer,
+      txBytes: cred.txBytes,
+      signature: cred.signature
+    }
+  };
+  return Buffer.from(JSON.stringify(payload), "utf8").toString("base64");
+}
+function decodeReceipt2(header) {
+  try {
+    const r = JSON.parse(Buffer.from(header, "base64").toString("utf8"));
+    if (!r?.success || !r.transaction) return null;
+    const receipt = {
+      challengeId: r.challengeId,
+      txDigest: r.transaction,
+      network: r.network,
+      payer: r.payer,
+      amount: r.amount,
+      asset: r.asset,
+      status: "settled"
+    };
+    if (typeof r.requestDigest === "string") receipt.requestDigest = r.requestDigest;
+    if (typeof r.netAmount === "string") receipt.netAmount = r.netAmount;
+    if (typeof r.platformFee === "string") receipt.platformFee = r.platformFee;
+    return receipt;
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/protocol/carrier.ts
+async function readChallenge(res, dialect) {
+  if (dialect === "mpp") {
+    const header = res.headers.get(MPP_CHALLENGE_HEADER);
+    return header ? decodeChallenge(header) : null;
+  }
+  return decodeChallenge2(await readBody(res));
+}
+function readReceipt(res, dialect) {
+  const header = dialect === "mpp" ? res.headers.get(MPP_RECEIPT_HEADER) : res.headers.get(X402_RECEIPT_HEADER);
+  if (!header) return null;
+  return dialect === "mpp" ? decodeReceipt(header) : decodeReceipt2(header);
+}
+var MAX_INLINE_BINARY_BYTES = 256 * 1024;
+function decodeUtf8OrNull(bytes) {
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+  } catch {
+    return null;
+  }
+}
+async function readBody(res) {
+  const bytes = new Uint8Array(await res.arrayBuffer());
+  const text2 = decodeUtf8OrNull(bytes);
+  if (text2 !== null) {
+    try {
+      return JSON.parse(text2);
+    } catch {
+      return text2;
+    }
+  }
+  const contentType = res.headers.get("content-type")?.split(";")[0]?.trim() || "application/octet-stream";
+  const binary = {
+    __binary: true,
+    contentType,
+    byteLength: bytes.byteLength
+  };
+  if (bytes.byteLength <= MAX_INLINE_BINARY_BYTES) {
+    binary.base64 = Buffer.from(bytes).toString("base64");
+  }
+  return binary;
+}
+
+// ../../src/trace/context.ts
+import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+
+// ../../src/trace/types.ts
+var DEFAULT_TRACE_LIMITS = {
+  maxEventsPerRun: 200,
+  maxPayloadBytesPerEvent: 16 * 1024,
+  maxPayloadBytesPerRun: 2 * 1024 * 1024,
+  retentionMs: 24 * 60 * 60 * 1e3
+};
+
+// ../../src/trace/redact.ts
+function policy(publicMetadata, technicalMetadata, content = {}) {
+  return {
+    public: { metadata: publicMetadata, content: content.public ?? [] },
+    technical: { metadata: technicalMetadata, content: content.technical ?? [] }
+  };
+}
+var TRACE_FIELD_POLICY = {
+  mcp_connected: policy(
+    ["clientName", "protocolVersion", "connectionState"],
+    ["clientName", "clientVersion", "protocolVersion", "transport", "connectionState"]
+  ),
+  tools_listed: policy(["toolCount"], ["toolCount", "toolNames"]),
+  tool_called: policy(["tool", "resource"], ["jsonRpcId", "tool", "resource"], {
+    public: ["question"],
+    technical: ["arguments"]
+  }),
+  tool_result: policy(
+    ["tool", "resultCount", "durationMs"],
+    ["jsonRpcId", "tool", "resultCount", "durationMs"],
+    { public: ["answer"], technical: ["result"] }
+  ),
+  tool_error: policy(["tool", "errorCode"], ["jsonRpcId", "tool", "errorCode"], {
+    technical: ["errorMessage"]
+  }),
+  challenge_received: policy(
+    ["serviceId", "serviceName", "amountAtomic", "asset", "decimals", "rail", "dialect", "httpStatus"],
+    [
+      "serviceId",
+      "serviceName",
+      "amountAtomic",
+      "asset",
+      "decimals",
+      "rail",
+      "dialect",
+      "httpStatus",
+      "network",
+      "payTo",
+      "challengeId",
+      "offerCount"
+    ]
+  ),
+  authority_matched: policy(
+    ["serviceId", "rail", "decision"],
+    ["serviceId", "rail", "decision", "grantId", "policyId", "profileId", "capsRemaining", "authorityEpoch"]
+  ),
+  authority_revalidated: policy(
+    ["decision"],
+    ["decision", "grantId", "authorityEpoch"]
+  ),
+  sponsor_requested: policy(["sponsor"], ["sponsor", "intentDigest", "serviceId"]),
+  transaction_sponsored: policy(
+    ["sponsor", "gasBudget"],
+    ["sponsor", "gasBudget", "intentDigest", "serviceId"]
+  ),
+  delegate_signed: policy(["delegateAddress"], ["delegateAddress", "intentDigest"]),
+  transaction_submitted: policy(["digest"], ["digest", "network"]),
+  payment_finalized: policy(
+    ["digest", "amountAtomic", "asset", "decimals"],
+    ["digest", "amountAtomic", "asset", "decimals", "network", "eventType", "checkpoint", "payTo"]
+  ),
+  proof_presented: policy(["dialect", "serviceId"], ["dialect", "serviceId", "digest", "proofScheme"]),
+  upstream_delivered: policy(
+    // mimeType and byteCount are safe structural metadata (a content type and a
+    // length, never body bytes), promoted to public so the owner audience view
+    // can tell a delivery was an image and offer an inline preview.
+    ["serviceId", "httpStatus", "durationMs", "mimeType", "byteCount"],
+    ["serviceId", "httpStatus", "durationMs", "mimeType", "byteCount"],
+    { public: ["answer"], technical: ["body"] }
+  ),
+  upstream_delivery_failed: policy(
+    ["serviceId", "httpStatus", "failureCode"],
+    ["serviceId", "httpStatus", "failureCode", "durationMs"]
+  ),
+  settlement_projected: policy(
+    ["serviceId", "amountAtomic", "asset"],
+    ["serviceId", "amountAtomic", "asset", "digest", "settlementId", "rail"]
+  ),
+  settlement_projection_failed: policy(
+    ["serviceId", "failureCode"],
+    ["serviceId", "failureCode", "digest"]
+  ),
+  receipt_issued: policy(
+    ["serviceId", "amountAtomic", "asset", "decimals", "digest", "payTo"],
+    [
+      "serviceId",
+      "amountAtomic",
+      "asset",
+      "decimals",
+      "digest",
+      "payTo",
+      "receiptId",
+      "rail",
+      "network",
+      "explorerUrl"
+    ]
+  ),
+  payment_failed: policy(
+    ["serviceId", "stage", "failureCode"],
+    ["serviceId", "stage", "failureCode", "errorCode"],
+    { technical: ["errorMessage"] }
+  ),
+  payment_ambiguous: policy(
+    ["serviceId", "stage", "digest"],
+    ["serviceId", "stage", "digest", "reasonCode"]
+  )
+};
+var MIN_OPAQUE_RUN = 20;
+var OPAQUE_RUN = new RegExp(`[A-Za-z0-9+/=_~.-]{${MIN_OPAQUE_RUN},}`, "g");
+
+// ../../src/trace/context.ts
+var DEFAULT_TRACE_IDLE_MS = 5 * 60 * 1e3;
+var TRACE_CONTEXT_VERSION = 1;
+var TRACE_HEADER_ID = "x-suipay-trace-id";
+var TRACE_HEADER_CONNECTION = "x-suipay-trace-connection";
+var TRACE_HEADER_REQUEST = "x-suipay-trace-request";
+var TRACE_HEADER_ISSUED_AT = "x-suipay-trace-issued-at";
+var TRACE_HEADER_VERSION = "x-suipay-trace-version";
+var TRACE_HEADER_SIGNATURE = "x-suipay-trace-signature";
+var NOTIFICATION = "notification";
+function canonicalTraceContext(tuple) {
+  return JSON.stringify([
+    tuple.version,
+    tuple.traceId,
+    tuple.connectionId,
+    tuple.requestId,
+    tuple.issuedAt,
+    tuple.method,
+    tuple.pathname
+  ]);
+}
+function sign(tuple, secret) {
+  return createHmac2("sha256", secret).update(canonicalTraceContext(tuple)).digest("base64url");
+}
+function signInternalTraceContext(input, secret) {
+  if (!secret) {
+    throw new Error("trace context signing requires a secret");
+  }
+  const tuple = {
+    version: TRACE_CONTEXT_VERSION,
+    traceId: input.traceId,
+    connectionId: input.connectionId,
+    requestId: input.requestId,
+    issuedAt: input.issuedAt ?? Date.now(),
+    method: input.method.toUpperCase(),
+    pathname: input.pathname
+  };
+  const headers = new Headers();
+  headers.set(TRACE_HEADER_VERSION, String(tuple.version));
+  headers.set(TRACE_HEADER_ID, tuple.traceId);
+  headers.set(TRACE_HEADER_CONNECTION, tuple.connectionId);
+  headers.set(TRACE_HEADER_REQUEST, tuple.requestId ?? NOTIFICATION);
+  headers.set(TRACE_HEADER_ISSUED_AT, String(tuple.issuedAt));
+  headers.set(TRACE_HEADER_SIGNATURE, sign(tuple, secret));
+  return headers;
+}
+function internalTraceHeaderRecord(input, secret) {
+  return Object.fromEntries(signInternalTraceContext(input, secret).entries());
+}
+
+// ../../src/protocol/request-binding.ts
+function sameResource(offered, requested) {
+  try {
+    return new URL(offered).href === new URL(requested).href;
+  } catch {
+    return false;
+  }
+}
+function requestBindingViolation(offer, request) {
+  if (offer.method !== void 0 && offer.method.toUpperCase() !== request.method) {
+    return {
+      code: "METHOD_MISMATCH",
+      reason: `offer is for ${offer.method}, request is ${request.method}`
+    };
+  }
+  if (!sameResource(offer.resource ?? "", request.url)) {
+    return {
+      code: "RESOURCE_MISMATCH",
+      reason: `offer resource ${offer.resource ?? "(none)"} does not match requested URL ${request.url}`
+    };
+  }
+  if (offer.path !== void 0 && offer.path !== new URL(request.url).pathname) {
+    return {
+      code: "PATH_MISMATCH",
+      reason: `offer path ${offer.path} does not match requested path`
+    };
+  }
+  if (request.method === "POST") {
+    if (offer.intent === "subscription" && offer.bodyHash === void 0 && offer.contentType === void 0) {
+      return null;
+    }
+    if (offer.digestVersion !== 3) {
+      return {
+        code: "OFFER_NOT_BODY_BOUND",
+        reason: "a paid POST requires an offer digest v3 that signs the request body"
+      };
+    }
+    if (offer.bodyHash !== request.bodyHash) {
+      return {
+        code: "BODY_HASH_MISMATCH",
+        reason: "offer body hash does not cover this request body"
+      };
+    }
+    if ((offer.contentType ?? null) !== request.contentType) {
+      return {
+        code: "CONTENT_TYPE_MISMATCH",
+        reason: "offer content type does not match this request body"
+      };
+    }
+    return null;
+  }
+  if (offer.bodyHash !== void 0 || offer.contentType !== void 0) {
+    return {
+      code: "UNEXPECTED_BODY_BINDING",
+      reason: "offer binds a request body, but this request carries none"
+    };
+  }
+  return null;
+}
+
+// src/sponsor.ts
+import { setTimeout as delay } from "timers/promises";
+import { Transaction as Transaction3 } from "@mysten/sui/transactions";
+import { fromBase64 as fromBase643, normalizeStructTag as normalizeStructTag4, normalizeSuiAddress as normalizeSuiAddress3 } from "@mysten/sui/utils";
+function paidRequestInit(request, extraHeaders = {}) {
+  const headers = { ...extraHeaders };
+  if (request.contentType) headers["content-type"] = request.contentType;
+  return {
+    method: request.method,
+    redirect: "manual",
+    headers,
+    // Uint8Array is a valid BodyInit at runtime; the cast only bridges the
+    // ArrayBufferLike generic that lib.dom's BodyInit does not spell out.
+    ...request.method === "POST" ? { body: request.body } : {}
+  };
+}
+
+// src/shared-pool-pay.ts
+var FINALIZATION_ATTEMPTS = 20;
+var FINALIZATION_DELAY_MS = 250;
+var SUI_CLOCK2 = "0x6";
+function traceEmitter(trace) {
+  if (!trace) return () => void 0;
+  const now = trace.now ?? Date.now;
+  return (input) => {
+    try {
+      void Promise.resolve(
+        trace.sink.emit({
+          traceId: trace.traceId,
+          requestId: trace.requestId,
+          buyerAccountId: trace.buyerAccountId,
+          connectionId: trace.connectionId,
+          at: new Date(now()).toISOString(),
+          source: input.source ?? "suipay",
+          kind: input.kind,
+          status: input.status,
+          summary: input.summary,
+          publicPayload: input.publicPayload,
+          ...input.technicalPayload ? { technicalPayload: input.technicalPayload } : {}
+        })
+      ).catch(() => void 0);
+    } catch {
+    }
+  };
+}
+function traceHeadersFor(deps, method, url) {
+  const trace = deps.trace;
+  if (!trace?.secret) return {};
+  try {
+    return internalTraceHeaderRecord(
+      {
+        traceId: trace.traceId,
+        connectionId: trace.connectionId,
+        requestId: trace.requestId,
+        method,
+        pathname: new URL(url).pathname
+      },
+      trace.secret
+    );
+  } catch {
+    return {};
+  }
+}
+function failed(code, detail, txDigest) {
+  return {
+    status: "failed",
+    paid: false,
+    code,
+    detail,
+    ...txDigest ? { txDigest } : {}
+  };
+}
+function sameAddress(a, b) {
+  try {
+    return normalizeSuiAddress4(a) === normalizeSuiAddress4(b);
+  } catch {
+    return false;
+  }
+}
+function sameStructTag(a, b) {
+  try {
+    return normalizeStructTag5(a) === normalizeStructTag5(b);
+  } catch {
+    return false;
+  }
+}
+async function sponsorPost(fetchImpl, url, body, traceHeaders = {}) {
+  try {
+    return await fetchImpl(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", ...traceHeaders },
+      body: JSON.stringify(body)
+    });
+  } catch {
+    return null;
+  }
+}
+var PRE_BROADCAST_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "EHOSTUNREACH",
+  "ENETUNREACH"
+]);
+function isProvablyPreBroadcast(err) {
+  const seen = /* @__PURE__ */ new Set();
+  let cur = err;
+  while (cur && typeof cur === "object" && !seen.has(cur)) {
+    seen.add(cur);
+    const code = cur.code;
+    if (typeof code === "string" && PRE_BROADCAST_ERROR_CODES.has(code)) {
+      return true;
+    }
+    cur = cur.cause;
+  }
+  return false;
+}
+async function responseDetail(response) {
+  const body = await readBody(response);
+  return typeof body === "string" ? body : JSON.stringify(body);
+}
+async function buildSharedPoolPayKind(input) {
+  if (!input.termsHash.length) throw new Error("termsHash must be non-empty");
+  if (!input.paymentIdHash.length) throw new Error("paymentIdHash must be non-empty");
+  const auth = defaultAuthorityForRail("shared_pool", input.packageId);
+  const target = `${normalizeSuiAddress4(auth.packageId)}::${auth.module}::${auth.payFunction}`;
+  const hashHex = input.targetHash.replace(/^0x/i, "").toLowerCase();
+  if (!/^[0-9a-f]{64}$/.test(hashHex)) throw new Error("targetHash must be 32-byte hex");
+  const hash = Uint8Array.from(Buffer.from(hashHex, "hex"));
+  const tx = new Transaction4();
+  tx.setSender(input.delegate);
+  tx.moveCall({
+    target,
+    typeArguments: [input.coinType],
+    arguments: [
+      tx.sharedObjectRef({
+        objectId: input.poolObjectId,
+        initialSharedVersion: "1",
+        mutable: true
+      }),
+      tx.sharedObjectRef({
+        objectId: input.grantObjectId,
+        initialSharedVersion: "1",
+        mutable: true
+      }),
+      tx.pure.u64(BigInt(input.policyId)),
+      tx.pure.vector("u8", Array.from(hash)),
+      tx.pure.u64(BigInt(input.amount)),
+      tx.pure.vector("u8", Array.from(input.paymentIdHash)),
+      tx.pure.vector("u8", Array.from(input.termsHash)),
+      tx.sharedObjectRef({
+        objectId: SUI_CLOCK2,
+        initialSharedVersion: "1",
+        mutable: false
+      })
+    ]
+  });
+  const bytes = await tx.build({ onlyTransactionKind: true });
+  return { kindBytes: toBase643(bytes) };
+}
+function assertSharedPoolPayReconstructs(bytes, expected) {
+  let data;
+  try {
+    data = Transaction4.from(fromBase644(bytes)).getData();
+  } catch {
+    throw new Error("sponsored transaction is not valid Sui transaction bytes");
+  }
+  if (!data.sender || !sameAddress(data.sender, expected.delegate)) {
+    throw new Error("sponsored transaction sender does not match delegate");
+  }
+  if (!data.commands || data.commands.length !== 1) {
+    throw new Error("sponsored transaction must contain exactly one command");
+  }
+  const auth = defaultAuthorityForRail("shared_pool", expected.packageId);
+  const wanted = `${normalizeSuiAddress4(auth.packageId)}::${auth.module}::${auth.payFunction}`;
+  const cmd = data.commands[0];
+  if (cmd.$kind !== "MoveCall" || !cmd.MoveCall) {
+    throw new Error("sponsored transaction is not a MoveCall");
+  }
+  const got = `${normalizeSuiAddress4(String(cmd.MoveCall.package))}::${cmd.MoveCall.module}::${cmd.MoveCall.function}`;
+  if (got !== wanted) {
+    throw new Error(`sponsored transaction does not reconstruct ${wanted}`);
+  }
+  let expectedKind;
+  try {
+    expectedKind = Transaction4.fromKind(fromBase644(expected.kindBytes)).getData();
+  } catch {
+    throw new Error("sponsored transaction kind baseline invalid");
+  }
+  if (JSON.stringify(data.commands) !== JSON.stringify(expectedKind.commands)) {
+    throw new Error("sponsored transaction commands do not match the intended payment");
+  }
+  if (JSON.stringify(data.inputs) !== JSON.stringify(expectedKind.inputs)) {
+    throw new Error(
+      "sponsored transaction inputs do not match the intended payment (pool/grant/amount/target tampered)"
+    );
+  }
+  void expected.poolObjectId;
+  void expected.grantObjectId;
+  void expected.amount;
+}
+async function signWithSeed(seed, txBytes, expectedDelegate) {
+  const kp = Ed25519Keypair2.fromSecretKey(Uint8Array.from(seed));
+  const address = kp.getPublicKey().toSuiAddress();
+  if (!sameAddress(address, expectedDelegate)) {
+    throw new Error("decrypted delegate seed does not match grant delegateAddress");
+  }
+  const { signature } = await kp.signTransaction(fromBase644(txBytes));
+  return signature;
+}
+async function paySharedPoolResource(args) {
+  const { session, cfg } = args;
+  const deps = args.deps ?? {};
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const preferred = args.preferredDialect ?? "mpp";
+  const trace = traceEmitter(deps.trace);
+  let request;
+  let resourceUrl;
+  let gatewayOrigin;
+  try {
+    request = args.request ?? normalizePaidHttpRequest({ url: args.url, method: "GET" });
+    resourceUrl = new URL(request.url);
+    gatewayOrigin = new URL(cfg.gatewayUrl).origin;
+  } catch {
+    return failed("POLICY_REJECTED", "resource and gateway URLs must be valid");
+  }
+  if (!["http:", "https:"].includes(resourceUrl.protocol) || resourceUrl.origin !== gatewayOrigin) {
+    return failed("POLICY_REJECTED", "pay only accepts configured gateway origin");
+  }
+  const first = await fetchImpl(resourceUrl, paidRequestInit(request));
+  if (first.status !== 402) {
+    return { status: "ok", paid: false, body: await readBody(first) };
+  }
+  let dialect = preferred;
+  let offer = await readChallenge(first, preferred);
+  if (!offer && preferred === "mpp") {
+    offer = await readChallenge(first, "x402");
+    dialect = "x402";
+  } else if (!offer && preferred === "x402") {
+    offer = await readChallenge(first, "mpp");
+    dialect = "mpp";
+  }
+  if (!offer) {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Payment required, but the challenge could not be read",
+      publicPayload: { stage: "challenge", failureCode: "MALFORMED_CHALLENGE" }
+    });
+    return failed("MALFORMED_CHALLENGE", "402 carried no readable mpp/x402 challenge");
+  }
+  trace({
+    kind: "challenge_received",
+    status: "ok",
+    summary: `Payment required: ${offer.amount} ${offer.asset}`,
+    publicPayload: {
+      serviceId: offer.serviceId,
+      amountAtomic: offer.amount,
+      asset: offer.asset,
+      decimals: offer.decimals,
+      rail: offer.settlementRail ?? "shared_pool",
+      dialect,
+      httpStatus: 402
+    },
+    technicalPayload: {
+      serviceId: offer.serviceId,
+      amountAtomic: offer.amount,
+      asset: offer.asset,
+      decimals: offer.decimals,
+      rail: offer.settlementRail ?? "shared_pool",
+      dialect,
+      httpStatus: 402,
+      network: offer.network,
+      payTo: offer.payTo,
+      challengeId: offer.challengeId
+    }
+  });
+  const binding = requestBindingViolation(offer, request);
+  if (binding) return failed("POLICY_REJECTED", binding.reason);
+  if (offer.settlementRail && offer.settlementRail !== "shared_pool") {
+    return failed(
+      "POLICY_REJECTED",
+      `offer settlementRail is ${offer.settlementRail}, not shared_pool`
+    );
+  }
+  if (!offer.targetHash) {
+    return failed("POLICY_REJECTED", "shared_pool offer missing targetHash");
+  }
+  if (!offer.packageId?.trim()) {
+    return failed("POLICY_REJECTED", "shared_pool offer missing packageId");
+  }
+  try {
+    if (normalizeSuiAddress4(offer.packageId) !== normalizeSuiAddress4(session.packageId)) {
+      return failed(
+        "POLICY_REJECTED",
+        `offer.packageId ${offer.packageId} !== session.packageId ${session.packageId}`
+      );
+    }
+  } catch {
+    return failed("POLICY_REJECTED", "invalid package id on offer or session");
+  }
+  if (offer.network !== `sui:${cfg.network}`) {
+    return failed(
+      "POLICY_REJECTED",
+      `offer.network ${offer.network ?? "(none)"} does not match sui:${cfg.network}`
+    );
+  }
+  const authority = defaultAuthorityForRail("shared_pool", session.packageId);
+  let mode;
+  try {
+    mode = dialectMode(authority, dialect);
+  } catch (err) {
+    return failed(
+      "POLICY_REJECTED",
+      err instanceof Error ? err.message : "dialect not in shared_pool ceiling"
+    );
+  }
+  const resolved = resolveGrantTarget(session.snapshot, offer.targetHash);
+  if (!resolved.ok) {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Authority denied this service",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "authority",
+        failureCode: "GRANT_DENIED"
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "authority",
+        failureCode: "GRANT_DENIED",
+        errorMessage: resolved.reason
+      }
+    });
+    return failed("GRANT_DENIED", resolved.reason);
+  }
+  trace({
+    kind: "authority_matched",
+    status: "ok",
+    summary: "Service allowed, caps live, grant active",
+    publicPayload: {
+      serviceId: offer.serviceId,
+      rail: "shared_pool",
+      decision: "allowed"
+    },
+    technicalPayload: {
+      serviceId: offer.serviceId,
+      rail: "shared_pool",
+      decision: "allowed",
+      grantId: session.snapshot.grantId,
+      policyId: resolved.policyId,
+      ...resolved.maxPerPayment !== void 0 ? { capsRemaining: resolved.maxPerPayment } : {}
+    }
+  });
+  if (!sameStructTag(resolved.coinType, offer.asset)) {
+    return failed(
+      "POLICY_REJECTED",
+      `grant coin ${resolved.coinType} does not match offer asset ${offer.asset}`
+    );
+  }
+  if (resolved.maxPerPayment !== void 0) {
+    if (BigInt(offer.amount) > BigInt(resolved.maxPerPayment)) {
+      return failed(
+        "POLICY_REJECTED",
+        `price ${offer.amount} exceeds target maxPerPayment ${resolved.maxPerPayment}`
+      );
+    }
+  }
+  const payIdHash = paymentIdHash(offer.challengeId);
+  const terms = termsHash(offer);
+  const build = deps.buildPayKind ?? ((input) => buildSharedPoolPayKind({
+    packageId: session.packageId,
+    ...input
+  }));
+  let kindBytes;
+  try {
+    const built = await build({
+      delegate: resolved.delegateAddress,
+      coinType: resolved.coinType,
+      poolObjectId: resolved.poolObjectId,
+      grantObjectId: resolved.grantObjectId,
+      policyId: resolved.onChainPolicyId,
+      targetHash: resolved.targetHash,
+      amount: offer.amount,
+      paymentIdHash: payIdHash,
+      termsHash: terms
+    });
+    kindBytes = built.kindBytes;
+  } catch (err) {
+    return failed(
+      "BUILD_FAILED",
+      err instanceof Error ? err.message : "failed to build shared_pool pay kind"
+    );
+  }
+  const payTarget = `${normalizeSuiAddress4(authority.packageId)}::${authority.module}::${authority.payFunction}`;
+  const sponsorUrl = cfg.sponsorUrl.replace(/\/$/, "");
+  trace({
+    kind: "sponsor_requested",
+    status: "started",
+    summary: "Requesting gas sponsorship from SuiPay",
+    publicPayload: { sponsor: "suipay" },
+    technicalPayload: { sponsor: "suipay", serviceId: offer.serviceId }
+  });
+  const createResponse = await sponsorPost(
+    fetchImpl,
+    sponsorUrl,
+    {
+      transactionKindBytes: kindBytes,
+      sender: resolved.delegateAddress,
+      allowedMoveCallTargets: [payTarget]
+    },
+    {
+      ...traceHeadersFor(deps, "POST", sponsorUrl),
+      ...session.sponsorAuthorization ? { Authorization: session.sponsorAuthorization } : {}
+    }
+  );
+  if (!createResponse || !createResponse.ok) {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Gas sponsor unavailable",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "sponsor",
+        failureCode: "SPONSOR_UNAVAILABLE"
+      }
+    });
+    return failed("SPONSOR_UNAVAILABLE", "platform sponsor could not create transaction");
+  }
+  let sponsored;
+  try {
+    const body = await createResponse.json();
+    if (typeof body.bytes !== "string" || typeof body.digest !== "string") {
+      throw new Error("invalid");
+    }
+    sponsored = { bytes: body.bytes, digest: body.digest };
+  } catch {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Gas sponsor returned an unusable transaction",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "sponsor",
+        failureCode: "SPONSOR_INVALID_RESPONSE"
+      }
+    });
+    return failed(
+      "SPONSOR_INVALID_RESPONSE",
+      "platform sponsor returned invalid transaction response"
+    );
+  }
+  trace({
+    kind: "transaction_sponsored",
+    status: "ok",
+    summary: "Gas attached by SuiPay",
+    publicPayload: { sponsor: "suipay" },
+    technicalPayload: { sponsor: "suipay", serviceId: offer.serviceId }
+  });
+  try {
+    assertSharedPoolPayReconstructs(sponsored.bytes, {
+      kindBytes,
+      packageId: session.packageId,
+      delegate: resolved.delegateAddress,
+      poolObjectId: resolved.poolObjectId,
+      grantObjectId: resolved.grantObjectId,
+      amount: offer.amount
+    });
+  } catch (error2) {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Sponsored transaction did not reconstruct the intended payment",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "sponsored_bytes",
+        failureCode: "SPONSORED_TX_MISMATCH"
+      }
+    });
+    return failed(
+      "SPONSORED_TX_MISMATCH",
+      error2 instanceof Error ? error2.message : "sponsored transaction verification failed"
+    );
+  }
+  if (session.assertLive) {
+    try {
+      await session.assertLive();
+    } catch (err) {
+      trace({
+        kind: "payment_failed",
+        status: "error",
+        summary: "Authority changed before signing; payment stopped",
+        publicPayload: {
+          serviceId: offer.serviceId,
+          stage: "authority_revalidate",
+          failureCode: "GRANT_DENIED"
+        },
+        technicalPayload: {
+          serviceId: offer.serviceId,
+          stage: "authority_revalidate",
+          failureCode: "GRANT_DENIED",
+          errorMessage: err instanceof Error ? err.message : "grant no longer live"
+        }
+      });
+      return failed(
+        "GRANT_DENIED",
+        err instanceof Error ? err.message : "grant no longer live at decrypt"
+      );
+    }
+    trace({
+      kind: "authority_revalidated",
+      status: "ok",
+      summary: "Authority unchanged before signing",
+      publicPayload: { decision: "allowed" },
+      technicalPayload: {
+        decision: "allowed",
+        grantId: session.snapshot.grantId
+      }
+    });
+  }
+  let signature;
+  {
+    let seed = null;
+    try {
+      seed = await session.decryptDelegateSeed();
+      signature = await signWithSeed(
+        seed,
+        sponsored.bytes,
+        resolved.delegateAddress
+      );
+    } catch (err) {
+      trace({
+        kind: "payment_failed",
+        status: "error",
+        summary: "Delegate signature failed",
+        publicPayload: {
+          serviceId: offer.serviceId,
+          stage: "sign",
+          failureCode: "SIGN_FAILED"
+        }
+      });
+      return failed(
+        "SIGN_FAILED",
+        err instanceof Error ? err.message : "delegate sign failed"
+      );
+    } finally {
+      if (seed) {
+        if (Buffer.isBuffer(seed)) seed.fill(0);
+        else seed.fill(0);
+      }
+      seed = null;
+    }
+  }
+  trace({
+    kind: "delegate_signed",
+    status: "ok",
+    summary: "Delegate approved transaction",
+    publicPayload: { delegateAddress: resolved.delegateAddress },
+    technicalPayload: { delegateAddress: resolved.delegateAddress }
+  });
+  if (dialect === "x402" && mode === "transaction") {
+    void sponsored.digest;
+    const credential = encodeCredential({
+      challengeId: offer.challengeId,
+      offer,
+      txBytes: sponsored.bytes,
+      signature,
+      payer: resolved.delegateAddress
+    });
+    const second2 = await fetchImpl(
+      resourceUrl,
+      paidRequestInit(request, { [X402_CREDENTIAL_HEADER]: credential })
+    );
+    if (second2.status === 503) {
+      return {
+        status: "ambiguous",
+        paid: false,
+        code: second2.headers.get("X-Suipay-Error") ?? "AMBIGUOUS",
+        detail: await responseDetail(second2),
+        txDigest: sponsored.digest
+      };
+    }
+    if (second2.status !== 200) {
+      return failed(
+        second2.headers.get("X-Suipay-Error") ?? `HTTP_${second2.status}`,
+        await responseDetail(second2),
+        sponsored.digest
+      );
+    }
+    return {
+      status: "ok",
+      paid: true,
+      body: await readBody(second2),
+      receipt: readReceipt(second2, "x402"),
+      txDigest: sponsored.digest
+    };
+  }
+  const executeUrl = `${sponsorUrl}/execute`;
+  let executeResponse;
+  try {
+    executeResponse = await fetchImpl(executeUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        ...traceHeadersFor(deps, "POST", executeUrl),
+        ...session.sponsorAuthorization ? { Authorization: session.sponsorAuthorization } : {}
+      },
+      body: JSON.stringify({ digest: sponsored.digest, signature })
+    });
+  } catch (err) {
+    if (isProvablyPreBroadcast(err)) {
+      trace({
+        kind: "payment_failed",
+        status: "error",
+        summary: "Sponsor could not submit the payment",
+        publicPayload: {
+          serviceId: offer.serviceId,
+          stage: "submit",
+          failureCode: "SPONSOR_UNAVAILABLE"
+        }
+      });
+      return failed("SPONSOR_UNAVAILABLE", "platform sponsor could not execute transaction");
+    }
+    trace({
+      kind: "payment_ambiguous",
+      status: "ambiguous",
+      summary: "Sponsor submission response was lost; outcome unknown",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "submit",
+        digest: sponsored.digest
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "submit",
+        digest: sponsored.digest,
+        reasonCode: "SPONSOR_UNREACHABLE"
+      }
+    });
+    return {
+      status: "ambiguous",
+      paid: false,
+      code: "SPONSOR_UNREACHABLE",
+      detail: "sponsor execute response was lost after send; outcome unknown",
+      txDigest: sponsored.digest
+    };
+  }
+  if (!executeResponse.ok) {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      summary: "Sponsor could not submit the payment",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "submit",
+        failureCode: "SPONSOR_UNAVAILABLE"
+      }
+    });
+    return failed("SPONSOR_UNAVAILABLE", "platform sponsor could not execute transaction");
+  }
+  let finalDigest;
+  try {
+    const body = await executeResponse.json();
+    if (typeof body.digest !== "string") throw new Error("invalid");
+    finalDigest = body.digest;
+  } catch {
+    trace({
+      kind: "payment_ambiguous",
+      status: "ambiguous",
+      summary: "Submission result is unreadable; outcome unknown",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "submit",
+        digest: sponsored.digest
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "submit",
+        digest: sponsored.digest,
+        reasonCode: "SPONSOR_INVALID_RESPONSE"
+      }
+    });
+    return {
+      status: "ambiguous",
+      paid: false,
+      code: "SPONSOR_INVALID_RESPONSE",
+      detail: "platform sponsor returned an unreadable execution response",
+      txDigest: sponsored.digest
+    };
+  }
+  trace({
+    kind: "transaction_submitted",
+    status: "ok",
+    source: "sui",
+    summary: `Submitted ${finalDigest}`,
+    publicPayload: { digest: finalDigest },
+    technicalPayload: { digest: finalDigest, network: offer.network }
+  });
+  const getFinalized = deps.getFinalizedTx ?? (async () => null);
+  let finalized = null;
+  for (let attempt = 0; attempt < FINALIZATION_ATTEMPTS; attempt += 1) {
+    finalized = await getFinalized(finalDigest);
+    if (finalized) break;
+    if (attempt + 1 < FINALIZATION_ATTEMPTS) await delay2(FINALIZATION_DELAY_MS);
+  }
+  if (!finalized) {
+    trace({
+      kind: "payment_ambiguous",
+      status: "ambiguous",
+      source: "sui",
+      summary: "Finality not observed in time; outcome unknown",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "finality",
+        digest: finalDigest
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "finality",
+        digest: finalDigest,
+        reasonCode: "FINALIZATION_TIMEOUT"
+      }
+    });
+    return {
+      status: "ambiguous",
+      paid: false,
+      code: "FINALIZATION_TIMEOUT",
+      detail: "sponsored payment submission is unresolved",
+      txDigest: finalDigest
+    };
+  }
+  if (finalized.status === "failed") {
+    trace({
+      kind: "payment_failed",
+      status: "error",
+      source: "sui",
+      summary: "Payment transaction was rejected on chain",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "settlement",
+        failureCode: "SETTLEMENT_REJECTED"
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "settlement",
+        failureCode: "SETTLEMENT_REJECTED",
+        errorMessage: finalized.reason ?? "tx failed"
+      }
+    });
+    return failed("SETTLEMENT_REJECTED", finalized.reason ?? "tx failed", finalDigest);
+  }
+  trace({
+    kind: "payment_finalized",
+    status: "ok",
+    source: "sui",
+    summary: "PaymentMade matched on Sui",
+    publicPayload: {
+      digest: finalDigest,
+      amountAtomic: offer.amount,
+      asset: offer.asset,
+      decimals: offer.decimals
+    },
+    technicalPayload: {
+      digest: finalDigest,
+      amountAtomic: offer.amount,
+      asset: offer.asset,
+      decimals: offer.decimals,
+      network: offer.network,
+      payTo: offer.payTo
+    }
+  });
+  const proof = encodeProof({
+    challengeId: offer.challengeId,
+    offer,
+    txDigest: finalDigest,
+    payer: resolved.delegateAddress
+  });
+  trace({
+    kind: "proof_presented",
+    status: "ok",
+    summary: "Presenting finalized payment proof",
+    publicPayload: { dialect: "mpp", serviceId: offer.serviceId },
+    technicalPayload: {
+      dialect: "mpp",
+      serviceId: offer.serviceId,
+      digest: finalDigest,
+      proofScheme: "finalized-digest"
+    }
+  });
+  let second;
+  try {
+    second = await fetchImpl(
+      resourceUrl,
+      paidRequestInit(request, {
+        [MPP_CREDENTIAL_HEADER]: proof,
+        ...traceHeadersFor(deps, request.method, resourceUrl)
+      })
+    );
+  } catch (err) {
+    trace({
+      kind: "payment_ambiguous",
+      status: "ambiguous",
+      summary: "Payment settled on chain but proof presentation failed",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "settle",
+        digest: finalDigest
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "settle",
+        digest: finalDigest,
+        reasonCode: "PROOF_PRESENTATION_FAILED",
+        errorMessage: err instanceof Error ? err.message : "proof presentation failed"
+      }
+    });
+    return {
+      status: "ambiguous",
+      paid: false,
+      code: "PROOF_PRESENTATION_FAILED",
+      detail: "payment finalized on chain but proof presentation failed; outcome unknown",
+      txDigest: finalDigest
+    };
+  }
+  if (second.status === 503) {
+    trace({
+      kind: "payment_ambiguous",
+      status: "ambiguous",
+      summary: "Settlement outcome unknown at the gateway",
+      publicPayload: {
+        serviceId: offer.serviceId,
+        stage: "settle",
+        digest: finalDigest
+      },
+      technicalPayload: {
+        serviceId: offer.serviceId,
+        stage: "settle",
+        digest: finalDigest,
+        reasonCode: second.headers.get("X-Suipay-Error") ?? "AMBIGUOUS"
+      }
+    });
+    return {
+      status: "ambiguous",
+      paid: false,
+      code: second.headers.get("X-Suipay-Error") ?? "AMBIGUOUS",
+      detail: await responseDetail(second),
+      txDigest: finalDigest
+    };
+  }
+  const receipt = readReceipt(second, "mpp");
+  if (second.status !== 200) {
+    if (!receipt) {
+      trace({
+        kind: "payment_failed",
+        status: "error",
+        summary: "Gateway refused the payment proof",
+        publicPayload: {
+          serviceId: offer.serviceId,
+          stage: "settle",
+          failureCode: second.headers.get("X-Suipay-Error") ?? `HTTP_${second.status}`
+        }
+      });
+    }
+    return failed(
+      second.headers.get("X-Suipay-Error") ?? `HTTP_${second.status}`,
+      await responseDetail(second),
+      finalDigest
+    );
+  }
+  return {
+    status: "ok",
+    paid: true,
+    body: await readBody(second),
+    receipt,
+    txDigest: finalDigest
+  };
+}
+
+// src/tools.ts
+function payerTrace(deps) {
+  const hooks = deps.trace;
+  const buyerAccountId = deps.auth?.buyerAccountId;
+  if (!hooks || !buyerAccountId) return null;
+  return {
+    sink: hooks.sink,
+    traceId: hooks.context.traceId,
+    requestId: hooks.context.requestId,
+    buyerAccountId,
+    connectionId: hooks.runtime.connectionId,
+    ...hooks.runtime.secret ? { secret: hooks.runtime.secret } : {},
+    ...hooks.runtime.now ? { now: hooks.runtime.now } : {}
+  };
+}
+var AUTH_REQUIRED = "No SuiPay credentials - use remote MCP OAuth (/mcp) with a shared_pool grant, or provision a delegated signer for SDK/REST.";
+function text(value) {
+  return {
+    content: [{
+      type: "text",
+      text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
+    }]
+  };
+}
+function error(value) {
+  return { ...text(value), isError: true };
+}
+function paidResult(result) {
+  const body = result.body;
+  if (!body || body.__binary !== true) return text(result);
+  const { base64, ...shape } = body;
+  const content = [
+    { type: "text", text: JSON.stringify({ ...result, body: shape }, null, 2) }
+  ];
+  if (base64 && shape.contentType?.startsWith("image/")) {
+    content.push({ type: "image", data: base64, mimeType: shape.contentType });
+  }
+  return { content };
+}
+function profile(deps) {
+  return (deps.profileLoader ?? loadPaymentProfile)();
+}
+async function pay(args, cfg, deps = {}) {
+  if (!args.url) return error("url is required");
+  let request;
+  try {
+    request = normalizeMcpPaidHttpRequest(args);
+  } catch (err) {
+    return error(err instanceof Error ? err.message : "request could not be normalized");
+  }
+  if (deps.auth?.sharedPoolPay) {
+    const sp = deps.auth.sharedPoolPay;
+    const finality = createSharedPoolFinalityReader({
+      network: cfg.network,
+      url: cfg.rpcUrl
+    });
+    const chain = createSharedPoolChain({
+      packageId: sp.packageId,
+      network: cfg.network,
+      url: cfg.rpcUrl
+    });
+    const trace = payerTrace(deps);
+    const result = await paySharedPoolResource({
+      url: request.url,
+      request,
+      session: {
+        snapshot: sp.snapshot,
+        packageId: sp.packageId,
+        decryptDelegateSeed: sp.decryptDelegateSeed,
+        // Forward the pay-time live gate so paySharedPoolResource re-verifies
+        // the paying authority against a fresh graph before decrypt (P0-5).
+        ...sp.assertLive ? { assertLive: sp.assertLive } : {},
+        // Forward the bearer so the gateway-internal /api/sponsor call can
+        // authenticate the delegate (remote /mcp runs the payer server-side).
+        ...sp.sponsorAuthorization ? { sponsorAuthorization: sp.sponsorAuthorization } : {}
+      },
+      cfg,
+      deps: {
+        ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+        ...trace ? { trace } : {},
+        buildPayKind: (input) => chain.buildPayKind(input),
+        getFinalizedTx: async (digest) => {
+          const f = await finality.getFinalizedTx(digest);
+          return f ? { status: f.status, reason: f.reason } : null;
+        }
+      }
+    });
+    return result.status === "ok" ? paidResult(result) : error(result);
+  }
+  if (deps.auth) {
+    return error(
+      "authenticated MCP pay requires a finalized shared_pool grant with session key; local allowance profile is not used on /mcp"
+    );
+  }
+  const paymentProfile = profile(deps);
+  if (paymentProfile) {
+    return error(
+      "local V1 allowance pay is retired; use remote MCP OAuth (/mcp) with a shared_pool grant, or provision a delegated signer for SDK/REST"
+    );
+  }
+  return error(AUTH_REQUIRED);
+}
+async function discover(args, cfg, deps = {}) {
+  const url = new URL("/v1/services", cfg.gatewayUrl);
+  if (args.query) url.searchParams.set("q", args.query);
+  const response = await (deps.fetchImpl ?? fetch)(url);
+  if (!response.ok) return error(`gateway unavailable: HTTP ${response.status}`);
+  return text(await response.json());
+}
+async function accessContext(deps = {}) {
+  if (!deps.auth) return error(AUTH_REQUIRED);
+  if (!deps.auth.access) {
+    return error(
+      "SuiPay access context unavailable. Reconnect this MCP session or inspect the connection in buyer console."
+    );
+  }
+  return text(deps.auth.access);
+}
+async function receipts(args, _cfg, deps = {}) {
+  if (deps.auth) {
+    if (!deps.auth.listReceipts) {
+      return error(
+        "receipts unavailable: this authenticated MCP session has no server-scoped settlement reader"
+      );
+    }
+    try {
+      const settlements = await deps.auth.listReceipts(args.challengeId);
+      return text({ count: settlements.length, settlements });
+    } catch (err) {
+      return error(err instanceof Error ? err.message : String(err));
+    }
+  }
+  if (!profile(deps)) return error(AUTH_REQUIRED);
+  return error(
+    "receipts is available on remote OAuth (/mcp) sessions only; the local allowance profile has no settlement feed access"
+  );
+}
+async function suipayLogin(_args, _cfg, _deps = {}) {
+  return error(
+    "V1 allowance login is retired; use remote MCP OAuth (/mcp) with a shared_pool grant, or provision a delegated signer for SDK/REST"
+  );
+}
+async function logout(args, cfg, deps = {}) {
+  if (args.force) {
+    clearCreds();
+    return text("SuiPay logged out. Local credentials removed.");
+  }
+  const paymentProfile = profile(deps);
+  if (!paymentProfile) return text("No SuiPay credentials found.");
+  const chain = deps.chainImpl ?? createSuiAllowanceChain({
+    packageId: paymentProfile.creds.packageId,
+    network: cfg.network,
+    url: cfg.rpcUrl
+  });
+  const allowance = await chain.readAllowance(paymentProfile.creds.allowanceId);
+  if (allowance && !allowance.revoked && BigInt(allowance.balance) > 0n) {
+    return error(
+      "Allowance still holds funds. Revoke and refund it in SuiPay console before logout, or pass force=true."
+    );
+  }
+  clearCreds();
+  return text("SuiPay logged out. Local credentials removed.");
+}
+
+// src/server.ts
+var PACKAGE_NAME = "@cmdoss/suipay-mcp";
+var TOOLS = [
+  {
+    name: "access_context",
+    description: "Inspect profiles, policies, service targets, spend caps, usage, and lifecycle state enforced for this authenticated SuiPay session. Call before choosing a paid service.",
+    inputSchema: {
+      type: "object",
+      properties: {}
+    }
+  },
+  {
+    name: "pay",
+    description: "Fetch a paid HTTP resource and settle its MPP challenge via shared_pool (remote OAuth MCP). Local V1 allowance pay is retired. Use method POST with json to pay for a JSON request body; the body you send is signed into the offer, so it cannot be changed after payment.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        url: { type: "string", description: "Full gateway resource URL." },
+        method: {
+          type: "string",
+          enum: ["GET", "POST"],
+          description: "HTTP method of the paid request. Defaults to GET."
+        },
+        json: {
+          type: "object",
+          description: "JSON request body for a POST. Sent as application/json and bound to the payment."
+        }
+      },
+      required: ["url"]
+    }
+  },
+  {
+    name: "discover",
+    description: "Search SuiPay gateway resources.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        query: {
+          type: "string",
+          description: "Optional service search terms."
+        }
+      }
+    }
+  },
+  {
+    name: "receipts",
+    description: "List SuiPay settlement receipts, optionally filtered by challenge id.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        challengeId: {
+          type: "string",
+          description: "Optional payment challenge id."
+        }
+      }
+    }
+  },
+  {
+    name: "suipay_login",
+    description: "Legacy V1 allowance login (retired). Returns an error directing you to remote MCP OAuth or delegated-signer provisioning.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: "Label shown in SuiPay console." },
+        gatewayResourceUrl: {
+          type: "string",
+          description: "Gateway resource URL whose 402 defines recipient, asset, and package."
+        }
+      }
+    }
+  },
+  {
+    name: "suipay_logout",
+    description: "Remove local SuiPay credentials. Refuses while live allowance holds funds unless forced.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        force: {
+          type: "boolean",
+          description: "Remove local credentials even if allowance still holds funds."
+        }
+      }
+    }
+  }
+];
+function accessInstructions(auth) {
+  if (!auth) {
+    return "Local stdio session: V1 allowance pay is retired. Use remote MCP OAuth (/mcp) with a shared_pool grant, or a delegated signer for SDK/REST.";
+  }
+  const access = auth.access;
+  if (!access) {
+    return [
+      "Authenticated SuiPay session.",
+      "Policy context is unavailable; do not assume unrestricted spending.",
+      "Call access_context and reconnect if context remains unavailable."
+    ].join("\n");
+  }
+  const profiles = access.profiles.length ? access.profiles.map((p) => p.name).join(", ") : "none";
+  const policies = access.policies.length ? access.policies.map(
+    (p) => `${p.name} [${p.status}] asset=${p.asset} cap=${p.totalCap} spent=${p.spent} max/payment=${p.maxPerPayment}`
+  ).join("; ") : "none";
+  return [
+    `SuiPay access mode: ${access.accessMode}.`,
+    `Agent profiles: ${profiles}.`,
+    `Enforced policies: ${policies}.`,
+    "Call access_context before selecting a paid service. Pay only services covered by active policy targets."
+  ].join("\n");
+}
+function toolError(value) {
+  return {
+    content: [
+      {
+        type: "text",
+        text: value instanceof Error ? value.message : String(value)
+      }
+    ],
+    isError: true
+  };
+}
+function createSuipayMcpServer(cfg, auth, trace) {
+  const server = new Server(
+    { name: "suipay", version: "1.0.0" },
+    {
+      capabilities: { tools: {} },
+      instructions: accessInstructions(auth)
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [...TOOLS]
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request, extra) => {
+    const { name, arguments: args = {} } = request.params;
+    try {
+      if (auth) {
+        const gate = toolAllowedByScope(name, auth.scope);
+        if (!gate.ok) {
+          return toolError(
+            `insufficient_scope: tool "${name}" requires ${gate.required}`
+          );
+        }
+      }
+      switch (name) {
+        case "access_context":
+          return await accessContext({ auth });
+        case "pay":
+          return await pay(
+            {
+              url: String(args.url ?? ""),
+              ...args.method !== void 0 ? { method: args.method } : {},
+              ...args.json !== void 0 ? { json: args.json } : {}
+            },
+            cfg,
+            { auth, ...trace ? { trace } : {} }
+          );
+        case "discover":
+          return await discover(
+            {
+              query: typeof args.query === "string" ? args.query : void 0
+            },
+            cfg
+          );
+        case "receipts":
+          return await receipts(
+            {
+              challengeId: typeof args.challengeId === "string" ? args.challengeId : void 0
+            },
+            cfg,
+            { auth }
+          );
+        case "suipay_login": {
+          if (auth) {
+            return toolError(
+              "suipay_login is for local stdio only; remote MCP uses OAuth bearer"
+            );
+          }
+          const progressToken = request.params._meta?.progressToken;
+          return await suipayLogin(
+            {
+              label: typeof args.label === "string" ? args.label : void 0,
+              gatewayResourceUrl: typeof args.gatewayResourceUrl === "string" ? args.gatewayResourceUrl : void 0
+            },
+            cfg,
+            {
+              onUrl(url) {
+                if (progressToken === void 0) return;
+                void extra.sendNotification({
+                  method: "notifications/progress",
+                  params: {
+                    progressToken,
+                    progress: 0,
+                    message: url
+                  }
+                }).catch(() => void 0);
+              }
+            }
+          );
+        }
+        case "suipay_logout":
+          if (auth) {
+            return toolError(
+              "suipay_logout is for local stdio only; remote MCP uses OAuth revoke at the AS"
+            );
+          }
+          return await logout({ force: args.force === true }, cfg);
+        default:
+          return toolError(`unknown tool: ${name}`);
+      }
+    } catch (error2) {
+      return toolError(error2);
+    }
+  });
+  return server;
+}
+
+// src/trace-proxy.ts
+var EMPTY_ENVELOPE = {
+  batch: false,
+  entries: [],
+  method: null,
+  requestId: null,
+  clientName: null
+};
+var DEFAULT_MAX_OBSERVED_BYTES = 64 * 1024;
+var DEFAULT_RUN_SETUP_TIMEOUT_MS = 500;
+function canonicalMcpRequestId(id) {
+  if (typeof id === "number") {
+    return Number.isFinite(id) ? `n:${JSON.stringify(id)}` : null;
+  }
+  if (typeof id === "string") {
+    return `s:${Buffer.from(id, "utf8").toString("base64url")}`;
+  }
+  return null;
+}
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
+}
+function readEntry(message) {
+  const record = asRecord(message);
+  if (!record) return null;
+  const params = asRecord(record.params);
+  const clientInfo = params ? asRecord(params.clientInfo) : null;
+  const rawId = record.id;
+  return {
+    method: typeof record.method === "string" ? record.method : null,
+    jsonRpcId: typeof rawId === "string" || typeof rawId === "number" ? rawId : null,
+    requestId: canonicalMcpRequestId(rawId),
+    toolName: params && typeof params.name === "string" ? params.name : null,
+    toolArguments: params ? params.arguments : void 0,
+    clientName: clientInfo && typeof clientInfo.name === "string" ? clientInfo.name : null,
+    clientVersion: clientInfo && typeof clientInfo.version === "string" ? clientInfo.version : null,
+    protocolVersion: params && typeof params.protocolVersion === "string" ? params.protocolVersion : null
+  };
+}
+async function readBoundedBody(request, maxBytes) {
+  const declared = Number(request.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) return null;
+  const body = request.body;
+  if (!body) {
+    try {
+      const text2 = await request.text();
+      return Buffer.byteLength(text2, "utf8") > maxBytes ? null : text2;
+    } catch {
+      return null;
+    }
+  }
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let out = "";
+  let bytes = 0;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      if (bytes > maxBytes) return null;
+      out += decoder.decode(value, { stream: true });
+    }
+    return out + decoder.decode();
+  } catch {
+    return null;
+  } finally {
+    void reader.cancel().catch(() => void 0);
+  }
+}
+async function inspectMcpEnvelope(request, maxBytes = DEFAULT_MAX_OBSERVED_BYTES) {
+  if (request.method !== "POST") return EMPTY_ENVELOPE;
+  const text2 = await readBoundedBody(request, maxBytes);
+  if (text2 === null) return EMPTY_ENVELOPE;
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    return EMPTY_ENVELOPE;
+  }
+  const batch = Array.isArray(parsed);
+  const messages = batch ? parsed : [parsed];
+  const entries = [];
+  for (const message of messages) {
+    const entry = readEntry(message);
+    if (entry) entries.push(entry);
+  }
+  const first = entries[0];
+  return {
+    batch,
+    entries,
+    method: first?.method ?? null,
+    requestId: first?.requestId ?? null,
+    clientName: entries.find((e) => e.clientName)?.clientName ?? null
+  };
+}
+function safeClock(now) {
+  let last = 0;
+  return () => {
+    try {
+      const value = now();
+      if (Number.isFinite(value)) {
+        last = value;
+        return value;
+      }
+    } catch {
+    }
+    return last;
+  };
+}
+function emit(ctx, input) {
+  try {
+    const event = {
+      traceId: ctx.run.id,
+      requestId: input.requestId,
+      buyerAccountId: ctx.runtime.buyerAccountId,
+      connectionId: ctx.runtime.connectionId,
+      at: new Date(ctx.now()).toISOString(),
+      source: "mcp_wire",
+      kind: input.kind,
+      status: input.status,
+      summary: input.summary,
+      publicPayload: input.publicPayload,
+      ...input.technicalPayload ? { technicalPayload: input.technicalPayload } : {}
+    };
+    void Promise.resolve(ctx.runtime.sink.emit(event)).catch(() => void 0);
+  } catch {
+  }
+}
+function firstText(content) {
+  if (!Array.isArray(content)) return null;
+  for (const block of content) {
+    const record = asRecord(block);
+    if (record && record.type === "text" && typeof record.text === "string") {
+      return record.text;
+    }
+  }
+  return null;
+}
+function questionOf(args) {
+  const record = asRecord(args);
+  if (!record) return null;
+  for (const key of ["question", "query", "prompt"]) {
+    const value = record[key];
+    if (typeof value === "string") return value;
+  }
+  return null;
+}
+function resourceOf(args) {
+  const record = asRecord(args);
+  if (!record) return null;
+  for (const key of ["url", "gatewayResourceUrl", "resource"]) {
+    const value = record[key];
+    if (typeof value === "string" && value.length > 0) return value;
+  }
+  return null;
+}
+function emitToolCalled(ctx, entry) {
+  const tool = entry.toolName ?? "unknown";
+  const question = questionOf(entry.toolArguments);
+  const resource = resourceOf(entry.toolArguments);
+  const metadata = {
+    tool,
+    ...resource !== null ? { resource } : {}
+  };
+  emit(ctx, {
+    requestId: entry.requestId,
+    kind: "tool_called",
+    status: "started",
+    summary: resource !== null ? `Tool call ${tool} -> ${resource}` : `Tool call ${tool}`,
+    publicPayload: { ...metadata, ...question !== null ? { question } : {} },
+    technicalPayload: {
+      ...metadata,
+      ...entry.jsonRpcId !== null ? { jsonRpcId: entry.jsonRpcId } : {},
+      ...entry.toolArguments !== void 0 ? { arguments: entry.toolArguments } : {}
+    }
+  });
+}
+function emitTerminal(ctx, input) {
+  const { entry, result, error: error2 } = input;
+  const method = entry.method;
+  if (error2) {
+    if (method !== "tools/call") return;
+    const tool2 = entry.toolName ?? "unknown";
+    emit(ctx, {
+      requestId: entry.requestId,
+      kind: "tool_error",
+      status: "error",
+      summary: `Tool error from ${tool2}`,
+      publicPayload: {
+        tool: tool2,
+        ...typeof error2.code === "number" ? { errorCode: error2.code } : {}
+      },
+      technicalPayload: {
+        tool: tool2,
+        ...entry.jsonRpcId !== null ? { jsonRpcId: entry.jsonRpcId } : {},
+        ...typeof error2.code === "number" ? { errorCode: error2.code } : {},
+        ...typeof error2.message === "string" ? { errorMessage: error2.message } : {}
+      }
+    });
+    return;
+  }
+  if (!result) return;
+  if (method === "initialize") {
+    emit(ctx, {
+      requestId: entry.requestId,
+      kind: "mcp_connected",
+      status: "ok",
+      summary: "OAuth connection verified",
+      publicPayload: {
+        ...entry.clientName ? { clientName: entry.clientName } : {},
+        ...typeof result.protocolVersion === "string" ? { protocolVersion: result.protocolVersion } : {},
+        connectionState: "connected"
+      },
+      technicalPayload: {
+        ...entry.clientName ? { clientName: entry.clientName } : {},
+        ...entry.clientVersion ? { clientVersion: entry.clientVersion } : {},
+        ...typeof result.protocolVersion === "string" ? { protocolVersion: result.protocolVersion } : {},
+        transport: "streamable_http",
+        connectionState: "connected"
+      }
+    });
+    return;
+  }
+  if (method === "tools/list") {
+    const tools = Array.isArray(result.tools) ? result.tools : [];
+    const names = tools.map((tool2) => asRecord(tool2)?.name).filter((name) => typeof name === "string");
+    emit(ctx, {
+      requestId: entry.requestId,
+      kind: "tools_listed",
+      status: "ok",
+      summary: `${tools.length} tools listed`,
+      publicPayload: { toolCount: tools.length },
+      technicalPayload: { toolCount: tools.length, toolNames: names }
+    });
+    return;
+  }
+  if (method !== "tools/call") return;
+  const tool = entry.toolName ?? "unknown";
+  if (result.isError === true) {
+    emit(ctx, {
+      requestId: entry.requestId,
+      kind: "tool_error",
+      status: "error",
+      summary: `Tool error from ${tool}`,
+      publicPayload: { tool },
+      technicalPayload: {
+        tool,
+        ...entry.jsonRpcId !== null ? { jsonRpcId: entry.jsonRpcId } : {},
+        ...firstText(result.content) !== null ? { errorMessage: firstText(result.content) } : {}
+      }
+    });
+    return;
+  }
+  const content = Array.isArray(result.content) ? result.content : [];
+  const answer = firstText(result.content);
+  emit(ctx, {
+    requestId: entry.requestId,
+    kind: "tool_result",
+    status: "ok",
+    summary: `Result from ${tool}`,
+    publicPayload: {
+      tool,
+      resultCount: content.length,
+      durationMs: input.durationMs,
+      ...answer !== null ? { answer } : {}
+    },
+    technicalPayload: {
+      tool,
+      ...entry.jsonRpcId !== null ? { jsonRpcId: entry.jsonRpcId } : {},
+      resultCount: content.length,
+      durationMs: input.durationMs,
+      result
+    }
+  });
+}
+function emitTruncationWarning(ctx, entry) {
+  if (entry.method !== "tools/call") return;
+  const tool = entry.toolName ?? "unknown";
+  emit(ctx, {
+    requestId: entry.requestId,
+    kind: "tool_result",
+    status: "warning",
+    summary: `Result from ${tool} exceeded the trace observation limit`,
+    publicPayload: { tool },
+    technicalPayload: {
+      tool,
+      ...entry.jsonRpcId !== null ? { jsonRpcId: entry.jsonRpcId } : {}
+    }
+  });
+}
+function parseMessages(text2) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch {
+    return [];
+  }
+  const list = Array.isArray(parsed) ? parsed : [parsed];
+  return list.map(asRecord).filter((record) => record !== null);
+}
+function sseFrameData(frame) {
+  const lines = frame.split("\n");
+  const data = [];
+  for (const line of lines) {
+    if (!line.startsWith("data:")) continue;
+    data.push(line.slice("data:".length).replace(/^ /, ""));
+  }
+  return data.length ? data.join("\n") : null;
+}
+function entryFor(observation, message) {
+  const key = canonicalMcpRequestId(message.id);
+  if (key === null) return null;
+  return observation.entries.get(key) ?? null;
+}
+function consumeMessage(observation, message) {
+  const entry = entryFor(observation, message);
+  if (!entry || entry.requestId === null) return;
+  if (observation.terminated.has(entry.requestId)) return;
+  const result = asRecord(message.result);
+  const error2 = asRecord(message.error);
+  if (!result && !error2) return;
+  observation.terminated.add(entry.requestId);
+  emitTerminal(observation.ctx, {
+    entry,
+    result,
+    error: error2,
+    durationMs: observation.ctx.now() - observation.startedAt
+  });
+}
+async function observeSse(body, observation, maxBytes) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffered = "";
+  let bytes = 0;
+  let truncated = false;
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      bytes += value.byteLength;
+      buffered += decoder.decode(value, { stream: true }).replace(/\r\n/g, "\n");
+      let boundary = buffered.indexOf("\n\n");
+      while (boundary !== -1) {
+        const frame = buffered.slice(0, boundary);
+        buffered = buffered.slice(boundary + 2);
+        const data = sseFrameData(frame);
+        if (data) {
+          for (const message of parseMessages(data)) {
+            consumeMessage(observation, message);
+          }
+        }
+        boundary = buffered.indexOf("\n\n");
+      }
+      if (bytes > maxBytes) {
+        truncated = true;
+        break;
+      }
+    }
+  } catch {
+  } finally {
+    void reader.cancel().catch(() => void 0);
+  }
+  if (!truncated) return;
+  for (const entry of observation.entries.values()) {
+    if (entry.requestId === null) continue;
+    if (observation.terminated.has(entry.requestId)) continue;
+    observation.terminated.add(entry.requestId);
+    emitTruncationWarning(observation.ctx, entry);
+  }
+}
+async function observeResponse(clone, observation, maxBytes) {
+  const contentType = clone.headers.get("content-type") ?? "";
+  if (contentType.includes("text/event-stream")) {
+    if (!clone.body) return;
+    await observeSse(clone.body, observation, maxBytes);
+    return;
+  }
+  if (!contentType.includes("application/json")) {
+    void clone.body?.cancel().catch(() => void 0);
+    return;
+  }
+  const text2 = await clone.text();
+  for (const message of parseMessages(text2)) consumeMessage(observation, message);
+}
+async function withDeadline(work, ms) {
+  work.catch(() => void 0);
+  let timer;
+  try {
+    return await Promise.race([
+      work,
+      new Promise((resolve) => {
+        timer = setTimeout(() => resolve(null), ms);
+        timer.unref?.();
+      })
+    ]);
+  } catch {
+    return null;
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+async function traceMcpHttpRequest(input) {
+  const runtime = input.runtime;
+  if (!runtime) return input.handle(input.request);
+  const now = safeClock(runtime.now ?? Date.now);
+  const maxBytes = input.maxObservedBytes ?? DEFAULT_MAX_OBSERVED_BYTES;
+  const prepared = await withDeadline(
+    (async () => {
+      const parsed = await inspectMcpEnvelope(input.request.clone(), maxBytes);
+      const resolved = await runtime.runs.resolveRun({
+        buyerAccountId: runtime.buyerAccountId,
+        connectionId: runtime.connectionId,
+        jsonRpcMethod: parsed.method,
+        clientName: parsed.clientName,
+        now: now()
+      });
+      return { envelope: parsed, run: resolved };
+    })().catch(() => null),
+    input.runSetupTimeoutMs ?? DEFAULT_RUN_SETUP_TIMEOUT_MS
+  );
+  if (!prepared?.run) return input.handle(input.request);
+  const { envelope, run } = prepared;
+  const ctx = { runtime, run, now };
+  const hooks = {
+    runtime,
+    context: { traceId: run.id, requestId: envelope.requestId },
+    sink: runtime.sink
+  };
+  const entries = /* @__PURE__ */ new Map();
+  for (const entry of envelope.entries) {
+    if (entry.requestId === null) continue;
+    entries.set(entry.requestId, entry);
+    if (entry.method === "tools/call") emitToolCalled(ctx, entry);
+  }
+  const startedAt = now();
+  const response = await input.handle(input.request, hooks);
+  if (entries.size > 0) {
+    try {
+      const clone = response.clone();
+      const observation = {
+        ctx,
+        entries,
+        startedAt,
+        terminated: /* @__PURE__ */ new Set()
+      };
+      void observeResponse(clone, observation, maxBytes).catch(() => void 0);
+    } catch {
+    }
+  }
+  return response;
+}
+
+// src/http.ts
+async function handleSuipayMcpHttpRequest(req, cfg, auth, trace) {
+  return traceMcpHttpRequest({
+    request: req,
+    runtime: trace ?? null,
+    handle: async (request, hooks) => {
+      const transport = new WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0,
+        enableJsonResponse: true
+      });
+      const server = createSuipayMcpServer(cfg, auth, hooks);
+      await server.connect(transport);
+      return transport.handleRequest(request);
+    }
+  });
+}
+
+export {
+  loadPaymentProfile,
+  resolveGrantTarget,
+  buildSharedPoolPayKind,
+  paySharedPoolResource,
+  PACKAGE_NAME,
+  TOOLS,
+  createSuipayMcpServer,
+  canonicalMcpRequestId,
+  inspectMcpEnvelope,
+  traceMcpHttpRequest,
+  handleSuipayMcpHttpRequest
+};