@cryptoapis-io/mcp-x402-pay 0.1.2 → 0.3.0

package/README.md

@@ -3,9 +3,12 @@
 > **This is the BUYER side of x402** — the tool an agent uses to *spend* (pay for a resource). Merchants
 > who want to *charge* for an API use the middleware SDK (`@cryptoapis-io/x402-merchant-sdk`), not an MCP tool.
 
-An MCP server that lets an AI agent **pay x402-gated HTTP endpoints**. One tool, `x402_pay`: it fetches a
-URL and, if the server returns `402 Payment Required`, it authorizes the payment via the CryptoAPIs buyer
-service, **signs locally**, retries, and returns the paid response.
+An MCP server that lets an AI agent **find and pay** x402-gated HTTP endpoints.
+
+- **`x402_pay`** — fetches a URL and, if the server returns `402 Payment Required`, authorizes the payment
+  via the CryptoAPIs buyer service, **signs locally**, retries, and returns the paid response.
+- **`x402_discover`** — browses the facilitator's catalogue of x402 resources and their prices, so an agent
+  can *find* a paid API instead of only calling one it was handed.
 
 **Non-custodial:** the private key is passed per request and never leaves the process (no HTTP server —
 stdio only).
@@ -49,10 +52,29 @@ bare name — and exactly one of `address` (any chain; **required for Solana/Kas
 | `method`/`body`/`headers` | | the request to make |
 | `allowedNetworks` | | restrict which CAIP-2 networks to pay on |
 | `maxAmount` | | safety cap — refuse if the required atomic-unit amount exceeds it |
+| `allowedHosts` | | restrict WHICH SITES may be paid, e.g. `["api.acme.com"]` (leading dot = subdomains). A url outside the list is refused **before any network call**. Falls back to `X402_ALLOWED_HOSTS` (comma-separated) — pin it there to keep the allowlist **outside the model's reach** |
 
 Returns `{ status, paid, body, settlement? }`. On a 402 with no acceptable option (or over `maxAmount`),
 `paid:false` with a `reason` — nothing is signed or paid.
 
+## Tool: `x402_discover`
+
+Browse the x402 "Bazaar" — the registered x402 resources and what each charges
+([spec §8](https://github.com/coinbase/x402/blob/main/specs/x402-specification-v2.md)).
+
+| Input | Required | Description |
+|---|---|---|
+| `type` | | filter by resource type, e.g. `"http"` |
+| `limit` | | page size, 1–100 (default 20) |
+| `offset` | | rows to skip, for paging (default 0) |
+| `facilitatorBaseUrl` | | override the facilitator (QA/local) |
+
+Returns `{ resources: [{ resource, type, x402Version, accepts, lastUpdated, metadata? }], pagination }`.
+
+**Public — no API key, no wallet, spends nothing**, so it is always safe to call. Note `accepts[].amount`
+is in **atomic units** (USDC 6-decimals: `"10000"` = $0.01) — convert before quoting a price to a user.
+Pass a chosen `resource` to `x402_pay` to actually buy it.
+
 ## Flow
 
 1. `fetch(url)`. Not 402 → return it.

package/dist/tools/index.d.ts

@@ -12,6 +12,7 @@ export declare const tools: readonly [import("./types.js").McpX402ToolDef<import
     kaspaKey: import("zod").ZodOptional<import("zod").ZodString>;
     xrpSeed: import("zod").ZodOptional<import("zod").ZodString>;
     allowedNetworks: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
+    allowedHosts: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodString, "many">>;
     buyerBaseUrl: import("zod").ZodOptional<import("zod").ZodString>;
     maxAmount: import("zod").ZodOptional<import("zod").ZodString>;
 }, "strip", import("zod").ZodTypeAny, {
@@ -28,6 +29,7 @@ export declare const tools: readonly [import("./types.js").McpX402ToolDef<import
     kaspaKey?: string | undefined;
     xrpSeed?: string | undefined;
     allowedNetworks?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
     buyerBaseUrl?: string | undefined;
     maxAmount?: string | undefined;
 }, {
@@ -44,7 +46,23 @@ export declare const tools: readonly [import("./types.js").McpX402ToolDef<import
     kaspaKey?: string | undefined;
     xrpSeed?: string | undefined;
     allowedNetworks?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
     buyerBaseUrl?: string | undefined;
     maxAmount?: string | undefined;
+}>>, import("./types.js").McpX402ToolDef<import("zod").ZodObject<{
+    type: import("zod").ZodOptional<import("zod").ZodString>;
+    limit: import("zod").ZodOptional<import("zod").ZodNumber>;
+    offset: import("zod").ZodOptional<import("zod").ZodNumber>;
+    facilitatorBaseUrl: import("zod").ZodOptional<import("zod").ZodString>;
+}, "strip", import("zod").ZodTypeAny, {
+    type?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    facilitatorBaseUrl?: string | undefined;
+}, {
+    type?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    facilitatorBaseUrl?: string | undefined;
 }>>];
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAA2C,CAAC"}

package/dist/tools/index.js

@@ -1,3 +1,4 @@
 import { x402PayTool } from "./x402-pay/index.js";
-export const tools = [x402PayTool];
+import { x402DiscoverTool } from "./x402-discover/index.js";
+export const tools = [x402PayTool, x402DiscoverTool];
 //# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,WAAW,CAAU,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,WAAW,EAAE,gBAAgB,CAAU,CAAC"}

package/dist/tools/x402-discover/index.d.ts

@@ -0,0 +1,4 @@
+import { X402DiscoverSchema } from "./schema.js";
+import type { McpX402ToolDef } from "../types.js";
+export declare const x402DiscoverTool: McpX402ToolDef<typeof X402DiscoverSchema>;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/x402-discover/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-discover/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuDlD,eAAO,MAAM,gBAAgB,EAAE,cAAc,CAAC,OAAO,kBAAkB,CAStE,CAAC"}

package/dist/tools/x402-discover/index.js

@@ -0,0 +1,40 @@
+import { X402DiscoverSchema } from "./schema.js";
+const DEFAULT_FACILITATOR_BASE_URL = "https://ai.cryptoapis.io/x402/merchant";
+/**
+ * List x402-enabled resources from the facilitator's Bazaar catalogue.
+ *
+ * No credential is sent: `/discovery/resources` is public by design, so an agent can
+ * survey what is for sale — and at what price — before deciding whether to spend.
+ */
+async function x402Discover(input) {
+    const root = (input.facilitatorBaseUrl ?? DEFAULT_FACILITATOR_BASE_URL).replace(/\/$/, "");
+    const params = new URLSearchParams();
+    if (input.type !== undefined)
+        params.set("type", input.type);
+    if (input.limit !== undefined)
+        params.set("limit", String(input.limit));
+    if (input.offset !== undefined)
+        params.set("offset", String(input.offset));
+    const qs = params.toString();
+    const res = await fetch(`${root}/discovery/resources${qs ? `?${qs}` : ""}`, { method: "GET" });
+    if (!res.ok) {
+        // 503 here means the catalogue is unreadable, NOT that there is nothing for sale —
+        // surface the difference so the agent retries instead of concluding "no resources".
+        throw new Error(`x402 discovery failed: ${res.status} ${await res.text().catch(() => "")}`.trim());
+    }
+    const body = (await res.json());
+    return {
+        resources: body.items ?? [],
+        pagination: body.pagination ?? { limit: 0, offset: 0, total: 0 },
+    };
+}
+export const x402DiscoverTool = {
+    name: "x402_discover",
+    description: "Discover x402-gated APIs you can pay for — browse the facilitator's Bazaar catalogue of registered x402 resources, each with the price and payment terms it accepts. Use this BEFORE x402_pay whenever you need to FIND a paid endpoint rather than call one you were already given: the pay tool only fetches a URL you hand it, so this is the only way to locate a monetized API on your own. Returns { resources: [{ resource, type, x402Version, accepts: [{ scheme, network, amount, asset, payTo }], lastUpdated, metadata? }], pagination: { limit, offset, total } } — `amount` is in ATOMIC units (USDC 6-decimals: \"10000\" = $0.01), so convert before quoting a price to the user. PUBLIC: needs no API key, no wallet and spends nothing, so it is always safe to call. Filter with `type` (e.g. \"http\") and page with `limit`/`offset`. Then pass a chosen `resource` URL to x402_pay to actually buy it.",
+    inputSchema: X402DiscoverSchema,
+    handler: async (input) => {
+        const result = await x402Discover(input);
+        return { content: [{ type: "text", text: JSON.stringify(result) }] };
+    },
+};
+//# sourceMappingURL=index.js.map

package/dist/tools/x402-discover/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/x402-discover/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,4BAA4B,GAAG,wCAAwC,CAAC;AAoB9E;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,KAAwB;IAIhD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,kBAAkB,IAAI,4BAA4B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE7B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACV,mFAAmF;QACnF,oFAAoF;QACpF,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;IACF,OAAO;QACH,SAAS,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;KACnE,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAA8C;IACvE,IAAI,EAAE,eAAe;IACrB,WAAW,EACP,63BAA63B;IACj4B,WAAW,EAAE,kBAAkB;IAC/B,OAAO,EAAE,KAAK,EAAE,KAAwB,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;CACJ,CAAC"}

package/dist/tools/x402-discover/schema.d.ts

@@ -0,0 +1,27 @@
+import * as z from "zod";
+/**
+ * Browse the x402 "Bazaar" — the catalogue of x402-enabled resources registered with a
+ * facilitator, each with the payment requirements it accepts (x402 v2 §8).
+ *
+ * This is the FIND half of x402: `x402_pay` can only pay a URL it is handed, so without
+ * discovery an agent can never locate a paid API on its own. The endpoint is PUBLIC — no
+ * API key and no wallet — so browsing costs nothing and commits nothing.
+ */
+export declare const X402DiscoverSchema: z.ZodObject<{
+    type: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+    offset: z.ZodOptional<z.ZodNumber>;
+    facilitatorBaseUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    type?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    facilitatorBaseUrl?: string | undefined;
+}, {
+    type?: string | undefined;
+    limit?: number | undefined;
+    offset?: number | undefined;
+    facilitatorBaseUrl?: string | undefined;
+}>;
+export type X402DiscoverInput = z.infer<typeof X402DiscoverSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/tools/x402-discover/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-discover/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAuB7B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/tools/x402-discover/schema.js

@@ -0,0 +1,34 @@
+import * as z from "zod";
+/**
+ * Browse the x402 "Bazaar" — the catalogue of x402-enabled resources registered with a
+ * facilitator, each with the payment requirements it accepts (x402 v2 §8).
+ *
+ * This is the FIND half of x402: `x402_pay` can only pay a URL it is handed, so without
+ * discovery an agent can never locate a paid API on its own. The endpoint is PUBLIC — no
+ * API key and no wallet — so browsing costs nothing and commits nothing.
+ */
+export const X402DiscoverSchema = z.object({
+    type: z
+        .string()
+        .optional()
+        .describe('Filter by resource type, e.g. "http". Omit to list every type.'),
+    limit: z
+        .number()
+        .int()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe("Max results to return, 1-100 (default 20). The facilitator clamps out-of-range values rather than erroring."),
+    offset: z
+        .number()
+        .int()
+        .min(0)
+        .optional()
+        .describe("How many results to skip, for paging (default 0). Use with `pagination.total` from a previous call."),
+    facilitatorBaseUrl: z
+        .string()
+        .url()
+        .optional()
+        .describe("Override the facilitator base URL (default https://ai.cryptoapis.io/x402/merchant). Useful against QA/local."),
+});
+//# sourceMappingURL=schema.js.map

package/dist/tools/x402-discover/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/tools/x402-discover/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC;SACF,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;IAC/E,KAAK,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,6GAA6G,CAAC;IAC5H,MAAM,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qGAAqG,CAAC;IACpH,kBAAkB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,QAAQ,CAAC,8GAA8G,CAAC;CAChI,CAAC,CAAC"}

package/dist/tools/x402-pay/index.d.ts

@@ -7,6 +7,18 @@ import type { McpX402ToolDef } from "../types.js";
  * @param input the tool input
  * @return the final (paid) response summary
  */
+/**
+ * Is `url` allowed by a host allowlist?
+ *
+ * An entry matches the host exactly; an entry with a LEADING DOT (`.acme.com`) also matches
+ * any subdomain. Matching is on the parsed hostname, never on substrings of the raw url —
+ * a substring test would let `evil.com/?x=api.acme.com` through.
+ *
+ * @param url the url about to be fetched
+ * @param allowed the allowlist (already resolved from param or env)
+ * @return true when the url may be paid
+ */
+export declare function isHostAllowed(url: string, allowed: string[]): boolean;
 export declare function x402Pay(input: X402PayInput): Promise<{
     status: number;
     paid: boolean;

package/dist/tools/x402-pay/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+ClD;;;;;GAKG;AACH,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACtF,CAAC,CA4KD;AAED,eAAO,MAAM,WAAW,EAAE,cAAc,CAAC,OAAO,aAAa,CAS5D,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA+ClD;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAYrE;AAED,wBAAsB,OAAO,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC;IACxD,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACtF,CAAC,CA4LD;AAED,eAAO,MAAM,WAAW,EAAE,cAAc,CAAC,OAAO,aAAa,CAS5D,CAAC"}

package/dist/tools/x402-pay/index.js

@@ -42,11 +42,52 @@ function selectRequirements(accepts, allowed) {
  * @param input the tool input
  * @return the final (paid) response summary
  */
+/**
+ * Is `url` allowed by a host allowlist?
+ *
+ * An entry matches the host exactly; an entry with a LEADING DOT (`.acme.com`) also matches
+ * any subdomain. Matching is on the parsed hostname, never on substrings of the raw url —
+ * a substring test would let `evil.com/?x=api.acme.com` through.
+ *
+ * @param url the url about to be fetched
+ * @param allowed the allowlist (already resolved from param or env)
+ * @return true when the url may be paid
+ */
+export function isHostAllowed(url, allowed) {
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return false; // unparseable url is never allowed
+    }
+    return allowed.some((entry) => {
+        const e = entry.trim().toLowerCase();
+        if (!e)
+            return false;
+        return e.startsWith(".") ? host === e.slice(1) || host.endsWith(e) : host === e;
+    });
+}
 export async function x402Pay(input) {
     // Credentials: prefer the per-call params, else fall back to env (set once in the
     // MCP config so the agent only ever passes `url` — and the key stays out of logs).
     // apiKey + walletId are always needed (to call /authorize); the SIGNING key is
     // resolved per-family at the dispatch below (each chain uses its own key form).
+    // Host allowlist FIRST — before credentials, before any fetch. This tool holds spending
+    // keys and will pay whatever url it is handed, so a url the operator never sanctioned
+    // must not even be contacted. Resolved from the param OR X402_ALLOWED_HOSTS so an
+    // operator can pin it outside the model's reach; unset = unrestricted (x402 is an open
+    // protocol and the tool must be able to pay any merchant, incl. our own customers).
+    const allowedHosts = input.allowedHosts
+        ?? (process.env.X402_ALLOWED_HOSTS ? process.env.X402_ALLOWED_HOSTS.split(",") : undefined);
+    if (allowedHosts && allowedHosts.length > 0 && !isHostAllowed(input.url, allowedHosts)) {
+        return {
+            status: 0,
+            paid: false,
+            reason: `host not allowed: ${input.url} is outside allowedHosts (${allowedHosts.join(", ")})`,
+            body: "",
+        };
+    }
     const apiKey = input.apiKey ?? process.env.CRYPTOAPIS_API_KEY;
     const walletId = input.walletId ?? process.env.X402_WALLET_ID;
     if (!apiKey || !walletId) {
@@ -218,7 +259,7 @@ export async function x402Pay(input) {
 }
 export const x402PayTool = {
     name: "x402_pay",
-    description: "Fetch an HTTP resource and, if it returns 402 Payment Required, pay it automatically with x402 and return the paid response. On a 402 it: parses the merchant's price, authorizes via the CryptoAPIs buyer /authorize, signs the payment LOCALLY (non-custodial — the key never leaves this process), and retries with the X-PAYMENT header. Returns { status, paid, body, settlement? }. Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, UTXO (bitcoin/ltc/doge/dash/bch/zcash), Kaspa and XRP are UPCOMING — wired but not yet enabled, and paying on them returns a clear coming-soon (family_not_yet_supported) result. Set CRYPTOAPIS_API_KEY + X402_WALLET_ID once, plus the signing key(s) for the chain(s) you pay on: X402_PRIVATE_KEY (EVM hex), X402_SVM_SECRET (base58). A scheme with no configured key errors cleanly (never mis-signs). Env vars keep keys OUT of tool-call logs. Use allowedNetworks to restrict, maxAmount as a safety cap. SECURITY: use only in trusted local environments.",
+    description: "Fetch an HTTP resource and, if it returns 402 Payment Required, pay it automatically with x402 and return the paid response. On a 402 it: parses the merchant's price, authorizes via the CryptoAPIs buyer /authorize, signs the payment LOCALLY (non-custodial — the key never leaves this process), and retries with the X-PAYMENT header. Returns { status, paid, body, settlement? }. Supported today: EVM (eip712, e.g. Base USDC) and Solana. Tron, UTXO (bitcoin/ltc/doge/dash/bch/zcash), Kaspa and XRP are UPCOMING — wired but not yet enabled, and paying on them returns a clear coming-soon (family_not_yet_supported) result. Set CRYPTOAPIS_API_KEY + X402_WALLET_ID once, plus the signing key(s) for the chain(s) you pay on: X402_PRIVATE_KEY (EVM hex), X402_SVM_SECRET (base58). A scheme with no configured key errors cleanly (never mis-signs). Env vars keep keys OUT of tool-call logs. Use allowedNetworks to restrict chains, maxAmount as a per-call spend cap, and allowedHosts to restrict WHICH SITES may be paid (a url outside the list is refused before any network call; set X402_ALLOWED_HOSTS in the MCP config to pin it outside the model's reach). SECURITY: this tool holds spending keys — use only in trusted local environments, and prefer pinning allowedHosts + maxAmount via env for unattended runs.",
     inputSchema: X402PaySchema,
     handler: async (input) => {
         const result = await x402Pay(input);

package/dist/tools/x402-pay/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB;;+DAE+D;AAC/D,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;6DAG6D;AAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEjE;uFACuF;AACvF,MAAM,UAAU,GAA4D;IACxE,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACrF,0CAA0C,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;CACzF,CAAC;AAQF,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,OAA8B,EAAE,OAAkB;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAG7C,kFAAkF;IAClF,mFAAmF;IACnF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,uCAAuC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,sFAAsF;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAChE,MAAM,IAAI,GAAG;QACT,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM;QAC1D,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QACnD,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAChD,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QACnD,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;KAClD,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAgB;QAC1B,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACrC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA+C,CAAC;IACnG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,YAAY,CAAC,MAAM,sBAAsB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzI,CAAC;IAED,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;QACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;KAClF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,OAAO,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAA0G,CAAC;IAC1I,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,kFAAkF;IAClF,8EAA8E;IAC9E,qFAAqF;IACrF,8EAA8E;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IAErC,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,kCAAkC,IAAI,CAAC,MAAM,8FAA8F;YACnJ,IAAI,EAAE,EAAE;SACX,CAAC;IACN,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACrC,IAAI,OAAgC,CAAC;IAErC,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAE,OAAe,EAAiB,EAAE,CACxE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,UAAU,OAAO,0BAA0B,CAAC,CAAC;IAEhG,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,EAAyJ,CAAC;QACrK,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,IAAI,CAAC,GAAa;YAC9B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC;YACnC,MAAM,EAAE,cAAc;YACtB,eAAe,EAAE,IAAI,CAAC,GAAa;YACnC,WAAW,EAAE,EAAE,CAAC,WAAqB;SACxC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,CAAC;YAC9C,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,IAAI,CAAC,IAAc;YAC/B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,uFAAuF;QACvF,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrG,MAAM,EAAE,oBAAoB,EAAE,GAAG,mBAAmB,CAAC;YACjD,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,KAAK,CAAC,UAAmB;YACrC,OAAO,EAAE,KAAK,CAAC,OAAgB;YAC/B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;YAClC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC;YAC/C,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EAAE,CAAC,IAAI,CAAC,KAAe,CAAC;YACnC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACtD,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,GAAa;YAC1B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,cAAc,GAA4B;QAC5C,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;KACnB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,QAAQ;QACX,OAAO,EAAE,EAAE,GAAI,QAAQ,CAAC,OAAkC,EAAE,WAAW,EAAE,QAAQ,EAAE;KACtF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/D,OAAO;QACH,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAC7C,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE;QACvB,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAChH,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAyC;IAC7D,IAAI,EAAE,UAAU;IAChB,WAAW,EACP,g+BAAg+B;IACp+B,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,KAAmB,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;CACJ,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACrB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,sBAAsB,GAAG,qCAAqC,CAAC;AACrE,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB;;+DAE+D;AAC/D,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B;;;6DAG6D;AAC7D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEjE;uFACuF;AACvF,MAAM,UAAU,GAA4D;IACxE,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE;IACxF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE;IACzF,yCAAyC,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACrF,0CAA0C,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE;IAC7F,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;IACtF,yCAAyC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE;CACzF,CAAC;AAQF,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,OAA8B,EAAE,OAAkB;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,OAAiB;IACxD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1B,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAmB;IAG7C,kFAAkF;IAClF,mFAAmF;IACnF,+EAA+E;IAC/E,gFAAgF;IAChF,wFAAwF;IACxF,sFAAsF;IACtF,kFAAkF;IAClF,uFAAuF;IACvF,oFAAoF;IACpF,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY;WAChC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAChG,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;QACrF,OAAO;YACH,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,qBAAqB,KAAK,CAAC,GAAG,6BAA6B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7F,IAAI,EAAE,EAAE;SACX,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAAE,CAAC,QAAQ,IAAI,yBAAyB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5H,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,uCAAuC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChI,CAAC;IACD,sFAAsF;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAChE,MAAM,IAAI,GAAG;QACT,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM;QAC1D,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe;QACnD,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;QAChD,KAAK,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;QACnD,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa;KAClD,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC;IACrC,MAAM,QAAQ,GAAgB;QAC1B,MAAM;QACN,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;QACrC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA+C,CAAC;IACnG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACxE,IAAI,CAAC,YAAY,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/G,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,YAAY,CAAC,MAAM,sBAAsB,KAAK,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzI,CAAC;IAED,6DAA6D;IAC7D,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;QACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;KAClF,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,OAAO,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACvI,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAA0G,CAAC;IAC1I,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC5G,CAAC;IAED,gFAAgF;IAChF,oFAAoF;IACpF,kFAAkF;IAClF,8EAA8E;IAC9E,qFAAqF;IACrF,8EAA8E;IAC9E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;IAErC,oFAAoF;IACpF,iFAAiF;IACjF,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,OAAO;YACH,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,kCAAkC,IAAI,CAAC,MAAM,8FAA8F;YACnJ,IAAI,EAAE,EAAE;SACX,CAAC;IACN,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IACrC,IAAI,OAAgC,CAAC;IAErC,4FAA4F;IAC5F,MAAM,OAAO,GAAG,CAAC,GAAuB,EAAE,OAAe,EAAiB,EAAE,CACxE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,IAAI,CAAC,MAAM,UAAU,OAAO,0BAA0B,CAAC,CAAC;IAEhG,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,GAAG,EAAyJ,CAAC;QACrK,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACzC,MAAM,EAAE,iBAAiB;YACzB,UAAU,EAAE,IAAI,CAAC,GAAa;YAC9B,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IACvD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACrD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,WAAW,EAAE,GAAG,cAAc,CAAC;YACnC,MAAM,EAAE,cAAc;YACtB,eAAe,EAAE,IAAI,CAAC,GAAa;YACnC,WAAW,EAAE,EAAE,CAAC,WAAqB;SACxC,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,CAAC;YAC9C,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,IAAI,CAAC,IAAc;YAC/B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,uFAAuF;QACvF,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACpD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACrG,MAAM,EAAE,oBAAoB,EAAE,GAAG,mBAAmB,CAAC;YACjD,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,KAAK,CAAC,UAAmB;YACrC,OAAO,EAAE,KAAK,CAAC,OAAgB;YAC/B,WAAW,EAAE,CAAC,IAAI,CAAC,IAAc,CAAC;YAClC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,mBAAmB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,iBAAiB,EAAE,GAAG,oBAAoB,CAAC;YAC/C,MAAM,EAAE,mBAAmB;YAC3B,WAAW,EAAE,CAAC,IAAI,CAAC,KAAe,CAAC;YACnC,mBAAmB,EAAE,EAAE,CAAC,mBAA8C;SACzE,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,IAAI,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACnD,IAAI,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC5E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,kBAAkB,CAAC;YACtD,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,IAAI,CAAC,GAAa;YAC1B,WAAW,EAAE,EAAE,CAAC,WAAsC;SACzD,CAAC,CAAC;QACH,OAAO,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IACpD,CAAC;SAAM,CAAC;QACJ,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,IAAI,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,cAAc,GAA4B;QAC5C,WAAW,EAAE,YAAY;QACzB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,OAAO;KACnB,CAAC;IAEF,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,GAAG,QAAQ;QACX,OAAO,EAAE,EAAE,GAAI,QAAQ,CAAC,OAAkC,EAAE,WAAW,EAAE,QAAQ,EAAE;KACtF,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/D,OAAO;QACH,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAC7C,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE;QACvB,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KAChH,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAyC;IAC7D,IAAI,EAAE,UAAU;IAChB,WAAW,EACP,wxCAAwxC;IAC5xC,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,KAAK,EAAE,KAAmB,EAAE,EAAE;QACnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IACzE,CAAC;CACJ,CAAC"}

package/dist/tools/x402-pay/schema.d.ts

@@ -24,6 +24,7 @@ export declare const X402PaySchema: z.ZodObject<{
     kaspaKey: z.ZodOptional<z.ZodString>;
     xrpSeed: z.ZodOptional<z.ZodString>;
     allowedNetworks: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    allowedHosts: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     buyerBaseUrl: z.ZodOptional<z.ZodString>;
     maxAmount: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
@@ -40,6 +41,7 @@ export declare const X402PaySchema: z.ZodObject<{
     kaspaKey?: string | undefined;
     xrpSeed?: string | undefined;
     allowedNetworks?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
     buyerBaseUrl?: string | undefined;
     maxAmount?: string | undefined;
 }, {
@@ -56,6 +58,7 @@ export declare const X402PaySchema: z.ZodObject<{
     kaspaKey?: string | undefined;
     xrpSeed?: string | undefined;
     allowedNetworks?: string[] | undefined;
+    allowedHosts?: string[] | undefined;
     buyerBaseUrl?: string | undefined;
     maxAmount?: string | undefined;
 }>;

package/dist/tools/x402-pay/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsBxB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/tools/x402-pay/schema.js

@@ -27,6 +27,7 @@ export const X402PaySchema = z.object({
     kaspaKey: z.string().optional().describe("Kaspa private key (hex, 32 bytes) — signs kaspa-transaction payments. Falls back to X402_KASPA_KEY."),
     xrpSeed: z.string().optional().describe("XRP secret/seed (base58, e.g. s...) — signs xrp-transaction payments. Falls back to X402_XRP_SEED."),
     allowedNetworks: z.array(z.string()).optional().describe("Restrict which CAIP-2 networks to pay on (e.g. [\"eip155:8453\"])"),
+    allowedHosts: z.array(z.string()).optional().describe("Restrict WHICH HOSTS may be paid, e.g. [\"api.acme.com\"] (a leading dot matches subdomains: \".acme.com\"). A url outside the list is refused BEFORE any network call. Falls back to the X402_ALLOWED_HOSTS env var (comma-separated) — set it there to pin the allowlist OUTSIDE the model's reach, so a prompt-injected url cannot widen it."),
     buyerBaseUrl: z.string().url().optional().describe("Override the buyer service base URL (default https://ai.cryptoapis.io/x402/buyer)"),
     maxAmount: z.string().optional().describe("Optional safety cap: refuse to pay if the required atomic-unit amount exceeds this"),
 });

package/dist/tools/x402-pay/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC1G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACrG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAEtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yKAAyK,CAAC;IACjN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sdAAsd,CAAC;IAEhgB,8EAA8E;IAC9E,+EAA+E;IAC/E,qDAAqD;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sKAAsK,CAAC;IAClN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IAC3J,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6HAA6H,CAAC;IACxK,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kIAAkI,CAAC;IAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qGAAqG,CAAC;IAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;IAE7I,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC7H,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;IACvI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;CAClI,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/tools/x402-pay/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;AAEzB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IAChF,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC1G,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+DAA+D,CAAC;IACrG,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IAEtF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yKAAyK,CAAC;IACjN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sdAAsd,CAAC;IAEhgB,8EAA8E;IAC9E,+EAA+E;IAC/E,qDAAqD;IACrD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sKAAsK,CAAC;IAClN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kHAAkH,CAAC;IAC3J,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6HAA6H,CAAC;IACxK,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kIAAkI,CAAC;IAC3K,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qGAAqG,CAAC;IAC/I,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oGAAoG,CAAC;IAE7I,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC7H,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iVAAiV,CAAC;IACxY,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;IACvI,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oFAAoF,CAAC;CAClI,CAAC,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@cryptoapis-io/mcp-x402-pay",
   "mcpName": "io.github.CryptoAPIs-io/mcp-x402-pay",
-  "version": "0.1.2",
+  "version": "0.3.0",
   "description": "MCP server that pays x402-gated HTTP endpoints — one x402_pay tool that fetches, and on a 402 authorizes via the CryptoAPIs buyer service, signs LOCALLY, and retries.",
   "license": "MIT",
   "type": "module",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/CryptoAPIs-io/cryptoapis-mcp-x402-pay",
     "source": "github"
   },
-  "version": "0.1.2",
+  "version": "0.3.0",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "@cryptoapis-io/mcp-x402-pay",
-      "version": "0.1.2",
+      "version": "0.3.0",
       "transport": {
         "type": "stdio"
       }