@curless/agentbank-mcp-pay 0.1.0

package/README.md

@@ -0,0 +1,52 @@
+# @curless/agentbank-mcp-pay
+
+Paywall an MCP tool (or any API) so **AI agents pay per call**. Wrap a tool
+handler with `withPaywall()`: an unpaid call returns a payment **gate**, the
+agent pays via agentbank's MPP HTTP-402 endpoint, and the call runs once the
+payment is verified — single-use. Settlement happens on agentbank's
+double-entry ledger + rails (card / stablecoin / Curless); this package only
+gates the tool on a verified, not-yet-used payment.
+
+Because MCP (especially stdio) has no HTTP layer to return a `402` on, the gate
+is a normal tool result carrying the terms in `structuredContent`
+(the SolvaPay / ATXP pattern).
+
+## Seller side
+
+```ts
+import { withPaywall, createHttpBackend } from '@curless/agentbank-mcp-pay';
+
+const backend = createHttpBackend({
+  baseUrl: 'https://api.agentbank…',
+  apiKey: process.env.AGENTBANK_KEY!, // needs agent:execute (to look up the PI)
+});
+
+server.tool(
+  'deep_search',
+  schema,
+  withPaywall(deepSearch, { backend, merchantId: 'curless_mch_…', price: 200, currency: 'USD', sku: 'deep_search' }),
+);
+// unpaid call → { structuredContent: { payment_required: { amount: 200, … } } }
+// paid retry  → runs deepSearch, returns its result + a receipt
+```
+
+`price` is in minor units (cents / token base units). The default one-time-use
+store is in-process — back it with Redis/DB in production via the `consumed`
+option.
+
+## Agent side
+
+```ts
+import { payMcpGate } from '@curless/agentbank-mcp-pay/agent';
+
+const r1 = await callTool('deep_search', { q: '…' });
+const gate = r1.structuredContent.payment_required;
+const { paymentIntentId } = await payMcpGate(gate, {
+  baseUrl: 'https://api.agentbank…',
+  token: agentAccessToken, // agent:execute
+  source: 'did:agent:buyer-1',
+});
+const r2 = await callTool('deep_search', { q: '…', _agentbankPayment: { paymentIntentId } });
+```
+
+MIT

package/dist/agent.d.ts

@@ -0,0 +1,13 @@
+import { type FetchLike } from '@curless/agentbank-core';
+import type { PaywallGate } from './types.js';
+export type PayMcpGateOptions = {
+    baseUrl: string;
+    token: string;
+    source: string;
+    payload?: Record<string, unknown>;
+    fetch?: FetchLike;
+};
+export declare const payMcpGate: (gate: PaywallGate, opts: PayMcpGateOptions) => Promise<{
+    paymentIntentId: string;
+}>;
+//# sourceMappingURL=agent.d.ts.map

package/dist/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAAY,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAyC9C,MAAM,MAAM,iBAAiB,GAAG;IAC9B,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;IAEd,MAAM,EAAE,MAAM,CAAC;IAEf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,CAAC;AAKF,eAAO,MAAM,UAAU,GACrB,MAAM,WAAW,EACjB,MAAM,iBAAiB,KACtB,OAAO,CAAC;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAoCrC,CAAC"}

package/dist/agent.js

@@ -0,0 +1,77 @@
+import { buildUrl } from '@curless/agentbank-core';
+// Agent-side helper: pay a paywall gate via agentbank's MPP HTTP-402 endpoint
+// and get back the PaymentIntent id to retry the gated tool with.
+//
+// The MPP wire (challenge / credential) is reimplemented here, byte-compatible
+// with @agentbank/protocol-mpp, so this published package needs no internal
+// dependency.
+// base64url(utf8) — portable across Node and edge runtimes.
+const toB64Url = (s) => {
+    if (typeof Buffer !== 'undefined')
+        return Buffer.from(s, 'utf8').toString('base64url');
+    const bytes = new TextEncoder().encode(s);
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+// Parse a `Payment id="..", request="..", opaque=".."` WWW-Authenticate value.
+const parseChallengeHeader = (header) => {
+    const m = header.trim().match(/^Payment\s+(.+)$/s);
+    if (!m?.[1])
+        throw new Error('not an MPP Payment challenge');
+    const params = {};
+    for (const part of m[1].split(',')) {
+        const eq = part.indexOf('=');
+        if (eq < 0)
+            continue;
+        const k = part.slice(0, eq).trim();
+        params[k] = part
+            .slice(eq + 1)
+            .trim()
+            .replace(/^"/, '')
+            .replace(/"$/, '');
+    }
+    if (!params.id || !params.request || !params.opaque) {
+        throw new Error('challenge missing id/request/opaque');
+    }
+    return { id: params.id, request: params.request, opaque: params.opaque };
+};
+// Drive the 2-step MPP charge for a gate: POST (no credential) → 402 +
+// challenge → POST (with credential) → settled PaymentIntent. Returns the id
+// to retry the gated tool with.
+export const payMcpGate = async (gate, opts) => {
+    const fetchImpl = opts.fetch ?? fetch;
+    const url = buildUrl(opts.baseUrl.replace(/\/+$/, ''), gate.payment.payEndpoint);
+    const headers = {
+        'content-type': 'application/json',
+        authorization: `Bearer ${opts.token}`,
+    };
+    const body = JSON.stringify({ amount: gate.payment.amount, currency: gate.payment.currency });
+    // 1. Unpaid → 402 + WWW-Authenticate: Payment challenge.
+    const challengeRes = await fetchImpl(url, { method: 'POST', headers, body });
+    if (challengeRes.status !== 402) {
+        throw new Error(`expected a 402 payment challenge, got ${challengeRes.status}`);
+    }
+    const wwwAuth = challengeRes.headers.get('www-authenticate');
+    if (!wwwAuth)
+        throw new Error('challenge response missing WWW-Authenticate header');
+    const challenge = parseChallengeHeader(wwwAuth);
+    // 2. Retry with a credential echoing the signed challenge.
+    const credential = `Payment ${toB64Url(JSON.stringify({
+        challenge: { id: challenge.id, request: challenge.request, opaque: challenge.opaque },
+        source: opts.source,
+        payload: opts.payload ?? { kind: 'delegated_token', ref: opts.source },
+    }))}`;
+    const paidRes = await fetchImpl(url, {
+        method: 'POST',
+        headers: { ...headers, 'x-mpp-credential': credential },
+        body,
+    });
+    const out = (await paidRes.json());
+    if (paidRes.status !== 200 || !out.paymentIntentId) {
+        throw new Error(`MPP charge failed (${paidRes.status}): ${JSON.stringify(out)}`);
+    }
+    return { paymentIntentId: out.paymentIntentId };
+};
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnE,8EAA8E;AAC9E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,cAAc;AAEd,4DAA4D;AAC5D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE;IACrC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC;AAIF,+EAA+E;AAC/E,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAmB,EAAE;IAC/D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC7D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,GAAG,CAAC;YAAE,SAAS;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI;aACb,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;aACb,IAAI,EAAE;aACN,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC3E,CAAC,CAAC;AAaF,uEAAuE;AACvE,6EAA6E;AAC7E,gCAAgC;AAChC,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAiB,EACjB,IAAuB,EACe,EAAE;IACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE;KACtC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAE9F,yDAAyD;IACzD,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAEhD,2DAA2D;IAC3D,MAAM,UAAU,GAAG,WAAW,QAAQ,CACpC,IAAI,CAAC,SAAS,CAAC;QACb,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE;QACrF,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE;KACvE,CAAC,CACH,EAAE,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACnC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE;QACvD,IAAI;KACL,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAkD,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,sBAAsB,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,GAAG,CAAC,eAAe,EAAE,CAAC;AAClD,CAAC,CAAC"}

package/dist/backend.d.ts

@@ -0,0 +1,8 @@
+import { type FetchLike } from '@curless/agentbank-core';
+import type { PaywallBackend } from './types.js';
+export declare const createHttpBackend: (cfg: {
+    baseUrl: string;
+    apiKey: string;
+    fetch?: FetchLike;
+}) => PaywallBackend;
+//# sourceMappingURL=backend.d.ts.map

package/dist/backend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.d.ts","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,SAAS,EAA0C,MAAM,yBAAyB,CAAC;AACjG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAMjD,eAAO,MAAM,iBAAiB,GAAI,KAAK;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB,KAAG,cA+BH,CAAC"}

package/dist/backend.js

@@ -0,0 +1,35 @@
+import { buildUrl, sendJson } from '@curless/agentbank-core';
+// agentbank-backed paywall verification: looks up the presented PaymentIntent
+// and confirms it actually paid this merchant the required amount. The key
+// must carry `agent:execute` (or `agentbank:admin`) — the scope GET
+// /v1/payment-intents/:id requires — and share the org the PI was created in.
+export const createHttpBackend = (cfg) => {
+    const fetchImpl = cfg.fetch ?? fetch;
+    const baseUrl = cfg.baseUrl.replace(/\/+$/, '');
+    const headers = {
+        'content-type': 'application/json',
+        authorization: `Bearer ${cfg.apiKey}`,
+    };
+    return {
+        async verifyPayment({ paymentIntentId, merchantId, minAmount, currency }) {
+            let pi;
+            try {
+                pi = await sendJson(fetchImpl, buildUrl(baseUrl, `/v1/payment-intents/${encodeURIComponent(paymentIntentId)}`), 'GET', headers, undefined);
+            }
+            catch (err) {
+                return { ok: false, reason: `payment_intent lookup failed: ${err.message}` };
+            }
+            if (pi.curlessMerchantId !== merchantId)
+                return { ok: false, reason: 'merchant_mismatch' };
+            if (pi.status !== 'captured' && pi.status !== 'settled' && pi.status !== 'reconciled') {
+                return { ok: false, reason: `payment not captured (status=${pi.status})` };
+            }
+            if (pi.currency !== currency)
+                return { ok: false, reason: 'currency_mismatch' };
+            if (pi.amount < minAmount)
+                return { ok: false, reason: 'insufficient_amount' };
+            return { ok: true, amount: pi.amount, currency: pi.currency };
+        },
+    };
+};
+//# sourceMappingURL=backend.js.map

package/dist/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../src/backend.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsC,QAAQ,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGjG,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAIjC,EAAkB,EAAE;IACnB,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,IAAI,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG;QACd,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE;KACtC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,aAAa,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE;YACtE,IAAI,EAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,EAAE,GAAG,MAAM,QAAQ,CACjB,SAAS,EACT,QAAQ,CAAC,OAAO,EAAE,uBAAuB,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,EAC/E,KAAK,EACL,OAAO,EACP,SAAS,CACV,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAkC,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1F,CAAC;YACD,IAAI,EAAE,CAAC,iBAAiB,KAAK,UAAU;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAC3F,IAAI,EAAE,CAAC,MAAM,KAAK,UAAU,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC;YAC7E,CAAC;YACD,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;YAChF,IAAI,EAAE,CAAC,MAAM,GAAG,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;YAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { PAYMENT_ARG, type WithPaywallOptions, withPaywall } from './paywall.js';
+export { createHttpBackend } from './backend.js';
+export { type PayMcpGateOptions, payMcpGate } from './agent.js';
+export type { ConsumedStore, PaywallBackend, PaywallGate, PaywallProof, ToolHandler, ToolResult, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,KAAK,kBAAkB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,iBAAiB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAChE,YAAY,EACV,aAAa,EACb,cAAc,EACd,WAAW,EACX,YAAY,EACZ,WAAW,EACX,UAAU,GACX,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// @curless/agentbank-mcp-pay — paywall an MCP tool / API so AI agents pay per
+// call. Seller side: wrap a tool with withPaywall(). Agent side: payMcpGate()
+// (also exported from "@curless/agentbank-mcp-pay/agent").
+export { PAYMENT_ARG, withPaywall } from './paywall.js';
+export { createHttpBackend } from './backend.js';
+export { payMcpGate } from './agent.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAA2B,WAAW,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAA0B,UAAU,EAAE,MAAM,YAAY,CAAC"}

package/dist/paywall.d.ts

@@ -0,0 +1,12 @@
+import type { ConsumedStore, PaywallBackend, ToolHandler } from './types.js';
+export declare const PAYMENT_ARG = "_agentbankPayment";
+export type WithPaywallOptions = {
+    backend: PaywallBackend;
+    merchantId: string;
+    price: number;
+    currency: string;
+    sku?: string;
+    consumed?: ConsumedStore;
+};
+export declare const withPaywall: <A extends Record<string, unknown> = Record<string, unknown>>(handler: ToolHandler<A>, opts: WithPaywallOptions) => ToolHandler<A>;
+//# sourceMappingURL=paywall.d.ts.map

package/dist/paywall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paywall.d.ts","sourceRoot":"","sources":["../src/paywall.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAGd,WAAW,EAEZ,MAAM,YAAY,CAAC;AAGpB,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,cAAc,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AA6CF,eAAO,MAAM,WAAW,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrF,SAAS,WAAW,CAAC,CAAC,CAAC,EACvB,MAAM,kBAAkB,KACvB,WAAW,CAAC,CAAC,CAiCf,CAAC"}

package/dist/paywall.js

@@ -0,0 +1,77 @@
+// The arg key the agent uses to present a payment proof on the retry call.
+export const PAYMENT_ARG = '_agentbankPayment';
+const inMemoryConsumed = () => {
+    const seen = new Set();
+    return {
+        has: (id) => seen.has(id),
+        add: (id) => {
+            seen.add(id);
+        },
+    };
+};
+const gate = (opts, note) => {
+    const g = {
+        status: 'payment_required',
+        payment: {
+            merchantId: opts.merchantId,
+            amount: opts.price,
+            currency: opts.currency,
+            sku: opts.sku,
+            protocol: 'mpp',
+            payEndpoint: `/mpp/${opts.merchantId}/charge`,
+        },
+        proofArg: PAYMENT_ARG,
+        note,
+    };
+    const what = opts.sku ? ` for "${opts.sku}"` : '';
+    const text = `Payment required: ${opts.price} ${opts.currency}${what}. ` +
+        `Pay via agentbank MPP (POST ${g.payment.payEndpoint}), then retry this tool with ` +
+        `${PAYMENT_ARG}: { paymentIntentId }.${note ? ` (${note})` : ''}`;
+    // A gate is NOT an error — the agent is expected to read structuredContent,
+    // pay, and retry. (MCP has no HTTP 402; the terms ride in structuredContent.)
+    return {
+        content: [{ type: 'text', text }],
+        structuredContent: { payment_required: g },
+        isError: false,
+    };
+};
+// Wrap an MCP tool handler with a per-call paywall. An unpaid call returns a
+// payment gate; once the agent pays (via agentbank MPP) and retries with the
+// PaymentIntent id, the payment is verified + consumed (single-use) and the
+// real handler runs. agentbank's ledger + rail did the actual settlement —
+// this only gates the tool on a verified, not-yet-used payment.
+export const withPaywall = (handler, opts) => {
+    const consumed = opts.consumed ?? inMemoryConsumed();
+    return async (args) => {
+        const proof = args[PAYMENT_ARG];
+        if (!proof?.paymentIntentId)
+            return gate(opts);
+        const pi = proof.paymentIntentId;
+        if (await consumed.has(pi))
+            return gate(opts, `payment ${pi} was already used — pay again`);
+        const verdict = await opts.backend.verifyPayment({
+            paymentIntentId: pi,
+            merchantId: opts.merchantId,
+            minAmount: opts.price,
+            currency: opts.currency,
+        });
+        if (!verdict.ok)
+            return gate(opts, verdict.reason ?? 'payment could not be verified');
+        // Bind the payment to this single execution before running the handler.
+        await consumed.add(pi);
+        const result = await handler(args);
+        return {
+            ...result,
+            structuredContent: {
+                ...(result.structuredContent ?? {}),
+                payment: {
+                    paymentIntentId: pi,
+                    amount: verdict.amount,
+                    currency: verdict.currency,
+                    status: 'paid',
+                },
+            },
+        };
+    };
+};
+//# sourceMappingURL=paywall.js.map

package/dist/paywall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paywall.js","sourceRoot":"","sources":["../src/paywall.ts"],"names":[],"mappings":"AASA,2EAA2E;AAC3E,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAY/C,MAAM,gBAAgB,GAAG,GAAkB,EAAE;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,OAAO;QACL,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE;YACV,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,IAAwB,EAAE,IAAa,EAAc,EAAE;IACnE,MAAM,CAAC,GAAgB;QACrB,MAAM,EAAE,kBAAkB;QAC1B,OAAO,EAAE;YACP,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,MAAM,EAAE,IAAI,CAAC,KAAK;YAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,QAAQ,EAAE,KAAK;YACf,WAAW,EAAE,QAAQ,IAAI,CAAC,UAAU,SAAS;SAC9C;QACD,QAAQ,EAAE,WAAW;QACrB,IAAI;KACL,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,IAAI,GACR,qBAAqB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,GAAG,IAAI,IAAI;QAC3D,+BAA+B,CAAC,CAAC,OAAO,CAAC,WAAW,+BAA+B;QACnF,GAAG,WAAW,yBAAyB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpE,4EAA4E;IAC5E,8EAA8E;IAC9E,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACjC,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE;QAC1C,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC,CAAC;AAEF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,gEAAgE;AAChE,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,OAAuB,EACvB,IAAwB,EACR,EAAE;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;IACrD,OAAO,KAAK,EAAE,IAAO,EAAuB,EAAE;QAC5C,MAAM,KAAK,GAAI,IAAgC,CAAC,WAAW,CAA6B,CAAC;QACzF,IAAI,CAAC,KAAK,EAAE,eAAe;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,KAAK,CAAC,eAAe,CAAC;QACjC,IAAI,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,+BAA+B,CAAC,CAAC;QAE5F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAC/C,eAAe,EAAE,EAAE;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,KAAK;YACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,IAAI,+BAA+B,CAAC,CAAC;QAEtF,wEAAwE;QACxE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO;YACL,GAAG,MAAM;YACT,iBAAiB,EAAE;gBACjB,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;gBACnC,OAAO,EAAE;oBACP,eAAe,EAAE,EAAE;oBACnB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,MAAM,EAAE,MAAM;iBACf;aACF;SACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,46 @@
+export type ToolResult = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    } | {
+        type: string;
+        [k: string]: unknown;
+    }>;
+    structuredContent?: Record<string, unknown>;
+    isError?: boolean;
+};
+export type ToolHandler<A = Record<string, unknown>> = (args: A) => Promise<ToolResult> | ToolResult;
+export type PaywallGate = {
+    status: 'payment_required';
+    payment: {
+        merchantId: string;
+        amount: number;
+        currency: string;
+        sku?: string;
+        protocol: 'mpp';
+        payEndpoint: string;
+    };
+    proofArg: string;
+    note?: string;
+};
+export type PaywallProof = {
+    paymentIntentId: string;
+};
+export type PaywallBackend = {
+    verifyPayment(input: {
+        paymentIntentId: string;
+        merchantId: string;
+        minAmount: number;
+        currency: string;
+    }): Promise<{
+        ok: boolean;
+        amount?: number;
+        currency?: string;
+        reason?: string;
+    }>;
+};
+export type ConsumedStore = {
+    has(id: string): boolean | Promise<boolean>;
+    add(id: string): void | Promise<void>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;IACxF,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CACrD,IAAI,EAAE,CAAC,KACJ,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;AAKtC,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,KAAK,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC;AAIvD,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,CAAC,KAAK,EAAE;QACnB,eAAe,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF,CAAC;AAIF,MAAM,MAAM,aAAa,GAAG;IAC1B,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@curless/agentbank-mcp-pay",
+  "version": "0.1.0",
+  "description": "Paywall an MCP tool / API so AI agents pay per call. Wrap a tool handler with withPaywall(): unpaid calls return a payment gate, the agent pays via agentbank (MPP/HTTP-402), and the call runs once payment is verified. Settles down to agentbank's ledger + rails (card / stablecoin / Curless).",
+  "license": "MIT",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./agent": {
+      "types": "./dist/agent.d.ts",
+      "default": "./dist/agent.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@curless/agentbank-core": "0.0.1"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.1",
+    "typescript": "^5.6.3",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "agentbank",
+    "curless",
+    "agent",
+    "mcp",
+    "paywall",
+    "x402",
+    "mpp",
+    "monetize"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}