@devlab.group/agent-commerce 1.6.0 → 2.0.0

package/dist/mcp.d.ts

@@ -1,4 +1,4 @@
-import { H as HttpProtocolAdapter } from './protocol-adapter-DTkrXTev.js';
+import { H as HttpProtocolAdapter } from './protocol-adapter-DonxfAwa.js';
 import 'node:http';
 import './runtime-CiYbgGpi.js';
 import './authorization-BpbWGGrf.js';

package/dist/mcp.js

@@ -1,10 +1,9 @@
-import { MCP_TOOL_NAME_PATTERN } from './chunk-AFI2CEZS.js';
-import { PACKAGE_VERSION, toLogInfo, toCommerceError, CommerceError, extractReservedInputFields, isRecord, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-IVJC5YLE.js';
-import { Server } from '@modelcontextprotocol/sdk/server/index.js';
-import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import { ListToolsRequestSchema, CallToolRequestSchema, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
+import { MCP_TOOL_NAME_PATTERN, readCappedBody, MCP_MODERN_PROTOCOL_REVISION, x402ErrorCode, settlementFailure, settlementResponseFromDetails, x402McpPaymentSubmission, X402_MCP_PAYMENT_META_KEY, X402_MCP_PAYMENT_RESPONSE_META_KEY, settlementResponse, X402_MCP_ERROR_META_KEY } from './chunk-HOZA3IWP.js';
+import { mcpPaymentRequired, MPP_MCP_CREDENTIAL_META_KEY, receiptObject, MPP_MCP_RECEIPT_META_KEY, MPP_MCP_PAYMENT_REQUIRED_META_KEY } from './chunk-CKJRITWY.js';
+import { PACKAGE_VERSION, toLogInfo, toCommerceError, CommerceError, extractReservedInputFields, isRecord, PAYMENT_INPUT_FIELD, AUTHORIZATION_INPUT_FIELD, toErrorEnvelope, DELIVERY_SUMMARY_META_KEY, toDeliverySummary, toPaymentRequiredEnvelope } from './chunk-53WXXIPR.js';
+import { createMcpHandler, Server, ProtocolError, ProtocolErrorCode, LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/server';
 
-var MCP_SUPPORTED_SPEC = LATEST_PROTOCOL_VERSION;
+var MCP_SUPPORTED_SPEC = `${MCP_MODERN_PROTOCOL_REVISION}, ${LATEST_PROTOCOL_VERSION}`;
 var MCP_CAPABILITIES = ["tools/list", "tools/call"];
 var MCP_UNSUPPORTED = [
   "resources",
@@ -16,7 +15,15 @@ var MCP_UNSUPPORTED = [
   "logging",
   "notifications/tools/list_changed",
   "tasks",
-  "dns-rebinding-protection"
+  "dns-rebinding-protection",
+  "authorization",
+  "sessions",
+  "subscriptions",
+  "pagination",
+  "HTTP+SSE transport",
+  // mppx reads challenges and refusals from tool-result `_meta`.
+  "MPP payment-required as JSON-RPC error -32042",
+  "MPP verification failure as JSON-RPC error -32043"
 ];
 function buildDescriptor(implementationVersion) {
   return {
@@ -30,41 +37,6 @@ function buildDescriptor(implementationVersion) {
   };
 }
 
-// src/protocols/mcp/result-mapping.ts
-function toRecord(value) {
-  return value;
-}
-function deliveredResult(outcome) {
-  const body = outcome.body;
-  const text = typeof body === "string" ? body : JSON.stringify(body ?? null);
-  return {
-    content: [{ type: "text", text }],
-    ...isRecord(body) ? { structuredContent: body } : {},
-    _meta: { [DELIVERY_SUMMARY_META_KEY]: toRecord(toDeliverySummary(outcome)) }
-  };
-}
-function paymentRequiredResult(outcome) {
-  const envelope = toPaymentRequiredEnvelope(outcome);
-  const p = envelope.payment;
-  const text = `Payment required: ${p.amount} ${p.currency} to ${p.destination} for resource "${outcome.resourceId}". Retry the call with a ${p.provider} payment proof in the "${PAYMENT_INPUT_FIELD}" input field.`;
-  return {
-    isError: true,
-    content: [{ type: "text", text }],
-    structuredContent: toRecord(envelope)
-  };
-}
-function errorResult(error) {
-  const envelope = toErrorEnvelope(error);
-  return {
-    isError: true,
-    content: [{ type: "text", text: `${envelope.code}: ${envelope.message}` }],
-    structuredContent: toRecord(envelope)
-  };
-}
-function mapOutcome(outcome) {
-  return outcome.kind === "delivered" ? deliveredResult(outcome) : paymentRequiredResult(outcome);
-}
-
 // src/protocols/mcp/tool-mapping.ts
 function isValidToolName(id) {
   return MCP_TOOL_NAME_PATTERN.test(id);
@@ -75,18 +47,25 @@ function isPaidResource(resource) {
 function primaryPaymentMethod(resource) {
   return resource.paymentMethods[0];
 }
+function proofCarriers(method) {
+  const field = `the "${PAYMENT_INPUT_FIELD}" argument`;
+  if (method === "x402") return `_meta["${X402_MCP_PAYMENT_META_KEY}"] or ${field}`;
+  if (method === "mpp") return `_meta["${MPP_MCP_CREDENTIAL_META_KEY}"] or ${field}`;
+  return field;
+}
 function paymentProofNote(resource) {
   const method = primaryPaymentMethod(resource);
-  const rail = method !== void 0 ? `a ${method}` : "a";
-  return `Requires ${rail} payment proof in the "${PAYMENT_INPUT_FIELD}" input field (obtained from a previous payment-required response).`;
+  const rail = method !== void 0 ? `an ${method}` : "a";
+  return `Requires ${rail} payment proof in ${proofCarriers(method)}, built from the payment-required response.`;
 }
+var OMIT_NOTE = "Omit it when the client sends the proof in _meta.";
 function paymentInputFieldDescription(resource) {
   const method = primaryPaymentMethod(resource);
   if (method === "x402") {
-    return "x402 payment proof (base64 PAYMENT-SIGNATURE value) returned from a previous payment-required response.";
+    return `x402 payment proof (base64 PAYMENT-SIGNATURE value) for a previous payment-required response. ${OMIT_NOTE}`;
   }
   if (method === "mpp") {
-    return 'MPP credential (the full "Authorization: Payment ..." value) for the challenge in a previous payment-required response.';
+    return `MPP credential (the full "Authorization: Payment ..." value) for the challenge in a previous payment-required response. ${OMIT_NOTE}`;
   }
   if (method !== void 0) {
     return `${method} payment proof (base64-encoded) returned from a previous payment-required response.`;
@@ -152,11 +131,92 @@ function buildInputSchema(resource) {
   };
 }
 
+// src/protocols/mcp/result-mapping.ts
+function toRecord(value) {
+  return value;
+}
+function deliveredResult(outcome) {
+  const body = outcome.body;
+  const text = typeof body === "string" ? body : JSON.stringify(body ?? null);
+  const payment = outcome.payment;
+  const receipt = payment?.provider === "mpp" ? receiptObject(payment.metadata?.["receipt"]) : void 0;
+  return {
+    content: [{ type: "text", text }],
+    ...isRecord(body) ? { structuredContent: body } : {},
+    _meta: {
+      [DELIVERY_SUMMARY_META_KEY]: toRecord(toDeliverySummary(outcome)),
+      ...payment?.provider === "x402" ? { [X402_MCP_PAYMENT_RESPONSE_META_KEY]: settlementResponse(payment) } : {},
+      ...receipt !== void 0 ? { [MPP_MCP_RECEIPT_META_KEY]: receipt } : {}
+    }
+  };
+}
+function structuredError(structured, sentence, meta) {
+  return {
+    isError: true,
+    content: [
+      { type: "text", text: JSON.stringify(structured) },
+      { type: "text", text: sentence }
+    ],
+    structuredContent: structured,
+    ...meta !== void 0 ? { _meta: meta } : {}
+  };
+}
+function withX402Challenge(envelope, challenge) {
+  return { ...challenge, ...envelope };
+}
+function paymentRequiredResult(outcome) {
+  const envelope = toPaymentRequiredEnvelope(outcome);
+  const p = envelope.payment;
+  const x402Required = p.provider === "x402" ? p.envelope : void 0;
+  const structured = x402Required !== void 0 ? withX402Challenge(toRecord(envelope), x402Required) : toRecord(envelope);
+  const mppRequired = p.provider === "mpp" ? mcpPaymentRequired(p.envelope) : void 0;
+  let meta;
+  if (x402Required !== void 0) meta = { [X402_MCP_ERROR_META_KEY]: x402Required };
+  else if (mppRequired !== void 0) meta = { [MPP_MCP_PAYMENT_REQUIRED_META_KEY]: mppRequired };
+  return structuredError(
+    structured,
+    `Payment required: ${p.amount} ${p.currency} to ${p.destination} for resource "${outcome.resourceId}". Retry with an ${p.provider} payment proof in ${proofCarriers(p.provider)}.`,
+    meta
+  );
+}
+function errorResult(error, rail) {
+  const envelope = toErrorEnvelope(error);
+  const details = error.details;
+  const challenge = details?.["challenge"];
+  const refused = error.httpStatus === 402 && isRecord(challenge);
+  const x402Required = rail === "x402" && refused ? { ...challenge, error: x402ErrorCode(error.code, details?.["reason"]) } : void 0;
+  const structured = x402Required !== void 0 ? withX402Challenge(toRecord(envelope), x402Required) : toRecord(envelope);
+  let meta;
+  if (rail === "x402") {
+    const settlement = error.code === "PAYMENT_SETTLEMENT_FAILED" ? settlementFailure(details) : settlementResponseFromDetails(details);
+    if (settlement !== void 0 || x402Required !== void 0) {
+      meta = {
+        ...x402Required !== void 0 ? { [X402_MCP_ERROR_META_KEY]: x402Required } : {},
+        ...settlement !== void 0 ? { [X402_MCP_PAYMENT_RESPONSE_META_KEY]: settlement } : {}
+      };
+    }
+  } else if (rail === "mpp" && refused) {
+    const required = mcpPaymentRequired(challenge, {
+      code: error.code,
+      reason: details?.["reason"],
+      detail: error.message
+    });
+    if (required !== void 0) meta = { [MPP_MCP_PAYMENT_REQUIRED_META_KEY]: required };
+  }
+  return structuredError(structured, `${envelope.code}: ${envelope.message}`, meta);
+}
+function mapOutcome(outcome) {
+  return outcome.kind === "delivered" ? deliveredResult(outcome) : paymentRequiredResult(outcome);
+}
+
 // src/protocols/mcp/adapter.ts
 var DEFAULT_MOUNT_PATH = "/mcp";
 var DEFAULT_SERVER_NAME = "agent-commerce";
 var MAX_CONCURRENT_TOOL_CALLS = 8;
+var MAX_REQUEST_BODY_BYTES = 256 * 1024;
 var MAX_QUEUED_TOOL_CALLS = 64;
+var MCP_BATCH_PROTOCOL_REVISION = "2025-03-26";
+var TOOLS_LIST_CACHE_HINT = { ttlMs: 6e4, cacheScope: "public" };
 var McpProtocolAdapter = class {
   name = "mcp";
   mountPath;
@@ -168,7 +228,7 @@ var McpProtocolAdapter = class {
   tools = [];
   toolsByResourceId = /* @__PURE__ */ new Map();
   skipped = [];
-  activeTransports = /* @__PURE__ */ new Set();
+  handler;
   // Counting semaphore on `pipeline.execute()`. It lives on the adapter, not
   // the request, so the cap holds across concurrent `/mcp` requests as well
   // as within one batch.
@@ -232,6 +292,14 @@ var McpProtocolAdapter = class {
     this.tools = tools;
     this.toolsByResourceId = toolsByResourceId;
     this.skipped = skipped;
+    this.handler = createMcpHandler(
+      (ctx) => this.buildServer(ctx.requestInfo?.signal ?? new AbortController().signal),
+      {
+        legacy: "stateless",
+        // Reporting only: a request the SDK rejects is already answered
+        onerror: (err) => context.logger.debug({ adapter: "mcp", err: toLogInfo(err) }, "mcp adapter: SDK error")
+      }
+    );
     this.started = true;
     context.logger.info(
       {
@@ -245,7 +313,7 @@ var McpProtocolAdapter = class {
   }
   async handleHttp(req, res) {
     try {
-      if (!this.started || !this.context) {
+      if (!this.started || !this.context || !this.handler) {
         this.writeJsonRpcError(res, 503, "MCP adapter is not running.");
         return;
       }
@@ -254,20 +322,39 @@ var McpProtocolAdapter = class {
         return;
       }
       const abortController = new AbortController();
-      const server = this.buildServer(abortController.signal);
-      const transport = new StreamableHTTPServerTransport();
-      this.activeTransports.add(transport);
-      const cleanup = () => {
-        abortController.abort();
-        this.activeTransports.delete(transport);
-        transport.close().catch(() => {
-        });
-        server.close().catch(() => {
-        });
-      };
-      res.once("close", cleanup);
-      await server.connect(transport);
-      await transport.handleRequest(req, res);
+      res.once("close", () => abortController.abort());
+      const read = await readCappedBody(req, MAX_REQUEST_BODY_BYTES);
+      if (read.kind === "too-large") {
+        this.writeJsonRpcError(
+          res,
+          413,
+          `Request body exceeds the ${MAX_REQUEST_BODY_BYTES}-byte limit.`
+        );
+        return;
+      }
+      if (read.kind !== "ok") {
+        this.writeJsonRpcError(res, 400, "Could not read the request body.");
+        return;
+      }
+      const body = parseJson(read.text);
+      const version = req.headers["mcp-protocol-version"];
+      if (Array.isArray(body) && version !== void 0 && version !== MCP_BATCH_PROTOCOL_REVISION) {
+        this.writeJsonRpcError(
+          res,
+          400,
+          `Invalid Request: JSON-RPC batches are supported only in MCP ${MCP_BATCH_PROTOCOL_REVISION}.`
+        );
+        return;
+      }
+      const malformed = isModernRequest(req) ? void 0 : malformedToolCall(body);
+      if (malformed !== void 0) {
+        this.writeJsonRpcError(res, 200, malformed.message, -32602, malformed.id);
+        return;
+      }
+      const response = await this.handler.fetch(
+        toWebRequest(req, read.text, abortController.signal)
+      );
+      await writeWebResponse(response, res);
     } catch (err) {
       this.context?.logger.error(
         { adapter: "mcp", err: toLogInfo(err) },
@@ -290,55 +377,60 @@ var McpProtocolAdapter = class {
   }
   async stop() {
     this.started = false;
-    const transports = [...this.activeTransports];
-    this.activeTransports.clear();
-    await Promise.all(
-      transports.map(async (transport) => {
-        try {
-          await transport.close();
-        } catch {
-        }
-      })
-    );
+    const handler = this.handler;
+    this.handler = void 0;
+    try {
+      await handler?.close();
+    } catch {
+    }
     this.context = void 0;
   }
-  writeJsonRpcError(res, status, message) {
+  // Use general JSON-RPC codes for transport errors
+  writeJsonRpcError(res, status, message, code = status >= 500 ? -32603 : -32600, id = null) {
     if (res.headersSent) return;
-    res.writeHead(status, { "content-type": "application/json" });
-    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32e3, message }, id: null }));
+    res.writeHead(status, {
+      "content-type": "application/json",
+      // RFC 9110 requires Allow on a 405, and this endpoint takes only POST
+      ...status === 405 ? { allow: "POST" } : {}
+    });
+    res.end(JSON.stringify({ jsonrpc: "2.0", error: { code, message }, id }));
   }
   buildServer(signal) {
     const server = new Server(
       { name: this.serverName, version: this.serverVersion },
-      { capabilities: { tools: {} } }
+      { capabilities: { tools: {} }, cacheHints: { "tools/list": TOOLS_LIST_CACHE_HINT } }
     );
-    server.setRequestHandler(ListToolsRequestSchema, async () => ({
-      tools: this.tools.map((t) => t.tool)
-    }));
+    server.setRequestHandler("tools/list", async (request) => {
+      if (request.params?.cursor !== void 0) {
+        throw new ProtocolError(ProtocolErrorCode.InvalidParams, "Invalid cursor.");
+      }
+      return { tools: this.tools.map((t) => t.tool) };
+    });
     server.setRequestHandler(
-      CallToolRequestSchema,
-      async (request) => this.handleToolCall(request.params.name, request.params.arguments ?? {}, signal)
+      "tools/call",
+      async (request) => this.handleToolCall(
+        request.params.name,
+        request.params.arguments ?? {},
+        request.params._meta,
+        signal
+      )
     );
     return server;
   }
-  async handleToolCall(resourceId, rawArgs, signal) {
+  async handleToolCall(resourceId, rawArgs, meta, signal) {
     const context = this.context;
     if (!context) {
       return errorResult(new CommerceError("INTERNAL_ERROR", "MCP adapter is not running."));
     }
+    const resource = this.toolsByResourceId.get(resourceId);
+    if (!resource) {
+      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown tool "${resourceId}".`);
+    }
     try {
-      const resource = this.toolsByResourceId.get(resourceId);
-      if (!resource) {
-        return errorResult(
-          new CommerceError("RESOURCE_NOT_FOUND", `Unknown tool "${resourceId}".`, { resourceId })
-        );
-      }
       const requestId = context.ids.next("mcp");
-      const { input, payment, authorization } = extractReservedInputFields(
-        rawArgs,
-        resource,
-        requestId
-      );
+      const fields = extractReservedInputFields(rawArgs, resource, requestId);
+      const { input, authorization } = fields;
+      const payment = paymentFromMeta(meta, resource) ?? fields.payment;
       const request = {
         requestId,
         resourceId,
@@ -369,7 +461,7 @@ var McpProtocolAdapter = class {
         { adapter: "mcp", resourceId, err: toLogInfo(error) },
         "mcp adapter: execution failed"
       );
-      return errorResult(error);
+      return errorResult(error, resource.paymentMethods[0]);
     }
   }
   /**
@@ -400,6 +492,67 @@ var McpProtocolAdapter = class {
     else this.inFlightToolCalls--;
   }
 };
+function toWebRequest(req, body, signal) {
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (value !== void 0) headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+  }
+  return new Request(new URL(req.url ?? "/", "http://localhost"), {
+    method: req.method ?? "POST",
+    headers,
+    body,
+    signal
+  });
+}
+function isModernRequest(req) {
+  if (req.headers["mcp-method"] !== void 0) return true;
+  const version = req.headers["mcp-protocol-version"];
+  return typeof version === "string" && version >= MCP_MODERN_PROTOCOL_REVISION;
+}
+function parseJson(body) {
+  try {
+    return JSON.parse(body);
+  } catch {
+    return void 0;
+  }
+}
+function malformedToolCall(message) {
+  if (!isRecord(message) || message["method"] !== "tools/call") return void 0;
+  const id = message["id"];
+  if (typeof id !== "string" && typeof id !== "number") return void 0;
+  const params = message["params"];
+  let problem;
+  if (!isRecord(params)) problem = "params must be an object";
+  else if (typeof params["name"] !== "string") problem = '"name" must be a string';
+  else if (params["arguments"] !== void 0 && !isRecord(params["arguments"])) {
+    problem = '"arguments" must be an object';
+  } else if (params["_meta"] !== void 0 && !isRecord(params["_meta"])) {
+    problem = '"_meta" must be an object';
+  }
+  return problem === void 0 ? void 0 : { id, message: `Invalid tools/call params: ${problem}.` };
+}
+async function writeWebResponse(response, res) {
+  res.writeHead(response.status, Object.fromEntries(response.headers));
+  if (response.body !== null) {
+    for await (const chunk of response.body) {
+      if (res.destroyed) break;
+      res.write(chunk);
+    }
+  }
+  res.end();
+}
+function paymentFromMeta(meta, resource) {
+  const method = resource.paymentMethods[0];
+  if (method === "x402") {
+    const payload = x402McpPaymentSubmission(meta?.[X402_MCP_PAYMENT_META_KEY]);
+    if (payload !== void 0) return { method, payload };
+  }
+  const credential = meta?.[MPP_MCP_CREDENTIAL_META_KEY];
+  if (method === "mpp" && isRecord(credential)) {
+    return { method, payload: JSON.stringify(credential) };
+  }
+  return void 0;
+}
 function createMcpAdapter(options) {
   return new McpProtocolAdapter(options);
 }