@devlab.group/agent-commerce 2.0.0 → 2.2.0

package/dist/cli/mcp-CNWQ2MOE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/protocols/mcp/descriptor.ts","../../src/protocols/mcp/tool-mapping.ts","../../src/protocols/mcp/result-mapping.ts","../../src/protocols/mcp/adapter.ts"],"names":[],"mappings":";;;;;;;;AAUA,IAAM,kBAAA,GAAqB,CAAA,EAAG,4BAA4B,CAAA,EAAA,EAAK,uBAAuB,CAAA,CAAA;AAGtF,IAAM,gBAAA,GAAsC,CAAC,YAAA,EAAc,YAAY,CAAA;AAUhE,IAAM,eAAA,GAAqC;AAAA,EAChD,WAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,OAAA;AAAA,EACA,SAAA;AAAA,EACA,kCAAA;AAAA,EACA,OAAA;AAAA,EACA,0BAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA,EACA,YAAA;AAAA,EACA,oBAAA;AAAA;AAAA,EAEA,+CAAA;AAAA,EACA;AACF,CAAA;AAEO,SAAS,gBAAgB,qBAAA,EAAkD;AAChF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA;AAAA,IACN,IAAA,EAAM,UAAA;AAAA,IACN,qBAAA;AAAA,IACA,aAAA,EAAe,kBAAA;AAAA,IACf,YAAA,EAAc,gBAAA;AAAA,IACd,MAAA,EAAQ,QAAA;AAAA,IACR,WAAA,EAAa;AAAA,GACf;AACF;;;ACnCO,SAAS,gBAAgB,EAAA,EAAqB;AACnD,EAAA,OAAO,qBAAA,CAAsB,KAAK,EAAE,CAAA;AACtC;AAEA,SAAS,eAAe,QAAA,EAAqC;AAC3D,EAAA,OAAO,QAAA,CAAS,QAAQ,IAAA,KAAS,MAAA;AACnC;AAIA,SAAS,qBAAqB,QAAA,EAA2D;AACvF,EAAA,OAAO,QAAA,CAAS,eAAe,CAAC,CAAA;AAClC;AAGO,SAAS,cAAc,MAAA,EAA+C;AAC3E,EAAA,MAAM,KAAA,GAAQ,QAAQ,mBAAmB,CAAA,UAAA,CAAA;AACzC,EAAA,IAAI,WAAW,MAAA,EAAQ,OAAO,CAAA,OAAA,EAAU,yBAAyB,SAAS,KAAK,CAAA,CAAA;AAC/E,EAAA,IAAI,WAAW,KAAA,EAAO,OAAO,CAAA,OAAA,EAAU,2BAA2B,SAAS,KAAK,CAAA,CAAA;AAChF,EAAA,OAAO,KAAA;AACT;AAGA,SAAS,iBAAiB,QAAA,EAAoC;AAC5D,EAAA,MAAM,MAAA,GAAS,qBAAqB,QAAQ,CAAA;AAC5C,EAAA,MAAM,IAAA,GAAO,MAAA,KAAW,MAAA,GAAY,CAAA,GAAA,EAAM,MAAM,CAAA,CAAA,GAAK,GAAA;AACrD,EAAA,OAAO,CAAA,SAAA,EAAY,IAAI,CAAA,kBAAA,EAAqB,aAAA,CAAc,MAAM,CAAC,CAAA,2CAAA,CAAA;AACnE;AAGA,IAAM,SAAA,GAAY,mDAAA;AAMlB,SAAS,6BAA6B,QAAA,EAAoC;AACxE,EAAA,MAAM,MAAA,GAAS,qBAAqB,QAAQ,CAAA;AAC5C,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,iGAAiG,SAAS,CAAA,CAAA;AAAA,EACnH;AACA,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAO,2HAA2H,SAAS,CAAA,CAAA;AAAA,EAC7I;AACA,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO,GAAG,MAAM,CAAA,mFAAA,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,mEAAA;AACT;AAGA,SAAS,sBAAsB,QAAA,EAA+C;AAC5E,EAAA,OAAO,QAAA,CAAS,aAAA,EAAe,QAAA,IAAY,EAAC;AAC9C;AAEA,SAAS,kBAAkB,QAAA,EAAoC;AAC7D,EAAA,MAAM,OAAA,GAAU,sBAAsB,QAAQ,CAAA;AAC9C,EAAA,OAAO,OAAA,CAAQ,MAAA,GAAS,CAAA,GACpB,CAAA,eAAA,EAAkB,OAAA,CAAQ,KAAK,OAAO,CAAC,CAAA,uBAAA,EAA0B,yBAAyB,CAAA,cAAA,CAAA,GAC1F,EAAA;AACN;AAMO,SAAS,qBAAqB,QAAA,EAAoC;AACvE,EAAA,MAAM,IAAA,GAAO,QAAA,CAAS,WAAA,IAAe,QAAA,CAAS,IAAA;AAC9C,EAAA,QAAQ,QAAA,CAAS,QAAQ,IAAA;AAAM,IAC7B,KAAK,MAAA;AACH,MAAA,OAAO,IAAA;AAAA,IACT,KAAK,OAAA,EAAS;AACZ,MAAA,MAAM,EAAE,MAAA,EAAQ,QAAA,EAAS,GAAI,QAAA,CAAS,OAAA;AACtC,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,EAAI,QAAQ,CAAA,WAAA,EAAc,gBAAA,CAAiB,QAAQ,CAAC,CAAA,EAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA,CAAA;AAAA,IAClH;AAAA,IACA,KAAK,SAAA;AACH,MAAA,OAAO,CAAA,EAAG,IAAI,CAAA,uDAAA,EAA0D,gBAAA,CAAiB,QAAQ,CAAC,CAAA,EAAG,iBAAA,CAAkB,QAAQ,CAAC,CAAA,CAAA;AAAA;AAEtI;AAaO,SAAS,iBAAiB,QAAA,EAAiD;AAChF,EAAA,MAAM,OAAO,QAAA,CAAS,WAAA;AACtB,EAAA,MAAM,YAAA,GAAe,SAAS,IAAI,CAAA;AAGlC,EAAA,MAAM,mBAAA,GACJ,YAAA,IAAgB,QAAA,CAAS,IAAA,CAAK,UAAU,IACpC,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,UAAU,CAAA,CAAE,MAAA;AAAA,IAAO,CAAC,KAAA,KACtC,QAAA,CAAS,KAAA,CAAM,CAAC,CAAC;AAAA,MAEnB,EAAC;AACP,EAAA,MAAM,UAAA,GAAyC,MAAA,CAAO,WAAA,CAAY,mBAAmB,CAAA;AAIrF,EAAA,IAAI,cAAA,CAAe,QAAQ,CAAA,EAAG;AAC5B,IAAA,UAAA,CAAW,mBAAmB,CAAA,GAAI;AAAA,MAChC,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EAAa,6BAA6B,QAAQ;AAAA,KACpD;AAAA,EACF;AACA,EAAA,MAAM,OAAA,GAAU,sBAAsB,QAAQ,CAAA;AAC9C,EAAA,IAAI,OAAA,CAAQ,SAAS,CAAA,EAAG;AACtB,IAAA,UAAA,CAAW,yBAAyB,CAAA,GAAI;AAAA,MACtC,IAAA,EAAM,QAAA;AAAA,MACN,WAAA,EACE,mGAAA;AAAA,MACF,UAAA,EAAY;AAAA,QACV,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,MAAM,CAAC,GAAG,OAAO,CAAA,EAAE;AAAA,QAC7C,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,WAAW,CAAA;AAAE,OAC1C;AAAA,MACA,QAAA,EAAU,CAAC,QAAA,EAAU,SAAS;AAAA,KAChC;AAAA,EACF;AAEA,EAAA,MAAM,WACJ,YAAA,IAAgB,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,GACvC,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAmB,OAAO,CAAA,KAAM,QAAQ,IAC9D,EAAC;AAEP,EAAA,MAAM,KAAA,GAAQ,eACV,MAAA,CAAO,WAAA;AAAA,IACL,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA,CAAE,MAAA;AAAA,MACnB,CAAC,CAAC,GAAG,CAAA,KAAM,QAAQ,MAAA,IAAU,GAAA,KAAQ,gBAAgB,GAAA,KAAQ;AAAA;AAC/D,MAEF,EAAC;AAEL,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,IAAA,EAAM,QAAA;AAAA,IACN,UAAA;AAAA,IACA,GAAI,QAAA,CAAS,MAAA,GAAS,IAAI,EAAE,QAAA,KAAa;AAAC,GAC5C;AACF;;;AChIA,SAAS,SAAS,KAAA,EAAwC;AACxD,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,gBAAgB,OAAA,EAA2C;AAClE,EAAA,MAAM,OAAO,OAAA,CAAQ,IAAA;AACrB,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,KAAS,QAAA,GAAW,OAAO,IAAA,CAAK,SAAA,CAAU,QAAQ,IAAI,CAAA;AAC1E,EAAA,MAAM,UAAU,OAAA,CAAQ,OAAA;AACxB,EAAA,MAAM,OAAA,GACJ,SAAS,QAAA,KAAa,KAAA,GAAQ,cAAc,OAAA,CAAQ,QAAA,GAAW,SAAS,CAAC,CAAA,GAAI,MAAA;AAC/E,EAAA,OAAO;AAAA,IACL,SAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA;AAAA,IAChC,GAAI,SAAS,IAAI,CAAA,GAAI,EAAE,iBAAA,EAAmB,IAAA,KAAS,EAAC;AAAA,IACpD,KAAA,EAAO;AAAA,MACL,CAAC,yBAAyB,GAAG,QAAA,CAAS,iBAAA,CAAkB,OAAO,CAAC,CAAA;AAAA,MAChE,GAAI,OAAA,EAAS,QAAA,KAAa,MAAA,GACtB,EAAE,CAAC,kCAAkC,GAAG,kBAAA,CAAmB,OAAO,CAAA,EAAE,GACpE,EAAC;AAAA,MACL,GAAI,YAAY,MAAA,GAAY,EAAE,CAAC,wBAAwB,GAAG,OAAA,EAAQ,GAAI;AAAC;AACzE,GACF;AACF;AAIA,SAAS,eAAA,CACP,UAAA,EACA,QAAA,EACA,IAAA,EACgB;AAChB,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,UAAU,CAAA,EAAE;AAAA,MACjD,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,QAAA;AAAS,KACjC;AAAA,IACA,iBAAA,EAAmB,UAAA;AAAA,IACnB,GAAI,IAAA,KAAS,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,KAAS;AAAC,GAC9C;AACF;AAIA,SAAS,iBAAA,CACP,UACA,SAAA,EACyB;AACzB,EAAA,OAAO,EAAE,GAAG,SAAA,EAAW,GAAG,QAAA,EAAS;AACrC;AAEA,SAAS,sBAAsB,OAAA,EAAiD;AAC9E,EAAA,MAAM,QAAA,GAAW,0BAA0B,OAAO,CAAA;AAClD,EAAA,MAAM,IAAI,QAAA,CAAS,OAAA;AACnB,EAAA,MAAM,YAAA,GAAe,CAAA,CAAE,QAAA,KAAa,MAAA,GAAS,EAAE,QAAA,GAAW,MAAA;AAC1D,EAAA,MAAM,UAAA,GACJ,YAAA,KAAiB,MAAA,GACb,iBAAA,CAAkB,QAAA,CAAS,QAAQ,CAAA,EAAG,YAAY,CAAA,GAClD,QAAA,CAAS,QAAQ,CAAA;AACvB,EAAA,MAAM,cAAc,CAAA,CAAE,QAAA,KAAa,QAAQ,kBAAA,CAAmB,CAAA,CAAE,QAAQ,CAAA,GAAI,MAAA;AAC5E,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,iBAAiB,MAAA,EAAW,IAAA,GAAO,EAAE,CAAC,uBAAuB,GAAG,YAAA,EAAa;AAAA,OAAA,IACxE,gBAAgB,MAAA,EAAW,IAAA,GAAO,EAAE,CAAC,iCAAiC,GAAG,WAAA,EAAY;AAC9F,EAAA,OAAO,eAAA;AAAA,IACL,UAAA;AAAA;AAAA,IAEA,CAAA,kBAAA,EAAqB,CAAA,CAAE,MAAM,CAAA,CAAA,EAAI,CAAA,CAAE,QAAQ,CAAA,EAAG,CAAA,CAAE,WAAA,KAAgB,MAAA,GAAY,CAAA,IAAA,EAAO,CAAA,CAAE,WAAW,CAAA,CAAA,GAAK,EAAE,CAAA,eAAA,EAAkB,OAAA,CAAQ,UAAU,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,kBAAA,EAAqB,aAAA,CAAc,CAAA,CAAE,QAAQ,CAAC,CAAA,CAAA,CAAA;AAAA,IACvN;AAAA,GACF;AACF;AAGO,SAAS,WAAA,CAAY,OAAsB,IAAA,EAA0C;AAC1F,EAAA,MAAM,QAAA,GAAW,gBAAgB,KAAK,CAAA;AACtC,EAAA,MAAM,UAAU,KAAA,CAAM,OAAA;AACtB,EAAA,MAAM,SAAA,GAAY,UAAU,WAAW,CAAA;AAEvC,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,UAAA,KAAe,GAAA,IAAO,SAAS,SAAS,CAAA;AAC9D,EAAA,MAAM,YAAA,GACJ,IAAA,KAAS,MAAA,IAAU,OAAA,GACf;AAAA,IACE,GAAG,SAAA;AAAA,IACH,KAAA,EAAO,cAAc,KAAA,CAAM,IAAA,EAAM,UAAU,QAAQ,CAAA,EAAG,OAAA,GAAU,SAAS,CAAC;AAAA,GAC5E,GACA,MAAA;AACN,EAAA,MAAM,UAAA,GACJ,YAAA,KAAiB,MAAA,GACb,iBAAA,CAAkB,QAAA,CAAS,QAAQ,CAAA,EAAG,YAAY,CAAA,GAClD,QAAA,CAAS,QAAQ,CAAA;AACvB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,MAAM,UAAA,GACJ,MAAM,IAAA,KAAS,2BAAA,GACX,kBAAkB,OAAO,CAAA,GACzB,8BAA8B,OAAO,CAAA;AAC3C,IAAA,IAAI,UAAA,KAAe,MAAA,IAAa,YAAA,KAAiB,MAAA,EAAW;AAC1D,MAAA,IAAA,GAAO;AAAA,QACL,GAAI,iBAAiB,MAAA,GAAY,EAAE,CAAC,uBAAuB,GAAG,YAAA,EAAa,GAAI,EAAC;AAAA,QAChF,GAAI,eAAe,MAAA,GAAY,EAAE,CAAC,kCAAkC,GAAG,UAAA,EAAW,GAAI;AAAC,OACzF;AAAA,IACF;AAAA,EACF,CAAA,MAAA,IAAW,IAAA,KAAS,KAAA,IAAS,OAAA,EAAS;AAEpC,IAAA,MAAM,QAAA,GAAW,mBAAmB,SAAA,EAAW;AAAA,MAC7C,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,MAAA,EAAQ,UAAU,QAAQ,CAAA;AAAA,MAC1B,QAAQ,KAAA,CAAM;AAAA,KACf,CAAA;AACD,IAAA,IAAI,aAAa,MAAA,EAAW,IAAA,GAAO,EAAE,CAAC,iCAAiC,GAAG,QAAA,EAAS;AAAA,EACrF;AACA,EAAA,OAAO,eAAA,CAAgB,YAAY,CAAA,EAAG,QAAA,CAAS,IAAI,CAAA,EAAA,EAAK,QAAA,CAAS,OAAO,CAAA,CAAA,EAAI,IAAI,CAAA;AAClF;AAEO,SAAS,WAAW,OAAA,EAA2C;AACpE,EAAA,OAAO,QAAQ,IAAA,KAAS,WAAA,GAAc,gBAAgB,OAAO,CAAA,GAAI,sBAAsB,OAAO,CAAA;AAChG;;;ACxEA,IAAM,kBAAA,GAAqB,MAAA;AAC3B,IAAM,mBAAA,GAAsB,gBAAA;AAO5B,IAAM,yBAAA,GAA4B,CAAA;AAIlC,IAAM,yBAAyB,GAAA,GAAM,IAAA;AAQrC,IAAM,qBAAA,GAAwB,EAAA;AAG9B,IAAM,2BAAA,GAA8B,YAAA;AAGpC,IAAM,qBAAA,GAAwB,EAAE,KAAA,EAAO,GAAA,EAAQ,YAAY,QAAA,EAAS;AAEpE,IAAM,qBAAN,MAAwD;AAAA,EAC7C,IAAA,GAAO,KAAA;AAAA,EACP,SAAA;AAAA,EACA,UAAA;AAAA,EAEQ,UAAA;AAAA,EACA,aAAA;AAAA,EAET,OAAA;AAAA,EACA,OAAA,GAAU,KAAA;AAAA,EACV,QAAmC,EAAC;AAAA,EACpC,iBAAA,uBAA+D,GAAA,EAAI;AAAA,EACnE,UAAsC,EAAC;AAAA,EACvC,OAAA;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAA,GAAoB,CAAA;AAAA,EACX,kBAAqC,EAAC;AAAA,EAEvD,WAAA,CAAY,OAAA,GAA6B,EAAC,EAAG;AAC3C,IAAA,IAAA,CAAK,SAAA,GAAY,QAAQ,SAAA,IAAa,kBAAA;AACtC,IAAA,IAAA,CAAK,UAAA,GAAa,QAAQ,UAAA,IAAc,mBAAA;AACxC,IAAA,IAAA,CAAK,aAAA,GAAgB,QAAQ,aAAA,IAAiB,eAAA;AAC9C,IAAA,IAAA,CAAK,UAAA,GAAa,gBAAgB,eAAe,CAAA;AAAA,EACnD;AAAA,EAEA,MAAM,MAAM,OAAA,EAAgD;AAC1D,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AAEf,IAAA,IAAI,YAAyC,EAAC;AAC9C,IAAA,IAAI;AACF,MAAA,SAAA,GAAY,OAAA,CAAQ,SAAA,CAAU,cAAA,CAAe,KAAK,CAAA;AAAA,IACpD,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAA;AAAA,QACb,EAAE,GAAA,EAAK,SAAA,CAAU,GAAG,CAAA,EAAE;AAAA,QACtB;AAAA,OACF;AACA,MAAA,SAAA,GAAY,EAAC;AAAA,IACf;AAEA,IAAA,MAAM,QAA0B,EAAC;AACjC,IAAA,MAAM,iBAAA,uBAAwB,GAAA,EAA8B;AAC5D,IAAA,MAAM,UAA6B,EAAC;AAEpC,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,IAAI;AACF,QAAA,IAAI,CAAC,eAAA,CAAgB,QAAA,CAAS,EAAE,CAAA,EAAG;AACjC,UAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,YACX,IAAI,QAAA,CAAS,EAAA;AAAA,YACb,MAAA,EAAQ,CAAA,qDAAA,EAAwD,qBAAA,CAAsB,MAAM,CAAA,CAAA;AAAA,WAC7F,CAAA;AACD,UAAA;AAAA,QACF;AACA,QAAA,IAAI,iBAAA,CAAkB,GAAA,CAAI,QAAA,CAAS,EAAE,CAAA,EAAG;AACtC,UAAA,OAAA,CAAQ,KAAK,EAAE,EAAA,EAAI,SAAS,EAAA,EAAI,MAAA,EAAQ,uBAAuB,CAAA;AAC/D,UAAA;AAAA,QACF;AACA,QAAA,MAAM,IAAA,GAAa;AAAA,UACjB,MAAM,QAAA,CAAS,EAAA;AAAA,UACf,WAAA,EAAa,qBAAqB,QAAQ,CAAA;AAAA,UAC1C,WAAA,EAAa,iBAAiB,QAAQ;AAAA,SACxC;AACA,QAAA,KAAA,CAAM,IAAA,CAAK,EAAE,QAAA,EAAU,IAAA,EAAM,CAAA;AAC7B,QAAA,iBAAA,CAAkB,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AAAA,MAC7C,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,IAAA,CAAK;AAAA,UACX,IAAI,QAAA,CAAS,EAAA;AAAA,UACb,MAAA,EAAQ,CAAA,0BAAA,EAA6B,eAAA,CAAgB,GAAG,EAAE,OAAO,CAAA;AAAA,SAClE,CAAA;AAAA,MACH;AAAA,IACF;AAEA,IAAA,KAAA,MAAW,KAAK,OAAA,EAAS;AACvB,MAAA,OAAA,CAAQ,MAAA,CAAO,IAAA,CAAK,EAAE,UAAA,EAAY,CAAA,CAAE,IAAI,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,EAAG,+BAA+B,CAAA;AAAA,IAC7F;AAEA,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AACb,IAAA,IAAA,CAAK,iBAAA,GAAoB,iBAAA;AACzB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AAEf,IAAA,IAAA,CAAK,OAAA,GAAU,gBAAA;AAAA,MACb,CAAC,GAAA,KAAQ,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,aAAa,MAAA,IAAU,IAAI,eAAA,EAAgB,CAAE,MAAM,CAAA;AAAA,MACjF;AAAA,QACE,MAAA,EAAQ,WAAA;AAAA;AAAA,QAER,OAAA,EAAS,CAAC,GAAA,KAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,EAAE,GAAA,EAAK,SAAA,CAAU,GAAG,CAAA,EAAE,EAAG,wBAAwB;AAAA;AAC1F,KACF;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA;AAEf,IAAA,OAAA,CAAQ,MAAA,CAAO,IAAA;AAAA,MACb;AAAA,QACE,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,WAAW,KAAA,CAAM,MAAA;AAAA,QACjB,cAAc,OAAA,CAAQ;AAAA,OACxB;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAAA,EAEA,MAAM,UAAA,CAAW,GAAA,EAAsB,GAAA,EAAoC;AACzE,IAAA,IAAI;AACF,MAAA,IAAI,CAAC,KAAK,OAAA,IAAW,CAAC,KAAK,OAAA,IAAW,CAAC,KAAK,OAAA,EAAS;AACnD,QAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,6BAA6B,CAAA;AAC9D,QAAA;AAAA,MACF;AACA,MAAA,IAAI,GAAA,CAAI,WAAW,MAAA,EAAQ;AACzB,QAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,sDAAsD,CAAA;AACvF,QAAA;AAAA,MACF;AAKA,MAAA,MAAM,eAAA,GAAkB,IAAI,eAAA,EAAgB;AAC5C,MAAA,GAAA,CAAI,IAAA,CAAK,OAAA,EAAS,MAAM,eAAA,CAAgB,OAAO,CAAA;AAC/C,MAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,sBAAsB,CAAA;AAC7D,MAAA,IAAI,IAAA,CAAK,SAAS,WAAA,EAAa;AAC7B,QAAA,IAAA,CAAK,iBAAA;AAAA,UACH,GAAA;AAAA,UACA,GAAA;AAAA,UACA,4BAA4B,sBAAsB,CAAA,YAAA;AAAA,SACpD;AACA,QAAA;AAAA,MACF;AACA,MAAA,IAAI,IAAA,CAAK,SAAS,IAAA,EAAM;AACtB,QAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,kCAAkC,CAAA;AACnE,QAAA;AAAA,MACF;AACA,MAAA,MAAM,IAAA,GAAO,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA;AAChC,MAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAClD,MAAA,IAAI,MAAM,OAAA,CAAQ,IAAI,KAAK,OAAA,KAAY,KAAA,CAAA,IAAa,YAAY,2BAAA,EAA6B;AAC3F,QAAA,IAAA,CAAK,iBAAA;AAAA,UACH,GAAA;AAAA,UACA,GAAA;AAAA,UACA,+DAA+D,2BAA2B,CAAA,CAAA;AAAA,SAC5F;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,YAAY,eAAA,CAAgB,GAAG,CAAA,GAAI,KAAA,CAAA,GAAY,kBAAkB,IAAI,CAAA;AAC3E,MAAA,IAAI,cAAc,KAAA,CAAA,EAAW;AAC3B,QAAA,IAAA,CAAK,kBAAkB,GAAA,EAAK,GAAA,EAAK,UAAU,OAAA,EAAS,CAAA,KAAA,EAAQ,UAAU,EAAE,CAAA;AACxE,QAAA;AAAA,MACF;AACA,MAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,KAAA;AAAA,QAClC,YAAA,CAAa,GAAA,EAAK,IAAA,CAAK,IAAA,EAAM,gBAAgB,MAAM;AAAA,OACrD;AACA,MAAA,MAAM,gBAAA,CAAiB,UAAU,GAAG,CAAA;AAAA,IACtC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,OAAA,EAAS,OAAO,KAAA,CAAM,EAAE,KAAK,SAAA,CAAU,GAAG,CAAA,EAAE,EAAG,sCAAsC,CAAA;AAC1F,MAAA,IAAA,CAAK,iBAAA,CAAkB,GAAA,EAAK,GAAA,EAAK,wBAAwB,CAAA;AAAA,IAC3D;AAAA,EACF;AAAA,EAEA,MAAM,MAAA,GAAiC;AACrC,IAAA,MAAM,SAAA,GAAY,KAAK,OAAA,EAAS,KAAA,CAAM,QAAO,IAAA,iBAAK,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AACzE,IAAA,IAAI,CAAC,IAAA,CAAK,OAAA,IAAW,CAAC,KAAK,OAAA,EAAS;AAClC,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,qCAAqC,SAAA,EAAU;AAAA,IAClF;AACA,IAAA,MAAM,SAAA,GAAY,KAAK,KAAA,CAAM,MAAA;AAC7B,IAAA,IAAI,IAAA,CAAK,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG;AAC3B,MAAA,MAAM,MAAA,GAAS,GAAG,SAAS,CAAA,qBAAA,EAAwB,KAAK,OAAA,CAAQ,MAAM,CAAA,sBAAA,EAAyB,IAAA,CAAK,OAAA,CACjG,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,EAAG,CAAA,CAAE,EAAE,CAAA,EAAA,EAAK,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA,CAClC,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACb,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,EAAQ,SAAA,EAAU;AAAA,IAC7C;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,QAAQ,CAAA,EAAG,SAAS,wBAAwB,SAAA,EAAU;AAAA,EACjF;AAAA,EAEA,MAAM,IAAA,GAAsB;AAC1B,IAAA,IAAA,CAAK,OAAA,GAAU,KAAA;AACf,IAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,KAAA,EAAM;AAAA,IACvB,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGQ,iBAAA,CACN,GAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,GAAO,UAAU,GAAA,GAAM,MAAA,GAAS,MAAA,EAChC,EAAA,GAA6B,IAAA,EACvB;AACN,IAAA,IAAI,IAAI,WAAA,EAAa;AACrB,IAAA,GAAA,CAAI,UAAU,MAAA,EAAQ;AAAA,MACpB,cAAA,EAAgB,kBAAA;AAAA;AAAA,MAEhB,GAAI,MAAA,KAAW,GAAA,GAAM,EAAE,KAAA,EAAO,MAAA,KAAW;AAAC,KAC3C,CAAA;AACD,IAAA,GAAA,CAAI,GAAA,CAAI,IAAA,CAAK,SAAA,CAAU,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,EAAA,EAAI,CAAC,CAAA;AAAA,EAC1E;AAAA,EAEQ,YAAY,MAAA,EAA6B;AAC/C,IAAA,MAAM,SAAS,IAAI,MAAA;AAAA,MACjB,EAAE,IAAA,EAAM,IAAA,CAAK,UAAA,EAAY,OAAA,EAAS,KAAK,aAAA,EAAc;AAAA,MACrD,EAAE,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE,EAAG,UAAA,EAAY,EAAE,YAAA,EAAc,qBAAA,EAAsB;AAAE,KACrF;AACA,IAAA,MAAA,CAAO,iBAAA,CAAkB,YAAA,EAAc,OAAO,OAAA,KAAY;AAExD,MAAA,IAAI,OAAA,CAAQ,MAAA,EAAQ,MAAA,KAAW,MAAA,EAAW;AACxC,QAAA,MAAM,IAAI,aAAA,CAAc,iBAAA,CAAkB,aAAA,EAAe,iBAAiB,CAAA;AAAA,MAC5E;AACA,MAAA,OAAO,EAAE,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,EAAE;AAAA,IAChD,CAAC,CAAA;AACD,IAAA,MAAA,CAAO,iBAAA;AAAA,MAAkB,YAAA;AAAA,MAAc,OAAO,YAC5C,IAAA,CAAK,cAAA;AAAA,QACH,QAAQ,MAAA,CAAO,IAAA;AAAA,QACf,OAAA,CAAQ,MAAA,CAAO,SAAA,IAAa,EAAC;AAAA,QAC7B,QAAQ,MAAA,CAAO,KAAA;AAAA,QACf;AAAA;AACF,KACF;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,cAAA,CACZ,UAAA,EACA,OAAA,EACA,MACA,MAAA,EACyB;AACzB,IAAA,MAAM,UAAU,IAAA,CAAK,OAAA;AACrB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,WAAA,CAAY,IAAI,aAAA,CAAc,gBAAA,EAAkB,6BAA6B,CAAC,CAAA;AAAA,IACvF;AAGA,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,iBAAA,CAAkB,GAAA,CAAI,UAAU,CAAA;AACtD,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,aAAA,CAAc,iBAAA,CAAkB,aAAA,EAAe,CAAA,cAAA,EAAiB,UAAU,CAAA,EAAA,CAAI,CAAA;AAAA,IAC1F;AACA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,IAAA,CAAK,KAAK,CAAA;AACxC,MAAA,MAAM,MAAA,GAAS,0BAAA,CAA2B,OAAA,EAAS,QAAA,EAAU,SAAS,CAAA;AACtE,MAAA,MAAM,EAAE,KAAA,EAAO,aAAA,EAAc,GAAI,MAAA;AAGjC,MAAA,MAAM,OAAA,GAAU,eAAA,CAAgB,IAAA,EAAM,QAAQ,KAAK,MAAA,CAAO,OAAA;AAC1D,MAAA,MAAM,OAAA,GAA4B;AAAA,QAChC,SAAA;AAAA,QACA,UAAA;AAAA,QACA,KAAA;AAAA,QACA,QAAA,EAAU,KAAA;AAAA,QACV,UAAA,EAAY,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAO;AAAA,QACjC,GAAI,OAAA,KAAY,KAAA,CAAA,GAAY,EAAE,OAAA,KAAY,EAAC;AAAA,QAC3C,GAAI,aAAA,KAAkB,KAAA,CAAA,GAAY,EAAE,aAAA,KAAkB;AAAC,OACzD;AACA,MAAA,MAAM,IAAA,CAAK,oBAAoB,MAAM,CAAA;AACrC,MAAA,IAAI;AAIF,QAAA,IAAI,OAAO,OAAA,EAAS;AAIlB,UAAA,OAAO,WAAA;AAAA,YACL,IAAI,aAAA;AAAA,cACF,sBAAA;AAAA,cACA;AAAA;AACF,WACF;AAAA,QACF;AACA,QAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,QAAA,CAAS,QAAQ,OAAO,CAAA;AACtD,QAAA,OAAO,WAAW,OAAO,CAAA;AAAA,MAC3B,CAAA,SAAE;AAGA,QAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,MAC3B;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,KAAA,GAAQ,gBAAgB,GAAG,CAAA;AACjC,MAAA,OAAA,CAAQ,MAAA,CAAO,KAAK,EAAE,UAAA,EAAY,KAAK,SAAA,CAAU,KAAK,CAAA,EAAE,EAAG,+BAA+B,CAAA;AAC1F,MAAA,OAAO,WAAA,CAAY,KAAA,EAAO,QAAA,CAAS,cAAA,CAAe,CAAC,CAAC,CAAA;AAAA,IACtD;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,oBAAoB,MAAA,EAAoC;AACpE,IAAA,IAAI,IAAA,CAAK,oBAAoB,yBAAA,EAA2B;AACtD,MAAA,IAAA,CAAK,iBAAA,EAAA;AACL,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,eAAA,CAAgB,MAAA,IAAU,qBAAA,EAAuB;AAGxD,MAAA,MAAM,IAAI,aAAA;AAAA,QACR,cAAA;AAAA,QACA;AAAA,OACF;AAAA,IACF;AAGA,IAAA,MAAM,IAAI,QAAc,CAAC,OAAA,KAAY,KAAK,eAAA,CAAgB,IAAA,CAAK,OAAO,CAAC,CAAA;AACvE,IAAA,IAAI,OAAO,OAAA,EAAS;AAElB,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAEzB,MAAA,MAAM,IAAI,aAAA,CAAc,sBAAA,EAAwB,mCAAmC,CAAA;AAAA,IACrF;AAAA,EACF;AAAA,EAEQ,mBAAA,GAA4B;AAClC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,eAAA,CAAgB,KAAA,EAAM;AAExC,IAAA,IAAI,IAAA,KAAS,QAAW,IAAA,EAAK;AAAA,SACxB,IAAA,CAAK,iBAAA,EAAA;AAAA,EACZ;AACF,CAAA;AAIA,SAAS,YAAA,CAAa,GAAA,EAAsB,IAAA,EAAc,MAAA,EAA8B;AACtF,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,EAAQ;AAC5B,EAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AACvD,IAAA,IAAI,KAAA,KAAU,MAAA,EAAW,OAAA,CAAQ,GAAA,CAAI,IAAA,EAAM,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,IAAA,CAAK,IAAI,IAAI,KAAK,CAAA;AAAA,EAC5F;AACA,EAAA,OAAO,IAAI,QAAQ,IAAI,GAAA,CAAI,IAAI,GAAA,IAAO,GAAA,EAAK,kBAAkB,CAAA,EAAG;AAAA,IAC9D,MAAA,EAAQ,IAAI,MAAA,IAAU,MAAA;AAAA,IACtB,OAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAMA,SAAS,gBAAgB,GAAA,EAA+B;AACtD,EAAA,IAAI,GAAA,CAAI,OAAA,CAAQ,YAAY,CAAA,KAAM,QAAW,OAAO,IAAA;AACpD,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,sBAAsB,CAAA;AAElD,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,IAAW,4BAAA;AACnD;AAGA,SAAS,UAAU,IAAA,EAAuB;AACxC,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,SAAS,kBAAkB,OAAA,EAAwE;AACjG,EAAA,IAAI,CAAC,SAAS,OAAO,CAAA,IAAK,QAAQ,QAAQ,CAAA,KAAM,cAAc,OAAO,MAAA;AACrE,EAAA,MAAM,EAAA,GAAK,QAAQ,IAAI,CAAA;AACvB,EAAA,IAAI,OAAO,EAAA,KAAO,QAAA,IAAY,OAAO,EAAA,KAAO,UAAU,OAAO,MAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,QAAQ,QAAQ,CAAA;AAC/B,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,CAAC,QAAA,CAAS,MAAM,CAAA,EAAG,OAAA,GAAU,0BAAA;AAAA,OAAA,IACxB,OAAO,MAAA,CAAO,MAAM,CAAA,KAAM,UAAU,OAAA,GAAU,yBAAA;AAAA,OAAA,IAC9C,MAAA,CAAO,WAAW,CAAA,KAAM,MAAA,IAAa,CAAC,QAAA,CAAS,MAAA,CAAO,WAAW,CAAC,CAAA,EAAG;AAC5E,IAAA,OAAA,GAAU,+BAAA;AAAA,EACZ,CAAA,MAAA,IAAW,MAAA,CAAO,OAAO,CAAA,KAAM,MAAA,IAAa,CAAC,QAAA,CAAS,MAAA,CAAO,OAAO,CAAC,CAAA,EAAG;AACtE,IAAA,OAAA,GAAU,2BAAA;AAAA,EACZ;AACA,EAAA,OAAO,OAAA,KAAY,SACf,MAAA,GACA,EAAE,IAAI,OAAA,EAAS,CAAA,2BAAA,EAA8B,OAAO,CAAA,CAAA,CAAA,EAAI;AAC9D;AAGA,eAAe,gBAAA,CAAiB,UAAoB,GAAA,EAAoC;AACtF,EAAA,GAAA,CAAI,UAAU,QAAA,CAAS,MAAA,EAAQ,OAAO,WAAA,CAAY,QAAA,CAAS,OAAO,CAAC,CAAA;AACnE,EAAA,IAAI,QAAA,CAAS,SAAS,IAAA,EAAM;AAC1B,IAAA,WAAA,MAAiB,KAAA,IAAS,SAAS,IAAA,EAAM;AACvC,MAAA,IAAI,IAAI,SAAA,EAAW;AACnB,MAAA,GAAA,CAAI,MAAM,KAAK,CAAA;AAAA,IACjB;AAAA,EACF;AACA,EAAA,GAAA,CAAI,GAAA,EAAI;AACV;AAGA,SAAS,eAAA,CACP,MACA,QAAA,EAC+B;AAC/B,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,cAAA,CAAe,CAAC,CAAA;AACxC,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,MAAM,OAAA,GAAU,wBAAA,CAAyB,IAAA,GAAO,yBAAyB,CAAC,CAAA;AAC1E,IAAA,IAAI,OAAA,KAAY,MAAA,EAAW,OAAO,EAAE,QAAQ,OAAA,EAAQ;AAAA,EACtD;AACA,EAAA,MAAM,UAAA,GAAa,OAAO,2BAA2B,CAAA;AACrD,EAAA,IAAI,MAAA,KAAW,KAAA,IAAS,QAAA,CAAS,UAAU,CAAA,EAAG;AAE5C,IAAA,OAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,IAAA,CAAK,SAAA,CAAU,UAAU,CAAA,EAAE;AAAA,EACvD;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,iBAAiB,OAAA,EAAkD;AACjF,EAAA,OAAO,IAAI,mBAAmB,OAAO,CAAA;AACvC","file":"mcp-CNWQ2MOE.js","sourcesContent":["/**\n * Adapter self-description. `supportedSpec` lists the modern revision and\n * the newest 2025-era revision. The SDK's legacy fallback also accepts older\n * 2025-era revisions.\n */\nimport { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/server';\nimport type { AdapterDescriptor } from '../../core';\nimport { MCP_MODERN_PROTOCOL_REVISION } from './constants';\n\n// List the modern revision followed by the SDK's latest legacy revision\nconst MCP_SUPPORTED_SPEC = `${MCP_MODERN_PROTOCOL_REVISION}, ${LATEST_PROTOCOL_VERSION}`;\n\n// Tool-oriented capabilities this adapter implements\nconst MCP_CAPABILITIES: readonly string[] = ['tools/list', 'tools/call'];\n\n/**\n * MCP surfaces this adapter does not implement, listed so its descriptor never\n * implies blanket protocol compatibility.\n *\n * `dns-rebinding-protection` is delegated rather than missing: the gateway's\n * `onRequest` hook validates Host and Origin for `/mcp` (see adapter.ts), and\n * the adapter provides none on its own.\n */\nexport const MCP_UNSUPPORTED: readonly string[] = [\n  'resources',\n  'prompts',\n  'sampling',\n  'completions',\n  'elicitation',\n  'roots',\n  'logging',\n  'notifications/tools/list_changed',\n  'tasks',\n  'dns-rebinding-protection',\n  'authorization',\n  'sessions',\n  'subscriptions',\n  'pagination',\n  'HTTP+SSE transport',\n  // mppx reads challenges and refusals from tool-result `_meta`.\n  'MPP payment-required as JSON-RPC error -32042',\n  'MPP verification failure as JSON-RPC error -32043',\n];\n\nexport function buildDescriptor(implementationVersion: string): AdapterDescriptor {\n  return {\n    name: 'mcp',\n    kind: 'protocol',\n    implementationVersion,\n    supportedSpec: MCP_SUPPORTED_SPEC,\n    capabilities: MCP_CAPABILITIES,\n    status: 'stable',\n    unsupported: MCP_UNSUPPORTED,\n  };\n}\n","/**\n * Maps a canonical `CommerceResource` to an MCP `Tool`: the tool name is the\n * resource id, the description carries a price notice for a paid resource,\n * and the input schema is the canonical JSON Schema plus the reserved\n * `_payment` and `_authorization` properties the resource accepts\n */\n\nimport type { JSONObject, Tool } from '@modelcontextprotocol/server';\nimport {\n  AUTHORIZATION_INPUT_FIELD,\n  type CommerceResource,\n  PAYMENT_INPUT_FIELD,\n  type PaymentMethodName,\n} from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport { MPP_MCP_CREDENTIAL_META_KEY } from '../../payments/mpp/transport';\nimport { X402_MCP_PAYMENT_META_KEY } from '../../payments/x402/transport';\nimport { MCP_TOOL_NAME_PATTERN } from './constants';\n\nexport function isValidToolName(id: string): boolean {\n  return MCP_TOOL_NAME_PATTERN.test(id);\n}\n\nfunction isPaidResource(resource: CommerceResource): boolean {\n  return resource.pricing.type !== 'free';\n}\n\n// The rail a `_payment` proof is labeled with (see `extractReservedInputFields`),\n// `undefined` when the resource lists none\nfunction primaryPaymentMethod(resource: CommerceResource): PaymentMethodName | undefined {\n  return resource.paymentMethods[0];\n}\n\n/** Describe the selected rail's `_meta` proof and `_payment` fallback */\nexport function proofCarriers(method: PaymentMethodName | undefined): string {\n  const field = `the \"${PAYMENT_INPUT_FIELD}\" argument`;\n  if (method === 'x402') return `_meta[\"${X402_MCP_PAYMENT_META_KEY}\"] or ${field}`;\n  if (method === 'mpp') return `_meta[\"${MPP_MCP_CREDENTIAL_META_KEY}\"] or ${field}`;\n  return field;\n}\n\n// How to supply a proof, generic when the resource names no rail\nfunction paymentProofNote(resource: CommerceResource): string {\n  const method = primaryPaymentMethod(resource);\n  const rail = method !== undefined ? `an ${method}` : 'a';\n  return `Requires ${rail} payment proof in ${proofCarriers(method)}, built from the payment-required response.`;\n}\n\n// Tell callers to omit `_payment` when a wrapper supplies `_meta`\nconst OMIT_NOTE = 'Omit it when the client sends the proof in _meta.';\n\n/**\n * Description for the reserved `_payment` input property, in the proof\n * encoding of the resource's own rail\n */\nfunction paymentInputFieldDescription(resource: CommerceResource): string {\n  const method = primaryPaymentMethod(resource);\n  if (method === 'x402') {\n    return `x402 payment proof (base64 PAYMENT-SIGNATURE value) for a previous payment-required response. ${OMIT_NOTE}`;\n  }\n  if (method === 'mpp') {\n    return `MPP credential (the full \"Authorization: Payment ...\" value) for the challenge in a previous payment-required response. ${OMIT_NOTE}`;\n  }\n  if (method !== undefined) {\n    return `${method} payment proof (base64-encoded) returned from a previous payment-required response.`;\n  }\n  return 'Payment proof returned from a previous payment-required response.';\n}\n\n// The authorization methods the resource requires, empty when it requires none\nfunction requiredAuthorization(resource: CommerceResource): readonly string[] {\n  return resource.authorization?.required ?? [];\n}\n\nfunction authorizationNote(resource: CommerceResource): string {\n  const methods = requiredAuthorization(resource);\n  return methods.length > 0\n    ? ` Also requires ${methods.join(' and ')} authorization in the \"${AUTHORIZATION_INPUT_FIELD}\" input field.`\n    : '';\n}\n\n/**\n * Tool description. A paid resource gets a price notice appended, so an agent\n * sees the cost before calling, not only in the input schema.\n */\nexport function buildToolDescription(resource: CommerceResource): string {\n  const base = resource.description ?? resource.name;\n  switch (resource.pricing.type) {\n    case 'free':\n      return base;\n    case 'fixed': {\n      const { amount, currency } = resource.pricing;\n      return `${base} Costs ${amount} ${currency} per call. ${paymentProofNote(resource)}${authorizationNote(resource)}`;\n    }\n    case 'dynamic':\n      return `${base} Requires payment (amount determined at request time). ${paymentProofNote(resource)}${authorizationNote(resource)}`;\n  }\n}\n\n/**\n * Builds the MCP `Tool.inputSchema` from the canonical `CommerceResource.inputSchema`.\n *\n * Every keyword is carried through except that `type` is forced to the\n * `'object'` MCP requires, `properties` keeps only object-valued entries and\n * `required` only strings. A paid resource gains the optional `_payment`\n * string property, and a resource requiring authorization the optional\n * `_authorization` object. Both are declared because a resource's input schema\n * is closed by default, and a client that validates arguments against it\n * would otherwise refuse to send them.\n */\nexport function buildInputSchema(resource: CommerceResource): Tool['inputSchema'] {\n  const base = resource.inputSchema;\n  const baseIsObject = isRecord(base);\n\n  // Keep object-valued property schemas from the resource's config JSON\n  const basePropertyEntries: readonly [string, JSONObject][] =\n    baseIsObject && isRecord(base.properties)\n      ? Object.entries(base.properties).filter((entry): entry is [string, JSONObject] =>\n          isRecord(entry[1]),\n        )\n      : [];\n  const properties: Record<string, JSONObject> = Object.fromEntries(basePropertyEntries);\n\n  // Both overwrite a resource-declared property of the same name; config\n  // rejects that collision at load time\n  if (isPaidResource(resource)) {\n    properties[PAYMENT_INPUT_FIELD] = {\n      type: 'string',\n      description: paymentInputFieldDescription(resource),\n    };\n  }\n  const methods = requiredAuthorization(resource);\n  if (methods.length > 0) {\n    properties[AUTHORIZATION_INPUT_FIELD] = {\n      type: 'object',\n      description:\n        'Authorization this resource requires in addition to payment: the method and its serialized proof.',\n      properties: {\n        method: { type: 'string', enum: [...methods] },\n        payload: { type: 'string', minLength: 1 },\n      },\n      required: ['method', 'payload'],\n    };\n  }\n\n  const required =\n    baseIsObject && Array.isArray(base.required)\n      ? base.required.filter((v): v is string => typeof v === 'string')\n      : [];\n\n  const extra = baseIsObject\n    ? Object.fromEntries(\n        Object.entries(base).filter(\n          ([key]) => key !== 'type' && key !== 'properties' && key !== 'required',\n        ),\n      )\n    : {};\n\n  return {\n    ...extra,\n    type: 'object',\n    properties,\n    ...(required.length > 0 ? { required } : {}),\n  };\n}\n","/**\n * Maps pipeline outcomes and errors to MCP tool results through the core wire\n * helpers (`toErrorEnvelope`, `toPaymentRequiredEnvelope`,\n * `toDeliverySummary`). The A2A adapter uses all three and the HTTP route the\n * two envelopes, so each shape is defined once.\n */\n\nimport type { CallToolResult } from '@modelcontextprotocol/server';\nimport {\n  type CommerceError,\n  DELIVERY_SUMMARY_META_KEY,\n  type DeliveredOutcome,\n  type ExecutionOutcome,\n  type PaymentMethodName,\n  type PaymentRequiredOutcome,\n  toDeliverySummary,\n  toErrorEnvelope,\n  toPaymentRequiredEnvelope,\n} from '../../core';\nimport { isRecord } from '../../core/is-record';\nimport {\n  MPP_MCP_PAYMENT_REQUIRED_META_KEY,\n  MPP_MCP_RECEIPT_META_KEY,\n  mcpPaymentRequired,\n  receiptObject,\n} from '../../payments/mpp/transport';\nimport {\n  settlementFailure,\n  settlementResponse,\n  settlementResponseFromDetails,\n  X402_MCP_ERROR_META_KEY,\n  X402_MCP_PAYMENT_RESPONSE_META_KEY,\n  x402ErrorCode,\n} from '../../payments/x402/transport';\nimport { proofCarriers } from './tool-mapping';\n\nfunction toRecord(value: object): Record<string, unknown> {\n  return value as Record<string, unknown>;\n}\n\nfunction deliveredResult(outcome: DeliveredOutcome): CallToolResult {\n  const body = outcome.body;\n  const text = typeof body === 'string' ? body : JSON.stringify(body ?? null);\n  const payment = outcome.payment;\n  const receipt =\n    payment?.provider === 'mpp' ? receiptObject(payment.metadata?.['receipt']) : undefined;\n  return {\n    content: [{ type: 'text', text }],\n    ...(isRecord(body) ? { structuredContent: body } : {}),\n    _meta: {\n      [DELIVERY_SUMMARY_META_KEY]: toRecord(toDeliverySummary(outcome)),\n      ...(payment?.provider === 'x402'\n        ? { [X402_MCP_PAYMENT_RESPONSE_META_KEY]: settlementResponse(payment) }\n        : {}),\n      ...(receipt !== undefined ? { [MPP_MCP_RECEIPT_META_KEY]: receipt } : {}),\n    },\n  };\n}\n\n// The x402 MCP transport requires the first text block to repeat\n// `structuredContent` as JSON; the second gives readers a short explanation\nfunction structuredError(\n  structured: Record<string, unknown>,\n  sentence: string,\n  meta?: Record<string, unknown>,\n): CallToolResult {\n  return {\n    isError: true,\n    content: [\n      { type: 'text', text: JSON.stringify(structured) },\n      { type: 'text', text: sentence },\n    ],\n    structuredContent: structured,\n    ...(meta !== undefined ? { _meta: meta } : {}),\n  };\n}\n\n// Put x402's PaymentRequired fields beside the gateway error envelope so\n// x402 clients can read the challenge from `structuredContent`\nfunction withX402Challenge(\n  envelope: Record<string, unknown>,\n  challenge: Record<string, unknown>,\n): Record<string, unknown> {\n  return { ...challenge, ...envelope };\n}\n\nfunction paymentRequiredResult(outcome: PaymentRequiredOutcome): CallToolResult {\n  const envelope = toPaymentRequiredEnvelope(outcome);\n  const p = envelope.payment;\n  const x402Required = p.provider === 'x402' ? p.envelope : undefined;\n  const structured =\n    x402Required !== undefined\n      ? withX402Challenge(toRecord(envelope), x402Required)\n      : toRecord(envelope);\n  const mppRequired = p.provider === 'mpp' ? mcpPaymentRequired(p.envelope) : undefined;\n  let meta: Record<string, unknown> | undefined;\n  if (x402Required !== undefined) meta = { [X402_MCP_ERROR_META_KEY]: x402Required };\n  else if (mppRequired !== undefined) meta = { [MPP_MCP_PAYMENT_REQUIRED_META_KEY]: mppRequired };\n  return structuredError(\n    structured,\n    // A challenge with several offers names no single destination\n    `Payment required: ${p.amount} ${p.currency}${p.destination !== undefined ? ` to ${p.destination}` : ''} for resource \"${outcome.resourceId}\". Retry with an ${p.provider} payment proof in ${proofCarriers(p.provider)}.`,\n    meta,\n  );\n}\n\n/** A tool result for an error; `rail` is the payment method the call used, if any */\nexport function errorResult(error: CommerceError, rail?: PaymentMethodName): CallToolResult {\n  const envelope = toErrorEnvelope(error);\n  const details = error.details;\n  const challenge = details?.['challenge'];\n  // Include the rail's new challenge when a 402 refusal supplies one\n  const refused = error.httpStatus === 402 && isRecord(challenge);\n  const x402Required =\n    rail === 'x402' && refused\n      ? {\n          ...challenge,\n          error: x402ErrorCode(error.code, details?.['reason'], details?.['network']),\n        }\n      : undefined;\n  const structured =\n    x402Required !== undefined\n      ? withX402Challenge(toRecord(envelope), x402Required)\n      : toRecord(envelope);\n  let meta: Record<string, unknown> | undefined;\n  if (rail === 'x402') {\n    const settlement =\n      error.code === 'PAYMENT_SETTLEMENT_FAILED'\n        ? settlementFailure(details)\n        : settlementResponseFromDetails(details);\n    if (settlement !== undefined || x402Required !== undefined) {\n      meta = {\n        ...(x402Required !== undefined ? { [X402_MCP_ERROR_META_KEY]: x402Required } : {}),\n        ...(settlement !== undefined ? { [X402_MCP_PAYMENT_RESPONSE_META_KEY]: settlement } : {}),\n      };\n    }\n  } else if (rail === 'mpp' && refused) {\n    // MPP error results carry a challenge but no receipt\n    const required = mcpPaymentRequired(challenge, {\n      code: error.code,\n      reason: details?.['reason'],\n      detail: error.message,\n    });\n    if (required !== undefined) meta = { [MPP_MCP_PAYMENT_REQUIRED_META_KEY]: required };\n  }\n  return structuredError(structured, `${envelope.code}: ${envelope.message}`, meta);\n}\n\nexport function mapOutcome(outcome: ExecutionOutcome): CallToolResult {\n  return outcome.kind === 'delivered' ? deliveredResult(outcome) : paymentRequiredResult(outcome);\n}\n","/**\n * MCP protocol adapter.\n *\n * One MCP tool per mcp-exposed canonical resource. Every `tools/call` builds a\n * `CanonicalRequest` and goes through `context.pipeline.execute()`. This\n * adapter reads payment carriers but leaves verification, settlement and\n * merchant calls to the pipeline.\n *\n * The SDK's `createMcpHandler` serves `2026-07-28` over Streamable HTTP and\n * routes 2025-era requests through its stateless fallback. It creates a\n * low-level `Server` for each request. This adapter converts the gateway's\n * Node request and response to the web types the handler uses, without adding\n * `@modelcontextprotocol/node` as a peer.\n *\n * Tools are registered on the low-level `Server`, not through\n * `McpServer.registerTool`, whose `inputSchema` accepts only a Zod schema or\n * shape. `CommerceResource.inputSchema` and the MCP wire `Tool.inputSchema`\n * are both JSON Schema, so building `Tool` objects directly carries the schema\n * through with no lossy conversion. The SDK marks `Server` `@deprecated` but\n * still documents it for advanced cases such as this one.\n *\n * The gateway's `onRequest` hook validates Host and Origin for every route,\n * including `/mcp`. This adapter has no separate allowlist. When mounted\n * outside the gateway, it provides no Host or Origin checks; its descriptor\n * therefore lists `dns-rebinding-protection` as unsupported.\n */\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport {\n  type CallToolResult,\n  createMcpHandler,\n  type McpHttpHandler,\n  ProtocolError,\n  ProtocolErrorCode,\n  Server,\n  type Tool,\n} from '@modelcontextprotocol/server';\nimport {\n  type AdapterDescriptor,\n  type AdapterHealth,\n  type CanonicalRequest,\n  CommerceError,\n  type CommerceResource,\n  extractReservedInputFields,\n  type HttpProtocolAdapter,\n  type PaymentSubmission,\n  type ProtocolAdapterContext,\n  toCommerceError,\n} from '../../core';\nimport { toLogInfo } from '../../core/errors';\nimport { isRecord } from '../../core/is-record';\nimport { MPP_MCP_CREDENTIAL_META_KEY } from '../../payments/mpp/transport';\nimport { X402_MCP_PAYMENT_META_KEY, x402McpPaymentSubmission } from '../../payments/x402/transport';\nimport { PACKAGE_VERSION } from '../../version';\nimport { readCappedBody } from '../http';\nimport { MCP_MODERN_PROTOCOL_REVISION, MCP_TOOL_NAME_PATTERN } from './constants';\nimport { buildDescriptor } from './descriptor';\nimport { errorResult, mapOutcome } from './result-mapping';\nimport { buildInputSchema, buildToolDescription, isValidToolName } from './tool-mapping';\n\nexport interface McpAdapterOptions {\n  /** Path prefix the gateway mounts this adapter at. Default '/mcp' */\n  readonly mountPath?: string;\n  /** MCP `Implementation.name` reported during initialize */\n  readonly serverName?: string;\n  /** MCP `Implementation.version` reported during initialize. Default: this package's version */\n  readonly serverVersion?: string;\n}\n\ninterface RegisteredTool {\n  readonly resource: CommerceResource;\n  readonly tool: Tool;\n}\n\ninterface SkippedResource {\n  readonly id: string;\n  readonly reason: string;\n}\n\nconst DEFAULT_MOUNT_PATH = '/mcp';\nconst DEFAULT_SERVER_NAME = 'agent-commerce';\n\n/**\n * The SDK can dispatch several `tools/call` requests in one JSON-RPC batch\n * before earlier calls settle. One POST can therefore start concurrent\n * `pipeline.execute()` calls. Limit active calls to 8 per adapter instance.\n */\nconst MAX_CONCURRENT_TOOL_CALLS = 8;\n\n// A second line behind the gateway mount's cap, bounding what this adapter\n// buffers if it is mounted without that guard\nconst MAX_REQUEST_BODY_BYTES = 256 * 1024;\n\n/**\n * Bounds the queue behind the semaphore, per adapter instance. Without it an\n * oversized batch would queue in full and then run in full. 64 is 8x\n * MAX_CONCURRENT_TOOL_CALLS, room for a legitimate burst; calls beyond it fail\n * fast with GATEWAY_BUSY and reach no backend.\n */\nconst MAX_QUEUED_TOOL_CALLS = 64;\n\n// Batch revision used by the SDK when no protocol-version header is sent\nconst MCP_BATCH_PROTOCOL_REVISION = '2025-03-26';\n\n// The tool list is public and stable until restart; cache it for a minute\nconst TOOLS_LIST_CACHE_HINT = { ttlMs: 60_000, cacheScope: 'public' } as const;\n\nclass McpProtocolAdapter implements HttpProtocolAdapter {\n  readonly name = 'mcp' as const;\n  readonly mountPath: string;\n  readonly descriptor: AdapterDescriptor;\n\n  private readonly serverName: string;\n  private readonly serverVersion: string;\n\n  private context: ProtocolAdapterContext | undefined;\n  private started = false;\n  private tools: readonly RegisteredTool[] = [];\n  private toolsByResourceId: ReadonlyMap<string, CommerceResource> = new Map();\n  private skipped: readonly SkippedResource[] = [];\n  private handler: McpHttpHandler | undefined;\n\n  // Counting semaphore on `pipeline.execute()`. It lives on the adapter, not\n  // the request, so the cap holds across concurrent `/mcp` requests as well\n  // as within one batch.\n  private inFlightToolCalls = 0;\n  private readonly toolCallWaiters: Array<() => void> = [];\n\n  constructor(options: McpAdapterOptions = {}) {\n    this.mountPath = options.mountPath ?? DEFAULT_MOUNT_PATH;\n    this.serverName = options.serverName ?? DEFAULT_SERVER_NAME;\n    this.serverVersion = options.serverVersion ?? PACKAGE_VERSION;\n    this.descriptor = buildDescriptor(PACKAGE_VERSION);\n  }\n\n  async start(context: ProtocolAdapterContext): Promise<void> {\n    this.context = context;\n    this.started = false;\n\n    let resources: readonly CommerceResource[] = [];\n    try {\n      resources = context.resources.listExposedVia('mcp');\n    } catch (err) {\n      context.logger.error(\n        { err: toLogInfo(err) },\n        'mcp adapter: failed to list mcp-exposed resources',\n      );\n      resources = [];\n    }\n\n    const tools: RegisteredTool[] = [];\n    const toolsByResourceId = new Map<string, CommerceResource>();\n    const skipped: SkippedResource[] = [];\n\n    for (const resource of resources) {\n      try {\n        if (!isValidToolName(resource.id)) {\n          skipped.push({\n            id: resource.id,\n            reason: `resource id is not a legal MCP tool name (must match ${MCP_TOOL_NAME_PATTERN.source})`,\n          });\n          continue;\n        }\n        if (toolsByResourceId.has(resource.id)) {\n          skipped.push({ id: resource.id, reason: 'duplicate tool name' });\n          continue;\n        }\n        const tool: Tool = {\n          name: resource.id,\n          description: buildToolDescription(resource),\n          inputSchema: buildInputSchema(resource),\n        };\n        tools.push({ resource, tool });\n        toolsByResourceId.set(resource.id, resource);\n      } catch (err) {\n        skipped.push({\n          id: resource.id,\n          reason: `failed to build MCP tool: ${toCommerceError(err).message}`,\n        });\n      }\n    }\n\n    for (const s of skipped) {\n      context.logger.warn({ resourceId: s.id, reason: s.reason }, 'mcp adapter: resource skipped');\n    }\n\n    this.tools = tools;\n    this.toolsByResourceId = toolsByResourceId;\n    this.skipped = skipped;\n    // Route 2025-era requests through the SDK's stateless fallback\n    this.handler = createMcpHandler(\n      (ctx) => this.buildServer(ctx.requestInfo?.signal ?? new AbortController().signal),\n      {\n        legacy: 'stateless',\n        // Reporting only: a request the SDK rejects is already answered\n        onerror: (err) => context.logger.debug({ err: toLogInfo(err) }, 'mcp adapter: SDK error'),\n      },\n    );\n    this.started = true;\n\n    context.logger.info(\n      {\n        mountPath: this.mountPath,\n        toolCount: tools.length,\n        skippedCount: skipped.length,\n      },\n      'mcp adapter started',\n    );\n  }\n\n  async handleHttp(req: IncomingMessage, res: ServerResponse): Promise<void> {\n    try {\n      if (!this.started || !this.context || !this.handler) {\n        this.writeJsonRpcError(res, 503, 'MCP adapter is not running.');\n        return;\n      }\n      if (req.method !== 'POST') {\n        this.writeJsonRpcError(res, 405, 'Method not allowed. This endpoint only accepts POST.');\n        return;\n      }\n\n      // Aborted when the response closes. `handleToolCall` checks it only\n      // before `pipeline.execute()`: a call that may already have settled\n      // must finish, or the buyer is charged for nothing.\n      const abortController = new AbortController();\n      res.once('close', () => abortController.abort());\n      const read = await readCappedBody(req, MAX_REQUEST_BODY_BYTES);\n      if (read.kind === 'too-large') {\n        this.writeJsonRpcError(\n          res,\n          413,\n          `Request body exceeds the ${MAX_REQUEST_BODY_BYTES}-byte limit.`,\n        );\n        return;\n      }\n      if (read.kind !== 'ok') {\n        this.writeJsonRpcError(res, 400, 'Could not read the request body.');\n        return;\n      }\n      const body = parseJson(read.text);\n      const version = req.headers['mcp-protocol-version'];\n      if (Array.isArray(body) && version !== undefined && version !== MCP_BATCH_PROTOCOL_REVISION) {\n        this.writeJsonRpcError(\n          res,\n          400,\n          `Invalid Request: JSON-RPC batches are supported only in MCP ${MCP_BATCH_PROTOCOL_REVISION}.`,\n        );\n        return;\n      }\n      const malformed = isModernRequest(req) ? undefined : malformedToolCall(body);\n      if (malformed !== undefined) {\n        this.writeJsonRpcError(res, 200, malformed.message, -32602, malformed.id);\n        return;\n      }\n      const response = await this.handler.fetch(\n        toWebRequest(req, read.text, abortController.signal),\n      );\n      await writeWebResponse(response, res);\n    } catch (err) {\n      this.context?.logger.error({ err: toLogInfo(err) }, 'mcp adapter: request handling failed');\n      this.writeJsonRpcError(res, 500, 'Internal server error.');\n    }\n  }\n\n  async health(): Promise<AdapterHealth> {\n    const checkedAt = this.context?.clock.nowIso() ?? new Date().toISOString();\n    if (!this.started || !this.context) {\n      return { status: 'fail', detail: 'MCP adapter has not been started.', checkedAt };\n    }\n    const toolCount = this.tools.length;\n    if (this.skipped.length > 0) {\n      const detail = `${toolCount} tool(s) registered; ${this.skipped.length} resource(s) skipped: ${this.skipped\n        .map((s) => `${s.id} (${s.reason})`)\n        .join('; ')}`;\n      return { status: 'warn', detail, checkedAt };\n    }\n    return { status: 'pass', detail: `${toolCount} tool(s) registered.`, checkedAt };\n  }\n\n  async stop(): Promise<void> {\n    this.started = false;\n    const handler = this.handler;\n    this.handler = undefined;\n    try {\n      await handler?.close();\n    } catch {\n      // Best effort: stop() must be idempotent and never throw\n    }\n    this.context = undefined;\n  }\n\n  // Use general JSON-RPC codes for transport errors\n  private writeJsonRpcError(\n    res: ServerResponse,\n    status: number,\n    message: string,\n    code = status >= 500 ? -32603 : -32600,\n    id: string | number | null = null,\n  ): void {\n    if (res.headersSent) return;\n    res.writeHead(status, {\n      'content-type': 'application/json',\n      // RFC 9110 requires Allow on a 405, and this endpoint takes only POST\n      ...(status === 405 ? { allow: 'POST' } : {}),\n    });\n    res.end(JSON.stringify({ jsonrpc: '2.0', error: { code, message }, id }));\n  }\n\n  private buildServer(signal: AbortSignal): Server {\n    const server = new Server(\n      { name: this.serverName, version: this.serverVersion },\n      { capabilities: { tools: {} }, cacheHints: { 'tools/list': TOOLS_LIST_CACHE_HINT } },\n    );\n    server.setRequestHandler('tools/list', async (request) => {\n      // A cursor is invalid because this list is not paginated\n      if (request.params?.cursor !== undefined) {\n        throw new ProtocolError(ProtocolErrorCode.InvalidParams, 'Invalid cursor.');\n      }\n      return { tools: this.tools.map((t) => t.tool) };\n    });\n    server.setRequestHandler('tools/call', async (request) =>\n      this.handleToolCall(\n        request.params.name,\n        request.params.arguments ?? {},\n        request.params._meta,\n        signal,\n      ),\n    );\n    return server;\n  }\n\n  private async handleToolCall(\n    resourceId: string,\n    rawArgs: Record<string, unknown>,\n    meta: Record<string, unknown> | undefined,\n    signal: AbortSignal,\n  ): Promise<CallToolResult> {\n    const context = this.context;\n    if (!context) {\n      return errorResult(new CommerceError('INTERNAL_ERROR', 'MCP adapter is not running.'));\n    }\n    // Clients can call names absent from `tools/list`. Return the same MCP\n    // error for unknown and non-MCP resources without revealing the latter\n    const resource = this.toolsByResourceId.get(resourceId);\n    if (!resource) {\n      throw new ProtocolError(ProtocolErrorCode.InvalidParams, `Unknown tool \"${resourceId}\".`);\n    }\n    try {\n      const requestId = context.ids.next('mcp');\n      const fields = extractReservedInputFields(rawArgs, resource, requestId);\n      const { input, authorization } = fields;\n      // Client wrappers attach proofs in `_meta`; that proof takes priority\n      // over a possible `_payment` placeholder in the arguments\n      const payment = paymentFromMeta(meta, resource) ?? fields.payment;\n      const request: CanonicalRequest = {\n        requestId,\n        resourceId,\n        input,\n        protocol: 'mcp',\n        receivedAt: context.clock.nowIso(),\n        ...(payment !== undefined ? { payment } : {}),\n        ...(authorization !== undefined ? { authorization } : {}),\n      };\n      await this.acquireToolCallSlot(signal);\n      try {\n        // The last cancellation point: a queued call whose caller has left\n        // must not start a pipeline run, while a started one may reach\n        // settle() and must finish\n        if (signal.aborted) {\n          // No error code names \"the caller left\". PROTOCOL_UNSUPPORTED is the\n          // closest non-retryable one; GATEWAY_BUSY would invite a retry\n          // nobody is left to make.\n          return errorResult(\n            new CommerceError(\n              'PROTOCOL_UNSUPPORTED',\n              'Client disconnected before this call started.',\n            ),\n          );\n        }\n        const outcome = await context.pipeline.execute(request);\n        return mapOutcome(outcome);\n      } finally {\n        // Always released: a stranded permit shrinks the cap for good and\n        // eventually deadlocks the adapter\n        this.releaseToolCallSlot();\n      }\n    } catch (err) {\n      const error = toCommerceError(err);\n      context.logger.warn({ resourceId, err: toLogInfo(error) }, 'mcp adapter: execution failed');\n      return errorResult(error, resource.paymentMethods[0]);\n    }\n  }\n\n  /**\n   * Takes a permit, or queues for one when MAX_CONCURRENT_TOOL_CALLS are in\n   * flight. Throws when the queue is full or the caller disconnected while\n   * queued; a throw never leaks a permit.\n   */\n  private async acquireToolCallSlot(signal: AbortSignal): Promise<void> {\n    if (this.inFlightToolCalls < MAX_CONCURRENT_TOOL_CALLS) {\n      this.inFlightToolCalls++;\n      return;\n    }\n    if (this.toolCallWaiters.length >= MAX_QUEUED_TOOL_CALLS) {\n      // Load shedding is transient, so GATEWAY_BUSY tells the caller to back\n      // off and retry\n      throw new CommerceError(\n        'GATEWAY_BUSY',\n        'Too many tool calls already queued on this adapter; retry later.',\n      );\n    }\n    // Resolved by releaseToolCallSlot, which hands its permit straight to the\n    // oldest waiter, so a call arriving later cannot take it first\n    await new Promise<void>((resolve) => this.toolCallWaiters.push(resolve));\n    if (signal.aborted) {\n      // This waiter now holds a permit it will not use; pass it on\n      this.releaseToolCallSlot();\n      // Non-retryable, for the same reason as the check in handleToolCall\n      throw new CommerceError('PROTOCOL_UNSUPPORTED', 'Client disconnected while queued.');\n    }\n  }\n\n  private releaseToolCallSlot(): void {\n    const next = this.toolCallWaiters.shift();\n    // Handing the permit over leaves the in-flight count unchanged\n    if (next !== undefined) next();\n    else this.inFlightToolCalls--;\n  }\n}\n\n// Pass the Node request body to the SDK as a stream. The gateway's socket\n// byte limit still applies, and the signal reports client disconnects.\nfunction toWebRequest(req: IncomingMessage, body: string, signal: AbortSignal): Request {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(req.headers)) {\n    if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(', ') : value);\n  }\n  return new Request(new URL(req.url ?? '/', 'http://localhost'), {\n    method: req.method ?? 'POST',\n    headers,\n    body,\n    signal,\n  });\n}\n\n/**\n * Let the SDK validate requests with `Mcp-Method` or a modern version header;\n * malformed headers and `_meta` may require an HTTP 400 response\n */\nfunction isModernRequest(req: IncomingMessage): boolean {\n  if (req.headers['mcp-method'] !== undefined) return true;\n  const version = req.headers['mcp-protocol-version'];\n  // ISO revision dates sort lexically.\n  return typeof version === 'string' && version >= MCP_MODERN_PROTOCOL_REVISION;\n}\n\n// Undefined for a body that is not JSON; the SDK answers that with -32700\nfunction parseJson(body: string): unknown {\n  try {\n    return JSON.parse(body);\n  } catch {\n    return undefined;\n  }\n}\n\n// Give malformed tool calls without modern headers a short -32602 response\nfunction malformedToolCall(message: unknown): { id: string | number; message: string } | undefined {\n  if (!isRecord(message) || message['method'] !== 'tools/call') return undefined;\n  const id = message['id'];\n  if (typeof id !== 'string' && typeof id !== 'number') return undefined;\n  const params = message['params'];\n  let problem: string | undefined;\n  if (!isRecord(params)) problem = 'params must be an object';\n  else if (typeof params['name'] !== 'string') problem = '\"name\" must be a string';\n  else if (params['arguments'] !== undefined && !isRecord(params['arguments'])) {\n    problem = '\"arguments\" must be an object';\n  } else if (params['_meta'] !== undefined && !isRecord(params['_meta'])) {\n    problem = '\"_meta\" must be an object';\n  }\n  return problem === undefined\n    ? undefined\n    : { id, message: `Invalid tools/call params: ${problem}.` };\n}\n\n// Stream the SDK's response body, including SSE, to the Node response\nasync function writeWebResponse(response: Response, res: ServerResponse): Promise<void> {\n  res.writeHead(response.status, Object.fromEntries(response.headers));\n  if (response.body !== null) {\n    for await (const chunk of response.body) {\n      if (res.destroyed) break;\n      res.write(chunk);\n    }\n  }\n  res.end();\n}\n\n// Read a proof from the selected rail's MCP `_meta` carrier\nfunction paymentFromMeta(\n  meta: Record<string, unknown> | undefined,\n  resource: CommerceResource,\n): PaymentSubmission | undefined {\n  const method = resource.paymentMethods[0];\n  if (method === 'x402') {\n    const payload = x402McpPaymentSubmission(meta?.[X402_MCP_PAYMENT_META_KEY]);\n    if (payload !== undefined) return { method, payload };\n  }\n  const credential = meta?.[MPP_MCP_CREDENTIAL_META_KEY];\n  if (method === 'mpp' && isRecord(credential)) {\n    // The MPP provider converts this object to an Authorization value\n    return { method, payload: JSON.stringify(credential) };\n  }\n  return undefined;\n}\n\nexport function createMcpAdapter(options?: McpAdapterOptions): HttpProtocolAdapter {\n  return new McpProtocolAdapter(options);\n}\n"]}

package/dist/cli/near-5AY3HWYF.js

@@ -0,0 +1,58 @@
+import { computeNearReplayKey } from './chunk-OSTCU6ZK.js';
+import { isRecord } from './chunk-3M6U7ILB.js';
+import { decodeSignedDelegateB64, parseFtTransferArgs } from '@x402/near';
+
+var MAX_SIGNED_DELEGATE_BASE64 = 4096;
+var ONE_YOCTO = 1n;
+function inspectNearPayload(payload, terms) {
+  const encoded = isRecord(payload) ? payload["signedDelegateAction"] : void 0;
+  if (typeof encoded !== "string" || encoded.length > MAX_SIGNED_DELEGATE_BASE64) {
+    return "invalid_exact_near_payload_shape";
+  }
+  let delegate;
+  try {
+    delegate = decodeSignedDelegateB64(encoded).delegate;
+  } catch {
+    return "invalid_exact_near_payload_signed_delegate_action";
+  }
+  if (!isCanonical(encoded)) return "invalid_exact_near_payload_signed_delegate_action";
+  if (delegate.actionCount !== 1) return "invalid_exact_near_payload_action_count";
+  const call = delegate.functionCall;
+  if (!call) return "invalid_exact_near_payload_action_kind";
+  if (call.methodName !== "ft_transfer") return "invalid_exact_near_payload_method_name";
+  if (delegate.receiverId !== terms.asset) {
+    return "invalid_exact_near_payload_token_contract_mismatch";
+  }
+  let args;
+  try {
+    args = parseFtTransferArgs(call.args);
+  } catch {
+    return "invalid_exact_near_payload_ft_transfer_args";
+  }
+  if (args.receiver_id !== terms.payTo) return "invalid_exact_near_payload_recipient_mismatch";
+  if (args.amount !== terms.amount) return "invalid_exact_near_payload_amount_mismatch";
+  if (call.deposit !== ONE_YOCTO) return "invalid_exact_near_payload_attached_deposit";
+  return {
+    payer: delegate.senderId,
+    replayKey: computeNearReplayKey({
+      network: terms.network,
+      senderId: delegate.senderId,
+      publicKey: delegate.publicKey,
+      nonce: delegate.nonce
+    })
+  };
+}
+function isCanonical(encoded) {
+  const bytes = Buffer.from(encoded, "base64");
+  if (bytes.toString("base64") !== encoded) return false;
+  try {
+    decodeSignedDelegateB64(bytes.subarray(0, bytes.length - 1).toString("base64"));
+    return false;
+  } catch {
+    return true;
+  }
+}
+
+export { inspectNearPayload };
+//# sourceMappingURL=near-5AY3HWYF.js.map
+//# sourceMappingURL=near-5AY3HWYF.js.map

package/dist/cli/near-5AY3HWYF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/payments/x402/near.ts"],"names":[],"mappings":";;;;AAeA,IAAM,0BAAA,GAA6B,IAAA;AAEnC,IAAM,SAAA,GAAY,EAAA;AAeX,SAAS,kBAAA,CACd,SACA,KAAA,EACiE;AACjE,EAAA,MAAM,UAAU,QAAA,CAAS,OAAO,CAAA,GAAI,OAAA,CAAQ,sBAAsB,CAAA,GAAI,MAAA;AACtE,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,SAAS,0BAAA,EAA4B;AAC9E,IAAA,OAAO,kCAAA;AAAA,EACT;AACA,EAAA,IAAI,QAAA;AACJ,EAAA,IAAI;AACF,IAAA,QAAA,GAAW,uBAAA,CAAwB,OAAO,CAAA,CAAE,QAAA;AAAA,EAC9C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,mDAAA;AAAA,EACT;AACA,EAAA,IAAI,CAAC,WAAA,CAAY,OAAO,CAAA,EAAG,OAAO,mDAAA;AAClC,EAAA,IAAI,QAAA,CAAS,WAAA,KAAgB,CAAA,EAAG,OAAO,yCAAA;AACvC,EAAA,MAAM,OAAO,QAAA,CAAS,YAAA;AACtB,EAAA,IAAI,CAAC,MAAM,OAAO,wCAAA;AAClB,EAAA,IAAI,IAAA,CAAK,UAAA,KAAe,aAAA,EAAe,OAAO,wCAAA;AAC9C,EAAA,IAAI,QAAA,CAAS,UAAA,KAAe,KAAA,CAAM,KAAA,EAAO;AACvC,IAAA,OAAO,oDAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,mBAAA,CAAoB,KAAK,IAAI,CAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,6CAAA;AAAA,EACT;AACA,EAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,CAAM,KAAA,EAAO,OAAO,+CAAA;AAC7C,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,4CAAA;AACzC,EAAA,IAAI,IAAA,CAAK,OAAA,KAAY,SAAA,EAAW,OAAO,6CAAA;AACvC,EAAA,OAAO;AAAA,IACL,OAAO,QAAA,CAAS,QAAA;AAAA,IAChB,WAAW,oBAAA,CAAqB;AAAA,MAC9B,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,UAAU,QAAA,CAAS,QAAA;AAAA,MACnB,WAAW,QAAA,CAAS,SAAA;AAAA,MACpB,OAAO,QAAA,CAAS;AAAA,KACjB;AAAA,GACH;AACF;AAOA,SAAS,YAAY,OAAA,EAA0B;AAC7C,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,OAAA,EAAS,QAAQ,CAAA;AAC3C,EAAA,IAAI,KAAA,CAAM,QAAA,CAAS,QAAQ,CAAA,KAAM,SAAS,OAAO,KAAA;AACjD,EAAA,IAAI;AACF,IAAA,uBAAA,CAAwB,KAAA,CAAM,SAAS,CAAA,EAAG,KAAA,CAAM,SAAS,CAAC,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAA;AAC9E,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"near-5AY3HWYF.js","sourcesContent":["/**\n * NEAR `exact` payload inspection: bounded decoding of the NEP-366 signed\n * delegate action, the transfer it authorizes and its replay identity. The\n * provider loads this module only for a NEAR offer, so other deployments never\n * import `@x402/near`.\n *\n * The facilitator checks the signature, the access key and its nonce, the\n * delegate window and chain state. The gateway checks the transfer the buyer\n * signed against the offer, so a proof for other terms never reaches it.\n */\nimport { decodeSignedDelegateB64, parseFtTransferArgs } from '@x402/near';\nimport { isRecord } from '../../core/is-record';\nimport { computeNearReplayKey } from './replay-key';\n\n// One `ft_transfer` delegate is a few hundred bytes; this bounds the decoder\nconst MAX_SIGNED_DELEGATE_BASE64 = 4096;\n// NEP-141 requires exactly one yoctoNEAR on `ft_transfer`\nconst ONE_YOCTO = 1n;\n\nexport interface NearTransferTerms {\n  readonly network: string;\n  /** The NEP-141 token contract the delegate must call */\n  readonly asset: string;\n  readonly payTo: string;\n  /** Atomic units, as the offer states them */\n  readonly amount: string;\n}\n\n/**\n * Returns the payer and replay key if the NEAR `exact` payload matches the\n * offer, or a refusal reason using the SDK facilitator's codes.\n */\nexport function inspectNearPayload(\n  payload: unknown,\n  terms: NearTransferTerms,\n): { readonly payer: string; readonly replayKey: string } | string {\n  const encoded = isRecord(payload) ? payload['signedDelegateAction'] : undefined;\n  if (typeof encoded !== 'string' || encoded.length > MAX_SIGNED_DELEGATE_BASE64) {\n    return 'invalid_exact_near_payload_shape';\n  }\n  let delegate: ReturnType<typeof decodeSignedDelegateB64>['delegate'];\n  try {\n    delegate = decodeSignedDelegateB64(encoded).delegate;\n  } catch {\n    return 'invalid_exact_near_payload_signed_delegate_action';\n  }\n  if (!isCanonical(encoded)) return 'invalid_exact_near_payload_signed_delegate_action';\n  if (delegate.actionCount !== 1) return 'invalid_exact_near_payload_action_count';\n  const call = delegate.functionCall;\n  if (!call) return 'invalid_exact_near_payload_action_kind';\n  if (call.methodName !== 'ft_transfer') return 'invalid_exact_near_payload_method_name';\n  if (delegate.receiverId !== terms.asset) {\n    return 'invalid_exact_near_payload_token_contract_mismatch';\n  }\n  let args: ReturnType<typeof parseFtTransferArgs>;\n  try {\n    args = parseFtTransferArgs(call.args);\n  } catch {\n    return 'invalid_exact_near_payload_ft_transfer_args';\n  }\n  if (args.receiver_id !== terms.payTo) return 'invalid_exact_near_payload_recipient_mismatch';\n  if (args.amount !== terms.amount) return 'invalid_exact_near_payload_amount_mismatch';\n  if (call.deposit !== ONE_YOCTO) return 'invalid_exact_near_payload_attached_deposit';\n  return {\n    payer: delegate.senderId,\n    replayKey: computeNearReplayKey({\n      network: terms.network,\n      senderId: delegate.senderId,\n      publicKey: delegate.publicKey,\n      nonce: delegate.nonce,\n    }),\n  };\n}\n\n/**\n * One delegate, one encoding: canonical base64, and no bytes after the signed\n * delegate. The SDK decoder ignores such bytes, so the check decodes the\n * payload without its last byte: a canonical encoding then runs short.\n */\nfunction isCanonical(encoded: string): boolean {\n  const bytes = Buffer.from(encoded, 'base64');\n  if (bytes.toString('base64') !== encoded) return false;\n  try {\n    decodeSignedDelegateB64(bytes.subarray(0, bytes.length - 1).toString('base64'));\n    return false;\n  } catch {\n    return true;\n  }\n}\n"]}

package/dist/cli/provider-4BQDH56Y.js

@@ -0,0 +1,396 @@
+import { MPP_PROFILE, MPP_NETWORKS, MPP_DEFAULT_NETWORK, MPP_SUPPORTED_SPEC, MPP_DEFAULT_PAYMENT_FLOW, MPP_SPEC_DRAFTS, MPP_MIN_CHALLENGE_SECRET_LENGTH, isMppNetwork } from './chunk-AA3FIEAR.js';
+import { createX402PaymentProvider, DEFAULT_IDS, parseCanonicalAmount } from './chunk-KLX2YZDG.js';
+import './chunk-NSPPEF5M.js';
+import { SETTLE_AFTER_BACKEND_METADATA_KEY } from './chunk-7JNYFUT3.js';
+import { computeReplayKey } from './chunk-OSTCU6ZK.js';
+import { CONTENT_DIGEST_METADATA_KEY } from './chunk-5K4XEAZV.js';
+import { PACKAGE_VERSION } from './chunk-FRMLWGSS.js';
+import { systemClock, CommerceError } from './chunk-QQ3WY5L3.js';
+import './chunk-3M6U7ILB.js';
+import { Challenge, Method, Receipt, Credential, PaymentRequest, Errors } from 'mppx';
+import { Methods } from 'mppx/evm';
+import { charge } from 'mppx/evm/server';
+import { parseAbi, createPublicClient, http, getAddress, isAddress } from 'viem';
+
+var VERIFICATION_REASONS = [
+  ["EVM authorization challenge hash mismatch", "wrong_nonce"],
+  ["EVM authorization signature mismatch", "invalid_signature"],
+  ["EVM authorization is not valid yet", "authorization_not_yet_valid"],
+  ["EVM authorization has expired", "authorization_expired"],
+  ["EVM authorization source mismatch", "source_mismatch"],
+  ["EVM authorization amount mismatch", "wrong_amount"],
+  ["EVM authorization recipient mismatch", "wrong_recipient"]
+];
+function verificationReason(error) {
+  if (error instanceof Errors.PaymentExpiredError) return "challenge_expired";
+  if (error instanceof Errors.InvalidPayloadError) return "invalid_payload";
+  if (error instanceof Errors.InvalidChallengeError) return "invalid_challenge";
+  if (error instanceof Errors.VerificationFailedError) {
+    const match = VERIFICATION_REASONS.find(([text]) => error.message.includes(text));
+    if (match) return match[1];
+  }
+  return "authorization_invalid";
+}
+function decodeCredential(payload) {
+  const serialized = payload.trimStart().startsWith("{") ? Credential.serialize(JSON.parse(payload)) : payload;
+  return Credential.deserialize(serialized);
+}
+function bindingMismatch(echoed, issued, resourceId) {
+  if (echoed.realm !== issued.realm) return "wrong_realm";
+  if (echoed.method !== issued.method || echoed.intent !== issued.intent) {
+    return "unsupported_method";
+  }
+  if (echoed.opaque !== PaymentRequest.serialize({ resource: resourceId })) {
+    return "wrong_resource";
+  }
+  if (echoed.digest !== void 0 && echoed.digest !== issued.digest) {
+    return "body_digest_mismatch";
+  }
+  const got = echoed.request;
+  const want = issued.request;
+  if (got.amount !== want.amount) return "wrong_amount";
+  if (!sameAddress(got.recipient, want.recipient)) return "wrong_recipient";
+  if (got.methodDetails?.chainId !== want.methodDetails?.chainId) return "wrong_network";
+  if (!sameAddress(got.currency, want.currency)) return "wrong_asset";
+  if (canonical(got.methodDetails) !== canonical(want.methodDetails)) {
+    return "unsupported_credential";
+  }
+  if (canonical(got) !== canonical(want)) return "wrong_terms";
+  return void 0;
+}
+function toX402Submission(x402Requirement, authorization) {
+  const { signature, from, to, value, validAfter, validBefore, nonce } = authorization;
+  const payment = {
+    x402Version: 2,
+    accepted: x402Requirement.challenge.accepts[0],
+    payload: { signature, authorization: { from, to, value, validAfter, validBefore, nonce } }
+  };
+  return { method: "x402", payload: Buffer.from(JSON.stringify(payment)).toString("base64") };
+}
+function canonical(value) {
+  return value === void 0 ? "" : PaymentRequest.serialize(value);
+}
+function sameAddress(a, b) {
+  return a !== void 0 && b !== void 0 && isAddress(a) && isAddress(b) ? getAddress(a) === getAddress(b) : false;
+}
+
+// src/payments/mpp/descriptor.ts
+var MPP_DESCRIPTOR = {
+  name: "mpp",
+  kind: "payment",
+  implementationVersion: PACKAGE_VERSION,
+  supportedSpec: MPP_SUPPORTED_SPEC,
+  capabilities: [
+    `intent=${MPP_PROFILE.intent}`,
+    `method=${MPP_PROFILE.method}`,
+    `credential=${MPP_PROFILE.credentialType}`,
+    "eip-3009",
+    ...MPP_NETWORKS.map((network) => `network=${network}`),
+    `asset=${MPP_PROFILE.assetSymbol}`,
+    "verify-before-settle",
+    "authorization-flow",
+    "upfront-flow",
+    "payment-receipt",
+    // HTTP request bodies only; MCP and A2A carry the proof in the body
+    "challenge-digest-binding"
+  ],
+  // The pinned specs are drafts and mppx is pre-1.0; the wire format may change
+  status: "experimental",
+  unsupported: [
+    // Name other methods as a class instead of maintaining a second list
+    "methods other than evm",
+    // This profile supports only the EIP-3009 `authorization` credential
+    "credential=permit2",
+    "credential=transaction",
+    "credential=hash",
+    // The draft allows splits only with permit2 credentials
+    "splits",
+    "intent=subscription",
+    // A separate EVM draft, not an option of charge
+    "evm sessions",
+    "discovery extension"
+  ]
+};
+function configInvalid(message) {
+  return new CommerceError("CONFIG_INVALID", message);
+}
+function validateOptions(options) {
+  if (!isAddress(options.recipient)) throw configInvalid("MPP recipient is not an EVM address");
+  if (!isAddress(options.asset)) throw configInvalid("MPP asset is not an EVM address");
+  if (options.assetName.length === 0 || options.assetVersion.length === 0) {
+    throw configInvalid("MPP asset needs its EIP-712 domain name and version");
+  }
+  if (options.realm.length === 0 || /[\r\n]/.test(options.realm)) {
+    throw configInvalid("MPP realm must be a non-empty single-line string");
+  }
+  if (options.challengeSecret.length < MPP_MIN_CHALLENGE_SECRET_LENGTH) {
+    throw configInvalid(
+      `MPP challenge secret must have length at least ${MPP_MIN_CHALLENGE_SECRET_LENGTH}`
+    );
+  }
+  const ttl = options.challengeTtlSeconds;
+  if (ttl !== void 0 && (!Number.isInteger(ttl) || ttl <= 0)) {
+    throw configInvalid("MPP challenge TTL must be a positive whole number of seconds");
+  }
+  if (options.network !== void 0 && !isMppNetwork(options.network)) {
+    throw configInvalid(`MPP network must be one of ${MPP_NETWORKS.join(", ")}`);
+  }
+}
+
+// src/payments/mpp/provider.ts
+var DEFAULT_CHALLENGE_TTL_SECONDS = 300;
+var NONCE_ALREADY_USED = "invalid_exact_evm_nonce_already_used";
+var AUTHORIZATION_STATE_ABI = parseAbi([
+  "function authorizationState(address authorizer, bytes32 nonce) view returns (bool)"
+]);
+var NONCE_READ_TIMEOUT_MS = 5e3;
+function createMppPaymentProvider(options) {
+  const { rpcUrl, facilitator, allowMainnet, allowUnauthenticatedFacilitator, logger, ...rest } = options;
+  validateOptions(rest);
+  const settlement = createX402PaymentProvider({
+    network: options.network ?? MPP_DEFAULT_NETWORK,
+    rpcUrl,
+    asset: options.asset,
+    assetName: options.assetName,
+    assetVersion: options.assetVersion,
+    assetDecimals: MPP_PROFILE.assetDecimals,
+    payTo: options.recipient,
+    facilitator,
+    ...allowMainnet !== void 0 ? { allowMainnet } : {},
+    ...allowUnauthenticatedFacilitator !== void 0 ? { allowUnauthenticatedFacilitator } : {},
+    ...logger !== void 0 ? { logger } : {},
+    ...options.clock !== void 0 ? { clock: options.clock } : {}
+  });
+  const chain = createPublicClient({
+    transport: http(rpcUrl, { timeout: NONCE_READ_TIMEOUT_MS, retryCount: 0 })
+  });
+  const nonceUsed = (payer, nonce) => chain.readContract({
+    address: options.asset,
+    abi: AUTHORIZATION_STATE_ABI,
+    functionName: "authorizationState",
+    args: [payer, nonce]
+  });
+  return createMppProviderWithSettlement(rest, settlement, nonceUsed);
+}
+function createMppProviderWithSettlement(options, settlement, nonceUsed) {
+  validateOptions(options);
+  if (settlement.name !== "x402") {
+    throw configInvalid("MPP settlement must be an x402 payment provider");
+  }
+  const network = options.network ?? MPP_DEFAULT_NETWORK;
+  const chainId = Number(network.split(":")[1]);
+  const clock = options.clock ?? systemClock;
+  const ttlSeconds = options.challengeTtlSeconds ?? DEFAULT_CHALLENGE_TTL_SECONDS;
+  const recipient = getAddress(options.recipient);
+  const asset = getAddress(options.asset);
+  const ids = options.ids ?? DEFAULT_IDS;
+  let settlementTermsChecked = false;
+  const method = charge({
+    currency: asset,
+    recipient,
+    chainId,
+    decimals: MPP_PROFILE.assetDecimals,
+    authorization: { name: options.assetName, version: options.assetVersion },
+    settle: async () => {
+      throw new CommerceError("INTERNAL_ERROR", "MPP direct broadcast is disabled");
+    }
+  });
+  function rejected(requirement, reason) {
+    return {
+      status: "rejected",
+      provider: "mpp",
+      amount: requirement.amount,
+      currency: requirement.currency,
+      network,
+      asset,
+      rejectionReason: reason
+    };
+  }
+  async function createRequirement(context) {
+    if (context.currency !== MPP_PROFILE.assetSymbol) {
+      throw configInvalid(
+        `Resource "${context.resource.id}" is priced in ${context.currency}, but MPP charges ${MPP_PROFILE.assetSymbol}`
+      );
+    }
+    if (parseCanonicalAmount(context.amount, MPP_PROFILE.assetDecimals) <= 0n) {
+      throw new CommerceError("PAYMENT_INVALID", `Amount "${context.amount}" must be above zero`, {
+        details: { amount: context.amount }
+      });
+    }
+    if (!settlementTermsChecked) {
+      await settlementRequirement(context);
+      settlementTermsChecked = true;
+    }
+    const paymentFlow = options.resourcePaymentFlows?.[context.resource.id] ?? options.paymentFlow ?? MPP_DEFAULT_PAYMENT_FLOW;
+    const expires = new Date(clock.now().getTime() + ttlSeconds * 1e3);
+    const digest = context.metadata?.[CONTENT_DIGEST_METADATA_KEY];
+    const challenge = Challenge.fromMethod(Methods.charge, {
+      secretKey: options.challengeSecret,
+      realm: options.realm,
+      expires,
+      // Present for an HTTP request with a body. MCP and A2A carry the proof
+      // in the body itself, so their challenges bind none.
+      ...typeof digest === "string" ? { digest } : {},
+      // Bound by the challenge HMAC, so a challenge for one resource cannot pay
+      // for another at the same price
+      meta: { resource: context.resource.id },
+      request: {
+        amount: context.amount,
+        currency: asset,
+        recipient,
+        chainId,
+        decimals: MPP_PROFILE.assetDecimals,
+        credentialTypes: [MPP_PROFILE.credentialType]
+      }
+    });
+    return {
+      id: ids.next("payreq"),
+      requestId: context.requestId,
+      resourceId: context.resource.id,
+      provider: "mpp",
+      amount: context.amount,
+      currency: context.currency,
+      destination: recipient,
+      network,
+      asset,
+      expiresAt: expires.toISOString(),
+      challenge: {
+        provider: "mpp",
+        version: MPP_SPEC_DRAFTS.core,
+        accepts: [challenge],
+        // Build both carrier forms here because the HTTP route and MCP
+        // adapter cannot import mppx: a header value for HTTP and challenge
+        // objects for MCP
+        envelope: { wwwAuthenticate: Challenge.serialize(challenge), challenges: [challenge] }
+      },
+      metadata: { [SETTLE_AFTER_BACKEND_METADATA_KEY]: paymentFlow === "authorization" }
+    };
+  }
+  async function verify(context) {
+    const { requirement, resource, submission } = context;
+    if (requirement.provider !== "mpp" || requirement.challenge.provider !== "mpp") {
+      return rejected(requirement, "wrong_provider");
+    }
+    const issued = requirement.challenge.accepts[0];
+    if (!issued) return rejected(requirement, "missing_challenge");
+    let credential;
+    try {
+      credential = decodeCredential(submission.payload);
+    } catch {
+      return rejected(requirement, "malformed_credential");
+    }
+    const echoed = credential.challenge;
+    if (!Challenge.verify(echoed, { secretKey: options.challengeSecret })) {
+      return rejected(requirement, "challenge_not_issued");
+    }
+    const binding = bindingMismatch(echoed, issued, resource.id);
+    if (binding) return rejected(requirement, binding);
+    if (!echoed.expires || new Date(echoed.expires).getTime() <= clock.now().getTime()) {
+      return rejected(requirement, "challenge_expired");
+    }
+    if (credential.payload?.type !== MPP_PROFILE.credentialType) {
+      return rejected(requirement, "unsupported_credential");
+    }
+    let payer;
+    try {
+      const validation = await Method.validateCredential([method], credential);
+      payer = getAddress(validation.details.payer);
+    } catch (error) {
+      return rejected(requirement, verificationReason(error));
+    }
+    const nonce = credential.payload.nonce;
+    const replayKey = computeReplayKey({ chainId, asset, from: payer, nonce });
+    const x402Verification = await settlement.verify(
+      await toX402Context(context, credential.payload)
+    );
+    if (x402Verification.status !== "verified") {
+      const reason = x402Verification.rejectionReason;
+      const spent = reason === NONCE_ALREADY_USED || (await nonceUsed?.(payer, nonce).catch(() => false) ?? false);
+      return rejected(
+        requirement,
+        spent ? "challenge_already_used" : reason ?? "settlement_rejected"
+      );
+    }
+    if (x402Verification.replayKey !== replayKey) {
+      return rejected(requirement, "settlement_mismatch");
+    }
+    return {
+      status: "verified",
+      provider: "mpp",
+      payer,
+      payee: recipient,
+      amount: requirement.amount,
+      currency: requirement.currency,
+      network,
+      asset,
+      replayKey
+    };
+  }
+  async function toX402Context(context, authorization) {
+    const { requestId, requirement, resource } = context;
+    const x402Requirement = await settlementRequirement({
+      requestId,
+      resource,
+      amount: requirement.amount,
+      currency: requirement.currency,
+      requestedAt: clock.nowIso()
+    });
+    return {
+      requestId,
+      resource,
+      requirement: x402Requirement,
+      submission: toX402Submission(x402Requirement, authorization)
+    };
+  }
+  async function settlementRequirement(context) {
+    const x402 = await settlement.createRequirement(context);
+    const extra = x402.challenge.accepts[0]?.["extra"] ?? {};
+    if (x402.network !== network || !sameAddress(x402.asset, asset) || !sameAddress(x402.destination, recipient) || extra["name"] !== options.assetName || extra["version"] !== options.assetVersion) {
+      throw configInvalid(
+        "MPP settlement provider must use the same network, asset, EIP-712 domain and recipient"
+      );
+    }
+    return x402;
+  }
+  async function settle(context) {
+    const { requestId, requirement, resource, submission, verification } = context;
+    if (verification.status !== "verified" || verification.replayKey === void 0) {
+      throw new CommerceError(
+        "PAYMENT_INVALID",
+        "MPP settle() called without a successful verify()"
+      );
+    }
+    const credential = decodeCredential(submission.payload);
+    const authorization = credential.payload;
+    const settled = await settlement.settle({
+      ...await toX402Context({ requestId, requirement, resource}, authorization),
+      verification: { ...verification, provider: "x402" }
+    });
+    const result = {
+      ...settled,
+      provider: "mpp",
+      amount: requirement.amount,
+      currency: requirement.currency,
+      replayKey: verification.replayKey
+    };
+    if (settled.status !== "settled" || settled.externalReference === void 0) return result;
+    const fields = {
+      method: MPP_PROFILE.method,
+      reference: settled.externalReference,
+      status: "success",
+      timestamp: settled.settledAt ?? clock.nowIso(),
+      challengeId: credential.challenge.id,
+      chainId
+    };
+    const receipt = Receipt.from(fields);
+    return { ...result, metadata: { ...settled.metadata, receipt: Receipt.serialize(receipt) } };
+  }
+  function health() {
+    return settlement.health();
+  }
+  return { name: "mpp", descriptor: MPP_DESCRIPTOR, createRequirement, verify, settle, health };
+}
+
+export { createMppPaymentProvider, createMppProviderWithSettlement };
+//# sourceMappingURL=provider-4BQDH56Y.js.map
+//# sourceMappingURL=provider-4BQDH56Y.js.map