@modainteract/moda-interact-shared 0.12.2 → 0.13.0

package/dist/chunk-QNANS4R4.js

@@ -0,0 +1,1027 @@
+import {
+  canonicaliseLanguageTag,
+  normalizeCurrencyCode
+} from "./chunk-B6Y3QQLI.js";
+
+// src/commerce/canonical-json.ts
+function canonicalJson(value, order = "codepoint") {
+  const seen = /* @__PURE__ */ new Set();
+  const compare = (a, b) => {
+    const aa = Array.from(a, (c) => c.codePointAt(0));
+    const bb = Array.from(b, (c) => c.codePointAt(0));
+    for (let i = 0; i < Math.min(aa.length, bb.length); i++)
+      if (aa[i] !== bb[i]) return aa[i] - bb[i];
+    return aa.length - bb.length;
+  };
+  function visit(v, depth) {
+    if (depth > 32) throw new TypeError("JSON depth exceeded");
+    if (v === null) return "null";
+    if (typeof v === "string") {
+      if (/\p{Surrogate}/u.test(v)) throw new TypeError("Invalid Unicode");
+      return JSON.stringify(v);
+    }
+    if (typeof v === "boolean") return String(v);
+    if (typeof v === "number" && Number.isFinite(v)) return JSON.stringify(v);
+    if (typeof v !== "object" || !v || seen.has(v))
+      throw new TypeError("Invalid JSON");
+    if (!Array.isArray(v) && Object.getPrototypeOf(v) !== Object.prototype && Object.getPrototypeOf(v) !== null)
+      throw new TypeError("Invalid JSON object");
+    seen.add(v);
+    let result;
+    if (Array.isArray(v)) {
+      if (Object.keys(v).length !== v.length)
+        throw new TypeError("Sparse or extended array");
+      result = "[" + v.map((item) => visit(item, depth + 1)).join(",") + "]";
+    } else {
+      const keys = Object.keys(v).sort(
+        order === "codepoint" ? compare : void 0
+      );
+      result = "{" + keys.map(
+        (k) => visit(k, depth + 1) + ":" + visit(v[k], depth + 1)
+      ).join(",") + "}";
+    }
+    seen.delete(v);
+    return result;
+  }
+  return visit(value, 0);
+}
+var jsonBytes = (value) => new TextEncoder().encode(canonicalJson(value)).length;
+var responseContractCanonicalJson = (value) => canonicalJson(value, "utf16");
+
+// src/commerce/subset.ts
+import { z } from "zod";
+var MONEY_PATTERN = "^[0-9]{1,18}(\\.[0-9]{1,6})?$";
+var safeName = (name) => /^[A-Za-z][A-Za-z0-9_]{0,63}$/.test(name) && !["__proto__", "prototype", "constructor"].includes(name);
+var safePath = (path) => path.length <= 256 && path.split(".").every(safeName);
+var keywords = [
+  "type",
+  "description",
+  "properties",
+  "required",
+  "additionalProperties",
+  "items",
+  "enum",
+  "minLength",
+  "maxLength",
+  "minimum",
+  "maximum",
+  "minItems",
+  "maxItems"
+];
+function validateSubset(value, mode) {
+  let propertyCount = 0;
+  const maxDepth = mode === "input" ? 3 : 4;
+  function walk(raw, depth) {
+    if (depth > maxDepth || !raw || typeof raw !== "object" || Array.isArray(raw))
+      return false;
+    const s = raw;
+    if (Object.keys(s).some(
+      (k) => !keywords.includes(k) && !(mode === "input" && k === "pattern")
+    ))
+      return false;
+    const nullable = Array.isArray(s.type);
+    if (nullable && (mode !== "input" || s.type.length !== 2 || s.type[1] !== "null"))
+      return false;
+    const type = typeof s.type === "string" ? s.type : s.type[0];
+    if (![
+      "object",
+      "string",
+      "integer",
+      "boolean",
+      "array",
+      ...mode === "details" ? ["number"] : []
+    ].includes(type))
+      return false;
+    if (s.description !== void 0 && (typeof s.description !== "string" || s.description.length > 1e3))
+      return false;
+    const specific = {
+      object: ["properties", "required", "additionalProperties"],
+      array: ["items", "minItems", "maxItems"],
+      string: ["minLength", "maxLength", "pattern"],
+      integer: ["minimum", "maximum"],
+      number: ["minimum", "maximum"],
+      boolean: []
+    };
+    if (Object.keys(s).some(
+      (k) => !["type", "description", "enum"].includes(k) && !specific[type].includes(k)
+    ))
+      return false;
+    if (s.enum !== void 0 && (!Array.isArray(s.enum) || s.enum.length < 1 || s.enum.length > (mode === "input" ? 32 : 20) || new Set(s.enum.map((v) => canonicalJson(v))).size !== s.enum.length || s.enum.some(
+      (v) => v === null ? !nullable : typeof v !== (type === "integer" ? "number" : type) || type === "integer" && !Number.isSafeInteger(v) || typeof v === "object"
+    )))
+      return false;
+    for (const [lo, hi] of [
+      ["minLength", "maxLength"],
+      ["minItems", "maxItems"],
+      ["minimum", "maximum"]
+    ]) {
+      if (s[lo] !== void 0 && (typeof s[lo] !== "number" || !Number.isFinite(s[lo])))
+        return false;
+      if (s[hi] !== void 0 && (typeof s[hi] !== "number" || !Number.isFinite(s[hi])))
+        return false;
+      if (lo !== "minimum" && [s[lo], s[hi]].some(
+        (v) => v !== void 0 && (!Number.isSafeInteger(v) || v < 0)
+      ))
+        return false;
+      if (s[lo] !== void 0 && s[hi] !== void 0 && s[lo] > s[hi])
+        return false;
+    }
+    if (type === "string")
+      return s.maxLength !== void 0 && s.maxLength <= 4096 && (s.pattern === void 0 || s.pattern === MONEY_PATTERN);
+    if (type === "array")
+      return s.maxItems !== void 0 && s.maxItems <= (mode === "input" ? 100 : 20) && walk(s.items, depth + 1);
+    if (type === "object") {
+      if (s.additionalProperties !== false || !s.properties || typeof s.properties !== "object" || Array.isArray(s.properties))
+        return false;
+      const names = Object.keys(s.properties);
+      propertyCount += names.length;
+      if (propertyCount > 32 || names.some((n) => !safeName(n)) || s.required !== void 0 && (!Array.isArray(s.required) || new Set(s.required).size !== s.required.length || s.required.some((n) => !names.includes(n))))
+        return false;
+      return Object.values(s.properties).every(
+        (child) => walk(child, depth + 1)
+      );
+    }
+    return true;
+  }
+  try {
+    return jsonBytes(value) <= 32768 && walk(value, 1) && value.type === "object";
+  } catch {
+    return false;
+  }
+}
+var InputSchemaSchema = z.custom(
+  (v) => validateSubset(v, "input")
+);
+var DetailsSchemaSchema = z.custom(
+  (v) => validateSubset(v, "details")
+);
+function matchesSubset(schema, value) {
+  const nullable = Array.isArray(schema.type);
+  const type = typeof schema.type === "string" ? schema.type : schema.type[0];
+  if (value === null)
+    return nullable && (!schema.enum || schema.enum.includes(null));
+  if (schema.enum && !schema.enum.includes(value)) return false;
+  if (type === "string")
+    return typeof value === "string" && value.length >= (schema.minLength ?? 0) && value.length <= schema.maxLength && (!schema.pattern || new RegExp(schema.pattern).test(value));
+  if (type === "boolean") return typeof value === "boolean";
+  if (type === "integer" || type === "number")
+    return typeof value === "number" && Number.isFinite(value) && (type !== "integer" || Number.isSafeInteger(value)) && value >= (schema.minimum ?? -Infinity) && value <= (schema.maximum ?? Infinity);
+  if (type === "array")
+    return Array.isArray(value) && value.length >= (schema.minItems ?? 0) && value.length <= schema.maxItems && value.every((v) => matchesSubset(schema.items, v));
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const obj = value;
+  return Object.keys(obj).every((k) => Object.hasOwn(schema.properties, k)) && (schema.required ?? []).every((k) => Object.hasOwn(obj, k)) && Object.entries(obj).every(
+    ([k, v]) => matchesSubset(schema.properties[k], v)
+  );
+}
+function compileSubset(schema, mode) {
+  if (!validateSubset(schema, mode)) throw new TypeError("Unsupported schema");
+  return z.custom((value) => {
+    try {
+      return jsonBytes(value) <= (mode === "details" ? 16384 : 131072) && matchesSubset(schema, value);
+    } catch {
+      return false;
+    }
+  });
+}
+
+// src/commerce/primitives.ts
+import { z as z2 } from "zod";
+var ContractVersionSchema = z2.literal("commerce.v1");
+var IdSchema = z2.string().min(1).max(128).refine(
+  (v) => v.trim() === v && !["standalone", "product-only", "unknown-shop"].includes(v)
+);
+var SemverSchema = z2.string().max(64).regex(/^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/);
+var HashSchema = z2.string().regex(/^[a-f0-9]{64}$/);
+var DateSchema = z2.iso.datetime({ offset: false });
+var MoneySchema = z2.string().regex(/^[0-9]{1,18}(\.[0-9]{1,6})?$/);
+var CurrencySchema = z2.string().refine((v) => {
+  try {
+    return normalizeCurrencyCode(v) === v;
+  } catch {
+    return false;
+  }
+});
+var LanguageSchema = z2.string().max(128).refine((v) => {
+  try {
+    return canonicaliseLanguageTag(v) === v;
+  } catch {
+    return false;
+  }
+});
+var distinct = (values) => new Set(values).size === values.length;
+var boundedJson = (bytes) => z2.unknown().refine((v) => {
+  try {
+    return jsonBytes(v) <= bytes;
+  } catch {
+    return false;
+  }
+});
+
+// src/commerce/definitions.ts
+import { z as z3 } from "zod";
+import { gt } from "semver";
+var ToolNameSchema = z3.string().regex(/^[a-z][a-z0-9_]{0,127}$/).refine((n) => n !== "finalResponse");
+var ToolBindingSchema = z3.strictObject({
+  toolId: IdSchema,
+  toolRevisionId: IdSchema
+});
+var ToolBindingsSchema = z3.array(ToolBindingSchema).max(32).refine((v) => distinct(v.map((x) => x.toolId)));
+var GrantedToolSchema = z3.strictObject({
+  toolId: IdSchema,
+  toolRevisionId: IdSchema,
+  toolName: ToolNameSchema,
+  definitionVersion: SemverSchema,
+  capabilityKeys: z3.array(IdSchema).min(1).max(32).refine((v) => distinct(v) && v.join("\0") === [...v].sort().join("\0"))
+});
+var GrantedToolsSchema = z3.array(GrantedToolSchema).max(32).refine(
+  (v) => distinct(v.map((x) => x.toolId)) && distinct(v.map((x) => x.toolName))
+);
+var ToolDescriptorSchema = z3.strictObject({
+  toolId: IdSchema,
+  toolRevisionId: IdSchema,
+  name: ToolNameSchema,
+  definitionVersion: SemverSchema,
+  description: z3.string().min(1).max(4096),
+  inputSchema: InputSchemaSchema
+});
+var MappingSchema = z3.union([
+  z3.strictObject({
+    input: z3.string().refine(safeName),
+    omitIfMissing: z3.literal(true).optional()
+  }),
+  z3.strictObject({ literal: boundedJson(8192) })
+]);
+var MappingsSchema = z3.record(z3.string().refine(safeName), MappingSchema).refine((v) => Object.keys(v).length <= 32);
+var POLICY_OPERATIONS = [
+  "recovery.getBasket",
+  "shopify.searchProducts",
+  "discounts.getOptions",
+  "discounts.evaluate",
+  "products.findQualifying",
+  "products.findSimilar"
+];
+var CommerceExecutionSchema = z3.discriminatedUnion("kind", [
+  z3.strictObject({
+    kind: z3.literal("SHOPIFY_STOREFRONT_QUERY"),
+    executorVersion: z3.literal("1.0.0"),
+    apiVersion: z3.literal("2026-07"),
+    schemaHash: HashSchema,
+    document: z3.string().min(1).refine((v) => new TextEncoder().encode(v).length <= 16384),
+    operationName: z3.string().refine(safeName),
+    variables: MappingsSchema,
+    resultPath: z3.string().refine(safePath)
+  }),
+  z3.strictObject({
+    kind: z3.literal("POLICY_OPERATION"),
+    operation: z3.enum(POLICY_OPERATIONS),
+    operationVersion: z3.literal("1.0.0"),
+    arguments: MappingsSchema
+  })
+]);
+function tokensValid(text, root) {
+  if (/[<>]/.test(text)) return false;
+  const residue = text.replace(
+    /\{\{([^{}]+)\}\}/g,
+    (_all, path) => path.startsWith(root + ".") && safePath(path.slice(root.length + 1)) ? "" : "{{invalid}}"
+  );
+  return !residue.includes("{{") && !residue.includes("}}");
+}
+var fixed = z3.string().max(4096).refine((v) => !/[<>]|\{\{|\}\}/.test(v));
+var ResponseTemplateSchema = z3.discriminatedUnion("kind", [
+  z3.strictObject({
+    kind: z3.literal("text"),
+    text: z3.string().max(4096).refine((v) => tokensValid(v, "result")),
+    unavailable: fixed
+  }),
+  z3.strictObject({
+    kind: z3.literal("items"),
+    itemsPath: z3.string().refine(safePath),
+    item: z3.string().max(4096).refine((v) => tokensValid(v, "item")),
+    empty: fixed,
+    unavailable: fixed
+  })
+]);
+var identity = {
+  name: ToolNameSchema,
+  definitionVersion: SemverSchema,
+  description: z3.string().min(1).max(4096)
+};
+var forbiddenInput = /^(shopid|customerid|checkoutrecoveryid|conversationid|grantid|releaseid|token|accesstoken|domain|headers|url|graphql|document|authorization)$/i;
+var CommerceToolDefinitionSchema = z3.strictObject({
+  ...identity,
+  inputSchema: InputSchemaSchema,
+  execution: CommerceExecutionSchema,
+  responseTemplate: ResponseTemplateSchema
+}).superRefine((d, ctx) => {
+  const properties = d.inputSchema.properties;
+  const containsAuthority = (schema) => Object.entries(schema.properties ?? {}).some(
+    ([name, child]) => forbiddenInput.test(name) || containsAuthority(child)
+  ) || !!(schema.items && containsAuthority(schema.items));
+  if (containsAuthority(d.inputSchema))
+    ctx.addIssue({
+      code: "custom",
+      message: "Authority/credential inputs are forbidden"
+    });
+  const mapping = d.execution.kind === "POLICY_OPERATION" ? d.execution.arguments : d.execution.variables;
+  for (const [name, m] of Object.entries(mapping))
+    if ("input" in m && !Object.hasOwn(properties, m.input))
+      ctx.addIssue({
+        code: "custom",
+        path: ["execution", name],
+        message: "Unknown mapped input"
+      });
+});
+var draftObject = boundedJson(65536).refine(
+  (v) => !!v && typeof v === "object" && !Array.isArray(v)
+);
+var CommerceToolDraftDefinitionSchema = z3.strictObject({
+  ...identity,
+  inputSchema: draftObject,
+  execution: draftObject,
+  responseTemplate: draftObject
+}).refine((v) => new TextEncoder().encode(canonicalJson(v)).length <= 131072);
+function at(schema, path) {
+  let current = schema;
+  for (const part of path.split(".")) current = current?.properties?.[part];
+  return current;
+}
+function validateDefinitionForPublication(raw, compiler) {
+  const definition = CommerceToolDefinitionSchema.parse(raw);
+  const compiled = compiler.compile(
+    definition.execution,
+    definition.inputSchema
+  );
+  if (!compiled.validateMappedArguments(definition.execution))
+    throw new TypeError("Invalid variable/operation mapping");
+  const template = definition.responseTemplate;
+  const schema = template.kind === "text" ? compiled.outputSchema : at(compiled.outputSchema, template.itemsPath)?.items;
+  if (!schema) throw new TypeError("Unknown template items path");
+  const text = template.kind === "text" ? template.text : template.item;
+  for (const match of text.matchAll(/\{\{(?:result|item)\.([^{}]+)\}\}/g)) {
+    const target = at(schema, match[1]);
+    const type = target && (Array.isArray(target.type) ? target.type[0] : target.type);
+    if (!type || ["object", "array"].includes(type))
+      throw new TypeError("Unknown or nonscalar template path");
+  }
+  return definition;
+}
+function definitionToMcpDescriptor(definition) {
+  const d = CommerceToolDefinitionSchema.parse(definition);
+  return {
+    name: d.name,
+    description: d.description,
+    inputSchema: d.inputSchema
+  };
+}
+function mapToolArguments(definition, raw) {
+  const input = compileSubset(definition.inputSchema, "input").parse(raw);
+  const mapping = definition.execution.kind === "POLICY_OPERATION" ? definition.execution.arguments : definition.execution.variables;
+  const result = /* @__PURE__ */ Object.create(null);
+  for (const [key, m] of Object.entries(mapping)) {
+    if ("literal" in m) result[key] = m.literal;
+    else if (Object.hasOwn(input, m.input)) result[key] = input[m.input];
+    else if (!m.omitIfMissing) throw new TypeError("Missing mapped input");
+  }
+  return result;
+}
+var toolHashInput = (definition) => ({
+  contractVersion: ContractVersionSchema.value,
+  definition: CommerceToolDefinitionSchema.parse(definition)
+});
+function capabilityHashInput(promptTemplate, configuration, toolBindings) {
+  if (!promptTemplate.trim() || promptTemplate.length > 32e3)
+    throw new TypeError("Invalid capability prompt");
+  return {
+    contractVersion: ContractVersionSchema.value,
+    promptTemplate,
+    configuration,
+    toolBindings: ToolBindingsSchema.parse(toolBindings).sort(
+      (a, b) => a.toolId < b.toolId ? -1 : 1
+    )
+  };
+}
+function validateDefinitionVersion(proposed, highestPublished) {
+  SemverSchema.parse(proposed);
+  if (highestPublished === null) return proposed === "1.0.0";
+  SemverSchema.parse(highestPublished);
+  return gt(proposed, highestPublished);
+}
+var CommerceToolIdentitySchema = z3.strictObject({
+  id: IdSchema,
+  name: ToolNameSchema,
+  enabled: z3.boolean()
+});
+var CommerceToolRevisionIdentitySchema = z3.strictObject({
+  toolId: IdSchema,
+  toolRevisionId: IdSchema,
+  definitionVersion: SemverSchema,
+  contentHash: HashSchema
+});
+var POLICY_OPERATION_DESCRIPTORS = POLICY_OPERATIONS.map(
+  (operation) => ({ operation, operationVersion: "1.0.0" })
+);
+
+// src/commerce/response.ts
+import { z as z4 } from "zod";
+var CommerceResponseContractSchema = z4.strictObject({
+  version: z4.literal("response.v1"),
+  instructions: z4.string().min(1).max(8e3),
+  detailsSchema: DetailsSchemaSchema
+}).refine((v) => jsonBytes(v) <= 32768);
+var EMPTY_RESPONSE_CONTRACT = {
+  version: "response.v1",
+  instructions: "Write a concise, natural WhatsApp reply supported by the available facts. Return an empty details object.",
+  detailsSchema: {
+    type: "object",
+    properties: {},
+    required: [],
+    additionalProperties: false
+  }
+};
+var ReferralReasonSchema = z4.enum([
+  "INSUFFICIENT_TOOLS",
+  "UNVERIFIABLE_FACTS",
+  "TOOL_UNAVAILABLE",
+  "TOOL_REVOKED"
+]);
+var CommerceFinalResponseSchema = z4.strictObject({
+  answerKind: z4.enum(["ANSWER", "REFER_TO_STORE"]),
+  replyText: z4.string().min(1).max(4096),
+  referralReason: ReferralReasonSchema.nullable(),
+  detectedLanguageTag: LanguageSchema.nullable(),
+  detectedLanguageConfidence: z4.number().min(0).max(1).nullable(),
+  evidenceIds: z4.array(IdSchema).max(3).refine((v) => new Set(v).size === v.length),
+  details: z4.record(z4.string(), z4.unknown()).refine((v) => {
+    try {
+      return jsonBytes(v) <= 16384;
+    } catch {
+      return false;
+    }
+  })
+}).superRefine((v, ctx) => {
+  if (v.detectedLanguageTag === null !== (v.detectedLanguageConfidence === null))
+    ctx.addIssue({
+      code: "custom",
+      message: "Language metadata must be a complete pair"
+    });
+  if (v.answerKind === "ANSWER" ? v.referralReason !== null : v.referralReason === null || v.evidenceIds.length > 0 || Object.keys(v.details).length > 0)
+    ctx.addIssue({
+      code: "custom",
+      message: "Invalid answer/referral envelope"
+    });
+});
+function finalResponseSchema(definition) {
+  const contract = CommerceResponseContractSchema.parse(definition);
+  const details = compileSubset(contract.detailsSchema, "details");
+  return CommerceFinalResponseSchema.refine(
+    (v) => v.answerKind === "REFER_TO_STORE" || details.safeParse(v.details).success,
+    { message: "Details do not match pinned contract" }
+  );
+}
+function verifyResponseContract(definition, hash, digest) {
+  const parsed = CommerceResponseContractSchema.parse(definition);
+  if (!/^[a-f0-9]{64}$/.test(hash) || digest(responseContractCanonicalJson(parsed)) !== hash)
+    throw new TypeError("Incompatible response contract");
+  return parsed;
+}
+function finalResponseToolSchema(definition) {
+  const contract = CommerceResponseContractSchema.parse(definition);
+  const properties = {
+    answerKind: { enum: ["ANSWER", "REFER_TO_STORE"] },
+    replyText: { type: "string", minLength: 1, maxLength: 4096 },
+    referralReason: {
+      enum: [
+        null,
+        "INSUFFICIENT_TOOLS",
+        "UNVERIFIABLE_FACTS",
+        "TOOL_UNAVAILABLE",
+        "TOOL_REVOKED"
+      ]
+    },
+    detectedLanguageTag: { type: ["string", "null"], maxLength: 128 },
+    detectedLanguageConfidence: {
+      type: ["number", "null"],
+      minimum: 0,
+      maximum: 1
+    },
+    evidenceIds: {
+      type: "array",
+      maxItems: 3,
+      uniqueItems: true,
+      items: { type: "string", maxLength: 128 }
+    },
+    details: { type: "object" }
+  };
+  return {
+    type: "object",
+    additionalProperties: false,
+    properties,
+    required: Object.keys(properties),
+    allOf: [
+      {
+        oneOf: [
+          {
+            properties: {
+              answerKind: { const: "ANSWER" },
+              referralReason: { type: "null" },
+              details: contract.detailsSchema
+            }
+          },
+          {
+            properties: {
+              answerKind: { const: "REFER_TO_STORE" },
+              referralReason: { enum: ReferralReasonSchema.options },
+              evidenceIds: { maxItems: 0 },
+              details: {
+                type: "object",
+                properties: {},
+                additionalProperties: false
+              }
+            }
+          }
+        ]
+      },
+      {
+        oneOf: [
+          {
+            properties: {
+              detectedLanguageTag: { type: "null" },
+              detectedLanguageConfidence: { type: "null" }
+            }
+          },
+          {
+            properties: {
+              detectedLanguageTag: { type: "string" },
+              detectedLanguageConfidence: { type: "number" }
+            }
+          }
+        ]
+      }
+    ]
+  };
+}
+
+// src/commerce/schemas.ts
+import { z as z5 } from "zod";
+import { validRange } from "semver";
+var CommerceTurnIdentitySchema = z5.strictObject({
+  contractVersion: ContractVersionSchema,
+  shopId: IdSchema,
+  checkoutRecoveryId: IdSchema,
+  conversationId: IdSchema,
+  inboundVersion: z5.number().int().positive()
+});
+var CommerceConversationGrantSchema = z5.strictObject({
+  id: IdSchema,
+  shopId: IdSchema,
+  conversationId: IdSchema,
+  initialInboundVersion: z5.number().int().positive(),
+  releaseId: IdSchema,
+  selectedCapabilityKeys: z5.array(IdSchema).min(1).max(32).refine((v) => distinct(v) && v.includes("conversation_core")),
+  grantedTools: GrantedToolsSchema,
+  runnerVersion: SemverSchema,
+  createdAt: DateSchema,
+  expiresAt: DateSchema.nullable()
+}).superRefine((v, c) => {
+  if (v.expiresAt && Date.parse(v.expiresAt) <= Date.parse(v.createdAt))
+    c.addIssue({ code: "custom", message: "Invalid grant retention date" });
+  if (jsonBytes(v.grantedTools) > 65536 || jsonBytes(v.selectedCapabilityKeys) > 8192 || v.grantedTools.some(
+    (t) => t.capabilityKeys.some((k) => !v.selectedCapabilityKeys.includes(k))
+  ))
+    c.addIssue({ code: "custom", message: "Unselected grant provenance" });
+});
+var CommerceConfigurationSchema = z5.strictObject({
+  maxRecommendations: z5.number().int().min(1).max(3).optional(),
+  maxSearchResults: z5.number().int().min(1).max(20).optional()
+});
+var CommerceManifestSchema = z5.strictObject({
+  contractVersion: ContractVersionSchema,
+  releaseId: IdSchema,
+  runnerCompatibility: z5.string().min(1).max(128).refine((v) => !!validRange(v)),
+  capabilities: z5.array(
+    z5.strictObject({
+      key: IdSchema,
+      revisionId: IdSchema,
+      position: z5.number().int().nonnegative(),
+      promptName: z5.string().min(1).max(512),
+      configuration: CommerceConfigurationSchema,
+      toolDescriptors: z5.array(ToolDescriptorSchema).max(32)
+    })
+  ).min(1).max(32),
+  selectedCapabilityKeys: z5.array(IdSchema).min(1).max(32).refine(distinct),
+  grantedTools: GrantedToolsSchema,
+  responseContract: CommerceResponseContractSchema,
+  responseContractHash: HashSchema
+}).superRefine((v, c) => {
+  if (jsonBytes(v) > 262144)
+    c.addIssue({ code: "custom", message: "Manifest exceeds output limit" });
+  const keys = v.capabilities.map((x) => x.key);
+  if (!distinct(keys) || !keys.includes("conversation_core") || JSON.stringify(keys) !== JSON.stringify(v.selectedCapabilityKeys) || v.capabilities.some(
+    (x, i) => i > 0 && x.position <= v.capabilities[i - 1].position
+  ))
+    c.addIssue({
+      code: "custom",
+      message: "Invalid capability ordering/selection"
+    });
+  const union = /* @__PURE__ */ new Map();
+  for (const cap of v.capabilities) {
+    if (cap.promptName !== `commerce/${v.releaseId}/${cap.key}/${cap.revisionId}`)
+      c.addIssue({ code: "custom", message: "Prompt identity mismatch" });
+    for (const d of cap.toolDescriptors) {
+      const old = union.get(d.toolId);
+      const descriptor = canonicalJson(d);
+      if (old) {
+        if (old.descriptor !== descriptor)
+          c.addIssue({
+            code: "custom",
+            message: "Conflicting tool revisions/descriptors"
+          });
+        old.tool.capabilityKeys.push(cap.key);
+      } else
+        union.set(d.toolId, {
+          descriptor,
+          tool: {
+            toolId: d.toolId,
+            toolRevisionId: d.toolRevisionId,
+            toolName: d.name,
+            definitionVersion: d.definitionVersion,
+            capabilityKeys: [cap.key]
+          }
+        });
+    }
+  }
+  if (union.size !== v.grantedTools.length || v.grantedTools.some((t) => {
+    const expected = union.get(t.toolId)?.tool;
+    return !expected || expected.toolRevisionId !== t.toolRevisionId || expected.toolName !== t.toolName || expected.definitionVersion !== t.definitionVersion || JSON.stringify([...new Set(expected.capabilityKeys)].sort()) !== JSON.stringify(t.capabilityKeys);
+  }))
+    c.addIssue({
+      code: "custom",
+      message: "Grant must equal selected binding union"
+    });
+});
+var CommerceReleaseIdentitySchema = z5.strictObject({
+  contractVersion: ContractVersionSchema,
+  releaseId: IdSchema,
+  runnerCompatibility: z5.string().min(1).max(128).refine((v) => !!validRange(v))
+});
+var CommerceResolveAssertionSchema = CommerceTurnIdentitySchema.extend(
+  { purpose: z5.literal("resolve") }
+);
+var CommerceExecuteAssertionSchema = CommerceTurnIdentitySchema.extend(
+  { purpose: z5.literal("execute"), grantId: IdSchema, releaseId: IdSchema }
+);
+var CommerceAssertionSchema = z5.discriminatedUnion("purpose", [
+  CommerceResolveAssertionSchema,
+  CommerceExecuteAssertionSchema
+]);
+var qty = z5.number().int().min(1).max(999);
+var CommerceProposalSchema = z5.strictObject({
+  operations: z5.array(
+    z5.discriminatedUnion("kind", [
+      z5.strictObject({
+        kind: z5.literal("ADD"),
+        variantId: IdSchema,
+        quantity: qty
+      }),
+      z5.strictObject({
+        kind: z5.literal("REPLACE"),
+        lineId: IdSchema,
+        variantId: IdSchema,
+        quantity: qty
+      })
+    ])
+  ).min(1).max(3)
+}).refine(
+  (v) => distinct(
+    v.operations.flatMap((o) => o.kind === "REPLACE" ? [o.lineId] : [])
+  )
+);
+var CommerceBasketSchema = z5.strictObject({
+  basketId: IdSchema,
+  source: z5.enum(["RECOVERY_SNAPSHOT", "PROPOSED"]),
+  observedAt: DateSchema,
+  currency: CurrencySchema.nullable(),
+  lines: z5.array(
+    z5.strictObject({
+      lineId: IdSchema,
+      productId: IdSchema.nullable(),
+      variantId: IdSchema.nullable(),
+      quantity: qty.nullable(),
+      unitPrice: MoneySchema.nullable()
+    })
+  ).max(100),
+  fingerprint: HashSchema,
+  unknownFields: z5.array(z5.string().min(1).max(256)).max(128)
+}).refine((v) => distinct(v.lines.map((line) => line.lineId)));
+var CommerceProductSchema = z5.strictObject({
+  productId: IdSchema,
+  variantId: IdSchema,
+  title: z5.string().min(1).max(512),
+  url: z5.url({ protocol: /^https$/ }).refine((v) => {
+    const u = new URL(v);
+    return !u.username && !u.password && !u.port;
+  }).nullable(),
+  available: z5.boolean().nullable(),
+  unitPrice: MoneySchema.nullable(),
+  currency: CurrencySchema.nullable(),
+  productType: z5.string().max(512).nullable(),
+  vendor: z5.string().max(512).nullable(),
+  observedAt: DateSchema
+});
+var CommerceOfferSchema = z5.strictObject({
+  offerId: IdSchema,
+  title: z5.string().min(1).max(512),
+  method: z5.enum(["AUTOMATIC", "CODE"]),
+  code: z5.string().min(1).max(128).nullable(),
+  startsAt: DateSchema.nullable(),
+  endsAt: DateSchema.nullable(),
+  support: z5.enum(["SUPPORTED", "UNSUPPORTED", "UNKNOWN"]),
+  reasonCodes: z5.array(z5.string().min(1).max(64)).max(16)
+}).refine(
+  (v) => (v.startsAt === null || v.endsAt === null || Date.parse(v.startsAt) < Date.parse(v.endsAt)) && (v.method !== "AUTOMATIC" || v.code === null)
+);
+var condition = z5.strictObject({
+  code: z5.string().min(1).max(64),
+  description: z5.string().max(256)
+});
+var CommerceEvidenceSchema = z5.strictObject({
+  evidenceId: HashSchema,
+  turn: CommerceTurnIdentitySchema,
+  grantId: IdSchema,
+  releaseId: IdSchema,
+  offerId: IdSchema,
+  proposal: CommerceProposalSchema.nullable(),
+  basketFingerprint: HashSchema,
+  ruleFingerprint: HashSchema,
+  evaluatedAt: DateSchema,
+  expiresAt: DateSchema,
+  outcome: z5.enum([
+    "QUALIFIES_FOR_KNOWN_RULES",
+    "DOES_NOT_QUALIFY",
+    "UNKNOWN",
+    "UNSUPPORTED"
+  ]),
+  currency: CurrencySchema.nullable(),
+  savings: MoneySchema.nullable(),
+  resultingTotal: MoneySchema.nullable(),
+  evaluatedConditions: z5.array(condition).max(32),
+  unresolvedConditions: z5.array(condition).max(32)
+}).superRefine((v, c) => {
+  if (Date.parse(v.expiresAt) - Date.parse(v.evaluatedAt) > 6e4)
+    c.addIssue({
+      code: "custom",
+      message: "Evidence lifetime exceeds ceiling"
+    });
+  if (v.outcome === "QUALIFIES_FOR_KNOWN_RULES" && (v.unresolvedConditions.length || Date.parse(v.expiresAt) <= Date.parse(v.evaluatedAt) || v.currency === null || v.savings === null || v.resultingTotal === null))
+    c.addIssue({ code: "custom", message: "Unsupported qualifying claim" });
+});
+var CommerceAlternativeSchema = z5.strictObject({
+  product: CommerceProductSchema,
+  proposal: CommerceProposalSchema,
+  extraSpend: MoneySchema.nullable(),
+  resultingTotal: MoneySchema.nullable(),
+  currency: CurrencySchema.nullable(),
+  evidence: CommerceEvidenceSchema.nullable(),
+  similarityReasons: z5.array(z5.string().max(256)).max(3)
+}).refine((v) => v.product.available === true);
+var CommerceErrorCodeSchema = z5.enum([
+  "INVALID_INPUT",
+  "DENIED",
+  "STALE_TURN",
+  "NOT_FOUND",
+  "UNAVAILABLE",
+  "THROTTLED",
+  "DEADLINE",
+  "INCOMPATIBLE_VERSION"
+]);
+function commerceToolResultSchema(data) {
+  return z5.union([
+    z5.strictObject({
+      contractVersion: ContractVersionSchema,
+      status: z5.literal("OK"),
+      data,
+      renderedText: z5.string().max(4096)
+    }),
+    z5.strictObject({
+      contractVersion: ContractVersionSchema,
+      status: z5.literal("ERROR"),
+      code: CommerceErrorCodeSchema,
+      retryable: z5.boolean(),
+      renderedText: z5.string().max(4096).optional()
+    })
+  ]);
+}
+var CommerceToolResultSchema = commerceToolResultSchema(
+  boundedJson(262144)
+);
+var limit = z5.number().int().min(1).max(3).default(3);
+var CommerceToolInputs = {
+  commerce_get_basket: z5.strictObject({}),
+  commerce_search_products: z5.strictObject({
+    query: z5.string().min(1).max(200),
+    maximumPrice: MoneySchema.optional(),
+    availableOnly: z5.boolean().default(true),
+    limit: z5.number().int().min(1).max(20).default(10),
+    cursor: z5.string().max(2048).nullable().default(null)
+  }),
+  commerce_get_discount_options: z5.strictObject({}),
+  commerce_evaluate_discount: z5.strictObject({
+    offerId: IdSchema,
+    proposal: CommerceProposalSchema.nullable()
+  }),
+  commerce_find_qualifying_products: z5.strictObject({
+    offerId: IdSchema,
+    query: z5.string().min(1).max(200).nullable(),
+    limit
+  }),
+  commerce_find_similar_products: z5.strictObject({
+    variantId: IdSchema,
+    offerId: IdSchema.nullable(),
+    limit
+  })
+};
+var alternatives = z5.strictObject({
+  alternatives: z5.array(CommerceAlternativeSchema).max(3),
+  truncated: z5.boolean()
+});
+var CommerceToolOutputs = {
+  commerce_get_basket: CommerceBasketSchema,
+  commerce_search_products: z5.strictObject({
+    products: z5.array(CommerceProductSchema).max(20),
+    cursor: z5.string().max(2048).nullable(),
+    truncated: z5.boolean()
+  }),
+  commerce_get_discount_options: z5.strictObject({
+    mode: z5.enum(["NONE", "FIXED", "AI_BEST_APPLICABLE"]),
+    offers: z5.array(CommerceOfferSchema).max(50),
+    truncated: z5.boolean()
+  }),
+  commerce_evaluate_discount: CommerceEvidenceSchema,
+  commerce_find_qualifying_products: alternatives,
+  commerce_find_similar_products: alternatives
+};
+function productBelongsToDomain(product, verifiedDomain) {
+  try {
+    return product.url === null || new URL(product.url).hostname === verifiedDomain;
+  } catch {
+    return false;
+  }
+}
+
+// src/commerce/selection.ts
+import { z as z6 } from "zod";
+var CommerceCapabilityBindingSchema = z6.discriminatedUnion("kind", [
+  z6.strictObject({
+    kind: z6.literal("BASE"),
+    key: z6.literal("conversation_core")
+  }),
+  z6.strictObject({
+    kind: z6.literal("FEATURE"),
+    key: IdSchema,
+    featureId: IdSchema
+  }),
+  z6.strictObject({
+    kind: z6.literal("RECOVERY_POLICY"),
+    key: z6.literal("discount_assistance")
+  })
+]);
+function selectCapabilities(candidates, facts) {
+  const selected = candidates.filter((c) => {
+    const b = CommerceCapabilityBindingSchema.parse(c.binding);
+    if (!c.enabled) return false;
+    if (b.kind === "BASE") return true;
+    if (b.kind === "RECOVERY_POLICY")
+      return facts.offerMode === "FIXED" || facts.offerMode === "AI_BEST_APPLICABLE";
+    const f = facts.features.find((f2) => f2.id === b.featureId);
+    return !!f && f.active && f.planMappingEnabled && (f.mode === "ALWAYS_ENABLED" || f.preferenceEnabled === true);
+  }).sort((a, b) => a.position - b.position);
+  if (!selected.some((c) => c.binding.kind === "BASE"))
+    throw new TypeError("Base capability unavailable");
+  if (new Set(selected.map((c) => c.binding.key)).size !== selected.length || new Set(selected.map((c) => c.position)).size !== selected.length)
+    throw new TypeError("Duplicate release membership");
+  return selected.map((c) => c.binding.key);
+}
+function deduplicateTools(capabilities) {
+  const byId = /* @__PURE__ */ new Map();
+  const names = /* @__PURE__ */ new Map();
+  for (const cap of capabilities)
+    for (const d of cap.toolDescriptors) {
+      const previous = byId.get(d.toolId);
+      const descriptor = canonicalJson(d);
+      if (previous && previous.descriptor !== descriptor || names.has(d.name) && names.get(d.name) !== d.toolId)
+        throw new TypeError("Conflicting tool association");
+      names.set(d.name, d.toolId);
+      if (previous)
+        previous.tool.capabilityKeys = [
+          .../* @__PURE__ */ new Set([...previous.tool.capabilityKeys, cap.key])
+        ].sort();
+      else
+        byId.set(d.toolId, {
+          descriptor,
+          tool: {
+            toolId: d.toolId,
+            toolRevisionId: d.toolRevisionId,
+            toolName: d.name,
+            definitionVersion: d.definitionVersion,
+            capabilityKeys: [cap.key]
+          }
+        });
+    }
+  return [...byId.values()].map((v) => v.tool).sort((a, b) => a.toolName.localeCompare(b.toolName, "en"));
+}
+function manifestMatchesGrant(manifest, grant) {
+  return manifest.releaseId === grant.releaseId && canonicalJson(manifest.selectedCapabilityKeys) === canonicalJson(grant.selectedCapabilityKeys) && canonicalJson(
+    [...manifest.grantedTools].sort(
+      (a, b) => a.toolId.localeCompare(b.toolId)
+    )
+  ) === canonicalJson(
+    [...grant.grantedTools].sort(
+      (a, b) => a.toolId.localeCompare(b.toolId)
+    )
+  );
+}
+var parseCommerceManifest = (raw) => CommerceManifestSchema.parse(raw);
+function currentlyGrantedTools(grant, eligibleCapabilityKeys, enabledToolIds) {
+  return grant.grantedTools.filter(
+    (t) => enabledToolIds.has(t.toolId) && t.capabilityKeys.some((k) => eligibleCapabilityKeys.has(k))
+  );
+}
+
+export {
+  canonicalJson,
+  jsonBytes,
+  responseContractCanonicalJson,
+  MONEY_PATTERN,
+  safeName,
+  safePath,
+  validateSubset,
+  InputSchemaSchema,
+  DetailsSchemaSchema,
+  matchesSubset,
+  compileSubset,
+  ContractVersionSchema,
+  IdSchema,
+  SemverSchema,
+  HashSchema,
+  DateSchema,
+  MoneySchema,
+  CurrencySchema,
+  LanguageSchema,
+  distinct,
+  boundedJson,
+  ToolNameSchema,
+  ToolBindingSchema,
+  ToolBindingsSchema,
+  GrantedToolSchema,
+  GrantedToolsSchema,
+  ToolDescriptorSchema,
+  POLICY_OPERATIONS,
+  CommerceExecutionSchema,
+  ResponseTemplateSchema,
+  CommerceToolDefinitionSchema,
+  CommerceToolDraftDefinitionSchema,
+  validateDefinitionForPublication,
+  definitionToMcpDescriptor,
+  mapToolArguments,
+  toolHashInput,
+  capabilityHashInput,
+  validateDefinitionVersion,
+  CommerceToolIdentitySchema,
+  CommerceToolRevisionIdentitySchema,
+  POLICY_OPERATION_DESCRIPTORS,
+  CommerceResponseContractSchema,
+  EMPTY_RESPONSE_CONTRACT,
+  ReferralReasonSchema,
+  CommerceFinalResponseSchema,
+  finalResponseSchema,
+  verifyResponseContract,
+  finalResponseToolSchema,
+  CommerceTurnIdentitySchema,
+  CommerceConversationGrantSchema,
+  CommerceConfigurationSchema,
+  CommerceManifestSchema,
+  CommerceReleaseIdentitySchema,
+  CommerceResolveAssertionSchema,
+  CommerceExecuteAssertionSchema,
+  CommerceAssertionSchema,
+  CommerceProposalSchema,
+  CommerceBasketSchema,
+  CommerceProductSchema,
+  CommerceOfferSchema,
+  CommerceEvidenceSchema,
+  CommerceAlternativeSchema,
+  CommerceErrorCodeSchema,
+  commerceToolResultSchema,
+  CommerceToolResultSchema,
+  CommerceToolInputs,
+  CommerceToolOutputs,
+  productBelongsToDomain,
+  CommerceCapabilityBindingSchema,
+  selectCapabilities,
+  deduplicateTools,
+  manifestMatchesGrant,
+  parseCommerceManifest,
+  currentlyGrantedTools
+};
+//# sourceMappingURL=chunk-QNANS4R4.js.map