@mupag/mcp-server 0.1.0

package/dist/chunk-ZGVY3GVY.js

@@ -0,0 +1,1100 @@
+// src/server.ts
+import { createHash } from "crypto";
+import { isIP } from "net";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { MuPag, MuPagError } from "mupag-sdk";
+var MAX_API_KEY_LENGTH = 512;
+var MAX_IDEMPOTENCY_KEY_LENGTH = 128;
+var MAX_IDENTIFIER_LENGTH = 128;
+var MAX_CURSOR_LENGTH = 256;
+var MAX_TEXT_LENGTH = 500;
+var MAX_INPUT_BYTES = 64 * 1024;
+var MAX_OUTPUT_BYTES = 64 * 1024;
+var MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+var MAX_MONEY_CENTS = 9e15;
+var MAX_IN_FLIGHT_MUTATIONS = 1e3;
+var IDENTIFIER_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var APPROVAL_REFERENCE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+var SAFE_ERROR_CODE_PATTERN = /^[a-z0-9][a-z0-9_.-]{0,63}$/;
+var MUTATION_GUARD_PROPERTIES = {
+  idempotency_key: {
+    type: "string",
+    minLength: 1,
+    maxLength: MAX_IDEMPOTENCY_KEY_LENGTH,
+    pattern: "^[\\x21-\\x7E]+$",
+    description: "Chave expl\xEDcita e est\xE1vel para repeti\xE7\xE3o segura da mesma inten\xE7\xE3o."
+  },
+  approval_reference: {
+    type: "string",
+    minLength: 1,
+    maxLength: MAX_IDENTIFIER_LENGTH,
+    pattern: "^[A-Za-z0-9][A-Za-z0-9._:/-]*$",
+    description: "Refer\xEAncia n\xE3o sens\xEDvel da aprova\xE7\xE3o humana ou do workflow autorizado."
+  },
+  confirm_financial_effect: {
+    type: "boolean",
+    const: true,
+    description: "Deve ser true para confirmar conscientemente a muta\xE7\xE3o."
+  }
+};
+var MUTATION_REQUIRED = [
+  "idempotency_key",
+  "approval_reference",
+  "confirm_financial_effect"
+];
+var TOOL_DEFINITIONS = [
+  {
+    name: "create_charge",
+    description: "Cria uma cobran\xE7a PIX ou cart\xE3o B2B direto no ambiente sandbox MuPag.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        amount_cents: {
+          type: "integer",
+          minimum: 100,
+          maximum: MAX_MONEY_CENTS,
+          description: "Valor inteiro em centavos; m\xEDnimo de R$ 1,00."
+        },
+        payment_method: { type: "string", enum: ["pix", "credit_card"] },
+        customer: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+            name: { type: "string", minLength: 1, maxLength: 200 },
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            tax_id: { type: "string", pattern: "^(?:[0-9]{11}|[0-9]{14})$" }
+          },
+          required: ["name", "email", "tax_id"]
+        },
+        payer_ip: {
+          type: "string",
+          minLength: 2,
+          maxLength: 45,
+          description: "IP literal do pagador, atestado pelo merchant; obrigat\xF3rio para cart\xE3o."
+        },
+        card_token_id: {
+          type: "string",
+          minLength: 1,
+          maxLength: MAX_IDENTIFIER_LENGTH,
+          description: "Somente token opaco do PSP; PAN e CVV n\xE3o s\xE3o aceitos."
+        },
+        installments: { type: "integer", minimum: 1, maximum: 1 },
+        description: { type: "string", minLength: 1, maxLength: MAX_TEXT_LENGTH },
+        ...MUTATION_GUARD_PROPERTIES
+      },
+      required: [
+        "amount_cents",
+        "payment_method",
+        "customer",
+        ...MUTATION_REQUIRED
+      ]
+    },
+    annotations: {
+      title: "Criar cobran\xE7a",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "create_checkout_session",
+    description: "Cria uma sess\xE3o real de checkout hospedado PIX-only no sandbox MuPag.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        items: {
+          type: "array",
+          minItems: 1,
+          maxItems: 100,
+          items: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+              name: { type: "string", minLength: 1, maxLength: 200 },
+              quantity: { type: "integer", minimum: 1, maximum: 1e5 },
+              unit_amount_cents: {
+                type: "integer",
+                minimum: 100,
+                maximum: MAX_MONEY_CENTS
+              }
+            },
+            required: ["name", "quantity", "unit_amount_cents"]
+          }
+        },
+        success_url: { type: "string", minLength: 1, maxLength: 2048 },
+        cancel_url: { type: "string", minLength: 1, maxLength: 2048 },
+        customer_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        customer_data: {
+          type: "object",
+          additionalProperties: false,
+          properties: {
+            name: { type: "string", minLength: 1, maxLength: 200 },
+            email: { type: "string", minLength: 3, maxLength: 254 },
+            document: { type: "string", pattern: "^(?:[0-9]{11}|[0-9]{14})$" },
+            phone: { type: "string", minLength: 8, maxLength: 20 }
+          },
+          minProperties: 1
+        },
+        allowed_payment_methods: {
+          type: "array",
+          minItems: 1,
+          maxItems: 1,
+          uniqueItems: true,
+          items: { type: "string", enum: ["pix"] }
+        },
+        expires_in_minutes: { type: "integer", minimum: 1, maximum: 1440 },
+        ...MUTATION_GUARD_PROPERTIES
+      },
+      required: ["items", "success_url", "cancel_url", ...MUTATION_REQUIRED]
+    },
+    annotations: {
+      title: "Criar sess\xE3o de checkout",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "create_subscription",
+    description: "Cria uma assinatura recorrente no ambiente sandbox MuPag.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        customer_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        plan_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        payment_method: { type: "string", enum: ["pix", "credit_card"] },
+        card_token_id: {
+          type: "string",
+          minLength: 1,
+          maxLength: MAX_IDENTIFIER_LENGTH,
+          description: "Somente token opaco do PSP; PAN e CVV n\xE3o s\xE3o aceitos."
+        },
+        trial_days: { type: "integer", minimum: 0, maximum: 365 },
+        external_reference: {
+          type: "string",
+          minLength: 1,
+          maxLength: MAX_IDENTIFIER_LENGTH
+        },
+        ...MUTATION_GUARD_PROPERTIES
+      },
+      required: ["customer_id", "plan_id", "payment_method", ...MUTATION_REQUIRED]
+    },
+    annotations: {
+      title: "Criar assinatura",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "cancel_subscription",
+    description: "Cancela uma assinatura no sandbox, imediatamente ou ao fim do per\xEDodo.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        subscription_id: {
+          type: "string",
+          minLength: 1,
+          maxLength: MAX_IDENTIFIER_LENGTH
+        },
+        mode: { type: "string", enum: ["immediate", "end_of_period"] },
+        reason: { type: "string", minLength: 1, maxLength: MAX_TEXT_LENGTH },
+        ...MUTATION_GUARD_PROPERTIES
+      },
+      required: ["subscription_id", "mode", ...MUTATION_REQUIRED]
+    },
+    annotations: {
+      title: "Cancelar assinatura",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "refund_charge",
+    description: "Solicita estorno total expl\xEDcito ou parcial de uma cobran\xE7a no sandbox.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        charge_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        amount_cents: {
+          type: "integer",
+          minimum: 1,
+          maximum: MAX_MONEY_CENTS
+        },
+        full: {
+          type: "boolean",
+          const: true,
+          description: "Use true para estorno total; n\xE3o combine com amount_cents."
+        },
+        reason: { type: "string", minLength: 1, maxLength: MAX_TEXT_LENGTH },
+        ...MUTATION_GUARD_PROPERTIES
+      },
+      required: ["charge_id", ...MUTATION_REQUIRED],
+      oneOf: [{ required: ["amount_cents"] }, { required: ["full"] }]
+    },
+    annotations: {
+      title: "Estornar cobran\xE7a",
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "list_charges",
+    description: "Lista cobran\xE7as do merchant autenticado com filtros e pagina\xE7\xE3o limitada.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        status: { type: "string", minLength: 1, maxLength: 64 },
+        customer_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        payment_method: { type: "string", enum: ["pix", "credit_card"] },
+        created_at_from: { type: "string", minLength: 1, maxLength: 64 },
+        created_at_to: { type: "string", minLength: 1, maxLength: 64 },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+        cursor: { type: "string", minLength: 1, maxLength: MAX_CURSOR_LENGTH }
+      }
+    },
+    annotations: {
+      title: "Listar cobran\xE7as",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "get_refund",
+    description: "Consulta um estorno pelo ID no escopo do merchant autenticado.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        refund_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH }
+      },
+      required: ["refund_id"]
+    },
+    annotations: {
+      title: "Consultar estorno",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  },
+  {
+    name: "list_charge_refunds",
+    description: "Lista os estornos existentes de uma cobran\xE7a no merchant autenticado.",
+    inputSchema: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        charge_id: { type: "string", minLength: 1, maxLength: MAX_IDENTIFIER_LENGTH },
+        limit: { type: "integer", minimum: 1, maximum: 100 },
+        cursor: { type: "string", minLength: 1, maxLength: MAX_CURSOR_LENGTH }
+      },
+      required: ["charge_id"]
+    },
+    annotations: {
+      title: "Listar estornos da cobran\xE7a",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    }
+  }
+];
+function readConfig(environment) {
+  const apiKey = environment.MUPAG_API_KEY;
+  if (apiKey === void 0 || apiKey.length === 0) {
+    throw new Error("MUPAG_API_KEY \xE9 obrigat\xF3ria.");
+  }
+  if (apiKey.length > MAX_API_KEY_LENGTH || apiKey.trim() !== apiKey || hasControlCharacter(apiKey)) {
+    throw new Error("MUPAG_API_KEY inv\xE1lida.");
+  }
+  const configuredEnvironment = environment.MUPAG_ENV;
+  if (configuredEnvironment === void 0 || configuredEnvironment.length === 0) {
+    throw new Error("MUPAG_ENV \xE9 obrigat\xF3ria.");
+  }
+  if (configuredEnvironment === "prd") {
+    throw new Error("O MCP est\xE1 habilitado somente para sandbox; prd n\xE3o est\xE1 dispon\xEDvel.");
+  }
+  if (configuredEnvironment !== "test") {
+    throw new Error("MUPAG_ENV deve selecionar explicitamente o ambiente test.");
+  }
+  if (!apiKey.startsWith("sk_test_")) {
+    throw new Error("MUPAG_API_KEY n\xE3o corresponde ao ambiente test.");
+  }
+  const rawBaseUrl = environment.MUPAG_API_URL;
+  const baseUrl = rawBaseUrl === void 0 ? void 0 : validateBaseUrl(rawBaseUrl);
+  return { apiKey, env: "test", baseUrl };
+}
+function createMuPagServer(config, options = {}) {
+  const sdk = options.sdk ?? new MuPag({
+    apiKey: config.apiKey,
+    env: config.env,
+    baseUrl: config.baseUrl,
+    timeoutMs: 15e3,
+    maxResponseBytes: MAX_RESPONSE_BYTES,
+    retry: {
+      maxRetries: 2,
+      initialDelayMs: 250,
+      maxDelayMs: 2e3
+    }
+  });
+  const executor = createToolExecutor(sdk, options.auditSink ?? writeAuditEntry);
+  const server = new Server(
+    { name: "mupag-mcp-server", version: "0.1.0" },
+    {
+      capabilities: { tools: {} },
+      instructions: "Servidor MuPag exclusivo de sandbox. Muta\xE7\xF5es exigem aprova\xE7\xE3o expl\xEDcita e Idempotency-Key est\xE1vel."
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOL_DEFINITIONS
+  }));
+  server.setRequestHandler(
+    CallToolRequestSchema,
+    async (request) => executor(request.params.name, request.params.arguments)
+  );
+  return server;
+}
+function createToolExecutor(sdk, auditSink = () => void 0) {
+  const inFlight = /* @__PURE__ */ new Map();
+  return async (name, args) => {
+    let prepared;
+    try {
+      assertInputBudget(args);
+      prepared = prepareCall(name, args, sdk);
+    } catch (error) {
+      return toolError(error instanceof UnknownToolError ? "tool_not_found" : "entrada_invalida");
+    }
+    if (prepared.kind === "read") {
+      return invokeAndSerialize(prepared.invoke);
+    }
+    const mapKey = `${name}:${prepared.idempotencyKey}`;
+    const fingerprint = sha256(stableStringify(prepared.fingerprintPayload));
+    const existing = inFlight.get(mapKey);
+    if (existing !== void 0) {
+      if (existing.fingerprint !== fingerprint) {
+        return toolError("idempotency_conflict");
+      }
+      return existing.result;
+    }
+    if (inFlight.size >= MAX_IN_FLIGHT_MUTATIONS) {
+      return toolError("server_busy");
+    }
+    let result;
+    result = runMutation(
+      name,
+      prepared,
+      fingerprint,
+      auditSink
+    ).finally(() => {
+      if (inFlight.get(mapKey)?.result === result) {
+        inFlight.delete(mapKey);
+      }
+    });
+    inFlight.set(mapKey, { fingerprint, result });
+    return result;
+  };
+}
+async function runMutation(name, prepared, fingerprint, auditSink) {
+  try {
+    await auditSink({
+      tool: name,
+      approvalReference: prepared.approvalReference,
+      idempotencyKeyHash: sha256(prepared.idempotencyKey),
+      payloadHash: fingerprint,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  } catch {
+    return toolError("audit_unavailable");
+  }
+  return invokeAndSerialize(prepared.invoke);
+}
+async function invokeAndSerialize(invoke) {
+  try {
+    return serializeResult(await invoke());
+  } catch (error) {
+    return safeSdkError(error);
+  }
+}
+function prepareCall(name, args, sdk) {
+  switch (name) {
+    case "create_charge":
+      return prepareCreateCharge(args, sdk);
+    case "create_checkout_session":
+      return prepareCheckoutSession(args, sdk);
+    case "create_subscription":
+      return prepareCreateSubscription(args, sdk);
+    case "cancel_subscription":
+      return prepareCancelSubscription(args, sdk);
+    case "refund_charge":
+      return prepareRefund(args, sdk);
+    case "list_charges":
+      return prepareListCharges(args, sdk);
+    case "get_refund":
+      return prepareGetRefund(args, sdk);
+    case "list_charge_refunds":
+      return prepareListChargeRefunds(args, sdk);
+    default:
+      throw new UnknownToolError();
+  }
+}
+function prepareCreateCharge(args, sdk) {
+  const input = strictObject(args, [
+    "amount_cents",
+    "payment_method",
+    "customer",
+    "payer_ip",
+    "card_token_id",
+    "installments",
+    "description",
+    ...MUTATION_REQUIRED
+  ]);
+  const guards = mutationGuards(input);
+  const amount = integer(input.amount_cents, 100, MAX_MONEY_CENTS);
+  const paymentMethod = enumValue(input.payment_method, ["pix", "credit_card"]);
+  const customer = chargeCustomer(input.customer);
+  const payerIp = optionalIpLiteral(input.payer_ip);
+  const description = optionalPanSafeText(input.description, MAX_TEXT_LENGTH);
+  const cardTokenId = optionalCardTokenIdentifier(input.card_token_id);
+  const installments = optionalInteger(input.installments, 1, 1);
+  if (paymentMethod === "credit_card" && (cardTokenId === void 0 || payerIp === void 0)) {
+    throw new ValidationFailure();
+  }
+  if (paymentMethod === "pix" && (cardTokenId !== void 0 || installments !== void 0)) {
+    throw new ValidationFailure();
+  }
+  const params = {
+    amount_cents: amount,
+    payment_method: paymentMethod,
+    customer
+  };
+  addDefined(params, "payer_ip", payerIp);
+  addDefined(params, "card_token_id", cardTokenId);
+  addDefined(params, "installments", installments);
+  addDefined(params, "description", description);
+  return mutation(
+    guards,
+    { params },
+    () => sdk.charges.create(params, { idempotencyKey: guards.idempotencyKey })
+  );
+}
+function prepareCheckoutSession(args, sdk) {
+  const input = strictObject(args, [
+    "items",
+    "success_url",
+    "cancel_url",
+    "customer_id",
+    "customer_data",
+    "allowed_payment_methods",
+    "expires_in_minutes",
+    ...MUTATION_REQUIRED
+  ]);
+  const guards = mutationGuards(input);
+  if (!Array.isArray(input.items) || input.items.length < 1 || input.items.length > 100) {
+    throw new ValidationFailure();
+  }
+  let total = 0;
+  const items = input.items.map((rawItem) => {
+    const item = strictObject(rawItem, ["name", "quantity", "unit_amount_cents"]);
+    requireOwn(item, ["name", "quantity", "unit_amount_cents"]);
+    const name = panSafeText(requiredText(item.name, 200));
+    const quantity = integer(item.quantity, 1, 1e5);
+    const unitAmount = integer(item.unit_amount_cents, 100, MAX_MONEY_CENTS);
+    const lineTotal = quantity * unitAmount;
+    if (!Number.isSafeInteger(lineTotal) || lineTotal > MAX_MONEY_CENTS - total) {
+      throw new ValidationFailure();
+    }
+    total += lineTotal;
+    return { name, quantity, unit_amount_cents: unitAmount };
+  });
+  const successUrl = redirectUrl(input.success_url);
+  const cancelUrl = redirectUrl(input.cancel_url);
+  const customerId = optionalPanSafeIdentifier(input.customer_id);
+  const customerData = optionalCheckoutCustomer(input.customer_data);
+  if (customerId !== void 0 && customerData !== void 0) {
+    throw new ValidationFailure();
+  }
+  const allowedPaymentMethods = optionalPaymentMethods(input.allowed_payment_methods);
+  const expiresInMinutes = optionalInteger(input.expires_in_minutes, 1, 1440);
+  const params = {
+    items,
+    success_url: successUrl,
+    cancel_url: cancelUrl
+  };
+  addDefined(params, "customer_id", customerId);
+  addDefined(params, "customer_data", customerData);
+  addDefined(params, "allowed_payment_methods", allowedPaymentMethods);
+  addDefined(params, "expires_in_minutes", expiresInMinutes);
+  return mutation(
+    guards,
+    { params },
+    () => sdk.checkoutSessions.create(params, { idempotencyKey: guards.idempotencyKey })
+  );
+}
+function prepareCreateSubscription(args, sdk) {
+  const input = strictObject(args, [
+    "customer_id",
+    "plan_id",
+    "payment_method",
+    "card_token_id",
+    "trial_days",
+    "external_reference",
+    ...MUTATION_REQUIRED
+  ]);
+  const guards = mutationGuards(input);
+  const customerId = panSafeText(identifier(input.customer_id));
+  const planId = identifier(input.plan_id);
+  const paymentMethod = enumValue(input.payment_method, ["pix", "credit_card"]);
+  const cardTokenId = optionalCardTokenIdentifier(input.card_token_id);
+  const trialDays = optionalInteger(input.trial_days, 0, 365);
+  const externalReference = optionalPanSafeIdentifier(input.external_reference);
+  if (paymentMethod === "credit_card" && cardTokenId === void 0) {
+    throw new ValidationFailure();
+  }
+  if (paymentMethod === "pix" && cardTokenId !== void 0) {
+    throw new ValidationFailure();
+  }
+  const params = {
+    customer_id: customerId,
+    plan_id: planId,
+    payment_method: paymentMethod
+  };
+  addDefined(params, "card_token_id", cardTokenId);
+  addDefined(params, "trial_days", trialDays);
+  addDefined(params, "external_reference", externalReference);
+  return mutation(
+    guards,
+    { params },
+    () => sdk.subscriptions.create(params, { idempotencyKey: guards.idempotencyKey })
+  );
+}
+function prepareCancelSubscription(args, sdk) {
+  const input = strictObject(args, [
+    "subscription_id",
+    "mode",
+    "reason",
+    ...MUTATION_REQUIRED
+  ]);
+  const guards = mutationGuards(input);
+  const subscriptionId = panSafeText(identifier(input.subscription_id));
+  const mode = enumValue(input.mode, ["immediate", "end_of_period"]);
+  const reason = optionalPanSafeText(input.reason, MAX_TEXT_LENGTH);
+  const params = { mode };
+  addDefined(params, "reason", reason);
+  return mutation(
+    guards,
+    { subscription_id: subscriptionId, params },
+    () => sdk.subscriptions.cancel(subscriptionId, params, {
+      idempotencyKey: guards.idempotencyKey
+    })
+  );
+}
+function prepareRefund(args, sdk) {
+  const input = strictObject(args, [
+    "charge_id",
+    "amount_cents",
+    "full",
+    "reason",
+    ...MUTATION_REQUIRED
+  ]);
+  const guards = mutationGuards(input);
+  const chargeId = panSafeText(identifier(input.charge_id));
+  const amount = optionalInteger(input.amount_cents, 1, MAX_MONEY_CENTS);
+  const full = input.full;
+  if (amount === void 0 && full !== true || amount !== void 0 && full !== void 0) {
+    throw new ValidationFailure();
+  }
+  const reason = optionalPanSafeText(input.reason, MAX_TEXT_LENGTH);
+  const params = {};
+  if (amount === void 0) {
+    params.full = true;
+  } else {
+    params.amount_cents = amount;
+  }
+  addDefined(params, "reason", reason);
+  return mutation(
+    guards,
+    { charge_id: chargeId, params },
+    () => sdk.refunds.create(chargeId, params, { idempotencyKey: guards.idempotencyKey })
+  );
+}
+function prepareListCharges(args, sdk) {
+  const input = strictObject(args ?? {}, [
+    "status",
+    "customer_id",
+    "payment_method",
+    "created_at_from",
+    "created_at_to",
+    "limit",
+    "cursor"
+  ]);
+  const params = {};
+  addDefined(params, "status", optionalSlug(input.status, 64));
+  addDefined(params, "customer_id", optionalPanSafeIdentifier(input.customer_id));
+  addDefined(
+    params,
+    "payment_method",
+    optionalEnumValue(input.payment_method, ["pix", "credit_card"])
+  );
+  const createdAtFrom = optionalTimestamp(input.created_at_from);
+  const createdAtTo = optionalTimestamp(input.created_at_to);
+  if (createdAtFrom !== void 0 && createdAtTo !== void 0 && Date.parse(createdAtFrom) > Date.parse(createdAtTo)) {
+    throw new ValidationFailure();
+  }
+  addDefined(params, "created_at_from", createdAtFrom);
+  addDefined(params, "created_at_to", createdAtTo);
+  addDefined(params, "limit", optionalInteger(input.limit, 1, 100));
+  addDefined(params, "cursor", optionalVisibleAscii(input.cursor, MAX_CURSOR_LENGTH));
+  return { kind: "read", invoke: () => sdk.charges.list(params) };
+}
+function prepareGetRefund(args, sdk) {
+  const input = strictObject(args, ["refund_id"]);
+  requireOwn(input, ["refund_id"]);
+  const refundId = panSafeText(identifier(input.refund_id));
+  return { kind: "read", invoke: () => sdk.refunds.get(refundId) };
+}
+function prepareListChargeRefunds(args, sdk) {
+  const input = strictObject(args, ["charge_id", "limit", "cursor"]);
+  requireOwn(input, ["charge_id"]);
+  const chargeId = panSafeText(identifier(input.charge_id));
+  const params = {};
+  addDefined(params, "limit", optionalInteger(input.limit, 1, 100));
+  addDefined(params, "cursor", optionalVisibleAscii(input.cursor, MAX_CURSOR_LENGTH));
+  return { kind: "read", invoke: () => sdk.refunds.listByCharge(chargeId, params) };
+}
+function mutation(guards, fingerprintPayload, invoke) {
+  return {
+    kind: "mutation",
+    ...guards,
+    fingerprintPayload,
+    invoke
+  };
+}
+function mutationGuards(input) {
+  requireOwn(input, MUTATION_REQUIRED);
+  if (input.confirm_financial_effect !== true) {
+    throw new ValidationFailure();
+  }
+  const idempotencyKey = panSafeVisibleAscii(
+    input.idempotency_key,
+    MAX_IDEMPOTENCY_KEY_LENGTH
+  );
+  if (typeof input.approval_reference !== "string") {
+    throw new ValidationFailure();
+  }
+  const approvalReference = stringMatching(
+    panSafeText(input.approval_reference),
+    APPROVAL_REFERENCE_PATTERN,
+    MAX_IDENTIFIER_LENGTH
+  );
+  return { idempotencyKey, approvalReference };
+}
+function chargeCustomer(value) {
+  const customer = strictObject(value, ["id", "name", "email", "tax_id"]);
+  const id = optionalPanSafeIdentifier(customer.id);
+  const name = optionalPanSafeText(customer.name, 200);
+  const email = optionalPanSafeEmail(customer.email);
+  const taxId = optionalTaxId(customer.tax_id);
+  if (name === void 0 || email === void 0 || taxId === void 0) {
+    throw new ValidationFailure();
+  }
+  const result = { name, email, tax_id: taxId };
+  addDefined(result, "id", id);
+  return result;
+}
+function optionalIpLiteral(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string" || value.length > 45 || isIP(value) === 0) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalCheckoutCustomer(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  const customer = strictObject(value, ["name", "email", "document", "phone"]);
+  const result = {};
+  addDefined(result, "name", optionalPanSafeText(customer.name, 200));
+  addDefined(result, "email", optionalPanSafeEmail(customer.email));
+  addDefined(result, "document", optionalTaxId(customer.document));
+  addDefined(result, "phone", optionalPhone(customer.phone));
+  if (Object.keys(result).length === 0) {
+    throw new ValidationFailure();
+  }
+  return result;
+}
+function optionalPaymentMethods(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (!Array.isArray(value) || value.length !== 1) {
+    throw new ValidationFailure();
+  }
+  const methods = value.map((item) => enumValue(item, ["pix"]));
+  if (new Set(methods).size !== methods.length) {
+    throw new ValidationFailure();
+  }
+  return methods;
+}
+function strictObject(value, allowedKeys) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ValidationFailure();
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new ValidationFailure();
+  }
+  const record = value;
+  const allowed = new Set(allowedKeys);
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) {
+      throw new ValidationFailure();
+    }
+  }
+  return record;
+}
+function requireOwn(value, keys) {
+  for (const key of keys) {
+    if (!Object.prototype.hasOwnProperty.call(value, key)) {
+      throw new ValidationFailure();
+    }
+  }
+}
+function integer(value, minimum, maximum) {
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalInteger(value, minimum, maximum) {
+  return value === void 0 ? void 0 : integer(value, minimum, maximum);
+}
+function enumValue(value, allowed) {
+  if (typeof value !== "string" || !allowed.includes(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalEnumValue(value, allowed) {
+  return value === void 0 ? void 0 : enumValue(value, allowed);
+}
+function identifier(value) {
+  return stringMatching(value, IDENTIFIER_PATTERN, MAX_IDENTIFIER_LENGTH);
+}
+function optionalIdentifier(value) {
+  return value === void 0 ? void 0 : identifier(value);
+}
+function optionalCardTokenIdentifier(value) {
+  const cardTokenId = optionalIdentifier(value);
+  if (cardTokenId !== void 0 && containsPanLikeSequence(cardTokenId)) {
+    throw new ValidationFailure();
+  }
+  return cardTokenId;
+}
+function panSafeText(value) {
+  if (containsPanLikeSequence(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalPanSafeText(value, maximumLength) {
+  const parsed = optionalText(value, maximumLength);
+  return parsed === void 0 ? void 0 : panSafeText(parsed);
+}
+function optionalPanSafeEmail(value) {
+  const parsed = optionalEmail(value);
+  return parsed === void 0 ? void 0 : panSafeText(parsed);
+}
+function optionalPanSafeIdentifier(value) {
+  const parsed = optionalIdentifier(value);
+  return parsed === void 0 ? void 0 : panSafeText(parsed);
+}
+function containsPanLikeSequence(value) {
+  let retainedDigits = "";
+  for (const character of value) {
+    if (character >= "0" && character <= "9") {
+      retainedDigits = (retainedDigits + character).slice(-19);
+      for (let length = 12; length <= retainedDigits.length; length += 1) {
+        if (validPanSequence(retainedDigits.slice(-length))) return true;
+      }
+    } else if (/^[\s\p{P}\p{S}\p{M}\p{Cc}\p{Cf}]$/u.test(character)) {
+      continue;
+    } else {
+      retainedDigits = "";
+    }
+  }
+  return false;
+}
+function validPanSequence(digits) {
+  if (!/^[0-9]{12,19}$/.test(digits)) return false;
+  let total = 0;
+  let doubleDigit = false;
+  for (let index = digits.length - 1; index >= 0; index -= 1) {
+    let digit = digits.charCodeAt(index) - 48;
+    if (doubleDigit) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    total += digit;
+    doubleDigit = !doubleDigit;
+  }
+  return total % 10 === 0;
+}
+function visibleAscii(value, maximumLength) {
+  if (typeof value !== "string" || value.length < 1 || value.length > maximumLength || !/^[\x21-\x7e]+$/.test(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function panSafeVisibleAscii(value, maximumLength) {
+  if (typeof value !== "string" || containsPanLikeSequence(value)) {
+    throw new ValidationFailure();
+  }
+  return visibleAscii(value, maximumLength);
+}
+function optionalVisibleAscii(value, maximumLength) {
+  return value === void 0 ? void 0 : visibleAscii(value, maximumLength);
+}
+function stringMatching(value, pattern, maximumLength) {
+  if (typeof value !== "string" || value.length < 1 || value.length > maximumLength || !pattern.test(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function requiredText(value, maximumLength) {
+  if (typeof value !== "string" || value.trim().length === 0 || value.length > maximumLength) {
+    throw new ValidationFailure();
+  }
+  if (hasUnsafeTextControl(value)) {
+    throw new ValidationFailure();
+  }
+  return value.trim();
+}
+function optionalText(value, maximumLength) {
+  return value === void 0 ? void 0 : requiredText(value, maximumLength);
+}
+function optionalSlug(value, maximumLength) {
+  if (value === void 0) {
+    return void 0;
+  }
+  return stringMatching(value, /^[a-z][a-z0-9_-]*$/, maximumLength);
+}
+function optionalEmail(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string" || value.length < 3 || value.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value) || hasControlCharacter(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalTaxId(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string" || !/^(?:\d{11}|\d{14})$/.test(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalPhone(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string" || !/^\+?[0-9 ()-]{8,20}$/.test(value)) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function optionalTimestamp(value) {
+  if (value === void 0) {
+    return void 0;
+  }
+  if (typeof value !== "string" || value.length < 1 || value.length > 64 || !Number.isFinite(Date.parse(value))) {
+    throw new ValidationFailure();
+  }
+  return value;
+}
+function redirectUrl(value) {
+  if (typeof value !== "string" || value.length < 1 || value.length > 2048) {
+    throw new ValidationFailure();
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new ValidationFailure();
+  }
+  if (parsed.username !== "" || parsed.password !== "" || parsed.hash !== "" || !isAllowedHttpUrl(parsed)) {
+    throw new ValidationFailure();
+  }
+  return parsed.toString();
+}
+function validateBaseUrl(value) {
+  if (value.length < 1 || value.length > 2048 || value.trim() !== value) {
+    throw new Error("MUPAG_API_URL inv\xE1lida.");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error("MUPAG_API_URL inv\xE1lida.");
+  }
+  if (parsed.username !== "" || parsed.password !== "" || parsed.search !== "" || parsed.hash !== "" || parsed.pathname !== "" && parsed.pathname !== "/" || !isAllowedHttpUrl(parsed)) {
+    throw new Error("MUPAG_API_URL inv\xE1lida.");
+  }
+  return `${parsed.protocol}//${parsed.host}`;
+}
+function isAllowedHttpUrl(value) {
+  if (value.protocol === "https:") {
+    return value.hostname.length > 0;
+  }
+  return value.protocol === "http:" && isLoopbackHost(value.hostname);
+}
+function isLoopbackHost(hostname) {
+  const normalized = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1";
+}
+function assertInputBudget(value) {
+  const stack = [{ value, depth: 0 }];
+  const seen = /* @__PURE__ */ new WeakSet();
+  let bytes = 0;
+  let nodes = 0;
+  while (stack.length > 0) {
+    const current = stack.pop();
+    if (current === void 0) {
+      break;
+    }
+    nodes++;
+    if (nodes > 1e4 || current.depth > 10) {
+      throw new ValidationFailure();
+    }
+    const item = current.value;
+    if (typeof item === "string") {
+      bytes += Buffer.byteLength(item, "utf8");
+    } else if (typeof item === "number" || typeof item === "boolean" || item === null) {
+      bytes += 16;
+    } else if (typeof item === "object") {
+      if (item === null || seen.has(item)) {
+        if (item !== null) {
+          throw new ValidationFailure();
+        }
+      } else {
+        seen.add(item);
+        if (Array.isArray(item)) {
+          for (const child of item) {
+            stack.push({ value: child, depth: current.depth + 1 });
+          }
+        } else {
+          for (const [key, child] of Object.entries(item)) {
+            bytes += Buffer.byteLength(key, "utf8");
+            stack.push({ value: child, depth: current.depth + 1 });
+          }
+        }
+      }
+    } else if (item !== void 0) {
+      throw new ValidationFailure();
+    }
+    if (bytes > MAX_INPUT_BYTES) {
+      throw new ValidationFailure();
+    }
+  }
+}
+function serializeResult(value) {
+  let serialized;
+  try {
+    serialized = JSON.stringify(value);
+  } catch {
+    return toolError("invalid_sdk_response");
+  }
+  if (serialized === void 0) {
+    return toolError("invalid_sdk_response");
+  }
+  if (Buffer.byteLength(serialized, "utf8") > MAX_OUTPUT_BYTES) {
+    return toolError("output_too_large");
+  }
+  return { content: [{ type: "text", text: serialized }] };
+}
+function safeSdkError(error) {
+  if (error instanceof MuPagError) {
+    const payload = {
+      code: typeof error.code === "string" && SAFE_ERROR_CODE_PATTERN.test(error.code) ? error.code : "api_error"
+    };
+    if (typeof error.status === "number" && Number.isInteger(error.status) && error.status >= 400 && error.status <= 599) {
+      payload.status = error.status;
+    }
+    if (typeof error.requestId === "string" && IDENTIFIER_PATTERN.test(error.requestId)) {
+      payload.request_id = error.requestId;
+    }
+    return toolErrorPayload(payload);
+  }
+  return toolError("sdk_error");
+}
+function toolError(code) {
+  return toolErrorPayload({ code });
+}
+function toolErrorPayload(payload) {
+  return {
+    isError: true,
+    content: [{ type: "text", text: JSON.stringify({ error: payload }) }]
+  };
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(stableStringify).join(",")}]`;
+  }
+  const record = value;
+  const pairs = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableStringify(record[key])}`);
+  return `{${pairs.join(",")}}`;
+}
+function sha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function addDefined(target, key, value) {
+  if (value !== void 0) {
+    target[key] = value;
+  }
+}
+function hasControlCharacter(value) {
+  return /[\u0000-\u001f\u007f]/.test(value);
+}
+function hasUnsafeTextControl(value) {
+  return /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/.test(value);
+}
+function writeAuditEntry(entry) {
+  process.stderr.write(`${JSON.stringify({ event: "mupag_mcp_financial_command", ...entry })}
+`);
+}
+var ValidationFailure = class extends Error {
+};
+var UnknownToolError = class extends Error {
+};
+
+export {
+  TOOL_DEFINITIONS,
+  readConfig,
+  createMuPagServer,
+  createToolExecutor
+};
+//# sourceMappingURL=chunk-ZGVY3GVY.js.map