@payclaw/badge 0.7.0 → 0.8.0

package/dist/lib/report-badge.js

@@ -1,18 +1,21 @@
+// Canonical: badge-server | Synced: 0.7.3 | Do not edit in mcp-server
 /**
  * POST identity_presented to /api/badge/report.
- * Simplified for badge-server (no OAuth, just API key).
+ * Uses getStoredConsentKey for OAuth users; PAYCLAW_API_KEY for legacy.
+ * Synced from mcp-server (BUG-01.1).
  */
+import { getStoredConsentKey } from "./storage.js";
 const DEFAULT_API_URL = "https://payclaw.io";
-export async function reportBadgePresented(verificationToken, merchant, context) {
+export async function reportBadgePresented(verificationToken, merchant, context, checkoutSessionId) {
     const apiUrl = process.env.PAYCLAW_API_URL || DEFAULT_API_URL;
-    const apiKey = process.env.PAYCLAW_API_KEY;
-    if (!apiKey)
+    const key = getStoredConsentKey();
+    if (!key)
         return;
     try {
         const res = await fetch(`${apiUrl}/api/badge/report`, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${apiKey}`,
+                Authorization: `Bearer ${key}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify({
@@ -20,6 +23,7 @@ export async function reportBadgePresented(verificationToken, merchant, context)
                 event_type: "identity_presented",
                 merchant,
                 ...(context && { presentation_context: context }),
+                ...(checkoutSessionId && { checkout_session_id: checkoutSessionId }),
             }),
         });
         if (!res.ok) {
@@ -33,14 +37,14 @@ export async function reportBadgePresented(verificationToken, merchant, context)
 }
 export async function reportBadgeNotPresented(verificationToken, merchant, reason) {
     const apiUrl = process.env.PAYCLAW_API_URL || DEFAULT_API_URL;
-    const apiKey = process.env.PAYCLAW_API_KEY;
-    if (!apiKey)
+    const key = getStoredConsentKey();
+    if (!key)
         return;
     try {
         const res = await fetch(`${apiUrl}/api/badge/report`, {
             method: "POST",
             headers: {
-                Authorization: `Bearer ${apiKey}`,
+                Authorization: `Bearer ${key}`,
                 "Content-Type": "application/json",
             },
             body: JSON.stringify({

package/dist/lib/report-badge.js.map

@@ -1 +1 @@
-{"version":3,"file":"report-badge.js","sourceRoot":"","sources":["../../src/lib/report-badge.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,iBAAyB,EACzB,QAAgB,EAChB,OAAwD;IAExD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,oBAAoB;gBAChC,QAAQ;gBACR,GAAG,CAAC,OAAO,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;aAClD,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,iBAAyB,EACzB,QAAgB,EAChB,MAAoD;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;IAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO;IAEpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,qBAAqB;gBACjC,QAAQ;gBACR,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"report-badge.js","sourceRoot":"","sources":["../../src/lib/report-badge.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAE7C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,iBAAyB,EACzB,QAAgB,EAChB,OAAwD,EACxD,iBAA0B;IAE1B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;IAC9D,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,oBAAoB;gBAChC,QAAQ;gBACR,GAAG,CAAC,OAAO,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC;gBACjD,GAAG,CAAC,iBAAiB,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,CAAC;aACrE,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wCAAwC,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,iBAAyB,EACzB,QAAgB,EAChB,MAAoD;IAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,CAAC;IAC9D,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO;IAEjB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,mBAAmB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,EAAE;gBAC9B,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,iBAAiB;gBACrC,UAAU,EAAE,qBAAqB;gBACjC,QAAQ;gBACR,MAAM;aACP,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2CAA2C,GAAG,CAAC,MAAM,MAAM,IAAI,IAAI,CACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC"}

package/dist/lib/report-badge.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/report-badge.test.js

@@ -0,0 +1,109 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { reportBadgePresented, reportBadgeNotPresented, } from "./report-badge.js";
+import * as storage from "./storage.js";
+vi.mock("./storage.js", () => ({
+    getStoredConsentKey: vi.fn(),
+}));
+describe("reportBadgePresented", () => {
+    const mockFetch = vi.fn();
+    beforeEach(() => {
+        vi.stubGlobal("fetch", mockFetch);
+        mockFetch.mockResolvedValue({ ok: true });
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+        delete process.env.PAYCLAW_API_KEY;
+        delete process.env.PAYCLAW_API_URL;
+    });
+    it("POSTs when consent key available", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        await reportBadgePresented("tok123", "merchant.com");
+        expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining("/api/badge/report"), expect.objectContaining({
+            method: "POST",
+            headers: expect.objectContaining({
+                Authorization: "Bearer pk_test_xxx",
+                "Content-Type": "application/json",
+            }),
+            body: JSON.stringify({
+                verification_token: "tok123",
+                event_type: "identity_presented",
+                merchant: "merchant.com",
+            }),
+        }));
+    });
+    it("POSTs when OAuth consent key exists", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("oauth_access_token_xyz");
+        await reportBadgePresented("tok456", "other.com");
+        expect(mockFetch).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({
+            headers: expect.objectContaining({
+                Authorization: "Bearer oauth_access_token_xyz",
+            }),
+        }));
+    });
+    it("skips POST when no key at all", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue(null);
+        await reportBadgePresented("tok789", "merchant.com");
+        expect(mockFetch).not.toHaveBeenCalled();
+    });
+    it("uses PAYCLAW_API_URL when set", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        process.env.PAYCLAW_API_URL = "https://custom-payclaw.example";
+        await reportBadgePresented("tok", "m");
+        expect(mockFetch).toHaveBeenCalledWith("https://custom-payclaw.example/api/badge/report", expect.any(Object));
+    });
+    it("uses payclaw.io when PAYCLAW_API_URL unset", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        delete process.env.PAYCLAW_API_URL;
+        await reportBadgePresented("tok", "m");
+        expect(mockFetch).toHaveBeenCalledWith("https://payclaw.io/api/badge/report", expect.any(Object));
+    });
+    it("does not throw when fetch rejects", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        mockFetch.mockRejectedValue(new Error("network error"));
+        await expect(reportBadgePresented("tok", "m")).resolves.toBeUndefined();
+    });
+    it("does not throw when POST returns 500", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        mockFetch.mockResolvedValue({ ok: false, status: 500, text: async () => "server error" });
+        await expect(reportBadgePresented("tok", "m")).resolves.toBeUndefined();
+    });
+    it("includes presentation_context in body when context provided", async () => {
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+        await reportBadgePresented("tok", "m", "checkout");
+        const body = JSON.parse(mockFetch.mock.calls[0][1].body);
+        expect(body.presentation_context).toBe("checkout");
+        expect(body.event_type).toBe("identity_presented");
+    });
+});
+describe("reportBadgeNotPresented", () => {
+    const mockFetch = vi.fn();
+    beforeEach(() => {
+        vi.stubGlobal("fetch", mockFetch);
+        mockFetch.mockResolvedValue({ ok: true });
+        vi.mocked(storage.getStoredConsentKey).mockReturnValue("pk_test_xxx");
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+        vi.restoreAllMocks();
+    });
+    it("POSTs with event_type badge_not_presented and reason", async () => {
+        await reportBadgeNotPresented("tok", "merchant.com", "abandoned");
+        expect(mockFetch).toHaveBeenCalledWith(expect.stringContaining("/api/badge/report"), expect.objectContaining({
+            method: "POST",
+            body: JSON.stringify({
+                verification_token: "tok",
+                event_type: "badge_not_presented",
+                merchant: "merchant.com",
+                reason: "abandoned",
+            }),
+        }));
+    });
+    it("supports all valid reasons", async () => {
+        await reportBadgeNotPresented("t", "m", "merchant_didnt_ask");
+        expect(JSON.parse(mockFetch.mock.calls[0][1].body).reason).toBe("merchant_didnt_ask");
+        await reportBadgeNotPresented("t", "m", "other");
+        expect(JSON.parse(mockFetch.mock.calls[1][1].body).reason).toBe("other");
+    });
+});
+//# sourceMappingURL=report-badge.test.js.map

package/dist/lib/report-badge.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-badge.test.js","sourceRoot":"","sources":["../../src/lib/report-badge.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,OAAO,MAAM,cAAc,CAAC;AAExC,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7B,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC7B,CAAC,CAAC,CAAC;AAEJ,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAE1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClC,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACnC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAEtE,MAAM,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBAC/B,aAAa,EAAE,oBAAoB;gBACnC,cAAc,EAAE,kBAAkB;aACnC,CAAC;YACF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,QAAQ;gBAC5B,UAAU,EAAE,oBAAoB;gBAChC,QAAQ,EAAE,cAAc;aACzB,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,KAAK,IAAI,EAAE;QACnD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,wBAAwB,CAAC,CAAC;QAEjF,MAAM,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAElD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAClB,MAAM,CAAC,gBAAgB,CAAC;YACtB,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC;gBAC/B,aAAa,EAAE,+BAA+B;aAC/C,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE7D,MAAM,oBAAoB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAErD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;QAC7C,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,gCAAgC,CAAC;QAE/D,MAAM,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvC,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,iDAAiD,EACjD,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAEnC,MAAM,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEvC,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,qCAAqC,EACrC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtE,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAExD,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtE,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QAE1F,MAAM,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAEtE,MAAM,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAEnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IAE1B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClC,SAAS,CAAC,iBAAiB,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAC;QACtB,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,uBAAuB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QAElE,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,kBAAkB,EAAE,KAAK;gBACzB,UAAU,EAAE,qBAAqB;gBACjC,QAAQ,EAAE,cAAc;gBACxB,MAAM,EAAE,WAAW;aACpB,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,oBAAoB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAEtF,MAAM,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/storage.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Layered consent key lookup:
+ * 1. PAYCLAW_API_KEY env (backward compat — device flow never triggers)
+ * 2. ~/.payclaw/consent_key file
+ * 3. In-memory (current process only)
+ */
+export declare function getStoredConsentKey(): string | null;
+/**
+ * Returns a human-readable description of the active auth mode.
+ * Used for startup logging — never exposes full key values.
+ */
+export declare function getAuthMode(): string;
+/**
+ * Store consent key to ~/.payclaw/consent_key.
+ * Creates directory if needed. Falls back to memory if file write fails.
+ */
+export declare function storeConsentKey(token: string): Promise<void>;

package/dist/lib/storage.js

@@ -0,0 +1,86 @@
+// Canonical: badge-server | Synced: 0.7.3 | Do not edit in mcp-server
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const CONSENT_KEY_DIR = ".payclaw";
+const CONSENT_KEY_FILE = "consent_key";
+/** In-memory fallback when file isn't writable. Lost on restart. */
+let memoryConsentKey = null;
+function getConsentKeyPath() {
+    const home = os.homedir();
+    return path.join(home, CONSENT_KEY_DIR, CONSENT_KEY_FILE);
+}
+/**
+ * Layered consent key lookup:
+ * 1. PAYCLAW_API_KEY env (backward compat — device flow never triggers)
+ * 2. ~/.payclaw/consent_key file
+ * 3. In-memory (current process only)
+ */
+export function getStoredConsentKey() {
+    const envKey = process.env.PAYCLAW_API_KEY;
+    if (envKey && envKey.trim().length > 0) {
+        return envKey.trim();
+    }
+    const filePath = getConsentKeyPath();
+    try {
+        if (fs.existsSync(filePath)) {
+            const content = fs.readFileSync(filePath, "utf8").trim();
+            if (content.length > 0) {
+                return content;
+            }
+        }
+    }
+    catch {
+        // File read failed — fall back to memory
+    }
+    return memoryConsentKey;
+}
+/**
+ * Returns a human-readable description of the active auth mode.
+ * Used for startup logging — never exposes full key values.
+ */
+export function getAuthMode() {
+    const envKey = process.env.PAYCLAW_API_KEY;
+    if (envKey && envKey.trim().length > 0) {
+        const masked = envKey.trim().substring(0, 8) + "****";
+        return `API key (${masked})`;
+    }
+    const filePath = getConsentKeyPath();
+    try {
+        if (fs.existsSync(filePath)) {
+            const content = fs.readFileSync(filePath, "utf8").trim();
+            if (content.length > 0) {
+                return "consent key (~/.payclaw/consent_key)";
+            }
+        }
+    }
+    catch {
+        // File read failed
+    }
+    if (memoryConsentKey) {
+        return "consent key (in-memory)";
+    }
+    return "none (device flow will trigger on first tool call)";
+}
+/**
+ * Store consent key to ~/.payclaw/consent_key.
+ * Creates directory if needed. Falls back to memory if file write fails.
+ */
+export async function storeConsentKey(token) {
+    const trimmed = token.trim();
+    if (trimmed.length === 0)
+        return;
+    memoryConsentKey = trimmed;
+    const filePath = getConsentKeyPath();
+    const dir = path.dirname(filePath);
+    try {
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { mode: 0o700, recursive: true });
+        }
+        fs.writeFileSync(filePath, trimmed, { mode: 0o600, flag: "w" });
+    }
+    catch {
+        // File write failed — key is in memory, will be lost on restart
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/lib/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/lib/storage.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,eAAe,GAAG,UAAU,CAAC;AACnC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC,oEAAoE;AACpE,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,SAAS,iBAAiB;IACxB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;IACvB,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC3C,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC;QACtD,OAAO,YAAY,MAAM,GAAG,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,sCAAsC,CAAC;YAChD,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,OAAO,oDAAoD,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,gBAAgB,GAAG,OAAO,CAAC;IAE3B,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;AACH,CAAC"}

package/dist/lib/ucp-manifest.d.ts

@@ -0,0 +1,32 @@
+/**
+ * UCP manifest fetcher — checks if a merchant supports io.payclaw.common.identity.
+ *
+ * Fetches {merchantUrl}/.well-known/ucp, caches per domain for 5 minutes.
+ * Never throws — returns null on any error.
+ */
+interface UCPCapability {
+    version: string;
+    spec?: string;
+    schema?: string;
+    extends?: string;
+    config?: {
+        required?: boolean;
+    };
+}
+interface UCPManifest {
+    capabilities?: Record<string, UCPCapability | UCPCapability[]>;
+    [key: string]: unknown;
+}
+export declare function fetchUCPManifest(merchantUrl: string): Promise<UCPManifest | null>;
+export interface PayClawCapability {
+    version: string;
+    required: boolean;
+}
+export declare function findPayClawCapability(manifest: UCPManifest): PayClawCapability | null;
+export declare function isVersionCompatible(version: string): boolean;
+/**
+ * Reset the manifest cache. Useful for testing.
+ * @internal
+ */
+export declare function _resetManifestCache(): void;
+export {};

package/dist/lib/ucp-manifest.js

@@ -0,0 +1,117 @@
+/**
+ * UCP manifest fetcher — checks if a merchant supports io.payclaw.common.identity.
+ *
+ * Fetches {merchantUrl}/.well-known/ucp, caches per domain for 5 minutes.
+ * Never throws — returns null on any error.
+ */
+const EXTENSION_NAME = "io.payclaw.common.identity";
+const FETCH_TIMEOUT_MS = 3000;
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+const manifestCache = new Map();
+function normalizeDomain(url) {
+    try {
+        const u = new URL(url.endsWith("/") ? url.slice(0, -1) : url);
+        return u.origin;
+    }
+    catch {
+        // Bare domain like "starbucks.com" — try with https://
+        try {
+            return new URL("https://" + url.replace(/\/+$/, "")).origin;
+        }
+        catch {
+            return url.replace(/\/+$/, "");
+        }
+    }
+}
+function isPublicOrigin(origin) {
+    let hostname;
+    try {
+        hostname = new URL(origin).hostname;
+    }
+    catch {
+        return false;
+    }
+    // Block non-https (except in tests)
+    if (!origin.startsWith("https://") && !process.env.VITEST)
+        return false;
+    // Block localhost and loopback
+    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1")
+        return false;
+    if (hostname.endsWith(".localhost"))
+        return false;
+    // Block private/reserved IPv4 ranges
+    const ipv4Match = hostname.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+    if (ipv4Match) {
+        const [, a, b] = ipv4Match.map(Number);
+        if (a === 10)
+            return false; // 10.0.0.0/8
+        if (a === 172 && b >= 16 && b <= 31)
+            return false; // 172.16.0.0/12
+        if (a === 192 && b === 168)
+            return false; // 192.168.0.0/16
+        if (a === 169 && b === 254)
+            return false; // 169.254.0.0/16 (link-local + metadata)
+        if (a === 0)
+            return false; // 0.0.0.0/8
+    }
+    // Block IPv6 loopback/link-local
+    if (hostname.startsWith("[")) {
+        const inner = hostname.slice(1, -1).toLowerCase();
+        if (inner === "::1" || inner.startsWith("fe80:") || inner.startsWith("fc") || inner.startsWith("fd"))
+            return false;
+    }
+    return true;
+}
+export async function fetchUCPManifest(merchantUrl) {
+    const domain = normalizeDomain(merchantUrl);
+    // SSRF protection: only fetch from public origins
+    if (!isPublicOrigin(domain))
+        return null;
+    // Check cache
+    const cached = manifestCache.get(domain);
+    if (cached && (Date.now() - cached.fetchedAt) < CACHE_TTL_MS) {
+        return cached.data;
+    }
+    try {
+        const res = await fetch(`${domain}/.well-known/ucp`, {
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            manifestCache.set(domain, { data: null, fetchedAt: Date.now() });
+            return null;
+        }
+        const data = (await res.json());
+        manifestCache.set(domain, { data, fetchedAt: Date.now() });
+        return data;
+    }
+    catch {
+        manifestCache.set(domain, { data: null, fetchedAt: Date.now() });
+        return null;
+    }
+}
+export function findPayClawCapability(manifest) {
+    const caps = manifest.capabilities;
+    if (!caps || !(EXTENSION_NAME in caps))
+        return null;
+    const entry = caps[EXTENSION_NAME];
+    // Handle both array-wrapped and plain object forms
+    const cap = Array.isArray(entry) ? entry[0] : entry;
+    if (!cap || typeof cap.version !== "string")
+        return null;
+    return {
+        version: cap.version,
+        required: cap.config?.required === true,
+    };
+}
+const COMPATIBLE_VERSIONS = ["2026-01-11"];
+export function isVersionCompatible(version) {
+    return COMPATIBLE_VERSIONS.includes(version);
+}
+/**
+ * Reset the manifest cache. Useful for testing.
+ * @internal
+ */
+export function _resetManifestCache() {
+    manifestCache.clear();
+}
+//# sourceMappingURL=ucp-manifest.js.map

package/dist/lib/ucp-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ucp-manifest.js","sourceRoot":"","sources":["../../src/lib/ucp-manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,cAAc,GAAG,4BAA4B,CAAC;AACpD,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAC9B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAoBhD,MAAM,aAAa,GAAG,IAAI,GAAG,EAA0B,CAAC;AAExD,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;QACvD,IAAI,CAAC;YACH,OAAO,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oCAAoC;IACpC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAExE,+BAA+B;IAC/B,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAElD,qCAAqC;IACrC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACjE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC,CAA0B,aAAa;QAClE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,CAAG,gBAAgB;QACrE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAa,iBAAiB;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC,CAAa,yCAAyC;QAC/F,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,CAA4B,YAAY;IACpE,CAAC;IAED,iCAAiC;IACjC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IACrH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,WAAmB;IACxD,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAE5C,kDAAkD;IAClD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,cAAc;IACd,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,YAAY,EAAE,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,kBAAkB,EAAE;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;QAC/C,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,qBAAqB,CAAC,QAAqB;IACzD,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,mDAAmD;IACnD,MAAM,GAAG,GAA8B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/E,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,KAAK,IAAI;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,mBAAmB,GAAG,CAAC,YAAY,CAAC,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAO,mBAAmB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC"}

package/dist/lib/ucp-manifest.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/ucp-manifest.test.js

@@ -0,0 +1,92 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { fetchUCPManifest, findPayClawCapability, isVersionCompatible, _resetManifestCache, } from "./ucp-manifest.js";
+describe("ucp-manifest", () => {
+    beforeEach(() => {
+        _resetManifestCache();
+    });
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+    const VALID_MANIFEST = {
+        capabilities: {
+            "io.payclaw.common.identity": [
+                {
+                    version: "2026-01-11",
+                    spec: "https://payclaw.io/ucp/spec/identity",
+                    schema: "https://payclaw.io/ucp/schemas/identity.json",
+                    config: { required: false },
+                },
+            ],
+        },
+    };
+    describe("fetchUCPManifest", () => {
+        it("fetches and returns manifest", async () => {
+            vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(VALID_MANIFEST), { status: 200 }));
+            const result = await fetchUCPManifest("https://shop.example.com");
+            expect(result).toEqual(VALID_MANIFEST);
+        });
+        it("caches manifest per domain", async () => {
+            const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(VALID_MANIFEST), { status: 200 }));
+            await fetchUCPManifest("https://shop.example.com");
+            await fetchUCPManifest("https://shop.example.com");
+            expect(fetchMock).toHaveBeenCalledOnce();
+        });
+        it("normalizes trailing slash", async () => {
+            const fetchMock = vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response(JSON.stringify(VALID_MANIFEST), { status: 200 }));
+            await fetchUCPManifest("https://shop.example.com/");
+            await fetchUCPManifest("https://shop.example.com");
+            expect(fetchMock).toHaveBeenCalledOnce();
+        });
+        it("returns null on network error", async () => {
+            vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("network error"));
+            const result = await fetchUCPManifest("https://shop.example.com");
+            expect(result).toBeNull();
+        });
+        it("returns null on non-200 response", async () => {
+            vi.spyOn(globalThis, "fetch").mockResolvedValue(new Response("Not Found", { status: 404 }));
+            const result = await fetchUCPManifest("https://shop.example.com");
+            expect(result).toBeNull();
+        });
+        it("negative-caches failed fetches", async () => {
+            const fetchMock = vi.spyOn(globalThis, "fetch").mockRejectedValue(new Error("down"));
+            await fetchUCPManifest("https://down.example.com");
+            await fetchUCPManifest("https://down.example.com");
+            expect(fetchMock).toHaveBeenCalledOnce();
+        });
+    });
+    describe("findPayClawCapability", () => {
+        it("finds capability in array-wrapped format", () => {
+            const result = findPayClawCapability(VALID_MANIFEST);
+            expect(result).toEqual({ version: "2026-01-11", required: false });
+        });
+        it("finds capability in plain object format", () => {
+            const manifest = {
+                capabilities: {
+                    "io.payclaw.common.identity": {
+                        version: "2026-01-11",
+                        config: { required: true },
+                    },
+                },
+            };
+            const result = findPayClawCapability(manifest);
+            expect(result).toEqual({ version: "2026-01-11", required: true });
+        });
+        it("returns null when extension not present", () => {
+            const result = findPayClawCapability({ capabilities: {} });
+            expect(result).toBeNull();
+        });
+        it("returns null when no capabilities", () => {
+            const result = findPayClawCapability({});
+            expect(result).toBeNull();
+        });
+    });
+    describe("isVersionCompatible", () => {
+        it("accepts 2026-01-11", () => {
+            expect(isVersionCompatible("2026-01-11")).toBe(true);
+        });
+        it("rejects unknown version", () => {
+            expect(isVersionCompatible("2025-01-01")).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=ucp-manifest.test.js.map

package/dist/lib/ucp-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ucp-manifest.test.js","sourceRoot":"","sources":["../../src/lib/ucp-manifest.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,UAAU,CAAC,GAAG,EAAE;QACd,mBAAmB,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,eAAe,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG;QACrB,YAAY,EAAE;YACZ,4BAA4B,EAAE;gBAC5B;oBACE,OAAO,EAAE,YAAY;oBACrB,IAAI,EAAE,sCAAsC;oBAC5C,MAAM,EAAE,8CAA8C;oBACtD,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAC5B;aACF;SACF;KACF,CAAC;IAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAChC,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC;YAEF,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACnD,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAEnD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACzC,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC/D,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC;YAEF,MAAM,gBAAgB,CAAC,2BAA2B,CAAC,CAAC;YACpD,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAEnD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+BAA+B,EAAE,KAAK,IAAI,EAAE;YAC7C,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;YAChD,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAC7C,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAC3C,CAAC;YACF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAClE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAErF,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YACnD,MAAM,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;YAEnD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,EAAE,CAAC;QAC3C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;QACrC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,QAAQ,GAAG;gBACf,YAAY,EAAE;oBACZ,4BAA4B,EAAE;wBAC5B,OAAO,EAAE,YAAY;wBACrB,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;qBAC3B;iBACF;aACF,CAAC;YACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;QACnC,EAAE,CAAC,oBAAoB,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACjC,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sampling.d.ts

@@ -1,6 +1,24 @@
 import type { Server } from "@modelcontextprotocol/sdk/server/index.js";
+export interface ActiveTrip {
+    token: string;
+    merchant: string;
+    startedAt: number;
+    presented: boolean;
+    presentedAt?: number;
+    outcome?: string;
+    samplingTimer?: ReturnType<typeof setTimeout>;
+}
 export declare function initSampling(server: Server): void;
 export declare function onTripStarted(token: string, merchant: string): void;
 export declare function onIdentityPresented(token: string, merchant: string): void;
-export declare function reportOutcomeFromAgent(token: string, merchant: string, outcome: "accepted" | "denied" | "inconclusive"): void;
 export declare function onServerClose(): void;
+/** Test-only: reset state between tests. No-op when VITEST not set. */
+export declare function resetSamplingState(): void;
+/** Test-only: get trip for assertions. Returns undefined when VITEST not set. */
+export declare function getActiveTrip(token: string): ActiveTrip | undefined;
+/**
+ * Report outcome from agent (payclaw_reportBadgeOutcome tool).
+ * Agent-only path — no sampling prompt. Resolves trip and POSTs to API.
+ * When token not in activeTrips (e.g. after restart), looks up by merchant or POSTs directly.
+ */
+export declare function reportOutcomeFromAgent(token: string, merchant: string, outcome: "accepted" | "denied" | "inconclusive"): void;