@payments-ai/mcp 1.1.2 → 1.4.3

package/dist/main.js

@@ -47,7 +47,8 @@ var require_tool_names = __commonJS({
       GET_MERCHANT_ACTIVATION_STATUS: "get_merchant_activation_status",
       SEARCH_PAYMENTS_AI_DOCS: "search_payments_ai_docs",
       CREATE_PRODUCT: "create_product",
-      UPLOAD_PRODUCT_IMAGE: "upload_product_image",
+      GET_PRODUCT_IMAGE_UPLOAD_URL: "get_product_image_upload_url",
+      CONFIRM_PRODUCT_IMAGE: "confirm_product_image",
       GET_CHECKOUT_CUSTOMIZATION: "get_checkout_customization",
       UPDATE_CHECKOUT_CUSTOMIZATION: "update_checkout_customization"
     };
@@ -103,43 +104,49 @@ var require_create_product = __commonJS({
   }
 });
 
-// ../../packages/mcp-contracts/dist/upload-product-image.js
-var require_upload_product_image = __commonJS({
-  "../../packages/mcp-contracts/dist/upload-product-image.js"(exports) {
+// ../../packages/mcp-contracts/dist/product-image-presigned-upload.js
+var require_product_image_presigned_upload = __commonJS({
+  "../../packages/mcp-contracts/dist/product-image-presigned-upload.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.PRODUCT_IMAGE_MIME_TYPES = exports.MAX_PRODUCT_IMAGE_BYTES = exports.uploadMcpProductImageOutputSchema = exports.uploadMcpProductImageInputSchema = exports.uploadMcpProductImageBodySchema = void 0;
+    exports.PRODUCT_IMAGE_MIME_TYPES = exports.MAX_PRODUCT_IMAGE_UPLOAD_BYTES = exports.confirmProductImageOutputSchema = exports.confirmProductImageInputSchema = exports.confirmProductImageBodySchema = exports.productImageUploadUrlOutputSchema = exports.productImageUploadUrlInputSchema = exports.productImageUploadUrlBodySchema = void 0;
     var zod_1 = __require("zod");
     var PRODUCT_IMAGE_MIME_TYPES = ["image/png", "image/jpeg", "image/jpg", "image/webp"];
     exports.PRODUCT_IMAGE_MIME_TYPES = PRODUCT_IMAGE_MIME_TYPES;
-    var MAX_PRODUCT_IMAGE_BYTES = 358400;
-    exports.MAX_PRODUCT_IMAGE_BYTES = MAX_PRODUCT_IMAGE_BYTES;
+    var MAX_PRODUCT_IMAGE_UPLOAD_BYTES = 5242880;
+    exports.MAX_PRODUCT_IMAGE_UPLOAD_BYTES = MAX_PRODUCT_IMAGE_UPLOAD_BYTES;
     var mimeTypeSchema = zod_1.z.enum(PRODUCT_IMAGE_MIME_TYPES, {
       message: "mimeType must be image/png, image/jpeg, image/jpg, or image/webp. Recovery: convert the file to a supported format."
     });
-    var fileContentBase64Schema = zod_1.z.string().trim().min(1, "fileContentBase64 is required. Recovery: provide the image encoded as base64.").transform((value) => value.replace(/\s/g, "")).refine((value) => value.length > 0, {
-      message: "fileContentBase64 is empty after stripping whitespace."
+    var fileNameSchema = zod_1.z.string().trim().min(1, "fileName is required.").max(255, "fileName must be at most 255 characters.");
+    exports.productImageUploadUrlBodySchema = zod_1.z.object({
+      fileName: fileNameSchema,
+      mimeType: mimeTypeSchema
+    }).strict();
+    exports.productImageUploadUrlInputSchema = exports.productImageUploadUrlBodySchema.extend({
+      merchantId: zod_1.z.uuid(),
+      productId: zod_1.z.uuid()
     });
-    exports.uploadMcpProductImageBodySchema = zod_1.z.object({
-      fileName: zod_1.z.string().trim().min(1, "fileName is required.").max(255, "fileName must be at most 255 characters."),
-      mimeType: mimeTypeSchema,
-      fileContentBase64: fileContentBase64Schema
-    }).superRefine((body, ctx) => {
-      const estimatedBytes = Math.floor(body.fileContentBase64.length * 0.75);
-      if (estimatedBytes > MAX_PRODUCT_IMAGE_BYTES) {
-        ctx.addIssue({
-          code: "custom",
-          message: `Image exceeds the 350 KB limit (estimated ${estimatedBytes} bytes). Recovery: compress or resize the image.`,
-          path: ["fileContentBase64"]
-        });
-      }
+    exports.productImageUploadUrlOutputSchema = zod_1.z.object({
+      // S3 POST endpoint the client submits the multipart/form-data upload to.
+      url: zod_1.z.string(),
+      // Form fields the client must include in the multipart body (policy, signature,
+      // key, Content-Type, ...). The `file` field must be added last per S3's spec.
+      fields: zod_1.z.record(zod_1.z.string(), zod_1.z.string()),
+      // Opaque storage key the client must echo back to confirmProductImage. Bound to the
+      // merchant; confirm rejects keys outside the caller's own prefix.
+      key: zod_1.z.string(),
+      expiresIn: zod_1.z.number().int().positive()
     });
-    exports.uploadMcpProductImageInputSchema = exports.uploadMcpProductImageBodySchema.extend({
+    exports.confirmProductImageBodySchema = zod_1.z.object({
+      key: zod_1.z.string().trim().min(1, "key is required. Recovery: use the key returned by the upload-url step.")
+    }).strict();
+    exports.confirmProductImageInputSchema = exports.confirmProductImageBodySchema.extend({
       merchantId: zod_1.z.uuid(),
       productId: zod_1.z.uuid()
     });
-    exports.uploadMcpProductImageOutputSchema = zod_1.z.object({
-      success: zod_1.z.literal(true)
+    exports.confirmProductImageOutputSchema = zod_1.z.object({
+      imageUrl: zod_1.z.string()
     });
   }
 });
@@ -275,7 +282,7 @@ var require_dist = __commonJS({
   "../../packages/mcp-contracts/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.checkoutCustomizationOutputSchema = exports.updateCheckoutCustomizationInputSchema = exports.getCheckoutCustomizationInputSchema = exports.checkoutCustomizationFieldsSchema = exports.searchPaymentsAiDocsOutputSchema = exports.searchPaymentsAiDocsResultSchema = exports.searchPaymentsAiDocsInputSchema = exports.paymentsAiHealthOutputSchema = exports.paymentsAiHealthBackendSchema = exports.paymentsAiHealthBackendProbeSchema = exports.activationStatusOutputSchema = exports.activationStatusEnumSchema = exports.activationStatusInputSchema = exports.createMerchantAccountOutputSchema = exports.createMerchantAccountInputSchema = exports.PRODUCT_IMAGE_MIME_TYPES = exports.MAX_PRODUCT_IMAGE_BYTES = exports.uploadMcpProductImageOutputSchema = exports.uploadMcpProductImageInputSchema = exports.uploadMcpProductImageBodySchema = exports.createMcpProductOutputSchema = exports.createMcpProductInputSchema = exports.createMcpProductBodySchema = exports.MCP_TOOL_NAMES = void 0;
+    exports.checkoutCustomizationOutputSchema = exports.updateCheckoutCustomizationInputSchema = exports.getCheckoutCustomizationInputSchema = exports.checkoutCustomizationFieldsSchema = exports.searchPaymentsAiDocsOutputSchema = exports.searchPaymentsAiDocsResultSchema = exports.searchPaymentsAiDocsInputSchema = exports.paymentsAiHealthOutputSchema = exports.paymentsAiHealthBackendSchema = exports.paymentsAiHealthBackendProbeSchema = exports.activationStatusOutputSchema = exports.activationStatusEnumSchema = exports.activationStatusInputSchema = exports.createMerchantAccountOutputSchema = exports.createMerchantAccountInputSchema = exports.PRODUCT_IMAGE_MIME_TYPES = exports.MAX_PRODUCT_IMAGE_UPLOAD_BYTES = exports.confirmProductImageOutputSchema = exports.confirmProductImageInputSchema = exports.confirmProductImageBodySchema = exports.productImageUploadUrlOutputSchema = exports.productImageUploadUrlInputSchema = exports.productImageUploadUrlBodySchema = exports.createMcpProductOutputSchema = exports.createMcpProductInputSchema = exports.createMcpProductBodySchema = exports.MCP_TOOL_NAMES = void 0;
     var tool_names_js_1 = require_tool_names();
     Object.defineProperty(exports, "MCP_TOOL_NAMES", { enumerable: true, get: function() {
       return tool_names_js_1.MCP_TOOL_NAMES;
@@ -290,21 +297,30 @@ var require_dist = __commonJS({
     Object.defineProperty(exports, "createMcpProductOutputSchema", { enumerable: true, get: function() {
       return create_product_js_1.createMcpProductOutputSchema;
     } });
-    var upload_product_image_js_1 = require_upload_product_image();
-    Object.defineProperty(exports, "uploadMcpProductImageBodySchema", { enumerable: true, get: function() {
-      return upload_product_image_js_1.uploadMcpProductImageBodySchema;
+    var product_image_presigned_upload_js_1 = require_product_image_presigned_upload();
+    Object.defineProperty(exports, "productImageUploadUrlBodySchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.productImageUploadUrlBodySchema;
+    } });
+    Object.defineProperty(exports, "productImageUploadUrlInputSchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.productImageUploadUrlInputSchema;
     } });
-    Object.defineProperty(exports, "uploadMcpProductImageInputSchema", { enumerable: true, get: function() {
-      return upload_product_image_js_1.uploadMcpProductImageInputSchema;
+    Object.defineProperty(exports, "productImageUploadUrlOutputSchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.productImageUploadUrlOutputSchema;
     } });
-    Object.defineProperty(exports, "uploadMcpProductImageOutputSchema", { enumerable: true, get: function() {
-      return upload_product_image_js_1.uploadMcpProductImageOutputSchema;
+    Object.defineProperty(exports, "confirmProductImageBodySchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.confirmProductImageBodySchema;
     } });
-    Object.defineProperty(exports, "MAX_PRODUCT_IMAGE_BYTES", { enumerable: true, get: function() {
-      return upload_product_image_js_1.MAX_PRODUCT_IMAGE_BYTES;
+    Object.defineProperty(exports, "confirmProductImageInputSchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.confirmProductImageInputSchema;
+    } });
+    Object.defineProperty(exports, "confirmProductImageOutputSchema", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.confirmProductImageOutputSchema;
+    } });
+    Object.defineProperty(exports, "MAX_PRODUCT_IMAGE_UPLOAD_BYTES", { enumerable: true, get: function() {
+      return product_image_presigned_upload_js_1.MAX_PRODUCT_IMAGE_UPLOAD_BYTES;
     } });
     Object.defineProperty(exports, "PRODUCT_IMAGE_MIME_TYPES", { enumerable: true, get: function() {
-      return upload_product_image_js_1.PRODUCT_IMAGE_MIME_TYPES;
+      return product_image_presigned_upload_js_1.PRODUCT_IMAGE_MIME_TYPES;
     } });
     var create_merchant_account_js_1 = require_create_merchant_account();
     Object.defineProperty(exports, "createMerchantAccountInputSchema", { enumerable: true, get: function() {
@@ -482,8 +498,11 @@ function backendActivationStatusPath(merchantId) {
 function backendGetCheckoutCustomizationPath(merchantId) {
   return `/api/v1/mcp/merchants/${merchantId}/checkout/customization`;
 }
-function backendUploadProductImagePath(merchantId, productId) {
-  return `/api/v1/mcp/merchants/${merchantId}/products/${productId}/image`;
+function backendProductImageUploadUrlPath(merchantId, productId) {
+  return `/api/v1/mcp/merchants/${merchantId}/products/${productId}/image/upload-url`;
+}
+function backendConfirmProductImagePath(merchantId, productId) {
+  return `/api/v1/mcp/merchants/${merchantId}/products/${productId}/image/confirm`;
 }
 function backendUpdateCheckoutCustomizationPath(merchantId) {
   return `/api/v1/mcp/merchants/${merchantId}/checkout/customization`;
@@ -624,7 +643,7 @@ function createInstrumentedMcpServer(options2) {
 }
 
 // src/tools/register-tools.ts
-var import_mcp_contracts8 = __toESM(require_dist(), 1);
+var import_mcp_contracts9 = __toESM(require_dist(), 1);
 
 // src/tools/merchant/activation-status.tool.ts
 var import_mcp_contracts = __toESM(require_dist(), 1);
@@ -729,56 +748,117 @@ ${formatZodIssuesForTool(parsed.error.issues)}`
   return { ok: true, data: parsed.data };
 }
 
-// src/tools/product/upload-product-image.tool.ts
+// src/tools/product/get-product-image-upload-url.tool.ts
 var import_mcp_contracts3 = __toESM(require_dist(), 1);
-function runUploadProductImageHandlerValidation(raw) {
-  const parsed = import_mcp_contracts3.uploadMcpProductImageInputSchema.safeParse(raw);
+function runGetProductImageUploadUrlValidation(raw) {
+  const parsed = import_mcp_contracts3.productImageUploadUrlInputSchema.safeParse(raw);
   if (!parsed.success) {
     return {
       ok: false,
-      errorText: `Invalid arguments for upload_product_image.
+      errorText: `Invalid arguments for get_product_image_upload_url.
 ${formatZodIssuesForTool(parsed.error.issues)}`
     };
   }
   return { ok: true, data: parsed.data };
 }
-function mapUploadHttpError(status, message) {
+function mapHttpError(status, message) {
   if (status === 404) {
     return `Product not found for this merchant.
 ${message}
-Recovery: call create_product first and pass the returned id as productId. If the product was just created, retry upload_product_image with the same productId.`;
+Recovery: call create_product first and pass the returned id as productId.`;
   }
   if (status === 422) {
     return `Cannot upload an image for this product.
 ${message}
-Recovery: archived products cannot receive images. Create a new product or restore the product in the dashboard.`;
+Recovery: archived products cannot receive images.`;
+  }
+  return `Backend get product image upload URL request failed.
+${message}
+Recovery: verify BACKEND_BASE_URL and that POST /api/v1/mcp/merchants/:merchantId/products/:productId/image/upload-url is reachable.`;
+}
+async function runGetProductImageUploadUrlHandler(backendClient, input) {
+  const { merchantId, productId, fileName, mimeType } = input;
+  const result = await backendClient.post(backendProductImageUploadUrlPath(merchantId, productId), {
+    fileName,
+    mimeType
+  });
+  if (!result.ok) {
+    return { ok: false, errorText: mapHttpError(result.status, result.message) };
+  }
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(result.bodyText);
+  } catch {
+    return {
+      ok: false,
+      errorText: "Backend returned non-JSON for get product image upload URL. Recovery: confirm the API matches this MCP server version."
+    };
+  }
+  const out = import_mcp_contracts3.productImageUploadUrlOutputSchema.safeParse(parsedJson);
+  if (!out.success) {
+    return {
+      ok: false,
+      errorText: "Backend response did not match expected upload URL output schema. Recovery: inspect backend deployment and shared @pai-managed/mcp-contracts version."
+    };
+  }
+  return { ok: true, data: out.data };
+}
+
+// src/tools/product/confirm-product-image.tool.ts
+var import_mcp_contracts4 = __toESM(require_dist(), 1);
+function runConfirmProductImageValidation(raw) {
+  const parsed = import_mcp_contracts4.confirmProductImageInputSchema.safeParse(raw);
+  if (!parsed.success) {
+    return {
+      ok: false,
+      errorText: `Invalid arguments for confirm_product_image.
+${formatZodIssuesForTool(parsed.error.issues)}`
+    };
+  }
+  return { ok: true, data: parsed.data };
+}
+function mapHttpError2(status, message) {
+  if (status === 404) {
+    return `Product not found for this merchant.
+${message}
+Recovery: pass the same productId used with get_product_image_upload_url.`;
+  }
+  if (status === 422) {
+    return `Cannot upload an image for this product.
+${message}
+Recovery: archived products cannot receive images.`;
   }
   if (status === 400) {
-    return `Image upload rejected by the backend.
+    return `Uploaded image rejected by the backend.
 ${message}
-Recovery: use PNG, JPEG, or WebP under 350 KB and ensure fileContentBase64 matches the declared mimeType.`;
+Recovery: POST the bytes (multipart/form-data with all returned fields, then the file field last) to the upload URL first, use PNG/JPEG/WebP under 5 MB, and pass the exact key returned by get_product_image_upload_url.`;
   }
-  return `Backend upload product image request failed.
+  return `Backend confirm product image request failed.
 ${message}
-Recovery: verify BACKEND_BASE_URL and that POST /api/v1/mcp/merchants/:merchantId/products/:productId/image is reachable. If create_product succeeded but upload failed, retry upload_product_image with the same productId.`;
+Recovery: verify BACKEND_BASE_URL and that POST /api/v1/mcp/merchants/:merchantId/products/:productId/image/confirm is reachable.`;
 }
-async function runUploadProductImageHandler(backendClient, input) {
-  const { merchantId, productId, fileName, mimeType, fileContentBase64 } = input;
-  const result = await backendClient.postNoContent(
-    backendUploadProductImagePath(merchantId, productId),
-    { fileName, mimeType, fileContentBase64 }
-  );
+async function runConfirmProductImageHandler(backendClient, input) {
+  const { merchantId, productId, key } = input;
+  const result = await backendClient.post(backendConfirmProductImagePath(merchantId, productId), {
+    key
+  });
   if (!result.ok) {
+    return { ok: false, errorText: mapHttpError2(result.status, result.message) };
+  }
+  let parsedJson;
+  try {
+    parsedJson = JSON.parse(result.bodyText);
+  } catch {
     return {
       ok: false,
-      errorText: mapUploadHttpError(result.status, result.message)
+      errorText: "Backend returned non-JSON for confirm product image. Recovery: confirm the API matches this MCP server version."
     };
   }
-  const out = import_mcp_contracts3.uploadMcpProductImageOutputSchema.safeParse({ success: true });
+  const out = import_mcp_contracts4.confirmProductImageOutputSchema.safeParse(parsedJson);
   if (!out.success) {
     return {
       ok: false,
-      errorText: "Internal error building upload product image output. Recovery: contact your platform administrator."
+      errorText: "Backend response did not match expected confirm product image output schema. Recovery: inspect backend deployment and shared @pai-managed/mcp-contracts version."
     };
   }
   return { ok: true, data: out.data };
@@ -795,16 +875,18 @@ var DOC_SECTIONS = [
     title: "Create a Product",
     path: "/docs/products-plans#create-a-product",
     content: `1. Call **create_product** with merchantId, name, and at least one plan.
-2. Optionally call **upload_product_image** with the returned product id as productId, plus fileName, mimeType, and fileContentBase64 (PNG/JPEG/WebP, max 350 KB).
+2. Optionally attach an image via the presigned upload flow: call **get_product_image_upload_url** with the returned product id, POST the raw bytes (multipart/form-data with the returned fields + file last) to the returned URL, then call **confirm_product_image** with the returned key.
 3. Use a returned planId to build a checkout URL: {checkout-base-url}/payment/{planId}`
   },
   {
     title: "Upload a Product Image (MCP)",
     path: "/docs/products-plans#upload-product-image-mcp",
     content: `After create_product returns an id:
-1. Call **upload_product_image** with merchantId, productId (the create_product id), fileName, mimeType, and fileContentBase64.
-2. Supported formats: PNG, JPEG, WebP. Maximum size: 350 KB.
-3. If upload fails after create, retry upload_product_image with the same productId \u2014 the product row is kept.`
+1. Call **get_product_image_upload_url** with merchantId, productId, fileName, and mimeType. It returns { url, fields, key, expiresIn }.
+2. HTTP POST the raw file bytes to \`url\` as \`multipart/form-data\`: add every entry from \`fields\` as a form field FIRST, then add the \`file\` field last (S3 requires the file field last). Example: \`curl -X POST -F "key=<fields.key>" -F "Content-Type=<mimeType>" -F "policy=<fields.policy>" -F "x-amz-signature=<fields['x-amz-signature']>" ... -F "file=@./logo.png" "<url>"\`.
+3. Call **confirm_product_image** with merchantId, productId, and the returned key to validate and attach the image.
+4. Supported formats: PNG, JPEG, WebP. Maximum size: 5 MB (enforced by S3 at upload time via a \`content-length-range\` policy condition \u2014 oversized bodies return a 403 from S3, before the backend ever sees them).
+5. If confirm fails, retry get_product_image_upload_url + POST + confirm_product_image with the same productId \u2014 the product row is kept; the previous rejected upload was cleaned up by the backend.`
   },
   {
     title: "Plan Fields",
@@ -883,7 +965,7 @@ function runSearchPaymentsAiDocsHandler(query) {
 }
 
 // src/tools/health/payments-ai-health.tool.ts
-var import_mcp_contracts4 = __toESM(require_dist(), 1);
+var import_mcp_contracts5 = __toESM(require_dist(), 1);
 async function buildPaymentsAiHealthOutput(backendClient) {
   const base = {
     serverName: "pai-managed-mcp-server",
@@ -892,11 +974,11 @@ async function buildPaymentsAiHealthOutput(backendClient) {
     backend: { baseUrlConfigured: false }
   };
   if (!backendClient) {
-    return import_mcp_contracts4.paymentsAiHealthOutputSchema.parse(base);
+    return import_mcp_contracts5.paymentsAiHealthOutputSchema.parse(base);
   }
   const result = await backendClient.get(BACKEND_HTTP_HEALTH_PATH);
   if (!result.ok) {
-    return import_mcp_contracts4.paymentsAiHealthOutputSchema.parse({
+    return import_mcp_contracts5.paymentsAiHealthOutputSchema.parse({
       ...base,
       backend: {
         baseUrlConfigured: true,
@@ -918,7 +1000,7 @@ async function buildPaymentsAiHealthOutput(backendClient) {
   } catch {
     message = result.bodyText.slice(0, 500) || message;
   }
-  return import_mcp_contracts4.paymentsAiHealthOutputSchema.parse({
+  return import_mcp_contracts5.paymentsAiHealthOutputSchema.parse({
     ...base,
     backend: {
       baseUrlConfigured: true,
@@ -933,15 +1015,15 @@ async function buildPaymentsAiHealthOutput(backendClient) {
 }
 
 // src/tools/merchant/create-merchant-account.tool.ts
-var import_mcp_contracts5 = __toESM(require_dist(), 1);
+var import_mcp_contracts6 = __toESM(require_dist(), 1);
 var STUB_MERCHANT = {
   merchantId: "01930000-0000-7000-8000-000000000001"
 };
 function buildCreateMerchantAccountStub(_input) {
-  return import_mcp_contracts5.createMerchantAccountOutputSchema.parse(STUB_MERCHANT);
+  return import_mcp_contracts6.createMerchantAccountOutputSchema.parse(STUB_MERCHANT);
 }
 function runCreateMerchantAccountHandler(raw) {
-  const parsed = import_mcp_contracts5.createMerchantAccountInputSchema.safeParse(raw);
+  const parsed = import_mcp_contracts6.createMerchantAccountInputSchema.safeParse(raw);
   if (!parsed.success) {
     return {
       ok: false,
@@ -974,7 +1056,7 @@ Recovery: verify BACKEND_BASE_URL and that POST ${BACKEND_CREATE_MERCHANT_ACCOUN
       errorText: "Backend returned non-JSON for create_merchant_account. Recovery: confirm the API matches this MCP server version."
     };
   }
-  const out = import_mcp_contracts5.createMerchantAccountOutputSchema.safeParse(parsedJson);
+  const out = import_mcp_contracts6.createMerchantAccountOutputSchema.safeParse(parsedJson);
   if (!out.success) {
     return {
       ok: false,
@@ -985,9 +1067,9 @@ Recovery: verify BACKEND_BASE_URL and that POST ${BACKEND_CREATE_MERCHANT_ACCOUN
 }
 
 // src/tools/checkout/get-checkout-customization.tool.ts
-var import_mcp_contracts6 = __toESM(require_dist(), 1);
+var import_mcp_contracts7 = __toESM(require_dist(), 1);
 function runGetCheckoutCustomizationValidation(raw) {
-  const parsed = import_mcp_contracts6.getCheckoutCustomizationInputSchema.safeParse(raw);
+  const parsed = import_mcp_contracts7.getCheckoutCustomizationInputSchema.safeParse(raw);
   if (!parsed.success) {
     return {
       ok: false,
@@ -1017,7 +1099,7 @@ Recovery: verify BACKEND_BASE_URL and that GET /api/v1/mcp/merchants/:merchantId
     };
   }
   const customization = parsedJson?.customization;
-  const out = import_mcp_contracts6.checkoutCustomizationOutputSchema.safeParse(customization);
+  const out = import_mcp_contracts7.checkoutCustomizationOutputSchema.safeParse(customization);
   if (!out.success) {
     return {
       ok: false,
@@ -1028,9 +1110,9 @@ Recovery: verify BACKEND_BASE_URL and that GET /api/v1/mcp/merchants/:merchantId
 }
 
 // src/tools/checkout/update-checkout-customization.tool.ts
-var import_mcp_contracts7 = __toESM(require_dist(), 1);
+var import_mcp_contracts8 = __toESM(require_dist(), 1);
 function runUpdateCheckoutCustomizationValidation(raw) {
-  const parsed = import_mcp_contracts7.updateCheckoutCustomizationInputSchema.safeParse(raw);
+  const parsed = import_mcp_contracts8.updateCheckoutCustomizationInputSchema.safeParse(raw);
   if (!parsed.success) {
     return {
       ok: false,
@@ -1063,7 +1145,7 @@ Recovery: verify BACKEND_BASE_URL and that PATCH /api/v1/mcp/merchants/:merchant
     };
   }
   const updated = parsedJson?.customization;
-  const out = import_mcp_contracts7.checkoutCustomizationOutputSchema.safeParse(updated);
+  const out = import_mcp_contracts8.checkoutCustomizationOutputSchema.safeParse(updated);
   if (!out.success) {
     return {
       ok: false,
@@ -1092,10 +1174,10 @@ function registerTools(server, options2) {
   const backendClient = options2?.backendClient ?? createBackendClientFromEnv();
   const mcpTokenPayload = options2?.mcpTokenPayload;
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.PAYMENTS_AI_HEALTH,
+    import_mcp_contracts9.MCP_TOOL_NAMES.PAYMENTS_AI_HEALTH,
     {
       description: "Check whether the PAI Managed MCP server is healthy. Returns server version and connectivity status.",
-      outputSchema: import_mcp_contracts8.paymentsAiHealthOutputSchema
+      outputSchema: import_mcp_contracts9.paymentsAiHealthOutputSchema
     },
     async () => {
       if (!isScopeAllowed("health:read", mcpTokenPayload)) {
@@ -1109,11 +1191,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.CREATE_MERCHANT_ACCOUNT,
+    import_mcp_contracts9.MCP_TOOL_NAMES.CREATE_MERCHANT_ACCOUNT,
     {
       description: "Create a merchant account on PAI Managed. Provide a business name and email; returns a merchant ID you can use with other tools such as create_product.",
-      inputSchema: import_mcp_contracts8.createMerchantAccountInputSchema,
-      outputSchema: import_mcp_contracts8.createMerchantAccountOutputSchema
+      inputSchema: import_mcp_contracts9.createMerchantAccountInputSchema,
+      outputSchema: import_mcp_contracts9.createMerchantAccountOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("merchant:create", mcpTokenPayload)) {
@@ -1134,11 +1216,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.GET_MERCHANT_ACTIVATION_STATUS,
+    import_mcp_contracts9.MCP_TOOL_NAMES.GET_MERCHANT_ACTIVATION_STATUS,
     {
       description: 'Get the production activation status of a merchant account on PAI Managed. Returns "pending" (account exists, activation in progress) or "not_provisioned" (not yet set up).',
-      inputSchema: import_mcp_contracts8.activationStatusInputSchema,
-      outputSchema: import_mcp_contracts8.activationStatusOutputSchema
+      inputSchema: import_mcp_contracts9.activationStatusInputSchema,
+      outputSchema: import_mcp_contracts9.activationStatusOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("merchant:read", mcpTokenPayload)) {
@@ -1158,11 +1240,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.SEARCH_PAYMENTS_AI_DOCS,
+    import_mcp_contracts9.MCP_TOOL_NAMES.SEARCH_PAYMENTS_AI_DOCS,
     {
       description: "Search the PAI Managed documentation knowledge base to find guides, API references, UI walkthroughs, and feature explanations. Returns matching sections with titles and direct documentation links. Use this tool to understand how PAI Managed works, find step-by-step instructions for dashboard tasks, or locate specific features such as creating products, configuring plans, or generating checkout links.",
-      inputSchema: import_mcp_contracts8.searchPaymentsAiDocsInputSchema,
-      outputSchema: import_mcp_contracts8.searchPaymentsAiDocsOutputSchema
+      inputSchema: import_mcp_contracts9.searchPaymentsAiDocsInputSchema,
+      outputSchema: import_mcp_contracts9.searchPaymentsAiDocsOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("docs:read", mcpTokenPayload)) {
@@ -1176,11 +1258,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.CREATE_PRODUCT,
+    import_mcp_contracts9.MCP_TOOL_NAMES.CREATE_PRODUCT,
     {
-      description: "Create a product with one or more pricing plans for a merchant on the PAI Managed platform. Products represent digital offerings (software, subscriptions, services) that customers can purchase via a checkout link. Each plan defines the price (in USD cents), billing type (one-time, recurring, or free-access), and billing period. Returns the product ID and the plan IDs; use a plan ID to build a checkout URL for your customers. Product images are not supported on create \u2014 after success, call upload_product_image with the returned id as productId.",
-      inputSchema: import_mcp_contracts8.createMcpProductInputSchema,
-      outputSchema: import_mcp_contracts8.createMcpProductOutputSchema
+      description: "Create a product with one or more pricing plans for a merchant on the PAI Managed platform. Products represent digital offerings (software, subscriptions, services) that customers can purchase via a checkout link. Each plan defines the price (in USD cents), billing type (one-time, recurring, or free-access), and billing period. Returns the product ID and the plan IDs; use a plan ID to build a checkout URL for your customers. Product images are not supported on create \u2014 after success, call get_product_image_upload_url with the returned id as productId, POST the file bytes (multipart/form-data) to the returned URL, then call confirm_product_image with the returned key.",
+      inputSchema: import_mcp_contracts9.createMcpProductInputSchema,
+      outputSchema: import_mcp_contracts9.createMcpProductOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("product:create", mcpTokenPayload)) {
@@ -1209,17 +1291,50 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.UPLOAD_PRODUCT_IMAGE,
+    import_mcp_contracts9.MCP_TOOL_NAMES.GET_PRODUCT_IMAGE_UPLOAD_URL,
+    {
+      description: 'Get a presigned POST policy to upload a product image directly to storage \u2014 the image bytes never pass through the tool call, and S3 enforces the 5 MB cap at upload time via `content-length-range` (oversized bodies get a 403 from S3, not the backend). Use this on any surface that can issue an HTTP multipart/form-data POST (CLI, agent, dashboard). The product must already exist (call create_product first). Provide merchantId, productId, fileName, and mimeType (image/png, image/jpeg, image/jpg, or image/webp). Returns { url, fields, key, expiresIn }: issue an HTTP POST to `url` with Content-Type: multipart/form-data. Add every entry from `fields` as a form field FIRST, then add the `file` field last (S3 requires the file field last), e.g. `curl -X POST <all -F fields...> -F "file=@./logo.png" "<url>"`. Then call confirm_product_image with the returned key to validate and attach the image.',
+      inputSchema: import_mcp_contracts9.productImageUploadUrlInputSchema,
+      outputSchema: import_mcp_contracts9.productImageUploadUrlOutputSchema
+    },
+    async (args) => {
+      if (!isScopeAllowed("product:create", mcpTokenPayload)) {
+        return toolError("Insufficient scope.");
+      }
+      const validation = runGetProductImageUploadUrlValidation(args);
+      if (!validation.ok) {
+        return toolError(validation.errorText);
+      }
+      if (!isMerchantAllowed(validation.data.merchantId, mcpTokenPayload)) {
+        return toolError("Merchant not authorized for this MCP key.");
+      }
+      if (!backendClient) {
+        return toolError(
+          "The PAI Managed backend is not reachable. Contact your platform administrator to configure backend connectivity."
+        );
+      }
+      const result = await runGetProductImageUploadUrlHandler(backendClient, validation.data);
+      if (!result.ok) {
+        return toolError(result.errorText);
+      }
+      return {
+        content: [{ type: "text", text: JSON.stringify(result.data) }],
+        structuredContent: result.data
+      };
+    }
+  );
+  server.registerTool(
+    import_mcp_contracts9.MCP_TOOL_NAMES.CONFIRM_PRODUCT_IMAGE,
     {
-      description: "Upload a product image for an existing product on PAI Managed. The product must already exist (call create_product first). Requires merchantId, productId, fileName, mimeType (image/png, image/jpeg, image/jpg, or image/webp), and fileContentBase64 (max 350 KB). Replaces any existing product image. On failure after create_product, retry upload_product_image with the same productId.",
-      inputSchema: import_mcp_contracts8.uploadMcpProductImageInputSchema,
-      outputSchema: import_mcp_contracts8.uploadMcpProductImageOutputSchema
+      description: "Confirm a product image uploaded via a presigned POST policy from get_product_image_upload_url. Call this after the multipart/form-data POST succeeds. Provide merchantId, productId, and the key returned by get_product_image_upload_url. The backend validates the stored object (format, size, magic bytes) and attaches it to the product. Returns { imageUrl } for verification. Replaces any existing product image.",
+      inputSchema: import_mcp_contracts9.confirmProductImageInputSchema,
+      outputSchema: import_mcp_contracts9.confirmProductImageOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("product:create", mcpTokenPayload)) {
         return toolError("Insufficient scope.");
       }
-      const validation = runUploadProductImageHandlerValidation(args);
+      const validation = runConfirmProductImageValidation(args);
       if (!validation.ok) {
         return toolError(validation.errorText);
       }
@@ -1231,7 +1346,7 @@ function registerTools(server, options2) {
           "The PAI Managed backend is not reachable. Contact your platform administrator to configure backend connectivity."
         );
       }
-      const result = await runUploadProductImageHandler(backendClient, validation.data);
+      const result = await runConfirmProductImageHandler(backendClient, validation.data);
       if (!result.ok) {
         return toolError(result.errorText);
       }
@@ -1242,11 +1357,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.GET_CHECKOUT_CUSTOMIZATION,
+    import_mcp_contracts9.MCP_TOOL_NAMES.GET_CHECKOUT_CUSTOMIZATION,
     {
       description: "Get a merchant's checkout customization on PAI Managed \u2014 theme mode, colors (background, button, button text, font), font family, input style, and the current logo URL (read-only). Use this to inspect current branding before changing it.",
-      inputSchema: import_mcp_contracts8.getCheckoutCustomizationInputSchema,
-      outputSchema: import_mcp_contracts8.checkoutCustomizationOutputSchema
+      inputSchema: import_mcp_contracts9.getCheckoutCustomizationInputSchema,
+      outputSchema: import_mcp_contracts9.checkoutCustomizationOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("checkout:read", mcpTokenPayload)) {
@@ -1275,11 +1390,11 @@ function registerTools(server, options2) {
     }
   );
   server.registerTool(
-    import_mcp_contracts8.MCP_TOOL_NAMES.UPDATE_CHECKOUT_CUSTOMIZATION,
+    import_mcp_contracts9.MCP_TOOL_NAMES.UPDATE_CHECKOUT_CUSTOMIZATION,
     {
       description: "Update a merchant's checkout customization on PAI Managed. Fields are MERGED: send only the fields you want to change \u2014 any field you omit is left unchanged. To remove/reset a field, use the dashboard (clearing is not supported over MCP). Colors are 6-digit hex like '#1A2B3C'; fontFamily is 'Inter' or 'Roboto'; themeMode is 'light' or 'dark'; inputStyle is 'rounded' or 'square'. The logo is set via the dashboard. Returns the full customization after the merge.",
-      inputSchema: import_mcp_contracts8.updateCheckoutCustomizationInputSchema,
-      outputSchema: import_mcp_contracts8.checkoutCustomizationOutputSchema
+      inputSchema: import_mcp_contracts9.updateCheckoutCustomizationInputSchema,
+      outputSchema: import_mcp_contracts9.checkoutCustomizationOutputSchema
     },
     async (args) => {
       if (!isScopeAllowed("checkout:write", mcpTokenPayload)) {

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "@payments-ai/mcp",
-  "version": "1.1.2",
+  "version": "1.4.3",
   "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
   "description": "MCP for Payments AI",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/paymentsai/pai-managed.git",
+    "directory": "apps/mcp-server"
+  },
   "bin": {
     "payments-ai-mcp": "./dist/main.js"
   },
@@ -15,23 +23,23 @@
     "start": "node dist/main.http.js",
     "dev": "tsx watch src/main.http.ts",
     "build": "node esbuild.config.mjs",
-    "build:http": "pnpm exec tsgo -p tsconfig.json",
+    "build:types": "pnpm exec tsgo -p tsconfig.build.json",
     "typecheck": "pnpm exec tsgo --noEmit -p tsconfig.json",
     "lint": "oxlint .",
     "lint:fix": "oxlint --fix .",
     "test": "tsx --test test/**/*.test.ts",
-    "clean": "rm -rf dist",
-    "prepublishOnly": "pnpm run clean && pnpm run build"
+    "clean": "rm -rf dist dist-types",
+    "prepublishOnly": "pnpm --filter @pai-managed/mcp-contracts run build && pnpm run clean && pnpm run build"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "1.29.0",
-    "@pai-managed/mcp-contracts": "workspace:*",
     "@sentry/node": "10.58.0",
     "cors": "2.8.6",
     "dotenv": "17.3.1",
     "zod": "4.4.3"
   },
   "devDependencies": {
+    "@pai-managed/mcp-contracts": "workspace:*",
     "@tsconfig/node24": "24.0.4",
     "@types/cors": "2.8.19",
     "@types/express": "5.0.6",
@@ -43,5 +51,5 @@
   "engines": {
     "node": ">=24"
   },
-  "mcpName": "io.github.szarl/payments-ai-mcp"
+  "mcpName": "ai.payments.managed/payments-ai-mcp"
 }