@payments-ai/mcp 2.6.0 → 2.7.1

package/dist/main.http.js

@@ -274,7 +274,11 @@ function isExplicitGrantScope(scope) {
 }
 var DEFAULT_OAUTH_SCOPES = OAUTH_CONSENT_READ_SCOPES.filter((scope) => !isExplicitGrantScope(scope));
 var OAUTH_RESPONSE_TYPES_SUPPORTED = ["code"];
-var OAUTH_GRANT_TYPES_SUPPORTED = ["authorization_code"];
+var OAUTH_DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+var OAUTH_GRANT_TYPES_SUPPORTED = [
+  "authorization_code",
+  OAUTH_DEVICE_CODE_GRANT_TYPE
+];
 var OAUTH_CODE_CHALLENGE_METHODS_SUPPORTED = ["S256"];
 function buildOAuthAuthorizationServerMetadata(issuerUrl, options2) {
   return {
@@ -283,6 +287,7 @@ function buildOAuthAuthorizationServerMetadata(issuerUrl, options2) {
     token_endpoint: `${issuerUrl}/api/v1/oauth/token`,
     revocation_endpoint: `${issuerUrl}/api/v1/oauth/revoke`,
     registration_endpoint: `${issuerUrl}/api/v1/oauth/register`,
+    device_authorization_endpoint: `${issuerUrl}/api/v1/oauth/device_authorization`,
     scopes_supported: SUPPORTED_OAUTH_SCOPES,
     response_types_supported: OAUTH_RESPONSE_TYPES_SUPPORTED,
     grant_types_supported: OAUTH_GRANT_TYPES_SUPPORTED,
@@ -296,12 +301,67 @@ function buildOAuthAuthorizationServerMetadata(issuerUrl, options2) {
 var MCP_OAUTH_AUTHORIZATION_WINDOW_MINUTES = 30;
 var MCP_OAUTH_AUTHORIZATION_WINDOW_MS = MCP_OAUTH_AUTHORIZATION_WINDOW_MINUTES * 60 * 1e3;
 
+// ../../packages/mcp-contracts/dist/device-user-code.js
+var DEVICE_USER_CODE_ALPHABET = "BCDFGHJKLMNPQRSTVWXZ";
+var DEVICE_USER_CODE_LENGTH = 8;
+var DEVICE_USER_CODE_PATTERN = new RegExp(`^[${DEVICE_USER_CODE_ALPHABET}]{${DEVICE_USER_CODE_LENGTH}}$`);
+
 // ../../packages/mcp-contracts/dist/order-limits.js
 var import_currency2 = __toESM(require_currency(), 1);
 
 // ../../packages/mcp-contracts/dist/currency-precision.js
 var import_currency = __toESM(require_currency(), 1);
 
+// ../../packages/mcp-contracts/dist/precision-messages.js
+function formatAmountPrecisionMessage(currency5, fractionDigits) {
+  const code = currency5.trim().toUpperCase();
+  if (fractionDigits === 0) {
+    return `Amount must be a whole number of ${code}, which has no minor unit. Recovery: round the amount to whole ${code}, e.g. 500 rather than 500.5.`;
+  }
+  return `Amount must have at most ${fractionDigits} decimal places in ${code}. Recovery: round the amount to ${fractionDigits} decimal places.`;
+}
+
+// ../../packages/mcp-contracts/dist/currency-precision.js
+function currencyFractionDigits(currencyCode3) {
+  const code = currencyCode3.trim().toUpperCase();
+  let digits;
+  try {
+    digits = new Intl.NumberFormat("en-US", {
+      style: "currency",
+      currency: code
+    }).resolvedOptions().maximumFractionDigits;
+  } catch {
+    throw new Error(`Unsupported currency "${currencyCode3}"`);
+  }
+  if (typeof digits !== "number") {
+    throw new Error(`Unsupported currency "${currencyCode3}"`);
+  }
+  return digits;
+}
+var MINOR_UNIT_RELATIVE_TOLERANCE = Number.EPSILON * 16;
+function amountExceedsCurrencyPrecision(amount, currencyCode3) {
+  const minorUnits = amount * 10 ** currencyFractionDigits(currencyCode3);
+  const drift = Math.abs(minorUnits - Math.round(minorUnits));
+  return drift > Math.abs(minorUnits) * MINOR_UNIT_RELATIVE_TOLERANCE;
+}
+function describeAmountPrecisionViolation(amount, currencyCode3) {
+  const fractionDigits = resolveFractionDigits(currencyCode3);
+  if (fractionDigits === void 0 || !amountExceedsCurrencyPrecision(amount, currencyCode3)) {
+    return void 0;
+  }
+  return formatAmountPrecisionMessage(currencyCode3, fractionDigits);
+}
+function describeRequestAmountPrecisionViolation(amount, currencyCode3) {
+  return describeAmountPrecisionViolation((0, import_currency.default)(amount).value, currencyCode3);
+}
+function resolveFractionDigits(currencyCode3) {
+  try {
+    return currencyFractionDigits(currencyCode3);
+  } catch {
+    return void 0;
+  }
+}
+
 // ../../packages/mcp-contracts/dist/plan-amount-limits.js
 var DEFAULT_MIN_PAID_PLAN_AMOUNT = 1;
 var MIN_PAID_PLAN_AMOUNT_BY_CURRENCY = {
@@ -334,13 +394,6 @@ function formatMinPaidPlanAmountMessage(currency5, minAmount) {
   const code = currency5.trim().toUpperCase() || "USD";
   return `Amount must be at least ${minAmount} ${code} for paid plans`;
 }
-function formatAmountPrecisionMessage(currency5, fractionDigits) {
-  const code = currency5.trim().toUpperCase();
-  if (fractionDigits === 0) {
-    return `Amount must be a whole number of ${code}, which has no minor unit. Recovery: round the amount to whole ${code}, e.g. 500 rather than 500.5.`;
-  }
-  return `Amount must have at most ${fractionDigits} decimal places in ${code}. Recovery: round the amount to ${fractionDigits} decimal places.`;
-}
 var LOWEST_MIN_PAID_PLAN_AMOUNT = Math.min(...Object.values(MIN_PAID_PLAN_AMOUNT_BY_CURRENCY));
 var PAID_PLAN_NOT_FREE_BY_ZERO_AMOUNT = "A paid plan cannot be made free by setting its amount to 0; create a free-access plan instead.";
 function formatAmountBelowLowestFloorMessage() {
@@ -391,47 +444,6 @@ function formatPeriodLengthRecovery(maxLength) {
 }
 var MAX_FREE_TRIAL_DAYS = 730;
 
-// ../../packages/mcp-contracts/dist/currency-precision.js
-function currencyFractionDigits(currencyCode3) {
-  const code = currencyCode3.trim().toUpperCase();
-  let digits;
-  try {
-    digits = new Intl.NumberFormat("en-US", {
-      style: "currency",
-      currency: code
-    }).resolvedOptions().maximumFractionDigits;
-  } catch {
-    throw new Error(`Unsupported currency "${currencyCode3}"`);
-  }
-  if (typeof digits !== "number") {
-    throw new Error(`Unsupported currency "${currencyCode3}"`);
-  }
-  return digits;
-}
-var MINOR_UNIT_RELATIVE_TOLERANCE = Number.EPSILON * 16;
-function amountExceedsCurrencyPrecision(amount, currencyCode3) {
-  const minorUnits = amount * 10 ** currencyFractionDigits(currencyCode3);
-  const drift = Math.abs(minorUnits - Math.round(minorUnits));
-  return drift > Math.abs(minorUnits) * MINOR_UNIT_RELATIVE_TOLERANCE;
-}
-function describeAmountPrecisionViolation(amount, currencyCode3) {
-  const fractionDigits = resolveFractionDigits(currencyCode3);
-  if (fractionDigits === void 0 || !amountExceedsCurrencyPrecision(amount, currencyCode3)) {
-    return void 0;
-  }
-  return formatAmountPrecisionMessage(currencyCode3, fractionDigits);
-}
-function describeRequestAmountPrecisionViolation(amount, currencyCode3) {
-  return describeAmountPrecisionViolation((0, import_currency.default)(amount).value, currencyCode3);
-}
-function resolveFractionDigits(currencyCode3) {
-  try {
-    return currencyFractionDigits(currencyCode3);
-  } catch {
-    return void 0;
-  }
-}
-
 // ../../packages/mcp-contracts/dist/order-limits.js
 function getMaxOrderAmount(currency5) {
   return getMaxPlanAmount(currency5);
@@ -591,7 +603,7 @@ function isPricedItem(item) {
   return typeof item === "object" && item !== null && "unitPrice" in item && typeof item.unitPrice === "number" && "quantity" in item && typeof item.quantity === "number";
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/external.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
   $brand: () => $brand,
@@ -854,7 +866,7 @@ __export(external_exports, {
   xor: () => xor
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/index.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/index.js
 var core_exports2 = {};
 __export(core_exports2, {
   $ZodAny: () => $ZodAny,
@@ -1171,7 +1183,7 @@ __export(core_exports2, {
   withParser: () => withParser
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/util.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/util.js
 var util_exports = {};
 __export(util_exports, {
   BIGINT_FORMAT_RANGES: () => BIGINT_FORMAT_RANGES,
@@ -1242,6 +1254,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -1761,6 +1774,18 @@ function prefixIssues(path2, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2014,7 +2039,7 @@ function constantCatch(value) {
   return fn;
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/core.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/core.js
 var _a;
 var NEVER = /* @__PURE__ */ Object.freeze({
   status: "aborted"
@@ -2136,7 +2161,7 @@ function config(newConfig) {
   return globalConfig;
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/errors.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/errors.js
 function _getMessage() {
   const internals = this._zod;
   internals.message ?? (internals.message = JSON.stringify(internals.def, jsonStringifyReplacer, 2));
@@ -2328,7 +2353,7 @@ function prettifyError(error62) {
   return lines.join("\n");
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/parse.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/parse.js
 function finalizeParams(callee, params) {
   return { callee: params?.callee ?? callee, Err: params?.Err };
 }
@@ -2488,7 +2513,7 @@ var _safeDecodeAsync = (_Err) => async (schema, value, _ctx) => {
 };
 var safeDecodeAsync = /* @__PURE__ */ _safeDecodeAsync($ZodRealError);
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/regexes.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/regexes.js
 var regexes_exports = {};
 __export(regexes_exports, {
   anyString: () => anyString,
@@ -2660,7 +2685,7 @@ var sha512_hex = /^[0-9a-fA-F]{128}$/;
 var sha512_base64 = /* @__PURE__ */ fixedBase64(86, "==");
 var sha512_base64url = /* @__PURE__ */ fixedBase64url(86);
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/checks.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/checks.js
 var $ZodCheck = /* @__PURE__ */ $constructor("$ZodCheck", (inst, def) => {
   var _a3;
   inst._zod ?? (inst._zod = {});
@@ -3136,7 +3161,7 @@ var $ZodCheckOverwrite = /* @__PURE__ */ $constructor("$ZodCheckOverwrite", (ins
   };
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/doc.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/doc.js
 var Doc = class {
   constructor(args = [], closed = {}) {
     this.content = [];
@@ -3177,14 +3202,14 @@ ${content.join("\n")}
   }
 };
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/versions.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/versions.js
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/schemas.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/schemas.js
 var $ZodType = /* @__PURE__ */ $constructor("$ZodType", (inst, def) => {
   var _a3;
   inst ?? (inst = {});
@@ -3937,6 +3962,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse4 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse4(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result2, final, index) {
   if (result2.issues.length) {
     final.issues.push(...prefixIssues(index, result2.issues));
@@ -3980,6 +4030,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result2, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -4936,6 +4987,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -5002,6 +5054,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result2, final) {
   if (result2.issues.length) {
@@ -5598,7 +5651,7 @@ function handleRefineResult(result2, payload, input2, inst) {
   }
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/memoizer.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/memoizer.js
 var $ZodCyclicError = class extends Error {
   constructor() {
     super(`Cannot parse a reference cycle that closes through a transform`);
@@ -5875,7 +5928,7 @@ function isBackEdge(ctx, value) {
   return backEdges !== void 0 && isRef(value) && backEdges.has(value);
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/index.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/index.js
 var locales_exports = {};
 __export(locales_exports, {
   ar: () => ar_default,
@@ -5943,7 +5996,7 @@ __export(locales_exports, {
   zhTW: () => zh_TW_default
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ar.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ar.js
 var error = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0641", verb: "\u0623\u0646 \u064A\u062D\u0648\u064A" },
@@ -6055,7 +6108,7 @@ function ar_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/az.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/az.js
 var error2 = () => {
   const Sizable = {
     string: { unit: "simvol", verb: "olmal\u0131d\u0131r" },
@@ -6166,7 +6219,7 @@ function az_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/be.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/be.js
 function getBelarusianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -6335,7 +6388,7 @@ function be_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bg.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/bg.js
 var error4 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0430", verb: "\u0434\u0430 \u0441\u044A\u0434\u044A\u0440\u0436\u0430" },
@@ -6461,7 +6514,7 @@ function bg_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/bn.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/bn.js
 var error5 = () => {
   const Sizable = {
     string: { unit: "\u0985\u0995\u09CD\u09B7\u09B0", verb: "\u09A5\u09BE\u0995\u09A4\u09C7 \u09B9\u09AC\u09C7" },
@@ -6575,7 +6628,7 @@ function bn_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ca.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ca.js
 var error6 = () => {
   const Sizable = {
     string: { unit: "car\xE0cters", verb: "contenir" },
@@ -6689,7 +6742,7 @@ function ca_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ckb.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ckb.js
 var error7 = () => {
   const Sizable = {
     string: { unit: "\u067E\u06CC\u062A", verb: "\u0628\u06CE\u062A" },
@@ -6822,7 +6875,7 @@ function ckb_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/cs.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/cs.js
 var error8 = () => {
   const Sizable = {
     string: { unit: "znak\u016F", verb: "m\xEDt" },
@@ -6939,7 +6992,7 @@ function cs_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/da.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/da.js
 var error9 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "havde" },
@@ -7060,7 +7113,7 @@ function da_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/de.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/de.js
 var error10 = () => {
   const Sizable = {
     string: { unit: "Zeichen", verb: "zu haben" },
@@ -7174,7 +7227,7 @@ function de_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/el.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/el.js
 var error11 = () => {
   const Sizable = {
     string: { unit: "\u03C7\u03B1\u03C1\u03B1\u03BA\u03C4\u03AE\u03C1\u03B5\u03C2", verb: "\u03BD\u03B1 \u03AD\u03C7\u03B5\u03B9" },
@@ -7287,7 +7340,7 @@ function el_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/en.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/en.js
 var error12 = () => {
   const Sizable = {
     string: { unit: "characters", verb: "to have" },
@@ -7412,7 +7465,7 @@ function en_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/eo.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/eo.js
 var error13 = () => {
   const Sizable = {
     string: { unit: "karaktrojn", verb: "havi" },
@@ -7527,7 +7580,7 @@ function eo_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/es.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/es.js
 var error14 = () => {
   const Sizable = {
     string: { unit: "caracteres", verb: "tener" },
@@ -7664,7 +7717,7 @@ function es_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fa.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/fa.js
 var error15 = () => {
   const Sizable = {
     string: { unit: "\u06A9\u0627\u0631\u0627\u06A9\u062A\u0631", verb: "\u062F\u0627\u0634\u062A\u0647 \u0628\u0627\u0634\u062F" },
@@ -7784,7 +7837,7 @@ function fa_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fi.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/fi.js
 var error16 = () => {
   const Sizable = {
     string: { unit: "merkki\xE4", subject: "merkkijonon" },
@@ -7902,7 +7955,7 @@ function fi_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/fr.js
 var error17 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -8032,7 +8085,7 @@ function fr_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/fr-CA.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/fr-CA.js
 var error18 = () => {
   const Sizable = {
     string: { unit: "caract\xE8res", verb: "avoir" },
@@ -8145,7 +8198,7 @@ function fr_CA_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/gu.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/gu.js
 var error19 = () => {
   const Sizable = {
     string: { unit: "\u0A85\u0A95\u0ACD\u0AB7\u0AB0", verb: "\u0AB9\u0ACB\u0AB5\u0ABE \u0A9C\u0ACB\u0A88\u0A8F" },
@@ -8259,7 +8312,7 @@ function gu_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/he.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/he.js
 var error20 = () => {
   const TypeNames = {
     string: { label: "\u05DE\u05D7\u05E8\u05D5\u05D6\u05EA", gender: "f" },
@@ -8461,7 +8514,7 @@ function he_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hi.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/hi.js
 var error21 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0930\u0916\u0928\u0947 \u0915\u0947 \u0932\u093F\u090F" },
@@ -8573,7 +8626,7 @@ function hi_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hr.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/hr.js
 var error22 = () => {
   const Sizable = {
     string: { unit: "znakova", verb: "imati" },
@@ -8700,7 +8753,7 @@ function hr_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hu.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/hu.js
 var error23 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "legyen" },
@@ -8814,7 +8867,7 @@ function hu_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/hy.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/hy.js
 function getArmenianPlural(count, one, many) {
   return Math.abs(count) === 1 ? one : many;
 }
@@ -8973,7 +9026,7 @@ function hy_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/id.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/id.js
 var error25 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "memiliki" },
@@ -9085,7 +9138,7 @@ function id_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/is.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/is.js
 var error26 = () => {
   const Sizable = {
     string: { unit: "stafi", verb: "a\xF0 hafa" },
@@ -9200,7 +9253,7 @@ function is_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/it.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/it.js
 var error27 = () => {
   const Sizable = {
     string: { unit: "caratteri", verb: "avere" },
@@ -9314,7 +9367,7 @@ function it_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ja.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ja.js
 var error28 = () => {
   const Sizable = {
     string: { unit: "\u6587\u5B57", verb: "\u3067\u3042\u308B" },
@@ -9427,7 +9480,7 @@ function ja_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ka.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ka.js
 var error29 = () => {
   const Sizable = {
     string: { unit: "\u10E1\u10D8\u10DB\u10D1\u10DD\u10DA\u10DD", verb: "\u10E3\u10DC\u10D3\u10D0 \u10E8\u10D4\u10D8\u10EA\u10D0\u10D5\u10D3\u10D4\u10E1" },
@@ -9545,7 +9598,7 @@ function ka_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/km.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/km.js
 var error30 = () => {
   const Sizable = {
     string: { unit: "\u178F\u17BD\u17A2\u1780\u17D2\u179F\u179A", verb: "\u1782\u17BD\u179A\u1798\u17B6\u1793" },
@@ -9661,12 +9714,12 @@ function km_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kh.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/kh.js
 function kh_default() {
   return km_default();
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/kn.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/kn.js
 var error31 = () => {
   const Sizable = {
     string: { unit: "\u0C85\u0C95\u0CCD\u0CB7\u0CB0\u0C97\u0CB3\u0CC1", verb: "\u0CB9\u0CCA\u0C82\u0CA6\u0CB2\u0CC1" },
@@ -9782,7 +9835,7 @@ function kn_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ko.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ko.js
 var error32 = () => {
   const Sizable = {
     string: { unit: "\uBB38\uC790", verb: "to have" },
@@ -9899,7 +9952,7 @@ function ko_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/lt.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/lt.js
 var capitalizeFirstCharacter = (text) => {
   return text.charAt(0).toUpperCase() + text.slice(1);
 };
@@ -10107,7 +10160,7 @@ function lt_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/mk.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/mk.js
 var error34 = () => {
   const Sizable = {
     string: { unit: "\u0437\u043D\u0430\u0446\u0438", verb: "\u0434\u0430 \u0438\u043C\u0430\u0430\u0442" },
@@ -10222,7 +10275,7 @@ function mk_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ms.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ms.js
 var error35 = () => {
   const Sizable = {
     string: { unit: "aksara", verb: "mempunyai" },
@@ -10335,7 +10388,7 @@ function ms_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ne.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ne.js
 var error36 = () => {
   const Sizable = {
     string: { unit: "\u0905\u0915\u094D\u0937\u0930", verb: "\u0939\u0941\u0928\u0941\u092A\u0930\u094D\u091B" },
@@ -10447,7 +10500,7 @@ function ne_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nl.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/nl.js
 var error37 = () => {
   const Sizable = {
     string: { unit: "tekens", verb: "heeft" },
@@ -10563,7 +10616,7 @@ function nl_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/nn.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/nn.js
 var error38 = () => {
   const Sizable = {
     string: { unit: "teikn", verb: "\xE5 ha" },
@@ -10677,7 +10730,7 @@ function nn_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/no.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/no.js
 var error39 = () => {
   const Sizable = {
     string: { unit: "tegn", verb: "\xE5 ha" },
@@ -10791,7 +10844,7 @@ function no_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ota.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ota.js
 var error40 = () => {
   const Sizable = {
     string: { unit: "harf", verb: "olmal\u0131d\u0131r" },
@@ -10906,7 +10959,7 @@ function ota_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ps.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ps.js
 var error41 = () => {
   const Sizable = {
     string: { unit: "\u062A\u0648\u06A9\u064A", verb: "\u0648\u0644\u0631\u064A" },
@@ -11026,7 +11079,7 @@ function ps_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pl.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/pl.js
 var error42 = () => {
   const Sizable = {
     string: { unit: "znak\xF3w", verb: "mie\u0107" },
@@ -11141,7 +11194,7 @@ function pl_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/pt.js
 var error43 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -11285,7 +11338,7 @@ function pt_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/pt-BR.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/pt-BR.js
 var error44 = () => {
   const Sizable = {
     string: { unit: "caracteres" },
@@ -11430,7 +11483,7 @@ function pt_BR_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ro.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ro.js
 var error45 = () => {
   const Sizable = {
     string: { unit: "caractere", verb: "s\u0103 aib\u0103" },
@@ -11553,7 +11606,7 @@ function ro_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ru.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ru.js
 function getRussianPlural(count, one, few, many) {
   const absCount = Math.abs(count);
   const lastDigit = absCount % 10;
@@ -11722,7 +11775,7 @@ function ru_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sk.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/sk.js
 var error47 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "ma\u0165" },
@@ -11839,7 +11892,7 @@ function sk_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sl.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/sl.js
 var error48 = () => {
   const Sizable = {
     string: { unit: "znakov", verb: "imeti" },
@@ -11954,7 +12007,7 @@ function sl_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/sv.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/sv.js
 var error49 = () => {
   const Sizable = {
     string: { unit: "tecken", verb: "att ha" },
@@ -12070,7 +12123,7 @@ function sv_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ta.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ta.js
 var error50 = () => {
   const Sizable = {
     string: { unit: "\u0B8E\u0BB4\u0BC1\u0BA4\u0BCD\u0BA4\u0BC1\u0B95\u0BCD\u0B95\u0BB3\u0BCD", verb: "\u0B95\u0BCA\u0BA3\u0BCD\u0B9F\u0BBF\u0BB0\u0BC1\u0B95\u0BCD\u0B95 \u0BB5\u0BC7\u0BA3\u0BCD\u0B9F\u0BC1\u0BAE\u0BCD" },
@@ -12186,7 +12239,7 @@ function ta_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tg.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/tg.js
 var error51 = () => {
   const Sizable = {
     string: { unit: "\u0430\u043B\u043E\u043C\u0430\u0442", verb: "\u0434\u043E\u0448\u0442\u0430 \u0431\u043E\u0448\u0430\u0434" },
@@ -12303,7 +12356,7 @@ function tg_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/th.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/th.js
 var error52 = () => {
   const Sizable = {
     string: { unit: "\u0E15\u0E31\u0E27\u0E2D\u0E31\u0E01\u0E29\u0E23", verb: "\u0E04\u0E27\u0E23\u0E21\u0E35" },
@@ -12419,7 +12472,7 @@ function th_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tk.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/tk.js
 var error53 = () => {
   const Sizable = {
     string: { unit: "simwol", verb: "bolmaly" },
@@ -12527,7 +12580,7 @@ function tk_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/tr.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/tr.js
 var error54 = () => {
   const Sizable = {
     string: { unit: "karakter", verb: "olmal\u0131" },
@@ -12638,7 +12691,7 @@ function tr_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uk.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/uk.js
 var error55 = () => {
   const Sizable = {
     string: { unit: "\u0441\u0438\u043C\u0432\u043E\u043B\u0456\u0432", verb: "\u043C\u0430\u0442\u0438\u043C\u0435" },
@@ -12752,12 +12805,12 @@ function uk_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ua.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ua.js
 function ua_default() {
   return uk_default();
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/ur.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/ur.js
 var error56 = () => {
   const Sizable = {
     string: { unit: "\u062D\u0631\u0648\u0641", verb: "\u06C1\u0648\u0646\u0627" },
@@ -12873,7 +12926,7 @@ function ur_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/uz.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/uz.js
 var error57 = () => {
   const Sizable = {
     string: { unit: "belgi", verb: "bo\u2018lishi kerak" },
@@ -12987,7 +13040,7 @@ function uz_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/vi.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/vi.js
 var error58 = () => {
   const Sizable = {
     string: { unit: "k\xFD t\u1EF1", verb: "c\xF3" },
@@ -13101,7 +13154,7 @@ function vi_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-CN.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/zh-CN.js
 var error59 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u7B26", verb: "\u5305\u542B" },
@@ -13216,7 +13269,7 @@ function zh_CN_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/zh-TW.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/zh-TW.js
 var error60 = () => {
   const Sizable = {
     string: { unit: "\u5B57\u5143", verb: "\u64C1\u6709" },
@@ -13329,7 +13382,7 @@ function zh_TW_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/locales/yo.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/locales/yo.js
 var error61 = () => {
   const Sizable = {
     string: { unit: "\xE0mi", verb: "n\xED" },
@@ -13442,7 +13495,7 @@ function yo_default() {
   };
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/registries.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/registries.js
 var _a2;
 var $output = /* @__PURE__ */ Symbol("ZodOutput");
 var $input = /* @__PURE__ */ Symbol("ZodInput");
@@ -13492,7 +13545,7 @@ function registry() {
 (_a2 = globalThis).__zod_globalRegistry ?? (_a2.__zod_globalRegistry = registry());
 var globalRegistry = globalThis.__zod_globalRegistry;
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/compile.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/compile.js
 var INVALID = /* @__PURE__ */ Symbol.for("zod.compile.invalid");
 var FALLBACK_FLAG = /* @__PURE__ */ Symbol.for("zod.compile.fallback");
 var ZodCompileAsyncError = class extends Error {
@@ -14532,9 +14585,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14934,6 +14993,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14950,6 +15010,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -15094,7 +15155,7 @@ function generateTransformCheck(doc, ctx, schema, accessor) {
   return accessor;
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/api.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/api.js
 function snapshotChecks(def) {
   if (def.checks)
     def.checks = [...def.checks];
@@ -16153,7 +16214,7 @@ function _stringFormat(Class2, format, fnOrRegex, _params = {}) {
   return inst;
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/to-json-schema.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/to-json-schema.js
 function assignProps(target, ...sources) {
   for (const source of sources) {
     for (const key of Reflect.ownKeys(source)) {
@@ -16683,7 +16744,7 @@ var createStandardJSONSchemaMethod = (schema, io, processors = {}) => (params) =
   return finalize(ctx, schema);
 };
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-processors.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/json-schema-processors.js
 var narrowMin = (agg, key, value) => {
   if (agg[key] === void 0 || value > agg[key])
     agg[key] = value;
@@ -17431,7 +17492,7 @@ function toJSONSchema(input2, params) {
   return finalize(ctx, input2);
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema-generator.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/json-schema-generator.js
 var JSONSchemaGenerator = class {
   /** @deprecated Access via ctx instead */
   get metadataRegistry() {
@@ -17509,10 +17570,10 @@ var JSONSchemaGenerator = class {
   }
 };
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/json-schema.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/json-schema.js
 var json_schema_exports = {};
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 var schemas_exports2 = {};
 __export(schemas_exports2, {
   ZodAny: () => ZodAny,
@@ -17693,7 +17754,7 @@ __export(schemas_exports2, {
   xor: () => xor
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/checks.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/checks.js
 var checks_exports2 = {};
 __export(checks_exports2, {
   endsWith: () => _endsWith,
@@ -17728,7 +17789,7 @@ __export(checks_exports2, {
   uppercase: () => _uppercase
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/errors.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/errors.js
 var _installedErrorProtos = /* @__PURE__ */ new WeakSet([Object.prototype, Error.prototype]);
 function _lazyMethod(proto, key, make) {
   Object.defineProperty(proto, key, {
@@ -17774,7 +17835,7 @@ var ZodRealError = /* @__PURE__ */ $constructor("ZodError", initializer2, void 0
   Parent: Error
 });
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/parse.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/parse.js
 var parse2 = /* @__PURE__ */ _parse(ZodRealError);
 var parseAsync2 = /* @__PURE__ */ _parseAsync(ZodRealError);
 var safeParse2 = /* @__PURE__ */ _safeParse(ZodRealError);
@@ -17788,7 +17849,7 @@ var safeDecode2 = /* @__PURE__ */ _safeDecode(ZodRealError);
 var safeEncodeAsync2 = /* @__PURE__ */ _safeEncodeAsync(ZodRealError);
 var safeDecodeAsync2 = /* @__PURE__ */ _safeDecodeAsync(ZodRealError);
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/schemas.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/schemas.js
 function _ensureDefaultLocale() {
   if (!globalConfig.localeError)
     config(en_default());
@@ -19253,7 +19314,7 @@ function preprocess(fn, schema) {
   });
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/compat.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/compat.js
 var ZodIssueCode = {
   invalid_type: "invalid_type",
   too_big: "too_big",
@@ -19279,7 +19340,7 @@ var ZodFirstPartyTypeKind;
 /* @__PURE__ */ (function(ZodFirstPartyTypeKind2) {
 })(ZodFirstPartyTypeKind || (ZodFirstPartyTypeKind = {}));
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/iso.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/iso.js
 var iso_exports = {};
 __export(iso_exports, {
   ZodISODate: () => ZodISODate,
@@ -19304,7 +19365,7 @@ function duration2(params) {
   return _isoDuration(ZodISODuration, params);
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/from-json-schema.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/from-json-schema.js
 var z = {
   ...schemas_exports2,
   ...checks_exports2,
@@ -20037,7 +20098,7 @@ function fromJSONSchema(schema, params) {
   return convertSchema(normalized, ctx);
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/core/visit.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/core/visit.js
 var RESOLVING = /* @__PURE__ */ Symbol("z.visit/resolving");
 function visit(schema, fnOrHandlers) {
   const fn = typeof fnOrHandlers === "function" ? fnOrHandlers : (node2, rewritten) => {
@@ -20192,7 +20253,7 @@ function visit(schema, fnOrHandlers) {
   return run(schema);
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/deep-partial.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/deep-partial.js
 function deepPartial(schema) {
   return visit(schema, {
     object: (s) => s.partial(),
@@ -20204,7 +20265,7 @@ function deepPartial(schema) {
   });
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/in-out.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/in-out.js
 function withChecks(side, checks) {
   if (!checks?.length)
     return side;
@@ -20234,7 +20295,7 @@ function output(schema) {
   });
 }
 
-// ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/coerce.js
+// ../../node_modules/.pnpm/zod@4.6.7/node_modules/zod/v4/classic/coerce.js
 var coerce_exports = {};
 __export(coerce_exports, {
   bigint: () => bigint3,
@@ -20725,11 +20786,15 @@ var credentialExpiryWarningSchema = external_exports.object({
 
 // ../../packages/mcp-contracts/dist/whoami.js
 var mcpConnectionHostSchema = external_exports.enum(["sandbox", "live"]);
+var EMBEDDED_EMAIL_ADDRESS_PATTERN = /[^\s@]+@[^\s@]+\.[^\s@]+/;
+var MCP_ACCOUNT_NAME_MAX_LENGTH = 255;
+var mcpAccountNameSchema = external_exports.string().min(1).max(MCP_ACCOUNT_NAME_MAX_LENGTH).refine((value) => value.length <= MCP_ACCOUNT_NAME_MAX_LENGTH && !EMBEDDED_EMAIL_ADDRESS_PATTERN.test(value), { message: "An account name must not contain an email address" });
 var mcpConnectionProofSchema = external_exports.object({
   userId: external_exports.uuid(),
   scopes: external_exports.array(external_exports.string()).nullable(),
   host: mcpConnectionHostSchema.describe(`The class of MCP URL this client is connected to: "live" for the main MCP URL, "sandbox" for the sandbox-only MCP URL. Not the environment (dev, stage or prod) and not a merchant's deployment.`),
   endpoint: external_exports.url(),
+  accountName: mcpAccountNameSchema.nullable().describe("The business name of the account you are connected to, never an email address. Quote it with host (live or sandbox) and ask the developer to confirm it is their business; null when the account has no business yet."),
   merchantIds: external_exports.array(external_exports.uuid()).describe("Ids of the merchants this credential is a member of, as returned when the credential was validated. Call get_my_merchant for names and per-deployment state; on the main MCP URL a merchant that exists on sandbox only is listed there, not here."),
   credentialExpiresAt: external_exports.iso.datetime().nullable().describe("When this MCP credential stops working (ISO 8601, UTC); null when unknown."),
   credentialExpiresInSeconds: external_exports.number().int().nonnegative().nullable().describe("Seconds of validity left on this MCP credential; null when the expiry is unknown."),
@@ -25502,7 +25567,7 @@ var TRANSACTION_SCOPE_RULE = 'Requires the "transaction:read" scope, which exist
 var LIST_TRANSACTIONS_SUMMARY = `List a merchant's transactions, newest first, narrowed by the optional filters in the input schema. For the full lookup guide, call search_payments_ai_docs with "transaction lookup".`;
 var GET_TRANSACTION_DETAIL = "Get one transaction by transactionId from list_transactions: the same fields plus the refunded amount and the order's line items. items is empty for a single-plan purchase, where plan names what was bought.";
 var TOOL_DESCRIPTIONS = {
-  [MCP_TOOL_NAMES.WHOAMI]: `Prove which account and which MCP server this connection reaches. Takes no arguments. Returns { userId, scopes, host, endpoint, merchantIds, credentialExpiresAt, credentialExpiresInSeconds, credentialExpiryWarning? }, read from the validated token and the server that answered. "scopes" null means the token holds every scope except "transaction:read", which must be granted by name. "host" is the class of MCP URL this client is connected to: "live" for the main MCP URL, which serves every merchant at its own deployment, or "sandbox" for the sandbox-only MCP URL. It is not the environment (dev, stage or prod) and not a merchant's deployment: on a "live" host a merchant that has not gone live still reports deployment "sandbox" in get_my_merchant, which is expected. To prove the connection, quote userId, host and endpoint from this result rather than the client's connected label. "merchantIds" are the merchants this credential is a member of; credentialExpiresAt and credentialExpiresInSeconds say when it stops working (null when unknown). credentialExpiryWarning is present only when the credential expires within ` + CREDENTIAL_EXPIRY_WARNING_WINDOW_DAYS + " days: tell the user and share its reapproveUrl, and expect the same warning appended to every other tool result until they re-approve. Needs no scope: any valid token can call it. Call get_my_merchant next to find the merchants this connection owns.",
+  [MCP_TOOL_NAMES.WHOAMI]: `Prove which account and which MCP server this connection reaches. Takes no arguments. Returns { userId, scopes, host, endpoint, accountName, merchantIds, credentialExpiresAt, credentialExpiresInSeconds, credentialExpiryWarning? }, read from the validated token and the server that answered. "scopes" null means the token holds every scope except "transaction:read", which must be granted by name. "host" is the class of MCP URL this client is connected to: "live" for the main MCP URL, which serves every merchant at its own deployment, or "sandbox" for the sandbox-only MCP URL. It is not the environment (dev, stage or prod) and not a merchant's deployment: on a "live" host a merchant that has not gone live still reports deployment "sandbox" in get_my_merchant, which is expected. To prove the connection, quote userId, host and endpoint from this result rather than the client's connected label. "accountName" is the business name of the account you are connected to, never an email address: quote it with host (live or sandbox) and ask the developer to confirm it is their business; when it is null, the account has no business yet, so say so and quote userId. "merchantIds" are the merchants this credential is a member of; credentialExpiresAt and credentialExpiresInSeconds say when it stops working (null when unknown). credentialExpiryWarning is present only when the credential expires within ` + CREDENTIAL_EXPIRY_WARNING_WINDOW_DAYS + " days: tell the user and share its reapproveUrl, and expect the same warning appended to every other tool result until they re-approve. Needs no scope: any valid token can call it. Call get_my_merchant next to find the merchants this connection owns.",
   [MCP_TOOL_NAMES.GET_MY_MERCHANT]: 'List the merchant accounts this connection already owns. Call this BEFORE create_merchant_account: a new agent session cannot remember a merchant created in an earlier one, and creating again produces a second merchant with its own products and its own checkout links. Takes no arguments \u2014 the merchants come from the authorization on the connection itself. Returns { merchants: [{ merchantId, name, deployment }] }. "deployment" is "sandbox" before go_live and "live" after it has succeeded, and it matches where create_product and list_products will route for that merchant right now. An empty merchants array is a normal result, not an error: this connection owns no merchant yet, so call create_merchant_account. When more than one merchant comes back, ask which one to use \u2014 do not pick for the user. Requires the "merchant:read" scope.',
   [MCP_TOOL_NAMES.CREATE_MERCHANT_ACCOUNT]: "Create a merchant account on PAI Managed. Call get_my_merchant first: if it returns a merchant, reuse that merchantId instead of creating another, because a duplicate merchant gets its own products and checkout links. " + CREATE_MERCHANT_CONTACT_GUIDANCE + " The business name is a display label and is not globally unique \u2014 every downstream tool (create_product, list_products, checkout) keys on merchantId, so if two merchants happen to share a name, disambiguate them by merchantId (do not pick a distinct name here to work around it). No identity verification (KYC/KYB) is needed to use sandbox \u2014 products, checkout links and test transactions all work without it; verification is required on live. " + IDENTITY_VERIFICATION_RULE + " Dual-provisions live and sandbox with a shared merchantId. On partial dual-provision failure (one backend created it, the other did not), retry without a merchantId to finish it. When both backends fail, the returned error names the appropriate recovery \u2014 follow it as-is rather than repeating the same call in a loop, and treat repeated identical failures as needing escalation to support. Returns that merchant ID. Without a merchantId, a merchant this account already owns is returned with existing: true instead of a new one being created, and whichever of live or sandbox is missing it gets a copy with the details the existing copy holds; a merchantId this account already owns is finished the same way, and the copy that exists is never changed. Next: create_product (and checkout tools) on sandbox, then go_live when ready.",
   [MCP_TOOL_NAMES.GET_MERCHANT_ACTIVATION_STATUS]: 'Get the production activation status of a merchant account on PAI Managed. Returns { status, identityVerification }. status "pending": the merchant has not been promoted to live yet; this is the only status where go_live is the next step, once the user confirms the merchant is ready, and polling this tool will not change it on its own. status "verification_pending": the merchant is promoted to live and identity verification (KYC) is not complete yet; do not call go_live again. status "active": live and identity verified. status "not_provisioned": no live merchant record exists (dual provision never finished on live); recovery: re-run create_merchant_account without a merchantId, which finds this merchant and creates the missing live copy with the details the sandbox copy holds \u2014 go_live cannot fix this and fails while the live twin is missing. ' + IDENTITY_VERIFICATION_RULE + ' identityVerification is the KYC state: "not_started", "pending", "in_review", "verified" or "rejected".',
@@ -25614,11 +25679,13 @@ var QUICKSTART_SKILL_SECTIONS = [
   "",
   'Do not trust the client\'s "Connected" label. Call `whoami` and report what it returns. `whoami` takes no arguments and needs no scope: every valid token can call it.',
   "",
-  "| Result         | Meaning                                                   | Tell the developer                                                                                                                                                              |",
-  "| -------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |",
-  "| Success        | Connected.                                                | Quote `userId`, `host` (`sandbox` or `live`: the MCP URL connected to, not the merchant deployment) and `endpoint`. `scopes: null` means every scope except `transaction:read`. |",
-  "| HTTP 401       | Not connected.                                            | Quote the 401 `message` verbatim (for `code: token_expired` it says where to generate a new token), then show the MCP config above.                                             |",
-  "| Any tool error | Connected, but the server could not prove the connection. | Quote the error. Do not say disconnected and do not paste the connect config.                                                                                                   |",
+  "| Result         | Meaning                                                   | Tell the developer                                                                                                                                                                                                                                                                                                                                                                                                                                |",
+  "| -------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |",
+  "| Success        | Connected.                                                | Quote `accountName` (the business name of the account you are connected to, never an email) and ask the developer to confirm it, together with `host` (live or sandbox), is their own business account. Then quote `userId`, `host` (`sandbox` or `live`: the MCP URL connected to, not the merchant deployment) and `endpoint`. `accountName: null` means no label is known: say so. `scopes: null` means every scope except `transaction:read`. |",
+  "| HTTP 401       | Not connected.                                            | Quote the 401 `message` verbatim (for `code: token_expired` it says how to reconnect: re-approve in the client for OAuth, run the device grant again and replace the `Authorization` header if connected that way, or generate a new token if connected with a token), then show the MCP config above.                                                                                                                                            |",
+  "| Any tool error | Connected, but the server could not prove the connection. | Quote the error. Do not say disconnected and do not paste the connect config.                                                                                                                                                                                                                                                                                                                                                                     |",
+  "",
+  'If `whoami` returns a `credentialExpiryWarning`, or a tool result carries one under `_meta["ai.payments/credentialExpiryWarning"]` with a closing text block (OAuth connections only, within 14 days of expiry), tell the user and share its re-approve link, which opens the connect page. If you connected with the device grant, run it again and replace the `Authorization` header instead (see "Connect without a terminal"). `credentialExpiresAt` and `credentialExpiresInSeconds` say when the credential stops working; `null` means unknown.',
   "",
   "## Before you mutate anything",
   "",
@@ -25680,26 +25747,26 @@ var QUICKSTART_SKILL_SECTIONS = [
   "",
   "## Tools",
   "",
-  "| Tool                             | Use                                                                          |",
-  "| -------------------------------- | ---------------------------------------------------------------------------- |",
-  "| `whoami`                         | `userId`, `scopes`, `host`, `endpoint`; any valid token                      |",
-  "| `search_payments_ai_docs`        | Search developer docs                                                        |",
-  "| `get_my_merchant`                | Owned merchants                                                              |",
-  "| `create_merchant_account`        | Dual-provision live + sandbox merchant                                       |",
-  "| `get_merchant_activation_status` | Activation status (see below)                                                |",
-  "| `go_live`                        | Promote to live; a repeat returns current status                             |",
-  "| `create_product`                 | Product + plans (sandbox until go-live)                                      |",
-  "| `create_order`                   | Multi-item or caller-priced checkout                                         |",
-  "| `update_product`                 | Merge-update a product's name, description or status                         |",
-  "| `update_plan`                    | Merge-update a plan's name, description, price, billing period or free trial |",
-  "| `list_products`                  | List products, plans, checkout URLs                                          |",
-  "| `list_transactions`              | Look up transactions (needs `transaction:read`)                              |",
-  "| `get_transaction`                | One transaction's details and line items                                     |",
-  "| `get_product_image_upload_url`   | Presigned POST for product image                                             |",
-  "| `confirm_product_image`          | Attach uploaded product image                                                |",
-  "| `get_checkout_customization`     | Read hosted checkout branding                                                |",
-  "| `update_checkout_customization`  | Merge-update branding                                                        |",
-  "| `set_checkout_logo`              | Mint \u2192 PUT \u2192 confirm checkout logo                                           |",
+  "| Tool                             | Use                                                                                                                                                                   |",
+  "| -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |",
+  "| `whoami`                         | `accountName`, `userId`, `scopes`, `host`, `endpoint`, `merchantIds`, `credentialExpiresAt`, `credentialExpiresInSeconds`, `credentialExpiryWarning`; any valid token |",
+  "| `search_payments_ai_docs`        | Search developer docs                                                                                                                                                 |",
+  "| `get_my_merchant`                | Owned merchants                                                                                                                                                       |",
+  "| `create_merchant_account`        | Dual-provision live + sandbox merchant                                                                                                                                |",
+  "| `get_merchant_activation_status` | Activation status (see below)                                                                                                                                         |",
+  "| `go_live`                        | Promote to live; a repeat returns current status                                                                                                                      |",
+  "| `create_product`                 | Product + plans (sandbox until go-live)                                                                                                                               |",
+  "| `create_order`                   | Multi-item or caller-priced checkout                                                                                                                                  |",
+  "| `update_product`                 | Merge-update a product's name, description or status                                                                                                                  |",
+  "| `update_plan`                    | Merge-update a plan's name, description, price, billing period or free trial                                                                                          |",
+  "| `list_products`                  | List products, plans, checkout URLs                                                                                                                                   |",
+  "| `list_transactions`              | Look up transactions (needs `transaction:read`)                                                                                                                       |",
+  "| `get_transaction`                | One transaction's details and line items                                                                                                                              |",
+  "| `get_product_image_upload_url`   | Presigned POST for product image                                                                                                                                      |",
+  "| `confirm_product_image`          | Attach uploaded product image                                                                                                                                         |",
+  "| `get_checkout_customization`     | Read hosted checkout branding                                                                                                                                         |",
+  "| `update_checkout_customization`  | Merge-update branding                                                                                                                                                 |",
+  "| `set_checkout_logo`              | Mint \u2192 PUT \u2192 confirm checkout logo                                                                                                                                    |",
   "",
   "### Activation status",
   "",
@@ -26831,6 +26898,7 @@ function buildConnectionProof(input2) {
     scopes: payload.scopes,
     host: host2,
     endpoint,
+    accountName: payload.accountName ?? null,
     merchantIds: payload.merchantIds,
     credentialExpiresAt: credentialExpiry.credentialExpiresAt,
     credentialExpiresInSeconds: credentialExpiry.credentialExpiresInSeconds,
@@ -28247,18 +28315,20 @@ function parseMcpTokenPayload(parsed) {
   if (typeof parsed !== "object" || parsed === null) {
     return void 0;
   }
-  const { userId, cognitoSub, merchantIds, scopes, expiresAt, oauthIssued } = parsed;
+  const { userId, cognitoSub, merchantIds, scopes, expiresAt, oauthIssued, accountName } = parsed;
   if (typeof userId !== "string" || typeof cognitoSub !== "string" || !isStringArray(merchantIds)) {
     return void 0;
   }
   const expiry = parseExpiresAt(expiresAt);
+  const label = mcpAccountNameSchema.safeParse(accountName);
   return {
     userId,
     cognitoSub,
     merchantIds,
     scopes: Array.isArray(scopes) ? scopes : null,
     oauthIssued: oauthIssued === true,
-    ...expiry === void 0 ? {} : { expiresAt: expiry }
+    ...expiry === void 0 ? {} : { expiresAt: expiry },
+    ...label.success ? { accountName: label.data } : {}
   };
 }
 function parseExpiresAt(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payments-ai/mcp",
-  "version": "2.6.0",
+  "version": "2.7.1",
   "private": false,
   "description": "MCP for Payments AI",
   "repository": {
@@ -29,7 +29,7 @@
     "dotenv": "17.3.1",
     "express": "5.2.1",
     "uuid": "14.0.2",
-    "zod": "4.6.5"
+    "zod": "4.6.7"
   },
   "devDependencies": {
     "@modelcontextprotocol/client": "2.3.1",