@paystage/preflight 0.0.0-stage → 0.1.1

package/README.md

@@ -1,3 +1,94 @@
-# Temporary Holding Version
+# @paystage/preflight
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Evaluate an [x402](https://x402.org) `PaymentRequired` against a local spending
+policy **before** your agent pays. Returns one of three verdicts: `pay`,
+`review`, or `do_not_pay`.
+
+- **Local-first** — policy lives in a JSON file on your machine. No secrets, no
+  network calls to decide.
+- **MCP-native** — runs as a stdio MCP server so Claude Desktop, Cursor, and any
+  MCP client can call it as a tool.
+- **Deterministic** — same input + same policy ⇒ same verdict.
+
+## Install
+
+Run directly with `npx` (no global install):
+
+```bash
+npx -y @paystage/preflight
+```
+
+Or add it to your MCP client config.
+
+## Claude Desktop
+
+Add to `claude_desktop_config.json`:
+
+```json
+{
+  "mcpServers": {
+    "paystage-preflight": {
+      "command": "npx",
+      "args": ["-y", "@paystage/preflight"],
+      "env": {
+        "PAYSTAGE_POLICY_PATH": "/absolute/path/to/policy.json"
+      }
+    }
+  }
+}
+```
+
+## Cursor
+
+Add to `.cursor/mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "paystage-preflight": {
+      "command": "npx",
+      "args": ["-y", "@paystage/preflight"],
+      "env": {
+        "PAYSTAGE_POLICY_PATH": "/absolute/path/to/policy.json"
+      }
+    }
+  }
+}
+```
+
+## Example `policy.json`
+
+```json
+{
+  "version": 1,
+  "name": "standard",
+  "allowed_networks": ["eip155:8453", "eip155:84532"],
+  "allowed_assets": [
+    "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
+  ],
+  "allowed_pay_to": ["0x209693Bc6afc0C5328bA36FaF03C514EF312287C"],
+  "max_amount_per_call": "1.00",
+  "max_amount_per_session": "10.00",
+  "require_human_above": "0.50",
+  "max_timeout_seconds": 300,
+  "default_verdict": "review"
+}
+```
+
+Amounts are human-readable USDC (e.g. `"0.50"` = 0.50 USDC). Networks use
+CAIP-2 identifiers.
+
+## Verdicts
+
+| Verdict       | Meaning                                                                 |
+| ------------- | ----------------------------------------------------------------------- |
+| `pay`         | Within policy — safe to proceed automatically.                          |
+| `review`      | Allowed but above a human threshold — ask a human before paying.        |
+| `do_not_pay`  | Violates policy (network, asset, payTo, amount, timeout, or malformed). |
+
+## Links
+
+- Website: <https://paystage.xyz>
+- Source: <https://github.com/base-buzz/paystage>
+- License: MIT

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import { startServer } from "./server.js";
+startServer().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/evaluate.d.ts

@@ -0,0 +1,38 @@
+import { type Policy } from "@paystage/policy";
+export interface AcceptOption {
+    scheme: string;
+    network: string;
+    amount: string;
+    asset: string;
+    payTo: string;
+    maxTimeoutSeconds: number;
+    extra?: Record<string, unknown>;
+}
+export interface PaymentResource {
+    url: string;
+    description?: string;
+    mimeType?: string;
+}
+export interface PaymentRequest {
+    x402Version: number;
+    accepts: AcceptOption[];
+    error?: string;
+    resource?: PaymentResource;
+}
+export type Decision = "pay" | "review" | "do_not_pay";
+export type AcceptStatus = "pay" | "review" | "do_not_pay";
+export interface AcceptResult {
+    accept: AcceptOption;
+    status: AcceptStatus;
+    reasons: string[];
+}
+export interface EvaluateResult {
+    decision: Decision;
+    selectedAccept?: AcceptOption;
+    acceptResults: AcceptResult[];
+    reasons: string[];
+    summary: string;
+    dailyCapNote?: string;
+}
+export declare function evaluatePayment(pr: PaymentRequest, policy: Policy): EvaluateResult;
+//# sourceMappingURL=evaluate.d.ts.map

package/dist/evaluate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,kBAAkB,CAAC;AAG1B,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,eAAe,CAAC;CAC5B;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AACvD,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE3D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,CAAC,EAAE,YAAY,CAAC;IAC9B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyHD,wBAAgB,eAAe,CAC7B,EAAE,EAAE,cAAc,EAClB,MAAM,EAAE,MAAM,GACb,cAAc,CA2EhB"}

package/dist/evaluate.js

@@ -0,0 +1,160 @@
+import { humanToAtomic, atomicToHuman, } from "@paystage/policy";
+import { isKnownDrainer } from "./known-drainers.js";
+function eq(a, b) {
+    return a.toLowerCase() === b.toLowerCase();
+}
+function findAsset(policy, network, assetAddress) {
+    return policy.allowed_assets.find((a) => eq(a.network, network) && eq(a.address, assetAddress));
+}
+function evaluateAccept(accept, policy) {
+    const reasons = [];
+    // Rule 2: network allowlist
+    const networkAllowed = policy.allowed_networks.some((n) => eq(n, accept.network));
+    if (!networkAllowed) {
+        reasons.push(`network ${accept.network} not in allowed_networks`);
+        return { accept, status: "do_not_pay", reasons };
+    }
+    // Rule 3: asset must match allowed_assets with same network
+    const asset = findAsset(policy, accept.network, accept.asset);
+    if (!asset) {
+        reasons.push(`asset ${accept.asset} on ${accept.network} not in allowed_assets`);
+        return { accept, status: "do_not_pay", reasons };
+    }
+    // Rule 4: amount is atomic
+    let amount;
+    try {
+        amount = BigInt(accept.amount);
+    }
+    catch {
+        reasons.push(`invalid atomic amount ${accept.amount}`);
+        return { accept, status: "do_not_pay", reasons };
+    }
+    // Rule 5: policy-level max_amount, only if asset symbol matches
+    if (eq(policy.max_amount.asset, asset.symbol)) {
+        const maxAtomic = humanToAtomic(policy.max_amount.value, policy.max_amount.decimals);
+        if (amount > maxAtomic) {
+            reasons.push(`amount ${atomicToHuman(amount, asset.decimals)} ${asset.symbol} exceeds max_amount ${policy.max_amount.value} ${policy.max_amount.asset}`);
+            return { accept, status: "do_not_pay", reasons };
+        }
+    }
+    // Rule 6: timeout
+    if (accept.maxTimeoutSeconds > policy.max_timeout_seconds) {
+        reasons.push(`maxTimeoutSeconds ${accept.maxTimeoutSeconds} exceeds policy max_timeout_seconds ${policy.max_timeout_seconds}`);
+        return { accept, status: "do_not_pay", reasons };
+    }
+    // Rule 7a: known drainers — hard deny before unknown_payee review
+    if (isKnownDrainer(accept.payTo)) {
+        reasons.push("known drainer");
+        return { accept, status: "do_not_pay", reasons };
+    }
+    // Rule 7: payee allowlist
+    const payeeAllowed = policy.allowed_pay_to.some((p) => eq(p, accept.payTo));
+    if (!payeeAllowed) {
+        if (policy.unknown_payee === "deny") {
+            reasons.push(`payTo ${accept.payTo} not in allowed_pay_to (deny)`);
+            return { accept, status: "do_not_pay", reasons };
+        }
+        reasons.push(`payTo ${accept.payTo} not in allowed_pay_to (review)`);
+        return { accept, status: "review", reasons };
+    }
+    // Rule 8: require_human_above
+    if (policy.require_human_above) {
+        const threshold = humanToAtomic(policy.require_human_above.value, policy.require_human_above.decimals);
+        if (amount > threshold) {
+            reasons.push(`amount ${atomicToHuman(amount, asset.decimals)} ${asset.symbol} exceeds require_human_above ${policy.require_human_above.value} ${policy.require_human_above.asset}`);
+            return { accept, status: "review", reasons };
+        }
+    }
+    return { accept, status: "pay", reasons };
+}
+function amountOf(accept) {
+    try {
+        return BigInt(accept.amount);
+    }
+    catch {
+        return BigInt(0);
+    }
+}
+function cheapest(accepts) {
+    if (accepts.length === 0)
+        return undefined;
+    return [...accepts].sort((a, b) => {
+        const da = amountOf(a);
+        const db = amountOf(b);
+        if (da < db)
+            return -1;
+        if (da > db)
+            return 1;
+        return a.maxTimeoutSeconds - b.maxTimeoutSeconds;
+    })[0];
+}
+export function evaluatePayment(pr, policy) {
+    // Rule 1: malformed
+    if (!pr || pr.x402Version !== 2) {
+        return {
+            decision: "do_not_pay",
+            acceptResults: [],
+            reasons: [`unsupported x402Version ${pr?.x402Version}`],
+            summary: "Payment request is malformed or unsupported version.",
+        };
+    }
+    if (!Array.isArray(pr.accepts) || pr.accepts.length === 0) {
+        return {
+            decision: "do_not_pay",
+            acceptResults: [],
+            reasons: ["no accepts in payment request"],
+            summary: "Payment request has no acceptable payment options.",
+        };
+    }
+    const acceptResults = pr.accepts.map((a) => evaluateAccept(a, policy));
+    const payAccepts = acceptResults
+        .filter((r) => r.status === "pay")
+        .map((r) => r.accept);
+    const reviewAccepts = acceptResults
+        .filter((r) => r.status === "review")
+        .map((r) => r.accept);
+    let decision;
+    let selectedAccept;
+    if (payAccepts.length > 0) {
+        decision = "pay";
+        selectedAccept = cheapest(payAccepts);
+    }
+    else if (reviewAccepts.length > 0) {
+        decision = "review";
+        selectedAccept = cheapest(reviewAccepts);
+    }
+    else {
+        decision = "do_not_pay";
+    }
+    const reasons = [];
+    for (const r of acceptResults) {
+        for (const reason of r.reasons)
+            reasons.push(reason);
+    }
+    // Rule 9: daily_cap note only
+    let dailyCapNote;
+    if (policy.daily_cap) {
+        dailyCapNote = `daily_cap ${policy.daily_cap.value} ${policy.daily_cap.asset} (informational only)`;
+    }
+    // Rule 12: summary
+    let summary;
+    if (selectedAccept) {
+        const asset = findAsset(policy, selectedAccept.network, selectedAccept.asset);
+        const decimals = asset?.decimals ?? policy.max_amount.decimals;
+        const human = atomicToHuman(BigInt(selectedAccept.amount), decimals);
+        const symbol = asset?.symbol ?? policy.max_amount.asset;
+        summary = `Decision: ${decision}. Selected ${human} ${symbol} on ${selectedAccept.network} to ${selectedAccept.payTo}.`;
+    }
+    else {
+        summary = `Decision: ${decision}. No acceptable payment option.`;
+    }
+    return {
+        decision,
+        selectedAccept,
+        acceptResults,
+        reasons,
+        summary,
+        dailyCapNote,
+    };
+}
+//# sourceMappingURL=evaluate.js.map

package/dist/evaluate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.js","sourceRoot":"","sources":["../src/evaluate.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,aAAa,GAGd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AA2CrD,SAAS,EAAE,CAAC,CAAS,EAAE,CAAS;IAC9B,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAChB,MAAc,EACd,OAAe,EACf,YAAoB;IAEpB,OAAO,MAAM,CAAC,cAAc,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAC7D,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB,EAAE,MAAc;IAC1D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,4BAA4B;IAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACxD,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CACtB,CAAC;IACF,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,WAAW,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAClE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,4DAA4D;IAC5D,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CACV,SAAS,MAAM,CAAC,KAAK,OAAO,MAAM,CAAC,OAAO,wBAAwB,CACnE,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,2BAA2B;IAC3B,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,gEAAgE;IAChE,IAAI,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,MAAM,SAAS,GAAG,aAAa,CAC7B,MAAM,CAAC,UAAU,CAAC,KAAK,EACvB,MAAM,CAAC,UAAU,CAAC,QAAQ,CAC3B,CAAC;QACF,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CACV,UAAU,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,uBAAuB,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAC3I,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CACV,qBAAqB,MAAM,CAAC,iBAAiB,uCAAuC,MAAM,CAAC,mBAAmB,EAAE,CACjH,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACnD,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,+BAA+B,CAAC,CAAC;YACnE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,iCAAiC,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,8BAA8B;IAC9B,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,aAAa,CAC7B,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAChC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CACpC,CAAC;QACF,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CACV,UAAU,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,MAAM,gCAAgC,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,CACtK,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,QAAQ,CAAC,MAAoB;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAuB;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,GAAG,EAAE;YAAE,OAAO,CAAC,CAAC;QACtB,OAAO,CAAC,CAAC,iBAAiB,GAAG,CAAC,CAAC,iBAAiB,CAAC;IACnD,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,EAAkB,EAClB,MAAc;IAEd,oBAAoB;IACpB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,QAAQ,EAAE,YAAY;YACtB,aAAa,EAAE,EAAE;YACjB,OAAO,EAAE,CAAC,2BAA2B,EAAE,EAAE,WAAW,EAAE,CAAC;YACvD,OAAO,EAAE,sDAAsD;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,QAAQ,EAAE,YAAY;YACtB,aAAa,EAAE,EAAE;YACjB,OAAO,EAAE,CAAC,+BAA+B,CAAC;YAC1C,OAAO,EAAE,oDAAoD;SAC9D,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAEvE,MAAM,UAAU,GAAG,aAAa;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,aAAa,GAAG,aAAa;SAChC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAExB,IAAI,QAAkB,CAAC;IACvB,IAAI,cAAwC,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,GAAG,KAAK,CAAC;QACjB,cAAc,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;SAAM,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,QAAQ,GAAG,QAAQ,CAAC;QACpB,cAAc,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,YAAY,CAAC;IAC1B,CAAC;IAED,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvD,CAAC;IAED,8BAA8B;IAC9B,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,YAAY,GAAG,aAAa,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,uBAAuB,CAAC;IACtG,CAAC;IAED,mBAAmB;IACnB,IAAI,OAAe,CAAC;IACpB,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,SAAS,CACrB,MAAM,EACN,cAAc,CAAC,OAAO,EACtB,cAAc,CAAC,KAAK,CACrB,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,OAAO,GAAG,aAAa,QAAQ,cAAc,KAAK,IAAI,MAAM,OAAO,cAAc,CAAC,OAAO,OAAO,cAAc,CAAC,KAAK,GAAG,CAAC;IAC1H,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,aAAa,QAAQ,iCAAiC,CAAC;IACnE,CAAC;IAED,OAAO;QACL,QAAQ;QACR,cAAc;QACd,aAAa;QACb,OAAO;QACP,OAAO;QACP,YAAY;KACb,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { evaluatePayment } from "./evaluate.js";
+export type { AcceptOption, PaymentResource, PaymentRequest, Decision, AcceptStatus, AcceptResult, EvaluateResult, } from "./evaluate.js";
+export { normalizePaymentRequired } from "./normalize.js";
+export { createServer, startServer } from "./server.js";
+export type { PaymentRequired, PaymentAccept, EvaluationResult, EvaluationDecision, AcceptEvaluation, } from "./types.js";
+export { isKnownDrainer, KNOWN_DRAINERS, SOURCES } from "./known-drainers.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,YAAY,EACV,YAAY,EACZ,eAAe,EACf,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EACV,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { evaluatePayment } from "./evaluate.js";
+export { normalizePaymentRequired } from "./normalize.js";
+export { createServer, startServer } from "./server.js";
+export { isKnownDrainer, KNOWN_DRAINERS, SOURCES } from "./known-drainers.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAUhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAQxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/known-drainers.d.ts

@@ -0,0 +1,12 @@
+export interface KnownDrainerSource {
+    name: string;
+    url: string;
+    retrieved: string;
+}
+export declare const SOURCES: readonly KnownDrainerSource[];
+/**
+ * Small curated subset. Do not add addresses without a public citation.
+ */
+export declare const KNOWN_DRAINERS: readonly string[];
+export declare function isKnownDrainer(addr: string): boolean;
+//# sourceMappingURL=known-drainers.d.ts.map

package/dist/known-drainers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-drainers.d.ts","sourceRoot":"","sources":["../src/known-drainers.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,OAAO,EAAE,SAAS,kBAAkB,EAoChD,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EA0C1C,CAAC;AAMH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD"}

package/dist/known-drainers.js

@@ -0,0 +1,91 @@
+// Curated hard-deny payees. Matching is checksum-agnostic (lowercase).
+// See KNOWN_DRAINERS.md for curation policy and how to extend.
+export const SOURCES = [
+    {
+        name: "MyEtherWallet ethereum-lists address darklist",
+        url: "https://github.com/MyEtherWallet/ethereum-lists/blob/master/src/addresses/addresses-darklist.json",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "MetaMask eth-phishing-detect (domain list; related ecosystem)",
+        url: "https://github.com/MetaMask/eth-phishing-detect",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "Ethereum burn / non-receivable sentinel 0x…dEaD",
+        url: "https://etherscan.io/address/0x000000000000000000000000000000000000dead",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "0xCERT IOC address feed (Base incidents incl. 0xCERT-2026-0230)",
+        url: "https://www.0xcert.com/iocs",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "Matcha Meta / CryptoTimes SwapNet approval-drain advisory",
+        url: "https://www.cryptotimes.io/2026/01/26/security-alert-matcha-meta-flags-swapnet-bug-as-over-16-8m-is-drained/",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "Chainabuse contract-exploit reports (Base EIP-7702 / USDC drains)",
+        url: "https://chainabuse.com/category/contract-exploit",
+        retrieved: "2026-11-02",
+    },
+    {
+        name: "Chainabuse address report (Base USDC theft Jul 2026)",
+        url: "https://chainabuse.com/address/0x2cff890f0378a11913b6129b2e97417a2c302680",
+        retrieved: "2026-11-02",
+    },
+];
+/**
+ * Small curated subset. Do not add addresses without a public citation.
+ */
+export const KNOWN_DRAINERS = Object.freeze([
+    // Canonical burn address — non-receivable sink (demo + sentinel).
+    "0x000000000000000000000000000000000000dead",
+    // MEW darklist: "XRP phishing website (ripple.com.pt) this wallet collects funds…"
+    "0x09750ad360fdb7a2ee23669c4503c974d86d8694",
+    // MEW darklist: XRP phishing website (ripple.com.pt) via Coinswitch
+    "0xc915ec7f4cfd1c0a8aba090f03bfaab588aef9b4",
+    "0xecb6ffac05d8b4660b99b475b359fe454c77d153",
+    "0x7f85a82a2da50540412f6e526f1d00a0690a77b8",
+    // MEW darklist: "Scam address for various fake twitter accounts and fake giveaways"
+    "0x08389b19ad52f0d983609ab785b3a43a0e90355f",
+    // MEW darklist: Fake MEW / myelherwallel.com wallet
+    "0xd0cc2b24980cbcca47ef755da88b220a82291407",
+    // MEW darklist: Fake MyEtherWallet
+    "0xdafc2a2d4e070f863cfcb5887bc2516e05e18877",
+    // MEW darklist: Fake giveaway site asking to pay miner fees
+    "0x8444173280e5fdc0525494638123b014cffcc521",
+    // MEW darklist: Trust-trading scam
+    "0x5d82db63cf0c54d47006d416bdc7dab09ea2f3f1",
+    // --- Added 2026-11-02 NZDT ---
+    // 0xCERT-2026-0230 Base attacker EOA (GoPlus Security; PeckShield); Basescan phishing label
+    // https://www.0xcert.com/iocs
+    "0x0b5126e1bc27c0de77e02e97945760a674edb034",
+    // 0xCERT-2026-0230 Base exploit contract (GoPlus)
+    // https://www.0xcert.com/iocs
+    "0xcdfe91301356da873562ef513828a60dba1f569d",
+    // SwapNet router — Matcha Meta approval-drain advisory (arbitrary call); CryptoTimes 2026-01-26; Basescan Exploit
+    // https://www.cryptotimes.io/2026/01/26/security-alert-matcha-meta-flags-swapnet-bug-as-over-16-8m-is-drained/
+    "0x616000e384ef1c2b52f5f3a88d57a3b64f23757e",
+    // Chainabuse Base EIP-7702 drain 2026-10-08; Basescan phishing
+    // https://chainabuse.com/category/contract-exploit
+    "0xc9002a87e2e3efdcc26cfb0bc9034b919d38fb03",
+    // Chainabuse Base drain forwarder 2026-10-08
+    // https://chainabuse.com/category/contract-exploit
+    "0x101a548bcda171b5f00179aaca0ac32074a2b86a",
+    // Chainabuse Base USDC theft Jul 2026
+    // https://chainabuse.com/address/0x2cff890f0378a11913b6129b2e97417a2c302680
+    "0x678245175aae05ba3301a7812a38f1a2592a97a8",
+    // Chainabuse reported drain receiver (Bitget Swap2 incident report)
+    // https://chainabuse.com/category/contract-exploit
+    "0x9cc58d06f299f2a37050403eb9c90482f38ee3ad",
+]);
+const SET = new Set(KNOWN_DRAINERS.map((a) => a.toLowerCase()));
+export function isKnownDrainer(addr) {
+    if (typeof addr !== "string" || addr.length === 0)
+        return false;
+    return SET.has(addr.toLowerCase());
+}
+//# sourceMappingURL=known-drainers.js.map

package/dist/known-drainers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-drainers.js","sourceRoot":"","sources":["../src/known-drainers.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,+DAA+D;AAQ/D,MAAM,CAAC,MAAM,OAAO,GAAkC;IACpD;QACE,IAAI,EAAE,+CAA+C;QACrD,GAAG,EAAE,mGAAmG;QACxG,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,+DAA+D;QACrE,GAAG,EAAE,iDAAiD;QACtD,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,iDAAiD;QACvD,GAAG,EAAE,yEAAyE;QAC9E,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,iEAAiE;QACvE,GAAG,EAAE,6BAA6B;QAClC,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,2DAA2D;QACjE,GAAG,EAAE,8GAA8G;QACnH,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,mEAAmE;QACzE,GAAG,EAAE,kDAAkD;QACvD,SAAS,EAAE,YAAY;KACxB;IACD;QACE,IAAI,EAAE,sDAAsD;QAC5D,GAAG,EAAE,2EAA2E;QAChF,SAAS,EAAE,YAAY;KACxB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC7D,kEAAkE;IAClE,4CAA4C;IAC5C,mFAAmF;IACnF,4CAA4C;IAC5C,oEAAoE;IACpE,4CAA4C;IAC5C,4CAA4C;IAC5C,4CAA4C;IAC5C,oFAAoF;IACpF,4CAA4C;IAC5C,oDAAoD;IACpD,4CAA4C;IAC5C,mCAAmC;IACnC,4CAA4C;IAC5C,4DAA4D;IAC5D,4CAA4C;IAC5C,mCAAmC;IACnC,4CAA4C;IAE5C,gCAAgC;IAChC,4FAA4F;IAC5F,8BAA8B;IAC9B,4CAA4C;IAC5C,kDAAkD;IAClD,8BAA8B;IAC9B,4CAA4C;IAC5C,kHAAkH;IAClH,+GAA+G;IAC/G,4CAA4C;IAC5C,+DAA+D;IAC/D,mDAAmD;IACnD,4CAA4C;IAC5C,6CAA6C;IAC7C,mDAAmD;IACnD,4CAA4C;IAC5C,sCAAsC;IACtC,4EAA4E;IAC5E,4CAA4C;IAC5C,oEAAoE;IACpE,mDAAmD;IACnD,4CAA4C;CAC7C,CAAC,CAAC;AAEH,MAAM,GAAG,GAAwB,IAAI,GAAG,CACtC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC3C,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/normalize.d.ts

@@ -0,0 +1,4 @@
+export type { PaymentRequest, AcceptOption, PaymentResource, } from "./evaluate.js";
+import type { PaymentRequest } from "./evaluate.js";
+export declare function normalizePaymentRequired(input: unknown): PaymentRequest;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,cAAc,EACd,YAAY,EACZ,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,eAAe,CAAC;AA6EvB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAsBvE"}

package/dist/normalize.js

@@ -0,0 +1,88 @@
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function parseJsonText(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new Error("content text is not valid JSON");
+    }
+}
+function coerceResource(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    if (typeof raw.url !== "string")
+        return undefined;
+    return {
+        url: raw.url,
+        description: typeof raw.description === "string" ? raw.description : undefined,
+        mimeType: typeof raw.mimeType === "string" ? raw.mimeType : undefined,
+    };
+}
+function coerceAccept(raw) {
+    const amount = typeof raw.amount === "string"
+        ? raw.amount
+        : typeof raw.maxAmountRequired === "string"
+            ? raw.maxAmountRequired
+            : undefined;
+    if (typeof raw.scheme !== "string" ||
+        typeof raw.network !== "string" ||
+        typeof amount !== "string" ||
+        typeof raw.asset !== "string" ||
+        typeof raw.payTo !== "string" ||
+        typeof raw.maxTimeoutSeconds !== "number") {
+        throw new Error("malformed accept option");
+    }
+    return {
+        scheme: raw.scheme,
+        network: raw.network,
+        amount,
+        asset: raw.asset,
+        payTo: raw.payTo,
+        maxTimeoutSeconds: raw.maxTimeoutSeconds,
+        extra: isRecord(raw.extra) ? raw.extra : undefined,
+    };
+}
+function coercePaymentRequired(candidate) {
+    if (!isRecord(candidate)) {
+        throw new Error("PaymentRequired must be an object");
+    }
+    if (candidate.x402Version !== 2) {
+        throw new Error(`x402Version must be 2, got ${String(candidate.x402Version)}`);
+    }
+    if (!Array.isArray(candidate.accepts)) {
+        throw new Error("accepts must be an array");
+    }
+    const accepts = candidate.accepts.map((item, i) => {
+        if (!isRecord(item))
+            throw new Error(`accepts[${i}] must be an object`);
+        return coerceAccept(item);
+    });
+    return {
+        x402Version: 2,
+        accepts,
+        error: typeof candidate.error === "string" ? candidate.error : undefined,
+        resource: coerceResource(candidate.resource),
+    };
+}
+export function normalizePaymentRequired(input) {
+    if (!isRecord(input)) {
+        throw new Error("payment required input must be an object");
+    }
+    if ("x402Version" in input && "accepts" in input) {
+        return coercePaymentRequired(input);
+    }
+    if ("structuredContent" in input) {
+        return coercePaymentRequired(input.structuredContent);
+    }
+    if (Array.isArray(input.content)) {
+        const textItem = input.content.find((c) => isRecord(c) && c.type === "text" && typeof c.text === "string");
+        if (!textItem || !isRecord(textItem) || typeof textItem.text !== "string") {
+            throw new Error("MCP tool result content array did not include a text JSON payload");
+        }
+        return coercePaymentRequired(parseJsonText(textItem.text));
+    }
+    throw new Error("Unrecognized PaymentRequired input shape");
+}
+//# sourceMappingURL=normalize.js.map

package/dist/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../src/normalize.ts"],"names":[],"mappings":"AAWA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,WAAW,EACT,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;QACnE,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KACtE,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAA4B;IAChD,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC5B,CAAC,CAAC,GAAG,CAAC,MAAM;QACZ,CAAC,CAAC,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;YACzC,CAAC,CAAC,GAAG,CAAC,iBAAiB;YACvB,CAAC,CAAC,SAAS,CAAC;IAClB,IACE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC9B,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAC/B,OAAO,MAAM,KAAK,QAAQ;QAC1B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAC7B,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,EACzC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM;QACN,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAkB;IAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,8BAA8B,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAChD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACxE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,CAAC;QACd,OAAO;QACP,KAAK,EAAE,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxE,QAAQ,EAAE,cAAc,CAAC,SAAS,CAAC,QAAQ,CAAC;KAC7C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,aAAa,IAAI,KAAK,IAAI,SAAS,IAAI,KAAK,EAAE,CAAC;QACjD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,mBAAmB,IAAI,KAAK,EAAE,CAAC;QACjC,OAAO,qBAAqB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CACtE,CAAC;QACF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,qBAAqB,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;AAC9D,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,4 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+export declare function createServer(): McpServer;
+export declare function startServer(): Promise<void>;
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AASpE,wBAAgB,YAAY,IAAI,SAAS,CA2CxC;AAcD,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAIjD"}

package/dist/server.js

@@ -0,0 +1,50 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { loadPolicy, parsePolicy } from "@paystage/policy";
+import { normalizePaymentRequired } from "./normalize.js";
+import { evaluatePayment } from "./evaluate.js";
+export function createServer() {
+    const server = new McpServer({
+        name: "paystage-preflight",
+        version: "0.1.0",
+    });
+    server.registerTool("evaluate_mcp_payment", {
+        description: "Evaluate an x402 PaymentRequired payload against a PayStage spending policy before paying",
+        inputSchema: {
+            payment_required: z.unknown(),
+            policy_path: z.string().optional(),
+            policy: z.unknown().optional(),
+        },
+    }, async (input) => {
+        try {
+            const policy = await resolvePolicy(input);
+            const pr = normalizePaymentRequired(input.payment_required);
+            const result = evaluatePayment(pr, policy);
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            return {
+                isError: true,
+                content: [{ type: "text", text: `Error: ${message}` }],
+            };
+        }
+    });
+    return server;
+}
+async function resolvePolicy(input) {
+    if (input.policy !== undefined) {
+        return parsePolicy(input.policy);
+    }
+    const path = input.policy_path ?? process.env.PAYSTAGE_POLICY_PATH ?? "./policy.json";
+    return await loadPolicy(path);
+}
+export async function startServer() {
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGhD,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;QAC3B,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,OAAO;KACjB,CAAC,CAAC;IAEH,MAAM,CAAC,YAAY,CACjB,sBAAsB,EACtB;QACE,WAAW,EACT,2FAA2F;QAC7F,WAAW,EAAE;YACX,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;YAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC/B;KACF,EACD,KAAK,EAAE,KAIN,EAGE,EAAE;QACH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;YAC1C,MAAM,EAAE,GAAG,wBAAwB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAmB,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;aACvD,CAAC;QACJ,CAAC;IACH,CAAC,CACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAG5B;IACC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IACD,MAAM,IAAI,GACR,KAAK,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,eAAe,CAAC;IAC3E,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,8 @@
+export type { AcceptOption, PaymentResource, PaymentRequest, Decision, AcceptStatus, AcceptResult, EvaluateResult, } from "./evaluate.js";
+/** @deprecated alias */
+export type PaymentRequired = import("./evaluate.js").PaymentRequest;
+export type PaymentAccept = import("./evaluate.js").AcceptOption;
+export type EvaluationResult = import("./evaluate.js").EvaluateResult;
+export type EvaluationDecision = import("./evaluate.js").Decision;
+export type AcceptEvaluation = import("./evaluate.js").AcceptResult;
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,YAAY,EACZ,eAAe,EACf,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,wBAAwB;AACxB,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,EAAE,cAAc,CAAC;AACrE,MAAM,MAAM,aAAa,GAAG,OAAO,eAAe,EAAE,YAAY,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,OAAO,eAAe,EAAE,cAAc,CAAC;AACtE,MAAM,MAAM,kBAAkB,GAAG,OAAO,eAAe,EAAE,QAAQ,CAAC;AAClE,MAAM,MAAM,gBAAgB,GAAG,OAAO,eAAe,EAAE,YAAY,CAAC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,63 @@
 {
   "name": "@paystage/preflight",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "Evaluate x402 PaymentRequired against a local spending policy before an agent pays",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "paystage-preflight": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "server.json"
+  ],
+  "mcpName": "xyz.paystage/preflight",
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "mcp",
+    "x402",
+    "agent-payments",
+    "usdc",
+    "base",
+    "preflight",
+    "policy"
+  ],
+  "homepage": "https://paystage.xyz",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/base-buzz/paystage.git",
+    "directory": "packages/preflight"
+  },
+  "bugs": {
+    "url": "https://github.com/base-buzz/paystage/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "prepublishOnly": "npm run typecheck && npm run build"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
+    "@paystage/policy": "0.1.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "typescript": "^5.5.4",
+    "vitest": "^2.0.5"
+  }
+}

package/server.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "xyz.paystage/preflight",
+  "title": "PayStage Preflight",
+  "description": "Evaluate x402 PaymentRequired against a local spending policy before an agent pays",
+  "version": "0.1.0",
+  "websiteUrl": "https://paystage.xyz",
+  "repository": {
+    "url": "https://github.com/base-buzz/paystage",
+    "source": "github",
+    "subfolder": "packages/preflight"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "registryBaseUrl": "https://registry.npmjs.org",
+      "identifier": "@paystage/preflight",
+      "version": "0.1.0",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "PAYSTAGE_POLICY_PATH",
+          "description": "Path to policy.json spending rules",
+          "isRequired": false
+        }
+      ]
+    }
+  ]
+}