@solvapay/mcp-core 0.2.5 → 0.2.6-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0

package/dist/index.cjs

@@ -35,6 +35,8 @@ __export(index_exports, {
   McpBearerAuthError: () => McpBearerAuthError,
   NARRATORS: () => NARRATORS,
   OPEN_TOOL_FOR_VIEW: () => OPEN_TOOL_FOR_VIEW,
+  SOLVAPAY_BOOTSTRAP_MIME_TYPE: () => SOLVAPAY_BOOTSTRAP_MIME_TYPE,
+  SOLVAPAY_BOOTSTRAP_URI: () => SOLVAPAY_BOOTSTRAP_URI,
   SOLVAPAY_DEFAULT_CSP: () => SOLVAPAY_DEFAULT_CSP,
   SOLVAPAY_MCP_VIEW_KINDS: () => SOLVAPAY_MCP_VIEW_KINDS,
   SOLVAPAY_OVERVIEW_MARKDOWN: () => SOLVAPAY_OVERVIEW_MARKDOWN,
@@ -183,10 +185,14 @@ function costPerCallRow(creditsPerUnit) {
 function commandsLine(commands) {
   return `Commands: ${commands.map((c) => `\`/${c}\``).join(" ")}`;
 }
+function formatPlanPrices(p) {
+  const options = p.pricingOptions && p.pricingOptions.length > 0 ? p.pricingOptions : [{ currency: p.currency, price: p.price, default: true }];
+  return options.map((option) => formatMoney(option.price, option.currency)).filter((value) => value != null).join(" \xB7 ");
+}
 function plansListLines(plans) {
   return plans.map((p) => {
     const name = p.name ?? "Plan";
-    const price = formatMoney(p.price, p.currency);
+    const price = formatPlanPrices(p);
     const cycle = p.billingCycle ? `/${p.billingCycle}` : "";
     const type = p.planType === "free" ? "no payment required" : p.planType === "usage-based" ? "pay as you go" : p.planType === "trial" ? "trial" : "recurring";
     if (price && p.planType !== "free") {
@@ -300,13 +306,19 @@ var UI_OPENED_VERB = {
   manage_account: (p) => `Opened your ${p} account.`,
   activate_plan: (p) => `Opened ${p} plan picker.`
 };
+var UI_PANEL_SHOWN = {
+  topup: "Top-up options are shown in the panel.",
+  upgrade: "Plans and checkout are shown in the panel.",
+  manage_account: "Account details are shown in the panel.",
+  activate_plan: "Plan options are shown in the panel."
+};
 function uiPlaceholder(tool, data) {
   const name = productName(data);
   const opened = UI_OPENED_VERB[tool](name);
   const balance = balanceSummary(data.customer);
   const parts = [opened];
   if (balance) parts.push(`Balance: ${balance}.`);
-  parts.push("Pass `mode: 'text'` for a markdown summary.");
+  parts.push(UI_PANEL_SHOWN[tool]);
   return parts.join(" ");
 }
 
@@ -439,7 +451,7 @@ function narratedToolResult(tool, data, mode = "ui", baseMeta = void 0) {
     type: "text",
     text: uiPlaceholder(tool, data)
   };
-  const content = mode === "ui" ? [placeholderBlock] : mode === "text" ? [narratedBlock, ...resourceLinkBlocks] : [narratedBlock, ...resourceLinkBlocks];
+  const content = mode === "ui" ? [placeholderBlock, narratedBlock] : mode === "text" ? [narratedBlock, ...resourceLinkBlocks] : [narratedBlock, ...resourceLinkBlocks];
   const meta = mode === "text" && baseMeta && "ui" in baseMeta ? Object.fromEntries(Object.entries(baseMeta).filter(([k]) => k !== "ui")) : baseMeta;
   return {
     content,
@@ -692,6 +704,10 @@ function createBuildBootstrapPayload(options) {
   };
 }
 
+// src/resources/bootstrap.ts
+var SOLVAPAY_BOOTSTRAP_URI = "solvapay://bootstrap.json";
+var SOLVAPAY_BOOTSTRAP_MIME_TYPE = "application/json";
+
 // src/resources/overview.ts
 var SOLVAPAY_OVERVIEW_URI = "docs://solvapay/overview.md";
 var SOLVAPAY_OVERVIEW_MIME_TYPE = "text/markdown";
@@ -757,8 +773,8 @@ function deriveIcons(branding) {
 var solvapayTool = (hints) => ({ openWorldHint: true, ...hints });
 var INTENT_TOOL_ANNOTATIONS = {
   account: solvapayTool({ readOnlyHint: true, idempotentHint: true }),
-  topup: solvapayTool({ destructiveHint: true }),
-  checkout: solvapayTool({ destructiveHint: true })
+  topup: solvapayTool({ readOnlyHint: true, idempotentHint: true }),
+  checkout: solvapayTool({ readOnlyHint: true, idempotentHint: true })
 };
 var DEFAULT_VIEWS = [...SOLVAPAY_MCP_VIEW_KINDS];
 function buildSolvaPayDescriptors(options) {
@@ -789,7 +805,13 @@ function buildSolvaPayDescriptors(options) {
     );
   }
   const toolMeta = { ui: { resourceUri } };
-  const uiToolMeta = { ...toolMeta, audience: "ui" };
+  const uiToolMeta = {
+    ui: { resourceUri, visibility: ["app"] },
+    audience: "ui",
+    // ChatGPT Apps SDK rejects iframe `callTool` unless this flag is set.
+    // Dual-stamp with `ui.visibility: ['app']` for MCP Apps hosts.
+    "openai/widgetAccessible": true
+  };
   const enabledViews = new Set(views);
   const tools = [];
   const pushTool = (descriptor) => {
@@ -863,7 +885,7 @@ function buildSolvaPayDescriptors(options) {
   pushIntentTool(
     "checkout",
     "Upgrade plan",
-    "Start or change a paid plan for the current customer. On UI hosts this opens the embedded checkout; on text hosts returns a markdown summary with a checkout URL. Also available: manage_account (current plan + cancel/reactivate), activate_plan (pick or activate a specific plan), topup (add credits)." + MODE_HINT
+    "Start or change a paid plan for the current customer. On UI hosts this opens the embedded checkout; on text hosts returns a markdown summary with a checkout URL. This tool only returns a read-only snapshot or opens the UI \u2014 actual charges happen later in the embedded checkout after the customer confirms. Also available: manage_account (current plan + cancel/reactivate), activate_plan (pick or activate a specific plan), topup (add credits)." + MODE_HINT
   );
   pushIntentTool(
     "account",
@@ -873,7 +895,7 @@ function buildSolvaPayDescriptors(options) {
   pushIntentTool(
     "topup",
     "Top up credits",
-    "Add SolvaPay credits for the current customer. On UI hosts this opens the embedded top-up flow; on text hosts returns a markdown summary with a top-up URL. Also available: manage_account (current plan + balance + usage), upgrade (switch to a recurring plan)." + MODE_HINT
+    "Add SolvaPay credits for the current customer. On UI hosts this opens the embedded top-up flow; on text hosts returns a markdown summary with a top-up URL. This tool only returns a read-only snapshot or opens the UI \u2014 credits are not charged until the customer confirms payment in the embedded flow. Also available: manage_account (current plan + balance + usage), upgrade (switch to a recurring plan)." + MODE_HINT
   );
   pushTool({
     name: MCP_TOOL_NAMES.createCheckoutSession,
@@ -903,7 +925,8 @@ function buildSolvaPayDescriptors(options) {
     description: UI_ONLY_PREFIX + "Create a Stripe payment intent for the authenticated customer to purchase a plan. Returns { clientSecret, publishableKey, accountId?, customerRef } for confirmation with Stripe Elements in the app UI.",
     inputSchema: {
       planRef: import_zod.z.string(),
-      productRef: import_zod.z.string()
+      productRef: import_zod.z.string(),
+      currency: import_zod.z.string().optional()
     },
     meta: uiToolMeta,
     annotations: solvapayTool({}),
@@ -912,9 +935,10 @@ function buildSolvaPayDescriptors(options) {
       if (typeof auth !== "string") return auth;
       const planRef = typeof args.planRef === "string" ? args.planRef : "";
       const effectiveProduct = typeof args.productRef === "string" && args.productRef ? args.productRef : productRef;
+      const currency = typeof args.currency === "string" && args.currency ? args.currency : void 0;
       const result = await (0, import_server3.createPaymentIntentCore)(
         buildRequest(extra, { method: "POST" }),
-        { planRef, productRef: effectiveProduct },
+        { planRef, productRef: effectiveProduct, ...currency && { currency } },
         { solvaPay }
       );
       if ((0, import_server3.isErrorResult)(result)) return toolErrorResult(result);
@@ -1091,7 +1115,18 @@ function buildSolvaPayDescriptors(options) {
       readBody: () => SOLVAPAY_OVERVIEW_MARKDOWN
     }
   ];
-  return { tools, resource, prompts, docsResources, buildBootstrapPayload };
+  const bootstrapResource = {
+    uri: SOLVAPAY_BOOTSTRAP_URI,
+    name: "SolvaPay bootstrap",
+    title: "SolvaPay bootstrap",
+    description: "Current merchant/product/plans/customer snapshot for the embedded UI. Widgets read this idempotently when the host scrubs structuredContent from tool results.",
+    mimeType: SOLVAPAY_BOOTSTRAP_MIME_TYPE,
+    // View is an echoed routing label — the widget resolves the actual
+    // surface from host context (`inferViewFromHost`), so any view kind
+    // produces identical merchant/product/plans/customer data.
+    readPayload: (extra) => buildBootstrapPayload("account", extra)
+  };
+  return { tools, resource, prompts, docsResources, bootstrapResource, buildBootstrapPayload };
 }
 function buildSolvaPayPrompts(options = {}) {
   const enabled = options.enabledViews ?? new Set(DEFAULT_VIEWS);
@@ -1455,6 +1490,8 @@ function buildAuthInfoFromBearer(authorization, options = {}) {
   McpBearerAuthError,
   NARRATORS,
   OPEN_TOOL_FOR_VIEW,
+  SOLVAPAY_BOOTSTRAP_MIME_TYPE,
+  SOLVAPAY_BOOTSTRAP_URI,
   SOLVAPAY_DEFAULT_CSP,
   SOLVAPAY_MCP_VIEW_KINDS,
   SOLVAPAY_OVERVIEW_MARKDOWN,

package/dist/index.d.cts

@@ -318,6 +318,19 @@ interface SolvaPayDocsResourceDescriptor {
     /** Returns the body — sync or async. */
     readBody: () => string | Promise<string>;
 }
+/**
+ * Bootstrap snapshot resource — a JSON `BootstrapPayload` the widget can
+ * `resources/read` when the host scrubs `structuredContent` from the
+ * opening tool-result notification. Auth-aware via `readPayload(extra)`.
+ */
+interface SolvaPayBootstrapResourceDescriptor {
+    uri: string;
+    name: string;
+    title?: string;
+    description: string;
+    mimeType: string;
+    readPayload: (extra?: McpToolExtra) => Promise<BootstrapPayload>;
+}
 /**
  * One MCP prompt — rendered as `/<name>` in hosts with slash-command
  * support. Kept framework-neutral so every adapter (`@modelcontextprotocol/sdk`,
@@ -605,6 +618,11 @@ interface PlanShape {
     planType?: string;
     price?: number;
     currency?: string;
+    pricingOptions?: Array<{
+        currency?: string;
+        price?: number;
+        default?: boolean;
+    }>;
     billingCycle?: string | null;
     meterRef?: string | null;
     limit?: number | null;
@@ -1126,6 +1144,12 @@ interface SolvaPayDescriptorBundle {
      * agents can `resources/read` before trying a tool.
      */
     docsResources: SolvaPayDocsResourceDescriptor[];
+    /**
+     * Idempotent bootstrap snapshot at `solvapay://bootstrap.json` — the
+     * widget reads this when the host scrubs `structuredContent` from the
+     * opening tool-result notification.
+     */
+    bootstrapResource: SolvaPayBootstrapResourceDescriptor;
     /**
      * Parallelised fetch of merchant + product + plans + (optional)
      * customer snapshot that backs every `open_*` tool. Exposed so the
@@ -1155,6 +1179,17 @@ declare function buildSolvaPayPrompts(options?: {
     enabledViews?: Set<SolvaPayMcpViewKind>;
 }): SolvaPayPromptDescriptor[];
 
+/**
+ * Idempotent bootstrap snapshot served at `solvapay://bootstrap.json`.
+ *
+ * Widgets read this via `app.readServerResource` when the host scrubs
+ * `structuredContent` from the opening `toolresult` notification (e.g.
+ * MCPJam's AI-SDK `toModelOutput` path). Resource reads bypass chat
+ * cards and model-output scrubbing — same auth context as tool calls.
+ */
+declare const SOLVAPAY_BOOTSTRAP_URI = "solvapay://bootstrap.json";
+declare const SOLVAPAY_BOOTSTRAP_MIME_TYPE = "application/json";
+
 /**
  * Narrated overview for the SolvaPay MCP server — served verbatim at
  * `docs://solvapay/overview.md` so agents can `resources/read` before
@@ -1319,4 +1354,4 @@ interface BuildAuthInfoFromBearerOptions extends McpBearerCustomerRefOptions {
 }
 declare function buildAuthInfoFromBearer(authorization?: string | null, options?: BuildAuthInfoFromBearerOptions): McpToolExtra['authInfo'] | null;
 
-export { type ApplyHideToolsByAudienceContext, type ApplyHideToolsByAudienceExtra, type ApplyHideToolsByAudienceOptions, type BootstrapCustomer, type BootstrapMerchant, type BootstrapPayload, type BootstrapPlan, type BootstrapProduct, type BuildAuthInfoFromBearerOptions, type BuildBootstrapPayloadFn, type BuildPayableHandlerContext, type BuildSolvaPayDescriptorsOptions, type BuildSolvaPayRequestOptions, type ContentBlock, type CreateBuildBootstrapPayloadOptions, type CustomerSnapshot, DEFAULT_OAUTH_PATHS, type HideToolsByAudienceBypass, type IntentTool, MCP_TOOL_NAMES, type McpAdapterOptions, McpBearerAuthError, type McpBearerCustomerRefOptions, type McpToolExtra, type McpToolName, NARRATORS, type NarratorOutput, type NudgeSpec, type OAuthAuthorizationServerOptions, type OAuthBridgePaths, OPEN_TOOL_FOR_VIEW, type PayableHandler, type PaywallToolResult, type PaywallToolResultContext, type ResponseContext, type ResponseOptions, type ResponseResult, SOLVAPAY_DEFAULT_CSP, SOLVAPAY_MCP_VIEW_KINDS, SOLVAPAY_OVERVIEW_MARKDOWN, SOLVAPAY_OVERVIEW_MIME_TYPE, SOLVAPAY_OVERVIEW_URI, type SolvaPayCallToolResult, type SolvaPayDescriptorBundle, type SolvaPayDocsResourceDescriptor, type SolvaPayMcpCsp, type SolvaPayMcpViewKind, type SolvaPayMerchantBranding, type SolvaPayPromptDescriptor, type SolvaPayPromptResult, type SolvaPayResourceDescriptor, type SolvaPayToolAnnotations, type SolvaPayToolDescriptor, type SolvaPayToolIcon, type SolvaPayToolMode, TOOL_FOR_VIEW, VIEW_FOR_OPEN_TOOL, VIEW_FOR_TOOL, applyHideToolsByAudience, balanceSummary, buildAuthInfoFromBearer, buildPayableHandler, buildSolvaPayDescriptors, buildSolvaPayPrompts, buildSolvaPayRequest, createBuildBootstrapPayload, decodeJwtPayload, defaultGetCustomerRef, defaultIsChatGptRequest, deriveIcons, enrichPurchase, extractBearerToken, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, mergeCsp, narrateActivatePlan, narrateManageAccount, narrateTopup, narrateUpgrade, narratedToolResult, parseMode, paywallToolResult, previewJson, resolveOAuthPaths, toolErrorResult, toolResult, uiPlaceholder, withoutTrailingSlash };
+export { type ApplyHideToolsByAudienceContext, type ApplyHideToolsByAudienceExtra, type ApplyHideToolsByAudienceOptions, type BootstrapCustomer, type BootstrapMerchant, type BootstrapPayload, type BootstrapPlan, type BootstrapProduct, type BuildAuthInfoFromBearerOptions, type BuildBootstrapPayloadFn, type BuildPayableHandlerContext, type BuildSolvaPayDescriptorsOptions, type BuildSolvaPayRequestOptions, type ContentBlock, type CreateBuildBootstrapPayloadOptions, type CustomerSnapshot, DEFAULT_OAUTH_PATHS, type HideToolsByAudienceBypass, type IntentTool, MCP_TOOL_NAMES, type McpAdapterOptions, McpBearerAuthError, type McpBearerCustomerRefOptions, type McpToolExtra, type McpToolName, NARRATORS, type NarratorOutput, type NudgeSpec, type OAuthAuthorizationServerOptions, type OAuthBridgePaths, OPEN_TOOL_FOR_VIEW, type PayableHandler, type PaywallToolResult, type PaywallToolResultContext, type ResponseContext, type ResponseOptions, type ResponseResult, SOLVAPAY_BOOTSTRAP_MIME_TYPE, SOLVAPAY_BOOTSTRAP_URI, SOLVAPAY_DEFAULT_CSP, SOLVAPAY_MCP_VIEW_KINDS, SOLVAPAY_OVERVIEW_MARKDOWN, SOLVAPAY_OVERVIEW_MIME_TYPE, SOLVAPAY_OVERVIEW_URI, type SolvaPayBootstrapResourceDescriptor, type SolvaPayCallToolResult, type SolvaPayDescriptorBundle, type SolvaPayDocsResourceDescriptor, type SolvaPayMcpCsp, type SolvaPayMcpViewKind, type SolvaPayMerchantBranding, type SolvaPayPromptDescriptor, type SolvaPayPromptResult, type SolvaPayResourceDescriptor, type SolvaPayToolAnnotations, type SolvaPayToolDescriptor, type SolvaPayToolIcon, type SolvaPayToolMode, TOOL_FOR_VIEW, VIEW_FOR_OPEN_TOOL, VIEW_FOR_TOOL, applyHideToolsByAudience, balanceSummary, buildAuthInfoFromBearer, buildPayableHandler, buildSolvaPayDescriptors, buildSolvaPayPrompts, buildSolvaPayRequest, createBuildBootstrapPayload, decodeJwtPayload, defaultGetCustomerRef, defaultIsChatGptRequest, deriveIcons, enrichPurchase, extractBearerToken, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, mergeCsp, narrateActivatePlan, narrateManageAccount, narrateTopup, narrateUpgrade, narratedToolResult, parseMode, paywallToolResult, previewJson, resolveOAuthPaths, toolErrorResult, toolResult, uiPlaceholder, withoutTrailingSlash };

package/dist/index.d.ts

@@ -318,6 +318,19 @@ interface SolvaPayDocsResourceDescriptor {
     /** Returns the body — sync or async. */
     readBody: () => string | Promise<string>;
 }
+/**
+ * Bootstrap snapshot resource — a JSON `BootstrapPayload` the widget can
+ * `resources/read` when the host scrubs `structuredContent` from the
+ * opening tool-result notification. Auth-aware via `readPayload(extra)`.
+ */
+interface SolvaPayBootstrapResourceDescriptor {
+    uri: string;
+    name: string;
+    title?: string;
+    description: string;
+    mimeType: string;
+    readPayload: (extra?: McpToolExtra) => Promise<BootstrapPayload>;
+}
 /**
  * One MCP prompt — rendered as `/<name>` in hosts with slash-command
  * support. Kept framework-neutral so every adapter (`@modelcontextprotocol/sdk`,
@@ -605,6 +618,11 @@ interface PlanShape {
     planType?: string;
     price?: number;
     currency?: string;
+    pricingOptions?: Array<{
+        currency?: string;
+        price?: number;
+        default?: boolean;
+    }>;
     billingCycle?: string | null;
     meterRef?: string | null;
     limit?: number | null;
@@ -1126,6 +1144,12 @@ interface SolvaPayDescriptorBundle {
      * agents can `resources/read` before trying a tool.
      */
     docsResources: SolvaPayDocsResourceDescriptor[];
+    /**
+     * Idempotent bootstrap snapshot at `solvapay://bootstrap.json` — the
+     * widget reads this when the host scrubs `structuredContent` from the
+     * opening tool-result notification.
+     */
+    bootstrapResource: SolvaPayBootstrapResourceDescriptor;
     /**
      * Parallelised fetch of merchant + product + plans + (optional)
      * customer snapshot that backs every `open_*` tool. Exposed so the
@@ -1155,6 +1179,17 @@ declare function buildSolvaPayPrompts(options?: {
     enabledViews?: Set<SolvaPayMcpViewKind>;
 }): SolvaPayPromptDescriptor[];
 
+/**
+ * Idempotent bootstrap snapshot served at `solvapay://bootstrap.json`.
+ *
+ * Widgets read this via `app.readServerResource` when the host scrubs
+ * `structuredContent` from the opening `toolresult` notification (e.g.
+ * MCPJam's AI-SDK `toModelOutput` path). Resource reads bypass chat
+ * cards and model-output scrubbing — same auth context as tool calls.
+ */
+declare const SOLVAPAY_BOOTSTRAP_URI = "solvapay://bootstrap.json";
+declare const SOLVAPAY_BOOTSTRAP_MIME_TYPE = "application/json";
+
 /**
  * Narrated overview for the SolvaPay MCP server — served verbatim at
  * `docs://solvapay/overview.md` so agents can `resources/read` before
@@ -1319,4 +1354,4 @@ interface BuildAuthInfoFromBearerOptions extends McpBearerCustomerRefOptions {
 }
 declare function buildAuthInfoFromBearer(authorization?: string | null, options?: BuildAuthInfoFromBearerOptions): McpToolExtra['authInfo'] | null;
 
-export { type ApplyHideToolsByAudienceContext, type ApplyHideToolsByAudienceExtra, type ApplyHideToolsByAudienceOptions, type BootstrapCustomer, type BootstrapMerchant, type BootstrapPayload, type BootstrapPlan, type BootstrapProduct, type BuildAuthInfoFromBearerOptions, type BuildBootstrapPayloadFn, type BuildPayableHandlerContext, type BuildSolvaPayDescriptorsOptions, type BuildSolvaPayRequestOptions, type ContentBlock, type CreateBuildBootstrapPayloadOptions, type CustomerSnapshot, DEFAULT_OAUTH_PATHS, type HideToolsByAudienceBypass, type IntentTool, MCP_TOOL_NAMES, type McpAdapterOptions, McpBearerAuthError, type McpBearerCustomerRefOptions, type McpToolExtra, type McpToolName, NARRATORS, type NarratorOutput, type NudgeSpec, type OAuthAuthorizationServerOptions, type OAuthBridgePaths, OPEN_TOOL_FOR_VIEW, type PayableHandler, type PaywallToolResult, type PaywallToolResultContext, type ResponseContext, type ResponseOptions, type ResponseResult, SOLVAPAY_DEFAULT_CSP, SOLVAPAY_MCP_VIEW_KINDS, SOLVAPAY_OVERVIEW_MARKDOWN, SOLVAPAY_OVERVIEW_MIME_TYPE, SOLVAPAY_OVERVIEW_URI, type SolvaPayCallToolResult, type SolvaPayDescriptorBundle, type SolvaPayDocsResourceDescriptor, type SolvaPayMcpCsp, type SolvaPayMcpViewKind, type SolvaPayMerchantBranding, type SolvaPayPromptDescriptor, type SolvaPayPromptResult, type SolvaPayResourceDescriptor, type SolvaPayToolAnnotations, type SolvaPayToolDescriptor, type SolvaPayToolIcon, type SolvaPayToolMode, TOOL_FOR_VIEW, VIEW_FOR_OPEN_TOOL, VIEW_FOR_TOOL, applyHideToolsByAudience, balanceSummary, buildAuthInfoFromBearer, buildPayableHandler, buildSolvaPayDescriptors, buildSolvaPayPrompts, buildSolvaPayRequest, createBuildBootstrapPayload, decodeJwtPayload, defaultGetCustomerRef, defaultIsChatGptRequest, deriveIcons, enrichPurchase, extractBearerToken, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, mergeCsp, narrateActivatePlan, narrateManageAccount, narrateTopup, narrateUpgrade, narratedToolResult, parseMode, paywallToolResult, previewJson, resolveOAuthPaths, toolErrorResult, toolResult, uiPlaceholder, withoutTrailingSlash };
+export { type ApplyHideToolsByAudienceContext, type ApplyHideToolsByAudienceExtra, type ApplyHideToolsByAudienceOptions, type BootstrapCustomer, type BootstrapMerchant, type BootstrapPayload, type BootstrapPlan, type BootstrapProduct, type BuildAuthInfoFromBearerOptions, type BuildBootstrapPayloadFn, type BuildPayableHandlerContext, type BuildSolvaPayDescriptorsOptions, type BuildSolvaPayRequestOptions, type ContentBlock, type CreateBuildBootstrapPayloadOptions, type CustomerSnapshot, DEFAULT_OAUTH_PATHS, type HideToolsByAudienceBypass, type IntentTool, MCP_TOOL_NAMES, type McpAdapterOptions, McpBearerAuthError, type McpBearerCustomerRefOptions, type McpToolExtra, type McpToolName, NARRATORS, type NarratorOutput, type NudgeSpec, type OAuthAuthorizationServerOptions, type OAuthBridgePaths, OPEN_TOOL_FOR_VIEW, type PayableHandler, type PaywallToolResult, type PaywallToolResultContext, type ResponseContext, type ResponseOptions, type ResponseResult, SOLVAPAY_BOOTSTRAP_MIME_TYPE, SOLVAPAY_BOOTSTRAP_URI, SOLVAPAY_DEFAULT_CSP, SOLVAPAY_MCP_VIEW_KINDS, SOLVAPAY_OVERVIEW_MARKDOWN, SOLVAPAY_OVERVIEW_MIME_TYPE, SOLVAPAY_OVERVIEW_URI, type SolvaPayBootstrapResourceDescriptor, type SolvaPayCallToolResult, type SolvaPayDescriptorBundle, type SolvaPayDocsResourceDescriptor, type SolvaPayMcpCsp, type SolvaPayMcpViewKind, type SolvaPayMerchantBranding, type SolvaPayPromptDescriptor, type SolvaPayPromptResult, type SolvaPayResourceDescriptor, type SolvaPayToolAnnotations, type SolvaPayToolDescriptor, type SolvaPayToolIcon, type SolvaPayToolMode, TOOL_FOR_VIEW, VIEW_FOR_OPEN_TOOL, VIEW_FOR_TOOL, applyHideToolsByAudience, balanceSummary, buildAuthInfoFromBearer, buildPayableHandler, buildSolvaPayDescriptors, buildSolvaPayPrompts, buildSolvaPayRequest, createBuildBootstrapPayload, decodeJwtPayload, defaultGetCustomerRef, defaultIsChatGptRequest, deriveIcons, enrichPurchase, extractBearerToken, getCustomerRefFromBearerAuthHeader, getCustomerRefFromJwtPayload, getOAuthAuthorizationServerResponse, getOAuthProtectedResourceResponse, mergeCsp, narrateActivatePlan, narrateManageAccount, narrateTopup, narrateUpgrade, narratedToolResult, parseMode, paywallToolResult, previewJson, resolveOAuthPaths, toolErrorResult, toolResult, uiPlaceholder, withoutTrailingSlash };

package/dist/index.js

@@ -103,10 +103,14 @@ function costPerCallRow(creditsPerUnit) {
 function commandsLine(commands) {
   return `Commands: ${commands.map((c) => `\`/${c}\``).join(" ")}`;
 }
+function formatPlanPrices(p) {
+  const options = p.pricingOptions && p.pricingOptions.length > 0 ? p.pricingOptions : [{ currency: p.currency, price: p.price, default: true }];
+  return options.map((option) => formatMoney(option.price, option.currency)).filter((value) => value != null).join(" \xB7 ");
+}
 function plansListLines(plans) {
   return plans.map((p) => {
     const name = p.name ?? "Plan";
-    const price = formatMoney(p.price, p.currency);
+    const price = formatPlanPrices(p);
     const cycle = p.billingCycle ? `/${p.billingCycle}` : "";
     const type = p.planType === "free" ? "no payment required" : p.planType === "usage-based" ? "pay as you go" : p.planType === "trial" ? "trial" : "recurring";
     if (price && p.planType !== "free") {
@@ -220,13 +224,19 @@ var UI_OPENED_VERB = {
   manage_account: (p) => `Opened your ${p} account.`,
   activate_plan: (p) => `Opened ${p} plan picker.`
 };
+var UI_PANEL_SHOWN = {
+  topup: "Top-up options are shown in the panel.",
+  upgrade: "Plans and checkout are shown in the panel.",
+  manage_account: "Account details are shown in the panel.",
+  activate_plan: "Plan options are shown in the panel."
+};
 function uiPlaceholder(tool, data) {
   const name = productName(data);
   const opened = UI_OPENED_VERB[tool](name);
   const balance = balanceSummary(data.customer);
   const parts = [opened];
   if (balance) parts.push(`Balance: ${balance}.`);
-  parts.push("Pass `mode: 'text'` for a markdown summary.");
+  parts.push(UI_PANEL_SHOWN[tool]);
   return parts.join(" ");
 }
 
@@ -359,7 +369,7 @@ function narratedToolResult(tool, data, mode = "ui", baseMeta = void 0) {
     type: "text",
     text: uiPlaceholder(tool, data)
   };
-  const content = mode === "ui" ? [placeholderBlock] : mode === "text" ? [narratedBlock, ...resourceLinkBlocks] : [narratedBlock, ...resourceLinkBlocks];
+  const content = mode === "ui" ? [placeholderBlock, narratedBlock] : mode === "text" ? [narratedBlock, ...resourceLinkBlocks] : [narratedBlock, ...resourceLinkBlocks];
   const meta = mode === "text" && baseMeta && "ui" in baseMeta ? Object.fromEntries(Object.entries(baseMeta).filter(([k]) => k !== "ui")) : baseMeta;
   return {
     content,
@@ -631,6 +641,10 @@ function createBuildBootstrapPayload(options) {
   };
 }
 
+// src/resources/bootstrap.ts
+var SOLVAPAY_BOOTSTRAP_URI = "solvapay://bootstrap.json";
+var SOLVAPAY_BOOTSTRAP_MIME_TYPE = "application/json";
+
 // src/resources/overview.ts
 var SOLVAPAY_OVERVIEW_URI = "docs://solvapay/overview.md";
 var SOLVAPAY_OVERVIEW_MIME_TYPE = "text/markdown";
@@ -696,8 +710,8 @@ function deriveIcons(branding) {
 var solvapayTool = (hints) => ({ openWorldHint: true, ...hints });
 var INTENT_TOOL_ANNOTATIONS = {
   account: solvapayTool({ readOnlyHint: true, idempotentHint: true }),
-  topup: solvapayTool({ destructiveHint: true }),
-  checkout: solvapayTool({ destructiveHint: true })
+  topup: solvapayTool({ readOnlyHint: true, idempotentHint: true }),
+  checkout: solvapayTool({ readOnlyHint: true, idempotentHint: true })
 };
 var DEFAULT_VIEWS = [...SOLVAPAY_MCP_VIEW_KINDS];
 function buildSolvaPayDescriptors(options) {
@@ -728,7 +742,13 @@ function buildSolvaPayDescriptors(options) {
     );
   }
   const toolMeta = { ui: { resourceUri } };
-  const uiToolMeta = { ...toolMeta, audience: "ui" };
+  const uiToolMeta = {
+    ui: { resourceUri, visibility: ["app"] },
+    audience: "ui",
+    // ChatGPT Apps SDK rejects iframe `callTool` unless this flag is set.
+    // Dual-stamp with `ui.visibility: ['app']` for MCP Apps hosts.
+    "openai/widgetAccessible": true
+  };
   const enabledViews = new Set(views);
   const tools = [];
   const pushTool = (descriptor) => {
@@ -802,7 +822,7 @@ function buildSolvaPayDescriptors(options) {
   pushIntentTool(
     "checkout",
     "Upgrade plan",
-    "Start or change a paid plan for the current customer. On UI hosts this opens the embedded checkout; on text hosts returns a markdown summary with a checkout URL. Also available: manage_account (current plan + cancel/reactivate), activate_plan (pick or activate a specific plan), topup (add credits)." + MODE_HINT
+    "Start or change a paid plan for the current customer. On UI hosts this opens the embedded checkout; on text hosts returns a markdown summary with a checkout URL. This tool only returns a read-only snapshot or opens the UI \u2014 actual charges happen later in the embedded checkout after the customer confirms. Also available: manage_account (current plan + cancel/reactivate), activate_plan (pick or activate a specific plan), topup (add credits)." + MODE_HINT
   );
   pushIntentTool(
     "account",
@@ -812,7 +832,7 @@ function buildSolvaPayDescriptors(options) {
   pushIntentTool(
     "topup",
     "Top up credits",
-    "Add SolvaPay credits for the current customer. On UI hosts this opens the embedded top-up flow; on text hosts returns a markdown summary with a top-up URL. Also available: manage_account (current plan + balance + usage), upgrade (switch to a recurring plan)." + MODE_HINT
+    "Add SolvaPay credits for the current customer. On UI hosts this opens the embedded top-up flow; on text hosts returns a markdown summary with a top-up URL. This tool only returns a read-only snapshot or opens the UI \u2014 credits are not charged until the customer confirms payment in the embedded flow. Also available: manage_account (current plan + balance + usage), upgrade (switch to a recurring plan)." + MODE_HINT
   );
   pushTool({
     name: MCP_TOOL_NAMES.createCheckoutSession,
@@ -842,7 +862,8 @@ function buildSolvaPayDescriptors(options) {
     description: UI_ONLY_PREFIX + "Create a Stripe payment intent for the authenticated customer to purchase a plan. Returns { clientSecret, publishableKey, accountId?, customerRef } for confirmation with Stripe Elements in the app UI.",
     inputSchema: {
       planRef: z.string(),
-      productRef: z.string()
+      productRef: z.string(),
+      currency: z.string().optional()
     },
     meta: uiToolMeta,
     annotations: solvapayTool({}),
@@ -851,9 +872,10 @@ function buildSolvaPayDescriptors(options) {
       if (typeof auth !== "string") return auth;
       const planRef = typeof args.planRef === "string" ? args.planRef : "";
       const effectiveProduct = typeof args.productRef === "string" && args.productRef ? args.productRef : productRef;
+      const currency = typeof args.currency === "string" && args.currency ? args.currency : void 0;
       const result = await createPaymentIntentCore(
         buildRequest(extra, { method: "POST" }),
-        { planRef, productRef: effectiveProduct },
+        { planRef, productRef: effectiveProduct, ...currency && { currency } },
         { solvaPay }
       );
       if (isErrorResult2(result)) return toolErrorResult(result);
@@ -1030,7 +1052,18 @@ function buildSolvaPayDescriptors(options) {
       readBody: () => SOLVAPAY_OVERVIEW_MARKDOWN
     }
   ];
-  return { tools, resource, prompts, docsResources, buildBootstrapPayload };
+  const bootstrapResource = {
+    uri: SOLVAPAY_BOOTSTRAP_URI,
+    name: "SolvaPay bootstrap",
+    title: "SolvaPay bootstrap",
+    description: "Current merchant/product/plans/customer snapshot for the embedded UI. Widgets read this idempotently when the host scrubs structuredContent from tool results.",
+    mimeType: SOLVAPAY_BOOTSTRAP_MIME_TYPE,
+    // View is an echoed routing label — the widget resolves the actual
+    // surface from host context (`inferViewFromHost`), so any view kind
+    // produces identical merchant/product/plans/customer data.
+    readPayload: (extra) => buildBootstrapPayload("account", extra)
+  };
+  return { tools, resource, prompts, docsResources, bootstrapResource, buildBootstrapPayload };
 }
 function buildSolvaPayPrompts(options = {}) {
   const enabled = options.enabledViews ?? new Set(DEFAULT_VIEWS);
@@ -1393,6 +1426,8 @@ export {
   McpBearerAuthError,
   NARRATORS,
   OPEN_TOOL_FOR_VIEW,
+  SOLVAPAY_BOOTSTRAP_MIME_TYPE,
+  SOLVAPAY_BOOTSTRAP_URI,
   SOLVAPAY_DEFAULT_CSP,
   SOLVAPAY_MCP_VIEW_KINDS,
   SOLVAPAY_OVERVIEW_MARKDOWN,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solvapay/mcp-core",
-  "version": "0.2.5",
+  "version": "0.2.6-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0",
   "description": "Framework-neutral MCP contracts for the SolvaPay SDK (tool names, descriptors, payable handler, paywall meta, CSP, bootstrap payload, OAuth discovery JSON builders, bearer/JWT helpers).",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -34,14 +34,14 @@
   },
   "peerDependencies": {
     "zod": "^3.25.0 || ^4.0.0",
-    "@solvapay/server": "^1.2.0"
+    "@solvapay/server": "^1.2.1-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0"
   },
   "devDependencies": {
     "tsup": "^8.5.1",
     "typescript": "^5.9.3",
     "vitest": "^4.1.2",
     "zod": "^4.3.6",
-    "@solvapay/server": "1.2.0",
+    "@solvapay/server": "1.2.1-preview-e89fa52f99b6d0c7bf9834fcf2d1403141051fa0",
     "@solvapay/test-utils": "^0.0.0"
   },
   "scripts": {