@solvapay/mcp 0.1.0 → 0.2.0

package/dist/fetch/index.cjs

@@ -0,0 +1,787 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/fetch/index.ts
+var fetch_exports = {};
+__export(fetch_exports, {
+  McpBearerAuthError: () => import_mcp_core6.McpBearerAuthError,
+  applyNativeCors: () => applyNativeCors,
+  authChallenge: () => authChallenge,
+  buildAuthInfoFromBearer: () => import_mcp_core6.buildAuthInfoFromBearer,
+  corsPreflight: () => corsPreflight,
+  createAuthorizationServerHandler: () => createAuthorizationServerHandler,
+  createOAuthAuthorizeHandler: () => createOAuthAuthorizeHandler,
+  createOAuthFetchRouter: () => createOAuthFetchRouter,
+  createOAuthRegisterHandler: () => createOAuthRegisterHandler,
+  createOAuthRevokeHandler: () => createOAuthRevokeHandler,
+  createOAuthTokenHandler: () => createOAuthTokenHandler,
+  createOpenidNotFoundHandler: () => createOpenidNotFoundHandler,
+  createProtectedResourceHandler: () => createProtectedResourceHandler,
+  createSolvaPayMcpFetch: () => createSolvaPayMcpFetch,
+  createSolvaPayMcpFetchHandler: () => createSolvaPayMcpFetchHandler,
+  getOAuthAuthorizationServerResponse: () => import_mcp_core6.getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse: () => import_mcp_core6.getOAuthProtectedResourceResponse,
+  isNativeClientOrigin: () => isNativeClientOrigin,
+  resolveBearer: () => resolveBearer
+});
+module.exports = __toCommonJS(fetch_exports);
+
+// src/fetch/oauth-bridge.ts
+var import_mcp_core2 = require("@solvapay/mcp-core");
+
+// src/fetch/cors.ts
+var import_mcp_core = require("@solvapay/mcp-core");
+var NATIVE_CLIENT_ORIGIN_REGEX = /^(cursor|vscode|vscode-webview|claude):\/\/.+$/;
+function isNativeClientOrigin(origin) {
+  if (!origin) return false;
+  return NATIVE_CLIENT_ORIGIN_REGEX.test(origin);
+}
+function applyNativeCors(reqHeaders, resHeaders) {
+  const origin = reqHeaders.get("origin");
+  if (!origin) return;
+  if (isNativeClientOrigin(origin)) {
+    resHeaders.set("Access-Control-Allow-Origin", origin);
+    resHeaders.append("Vary", "Origin");
+  }
+}
+function corsPreflight(req) {
+  const reqHeaders = req.headers;
+  const requestedMethod = reqHeaders.get("access-control-request-method") ?? "POST";
+  const requestedHeaders = reqHeaders.get("access-control-request-headers") ?? "authorization, content-type";
+  const headers = new Headers();
+  applyNativeCors(reqHeaders, headers);
+  headers.set("Access-Control-Allow-Methods", `${requestedMethod}, OPTIONS`);
+  headers.set("Access-Control-Allow-Headers", requestedHeaders);
+  headers.set("Access-Control-Max-Age", "600");
+  return new Response(null, { status: 204, headers });
+}
+function authChallenge(req, options) {
+  const {
+    publicBaseUrl,
+    protectedResourcePath = "/.well-known/oauth-protected-resource",
+    jsonRpcId = null
+  } = options;
+  const headers = new Headers();
+  applyNativeCors(req.headers, headers);
+  headers.set("Access-Control-Expose-Headers", "WWW-Authenticate");
+  headers.set(
+    "WWW-Authenticate",
+    `Bearer resource_metadata="${(0, import_mcp_core.withoutTrailingSlash)(publicBaseUrl)}${protectedResourcePath}"`
+  );
+  headers.set("Content-Type", "application/json");
+  const body = {
+    jsonrpc: "2.0",
+    id: jsonRpcId,
+    error: { code: -32001, message: "Unauthorized" }
+  };
+  return new Response(JSON.stringify(body), { status: 401, headers });
+}
+function resolveBearer(req) {
+  const header = req.headers.get("authorization");
+  if (!header) return null;
+  const match = /^\s*Bearer\s+(.+?)\s*$/i.exec(header);
+  return match ? match[1] : null;
+}
+
+// src/fetch/oauth-bridge.ts
+function hasOAuthErrorShape(body) {
+  return body !== null && typeof body === "object" && typeof body.error === "string";
+}
+function extractZodErrors(body) {
+  const errs = body.errors;
+  if (!Array.isArray(errs)) return [];
+  return errs.filter((e) => !!e && typeof e === "object");
+}
+function deriveOAuthErrorCode(status, nestBody) {
+  if (status === 401 || status === 403) return "invalid_client";
+  if (status >= 500) return "server_error";
+  const zodErrors = extractZodErrors(nestBody);
+  const touches = (field) => zodErrors.some((e) => {
+    const path = e.path;
+    return Array.isArray(path) && path.includes(field);
+  });
+  if (touches("grant_type")) {
+    const grantTypeErr = zodErrors.find((e) => {
+      const path = e.path;
+      return Array.isArray(path) && path.includes("grant_type");
+    });
+    const received = grantTypeErr && grantTypeErr.received;
+    if (received !== "undefined" && received !== void 0 && received !== "") {
+      return "unsupported_grant_type";
+    }
+    return "invalid_request";
+  }
+  if (touches("code") || touches("refresh_token")) return "invalid_grant";
+  if (touches("scope")) return "invalid_scope";
+  if (touches("client_id") || touches("client_secret")) return "invalid_client";
+  return "invalid_request";
+}
+function buildErrorDescription(nestBody) {
+  const zodErrors = extractZodErrors(nestBody);
+  if (zodErrors.length > 0) {
+    const parts = zodErrors.map((e) => {
+      const path = e.path;
+      const message2 = e.message;
+      const pathStr = Array.isArray(path) ? path.filter((p) => typeof p === "string").join(".") : "";
+      const msgStr = typeof message2 === "string" ? message2 : "";
+      if (pathStr && msgStr) return `${pathStr}: ${msgStr}`;
+      return pathStr || msgStr;
+    }).filter(Boolean);
+    if (parts.length > 0) return parts.join("; ");
+  }
+  const message = nestBody.message;
+  if (typeof message === "string") return message;
+  if (Array.isArray(message)) {
+    const strings = message.filter((m) => typeof m === "string");
+    if (strings.length > 0) return strings.join("; ");
+  }
+  return void 0;
+}
+function toOAuthErrorBody(body, text, status) {
+  if (hasOAuthErrorShape(body)) return body;
+  if (body && typeof body === "object") {
+    const nestBody = body;
+    const error = deriveOAuthErrorCode(status, nestBody);
+    const error_description = buildErrorDescription(nestBody);
+    return error_description ? { error, error_description } : { error };
+  }
+  const fallbackError = status >= 500 ? "server_error" : "invalid_request";
+  const description = typeof text === "string" && text.length > 0 && text.length < 500 ? text : void 0;
+  return description ? { error: fallbackError, error_description: description } : { error: fallbackError };
+}
+async function parseUpstreamJson(response) {
+  const text = await response.text();
+  if (!text) return { body: {}, text: "" };
+  try {
+    return { body: JSON.parse(text), text };
+  } catch {
+    return { body: text, text };
+  }
+}
+function upstreamUnreachable(req) {
+  const headers = new Headers({ "content-type": "application/json" });
+  applyNativeCors(req.headers, headers);
+  return new Response(JSON.stringify({ error: "upstream_unreachable" }), { status: 502, headers });
+}
+function corsResponse(req, response) {
+  const headers = new Headers(response.headers);
+  applyNativeCors(req.headers, headers);
+  return new Response(response.body, { status: response.status, headers });
+}
+function jsonResponse(req, status, body) {
+  const headers = new Headers({ "content-type": "application/json" });
+  applyNativeCors(req.headers, headers);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+function emptyResponse(req, status) {
+  const headers = new Headers();
+  applyNativeCors(req.headers, headers);
+  return new Response(null, { status, headers });
+}
+function pathOf(req) {
+  return new URL(req.url).pathname;
+}
+function queryOf(req) {
+  const search = new URL(req.url).search;
+  return search || "";
+}
+function createProtectedResourceHandler(options) {
+  const path = options.protectedResourcePath ?? "/.well-known/oauth-protected-resource";
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== path) return null;
+    return jsonResponse(req, 200, (0, import_mcp_core2.getOAuthProtectedResourceResponse)(options.publicBaseUrl));
+  };
+}
+function createAuthorizationServerHandler(options) {
+  const path = options.authorizationServerPath ?? "/.well-known/oauth-authorization-server";
+  const resolvedPaths = (0, import_mcp_core2.resolveOAuthPaths)(options.paths);
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== path) return null;
+    if (!options.productRef) {
+      return jsonResponse(req, 500, { error: "SOLVAPAY_PRODUCT_REF missing" });
+    }
+    return jsonResponse(
+      req,
+      200,
+      (0, import_mcp_core2.getOAuthAuthorizationServerResponse)({
+        publicBaseUrl: options.publicBaseUrl,
+        paths: resolvedPaths
+      })
+    );
+  };
+}
+function createOpenidNotFoundHandler() {
+  return async (req) => {
+    if (req.method !== "GET" || pathOf(req) !== "/.well-known/openid-configuration") return null;
+    return emptyResponse(req, 404);
+  };
+}
+function createOAuthRegisterHandler(options) {
+  const path = options.path ?? "/oauth/register";
+  const api = (0, import_mcp_core2.withoutTrailingSlash)(options.apiBaseUrl);
+  const upstream = `${api}/v1/customer/auth/register?product_ref=${encodeURIComponent(options.productRef)}`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    const body = await req.text();
+    try {
+      const upstreamResponse = await fetch(upstream, {
+        method: "POST",
+        headers: { "content-type": req.headers.get("content-type") ?? "application/json" },
+        body
+      });
+      return corsResponse(req, upstreamResponse);
+    } catch {
+      return upstreamUnreachable(req);
+    }
+  };
+}
+function createOAuthAuthorizeHandler(options) {
+  const path = options.path ?? "/oauth/authorize";
+  const api = (0, import_mcp_core2.withoutTrailingSlash)(options.apiBaseUrl);
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "GET") return null;
+    const query = queryOf(req);
+    const location = `${api}/v1/customer/auth/authorize${query}`;
+    const headers = new Headers({ Location: location });
+    applyNativeCors(req.headers, headers);
+    return new Response(null, { status: 302, headers });
+  };
+}
+async function proxyFormEndpoint(req, upstreamUrl, normalizeErrors) {
+  const rawBody = await req.text();
+  const contentType = req.headers.get("content-type") ?? "application/x-www-form-urlencoded";
+  const headers = { "content-type": contentType };
+  const authorization = req.headers.get("authorization");
+  if (authorization) headers.authorization = authorization;
+  try {
+    const upstreamResponse = await fetch(upstreamUrl, {
+      method: "POST",
+      headers,
+      body: rawBody
+    });
+    if (!normalizeErrors || upstreamResponse.ok || upstreamResponse.status === 204) {
+      return corsResponse(req, upstreamResponse);
+    }
+    const { body, text } = await parseUpstreamJson(upstreamResponse);
+    const normalized = toOAuthErrorBody(body, text, upstreamResponse.status);
+    return jsonResponse(req, upstreamResponse.status, normalized);
+  } catch {
+    return upstreamUnreachable(req);
+  }
+}
+function createOAuthTokenHandler(options) {
+  const path = options.path ?? "/oauth/token";
+  const upstream = `${(0, import_mcp_core2.withoutTrailingSlash)(options.apiBaseUrl)}/v1/customer/auth/token`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    return proxyFormEndpoint(
+      req,
+      upstream,
+      /* normalizeErrors */
+      true
+    );
+  };
+}
+function createOAuthRevokeHandler(options) {
+  const path = options.path ?? "/oauth/revoke";
+  const upstream = `${(0, import_mcp_core2.withoutTrailingSlash)(options.apiBaseUrl)}/v1/customer/auth/revoke`;
+  return async (req) => {
+    if (pathOf(req) !== path) return null;
+    if (req.method === "OPTIONS") return corsPreflight(req);
+    if (req.method !== "POST") return null;
+    return proxyFormEndpoint(
+      req,
+      upstream,
+      /* normalizeErrors */
+      true
+    );
+  };
+}
+function createOAuthFetchRouter(options) {
+  const paths = (0, import_mcp_core2.resolveOAuthPaths)(options.oauthPaths);
+  const handlers = [
+    createOpenidNotFoundHandler(),
+    createProtectedResourceHandler({
+      publicBaseUrl: options.publicBaseUrl,
+      protectedResourcePath: options.protectedResourcePath
+    }),
+    createAuthorizationServerHandler({
+      publicBaseUrl: options.publicBaseUrl,
+      authorizationServerPath: options.authorizationServerPath,
+      paths,
+      productRef: options.productRef
+    }),
+    createOAuthRegisterHandler({
+      apiBaseUrl: options.apiBaseUrl,
+      productRef: options.productRef,
+      path: paths.register
+    }),
+    createOAuthAuthorizeHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.authorize }),
+    createOAuthTokenHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.token }),
+    createOAuthRevokeHandler({ apiBaseUrl: options.apiBaseUrl, path: paths.revoke })
+  ];
+  return async (req) => {
+    for (const handler of handlers) {
+      const response = await handler(req);
+      if (response) return response;
+    }
+    return null;
+  };
+}
+
+// src/fetch/handler.ts
+var import_mcp_core3 = require("@solvapay/mcp-core");
+var import_webStandardStreamableHttp = require("@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js");
+function defaultSessionIdGenerator() {
+  const c = globalThis.crypto;
+  if (c?.randomUUID) return c.randomUUID();
+  return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, (ch) => {
+    const r = Math.floor(Math.random() * 16);
+    const v = ch === "x" ? r : r & 3 | 8;
+    return v.toString(16);
+  });
+}
+function getJsonRpcId(body) {
+  if (body && typeof body === "object" && "id" in body) {
+    const id = body.id;
+    return id ?? null;
+  }
+  return null;
+}
+async function readJsonRpcId(req) {
+  try {
+    const clone = req.clone();
+    const body = await clone.json();
+    return getJsonRpcId(body);
+  } catch {
+    return null;
+  }
+}
+function createSolvaPayMcpFetchHandler(options) {
+  const {
+    server,
+    publicBaseUrl,
+    apiBaseUrl,
+    productRef,
+    mcpPath = "/mcp",
+    requireAuth = true,
+    authInfo,
+    protectedResourcePath,
+    authorizationServerPath,
+    oauthPaths,
+    mode = "sse-stateful",
+    buildTransport,
+    sessionIdGenerator
+  } = options;
+  const oauthRouter = createOAuthFetchRouter({
+    publicBaseUrl,
+    apiBaseUrl,
+    productRef,
+    protectedResourcePath,
+    authorizationServerPath,
+    oauthPaths
+  });
+  const makeTransport = () => {
+    if (buildTransport) return buildTransport();
+    if (mode === "json-stateless") {
+      return new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0,
+        enableJsonResponse: true
+      });
+    }
+    if (mode === "sse-stateless") {
+      return new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
+        sessionIdGenerator: void 0
+      });
+    }
+    return new import_webStandardStreamableHttp.WebStandardStreamableHTTPServerTransport({
+      sessionIdGenerator: sessionIdGenerator ?? defaultSessionIdGenerator
+    });
+  };
+  let serverMutex = Promise.resolve();
+  return async (req) => {
+    const url = new URL(req.url);
+    const pathname = url.pathname;
+    if (req.method === "OPTIONS" && pathname === mcpPath) {
+      return corsPreflight(req);
+    }
+    const oauthResponse = await oauthRouter(req);
+    if (oauthResponse) return oauthResponse;
+    if (pathname !== mcpPath) {
+      return new Response("not_found", { status: 404 });
+    }
+    if (req.method && req.method !== "POST" && req.method !== "OPTIONS") {
+      const headers = new Headers({ Allow: "POST, OPTIONS" });
+      applyNativeCors(req.headers, headers);
+      return new Response(null, { status: 405, headers });
+    }
+    const authHeader = req.headers.get("authorization");
+    let resolvedAuthInfo = null;
+    if (authHeader || requireAuth) {
+      try {
+        resolvedAuthInfo = (0, import_mcp_core3.buildAuthInfoFromBearer)(authHeader, authInfo);
+        if (!resolvedAuthInfo) {
+          throw new import_mcp_core3.McpBearerAuthError("Missing bearer token");
+        }
+      } catch {
+        const jsonRpcId = await readJsonRpcId(req);
+        return authChallenge(req, {
+          publicBaseUrl,
+          protectedResourcePath,
+          jsonRpcId
+        });
+      }
+    }
+    const previous = serverMutex;
+    let releaseMutex = () => {
+    };
+    serverMutex = new Promise((resolve) => {
+      releaseMutex = resolve;
+    });
+    await previous;
+    const transport = makeTransport();
+    try {
+      await server.connect(transport);
+      const response = await transport.handleRequest(
+        req,
+        resolvedAuthInfo ? {
+          // `AuthInfo` from the SDK is structurally identical to our
+          // envelope — cast away the brand so the types line up.
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          authInfo: resolvedAuthInfo
+        } : void 0
+      );
+      const merged = new Headers(response.headers);
+      applyNativeCors(req.headers, merged);
+      return new Response(response.body, { status: response.status, headers: merged });
+    } catch (error) {
+      const headers = new Headers({ "content-type": "application/json" });
+      applyNativeCors(req.headers, headers);
+      const jsonRpcId = await readJsonRpcId(req);
+      return new Response(
+        JSON.stringify({
+          jsonrpc: "2.0",
+          id: jsonRpcId,
+          error: {
+            code: -32603,
+            message: error instanceof Error ? error.message : "internal_error"
+          }
+        }),
+        { status: 500, headers }
+      );
+    } finally {
+      await transport.close().catch(() => {
+      });
+      releaseMutex();
+    }
+  };
+}
+
+// src/internal/buildMcpServer.ts
+var import_server = require("@modelcontextprotocol/ext-apps/server");
+var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
+var import_mcp_core4 = require("@solvapay/mcp-core");
+function registerDescriptor(server, tool) {
+  const baseMeta = tool.meta ?? {};
+  const baseUi = baseMeta.ui ?? {};
+  const metaWithIcons = tool.icons && tool.icons.length > 0 ? { ...baseMeta, ui: { ...baseUi, icons: tool.icons } } : baseMeta;
+  (0, import_server.registerAppTool)(
+    server,
+    tool.name,
+    {
+      ...tool.title !== void 0 ? { title: tool.title } : {},
+      description: tool.description,
+      inputSchema: tool.inputSchema,
+      _meta: metaWithIcons,
+      ...tool.annotations !== void 0 ? { annotations: tool.annotations } : {},
+      ...tool.icons !== void 0 ? { icons: tool.icons } : {}
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    },
+    // `SolvaPayCallToolResult` is a structural subset of the official
+    // SDK's `CallToolResult`; cast to erase the extra-narrow `resource`
+    // block typing the SDK expects on `{ type: 'resource' }` content.
+    async (args, extra) => await tool.handler(
+      args,
+      extra
+    )
+  );
+}
+function registerPromptDescriptor(server, prompt) {
+  const config = { description: prompt.description };
+  if (prompt.title !== void 0) config.title = prompt.title;
+  if (prompt.argsSchema !== void 0) config.argsSchema = prompt.argsSchema;
+  server.registerPrompt(
+    prompt.name,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    config,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    async (args) => await prompt.handler(args ?? {})
+  );
+}
+function registerDocsResource(server, docs) {
+  server.registerResource(
+    docs.name,
+    docs.uri,
+    {
+      ...docs.title !== void 0 ? { title: docs.title } : {},
+      description: docs.description,
+      mimeType: docs.mimeType
+    },
+    async () => ({
+      contents: [
+        {
+          uri: docs.uri,
+          mimeType: docs.mimeType,
+          text: await docs.readBody()
+        }
+      ]
+    })
+  );
+}
+function buildSolvaPayMcpServer(options) {
+  const {
+    registerPrompts = true,
+    registerDocsResources = true,
+    serverName,
+    serverVersion = "1.0.0",
+    hideToolsByAudience: _hideToolsByAudience,
+    ...descriptorOptions
+  } = options;
+  const descriptors = (0, import_mcp_core4.buildSolvaPayDescriptors)(descriptorOptions);
+  const effectiveServerName = serverName ?? descriptorOptions.branding?.brandName ?? "solvapay-mcp-server";
+  const serverIcons = (0, import_mcp_core4.deriveIcons)(descriptorOptions.branding);
+  const server = new import_mcp.McpServer({
+    name: effectiveServerName,
+    version: serverVersion,
+    ...serverIcons ? { icons: serverIcons } : {}
+  });
+  for (const tool of descriptors.tools) {
+    registerDescriptor(server, tool);
+  }
+  if (registerPrompts) {
+    for (const prompt of descriptors.prompts) {
+      registerPromptDescriptor(server, prompt);
+    }
+  }
+  if (registerDocsResources) {
+    for (const docs of descriptors.docsResources) {
+      registerDocsResource(server, docs);
+    }
+  }
+  const resource = descriptors.resource;
+  (0, import_server.registerAppResource)(
+    server,
+    resource.uri,
+    resource.uri,
+    {
+      mimeType: import_server.RESOURCE_MIME_TYPE,
+      _meta: {
+        ui: {
+          csp: resource.csp,
+          // `false` asks the host to skip painting its own outer card /
+          // border around the iframe. The widget paints its own frame
+          // via `.solvapay-mcp-card`, and `<AppHeader>` renders the
+          // merchant mark at the top; a host-painted card on top of
+          // that produced a nested-container look (visible on MCP Jam
+          // with the earlier `true` default). Hosts that honour the
+          // preference (per the MCP Apps spec) now render us flush
+          // inside their conversation surface.
+          prefersBorder: false
+        }
+      }
+    },
+    async () => ({
+      contents: [
+        {
+          uri: resource.uri,
+          mimeType: import_server.RESOURCE_MIME_TYPE,
+          text: await resource.readHtml(),
+          _meta: {
+            ui: {
+              csp: resource.csp,
+              prefersBorder: false
+            }
+          }
+        }
+      ]
+    })
+  );
+  return { server, descriptors };
+}
+
+// src/registerPayableTool.ts
+var import_server2 = require("@modelcontextprotocol/ext-apps/server");
+var import_mcp_core5 = require("@solvapay/mcp-core");
+function registerPayableTool(server, name, options) {
+  const {
+    solvaPay,
+    schema,
+    product,
+    title,
+    description,
+    handler,
+    buildBootstrap,
+    getCustomerRef,
+    meta,
+    annotations,
+    icons
+  } = options;
+  const protectedHandler = (0, import_mcp_core5.buildPayableHandler)(
+    solvaPay,
+    { product, buildBootstrap, getCustomerRef },
+    handler
+  );
+  const baseMeta = meta ?? {};
+  const baseUi = baseMeta.ui ?? {};
+  const hasIcons = icons !== void 0 && icons.length > 0;
+  const mergedUi = {
+    ...baseUi,
+    ...hasIcons ? { icons } : {}
+  };
+  const hasUi = Object.keys(mergedUi).length > 0;
+  const toolMeta = hasUi ? { ...baseMeta, ui: mergedUi } : { ...baseMeta };
+  const effectiveAnnotations = {
+    readOnlyHint: true,
+    openWorldHint: true,
+    ...annotations
+  };
+  const hasUiResource = hasUi && typeof mergedUi.resourceUri === "string";
+  const toolConfig = {
+    ...title !== void 0 ? { title } : {},
+    ...description !== void 0 ? { description } : {},
+    ...schema !== void 0 ? { inputSchema: schema } : {},
+    ...Object.keys(toolMeta).length > 0 ? { _meta: toolMeta } : {},
+    annotations: effectiveAnnotations,
+    ...icons !== void 0 && icons.length > 0 ? { icons } : {}
+  };
+  const toolCallback = async (args, extra) => await protectedHandler(args, extra);
+  if (hasUiResource) {
+    return (0, import_server2.registerAppTool)(
+      server,
+      name,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      toolConfig,
+      toolCallback
+    );
+  }
+  return server.registerTool(
+    name,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    toolConfig,
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    toolCallback
+  );
+}
+
+// src/fetch/createSolvaPayMcpFetch.ts
+function createSolvaPayMcpFetch(options) {
+  const {
+    // Descriptor options.
+    solvaPay,
+    productRef,
+    resourceUri,
+    htmlPath,
+    readHtml,
+    publicBaseUrl,
+    views,
+    csp,
+    getCustomerRef,
+    onToolCall,
+    onToolResult,
+    branding,
+    // Server / registration options.
+    additionalTools,
+    hideToolsByAudience,
+    registerPrompts = true,
+    registerDocsResources = true,
+    serverName,
+    serverVersion = "1.0.0",
+    // Handler options — everything in
+    // `CreateSolvaPayMcpFetchHandlerOptions` except `server`.
+    ...handlerRest
+  } = options;
+  const { server, descriptors } = buildSolvaPayMcpServer({
+    solvaPay,
+    productRef,
+    resourceUri,
+    ...htmlPath !== void 0 ? { htmlPath } : {},
+    ...readHtml !== void 0 ? { readHtml } : {},
+    publicBaseUrl,
+    ...views !== void 0 ? { views } : {},
+    ...csp !== void 0 ? { csp } : {},
+    ...getCustomerRef !== void 0 ? { getCustomerRef } : {},
+    ...onToolCall !== void 0 ? { onToolCall } : {},
+    ...onToolResult !== void 0 ? { onToolResult } : {},
+    ...branding !== void 0 ? { branding } : {},
+    registerPrompts,
+    registerDocsResources,
+    ...serverName !== void 0 ? { serverName } : {},
+    serverVersion
+  });
+  if (additionalTools) {
+    const registerPayable = (name, opts) => {
+      registerPayableTool(server, name, {
+        solvaPay,
+        ...opts,
+        product: opts.product ?? productRef,
+        buildBootstrap: opts.buildBootstrap ?? descriptors.buildBootstrapPayload
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      });
+    };
+    additionalTools({ server, solvaPay, resourceUri, productRef, registerPayable });
+  }
+  (0, import_mcp_core4.applyHideToolsByAudience)(server, hideToolsByAudience);
+  return createSolvaPayMcpFetchHandler({
+    server,
+    publicBaseUrl,
+    productRef,
+    ...handlerRest
+  });
+}
+
+// src/fetch/index.ts
+var import_mcp_core6 = require("@solvapay/mcp-core");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  McpBearerAuthError,
+  applyNativeCors,
+  authChallenge,
+  buildAuthInfoFromBearer,
+  corsPreflight,
+  createAuthorizationServerHandler,
+  createOAuthAuthorizeHandler,
+  createOAuthFetchRouter,
+  createOAuthRegisterHandler,
+  createOAuthRevokeHandler,
+  createOAuthTokenHandler,
+  createOpenidNotFoundHandler,
+  createProtectedResourceHandler,
+  createSolvaPayMcpFetch,
+  createSolvaPayMcpFetchHandler,
+  getOAuthAuthorizationServerResponse,
+  getOAuthProtectedResourceResponse,
+  isNativeClientOrigin,
+  resolveBearer
+});