@subly_fi/pay 0.1.0

package/dist/mcp-server.js

@@ -0,0 +1,1916 @@
+// ../../demo/mcp-server.ts
+import { readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import {
+  CallToolRequestSchema,
+  ListToolsRequestSchema
+} from "@modelcontextprotocol/sdk/types.js";
+
+// ../../src/client/agent-wallet-signer.ts
+import { signBytes } from "@solana/kit";
+import bs584 from "bs58";
+
+// ../../src/solana/tx.ts
+import bs58 from "bs58";
+import {
+  appendTransactionMessageInstructions,
+  compileTransaction,
+  compressTransactionMessageUsingAddressLookupTables,
+  createTransactionMessage,
+  getBase64EncodedWireTransaction,
+  getTransactionDecoder,
+  partiallySignTransaction,
+  pipe,
+  setTransactionMessageFeePayer,
+  setTransactionMessageLifetimeUsingBlockhash
+} from "@solana/kit";
+
+// ../../src/lib/hash.ts
+import { createHash } from "node:crypto";
+var EMPTY_BODY_HASH = "sha256-e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855";
+function sha256TaggedHex(data) {
+  return `sha256-${createHash("sha256").update(data).digest("hex")}`;
+}
+function stableStringify(value) {
+  if (value === null) {
+    return "null";
+  }
+  if (typeof value === "bigint") {
+    return JSON.stringify(value.toString());
+  }
+  if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((item) => stableStringify(item)).join(",")}]`;
+  }
+  const keys = Object.keys(value).filter((key) => value[key] !== void 0).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${stableStringify(value[key])}`).join(",")}}`;
+}
+function hashStableJson(value) {
+  return sha256TaggedHex(stableStringify(value));
+}
+
+// ../../src/solana/tx.ts
+function decodeSerializedTransaction(serializedBase64) {
+  return getTransactionDecoder().decode(Buffer.from(serializedBase64, "base64"));
+}
+async function addSignaturesToSerializedTransaction(params) {
+  const decoded = decodeSerializedTransaction(params.serializedBase64);
+  const signed = await partiallySignTransaction(params.signers, decoded);
+  return {
+    serializedBase64: getBase64EncodedWireTransaction(signed),
+    transaction: signed
+  };
+}
+function signatureBase58ForSigner(transaction, signer2) {
+  const signature = transaction.signatures[signer2];
+  if (signature === null || signature === void 0) {
+    return null;
+  }
+  return bs58.encode(signature);
+}
+
+// ../../src/client/transaction-intent-validator.ts
+import bs583 from "bs58";
+import { getCompiledTransactionMessageDecoder } from "@solana/kit";
+
+// ../../src/config/constants.ts
+var PAYMENT_SCHEME = "subly-yield-exact";
+var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var SUBLY_VAULT = {
+  name: "Subly USDC Payment Vault Alpha",
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
+  usdcMint: "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+};
+var USDC_DECIMALS = 6;
+
+// ../../src/domain/request-binding.ts
+function computeRequestBindingHash(fields) {
+  return hashStableJson({
+    sellerRequestId: fields.sellerRequestId,
+    httpMethod: fields.httpMethod.toUpperCase(),
+    canonicalResourceUrl: fields.canonicalResourceUrl,
+    requestBodyHash: fields.requestBodyHash,
+    seller: fields.seller,
+    asset: fields.asset,
+    amountRawUsdc: fields.amountRawUsdc,
+    payTo: fields.payTo,
+    sellerUsdcAta: fields.sellerUsdcAta
+  });
+}
+
+// ../../src/lib/associated-token-account.ts
+import { createHash as createHash2 } from "node:crypto";
+import bs582 from "bs58";
+var PDA_MARKER = Buffer.from("ProgramDerivedAddress", "utf8");
+var ED25519_P = (1n << 255n) - 19n;
+var ED25519_D = mod(-121665n * modPow(121666n, ED25519_P - 2n, ED25519_P), ED25519_P);
+function deriveAssociatedTokenAddress(params) {
+  const owner = decodePublicKey(params.owner, "owner");
+  const mint = decodePublicKey(params.mint ?? SUBLY_VAULT.usdcMint, "mint");
+  const tokenProgramId = decodePublicKey(
+    params.tokenProgramId ?? SPL_TOKEN_PROGRAM_ID,
+    "tokenProgramId"
+  );
+  const associatedTokenProgramId = decodePublicKey(
+    ASSOCIATED_TOKEN_PROGRAM_ID,
+    "associatedTokenProgramId"
+  );
+  for (let bump = 255; bump >= 0; bump -= 1) {
+    const address2 = createProgramAddress(
+      [owner, tokenProgramId, mint, Uint8Array.of(bump)],
+      associatedTokenProgramId
+    );
+    if (address2 !== null) {
+      return bs582.encode(address2);
+    }
+  }
+  throw new Error("Unable to derive associated token account address");
+}
+function createProgramAddress(seeds, programId) {
+  const hash = createHash2("sha256");
+  for (const seed of seeds) {
+    hash.update(seed);
+  }
+  hash.update(programId);
+  hash.update(PDA_MARKER);
+  const digest = hash.digest();
+  return isEd25519Point(digest) ? null : new Uint8Array(digest);
+}
+function decodePublicKey(value, fieldName) {
+  const decoded = bs582.decode(value);
+  if (decoded.length !== 32) {
+    throw new Error(`${fieldName} must be a 32-byte public key`);
+  }
+  return decoded;
+}
+function isEd25519Point(bytes) {
+  if (bytes.length !== 32) {
+    return false;
+  }
+  const yBytes = Uint8Array.from(bytes);
+  yBytes[31] = yBytes[31] & 127;
+  const y = littleEndianToBigInt(yBytes);
+  if (y >= ED25519_P) {
+    return false;
+  }
+  const ySquared = mod(y * y, ED25519_P);
+  const numerator = mod(ySquared - 1n, ED25519_P);
+  const denominator = mod(ED25519_D * ySquared + 1n, ED25519_P);
+  if (denominator === 0n) {
+    return false;
+  }
+  const xSquared = mod(
+    numerator * modPow(denominator, ED25519_P - 2n, ED25519_P),
+    ED25519_P
+  );
+  return xSquared === 0n || modPow(xSquared, (ED25519_P - 1n) / 2n, ED25519_P) === 1n;
+}
+function littleEndianToBigInt(bytes) {
+  let value = 0n;
+  for (let index = bytes.length - 1; index >= 0; index -= 1) {
+    value = (value << 8n) + BigInt(bytes[index]);
+  }
+  return value;
+}
+function mod(value, modulus) {
+  const result = value % modulus;
+  return result >= 0n ? result : result + modulus;
+}
+function modPow(base, exponent, modulus) {
+  let result = 1n;
+  let nextBase = mod(base, modulus);
+  let nextExponent = exponent;
+  while (nextExponent > 0n) {
+    if ((nextExponent & 1n) === 1n) {
+      result = mod(result * nextBase, modulus);
+    }
+    nextBase = mod(nextBase * nextBase, modulus);
+    nextExponent >>= 1n;
+  }
+  return result;
+}
+
+// ../../src/client/transaction-intent-validator.ts
+var COMPUTE_BUDGET_PROGRAM_ID = "ComputeBudget111111111111111111111111111111";
+var SYSTEM_PROGRAM_ID = "11111111111111111111111111111111";
+var ASSOCIATED_TOKEN_PROGRAM_ID2 = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var MEMO_PROGRAM_ID = "MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr";
+var KVAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var KAMINO_FARMS_PROGRAM_ID = "FarmsPZpWu9i7Kky8tPN37rs2TpmMrAZrC7S7vJa91Hr";
+var KVAULT_WITHDRAW_DISCRIMINATOR = Uint8Array.from([
+  183,
+  18,
+  70,
+  156,
+  148,
+  109,
+  161,
+  34
+]);
+var KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR = Uint8Array.from([
+  19,
+  131,
+  112,
+  155,
+  170,
+  220,
+  34,
+  57
+]);
+var KVAULT_DEPOSIT_DISCRIMINATOR = Uint8Array.from([
+  242,
+  35,
+  198,
+  137,
+  82,
+  225,
+  242,
+  182
+]);
+var U64_MAX = 18446744073709551615n;
+var MAX_TEMP_ACCOUNT_LAMPORTS = 10000000n;
+var DEFAULT_MAX_COMPUTE_UNIT_LIMIT = 14e5;
+var DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS = 100000n;
+var IntentValidationError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "IntentValidationError";
+    this.reason = reason;
+  }
+};
+function reject(reason, message) {
+  throw new IntentValidationError(reason, message);
+}
+function decodeIntentTransaction(params) {
+  const wire = Buffer.from(params.serializedTransaction, "base64");
+  const signatureCount = readShortVec(wire, 0);
+  if (signatureCount === null) {
+    reject("invalid_transaction_encoding", "Cannot parse signature count");
+  }
+  const messageOffset = signatureCount.nextOffset + signatureCount.value * 64;
+  if (messageOffset >= wire.length) {
+    reject("invalid_transaction_encoding", "Transaction has no message bytes");
+  }
+  const messageBytes = wire.subarray(messageOffset);
+  const compiled = getCompiledTransactionMessageDecoder().decode(messageBytes);
+  if (compiled.version !== 0) {
+    reject("unsupported_transaction_version", "Only v0 transactions are supported");
+  }
+  const staticAccounts = compiled.staticAccounts.map(String);
+  const loadedWritable = [];
+  const loadedReadonly = [];
+  const lookups = compiled.addressTableLookups ?? [];
+  for (const rawLookup of lookups) {
+    const lookup = rawLookup;
+    const table = params.lookupTables?.[String(lookup.lookupTableAddress)];
+    if (table === void 0) {
+      reject(
+        "lookup_table_unresolved",
+        `Transaction references unknown lookup table ${lookup.lookupTableAddress}`
+      );
+    }
+    const writableIndexes = lookup.writableIndexes ?? lookup.writableIndices ?? [];
+    const readonlyIndexes = lookup.readonlyIndexes ?? lookup.readableIndices ?? [];
+    for (const index of writableIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedWritable.push(String(resolved));
+    }
+    for (const index of readonlyIndexes) {
+      const resolved = table[index];
+      if (resolved === void 0) {
+        reject("lookup_table_unresolved", "Lookup table index out of range");
+      }
+      loadedReadonly.push(String(resolved));
+    }
+  }
+  const orderedAccounts = [...staticAccounts, ...loadedWritable, ...loadedReadonly];
+  const instructions = compiled.instructions.map(
+    (instruction) => {
+      const programAddress = orderedAccounts[instruction.programAddressIndex];
+      if (programAddress === void 0) {
+        reject("invalid_transaction_encoding", "Program index out of range");
+      }
+      const accounts = (instruction.accountIndices ?? []).map((index) => {
+        const account = orderedAccounts[index];
+        if (account === void 0) {
+          reject("invalid_transaction_encoding", "Account index out of range");
+        }
+        return account;
+      });
+      return {
+        programAddress,
+        accounts,
+        data: instruction.data === void 0 ? new Uint8Array() : Uint8Array.from(instruction.data)
+      };
+    }
+  );
+  const feePayer = staticAccounts[0];
+  if (feePayer === void 0) {
+    reject("invalid_transaction_encoding", "Transaction has no fee payer");
+  }
+  return {
+    feePayer,
+    requiredSigners: staticAccounts.slice(0, compiled.header.numSignerAccounts),
+    instructions,
+    messageHash: sha256TaggedHex(Buffer.from(messageBytes))
+  };
+}
+function validatePaymentIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Payment intent has expired");
+  }
+  if (intent.scheme !== PAYMENT_SCHEME) {
+    reject("scheme_mismatch", `scheme must be ${PAYMENT_SCHEME}`);
+  }
+  if (intent.network !== SOLANA_MAINNET_NETWORK) {
+    reject("network_mismatch", "Unsupported network");
+  }
+  if (intent.vault !== SUBLY_VAULT.address) {
+    reject("vault_mismatch", "Unsupported vault");
+  }
+  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
+  }
+  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+    reject("asset_mismatch", "Only USDC payments are supported");
+  }
+  if (intent.memo !== intent.paymentId) {
+    reject("memo_mismatch", "Memo must equal the paymentId");
+  }
+  const expectedBinding = computeRequestBindingHash({
+    sellerRequestId: intent.sellerRequestId,
+    httpMethod: intent.httpMethod,
+    canonicalResourceUrl: intent.canonicalResourceUrl,
+    requestBodyHash: intent.requestBodyHash,
+    seller: intent.seller,
+    asset: intent.asset,
+    amountRawUsdc: intent.amountRawUsdc,
+    payTo: intent.payTo,
+    sellerUsdcAta: intent.sellerUsdcAta
+  });
+  if (expectedBinding !== intent.requestBindingHash) {
+    reject(
+      "request_binding_mismatch",
+      "requestBindingHash does not match the request fields"
+    );
+  }
+  const expectedSellerAta = deriveAssociatedTokenAddress({
+    owner: intent.payTo,
+    mint: intent.asset
+  });
+  if (expectedSellerAta !== intent.sellerUsdcAta) {
+    reject(
+      "seller_ata_mismatch",
+      "sellerUsdcAta must be the associated USDC account for payTo"
+    );
+  }
+  const expectedDustAta = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDustAta !== intent.dustRecipientUsdcAta) {
+    reject(
+      "dust_recipient_mismatch",
+      "dustRecipientUsdcAta must be the agent wallet's USDC ATA"
+    );
+  }
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  const expectedSigners = /* @__PURE__ */ new Set([
+    intent.feePayer,
+    intent.wallet,
+    intent.temporarySettlementTokenAccount
+  ]);
+  if (decoded.requiredSigners.length !== expectedSigners.size || !decoded.requiredSigners.every((signer2) => expectedSigners.has(signer2))) {
+    reject(
+      "unexpected_signers",
+      "Transaction signers must be exactly the sponsor, the agent wallet, and the temporary settlement account"
+    );
+  }
+  const ixs = [...decoded.instructions];
+  expectComputeBudgetPair(ixs, policy);
+  expectCreateTemporaryAccount(ixs, intent, policy);
+  expectInitializeTemporaryAccount(ixs, intent);
+  consumeFarmInstructions(ixs, intent.wallet);
+  expectKvaultWithdraw(ixs, {
+    wallet: intent.wallet,
+    vault: intent.vault,
+    shareMint: intent.shareMint,
+    asset: intent.asset,
+    userTokenAccount: intent.temporarySettlementTokenAccount,
+    maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+    allowFullExit: false
+  });
+  expectTransferChecked(ixs, {
+    source: intent.temporarySettlementTokenAccount,
+    mint: intent.asset,
+    destination: intent.sellerUsdcAta,
+    authority: intent.wallet,
+    amount: BigInt(intent.amountRawUsdc),
+    label: "seller transfer"
+  });
+  if (ixs[0] !== void 0 && ixs[0].programAddress === SPL_TOKEN_PROGRAM_ID && ixs[0].data[0] === 12) {
+    expectTransferChecked(ixs, {
+      source: intent.temporarySettlementTokenAccount,
+      mint: intent.asset,
+      destination: intent.dustRecipientUsdcAta,
+      authority: intent.wallet,
+      amount: null,
+      label: "dust sweep"
+    });
+  }
+  expectCloseAccount(ixs, {
+    account: intent.temporarySettlementTokenAccount,
+    destination: intent.feePayer,
+    owner: intent.wallet
+  });
+  expectMemo(ixs, intent.memo);
+  if (ixs.length > 0) {
+    reject(
+      "unexpected_instruction",
+      `Transaction contains ${ixs.length} unexpected trailing instruction(s)`
+    );
+  }
+}
+function validateDepositIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Deposit intent has expired");
+  }
+  assertVaultIntentTargets(intent);
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  let sawDeposit = false;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case MEMO_PROGRAM_ID:
+        break;
+      case KVAULT_PROGRAM_ID: {
+        if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
+          reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
+        }
+        const maxAmount = readU64LE(ix.data, 8);
+        if (maxAmount !== BigInt(intent.amountRawUsdc)) {
+          reject("amount_mismatch", "Deposit amount does not match the intent");
+        }
+        if (ix.accounts[0] !== intent.wallet) {
+          reject("wallet_mismatch", "Deposit user is not the agent wallet");
+        }
+        if (ix.accounts[1] !== intent.vault) {
+          reject("vault_mismatch", "Deposit vault mismatch");
+        }
+        if (ix.accounts[3] !== intent.asset) {
+          reject("asset_mismatch", "Deposit token mint mismatch");
+        }
+        if (ix.accounts[5] !== intent.shareMint) {
+          reject("share_mint_mismatch", "Deposit share mint mismatch");
+        }
+        const expectedSourceAta = deriveAssociatedTokenAddress({
+          owner: intent.wallet,
+          mint: intent.asset
+        });
+        if (ix.accounts[6] !== expectedSourceAta) {
+          reject(
+            "source_ata_mismatch",
+            "Deposit source must be the agent wallet's USDC ATA"
+          );
+        }
+        sawDeposit = true;
+        break;
+      }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in deposit transaction`
+        );
+    }
+  }
+  if (!sawDeposit) {
+    reject("missing_instruction", "Deposit transaction has no KVault deposit");
+  }
+}
+function validateWithdrawalIntentTransaction(params) {
+  const { intent } = params;
+  const now = params.nowMs ?? Date.now();
+  const policy = resolveIntentValidationPolicy(params.policy);
+  if (new Date(intent.expiresAt).getTime() <= now) {
+    reject("expired", "Withdrawal intent has expired");
+  }
+  assertVaultIntentTargets(intent);
+  const expectedDestination = deriveAssociatedTokenAddress({
+    owner: intent.wallet,
+    mint: intent.asset
+  });
+  if (expectedDestination !== intent.destinationUsdcAta) {
+    reject(
+      "destination_mismatch",
+      "Withdrawal destination must be the agent wallet's USDC ATA"
+    );
+  }
+  const decoded = decodeIntentTransaction({
+    serializedTransaction: params.serializedTransaction,
+    ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
+  });
+  if (decoded.messageHash !== intent.preparedMessageHash) {
+    reject("message_hash_mismatch", "Prepared message hash mismatch");
+  }
+  if (decoded.feePayer !== intent.feePayer) {
+    reject("fee_payer_mismatch", "Transaction fee payer is not the Subly sponsor");
+  }
+  let sawWithdraw = false;
+  for (const ix of decoded.instructions) {
+    switch (ix.programAddress) {
+      case COMPUTE_BUDGET_PROGRAM_ID:
+        validateComputeBudgetInstruction(ix, policy);
+        break;
+      case MEMO_PROGRAM_ID:
+      case KAMINO_FARMS_PROGRAM_ID:
+        break;
+      case ASSOCIATED_TOKEN_PROGRAM_ID2:
+        expectAtaCreateForOwner(ix, intent.wallet);
+        break;
+      case SPL_TOKEN_PROGRAM_ID: {
+        if (ix.data[0] !== 9) {
+          reject(
+            "unexpected_instruction",
+            "Only CloseAccount token instructions are allowed in withdrawals"
+          );
+        }
+        if (ix.accounts[1] !== intent.wallet || ix.accounts[2] !== intent.wallet) {
+          reject(
+            "unexpected_instruction",
+            "Withdrawal CloseAccount must pay out to the agent wallet"
+          );
+        }
+        break;
+      }
+      case KVAULT_PROGRAM_ID: {
+        validateKvaultWithdrawInstruction(ix, {
+          wallet: intent.wallet,
+          vault: intent.vault,
+          shareMint: intent.shareMint,
+          asset: intent.asset,
+          userTokenAccount: intent.destinationUsdcAta,
+          maxSharesToRedeemRaw: BigInt(intent.maxSharesToRedeemRaw),
+          allowFullExit: intent.allowFullExit
+        });
+        sawWithdraw = true;
+        break;
+      }
+      default:
+        reject(
+          "unexpected_instruction",
+          `Unexpected program ${ix.programAddress} in withdrawal transaction`
+        );
+    }
+  }
+  if (!sawWithdraw) {
+    reject("missing_instruction", "Withdrawal transaction has no KVault withdraw");
+  }
+}
+function assertVaultIntentTargets(intent) {
+  if (intent.vault !== SUBLY_VAULT.address) {
+    reject("vault_mismatch", "Unsupported vault");
+  }
+  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+    reject("share_mint_mismatch", "Unsupported share mint");
+  }
+  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+    reject("asset_mismatch", "Only USDC is supported");
+  }
+}
+function resolveIntentValidationPolicy(policy) {
+  const resolved = {
+    maxComputeUnitLimit: policy?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
+    maxComputeUnitPriceMicroLamports: policy?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
+    maxTemporaryAccountLamports: policy?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
+  };
+  if (!Number.isSafeInteger(resolved.maxComputeUnitLimit) || resolved.maxComputeUnitLimit <= 0) {
+    reject("invalid_policy", "maxComputeUnitLimit must be a positive safe integer");
+  }
+  if (resolved.maxComputeUnitPriceMicroLamports < 0n) {
+    reject(
+      "invalid_policy",
+      "maxComputeUnitPriceMicroLamports must be non-negative"
+    );
+  }
+  if (resolved.maxTemporaryAccountLamports <= 0n) {
+    reject("invalid_policy", "maxTemporaryAccountLamports must be positive");
+  }
+  return resolved;
+}
+function expectComputeBudgetPair(ixs, policy) {
+  for (const discriminator of [2, 3]) {
+    const ix = ixs.shift();
+    if (ix === void 0 || ix.programAddress !== COMPUTE_BUDGET_PROGRAM_ID || ix.data[0] !== discriminator) {
+      reject(
+        "compute_budget_mismatch",
+        "Transaction must start with ComputeBudget limit and price instructions"
+      );
+    }
+    validateComputeBudgetInstruction(ix, policy);
+  }
+}
+function validateComputeBudgetInstruction(ix, policy) {
+  switch (ix.data[0]) {
+    case 2: {
+      const units = readU32LE(ix.data, 1);
+      if (units <= 0 || units > policy.maxComputeUnitLimit) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit limit ${units} exceeds policy maximum ${policy.maxComputeUnitLimit}`
+        );
+      }
+      break;
+    }
+    case 3: {
+      const microLamports = readU64LE(ix.data, 1);
+      if (microLamports > policy.maxComputeUnitPriceMicroLamports) {
+        reject(
+          "compute_budget_mismatch",
+          `Compute unit price ${microLamports} exceeds policy maximum ${policy.maxComputeUnitPriceMicroLamports}`
+        );
+      }
+      break;
+    }
+    default:
+      reject("compute_budget_mismatch", "Unexpected ComputeBudget instruction");
+  }
+}
+function expectCreateTemporaryAccount(ixs, intent, policy) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SYSTEM_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Expected System createAccount instruction");
+  }
+  if (ix.data.length < 52 || readU32LE(ix.data, 0) !== 0) {
+    reject("temp_account_mismatch", "Expected createAccount discriminator");
+  }
+  const lamports = readU64LE(ix.data, 4);
+  const space = readU64LE(ix.data, 12);
+  const owner = bs583.encode(ix.data.subarray(20, 52));
+  if (space !== 165n) {
+    reject("temp_account_mismatch", "Temporary account space must be 165 bytes");
+  }
+  if (owner !== SPL_TOKEN_PROGRAM_ID) {
+    reject("temp_account_mismatch", "Temporary account owner must be the token program");
+  }
+  if (lamports > policy.maxTemporaryAccountLamports) {
+    reject("temp_account_mismatch", "Temporary account rent exceeds the cap");
+  }
+  if (ix.accounts[0] !== intent.feePayer) {
+    reject("temp_account_mismatch", "Temporary account must be funded by the sponsor");
+  }
+  if (ix.accounts[1] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "createAccount target is not the temporary account");
+  }
+}
+function expectInitializeTemporaryAccount(ixs, intent) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 18) {
+    reject("temp_account_mismatch", "Expected InitializeAccount3 instruction");
+  }
+  const owner = bs583.encode(ix.data.subarray(1, 33));
+  if (owner !== intent.wallet) {
+    reject(
+      "temp_account_mismatch",
+      "Temporary account token authority must be the agent wallet"
+    );
+  }
+  if (ix.accounts[0] !== intent.temporarySettlementTokenAccount) {
+    reject("temp_account_mismatch", "InitializeAccount3 target mismatch");
+  }
+  if (ix.accounts[1] !== intent.asset) {
+    reject("temp_account_mismatch", "Temporary account mint must be USDC");
+  }
+}
+function consumeFarmInstructions(ixs, wallet) {
+  while (ixs[0] !== void 0 && ixs[0].programAddress === KAMINO_FARMS_PROGRAM_ID) {
+    const ix = ixs.shift();
+    if (!ix.accounts.includes(wallet)) {
+      reject(
+        "farm_instruction_mismatch",
+        "Farm unstake instruction does not reference the agent wallet"
+      );
+    }
+  }
+}
+function expectKvaultWithdraw(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== KVAULT_PROGRAM_ID) {
+    reject("withdraw_mismatch", "Expected KVault withdraw instruction");
+  }
+  validateKvaultWithdrawInstruction(ix, expectation);
+}
+function validateKvaultWithdrawInstruction(ix, expectation) {
+  const isWithdraw = bytesStartWith(ix.data, KVAULT_WITHDRAW_DISCRIMINATOR);
+  const isWithdrawFromAvailable = bytesStartWith(
+    ix.data,
+    KVAULT_WITHDRAW_FROM_AVAILABLE_DISCRIMINATOR
+  );
+  if (!isWithdraw && !isWithdrawFromAvailable) {
+    reject("withdraw_mismatch", "Unexpected KVault instruction");
+  }
+  const sharesAmount = readU64LE(ix.data, 8);
+  const fullExit = sharesAmount === U64_MAX;
+  if (fullExit && !expectation.allowFullExit) {
+    reject("withdraw_mismatch", "Full-exit share burn is not allowed for this intent");
+  }
+  if (!fullExit && sharesAmount > expectation.maxSharesToRedeemRaw) {
+    reject(
+      "shares_exceed_max",
+      `Withdraw burns ${sharesAmount} shares which exceeds the approved maximum ${expectation.maxSharesToRedeemRaw}`
+    );
+  }
+  if (ix.accounts[0] !== expectation.wallet) {
+    reject("withdraw_mismatch", "Withdraw user is not the agent wallet");
+  }
+  if (ix.accounts[1] !== expectation.vault) {
+    reject("withdraw_mismatch", "Withdraw vault mismatch");
+  }
+  if (ix.accounts[5] !== expectation.userTokenAccount) {
+    reject(
+      "withdraw_mismatch",
+      "Withdraw token destination is not the approved account"
+    );
+  }
+  if (ix.accounts[6] !== expectation.asset) {
+    reject("withdraw_mismatch", "Withdraw token mint mismatch");
+  }
+  const expectedSharesAta = deriveAssociatedTokenAddress({
+    owner: expectation.wallet,
+    mint: expectation.shareMint
+  });
+  if (ix.accounts[7] !== expectedSharesAta) {
+    reject("withdraw_mismatch", "Withdraw share source must be the agent share ATA");
+  }
+  if (ix.accounts[8] !== expectation.shareMint) {
+    reject("withdraw_mismatch", "Withdraw share mint mismatch");
+  }
+}
+function expectTransferChecked(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 12) {
+    reject("transfer_mismatch", `Expected TransferChecked for ${expectation.label}`);
+  }
+  const amount = readU64LE(ix.data, 1);
+  const decimals = ix.data[9];
+  if (expectation.amount !== null && amount !== expectation.amount) {
+    reject(
+      "amount_mismatch",
+      `${expectation.label} amount ${amount} does not match ${expectation.amount}`
+    );
+  }
+  if (decimals !== USDC_DECIMALS) {
+    reject("transfer_mismatch", `${expectation.label} has unexpected decimals`);
+  }
+  if (ix.accounts[0] !== expectation.source) {
+    reject("transfer_mismatch", `${expectation.label} source mismatch`);
+  }
+  if (ix.accounts[1] !== expectation.mint) {
+    reject("transfer_mismatch", `${expectation.label} mint mismatch`);
+  }
+  if (ix.accounts[2] !== expectation.destination) {
+    reject("transfer_mismatch", `${expectation.label} destination mismatch`);
+  }
+  if (ix.accounts[3] !== expectation.authority) {
+    reject("transfer_mismatch", `${expectation.label} authority mismatch`);
+  }
+}
+function expectCloseAccount(ixs, expectation) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== SPL_TOKEN_PROGRAM_ID || ix.data[0] !== 9) {
+    reject("close_mismatch", "Expected CloseAccount instruction");
+  }
+  if (ix.accounts[0] !== expectation.account) {
+    reject("close_mismatch", "CloseAccount target is not the temporary account");
+  }
+  if (ix.accounts[1] !== expectation.destination) {
+    reject("close_mismatch", "CloseAccount rent destination must be the sponsor");
+  }
+  if (ix.accounts[2] !== expectation.owner) {
+    reject("close_mismatch", "CloseAccount authority must be the agent wallet");
+  }
+}
+function expectMemo(ixs, memo) {
+  const ix = ixs.shift();
+  if (ix === void 0 || ix.programAddress !== MEMO_PROGRAM_ID) {
+    reject("memo_mismatch", "Expected Memo instruction");
+  }
+  if (Buffer.from(ix.data).toString("utf8") !== memo) {
+    reject("memo_mismatch", "Memo content does not match the paymentId");
+  }
+}
+function expectAtaCreateForOwner(ix, owner) {
+  if (ix.accounts[2] !== owner) {
+    reject(
+      "unexpected_instruction",
+      "Associated token account creation for a foreign owner"
+    );
+  }
+}
+function bytesStartWith(data, prefix) {
+  if (data.length < prefix.length) {
+    return false;
+  }
+  return prefix.every((byte, index) => data[index] === byte);
+}
+function readU64LE(data, offset) {
+  if (data.length < offset + 8) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u64");
+  }
+  return Buffer.from(data.subarray(offset, offset + 8)).readBigUInt64LE(0);
+}
+function readU32LE(data, offset) {
+  if (data.length < offset + 4) {
+    reject("invalid_transaction_encoding", "Instruction data too short for u32");
+  }
+  return Buffer.from(data.subarray(offset, offset + 4)).readUInt32LE(0);
+}
+function readShortVec(bytes, startOffset) {
+  let value = 0;
+  let shift = 0;
+  let offset = startOffset;
+  while (offset < bytes.length) {
+    const byte = bytes[offset];
+    value |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      return { value, nextOffset: offset };
+    }
+    shift += 7;
+    if (shift > 28) {
+      return null;
+    }
+  }
+  return null;
+}
+
+// ../../src/client/agent-wallet-signer.ts
+var LocalKeypairAgentWalletSigner = class {
+  validationMode = "structured_intent_transaction";
+  keyPairSigner;
+  validationPolicy;
+  constructor(keyPairSigner2, validationPolicy) {
+    this.keyPairSigner = keyPairSigner2;
+    this.validationPolicy = validationPolicy;
+  }
+  get walletAddress() {
+    return this.keyPairSigner.address;
+  }
+  async signPayment(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validatePaymentIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  async signDeposit(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateDepositIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  async signWithdrawal(params) {
+    this.assertIntentWallet(params.intent.wallet);
+    validateWithdrawalIntentTransaction({
+      ...params,
+      ...this.validationPolicy === void 0 ? {} : { policy: this.validationPolicy }
+    });
+    return this.sign(params.serializedTransaction);
+  }
+  assertIntentWallet(wallet) {
+    if (wallet !== this.keyPairSigner.address) {
+      throw new IntentValidationError(
+        "wallet_mismatch",
+        "Intent wallet does not match this signer's wallet"
+      );
+    }
+  }
+  async signApiMessage(message) {
+    const signature = await signBytes(
+      this.keyPairSigner.keyPair.privateKey,
+      message
+    );
+    return bs584.encode(signature);
+  }
+  async sign(serializedTransaction) {
+    const { serializedBase64, transaction } = await addSignaturesToSerializedTransaction({
+      serializedBase64: serializedTransaction,
+      signers: [this.keyPairSigner.keyPair]
+    });
+    const agentSignature = signatureBase58ForSigner(
+      transaction,
+      this.keyPairSigner.address
+    );
+    if (agentSignature === null) {
+      throw new IntentValidationError(
+        "signing_failed",
+        "Agent signature was not produced"
+      );
+    }
+    return { serializedTransaction: serializedBase64, agentSignature };
+  }
+};
+
+// ../../src/client/lookup-tables.ts
+import { fetchAllMaybeAddressLookupTable } from "@solana-program/address-lookup-table";
+import { address, getCompiledTransactionMessageDecoder as getCompiledTransactionMessageDecoder2 } from "@solana/kit";
+function lookupTableAddressesForTransaction(serializedTransaction) {
+  const wire = Buffer.from(serializedTransaction, "base64");
+  let offset = 0;
+  let signatureCount = 0;
+  let shift = 0;
+  while (offset < wire.length) {
+    const byte = wire[offset];
+    signatureCount |= (byte & 127) << shift;
+    offset += 1;
+    if ((byte & 128) === 0) {
+      break;
+    }
+    shift += 7;
+  }
+  const messageBytes = wire.subarray(offset + signatureCount * 64);
+  const compiled = getCompiledTransactionMessageDecoder2().decode(messageBytes);
+  const lookups = compiled.addressTableLookups ?? [];
+  return lookups.map((lookup) => String(lookup.lookupTableAddress));
+}
+async function fetchLookupTablesForTransaction(rpc2, serializedTransaction) {
+  const addresses = lookupTableAddressesForTransaction(serializedTransaction);
+  if (addresses.length === 0) {
+    return {};
+  }
+  const tables = await fetchAllMaybeAddressLookupTable(
+    rpc2,
+    addresses.map((value) => address(value))
+  );
+  const result = {};
+  for (const table of tables) {
+    if (table.exists) {
+      result[table.address] = table.data.addresses.map(String);
+    }
+  }
+  return result;
+}
+
+// ../../src/x402/headers.ts
+import { z } from "zod";
+var PAYMENT_REQUIRED_HEADER = "payment-required";
+var PAYMENT_SIGNATURE_HEADER = "payment-signature";
+var PAYMENT_RESPONSE_HEADER = "payment-response";
+var X402_VERSION = 2;
+var MAX_HEADER_JSON_BYTES = 16384;
+var X402HeaderError = class extends Error {
+  reason;
+  constructor(reason, message) {
+    super(message);
+    this.name = "X402HeaderError";
+    this.reason = reason;
+  }
+};
+var sublyPaymentRequirementsSchema = z.object({
+  scheme: z.literal(PAYMENT_SCHEME),
+  network: z.string().min(1),
+  asset: z.string().min(32),
+  /** Exact seller amount in raw USDC; the scheme settles exactly this. */
+  amountRawUsdc: z.string().regex(/^[1-9]\d*$/),
+  resource: z.string().url(),
+  description: z.string().optional(),
+  mimeType: z.string().optional(),
+  payTo: z.string().min(32),
+  maxTimeoutSeconds: z.number().int().positive(),
+  extra: z.object({
+    sellerRequestId: z.string().min(1),
+    seller: z.string().min(32),
+    sellerUsdcAta: z.string().min(32),
+    vault: z.string().min(32),
+    shareMint: z.string().min(32)
+  })
+}).loose();
+var paymentRequiredSchema = z.object({
+  x402Version: z.number().int(),
+  accepts: z.array(z.unknown()),
+  error: z.string().optional()
+}).loose();
+var sublyPaymentPayloadSchema = z.object({
+  x402Version: z.number().int(),
+  scheme: z.literal(PAYMENT_SCHEME),
+  network: z.string().min(1),
+  payload: z.object({
+    paymentId: z.string().min(1),
+    requestBindingHash: z.string().min(1),
+    preparedMessageHash: z.string().min(1),
+    serializedTransaction: z.string().min(1).max(4096),
+    agentSignature: z.string().min(1).max(128),
+    temporarySettlementSignature: z.string().min(1).max(128)
+  })
+}).loose();
+function encodeX402Header(value) {
+  const json = JSON.stringify(value);
+  if (Buffer.byteLength(json, "utf8") > MAX_HEADER_JSON_BYTES) {
+    throw new X402HeaderError(
+      "header_too_large",
+      `x402 header JSON exceeds ${MAX_HEADER_JSON_BYTES} bytes`
+    );
+  }
+  return Buffer.from(json, "utf8").toString("base64");
+}
+function decodeX402Header(headerValue) {
+  if (headerValue.length > Math.ceil(MAX_HEADER_JSON_BYTES * 4 / 3) + 4) {
+    throw new X402HeaderError(
+      "header_too_large",
+      `x402 header exceeds ${MAX_HEADER_JSON_BYTES} encoded bytes`
+    );
+  }
+  const json = Buffer.from(headerValue, "base64").toString("utf8");
+  try {
+    return JSON.parse(json);
+  } catch {
+    throw new X402HeaderError(
+      "invalid_header_encoding",
+      "x402 header is not base64-encoded JSON"
+    );
+  }
+}
+function decodePaymentRequiredHeader(headerValue) {
+  const parsed = paymentRequiredSchema.safeParse(decodeX402Header(headerValue));
+  if (!parsed.success) {
+    throw new X402HeaderError(
+      "invalid_payment_required",
+      "PAYMENT-REQUIRED header is not a valid x402 PaymentRequired object"
+    );
+  }
+  const sublyRequirements = parsed.data.accepts.flatMap((candidate) => {
+    const requirement = sublyPaymentRequirementsSchema.safeParse(candidate);
+    return requirement.success ? [requirement.data] : [];
+  });
+  return { paymentRequired: parsed.data, sublyRequirements };
+}
+function requestBodyHashFor(body) {
+  if (body === null || body === void 0 || body.length === 0) {
+    return EMPTY_BODY_HASH;
+  }
+  return sha256TaggedHex(
+    typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body)
+  );
+}
+
+// ../../src/client/paid-fetch.ts
+var PaidFetchError = class extends Error {
+  constructor(reason, message, detail = null) {
+    super(message);
+    this.reason = reason;
+    this.detail = detail;
+    this.name = "PaidFetchError";
+  }
+  reason;
+  detail;
+};
+var DEFAULT_PENDING_TTL_MS = 11e4;
+var DEFAULT_MAX_TRACKED_URLS = 1e3;
+var DEFAULT_MAX_BODY_CHARS = 2e4;
+function formatRawUsdcAmount(raw) {
+  const value = BigInt(raw);
+  const negative = value < 0n;
+  const abs = negative ? -value : value;
+  const whole = abs / 1000000n;
+  const frac = (abs % 1000000n).toString().padStart(6, "0");
+  return `${negative ? "-" : ""}${whole}.${frac}`;
+}
+var PaidFetchService = class {
+  signatureBuilder;
+  fetchImpl;
+  fetchBudget;
+  paymentStatusFor;
+  defaultMaxAmountRawUsdc;
+  pendingTtlMs;
+  maxTrackedUrls;
+  maxBodyChars;
+  nowMs;
+  stateStore;
+  pending = /* @__PURE__ */ new Map();
+  inFlight = /* @__PURE__ */ new Map();
+  constructor(config) {
+    this.signatureBuilder = config.signatureBuilder;
+    this.fetchImpl = config.fetchImpl ?? fetch;
+    this.fetchBudget = config.fetchBudget ?? (async () => null);
+    this.paymentStatusFor = config.paymentStatusFor ?? (async () => "indeterminate");
+    this.defaultMaxAmountRawUsdc = config.defaultMaxAmountRawUsdc;
+    this.pendingTtlMs = config.pendingTtlMs ?? DEFAULT_PENDING_TTL_MS;
+    this.maxTrackedUrls = config.maxTrackedUrls ?? DEFAULT_MAX_TRACKED_URLS;
+    this.maxBodyChars = config.maxBodyChars ?? DEFAULT_MAX_BODY_CHARS;
+    this.nowMs = config.nowMs ?? (() => Date.now());
+    this.stateStore = config.stateStore ?? null;
+    if (this.stateStore !== null) {
+      for (const record of this.stateStore.load()) {
+        const { url, ...entry } = record;
+        this.pending.set(url, entry);
+      }
+    }
+  }
+  /**
+   * GET the URL, paying a 402 challenge when needed. Concurrent calls for the
+   * same URL share one flow and one result.
+   */
+  paidFetch(params) {
+    const existing = this.inFlight.get(params.url);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const flow = this.run(params).finally(() => {
+      this.inFlight.delete(params.url);
+    });
+    this.inFlight.set(params.url, flow);
+    return flow;
+  }
+  async run(params) {
+    const { url } = params;
+    const pending = this.pending.get(url);
+    if (pending !== void 0) {
+      const expired = this.nowMs() - pending.challengeAtMs > this.pendingTtlMs;
+      if (pending.unresolved || expired) {
+        if (params.forceNewPayment === true) {
+          this.untrack(url);
+        } else {
+          const outcome = await this.paymentStatusFor(pending.paymentId);
+          if (outcome === "not_settled") {
+            this.untrack(url);
+          } else if (outcome === "settled") {
+            throw new PaidFetchError(
+              "payment_already_settled",
+              `the previous payment for this URL settled (paymentId=${pending.paymentId}) but the content delivery was lost, and the signature can no longer be retried. Calling again with forceNewPayment=true will PAY A SECOND TIME for the same resource.`,
+              { paymentId: pending.paymentId }
+            );
+          } else {
+            throw new PaidFetchError(
+              "payment_outcome_unknown",
+              `a previously signed payment for this URL (paymentId=${pending.paymentId}) has an unknown outcome. Verify whether it settled before purchasing again; to pay again anyway, call this tool with forceNewPayment=true.`,
+              { paymentId: pending.paymentId }
+            );
+          }
+        }
+      } else {
+        return this.deliver(url, pending, {
+          retried: true,
+          budgetBefore: null
+        });
+      }
+    }
+    const challengeAtMs = this.nowMs();
+    const first = await this.fetchImpl(url);
+    const firstText = await first.text();
+    if (first.status !== 402) {
+      return {
+        paid: false,
+        status: first.status,
+        body: this.truncated(firstText)
+      };
+    }
+    const challengeHeader = first.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (challengeHeader === null) {
+      throw new PaidFetchError(
+        "invalid_challenge",
+        "402 response is missing the PAYMENT-REQUIRED header"
+      );
+    }
+    const requirement = decodePaymentRequiredHeader(challengeHeader).sublyRequirements[0];
+    if (requirement === void 0) {
+      throw new PaidFetchError(
+        "invalid_challenge",
+        "402 challenge contains no subly-yield-exact requirement"
+      );
+    }
+    const amountRawUsdc = BigInt(requirement.amountRawUsdc);
+    const maxAmountRawUsdc = params.maxAmountRawUsdc ?? this.defaultMaxAmountRawUsdc;
+    if (amountRawUsdc > maxAmountRawUsdc) {
+      throw new PaidFetchError(
+        "amount_exceeds_client_cap",
+        `the challenge demands ${formatRawUsdcAmount(amountRawUsdc)} USDC, above this tool call's cap of ${formatRawUsdcAmount(maxAmountRawUsdc)} USDC; nothing was paid. Raise maxAmountRawUsdc only if this price is expected.`,
+        {
+          amountRawUsdc: requirement.amountRawUsdc,
+          maxAmountRawUsdc: maxAmountRawUsdc.toString(),
+          payTo: requirement.payTo
+        }
+      );
+    }
+    const budgetBefore = await this.fetchBudget();
+    const { headerValue, paymentId } = await this.signatureBuilder.buildPaymentSignatureHeader({
+      paymentRequiredHeader: challengeHeader,
+      httpMethod: "GET",
+      url
+    });
+    const entry = {
+      headerValue,
+      paymentId,
+      amountUsdc: formatRawUsdcAmount(amountRawUsdc),
+      payTo: requirement.payTo,
+      challengeAtMs,
+      unresolved: false
+    };
+    this.track(url, entry);
+    return this.deliver(url, entry, { retried: false, budgetBefore });
+  }
+  /**
+   * Sends the signed PAYMENT-SIGNATURE retry. The tracked entry is removed
+   * only on confirmed delivery (200). A fresh 402 proves the signature can no
+   * longer settle, so the entry is kept as an unresolved marker; every other
+   * failure keeps it retryable so the next call reuses the same signature.
+   */
+  async deliver(url, entry, params) {
+    let second;
+    let secondText;
+    try {
+      second = await this.fetchImpl(url, {
+        headers: { [PAYMENT_SIGNATURE_HEADER]: entry.headerValue }
+      });
+      secondText = await second.text();
+    } catch (error) {
+      throw new PaidFetchError(
+        "delivery_failed_payment_pending",
+        `delivery request failed in flight (${error instanceof Error ? error.message : String(error)}); the payment (paymentId=${entry.paymentId}) is already signed and may settle. Call this tool again with the same URL to retry delivery with the same payment signature \u2014 do NOT treat this as unpaid.`,
+        { paymentId: entry.paymentId }
+      );
+    }
+    if (second.status === 200) {
+      this.untrack(url);
+      const transaction = receiptTransaction(second.headers);
+      return {
+        paid: true,
+        status: second.status,
+        body: this.truncated(secondText),
+        ...params.retried ? { retriedPendingPayment: true } : {},
+        payment: {
+          amountUsdc: entry.amountUsdc,
+          payTo: entry.payTo,
+          paymentId: entry.paymentId,
+          transaction,
+          solscanUrl: transaction === null ? null : `https://solscan.io/tx/${transaction}`,
+          budgetBefore: params.budgetBefore,
+          budgetAfter: await this.fetchBudget()
+        }
+      };
+    }
+    if (second.status === 402) {
+      entry.unresolved = true;
+      this.persist();
+      throw new PaidFetchError(
+        "payment_outcome_unknown",
+        `the seller no longer accepts the signed payment (paymentId=${entry.paymentId}); it may or may not have settled. Verify the payment before purchasing again; to pay again anyway, call this tool with forceNewPayment=true.`,
+        { paymentId: entry.paymentId }
+      );
+    }
+    throw new PaidFetchError(
+      "delivery_failed_payment_pending",
+      `paid delivery failed with ${second.status} (paymentId=${entry.paymentId}); the payment may already have settled. Call this tool again with the same URL to retry delivery with the same payment signature \u2014 do NOT treat this as unpaid.`,
+      {
+        paymentId: entry.paymentId,
+        status: second.status,
+        body: this.truncated(secondText)
+      }
+    );
+  }
+  track(url, entry) {
+    if (!this.pending.has(url) && this.pending.size >= this.maxTrackedUrls) {
+      const oldest = this.pending.keys().next();
+      if (!oldest.done) {
+        this.pending.delete(oldest.value);
+      }
+    }
+    this.pending.set(url, entry);
+    this.persist();
+  }
+  untrack(url) {
+    this.pending.delete(url);
+    this.persist();
+  }
+  persist() {
+    if (this.stateStore === null) {
+      return;
+    }
+    this.stateStore.save(
+      [...this.pending.entries()].map(([url, entry]) => ({ url, ...entry }))
+    );
+  }
+  truncated(text) {
+    return text.length > this.maxBodyChars ? `${text.slice(0, this.maxBodyChars)}
+... (truncated)` : text;
+  }
+};
+function receiptTransaction(headers) {
+  try {
+    const receiptHeader = headers.get(PAYMENT_RESPONSE_HEADER);
+    if (receiptHeader === null) {
+      return null;
+    }
+    const receipt = decodeX402Header(receiptHeader);
+    return typeof receipt.transaction === "string" && receipt.transaction.length > 0 ? receipt.transaction : null;
+  } catch {
+    return null;
+  }
+}
+
+// ../../src/api/wallet-auth.ts
+import { createHash as createHash3 } from "node:crypto";
+import bs585 from "bs58";
+import nacl from "tweetnacl";
+var WALLET_AUTH_WALLET_HEADER = "x-subly-wallet";
+var WALLET_AUTH_SIGNED_AT_HEADER = "x-subly-signed-at";
+var WALLET_AUTH_SIGNATURE_HEADER = "x-subly-signature";
+function sha256Hex(data) {
+  return createHash3("sha256").update(data, "utf8").digest("hex");
+}
+function walletAuthMessage(params) {
+  return new TextEncoder().encode(
+    `subly-api:${params.method.toUpperCase()}:${params.path}:${sha256Hex(
+      params.rawBody
+    )}:${params.signedAtMs}`
+  );
+}
+
+// ../../src/client/wallet-auth-headers.ts
+async function walletAuthHeaders(params) {
+  const signedAtMs = String(Date.now());
+  const message = walletAuthMessage({
+    method: params.method,
+    path: new URL(params.url).pathname,
+    rawBody: params.body ?? "",
+    signedAtMs
+  });
+  return {
+    [WALLET_AUTH_WALLET_HEADER]: params.signer.walletAddress,
+    [WALLET_AUTH_SIGNED_AT_HEADER]: signedAtMs,
+    [WALLET_AUTH_SIGNATURE_HEADER]: await params.signer.signApiMessage(message)
+  };
+}
+
+// ../../src/client/onboarding.ts
+var SELF_SERVE_POLICY_ID = "self-serve";
+var OnboardingError = class extends Error {
+  constructor(step, message, detail = null) {
+    super(message);
+    this.step = step;
+    this.detail = detail;
+    this.name = "OnboardingError";
+  }
+  step;
+  detail;
+};
+async function ensureWalletOnboarded(params) {
+  const fetchImpl = params.fetchImpl ?? fetch;
+  const baseUrl = params.facilitatorBaseUrl.replace(/\/$/, "");
+  const post = async (step, path, body) => {
+    const url = `${baseUrl}${path}`;
+    const serialized = JSON.stringify(body);
+    const response = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: params.signer,
+          method: "POST",
+          url,
+          body: serialized
+        }),
+        "content-type": "application/json"
+      },
+      body: serialized
+    });
+    if (response.status !== 200) {
+      let detail = null;
+      try {
+        detail = await response.json();
+      } catch {
+        detail = null;
+      }
+      throw new OnboardingError(
+        step,
+        `wallet onboarding ${step} failed with ${response.status}`,
+        detail
+      );
+    }
+  };
+  const wallet = params.signer.walletAddress;
+  await post("register", "/v1/wallets/agent", {
+    wallet,
+    signingPolicyId: SELF_SERVE_POLICY_ID,
+    signingMode: "non_interactive",
+    signerValidationMode: params.signer.validationMode,
+    signerProvider: "local-keypair",
+    activateForPayments: true
+  });
+  await post("sync", `/v1/wallets/${wallet}/sync`, { source: "chain" });
+}
+
+// ../../src/solana/keys.ts
+import { readFileSync } from "node:fs";
+import bs586 from "bs58";
+import {
+  createKeyPairSignerFromBytes
+} from "@solana/kit";
+async function loadKeyPairSigner(params) {
+  const { base58Secret, jsonFilePath, label } = params;
+  if (base58Secret !== void 0 && base58Secret.length > 0) {
+    const bytes = bs586.decode(base58Secret);
+    if (bytes.length !== 64) {
+      throw new Error(`${label} base58 secret must decode to 64 bytes`);
+    }
+    return createKeyPairSignerFromBytes(bytes);
+  }
+  if (jsonFilePath !== void 0 && jsonFilePath.length > 0) {
+    const raw = JSON.parse(readFileSync(jsonFilePath, "utf8"));
+    if (!Array.isArray(raw) || raw.length !== 64) {
+      throw new Error(`${label} keypair file must be a 64-byte JSON array`);
+    }
+    return createKeyPairSignerFromBytes(Uint8Array.from(raw));
+  }
+  throw new Error(`${label} keypair is not configured`);
+}
+
+// ../../src/solana/rpc.ts
+import { createSolanaRpc } from "@solana/kit";
+function createRpcFromEnv(env = process.env) {
+  const url = env.SOLANA_RPC_URL;
+  if (url === void 0 || url.length === 0) {
+    throw new Error("SOLANA_RPC_URL must be configured");
+  }
+  return createSolanaRpc(url);
+}
+
+// ../../src/x402/client.ts
+var X402ClientError = class extends Error {
+  reason;
+  detail;
+  constructor(reason, message, detail) {
+    super(message);
+    this.name = "X402ClientError";
+    this.reason = reason;
+    this.detail = detail;
+  }
+};
+var SublyX402Client = class {
+  config;
+  signer;
+  lookupTablesFor;
+  fetchImpl;
+  constructor(config) {
+    this.config = {
+      facilitatorBaseUrl: config.facilitatorBaseUrl.replace(/\/$/, ""),
+      network: config.network ?? SOLANA_MAINNET_NETWORK
+    };
+    this.signer = config.signer;
+    this.lookupTablesFor = config.lookupTablesFor ?? null;
+    this.fetchImpl = config.fetchImpl ?? fetch;
+  }
+  /**
+   * Builds the PAYMENT-SIGNATURE header for a 402 challenge. The request
+   * method, URL, and body must be exactly the request being retried; they are
+   * bound into the payment and verified again by the seller and facilitator.
+   */
+  async buildPaymentSignatureHeader(input) {
+    const requirement = this.selectRequirement(input.paymentRequiredHeader);
+    if (requirement.resource !== input.url) {
+      throw new X402ClientError(
+        "resource_mismatch",
+        "PAYMENT-REQUIRED resource does not match the request URL"
+      );
+    }
+    const requestBodyHash = requestBodyHashFor(input.body);
+    const prepared = await this.preparePayment({
+      requirement,
+      httpMethod: input.httpMethod.toUpperCase(),
+      requestBodyHash
+    });
+    const lookupTables = this.lookupTablesFor === null ? void 0 : await this.lookupTablesFor(prepared.intentJson.serializedTransaction);
+    const signed = await this.signer.signPayment({
+      intent: prepared.intentJson.signingIntent,
+      serializedTransaction: prepared.intentJson.serializedTransaction,
+      lookupTables
+    });
+    const payload = {
+      x402Version: X402_VERSION,
+      scheme: requirement.scheme,
+      network: requirement.network,
+      payload: {
+        paymentId: prepared.paymentId,
+        requestBindingHash: prepared.requestBindingHash,
+        preparedMessageHash: prepared.preparedMessageHash,
+        serializedTransaction: signed.serializedTransaction,
+        agentSignature: signed.agentSignature,
+        temporarySettlementSignature: prepared.temporarySettlementSignature
+      }
+    };
+    return {
+      headerValue: encodeX402Header(payload),
+      paymentId: prepared.paymentId
+    };
+  }
+  /**
+   * Convenience wrapper: performs the request, and on a 402 with a Subly
+   * requirement pays from vault yield and retries once.
+   */
+  async fetchWithPayment(url, init) {
+    const first = await this.fetchImpl(url, init);
+    if (first.status !== 402) {
+      return first;
+    }
+    const challenge = first.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (challenge === null) {
+      return first;
+    }
+    const { headerValue } = await this.buildPaymentSignatureHeader({
+      paymentRequiredHeader: challenge,
+      httpMethod: init?.method ?? "GET",
+      url,
+      body: init?.body ?? null
+    });
+    return this.fetchImpl(url, {
+      ...init,
+      headers: {
+        ...init?.headers,
+        [PAYMENT_SIGNATURE_HEADER]: headerValue
+      }
+    });
+  }
+  selectRequirement(paymentRequiredHeader) {
+    let sublyRequirements;
+    try {
+      sublyRequirements = decodePaymentRequiredHeader(
+        paymentRequiredHeader
+      ).sublyRequirements;
+    } catch (error) {
+      throw new X402ClientError(
+        error instanceof X402HeaderError ? error.reason : "invalid_challenge",
+        "Cannot decode the PAYMENT-REQUIRED header"
+      );
+    }
+    const selected = sublyRequirements.find(
+      (candidate) => candidate.network === this.config.network && candidate.extra.vault === SUBLY_VAULT.address && candidate.extra.shareMint === SUBLY_VAULT.shareMint && candidate.asset === SUBLY_VAULT.usdcMint
+    ) ?? null;
+    if (selected === null) {
+      throw new X402ClientError(
+        "no_supported_requirement",
+        "The 402 challenge contains no supported subly-yield-exact requirement"
+      );
+    }
+    return selected;
+  }
+  async preparePayment(input) {
+    const { requirement } = input;
+    const wallet = this.signer.walletAddress;
+    const prepareUrl = `${this.config.facilitatorBaseUrl}/v1/payments/prepare`;
+    const prepareBody = JSON.stringify({
+      wallet,
+      scheme: requirement.scheme,
+      network: requirement.network,
+      vault: requirement.extra.vault,
+      shareMint: requirement.extra.shareMint,
+      asset: requirement.asset,
+      seller: requirement.extra.seller,
+      sellerRequestId: requirement.extra.sellerRequestId,
+      httpMethod: input.httpMethod,
+      canonicalResourceUrl: requirement.resource,
+      requestBodyHash: input.requestBodyHash,
+      amountRawUsdc: requirement.amountRawUsdc,
+      payTo: requirement.payTo,
+      sellerUsdcAta: requirement.extra.sellerUsdcAta,
+      dustRecipientUsdcAta: deriveAssociatedTokenAddress({
+        owner: wallet,
+        mint: SUBLY_VAULT.usdcMint
+      })
+    });
+    const response = await this.fetchImpl(prepareUrl, {
+      method: "POST",
+      headers: {
+        ...await walletAuthHeaders({
+          signer: this.signer,
+          method: "POST",
+          url: prepareUrl,
+          body: prepareBody
+        }),
+        "content-type": "application/json"
+      },
+      body: prepareBody
+    });
+    const body = await response.json();
+    if (response.status !== 200) {
+      const error = body.error;
+      throw new X402ClientError(
+        typeof error?.code === "string" ? error.code : "prepare_failed",
+        "Payment preparation failed at the facilitator",
+        body
+      );
+    }
+    const prepared = body;
+    if (typeof prepared.paymentId !== "string" || typeof prepared.preparedMessageHash !== "string" || typeof prepared.intentJson?.serializedTransaction !== "string" || typeof prepared.intentJson?.signingIntent !== "object") {
+      throw new X402ClientError(
+        "invalid_prepare_response",
+        "Facilitator prepare response is missing required fields"
+      );
+    }
+    return prepared;
+  }
+};
+
+// ../../demo/shared.ts
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+function requireEnv(name) {
+  const value = process.env[name];
+  if (value === void 0 || value.length === 0) {
+    fail(`Missing required environment variable: ${name}`);
+  }
+  return value;
+}
+
+// ../../demo/mcp-server.ts
+var TOOL_NAME = "fetch_with_subly_payment";
+var DEFAULT_MAX_AMOUNT_RAW_USDC = 10000n;
+requireEnv("SOLANA_RPC_URL");
+var facilitatorBaseUrl = process.env.SUBLY_FACILITATOR_URL ?? "http://localhost:3000";
+var defaultMaxAmountRawUsdc = process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC === void 0 ? DEFAULT_MAX_AMOUNT_RAW_USDC : BigInt(process.env.SUBLY_MCP_MAX_AMOUNT_RAW_USDC);
+var keyPairSigner = await loadKeyPairSigner({
+  base58Secret: process.env.SUBLY_DEMO_AGENT_KEYPAIR,
+  jsonFilePath: process.env.SUBLY_DEMO_AGENT_KEYPAIR_PATH,
+  label: "SUBLY_DEMO_AGENT_KEYPAIR"
+});
+var signer = new LocalKeypairAgentWalletSigner(keyPairSigner);
+var rpc = createRpcFromEnv();
+async function fetchBudget() {
+  try {
+    const url = `${facilitatorBaseUrl}/v1/wallets/${signer.walletAddress}/budget`;
+    const response = await fetch(url, {
+      headers: await walletAuthHeaders({ signer, method: "GET", url })
+    });
+    if (response.status !== 200) {
+      return null;
+    }
+    const body = await response.json();
+    if (body.budget === void 0) {
+      return null;
+    }
+    return {
+      positionValueUsdc: formatRawUsdcAmount(body.budget.positionValueRawUsdc),
+      spendableYieldUsdc: formatRawUsdcAmount(
+        body.budget.spendableYieldRawUsdc
+      )
+    };
+  } catch {
+    return null;
+  }
+}
+async function paymentStatusFor(paymentId) {
+  try {
+    const url = `${facilitatorBaseUrl}/v1/payments/${paymentId}`;
+    const response = await fetch(url, {
+      headers: await walletAuthHeaders({ signer, method: "GET", url })
+    });
+    if (response.status !== 200) {
+      return "indeterminate";
+    }
+    const body = await response.json();
+    if (body.status === "settled") {
+      return "settled";
+    }
+    if (body.status === "expired" || body.status === "failed" || body.status === "failed_not_submitted") {
+      return "not_settled";
+    }
+    return "indeterminate";
+  } catch {
+    return "indeterminate";
+  }
+}
+function fileStateStore(path) {
+  return {
+    load() {
+      try {
+        const parsed = JSON.parse(readFileSync2(path, "utf8"));
+        return Array.isArray(parsed) ? parsed : [];
+      } catch {
+        return [];
+      }
+    },
+    save(records) {
+      try {
+        writeFileSync(path, JSON.stringify(records));
+      } catch (error) {
+        console.error(
+          `[subly-mcp] failed to persist pending payments: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  };
+}
+var pendingStatePath = process.env.SUBLY_MCP_STATE_PATH ?? "demo/env/mcp-pending-payments.json";
+var paidFetchService = new PaidFetchService({
+  signatureBuilder: new SublyX402Client({
+    facilitatorBaseUrl,
+    signer,
+    lookupTablesFor: (serializedTransaction) => fetchLookupTablesForTransaction(rpc, serializedTransaction)
+  }),
+  defaultMaxAmountRawUsdc,
+  fetchBudget,
+  paymentStatusFor,
+  stateStore: fileStateStore(pendingStatePath)
+});
+var SERVER_INSTRUCTIONS = `Subly lets an agent pay for HTTP 402 (subly-yield-exact) resources from its wallet's Kamino vault YIELD \u2014 the deposited principal is never spent.
+
+Before payments can succeed the operator of this server must have, once:
+1. A Solana keypair for the agent wallet. Subly does NOT create wallets; make one with \`solana-keygen new -o agent.json\` (or export a keypair from an existing wallet) and point SUBLY_DEMO_AGENT_KEYPAIR_PATH at it. The private key never leaves that file; this server only signs locally with it.
+2. Funded that wallet with USDC on Solana mainnet (no SOL needed \u2014 fees are sponsored) and deposited into the vault (see the project's deposit command). The vault minimum deposit is 1 USDC.
+3. Waited for yield to accrue; a payment needs the price plus a fixed overhead (~0.0024 USDC) of spendable yield.
+
+Then use fetch_with_subly_payment(url) to GET a paid resource: it pays the 402 from yield and returns the body plus an on-chain receipt. If it returns insufficient_yield, that is expected \u2014 wait for yield, do not loop. If it returns delivery_failed_payment_pending, call the SAME url again (it retries the same payment, never double-pays).`;
+var server = new Server(
+  { name: "subly-payments", version: "0.1.0" },
+  { capabilities: { tools: {} }, instructions: SERVER_INSTRUCTIONS }
+);
+server.setRequestHandler(ListToolsRequestSchema, () => ({
+  tools: [
+    {
+      name: TOOL_NAME,
+      description: `GET a URL, automatically paying a Subly x402 (subly-yield-exact) 402 challenge from the agent wallet's Kamino vault yield. Returns the response body; when a payment was made, also returns the settlement receipt (amount, payee, paymentId, Solscan link). Challenges above maxAmountRawUsdc (default ${defaultMaxAmountRawUsdc} raw = ${formatRawUsdcAmount(
+        defaultMaxAmountRawUsdc
+      )} USDC) are refused without paying. If delivery fails after the payment was signed, the signature is kept and calling again with the same URL retries the same payment instead of paying twice. Payments are refused by the facilitator when the spendable yield budget cannot cover them \u2014 the principal is never spent. Use only for URLs you intend to purchase access to.`,
+      inputSchema: {
+        type: "object",
+        properties: {
+          url: {
+            type: "string",
+            description: "URL to fetch (GET). Must match the seller's resource URL exactly."
+          },
+          maxAmountRawUsdc: {
+            type: "string",
+            description: 'Refuse (without paying) any challenge above this amount in raw USDC units (6 decimals, e.g. "10000" = 0.01 USDC). Defaults to the server-side cap.'
+          },
+          forceNewPayment: {
+            type: "boolean",
+            description: "Pay again even though a previous payment for this URL settled or has an unknown outcome. Only set deliberately: combined with payment_already_settled this means paying twice for the same resource. Ignored while the previous payment is still retryable (the same signature is retried instead)."
+          }
+        },
+        required: ["url"]
+      },
+      annotations: {
+        title: "Fetch with Subly payment",
+        readOnlyHint: false,
+        destructiveHint: true,
+        idempotentHint: false,
+        openWorldHint: true
+      }
+    }
+  ]
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+  if (request.params.name !== TOOL_NAME) {
+    return {
+      content: [
+        { type: "text", text: `unknown tool: ${request.params.name}` }
+      ],
+      isError: true
+    };
+  }
+  const args = request.params.arguments ?? {};
+  const url = args.url;
+  if (typeof url !== "string" || url.length === 0) {
+    return {
+      content: [{ type: "text", text: "missing required argument: url" }],
+      isError: true
+    };
+  }
+  let maxAmountRawUsdc;
+  if (args.maxAmountRawUsdc !== void 0) {
+    const raw = args.maxAmountRawUsdc;
+    try {
+      if (typeof raw !== "string" && typeof raw !== "number") {
+        throw new TypeError("not a string or number");
+      }
+      maxAmountRawUsdc = BigInt(raw);
+    } catch {
+      return {
+        content: [
+          {
+            type: "text",
+            text: "maxAmountRawUsdc must be an integer raw USDC amount"
+          }
+        ],
+        isError: true
+      };
+    }
+  }
+  try {
+    const result = await paidFetchService.paidFetch({
+      url,
+      ...maxAmountRawUsdc === void 0 ? {} : { maxAmountRawUsdc },
+      forceNewPayment: args.forceNewPayment === true
+    });
+    return {
+      content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+    };
+  } catch (error) {
+    if (error instanceof PaidFetchError) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                paid: false,
+                refused: true,
+                reason: error.reason,
+                message: error.message,
+                detail: error.detail
+              },
+              null,
+              2
+            )
+          }
+        ],
+        isError: true
+      };
+    }
+    if (error instanceof X402ClientError) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                paid: false,
+                refused: true,
+                reason: error.reason,
+                detail: error.detail ?? null
+              },
+              null,
+              2
+            )
+          }
+        ],
+        isError: true
+      };
+    }
+    return {
+      content: [
+        {
+          type: "text",
+          text: error instanceof Error ? error.message : String(error)
+        }
+      ],
+      isError: true
+    };
+  }
+});
+try {
+  await ensureWalletOnboarded({ facilitatorBaseUrl, signer });
+  console.error("[subly-mcp] wallet registered and synced at the facilitator");
+} catch (error) {
+  console.error(
+    `[subly-mcp] wallet onboarding failed (will still serve tools): ${error instanceof Error ? error.message : String(error)}`
+  );
+}
+var transport = new StdioServerTransport();
+await server.connect(transport);
+console.error(
+  `[subly-mcp] ready: agent wallet ${signer.walletAddress}, facilitator ${facilitatorBaseUrl}, default cap ${formatRawUsdcAmount(defaultMaxAmountRawUsdc)} USDC`
+);