pop-pay 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +411 -15
  2. package/dist/mcp-server.js +102 -5
  3. package/dist/mcp-server.js.map +1 -1
  4. package/dist/providers/lithic.d.ts +15 -0
  5. package/dist/providers/lithic.d.ts.map +1 -0
  6. package/dist/providers/lithic.js +40 -0
  7. package/dist/providers/lithic.js.map +1 -0
  8. package/package.json +1 -1
package/README.md CHANGED
@@ -1,18 +1,101 @@
1
- # pop-pay
1
+ [![npm version](https://img.shields.io/npm/v/pop-pay.svg)](https://www.npmjs.com/package/pop-pay) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![CI](https://github.com/TPEmist/pop-pay/actions/workflows/ci.yml/badge.svg)](https://github.com/TPEmist/pop-pay/actions/workflows/ci.yml) [![Node.js](https://img.shields.io/badge/Node.js-%3E%3D18-339933?logo=node.js&logoColor=white)](https://nodejs.org/)
2
2
 
3
- **Point One Percent** — Semantic Payment Guardrail for AI Agents.
3
+ <p align="center">
4
+ <picture>
5
+ <img src="https://raw.githubusercontent.com/TPEmist/Point-One-Percent/main/project_banner.png" alt="Point One Percent (AgentPay)" width="800">
6
+ </picture>
7
+ </p>
4
8
 
5
- > It only takes 0.1% of hallucination to drain 100% of your wallet.
9
+ # Point One Percent — pop-pay
10
+ <p align="left"><i>it only takes <b>0.1%</b> of Hallucination to drain <b>100%</b> of your wallet.</i></p>
6
11
 
7
- TypeScript + Rust implementation of the pop-pay runtime security layer for AI agent commerce.
12
+ ### The runtime security layer for AI agent commerce.
8
13
 
9
- ## Features
14
+ > Your card never enters the agent's context. One hallucinated prompt can't drain a wallet it can't see.
10
15
 
11
- - **Vault**: AES-256-GCM encrypted credential storage with Rust native security layer
12
- - **Guardrails**: Keyword + LLM-based payment intent validation
13
- - **MCP Server**: Model Context Protocol server for AI agent integration
14
- - **Providers**: Stripe Issuing, BYOC (Bring Your Own Card), Mock
15
- - **Security Scan**: Prompt injection detection on checkout pages
16
+ <p align="center">
17
+ <img src="assets/runtime_demo.gif" alt="Point One Percent — live CDP injection demo" width="800">
18
+ </p>
19
+
20
+ pop-pay is an open-source (MIT) runtime security layer that protects AI agents during online purchases. It works with OpenClaw, NemoClaw, Claude Code, OpenHands, and any MCP-compatible framework.
21
+
22
+ ## Architecture: Five Security Primitives
23
+
24
+ | Primitive | What it does |
25
+ |-----------|-------------|
26
+ | **Context Isolation Layer** | Card credentials are injected directly into the browser DOM via CDP — they never enter the agent's process or LLM context window. Prompt injection can't steal what the agent doesn't have. |
27
+ | **Intent Verification Engine** | Hybrid keyword + LLM guardrail evaluates whether a purchase *should* happen — not just whether it *can*. [95% accuracy on 20-scenario benchmark.](./docs/GUARDRAIL_BENCHMARK.md) |
28
+ | **Human Trust Anchor** | Configurable human-in-the-loop approval for high-value or unrecognized transactions. |
29
+ | **Zero-Knowledge Card Surface** | Agent only sees masked tokens (`****-4242`). Real data is stored in an AES-256-GCM encrypted vault. |
30
+ | **Ephemeral Authorization Scope** | Each payment approval is single-use with TOCTOU domain guard — an approved session can't be redirected to a malicious merchant. |
31
+
32
+ > See [THREAT_MODEL.md](./docs/THREAT_MODEL.md) for the full STRIDE analysis and [COMPLIANCE_FAQ.md](./docs/COMPLIANCE_FAQ.md) for enterprise compliance details.
33
+
34
+ ## Guardrail Benchmark
35
+
36
+ | Layer | Score | Notes |
37
+ |-------|-------|-------|
38
+ | Keyword only | 14/20 (70%) | Fast, zero-cost, catches obvious violations |
39
+ | **Hybrid (Keyword + LLM)** | **19/20 (95%)** | LLM resolves 5 of 6 keyword failures |
40
+
41
+ | Feature | AgentPayy | AgentWallet | Prava | **pop-pay** |
42
+ |---------|-----------|-------------|-------|------------|
43
+ | Enforcement | Mock alert() | Rule-based | Spending limits | **Semantic validation** |
44
+ | Intent check | None | Agent-provided text | None | **Context-aware LLM** |
45
+ | Injection-proof | No | No | No | **Yes** |
46
+
47
+ ## Two Deployment Modes
48
+
49
+ ### BYOC — Bring Your Own Card (Local)
50
+ The agent **never** receives the true card number — it only sees `****-4242`. When checkout is reached, the Context Isolation Layer attaches via CDP, traverses all cross-origin iframes (Stripe Elements, Adyen, etc.), and injects credentials directly into the DOM. Runs entirely on your machine via Node.js — no SaaS, no login, no external account.
51
+
52
+ ### Enterprise — Stripe Issuing
53
+ For cloud-hosted AI fleets: programmatically issue single-use virtual cards via Stripe API, with per-agent budgets and full audit trails.
54
+
55
+ ---
56
+
57
+ ## Ecosystem Position
58
+
59
+ pop-pay is the agent's **Policy Enforcement Point** — it evaluates, approves, and injects. It does NOT navigate websites or solve CAPTCHAs — that's the browser agent's job.
60
+
61
+ ### The Handshake: How Point One Percent and Browser Agents Work Together
62
+
63
+ The real power emerges when Point One Percent is paired with a browser automation agent (e.g., OpenHands, browser-use, Skyvern). The workflow is a clean division of labor:
64
+
65
+ ```
66
+ 1. [Browser Agent] Navigates to a site, scrapes product info, reaches checkout.
67
+ │
68
+ │ (Hit a paywall / payment form)
69
+ ▼
70
+ 2. [Browser Agent → POP MCP] Calls request_virtual_card(amount, vendor, reasoning)
71
+ │
72
+ │ (Point One Percent evaluates: budget OK? vendor approved? no hallucination?)
73
+ ▼
74
+ 3. [POP] Issues a one-time virtual card (Stripe mode) or uses BYOC vault credentials.
75
+ Full card credentials handled only by the local trusted process —
76
+ never exposed to the agent or LLM context.
77
+ │
78
+ ▼
79
+ 4. [POP] Injects real credentials into the checkout form via CDP.
80
+ The agent receives only a transaction confirmation — no card details.
81
+ │
82
+ ▼
83
+ 5. [Browser Agent] Clicks the submit button to complete the transaction.
84
+ │
85
+ ▼
86
+ 6. [The Vault] Logs the transaction. Card session is immediately burned.
87
+ ```
88
+
89
+ ### Supported Integrations
90
+
91
+ | Integration path | Works with |
92
+ |---|---|
93
+ | **MCP Tool** | Claude Code, OpenClaw, NemoClaw, OpenHands, any MCP-compatible host |
94
+ | **Node.js SDK** | Custom Playwright scripts, Puppeteer automation, gemini-cli |
95
+
96
+ > **Any browser-capable agent** (Claude Code, OpenClaw, browser-use, Skyvern, etc.) gets full CDP injection — card is auto-filled into the payment form, the agent only ever sees the masked confirmation (`****-****-****-4242`). See the **[Integration Guide](./docs/INTEGRATION_GUIDE.md)** for setup instructions and System Prompt templates.
97
+
98
+ ---
16
99
 
17
100
  ## Installation
18
101
 
@@ -20,16 +103,329 @@ TypeScript + Rust implementation of the pop-pay runtime security layer for AI ag
20
103
  npm install pop-pay
21
104
  ```
22
105
 
23
- ## Quick Start
106
+ ## Quick Start for Claude Code / OpenHands
107
+
108
+ If you're using Claude Code, OpenHands, or any MCP-compatible agentic framework, you can get Point One Percent running in under 2 minutes:
109
+
110
+ ### Step 1: Initialize the Credential Vault
111
+
112
+ Credentials are stored in an AES-256-GCM encrypted vault — no plaintext `.env` required.
113
+
114
+ ```bash
115
+ npx pop-init-vault
116
+ ```
117
+
118
+ This will prompt for your card credentials (input is hidden), encrypt them into `~/.config/pop-pay/vault.enc`, and securely wipe any existing `.env`. The MCP server auto-decrypts the vault at startup.
119
+
120
+ **Passphrase mode (stronger — protects against agents with shell access):**
121
+
122
+ ```bash
123
+ npx pop-init-vault --passphrase # one-time setup
124
+ npx pop-unlock # run once before each MCP server session
125
+ ```
126
+
127
+ `pop-unlock` derives the key from your passphrase and stores it in the OS keyring. The MCP server reads it automatically at startup.
128
+
129
+ **Security levels (lowest → highest):**
130
+
131
+ | Mode | Protects against |
132
+ |---|---|
133
+ | `.env` file (legacy) | Nothing — plaintext on disk |
134
+ | Vault, machine key, OSS source | File-read agents |
135
+ | Vault, machine key, `npm install pop-pay` | File-read agents + casual shell inspection |
136
+ | Vault + passphrase | File-read agents + shell agents |
137
+ | Stripe Issuing (commercial) | All local threats — no credentials stored |
138
+
139
+ > **Policy & non-credential config** (allowed vendors, spending limits, CDP URL) is still read from `~/.config/pop-pay/.env`. Only card credentials moved to the vault.
140
+
141
+ ### Step 2: Launch Chrome & Get MCP Commands
142
+
143
+ ```bash
144
+ npx pop-launch --print-mcp
145
+ ```
146
+
147
+ This launches Chrome with CDP enabled and prints the exact `claude mcp add` commands to run.
148
+
149
+ ### Step 3: Add to Claude Code
150
+
151
+ ```bash
152
+ claude mcp add pop-pay -- npx pop-pay launch-mcp
153
+ ```
154
+
155
+ > `--scope user` (optional) stores the registration in `~/.claude.json` — available in every Claude Code session.
156
+
157
+ ### Step 4: Configure Policy
158
+
159
+ Edit `~/.config/pop-pay/.env` to set your spending limits and allowed vendors:
160
+
161
+ | Variable | Default | Description |
162
+ |---|---|---|
163
+ | `POP_ALLOWED_CATEGORIES` | `["aws","cloudflare"]` | Vendors the agent is allowed to pay — see [Categories Cookbook](./docs/CATEGORIES_COOKBOOK.md) |
164
+ | `POP_MAX_PER_TX` | `100.0` | Max $ per transaction |
165
+ | `POP_MAX_DAILY` | `500.0` | Max $ per day |
166
+ | `POP_BLOCK_LOOPS` | `true` | Block hallucination/retry loops |
167
+ | `POP_AUTO_INJECT` | `true` | Enable CDP card injection |
168
+ | `POP_GUARDRAIL_ENGINE` | `keyword` | Guardrail engine: `keyword` (zero-cost, default) or `llm` (semantic, two-layer) — see [Guardrail Mode](#guardrail-mode-keyword-vs-llm) |
169
+ | `POP_BILLING_FIRST_NAME` / `POP_BILLING_LAST_NAME` | _(empty)_ | Auto-fill name fields on checkout pages |
170
+ | `POP_BILLING_EMAIL` | _(empty)_ | Auto-fill email |
171
+ | `POP_BILLING_PHONE` | _(empty)_ | E.164 format — auto-fill combined phone input |
172
+ | `POP_BILLING_PHONE_COUNTRY_CODE` | _(empty)_ | ISO code (`"US"`) or dial prefix (`"+1"`) — fills country code dropdown |
173
+ | `POP_BILLING_STREET` / `POP_BILLING_CITY` / `POP_BILLING_STATE` / `POP_BILLING_COUNTRY` / `POP_BILLING_ZIP` | _(empty)_ | Auto-fill address fields; state and country matched fuzzily |
174
+ | `POP_ALLOWED_PAYMENT_PROCESSORS` | `[]` | Extra third-party payment processor domains to trust (pop-pay ships with 20 built-in) |
175
+ | `POP_WEBHOOK_URL` | _(empty)_ | Webhook URL for Slack/Teams/PagerDuty notifications |
176
+
177
+ > **After editing `.env`, fully close and reopen Claude Code.** The MCP server loads configuration at startup — `!claude mcp list` alone is not sufficient to pick up `.env` changes.
178
+
179
+ #### Guardrail Mode: Keyword vs LLM
180
+
181
+ Point One Percent ships with two guardrail engines. You switch between them with a single env var:
182
+
183
+ | | `keyword` (default) | `llm` |
184
+ |---|---|---|
185
+ | **How it works** | Blocks requests whose `reasoning` string contains suspicious keywords (e.g. "retry", "failed again", "ignore previous instructions") | Sends the agent's `reasoning` to an LLM for deep semantic analysis |
186
+ | **What it catches** | Obvious loops, hallucination phrases, prompt injection attempts | Subtle off-topic purchases, logical inconsistencies, policy violations that keyword matching misses |
187
+ | **Cost** | Zero — no API calls, instant | One LLM call per `request_virtual_card` invocation |
188
+ | **Dependencies** | None | Any OpenAI-compatible endpoint |
189
+ | **Best for** | Development, low-risk workflows, cost-sensitive setups | Production, high-value transactions, untrusted agent pipelines |
190
+
191
+ > **Tip:** `keyword` mode requires no extra config. To enable LLM mode, see the [full configuration reference in the Integration Guide §1](./docs/INTEGRATION_GUIDE.md#guardrail-mode-configuration).
192
+
193
+ ### Step 5: Use It
194
+
195
+ Your agent now has access to these tools:
196
+
197
+ | Tool | When to use |
198
+ |---|---|
199
+ | `request_purchaser_info` | Billing/contact info page (name, email, phone, address) — no card fields visible yet |
200
+ | `request_virtual_card` | Payment page — card fields are visible. Prompt injection scan runs automatically inside this call. |
201
+
202
+ **Single-page checkout** (e.g. Wikipedia donate): agent calls `request_virtual_card`.
203
+ **Two-page checkout** (e.g. billing info → payment): agent calls `request_purchaser_info` first, then `request_virtual_card`.
204
+
205
+ When it encounters a paywall:
206
+
207
+ ```
208
+ Agent: "I need to purchase an API key from AWS for $15 to continue."
209
+ [Tool Call] request_virtual_card(amount=15.0, vendor="AWS", reasoning="Need API key for deployment")
210
+ [POP] Payment approved. Card Issued: ****4242, Expiry: 12/25, Amount: 15.0
211
+ Agent: "Purchase successful, continuing workflow."
212
+ ```
213
+
214
+ If the agent hallucinates or tries to overspend:
215
+ ```
216
+ Agent: "Let me retry buying compute... the previous attempt failed again."
217
+ [Tool Call] request_virtual_card(amount=50.0, vendor="AWS", reasoning="failed again, retry loop")
218
+ [POP] Payment rejected. Reason: Hallucination or infinite loop detected in reasoning
219
+ ```
220
+
221
+ ---
222
+
223
+ ## Setup
224
+
225
+ **Standard config** works across most MCP-compatible tools:
226
+
227
+ ```json
228
+ {
229
+ "mcpServers": {
230
+ "pop-pay": {
231
+ "command": "npx",
232
+ "args": ["-y", "pop-pay", "launch-mcp"],
233
+ "env": {
234
+ "POP_CDP_URL": "http://localhost:9222",
235
+ "POP_ALLOWED_CATEGORIES": "[\"aws\",\"cloudflare\"]",
236
+ "POP_MAX_PER_TX": "100.0",
237
+ "POP_MAX_DAILY": "500.0",
238
+ "POP_GUARDRAIL_ENGINE": "keyword"
239
+ }
240
+ }
241
+ }
242
+ }
243
+ ```
244
+
245
+ [<img src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20MCP%20Server&color=0098FF" alt="Install in VS Code">](https://insiders.vscode.dev/redirect?url=vscode%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522pop-pay%2522%252C%2522command%2522%253A%2522npx%2522%252C%2522args%2522%253A%255B%2522-y%2522%252C%2522pop-pay%2522%252C%2522launch-mcp%2522%255D%252C%2522env%2522%253A%257B%2522POP_CDP_URL%2522%253A%2522http%253A%252F%252Flocalhost%253A9222%2522%257D%257D) [<img alt="Install in VS Code Insiders" src="https://img.shields.io/badge/VS_Code_Insiders-VS_Code_Insiders?style=flat-square&label=Install%20MCP%20Server&color=24bfa5">](https://insiders.vscode.dev/redirect?url=vscode-insiders%3Amcp%2Finstall%3F%257B%2522name%2522%253A%2522pop-pay%2522%252C%2522command%2522%253A%2522npx%2522%252C%2522args%2522%253A%255B%2522-y%2522%252C%2522pop-pay%2522%252C%2522launch-mcp%2522%255D%252C%2522env%2522%253A%257B%2522POP_CDP_URL%2522%253A%2522http%253A%252F%252Flocalhost%253A9222%2522%257D%257D)
246
+
247
+ <details>
248
+ <summary>Claude Code</summary>
24
249
 
25
250
  ```bash
26
- # Initialize vault
27
- pop-init-vault
251
+ claude mcp add pop-pay -- npx -y pop-pay launch-mcp
252
+ ```
253
+
254
+ To configure spending limits and allowed vendors, set environment variables:
28
255
 
29
- # Launch MCP server
30
- pop-launch
256
+ ```bash
257
+ claude mcp add pop-pay \
258
+ -e POP_CDP_URL=http://localhost:9222 \
259
+ -e POP_ALLOWED_CATEGORIES='["aws","cloudflare"]' \
260
+ -e POP_MAX_PER_TX=100.0 \
261
+ -e POP_MAX_DAILY=500.0 \
262
+ -e POP_GUARDRAIL_ENGINE=keyword \
263
+ -- npx -y pop-pay launch-mcp
31
264
  ```
32
265
 
266
+ Add `--scope user` to make the registration available across all projects.
267
+
268
+ </details>
269
+
270
+ <details>
271
+ <summary>Cursor</summary>
272
+
273
+ [<img src="https://img.shields.io/badge/Cursor-Cursor?style=flat-square&label=Install%20MCP%20Server&color=5C2D91" alt="Install in Cursor">](cursor://anysphere.cursor-deeplink/mcp/install?name=pop-pay&config=eyJjb21tYW5kIjoibnB4IiwiYXJncyI6WyIteSIsInBvcC1wYXkiLCJsYXVuY2gtbWNwIl0sImVudiI6eyJQT1BfQ0RQX1VSTCI6Imh0dHA6Ly9sb2NhbGhvc3Q6OTIyMiJ9fQ==)
274
+
275
+ Or add manually to `~/.cursor/mcp.json`:
276
+
277
+ ```json
278
+ {
279
+ "mcpServers": {
280
+ "pop-pay": {
281
+ "command": "npx",
282
+ "args": ["-y", "pop-pay", "launch-mcp"],
283
+ "env": {
284
+ "POP_CDP_URL": "http://localhost:9222",
285
+ "POP_ALLOWED_CATEGORIES": "[\"aws\",\"cloudflare\"]",
286
+ "POP_MAX_PER_TX": "100.0",
287
+ "POP_MAX_DAILY": "500.0",
288
+ "POP_GUARDRAIL_ENGINE": "keyword"
289
+ }
290
+ }
291
+ }
292
+ }
293
+ ```
294
+
295
+ </details>
296
+
297
+ <details>
298
+ <summary>Windsurf</summary>
299
+
300
+ Add to `~/.codeium/windsurf/mcp_config.json`:
301
+
302
+ ```json
303
+ {
304
+ "mcpServers": {
305
+ "pop-pay": {
306
+ "command": "npx",
307
+ "args": ["-y", "pop-pay", "launch-mcp"],
308
+ "env": {
309
+ "POP_CDP_URL": "http://localhost:9222",
310
+ "POP_ALLOWED_CATEGORIES": "[\"aws\",\"cloudflare\"]",
311
+ "POP_MAX_PER_TX": "100.0",
312
+ "POP_MAX_DAILY": "500.0",
313
+ "POP_GUARDRAIL_ENGINE": "keyword"
314
+ }
315
+ }
316
+ }
317
+ }
318
+ ```
319
+
320
+ </details>
321
+
322
+ <details>
323
+ <summary>VS Code (Copilot)</summary>
324
+
325
+ Add to `.vscode/mcp.json` in your project root:
326
+
327
+ ```json
328
+ {
329
+ "mcpServers": {
330
+ "pop-pay": {
331
+ "command": "npx",
332
+ "args": ["-y", "pop-pay", "launch-mcp"],
333
+ "env": {
334
+ "POP_CDP_URL": "http://localhost:9222",
335
+ "POP_ALLOWED_CATEGORIES": "[\"aws\",\"cloudflare\"]",
336
+ "POP_MAX_PER_TX": "100.0",
337
+ "POP_MAX_DAILY": "500.0",
338
+ "POP_GUARDRAIL_ENGINE": "keyword"
339
+ }
340
+ }
341
+ }
342
+ }
343
+ ```
344
+
345
+ </details>
346
+
347
+ <details>
348
+ <summary>OpenClaw / NemoClaw</summary>
349
+
350
+ pop-pay works as an MCP tool with OpenClaw and NemoClaw. Use the standard config above, or see the [Integration Guide §4](./docs/INTEGRATION_GUIDE.md) for detailed setup instructions and System Prompt templates.
351
+
352
+ </details>
353
+
354
+ <details>
355
+ <summary>Docker</summary>
356
+
357
+ ```bash
358
+ docker-compose up -d
359
+ ```
360
+
361
+ Runs pop-pay MCP server + headless Chromium with CDP. Mount your encrypted vault from the host. See `docker-compose.yml` for configuration.
362
+
363
+ </details>
364
+
365
+ > **Environment variables reference:** See [ENV_REFERENCE.md](./docs/ENV_REFERENCE.md) for the full list of `POP_*` variables (guardrail engine, LLM config, billing info, card credentials, webhooks, and more).
366
+
367
+ ---
368
+
369
+ ## MCP Tools
370
+
371
+ | Tool | Description |
372
+ |:---|:---|
373
+ | `request_virtual_card` | Issue a one-time virtual card for an automated purchase. Runs security scan on the checkout page. |
374
+ | `request_purchaser_info` | Auto-fill billing/contact info from pre-configured profile. |
375
+ | `request_x402_payment` | Pay for API calls via the x402 HTTP payment protocol. |
376
+ | `page_snapshot` | Security scan a checkout page for hidden prompt injections and anomalies. |
377
+
378
+ ## Providers
379
+
380
+ | Provider | Description |
381
+ |:---|:---|
382
+ | **BYOC** (default) | Bring Your Own Card — uses your encrypted vault credentials for local CDP injection. |
383
+ | **Stripe Issuing** | Real virtual cards via Stripe Issuing API. Requires `POP_STRIPE_KEY`. |
384
+ | **Lithic** | Multi-issuer adapter skeleton (Stripe Issuing / Lithic). |
385
+ | **Mock** | Test mode with generated card numbers for development. |
386
+
387
+ **Provider priority (high → low):** Stripe Issuing → BYOC Local → Mock.
388
+
389
+ If `POP_STRIPE_KEY` is set, Stripe takes precedence. If `POP_BYOC_NUMBER` is set (but no Stripe key), `LocalVaultProvider` is used. If neither is set, `MockProvider` is used for development.
390
+
391
+ > **CDP injection limitation with Stripe Issuing:** The Stripe Issuing API returns only the last 4 digits of the card number for security reasons. CDP auto-injection (`POP_AUTO_INJECT=true`) requires the full PAN and therefore **does not work** with Stripe Issuing. Use BYOC (`POP_BYOC_NUMBER`) if you need CDP injection; use Stripe Issuing if you need a real card and will handle form submission yourself.
392
+
393
+ ---
394
+
395
+ ## Security Statement
396
+
397
+ Security is a first-class citizen in pop-pay. The SDK **masks card numbers by default** (e.g., `****-****-****-4242`) when returning authorization results to the agent.
398
+
399
+ **Defense-in-depth hardening:**
400
+
401
+ | Layer | Defense |
402
+ |---|---|
403
+ | **Encrypted vault** | Card credentials stored as AES-256-GCM ciphertext (`vault.enc`); plaintext never touches disk after `pop-init-vault` |
404
+ | **Passphrase mode** | Key derived from user passphrase via scrypt; stored in OS keyring — agents with shell access cannot derive the key |
405
+ | **Database** | SQLite only stores masked card (`****-4242`); `card_number` and `cvv` columns removed entirely |
406
+ | **Injection-time TOCTOU guard** | Domain verified against guardrail-approved vendor at the moment of injection — prevents redirect-to-attacker attacks |
407
+ | **Repr redaction** | Masked card output in all logs and responses; credentials cannot leak via tracebacks |
408
+ | **Process isolation** | Agent communicates via MCP JSON-RPC as a separate process — cannot access MCP server memory or env vars through the protocol |
409
+ | **Native security layer** | XOR-split salt storage and scrypt key derivation handled in a stripped Rust binary (napi-rs) |
410
+
411
+ See [THREAT_MODEL.md](./docs/THREAT_MODEL.md) for the full STRIDE analysis and red team results.
412
+
413
+ ## Architecture
414
+
415
+ - **TypeScript** — MCP server, CDP injection engine, guardrails, CLI
416
+ - **Rust (napi-rs)** — Native security layer: XOR-split salt storage, scrypt key derivation
417
+ - **Node.js crypto** — AES-256-GCM vault encryption (OpenSSL binding)
418
+ - **Chrome DevTools Protocol** — Direct DOM injection via raw WebSocket
419
+
420
+ ## Documentation
421
+
422
+ - [Threat Model](docs/THREAT_MODEL.md) — STRIDE analysis, 5 security primitives, 10 attack scenarios
423
+ - [Guardrail Benchmark](docs/GUARDRAIL_BENCHMARK.md) — 95% accuracy across 20 test scenarios, competitive comparison
424
+ - [Compliance FAQ](docs/COMPLIANCE_FAQ.md) — Enterprise security and PCI DSS/SOC 2/GDPR details
425
+ - [Environment Reference](docs/ENV_REFERENCE.md) — All POP_* environment variables
426
+ - [Integration Guide](docs/INTEGRATION_GUIDE.md) — Detailed setup for Claude Code, Node.js SDK, and browser agents
427
+ - [Categories Cookbook](docs/CATEGORIES_COOKBOOK.md) — POP_ALLOWED_CATEGORIES patterns and examples
428
+
33
429
  ## License
34
430
 
35
431
  MIT
package/dist/mcp-server.js CHANGED
@@ -17,6 +17,7 @@ const client_js_1 = require("./client.js");
17
17
  const stripe_mock_js_1 = require("./providers/stripe-mock.js");
18
18
  const byoc_local_js_1 = require("./providers/byoc-local.js");
19
19
  const guardrails_js_1 = require("./engine/guardrails.js");
20
+ const injector_js_1 = require("./engine/injector.js");
20
21
  async function main() {
21
22
  // Load .env from config dir first, then fallback
22
23
  const configEnv = (0, node_path_1.join)((0, node_os_1.homedir)(), ".config", "pop-pay", ".env");
@@ -90,6 +91,10 @@ async function main() {
90
91
  engine = new guardrails_js_1.GuardrailEngine();
91
92
  }
92
93
  const client = new client_js_1.PopClient(provider, policy, engine);
94
+ // Optional: browser injector (only loaded when POP_AUTO_INJECT=true)
95
+ const cdpUrl = process.env.POP_CDP_URL ?? "http://localhost:9222";
96
+ const autoInject = (process.env.POP_AUTO_INJECT ?? "false").toLowerCase() === "true";
97
+ const injector = autoInject ? new injector_js_1.PopBrowserInjector(cdpUrl) : null;
93
98
  // Snapshot cache for security scans
94
99
  const snapshotCache = new Map();
95
100
  const SNAPSHOT_CACHE_MAX = 200;
@@ -238,6 +243,49 @@ async function main() {
238
243
  }
239
244
  const last4 = seal.cardNumber?.slice(-4) ?? "????";
240
245
  const maskedCard = `****-****-****-${last4}`;
246
+ // Auto-injection path: inject into browser if enabled
247
+ if (injector && seal.cardNumber && seal.cvv && seal.expirationDate) {
248
+ const injectionResult = await injector.injectPaymentInfo({
249
+ sealId: seal.sealId,
250
+ cardNumber: seal.cardNumber,
251
+ cvv: seal.cvv,
252
+ expirationDate: seal.expirationDate,
253
+ pageUrl: page_url,
254
+ approvedVendor: target_vendor,
255
+ });
256
+ if (!injectionResult.cardFilled) {
257
+ client.stateTracker.markUsed(seal.sealId);
258
+ if (injectionResult.blockedReason.startsWith("domain_mismatch:")) {
259
+ const actual = injectionResult.blockedReason.split(":", 2)[1];
260
+ return {
261
+ content: [{
262
+ type: "text",
263
+ text: `Payment blocked. Security: current page domain '${actual}' does not match approved vendor '${target_vendor}'. Do not retry.`,
264
+ }],
265
+ };
266
+ }
267
+ return {
268
+ content: [{
269
+ type: "text",
270
+ text: "Payment rejected. Could not find credit card input fields. Ensure page_url points to the checkout page and Playwright MCP shares --cdp-endpoint http://localhost:9222.",
271
+ }],
272
+ };
273
+ }
274
+ let billingNote = "";
275
+ if (injectionResult.billingFilled && injectionResult.billingDetails) {
276
+ const filled = injectionResult.billingDetails.filled;
277
+ const failed = injectionResult.billingDetails.failed;
278
+ billingNote = ` Billing filled: ${JSON.stringify(filled)}.`;
279
+ if (failed.length > 0)
280
+ billingNote += ` FAILED: ${JSON.stringify(failed)}.`;
281
+ }
282
+ return {
283
+ content: [{
284
+ type: "text",
285
+ text: `Payment approved and securely auto-injected into the browser form.${billingNote}${scanNote} Please proceed to click the submit/pay button. Masked card: ${maskedCard}`,
286
+ }],
287
+ };
288
+ }
241
289
  return {
242
290
  content: [
243
291
  {
@@ -266,13 +314,40 @@ async function main() {
266
314
  ],
267
315
  };
268
316
  }
317
+ if (!injector) {
318
+ return {
319
+ content: [{
320
+ type: "text",
321
+ text: "Billing info injection is not available. Ensure POP_AUTO_INJECT=true in ~/.config/pop-pay/.env and restart the MCP server.",
322
+ }],
323
+ };
324
+ }
325
+ const injectionResult = await injector.injectBillingOnly({
326
+ pageUrl: page_url,
327
+ approvedVendor: target_vendor,
328
+ });
329
+ if (injectionResult.blockedReason.startsWith("domain_mismatch:")) {
330
+ const actual = injectionResult.blockedReason.split(":", 2)[1];
331
+ return {
332
+ content: [{
333
+ type: "text",
334
+ text: `Blocked. Current page domain '${actual}' does not match approved vendor '${target_vendor}'. Do not retry.`,
335
+ }],
336
+ };
337
+ }
338
+ if (!injectionResult.billingFilled) {
339
+ return {
340
+ content: [{
341
+ type: "text",
342
+ text: "Could not find billing fields on the current page. Make sure you are on the billing/contact info page before calling this tool.",
343
+ }],
344
+ };
345
+ }
269
346
  return {
270
- content: [
271
- {
347
+ content: [{
272
348
  type: "text",
273
- text: `Billing info request acknowledged for '${target_vendor}'. Browser injection is not yet implemented in the TypeScript version. Please fill billing fields manually.`,
274
- },
275
- ],
349
+ text: `Billing info filled successfully for '${target_vendor}'. Name, address, email, and/or phone fields have been auto-populated. Proceed to the payment page and call request_virtual_card when card fields are visible.`,
350
+ }],
276
351
  };
277
352
  });
278
353
  server.tool("request_x402_payment", "Pay for an API call or service using the x402 HTTP payment protocol.", {
@@ -323,6 +398,28 @@ async function main() {
323
398
  ],
324
399
  };
325
400
  });
401
+ server.tool("page_snapshot", "Capture a security snapshot of a checkout page. Scans for hidden prompt injections, price mismatches, and redirect anomalies. Call before request_virtual_card to pre-validate checkout safety.", {
402
+ page_url: zod_1.z.string().describe("The checkout page URL to scan (must be https://)"),
403
+ }, async ({ page_url }) => {
404
+ const scanResult = await scanPage(page_url);
405
+ if (scanResult.error) {
406
+ return {
407
+ content: [{
408
+ type: "text",
409
+ text: `Snapshot failed: ${scanResult.error} Snapshot ID: ${scanResult.snapshotId}.`,
410
+ }],
411
+ };
412
+ }
413
+ const flagsSummary = scanResult.flags.length > 0
414
+ ? `Flags: ${scanResult.flags.join(", ")}.`
415
+ : "No flags detected.";
416
+ return {
417
+ content: [{
418
+ type: "text",
419
+ text: `Page snapshot complete. Safe: ${scanResult.safe}. ${flagsSummary} Snapshot ID: ${scanResult.snapshotId}.`,
420
+ }],
421
+ };
422
+ });
326
423
  // Start stdio transport
327
424
  const transport = new stdio_js_1.StdioServerTransport();
328
425
  await server.connect(transport);
package/dist/mcp-server.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";;AACA;;;GAGG;;AAEH,oEAAoE;AACpE,wEAAiF;AACjF,6BAAwB;AACxB,6CAAyC;AACzC,mCAAgC;AAChC,qCAAqC;AACrC,yCAAiC;AACjC,qCAAkC;AAGlC,2CAAwC;AACxC,+DAAgE;AAChE,6DAA+D;AAC/D,0DAAsE;AAGtE,KAAK,UAAU,IAAI;IAEnB,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAA,eAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,IAAA,eAAM,GAAE,CAAC;IACX,CAAC;IAED,yBAAyB;IACzB,IAAI,UAAU,GAA2B,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/F,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;YACD,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,kCAAkC;IAClC,IAAI,UAAU,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,UAAU,CAAC,WAAW,CAAC;IACnF,IAAI,UAAU,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,UAAU,CAAC,GAAG,CAAC;IAChE,IAAI,UAAU,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,UAAU,CAAC,SAAS,CAAC;IAClF,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,UAAU,CAAC,QAAQ,CAAC;IAE/E,gBAAgB;IAChB,MAAM,iBAAiB,GAAa,IAAI,CAAC,KAAK,CAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;IAEvD,MAAM,MAAM,GAAoB;QAC9B,iBAAiB;QACjB,cAAc,EAAE,QAAQ;QACxB,cAAc,EAAE,QAAQ;QACxB,uBAAuB,EAAE,UAAU;QACnC,UAAU;KACX,CAAC;IAEF,qBAAqB;IACrB,IAAI,QAA6B,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC7E,QAAQ,GAAG,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACvC,QAAQ,GAAG,IAAI,kCAAkB,EAAE,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,mCAAkB,EAAE,CAAC;IACtC,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAuB,CAAC;IAC5B,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACjG,MAAM,GAAG,IAAI,qBAAqB,CAChC,IAAI,kBAAkB,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE;YACzC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;YAClD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa;YACjD,WAAW,EAAE,IAAI;SAClB,CAAC,CACI,CAAC;IACX,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,+BAAe,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,qBAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,oCAAoC;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoE,CAAC;IAClG,MAAM,kBAAkB,GAAG,GAAG,CAAC;IAE/B,iCAAiC;IACjC,MAAM,eAAe,GACnB,0OAA0O,CAAC;IAC7O,MAAM,QAAQ,GAAG,2CAA2C,CAAC;IAE7D,KAAK,UAAU,QAAQ,CAAC,OAAe;QAMrC,MAAM,UAAU,GAAG,IAAA,wBAAU,GAAE,CAAC;QAChC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,aAAa;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACpF,CAAC;QAED,aAAa;QACb,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9F,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,wBAAwB;QACxB,MAAM,mBAAmB,GAAG;YAC1B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC9F,CAAC;QACF,IAAI,0BAA0B,GAAG,KAAK,CAAC;QACvC,IAAI,KAAK,CAAC;QACV,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7G,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3D,0BAA0B,GAAG,IAAI,CAAC;gBAClC,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,0BAA0B;YAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAE3E,iBAAiB;QACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAElD,QAAQ;QACR,IAAI,aAAa,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;YAC7C,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,UAAU,GAAG,QAAQ,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;oBACvC,MAAM,GAAG,CAAC,CAAC;oBACX,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,SAAS,eAAe,CAAC,GAAW;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,OAAO,mCAAmC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;IACb,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,sIAAsI,EACtI;QACE,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACvE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC1F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QACjE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KACtE,EACD,KAAK,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;QACjE,gBAAgB;QAChB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC;YACf,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtE,UAAU,GAAG;oBACX,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;oBAC5D,KAAK,EAAE,IAAI;iBACZ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,2CAA2C,UAAU,CAAC,KAAK,iBAAiB,UAAU,CAAC,UAAU,GAAG;yBAC3G;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,kFAAkF,UAAU,CAAC,UAAU,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;yBACnL;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,sDAAsD,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,gBAAgB;YACjC,YAAY,EAAE,aAAa;YAC3B,SAAS;YACT,OAAO,EAAE,QAAQ,IAAI,IAAI;SAC1B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,2CAA2C,IAAI,CAAC,eAAe,EAAE,EAAE;iBACnG;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACnD,MAAM,UAAU,GAAG,kBAAkB,KAAK,EAAE,CAAC;QAE7C,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,kCAAkC,UAAU,aAAa,IAAI,CAAC,cAAc,aAAa,IAAI,CAAC,gBAAgB,GAAG,QAAQ,EAAE;iBAClI;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,8KAA8K,EAC9K;QACE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACzE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC5D,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,QAAQ;YACzB,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,aAAa,GAAG,IAAA,2BAAW,EAAC,aAAa,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,WAAW,aAAa,+EAA+E;qBAC9G;iBACF;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,0CAA0C,aAAa,6GAA6G;iBAC3K;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,sEAAsE,EACtE;QACE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACzD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,6EAA6E;qBACpF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kDAAkD,SAAS,EAAE,EAAE;iBAC/F;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,gBAAgB;YACzB,eAAe,EAAE,MAAM;YACvB,YAAY,EAAE,WAAW;YACzB,SAAS;YACT,OAAO,EAAE,WAAW;SACrB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gDAAgD,IAAI,CAAC,eAAe,EAAE,EAAE;iBACxG;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,4CAA4C,IAAI,CAAC,MAAM,aAAa,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,WAAW,gEAAgE;iBACxL;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAEhC,CAAC,CAAC,WAAW;AAEb,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../src/mcp-server.ts"],"names":[],"mappings":";;AACA;;;GAGG;;AAEH,oEAAoE;AACpE,wEAAiF;AACjF,6BAAwB;AACxB,6CAAyC;AACzC,mCAAgC;AAChC,qCAAqC;AACrC,yCAAiC;AACjC,qCAAkC;AAGlC,2CAAwC;AACxC,+DAAgE;AAChE,6DAA+D;AAC/D,0DAAsE;AACtE,sDAA0D;AAG1D,KAAK,UAAU,IAAI;IAEnB,iDAAiD;IACjD,MAAM,SAAS,GAAG,IAAA,gBAAI,EAAC,IAAA,iBAAO,GAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAChE,IAAI,IAAA,oBAAU,EAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,IAAA,eAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IAC9B,CAAC;SAAM,CAAC;QACN,IAAA,eAAM,GAAE,CAAC;IACX,CAAC;IAED,yBAAyB;IACzB,IAAI,UAAU,GAA2B,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/F,IAAI,WAAW,EAAE,EAAE,CAAC;YAClB,MAAM,UAAU,GAAG,MAAM,kBAAkB,EAAE,CAAC;YAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;YACD,UAAU,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,kCAAkC;IAClC,IAAI,UAAU,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,UAAU,CAAC,WAAW,CAAC;IACnF,IAAI,UAAU,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,UAAU,CAAC,GAAG,CAAC;IAChE,IAAI,UAAU,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,UAAU,CAAC,SAAS,CAAC;IAClF,IAAI,UAAU,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,UAAU,CAAC,QAAQ,CAAC;IAE/E,gBAAgB;IAChB,MAAM,iBAAiB,GAAa,IAAI,CAAC,KAAK,CAC5C,OAAO,CAAC,GAAG,CAAC,sBAAsB,IAAI,uBAAuB,CAC9D,CAAC;IACF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACpF,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC;IAEvD,MAAM,MAAM,GAAoB;QAC9B,iBAAiB;QACjB,cAAc,EAAE,QAAQ;QACxB,cAAc,EAAE,QAAQ;QACxB,uBAAuB,EAAE,UAAU;QACnC,UAAU;KACX,CAAC;IAEF,qBAAqB;IACrB,IAAI,QAA6B,CAAC;IAClC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC7E,QAAQ,GAAG,IAAI,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACvC,QAAQ,GAAG,IAAI,kCAAkB,EAAE,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,IAAI,mCAAkB,EAAE,CAAC;IACtC,CAAC;IAED,mBAAmB;IACnB,IAAI,MAAuB,CAAC;IAC5B,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IACjF,IAAI,UAAU,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QACjG,MAAM,GAAG,IAAI,qBAAqB,CAChC,IAAI,kBAAkB,CAAC;YACrB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE;YACzC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,SAAS;YAClD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa;YACjD,WAAW,EAAE,IAAI;SAClB,CAAC,CACI,CAAC;IACX,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,IAAI,+BAAe,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,qBAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvD,qEAAqE;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,uBAAuB,CAAC;IAClE,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;IACrF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,gCAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEpE,oCAAoC;IACpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAoE,CAAC;IAClG,MAAM,kBAAkB,GAAG,GAAG,CAAC;IAE/B,iCAAiC;IACjC,MAAM,eAAe,GACnB,0OAA0O,CAAC;IAC7O,MAAM,QAAQ,GAAG,2CAA2C,CAAC;IAE7D,KAAK,UAAU,QAAQ,CAAC,OAAe;QAMrC,MAAM,UAAU,GAAG,IAAA,wBAAU,GAAE,CAAC;QAChC,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,aAAa;QACb,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACpF,CAAC;QAED,aAAa;QACb,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9F,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACxF,CAAC;QAED,wBAAwB;QACxB,MAAM,mBAAmB,GAAG;YAC1B,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;SAC9F,CAAC;QACF,IAAI,0BAA0B,GAAG,KAAK,CAAC;QACvC,IAAI,KAAK,CAAC;QACV,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7G,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC3D,0BAA0B,GAAG,IAAI,CAAC;gBAClC,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,0BAA0B;YAAE,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAE3E,iBAAiB;QACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAElD,QAAQ;QACR,IAAI,aAAa,CAAC,IAAI,IAAI,kBAAkB,EAAE,CAAC;YAC7C,IAAI,MAAM,GAAkB,IAAI,CAAC;YACjC,IAAI,UAAU,GAAG,QAAQ,CAAC;YAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,aAAa,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,UAAU,EAAE,CAAC;oBACvC,MAAM,GAAG,CAAC,CAAC;oBACX,UAAU,GAAG,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzE,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC,CAAC;QAC7D,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAED,SAAS,eAAe,CAAC,GAAW;QAClC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnD,OAAO,mCAAmC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa;IACb,MAAM,MAAM,GAAG,IAAI,kBAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAEpE,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,sIAAsI,EACtI;QACE,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACvE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,sDAAsD,CAAC;QAC1F,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;QACjE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2BAA2B,CAAC;KACtE,EACD,KAAK,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;QACjE,gBAAgB;QAChB,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC;YACf,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBACtE,UAAU,GAAG;oBACX,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,IAAI,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,8BAA8B,CAAC;oBAC5D,KAAK,EAAE,IAAI;iBACZ,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,CAAC;YACD,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,2CAA2C,UAAU,CAAC,KAAK,iBAAiB,UAAU,CAAC,UAAU,GAAG;yBAC3G;qBACF;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,kFAAkF,UAAU,CAAC,UAAU,YAAY,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;yBACnL;qBACF;iBACF,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,sDAAsD,CAAC;QACpE,CAAC;QAED,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,WAAW;YACpB,eAAe,EAAE,gBAAgB;YACjC,YAAY,EAAE,aAAa;YAC3B,SAAS;YACT,OAAO,EAAE,QAAQ,IAAI,IAAI;SAC1B,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,2CAA2C,IAAI,CAAC,eAAe,EAAE,EAAE;iBACnG;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;QACnD,MAAM,UAAU,GAAG,kBAAkB,KAAK,EAAE,CAAC;QAE7C,sDAAsD;QACtD,IAAI,QAAQ,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACnE,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC;gBACvD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,QAAQ;gBACjB,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;YAEH,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,CAAC;gBAChC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC1C,IAAI,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;oBACjE,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC9D,OAAO;wBACL,OAAO,EAAE,CAAC;gCACR,IAAI,EAAE,MAAe;gCACrB,IAAI,EAAE,mDAAmD,MAAM,qCAAqC,aAAa,kBAAkB;6BACpI,CAAC;qBACH,CAAC;gBACJ,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,CAAC;4BACR,IAAI,EAAE,MAAe;4BACrB,IAAI,EAAE,wKAAwK;yBAC/K,CAAC;iBACH,CAAC;YACJ,CAAC;YAED,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,eAAe,CAAC,aAAa,IAAI,eAAe,CAAC,cAAc,EAAE,CAAC;gBACpE,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC;gBACrD,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,MAAM,CAAC;gBACrD,WAAW,GAAG,oBAAoB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;gBAC5D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,WAAW,IAAI,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;YAC9E,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,qEAAqE,WAAW,GAAG,QAAQ,gEAAgE,UAAU,EAAE;qBAC9K,CAAC;aACH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,kCAAkC,UAAU,aAAa,IAAI,CAAC,cAAc,aAAa,IAAI,CAAC,gBAAgB,GAAG,QAAQ,EAAE;iBAClI;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,wBAAwB,EACxB,8KAA8K,EAC9K;QACE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;QACzE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC5D,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC;KACxE,EACD,KAAK,EAAE,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,EAAE;QAC/C,MAAM,UAAU,GAAG,QAAQ;YACzB,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,aAAa,GAAG,IAAA,2BAAW,EAAC,aAAa,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAChF,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,WAAW,aAAa,+EAA+E;qBAC9G;iBACF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,4HAA4H;qBACnI,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC;YACvD,OAAO,EAAE,QAAQ;YACjB,cAAc,EAAE,aAAa;SAC9B,CAAC,CAAC;QAEH,IAAI,eAAe,CAAC,aAAa,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,iCAAiC,MAAM,qCAAqC,aAAa,kBAAkB;qBAClH,CAAC;aACH,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,iIAAiI;qBACxI,CAAC;aACH,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,yCAAyC,aAAa,gKAAgK;iBAC7N,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,sBAAsB,EACtB,sEAAsE,EACtE;QACE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;KACzD,EACD,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,EAAE,CAAC;QACxD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,6EAA6E;qBACpF;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;QAC/C,IAAI,SAAS,EAAE,CAAC;YACd,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,kDAAkD,SAAS,EAAE,EAAE;iBAC/F;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAkB;YAC5B,OAAO,EAAE,gBAAgB;YACzB,eAAe,EAAE,MAAM;YACvB,YAAY,EAAE,WAAW;YACzB,SAAS;YACT,OAAO,EAAE,WAAW;SACrB,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEjD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,gDAAgD,IAAI,CAAC,eAAe,EAAE,EAAE;iBACxG;aACF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,4CAA4C,IAAI,CAAC,MAAM,aAAa,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,WAAW,gEAAgE;iBACxL;aACF;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,iMAAiM,EACjM;QACE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC;KAClF,EACD,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrB,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,CAAC;wBACR,IAAI,EAAE,MAAe;wBACrB,IAAI,EAAE,oBAAoB,UAAU,CAAC,KAAK,iBAAiB,UAAU,CAAC,UAAU,GAAG;qBACpF,CAAC;aACH,CAAC;QACJ,CAAC;QAED,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAC9C,CAAC,CAAC,UAAU,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC1C,CAAC,CAAC,oBAAoB,CAAC;QAEzB,OAAO;YACL,OAAO,EAAE,CAAC;oBACR,IAAI,EAAE,MAAe;oBACrB,IAAI,EAAE,iCAAiC,UAAU,CAAC,IAAI,KAAK,YAAY,iBAAiB,UAAU,CAAC,UAAU,GAAG;iBACjH,CAAC;SACH,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,wBAAwB;IACxB,MAAM,SAAS,GAAG,IAAI,+BAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAEhC,CAAC,CAAC,WAAW;AAEb,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
package/dist/providers/lithic.d.ts ADDED
@@ -0,0 +1,15 @@
1
+ import type { VirtualCardProvider } from "./base.js";
2
+ import type { PaymentIntent, GuardrailPolicy, VirtualSeal } from "../core/models.js";
3
+ /**
4
+ * LithicProvider — multi-issuer adapter skeleton for Lithic virtual cards.
5
+ *
6
+ * Lithic provides an API for issuing virtual debit and credit cards.
7
+ * This is a skeleton implementation; replace TODO sections with real API calls
8
+ * once the Lithic SDK integration is ready.
9
+ */
10
+ export declare class LithicProvider implements VirtualCardProvider {
11
+ private apiKey;
12
+ constructor(apiKey: string);
13
+ issueCard(intent: PaymentIntent, policy: GuardrailPolicy): Promise<VirtualSeal>;
14
+ }
15
+ //# sourceMappingURL=lithic.d.ts.map
package/dist/providers/lithic.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"lithic.d.ts","sourceRoot":"","sources":["../../src/providers/lithic.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErF;;;;;;GAMG;AACH,qBAAa,cAAe,YAAW,mBAAmB;IACxD,OAAO,CAAC,MAAM,CAAS;gBAEX,MAAM,EAAE,MAAM;IAIpB,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC;CAwBtF"}
package/dist/providers/lithic.js ADDED
@@ -0,0 +1,40 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", { value: true });
3
+ exports.LithicProvider = void 0;
4
+ const node_crypto_1 = require("node:crypto");
5
+ /**
6
+ * LithicProvider — multi-issuer adapter skeleton for Lithic virtual cards.
7
+ *
8
+ * Lithic provides an API for issuing virtual debit and credit cards.
9
+ * This is a skeleton implementation; replace TODO sections with real API calls
10
+ * once the Lithic SDK integration is ready.
11
+ */
12
+ class LithicProvider {
13
+ apiKey;
14
+ constructor(apiKey) {
15
+ this.apiKey = apiKey;
16
+ }
17
+ async issueCard(intent, policy) {
18
+ if (intent.requestedAmount > policy.maxAmountPerTx) {
19
+ return {
20
+ sealId: (0, node_crypto_1.randomUUID)(),
21
+ cardNumber: null,
22
+ cvv: null,
23
+ expirationDate: null,
24
+ authorizedAmount: 0.0,
25
+ status: "Rejected",
26
+ rejectionReason: "Amount exceeds policy limit",
27
+ };
28
+ }
29
+ // TODO: Replace with real Lithic API call
30
+ // const card = await lithicClient.cards.create({
31
+ // type: "VIRTUAL",
32
+ // spend_limit: Math.round(intent.requestedAmount * 100),
33
+ // spend_limit_duration: "TRANSACTION",
34
+ // });
35
+ throw new Error("LithicProvider is a skeleton — real Lithic API integration not yet implemented. " +
36
+ "Set POP_PROVIDER=stripe or POP_PROVIDER=byoc for working providers.");
37
+ }
38
+ }
39
+ exports.LithicProvider = LithicProvider;
40
+ //# sourceMappingURL=lithic.js.map
package/dist/providers/lithic.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"lithic.js","sourceRoot":"","sources":["../../src/providers/lithic.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAIzC;;;;;;GAMG;AACH,MAAa,cAAc;IACjB,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAqB,EAAE,MAAuB;QAC5D,IAAI,MAAM,CAAC,eAAe,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;YACnD,OAAO;gBACL,MAAM,EAAE,IAAA,wBAAU,GAAE;gBACpB,UAAU,EAAE,IAAI;gBAChB,GAAG,EAAE,IAAI;gBACT,cAAc,EAAE,IAAI;gBACpB,gBAAgB,EAAE,GAAG;gBACrB,MAAM,EAAE,UAAU;gBAClB,eAAe,EAAE,6BAA6B;aAC/C,CAAC;QACJ,CAAC;QAED,0CAA0C;QAC1C,iDAAiD;QACjD,qBAAqB;QACrB,2DAA2D;QAC3D,yCAAyC;QACzC,MAAM;QACN,MAAM,IAAI,KAAK,CACb,kFAAkF;YAClF,qEAAqE,CACtE,CAAC;IACJ,CAAC;CACF;AA/BD,wCA+BC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "pop-pay",
3
- "version": "0.1.0",
3
+ "version": "0.2.0",
4
4
  "description": "Point One Percent - Semantic Payment Guardrail for AI Agents. It only takes 0.1% of hallucination to drain 100% of your wallet.",
5
5
  "main": "dist/index.js",
6
6
  "types": "dist/index.d.ts",