shabaaspay-mcp-server 1.0.5 → 1.0.7

package/dist/api/client.d.ts

@@ -59,6 +59,39 @@ export declare class ShabaasApiClient {
         amount: string | number;
         description?: string;
     }, options?: RequestAuthOptions): Promise<ApiResponse>;
+    initiateDirectDebitPublic(data: {
+        amount: string | number;
+        name: string;
+        consent_received: boolean | string;
+        bsb: string | number;
+        account_number: string | number;
+        phone_number?: string;
+        notes?: string;
+        destination?: unknown;
+    }, options?: RequestAuthOptions): Promise<ApiResponse>;
+    updateBilateralAgreement(data: {
+        id?: string;
+        phone_number?: string;
+        maximum_amount: string | number;
+        frequency: string;
+        agreement_type?: string;
+        number_of_transactions_permitted: number;
+    }, options?: RequestAuthOptions): Promise<ApiResponse>;
+    generateInvoice(data: {
+        uuid: string;
+        phone_number?: string;
+        invoice: {
+            amount: string | number;
+            description: string;
+            bill_to: string;
+            address: string;
+            receiver_abn: string;
+            ref_no: string;
+            gst_included: boolean;
+            gst_does_not_apply?: boolean;
+            email?: string;
+        };
+    }, options?: RequestAuthOptions): Promise<ApiResponse>;
     getPaymentLink(data: {
         amount: string;
         reference?: string;

package/dist/api/client.js

@@ -213,6 +213,49 @@ class ShabaasApiClient {
             return response.data;
         }, options?.requestUuid);
     }
+    async initiateDirectDebitPublic(data, options) {
+        return await this.withAuthRetry(async (token) => {
+            const amount = normalizeAmount(data.amount);
+            const response = await this.client.post('/api/public/payment_initiation/direct_debit', {
+                direct_debit: {
+                    name: data.name,
+                    amount,
+                    consent_received: data.consent_received,
+                    bsb: data.bsb,
+                    account_number: data.account_number,
+                    phone_number: data.phone_number,
+                    notes: data.notes,
+                },
+                destination: data.destination,
+            }, {
+                headers: {
+                    Authorization: token,
+                },
+            });
+            return response.data;
+        }, options?.requestUuid);
+    }
+    async updateBilateralAgreement(data, options) {
+        return await this.withAuthRetry(async (token) => {
+            const response = await this.client.patch('/api/public/payment_agreement/bilateral', {
+                payment_agreement: {
+                    id: data.id,
+                    phone_number: data.phone_number,
+                    maximum_amount: data.maximum_amount,
+                    frequency: data.frequency,
+                    agreement_type: data.agreement_type,
+                    number_of_transactions_permitted: data.number_of_transactions_permitted,
+                },
+            }, { headers: { Authorization: token } });
+            return response.data;
+        }, options?.requestUuid);
+    }
+    async generateInvoice(data, options) {
+        return await this.withAuthRetry(async (token) => {
+            const response = await this.client.post('/api/public/generate_invoice', data, { headers: { Authorization: token } });
+            return response.data;
+        }, options?.requestUuid);
+    }
     async getPaymentLink(data, options) {
         return await this.withAuthRetry(async (token) => {
             const response = await this.client.post('/api/get_url', data, {

package/dist/mcp-handler/discovery.js

@@ -274,6 +274,111 @@ async function listTools(env) {
                 ],
             },
         },
+        {
+            name: 'initiate_direct_debit',
+            description: 'Initiate a direct debit payment with account details and consent.',
+            ...sharedExecution,
+            openapi_operation: { method: 'post', path: '/api/public/payment_initiation/direct_debit' },
+            output_openapi_schema_ref: '#/components/schemas/SuccessPaymentInitiationResponse',
+            required_arguments: ['name', 'amount', 'consent_received', 'bsb', 'account_number'],
+            optional_arguments: ['phone_number', 'notes', 'destination', 'include_raw'],
+            argument_hints: {
+                consent_received: 'Must be true / "true".',
+            },
+            argument_schema: {
+                name: { type: 'string' },
+                amount: { oneOf: [{ type: 'number', exclusiveMinimum: 0 }, { type: 'string', pattern: '^\\d+(\\.\\d{1,2})?$' }] },
+                consent_received: { oneOf: [{ type: 'boolean' }, { type: 'string', enum: ['true', 'false'] }] },
+                bsb: { oneOf: [{ type: 'string' }, { type: 'number' }] },
+                account_number: { oneOf: [{ type: 'string' }, { type: 'number' }] },
+            },
+            example: {
+                tool: 'initiate_direct_debit',
+                arguments: { name: 'John Citizen', amount: '10.00', consent_received: true, bsb: '062000', account_number: '12345678' },
+            },
+            decision_guidance: {
+                when_to_use: 'Use to create a direct debit payment initiation from account details.',
+                preconditions: ['name, amount, consent_received, bsb, account_number'],
+                retryable_errors: ['AUTH_MISSING_OR_INVALID'],
+                non_retryable_errors: ['INVALID_REQUEST', 'BUSINESS_RULE_FAILURE'],
+                next_best_tool_on_failure: 'get_payment_initiation',
+            },
+            idempotency_notes: 'Creates a new payment initiation and is non-idempotent without caller deduplication.',
+            error_contract: [
+                { status: 400, code: 'INVALID_REQUEST', when: 'Malformed direct_debit payload or missing required fields' },
+                { status: 401, code: 'AUTH_MISSING_OR_INVALID', when: 'Session/API key missing or invalid' },
+                { status: 422, code: 'BUSINESS_RULE_FAILURE', when: 'Consent/amount/cooldown or provider validation failed' },
+            ],
+        },
+        {
+            name: 'update_bilateral_agreement',
+            description: 'Update bilateral parameters for a payment agreement.',
+            ...sharedExecution,
+            openapi_operation: { method: 'patch', path: '/api/public/payment_agreement/bilateral' },
+            output_openapi_schema_ref: '#/components/schemas/SuccessPaymentAgreementResponse',
+            required_arguments: ['maximum_amount', 'frequency', 'number_of_transactions_permitted'],
+            optional_arguments: ['id', 'phone_number', 'agreement_type', 'include_raw'],
+            argument_hints: {
+                frequency: 'Use supported stored codes like ADHO, DAIL, FRTN, INDA, MIAN, MNTH, QURT, WEEK, YEAR.',
+            },
+            argument_schema: {
+                id: { type: 'string' },
+                phone_number: { type: 'string' },
+                maximum_amount: { oneOf: [{ type: 'string' }, { type: 'number' }] },
+                frequency: { type: 'string' },
+                number_of_transactions_permitted: { type: 'integer', minimum: 1 },
+            },
+            example: {
+                tool: 'update_bilateral_agreement',
+                arguments: { id: '2882PA20251227045450257', maximum_amount: '100.00', frequency: 'MNTH', number_of_transactions_permitted: 2 },
+            },
+            decision_guidance: {
+                when_to_use: 'Use to amend bilateral parameters on an existing payment agreement.',
+                preconditions: ['id or phone_number, maximum_amount, frequency, number_of_transactions_permitted'],
+                retryable_errors: ['AUTH_MISSING_OR_INVALID'],
+                non_retryable_errors: ['RESOURCE_NOT_FOUND', 'VALIDATION_OR_BUSINESS_RULE'],
+                next_best_tool_on_failure: 'get_payment_agreement',
+            },
+            idempotency_notes: 'Updates agreement settings and is non-idempotent under concurrent updates.',
+            error_contract: [
+                { status: 400, code: 'INVALID_REQUEST', when: 'Malformed bilateral amend payload' },
+                { status: 401, code: 'AUTH_MISSING_OR_INVALID', when: 'Session/API key missing or invalid' },
+                { status: 404, code: 'RESOURCE_NOT_FOUND', when: 'Payment agreement not found' },
+                { status: 422, code: 'VALIDATION_OR_BUSINESS_RULE', when: 'Amount/rule validation failed' },
+            ],
+        },
+        {
+            name: 'generate_invoice',
+            description: 'Generate checkout URL for invoice flow.',
+            ...sharedExecution,
+            openapi_operation: { method: 'post', path: '/api/public/generate_invoice' },
+            output_openapi_schema_ref: 'inline: { message, data: { checkout_url } }',
+            required_arguments: ['uuid', 'invoice'],
+            optional_arguments: ['phone_number', 'include_raw'],
+            argument_hints: {
+                uuid: 'Merchant checkout username.',
+            },
+            example: {
+                tool: 'generate_invoice',
+                arguments: {
+                    uuid: 'merchant_slug_or_secret',
+                    invoice: { amount: '50.00', description: 'Invoice 1001', bill_to: 'Customer', address: 'Address', receiver_abn: 'ABN', ref_no: '1001', gst_included: true },
+                },
+            },
+            decision_guidance: {
+                when_to_use: 'Use to generate invoice checkout URL for external collection flow.',
+                preconditions: ['uuid and invoice payload'],
+                retryable_errors: ['AUTH_MISSING_OR_INVALID'],
+                non_retryable_errors: ['INVALID_REQUEST', 'VALIDATION_OR_BUSINESS_RULE'],
+                next_best_tool_on_failure: null,
+            },
+            idempotency_notes: 'Creates a new invoice checkout URL/session per call; treat as non-idempotent.',
+            error_contract: [
+                { status: 400, code: 'INVALID_REQUEST', when: 'Invalid uuid or invoice payload shape' },
+                { status: 401, code: 'AUTH_MISSING_OR_INVALID', when: 'Session/API key missing or invalid' },
+                { status: 422, code: 'VALIDATION_OR_BUSINESS_RULE', when: 'Invoice validation/business rule failure' },
+            ],
+        },
     ];
     if (!prod) {
         toolsList.push({

package/dist/mcp-handler/mcp.js

@@ -49,24 +49,39 @@ function buildAllowedToolsList(policy, env) {
     const allTools = [
         {
             name: 'get_payment_agreement',
-            description: `Retrieve payment agreement details with AI insights.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Retrieve payment agreement details with AI insights.',
             inputSchema: httpMcpToolSchema(index_js_2.GetPaymentAgreementInputSchema),
         },
         {
             name: 'create_payment_agreement',
-            description: `Create a new payment agreement.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Create a new payment agreement.',
             inputSchema: httpMcpToolSchema(index_js_2.CreatePaymentAgreementInputSchema),
         },
         {
             name: 'initiate_payment',
-            description: `Initiate a payment against an agreement.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Initiate a payment against an agreement.',
             inputSchema: httpMcpToolSchema(index_js_2.InitiatePaymentInputSchema),
         },
         {
             name: 'get_payment_initiation',
-            description: `Retrieve payment initiation by ID.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Retrieve payment initiation by ID.',
             inputSchema: httpMcpToolSchema(index_js_2.GetPaymentInitiationInputSchema),
         },
+        {
+            name: 'initiate_direct_debit',
+            description: 'Initiate direct debit using account details and consent.',
+            inputSchema: httpMcpToolSchema(index_js_2.InitiateDirectDebitInputSchema),
+        },
+        {
+            name: 'update_bilateral_agreement',
+            description: 'Update bilateral configuration of a payment agreement.',
+            inputSchema: httpMcpToolSchema(index_js_2.UpdateBilateralAgreementInputSchema),
+        },
+        {
+            name: 'generate_invoice',
+            description: 'Generate invoice checkout URL for external invoice flow.',
+            inputSchema: httpMcpToolSchema(index_js_2.GenerateInvoiceInputSchema),
+        },
         ...(env.SHABAAS_ENVIRONMENT === 'production'
             ? []
             : [{

package/dist/mcp-handler/schema-helpers.d.ts

@@ -3,6 +3,4 @@
  * Remote HTTP clients authenticate via the connection (OAuth / Authorization header);
  * omitting `authorization` from published inputSchema avoids agents prompting users for keys.
  */
-/** Appended to tool descriptions for streamable HTTP ListTools so agents do not prompt for API keys. */
-export declare const HTTP_MCP_SESSION_AUTH_HINT = " Remote MCP (HTTP): session is authenticated via OAuth or Authorization header\u2014do not ask the user for an API key.";
 export declare function stripAuthorizationFieldFromJsonSchema(schema: unknown): unknown;

package/dist/mcp-handler/schema-helpers.js

@@ -5,10 +5,7 @@
  * omitting `authorization` from published inputSchema avoids agents prompting users for keys.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HTTP_MCP_SESSION_AUTH_HINT = void 0;
 exports.stripAuthorizationFieldFromJsonSchema = stripAuthorizationFieldFromJsonSchema;
-/** Appended to tool descriptions for streamable HTTP ListTools so agents do not prompt for API keys. */
-exports.HTTP_MCP_SESSION_AUTH_HINT = ' Remote MCP (HTTP): session is authenticated via OAuth or Authorization header—do not ask the user for an API key.';
 function stripAuthorizationFieldFromJsonSchema(schema) {
     if (!schema || typeof schema !== 'object')
         return schema;

package/dist/mcp-handler/server-card.js

@@ -32,7 +32,7 @@ function buildServerCard(env) {
     const tools = [
         {
             name: 'get_payment_agreement',
-            description: `Retrieve payment agreement details with AI insights.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Retrieve payment agreement details with AI insights.',
             inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.GetPaymentAgreementInputSchema))),
             metadata: {
                 schemaVersion: '2026-04-15',
@@ -50,7 +50,7 @@ function buildServerCard(env) {
         },
         {
             name: 'create_payment_agreement',
-            description: `Create a new payment agreement.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Create a new payment agreement.',
             inputSchema: withCreatePaymentAgreementConditionals(toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.CreatePaymentAgreementInputSchema)))),
             metadata: {
                 schemaVersion: '2026-04-15',
@@ -69,7 +69,7 @@ function buildServerCard(env) {
         },
         {
             name: 'initiate_payment',
-            description: `Initiate a payment against an agreement.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Initiate a payment against an agreement.',
             inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.InitiatePaymentInputSchema))),
             metadata: {
                 schemaVersion: '2026-04-15',
@@ -88,7 +88,7 @@ function buildServerCard(env) {
         },
         {
             name: 'get_payment_initiation',
-            description: `Retrieve payment initiation by ID.${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Retrieve payment initiation by ID.',
             inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.GetPaymentInitiationInputSchema))),
             metadata: {
                 schemaVersion: '2026-04-15',
@@ -104,12 +104,51 @@ function buildServerCard(env) {
             },
             annotations: { readOnlyHint: true, idempotentHint: true, openWorldHint: false },
         },
+        {
+            name: 'initiate_direct_debit',
+            description: 'Initiate direct debit using account details and explicit consent.',
+            inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.InitiateDirectDebitInputSchema))),
+            metadata: {
+                schemaVersion: '2026-04-15',
+                requiredArguments: ['name', 'amount', 'consent_received', 'bsb', 'account_number'],
+                optionalArguments: ['phone_number', 'notes', 'destination', 'include_raw'],
+                openapiOperation: { method: 'post', path: '/api/public/payment_initiation/direct_debit' },
+                outputSchemaRef: '#/components/schemas/SuccessPaymentInitiationResponse',
+            },
+            annotations: { readOnlyHint: false, idempotentHint: false, openWorldHint: false },
+        },
+        {
+            name: 'update_bilateral_agreement',
+            description: 'Update bilateral terms for an existing payment agreement.',
+            inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.UpdateBilateralAgreementInputSchema))),
+            metadata: {
+                schemaVersion: '2026-04-15',
+                requiredArguments: ['maximum_amount', 'frequency', 'number_of_transactions_permitted'],
+                optionalArguments: ['id', 'phone_number', 'agreement_type', 'include_raw'],
+                openapiOperation: { method: 'patch', path: '/api/public/payment_agreement/bilateral' },
+                outputSchemaRef: '#/components/schemas/SuccessPaymentAgreementResponse',
+            },
+            annotations: { readOnlyHint: false, idempotentHint: false, openWorldHint: false },
+        },
+        {
+            name: 'generate_invoice',
+            description: 'Generate external invoice checkout URL.',
+            inputSchema: toStrictObjectSchema((0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(index_js_1.GenerateInvoiceInputSchema))),
+            metadata: {
+                schemaVersion: '2026-04-15',
+                requiredArguments: ['uuid', 'invoice'],
+                optionalArguments: ['phone_number', 'include_raw'],
+                openapiOperation: { method: 'post', path: '/api/public/generate_invoice' },
+                outputSchemaRef: 'inline: { message, data: { checkout_url } }',
+            },
+            annotations: { readOnlyHint: false, idempotentHint: false, openWorldHint: false },
+        },
     ];
     const isProduction = env.SHABAAS_ENVIRONMENT === 'production';
     if (!isProduction) {
         tools.push({
             name: 'get_auth_token',
-            description: `Get ShaBaas API authorization token (non-production helper).${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+            description: 'Get ShaBaas API authorization token (non-production helper).',
             inputSchema: {
                 type: 'object',
                 additionalProperties: false,
@@ -170,6 +209,37 @@ function buildServerCard(env) {
                     { name: 'payment_initiation_id', description: 'Optional initiation ID', required: false },
                 ],
             },
+            {
+                name: 'initiate_direct_debit',
+                description: 'Draft direct debit parameters, then call initiate_direct_debit with validated account and consent fields.',
+                arguments: [
+                    { name: 'name', description: 'Account holder name', required: true },
+                    { name: 'amount', description: 'Debit amount (e.g. 10.00)', required: true },
+                    { name: 'consent_received', description: 'Must be true', required: true },
+                    { name: 'bsb', description: 'Payer BSB', required: true },
+                    { name: 'account_number', description: 'Payer account number', required: true },
+                ],
+            },
+            {
+                name: 'update_bilateral_agreement',
+                description: 'Prepare bilateral amendment fields and call update_bilateral_agreement for an existing payment agreement.',
+                arguments: [
+                    { name: 'id', description: 'Payment agreement id (or use phone_number)', required: false },
+                    { name: 'phone_number', description: 'Alternative payer lookup', required: false },
+                    { name: 'maximum_amount', description: 'Updated maximum amount', required: true },
+                    { name: 'frequency', description: 'Frequency code (e.g. WEEK, MNTH)', required: true },
+                    { name: 'number_of_transactions_permitted', description: 'Allowed transaction count', required: true },
+                ],
+            },
+            {
+                name: 'generate_invoice',
+                description: 'Draft invoice payload and call generate_invoice to get an external checkout URL.',
+                arguments: [
+                    { name: 'uuid', description: 'Merchant checkout username or secret', required: true },
+                    { name: 'invoice', description: 'Invoice object with amount and description', required: true },
+                    { name: 'phone_number', description: 'Optional customer phone', required: false },
+                ],
+            },
         ],
         metadata: {
             schemaVersion: '2026-04-15',

package/dist/mcp-handler/tools/implementations.d.ts

@@ -15,3 +15,6 @@ export declare function createPaymentAgreement(args: any, baseUrl: string, env:
 export declare function initiatePayment(args: any, baseUrl: string, env: Env, bearer: string, requestId: string): Promise<Response>;
 /** get_payment_initiation: GET initiation status by ID */
 export declare function getPaymentInitiation(args: any, baseUrl: string, env: Env, bearer: string): Promise<Response>;
+export declare function initiateDirectDebit(args: any, baseUrl: string, env: Env, bearer: string, requestId: string): Promise<Response>;
+export declare function updateBilateralAgreement(args: any, baseUrl: string, env: Env, bearer: string): Promise<Response>;
+export declare function generateInvoice(args: any, baseUrl: string, env: Env, bearer: string): Promise<Response>;

package/dist/mcp-handler/tools/implementations.js

@@ -11,6 +11,9 @@ exports.getPaymentAgreement = getPaymentAgreement;
 exports.createPaymentAgreement = createPaymentAgreement;
 exports.initiatePayment = initiatePayment;
 exports.getPaymentInitiation = getPaymentInitiation;
+exports.initiateDirectDebit = initiateDirectDebit;
+exports.updateBilateralAgreement = updateBilateralAgreement;
+exports.generateInvoice = generateInvoice;
 const shabaas_api_client_js_1 = require("../shabaas-api-client.js");
 const utils_js_1 = require("../utils.js");
 const index_js_1 = require("../../enricher/index.js");
@@ -304,3 +307,134 @@ async function getPaymentInitiation(args, baseUrl, env, bearer) {
         return (0, utils_js_1.jsonResponse)({ success: false, error: 'Not found', message: 'Payment initiation not found.' }, 404, env);
     }
 }
+async function initiateDirectDebit(args, baseUrl, env, bearer, requestId) {
+    const amountNum = Number(args.amount);
+    if (!Number.isFinite(amountNum) || amountNum <= 0) {
+        return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Invalid amount', message: 'Amount must be greater than zero' }, 400, env), requestId);
+    }
+    if (!args.name || !args.bsb || !args.account_number) {
+        return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Invalid request', message: 'name, bsb, and account_number are required' }, 400, env), requestId);
+    }
+    const consent = args.consent_received === true || String(args.consent_received).toLowerCase() === 'true';
+    if (!consent) {
+        return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Invalid request', message: 'consent_received must be true' }, 400, env), requestId);
+    }
+    try {
+        const startTime = Date.now();
+        const includeRaw = args.include_raw === true;
+        const response = await fetch(`${baseUrl}/api/public/payment_initiation/direct_debit`, {
+            method: 'POST',
+            headers: { 'Authorization': bearer, 'Content-Type': 'application/json', 'X-Shabaas-Client': 'mcp' },
+            body: JSON.stringify({
+                direct_debit: {
+                    name: args.name,
+                    amount: amountNum,
+                    consent_received: true,
+                    bsb: args.bsb,
+                    account_number: args.account_number,
+                    phone_number: args.phone_number,
+                    notes: args.notes,
+                },
+                destination: args.destination,
+            }),
+        });
+        const data = await response.json();
+        if (!response.ok) {
+            return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ success: false, error: data.error_code || 'Request failed', message: data.message || 'Failed to initiate direct debit', data: data.data }, response.status, env), requestId);
+        }
+        return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({
+            success: true,
+            timestamp: new Date().toISOString(),
+            data: data.data,
+            metadata: {
+                requestId: `req_${Date.now()}`,
+                processingTime: Date.now() - startTime,
+                environment: env.SHABAAS_ENVIRONMENT === 'production' ? 'production' : 'sandbox',
+            },
+            insights: { status: data.data?.status || 'submitted', canProceed: true, nextActions: ['get_payment_initiation'] },
+            summary: 'Direct debit request submitted successfully.',
+            ...(includeRaw ? { raw: data } : {}),
+        }, response.status, env), requestId);
+    }
+    catch (error) {
+        return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Request failed', message: error.message || 'An error occurred' }, 500, env), requestId);
+    }
+}
+async function updateBilateralAgreement(args, baseUrl, env, bearer) {
+    if (!args.id && !args.phone_number) {
+        return (0, utils_js_1.jsonResponse)({ error: 'Invalid request', message: 'Either id or phone_number is required' }, 400, env);
+    }
+    try {
+        const startTime = Date.now();
+        const includeRaw = args.include_raw === true;
+        const response = await fetch(`${baseUrl}/api/public/payment_agreement/bilateral`, {
+            method: 'PATCH',
+            headers: { 'Authorization': bearer, 'Content-Type': 'application/json', 'X-Shabaas-Client': 'mcp' },
+            body: JSON.stringify({
+                payment_agreement: {
+                    id: args.id,
+                    phone_number: args.phone_number,
+                    maximum_amount: args.maximum_amount,
+                    frequency: args.frequency,
+                    agreement_type: args.agreement_type,
+                    number_of_transactions_permitted: args.number_of_transactions_permitted,
+                },
+            }),
+        });
+        const data = await response.json();
+        if (!response.ok) {
+            return (0, utils_js_1.jsonResponse)({ success: false, error: data.error_code || 'Request failed', message: data.message || 'Failed to update bilateral agreement', data: data.data }, response.status, env);
+        }
+        return (0, utils_js_1.jsonResponse)({
+            success: true,
+            timestamp: new Date().toISOString(),
+            data: data.data,
+            metadata: {
+                requestId: `req_${Date.now()}`,
+                processingTime: Date.now() - startTime,
+                environment: env.SHABAAS_ENVIRONMENT === 'production' ? 'production' : 'sandbox',
+            },
+            insights: { status: 'updated', canProceed: true, nextActions: ['get_payment_agreement'] },
+            summary: 'Bilateral agreement update submitted successfully.',
+            ...(includeRaw ? { raw: data } : {}),
+        }, response.status, env);
+    }
+    catch (error) {
+        return (0, utils_js_1.jsonResponse)({ error: 'Request failed', message: error.message || 'An error occurred' }, 500, env);
+    }
+}
+async function generateInvoice(args, baseUrl, env, bearer) {
+    try {
+        const startTime = Date.now();
+        const includeRaw = args.include_raw === true;
+        const response = await fetch(`${baseUrl}/api/public/generate_invoice`, {
+            method: 'POST',
+            headers: { 'Authorization': bearer, 'Content-Type': 'application/json', 'X-Shabaas-Client': 'mcp' },
+            body: JSON.stringify({
+                uuid: args.uuid,
+                phone_number: args.phone_number,
+                invoice: args.invoice,
+            }),
+        });
+        const data = await response.json();
+        if (!response.ok) {
+            return (0, utils_js_1.jsonResponse)({ success: false, error: data.error_code || 'Request failed', message: data.message || 'Failed to generate invoice', data: data.data }, response.status, env);
+        }
+        return (0, utils_js_1.jsonResponse)({
+            success: true,
+            timestamp: new Date().toISOString(),
+            data: data.data,
+            metadata: {
+                requestId: `req_${Date.now()}`,
+                processingTime: Date.now() - startTime,
+                environment: env.SHABAAS_ENVIRONMENT === 'production' ? 'production' : 'sandbox',
+            },
+            insights: { status: 'created', canProceed: true, nextActions: ['generate_invoice'] },
+            summary: 'Invoice checkout URL generated successfully.',
+            ...(includeRaw ? { raw: data } : {}),
+        }, response.status, env);
+    }
+    catch (error) {
+        return (0, utils_js_1.jsonResponse)({ error: 'Request failed', message: error.message || 'An error occurred' }, 500, env);
+    }
+}

package/dist/mcp-handler/tools/index.js

@@ -24,7 +24,13 @@ const AUTH_REQUIRED_HTTP_MESSAGE = 'No API key on this MCP session. For remote H
 const AUTH_REQUIRED_INVALID_KEY_MESSAGE = 'API key was rejected or could not be exchanged for a session token. For HTTP MCP, fix the Authorization header or OAuth token; for stdio, pass a valid "authorization" in tool arguments.';
 /** True if tool performs a write (create, initiate) - needs extra validation */
 function isWriteTool(toolName) {
-    return toolName === 'create_payment_agreement' || toolName === 'initiate_payment';
+    return [
+        'create_payment_agreement',
+        'initiate_payment',
+        'initiate_direct_debit',
+        'update_bilateral_agreement',
+        'generate_invoice',
+    ].includes(toolName);
 }
 /** Validate write tool args (e.g. amount > 0 for initiate_payment) */
 function validateWriteConstraints(toolName, args, env, requestId) {
@@ -36,6 +42,12 @@ function validateWriteConstraints(toolName, args, env, requestId) {
             return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Invalid amount', message: 'Amount must be greater than zero' }, 400, env), requestId);
         }
     }
+    if (toolName === 'initiate_direct_debit') {
+        const amountNum = Number(args?.amount);
+        if (!Number.isFinite(amountNum) || amountNum <= 0) {
+            return (0, utils_js_1.withRequestId)((0, utils_js_1.jsonResponse)({ error: 'Invalid amount', message: 'Amount must be greater than zero' }, 400, env), requestId);
+        }
+    }
     return undefined;
 }
 /**
@@ -112,6 +124,15 @@ async function runToolInvocation(toolName, args, env, policy, authToken, request
         case 'get_payment_initiation':
             resp = await (0, implementations_js_1.getPaymentInitiation)(args, baseUrl, env, bearer);
             break;
+        case 'initiate_direct_debit':
+            resp = await (0, implementations_js_1.initiateDirectDebit)(args, baseUrl, env, bearer, requestId);
+            break;
+        case 'update_bilateral_agreement':
+            resp = await (0, implementations_js_1.updateBilateralAgreement)(args, baseUrl, env, bearer);
+            break;
+        case 'generate_invoice':
+            resp = await (0, implementations_js_1.generateInvoice)(args, baseUrl, env, bearer);
+            break;
         default:
             return {
                 status: 404,

package/dist/server/http-server.js

@@ -474,7 +474,7 @@ class HttpMcpServer {
         this.mcpServer.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
             const toolsList = Object.values(this.tools).map(tool => ({
                 name: tool.name,
-                description: `${tool.description ?? ''}${schema_helpers_js_1.HTTP_MCP_SESSION_AUTH_HINT}`,
+                description: tool.description ?? '',
                 inputSchema: (0, schema_helpers_js_1.stripAuthorizationFieldFromJsonSchema)((0, zod_to_json_schema_1.zodToJsonSchema)(tool.inputSchema)),
             }));
             console.log(`[HTTP][MCP] Listing ${toolsList.length} tools`);

package/dist/tools/capability-prompts.d.ts

@@ -0,0 +1,16 @@
+import { ShabaasApiClient } from '../api/client.js';
+import { Config } from '../config/index.js';
+export declare function createCapabilityPromptTools(_apiClient: ShabaasApiClient, config: Config): {
+    get_capability_prompts: {
+        name: string;
+        description: string;
+        inputSchema: import("zod").ZodObject<{
+            capability: import("zod").ZodDefault<import("zod").ZodOptional<import("zod").ZodEnum<["all", "direct_debit", "bilateral_api", "invoice_generation", "collections_api"]>>>;
+        }, "strip", import("zod").ZodTypeAny, {
+            capability: "all" | "direct_debit" | "bilateral_api" | "invoice_generation" | "collections_api";
+        }, {
+            capability?: "all" | "direct_debit" | "bilateral_api" | "invoice_generation" | "collections_api" | undefined;
+        }>;
+        execute: (args: unknown) => Promise<import("../types/index.js").StandardResponse<unknown>>;
+    };
+};