@cmdoss/suipay-mcp 0.2.1 → 0.2.2

package/README.md

@@ -5,13 +5,13 @@ buyer-funded spend account. The buyer owns the account. The agent holds the
 delegate key and can spend only under the on-chain grant (recipient bind,
 per-payment cap, budget).
 
-Pin `@cmdoss/suipay-mcp@0.2.1` in MCP config. `1.0.1` remains on the
+Pin `@cmdoss/suipay-mcp@0.2.2` in MCP config. `1.0.1` remains on the
 registry as a historical release; do not install it for new agents.
 
 ## Install
 
 ```bash
-claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.1
+claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.2
 ```
 
 No wallet secret belongs in this command or MCP config. There is no

package/dist/bin/suipay.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-TPW6S2K4.js";
-import "../chunk-XZQOOY66.js";
+} from "../chunk-EM7PKWVL.js";
+import "../chunk-26NKQ37M.js";
 import "../chunk-A3JIIDYT.js";
 
 // src/bin/suipay.ts

package/dist/{chunk-XZQOOY66.js → chunk-26NKQ37M.js}

@@ -3650,7 +3650,7 @@ import {
 } from "fs";
 import { Ed25519Keypair as Ed25519Keypair2 } from "@mysten/sui/keypairs/ed25519";
 import { fromBase64 as fromBase643 } from "@mysten/sui/utils";
-import { bytesToHex as bytesToHex2 } from "@noble/hashes/utils";
+import { bytesToHex as bytesToHex2 } from "@noble/hashes/utils.js";
 
 // src/config.ts
 import { homedir } from "os";
@@ -3686,8 +3686,8 @@ function loadMcpConfig(env = process.env) {
 
 // src/crypto.ts
 import { getPublicKeyAsync, utils } from "@noble/ed25519";
-import { blake2b } from "@noble/hashes/blake2b";
-import { bytesToHex } from "@noble/hashes/utils";
+import { blake2b } from "@noble/hashes/blake2.js";
+import { bytesToHex } from "@noble/hashes/utils.js";
 var ED25519_FLAG = 0;
 function deriveSuiAddress(publicKey) {
   const data = new Uint8Array(1 + publicKey.length);
@@ -3758,6 +3758,28 @@ function loadCreds() {
   }
   return parsed;
 }
+function writeCredentialsFile(payload) {
+  const dir = credsDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {
+  }
+  const path = credsPath();
+  const tmp = join2(dir, `.credentials.${process.pid}.tmp`);
+  const fd = openSync(tmp, "w", 384);
+  try {
+    writeSync(fd, JSON.stringify(payload, null, 2));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
 function createCredentialsFileExclusive(payload) {
   const dir = credsDir();
   mkdirSync(dir, { recursive: true, mode: 448 });
@@ -3855,6 +3877,23 @@ function identityFromStored(privateKeyHex, publicKeyHex, address) {
   }
   return { delegateAddress: address, publicKeyHex };
 }
+function rewriteV1ToLocalSigningKey(creds, opts = {}) {
+  const identity = identityFromStored(
+    creds.delegatePrivateKey,
+    creds.delegatePublicKeyHex,
+    creds.delegateAddress
+  );
+  const record = {
+    version: 2,
+    delegatePrivateKey: creds.delegatePrivateKey,
+    delegatePublicKeyHex: creds.delegatePublicKeyHex,
+    delegateAddress: creds.delegateAddress,
+    createdAt: creds.createdAt,
+    ...opts.label?.trim() ? { label: opts.label.trim() } : creds.label?.trim() ? { label: creds.label.trim() } : {}
+  };
+  writeCredentialsFile(record);
+  return identity;
+}
 async function ensureLocalSigningKey(opts = {}) {
   const parsed = readCredentialsJson();
   if (parsed !== null) {
@@ -3866,11 +3905,7 @@ async function ensureLocalSigningKey(opts = {}) {
       );
     }
     if (isValid(parsed)) {
-      return identityFromStored(
-        parsed.delegatePrivateKey,
-        parsed.delegatePublicKeyHex,
-        parsed.delegateAddress
-      );
+      return rewriteV1ToLocalSigningKey(parsed, opts);
     }
     throw new Error(`credentials file at ${credsPath()} failed schema validation - refusing to continue`);
   }
@@ -3887,13 +3922,16 @@ async function ensureLocalSigningKey(opts = {}) {
     return { delegateAddress: kp.suiAddress, publicKeyHex: kp.publicKeyHex };
   }
   const winner = readCredentialsJson();
-  if (winner !== null && (isLocalSigningKeyRecord(winner) || isValid(winner))) {
+  if (winner !== null && isLocalSigningKeyRecord(winner)) {
     return identityFromStored(
       winner.delegatePrivateKey,
       winner.delegatePublicKeyHex,
       winner.delegateAddress
     );
   }
+  if (winner !== null && isValid(winner)) {
+    return rewriteV1ToLocalSigningKey(winner, opts);
+  }
   throw new Error(
     `credentials file at ${credsPath()} appeared during authorization but is unusable - refusing to continue`
   );
@@ -5313,8 +5351,18 @@ async function payStdioWithLocalKey(args) {
       });
     }
     const agentHeld = deps.agentHeld ?? settlementFromLocalSigner(cfg, local, packageId);
+    const grantCeiling = resolved.value.binding.maxPerPayment;
+    const maxAmount = intent.maxAmount !== void 0 ? intent.maxAmount.toString() : grantCeiling != null && grantCeiling !== "" ? grantCeiling : null;
+    if (maxAmount === null) {
+      return error({
+        status: "failed",
+        paid: false,
+        code: "POLICY_REJECTED",
+        detail: "stdio pay requires maxAmount or a grant maxPerPayment; refusing to default the ceiling to the offer"
+      });
+    }
     const spendIntent = {
-      maxAmount: intent.maxAmount !== void 0 ? intent.maxAmount.toString() : resolved.value.binding.maxPerPayment ?? result.signingRequest.amount,
+      maxAmount,
       asset: resolved.value.binding.coinType,
       ...intent.recipient ? { recipient: intent.recipient } : {}
     };

package/dist/{chunk-TPW6S2K4.js → chunk-EM7PKWVL.js}

@@ -2,7 +2,7 @@ import {
   createServer,
   loadMcpConfig,
   loadPaymentProfile
-} from "./chunk-XZQOOY66.js";
+} from "./chunk-26NKQ37M.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-XZQOOY66.js";
+} from "./chunk-26NKQ37M.js";
 import "./chunk-A3JIIDYT.js";
 export {
   handleSuipayMcpHttpRequest

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-TPW6S2K4.js";
+} from "./chunk-EM7PKWVL.js";
 import {
   PACKAGE_NAME,
   TOOLS,
@@ -20,7 +20,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-XZQOOY66.js";
+} from "./chunk-26NKQ37M.js";
 import "./chunk-A3JIIDYT.js";
 export {
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmdoss/suipay-mcp",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "main": "./dist/index.js",
@@ -34,12 +34,12 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@mysten/sui": "2.24.0",
     "@noble/ed25519": "^2.1.0",
-    "@noble/hashes": "^1.4.0",
+    "@noble/hashes": "^2.3.0",
     "open": "^11.0.0"
   },
   "devDependencies": {
     "tsup": "^8.0.0",
-    "typescript": "^5.9.0",
+    "typescript": "^6.0.3",
     "vitest": "^3.0.0"
   }
 }