@cmdoss/suipay-mcp 0.2.2-dev.1 → 0.2.2-dev.2

package/README.md

@@ -51,7 +51,7 @@ missing, expired, or revoked.
 | Tool | Purpose |
 | --- | --- |
 | `discover` | Search live gateway resources. After login: `name`, `path`, `url`, `targetHash`, catalog price, and `affordable` (can this session cover one call — not authorization). `pay({ url })` still settles |
-| `pay` | Fetch resource, prepare `spend_account` settlement, settle when this process holds the grant key |
+| `pay` | Fetch resource, prepare `spend_account` settlement, settle when this process holds the grant key. POST `json` is the paid body. Optional stdio `file` + `fileField` fill one JSON key from a local file as canonical base64 (Walrus `contentBase64`); hosted `/mcp` refuses `file` |
 | `receipts` | List settlement receipts, optionally by challenge ID |
 | `access_context` | Report current session / delegate / policy state (no secret material) |
 | `suipay_login` | Mint or reuse the local delegate key and return a clickable console URL (does not wait for the wallet). Default target is Railway suipay-dev; pass `target: "local"` for the laptop stack |
@@ -76,6 +76,16 @@ json: {"prompt":"a cat"}
 maxAmount: 50000
 ```
 
+To store local bytes (Walrus), do not paste base64. Name the file and field:
+
+```
+url: https://gateway.example/v1/storage/store
+method: POST
+json: {"contentType":"text/plain"}
+file: /absolute/path/to/note.txt
+fileField: contentBase64
+```
+
 `pay` uses SDK `createPayer` internally. A delivered image is returned as an MCP
 image block, not as a base64 wall in the JSON summary.
 

package/dist/bin/suipay.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-K6WM4Z7H.js";
-import "../chunk-NVTYOOMY.js";
+} from "../chunk-AFEXT5X4.js";
+import "../chunk-62LFIYB7.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-NVTYOOMY.js → chunk-62LFIYB7.js}

@@ -6918,6 +6918,115 @@ function settlePayResult(result) {
   return error(result);
 }
 
+// src/pay-file.ts
+import { isAbsolute } from "path";
+import { openSync as openSync2, closeSync as closeSync2, fstatSync, readFileSync as readFileSync2, constants } from "fs";
+var MCP_MAX_FILE_FIELD_BYTES = 32 * 1024;
+var FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+var FORBIDDEN = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+function fail2(code, detail) {
+  return { code, detail };
+}
+function parseField(value) {
+  if (typeof value !== "string" || !FIELD.test(value) || FORBIDDEN.has(value)) {
+    return fail2("INVALID_FILE_FIELD", "fileField must be a simple JSON key");
+  }
+  return value;
+}
+function parsePath(value) {
+  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
+    return fail2("INVALID_FILE", "file must be a non-empty absolute path");
+  }
+  if (!isAbsolute(value) || value.includes("://")) {
+    return fail2("INVALID_FILE", "file must be an absolute filesystem path, not a URL");
+  }
+  return value;
+}
+function readRegularFile(path) {
+  let fd;
+  try {
+    const flags = constants.O_RDONLY | (constants.O_NOFOLLOW !== void 0 ? constants.O_NOFOLLOW : 0);
+    fd = openSync2(path, flags);
+    const st = fstatSync(fd);
+    if (!st.isFile()) {
+      return fail2("INVALID_FILE", "file must be a regular file");
+    }
+    if (st.size === 0) {
+      return fail2("EMPTY_FILE", "file is empty");
+    }
+    if (st.size > MCP_MAX_FILE_FIELD_BYTES) {
+      return fail2(
+        "FILE_TOO_LARGE",
+        `file exceeds ${MCP_MAX_FILE_FIELD_BYTES} decoded bytes`
+      );
+    }
+    const bytes = readFileSync2(fd);
+    if (bytes.byteLength === 0) {
+      return fail2("EMPTY_FILE", "file is empty");
+    }
+    if (bytes.byteLength > MCP_MAX_FILE_FIELD_BYTES) {
+      return fail2(
+        "FILE_TOO_LARGE",
+        `file exceeds ${MCP_MAX_FILE_FIELD_BYTES} decoded bytes`
+      );
+    }
+    return bytes;
+  } catch (err) {
+    const code = err.code;
+    if (code === "ENOENT") return fail2("FILE_NOT_FOUND", "file does not exist");
+    if (code === "ELOOP" || code === "EMLINK") {
+      return fail2("INVALID_FILE", "file must be a regular file");
+    }
+    return fail2("INVALID_FILE", "file could not be read");
+  } finally {
+    if (fd !== void 0) closeSync2(fd);
+  }
+}
+function toCanonicalBase64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function jsonWithLocalFile(input) {
+  const hasFile = input.file !== void 0 && input.file !== null && input.file !== "";
+  const hasField = input.fileField !== void 0 && input.fileField !== null && input.fileField !== "";
+  if (!hasFile && !hasField) return { json: input.json };
+  if (hasFile !== hasField) {
+    return {
+      error: fail2(
+        "INVALID_FILE_ARGS",
+        "file and fileField are required together"
+      )
+    };
+  }
+  const method = input.method === void 0 || input.method === null || input.method === "" ? "GET" : String(input.method).trim().toUpperCase();
+  if (method !== "POST") {
+    return { error: fail2("INVALID_FILE_ARGS", "file is only valid on POST") };
+  }
+  const field = parseField(input.fileField);
+  if (typeof field !== "string") return { error: field };
+  const path = parsePath(input.file);
+  if (typeof path !== "string") return { error: path };
+  let json;
+  if (input.json === void 0) {
+    json = {};
+  } else if (typeof input.json === "object" && input.json !== null && !Array.isArray(input.json)) {
+    json = { ...input.json };
+  } else {
+    return { error: fail2("MALFORMED_REQUEST", "POST requires json object") };
+  }
+  if (Object.prototype.hasOwnProperty.call(json, field)) {
+    return {
+      error: fail2(
+        "FILE_FIELD_EXISTS",
+        "json already has fileField; refuse to overwrite"
+      )
+    };
+  }
+  const bytes = readRegularFile(path);
+  if (!(bytes instanceof Uint8Array)) return { error: bytes };
+  json[field] = toCanonicalBase64(bytes);
+  return { json };
+}
+
 // src/tools.ts
 function payerTrace(deps) {
   const hooks = deps.trace;
@@ -6996,15 +7105,27 @@ function intentViolation(intent, prepared) {
 }
 async function pay(args, cfg, deps = {}) {
   if (!args.url) return error("url is required");
+  const hasFileArg = args.file !== void 0 && args.file !== null && args.file !== "" || args.fileField !== void 0 && args.fileField !== null && args.fileField !== "";
+  if (hasFileArg && deps.auth) {
+    return closedPayError(
+      "FILE_STDIO_ONLY",
+      "file is stdio only; hosted /mcp does not read the buyer disk"
+    );
+  }
   let intent;
   try {
     intent = normalizePayIntent(args);
   } catch {
     return closedPayError("INVALID_INTENT", "payment intent is invalid");
   }
+  const attached = jsonWithLocalFile(args);
+  if ("error" in attached) {
+    return closedPayError(attached.error.code, attached.error.detail);
+  }
+  const paidArgs = { ...args, json: attached.json };
   let request;
   try {
-    request = normalizeMcpPaidHttpRequest(args);
+    request = normalizeMcpPaidHttpRequest(paidArgs);
   } catch (err) {
     const raw = err instanceof Error ? err.message : "";
     const detail = /method/i.test(raw) ? "method must be GET or POST" : /json/i.test(raw) ? "POST requires json" : "request could not be normalized";
@@ -7540,6 +7661,14 @@ var TOOLS = [
           type: "object",
           description: "JSON request body for a POST. Sent as application/json and bound to the payment."
         },
+        file: {
+          type: "string",
+          description: "Absolute local path whose bytes fill json[fileField] as canonical base64. Stdio only; requires fileField. GET must omit this."
+        },
+        fileField: {
+          type: "string",
+          description: "JSON key to set from file (e.g. contentBase64). Required with file. Must not already be present on json."
+        },
         recipient: {
           type: "string",
           description: "Sui address you expect to be paid. The payment is refused, unsigned, if the prepared transaction pays anyone else."
@@ -7678,6 +7807,8 @@ function createServer2(cfg, auth, trace, options = {}) {
               url: String(args.url ?? ""),
               ...args.method !== void 0 ? { method: args.method } : {},
               ...args.json !== void 0 ? { json: args.json } : {},
+              ...args.file !== void 0 ? { file: args.file } : {},
+              ...args.fileField !== void 0 ? { fileField: args.fileField } : {},
               ...args.recipient !== void 0 ? { recipient: args.recipient } : {},
               ...args.maxAmount !== void 0 ? { maxAmount: args.maxAmount } : {}
             },

package/dist/{chunk-K6WM4Z7H.js → chunk-AFEXT5X4.js}

@@ -4,7 +4,7 @@ import {
   loadLocalSigningKeyRecord,
   loadMcpConfig,
   loadPaymentProfile
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-62LFIYB7.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{http-B4YTVw0k.d.ts → http-IivHoDeb.d.ts}

@@ -282,6 +282,14 @@ declare const TOOLS: readonly [{
                 readonly type: "object";
                 readonly description: "JSON request body for a POST. Sent as application/json and bound to the payment.";
             };
+            readonly file: {
+                readonly type: "string";
+                readonly description: "Absolute local path whose bytes fill json[fileField] as canonical base64. Stdio only; requires fileField. GET must omit this.";
+            };
+            readonly fileField: {
+                readonly type: "string";
+                readonly description: "JSON key to set from file (e.g. contentBase64). Required with file. Must not already be present on json.";
+            };
             readonly recipient: {
                 readonly type: "string";
                 readonly description: "Sui address you expect to be paid. The payment is refused, unsigned, if the prepared transaction pays anyone else.";

package/dist/http.d.ts

@@ -1,4 +1,4 @@
-export { m as handleSuipayMcpHttpRequest } from './http-B4YTVw0k.js';
+export { m as handleSuipayMcpHttpRequest } from './http-IivHoDeb.js';
 import '@cmdoss/suipay-core/policy/grant-target';
 import '@cmdoss/suipay-sdk/mcp/access-context';
 import '@cmdoss/suipay-sdk/buyer/settlement-dto';

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-62LFIYB7.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { Wallet } from '@cmdoss/suipay-core/chain/types';
-import { M as McpConfig, a as McpAuthContext, b as McpTraceHooks } from './http-B4YTVw0k.js';
-export { A as AgentHeldResolver, c as AgentHeldSettlement, d as MCP_TARGET_PRESETS, e as McpEnvelope, f as McpEnvelopeEntry, g as McpServerOptions, h as McpTarget, i as McpTraceContext, j as McpTraceRuntime, P as PACKAGE_NAME, T as TOOLS, k as canonicalMcpRequestId, l as createServer, m as handleSuipayMcpHttpRequest, n as inspectMcpEnvelope, o as loadMcpConfig, p as parseMcpTargetFlag, r as resetAgentHeldProcessLedger, q as resolveAgentHeldSettlement, s as resolveMcpTarget, t as sameMcpGateway, u as traceMcpHttpRequest } from './http-B4YTVw0k.js';
+import { M as McpConfig, a as McpAuthContext, b as McpTraceHooks } from './http-IivHoDeb.js';
+export { A as AgentHeldResolver, c as AgentHeldSettlement, d as MCP_TARGET_PRESETS, e as McpEnvelope, f as McpEnvelopeEntry, g as McpServerOptions, h as McpTarget, i as McpTraceContext, j as McpTraceRuntime, P as PACKAGE_NAME, T as TOOLS, k as canonicalMcpRequestId, l as createServer, m as handleSuipayMcpHttpRequest, n as inspectMcpEnvelope, o as loadMcpConfig, p as parseMcpTargetFlag, r as resetAgentHeldProcessLedger, q as resolveAgentHeldSettlement, s as resolveMcpTarget, t as sameMcpGateway, u as traceMcpHttpRequest } from './http-IivHoDeb.js';
 import { GrantSnapshot } from '@cmdoss/suipay-core/policy/grant-target';
 export { resolveGrantTarget } from '@cmdoss/suipay-core/policy/grant-target';
 import { PaidHttpRequest } from '@cmdoss/suipay-sdk/protocol/paid-http-request';
@@ -382,6 +382,8 @@ declare function pay(args: {
     url: string;
     method?: unknown;
     json?: unknown;
+    file?: unknown;
+    fileField?: unknown;
     recipient?: unknown;
     maxAmount?: unknown;
 }, cfg: McpConfig, deps?: ToolDeps): Promise<ToolResult>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-K6WM4Z7H.js";
+} from "./chunk-AFEXT5X4.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-62LFIYB7.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmdoss/suipay-mcp",
-  "version": "0.2.2-dev.1",
+  "version": "0.2.2-dev.2",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "main": "./dist/index.js",