@cmdoss/suipay-mcp 0.2.2-dev.1 → 0.2.2-dev.3

package/README.md

@@ -76,8 +76,13 @@ json: {"prompt":"a cat"}
 maxAmount: 50000
 ```
 
-`pay` uses SDK `createPayer` internally. A delivered image is returned as an MCP
-image block, not as a base64 wall in the JSON summary.
+`pay` uses SDK `createPayer` internally. A binary body is written once under
+`~/.suipay/deliveries/` and named first in the JSON as `savedTo` (absolute
+path) and `savedToUrl` (`file://`). Any MIME — image, audio, pdf,
+octet-stream. JSON stays compact (no base64 wall). An MCP `image` block is an
+extra display hint when the type is `image/*`; hosts such as Claude Code's
+TUI may not render it. Always quote `savedTo` to the user. Do not call `pay`
+again to "save" a delivery that already settled.
 
 ## Targets
 

package/dist/bin/suipay.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-K6WM4Z7H.js";
-import "../chunk-NVTYOOMY.js";
+} from "../chunk-C2IYSV43.js";
+import "../chunk-SRMAH6MK.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-K6WM4Z7H.js → chunk-C2IYSV43.js}

@@ -4,7 +4,7 @@ import {
   loadLocalSigningKeyRecord,
   loadMcpConfig,
   loadPaymentProfile
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-SRMAH6MK.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{chunk-NVTYOOMY.js → chunk-SRMAH6MK.js}

@@ -6872,6 +6872,52 @@ function joinDiscoverCatalog(opts) {
   return scoped ? { accessMode: "scoped", count: services.length, services, allowedTargetHashes } : { accessMode: "open", count: services.length, services };
 }
 
+// src/tool-result.ts
+import { pathToFileURL } from "url";
+
+// src/delivery-file.ts
+import { mkdirSync as mkdirSync2, writeFileSync, chmodSync as chmodSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+function mcpDeliveriesDir() {
+  return join3(dirname2(mcpCredentialsPath()), "deliveries");
+}
+var EXT = {
+  "image/png": ".png",
+  "image/jpeg": ".jpg",
+  "image/jpg": ".jpg",
+  "image/webp": ".webp",
+  "image/gif": ".gif",
+  "image/svg+xml": ".svg",
+  "audio/mpeg": ".mp3",
+  "audio/wav": ".wav",
+  "audio/ogg": ".ogg",
+  "video/mp4": ".mp4",
+  "application/pdf": ".pdf",
+  "application/json": ".json",
+  "text/plain": ".txt"
+};
+function extensionFor(contentType) {
+  const type = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  return EXT[type] ?? ".bin";
+}
+function fileStem(digest, challengeId) {
+  const raw = (digest ?? challengeId ?? `delivery-${Date.now()}`).trim();
+  const safe = raw.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return (safe.slice(0, 80) || `delivery-${Date.now()}`).replace(/^\.+$/, "delivery");
+}
+function saveDeliveredBody(input) {
+  if (input.bytes.byteLength === 0) return void 0;
+  const dir = mcpDeliveriesDir();
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const path = join3(
+    dir,
+    `${fileStem(input.digest, input.challengeId)}${extensionFor(input.contentType)}`
+  );
+  writeFileSync(path, input.bytes, { mode: 384 });
+  chmodSync2(path, 384);
+  return path;
+}
+
 // src/tool-result.ts
 var MAX_MCP_IMAGE_BYTES = 5 * 1024 * 1024;
 function text(value) {
@@ -6893,6 +6939,11 @@ function closedError(code, detail) {
 function closedPayError(code, detail) {
   return error({ status: "failed", paid: false, code, detail });
 }
+function receiptChallengeId(receipt) {
+  if (!receipt || typeof receipt !== "object") return void 0;
+  const id = receipt.challengeId;
+  return typeof id === "string" && id.length > 0 ? id : void 0;
+}
 function paidResult(result) {
   if (!isBinaryBody(result.body)) return text(result);
   const body = result.body;
@@ -6901,8 +6952,28 @@ function paidResult(result) {
     contentType: body.contentType,
     byteLength: body.byteLength
   };
+  let savedTo;
+  try {
+    savedTo = saveDeliveredBody({
+      bytes: body.bytes,
+      contentType: body.contentType,
+      digest: result.txDigest,
+      challengeId: receiptChallengeId(result.receipt)
+    });
+  } catch {
+    savedTo = void 0;
+  }
+  const payload = savedTo ? {
+    savedTo,
+    savedToUrl: pathToFileURL(savedTo).href,
+    ...result,
+    body: shape
+  } : { ...result, body: shape };
   const content = [
-    { type: "text", text: JSON.stringify({ ...result, body: shape }, null, 2) }
+    {
+      type: "text",
+      text: JSON.stringify(payload, null, 2)
+    }
   ];
   if (body.contentType.startsWith("image/") && body.bytes.byteLength > 0 && body.bytes.byteLength <= MAX_MCP_IMAGE_BYTES) {
     content.push({
@@ -7526,7 +7597,7 @@ var TOOLS = [
   },
   {
     name: "pay",
-    description: "Pay a HTTP resource via delegate. On hosted /mcp the gateway PREPARES an unsigned transaction and returns it (prepare-only \u2014 it never holds the delegate key and cannot settle). Only a process holding the delegate key the grant names can complete settlement (e.g. local stdio MCP, or any self-hosted process with the matching key). Pass recipient and/or maxAmount to state who you intend to pay and what you will spend; both are checked before anything is signed or handed back. Local V1 allowance pay is retired.",
+    description: "Pay a HTTP resource via delegate. On hosted /mcp the gateway PREPARES an unsigned transaction and returns it (prepare-only \u2014 it never holds the delegate key and cannot settle). Only a process holding the delegate key the grant names can complete settlement (e.g. local stdio MCP, or any self-hosted process with the matching key). Pass recipient and/or maxAmount to state who you intend to pay and what you will spend; both are checked before anything is signed or handed back. Local V1 allowance pay is retired. A paid binary body is written under ~/.suipay/deliveries/ and named as savedTo (absolute path) and savedToUrl (file://) at the top of the JSON. Always quote savedTo to the user so they can open the file. Do not assume the host rendered an image block. Never call pay again to display or save a delivery that already settled.",
     inputSchema: {
       type: "object",
       properties: {

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-SRMAH6MK.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.d.ts

@@ -340,11 +340,6 @@ interface StartedStdioLogin {
  */
 declare function startStdioLogin(opts: StdioLoginOptions): Promise<StartedStdioLogin>;
 
-/**
- * MCP tool payloads. Settlement honesty matches the playground stamp:
- * money that moved is never reported as a tool error (that invites a second pay).
- */
-
 type ToolResult = CallToolResult;
 
 interface ToolDeps {

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-K6WM4Z7H.js";
+} from "./chunk-C2IYSV43.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-NVTYOOMY.js";
+} from "./chunk-SRMAH6MK.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmdoss/suipay-mcp",
-  "version": "0.2.2-dev.1",
+  "version": "0.2.2-dev.3",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "main": "./dist/index.js",