@cmdoss/suipay-mcp 0.2.2-dev.10 → 0.2.2-dev.11

package/README.md

@@ -5,15 +5,21 @@ buyer-funded spend account. The buyer owns the account. The agent holds the
 delegate key and can spend only under the on-chain grant (recipient bind,
 per-payment cap, budget).
 
-Pin `@cmdoss/suipay-mcp@0.2.2-dev.10` in MCP config. `1.0.1` remains on the
-registry as a historical release; do not install it for new agents.
+Pin `@cmdoss/suipay-mcp@0.2.2-dev.11` in MCP config for the `latest` dist-tag.
+`npx -y @cmdoss/suipay-mcp@dev` tracks the `dev` prerelease line.
+`1.0.1` remains on the registry as a historical release; do not install it
+for new agents.
 
 ## Install
 
 ```bash
-claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.2-dev.10
+claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.2-dev.11
 ```
 
+`@dev` installs the Railway-dev gateway/console defaults. A workspace
+checkout still defaults to localhost. `SUIPAY_GATEWAY_URL` and
+`SUIPAY_CONSOLE_URL` always override.
+
 No wallet secret belongs in this command or MCP config. There is no
 Sign-In With Sui (SIWS) step. To reuse an existing delegate seed locally,
 set `SUIPAY_MCP_KEY` (64-hex or `suiprivkey1…`) in the MCP env — never in
@@ -112,10 +118,10 @@ Default is Railway **suipay-dev**. `--local` / `target: "local"` is laptop-only.
 
 ```bash
 # Railway suipay-dev (default)
-npx @cmdoss/suipay-mcp@0.2.2-dev.10
+npx @cmdoss/suipay-mcp@0.2.2-dev.11
 
 # Laptop stack
-npx @cmdoss/suipay-mcp@0.2.2-dev.10 --local
+npx @cmdoss/suipay-mcp@0.2.2-dev.11 --local
 ```
 
 `SUIPAY_MCP_TARGET=local|dev` selects the same preset. Explicit
@@ -175,4 +181,8 @@ node packages/mcp/dist/bin/suipay.js
 Binary writes status banner to stderr only. Stdout stays reserved for
 MCP protocol.
 
-Do not publish `@cmdoss/suipay-mcp` from this change.
+Publishing is the `release-npm` workflow: merge to `dev` publishes
+`@cmdoss/suipay-mcp@<version>-dev.N` with dist-tag `dev` (OIDC, pack gate,
+provenance). `latest` is a gated dispatch from `main` (`dry_run` default
+true). Do not `npm publish` from a laptop. See
+[`docs/guide/npm-release.md`](../../docs/guide/npm-release.md).

package/dist/bin/suipay.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-LQOZBRH6.js";
-import "../chunk-NDJ7BFI4.js";
+} from "../chunk-6GJ7IGYM.js";
+import "../chunk-WRN7FRUI.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-LQOZBRH6.js → chunk-6GJ7IGYM.js}

@@ -4,7 +4,7 @@ import {
   loadLocalSigningKeyRecord,
   loadMcpConfig,
   loadPaymentProfile
-} from "./chunk-NDJ7BFI4.js";
+} from "./chunk-WRN7FRUI.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{chunk-NDJ7BFI4.js → chunk-WRN7FRUI.js}

@@ -5547,10 +5547,10 @@ function createMemoryLedger() {
 }
 
 // src/auth.ts
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import {
   mkdirSync,
-  readFileSync,
+  readFileSync as readFileSync2,
   renameSync,
   chmodSync,
   unlinkSync,
@@ -5567,12 +5567,70 @@ import { bytesToHex as bytesToHex4 } from "@noble/hashes/utils.js";
 
 // src/config.ts
 import { homedir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 import { SuiGrpcClient as SuiGrpcClient2 } from "@mysten/sui/grpc";
 import { normalizeSuiAddress as normalizeSuiAddress7 } from "@mysten/sui/utils";
+
+// src/hosted-defaults.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var MCP_LOCAL_GATEWAY_URL = "https://gateway-dev-ba84.up.railway.app";
+var MCP_LOCAL_CONSOLE_URL = "https://suipay-dev.up.railway.app";
+var MCP_DEV_GATEWAY_URL = "https://gateway-dev-ba84.up.railway.app";
+var MCP_DEV_CONSOLE_URL = "https://suipay-dev.up.railway.app";
+var MCP_PROD_GATEWAY_URL = "https://gateway.suipay.dev";
+var MCP_PROD_CONSOLE_URL = "https://www.sui.io/agentpayments";
+var MCP_CHANNEL_DEFAULTS = {
+  local: { gatewayUrl: MCP_LOCAL_GATEWAY_URL, consoleUrl: MCP_LOCAL_CONSOLE_URL },
+  dev: { gatewayUrl: MCP_DEV_GATEWAY_URL, consoleUrl: MCP_DEV_CONSOLE_URL },
+  prod: { gatewayUrl: MCP_PROD_GATEWAY_URL, consoleUrl: MCP_PROD_CONSOLE_URL }
+};
+function isNodeModulesInstall(moduleUrl) {
+  const text2 = moduleUrl.replace(/\\/g, "/");
+  if (text2.includes("/packages/mcp/")) return false;
+  return text2.includes("/node_modules/");
+}
+function detectMcpDefaultChannel(opts) {
+  if (!isNodeModulesInstall(opts.moduleUrl)) return "local";
+  if (typeof opts.version === "string" && opts.version.includes("-dev.")) return "dev";
+  if (!opts.version) return "local";
+  return "prod";
+}
+function readOwnPackageVersion(moduleUrl = import.meta.url) {
+  let dir = dirname(fileURLToPath(moduleUrl));
+  for (let i = 0; i < 6; i += 1) {
+    const candidate = join(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const pkg = JSON.parse(readFileSync(candidate, "utf8"));
+        if (pkg.name === "@cmdoss/suipay-mcp" && typeof pkg.version === "string") {
+          return pkg.version;
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return "";
+}
+function resolveMcpHostedDefaults(opts = {}) {
+  const env = opts.env ?? process.env;
+  const moduleUrl = opts.moduleUrl ?? import.meta.url;
+  const version = opts.version ?? readOwnPackageVersion(moduleUrl);
+  const defaults = MCP_CHANNEL_DEFAULTS[detectMcpDefaultChannel({ moduleUrl, version })];
+  return {
+    gatewayUrl: env.SUIPAY_GATEWAY_URL ?? defaults.gatewayUrl,
+    consoleUrl: env.SUIPAY_CONSOLE_URL ?? defaults.consoleUrl
+  };
+}
+
+// src/config.ts
 function mcpCredentialsPath() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? homedir();
-  return join(home, ".suipay", "credentials.json");
+  return join2(home, ".suipay", "credentials.json");
 }
 var MCP_TARGET_PRESETS = {
   dev: {
@@ -5670,14 +5728,15 @@ function sameMcpGateway(a, b) {
 }
 function loadMcpConfig(env = process.env, argv = []) {
   const network = env.SUIPAY_NETWORK ?? "testnet";
-  const target = resolveMcpTarget(env, argv);
-  const preset = MCP_TARGET_PRESETS[target];
-  const gatewayUrl = env.SUIPAY_GATEWAY_URL?.trim() || preset.gatewayUrl;
-  const consoleUrl = env.SUIPAY_CONSOLE_URL?.trim() || preset.consoleUrl;
+  const explicit = parseMcpTargetFlag(argv) ?? parseMcpTargetName(env.SUIPAY_MCP_TARGET);
+  const hosted = resolveMcpHostedDefaults({ env });
+  const preset = explicit ? MCP_TARGET_PRESETS[explicit] : null;
+  const gatewayUrl = preset ? env.SUIPAY_GATEWAY_URL?.trim() || preset.gatewayUrl : hosted.gatewayUrl;
+  const consoleUrl = preset ? env.SUIPAY_CONSOLE_URL?.trim() || preset.consoleUrl : hosted.consoleUrl;
   const rawDir = env.SUIPAY_EXCLUSION_DIRECTORY_OBJECT_ID?.trim();
   if (rawDir) assertValidPackageId("SUIPAY_EXCLUSION_DIRECTORY_OBJECT_ID", rawDir);
   return {
-    target,
+    ...explicit ? { target: explicit } : {},
     consoleUrl,
     gatewayUrl,
     rpcUrl: env.SUIPAY_RPC_URL ?? GRPC_URLS[network],
@@ -5751,7 +5810,7 @@ function credsPath() {
   return mcpCredentialsPath();
 }
 function credsDir() {
-  return dirname(credsPath());
+  return dirname2(credsPath());
 }
 var HEX64 = /^[0-9a-fA-F]{64}$/;
 var ADDR = /^0x[0-9a-fA-F]{64}$/;
@@ -5782,7 +5841,7 @@ function readCredentialsJson() {
   const path = credsPath();
   let raw;
   try {
-    raw = readFileSync(path, "utf8");
+    raw = readFileSync2(path, "utf8");
   } catch (error2) {
     const code = error2.code;
     if (code === "ENOENT" || code === "ENOTDIR") return null;
@@ -5824,7 +5883,7 @@ function fsyncDir(dir) {
   }
 }
 function writeTmpCredentials(dir, payload) {
-  const tmp = join2(dir, `.credentials.${process.pid}.${randomSuffix()}.tmp`);
+  const tmp = join3(dir, `.credentials.${process.pid}.${randomSuffix()}.tmp`);
   const fd = openSync(tmp, "w", 384);
   try {
     writeSync(fd, JSON.stringify(payload, null, 2));
@@ -8360,9 +8419,9 @@ import { pathToFileURL } from "url";
 
 // src/delivery-file.ts
 import { mkdirSync as mkdirSync2, writeFileSync, chmodSync as chmodSync2 } from "fs";
-import { dirname as dirname2, join as join3 } from "path";
+import { dirname as dirname3, join as join4 } from "path";
 function mcpDeliveriesDir() {
-  return join3(dirname2(mcpCredentialsPath()), "deliveries");
+  return join4(dirname3(mcpCredentialsPath()), "deliveries");
 }
 var EXT = {
   "image/png": ".png",
@@ -8396,7 +8455,7 @@ function saveDeliveredBody(input) {
     chmodSync2(dir, 448);
   } catch {
   }
-  const path = join3(
+  const path = join4(
     dir,
     `${fileStem(input.digest, input.challengeId)}${extensionFor(input.contentType)}`
   );
@@ -8486,12 +8545,12 @@ function settlePayResult(result) {
 }
 
 // src/pay-file.ts
-import { isAbsolute, dirname as dirname3, sep } from "path";
+import { isAbsolute, dirname as dirname4, sep } from "path";
 import {
   openSync as openSync2,
   closeSync as closeSync2,
   fstatSync,
-  readFileSync as readFileSync2,
+  readFileSync as readFileSync3,
   realpathSync,
   constants
 } from "fs";
@@ -8574,7 +8633,7 @@ function resolveContainedPath(raw) {
   if (!inside(rootReal, fileReal)) {
     return fail2("FILE_OUTSIDE_ROOT", "file must be under SUIPAY_MCP_FILE_ROOT");
   }
-  const credsDir2 = dirname3(mcpCredentialsPath());
+  const credsDir2 = dirname4(mcpCredentialsPath());
   let credsReal = credsDir2;
   try {
     credsReal = realpathSync(credsDir2);
@@ -8603,7 +8662,7 @@ function readRegularFile(path) {
         `file is ${st.size} bytes; exceeds ${MCP_MAX_FILE_FIELD_BYTES} decoded bytes`
       );
     }
-    const bytes = readFileSync2(fd);
+    const bytes = readFileSync3(fd);
     if (bytes.byteLength === 0) {
       return fail2("EMPTY_FILE", "file is empty");
     }

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-NDJ7BFI4.js";
+} from "./chunk-WRN7FRUI.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-LQOZBRH6.js";
+} from "./chunk-6GJ7IGYM.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-NDJ7BFI4.js";
+} from "./chunk-WRN7FRUI.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmdoss/suipay-mcp",
-  "version": "0.2.2-dev.10",
+  "version": "0.2.2-dev.11",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "main": "./dist/index.js",
@@ -37,8 +37,8 @@
     "tsup": "^8.0.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@cmdoss/suipay-sdk": "0.1.0",
-    "@cmdoss/suipay-core": "0.1.0"
+    "@cmdoss/suipay-core": "0.1.0",
+    "@cmdoss/suipay-sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup",