@cmdoss/suipay-mcp 0.2.2-dev.2 → 0.2.2-dev.4

package/dist/{chunk-62LFIYB7.js → chunk-KDOGSB5I.js}

@@ -151,46 +151,6 @@ import { normalizeStructTag as normalizeStructTag2 } from "@mysten/sui/utils";
 
 // ../core/dist/assets/testnet.js
 import { normalizeStructTag } from "@mysten/sui/utils";
-var TESTNET_SUI_COIN_TYPE = "0x2::sui::SUI";
-var TESTNET_USDC_COIN_TYPE = "0xa1ec7fc00a6f40db9693ad1415d0c193ad3906494428cf252621037bd7117e29::usdc::USDC";
-var TESTNET_SUI_DECIMALS = 9;
-var TESTNET_USDC_DECIMALS = 6;
-var TESTNET_ASSETS = [
-  {
-    id: "sui",
-    symbol: "SUI",
-    coinType: TESTNET_SUI_COIN_TYPE,
-    decimals: TESTNET_SUI_DECIMALS,
-    network: "sui:testnet"
-  },
-  {
-    id: "usdc",
-    symbol: "USDC",
-    coinType: TESTNET_USDC_COIN_TYPE,
-    decimals: TESTNET_USDC_DECIMALS,
-    network: "sui:testnet"
-  }
-];
-function supportedAssetByCoinType(coinType) {
-  const normalized = tryNormalizeStructTag(coinType);
-  if (!normalized)
-    return null;
-  for (const asset of TESTNET_ASSETS) {
-    if (tryNormalizeStructTag(asset.coinType) === normalized)
-      return asset;
-  }
-  return null;
-}
-function tryNormalizeStructTag(coinType) {
-  const trimmed = coinType.trim();
-  if (!trimmed)
-    return null;
-  try {
-    return normalizeStructTag(trimmed);
-  } catch {
-    return null;
-  }
-}
 
 // ../core/dist/service-state/index.js
 var STATE_DIMENSIONS = Object.freeze([
@@ -411,101 +371,6 @@ var SERVICE_STATE_TRANSITIONS = Object.freeze([
 ]);
 
 // ../core/dist/policy/target.js
-var AUTHORIZATION_PROTOCOL_VERSION = "suipay-target-v1";
-function normalizeHexAddress(address) {
-  const raw = address.trim().toLowerCase();
-  if (!raw.startsWith("0x")) {
-    throw new Error("Address must be a 0x-prefixed Sui address.");
-  }
-  const hex = raw.slice(2);
-  if (!/^[0-9a-f]+$/.test(hex) || hex.length === 0 || hex.length > 64) {
-    throw new Error("Invalid Sui address.");
-  }
-  if (/^0+$/.test(hex)) {
-    throw new Error("Recipient must be a non-zero address.");
-  }
-  return `0x${hex.padStart(64, "0")}`;
-}
-function normalizePath(path) {
-  const p = path.trim();
-  if (!p.startsWith("/")) {
-    throw new Error("Path must be an absolute path starting with /.");
-  }
-  if (p.length > 1 && p.endsWith("/"))
-    return p.replace(/\/+$/, "");
-  return p;
-}
-function normalizeMethod(method) {
-  const m = method.trim().toUpperCase();
-  if (!m)
-    throw new Error("HTTP method is required.");
-  return m;
-}
-function normalizeNetwork(network) {
-  const n = network.trim().toLowerCase();
-  if (n !== "sui:testnet") {
-    throw new Error(`Unsupported network: ${network}`);
-  }
-  return n;
-}
-function normalizeAsset(asset) {
-  const trimmed = asset.trim();
-  let normalized;
-  try {
-    normalized = normalizeStructTag2(trimmed);
-  } catch {
-    throw new Error(`Invalid coin type: ${asset}`);
-  }
-  if (!supportedAssetByCoinType(normalized)) {
-    throw new Error(`Unsupported asset: ${asset}`);
-  }
-  return normalized;
-}
-function normalizeId(id, label) {
-  const v = id.trim();
-  if (!v)
-    throw new Error(`${label} is required.`);
-  if (/[\n\r\0]/.test(v))
-    throw new Error(`${label} contains control characters.`);
-  return v;
-}
-function normalizeEpoch(epoch) {
-  if (!Number.isInteger(epoch) || epoch < 1) {
-    throw new Error("authorizationEpoch must be a positive integer.");
-  }
-  return epoch;
-}
-function canonicalizeTargetFields(input) {
-  return {
-    network: normalizeNetwork(input.network),
-    providerId: normalizeHexAddress(input.providerId),
-    serviceId: normalizeId(input.serviceId, "serviceId"),
-    endpointId: normalizeId(input.endpointId, "endpointId"),
-    method: normalizeMethod(input.method),
-    path: normalizePath(input.path),
-    asset: normalizeAsset(input.asset),
-    recipient: normalizeHexAddress(input.recipient),
-    authorizationEpoch: normalizeEpoch(input.authorizationEpoch)
-  };
-}
-function authorizationFingerprint(input) {
-  const c = canonicalizeTargetFields(input);
-  return [
-    AUTHORIZATION_PROTOCOL_VERSION,
-    c.network,
-    c.providerId,
-    c.serviceId,
-    c.endpointId,
-    c.method,
-    c.path,
-    c.asset,
-    c.recipient,
-    String(c.authorizationEpoch)
-  ].join("\n");
-}
-function targetHashFromFingerprint(fingerprint) {
-  return createHash("sha256").update(fingerprint, "utf8").digest("hex");
-}
 function targetHashBytes(hexHash) {
   if (!/^[0-9a-f]{64}$/i.test(hexHash)) {
     throw new Error("targetHash must be 32-byte hex.");
@@ -4467,10 +4332,8 @@ import {
   fsyncSync,
   openSync,
   closeSync,
-  writeSync,
-  linkSync
+  writeSync
 } from "fs";
-import { decodeSuiPrivateKey } from "@mysten/sui/cryptography";
 import { Ed25519Keypair as Ed25519Keypair2 } from "@mysten/sui/keypairs/ed25519";
 import { fromBase64 as fromBase644 } from "@mysten/sui/utils";
 import { bytesToHex as bytesToHex4 } from "@noble/hashes/utils.js";
@@ -4484,16 +4347,6 @@ function mcpCredentialsPath() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? homedir();
   return join(home, ".suipay", "credentials.json");
 }
-var MCP_TARGET_PRESETS = {
-  dev: {
-    consoleUrl: "https://suipay-dev.up.railway.app",
-    gatewayUrl: "https://gateway-dev-ba84.up.railway.app"
-  },
-  local: {
-    consoleUrl: "http://localhost:3000",
-    gatewayUrl: "http://127.0.0.1:4340"
-  }
-};
 var GRPC_URLS = {
   mainnet: "https://fullnode.mainnet.sui.io:443",
   testnet: "https://fullnode.testnet.sui.io:443",
@@ -4537,56 +4390,11 @@ function resolveActiveMovePackageId(env = process.env) {
   }
   return configured[0]?.value;
 }
-function parseMcpTargetFlag(argv) {
-  let target;
-  for (const arg of argv) {
-    const next = arg === "--local" || arg === "-local" ? "local" : arg === "--dev" || arg === "-dev" ? "dev" : void 0;
-    if (!next) continue;
-    if (target && target !== next) {
-      throw new Error("pass only one of --local or --dev");
-    }
-    target = next;
-  }
-  return target;
-}
-function parseMcpTargetName(value) {
-  const trimmed = value?.trim().toLowerCase();
-  if (!trimmed) return void 0;
-  if (trimmed === "dev" || trimmed === "local") return trimmed;
-  throw new Error(`SUIPAY_MCP_TARGET must be "dev" or "local", got ${JSON.stringify(value)}`);
-}
-function resolveMcpTarget(env = process.env, argv = []) {
-  return parseMcpTargetFlag(argv) ?? parseMcpTargetName(env.SUIPAY_MCP_TARGET) ?? "dev";
-}
-function loopbackKey(url) {
-  if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-  if (url.hostname !== "127.0.0.1" && url.hostname !== "localhost") return null;
-  const port = url.port || (url.protocol === "https:" ? "443" : "80");
-  return `${url.protocol}//loopback:${port}`;
-}
-function sameMcpGateway(a, b) {
-  let ua;
-  let ub;
-  try {
-    ua = new URL(a);
-    ub = new URL(b);
-  } catch {
-    return a.replace(/\/+$/, "") === b.replace(/\/+$/, "");
-  }
-  if (ua.origin === ub.origin) return true;
-  const left = loopbackKey(ua);
-  const right = loopbackKey(ub);
-  return left !== null && left === right;
-}
-function loadMcpConfig(env = process.env, argv = []) {
+function loadMcpConfig(env = process.env) {
   const network = env.SUIPAY_NETWORK ?? "testnet";
-  const target = resolveMcpTarget(env, argv);
-  const preset = MCP_TARGET_PRESETS[target];
-  const gatewayUrl = env.SUIPAY_GATEWAY_URL?.trim() || preset.gatewayUrl;
-  const consoleUrl = env.SUIPAY_CONSOLE_URL?.trim() || preset.consoleUrl;
+  const gatewayUrl = env.SUIPAY_GATEWAY_URL ?? "http://localhost:4340";
   return {
-    target,
-    consoleUrl,
+    consoleUrl: env.SUIPAY_CONSOLE_URL ?? "http://localhost:3000",
     gatewayUrl,
     rpcUrl: env.SUIPAY_RPC_URL ?? GRPC_URLS[network],
     network,
@@ -4635,23 +4443,10 @@ function isValid(obj) {
   const c = obj;
   return typeof c.delegatePrivateKey === "string" && HEX64.test(c.delegatePrivateKey) && typeof c.delegatePublicKeyHex === "string" && HEX64.test(c.delegatePublicKeyHex) && typeof c.delegateAddress === "string" && ADDR.test(c.delegateAddress) && typeof c.ownerAddress === "string" && ADDR.test(c.ownerAddress) && typeof c.allowanceId === "string" && ADDR.test(c.allowanceId) && typeof c.packageId === "string" && ADDR.test(c.packageId) && typeof c.recipient === "string" && ADDR.test(c.recipient) && typeof c.coinType === "string" && c.coinType.length > 0 && typeof c.gatewayUrl === "string" && typeof c.network === "string" && typeof c.maxPerPayment === "string" && /^\d+$/.test(c.maxPerPayment) && typeof c.createdAt === "string" && c.version === 1;
 }
-function isHttpUrl(value) {
-  if (typeof value !== "string" || !value.trim()) return false;
-  try {
-    const parsed = new URL(value);
-    return parsed.protocol === "http:" || parsed.protocol === "https:";
-  } catch {
-    return false;
-  }
-}
 function isLocalSigningKeyRecord(obj) {
   if (!obj || typeof obj !== "object") return false;
   const c = obj;
-  if (c.version !== 2 || typeof c.delegatePrivateKey !== "string" || !HEX64.test(c.delegatePrivateKey) || typeof c.delegatePublicKeyHex !== "string" || !HEX64.test(c.delegatePublicKeyHex) || typeof c.delegateAddress !== "string" || !ADDR.test(c.delegateAddress) || typeof c.createdAt !== "string") {
-    return false;
-  }
-  if (c.gatewayUrl !== void 0 && !isHttpUrl(c.gatewayUrl)) return false;
-  return true;
+  return c.version === 2 && typeof c.delegatePrivateKey === "string" && HEX64.test(c.delegatePrivateKey) && typeof c.delegatePublicKeyHex === "string" && HEX64.test(c.delegatePublicKeyHex) && typeof c.delegateAddress === "string" && ADDR.test(c.delegateAddress) && typeof c.createdAt === "string";
 }
 function readCredentialsJson() {
   const path = credsPath();
@@ -4687,19 +4482,15 @@ function loadCreds() {
   }
   return parsed;
 }
-function fsyncDir(dir) {
+function writeCredentialsFile(payload) {
+  const dir = credsDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
   try {
-    const fd = openSync(dir, "r");
-    try {
-      fsyncSync(fd);
-    } finally {
-      closeSync(fd);
-    }
+    chmodSync(dir, 448);
   } catch {
   }
-}
-function writeTmpCredentials(dir, payload) {
-  const tmp = join2(dir, `.credentials.${process.pid}.${randomSuffix()}.tmp`);
+  const path = credsPath();
+  const tmp = join2(dir, `.credentials.${process.pid}.tmp`);
   const fd = openSync(tmp, "w", 384);
   try {
     writeSync(fd, JSON.stringify(payload, null, 2));
@@ -4707,23 +4498,7 @@ function writeTmpCredentials(dir, payload) {
   } finally {
     closeSync(fd);
   }
-  return tmp;
-}
-function randomSuffix() {
-  return Math.random().toString(16).slice(2, 10);
-}
-function writeCredentialsFile(payload) {
-  const dir = credsDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    chmodSync(dir, 448);
-  } catch {
-  }
-  const path = credsPath();
-  const tmp = writeTmpCredentials(dir, payload);
-  fsyncDir(dir);
   renameSync(tmp, path);
-  fsyncDir(dir);
   try {
     chmodSync(path, 384);
   } catch {
@@ -4737,23 +4512,19 @@ function createCredentialsFileExclusive(payload) {
   } catch {
   }
   const path = credsPath();
-  const tmp = writeTmpCredentials(dir, payload);
-  fsyncDir(dir);
+  let fd;
   try {
-    linkSync(tmp, path);
+    fd = openSync(path, "wx", 384);
   } catch (error2) {
-    try {
-      unlinkSync(tmp);
-    } catch {
-    }
     if (error2.code === "EEXIST") return false;
     throw error2;
   }
   try {
-    unlinkSync(tmp);
-  } catch {
+    writeSync(fd, JSON.stringify(payload, null, 2));
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
   }
-  fsyncDir(dir);
   try {
     chmodSync(path, 384);
   } catch {
@@ -4842,90 +4613,12 @@ function rewriteV1ToLocalSigningKey(creds, opts = {}) {
     delegatePublicKeyHex: creds.delegatePublicKeyHex,
     delegateAddress: creds.delegateAddress,
     createdAt: creds.createdAt,
-    ...isHttpUrl(creds.gatewayUrl) ? { gatewayUrl: creds.gatewayUrl } : {},
     ...opts.label?.trim() ? { label: opts.label.trim() } : creds.label?.trim() ? { label: creds.label.trim() } : {}
   };
   writeCredentialsFile(record);
   return identity;
 }
-function keypairFromOperatorSecret(raw) {
-  const key = raw.trim();
-  if (!key) throw new Error("SUIPAY_MCP_KEY is set but empty");
-  try {
-    return /^(0x)?[0-9a-fA-F]{64}$/.test(key) ? Ed25519Keypair2.fromSecretKey(
-      Uint8Array.from(Buffer.from(key.replace(/^0x/i, ""), "hex"))
-    ) : Ed25519Keypair2.fromSecretKey(key);
-  } catch {
-    throw new Error(
-      "SUIPAY_MCP_KEY is malformed (expected 64-hex or suiprivkey1\u2026 Ed25519 secret)"
-    );
-  }
-}
-function seedHexFromKeypair(kp, operatorSecret) {
-  const hex = operatorSecret.trim().replace(/^0x/i, "");
-  if (/^[0-9a-fA-F]{64}$/.test(hex)) return hex.toLowerCase();
-  try {
-    return bytesToHex4(decodeSuiPrivateKey(kp.getSecretKey()).secretKey);
-  } catch {
-    throw new Error(
-      "SUIPAY_MCP_KEY is malformed (expected 64-hex or suiprivkey1\u2026 Ed25519 secret)"
-    );
-  }
-}
-function recordFromKeypair(kp, opts = {}, existing, operatorSecret) {
-  const seed = seedHexFromKeypair(kp, operatorSecret);
-  const publicKeyHex = bytesToHex4(kp.getPublicKey().toRawBytes());
-  const delegateAddress = kp.getPublicKey().toSuiAddress();
-  const label = opts.label?.trim() || existing?.label?.trim();
-  return {
-    version: 2,
-    delegatePrivateKey: seed,
-    delegatePublicKeyHex: publicKeyHex,
-    delegateAddress,
-    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-    ...existing && isHttpUrl(existing.gatewayUrl ?? "") ? { gatewayUrl: existing.gatewayUrl } : {},
-    ...label ? { label } : {}
-  };
-}
-var ENV_KEY_MISMATCH = "SUIPAY_MCP_KEY does not match the stored delegate key - refusing to overwrite";
-function existingRecordForEnv(parsed) {
-  if (parsed === null) return null;
-  if (isLocalSigningKeyRecord(parsed) || isValid(parsed)) return parsed;
-  throw new Error(
-    `credentials file at ${credsPath()} failed schema validation - refusing to continue`
-  );
-}
 async function ensureLocalSigningKey(opts = {}) {
-  const envKey = process.env.SUIPAY_MCP_KEY?.trim();
-  if (envKey) {
-    const kp2 = keypairFromOperatorSecret(envKey);
-    const parsed2 = readCredentialsJson();
-    const existing = existingRecordForEnv(parsed2);
-    const asV2 = existing ? isLocalSigningKeyRecord(existing) ? existing : {
-      version: 2,
-      delegatePrivateKey: existing.delegatePrivateKey,
-      delegatePublicKeyHex: existing.delegatePublicKeyHex,
-      delegateAddress: existing.delegateAddress,
-      createdAt: existing.createdAt,
-      ...isHttpUrl(existing.gatewayUrl) ? { gatewayUrl: existing.gatewayUrl } : {},
-      ...existing.label?.trim() ? { label: existing.label.trim() } : {}
-    } : null;
-    const record2 = recordFromKeypair(kp2, opts, asV2, envKey);
-    if (existing) {
-      if (existing.delegateAddress !== record2.delegateAddress || existing.delegatePrivateKey !== record2.delegatePrivateKey) {
-        throw new Error(ENV_KEY_MISMATCH);
-      }
-      if (!isLocalSigningKeyRecord(existing)) {
-        writeCredentialsFile(record2);
-      }
-    } else {
-      writeCredentialsFile(record2);
-    }
-    return {
-      delegateAddress: record2.delegateAddress,
-      publicKeyHex: record2.delegatePublicKeyHex
-    };
-  }
   const parsed = readCredentialsJson();
   if (parsed !== null) {
     if (isLocalSigningKeyRecord(parsed)) {
@@ -4995,67 +4688,6 @@ function loadLocalSigner() {
     }
   };
 }
-function loadLocalSigningKeyRecord() {
-  const parsed = readCredentialsJson();
-  if (parsed === null) return null;
-  if (isLocalSigningKeyRecord(parsed)) {
-    identityFromStored(
-      parsed.delegatePrivateKey,
-      parsed.delegatePublicKeyHex,
-      parsed.delegateAddress
-    );
-    return parsed;
-  }
-  if (isValid(parsed)) return null;
-  throw new Error(
-    `credentials file at ${credsPath()} failed schema validation - refusing to continue`
-  );
-}
-function loadLocalKeypair() {
-  const parsed = readCredentialsJson();
-  if (parsed === null) return null;
-  if (!isLocalSigningKeyRecord(parsed) && !isValid(parsed)) {
-    throw new Error(
-      `credentials file at ${credsPath()} failed schema validation - refusing to continue`
-    );
-  }
-  identityFromStored(
-    parsed.delegatePrivateKey,
-    parsed.delegatePublicKeyHex,
-    parsed.delegateAddress
-  );
-  return Ed25519Keypair2.fromSecretKey(
-    Uint8Array.from(Buffer.from(parsed.delegatePrivateKey, "hex"))
-  );
-}
-function persistGatewayUrl(gatewayUrl) {
-  if (!isHttpUrl(gatewayUrl)) {
-    throw new Error("gatewayUrl must be an http(s) origin");
-  }
-  const parsed = readCredentialsJson();
-  if (parsed === null) {
-    throw new Error(
-      `credentials file at ${credsPath()} is missing - refusing to persist gatewayUrl`
-    );
-  }
-  if (isLocalSigningKeyRecord(parsed)) {
-    identityFromStored(
-      parsed.delegatePrivateKey,
-      parsed.delegatePublicKeyHex,
-      parsed.delegateAddress
-    );
-    writeCredentialsFile({ ...parsed, gatewayUrl });
-    return;
-  }
-  if (isValid(parsed)) {
-    rewriteV1ToLocalSigningKey(parsed);
-    persistGatewayUrl(gatewayUrl);
-    return;
-  }
-  throw new Error(
-    `credentials file at ${credsPath()} failed schema validation - refusing to continue`
-  );
-}
 
 // src/agent-held.ts
 var processLedger = null;
@@ -5083,6 +4715,38 @@ function offerSecret(env) {
   const secret = env.SUIPAY_SECRET?.trim();
   return secret ? secret : null;
 }
+function settlementFromLocalSigner(cfg, local, packageId, env = process.env) {
+  const chain = createSpendAccountChain({
+    packageId,
+    network: cfg.network,
+    url: cfg.rpcUrl
+  });
+  const finality = createSpendAccountFinalityReader({ client: chain.client });
+  const getObjectJson = async (objectId) => {
+    const { object } = await chain.client.core.getObject({
+      objectId,
+      include: { json: true }
+    });
+    return objectWithOwner(object);
+  };
+  const secret = offerSecret(env);
+  return {
+    signer: {
+      address: local.address,
+      signTransaction: local.signTransaction,
+      signPersonalMessage: local.signPersonalMessage
+    },
+    getObjectJson,
+    payerDeps: {
+      ...secret ? { offerSecret: secret } : {},
+      paymentLedger: sharedProcessLedger(),
+      sponsor: { sponsorUrl: cfg.gatewayUrl },
+      gasMode: "sponsored",
+      resolveSharedObjectVersions: (ids) => resolveSharedObjectVersionsFromGetObject(getObjectJson, ids),
+      getFinalizedTx: (digest) => finality.getFinalizedTx(digest)
+    }
+  };
+}
 function resolveAgentHeldSettlement(cfg, spendAccountPay, env = process.env) {
   const secret = offerSecret(env);
   if (!secret) return null;
@@ -5176,311 +4840,52 @@ function toolAllowedByScope(toolName, grantedScope) {
 }
 
 // src/tools.ts
-import { isValidSuiAddress, normalizeSuiAddress as normalizeSuiAddress12 } from "@mysten/sui/utils";
+import { isValidSuiAddress, normalizeSuiAddress as normalizeSuiAddress10 } from "@mysten/sui/utils";
 
-// src/settle.ts
-async function settlePreparedMcpPayment(args) {
-  try {
-    await verifyPreparedSettlementKind({
-      kindBytes: args.signingRequest.unsignedKindBytes,
-      expected: {
-        packageId: args.signingRequest.packageId,
-        delegateAddress: args.expected.delegateAddress,
-        amount: args.expected.amount,
-        recipient: args.expected.recipient,
-        accessMode: args.signingRequest.submit.moveCallTarget.endsWith(
-          "settle_open_recipient_payment"
-        ) ? "open" : "scoped"
-      },
-      getObjectJson: args.getObjectJson
-    });
-  } catch (err) {
-    if (err instanceof PreparedVerificationUnavailableError) {
-      return {
-        status: "failed",
-        paid: false,
-        code: DELEGATED_PAY_ERROR_CODES.PREPARED_VERIFY_UNAVAILABLE,
-        detail: err.message
-      };
-    }
-    return {
-      status: "failed",
-      paid: false,
-      code: DELEGATED_PAY_ERROR_CODES.TX_MISMATCH,
-      detail: err instanceof Error ? err.message : "prepared transaction mismatch"
-    };
-  }
-  const prepared = args.signingRequest.resource;
-  if (args.request.url !== prepared.url || args.request.method !== prepared.method) {
-    return {
-      status: "failed",
-      paid: false,
-      code: DELEGATED_PAY_ERROR_CODES.UNSUPPORTED_REQUEST,
-      detail: "prepared resource request cannot be replayed"
-    };
-  }
-  return payDelegatedSpendAccount({
-    url: args.signingRequest.resource.url,
-    request: args.request,
-    session: args.session,
-    cfg: args.cfg,
-    deps: args.deps,
-    preparedTerms: {
-      recipient: args.expected.recipient,
-      amount: args.expected.amount,
-      asset: args.signingRequest.coinType,
-      targetHash: args.signingRequest.targetHash
-    },
-    ...args.intent ? { intent: args.intent } : {}
-  });
-}
-
-// ../sdk/dist/agent-sdk/delegate-agent.js
-import { normalizeSuiAddress as normalizeSuiAddress10 } from "@mysten/sui/utils";
-
-// ../sdk/dist/agent-sdk/verify-prepared-settlement.js
-import { normalizeSuiAddress as normalizeSuiAddress9 } from "@mysten/sui/utils";
-import { Transaction as Transaction5 } from "@mysten/sui/transactions";
-import { fromBase64 as fromBase645 } from "@mysten/sui/utils";
-
-// ../sdk/dist/protocol/prepared-settlement.js
-var PREPARED_SETTLEMENT_VERSION = 1;
-function asPreparedSettlement(value) {
-  if (!value || typeof value !== "object")
-    return null;
-  const v = value;
-  if (v.version !== PREPARED_SETTLEMENT_VERSION)
-    return null;
-  const accessMode = v.accessMode;
-  if (accessMode !== "open" && accessMode !== "scoped")
-    return null;
-  const strings = [
-    "transactionBytes",
-    "transactionKindBytes",
-    "sender",
-    "packageId",
-    "moveTarget",
-    "poolObjectId",
-    "grantObjectId",
-    "poolInitialSharedVersion",
-    "grantInitialSharedVersion",
-    "clockInitialSharedVersion",
-    "policyId",
-    "coinType",
-    "amount",
-    "recipient",
-    "payUrl"
-  ];
-  for (const key of strings) {
-    const got = v[key];
-    if (typeof got !== "string" || !got.trim())
-      return null;
-  }
-  return {
-    version: PREPARED_SETTLEMENT_VERSION,
-    accessMode,
-    transactionBytes: v.transactionBytes,
-    transactionKindBytes: v.transactionKindBytes,
-    sender: v.sender,
-    packageId: v.packageId,
-    moveTarget: v.moveTarget,
-    poolObjectId: v.poolObjectId,
-    grantObjectId: v.grantObjectId,
-    poolInitialSharedVersion: v.poolInitialSharedVersion,
-    grantInitialSharedVersion: v.grantInitialSharedVersion,
-    clockInitialSharedVersion: v.clockInitialSharedVersion,
-    policyId: v.policyId,
-    coinType: v.coinType,
-    amount: v.amount,
-    recipient: v.recipient,
-    payUrl: v.payUrl
-  };
-}
-
-// ../sdk/dist/agent-sdk/verify-prepared-settlement.js
-var PreparedSettlementRejected = class extends Error {
-  code = "PREPARED_SETTLEMENT_REJECTED";
-  /** Which check failed, for a caller that logs rather than reads prose. */
-  field;
-  constructor(field, message) {
-    super(message);
-    this.name = "PreparedSettlementRejected";
-    this.field = field;
-  }
-};
-function reject(field, message) {
-  throw new PreparedSettlementRejected(field, message);
-}
-function sameAddress3(a, b) {
-  try {
-    return normalizeSuiAddress9(a) === normalizeSuiAddress9(b);
-  } catch {
-    return false;
-  }
-}
-function sameCoinType(a, b) {
-  const norm = (value) => {
-    const [pkg, ...rest] = value.trim().split("::");
-    if (pkg === void 0 || rest.length !== 2)
-      return value.trim();
-    try {
-      return `${normalizeSuiAddress9(pkg)}::${rest.join("::")}`;
-    } catch {
-      return value.trim();
-    }
-  };
-  return norm(a) === norm(b);
-}
-function sameAmount(a, b) {
-  try {
-    return BigInt(a) === BigInt(b);
-  } catch {
-    return false;
-  }
-}
-async function verifyPreparedPayment(input) {
-  const prepared = asPreparedSettlement(input.prepared);
-  if (!prepared) {
-    reject("shape", "the 402 carried no usable prepared settlement");
-  }
-  const { offer, delegateAddress } = input;
-  if (!sameAddress3(prepared.sender, delegateAddress)) {
-    reject("sender", `prepared sender ${prepared.sender} is not this agent's address`);
-  }
-  let data;
-  try {
-    data = Transaction5.from(fromBase645(prepared.transactionBytes)).getData();
-  } catch {
-    reject("transactionBytes", "prepared transaction bytes are not a Sui transaction");
-  }
-  const gasOwner = data.gasData?.owner;
-  if (!gasOwner || sameAddress3(gasOwner, delegateAddress)) {
-    reject("gasOwner", "prepared transaction is not sponsored: gas would be paid by this agent");
-  }
-  if (input.expectedGrantObjectId && !sameAddress3(prepared.grantObjectId, input.expectedGrantObjectId)) {
-    reject("grantObjectId", `prepared settlement draws on grant ${prepared.grantObjectId}, not the one this agent resolved`);
-  }
-  if (input.expectedPoolObjectId && !sameAddress3(prepared.poolObjectId, input.expectedPoolObjectId)) {
-    reject("poolObjectId", `prepared settlement draws on pool ${prepared.poolObjectId}, not the one this agent resolved`);
-  }
-  if (!offer.packageId || !sameAddress3(prepared.packageId, offer.packageId)) {
-    reject("packageId", "prepared package id does not match the offer");
-  }
-  const wantedTarget = payMoveCallTarget(offer.packageId, prepared.accessMode);
-  if (prepared.moveTarget !== wantedTarget) {
-    reject("moveTarget", `prepared Move target ${prepared.moveTarget} is not ${wantedTarget}`);
-  }
-  if (!sameCoinType(prepared.coinType, offer.asset)) {
-    reject("coinType", "prepared coin type does not match the offer asset");
-  }
-  if (!sameAmount(prepared.amount, offer.amount)) {
-    reject("amount", "prepared amount does not match the offer amount");
-  }
-  if (!sameAddress3(prepared.recipient, offer.payTo)) {
-    reject("recipient", "prepared recipient does not match the offer payTo");
-  }
-  const targetHash = offer.targetHash?.trim();
-  if (!targetHash) {
-    reject("targetHash", "offer carries no targetHash to bind the settlement to");
-  }
-  if (!offer.digest?.trim()) {
-    reject("digest", "offer carries no digest, so its terms hash cannot be derived");
-  }
-  const common = {
-    packageId: offer.packageId,
-    delegate: prepared.sender,
-    coinType: prepared.coinType,
-    poolObjectId: prepared.poolObjectId,
-    grantObjectId: prepared.grantObjectId,
-    poolInitialSharedVersion: prepared.poolInitialSharedVersion,
-    grantInitialSharedVersion: prepared.grantInitialSharedVersion,
-    clockInitialSharedVersion: prepared.clockInitialSharedVersion,
-    targetHash,
-    amount: offer.amount,
-    paymentIdHash: paymentIdHash(offer.challengeId),
-    termsHash: termsHash(offer)
-  };
-  let rebuilt;
-  try {
-    rebuilt = prepared.accessMode === "open" ? (await buildSpendAccountSettleOpenRecipientKind({
-      ...common,
-      recipient: prepared.recipient
-    })).kindBytes : (await buildSpendAccountPayKind({
-      ...common,
-      policyId: prepared.policyId
-    })).kindBytes;
-  } catch (err) {
-    reject("rebuild", `the prepared settlement could not be rebuilt offline: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  if (rebuilt !== prepared.transactionKindBytes) {
-    reject("transactionKindBytes", "the prepared transaction kind is not the one this offer describes");
-  }
-  try {
-    assertPayTransaction(prepared.transactionBytes, {
-      packageId: offer.packageId,
-      delegate: prepared.sender,
-      poolObjectId: prepared.poolObjectId,
-      grantObjectId: prepared.grantObjectId,
-      policyId: prepared.policyId,
-      targetHash,
-      amount: offer.amount,
-      paymentIdHash: common.paymentIdHash,
-      termsHash: common.termsHash,
-      coinType: prepared.coinType,
-      kindBytes: rebuilt,
-      accessMode: prepared.accessMode,
-      recipient: prepared.recipient
-    });
-  } catch (err) {
-    reject("transactionBytes", `prepared transaction does not reconstruct the intended settlement: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  return prepared;
-}
-
-// ../sdk/dist/agent-sdk/manifest.js
-var MANIFEST_ERROR_CODES = {
-  MALFORMED_MANIFEST: "MALFORMED_MANIFEST",
-  MISSING_NETWORK: "MISSING_NETWORK",
-  MISSING_PACKAGE: "MISSING_PACKAGE",
-  MISSING_DELEGATE: "MISSING_DELEGATE",
-  NO_GRANTS: "NO_GRANTS",
-  MISSING_COIN_TYPE: "MISSING_COIN_TYPE",
-  MISSING_POOL_OBJECT: "MISSING_POOL_OBJECT",
-  MISSING_GRANT_OBJECT: "MISSING_GRANT_OBJECT",
-  MISSING_POLICY_BINDING: "MISSING_POLICY_BINDING",
-  INVALID_ACCESS_MODE: "INVALID_ACCESS_MODE",
-  GRANT_NOT_FOUND: "GRANT_NOT_FOUND",
-  AMBIGUOUS_GRANT: "AMBIGUOUS_GRANT",
-  /**
-   * The chain does not agree that this grant belongs to this delegate. The
-   * gateway said it did; an unsigned `getObject` says otherwise, and the chain
-   * wins (ADR-0016 §3).
-   */
-  GRANT_NOT_VERIFIED: "GRANT_NOT_VERIFIED",
-  /**
-   * The on-chain check could not run to a verdict — the fullnode read was
-   * unreachable or returned nothing. "Could not verify" is not "verified and it
-   * failed": both refuse, but only one is a security event.
-   */
-  GRANT_VERIFY_UNAVAILABLE: "GRANT_VERIFY_UNAVAILABLE"
-};
-function fail(code, detail) {
-  return { ok: false, error: { code, detail } };
-}
-var OBJECT_ID_RE = /^0x[0-9a-fA-F]{1,64}$/;
-var HEX32_RE = /^(0x)?[0-9a-fA-F]{64}$/;
-var U64_MAX = (1n << 64n) - 1n;
-function isNonEmptyString(v) {
-  return typeof v === "string" && v.trim().length > 0;
-}
-function isObjectId(v) {
-  return typeof v === "string" && OBJECT_ID_RE.test(v.trim());
-}
-function parseU64PolicyId(onChain) {
-  if (typeof onChain === "number") {
-    if (!Number.isSafeInteger(onChain) || onChain < 0)
-      return null;
-    return String(onChain);
+// ../sdk/dist/agent-sdk/manifest.js
+var MANIFEST_ERROR_CODES = {
+  MALFORMED_MANIFEST: "MALFORMED_MANIFEST",
+  MISSING_NETWORK: "MISSING_NETWORK",
+  MISSING_PACKAGE: "MISSING_PACKAGE",
+  MISSING_DELEGATE: "MISSING_DELEGATE",
+  NO_GRANTS: "NO_GRANTS",
+  MISSING_COIN_TYPE: "MISSING_COIN_TYPE",
+  MISSING_POOL_OBJECT: "MISSING_POOL_OBJECT",
+  MISSING_GRANT_OBJECT: "MISSING_GRANT_OBJECT",
+  MISSING_POLICY_BINDING: "MISSING_POLICY_BINDING",
+  INVALID_ACCESS_MODE: "INVALID_ACCESS_MODE",
+  GRANT_NOT_FOUND: "GRANT_NOT_FOUND",
+  AMBIGUOUS_GRANT: "AMBIGUOUS_GRANT",
+  /**
+   * The chain does not agree that this grant belongs to this delegate. The
+   * gateway said it did; an unsigned `getObject` says otherwise, and the chain
+   * wins (ADR-0016 §3).
+   */
+  GRANT_NOT_VERIFIED: "GRANT_NOT_VERIFIED",
+  /**
+   * The on-chain check could not run to a verdict — the fullnode read was
+   * unreachable or returned nothing. "Could not verify" is not "verified and it
+   * failed": both refuse, but only one is a security event.
+   */
+  GRANT_VERIFY_UNAVAILABLE: "GRANT_VERIFY_UNAVAILABLE"
+};
+function fail(code, detail) {
+  return { ok: false, error: { code, detail } };
+}
+var OBJECT_ID_RE = /^0x[0-9a-fA-F]{1,64}$/;
+var HEX32_RE = /^(0x)?[0-9a-fA-F]{64}$/;
+var U64_MAX = (1n << 64n) - 1n;
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function isObjectId(v) {
+  return typeof v === "string" && OBJECT_ID_RE.test(v.trim());
+}
+function parseU64PolicyId(onChain) {
+  if (typeof onChain === "number") {
+    if (!Number.isSafeInteger(onChain) || onChain < 0)
+      return null;
+    return String(onChain);
   }
   if (typeof onChain === "string" && /^\d+$/.test(onChain.trim())) {
     const s = onChain.trim();
@@ -5867,489 +5272,71 @@ async function resolvePayerSession(options) {
   });
 }
 
-// ../sdk/dist/buyer/transport.js
-var FORBIDDEN_SECRET_KEYS = [
-  "privateKey",
-  "private_key",
-  "privateKeyHex",
-  "secretKey",
-  "secret_key",
-  "secret",
-  "seed",
-  "seedPhrase",
-  "seed_phrase",
-  "mnemonic",
-  "privkey",
-  "suiprivkey"
-];
-var FORBIDDEN_SECRET_KEY_SET = new Set(FORBIDDEN_SECRET_KEYS.map((k) => k.toLowerCase()));
-
-// ../sdk/dist/agent-sdk/smoke.js
-function mergeObjectEnvelope(object) {
-  if (!object || typeof object.json !== "object" || object.json === null) {
-    return null;
-  }
-  return { ...object.json, owner: object.owner };
-}
-var SECRET_KEY_SET = new Set(FORBIDDEN_SECRET_KEYS.map((k) => k.toLowerCase()));
+// src/tools.ts
+import open from "open";
 
-// ../sdk/dist/agent-sdk/delegate-agent.js
-async function verifyGrantOnChain(input) {
-  let state;
-  try {
-    state = await readPublicGrantState(input.getObjectJson, input.grantObjectId);
-  } catch {
-    return {
-      ok: false,
-      error: {
-        code: MANIFEST_ERROR_CODES.GRANT_VERIFY_UNAVAILABLE,
-        detail: `the on-chain read of grant ${input.grantObjectId} did not complete, so this session was not verified and no payment was prepared`
-      }
-    };
-  }
-  if (!state) {
-    return {
-      ok: false,
-      error: {
-        code: MANIFEST_ERROR_CODES.GRANT_VERIFY_UNAVAILABLE,
-        detail: `grant ${input.grantObjectId} returned no readable on-chain state`
-      }
-    };
-  }
-  const notVerified = (detail) => ({
-    ok: false,
-    error: { code: MANIFEST_ERROR_CODES.GRANT_NOT_VERIFIED, detail }
-  });
-  if (!state.delegateAddress || normalizeSuiAddress10(state.delegateAddress) !== normalizeSuiAddress10(input.delegateAddress)) {
-    return notVerified(`grant ${input.grantObjectId} does not name this delegate on chain`);
-  }
-  if (!state.poolObjectId || normalizeSuiAddress10(state.poolObjectId) !== normalizeSuiAddress10(input.poolObjectId)) {
-    return notVerified(`grant ${input.grantObjectId} draws on a different pool than the one resolved`);
-  }
-  if (state.revoked === true) {
-    return notVerified(`grant ${input.grantObjectId} is revoked on chain`);
-  }
-  if (state.paused === true) {
-    return notVerified(`grant ${input.grantObjectId} is paused on chain`);
-  }
-  return { ok: true, value: null };
-}
-async function createPayer(options) {
-  const keypair = options.keypair;
-  const address = keypair.getPublicKey().toSuiAddress();
-  const resolved = await resolvePayerSession({
-    gatewayUrl: options.gatewayUrl,
-    delegateAddress: address,
-    // The bootstrap signature and the payment signature come from the same key.
-    // A caller never wires a second signer for either this or the sponsor personal-message.
-    signPersonalMessage: async (message) => {
-      const { signature } = await keypair.signPersonalMessage(message);
-      return signature;
-    },
-    signer: keypair,
-    ...options.select ? { select: options.select } : {},
-    ...options.deployment ? { deployment: options.deployment } : {},
-    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}
-  });
-  if (!resolved.ok)
-    return resolved;
-  const { session, binding } = resolved.value;
-  const deployment = {
-    network: session.network,
-    packageId: session.packageId
-  };
-  let network;
-  try {
-    network = toGrpcNetwork(deployment.network);
-  } catch {
-    return {
-      ok: false,
-      error: {
-        code: MANIFEST_ERROR_CODES.MISSING_NETWORK,
-        detail: `the gateway reports network "${deployment.network}", which has no Sui fullnode this SDK can read; pass fullnodeUrl to name one`
-      }
-    };
-  }
-  let chain;
+// src/settle.ts
+async function settlePreparedMcpPayment(args) {
   try {
-    chain = createSpendAccountChain({
-      packageId: deployment.packageId,
-      network,
-      ...options.fullnodeUrl ? { url: options.fullnodeUrl } : {},
-      ...options.client ? { client: options.client } : {}
-    });
-  } catch {
-    return {
-      ok: false,
-      error: {
-        code: MANIFEST_ERROR_CODES.GRANT_VERIFY_UNAVAILABLE,
-        detail: "the agent could not open a Sui fullnode client, so this grant was not verified and no payment was prepared"
-      }
-    };
-  }
-  const finality = createSpendAccountFinalityReader({ client: chain.client });
-  const getObjectJson = async (objectId) => {
-    const { object } = await chain.client.core.getObject({
-      objectId,
-      include: { json: true }
+    await verifyPreparedSettlementKind({
+      kindBytes: args.signingRequest.unsignedKindBytes,
+      expected: {
+        packageId: args.signingRequest.packageId,
+        delegateAddress: args.expected.delegateAddress,
+        amount: args.expected.amount,
+        recipient: args.expected.recipient,
+        accessMode: args.signingRequest.submit.moveCallTarget.endsWith(
+          "settle_open_recipient_payment"
+        ) ? "open" : "scoped"
+      },
+      getObjectJson: args.getObjectJson
     });
-    return mergeObjectEnvelope(object);
-  };
-  const verified = await verifyGrantOnChain({
-    getObjectJson,
-    grantObjectId: binding.grantObjectId,
-    poolObjectId: binding.poolObjectId,
-    delegateAddress: address
-  });
-  if (!verified.ok)
-    return verified;
-  const deps = {
-    paymentLedger: options.paymentLedger ?? createMemoryLedger(),
-    // Sponsorship IS a gateway service: the agent holds no SUI for gas, and the
-    // sponsor can only attach gas to a transaction this agent signed.
-    sponsor: { sponsorUrl: options.gatewayUrl },
-    gasMode: "sponsored",
-    resolveSharedObjectVersions: (ids) => resolveSharedObjectVersionsFromGetObject(getObjectJson, ids),
-    getFinalizedTx: finality.getFinalizedTx,
-    ...options.offerSecret ? { offerSecret: options.offerSecret } : {},
-    ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
-    ...options.logError ? { logError: options.logError } : {}
-  };
-  async function pay2(url, input) {
-    let request;
-    try {
-      request = normalizePaidHttpRequest({
-        url,
-        method: input.method,
-        ...input.body !== void 0 ? { body: input.body } : {},
-        ...input.contentType !== void 0 ? { contentType: input.contentType } : {}
-      });
-    } catch (err) {
-      options.logError?.("normalize paid request failed", err);
+  } catch (err) {
+    if (err instanceof PreparedVerificationUnavailableError) {
       return {
         status: "failed",
         paid: false,
-        code: DELEGATED_PAY_ERROR_CODES.UNSUPPORTED_REQUEST,
-        detail: "request cannot be paid for"
+        code: DELEGATED_PAY_ERROR_CODES.PREPARED_VERIFY_UNAVAILABLE,
+        detail: err.message
       };
     }
-    return payDelegatedSpendAccount({
-      url,
-      request,
-      session,
-      cfg: { gatewayUrl: options.gatewayUrl },
-      deps,
-      intent: input.intent,
-      ...input.preparedTerms ? { preparedTerms: input.preparedTerms } : {}
-    });
-  }
-  async function verifySettlement(prepared, offer) {
-    return verifyPreparedPayment({
-      prepared,
-      offer,
-      delegateAddress: address,
-      expectedGrantObjectId: binding.grantObjectId,
-      expectedPoolObjectId: binding.poolObjectId
-    });
-  }
-  return {
-    ok: true,
-    value: { address, deployment, grant: binding, session, pay: pay2, verifySettlement }
-  };
-}
-
-// src/stdio-login.ts
-import { createServer } from "http";
-import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import open from "open";
-var HEX642 = /^[0-9a-f]{64}$/;
-var PUBHEX = /^[0-9a-fA-F]{64}$/;
-function isPreflight(obj) {
-  if (!obj || typeof obj !== "object") return false;
-  const o = obj;
-  return typeof o.state === "string" && HEX642.test(o.state) && typeof o.publicKey === "string" && PUBHEX.test(o.publicKey) && typeof o.delegateAddress === "string" && /^0x[0-9a-fA-F]{64}$/.test(o.delegateAddress) && typeof o.gateway === "string" && o.gateway.length > 0;
-}
-function isCallback(obj) {
-  if (!obj || typeof obj !== "object") return false;
-  const o = obj;
-  return typeof o.state === "string" && HEX642.test(o.state) && typeof o.gatewayUrl === "string" && o.gatewayUrl.length > 0;
-}
-function stateEquals(a, b) {
-  if (a.length !== b.length) return false;
-  try {
-    return timingSafeEqual2(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
-  } catch {
-    return false;
-  }
-}
-function normalizeOrigin(url) {
-  try {
-    return new URL(url).origin;
-  } catch {
-    return url.replace(/\/+$/, "");
-  }
-}
-function loopbackAlternateOrigin(origin) {
-  try {
-    const url = new URL(origin);
-    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
-    if (url.hostname === "localhost") {
-      url.hostname = "127.0.0.1";
-      return url.origin;
-    }
-    if (url.hostname === "127.0.0.1") {
-      url.hostname = "localhost";
-      return url.origin;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function normalizeUrl(url) {
-  return url.replace(/\/+$/, "");
-}
-function readBody2(req, maxBytes = 16 * 1024) {
-  return new Promise((resolve, reject2) => {
-    const chunks = [];
-    let len = 0;
-    req.on("data", (c) => {
-      len += c.length;
-      if (len > maxBytes) {
-        reject2(new Error("body too large"));
-        req.destroy();
-        return;
-      }
-      chunks.push(c);
-    });
-    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
-    req.on("error", reject2);
-  });
-}
-var SECURITY_HEADERS = {
-  "cache-control": "no-store",
-  "x-content-type-options": "nosniff",
-  "referrer-policy": "no-referrer",
-  "content-security-policy": "default-src 'none'"
-};
-var SUCCESS_HTML = `<!doctype html><meta charset=utf-8><title>SuiPay MCP - Connected</title><body style="font:16px system-ui;max-width:480px;margin:80px auto;padding:0 24px"><h1>\u2713 SuiPay MCP connected</h1><p>Credentials saved to <code>~/.suipay/credentials.json</code>. You can close this tab \u2014 your MCP client will pick up the new credentials automatically.</p>`;
-var failHtml = (m) => `<!doctype html><meta charset=utf-8><title>SuiPay MCP - Failed</title><body style="font:16px system-ui;max-width:480px;margin:80px auto;padding:0 24px"><h1>\xD7 Login failed</h1><p>${m}</p>`;
-async function startStdioLogin(opts) {
-  const timeoutMs = opts.timeoutMs ?? 5 * 6e4;
-  const openBrowser = opts.openBrowser ?? false;
-  const label = opts.label ?? "SuiPay MCP";
-  const expectedOrigin = normalizeOrigin(opts.consoleUrl);
-  const allowedCorsOrigins = /* @__PURE__ */ new Set([expectedOrigin]);
-  const loopbackAlt = loopbackAlternateOrigin(expectedOrigin);
-  if (loopbackAlt) allowedCorsOrigins.add(loopbackAlt);
-  const expectedGateway = normalizeUrl(opts.gatewayUrl);
-  const connectState = randomBytes3(32).toString("hex");
-  const server = createServer();
-  server.requestTimeout = 1e4;
-  server.headersTimeout = 1e4;
-  server.keepAliveTimeout = 5e3;
-  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-  const port = server.address().port;
-  const allowedHosts = /* @__PURE__ */ new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
-  const base = opts.consoleUrl.replace(/\/+$/, "");
-  const connectUrl = `${base}/connect/agent?port=${port}&publicKey=${encodeURIComponent(opts.identity.publicKeyHex)}&delegateAddress=${encodeURIComponent(opts.identity.delegateAddress)}&label=${encodeURIComponent(label)}&gateway=${encodeURIComponent(opts.gatewayUrl)}&connectState=${connectState}`;
-  try {
-    opts.onUrl?.(connectUrl);
-  } catch {
+    return {
+      status: "failed",
+      paid: false,
+      code: DELEGATED_PAY_ERROR_CODES.TX_MISMATCH,
+      detail: err instanceof Error ? err.message : "prepared transaction mismatch"
+    };
   }
-  let preflightVerified = false;
-  let completed = false;
-  let error2 = null;
-  const done = new Promise((resolve) => {
-    const timer = setTimeout(() => {
-      if (!completed) {
-        error2 = new Error(`login timed out after ${timeoutMs}ms`);
-        server.close();
-        resolve();
-      }
-    }, timeoutMs);
-    timer.unref?.();
-    server.on("request", async (req, res) => {
-      const hostHeader = (req.headers.host ?? "").toLowerCase();
-      const origin = req.headers.origin;
-      const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
-      const okHost = allowedHosts.has(hostHeader);
-      let requestOrigin = null;
-      if (typeof origin === "string") {
-        try {
-          requestOrigin = new URL(origin).origin;
-        } catch {
-          requestOrigin = null;
-        }
-      }
-      const okOrigin = requestOrigin !== null && allowedCorsOrigins.has(requestOrigin);
-      const cors = {
-        "access-control-allow-origin": okOrigin && requestOrigin ? requestOrigin : expectedOrigin,
-        "access-control-allow-methods": "POST, OPTIONS",
-        "access-control-allow-headers": "content-type",
-        vary: "origin"
-      };
-      const send = (code, body, type = "text/plain", extra = {}) => {
-        res.writeHead(code, { "content-type": type, ...SECURITY_HEADERS, ...extra });
-        res.end(body);
-      };
-      const okPath = url.pathname === "/preflight" || url.pathname === "/callback";
-      if (req.method === "OPTIONS") {
-        const extra = { ...cors };
-        if (okHost && okOrigin && okPath && req.headers["access-control-request-private-network"] === "true") {
-          extra["access-control-allow-private-network"] = "true";
-        }
-        res.writeHead(204, { ...SECURITY_HEADERS, ...extra });
-        res.end();
-        return;
-      }
-      if (req.method !== "POST" || !okPath) {
-        send(404, "Not found");
-        return;
-      }
-      if (!okHost) {
-        send(403, "Forbidden");
-        return;
-      }
-      if (!okOrigin) {
-        send(403, "Forbidden");
-        return;
-      }
-      const ct = (req.headers["content-type"] ?? "").toLowerCase();
-      if (!ct.startsWith("application/json")) {
-        send(415, "Content-Type must be application/json");
-        return;
-      }
-      try {
-        const parsed = JSON.parse(await readBody2(req));
-        if (url.pathname === "/preflight") {
-          if (!isPreflight(parsed)) {
-            res.writeHead(400, {
-              "content-type": "application/json",
-              ...cors,
-              ...SECURITY_HEADERS
-            });
-            res.end(JSON.stringify({ ok: false, error: "invalid preflight payload" }));
-            return;
-          }
-          const derived = deriveSuiAddress(
-            Uint8Array.from(Buffer.from(parsed.publicKey, "hex"))
-          );
-          const valid = stateEquals(parsed.state, connectState) && stateEquals(
-            parsed.publicKey.toLowerCase(),
-            opts.identity.publicKeyHex.toLowerCase()
-          ) && parsed.delegateAddress.toLowerCase() === opts.identity.delegateAddress.toLowerCase() && derived.toLowerCase() === opts.identity.delegateAddress.toLowerCase() && normalizeUrl(parsed.gateway) === expectedGateway;
-          if (!valid) {
-            res.writeHead(403, {
-              "content-type": "application/json",
-              ...cors,
-              ...SECURITY_HEADERS
-            });
-            res.end(JSON.stringify({ ok: false, error: "preflight mismatch" }));
-            return;
-          }
-          preflightVerified = true;
-          res.writeHead(200, {
-            "content-type": "application/json",
-            ...cors,
-            ...SECURITY_HEADERS
-          });
-          res.end(
-            JSON.stringify({
-              ok: true,
-              publicKey: opts.identity.publicKeyHex,
-              label,
-              gateway: opts.gatewayUrl
-            })
-          );
-          return;
-        }
-        if (!preflightVerified) {
-          res.writeHead(428, {
-            "content-type": "text/html",
-            ...cors,
-            ...SECURITY_HEADERS
-          });
-          res.end(
-            failHtml("Local MCP bridge verification is required before the callback.")
-          );
-          return;
-        }
-        if (!isCallback(parsed)) {
-          res.writeHead(400, {
-            "content-type": "text/html",
-            ...cors,
-            ...SECURITY_HEADERS
-          });
-          res.end(failHtml("Callback payload missing required fields."));
-          return;
-        }
-        if (!stateEquals(parsed.state, connectState)) {
-          res.writeHead(403, {
-            "content-type": "text/html",
-            ...cors,
-            ...SECURITY_HEADERS
-          });
-          res.end(failHtml("Callback state mismatch \u2014 refusing to save."));
-          return;
-        }
-        if (normalizeUrl(parsed.gatewayUrl) !== expectedGateway) {
-          res.writeHead(403, {
-            "content-type": "text/html",
-            ...cors,
-            ...SECURITY_HEADERS
-          });
-          res.end(failHtml("Callback gateway mismatch \u2014 refusing to save."));
-          return;
-        }
-        preflightVerified = false;
-        persistGatewayUrl(opts.gatewayUrl);
-        completed = true;
-        res.writeHead(200, {
-          "content-type": "text/html",
-          ...cors,
-          ...SECURITY_HEADERS
-        });
-        res.end(SUCCESS_HTML);
-        setTimeout(() => server.close(), 100);
-        resolve();
-      } catch (err) {
-        error2 = err instanceof Error ? err : new Error(String(err));
-        res.writeHead(500, {
-          "content-type": "text/html",
-          ...cors,
-          ...SECURITY_HEADERS
-        });
-        res.end(failHtml("Internal error parsing callback."));
-        setTimeout(() => server.close(), 100);
-        resolve();
-      }
-    });
-  });
-  if (openBrowser) {
-    open(connectUrl).catch(() => {
-    });
+  const prepared = args.signingRequest.resource;
+  if (args.request.url !== prepared.url || args.request.method !== prepared.method) {
+    return {
+      status: "failed",
+      paid: false,
+      code: DELEGATED_PAY_ERROR_CODES.UNSUPPORTED_REQUEST,
+      detail: "prepared resource request cannot be replayed"
+    };
   }
-  void done.then(() => {
-    if (error2) {
-    }
+  return payDelegatedSpendAccount({
+    url: args.signingRequest.resource.url,
+    request: args.request,
+    session: args.session,
+    cfg: args.cfg,
+    deps: args.deps,
+    preparedTerms: {
+      recipient: args.expected.recipient,
+      amount: args.expected.amount,
+      asset: args.signingRequest.coinType,
+      targetHash: args.signingRequest.targetHash
+    },
+    ...args.intent ? { intent: args.intent } : {}
   });
-  return {
-    connectUrl,
-    port,
-    connectState,
-    done,
-    close: () => {
-      server.close();
-    }
-  };
 }
 
 // src/spend-account-pay.ts
-import { Transaction as Transaction6 } from "@mysten/sui/transactions";
+import { Transaction as Transaction5 } from "@mysten/sui/transactions";
 import {
-  fromBase64 as fromBase646,
-  normalizeSuiAddress as normalizeSuiAddress11,
+  fromBase64 as fromBase645,
+  normalizeSuiAddress as normalizeSuiAddress9,
   toBase64 as toBase644
 } from "@mysten/sui/utils";
 var SUI_CLOCK3 = "0x6";
@@ -6387,11 +5374,11 @@ async function buildSpendAccountPayKind2(input) {
   if (!input.termsHash.length) throw new Error("termsHash must be non-empty");
   if (!input.paymentIdHash.length) throw new Error("paymentIdHash must be non-empty");
   const auth = defaultAuthorityForRail("delegate", input.packageId);
-  const target = `${normalizeSuiAddress11(auth.packageId)}::${auth.module}::${auth.payFunction}`;
+  const target = `${normalizeSuiAddress9(auth.packageId)}::${auth.module}::${auth.payFunction}`;
   const hashHex = input.targetHash.replace(/^0x/i, "").toLowerCase();
   if (!/^[0-9a-f]{64}$/.test(hashHex)) throw new Error("targetHash must be 32-byte hex");
   const hash = Uint8Array.from(Buffer.from(hashHex, "hex"));
-  const tx = new Transaction6();
+  const tx = new Transaction5();
   tx.setSender(input.delegate);
   tx.moveCall({
     target,
@@ -6425,29 +5412,29 @@ async function buildSpendAccountPayKind2(input) {
 function verifySpendAccountPayReconstructs(bytes, expected) {
   let data;
   try {
-    data = Transaction6.from(fromBase646(bytes)).getData();
+    data = Transaction5.from(fromBase645(bytes)).getData();
   } catch {
     throw new Error("sponsored transaction is not valid Sui transaction bytes");
   }
-  if (!data.sender || normalizeSuiAddress11(data.sender) !== normalizeSuiAddress11(expected.delegate)) {
+  if (!data.sender || normalizeSuiAddress9(data.sender) !== normalizeSuiAddress9(expected.delegate)) {
     throw new Error("sponsored transaction sender does not match delegate");
   }
   if (!data.commands || data.commands.length !== 1) {
     throw new Error("sponsored transaction must contain exactly one command");
   }
   const auth = defaultAuthorityForRail("delegate", expected.packageId);
-  const wanted = `${normalizeSuiAddress11(auth.packageId)}::${auth.module}::${auth.payFunction}`;
+  const wanted = `${normalizeSuiAddress9(auth.packageId)}::${auth.module}::${auth.payFunction}`;
   const cmd = data.commands[0];
   if (cmd.$kind !== "MoveCall" || !cmd.MoveCall) {
     throw new Error("sponsored transaction is not a MoveCall");
   }
-  const got = `${normalizeSuiAddress11(String(cmd.MoveCall.package))}::${cmd.MoveCall.module}::${cmd.MoveCall.function}`;
+  const got = `${normalizeSuiAddress9(String(cmd.MoveCall.package))}::${cmd.MoveCall.module}::${cmd.MoveCall.function}`;
   if (got !== wanted) {
     throw new Error(`sponsored transaction does not reconstruct ${wanted}`);
   }
   let expectedKind;
   try {
-    expectedKind = Transaction6.fromKind(fromBase646(expected.kindBytes)).getData();
+    expectedKind = Transaction5.fromKind(fromBase645(expected.kindBytes)).getData();
   } catch {
     throw new Error("sponsored transaction kind baseline invalid");
   }
@@ -6604,7 +5591,7 @@ async function prepareSpendAccountPayment(args) {
   const signingRequest = {
     unsignedKindBytes: kindBytes,
     delegateAddress: resolved.delegateAddress,
-    packageId: normalizeSuiAddress11(authority.packageId),
+    packageId: normalizeSuiAddress9(authority.packageId),
     poolObjectId: resolved.poolObjectId,
     grantObjectId: resolved.grantObjectId,
     policyId: resolved.onChainPolicyId,
@@ -6685,203 +5672,28 @@ function mapErrorCode(code) {
   }
 }
 
-// src/discover-afford.ts
-import { normalizeStructTag as normalizeStructTag6 } from "@mysten/sui/utils";
-function sameCoinType2(rowAsset, grantCoin) {
-  if (typeof rowAsset !== "string" || !grantCoin) return false;
-  try {
-    return normalizeStructTag6(rowAsset) === normalizeStructTag6(grantCoin);
-  } catch {
-    return false;
-  }
-}
-function parseAtomic(value) {
-  if (typeof value === "bigint") return value >= 0n ? value : null;
-  if (typeof value === "number" && Number.isInteger(value) && value >= 0) {
-    return BigInt(value);
-  }
-  if (typeof value !== "string") return null;
-  const raw = value.trim();
-  if (!/^[0-9]+$/.test(raw)) return null;
-  return BigInt(raw);
-}
-function catalogPriceAtomic(row) {
-  return parseAtomic(row.price);
-}
-function catalogDecimals(row) {
-  if (typeof row.decimals !== "number" || !Number.isInteger(row.decimals)) return null;
-  if (row.decimals < 0 || row.decimals > 18) return null;
-  return row.decimals;
-}
-function formatAtomic(amount, decimals) {
-  if (!Number.isInteger(decimals) || decimals < 0 || decimals > 18) {
-    return amount.toString();
-  }
-  const negative = amount < 0n;
-  const abs = negative ? -amount : amount;
-  const scale = 10n ** BigInt(decimals);
-  const whole = abs / scale;
-  const frac = abs % scale;
-  const sign = negative ? "-" : "";
-  if (decimals === 0 || frac === 0n) return `${sign}${whole.toString()}`;
-  const fracStr = frac.toString().padStart(decimals, "0").replace(/0+$/, "");
-  return `${sign}${whole.toString()}.${fracStr}`;
-}
-function minAtomic(left, right) {
-  if (left == null) return right;
-  if (right == null) return left;
-  return left <= right ? left : right;
-}
-function isAffordable(price, budget, opts = {}) {
-  if (price == null) return void 0;
-  if (!sameCoinType2(opts.asset, budget.coinType)) return void 0;
-  const remaining = parseAtomic(budget.sessionRemaining);
-  if (remaining == null) return void 0;
-  if (price > remaining) return false;
-  const cap = minAtomic(
-    parseAtomic(budget.maxPerPayment),
-    parseAtomic(opts.targetMaxPerPayment ?? null)
-  );
-  if (cap != null && price > cap) return false;
-  return true;
-}
-function withCatalogAffordability(service, budget) {
-  if (!budget) return service;
-  const price = catalogPriceAtomic(service);
-  const decimals = catalogDecimals(service);
-  const targetMax = typeof service.maxPerPayment === "string" ? service.maxPerPayment : null;
-  const sameAsset = sameCoinType2(service.asset, budget.coinType);
-  const affordable = isAffordable(price, budget, {
-    targetMaxPerPayment: targetMax,
-    asset: service.asset
-  });
-  const remaining = sameAsset ? parseAtomic(budget.sessionRemaining) : null;
-  const out = { ...service };
-  if (price != null) out.price = price.toString();
-  if (decimals != null) out.decimals = decimals;
-  if (remaining != null) out.sessionRemaining = remaining.toString();
-  if (affordable !== void 0) out.affordable = affordable;
-  if (decimals != null && price != null) out.priceDisplay = formatAtomic(price, decimals);
-  if (decimals != null && remaining != null) {
-    out.remainingDisplay = formatAtomic(remaining, decimals);
-  }
-  return out;
-}
-
-// src/discover-catalog.ts
-function asString(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-function catalogRows(catalog) {
-  if (Array.isArray(catalog)) return catalog.filter((row) => row && typeof row === "object");
-  if (!catalog || typeof catalog !== "object") return [];
-  const services = catalog.services;
-  if (!Array.isArray(services)) return [];
-  return services.filter((row) => row && typeof row === "object");
-}
-function authorizationEpochOf(row) {
-  if (typeof row.authorizationEpoch === "number" && Number.isInteger(row.authorizationEpoch)) {
-    return row.authorizationEpoch;
-  }
-  const state = row.state;
-  if (state && typeof state === "object") {
-    const revision = state.revision;
-    if (typeof revision?.authorizationEpoch === "number" && Number.isInteger(revision.authorizationEpoch)) {
-      return revision.authorizationEpoch;
-    }
-  }
-  return 1;
-}
-function catalogRowTargetHash(row) {
-  const id = asString(row.id);
-  const path = asString(row.path);
-  const method = asString(row.method) || "GET";
-  const network = asString(row.network);
-  const asset = asString(row.asset);
-  const recipient = asString(row.payTo) || asString(row.recipient);
-  const providerId = asString(row.ownerAddress) || asString(row.providerId);
-  const endpointId = asString(row.endpointId) || id;
-  if (!id || !path || !network || !asset || !recipient || !providerId) return null;
-  try {
-    return targetHashFromFingerprint(
-      authorizationFingerprint({
-        network,
-        providerId,
-        serviceId: id,
-        endpointId,
-        method,
-        path,
-        asset,
-        recipient,
-        authorizationEpoch: authorizationEpochOf(row)
-      })
-    ).toLowerCase();
-  } catch {
-    return null;
-  }
-}
-function catalogRowResourceUrl(row, gatewayUrl) {
-  const listed = asString(row.resourceUrl);
-  if (/^https?:\/\//i.test(listed)) return listed.replace(/\/+$/, "");
-  const path = asString(row.path);
-  const base = gatewayUrl.replace(/\/+$/, "");
-  if (!path) return base;
-  return `${base}${path.startsWith("/") ? path : `/${path}`}`;
-}
-function matchesQuery(row, query) {
-  if (!query) return true;
-  return JSON.stringify(row).toLowerCase().includes(query);
-}
-function joinDiscoverCatalog(opts) {
-  const query = opts.query?.trim().toLowerCase() ?? "";
-  const rows = catalogRows(opts.catalog);
-  const scoped = Array.isArray(opts.policies);
-  const byHash = /* @__PURE__ */ new Map();
-  const allowedTargetHashes = [];
-  if (scoped) {
-    for (const policy of opts.policies) {
-      for (const target of policy.targets) {
-        const hash = asString(target.targetHash).toLowerCase();
-        if (!hash) continue;
-        allowedTargetHashes.push(hash);
-        if (!byHash.has(hash)) byHash.set(hash, { ...policy, target });
-      }
-    }
-  }
-  const services = [];
-  for (const row of rows) {
-    const targetHash = catalogRowTargetHash(row);
-    const url = catalogRowResourceUrl(row, opts.gatewayUrl);
-    const bound = targetHash && scoped ? byHash.get(targetHash) : void 0;
-    if (scoped && !bound) continue;
-    const service = {
-      ...row,
-      ...targetHash ? { targetHash } : {},
-      url
-    };
-    if (bound) {
-      service.policyId = bound.policyId;
-      service.onChainPolicyId = bound.onChainPolicyId;
-      service.policyStatus = bound.status;
-      if (bound.target.recipient) service.recipient = bound.target.recipient;
-      if (bound.target.maxPerPayment) service.maxPerPayment = bound.target.maxPerPayment;
-    }
-    if (!matchesQuery(service, query)) continue;
-    services.push(withCatalogAffordability(service, opts.budget));
-  }
-  return scoped ? { accessMode: "scoped", count: services.length, services, allowedTargetHashes } : { accessMode: "open", count: services.length, services };
+// src/tools.ts
+function payerTrace(deps) {
+  const hooks = deps.trace;
+  const buyerAccountId = deps.auth?.buyerAccountId;
+  if (!hooks || !buyerAccountId) return null;
+  return {
+    sink: hooks.sink,
+    traceId: hooks.context.traceId,
+    requestId: hooks.context.requestId,
+    buyerAccountId,
+    connectionId: hooks.runtime.connectionId,
+    ...hooks.runtime.secret ? { secret: hooks.runtime.secret } : {},
+    ...hooks.runtime.now ? { now: hooks.runtime.now } : {}
+  };
 }
-
-// src/tool-result.ts
-var MAX_MCP_IMAGE_BYTES = 5 * 1024 * 1024;
+var AUTH_REQUIRED = "No SuiPay credentials - run suipay_login to create a local delegate key, then bind a spend-account grant in the console.";
 function text(value) {
   return {
-    content: [
-      {
-        type: "text",
-        text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
-      }
-    ]
+    content: [{
+      type: "text",
+      text: typeof value === "string" ? value : JSON.stringify(value, null, 2)
+    }]
   };
 }
 function error(value) {
@@ -6893,6 +5705,7 @@ function closedError(code, detail) {
 function closedPayError(code, detail) {
   return error({ status: "failed", paid: false, code, detail });
 }
+var MAX_MCP_IMAGE_BYTES = 5 * 1024 * 1024;
 function paidResult(result) {
   if (!isBinaryBody(result.body)) return text(result);
   const body = result.body;
@@ -6913,137 +5726,6 @@ function paidResult(result) {
   }
   return { content };
 }
-function settlePayResult(result) {
-  if (result.paid === true) return paidResult(result);
-  return error(result);
-}
-
-// src/pay-file.ts
-import { isAbsolute } from "path";
-import { openSync as openSync2, closeSync as closeSync2, fstatSync, readFileSync as readFileSync2, constants } from "fs";
-var MCP_MAX_FILE_FIELD_BYTES = 32 * 1024;
-var FIELD = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
-var FORBIDDEN = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-function fail2(code, detail) {
-  return { code, detail };
-}
-function parseField(value) {
-  if (typeof value !== "string" || !FIELD.test(value) || FORBIDDEN.has(value)) {
-    return fail2("INVALID_FILE_FIELD", "fileField must be a simple JSON key");
-  }
-  return value;
-}
-function parsePath(value) {
-  if (typeof value !== "string" || value.length === 0 || value.includes("\0")) {
-    return fail2("INVALID_FILE", "file must be a non-empty absolute path");
-  }
-  if (!isAbsolute(value) || value.includes("://")) {
-    return fail2("INVALID_FILE", "file must be an absolute filesystem path, not a URL");
-  }
-  return value;
-}
-function readRegularFile(path) {
-  let fd;
-  try {
-    const flags = constants.O_RDONLY | (constants.O_NOFOLLOW !== void 0 ? constants.O_NOFOLLOW : 0);
-    fd = openSync2(path, flags);
-    const st = fstatSync(fd);
-    if (!st.isFile()) {
-      return fail2("INVALID_FILE", "file must be a regular file");
-    }
-    if (st.size === 0) {
-      return fail2("EMPTY_FILE", "file is empty");
-    }
-    if (st.size > MCP_MAX_FILE_FIELD_BYTES) {
-      return fail2(
-        "FILE_TOO_LARGE",
-        `file exceeds ${MCP_MAX_FILE_FIELD_BYTES} decoded bytes`
-      );
-    }
-    const bytes = readFileSync2(fd);
-    if (bytes.byteLength === 0) {
-      return fail2("EMPTY_FILE", "file is empty");
-    }
-    if (bytes.byteLength > MCP_MAX_FILE_FIELD_BYTES) {
-      return fail2(
-        "FILE_TOO_LARGE",
-        `file exceeds ${MCP_MAX_FILE_FIELD_BYTES} decoded bytes`
-      );
-    }
-    return bytes;
-  } catch (err) {
-    const code = err.code;
-    if (code === "ENOENT") return fail2("FILE_NOT_FOUND", "file does not exist");
-    if (code === "ELOOP" || code === "EMLINK") {
-      return fail2("INVALID_FILE", "file must be a regular file");
-    }
-    return fail2("INVALID_FILE", "file could not be read");
-  } finally {
-    if (fd !== void 0) closeSync2(fd);
-  }
-}
-function toCanonicalBase64(bytes) {
-  return Buffer.from(bytes).toString("base64");
-}
-function jsonWithLocalFile(input) {
-  const hasFile = input.file !== void 0 && input.file !== null && input.file !== "";
-  const hasField = input.fileField !== void 0 && input.fileField !== null && input.fileField !== "";
-  if (!hasFile && !hasField) return { json: input.json };
-  if (hasFile !== hasField) {
-    return {
-      error: fail2(
-        "INVALID_FILE_ARGS",
-        "file and fileField are required together"
-      )
-    };
-  }
-  const method = input.method === void 0 || input.method === null || input.method === "" ? "GET" : String(input.method).trim().toUpperCase();
-  if (method !== "POST") {
-    return { error: fail2("INVALID_FILE_ARGS", "file is only valid on POST") };
-  }
-  const field = parseField(input.fileField);
-  if (typeof field !== "string") return { error: field };
-  const path = parsePath(input.file);
-  if (typeof path !== "string") return { error: path };
-  let json;
-  if (input.json === void 0) {
-    json = {};
-  } else if (typeof input.json === "object" && input.json !== null && !Array.isArray(input.json)) {
-    json = { ...input.json };
-  } else {
-    return { error: fail2("MALFORMED_REQUEST", "POST requires json object") };
-  }
-  if (Object.prototype.hasOwnProperty.call(json, field)) {
-    return {
-      error: fail2(
-        "FILE_FIELD_EXISTS",
-        "json already has fileField; refuse to overwrite"
-      )
-    };
-  }
-  const bytes = readRegularFile(path);
-  if (!(bytes instanceof Uint8Array)) return { error: bytes };
-  json[field] = toCanonicalBase64(bytes);
-  return { json };
-}
-
-// src/tools.ts
-function payerTrace(deps) {
-  const hooks = deps.trace;
-  const buyerAccountId = deps.auth?.buyerAccountId;
-  if (!hooks || !buyerAccountId) return null;
-  return {
-    sink: hooks.sink,
-    traceId: hooks.context.traceId,
-    requestId: hooks.context.requestId,
-    buyerAccountId,
-    connectionId: hooks.runtime.connectionId,
-    ...hooks.runtime.secret ? { secret: hooks.runtime.secret } : {},
-    ...hooks.runtime.now ? { now: hooks.runtime.now } : {}
-  };
-}
-var AUTH_REQUIRED = "No SuiPay credentials - call suipay_login first. It returns a console URL; approve the spend-account grant in the browser. The next tool call picks up ~/.suipay/credentials.json automatically.";
-var LOGIN_BG_TIMEOUT_MS = 5 * 6e4;
 function preparedResult(result) {
   return text({
     status: "prepared",
@@ -7063,7 +5745,7 @@ function normalizePayIntent(args) {
     if (!/^0x[0-9a-fA-F]{1,64}$/.test(raw)) {
       throw new Error("recipient must be a 0x-prefixed Sui address");
     }
-    const normalized = normalizeSuiAddress12(raw);
+    const normalized = normalizeSuiAddress10(raw);
     if (!isValidSuiAddress(normalized) || /^0x0+$/.test(normalized)) {
       throw new Error("recipient must be a non-zero Sui address");
     }
@@ -7082,7 +5764,7 @@ function intentViolation(intent, prepared) {
   if (intent.recipient) {
     let preparedRecipient;
     try {
-      preparedRecipient = normalizeSuiAddress12(prepared.recipient);
+      preparedRecipient = normalizeSuiAddress10(prepared.recipient);
     } catch {
       return "prepared payment does not name a valid recipient";
     }
@@ -7105,27 +5787,15 @@ function intentViolation(intent, prepared) {
 }
 async function pay(args, cfg, deps = {}) {
   if (!args.url) return error("url is required");
-  const hasFileArg = args.file !== void 0 && args.file !== null && args.file !== "" || args.fileField !== void 0 && args.fileField !== null && args.fileField !== "";
-  if (hasFileArg && deps.auth) {
-    return closedPayError(
-      "FILE_STDIO_ONLY",
-      "file is stdio only; hosted /mcp does not read the buyer disk"
-    );
-  }
   let intent;
   try {
     intent = normalizePayIntent(args);
   } catch {
     return closedPayError("INVALID_INTENT", "payment intent is invalid");
   }
-  const attached = jsonWithLocalFile(args);
-  if ("error" in attached) {
-    return closedPayError(attached.error.code, attached.error.detail);
-  }
-  const paidArgs = { ...args, json: attached.json };
   let request;
   try {
-    request = normalizeMcpPaidHttpRequest(paidArgs);
+    request = normalizeMcpPaidHttpRequest(args);
   } catch (err) {
     const raw = err instanceof Error ? err.message : "";
     const detail = /method/i.test(raw) ? "method must be GET or POST" : /json/i.test(raw) ? "POST requires json" : "request could not be normalized";
@@ -7200,10 +5870,10 @@ async function pay(args, cfg, deps = {}) {
           ...deps.fetchImpl && !deps.agentHeld.payerDeps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
         }
       });
-      return settlePayResult(settled);
+      return settled.status === "ok" ? paidResult(settled) : error(settled);
     }
     if (result.status === "prepared") return preparedResult(result);
-    return settlePayResult(result);
+    return result.status === "ok" ? paidResult(result) : error(result);
   }
   if (deps.auth) {
     return error(
@@ -7218,259 +5888,122 @@ async function pay(args, cfg, deps = {}) {
   }
   const local = loadLocalSigner();
   if (!local) return error(AUTH_REQUIRED);
-  return payStdioWithLocalKey({ request, intent, cfg, deps });
+  return payStdioWithLocalKey({ request, intent, cfg, deps, local });
 }
-function stdioGatewayUrl(cfg) {
-  return loadLocalSigningKeyRecord()?.gatewayUrl ?? cfg.gatewayUrl;
+function snapshotFromBinding(binding, delegateAddress) {
+  return {
+    grantId: binding.grantObjectId,
+    status: "active",
+    grantObjectId: binding.grantObjectId,
+    poolObjectId: binding.poolObjectId,
+    coinType: binding.coinType,
+    delegateAddress,
+    policies: binding.policies,
+    accessMode: binding.accessMode,
+    ...binding.maxPerPayment != null ? { maxPerPayment: binding.maxPerPayment } : {},
+    ...binding.sessionCap != null ? { sessionCap: binding.sessionCap } : {}
+  };
 }
-function isExpiredBootstrapGrant(expiresAtMs, nowMs) {
-  if (expiresAtMs === void 0 || expiresAtMs === null || expiresAtMs === "" || expiresAtMs === "0" || expiresAtMs === 0) {
-    return false;
-  }
-  const exp = typeof expiresAtMs === "number" ? expiresAtMs : typeof expiresAtMs === "string" && /^\d+$/.test(expiresAtMs) ? Number(expiresAtMs) : NaN;
-  if (!Number.isFinite(exp) || exp <= 0) return false;
-  return exp <= nowMs;
-}
-function grantObjectIdFromBootstrap(grants, nowMs) {
-  let named = 0;
-  const live = [];
-  for (const grant of grants) {
-    if (!grant || typeof grant !== "object") continue;
-    const g = grant;
-    const id = g.grantObjectId;
-    if (typeof id !== "string" || !id.trim()) continue;
-    named += 1;
-    if (isExpiredBootstrapGrant(g.expiresAtMs, nowMs)) continue;
-    live.push(id.trim());
-  }
-  if (live.length === 1) return { kind: "live", grantObjectId: live[0] };
-  if (live.length > 1) return { kind: "ambiguous" };
-  if (named > 0) return { kind: "absent" };
-  if (grants.length > 0) return { kind: "unknown", detail: "delegate grants list was not usable" };
-  return { kind: "absent" };
-}
-async function checkLiveDelegateGrant(args) {
-  const deployment = await fetchGatewayDeployment({
-    gatewayUrl: args.gatewayUrl,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
-  });
-  if (!deployment.ok) {
-    return {
-      kind: "unknown",
-      detail: "gateway deployment identity could not be verified"
-    };
-  }
-  const listed = await bootstrapPayerGrants({
-    gatewayUrl: args.gatewayUrl,
-    context: {
-      network: deployment.value.network,
-      packageId: deployment.value.packageId,
-      delegateAddress: args.delegateAddress
+async function payStdioWithLocalKey(args) {
+  const { request, intent, cfg, deps, local } = args;
+  const resolved = await resolvePayerSession({
+    gatewayUrl: cfg.gatewayUrl,
+    delegateAddress: local.address,
+    signPersonalMessage: local.signPersonalMessage,
+    signer: {
+      address: local.address,
+      signTransaction: local.signTransaction,
+      signPersonalMessage: local.signPersonalMessage
     },
-    signPersonalMessage: args.signPersonalMessage,
-    ...args.fetchImpl ? { fetchImpl: args.fetchImpl } : {}
+    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
   });
-  if (!listed.ok) {
-    return {
-      kind: "unknown",
-      detail: `delegate grants read ${listed.error} (HTTP ${listed.status})`
-    };
-  }
-  if (!Array.isArray(listed.data.grants) || listed.data.grants.length === 0) {
-    return { kind: "absent" };
-  }
-  return grantObjectIdFromBootstrap(listed.data.grants, Date.now());
-}
-async function payStdioWithLocalKey(args) {
-  const { request, intent, cfg, deps } = args;
-  const built = await stdioPayerAndReader(cfg, deps);
-  if (!built.ok) return built.result;
-  const payer = built.payer;
-  const grantCeiling = payer.grant.maxPerPayment;
-  const maxAmount = intent.maxAmount !== void 0 ? intent.maxAmount.toString() : grantCeiling != null && grantCeiling !== "" ? grantCeiling : null;
-  if (maxAmount === null) {
-    return error({
-      status: "failed",
-      paid: false,
-      code: "POLICY_REJECTED",
-      detail: "stdio pay requires maxAmount or a grant maxPerPayment; refusing to default the ceiling to the offer"
-    });
+  if (!resolved.ok) {
+    return closedPayError(resolved.error.code, resolved.error.detail);
   }
-  const settled = await payer.pay(request.url, {
-    method: request.method,
-    ...request.method === "POST" ? { body: request.body } : {},
-    ...request.contentType ? { contentType: request.contentType } : {},
-    intent: {
-      maxAmount,
-      asset: payer.grant.coinType,
-      ...intent.recipient ? { recipient: intent.recipient } : {}
+  const snapshot = snapshotFromBinding(resolved.value.binding, local.address);
+  const packageId = resolved.value.session.packageId;
+  const result = await prepareSpendAccountPayment({
+    url: request.url,
+    request,
+    session: {
+      snapshot,
+      packageId,
+      ...resolved.value.session.assertLive ? { assertLive: resolved.value.session.assertLive } : {}
+    },
+    cfg,
+    deps: {
+      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
+      ...deps.buildPayKind ? { buildPayKind: deps.buildPayKind } : {}
     }
   });
-  return settlePayResult(settled);
-}
-async function stdioPayerAndReader(cfg, deps) {
-  const keypair = loadLocalKeypair();
-  if (!keypair) return { ok: false, result: error(AUTH_REQUIRED) };
-  const gatewayUrl = stdioGatewayUrl(cfg);
-  const local = loadLocalSigner();
-  let select;
-  const shouldSelect = Boolean(local) && (deps.fetchImpl !== void 0 || deps.createPayer === void 0);
-  if (local && shouldSelect) {
-    const check = await checkLiveDelegateGrant({
-      gatewayUrl,
-      delegateAddress: local.address,
-      signPersonalMessage: local.signPersonalMessage,
-      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-    });
-    if (check.kind === "ambiguous") {
-      return {
-        ok: false,
-        result: closedError(
-          "AMBIGUOUS_GRANT",
-          "multiple live grants name this key; pass a selector (grantObjectId / asset / coinType)"
-        )
-      };
+  if (result.status === "prepared") {
+    const violation = intentViolation(intent, result.signingRequest);
+    if (violation) {
+      return error({
+        status: "failed",
+        paid: false,
+        code: "POLICY_REJECTED",
+        detail: violation
+      });
     }
-    if (check.kind === "live") select = { grantObjectId: check.grantObjectId };
-  }
-  const built = await (deps.createPayer ?? createPayer)({
-    gatewayUrl,
-    keypair,
-    ...select ? { select } : {},
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {},
-    ...cfg.rpcUrl ? { fullnodeUrl: cfg.rpcUrl } : {}
-  });
-  if (!built.ok) {
-    return {
-      ok: false,
-      result: closedError(built.error.code, built.error.detail)
+    const agentHeld = deps.agentHeld ?? settlementFromLocalSigner(cfg, local, packageId);
+    const grantCeiling = resolved.value.binding.maxPerPayment;
+    const maxAmount = intent.maxAmount !== void 0 ? intent.maxAmount.toString() : grantCeiling != null && grantCeiling !== "" ? grantCeiling : null;
+    if (maxAmount === null) {
+      return error({
+        status: "failed",
+        paid: false,
+        code: "POLICY_REJECTED",
+        detail: "stdio pay requires maxAmount or a grant maxPerPayment; refusing to default the ceiling to the offer"
+      });
+    }
+    const spendIntent = {
+      maxAmount,
+      asset: resolved.value.binding.coinType,
+      ...intent.recipient ? { recipient: intent.recipient } : {}
     };
+    const settled = await settlePreparedMcpPayment({
+      signingRequest: result.signingRequest,
+      request,
+      expected: {
+        amount: result.signingRequest.amount,
+        recipient: intent.recipient ?? result.signingRequest.recipient,
+        delegateAddress: local.address
+      },
+      signer: local,
+      getObjectJson: agentHeld.getObjectJson,
+      session: {
+        ...resolved.value.session,
+        signer: local
+      },
+      cfg: { gatewayUrl: cfg.gatewayUrl },
+      deps: {
+        ...agentHeld.payerDeps,
+        ...deps.fetchImpl && !agentHeld.payerDeps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+      },
+      intent: spendIntent
+    });
+    return settled.status === "ok" ? paidResult(settled) : error(settled);
   }
-  return { ok: true, payer: built.value };
-}
-function stdioReaderForPayer(cfg, deps, payer) {
-  return (deps.createReader ?? createReader)({
-    gatewayUrl: stdioGatewayUrl(cfg),
-    context: {
-      network: payer.deployment.network,
-      packageId: payer.deployment.packageId,
-      grantObjectId: payer.grant.grantObjectId,
-      delegateAddress: payer.address
-    },
-    signPersonalMessage: async (message) => {
-      const { signature } = await loadLocalKeypair().signPersonalMessage(message);
-      return signature;
-    },
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-  });
-}
-function budgetFromBalance(balance, grant) {
-  if (!balance.ok || !balance.data) return void 0;
-  return {
-    sessionRemaining: balance.data.sessionRemaining ?? null,
-    maxPerPayment: balance.data.maxPerPayment ?? grant.maxPerPayment ?? null,
-    coinType: balance.data.coinType ?? grant.coinType ?? null
-  };
-}
-async function fetchPublicCatalog(gatewayUrl, fetchImpl) {
-  const catalogUrl = new URL("/v1/services", gatewayUrl);
-  const response = await (fetchImpl ?? fetch)(catalogUrl);
-  if (!response.ok) return { ok: false, result: error(`gateway unavailable: HTTP ${response.status}`) };
-  return { ok: true, catalog: await response.json() };
-}
-async function publicCatalog(gatewayUrl, query, fetchImpl) {
-  const loaded = await fetchPublicCatalog(gatewayUrl, fetchImpl);
-  if (!loaded.ok) return loaded.result;
-  return text(
-    joinDiscoverCatalog({
-      catalog: loaded.catalog,
-      gatewayUrl,
-      query
-    })
-  );
+  return result.status === "ok" ? paidResult(result) : error(result);
 }
 async function discover(args, cfg, deps = {}) {
-  if (deps.auth || !loadLocalKeypair()) {
-    return publicCatalog(cfg.gatewayUrl, args.query, deps.fetchImpl);
+  const url = new URL("/v1/services", cfg.gatewayUrl);
+  if (args.query) url.searchParams.set("q", args.query);
+  const response = await (deps.fetchImpl ?? fetch)(url);
+  if (!response.ok) return error(`gateway unavailable: HTTP ${response.status}`);
+  return text(await response.json());
+}
+async function accessContext(deps = {}) {
+  if (!deps.auth) return error(AUTH_REQUIRED);
+  if (!deps.auth.access) {
+    return error(
+      "SuiPay access context unavailable. Reconnect this MCP session or inspect the connection in buyer console."
+    );
   }
-  const local = loadLocalSigner();
-  if (local) {
-    const check = await checkLiveDelegateGrant({
-      gatewayUrl: stdioGatewayUrl(cfg),
-      delegateAddress: local.address,
-      signPersonalMessage: local.signPersonalMessage,
-      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-    });
-    if (check.kind !== "live") {
-      return publicCatalog(stdioGatewayUrl(cfg), args.query, deps.fetchImpl);
-    }
-  }
-  const resolved = await stdioPayerAndReader(cfg, deps);
-  if (!resolved.ok) return resolved.result;
-  const gatewayUrl = stdioGatewayUrl(cfg);
-  const loaded = await fetchPublicCatalog(gatewayUrl, deps.fetchImpl);
-  if (!loaded.ok) return loaded.result;
-  const scoped = resolved.payer.grant.accessMode === "scoped";
-  const reader = stdioReaderForPayer(cfg, deps, resolved.payer);
-  const [policies, balance] = await Promise.all([
-    scoped ? reader.policies() : Promise.resolve({ ok: true, data: { policies: void 0 } }),
-    reader.balance()
-  ]);
-  if (scoped && !policies.ok) {
-    return closedError("POLICIES_UNAVAILABLE", "grant policies could not be loaded");
-  }
-  return text(
-    joinDiscoverCatalog({
-      catalog: loaded.catalog,
-      gatewayUrl,
-      query: args.query,
-      ...scoped && policies.ok ? { policies: policies.data.policies } : {},
-      budget: budgetFromBalance(balance, resolved.payer.grant)
-    })
-  );
-}
-async function accessContext(deps = {}, cfg) {
-  if (deps.auth) {
-    if (!deps.auth.access) {
-      return error(
-        "SuiPay access context unavailable. Reconnect this MCP session or inspect the connection in buyer console."
-      );
-    }
-    return text(deps.auth.access);
-  }
-  if (!cfg) return error(AUTH_REQUIRED);
-  const resolved = await stdioPayerAndReader(cfg, deps);
-  if (!resolved.ok) return resolved.result;
-  const gatewayUrl = stdioGatewayUrl(cfg);
-  const reader = stdioReaderForPayer(cfg, deps, resolved.payer);
-  const scoped = resolved.payer.grant.accessMode === "scoped";
-  const [policies, balance, loaded] = await Promise.all([
-    reader.policies(),
-    reader.balance(),
-    fetchPublicCatalog(gatewayUrl, deps.fetchImpl)
-  ]);
-  const budget = budgetFromBalance(balance, resolved.payer.grant);
-  const joined = loaded.ok && (!scoped || policies.ok) ? joinDiscoverCatalog({
-    catalog: loaded.catalog,
-    gatewayUrl,
-    ...scoped && policies.ok ? { policies: policies.data.policies } : {},
-    budget
-  }) : null;
-  return text({
-    accessMode: resolved.payer.grant.accessMode,
-    grant: {
-      id: resolved.payer.grant.grantObjectId,
-      poolObjectId: resolved.payer.grant.poolObjectId,
-      coinType: resolved.payer.grant.coinType,
-      maxPerPayment: resolved.payer.grant.maxPerPayment ?? null,
-      sessionCap: resolved.payer.grant.sessionCap ?? null
-    },
-    policies: policies.ok ? policies.data : { error: policies.error },
-    balance: balance.ok ? balance.data : { error: balance.error },
-    ...joined ? { services: joined.services, count: joined.count } : {}
-  });
+  return text(deps.auth.access);
 }
-async function receipts(args, cfg, deps = {}) {
+async function receipts(args, _cfg, deps = {}) {
   if (deps.auth) {
     if (!deps.auth.listReceipts) {
       return error(
@@ -7484,144 +6017,28 @@ async function receipts(args, cfg, deps = {}) {
       return closedError("RECEIPTS_UNAVAILABLE", "receipts could not be loaded");
     }
   }
-  if (profile(deps)) {
-    return error(
-      "receipts is available after suipay_login (version-2 key) or on remote OAuth (/mcp) sessions; the local V1 allowance profile has no settlement feed access"
-    );
-  }
-  const resolved = await stdioPayerAndReader(cfg, deps);
-  if (!resolved.ok) return resolved.result;
-  const reader = (deps.createReader ?? createReader)({
-    gatewayUrl: stdioGatewayUrl(cfg),
-    context: {
-      network: resolved.payer.deployment.network,
-      packageId: resolved.payer.deployment.packageId,
-      grantObjectId: resolved.payer.grant.grantObjectId,
-      delegateAddress: resolved.payer.address
-    },
-    signPersonalMessage: async (message) => {
-      const { signature } = await loadLocalKeypair().signPersonalMessage(message);
-      return signature;
-    },
-    ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-  });
-  const listed = await reader.receipts();
-  if (!listed.ok) {
-    return closedError("RECEIPTS_UNAVAILABLE", "receipts could not be loaded");
-  }
-  const receiptsOut = listed.data.receipts;
-  const filtered = args.challengeId && Array.isArray(receiptsOut) ? receiptsOut.filter((row) => {
-    if (!row || typeof row !== "object") return false;
-    const rec = row;
-    return rec.challengeId === args.challengeId || rec.receipt?.challengeId === args.challengeId;
-  }) : receiptsOut;
-  return text({ count: Array.isArray(filtered) ? filtered.length : 0, receipts: filtered });
-}
-function parseLoginTarget(value) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  if (typeof value !== "string") return { error: 'target must be "dev" or "local"' };
-  const target = value.trim().toLowerCase();
-  if (target === "dev" || target === "local") return target;
-  return { error: 'target must be "dev" or "local"' };
+  if (!profile(deps)) return error(AUTH_REQUIRED);
+  return error(
+    "receipts is available on remote OAuth (/mcp) sessions only; the local allowance profile has no settlement feed access"
+  );
 }
 async function suipayLogin(args, cfg, deps = {}) {
-  const parsedTarget = parseLoginTarget(args.target);
-  if (parsedTarget && typeof parsedTarget === "object" && "error" in parsedTarget) {
-    return error({
-      status: "failed",
-      code: "INVALID_TARGET",
-      detail: parsedTarget.error
-    });
-  }
-  const target = parsedTarget;
   const label = args.label?.trim() || cfg.label.trim();
   const identity = await ensureLocalSigningKey(label ? { label } : {});
-  const local = loadLocalSigner();
-  const stored = loadLocalSigningKeyRecord();
-  const endpoints = target ? MCP_TARGET_PRESETS[target] : {
-    consoleUrl: cfg.consoleUrl,
-    gatewayUrl: stored?.gatewayUrl ?? cfg.gatewayUrl
-  };
-  if (local) {
-    const live = await checkLiveDelegateGrant({
-      gatewayUrl: endpoints.gatewayUrl,
-      delegateAddress: local.address,
-      signPersonalMessage: local.signPersonalMessage,
-      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
-    });
-    if (live.kind === "ambiguous") {
-      return error({
-        status: "failed",
-        code: "AMBIGUOUS_GRANT",
-        detail: "multiple live grants name this key; revoke extras or pass a selector before paying"
-      });
-    }
-    if (live.kind === "live") {
-      const storedUrl = stored?.gatewayUrl;
-      if (!storedUrl || storedUrl !== endpoints.gatewayUrl && (sameMcpGateway(storedUrl, endpoints.gatewayUrl) || target !== void 0)) {
-        persistGatewayUrl(endpoints.gatewayUrl);
-      }
-      return text({
-        status: "ok",
-        reused: true,
-        target: target ?? cfg.target,
-        delegateAddress: identity.delegateAddress,
-        gatewayUrl: loadLocalSigningKeyRecord()?.gatewayUrl ?? endpoints.gatewayUrl,
-        grantObjectId: live.grantObjectId,
-        message: "Existing spend-account grant is live for this key. No browser round-trip."
-      });
-    }
-    if (live.kind === "unknown") {
-      return error({
-        status: "failed",
-        code: "GRANT_STATUS_UNKNOWN",
-        detail: "Could not verify the existing grant. Credentials were not modified. Retry later; do not start a new consent (that would mint a second grant)."
-      });
-    }
+  const connect = new URL("/connect/agent", cfg.consoleUrl);
+  connect.searchParams.set("delegateAddress", identity.delegateAddress);
+  const url = connect.toString();
+  deps.onUrl?.(url);
+  try {
+    await open(url);
+  } catch {
   }
-  const started = await (deps.startStdioLogin ?? startStdioLogin)({
-    consoleUrl: endpoints.consoleUrl,
-    gatewayUrl: endpoints.gatewayUrl,
-    identity,
-    label,
-    timeoutMs: LOGIN_BG_TIMEOUT_MS,
-    openBrowser: false,
-    onUrl: deps.onUrl
+  return text({
+    status: "ok",
+    delegateAddress: identity.delegateAddress,
+    connectUrl: url,
+    message: "Open the console to bind a spend-account grant to this delegate address. The private key never leaves this process."
   });
-  const url = started.connectUrl;
-  return text(
-    [
-      `## ACTION REQUIRED: User must click this URL to sign in`,
-      ``,
-      `**Target:** ${target ?? cfg.target ?? "custom"} \xB7 ${endpoints.gatewayUrl}`,
-      ``,
-      `**URL:** ${url}`,
-      ``,
-      "```",
-      url,
-      "```",
-      ``,
-      `[Click here to open SuiPay sign-in](${url})`,
-      ``,
-      `**IMPORTANT for the assistant**: do NOT summarize or omit the URL above.`,
-      `The user CANNOT proceed without seeing the exact URL. Surface it verbatim.`,
-      ``,
-      `1. Open the URL in any browser`,
-      `2. Connect the owner wallet and approve the spend-account grant (Access keys / policies)`,
-      `3. Once Connected appears, retry the original request \u2014 credentials at \`~/.suipay/credentials.json\` are picked up on the next tool call`,
-      ``,
-      `_The login link stays valid for 5 minutes. If it expires, call \`suipay_login\` again._`,
-      ``,
-      JSON.stringify({
-        status: "ok",
-        target: target ?? cfg.target,
-        delegateAddress: identity.delegateAddress,
-        connectUrl: url,
-        consoleUrl: endpoints.consoleUrl,
-        gatewayUrl: endpoints.gatewayUrl
-      })
-    ].join("\n")
-  );
 }
 async function logout(args, _cfg, deps = {}) {
   if (args.force) {
@@ -7661,14 +6078,6 @@ var TOOLS = [
           type: "object",
           description: "JSON request body for a POST. Sent as application/json and bound to the payment."
         },
-        file: {
-          type: "string",
-          description: "Absolute local path whose bytes fill json[fileField] as canonical base64. Stdio only; requires fileField. GET must omit this."
-        },
-        fileField: {
-          type: "string",
-          description: "JSON key to set from file (e.g. contentBase64). Required with file. Must not already be present on json."
-        },
         recipient: {
           type: "string",
           description: "Sui address you expect to be paid. The payment is refused, unsigned, if the prepared transaction pays anyone else."
@@ -7683,7 +6092,7 @@ var TOOLS = [
   },
   {
     name: "discover",
-    description: "Search SuiPay gateway resources. After login, each row includes name, path, url, catalog price, and whether the current session can cover one call at that price (descriptive only \u2014 pay still enforces the grant).",
+    description: "Search SuiPay gateway resources.",
     inputSchema: {
       type: "object",
       properties: {
@@ -7709,16 +6118,11 @@ var TOOLS = [
   },
   {
     name: "suipay_login",
-    description: 'Mint or reuse the local delegate key (version-2, mode 0600) and return a clickable console URL immediately so the owner can bind a spend-account grant. Does not wait for the wallet. Default target is Railway suipay-dev; pass target="local" (or start the binary with --local) for the laptop stack. Stdio only; hosted /mcp never holds a spendable key.',
+    description: "Mint or reuse the local delegate key (version-2, mode 0600) and open the console with the public address only so the owner can bind a spend-account grant. Stdio only; hosted /mcp never holds a spendable key.",
     inputSchema: {
       type: "object",
       properties: {
         label: { type: "string", description: "Label shown in SuiPay console." },
-        target: {
-          type: "string",
-          enum: ["dev", "local"],
-          description: 'Where to bind the grant. Default is Railway suipay-dev. Pass "local" for localhost:3000 / 127.0.0.1:4340.'
-        },
         gatewayResourceUrl: {
           type: "string",
           description: "Gateway resource URL whose 402 defines recipient, asset, and package."
@@ -7774,7 +6178,7 @@ function toolError(value) {
     isError: true
   };
 }
-function createServer2(cfg, auth, trace, options = {}) {
+function createServer(cfg, auth, trace, options = {}) {
   const resolveAgentHeld = options.resolveAgentHeld ?? resolveAgentHeldSettlement;
   const server = new Server(
     { name: "suipay", version: "1.0.0" },
@@ -7799,7 +6203,7 @@ function createServer2(cfg, auth, trace, options = {}) {
       }
       switch (name) {
         case "access_context":
-          return await accessContext({ auth }, cfg);
+          return await accessContext({ auth });
         case "pay": {
           const agentHeld = auth?.spendAccountPay ? resolveAgentHeld(cfg, auth.spendAccountPay) : null;
           return await pay(
@@ -7807,8 +6211,6 @@ function createServer2(cfg, auth, trace, options = {}) {
               url: String(args.url ?? ""),
               ...args.method !== void 0 ? { method: args.method } : {},
               ...args.json !== void 0 ? { json: args.json } : {},
-              ...args.file !== void 0 ? { file: args.file } : {},
-              ...args.fileField !== void 0 ? { fileField: args.fileField } : {},
               ...args.recipient !== void 0 ? { recipient: args.recipient } : {},
               ...args.maxAmount !== void 0 ? { maxAmount: args.maxAmount } : {}
             },
@@ -7845,7 +6247,6 @@ function createServer2(cfg, auth, trace, options = {}) {
           return await suipayLogin(
             {
               label: typeof args.label === "string" ? args.label : void 0,
-              target: typeof args.target === "string" ? args.target : void 0,
               gatewayResourceUrl: typeof args.gatewayResourceUrl === "string" ? args.gatewayResourceUrl : void 0
             },
             cfg,
@@ -8344,7 +6745,7 @@ async function handleSuipayMcpHttpRequest(req, cfg, auth, trace, options) {
         sessionIdGenerator: void 0,
         enableJsonResponse: true
       });
-      const server = createServer2(cfg, auth, hooks, options);
+      const server = createServer(cfg, auth, hooks, options);
       await server.connect(transport);
       return transport.handleRequest(request);
     }
@@ -8353,15 +6754,10 @@ async function handleSuipayMcpHttpRequest(req, cfg, auth, trace, options) {
 
 export {
   resolveGrantTarget,
-  MCP_TARGET_PRESETS,
-  parseMcpTargetFlag,
-  resolveMcpTarget,
-  sameMcpGateway,
   loadMcpConfig,
   loadPaymentProfile,
   ensureLocalSigningKey,
   loadLocalSigner,
-  loadLocalSigningKeyRecord,
   resetAgentHeldProcessLedger,
   resolveAgentHeldSettlement,
   settlePreparedMcpPayment,
@@ -8372,7 +6768,7 @@ export {
   receipts,
   PACKAGE_NAME,
   TOOLS,
-  createServer2 as createServer,
+  createServer,
   canonicalMcpRequestId,
   inspectMcpEnvelope,
   traceMcpHttpRequest,