@cmdoss/suipay-mcp 0.2.2-dev.8 → 0.2.2-dev.9

package/README.md

@@ -5,13 +5,13 @@ buyer-funded spend account. The buyer owns the account. The agent holds the
 delegate key and can spend only under the on-chain grant (recipient bind,
 per-payment cap, budget).
 
-Pin `@cmdoss/suipay-mcp@0.2.2` in MCP config. `1.0.1` remains on the
+Pin `@cmdoss/suipay-mcp@0.2.2-dev.9` in MCP config. `1.0.1` remains on the
 registry as a historical release; do not install it for new agents.
 
 ## Install
 
 ```bash
-claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.2
+claude mcp add --scope user suipay -- npx -y @cmdoss/suipay-mcp@0.2.2-dev.9
 ```
 
 No wallet secret belongs in this command or MCP config. There is no
@@ -112,10 +112,10 @@ Default is Railway **suipay-dev**. `--local` / `target: "local"` is laptop-only.
 
 ```bash
 # Railway suipay-dev (default)
-npx @cmdoss/suipay-mcp@0.2.2
+npx @cmdoss/suipay-mcp@0.2.2-dev.9
 
 # Laptop stack
-npx @cmdoss/suipay-mcp@0.2.2 --local
+npx @cmdoss/suipay-mcp@0.2.2-dev.9 --local
 ```
 
 `SUIPAY_MCP_TARGET=local|dev` selects the same preset. Explicit

package/dist/bin/suipay.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-KW3ZECP6.js";
-import "../chunk-K4C64BXE.js";
+} from "../chunk-LQOZBRH6.js";
+import "../chunk-NDJ7BFI4.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-KW3ZECP6.js → chunk-LQOZBRH6.js}

@@ -4,7 +4,7 @@ import {
   loadLocalSigningKeyRecord,
   loadMcpConfig,
   loadPaymentProfile
-} from "./chunk-K4C64BXE.js";
+} from "./chunk-NDJ7BFI4.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{chunk-K4C64BXE.js → chunk-NDJ7BFI4.js}

@@ -538,6 +538,32 @@ function createSpendAccountChain(options) {
       kindBytes: toBase64(await tx.build({ client, onlyTransactionKind: true }))
     };
   }
+  function appendCreatePolicyGrant(tx, input) {
+    if (!input.onChainPolicyIds.length) {
+      throw new Error("create_grant requires at least one on-chain policy id");
+    }
+    if (!input.maxPerPayment || BigInt(input.maxPerPayment) <= 0n) {
+      throw new Error("create_grant requires a non-zero max_per_payment");
+    }
+    if (!input.sessionCap || BigInt(input.sessionCap) <= 0n) {
+      throw new Error("create_grant requires a non-zero session_cap");
+    }
+    const expires = input.expiresAtMs === void 0 || input.expiresAtMs === null ? 0n : BigInt(input.expiresAtMs);
+    tx.moveCall({
+      target: target("create_policy_grant"),
+      typeArguments: [input.coinType],
+      arguments: [
+        tx.object(input.poolObjectId),
+        tx.pure.address(input.delegate),
+        // The unified Grant<T> takes Option<u64> caps. This builder rejects
+        // absent or zero caps above, so both are always Some here.
+        tx.pure.option("u64", BigInt(input.sessionCap)),
+        tx.pure.option("u64", BigInt(input.maxPerPayment)),
+        tx.pure.u64(expires),
+        tx.pure.vector("u64", input.onChainPolicyIds.map((id) => BigInt(id)))
+      ]
+    });
+  }
   async function fundingCoin(tx, owner, coinType, amount) {
     if (!isSuiCoinType(coinType)) {
       return coinWithBalance({ type: coinType, balance: amount });
@@ -737,32 +763,23 @@ function createSpendAccountChain(options) {
       return kindBytes(tx);
     },
     async buildCreateGrantKind(input) {
-      if (!input.onChainPolicyIds.length) {
-        throw new Error("create_grant requires at least one on-chain policy id");
-      }
-      if (!input.maxPerPayment || BigInt(input.maxPerPayment) <= 0n) {
-        throw new Error("create_grant requires a non-zero max_per_payment");
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      appendCreatePolicyGrant(tx, input);
+      return kindBytes(tx);
+    },
+    async buildCreateGrantBatchKind(inputs) {
+      if (!inputs.length) {
+        throw new Error("create_grant batch requires at least one grant");
       }
-      if (!input.sessionCap || BigInt(input.sessionCap) <= 0n) {
-        throw new Error("create_grant requires a non-zero session_cap");
+      const owner = inputs[0].owner;
+      if (inputs.some((input) => input.owner !== owner)) {
+        throw new Error("create_grant batch requires one owner");
       }
       const tx = new Transaction2();
-      tx.setSender(input.owner);
-      const expires = input.expiresAtMs === void 0 || input.expiresAtMs === null ? 0n : BigInt(input.expiresAtMs);
-      tx.moveCall({
-        target: target("create_policy_grant"),
-        typeArguments: [input.coinType],
-        arguments: [
-          tx.object(input.poolObjectId),
-          tx.pure.address(input.delegate),
-          // The unified Grant<T> takes Option<u64> caps. This builder rejects
-          // absent or zero caps above, so both are always Some here.
-          tx.pure.option("u64", BigInt(input.sessionCap)),
-          tx.pure.option("u64", BigInt(input.maxPerPayment)),
-          tx.pure.u64(expires),
-          tx.pure.vector("u64", input.onChainPolicyIds.map((id) => BigInt(id)))
-        ]
-      });
+      tx.setSender(owner);
+      for (const input of inputs)
+        appendCreatePolicyGrant(tx, input);
       return kindBytes(tx);
     },
     async buildCreateSpendGrantKind(input) {
@@ -5563,7 +5580,7 @@ var MCP_TARGET_PRESETS = {
     gatewayUrl: "https://gateway-dev-ba84.up.railway.app"
   },
   local: {
-    consoleUrl: "http://localhost:3000",
+    consoleUrl: "https://suipay-dev.up.railway.app",
     gatewayUrl: "http://127.0.0.1:4340"
   }
 };
@@ -5996,9 +6013,29 @@ function recordFromKeypair(kp, opts = {}, existing, operatorSecret) {
   };
 }
 var ENV_KEY_MISMATCH = "SUIPAY_MCP_KEY does not match the stored delegate key - refusing to overwrite";
+function signingMaterial(parsed) {
+  if (!parsed || typeof parsed !== "object") return null;
+  if (isLocalSigningKeyRecord(parsed)) return parsed;
+  const c = parsed;
+  if (typeof c.delegatePrivateKey !== "string" || !HEX64.test(c.delegatePrivateKey) || typeof c.delegatePublicKeyHex !== "string" || !HEX64.test(c.delegatePublicKeyHex) || typeof c.delegateAddress !== "string" || !ADDR.test(c.delegateAddress)) {
+    return null;
+  }
+  const label = typeof c.label === "string" ? c.label.trim() : "";
+  return {
+    version: 2,
+    delegatePrivateKey: c.delegatePrivateKey,
+    delegatePublicKeyHex: c.delegatePublicKeyHex,
+    delegateAddress: c.delegateAddress,
+    createdAt: typeof c.createdAt === "string" && c.createdAt ? c.createdAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+    ...isHttpUrl(c.gatewayUrl) ? { gatewayUrl: c.gatewayUrl } : {},
+    ...label ? { label } : {}
+  };
+}
 function existingRecordForEnv(parsed) {
   if (parsed === null) return null;
-  if (isLocalSigningKeyRecord(parsed) || isValid(parsed)) return parsed;
+  if (isValid(parsed)) return parsed;
+  const material = signingMaterial(parsed);
+  if (material) return material;
   throw new Error(
     `credentials file at ${credsPath()} failed schema validation - refusing to continue`
   );
@@ -6036,16 +6073,25 @@ async function ensureLocalSigningKey(opts = {}) {
   }
   const parsed = readCredentialsJson();
   if (parsed !== null) {
-    if (isLocalSigningKeyRecord(parsed)) {
-      return identityFromStored(
-        parsed.delegatePrivateKey,
-        parsed.delegatePublicKeyHex,
-        parsed.delegateAddress
-      );
-    }
-    if (isValid(parsed)) {
+    if (isValid(parsed) && !isLocalSigningKeyRecord(parsed)) {
       return rewriteV1ToLocalSigningKey(parsed, opts);
     }
+    const material = signingMaterial(parsed);
+    if (material) {
+      const identity = identityFromStored(
+        material.delegatePrivateKey,
+        material.delegatePublicKeyHex,
+        material.delegateAddress
+      );
+      if (!isLocalSigningKeyRecord(parsed)) {
+        const label = opts.label?.trim() || material.label;
+        writeCredentialsFile({
+          ...material,
+          ...label ? { label } : {}
+        });
+      }
+      return identity;
+    }
     throw new Error(`credentials file at ${credsPath()} failed schema validation - refusing to continue`);
   }
   const kp = await generateKeypair();
@@ -6136,6 +6182,32 @@ function loadLocalKeypair() {
     Uint8Array.from(Buffer.from(parsed.delegatePrivateKey, "hex"))
   );
 }
+function replaceLocalSigningKey(input) {
+  identityFromStored(
+    input.delegatePrivateKey,
+    input.delegatePublicKeyHex,
+    input.delegateAddress
+  );
+  const parsed = readCredentialsJson();
+  let gatewayUrl;
+  let label;
+  if (parsed && typeof parsed === "object") {
+    const record = parsed;
+    if (isHttpUrl(record.gatewayUrl)) gatewayUrl = record.gatewayUrl;
+    if (typeof record.label === "string" && record.label.trim()) {
+      label = record.label.trim();
+    }
+  }
+  writeCredentialsFile({
+    version: 2,
+    delegatePrivateKey: input.delegatePrivateKey,
+    delegatePublicKeyHex: input.delegatePublicKeyHex,
+    delegateAddress: input.delegateAddress,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    ...gatewayUrl ? { gatewayUrl } : {},
+    ...label ? { label } : {}
+  });
+}
 function persistGatewayUrl(gatewayUrl) {
   if (!isHttpUrl(gatewayUrl)) {
     throw new Error("gatewayUrl must be an http(s) origin");
@@ -7146,7 +7218,7 @@ var SECRET_KEY_SET = new Set(FORBIDDEN_SECRET_KEYS.map((k) => k.toLowerCase()));
 
 // ../sdk/dist/agent-sdk/delegate-agent.js
 function resolveExclusionDirectoryId(explicit, discovered) {
-  return explicit ?? discovered;
+  return explicit?.trim() ? explicit : discovered;
 }
 function createExclusionRegistryResolver(client, exclusionDirectoryObjectId) {
   if (!exclusionDirectoryObjectId || !exclusionDirectoryObjectId.trim())
@@ -7216,7 +7288,15 @@ async function createPayer(options) {
   const { session, binding } = resolved.value;
   const deployment = {
     network: session.network,
-    packageId: session.packageId
+    packageId: session.packageId,
+    // What the GATEWAY published, not what this payer settled on: a caller
+    // override belongs to the payer's configuration, not to the deployment it
+    // is describing. Dropping this left the field permanently undefined on the
+    // one instance a consumer can reach, so anything asking the payer whether
+    // guarded settles are available got "no" while it was doing them.
+    ...resolved.value.deployment.exclusionDirectoryObjectId ? {
+      exclusionDirectoryObjectId: resolved.value.deployment.exclusionDirectoryObjectId
+    } : {}
   };
   const exclusionDirectoryObjectId = resolveExclusionDirectoryId(options.exclusionDirectoryObjectId, resolved.value.deployment.exclusionDirectoryObjectId);
   let network;
@@ -7336,6 +7416,7 @@ async function createPayer(options) {
 import { createServer } from "http";
 import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
 import open from "open";
+import { Ed25519Keypair as Ed25519Keypair3 } from "@mysten/sui/keypairs/ed25519";
 var HEX642 = /^[0-9a-f]{64}$/;
 var PUBHEX = /^[0-9a-fA-F]{64}$/;
 function isPreflight(obj) {
@@ -7343,6 +7424,11 @@ function isPreflight(obj) {
   const o = obj;
   return typeof o.state === "string" && HEX642.test(o.state) && typeof o.publicKey === "string" && PUBHEX.test(o.publicKey) && typeof o.delegateAddress === "string" && /^0x[0-9a-fA-F]{64}$/.test(o.delegateAddress) && typeof o.gateway === "string" && o.gateway.length > 0;
 }
+function isAdoptKey(obj) {
+  if (!obj || typeof obj !== "object") return false;
+  const o = obj;
+  return typeof o.state === "string" && HEX642.test(o.state) && typeof o.delegatePrivateKey === "string" && HEX642.test(o.delegatePrivateKey) && typeof o.delegatePublicKeyHex === "string" && PUBHEX.test(o.delegatePublicKeyHex) && typeof o.delegateAddress === "string" && /^0x[0-9a-fA-F]{64}$/.test(o.delegateAddress);
+}
 function isCallback(obj) {
   if (!obj || typeof obj !== "object") return false;
   const o = obj;
@@ -7467,7 +7553,7 @@ async function startStdioLogin(opts) {
         res.writeHead(code, { "content-type": type, ...SECURITY_HEADERS, ...extra });
         res.end(body);
       };
-      const okPath = url.pathname === "/preflight" || url.pathname === "/callback";
+      const okPath = url.pathname === "/preflight" || url.pathname === "/callback" || url.pathname === "/key";
       if (req.method === "OPTIONS") {
         const extra = { ...cors };
         if (okHost && okOrigin && okPath && req.headers["access-control-request-private-network"] === "true") {
@@ -7538,6 +7624,55 @@ async function startStdioLogin(opts) {
           );
           return;
         }
+        if (url.pathname === "/key") {
+          if (!preflightVerified) {
+            res.writeHead(428, {
+              "content-type": "application/json",
+              ...cors,
+              ...SECURITY_HEADERS
+            });
+            res.end(JSON.stringify({ ok: false, error: "preflight required" }));
+            return;
+          }
+          if (!isAdoptKey(parsed) || !stateEquals(parsed.state, connectState)) {
+            res.writeHead(400, {
+              "content-type": "application/json",
+              ...cors,
+              ...SECURITY_HEADERS
+            });
+            res.end(JSON.stringify({ ok: false, error: "invalid key payload" }));
+            return;
+          }
+          try {
+            const kp = Ed25519Keypair3.fromSecretKey(
+              Uint8Array.from(Buffer.from(parsed.delegatePrivateKey, "hex"))
+            );
+            const derived = kp.getPublicKey().toSuiAddress();
+            if (derived.toLowerCase() !== parsed.delegateAddress.toLowerCase()) {
+              throw new Error("address mismatch");
+            }
+            replaceLocalSigningKey({
+              delegatePrivateKey: parsed.delegatePrivateKey,
+              delegatePublicKeyHex: parsed.delegatePublicKeyHex,
+              delegateAddress: derived
+            });
+          } catch {
+            res.writeHead(400, {
+              "content-type": "application/json",
+              ...cors,
+              ...SECURITY_HEADERS
+            });
+            res.end(JSON.stringify({ ok: false, error: "key rejected" }));
+            return;
+          }
+          res.writeHead(200, {
+            "content-type": "application/json",
+            ...cors,
+            ...SECURITY_HEADERS
+          });
+          res.end(JSON.stringify({ ok: true }));
+          return;
+        }
         if (!preflightVerified) {
           res.writeHead(428, {
             "content-type": "text/html",
@@ -9099,10 +9234,15 @@ async function suipayLogin(args, cfg, deps = {}) {
       });
     }
     if (live.kind === "unknown") {
-      return error({
-        status: "failed",
+      return text({
+        status: "ok",
+        reused: true,
+        grantStatus: "unknown",
         code: "GRANT_STATUS_UNKNOWN",
-        detail: "Could not verify the existing grant. Credentials were not modified. Retry later; do not start a new consent (that would mint a second grant)."
+        target: target ?? cfg.target,
+        delegateAddress: identity.delegateAddress,
+        gatewayUrl: endpoints.gatewayUrl,
+        message: "Credentials are already saved for this agent. The existing grant could not be checked just now, so no new sign-in was started and the key file was left unchanged. Retry suipay_login in a moment."
       });
     }
   }

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-K4C64BXE.js";
+} from "./chunk-NDJ7BFI4.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-KW3ZECP6.js";
+} from "./chunk-LQOZBRH6.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-K4C64BXE.js";
+} from "./chunk-NDJ7BFI4.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cmdoss/suipay-mcp",
-  "version": "0.2.2-dev.8",
+  "version": "0.2.2-dev.9",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
   ],
   "publishConfig": {
     "access": "public",
-    "provenance": true
+    "provenance": false
   },
   "engines": {
     "node": ">=20"
@@ -36,7 +36,9 @@
     "@types/node": "^26",
     "tsup": "^8.0.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.10"
+    "vitest": "^4.1.10",
+    "@cmdoss/suipay-core": "0.1.0",
+    "@cmdoss/suipay-sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup",