@moonpay/cli 0.4.2 → 0.5.0

package/dist/{mcp-QLBMU7OH.js → mcp-VOEHXIOY.js}

@@ -6,22 +6,20 @@ import {
   defineToolSchema,
   messageSign,
   resolveBaseUrl,
-  resolveSigningKey,
   schemas_default,
+  tokenSwap,
   transactionSign,
+  virtualAccountWalletRegister,
   walletCreate,
   walletDelete,
   walletImport,
   walletList,
-  walletLock,
-  walletRetrieve,
-  walletUnlock
-} from "./chunk-DAQDHLPY.js";
+  walletRetrieve
+} from "./chunk-AH5VMN63.js";
 import {
-  loadWallet
-} from "./chunk-AGDVU2O5.js";
-import "./chunk-Z33PSOPD.js";
-import "./chunk-EEBB5MQP.js";
+  findWalletOrThrow,
+  resolveSigningKey
+} from "./chunk-V7MA7WNX.js";
 
 // src/mcp.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -46,8 +44,18 @@ var x402RequestSchema = defineToolSchema({
   description: "Make an HTTP request to an x402-protected endpoint. Automatically handles payment when a 402 Payment Required response is received, signing the payment transaction with the local wallet.",
   input: z.object({
     method: z.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]).describe("HTTP method"),
-    url: z.string().url().describe(
-      "Full URL of the x402-protected endpoint (e.g., 'https://agents.moonpay.com/api/x402/tools/market_digest_retrieve')"
+    url: z.string().url().refine((u) => u.startsWith("https://"), { message: "URL must use HTTPS" }).refine(
+      (u) => {
+        try {
+          const host = new URL(u).hostname;
+          return !host.match(/^(localhost|127\.|10\.|172\.(1[6-9]|2\d|3[01])\.|192\.168\.|169\.254\.|0\.0\.0\.0|\[::1\])/);
+        } catch {
+          return false;
+        }
+      },
+      { message: "URL must not target private/internal addresses" }
+    ).describe(
+      "Full HTTPS URL of the x402-protected endpoint (e.g., 'https://agents.moonpay.com/api/x402/tools/market_digest_retrieve')"
     ),
     body: z.record(z.any()).nullable().describe("Request body (for POST, PUT, PATCH)"),
     params: z.record(z.any()).nullable().describe("Query parameters"),
@@ -99,7 +107,7 @@ function createLocalX402Client(walletAddress, secretKey) {
 var x402Request = createTool(
   x402RequestSchema,
   async ({ method, url, body, params, wallet: walletNameOrAddress }) => {
-    const walletMetadata = loadWallet(walletNameOrAddress);
+    const walletMetadata = findWalletOrThrow(walletNameOrAddress);
     const { privateKey, address } = resolveSigningKey(walletMetadata, "solana");
     const client = createLocalX402Client(address, privateKey);
     let response;
@@ -137,12 +145,12 @@ var LOCAL_TOOLS = [
   walletList,
   walletRetrieve,
   walletDelete,
-  walletLock,
-  walletUnlock,
   transactionSign,
   messageSign,
   bitcoinBalanceRetrieve,
-  x402Request
+  x402Request,
+  tokenSwap,
+  virtualAccountWalletRegister
 ];
 var localToolMap = new Map(LOCAL_TOOLS.map((t) => [t.schema.name, t]));
 function resolveRemoteSchema(schema) {
@@ -198,43 +206,55 @@ async function startMcpServer() {
         isError: true
       };
     }
-    const localTool = localToolMap.get(name);
-    if (localTool) {
-      const shape = localTool.schema.input.shape ?? {};
-      for (const [key, field] of Object.entries(shape)) {
-        if (params[key] === void 0 && field._def.typeName === "ZodNullable") {
-          params[key] = null;
+    try {
+      const localTool = localToolMap.get(name);
+      if (localTool) {
+        const shape = localTool.schema.input.shape ?? {};
+        for (const [key, field] of Object.entries(shape)) {
+          if (params[key] === void 0 && field._def.typeName === "ZodNullable") {
+            params[key] = null;
+          }
         }
+        const result2 = await localTool.handler(params);
+        return {
+          content: [
+            { type: "text", text: JSON.stringify(result2, null, 2) }
+          ]
+        };
       }
-      const result2 = await localTool.handler(params);
+      const props = remotePropsMap.get(name) ?? {};
+      for (const [key, prop] of Object.entries(props)) {
+        if (params[key] === void 0) {
+          const nullable = Array.isArray(prop.type) ? prop.type.includes("null") : prop.anyOf?.some((t) => t.type === "null");
+          if (nullable) params[key] = null;
+        }
+        const isNum = prop.type === "number" || prop.type === "integer" || Array.isArray(prop.type) && prop.type.some(
+          (t) => t === "number" || t === "integer"
+        ) || prop.anyOf?.some(
+          (t) => t.type === "number" || t.type === "integer"
+        );
+        if (isNum && typeof params[key] === "string") {
+          params[key] = Number(params[key]);
+        }
+      }
+      const baseUrl = resolveBaseUrl();
+      const result = await callTool(baseUrl, name, params);
       return {
         content: [
-          { type: "text", text: JSON.stringify(result2, null, 2) }
+          { type: "text", text: JSON.stringify(result, null, 2) }
         ]
       };
+    } catch (error) {
+      return {
+        content: [
+          {
+            type: "text",
+            text: error instanceof Error ? error.message : String(error)
+          }
+        ],
+        isError: true
+      };
     }
-    const props = remotePropsMap.get(name) ?? {};
-    for (const [key, prop] of Object.entries(props)) {
-      if (params[key] === void 0) {
-        const nullable = Array.isArray(prop.type) ? prop.type.includes("null") : prop.anyOf?.some((t) => t.type === "null");
-        if (nullable) params[key] = null;
-      }
-      const isNum = prop.type === "number" || prop.type === "integer" || Array.isArray(prop.type) && prop.type.some(
-        (t) => t === "number" || t === "integer"
-      ) || prop.anyOf?.some(
-        (t) => t.type === "number" || t.type === "integer"
-      );
-      if (isNum && typeof params[key] === "string") {
-        params[key] = Number(params[key]);
-      }
-    }
-    const baseUrl = resolveBaseUrl();
-    const result = await callTool(baseUrl, name, params);
-    return {
-      content: [
-        { type: "text", text: JSON.stringify(result, null, 2) }
-      ]
-    };
   });
   const transport = new StdioServerTransport();
   await server.connect(transport);
@@ -242,4 +262,4 @@ async function startMcpServer() {
 export {
   startMcpServer
 };
-//# sourceMappingURL=mcp-QLBMU7OH.js.map
+//# sourceMappingURL=mcp-VOEHXIOY.js.map

package/dist/mcp-VOEHXIOY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp.ts","../src/tools/x402/request/tool.ts","../src/tools/x402/request/schema.ts"],"sourcesContent":["import { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { z } from \"zod\";\nimport { zodToJsonSchema } from \"zod-to-json-schema\";\nimport { callTool } from \"./client\";\nimport { resolveBaseUrl } from \"./auth\";\nimport type { Tool } from \"./tools/shared\";\nimport { walletCreate } from \"./tools/wallet/create/tool\";\nimport { walletImport } from \"./tools/wallet/import/tool\";\nimport { walletList } from \"./tools/wallet/list/tool\";\nimport { walletRetrieve } from \"./tools/wallet/retrieve/tool\";\nimport { walletDelete } from \"./tools/wallet/delete/tool\";\nimport { transactionSign } from \"./tools/transaction/sign/tool\";\nimport { messageSign } from \"./tools/message/sign/tool\";\nimport { bitcoinBalanceRetrieve } from \"./tools/bitcoin/balance/tool\";\nimport { x402Request } from \"./tools/x402/request/tool\";\nimport { tokenSwap } from \"./tools/token/swap/tool\";\nimport { virtualAccountWalletRegister } from \"./tools/virtual-account/wallet/register/tool\";\nimport schemas from \"./generated/schemas.json\";\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nconst LOCAL_TOOLS: Tool<any>[] = [\n  walletCreate,\n  walletImport,\n  walletList,\n  walletRetrieve,\n  walletDelete,\n  transactionSign,\n  messageSign,\n  bitcoinBalanceRetrieve,\n  x402Request,\n  tokenSwap,\n  virtualAccountWalletRegister,\n];\n\nconst localToolMap = new Map(LOCAL_TOOLS.map((t) => [t.schema.name, t]));\n\n/**\n * Resolve a remote schema's $ref to the actual properties object.\n */\nfunction resolveRemoteSchema(schema: (typeof schemas)[number]) {\n  const input = schema.inputSchema as any;\n  if (input.$ref && input.definitions) {\n    const defName = input.$ref.replace(\"#/definitions/\", \"\");\n    return input.definitions[defName] ?? input;\n  }\n  return input;\n}\n\nexport async function startMcpServer() {\n  const server = new Server(\n    { name: \"moonpay\", version: \"1.0.0\" },\n    { capabilities: { tools: { listChanged: true } } },\n  );\n\n  // Build tool definitions — local tools use Zod→JSON, remote use JSON directly\n  const toolDefs: Array<{\n    name: string;\n    description: string;\n    inputSchema: Record<string, unknown>;\n  }> = LOCAL_TOOLS.map((tool) => ({\n    name: tool.schema.name,\n    description: tool.schema.description,\n    inputSchema: zodToJsonSchema(tool.schema.input) as Record<string, unknown>,\n  }));\n\n  const remotePropsMap = new Map<string, Record<string, any>>();\n  for (const schema of schemas) {\n    if (localToolMap.has(schema.name)) continue;\n    const resolved = resolveRemoteSchema(schema);\n    remotePropsMap.set(\n      schema.name,\n      (resolved.properties ?? {}) as Record<string, any>,\n    );\n    toolDefs.push({\n      name: schema.name,\n      description: schema.description,\n      inputSchema: {\n        type: \"object\",\n        properties: resolved.properties ?? {},\n        ...(resolved.required ? { required: resolved.required } : {}),\n        ...(resolved.additionalProperties !== undefined\n          ? { additionalProperties: resolved.additionalProperties }\n          : {}),\n      },\n    });\n  }\n\n  const toolDefMap = new Map(toolDefs.map((t) => [t.name, t]));\n\n  // tools/list — return raw JSON schemas directly\n  server.setRequestHandler(ListToolsRequestSchema, async () => ({\n    tools: toolDefs.map((t) => ({\n      name: t.name,\n      description: t.description,\n      inputSchema: t.inputSchema,\n    })),\n  }));\n\n  // tools/call\n  server.setRequestHandler(CallToolRequestSchema, async (request) => {\n    const { name, arguments: params = {} } = request.params;\n\n    if (!toolDefMap.has(name)) {\n      return {\n        content: [{ type: \"text\" as const, text: `Unknown tool: ${name}` }],\n        isError: true,\n      };\n    }\n\n    try {\n      // Local tool — coerce nullable fields then run handler\n      const localTool = localToolMap.get(name);\n      if (localTool) {\n        // Fill missing nullable fields with null (MCP clients may omit them)\n        const shape = (localTool.schema.input as z.ZodObject<z.ZodRawShape>).shape ?? {};\n        for (const [key, field] of Object.entries(shape)) {\n          if (\n            params[key] === undefined &&\n            (field as z.ZodTypeAny)._def.typeName === \"ZodNullable\"\n          ) {\n            params[key] = null;\n          }\n        }\n\n        const result = await localTool.handler(params);\n        return {\n          content: [\n            { type: \"text\" as const, text: JSON.stringify(result, null, 2) },\n          ],\n        };\n      }\n\n      // Remote tool — coerce types then call API\n      const props = remotePropsMap.get(name) ?? {};\n      for (const [key, prop] of Object.entries(props)) {\n        if (params[key] === undefined) {\n          const nullable = Array.isArray(prop.type)\n            ? prop.type.includes(\"null\")\n            : prop.anyOf?.some((t: any) => t.type === \"null\");\n          if (nullable) params[key] = null;\n        }\n        const isNum =\n          prop.type === \"number\" ||\n          prop.type === \"integer\" ||\n          (Array.isArray(prop.type) &&\n            prop.type.some(\n              (t: string) => t === \"number\" || t === \"integer\",\n            )) ||\n          prop.anyOf?.some(\n            (t: any) => t.type === \"number\" || t.type === \"integer\",\n          );\n        if (isNum && typeof params[key] === \"string\") {\n          params[key] = Number(params[key]);\n        }\n      }\n\n      const baseUrl = resolveBaseUrl();\n      const result = await callTool(baseUrl, name, params);\n      return {\n        content: [\n          { type: \"text\" as const, text: JSON.stringify(result, null, 2) },\n        ],\n      };\n    } catch (error) {\n      return {\n        content: [\n          {\n            type: \"text\" as const,\n            text: error instanceof Error ? error.message : String(error),\n          },\n        ],\n        isError: true,\n      };\n    }\n  });\n\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n}\n","import { Keypair, VersionedTransaction, VersionedMessage } from \"@solana/web3.js\";\nimport axios from \"axios\";\nimport { wrapAxiosWithPayment } from \"@x402/axios\";\nimport { x402Client } from \"@x402/core/client\";\nimport { ExactSvmScheme } from \"@x402/svm\";\nimport type { Address } from \"@solana/addresses\";\nimport type { SignatureDictionary } from \"@solana/signers\";\nimport type { Transaction } from \"@solana/transactions\";\nimport { createTool } from \"../../shared\";\nimport { findWalletOrThrow, resolveSigningKey } from \"../../wallet/store\";\nimport { x402RequestSchema } from \"./schema\";\n\nconst SOLANA_NETWORK = \"solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp\" as const;\n\nfunction createLocalX402Client(walletAddress: string, secretKey: Uint8Array) {\n  const keypair = Keypair.fromSecretKey(secretKey);\n\n  const signer = {\n    address: walletAddress as Address,\n    signTransactions: async (\n      transactions: readonly Transaction[],\n    ): Promise<readonly SignatureDictionary[]> => {\n      return transactions.map((transaction) => {\n        const messageBytes = new Uint8Array(transaction.messageBytes);\n        const message = VersionedMessage.deserialize(messageBytes);\n        const numSigs = Object.keys(transaction.signatures).length;\n        const tx = new VersionedTransaction(\n          message,\n          new Array(numSigs).fill(new Uint8Array(64)),\n        );\n\n        tx.sign([keypair]);\n\n        const signerIndex = message.staticAccountKeys.findIndex(\n          (key) => key.toBase58() === walletAddress,\n        );\n        if (signerIndex === -1) {\n          throw new Error(\n            `Wallet ${walletAddress} is not a signer for this transaction`,\n          );\n        }\n\n        return {\n          [walletAddress]: tx.signatures[signerIndex],\n        } as SignatureDictionary;\n      });\n    },\n  };\n\n  const client = new x402Client();\n  const svmScheme = new ExactSvmScheme(signer);\n  client.register(SOLANA_NETWORK, svmScheme);\n  client.registerV1(\"solana\", svmScheme);\n\n  return wrapAxiosWithPayment(axios.create(), client);\n}\n\nexport const x402Request = createTool(\n  x402RequestSchema,\n  async ({ method, url, body, params, wallet: walletNameOrAddress }) => {\n    const walletMetadata = findWalletOrThrow(walletNameOrAddress);\n    const { privateKey, address } = resolveSigningKey(walletMetadata, \"solana\");\n    const client = createLocalX402Client(address, privateKey);\n\n    let response;\n    switch (method) {\n      case \"GET\":\n        response = await client.get(url, { params });\n        break;\n      case \"POST\":\n        response = await client.post(url, body || {}, { params });\n        break;\n      case \"PUT\":\n        response = await client.put(url, body || {}, { params });\n        break;\n      case \"PATCH\":\n        response = await client.patch(url, body || {}, { params });\n        break;\n      case \"DELETE\":\n        response = await client.delete(url, { params });\n        break;\n      default:\n        throw new Error(`Unsupported HTTP method: ${method}`);\n    }\n\n    return {\n      status: response.status,\n      data: response.data,\n      headers: response.headers as Record<string, string>,\n    };\n  },\n);\n","import { z } from \"zod\";\nimport { defineToolSchema } from \"../../shared\";\n\nexport const x402RequestSchema = defineToolSchema({\n  name: \"x402_request\",\n  description:\n    \"Make an HTTP request to an x402-protected endpoint. Automatically handles payment when a 402 Payment Required response is received, signing the payment transaction with the local wallet.\",\n  input: z.object({\n    method: z\n      .enum([\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"])\n      .describe(\"HTTP method\"),\n    url: z\n      .string()\n      .url()\n      .refine((u) => u.startsWith(\"https://\"), { message: \"URL must use HTTPS\" })\n      .refine(\n        (u) => {\n          try {\n            const host = new URL(u).hostname;\n            return !host.match(/^(localhost|127\\.|10\\.|172\\.(1[6-9]|2\\d|3[01])\\.|192\\.168\\.|169\\.254\\.|0\\.0\\.0\\.0|\\[::1\\])/);\n          } catch { return false; }\n        },\n        { message: \"URL must not target private/internal addresses\" },\n      )\n      .describe(\n        \"Full HTTPS URL of the x402-protected endpoint (e.g., 'https://agents.moonpay.com/api/x402/tools/market_digest_retrieve')\",\n      ),\n    body: z\n      .record(z.any())\n      .nullable()\n      .describe(\"Request body (for POST, PUT, PATCH)\"),\n    params: z.record(z.any()).nullable().describe(\"Query parameters\"),\n    wallet: z.string().describe(\"Wallet name or address to pay with\"),\n  }),\n  output: z.object({\n    status: z.number().describe(\"HTTP status code\"),\n    data: z.any().describe(\"Response data\"),\n    headers: z.record(z.string()).describe(\"Response headers\"),\n  }),\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB;;;ACPhC,SAAS,SAAS,sBAAsB,wBAAwB;AAChE,OAAO,WAAW;AAClB,SAAS,4BAA4B;AACrC,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;;;ACJ/B,SAAS,SAAS;AAGX,IAAM,oBAAoB,iBAAiB;AAAA,EAChD,MAAM;AAAA,EACN,aACE;AAAA,EACF,OAAO,EAAE,OAAO;AAAA,IACd,QAAQ,EACL,KAAK,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ,CAAC,EAC9C,SAAS,aAAa;AAAA,IACzB,KAAK,EACF,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,GAAG,EAAE,SAAS,qBAAqB,CAAC,EACzE;AAAA,MACC,CAAC,MAAM;AACL,YAAI;AACF,gBAAM,OAAO,IAAI,IAAI,CAAC,EAAE;AACxB,iBAAO,CAAC,KAAK,MAAM,4FAA4F;AAAA,QACjH,QAAQ;AAAE,iBAAO;AAAA,QAAO;AAAA,MAC1B;AAAA,MACA,EAAE,SAAS,iDAAiD;AAAA,IAC9D,EACC;AAAA,MACC;AAAA,IACF;AAAA,IACF,MAAM,EACH,OAAO,EAAE,IAAI,CAAC,EACd,SAAS,EACT,SAAS,qCAAqC;AAAA,IACjD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,kBAAkB;AAAA,IAChE,QAAQ,EAAE,OAAO,EAAE,SAAS,oCAAoC;AAAA,EAClE,CAAC;AAAA,EACD,QAAQ,EAAE,OAAO;AAAA,IACf,QAAQ,EAAE,OAAO,EAAE,SAAS,kBAAkB;AAAA,IAC9C,MAAM,EAAE,IAAI,EAAE,SAAS,eAAe;AAAA,IACtC,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,SAAS,kBAAkB;AAAA,EAC3D,CAAC;AACH,CAAC;;;AD3BD,IAAM,iBAAiB;AAEvB,SAAS,sBAAsB,eAAuB,WAAuB;AAC3E,QAAM,UAAU,QAAQ,cAAc,SAAS;AAE/C,QAAM,SAAS;AAAA,IACb,SAAS;AAAA,IACT,kBAAkB,OAChB,iBAC4C;AAC5C,aAAO,aAAa,IAAI,CAAC,gBAAgB;AACvC,cAAM,eAAe,IAAI,WAAW,YAAY,YAAY;AAC5D,cAAM,UAAU,iBAAiB,YAAY,YAAY;AACzD,cAAM,UAAU,OAAO,KAAK,YAAY,UAAU,EAAE;AACpD,cAAM,KAAK,IAAI;AAAA,UACb;AAAA,UACA,IAAI,MAAM,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,CAAC;AAAA,QAC5C;AAEA,WAAG,KAAK,CAAC,OAAO,CAAC;AAEjB,cAAM,cAAc,QAAQ,kBAAkB;AAAA,UAC5C,CAAC,QAAQ,IAAI,SAAS,MAAM;AAAA,QAC9B;AACA,YAAI,gBAAgB,IAAI;AACtB,gBAAM,IAAI;AAAA,YACR,UAAU,aAAa;AAAA,UACzB;AAAA,QACF;AAEA,eAAO;AAAA,UACL,CAAC,aAAa,GAAG,GAAG,WAAW,WAAW;AAAA,QAC5C;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,SAAS,IAAI,WAAW;AAC9B,QAAM,YAAY,IAAI,eAAe,MAAM;AAC3C,SAAO,SAAS,gBAAgB,SAAS;AACzC,SAAO,WAAW,UAAU,SAAS;AAErC,SAAO,qBAAqB,MAAM,OAAO,GAAG,MAAM;AACpD;AAEO,IAAM,cAAc;AAAA,EACzB;AAAA,EACA,OAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,QAAQ,oBAAoB,MAAM;AACpE,UAAM,iBAAiB,kBAAkB,mBAAmB;AAC5D,UAAM,EAAE,YAAY,QAAQ,IAAI,kBAAkB,gBAAgB,QAAQ;AAC1E,UAAM,SAAS,sBAAsB,SAAS,UAAU;AAExD,QAAI;AACJ,YAAQ,QAAQ;AAAA,MACd,KAAK;AACH,mBAAW,MAAM,OAAO,IAAI,KAAK,EAAE,OAAO,CAAC;AAC3C;AAAA,MACF,KAAK;AACH,mBAAW,MAAM,OAAO,KAAK,KAAK,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AACxD;AAAA,MACF,KAAK;AACH,mBAAW,MAAM,OAAO,IAAI,KAAK,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AACvD;AAAA,MACF,KAAK;AACH,mBAAW,MAAM,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;AACzD;AAAA,MACF,KAAK;AACH,mBAAW,MAAM,OAAO,OAAO,KAAK,EAAE,OAAO,CAAC;AAC9C;AAAA,MACF;AACE,cAAM,IAAI,MAAM,4BAA4B,MAAM,EAAE;AAAA,IACxD;AAEA,WAAO;AAAA,MACL,QAAQ,SAAS;AAAA,MACjB,MAAM,SAAS;AAAA,MACf,SAAS,SAAS;AAAA,IACpB;AAAA,EACF;AACF;;;ADlEA,IAAM,cAA2B;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,eAAe,IAAI,IAAI,YAAY,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC;AAKvE,SAAS,oBAAoB,QAAkC;AAC7D,QAAM,QAAQ,OAAO;AACrB,MAAI,MAAM,QAAQ,MAAM,aAAa;AACnC,UAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,EAAE;AACvD,WAAO,MAAM,YAAY,OAAO,KAAK;AAAA,EACvC;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB;AACrC,QAAM,SAAS,IAAI;AAAA,IACjB,EAAE,MAAM,WAAW,SAAS,QAAQ;AAAA,IACpC,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,KAAK,EAAE,EAAE;AAAA,EACnD;AAGA,QAAM,WAID,YAAY,IAAI,CAAC,UAAU;AAAA,IAC9B,MAAM,KAAK,OAAO;AAAA,IAClB,aAAa,KAAK,OAAO;AAAA,IACzB,aAAa,gBAAgB,KAAK,OAAO,KAAK;AAAA,EAChD,EAAE;AAEF,QAAM,iBAAiB,oBAAI,IAAiC;AAC5D,aAAW,UAAU,iBAAS;AAC5B,QAAI,aAAa,IAAI,OAAO,IAAI,EAAG;AACnC,UAAM,WAAW,oBAAoB,MAAM;AAC3C,mBAAe;AAAA,MACb,OAAO;AAAA,MACN,SAAS,cAAc,CAAC;AAAA,IAC3B;AACA,aAAS,KAAK;AAAA,MACZ,MAAM,OAAO;AAAA,MACb,aAAa,OAAO;AAAA,MACpB,aAAa;AAAA,QACX,MAAM;AAAA,QACN,YAAY,SAAS,cAAc,CAAC;AAAA,QACpC,GAAI,SAAS,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,QAC3D,GAAI,SAAS,yBAAyB,SAClC,EAAE,sBAAsB,SAAS,qBAAqB,IACtD,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,IAAI,IAAI,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAG3D,SAAO,kBAAkB,wBAAwB,aAAa;AAAA,IAC5D,OAAO,SAAS,IAAI,CAAC,OAAO;AAAA,MAC1B,MAAM,EAAE;AAAA,MACR,aAAa,EAAE;AAAA,MACf,aAAa,EAAE;AAAA,IACjB,EAAE;AAAA,EACJ,EAAE;AAGF,SAAO,kBAAkB,uBAAuB,OAAO,YAAY;AACjE,UAAM,EAAE,MAAM,WAAW,SAAS,CAAC,EAAE,IAAI,QAAQ;AAEjD,QAAI,CAAC,WAAW,IAAI,IAAI,GAAG;AACzB,aAAO;AAAA,QACL,SAAS,CAAC,EAAE,MAAM,QAAiB,MAAM,iBAAiB,IAAI,GAAG,CAAC;AAAA,QAClE,SAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI;AAEF,YAAM,YAAY,aAAa,IAAI,IAAI;AACvC,UAAI,WAAW;AAEb,cAAM,QAAS,UAAU,OAAO,MAAqC,SAAS,CAAC;AAC/E,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,cACE,OAAO,GAAG,MAAM,UACf,MAAuB,KAAK,aAAa,eAC1C;AACA,mBAAO,GAAG,IAAI;AAAA,UAChB;AAAA,QACF;AAEA,cAAMA,UAAS,MAAM,UAAU,QAAQ,MAAM;AAC7C,eAAO;AAAA,UACL,SAAS;AAAA,YACP,EAAE,MAAM,QAAiB,MAAM,KAAK,UAAUA,SAAQ,MAAM,CAAC,EAAE;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAGA,YAAM,QAAQ,eAAe,IAAI,IAAI,KAAK,CAAC;AAC3C,iBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC/C,YAAI,OAAO,GAAG,MAAM,QAAW;AAC7B,gBAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,IACpC,KAAK,KAAK,SAAS,MAAM,IACzB,KAAK,OAAO,KAAK,CAAC,MAAW,EAAE,SAAS,MAAM;AAClD,cAAI,SAAU,QAAO,GAAG,IAAI;AAAA,QAC9B;AACA,cAAM,QACJ,KAAK,SAAS,YACd,KAAK,SAAS,aACb,MAAM,QAAQ,KAAK,IAAI,KACtB,KAAK,KAAK;AAAA,UACR,CAAC,MAAc,MAAM,YAAY,MAAM;AAAA,QACzC,KACF,KAAK,OAAO;AAAA,UACV,CAAC,MAAW,EAAE,SAAS,YAAY,EAAE,SAAS;AAAA,QAChD;AACF,YAAI,SAAS,OAAO,OAAO,GAAG,MAAM,UAAU;AAC5C,iBAAO,GAAG,IAAI,OAAO,OAAO,GAAG,CAAC;AAAA,QAClC;AAAA,MACF;AAEA,YAAM,UAAU,eAAe;AAC/B,YAAM,SAAS,MAAM,SAAS,SAAS,MAAM,MAAM;AACnD,aAAO;AAAA,QACL,SAAS;AAAA,UACP,EAAE,MAAM,QAAiB,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE;AAAA,QACjE;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,aAAO;AAAA,QACL,SAAS;AAAA,UACP;AAAA,YACE,MAAM;AAAA,YACN,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,UAC7D;AAAA,QACF;AAAA,QACA,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,YAAY,IAAI,qBAAqB;AAC3C,QAAM,OAAO,QAAQ,SAAS;AAChC;","names":["result"]}

package/dist/store-HCN56E6A.js

@@ -0,0 +1,22 @@
+import { createRequire as __createRequire } from "module"; const require = __createRequire(import.meta.url);
+import {
+  addWallet,
+  findWallet,
+  findWalletOrThrow,
+  loadWallets,
+  mutateWallets,
+  removeWallet,
+  resolveSigningKey,
+  saveWallets
+} from "./chunk-V7MA7WNX.js";
+export {
+  addWallet,
+  findWallet,
+  findWalletOrThrow,
+  loadWallets,
+  mutateWallets,
+  removeWallet,
+  resolveSigningKey,
+  saveWallets
+};
+//# sourceMappingURL=store-HCN56E6A.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moonpay/cli",
-  "version": "0.4.2",
+  "version": "0.5.0",
   "publishConfig": {
     "access": "public"
   },
@@ -21,7 +21,8 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@scure/bip32": "^1.4.0",
+    "@noble/hashes": "^1.7.0",
+"@scure/bip32": "^1.4.0",
     "@scure/bip39": "^1.6.0",
     "@solana/web3.js": "^1.98.4",
     "@x402/axios": "^2.4.0",
@@ -35,6 +36,7 @@
     "ed25519-hd-key": "^1.3.0",
     "tiny-secp256k1": "^2.2.4",
     "tweetnacl": "^1.0.3",
+    "viem": "^2.46.2",
     "zod": "^3.25.76",
     "zod-to-json-schema": "^3.25.1"
   },

package/skills/moonpay-auth/SKILL.md

@@ -36,14 +36,17 @@ mp logout
 
 ## Local wallet management
 
-The CLI manages local Solana wallets stored in `~/.config/moonpay/wallets/`. Private keys never leave the machine — transactions are signed locally.
+The CLI manages local wallets stored encrypted in `~/.config/moonpay/wallets.json`. Private keys are encrypted with AES-256-GCM using a random key stored in your OS keychain. No password required — keys never leave the machine.
 
 ```bash
-# Create a new wallet
+# Create a new HD wallet (Solana, Ethereum, Bitcoin, Tron)
 mp wallet create --name "my-wallet"
 
-# Import from a base58 private key
-mp wallet import --name "imported" --privateKey <base58-key>
+# Import from a mnemonic (all chains)
+mp wallet import --name "restored" --mnemonic "word1 word2 ..."
+
+# Import from a private key (single chain)
+mp wallet import --name "imported" --key <hex-key> --chain ethereum
 
 # List all local wallets
 mp wallet list
@@ -51,6 +54,9 @@ mp wallet list
 # Get wallet details (by name or address)
 mp wallet retrieve --wallet "my-wallet"
 
+# Export mnemonic/key (interactive only — agents cannot run this)
+mp wallet export --wallet "my-wallet"
+
 # Delete a wallet (irreversible)
 mp wallet delete --wallet "my-wallet" --confirm
 ```
@@ -64,35 +70,20 @@ mp wallet delete --wallet "my-wallet" --confirm
 
 ## Config locations
 
+- **Wallets:** `~/.config/moonpay/wallets.json` (encrypted, AES-256-GCM)
+- **Encryption key:** OS keychain (`moonpay-cli` / `encryption-key`)
 - **Credentials:** `~/.config/moonpay/credentials.json` (OAuth tokens)
 - **Config:** `~/.config/moonpay/config.json` (base URL, client ID)
-- **Wallets:** `~/.config/moonpay/wallets/` (local keypairs, 0600 permissions)
-
-## Output formats
-
-```bash
-mp -f json wallet list    # Pretty JSON (default)
-mp -f compact wallet list # Single-line JSON
-mp -f table wallet list   # ASCII table
-```
-
-## Environment for scripts/agents
-
-If running `mp` from a script or agent subprocess, ensure PATH includes the npm global bin:
-
-```bash
-export PATH="$(npm config get prefix)/bin:$PATH"
-mp --version
-```
 
-## Troubleshooting
+## Security
 
-- **"command not found"** — `npm i -g @moonpay/cli` and check PATH.
-- **401 / auth errors** — Run `mp login`.
-- **"fetch failed"** — Check network connectivity to agents.moonpay.com.
-- Tokens auto-refresh on expiry. If refresh fails, run `mp login` again.
+- Wallet secrets are always encrypted on disk
+- Encryption key is stored in macOS Keychain / Linux libsecret
+- No password to remember — the OS handles authentication
+- `wallet export` requires an interactive terminal (TTY) — agents and scripts cannot extract secrets
+- 24-word BIP39 mnemonics (256-bit entropy)
 
 ## Related skills
 
-- **moonpay-swap-tokens** — Swap tokens using local wallets.
+- **moonpay-swap-tokens** — Swap or bridge tokens using local wallets.
 - **moonpay-check-wallet** — Check wallet balances.

package/skills/moonpay-missions/SKILL.md

@@ -20,82 +20,75 @@ mp wallet list
 If no wallets exist, create one:
 
 ```bash
-mp wallet create --name "my-wallet"
+mp wallet create --name "main"
 ```
 
-Tell the user their email, wallet address, and that this wallet's private key lives locally on their machine.
+Tell the user their email, all wallet addresses (Solana, Ethereum, Bitcoin, Tron), and that keys are encrypted locally with a random key in the OS keychain.
 
 ## Mission 2: Recon
 
 **Goal:** See what's trending and research a token.
 
-First, check what's hot:
-
 ```bash
 mp token trending list --chain solana --limit 5 --page 1
 ```
 
-Present the top trending tokens with price, 24h change, and volume.
-
-Then ask the user to pick a token to research (or default to SOL):
+Present the top trending tokens. Then ask the user to pick one to research:
 
 ```bash
 mp token search --query "<token>" --chain solana
 mp token retrieve --token <address-from-search> --chain solana
 ```
 
-Present: name, symbol, price, 24h change, market cap, liquidity, volume, and trading activity. Flag anything interesting (high volume, thin liquidity, etc).
+Present: name, symbol, price, market cap, liquidity, volume.
 
 ## Mission 3: Portfolio Check
 
-**Goal:** See what's in the wallet.
+**Goal:** See what's in the wallet across chains.
 
 ```bash
-mp token balance list --wallet <address> --chain solana
+mp token balance list --wallet <solana-address> --chain solana
+mp token balance list --wallet <eth-address> --chain ethereum
+mp bitcoin balance retrieve --wallet <btc-address>
 ```
 
-Present holdings as a mini portfolio report: each token, amount, USD value, and % allocation. Give the total portfolio value.
+Present holdings as a multi-chain portfolio report with USD values and total.
 
 ## Mission 4: Swap
 
-**Goal:** Build a swap transaction, sign it locally, and show the quote.
-
-Pick a small swap based on what the wallet holds (e.g. 0.01 USDC → SOL). If the wallet has no USDC, pick any token pair that makes sense.
-
-```bash
-mp token swap build --input <input-mint> --output <output-mint> --amount <small-amount> --wallet <address>
-```
-
-Show the quote from the `message` field. Ask the user: **"Want to execute this swap?"**
+**Goal:** Execute a swap end-to-end.
 
-If yes:
+Pick a small swap based on what the wallet holds:
 
 ```bash
-mp transaction sign --transaction <tx> --wallet <address>
-mp token swap execute --transaction <signed-tx> --requestId <id>
+mp token swap \
+  --from-wallet main --from-chain solana \
+  --from-token So11111111111111111111111111111111111111112 \
+  --from-amount 0.01 \
+  --to-token EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
 ```
 
-If no, move on. Either way, explain what just happened: the transaction was built on the server, signed locally (key never left the machine), and submitted on-chain.
+This builds, signs locally, and broadcasts in one step. Show the result and explain: the transaction was built on the server, signed locally (key never left the machine), and submitted on-chain.
 
 ## Mission 5: Buy with Fiat
 
-**Goal:** Generate a fiat checkout link and open it.
+**Goal:** Generate a fiat checkout link.
 
 ```bash
-mp buy --token sol --amount 1 --wallet <address> --email <email-from-mission-1>
+mp buy --token sol --amount 1 --wallet <solana-address> --email <email>
 ```
 
-Present the checkout URL and open it in the user's browser. Explain: this is MoonPay's fiat gateway where they can buy crypto with a card or bank transfer. Tokens get sent directly to their wallet.
+Open the checkout URL. Explain: MoonPay's fiat gateway for buying crypto with card or bank transfer.
 
 ## Mission 6: Message Signing
 
 **Goal:** Sign a message to prove wallet ownership.
 
 ```bash
-mp message sign --wallet <address> --message "I own this wallet"
+mp message sign --wallet main --chain solana --message "I own this wallet"
 ```
 
-Present the signature. Explain: this is used for wallet verification (e.g. registering with virtual accounts, proving ownership to dApps).
+Present the signature. Explain: used for wallet verification (e.g. registering with virtual accounts, proving ownership to dApps).
 
 ## Mission 7: Virtual Account (optional)
 
@@ -105,28 +98,28 @@ Present the signature. Explain: this is used for wallet verification (e.g. regis
 mp virtual-account retrieve
 ```
 
-If they have one, show the status and next step. If not, explain what a virtual account is (KYC-verified fiat bridge) and that they can set one up with `mp virtual-account create`.
+If they have one, show the status and next step. If not, explain what it is and that they can set one up with `mp virtual-account create`.
 
 ## Mission 8: Skills
 
-**Goal:** Show the user what skills are available.
+**Goal:** Show what skills are available.
 
 ```bash
 mp skill list
 ```
 
-Explain: skills are guides that teach agents how to use the CLI. They can install them for Claude Code with `mp skill install`.
+Explain: skills are guides that teach agents how to use the CLI. Install them with `mp skill install`.
 
 ## Debrief
 
-Summarize everything the user just did:
-- Authenticated and set up a wallet
+Summarize everything:
+- Set up a multi-chain HD wallet (encrypted, OS keychain secured)
 - Searched and analyzed tokens
-- Checked portfolio
-- Built and signed a swap (and maybe executed it)
+- Checked portfolio across Solana, Ethereum, Bitcoin
+- Executed a swap (built, signed locally, broadcast)
 - Generated a fiat buy link
-- Signed a message
+- Signed a message for verification
 - Explored virtual accounts
 - Discovered skills
 
-End with: "You're oriented. Run `mp --help` to see all commands, or ask me anything."
+End with: "You're all set. Run `mp --help` to see all commands, or ask me anything."

package/skills/moonpay-swap-tokens/SKILL.md

@@ -1,73 +1,83 @@
 ---
 name: moonpay-swap-tokens
-description: Swap tokens using the build, sign, execute flow. Use when the user wants to swap token A for token B on Solana.
+description: Swap or bridge tokens across chains. Use when the user wants to swap, bridge, or move tokens between wallets or chains.
 tags: [trading]
 ---
 
-# Swap tokens
+# Swap or bridge tokens
 
 ## Goal
 
-Swap tokens on Solana using the three-step flow: build an unsigned transaction, sign it locally with a wallet, then execute it on-chain.
+Swap tokens on any supported chain, or bridge tokens across chains. One command handles everything: builds the transaction via swaps.xyz, signs locally, broadcasts, and registers for tracking.
 
-## Tools
+## Command
 
-- `token swap build` — Build an unsigned swap transaction (returns base64 tx + quote)
-- `transaction sign` — Sign the transaction with a local wallet
-- `token swap execute` — Submit the signed transaction on-chain
+```bash
+mp token swap \
+  --from-wallet <wallet-name> \
+  --from-chain <chain> \
+  --from-token <token-address> \
+  --from-amount <amount> \
+  --to-token <token-address> \
+  --to-chain <chain>         # optional, defaults to from-chain
+  --to-wallet <wallet-name>  # optional, defaults to from-wallet
+```
 
-## Workflow
+## Examples
 
-### 1. Build the swap transaction
+### Same-chain swap (SOL → USDC on Solana)
 
 ```bash
-mp token swap build \
-  --input <input-token-mint> \
-  --output <output-token-mint> \
-  --amount <amount-of-input-token> \
-  --wallet <wallet-address>
+mp token swap \
+  --from-wallet main --from-chain solana \
+  --from-token So11111111111111111111111111111111111111112 \
+  --from-amount 0.1 \
+  --to-token EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
 ```
 
-This returns a `transaction` (base64), `message` (human-readable quote), and `requestId`.
-
-### 2. Sign the transaction locally
+### Cross-chain bridge (ETH → USDC.e on Polygon)
 
 ```bash
-mp transaction sign \
-  --transaction <base64-transaction> \
-  --wallet <wallet-address>
+mp token swap \
+  --from-wallet funded --from-chain ethereum \
+  --from-token 0x0000000000000000000000000000000000000000 \
+  --from-amount 0.003 \
+  --to-chain polygon \
+  --to-token 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174
 ```
 
-This returns a signed `transaction` (base64). The private key never leaves the machine.
-
-### 3. Execute the swap
+### ERC20 swap (auto-approves if needed)
 
 ```bash
-mp token swap execute \
-  --transaction <signed-base64-transaction> \
-  --requestId <request-id-from-build>
+mp token swap \
+  --from-wallet funded --from-chain polygon \
+  --from-token 0x2791Bca1f2de4661ED88A30C99A7a9449Aa84174 \
+  --from-amount 5 \
+  --to-token 0x0000000000000000000000000000000000000000
 ```
 
-This returns a `signature` (the on-chain transaction hash).
+## Supported chains
+
+solana, ethereum, base, polygon, arbitrum, optimism, bnb, avalanche, bitcoin (bridges only)
 
-## Example flow
+## How it works
 
-1. User: "Swap 1 USDC for WBTC"
-2. Resolve token addresses via `mp token search --query "USDC" --chain solana`.
-3. Build: `mp token swap build --input EPjF...Dt1v --output 3NZ9...cmJh --amount 1 --wallet <addr>`
-4. Show the quote from the `message` field. Ask for confirmation.
-5. Sign: `mp transaction sign --transaction <tx> --wallet <addr>`
-6. Execute: `mp token swap execute --transaction <signed-tx> --requestId <id>`
-7. Return the transaction signature.
+1. Resolves wallet name → address
+2. Builds unsigned transaction via swaps.xyz (handles decimal conversion)
+3. If ERC20 token needs approval, sends an approve transaction first, then re-builds
+4. Signs locally — private key never leaves the machine
+5. Broadcasts to the network
+6. Registers for tracking
 
-## Notes
+## Tips
 
-- If the user provides token names/symbols, resolve to addresses with `mp token search`.
-- Always show the quote and ask for confirmation before signing.
-- The wallet must be a local wallet (see `mp wallet list`).
+- If the user provides token names/symbols, resolve to addresses with `mp token search --query "USDC" --chain solana`
+- Check balances first with `mp token balance list --wallet <address> --chain <chain>`
+- For cross-chain bridges, specify `--to-chain`. The tool detects it and routes through a bridge protocol.
+- Native tokens use `0x0000000000000000000000000000000000000000` (EVM) or `So11111111111111111111111111111111111111112` (Solana)
 
 ## Related skills
 
-- **moonpay-discover-tokens** — Search for token addresses.
-- **moonpay-check-wallet** — Check balances before swapping.
-- **moonpay-auth** — Set up wallets for signing.
+- **moonpay-discover-tokens** — Search for token addresses
+- **moonpay-check-wallet** — Check balances before swapping
+- **moonpay-auth** — Set up wallets for signing