@mysten-incubation/suipay-mcp 0.3.0-dev.5 → 0.3.0-dev.7

package/README.md

@@ -5,7 +5,7 @@ buyer-funded spend account. The buyer owns the account. The agent holds the
 delegate key and can spend only under the on-chain grant (recipient bind,
 per-payment cap, budget).
 
-Pin `@mysten-incubation/suipay-mcp@0.3.0-dev.5` in MCP config for the `latest` dist-tag.
+Pin `@mysten-incubation/suipay-mcp@0.3.0-dev.7` in MCP config for the `latest` dist-tag.
 `npx -y @mysten-incubation/suipay-mcp@dev` tracks the `dev` prerelease line.
 `1.0.1` remains on the registry as a historical release; do not install it
 for new agents.
@@ -13,7 +13,7 @@ for new agents.
 ## Install
 
 ```bash
-claude mcp add --scope user suipay -- npx -y @mysten-incubation/suipay-mcp@0.3.0-dev.5
+claude mcp add --scope user suipay -- npx -y @mysten-incubation/suipay-mcp@0.3.0-dev.7
 ```
 
 `@dev` installs the Railway-dev gateway/console defaults. A workspace
@@ -155,10 +155,10 @@ Default is Railway **suipay-dev**. `--local` / `target: "local"` is laptop-only.
 
 ```bash
 # Railway suipay-dev (default)
-npx @mysten-incubation/suipay-mcp@0.3.0-dev.5
+npx @mysten-incubation/suipay-mcp@0.3.0-dev.7
 
 # Laptop stack
-npx @mysten-incubation/suipay-mcp@0.3.0-dev.5 --local
+npx @mysten-incubation/suipay-mcp@0.3.0-dev.7 --local
 ```
 
 `SUIPAY_MCP_TARGET=local|dev` selects the same preset. Explicit

package/dist/bin/suipay.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-IVHVB3IY.js";
+} from "../chunk-X23ENZQ6.js";
 import {
   logError
-} from "../chunk-7S4TYZJM.js";
+} from "../chunk-VKRYN5FA.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-7S4TYZJM.js → chunk-VKRYN5FA.js}

@@ -957,6 +957,70 @@ function createSpendAccountChain(options) {
       });
       return kindBytes(tx);
     },
+    async buildCreatePolicyAndGrantKind(input) {
+      if (!input.policy.targets?.length) {
+        throw new Error("create_spend_policy requires at least one target");
+      }
+      if (!input.policy.totalCap || BigInt(input.policy.totalCap) <= 0n) {
+        throw new Error("create_spend_policy requires a non-zero total_cap");
+      }
+      if (!input.policy.maxPerPayment || BigInt(input.policy.maxPerPayment) <= 0n) {
+        throw new Error("create_spend_policy requires a non-zero max_per_payment");
+      }
+      if (!input.grant.sessionCap || BigInt(input.grant.sessionCap) <= 0n) {
+        throw new Error("create_grant requires a non-zero session_cap");
+      }
+      if (!input.grant.maxPerPayment || BigInt(input.grant.maxPerPayment) <= 0n) {
+        throw new Error("create_grant requires a non-zero max_per_payment");
+      }
+      const tx = new Transaction2();
+      tx.setSender(input.owner);
+      const targetResults = input.policy.targets.map((t) => {
+        const hash = targetHashBytes(t.targetHash);
+        return tx.moveCall({
+          target: target("new_policy_target"),
+          arguments: [
+            tx.pure.vector("u8", Array.from(hash)),
+            tx.pure.address(t.recipient),
+            tx.pure.u64(BigInt(t.maxPerPayment))
+          ]
+        });
+      });
+      const targetsVec = tx.makeMoveVec({
+        type: `${packageId}::${MODULE}::PolicyTarget`,
+        elements: targetResults
+      });
+      const policyExpires = input.policy.expiresAtMs === void 0 || input.policy.expiresAtMs === null ? 0n : BigInt(input.policy.expiresAtMs);
+      const policyIdResult = tx.moveCall({
+        target: target("create_spend_policy"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          targetsVec,
+          tx.pure.u64(BigInt(input.policy.totalCap)),
+          tx.pure.u64(BigInt(input.policy.maxPerPayment)),
+          tx.pure.u64(policyExpires)
+        ]
+      });
+      const policyIdsVec = tx.makeMoveVec({
+        type: "u64",
+        elements: [policyIdResult]
+      });
+      const grantExpires = input.grant.expiresAtMs === void 0 || input.grant.expiresAtMs === null ? 0n : BigInt(input.grant.expiresAtMs);
+      tx.moveCall({
+        target: target("create_policy_grant"),
+        typeArguments: [input.coinType],
+        arguments: [
+          tx.object(input.poolObjectId),
+          tx.pure.address(input.delegate),
+          tx.pure.option("u64", BigInt(input.grant.sessionCap)),
+          tx.pure.option("u64", BigInt(input.grant.maxPerPayment)),
+          tx.pure.u64(grantExpires),
+          policyIdsVec
+        ]
+      });
+      return kindBytes(tx);
+    },
     async buildPausePolicyKind(input) {
       const tx = new Transaction2();
       tx.setSender(input.owner);
@@ -13894,7 +13958,7 @@ function grantObjectIdFromBootstrap(grants, nowMs) {
   }
   if (live.length === 1) return { kind: "live", grantObjectId: live[0] };
   if (live.length > 1) return { kind: "ambiguous" };
-  if (named > 0) return { kind: "absent" };
+  if (named > 0) return { kind: "expired" };
   if (grants.length > 0) return { kind: "unknown", detail: "delegate grants list was not usable" };
   return { kind: "absent" };
 }
@@ -14341,7 +14405,8 @@ async function suipayLogin(args, cfg, deps = {}) {
         target: target ?? cfg.target,
         delegateAddress: identity.delegateAddress,
         gatewayUrl: endpoints.gatewayUrl,
-        message: "Credentials are already saved for this agent. The existing grant could not be checked just now, so no new sign-in was started and the key file was left unchanged. Retry suipay_login in a moment."
+        nextAction: "poll suipay_login_status to verify authorization before retrying payment",
+        message: "Credentials are already saved for this agent. The existing grant could not be checked just now, so no new sign-in was started and the key file was left unchanged. Poll suipay_login_status in a moment."
       });
     }
   }
@@ -14376,7 +14441,7 @@ async function suipayLogin(args, cfg, deps = {}) {
       ``,
       `1. Use the browser window that just opened, or open the URL above`,
       `2. Connect the owner wallet, create a key, then Authorize on the review step`,
-      `3. Once Connected appears, retry the original request \u2014 credentials at \`~/.suipay/credentials.json\` are picked up on the next tool call`,
+      `3. Poll \`suipay_login_status\` to confirm authorization \u2014 credentials at \`~/.suipay/credentials.json\` are active once approved`,
       ``,
       `_The login link stays valid for 5 minutes. If it expires, call \`suipay_login\` again._`,
       ``,
@@ -14386,11 +14451,113 @@ async function suipayLogin(args, cfg, deps = {}) {
         delegateAddress: identity.delegateAddress,
         connectUrl: url,
         consoleUrl: endpoints.consoleUrl,
-        gatewayUrl: endpoints.gatewayUrl
+        gatewayUrl: endpoints.gatewayUrl,
+        nextAction: "poll suipay_login_status to verify authorization before retrying payment"
       })
     ].join("\n")
   );
 }
+function defaultKeyName(delegateAddress) {
+  const clean = delegateAddress.trim().toLowerCase();
+  const hex = clean.startsWith("0x") ? clean.slice(2) : clean;
+  const prefix = hex.slice(0, 8).padEnd(8, "0");
+  return `agent-${prefix}`;
+}
+function safeRetryDetail(rawDetail) {
+  if (!rawDetail) {
+    return "Grant status could not be verified on chain. Retry shortly.";
+  }
+  let stripped = rawDetail.replace(/https?:\/\/[^\s"'<>]+/gi, "[redacted]");
+  if (stripped.includes("ECONNREFUSED") || stripped.includes("ETIMEDOUT") || stripped.includes("fetch failed")) {
+    return "Network connection to gateway or chain node failed. Retry shortly.";
+  }
+  return stripped;
+}
+var loginStatusCache = /* @__PURE__ */ new Map();
+var DEFAULT_LOGIN_STATUS_RETRY_AFTER_MS = 2e3;
+var DEFAULT_LOGIN_STATUS_CACHE_TTL_MS = 1500;
+async function suipayLoginStatus(_args = {}, cfg, deps = {}) {
+  if (deps.auth) {
+    return mcpFailure(
+      "request.local_only",
+      "suipay_login_status is for local stdio only; hosted /mcp never holds a spendable key"
+    );
+  }
+  const loadKeypair = deps.loadLocalKeypair ?? loadLocalKeypair;
+  const keypair = loadKeypair();
+  if (!keypair) {
+    return text({
+      status: "not_started",
+      nextAction: "run suipay_login"
+    });
+  }
+  const delegateAddress = keypair.toSuiAddress();
+  const stored = loadLocalSigningKeyRecord();
+  const gatewayUrl = stored?.gatewayUrl ?? cfg.gatewayUrl;
+  const cacheKey = `${gatewayUrl}:${delegateAddress}`;
+  const now = Date.now();
+  const cacheTtlMs = deps.cacheTtlMs ?? DEFAULT_LOGIN_STATUS_CACHE_TTL_MS;
+  if (!deps.bypassCache) {
+    const cached = loginStatusCache.get(cacheKey);
+    if (cached && now - cached.timestamp < cacheTtlMs) {
+      return cached.result;
+    }
+  }
+  const checkFn = deps.checkLiveDelegateGrant ?? checkLiveDelegateGrant;
+  let live;
+  try {
+    live = await checkFn({
+      gatewayUrl,
+      delegateAddress,
+      signPersonalMessage: async (bytes) => {
+        const { signature } = await keypair.signPersonalMessage(bytes);
+        return signature;
+      },
+      ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
+    });
+  } catch (err) {
+    const rawMessage = err instanceof Error ? err.message : String(err);
+    live = {
+      kind: "unknown",
+      detail: rawMessage
+    };
+  }
+  let result;
+  if (live.kind === "live") {
+    result = text({
+      status: "connected",
+      grantObjectId: live.grantObjectId,
+      delegateAddress
+    });
+  } else if (live.kind === "expired") {
+    result = text({
+      status: "expired",
+      delegateAddress,
+      detail: "Grant has expired. Run suipay_login to reconnect.",
+      nextAction: "run suipay_login"
+    });
+  } else if (live.kind === "absent") {
+    result = text({
+      status: "pending",
+      delegateAddress,
+      defaultKeyName: defaultKeyName(delegateAddress)
+    });
+  } else if (live.kind === "ambiguous") {
+    result = text({
+      status: "ambiguous",
+      delegateAddress,
+      detail: "Multiple live grants found for this delegate key. Revoke the duplicate grants and reconnect."
+    });
+  } else {
+    result = text({
+      status: "retry",
+      retryAfterMs: DEFAULT_LOGIN_STATUS_RETRY_AFTER_MS,
+      detail: safeRetryDetail(live.detail)
+    });
+  }
+  loginStatusCache.set(cacheKey, { timestamp: Date.now(), result });
+  return result;
+}
 async function logout(args, _cfg, deps = {}) {
   if (args.force) {
     clearCreds();
@@ -14494,6 +14661,14 @@ var TOOLS = [
       }
     }
   },
+  {
+    name: "suipay_login_status",
+    description: `Check whether the local delegate key has an approved, active spend-account grant, read from the gateway's delegate-grant state. Read-only and pollable (does not mint keys, write credentials, or sign transactions). Returns one of five states: (1) "not_started" if no local key exists yet (call suipay_login first); (2) "connected" if a live grant exists for this local delegate key (note: "connected" means a live grant exists for this delegate key, which may be pre-existing from a prior session); (3) "pending" if the key exists but no grant has been approved yet (includes delegateAddress and a defaultKeyName of format "agent-<first-8-hex-chars-of-address-without-0x>"; note that if the owner already has a live key with this normalized name, creating it may yield 409 CONFLICT); (4) "ambiguous" (terminal) if several live grants exist for this delegate key \u2014 stop polling and revoke the duplicates; (5) "retry" if the status could not be verified (includes retryAfterMs floor and safe detail). Stdio only; hosted /mcp never holds a spendable key.`,
+    inputSchema: {
+      type: "object",
+      properties: {}
+    }
+  },
   {
     name: "suipay_logout",
     description: "Remove the local delegate-key credentials file. Missing file is success. Force clears a corrupt file without printing the seed.",
@@ -14641,6 +14816,14 @@ function createServer2(cfg, auth, trace, options = {}) {
             }
           );
         }
+        case "suipay_login_status":
+          if (auth) {
+            return mcpFailure(
+              "request.local_only",
+              "suipay_login_status is for local stdio only; hosted /mcp never holds a spendable key"
+            );
+          }
+          return await suipayLoginStatus(args, cfg, { auth });
         case "suipay_logout":
           if (auth) {
             return mcpFailure(

package/dist/{chunk-IVHVB3IY.js → chunk-X23ENZQ6.js}

@@ -5,7 +5,7 @@ import {
   loadMcpConfig,
   loadPaymentProfile,
   logError
-} from "./chunk-7S4TYZJM.js";
+} from "./chunk-VKRYN5FA.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/{http-Du_v0e8E.d.ts → http-OHkrRnYJ.d.ts}

@@ -4971,6 +4971,13 @@ declare const TOOLS: readonly [{
             };
         };
     };
+}, {
+    readonly name: "suipay_login_status";
+    readonly description: string;
+    readonly inputSchema: {
+        readonly type: "object";
+        readonly properties: {};
+    };
 }, {
     readonly name: "suipay_logout";
     readonly description: "Remove the local delegate-key credentials file. Missing file is success. Force clears a corrupt file without printing the seed.";

package/dist/http.d.ts

@@ -1,4 +1,4 @@
-export { I as handleSuipayMcpHttpRequest } from './http-Du_v0e8E.js';
+export { I as handleSuipayMcpHttpRequest } from './http-OHkrRnYJ.js';
 import '@modelcontextprotocol/sdk/server/index.js';
 import '@mysten/sui/keypairs/ed25519';
 import 'node:crypto';

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-7S4TYZJM.js";
+} from "./chunk-VKRYN5FA.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
-import { S as SpendAccountSigningRequest, P as PaidHttpRequest, D as DelegatedKeySigner, G as GetObjectJson, a as DelegatedPayerSession, b as DelegatedPayerConfig, c as DelegatedPayerDeps, d as SpendIntent, e as DelegatedPayResult, f as DelegationScope, C as CodeFor, N as NextAction, g as GrantPolicyBinding, h as PaymentAttemptLedger, O as OfferPublicKeySource, i as DelegatedPayerLog, j as PreparedSettlementTerms, X as X402PayProgress, k as Offer, M as McpConfig, l as McpAuthContext, m as McpTraceHooks, n as SpendAccountPayDeps, o as createReader } from './http-Du_v0e8E.js';
-export { A as AgentHeldResolver, p as AgentHeldSettlement, q as MCP_TARGET_PRESETS, r as McpEnvelope, s as McpEnvelopeEntry, t as McpServerOptions, u as McpTarget, v as McpTraceContext, w as McpTraceRuntime, x as PACKAGE_NAME, y as PreparedPayment, z as SpendAccountPrepareResult, B as SpendAccountPrepareSession, T as TOOLS, E as buildSpendAccountPayKind, F as canonicalMcpRequestId, H as createServer, I as handleSuipayMcpHttpRequest, J as inspectMcpEnvelope, K as loadMcpConfig, L as parseMcpTargetFlag, Q as prepareSpendAccountPayment, R as resetAgentHeldProcessLedger, U as resolveAgentHeldSettlement, V as resolveGrantTarget, W as resolveMcpTarget, Y as sameMcpGateway, Z as traceMcpHttpRequest, _ as verifySpendAccountPayReconstructs } from './http-Du_v0e8E.js';
-import { SuiGrpcClient } from '@mysten/sui/grpc';
 import { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';
+import { S as SpendAccountSigningRequest, P as PaidHttpRequest, D as DelegatedKeySigner, G as GetObjectJson, a as DelegatedPayerSession, b as DelegatedPayerConfig, c as DelegatedPayerDeps, d as SpendIntent, e as DelegatedPayResult, f as DelegationScope, C as CodeFor, N as NextAction, g as GrantPolicyBinding, h as PaymentAttemptLedger, O as OfferPublicKeySource, i as DelegatedPayerLog, j as PreparedSettlementTerms, X as X402PayProgress, k as Offer, M as McpConfig, l as McpAuthContext, m as McpTraceHooks, n as SpendAccountPayDeps, o as createReader } from './http-OHkrRnYJ.js';
+export { A as AgentHeldResolver, p as AgentHeldSettlement, q as MCP_TARGET_PRESETS, r as McpEnvelope, s as McpEnvelopeEntry, t as McpServerOptions, u as McpTarget, v as McpTraceContext, w as McpTraceRuntime, x as PACKAGE_NAME, y as PreparedPayment, z as SpendAccountPrepareResult, B as SpendAccountPrepareSession, T as TOOLS, E as buildSpendAccountPayKind, F as canonicalMcpRequestId, H as createServer, I as handleSuipayMcpHttpRequest, J as inspectMcpEnvelope, K as loadMcpConfig, L as parseMcpTargetFlag, Q as prepareSpendAccountPayment, R as resetAgentHeldProcessLedger, U as resolveAgentHeldSettlement, V as resolveGrantTarget, W as resolveMcpTarget, Y as sameMcpGateway, Z as traceMcpHttpRequest, _ as verifySpendAccountPayReconstructs } from './http-OHkrRnYJ.js';
+import { SuiGrpcClient } from '@mysten/sui/grpc';
 import { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
 import '@modelcontextprotocol/sdk/server/index.js';
 import 'node:crypto';
@@ -65,6 +65,8 @@ declare function loadLocalSigner(): {
     signTransaction: (txBytes: string) => Promise<string>;
     signPersonalMessage: (message: Uint8Array) => Promise<string>;
 } | null;
+/** Ed25519 keypair from the persisted seed. Null when this process holds no key. */
+declare function loadLocalKeypair(): Ed25519Keypair | null;
 
 /**
  * Client-side completion of an MCP prepared payment.
@@ -581,6 +583,10 @@ interface ToolDeps {
     createPayer?: typeof createPayer;
     createReader?: typeof createReader;
     startStdioLogin?: typeof startStdioLogin;
+    loadLocalKeypair?: typeof loadLocalKeypair;
+    checkLiveDelegateGrant?: typeof checkLiveDelegateGrant;
+    bypassCache?: boolean;
+    cacheTtlMs?: number;
 }
 declare function pay(args: {
     url: string;
@@ -591,6 +597,25 @@ declare function pay(args: {
     recipient?: unknown;
     maxAmount?: unknown;
 }, cfg: McpConfig, deps?: ToolDeps): Promise<ToolResult>;
+type LiveGrantCheck = {
+    kind: 'live';
+    grantObjectId: string;
+} | {
+    kind: 'ambiguous';
+} | {
+    kind: 'absent';
+} | {
+    kind: 'expired';
+} | {
+    kind: 'unknown';
+    detail: string;
+};
+declare function checkLiveDelegateGrant(args: {
+    gatewayUrl: string;
+    delegateAddress: string;
+    signPersonalMessage: (message: Uint8Array) => Promise<string>;
+    fetchImpl?: typeof fetch;
+}): Promise<LiveGrantCheck>;
 declare function receipts(args: {
     challengeId?: string;
 }, cfg: McpConfig, deps?: ToolDeps): Promise<ToolResult>;

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-IVHVB3IY.js";
+} from "./chunk-X23ENZQ6.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-7S4TYZJM.js";
+} from "./chunk-VKRYN5FA.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mysten-incubation/suipay-mcp",
-  "version": "0.3.0-dev.5",
+  "version": "0.3.0-dev.7",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "repository": {