@mysten-incubation/suipay-mcp 0.3.0-dev.8 → 0.3.0-dev.9

package/README.md

@@ -5,7 +5,7 @@ buyer-funded spend account. The buyer owns the account. The agent holds the
 delegate key and can spend only under the on-chain grant (recipient bind,
 per-payment cap, budget).
 
-Pin `@mysten-incubation/suipay-mcp@0.3.0-dev.8` in MCP config for the `latest` dist-tag.
+Pin `@mysten-incubation/suipay-mcp@0.3.0-dev.9` in MCP config for the `latest` dist-tag.
 `npx -y @mysten-incubation/suipay-mcp@dev` tracks the `dev` prerelease line.
 `1.0.1` remains on the registry as a historical release; do not install it
 for new agents.
@@ -13,7 +13,7 @@ for new agents.
 ## Install
 
 ```bash
-claude mcp add --scope user suipay -- npx -y @mysten-incubation/suipay-mcp@0.3.0-dev.8
+claude mcp add --scope user suipay -- npx -y @mysten-incubation/suipay-mcp@0.3.0-dev.9
 ```
 
 `@dev` installs the Railway-dev gateway/console defaults. A workspace
@@ -155,10 +155,10 @@ Default is Railway **suipay-dev**. `--local` / `target: "local"` is laptop-only.
 
 ```bash
 # Railway suipay-dev (default)
-npx @mysten-incubation/suipay-mcp@0.3.0-dev.8
+npx @mysten-incubation/suipay-mcp@0.3.0-dev.9
 
 # Laptop stack
-npx @mysten-incubation/suipay-mcp@0.3.0-dev.8 --local
+npx @mysten-incubation/suipay-mcp@0.3.0-dev.9 --local
 ```
 
 `SUIPAY_MCP_TARGET=local|dev` selects the same preset. Explicit
@@ -169,12 +169,32 @@ credential is bound yet. After a successful login, `credentials.json`
 Rebind with `suipay_login({ target: "dev" | "local" })` (same key, new consent
 if that stack has no live grant).
 
+### Isolate connection environments
+
+`SUIPAY_MCP_PROFILE` selects a separate agent-held key file at
+`~/.suipay/profiles/<sha256-of-trimmed-profile>/credentials.json`. Unset or
+blank keeps the existing `~/.suipay/credentials.json`. The profile is a local
+storage selector, not an authorization grant or gateway override: set
+`SUIPAY_GATEWAY_URL` and `SUIPAY_CONSOLE_URL` as well. Use the same stable profile
+for the same environment. Login, status, discovery, pay, and logout all use
+that profile; logout removes only its file. Files stay mode `0600` inside a
+`0700` profile directory. Existing files are never copied, rebound, or deleted
+when selecting a profile. A new profile requires fresh owner authorization.
+
+The console's Connect Agent prompt uses its public gateway URL as the profile.
+Install an MCP package that supports profiles before using this prompt, and
+verify the returned login gateway matches the configured environment before
+continuing. An older package may ignore the variable and reuse legacy
+credentials. Stop on a mismatch; do not pay or delete the existing key.
+
 ## Client environment
 
 ```bash
 # Optional. Unset = Railway suipay-dev. --local uses localhost:3000 / 127.0.0.1:4340.
 SUIPAY_GATEWAY_URL=https://gateway.example
 SUIPAY_CONSOLE_URL=https://console.example
+# Optional. Unset/blank retains the legacy credentials file.
+SUIPAY_MCP_PROFILE=https://gateway.example
 SUIPAY_RPC_URL=https://your-testnet-rpc.example
 SUIPAY_NETWORK=testnet
 SUIPAY_MCP_TARGET=dev

package/dist/bin/suipay.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   main
-} from "../chunk-4275QE4A.js";
+} from "../chunk-QXBN3DSX.js";
 import {
   logError
-} from "../chunk-7KI45A7U.js";
+} from "../chunk-3CONDPUL.js";
 
 // src/bin/suipay.ts
 main().catch((err) => {

package/dist/{chunk-7KI45A7U.js → chunk-3CONDPUL.js}

@@ -9988,6 +9988,7 @@ import { bytesToHex as bytesToHex4 } from "@noble/hashes/utils.js";
 
 // src/config.ts
 import { homedir } from "os";
+import { createHash as createHash4 } from "crypto";
 import { join as join2 } from "path";
 import { SuiGrpcClient as SuiGrpcClient2 } from "@mysten/sui/grpc";
 import { normalizeSuiAddress as normalizeSuiAddress7 } from "@mysten/sui/utils";
@@ -10054,6 +10055,11 @@ function configError(detail) {
 }
 function mcpCredentialsPath() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? homedir();
+  const profile2 = process.env.SUIPAY_MCP_PROFILE?.trim();
+  if (profile2) {
+    const id = createHash4("sha256").update(profile2).digest("hex");
+    return join2(home, ".suipay", "profiles", id, "credentials.json");
+  }
   return join2(home, ".suipay", "credentials.json");
 }
 var MCP_TARGET_PRESETS = {

package/dist/{chunk-4275QE4A.js → chunk-QXBN3DSX.js}

@@ -5,7 +5,7 @@ import {
   loadMcpConfig,
   loadPaymentProfile,
   logError
-} from "./chunk-7KI45A7U.js";
+} from "./chunk-3CONDPUL.js";
 
 // src/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

package/dist/http.js

@@ -1,6 +1,6 @@
 import {
   handleSuipayMcpHttpRequest
-} from "./chunk-7KI45A7U.js";
+} from "./chunk-3CONDPUL.js";
 export {
   handleSuipayMcpHttpRequest
 };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   loadBootProfile,
   main
-} from "./chunk-4275QE4A.js";
+} from "./chunk-QXBN3DSX.js";
 import {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,
@@ -26,7 +26,7 @@ import {
   settlePreparedMcpPayment,
   traceMcpHttpRequest,
   verifySpendAccountPayReconstructs
-} from "./chunk-7KI45A7U.js";
+} from "./chunk-3CONDPUL.js";
 export {
   MCP_TARGET_PRESETS,
   PACKAGE_NAME,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mysten-incubation/suipay-mcp",
-  "version": "0.3.0-dev.8",
+  "version": "0.3.0-dev.9",
   "type": "module",
   "description": "SuiPay MCP — pay MPP-gated APIs from a spend-account grant with an agent-held delegate key.",
   "repository": {
@@ -42,8 +42,8 @@
     "tsup": "^8.0.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10",
-    "@cmdoss/suipay-sdk": "0.1.0",
-    "@cmdoss/suipay-core": "0.1.0"
+    "@cmdoss/suipay-core": "0.1.0",
+    "@cmdoss/suipay-sdk": "0.1.0"
   },
   "scripts": {
     "build": "tsup",