@vapi-network/mcp 0.5.0 → 0.8.0

package/dist/server.d.ts

@@ -1,11 +1,14 @@
-import { type SecretStore, type VapiPaymentAccount, type VapiConfig, type WalletStore } from "@vapi-network/core";
+import { type SecretStore, type SwarmCapitalDeps, type VapiPaymentAccount, type VapiConfig, type WalletStore } from "@vapi-network/core";
 import { z } from "zod";
+import { type Runtime } from "./agent/runtime.js";
 import { callService, type CallToolInput, type CallToolResult } from "./tools/call.js";
+import { type AccountsToolOverrides } from "./tools/accounts.js";
 import { type AuthAgentLinkOverrides } from "./tools/auth.js";
 import { type RouterCoreOverrides } from "./tools/router.js";
+import { type StatusCoreOverrides } from "./tools/status.js";
 export { callService, type CallToolInput, type CallToolResult };
 export type VapiServerOptions = {
-    /** The wallet unlocked before stdio was connected. */
+    /** The account opened before stdio was connected. */
     account: VapiPaymentAccount;
     config: VapiConfig;
     fetchImpl?: typeof fetch;
@@ -13,19 +16,27 @@ export type VapiServerOptions = {
     receiptsPath?: string;
     searchesPath?: string;
     reportsDirectory?: string;
-    /** The wallets on this machine. Without it the server has exactly one. */
+    /** The accounts on this machine. Without it the server has exactly one. */
     store?: WalletStore | undefined;
-    /** The wallet the session starts on; `VAPI_WALLET` and the default follow. */
+    /** The account the session starts on; `VAPI_WALLET` and the default follow. */
     wallet?: string | undefined;
     env?: NodeJS.ProcessEnv | undefined;
-    /** The passphrase a payment unlocks with; see `WalletSession`. */
+    /** The passphrase for a legacy 0.5 keystore that has not been migrated yet. */
     passphrase?: (() => string | Promise<string>) | undefined;
-    /** The OS secret store `vapi unlock` writes to; see `WalletSession`. */
+    /** The OS secret store used by the vault and any legacy keystore entries. */
     secretStore?: SecretStore | undefined;
     /** Device-link functions and API base overridden by deterministic tests. */
     agentLink?: AuthAgentLinkOverrides | undefined;
     /** Core Router functions overridden by deterministic tests. */
     router?: RouterCoreOverrides | undefined;
+    /** Status probes and clock overridden by deterministic tests. */
+    status?: StatusCoreOverrides | undefined;
+    /** Account-link functions, device identity and clock overridden by deterministic tests. */
+    accounts?: AccountsToolOverrides | undefined;
+    /** Swarm capital seams overridden by deterministic tests. */
+    swarm?: Pick<SwarmCapitalDeps, "balanceReader" | "transfer" | "randomId" | "randomNonce"> | undefined;
+    /** Background runtime used by detached swarm runs. */
+    runtime?: Runtime | undefined;
 };
 type ToolResult = {
     isError?: boolean;
@@ -51,6 +62,7 @@ type ListedTool = {
 /** Minimal MCP server implementation for stdio and deterministic in-memory tests. */
 export declare class VapiMcpServer {
     #private;
+    constructor(onClose?: () => void);
     registerTool<Shape extends z.ZodRawShape>(name: string, definition: ToolDefinition<Shape>, handler: (input: z.infer<z.ZodObject<Shape>>) => Promise<ToolResult>): void;
     listTools(): Promise<{
         tools: ListedTool[];
@@ -86,4 +98,5 @@ export declare function loadServerConfig(): Promise<{
         marketplaceDiscoveryUrl: string;
     }[] | undefined;
     allowPrivateNetwork?: boolean | undefined;
+    device?: string | undefined;
 }>;

package/dist/tools/accounts.d.ts

@@ -0,0 +1,145 @@
+import { type AddAccountArgs, type SecretStore, type TransferArgs, type WalletStore } from "@vapi-network/core";
+import { z } from "zod";
+import type { AccountsPort } from "../actions/context.js";
+import type { WalletSession } from "../wallet-session.js";
+export { accountsSendInputSchema, accountsSendOutputSchema } from "../actions/accounts.js";
+export declare const accountsAddTool: {
+    description: string;
+    strictInput: boolean;
+    inputSchema: {
+        name: z.ZodString;
+        caps: z.ZodOptional<z.ZodObject<{
+            perCallUsd: z.ZodOptional<z.ZodNumber>;
+            perDayUsd: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        routerAllowanceUsd: z.ZodOptional<z.ZodNumber>;
+        link: z.ZodOptional<z.ZodBoolean>;
+    };
+    outputSchema: z.ZodObject<{
+        account: z.ZodString;
+        address: z.ZodString;
+        caps: z.ZodObject<{
+            perCallUsd: z.ZodString;
+            perDayUsd: z.ZodString;
+        }, z.core.$strip>;
+        created: z.ZodBoolean;
+        linked: z.ZodBoolean;
+        autoApproved: z.ZodBoolean;
+        link: z.ZodOptional<z.ZodObject<{
+            userCode: z.ZodString;
+            verificationUri: z.ZodURL;
+            verificationUriComplete: z.ZodURL;
+            expiresInSeconds: z.ZodNumber;
+        }, z.core.$strip>>;
+        message: z.ZodString;
+    }, z.core.$strip>;
+};
+export declare const accountsCapsTool: {
+    description: string;
+    strictInput: boolean;
+    inputSchema: {
+        name: z.ZodString;
+        perCallUsd: z.ZodOptional<z.ZodNumber>;
+        perDayUsd: z.ZodOptional<z.ZodNumber>;
+        ceilingUsd: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<"off">]>>;
+    };
+    outputSchema: z.ZodObject<{
+        account: z.ZodString;
+        address: z.ZodString;
+        caps: z.ZodObject<{
+            perCallUsd: z.ZodString;
+            perDayUsd: z.ZodString;
+            ceilingUsd: z.ZodString;
+        }, z.core.$strip>;
+        message: z.ZodString;
+    }, z.core.$strip>;
+};
+export declare const accountsSendTool: {
+    description: string;
+    strictInput: boolean;
+    inputSchema: {
+        from: z.ZodString;
+        to: z.ZodString;
+        amountUsd: z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>;
+        network: z.ZodOptional<z.ZodEnum<{
+            base: "base";
+            arc: "arc";
+        }>>;
+    };
+    outputSchema: z.ZodObject<{
+        status: z.ZodEnum<{
+            unknown: "unknown";
+            sent: "sent";
+        }>;
+        from: z.ZodString;
+        to: z.ZodString;
+        toName: z.ZodString;
+        toKind: z.ZodEnum<{
+            account: "account";
+            owner: "owner";
+        }>;
+        amountUsd: z.ZodString;
+        amountAtomic: z.ZodString;
+        network: z.ZodEnum<{
+            "eip155:8453": "eip155:8453";
+            "eip155:5042": "eip155:5042";
+        }>;
+        txHash: z.ZodNullable<z.ZodString>;
+        nonce: z.ZodString;
+        replayed: z.ZodBoolean;
+        message: z.ZodString;
+    }, z.core.$strip>;
+};
+export type AccountsToolOverrides = {
+    configPath?: string | undefined;
+    hostname?: string | undefined;
+    now?: (() => number) | undefined;
+    sleep?: AddAccountArgs["sleep"];
+    startDeviceLink?: AddAccountArgs["startDeviceLink"];
+    pollDeviceLink?: AddAccountArgs["pollDeviceLink"];
+    saveAgentLink?: AddAccountArgs["saveAgentLink"];
+    scopes?: AddAccountArgs["scopes"];
+    nonce?: TransferArgs["nonce"];
+};
+export type AccountsToolsOptions = AccountsToolOverrides & {
+    session: WalletSession;
+    secrets: SecretStore;
+    wallets?: WalletStore | undefined;
+    fetchImpl: typeof fetch;
+    apiBase: string;
+    env?: NodeJS.ProcessEnv | undefined;
+    signal?: AbortSignal | undefined;
+};
+export type CreateAccountsPortOptions = Pick<AccountsToolsOptions, "session" | "secrets" | "wallets" | "fetchImpl" | "apiBase" | "now" | "nonce">;
+type ToolResult = {
+    structuredContent: Record<string, unknown>;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+} | {
+    isError: true;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+/** Account mutation tools. Link credentials and the device code stay inside core. */
+export declare function createAccountsTools(options: AccountsToolsOptions): {
+    add(input: {
+        name: string;
+        caps?: {
+            perCallUsd?: number;
+            perDayUsd?: number;
+        };
+        routerAllowanceUsd?: number;
+        link?: boolean;
+    }): Promise<ToolResult>;
+    caps(input: {
+        name: string;
+        perCallUsd?: number;
+        perDayUsd?: number;
+        ceilingUsd?: number | "off";
+    }): Promise<ToolResult>;
+};
+export declare function createAccountsPort(options: CreateAccountsPortOptions): AccountsPort;

package/dist/tools/auth.d.ts

@@ -38,6 +38,7 @@ export declare const authLinkTool: {
     description: string;
     inputSchema: {
         label: z.ZodOptional<z.ZodString>;
+        account: z.ZodOptional<z.ZodString>;
     };
     outputSchema: z.ZodObject<{
         wallet: z.ZodString;
@@ -73,6 +74,7 @@ type ToolResult = {
 export declare function createAuthTools(options: AuthToolsOptions): {
     link(input: {
         label?: string;
+        account?: string;
     }): Promise<ToolResult>;
     status(input: {
         wallet?: string;

package/dist/tools/call.d.ts

@@ -1,4 +1,4 @@
-import { type ListingVerification, type LookupFn, type MarketplaceHit, type SpendCaps, type VapiPaymentAccount, type VapiConfig, type WalletName } from "@vapi-network/core";
+import { type ListingVerification, type LookupFn, type MarketplaceHit, type RunBudget, type RunRef, type CeilingSweepHook, type SpendCaps, type VapiPaymentAccount, type VapiConfig, type WalletName } from "@vapi-network/core";
 export type CallToolInput = {
     id?: string;
     url?: string;
@@ -44,6 +44,8 @@ export declare class VapiCallError extends Error {
 export type CallToolResult = {
     status: number;
     body: unknown;
+    /** The final resource URL after guarded redirects, present when a payment settled. */
+    resourceUrl?: string;
     /**
      * How far the paid listing got through vAPI review. Absent when there was no
      * listing to disclose — a call made against an explicit URL.
@@ -78,7 +80,12 @@ export type CallServiceArgs = {
     /** The caps of that wallet. Without it, the machine-wide config caps apply. */
     spendCaps?: SpendCaps;
     now?: Date;
+    allowanceExpiresAt?: Date;
     nowMs?: () => number;
     timeoutMs?: number;
+    runBudget?: RunBudget;
+    run?: RunRef;
+    /** Best-effort account ceiling enforcement after decisive settlement. */
+    ceilingSweep?: CeilingSweepHook | false;
 };
 export declare function callService(args: CallServiceArgs): Promise<CallToolResult>;

package/dist/tools/siblings.d.ts

@@ -0,0 +1,70 @@
+import { type SecretStore, type WalletStore } from "@vapi-network/core";
+import { z } from "zod";
+declare const siblingsOutputSchema: z.ZodObject<{
+    owner: z.ZodNullable<z.ZodString>;
+    siblings: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        address: z.ZodString;
+        device: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+        }>;
+        allowance: z.ZodObject<{
+            routerPerDayUsd: z.ZodNullable<z.ZodNumber>;
+            perCallUsd: z.ZodNullable<z.ZodNumber>;
+            perDayUsd: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>;
+        self: z.ZodBoolean;
+        onThisDevice: z.ZodBoolean;
+    }, z.core.$strip>>;
+    note: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const vapiSiblingsTool: {
+    description: string;
+    inputSchema: {
+        account: z.ZodOptional<z.ZodString>;
+    };
+    outputSchema: z.ZodObject<{
+        owner: z.ZodNullable<z.ZodString>;
+        siblings: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            address: z.ZodString;
+            device: z.ZodNullable<z.ZodString>;
+            status: z.ZodEnum<{
+                active: "active";
+                revoked: "revoked";
+            }>;
+            allowance: z.ZodObject<{
+                routerPerDayUsd: z.ZodNullable<z.ZodNumber>;
+                perCallUsd: z.ZodNullable<z.ZodNumber>;
+                perDayUsd: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>;
+            self: z.ZodBoolean;
+            onThisDevice: z.ZodBoolean;
+        }, z.core.$strip>>;
+        note: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+};
+type ToolResult = {
+    structuredContent: z.infer<typeof siblingsOutputSchema>;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+} | {
+    isError: true;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+export declare function createSiblingsTool(options: {
+    wallets?: WalletStore | undefined;
+    secrets: SecretStore;
+    fetchImpl: typeof fetch;
+    now?: (() => Date) | undefined;
+}): (input: {
+    account?: string;
+}) => Promise<ToolResult>;
+export {};

package/dist/tools/status.d.ts

@@ -0,0 +1,116 @@
+import { type SecretStore, type StatusDeps, type VapiConfig, type WalletStore } from "@vapi-network/core";
+import { routerUsage } from "@vapi-network/core/router-client";
+import { z } from "zod";
+export declare const vapiStatusTool: {
+    description: string;
+    inputSchema: {};
+    outputSchema: z.ZodObject<{
+        version: z.ZodString;
+        home: z.ZodString;
+        registry: z.ZodString;
+        owner: z.ZodOptional<z.ZodObject<{
+            address: z.ZodString;
+            linked: z.ZodBoolean;
+            console: z.ZodString;
+        }, z.core.$strip>>;
+        vault: z.ZodObject<{
+            exists: z.ZodBoolean;
+            unlocked: z.ZodBoolean;
+            store: z.ZodString;
+            protected: z.ZodBoolean;
+        }, z.core.$strip>;
+        accounts: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            default: z.ZodBoolean;
+            address: z.ZodString;
+            usdc: z.ZodOptional<z.ZodString>;
+            routerTodayUsd: z.ZodOptional<z.ZodString>;
+            routerAllowanceUsd: z.ZodOptional<z.ZodString>;
+            caps: z.ZodObject<{
+                perCallUsd: z.ZodString;
+                perDayUsd: z.ZodString;
+                ceilingUsd: z.ZodString;
+                ceilingFloorUsd: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            link: z.ZodEnum<{
+                unknown: "unknown";
+                paused: "paused";
+                not_linked: "not_linked";
+                active: "active";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>>;
+        unfinishedMovements: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            from: z.ZodString;
+            network: z.ZodString;
+            createdAt: z.ZodString;
+            pendingLegs: z.ZodNumber;
+            unknownLegs: z.ZodNumber;
+        }, z.core.$strip>>;
+        next: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+};
+export declare const vapiAccountsTool: {
+    description: string;
+    inputSchema: {};
+    outputSchema: z.ZodObject<{
+        accounts: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            default: z.ZodBoolean;
+            address: z.ZodString;
+            usdc: z.ZodOptional<z.ZodString>;
+            routerTodayUsd: z.ZodOptional<z.ZodString>;
+            routerAllowanceUsd: z.ZodOptional<z.ZodString>;
+            caps: z.ZodObject<{
+                perCallUsd: z.ZodString;
+                perDayUsd: z.ZodString;
+                ceilingUsd: z.ZodString;
+                ceilingFloorUsd: z.ZodOptional<z.ZodString>;
+            }, z.core.$strip>;
+            link: z.ZodEnum<{
+                unknown: "unknown";
+                paused: "paused";
+                not_linked: "not_linked";
+                active: "active";
+                revoked: "revoked";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+};
+export type StatusCoreOverrides = {
+    usdcBalance?: StatusDeps["chain"]["usdcBalance"] | undefined;
+    routerUsage?: StatusDeps["agents"]["routerUsage"] | undefined;
+    linkStatus?: StatusDeps["agents"]["linkStatus"] | undefined;
+    timeoutMs?: number | undefined;
+    now?: (() => Date) | undefined;
+};
+export type StatusToolsOptions = StatusCoreOverrides & {
+    version: string;
+    home: string;
+    registry: string;
+    wallets?: WalletStore | undefined;
+    secrets: SecretStore;
+    env?: NodeJS.ProcessEnv | undefined;
+    fetchImpl: typeof fetch;
+    config: VapiConfig;
+    routerClientUsage?: typeof routerUsage | undefined;
+};
+type StatusToolResult = {
+    structuredContent: Record<string, unknown>;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+} | {
+    isError: true;
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+};
+export declare function createStatusTools(options: StatusToolsOptions): {
+    status(input: Record<string, never>): Promise<StatusToolResult>;
+    accounts(input: Record<string, never>): Promise<StatusToolResult>;
+};
+export {};

package/dist/wallet-session.d.ts

@@ -1,9 +1,9 @@
 import { type SecretStore, type SpendCaps, type VapiPaymentAccount, type WalletName, type WalletStore } from "@vapi-network/core";
 import type { WalletAddresses } from "./tools/wallet.js";
-/** The wallet one tool call acts on. `path` is absent on a single-wallet home. */
+/** The account one tool call acts on. `path` is absent on a single-account home. */
 export type SessionWallet = {
     name: WalletName;
-    /** The keystore file, when this machine has a wallet store. */
+    /** The legacy keystore path, when this machine has an account store. */
     path?: string;
 };
 /** One row of `wallet.list`, before balances are read. */
@@ -13,24 +13,22 @@ export type SessionWalletInfo = {
     solanaAddress?: string;
     label?: string;
     isDefault: boolean;
-    /** Whether this is the wallet the session currently pays from. */
+    /** Whether this is the account the session currently pays from. */
     isActive: boolean;
     spendCaps?: SpendCaps;
 };
 export type WalletSessionOptions = {
-    /** The wallet unlocked before stdio was connected, for a store-less home. */
+    /** The account opened before stdio was connected, for a store-less home. */
     account: VapiPaymentAccount;
-    /** The wallets on this machine. Without it the session has exactly one. */
+    /** The accounts on this machine. Without it the session has exactly one. */
     store?: WalletStore | undefined;
     /** The name the session starts on, before `VAPI_WALLET` and the default. */
     wallet?: string | undefined;
     env?: NodeJS.ProcessEnv | undefined;
     /**
-     * The passphrase a payment unlocks with when neither
-     * `VAPI_KEYSTORE_PASSWORD` nor the OS secret store has one. The CLI hands
-     * over what it read at startup — from the person who ran `vapi mcp` in a
-     * terminal — so switching wallets never needs a prompt on a stdout that
-     * belongs to MCP frames.
+     * The passphrase for a legacy 0.5 keystore that has not been migrated yet,
+     * used when neither `VAPI_KEYSTORE_PASSWORD` nor the OS secret store has one.
+     * The CLI hands over what it read at startup, so MCP stdout is never prompted.
      */
     passphrase?: (() => string | Promise<string>) | undefined;
     /** The OS secret store to read `vapi unlock` entries from. */
@@ -38,49 +36,47 @@ export type WalletSessionOptions = {
     now?: (() => Date) | undefined;
 };
 /**
- * Which wallet an MCP session pays from, for the lifetime of the process.
+ * Which account an MCP session pays from, for the lifetime of the process.
  *
- * The session is the only mutable wallet state the server has, and it is
- * deliberately memory-only: `wallet.use` moves it, and nothing in this package
- * ever writes `wallets.json`, creates, removes, renames, backs up or exports a
- * wallet. Reads — addresses, balances, accounts, funding links — need no
- * passphrase at all, because the wallet store can read a keystore's addresses
- * without opening it. Only a payment unlocks a key, once, for that one call.
+ * `wallet.use` is memory-only. The account tools may derive an account or lower
+ * its caps in `wallets.json`, but this package never renames, removes, backs up
+ * or exports one. Reads — addresses, balances, network accounts, funding links
+ * — need no passphrase or opened vault. Only signing operations open a signer.
  */
 export declare class WalletSession {
     #private;
     private readonly options;
     constructor(options: WalletSessionOptions);
-    /** The wallet the next tool call uses when it names none. */
+    /** The account the next tool call uses when it names none. */
     get activeName(): WalletName | undefined;
     get store(): WalletStore | undefined;
     /** The home the audit log lives in, honouring `VAPI_HOME`. */
     get home(): string;
     /**
-     * An explicit name first, then the session's active wallet — which already
+     * An explicit name first, then the session's active account — which already
      * absorbed `VAPI_WALLET` and the registry default when the session started.
      */
     resolve(name?: string): SessionWallet;
-    /** The addresses of a wallet, read straight out of its keystore header. */
+    /** The addresses of an account, read from the vault or a legacy keystore header. */
     addressesFor(name?: string): Promise<{
         wallet: SessionWallet;
     } & WalletAddresses>;
     /**
-     * The unlocked key for one payment, plus the caps of that wallet. Nothing
+     * The signer for one payment, plus the caps of that account. Nothing
      * here is cached: the account is created for this call and dropped with it,
-     * so switching wallets mid-session pays from the wallet that was asked for.
+     * so switching accounts mid-session pays from the account that was asked for.
      */
     payment(name?: string): Promise<{
         wallet: SessionWallet;
         account: VapiPaymentAccount;
         spendCaps?: SpendCaps;
     }>;
-    /** Every wallet this machine knows, with the session's own marker on one. */
+    /** Every account this machine knows, with the session's own marker on one. */
     list(): Promise<SessionWalletInfo[]>;
     /**
-     * Points the session at another wallet. Memory only: the human's default in
+     * Points the session at another account. Memory only: the human's default in
      * `wallets.json` is not touched, so the next `vapi` command in their terminal
-     * still uses the wallet they chose. The switch is audited, because the wallet
+     * still uses the account they chose. The switch is audited, because the account
      * an agent pays from changed.
      */
     use(name: string): Promise<{

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vapi-network/mcp",
-  "version": "0.5.0",
+  "version": "0.8.0",
   "description": "Local, non-custodial MCP server for discovering and paying x402 APIs",
   "license": "Apache-2.0",
   "repository": {