@xona-labs/xpay 0.1.0

package/dist/cli/mcp-server.js

@@ -0,0 +1,112 @@
+/**
+ * xPay MCP server.
+ *
+ * Exposes every CLI capability as an MCP tool over stdio. Designed to be
+ * dropped into Claude Desktop / Cursor / Codex configs verbatim:
+ *
+ *   {
+ *     "mcpServers": {
+ *       "xpay": {
+ *         "command": "npx",
+ *         "args": ["-y", "@xona-labs/xpay"],
+ *         "env": { "XPAY_PASSPHRASE": "<your-passphrase>" }
+ *       }
+ *     }
+ *   }
+ *
+ * Configuration via env:
+ *   XPAY_PROFILE     profile to load (default: active profile, else "default")
+ *   XPAY_PASSPHRASE  passphrase for encrypted wallets
+ *   XPAY_HOME        override ~/.xpay/ root (mirrors the CLI)
+ *
+ * For ephemeral / test setups you can still bypass profiles with:
+ *   XPAY_SOLANA_SECRET, XPAY_EVM_KEY, XPAY_EVM_NETWORK
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { createXPay, loadProfile } from "../index.js";
+import { profileExists } from "../profile/storage.js";
+import { rawSolanaSigner } from "../signers/raw-solana.js";
+import { rawEvmSigner } from "../signers/raw-evm.js";
+import { forClaude } from "../tools/index.js";
+import { getActiveProfile } from "./accounts.js";
+export async function startMcpServer() {
+    const xpay = await buildXPay();
+    const { tools, handlers } = forClaude(xpay);
+    const server = new Server({ name: "xpay", version: "0.1.0" }, { capabilities: { tools: {} } });
+    server.setRequestHandler(ListToolsRequestSchema, async () => ({
+        tools: tools.map((t) => ({
+            name: t.name,
+            description: t.description,
+            inputSchema: t.input_schema,
+        })),
+    }));
+    server.setRequestHandler(CallToolRequestSchema, async (req) => {
+        const handler = handlers[req.params.name];
+        if (!handler) {
+            throw new Error(`Unknown tool: ${req.params.name}`);
+        }
+        try {
+            const result = await handler(req.params.arguments ?? {});
+            return {
+                content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
+            };
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return {
+                content: [{ type: "text", text: `Error: ${message}` }],
+                isError: true,
+            };
+        }
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+/**
+ * Build the XPay client the MCP host will use. Preference order:
+ *   1. A loaded profile (the common case after `xpay init`).
+ *   2. Raw signer envs (for tests / ephemeral pods that skip the profile flow).
+ */
+async function buildXPay() {
+    const profileName = process.env.XPAY_PROFILE ?? getActiveProfile();
+    if (profileExists(profileName)) {
+        const profile = await loadProfile({
+            name: profileName,
+            passphrase: process.env.XPAY_PASSPHRASE,
+        });
+        return createXPay({ profile });
+    }
+    // Fallback: ephemeral raw signers.
+    const networks = (process.env.XPAY_NETWORKS ?? "solana,base").split(",");
+    const signers = {};
+    if (process.env.XPAY_SOLANA_SECRET) {
+        signers["solana"] = rawSolanaSigner({ secretKey: process.env.XPAY_SOLANA_SECRET });
+    }
+    if (process.env.XPAY_EVM_KEY) {
+        const evmNet = (process.env.XPAY_EVM_NETWORK ?? "base");
+        signers[evmNet] = rawEvmSigner({ privateKey: process.env.XPAY_EVM_KEY, network: evmNet });
+    }
+    if (Object.keys(signers).length === 0) {
+        throw new Error(`xpay-mcp: no profile "${profileName}" found and no raw signer env set. ` +
+            `Run \`xpay init\` first, or set XPAY_SOLANA_SECRET / XPAY_EVM_KEY.`);
+    }
+    return createXPay({
+        networks,
+        signers,
+        guardrail: {
+            maxPerTx: numericEnv("XPAY_MAX_PER_TX"),
+            maxPerDay: numericEnv("XPAY_MAX_PER_DAY"),
+            allowedHosts: process.env.XPAY_ALLOWED_HOSTS?.split(","),
+        },
+    });
+}
+function numericEnv(name) {
+    const v = process.env[name];
+    if (v === undefined || v === "")
+        return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+}
+//# sourceMappingURL=mcp-server.js.map

package/dist/cli/mcp-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-server.js","sourceRoot":"","sources":["../../src/cli/mcp-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAIjD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAClC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,WAAW,EAAE,CAAC,CAAC,YAAY;SAC5B,CAAC,CAAC;KACJ,CAAC,CAAC,CAAC;IAEJ,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACzD,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;aACnE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,EAAE,EAAE,CAAC;gBACtD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,SAAS;IACtB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,gBAAgB,EAAE,CAAC;IACnE,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC;YAChC,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe;SACxC,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACjC,CAAC;IAED,mCAAmC;IACnC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,aAAa,CAAC,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtF,MAAM,OAAO,GAAqC,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAY,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,WAAW,qCAAqC;YACvE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC;QAChB,QAAQ;QACR,OAAO;QACP,SAAS,EAAE;YACT,QAAQ,EAAE,UAAU,CAAC,iBAAiB,CAAC;YACvC,SAAS,EAAE,UAAU,CAAC,kBAAkB,CAAC;YACzC,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,GAAG,CAAC;SACzD;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC"}

package/dist/cli/pay.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `xpay pay <url>` — pay an x402 endpoint.
+ *
+ * Accepts either a catalog URL (we resolve metadata via discover) or any
+ * URL that returns HTTP 402 (live challenge mode).
+ */
+export interface PayCmdOptions {
+    profile?: string;
+    passphrase?: string;
+    maxUsd?: string;
+    body?: string;
+    yes?: boolean;
+}
+export declare function runPay(url: string, opts: PayCmdOptions): Promise<void>;
+//# sourceMappingURL=pay.d.ts.map

package/dist/cli/pay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pay.d.ts","sourceRoot":"","sources":["../../src/cli/pay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAuE5E"}

package/dist/cli/pay.js

@@ -0,0 +1,76 @@
+/**
+ * `xpay pay <url>` — pay an x402 endpoint.
+ *
+ * Accepts either a catalog URL (we resolve metadata via discover) or any
+ * URL that returns HTTP 402 (live challenge mode).
+ */
+import chalk from "chalk";
+import inquirer from "inquirer";
+import { createXPay } from "../index.js";
+import { unlockActive, formatUsd } from "./common.js";
+export async function runPay(url, opts) {
+    if (!url) {
+        console.error(chalk.red("✗ usage: xpay pay <url> [--max-usd N] [--body '{...}']"));
+        process.exit(1);
+    }
+    const profile = await unlockActive(opts);
+    // Optional guardrail override from the command line.
+    if (opts.maxUsd) {
+        profile.config.guardrail = {
+            ...profile.config.guardrail,
+            maxPerTx: Number(opts.maxUsd),
+        };
+    }
+    const xpay = createXPay({ profile });
+    // Pre-flight: parse the body if supplied.
+    let body;
+    if (opts.body) {
+        try {
+            body = JSON.parse(opts.body);
+        }
+        catch {
+            console.error(chalk.red("✗ --body must be valid JSON"));
+            process.exit(1);
+        }
+    }
+    // Confirm spend if interactive and no --yes.
+    if (process.stdin.isTTY && !opts.yes) {
+        const { go } = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "go",
+                message: `Pay and call ${chalk.cyan(url)}? (caps: ${profile.config.guardrail?.maxPerTx
+                    ? `$${profile.config.guardrail.maxPerTx}/tx`
+                    : "none"})`,
+                default: true,
+            },
+        ]);
+        if (!go) {
+            console.log(chalk.yellow("Cancelled."));
+            return;
+        }
+    }
+    const t0 = Date.now();
+    try {
+        const result = await xpay.useByUrl(url, { body });
+        const elapsed = Date.now() - t0;
+        const amount = Number(result.amountPaid) / 1_000_000;
+        console.log("");
+        console.log(chalk.green(`✔ Paid ${formatUsd(amount)} on ${chalk.cyan(result.network)} in ${elapsed}ms`));
+        if (result.txSig) {
+            console.log(`  ${chalk.dim("tx:")} ${result.txSig}`);
+        }
+        console.log("");
+        console.log(chalk.bold("Response:"));
+        const display = typeof result.data === "string" ? result.data : JSON.stringify(result.data, null, 2);
+        console.log(display.slice(0, 2000));
+        if (display.length > 2000)
+            console.log(chalk.dim(`\n  ...truncated (${display.length} chars total)`));
+    }
+    catch (err) {
+        console.error("");
+        console.error(chalk.red(`✗ ${err.message}`));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=pay.js.map

package/dist/cli/pay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pay.js","sourceRoot":"","sources":["../../src/cli/pay.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAUtD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAAmB;IAC3D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACnF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAEzC,qDAAqD;IACrD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,SAAS,GAAG;YACzB,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAErC,0CAA0C;IAC1C,IAAI,IAAa,CAAC;IAClB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;YACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6CAA6C;IAC7C,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;YACpD;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,gBAAgB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,YACtC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,QAAQ;oBAChC,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,KAAK;oBAC5C,CAAC,CAAC,MACN,GAAG;gBACH,OAAO,EAAE,IAAI;aACd;SACF,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;QAErD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,OAAO,IAAI,CAAC,CAAC,CAAC;QACzG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GACX,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,OAAO,CAAC,MAAM,eAAe,CAAC,CAAC,CAAC;IACxG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/cli/transfer.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `xpay transfer <amount> <token> <to>` — send USDC.
+ *
+ * Examples:
+ *   xpay transfer 5 USDC 7G73PL...gC
+ *   xpay transfer 1 USDC 0x47ff...5552 --network base
+ *
+ * Network is auto-detected from the address shape (0x → EVM, else Solana).
+ * If the wallet has multiple EVM signers, --network is required.
+ */
+import type { Network } from "../types.js";
+export interface TransferCmdOptions {
+    profile?: string;
+    passphrase?: string;
+    network?: Network;
+    yes?: boolean;
+}
+export declare function runTransfer(amountArg: string, tokenArg: string, to: string, opts: TransferCmdOptions): Promise<void>;
+//# sourceMappingURL=transfer.d.ts.map

package/dist/cli/transfer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.d.ts","sourceRoot":"","sources":["../../src/cli/transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAsB,WAAW,CAC/B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,IAAI,CAAC,CAwDf"}

package/dist/cli/transfer.js

@@ -0,0 +1,66 @@
+/**
+ * `xpay transfer <amount> <token> <to>` — send USDC.
+ *
+ * Examples:
+ *   xpay transfer 5 USDC 7G73PL...gC
+ *   xpay transfer 1 USDC 0x47ff...5552 --network base
+ *
+ * Network is auto-detected from the address shape (0x → EVM, else Solana).
+ * If the wallet has multiple EVM signers, --network is required.
+ */
+import chalk from "chalk";
+import inquirer from "inquirer";
+import { createXPay } from "../index.js";
+import { unlockActive, formatUsd, shortAddress } from "./common.js";
+export async function runTransfer(amountArg, tokenArg, to, opts) {
+    const amount = Number(amountArg);
+    if (!(amount > 0)) {
+        console.error(chalk.red(`✗ amount must be a positive number (got "${amountArg}")`));
+        process.exit(1);
+    }
+    const token = tokenArg.toUpperCase();
+    if (token !== "USDC") {
+        console.error(chalk.red(`✗ only USDC supported in v1 (got "${tokenArg}")`));
+        process.exit(1);
+    }
+    if (!to) {
+        console.error(chalk.red("✗ usage: xpay transfer <amount> USDC <to>"));
+        process.exit(1);
+    }
+    const profile = await unlockActive(opts);
+    const xpay = createXPay({ profile });
+    // Confirm.
+    if (process.stdin.isTTY && !opts.yes) {
+        const { go } = await inquirer.prompt([
+            {
+                type: "confirm",
+                name: "go",
+                message: `Send ${chalk.bold(`$${amount.toFixed(4)} USDC`)} to ${chalk.cyan(shortAddress(to, 6, 6))}${opts.network ? ` on ${chalk.cyan(opts.network)}` : ""}?`,
+                default: false,
+            },
+        ]);
+        if (!go) {
+            console.log(chalk.yellow("Cancelled."));
+            return;
+        }
+    }
+    try {
+        const t0 = Date.now();
+        const result = await xpay.transfer({
+            amount,
+            to,
+            network: opts.network,
+            token: "USDC",
+        });
+        const elapsed = Date.now() - t0;
+        console.log("");
+        console.log(chalk.green(`✔ Sent ${formatUsd(result.amount)} USDC on ${chalk.cyan(result.network)} in ${elapsed}ms`));
+        console.log(`  ${chalk.dim("→ to:")} ${result.to}`);
+        console.log(`  ${chalk.dim("→ tx:")} ${result.txSig}`);
+    }
+    catch (err) {
+        console.error(chalk.red(`\n✗ ${err.message}`));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=transfer.js.map

package/dist/cli/transfer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transfer.js","sourceRoot":"","sources":["../../src/cli/transfer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AASpE,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAiB,EACjB,QAAgB,EAChB,EAAU,EACV,IAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,4CAA4C,SAAS,IAAI,CAAC,CAAC,CAAC;QACpF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAErC,WAAW;IACX,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACrC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAkB;YACpD;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,IAAI;gBACV,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAChG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EACrD,GAAG;gBACH,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;YACjC,MAAM;YACN,EAAE;YACF,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,UAAU,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,OAAO,IAAI,CAAC,CACxG,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAQ,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/discover/cache.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Module-level cache for catalog fetches.
+ *
+ * Discovery against PayAI's full 21k-item catalog takes ~50s on a cold fetch,
+ * which is unusable in a UI search loop. We cache the result in memory with a
+ * TTL so repeat lookups (and concurrent ones via the in-flight promise) hit
+ * the cache instead.
+ *
+ * Trade-off: a single process holds one snapshot per source. For server
+ * deployments (the platform's API route), this naturally warms after the
+ * first request. For very long-running processes, the TTL ensures freshness.
+ */
+import type { Resource } from "../types.js";
+type Loader = () => Promise<Resource[]>;
+export declare function setCacheTtl(ms: number): void;
+/**
+ * Get cached resources for `key`, loading via `loader` if missing or expired.
+ * Concurrent calls during a cold load share the same in-flight promise.
+ */
+export declare function cached(key: string, loader: Loader): Promise<Resource[]>;
+/** Force-evict a cache entry (or all entries with no arg). */
+export declare function invalidate(key?: string): void;
+export {};
+//# sourceMappingURL=cache.d.ts.map

package/dist/discover/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/discover/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,KAAK,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AAmDxC,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAE5C;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA4B7E;AAED,8DAA8D;AAC9D,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAG7C"}

package/dist/discover/cache.js

@@ -0,0 +1,94 @@
+/**
+ * Module-level cache for catalog fetches.
+ *
+ * Discovery against PayAI's full 21k-item catalog takes ~50s on a cold fetch,
+ * which is unusable in a UI search loop. We cache the result in memory with a
+ * TTL so repeat lookups (and concurrent ones via the in-flight promise) hit
+ * the cache instead.
+ *
+ * Trade-off: a single process holds one snapshot per source. For server
+ * deployments (the platform's API route), this naturally warms after the
+ * first request. For very long-running processes, the TTL ensures freshness.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+const DEFAULT_TTL_MS = 10 * 60 * 1000; // 10 minutes
+const store = new Map();
+/** Where on-disk cache lives. Honors $XPAY_HOME (mirrors profile storage). */
+function diskCacheDir() {
+    const root = process.env.XPAY_HOME ?? join(homedir(), ".xpay");
+    return join(root, "cache");
+}
+function diskCachePath(key) {
+    const safe = key.replace(/[^a-zA-Z0-9_-]+/g, "_");
+    return join(diskCacheDir(), `${safe}.json`);
+}
+function readDisk(key) {
+    try {
+        const file = diskCachePath(key);
+        if (!existsSync(file))
+            return null;
+        const blob = JSON.parse(readFileSync(file, "utf8"));
+        if (blob.expiresAt > Date.now())
+            return blob.data;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeDisk(key, data) {
+    try {
+        const dir = diskCacheDir();
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const blob = { expiresAt: Date.now() + ttlMs, data };
+        writeFileSync(diskCachePath(key), JSON.stringify(blob));
+    }
+    catch {
+        // Best-effort — cache failures should never break the call.
+    }
+}
+/** TTL is configurable at runtime; defaults to 10 min. */
+let ttlMs = DEFAULT_TTL_MS;
+export function setCacheTtl(ms) {
+    ttlMs = ms;
+}
+/**
+ * Get cached resources for `key`, loading via `loader` if missing or expired.
+ * Concurrent calls during a cold load share the same in-flight promise.
+ */
+export async function cached(key, loader) {
+    const now = Date.now();
+    const entry = store.get(key);
+    if (entry?.data && entry.expiresAt > now)
+        return entry.data;
+    if (entry?.inflight)
+        return entry.inflight;
+    // Try disk before paying the network cost. CLI invocations hit this path
+    // every time (each invocation is a fresh process with empty memory).
+    const onDisk = readDisk(key);
+    if (onDisk) {
+        store.set(key, { data: onDisk, expiresAt: now + ttlMs });
+        return onDisk;
+    }
+    const inflight = loader().then((data) => {
+        store.set(key, { data, expiresAt: Date.now() + ttlMs });
+        writeDisk(key, data);
+        return data;
+    }, (err) => {
+        store.delete(key);
+        throw err;
+    });
+    store.set(key, { expiresAt: 0, inflight });
+    return inflight;
+}
+/** Force-evict a cache entry (or all entries with no arg). */
+export function invalidate(key) {
+    if (key)
+        store.delete(key);
+    else
+        store.clear();
+}
+//# sourceMappingURL=cache.js.map

package/dist/discover/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/discover/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWlC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AACpD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;AAEvC,8EAA8E;AAC9E,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC7B,CAAC;AACD,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC9C,CAAC;AAOD,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAc,CAAC;QACjE,IAAI,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAgB;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GAAc,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAChE,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,IAAI,KAAK,GAAG,cAAc,CAAC;AAC3B,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,KAAK,GAAG,EAAE,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,MAAc;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7B,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAC5D,IAAI,KAAK,EAAE,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAE3C,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,IAAI,CAC5B,CAAC,IAAI,EAAE,EAAE;QACP,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACxD,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG;QAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;;QACtB,KAAK,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/discover/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Discovery — find paid services across catalogs.
+ *
+ * v0 wires PayAI as the only source. Pay (the MCP catalog) and xona-labs' own
+ * registry slot in here as additional source modules later, all returning the
+ * same {@link Resource} shape.
+ */
+import type { DiscoverOptions, Resource } from "../types.js";
+export { setCacheTtl, invalidate as invalidateCache } from "./cache.js";
+interface InternalDiscoverOptions extends DiscoverOptions {
+    catalogs?: Partial<Record<string, string>>;
+}
+/**
+ * Fetch resources from each source in parallel, then rank by simple relevance.
+ *
+ * Ranking v0 is intentionally dumb — token overlap on the URL + metadata. The
+ * real moat is in v0.2 ranking (price, reliability, reputation) but we ship
+ * with something that works.
+ */
+export declare function discover(opts?: InternalDiscoverOptions): Promise<Resource[]>;
+//# sourceMappingURL=index.d.ts.map

package/dist/discover/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/discover/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAiB,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAI5E,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI,eAAe,EAAE,MAAM,YAAY,CAAC;AAExE,UAAU,uBAAwB,SAAQ,eAAe;IACvD,QAAQ,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAC5C;AAcD;;;;;;GAMG;AACH,wBAAsB,QAAQ,CAAC,IAAI,GAAE,uBAA4B,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAsCtF"}

package/dist/discover/index.js

@@ -0,0 +1,88 @@
+/**
+ * Discovery — find paid services across catalogs.
+ *
+ * v0 wires PayAI as the only source. Pay (the MCP catalog) and xona-labs' own
+ * registry slot in here as additional source modules later, all returning the
+ * same {@link Resource} shape.
+ */
+import { fetchPayAIResources } from "./payai.js";
+import { cached } from "./cache.js";
+export { setCacheTtl, invalidate as invalidateCache } from "./cache.js";
+/**
+ * Each source's fetcher runs through the module cache. Cold fetch for the
+ * full PayAI catalog is ~50s; cached fetches return in microseconds.
+ */
+const sourceFetchers = {
+    payai: (endpoint) => cached(`payai:${endpoint ?? "default"}`, () => fetchPayAIResources({ endpoint })),
+    // TODO: pay (Solana Foundation catalog), xona (our own listings).
+    pay: async () => [],
+    xona: async () => [],
+};
+/**
+ * Fetch resources from each source in parallel, then rank by simple relevance.
+ *
+ * Ranking v0 is intentionally dumb — token overlap on the URL + metadata. The
+ * real moat is in v0.2 ranking (price, reliability, reputation) but we ship
+ * with something that works.
+ */
+export async function discover(opts = {}) {
+    const sources = opts.sources ?? ["payai"];
+    const lists = await Promise.all(sources.map(async (src) => {
+        const fetcher = sourceFetchers[src];
+        if (!fetcher)
+            return [];
+        try {
+            return await fetcher(opts.catalogs?.[src]);
+        }
+        catch (err) {
+            // One bad source shouldn't kill discovery.
+            console.warn(`[xpay] discovery source "${src}" failed:`, err);
+            return [];
+        }
+    }));
+    let results = lists.flat();
+    // Network filter.
+    if (opts.networks?.length) {
+        const allowed = new Set(opts.networks);
+        results = results.filter((r) => r.accepts.some((a) => allowed.has(normalizeNetwork(a.network))));
+    }
+    // Query filter + ranking.
+    if (opts.query) {
+        const terms = opts.query.toLowerCase().split(/\s+/).filter(Boolean);
+        results = results
+            .map((r) => ({ r, score: scoreResource(r, terms) }))
+            .filter((x) => x.score > 0)
+            .sort((a, b) => b.score - a.score)
+            .map((x) => x.r);
+    }
+    if (opts.limit)
+        results = results.slice(0, opts.limit);
+    return results;
+}
+function scoreResource(r, terms) {
+    const haystack = [
+        r.resource,
+        JSON.stringify(r.metadata ?? {}),
+        JSON.stringify(r.inputSchema ?? {}),
+    ]
+        .join(" ")
+        .toLowerCase();
+    let score = 0;
+    for (const t of terms) {
+        if (haystack.includes(t))
+            score += 1;
+    }
+    return score;
+}
+function normalizeNetwork(raw) {
+    if (raw === "eip155:8453")
+        return "base";
+    if (raw === "eip155:1")
+        return "ethereum";
+    if (raw === "eip155:42161")
+        return "arbitrum";
+    if (raw === "eip155:10")
+        return "optimism";
+    return raw;
+}
+//# sourceMappingURL=index.js.map

package/dist/discover/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/discover/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,UAAU,IAAI,eAAe,EAAE,MAAM,YAAY,CAAC;AAMxE;;;GAGG;AACH,MAAM,cAAc,GAAsE;IACxF,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClB,MAAM,CAAC,SAAS,QAAQ,IAAI,SAAS,EAAE,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnF,kEAAkE;IAClE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;IACnB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;CACrB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgC,EAAE;IAC/D,MAAM,OAAO,GAAoB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2CAA2C;YAC3C,OAAO,CAAC,IAAI,CAAC,4BAA4B,GAAG,WAAW,EAAE,GAAG,CAAC,CAAC;YAC9D,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,IAAI,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAE3B,kBAAkB;IAClB,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAChE,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,GAAG,OAAO;aACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACnD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;aAC1B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;aACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACvD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,CAAW,EAAE,KAAe;IACjD,MAAM,QAAQ,GAAG;QACf,CAAC,CAAC,QAAQ;QACV,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC;KACpC;SACE,IAAI,CAAC,GAAG,CAAC;SACT,WAAW,EAAE,CAAC;IACjB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IACzC,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IAC1C,IAAI,GAAG,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,UAAU,CAAC;IAC3C,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/discover/payai.d.ts

@@ -0,0 +1,18 @@
+/**
+ * PayAI facilitator client.
+ *
+ * Source-of-truth for the bulk of xPay's catalog (21k+ x402 resources as of
+ * May 2026). The endpoint paginates via `?limit=N&offset=M` and includes a
+ * `{ limit, offset, total }` block alongside `items` so we know when to stop.
+ */
+import { type Resource } from "../types.js";
+export interface PayAIClientOptions {
+    endpoint?: string;
+    /** Hard cap on items fetched across all pages. Defaults to the full catalog. */
+    maxItems?: number;
+    /** Per-page size hint. Capped at {@link PAGE_SIZE}. */
+    limit?: number;
+    fetch?: typeof fetch;
+}
+export declare function fetchPayAIResources(opts?: PayAIClientOptions): Promise<Resource[]>;
+//# sourceMappingURL=payai.d.ts.map

package/dist/discover/payai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payai.d.ts","sourceRoot":"","sources":["../../src/discover/payai.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAO5D,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAOD,wBAAsB,mBAAmB,CAAC,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CA4C5F"}

package/dist/discover/payai.js

@@ -0,0 +1,56 @@
+/**
+ * PayAI facilitator client.
+ *
+ * Source-of-truth for the bulk of xPay's catalog (21k+ x402 resources as of
+ * May 2026). The endpoint paginates via `?limit=N&offset=M` and includes a
+ * `{ limit, offset, total }` block alongside `items` so we know when to stop.
+ */
+import { ResourceSchema } from "../types.js";
+const DEFAULT_ENDPOINT = "https://facilitator.payai.network/discovery/resources";
+/** PayAI accepts up to 1000 per call as of testing; a single big page is much
+ *  cheaper than ten small ones. */
+const PAGE_SIZE = 1000;
+export async function fetchPayAIResources(opts = {}) {
+    const endpoint = opts.endpoint ?? DEFAULT_ENDPOINT;
+    const limit = Math.min(opts.limit ?? PAGE_SIZE, PAGE_SIZE);
+    const maxItems = opts.maxItems ?? Infinity;
+    const fetchImpl = opts.fetch ?? fetch;
+    const all = [];
+    let offset = 0;
+    let total = Infinity;
+    // Defensive page cap: even with limit=1000 and a 100k catalog, 100 pages
+    // would be excessive. Real-world we stop at `total`.
+    for (let page = 0; page < 100 && offset < total && all.length < maxItems; page++) {
+        const url = new URL(endpoint);
+        url.searchParams.set("limit", String(limit));
+        url.searchParams.set("offset", String(offset));
+        const res = await fetchImpl(url.toString(), {
+            headers: { accept: "application/json" },
+        });
+        if (!res.ok) {
+            throw new Error(`PayAI discovery failed: ${res.status} ${res.statusText}`);
+        }
+        const body = (await res.json());
+        const rawItems = body.items ?? [];
+        for (const raw of rawItems) {
+            const parsed = ResourceSchema.safeParse(raw);
+            if (parsed.success)
+                all.push(parsed.data);
+            if (all.length >= maxItems)
+                return all;
+        }
+        if (body.pagination) {
+            total = body.pagination.total;
+            offset = body.pagination.offset + rawItems.length;
+        }
+        else {
+            // No pagination block — assume single-shot.
+            break;
+        }
+        // Server returned fewer items than requested → we hit the end.
+        if (rawItems.length < limit)
+            break;
+    }
+    return all;
+}
+//# sourceMappingURL=payai.js.map