agentic-wallet-mcp 0.3.0 → 0.3.1

package/README.md

@@ -126,9 +126,8 @@ network:
 
 Only set any of the four explicitly if you run your own instance of that service instead of the
 default one — an explicit value always wins over the network default. The `*.myegdev.com`
-(testnet) hosts are public endpoints — no VPN needed; if you're on a corporate VPN and one of
-them times out, disconnecting it is more likely to fix that than connecting it. See "Network
-reachability & troubleshooting" below.
+(testnet) hosts are internal — unreachable without VPN; see "Network reachability &
+troubleshooting" below if any of them time out.
 
 That's the complete list — no VC-MCP subprocess, no BaaS gateway key, no manually-configured
 BBS+ key to set up.
@@ -221,13 +220,13 @@ Independent of Phases 2/3 — no VC or identity proof involved, just a fresh pay
 
 ## Network reachability & troubleshooting
 
-The `*.myegdev.com` testnet endpoints are public — no VPN needed to reach them. One dependency
-sits behind a CDN edge (see the ZID resolver row below). When something that worked before
-suddenly times out or 403s, check this table before assuming a code regression.
+Several dependencies sit behind a corporate VPN or a CDN edge. When something that worked before
+suddenly times out or 403s, check this table before assuming a code regression — in every case
+observed so far, the code was correct and the network/edge state had changed.
 
 | Symptom | Cause | Fix / status |
 |---|---|---|
-| `Wallet BE /wallet/hsm/sign-blob request failed <- fetch failed <- UND_ERR_CONNECT_TIMEOUT` (or same for `mbi-vc.myegdev.com`) | Transient network issue, or (if you're on a corporate VPN) the VPN routing away from the public internet | If you're on a VPN, try disconnecting it and retrying. Verify reachability directly: `curl -I https://wallet-api.myegdev.com/server` |
+| `Wallet BE /wallet/hsm/sign-blob request failed <- fetch failed <- UND_ERR_CONNECT_TIMEOUT` (or same for `mbi-vc.myegdev.com`) | `*.myegdev.com` hosts are internal — unreachable without VPN | Connect/reconnect your VPN, then retry. Verify first: `curl -I https://wallet-api.myegdev.com/server` |
 | `VP derivation failed <- ZID resolver HTTP 403 ... cf-mitigated: challenge` | ZID resolver (`zid-resolver-sandbox.zetrix.com`) sitting behind a Cloudflare **managed challenge** that blocks plain server-to-server `fetch` | Server-to-server access to the resolver must be allowlisted so it returns `200` directly. If the challenge is active, `prove_identity`'s `issuerKeys` input is the fallback — fetch the DID document via a real browser (it clears the JS challenge) and pass its `verificationMethod` entries' `publicKeyMultibase` (BBS+) / `publicKeyHex` (Ed25519) directly. |
 | `OID4VP backend returned a malformed presentation definition` | Historical SDK bug: the live sandbox's `GET /v1/presentation/{id}` response has no `expires_at` field, but the SDK guard required one | **Fixed** in `x401-zetrix-client` — `expiresAt` is now optional on `PresentationDefinition`. If you see this, you're on a stale cached `npx` install — clear it (`npx clear-npx-cache` or bump the version) to pick up the current published `agentic-wallet-mcp`. |
 | `SUBMIT_FAILED: OID4VP backend returned 401 ... Missing X-Wallet-Public-Key header` | Historical SDK gap: `POST /v1/presentation/submit` requires wallet-auth headers (`X-Wallet-Public-Key` / `X-Wallet-Signed-Data`, holder signs their own address) that the SDK didn't send | **Fixed** — `X401Wallet` now accepts an injected `submitAuth` provider and the wallet wires it automatically; nothing to configure. |