agentic-wallet-mcp 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -8,6 +8,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 > Entries for 0.5.0 and earlier were reconstructed from commit history when this file was
 > introduced in 0.6.0, so they summarise each release rather than being exhaustive.
 
+## [0.6.1] — 2026-07-29
+
+**Upgrade if you use testnet.** The testnet Wallet BE and MBI endpoints have moved to the Zetrix
+sandbox hosts. No API, tool or config surface changed — this is an endpoint migration only.
+
+### Changed
+
+- **Testnet default endpoints moved to the Zetrix sandbox hosts.** `ZETRIX_NETWORK=zetrix:testnet`
+  now derives `https://wallet-api-sandbox.zetrix.com/server` (was
+  `https://wallet-api.myegdev.com/server`) and `https://mbi-vc-sandbox.zetrix.com` (was
+  `https://mbi-vc.myegdev.com`). Anyone on testnet relying on the built-in defaults should upgrade
+  to follow the platform; mainnet defaults are unchanged, and an explicit `WALLET_BE_URL` /
+  `MBI_BASE_URL` still wins over the network default, so anyone pinning those is unaffected.
+  Note the Wallet BE base keeps its `/server` path suffix — verified against the new host, which
+  returns nginx `404` without it.
+
 ## [0.6.0] — 2026-07-28
 
 This release is about the wallet never misstating what a call cost. Four reporting defects were

package/README.md

@@ -216,11 +216,11 @@ network:
 
 | Network | `WALLET_BE_URL` default | `MBI_BASE_URL` default | `OID4VP_BASE_URL` default | `ZID_RESOLVER_BASE_URL` default |
 |---|---|---|---|---|
-| `zetrix:testnet` | `https://wallet-api.myegdev.com/server` | `https://mbi-vc.myegdev.com` | `https://zid-oid4vp-sandbox.zetrix.com/api` | `https://zid-resolver-sandbox.zetrix.com` |
+| `zetrix:testnet` | `https://wallet-api-sandbox.zetrix.com/server` | `https://mbi-vc-sandbox.zetrix.com` | `https://zid-oid4vp-sandbox.zetrix.com/api` | `https://zid-resolver-sandbox.zetrix.com` |
 | `zetrix:mainnet` | `https://wallet-api.zetrix.com/server` | `https://mbi-vc.zetrix.com` | `https://zid-oid4vp.zetrix.com/api` | `https://zid-resolver.zetrix.com` |
 
 Only set any of the four explicitly if you run your own instance of that service instead of the
-default one — an explicit value always wins over the network default. The `*.myegdev.com`
+default one — an explicit value always wins over the network default. The `*-sandbox.zetrix.com`
 (testnet) hosts are public endpoints — no VPN needed; if you're on a corporate VPN and one of
 them times out, disconnecting it is more likely to fix that than connecting it. See "Network
 reachability & troubleshooting" below.
@@ -323,17 +323,25 @@ Independent of Phases 2/3 — no VC or identity proof involved, just a fresh pay
 
 ## Network reachability & troubleshooting
 
-The `*.myegdev.com` testnet endpoints are public — no VPN needed to reach them. One dependency
-sits behind a CDN edge (see the ZID resolver row below). When something that worked before
-suddenly times out or 403s, check this table before assuming a code regression.
+The `*-sandbox.zetrix.com` testnet endpoints are public — no VPN needed to reach them. Reachability
+differs per host, and this is the first thing to check when something that worked before suddenly
+times out or 403s, before assuming a code regression.
+
+- **`wallet-api-sandbox.zetrix.com` / `mbi-vc-sandbox.zetrix.com`** — direct origin IPs
+  (`124.243.148.237` / `111.119.237.222` as of 2026-07-29), **not** CDN-fronted, unlike the ZID
+  hosts and the mainnet endpoints. Being off-CDN is why the **corporate VPN blocks them
+  specifically** while `test-node.zetrix.com` and the mainnet hosts keep working over the same
+  VPN — so a failure here looks like a total outage while everything else looks healthy.
+  Disconnect the VPN. Verified reachable over a plain internet path on 2026-07-29.
+- **ZID resolver** sits behind a CDN edge with a managed challenge — see its row below.
 
 | Symptom | Cause | Fix / status |
 |---|---|---|
-| `Wallet BE /wallet/hsm/sign-blob request failed <- fetch failed <- UND_ERR_CONNECT_TIMEOUT` (or same for `mbi-vc.myegdev.com`) | Transient network issue, or (if you're on a corporate VPN) the VPN routing away from the public internet | If you're on a VPN, try disconnecting it and retrying. Verify reachability directly: `curl -I https://wallet-api.myegdev.com/server` |
+| `Wallet BE /wallet/hsm/sign-blob request failed <- fetch failed <- UND_ERR_CONNECT_TIMEOUT` (or same for `mbi-vc-sandbox.zetrix.com`) | Corporate VPN routing away from the public internet — it blocks these two direct-origin hosts specifically (observed 2026-07-29), or a transient network issue | **Disconnect the VPN and retry.** Verify reachability directly: `curl -sS -o /dev/null -w '%{http_code}\n' "https://wallet-api-sandbox.zetrix.com/server/wallet/hsm/account/activate/status?address=<yourAddress>"` — `200` (with an `errorCode: 0` body) is healthy; `000` means the TCP connect never completed, so it's a network path problem, not a code problem |
 | `VP derivation failed <- ZID resolver HTTP 403 ... cf-mitigated: challenge` | ZID resolver (`zid-resolver-sandbox.zetrix.com`) sitting behind a Cloudflare **managed challenge** that blocks plain server-to-server `fetch` | Server-to-server access to the resolver must be allowlisted so it returns `200` directly. If the challenge is active, `prove_identity`'s `issuerKeys` input is the fallback — fetch the DID document via a real browser (it clears the JS challenge) and pass its `verificationMethod` entries' `publicKeyMultibase` (BBS+) / `publicKeyHex` (Ed25519) directly. |
 | `OID4VP backend returned a malformed presentation definition` | Historical SDK bug: the live sandbox's `GET /v1/presentation/{id}` response has no `expires_at` field, but the SDK guard required one | **Fixed** in `x401-zetrix-client` — `expiresAt` is now optional on `PresentationDefinition`. If you see this, you're on a stale cached `npx` install — clear it (`npx clear-npx-cache` or bump the version) to pick up the current published `agentic-wallet-mcp`. |
 | `SUBMIT_FAILED: OID4VP backend returned 401 ... Missing X-Wallet-Public-Key header` | Historical SDK gap: `POST /v1/presentation/submit` requires wallet-auth headers (`X-Wallet-Public-Key` / `X-Wallet-Signed-Data`, holder signs their own address) that the SDK didn't send | **Fixed** — `X401Wallet` now accepts an injected `submitAuth` provider and the wallet wires it automatically; nothing to configure. |
-| `MBI /vp/ext/submit did not return vp` | MBI's `includeVp` opt-in not deployed on the target instance | Deployed on the sandbox (`mbi-vc.myegdev.com`). If you see this against a different MBI instance, that instance needs the same rollout. |
+| `MBI /vp/ext/submit did not return vp` | MBI's `includeVp` opt-in not deployed on the target instance | Deployed on the sandbox (`mbi-vc-sandbox.zetrix.com`). If you see this against a different MBI instance, that instance needs the same rollout. |
 
 ## Security notes
 

package/dist/server-bundle.cjs

@@ -12547,7 +12547,7 @@ var import_node_path3 = require("node:path");
 // package.json
 var package_default = {
   name: "agentic-wallet-mcp",
-  version: "0.6.0",
+  version: "0.6.1",
   description: "Agent-facing MCP wallet for Zetrix \u2014 orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
   keywords: [
     "mcp",
@@ -21548,10 +21548,10 @@ function deriveZidResolverBaseUrl(network) {
   return network.includes("testnet") ? "https://zid-resolver-sandbox.zetrix.com" : "https://zid-resolver.zetrix.com";
 }
 function deriveWalletBeUrl(network) {
-  return network.includes("testnet") ? "https://wallet-api.myegdev.com/server" : "https://wallet-api.zetrix.com/server";
+  return network.includes("testnet") ? "https://wallet-api-sandbox.zetrix.com/server" : "https://wallet-api.zetrix.com/server";
 }
 function deriveMbiBaseUrl(network) {
-  return network.includes("testnet") ? "https://mbi-vc.myegdev.com" : "https://mbi-vc.zetrix.com";
+  return network.includes("testnet") ? "https://mbi-vc-sandbox.zetrix.com" : "https://mbi-vc.zetrix.com";
 }
 function deriveTemplateRegistryAddress(network) {
   return network.includes("testnet") ? "ZTX3JszqPgRUx743SAp7q7zURfjvkWuH2FMEz" : "ZTX3GqJM1U6ifMPonwD4fGvrgoTKJua7b2cKX";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentic-wallet-mcp",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Agent-facing MCP wallet for Zetrix — orchestrates x401 identity proof, x402 payment, and MBI VC issuance",
   "keywords": [
     "mcp",