z-zero-mcp-server 1.0.7 → 1.0.9

package/dist/api_backend.js

@@ -11,16 +11,18 @@ exports.resolveTokenRemote = resolveTokenRemote;
 exports.burnTokenRemote = burnTokenRemote;
 exports.cancelTokenRemote = cancelTokenRemote;
 exports.refundUnderspendRemote = refundUnderspendRemote;
+const key_store_js_1 = require("./lib/key-store.js");
 const API_BASE_URL = process.env.Z_ZERO_API_BASE_URL || "https://www.clawcard.store";
-const PASSPORT_KEY = process.env.Z_ZERO_API_KEY || "";
-if (!PASSPORT_KEY) {
+const INTERNAL_SECRET = process.env.Z_ZERO_INTERNAL_SECRET || "";
+if (!(0, key_store_js_1.hasPassportKey)()) {
     console.error("❌ ERROR: Z_ZERO_API_KEY (Passport Key) is missing!");
-    console.error("🔐 Please get your Passport Key from: https://www.clawcard.store/dashboard/agents");
-    console.error("🛠️ Setup: Ensure 'Z_ZERO_API_KEY' is set in your environment variables.");
+    console.error("🔐 Get your key: https://www.clawcard.store/dashboard/agents");
+    console.error("🛠️  Or call the set_api_key MCP tool to set it without restarting.");
 }
 async function apiRequest(endpoint, method = 'GET', body = null) {
+    const PASSPORT_KEY = (0, key_store_js_1.getPassportKey)(); // ✅ Hot-swap: read key dynamically each request
     if (!PASSPORT_KEY) {
-        return { error: "AUTH_REQUIRED", message: "Z_ZERO_API_KEY is missing. Human needs to set it in MCP config." };
+        return { error: "AUTH_REQUIRED", message: "Z_ZERO_API_KEY is missing. Call set_api_key tool or set it in MCP config and restart." };
     }
     const url = `${API_BASE_URL.replace(/\/$/, '')}${endpoint}`;
     try {
@@ -44,6 +46,34 @@ async function apiRequest(endpoint, method = 'GET', body = null) {
         return { error: "NETWORK_ERROR", message: err.message };
     }
 }
+// Internal API calls that require INTERNAL_SECRET (resolve PAN, burn token)
+async function internalApiRequest(endpoint, method, body) {
+    if (!INTERNAL_SECRET) {
+        console.error("[MCP] Z_ZERO_INTERNAL_SECRET is missing — cannot call secure endpoints");
+        return { error: "CONFIG_ERROR", message: "INTERNAL_SECRET not configured" };
+    }
+    const url = `${API_BASE_URL.replace(/\/$/, '')}${endpoint}`;
+    try {
+        const res = await fetch(url, {
+            method,
+            headers: {
+                "x-internal-secret": INTERNAL_SECRET,
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : null,
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({ error: res.statusText }));
+            console.error(`[INTERNAL API ERROR] ${endpoint}:`, err.error);
+            return { error: "API_ERROR", message: err.error || res.statusText };
+        }
+        return await res.json();
+    }
+    catch (err) {
+        console.error(`[NETWORK ERROR] ${endpoint}:`, err.message);
+        return { error: "NETWORK_ERROR", message: err.message };
+    }
+}
 async function listCardsRemote() {
     return await apiRequest('/api/tokens/cards', 'GET');
 }
@@ -90,24 +120,27 @@ async function issueTokenRemote(cardAlias, amount, merchant) {
     };
 }
 async function resolveTokenRemote(token) {
-    const data = await apiRequest('/api/tokens/resolve', 'POST', { token });
-    if (!data)
-        return null;
+    // Uses INTERNAL_SECRET — this endpoint returns real PAN/CVV
+    const data = await internalApiRequest('/api/tokens/resolve', 'POST', { token });
+    if (!data || data.error)
+        return data;
     return {
         number: data.number,
         exp_month: data.exp?.split('/')[0] || "12",
         exp_year: "20" + (data.exp?.split('/')[1] || "30"),
         cvv: data.cvv || "123",
-        name: data.name || "Z-ZERO AI AGENT"
+        name: data.name || "Z-ZERO AI AGENT",
+        authorized_amount: data.authorized_amount ? Number(data.authorized_amount) : undefined,
     };
 }
 async function burnTokenRemote(token, receipt_id) {
-    const data = await apiRequest('/api/tokens/burn', 'POST', {
+    // Uses INTERNAL_SECRET — burn endpoint requires it
+    const data = await internalApiRequest('/api/tokens/burn', 'POST', {
         token,
         receipt_id,
         success: true
     });
-    return !!data;
+    return !!data && !data.error;
 }
 async function cancelTokenRemote(token) {
     const data = await apiRequest('/api/tokens/cancel', 'POST', { token });