z-zero-mcp-server 1.0.7 → 1.1.0

package/dist/wdk_backend.js

@@ -0,0 +1,228 @@
+"use strict";
+// Z-ZERO WDK Backend — Non-Custodial Module
+// Drop-in replacement for api_backend.ts when Z_ZERO_WALLET_MODE=wdk
+// Exports IDENTICAL function signatures so index.ts can swap backends without any changes.
+//
+// Key differences from custodial api_backend.ts:
+//   - getBalanceRemote() → reads USDT balance on-chain (not from Supabase wallets table)
+//   - getDepositAddressesRemote() → returns WDK wallet address (not HD custodial address)
+//   - issueTokenRemote() → sends USDT on-chain first, THEN issues JIT card
+//   - cancelTokenRemote() → triggers on-chain USDT refund back to user WDK wallet
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listCardsRemote = listCardsRemote;
+exports.getBalanceRemote = getBalanceRemote;
+exports.getDepositAddressesRemote = getDepositAddressesRemote;
+exports.issueTokenRemote = issueTokenRemote;
+exports.resolveTokenRemote = resolveTokenRemote;
+exports.burnTokenRemote = burnTokenRemote;
+exports.cancelTokenRemote = cancelTokenRemote;
+exports.refundUnderspendRemote = refundUnderspendRemote;
+const key_store_js_1 = require("./lib/key-store.js");
+const API_BASE_URL = process.env.Z_ZERO_API_BASE_URL || "https://www.clawcard.store";
+const INTERNAL_SECRET = process.env.Z_ZERO_INTERNAL_SECRET || "";
+if (!(0, key_store_js_1.hasPassportKey)()) {
+    console.error("❌ ERROR: Z_ZERO_API_KEY (Passport Key) is missing!");
+    console.error("🔐 Get your key: https://www.clawcard.store/dashboard/agents");
+    console.error("🛠️  Or call the set_api_key MCP tool to set it without restarting.");
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// HTTP helpers (same as api_backend.ts to call Dashboard API)
+// ──────────────────────────────────────────────────────────────────────────────
+async function apiRequest(endpoint, method = 'GET', body = null) {
+    const PASSPORT_KEY = (0, key_store_js_1.getPassportKey)(); // ✅ Hot-swap: read key dynamically each request
+    if (!PASSPORT_KEY) {
+        return { error: "AUTH_REQUIRED", message: "Z_ZERO_API_KEY is missing." };
+    }
+    const url = `${API_BASE_URL.replace(/\/$/, '')}${endpoint}`;
+    try {
+        const res = await fetch(url, {
+            method,
+            headers: {
+                "Authorization": `Bearer ${PASSPORT_KEY}`,
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : null,
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({ error: res.statusText }));
+            return { error: "API_ERROR", message: err.error || res.statusText };
+        }
+        return await res.json();
+    }
+    catch (err) {
+        return { error: "NETWORK_ERROR", message: err.message };
+    }
+}
+async function internalApiRequest(endpoint, method, body) {
+    if (!INTERNAL_SECRET) {
+        return { error: "CONFIG_ERROR", message: "INTERNAL_SECRET not configured" };
+    }
+    const url = `${API_BASE_URL.replace(/\/$/, '')}${endpoint}`;
+    try {
+        const res = await fetch(url, {
+            method,
+            headers: {
+                "x-internal-secret": INTERNAL_SECRET,
+                "Content-Type": "application/json",
+            },
+            body: body ? JSON.stringify(body) : null,
+        });
+        if (!res.ok) {
+            const err = await res.json().catch(() => ({ error: res.statusText }));
+            return { error: "API_ERROR", message: err.error || res.statusText };
+        }
+        return await res.json();
+    }
+    catch (err) {
+        return { error: "NETWORK_ERROR", message: err.message };
+    }
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Core API: Same as custodial (cards, tokens still managed by Dashboard)
+// ──────────────────────────────────────────────────────────────────────────────
+async function listCardsRemote() {
+    // Calls /api/tokens/cards — but that route returns balance from Supabase.
+    // For WDK mode, the Dashboard API must read wallet_mode and return on-chain balance.
+    // This is handled server-side in the updated /api/tokens/cards route.
+    return await apiRequest('/api/tokens/cards', 'GET');
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Balance: On-chain USDT via Dashboard WDK API
+// ──────────────────────────────────────────────────────────────────────────────
+async function getBalanceRemote(cardAlias) {
+    // Call Dashboard to get WDK wallet balance (Dashboard resolves user from passport key,
+    // finds connected WDK wallet, queries on-chain balance)
+    const data = await apiRequest('/api/wdk/balance', 'GET');
+    if (data?.error) {
+        // Fallback: try custodial balance if WDK not set up yet
+        const custodialData = await apiRequest('/api/tokens/cards', 'GET');
+        if (custodialData?.cards?.[0]) {
+            return {
+                wallet_balance: custodialData.cards[0].balance,
+                currency: 'USD',
+                mode: 'custodial_fallback',
+                note: 'WDK wallet not connected yet. Showing custodial balance.'
+            };
+        }
+        return data;
+    }
+    return {
+        wallet_balance: data.balance_usdt,
+        currency: 'USDT',
+        chain: data.chain || 'polygon',
+        address: data.address,
+        mode: 'wdk_onchain',
+        note: `Non-custodial WDK wallet balance (live on-chain). Address: ${data.address}`
+    };
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Deposit Addresses: WDK wallet address (not custodial HD addresses)
+// ──────────────────────────────────────────────────────────────────────────────
+async function getDepositAddressesRemote() {
+    const data = await apiRequest('/api/wdk/balance', 'GET');
+    if (data?.error) {
+        // Fallback to custodial addresses
+        const custodial = await apiRequest('/api/tokens/cards', 'GET');
+        return {
+            ...custodial,
+            note: 'WDK wallet not connected. Showing custodial deposit addresses as fallback.'
+        };
+    }
+    return {
+        cards: [{ alias: 'wdk-wallet', balance: data.balance_usdt, currency: 'USDT' }],
+        deposit_addresses: {
+            polygon: data.address, // Primary: USDT on Polygon (ERC-20)
+            note: 'Send USDT (Polygon/ERC-20) to fund your Agent wallet. Gasless payments via ERC-4337.'
+        },
+        wdk_wallet: {
+            address: data.address,
+            chain: data.chain || 'polygon',
+            balance_usdt: data.balance_usdt
+        }
+    };
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Issue Token: On-chain USDT payment → JIT card
+// ──────────────────────────────────────────────────────────────────────────────
+async function issueTokenRemote(cardAlias, amount, merchant) {
+    // WDK Flow (reversed from custodial):
+    // 1. Create Airwallex card first (reservation)
+    // 2. Send USDT on-chain from WDK wallet → system wallet
+    // 3. Dashboard verifies on-chain tx, activates token
+    // This is safe: if on-chain tx fails, Dashboard auto-cancels the card reservation.
+    const data = await apiRequest('/api/tokens/issue', 'POST', {
+        card_alias: cardAlias,
+        amount,
+        merchant,
+        device_fingerprint: `mcp-wdk-${process.platform}-${process.arch}`,
+        network_id: process.env.NETWORK_ID || "polygon-wdk",
+        session_id: `wdk-${Math.random().toString(36).substring(7)}`,
+        wallet_mode: 'wdk', // Signals Dashboard to use on-chain payment path
+    });
+    if (!data)
+        return null;
+    if (data.error)
+        return data;
+    return {
+        token: data.token,
+        card_alias: cardAlias,
+        amount,
+        merchant,
+        created_at: Date.now(),
+        ttl_seconds: 1800,
+        used: false,
+        tx_hash: data.tx_hash, // On-chain tx hash (for transparency)
+        mode: 'wdk_noncustodial'
+    };
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Resolve Token: Same as custodial (returns PAN/CVV for Playwright injection)
+// ──────────────────────────────────────────────────────────────────────────────
+async function resolveTokenRemote(token) {
+    const data = await internalApiRequest('/api/tokens/resolve', 'POST', { token });
+    if (!data || data.error)
+        return data;
+    return {
+        number: data.number,
+        exp_month: data.exp?.split('/')[0] || "12",
+        exp_year: "20" + (data.exp?.split('/')[1] || "30"),
+        cvv: data.cvv || "123",
+        name: data.name || "Z-ZERO AI AGENT",
+        authorized_amount: data.authorized_amount ? Number(data.authorized_amount) : undefined,
+    };
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Burn Token: Mark used + on-chain refund of underspend (if any)
+// ──────────────────────────────────────────────────────────────────────────────
+async function burnTokenRemote(token, receipt_id) {
+    const data = await internalApiRequest('/api/tokens/burn', 'POST', {
+        token,
+        receipt_id,
+        success: true,
+        wallet_mode: 'wdk', // Signals Dashboard to refund underspend on-chain
+    });
+    return !!data && !data.error;
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Cancel Token: Refund USDT back to user's WDK wallet on-chain
+// ──────────────────────────────────────────────────────────────────────────────
+async function cancelTokenRemote(token) {
+    const data = await apiRequest('/api/tokens/cancel', 'POST', {
+        token,
+        wallet_mode: 'wdk', // Triggers on-chain USDT refund
+    });
+    if (data?.error)
+        return data;
+    return {
+        success: !!data,
+        refunded_amount: data?.refunded_amount || 0,
+        tx_hash: data?.tx_hash || null, // On-chain refund tx hash
+        note: 'USDT refunded on-chain to your WDK wallet.'
+    };
+}
+// ──────────────────────────────────────────────────────────────────────────────
+// Refund Underspend: Logged only (full refund logic handled in burnTokenRemote)
+// ──────────────────────────────────────────────────────────────────────────────
+async function refundUnderspendRemote(token, actualSpent) {
+    console.log(`[WDK MCP] Token ${token} burned. Actual spent: $${actualSpent}. On-chain refund handled by Dashboard.`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "z-zero-mcp-server",
-    "version": "1.0.7",
+    "version": "1.1.0",
     "description": "Z-ZERO MCP Server — Secure JIT Virtual Card Payment tools for AI Agents (Claude, Cursor, AutoGPT) — Real Single-Use Visa Cards",
     "main": "dist/index.js",
     "bin": "dist/index.js",
@@ -38,4 +38,4 @@
         "tsx": "^4.19.4",
         "typescript": "^5.8.3"
     }
-}
+}