z-zero-mcp-server 1.1.0 → 1.1.1

package/README.md

@@ -52,6 +52,9 @@ Get your Passport Key at: **[clawcard.store/dashboard/agents](https://www.clawca
 | `execute_payment` | Auto-fill checkout form and execute payment |
 | `cancel_payment_token` | Cancel unused token, refund to wallet |
 | `request_human_approval` | Pause and ask human for approval |
+| `set_api_key` | **(Hot-Swap)** Update the Passport Key *without restarting Claude* |
+| `show_api_key_status` | Check if a Passport Key is currently loaded |
+| `check_for_updates` | **(Maintenance)** Check if a new MCP version is available |
 
 ---
 

package/dist/index.d.ts

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-export {};
+export { CURRENT_MCP_VERSION } from "./version.js";

package/dist/index.js

@@ -3,7 +3,6 @@
 // OpenClaw MCP Server (z-zero-mcp-server) v1.1.0
 // Exposes secure JIT payment tools to AI Agents via Model Context Protocol
 // Status: Connected to Z-ZERO Gateway — produces secure JIT virtual cards
-// WDK Mode: Set Z_ZERO_WALLET_MODE=wdk for non-custodial WDK payments
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -38,21 +37,17 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const CURRENT_MCP_VERSION = "1.1.0"; // ← bump this on every release
-const ZZERO_VERSION_API = "https://www.clawcard.store/api/version";
+exports.CURRENT_MCP_VERSION = void 0;
+var version_js_1 = require("./version.js");
+Object.defineProperty(exports, "CURRENT_MCP_VERSION", { enumerable: true, get: function () { return version_js_1.CURRENT_MCP_VERSION; } });
+const version_js_2 = require("./version.js");
+// Note: version warnings are now delivered automatically via X-MCP-Version header
+// in each API call — no need for a separate check_for_updates tool.
 const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const zod_1 = require("zod");
-// ── Backend selection (resolved at startup, before server init) ──────────────
-// tsx / Node ESM: import() is async, so we use a synchronous pattern here.
-// Both backends export identical function signatures (drop-in swap).
-const WALLET_MODE = process.env.Z_ZERO_WALLET_MODE || "custodial";
-const isWDKMode = WALLET_MODE === "wdk";
-// Import both backends; pick which one to use based on env var.
-// In production build, tree-shaking will handle this. In dev (tsx), both load.
-const custodialBackend = __importStar(require("./api_backend.js"));
-const wdkBackend = __importStar(require("./wdk_backend.js"));
-const activeBackend = isWDKMode ? wdkBackend : custodialBackend;
+// ── WDK Non-Custodial Backend (single backend, no custodial fallback) ─────────
+const activeBackend = __importStar(require("./wdk_backend.js"));
 const issueTokenRemote = activeBackend.issueTokenRemote;
 const resolveTokenRemote = activeBackend.resolveTokenRemote;
 const burnTokenRemote = activeBackend.burnTokenRemote;
@@ -61,7 +56,7 @@ const refundUnderspendRemote = activeBackend.refundUnderspendRemote;
 const getBalanceRemote = activeBackend.getBalanceRemote;
 const listCardsRemote = activeBackend.listCardsRemote;
 const getDepositAddressesRemote = activeBackend.getDepositAddressesRemote;
-console.error(`[Z-ZERO MCP] 🚀 Wallet mode: ${WALLET_MODE.toUpperCase()}`);
+console.error(`[Z-ZERO MCP] 🚀 Pure WDK Non-Custodial Mode`);
 // ────────────────────────────────────────────────────────────────────────────
 const playwright_bridge_js_1 = require("./playwright_bridge.js");
 const web3_detector_js_1 = require("./lib/web3-detector.js");
@@ -73,7 +68,7 @@ const key_store_js_1 = require("./lib/key-store.js"); // ✅ Hot-Swap support
 // ============================================================
 const server = new mcp_js_1.McpServer({
     name: "z-zero-mcp-server",
-    version: "2.0.0",
+    version: version_js_2.CURRENT_MCP_VERSION,
 });
 // ============================================================
 // TOOL 1: List available cards (safe - no sensitive data)
@@ -177,57 +172,36 @@ server.tool("get_deposit_addresses", "Get your unique deposit addresses for EVM
     if (data?.wdk_wallet?.address) {
         const wdkAddr = data.wdk_wallet.address;
         const balance = data.wdk_wallet.balance_usdt ?? 0;
+        const tronAddr = data.wdk_wallet.tron_address;
         return {
             content: [{
                     type: "text",
                     text: JSON.stringify({
                         wallet_type: "non-custodial (WDK)",
-                        address: wdkAddr,
                         balance_usdt: balance,
                         supported_chains: [
-                            { chain: "Polygon", token: "USDT", address: wdkAddr },
+                            { chain: "Ethereum", token: "USDT", address: wdkAddr },
+                            ...(tronAddr ? [{ chain: "Tron", token: "USDT", address: tronAddr }] : []),
                         ],
-                        instructions: `Send USDT (Polygon/ERC-20) to this address: ${wdkAddr}. Funds will appear in your agent wallet within 1-3 minutes.`,
-                        note: "Gasless payments via ERC-4337 Paymaster. Your agent pays ~$0.001 in gas per tx."
+                        instructions: `Send USDT (Ethereum ERC-20) to: ${wdkAddr}${tronAddr ? `\nSend USDT (Tron TRC-20) to: ${tronAddr}` : ''}`,
+                        note: "Gasless payments via ERC-4337 Paymaster (Ethereum) / GasFree (Tron)."
                     }, null, 2),
                 }],
         };
     }
-    // ── Custodial Mode Fallback ───────────────────────────────────────────
-    const addresses = data?.deposit_addresses;
-    if (!addresses) {
-        return {
-            content: [{
-                    type: "text",
-                    text: "Failed to retrieve deposit addresses. Please ensure your Z_ZERO_API_KEY (Passport Key) is valid. You can find it at https://www.clawcard.store/dashboard/agents",
-                }],
-            isError: true,
-        };
-    }
+    // No WDK wallet connected
     return {
         content: [{
                 type: "text",
-                text: JSON.stringify({
-                    wallet_type: "custodial",
-                    evm: {
-                        address: addresses.evm,
-                        supported_chains: ["Base", "BNB Smart Chain (BSC)", "Ethereum"],
-                        tokens: ["USDC", "USDT"]
-                    },
-                    tron: {
-                        address: addresses.tron,
-                        supported_chains: ["Tron (TRC-20)"],
-                        tokens: ["USDT"]
-                    },
-                    note: "Funds sent to these addresses will be automatically credited to your Z-ZERO balance within minutes."
-                }, null, 2),
+                text: "No WDK wallet found. Please create one at https://www.clawcard.store/dashboard/agent-wallet",
             }],
+        isError: true,
     };
 });
 // ============================================================
 // TOOL 3: Request a temporary payment token (issues secure JIT card)
 // ============================================================
-server.tool("request_payment_token", "Request a temporary payment token for a specific amount. A secure single-use virtual card is issued via the Z-ZERO network. The token is valid for 30 minutes. Min: $1, Max: $100. Use this token with execute_payment to complete a purchase.", {
+server.tool("request_payment_token", "Request a temporary payment token for a specific amount. A secure single-use virtual card is issued via the Z-ZERO network. The token is valid for 1 hour. Min: $1, Max: $100. Use this token with execute_payment to complete a purchase.", {
     card_alias: zod_1.z
         .string()
         .describe("Which card to charge, e.g. 'Card_01'"),
@@ -288,7 +262,8 @@ server.tool("request_payment_token", "Request a temporary payment token for a sp
                     merchant: token.merchant,
                     expires_at: expiresAt,
                     card_issued: true,
-                    instructions: "Use this token with execute_payment within 30 minutes. IMPORTANT: If the actual checkout price is HIGHER than the token amount, do NOT proceed — call cancel_payment_token first and request a new token with the correct amount.",
+                    instructions: "Use this token with execute_payment within 1 hour. IMPORTANT: If the actual checkout price is HIGHER than the token amount, do NOT proceed — call cancel_payment_token first and request a new token with the correct amount.",
+                    ...(token.mcp_warning ? { _mcp_warning: token.mcp_warning } : {}),
                 }, null, 2),
             },
         ],
@@ -495,49 +470,6 @@ server.tool("request_human_approval", "Request human approval before proceeding
     };
 });
 // ============================================================
-// TOOL 6.4: Check for Updates (polls clawcard.store, not npm)
-// ============================================================
-server.tool("check_for_updates", "Check if a newer version of this MCP server is available. Polls clawcard.store/api/version — independent of npm so works even if distribution changes. Call this when: (1) user asks if MCP is up to date, (2) a payment fails and you want to rule out a stale MCP version.", {}, async () => {
-    try {
-        const res = await fetch(ZZERO_VERSION_API, {
-            headers: { "User-Agent": `z-zero-mcp/${CURRENT_MCP_VERSION}` },
-            signal: AbortSignal.timeout(8_000),
-        });
-        if (!res.ok)
-            throw new Error(`HTTP ${res.status}`);
-        const data = await res.json();
-        const latest = data.latest_version;
-        const isUpToDate = CURRENT_MCP_VERSION === latest;
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        current_version: CURRENT_MCP_VERSION,
-                        latest_version: latest,
-                        up_to_date: isUpToDate,
-                        status: isUpToDate ? "✅ You are on the latest version." : `⚠️ Update available: ${CURRENT_MCP_VERSION} → ${latest}`,
-                        release_notes: isUpToDate ? null : data.release_notes,
-                        how_to_update: isUpToDate ? null : data.update_instructions,
-                    }, null, 2),
-                }],
-        };
-    }
-    catch (err) {
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        current_version: CURRENT_MCP_VERSION,
-                        status: "⚠️ Could not reach version server. Check your internet connection.",
-                        error: err.message,
-                        fallback_check: `Visit https://www.clawcard.store to see latest version.`,
-                    }, null, 2),
-                }],
-            isError: true,
-        };
-    }
-});
-// ============================================================
 // TOOL 6.5: Set API Key (Hot-Swap Passport Key — NO restart needed)
 // ============================================================
 server.tool("set_api_key", "Update the Z-ZERO Passport Key immediately WITHOUT restarting the AI tool. Call this when the human provides a new key (e.g. 'zk_live_xxxxx'). The key is validated and activated instantly for all subsequent API calls. IMPORTANT: Never ask for the key proactively — only call this when the human explicitly provides it.", {
@@ -584,9 +516,6 @@ server.tool("show_api_key_status", "Show whether a Passport Key is currently con
             }],
     };
 });
-// ============================================================
-// TOOL 7: Auto Pay Checkout (Phase 2 — Smart Routing)
-// ============================================================
 server.tool("auto_pay_checkout", "[Phase 2] Autonomous Smart Routing checkout tool. Provide a checkout URL and this tool will:\n" +
     "1. Scan the page to detect if it supports Web3 (Crypto) payments via window.ethereum or EIP-681 links.\n" +
     "2. SCENARIO A (Web3): If detected, automatically send USDT on-chain via WDK (gas ~$0.001). No Visa card needed.\n" +
@@ -597,22 +526,20 @@ server.tool("auto_pay_checkout", "[Phase 2] Autonomous Smart Routing checkout to
         .describe("Full URL of the checkout/payment page to analyze and pay."),
     card_alias: zod_1.z
         .string()
-        .describe("Card alias to charge for JIT Fiat fallback, e.g. 'Card_01'. Required even if Web3 route is used (used for WDK wallet lookup)."),
+        .describe("Card alias to charge for JIT Fiat fallback, e.g. 'Card_01'."),
 }, async ({ checkout_url, card_alias }) => {
     const ZZERO_API = process.env.Z_ZERO_API_BASE || "https://www.clawcard.store";
-    const API_KEY = process.env.Z_ZERO_API_KEY || "";
-    // ── C2 FIX: API key guard ────────────────────────────────────────────
+    const API_KEY = (0, key_store_js_1.getPassportKey)(); // ✅ FIX: use hot-swap key store, not process.env
     if (!API_KEY) {
         return {
             content: [{ type: "text", text: JSON.stringify({
                         status: "CONFIG_ERROR",
-                        message: "Z_ZERO_API_KEY is not configured on this MCP server. Cannot proceed.",
+                        message: "Z_ZERO_API_KEY is not configured.",
                     }, null, 2) }],
             isError: true,
         };
     }
-    // ── C1 FIX: SSRF guard — validate checkout_url ───────────────────────
-    // Block non-https and internal/private IP ranges
+    // ── SSRF guard ───────────────────────────────────────────────
     (() => {
         let url;
         try {
@@ -623,13 +550,9 @@ server.tool("auto_pay_checkout", "[Phase 2] Autonomous Smart Routing checkout to
         }
         const isDev = process.env.NODE_ENV !== "production";
         const hostname = url.hostname;
-        // ✅ BUG 4 FIX: Allow http://localhost in dev for testing local checkout pages
-        if (isDev && (hostname === "localhost" || hostname === "127.0.0.1")) {
-            console.error(`[SMART ROUTE] Dev mode: allowing localhost checkout URL`);
-        }
-        else {
+        if (!(isDev && (hostname === "localhost" || hostname === "127.0.0.1"))) {
             if (url.protocol !== "https:") {
-                throw new Error(`checkout_url must use HTTPS. Got: ${url.protocol}`);
+                throw new Error(`checkout_url must use HTTPS.`);
             }
             const privatePatterns = [
                 /^localhost$/i, /^127\./, /^10\./,
@@ -637,187 +560,115 @@ server.tool("auto_pay_checkout", "[Phase 2] Autonomous Smart Routing checkout to
                 /^169\.254\./, /^\[::1\]$/, /^0\.0\.0\.0$/,
             ];
             if (privatePatterns.some(p => p.test(hostname))) {
-                throw new Error(`SSRF blocked: checkout_url points to private/internal host: ${hostname}`);
+                throw new Error(`SSRF blocked host: ${hostname}`);
             }
         }
     })();
-    // ── STEP A: Try to detect Web3 payment on the page ──────────────────
-    console.error(`[SMART ROUTE] Scanning ${checkout_url} for Web3 payment...`);
-    const web3Result = await (0, web3_detector_js_1.detectWeb3Payment)(checkout_url);
-    if (web3Result.detected && web3Result.params) {
-        // ── SCENARIO A: Web3 Payment Detected ────────────────────────────
-        const { to, eip681_amount, data } = web3Result.params;
-        // If amount is baked into EIP-681 link, use it. Otherwise need user to confirm.
-        if (!eip681_amount && !data) {
+    // ── Single Browser Instance for efficiency ──────────────────
+    const browser = await playwright_1.chromium.launch({ headless: true });
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    try {
+        // STEP 1: Web3 Detection
+        console.error(`[SMART ROUTE] Scanning ${checkout_url} for Web3...`);
+        const web3Result = await (0, web3_detector_js_1.detectWeb3Payment)(page, checkout_url);
+        if (web3Result.detected && web3Result.params) {
+            const { to, eip681_amount, data } = web3Result.params;
+            let amount = eip681_amount ?? 0;
+            if (!amount && data && data.length >= 138) {
+                const amountHex = data.slice(-64);
+                amount = Number(BigInt(`0x${amountHex}`)) / 1_000_000;
+            }
+            if (!amount || amount <= 0) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({
+                                route: "WEB3", status: "AMOUNT_REQUIRED", recipient: to,
+                                message: "Web3 detected but amount is unknown.",
+                            }, null, 2) }],
+                };
+            }
+            const resp = await fetch(`${ZZERO_API}/api/wdk/transfer`, {
+                method: "POST",
+                headers: { "Content-Type": "application/json", "x-passport-key": API_KEY },
+                body: JSON.stringify({ to, amount, card_alias }),
+            });
+            const txResult = await resp.json();
+            if (!resp.ok || !txResult.success) {
+                return {
+                    content: [{ type: "text", text: JSON.stringify({
+                                route: "WEB3", status: "FAILED", reason: txResult.message || "Transfer failed",
+                            }, null, 2) }],
+                    isError: true,
+                };
+            }
             return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            route: "WEB3",
-                            detected: true,
-                            status: "AMOUNT_REQUIRED",
-                            recipient: to,
-                            message: `Web3 payment gateway detected (${web3Result.method}), recipient: ${to}. Could not determine exact USDT amount automatically. Please confirm the amount with the user, then call this tool again with the amount in the checkout_url or use pay_crypto(to=${to}, amount=<confirmed_amount>).`,
-                        }, null, 2),
-                    }],
+                content: [{ type: "text", text: JSON.stringify({
+                            route: "WEB3", method: web3Result.method, status: "SUCCESS",
+                            recipient: to, amount_usdt: amount, tx_hash: txResult.txHash,
+                            message: `✅ Web3 payment sent on-chain! ${amount} USDT → ${to}.`,
+                            gas_savings: "~$0.001 (ERC-4337 Paymaster, gasless for user)",
+                        }, null, 2) }],
             };
         }
-        // Call backend WDK transfer API
-        let amount = eip681_amount ?? 0;
-        // Decode ERC-20 transfer amount from calldata if EIP-681 amount not available
-        if (!amount && data && data.length >= 138) {
-            const amountHex = data.slice(-64);
-            const amountRaw = BigInt(`0x${amountHex}`);
-            amount = Number(amountRaw) / 1_000_000;
-        }
-        // Guard: if we still can't determine amount, ask user
-        if (!amount || amount <= 0) {
+        // STEP 2: Fiat Fallback (Price Extraction)
+        console.error(`[SMART ROUTE] No Web3. Extracting price...`);
+        const totalPrice = await (0, extract_total_price_js_1.extractTotalPrice)(page);
+        if (!totalPrice) {
             return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            route: "WEB3",
-                            detected: true,
-                            status: "AMOUNT_REQUIRED",
-                            recipient: to,
-                            message: `Web3 tx detected but could not decode USDT amount from calldata. Please confirm the exact amount with the user and use pay_crypto(to=${to}, amount=<amount>).`,
-                        }, null, 2),
-                    }],
+                content: [{ type: "text", text: JSON.stringify({
+                            route: "FIAT", status: "PRICE_NOT_FOUND",
+                        }, null, 2) }],
+                isError: true,
             };
         }
-        const resp = await fetch(`${ZZERO_API}/api/wdk/transfer`, {
-            method: "POST",
-            headers: {
-                "Content-Type": "application/json",
-                "x-passport-key": API_KEY,
-            },
-            body: JSON.stringify({ to, amount, card_alias }),
-        });
-        const txResult = await resp.json();
-        if (!resp.ok || !txResult.success) {
+        if (totalPrice < 1 || totalPrice > 100) {
             return {
-                content: [{
-                        type: "text",
-                        text: JSON.stringify({
-                            route: "WEB3",
-                            status: "FAILED",
-                            reason: txResult.message || txResult.error || "Unknown error from WDK transfer API",
-                        }, null, 2),
-                    }],
+                content: [{ type: "text", text: JSON.stringify({
+                            route: "FIAT", status: "AMOUNT_OUT_OF_RANGE", detected_price: totalPrice,
+                        }, null, 2) }],
                 isError: true,
             };
         }
+        // Issue Token
+        const token = await issueTokenRemote(card_alias, totalPrice, checkout_url);
+        if (!token || token.error)
+            throw new Error(token?.message || "Token issue failed");
+        // Resolve Card Data
+        const cardData = await resolveTokenRemote(token.token);
+        if (!cardData || cardData.error)
+            throw new Error("Card resolve failed");
+        // Fill Form (Reusing the same page!)
+        const fillResult = await (0, playwright_bridge_js_1.fillCheckoutForm)(checkout_url, cardData, page);
+        if (fillResult.success) {
+            const burnOk = await burnTokenRemote(token.token);
+            if (!burnOk)
+                console.error(`[WARN] Token burn failed for ${token.token} — manual check needed`);
+        }
         return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        route: "WEB3",
-                        method: web3Result.method,
-                        status: "SUCCESS",
-                        recipient: to,
-                        amount_usdt: amount,
-                        tx_hash: txResult.txHash,
-                        message: `✅ Web3 payment sent on-chain! ${amount} USDT → ${to}. Tx: ${txResult.txHash}`,
-                        gas_savings: "~$0.001 (ERC-4337 Paymaster, gasless for user)",
-                    }, null, 2),
-                }],
-        };
-    }
-    // ── SCENARIO B: No Web3 — Fiat JIT Card fallback ────────────────────
-    console.error(`[SMART ROUTE] No Web3 detected. Scanning DOM for total price...`);
-    // ✅ BUG 1+2 FIX: Use try/finally so browser ALWAYS closes (even on success).
-    // fillCheckoutForm opens its own browser — this avoids triple browser + leak.
-    let totalPrice = null;
-    const priceBrowser = await playwright_1.chromium.launch({ headless: true });
-    try {
-        const pricePage = await priceBrowser.newPage();
-        await pricePage.goto(checkout_url, { waitUntil: "domcontentloaded", timeout: 20_000 });
-        totalPrice = await (0, extract_total_price_js_1.extractTotalPrice)(pricePage);
-    }
-    catch {
-        // ignore — totalPrice stays null, handled below
-    }
-    finally {
-        await priceBrowser.close().catch(() => { }); // ✅ Always close
-    }
-    if (!totalPrice) {
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        route: "FIAT",
-                        status: "PRICE_NOT_FOUND",
-                        message: "Could not automatically detect the total price on this page. Please manually confirm the exact checkout price and use request_payment_token + execute_payment instead.",
-                    }, null, 2),
-                }],
-            isError: true,
-        };
-    }
-    if (totalPrice < 1 || totalPrice > 100) {
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        route: "FIAT",
-                        status: "AMOUNT_OUT_OF_RANGE",
+            content: [{ type: "text", text: JSON.stringify({
+                        route: "FIAT", status: fillResult.success ? "SUCCESS" : "FILL_FAILED",
                         detected_price: totalPrice,
-                        message: `Detected price $${totalPrice} is outside the JIT card limit ($1-$100). Please confirm with user and use request_payment_token manually.`,
-                    }, null, 2),
-                }],
-            isError: true,
-        };
-    }
-    // Issue JIT card for exactly the detected total
-    console.error(`[SMART ROUTE] Fiat route: issuing JIT card for $${totalPrice}`);
-    const token = await issueTokenRemote(card_alias, totalPrice, checkout_url);
-    if (!token || token.error) {
-        return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        route: "FIAT",
-                        status: "TOKEN_ISSUE_FAILED",
-                        message: token?.message || "Could not issue JIT card. Check balance or card alias.",
-                    }, null, 2),
-                }],
-            isError: true,
+                        message: fillResult.success
+                            ? `✅ JIT card issued for $${totalPrice} and checkout filled.`
+                            : `❌ Fill failed: ${fillResult.message}`,
+                        receipt_id: fillResult.receipt_id || null,
+                    }, null, 2) }],
+            isError: !fillResult.success,
         };
     }
-    // Resolve token and auto-fill form
-    const cardData = await resolveTokenRemote(token.token);
-    if (!cardData || cardData.error) {
+    catch (err) {
+        // ✅ FIX 8: Sanitize error message before returning to agent — avoid leaking internal paths
+        const safeMsg = (err?.message || String(err)).replace(/\/.*(src|dist)\/.*\.ts/g, '[internal]').slice(0, 200);
         return {
-            content: [{
-                    type: "text",
-                    text: JSON.stringify({
-                        route: "FIAT",
-                        status: "CARD_RESOLVE_FAILED",
-                        message: "Failed to resolve JIT card data. Token may have expired.",
-                    }, null, 2),
-                }],
+            content: [{ type: "text", text: JSON.stringify({
+                        status: "ERROR", message: safeMsg,
+                    }, null, 2) }],
             isError: true,
         };
     }
-    const fillResult = await (0, playwright_bridge_js_1.fillCheckoutForm)(checkout_url, cardData);
-    if (fillResult.success) {
-        await burnTokenRemote(token.token);
+    finally {
+        await browser.close().catch(() => { });
     }
-    return {
-        content: [{
-                type: "text",
-                text: JSON.stringify({
-                    route: "FIAT",
-                    status: fillResult.success ? "SUCCESS" : "FILL_FAILED",
-                    detected_price: totalPrice,
-                    jit_card_issued: true,
-                    message: fillResult.success
-                        ? `✅ JIT Visa card issued for $${totalPrice} and checkout filled successfully.`
-                        : `❌ JIT card issued but checkout form fill failed: ${fillResult.message}`,
-                    receipt_id: fillResult.receipt_id || null,
-                }, null, 2),
-            }],
-        isError: !fillResult.success,
-    };
 });
 // ============================================================
 // RESOURCE: Z-ZERO Autonomous Payment SOP
@@ -840,7 +691,7 @@ When asked to make a purchase, execute the following steps precisely in order:
 
 ## Step 2: Requesting the JIT Token
 1. Request Token: Call the \`request_payment_token\` tool with the exact \`amount\` required and the \`merchant\` name.
-2. Receive Token: You will receive a temporary \`token\` (e.g., \`temp_auth_1a2b...\`). This token is locked to the requested amount and is valid for 30 minutes.
+2. Receive Token: You will receive a temporary \`token\` (e.g., \`temp_auth_1a2b...\`). This token is locked to the requested amount and is valid for 1 hour.
 
 ## Step 3: Locating the Checkout
 1. Identify Checkout URL: Find the merchant's checkout/payment page where credit card details are normally entered.
@@ -857,6 +708,13 @@ When asked to make a purchase, execute the following steps precisely in order:
 - NEVER print full tokens in the human chat logs.
 - NO MANUAL ENTRY: If a merchant asks you to type a credit card number into a text box, REFUSE. 
 - FAIL GRACEFULLY: If \`execute_payment\` returns \`success: false\`, report the error message to the human. Do not try again.
+
+## ⚡ Smart Route Alternative (Recommended)
+For most purchases, use \`auto_pay_checkout\` instead of the 4-step flow above.
+It auto-detects Web3 checkout (pay on-chain with USDT) vs Fiat checkout (JIT Visa card), all in a single call.
+- Web3 route: sends USDT directly on-chain to merchant wallet
+- Fiat route: issues JIT card + fills checkout form automatically
+Call \`auto_pay_checkout\` with just \`checkout_url\` and \`card_alias\`. The tool handles the rest.
 `;
     return {
         contents: [
@@ -874,7 +732,7 @@ When asked to make a purchase, execute the following steps precisely in order:
 async function main() {
     const transport = new stdio_js_1.StdioServerTransport();
     await server.connect(transport);
-    console.error("🔐 OpenClaw MCP Server v2.0.0 running (Phase 2: Smart Routing enabled)...");
+    console.error(`🔐 OpenClaw MCP Server v${version_js_2.CURRENT_MCP_VERSION} running (Phase 2: Smart Routing enabled)...`);
     console.error("Status: Secure & Connected to Z-ZERO Gateway");
     console.error("Tools: list_cards, check_balance, request_payment_token, execute_payment, cancel_payment_token, request_human_approval, auto_pay_checkout");
 }

package/dist/lib/extract-total-price.js

@@ -101,7 +101,9 @@ async function extractTotalPrice(page) {
             }
             if (values.length === 0)
                 return null;
-            return Math.max(...values);
+            // ✅ FIX 10: Use median instead of max — prevents merchant injecting hidden large price
+            values.sort((a, b) => a - b);
+            return values[Math.floor(values.length / 2)];
         });
         if (amount !== null && amount > 0) {
             console.error(`[PRICE] ⚠️  Strategy 3 (largest $ on page): $${amount}. Low confidence.`);

package/dist/lib/key-store.js

@@ -27,9 +27,9 @@ function setPassportKey(newKey) {
     if (!trimmed.startsWith("zk_live_") && !trimmed.startsWith("zk_test_")) {
         return { ok: false, message: `Invalid key format — must start with "zk_live_" or "zk_test_". Got: "${trimmed.slice(0, 12)}..."` };
     }
-    const previous = _passportKey;
     _passportKey = trimmed;
-    console.error(`[KEY-STORE] ✅ Passport Key updated: ${previous.slice(0, 10)}... → ${trimmed.slice(0, 10)}...`);
+    // ✅ FIX 11: Don't log partial key — even 10 chars helps brute-force
+    console.error(`[KEY-STORE] ✅ Passport Key updated successfully.`);
     return { ok: true, message: `Passport Key updated successfully. Active key prefix: ${trimmed.slice(0, 10)}...` };
 }
 /** Check if a key is currently configured. */

package/dist/lib/web3-detector.d.ts

@@ -12,9 +12,8 @@ export interface Web3DetectionResult {
     message: string;
 }
 /**
- * Opens the checkout URL in a headless browser.
+ * Checks a page for Web3 payment indicators (EIP-681 or interrupted eth_sendTransaction).
  * Injects a mock window.ethereum (MetaMask emulation).
- * Scans for EIP-681 links.
  * Returns the tx params if Web3 payment is detected, else null.
  */
-export declare function detectWeb3Payment(checkoutUrl: string): Promise<Web3DetectionResult>;
+export declare function detectWeb3Payment(page: import("playwright").Page, checkoutUrl: string): Promise<Web3DetectionResult>;

package/dist/lib/web3-detector.js

@@ -6,21 +6,15 @@
 // If page is not Web3-aware → return null (caller falls back to Fiat JIT card).
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectWeb3Payment = detectWeb3Payment;
-const playwright_1 = require("playwright");
 const WEB3_DETECT_TIMEOUT_MS = 12_000; // 12s max to detect Web3 button click
 /**
- * Opens the checkout URL in a headless browser.
+ * Checks a page for Web3 payment indicators (EIP-681 or interrupted eth_sendTransaction).
  * Injects a mock window.ethereum (MetaMask emulation).
- * Scans for EIP-681 links.
  * Returns the tx params if Web3 payment is detected, else null.
  */
-async function detectWeb3Payment(checkoutUrl) {
-    const browser = await playwright_1.chromium.launch({ headless: true });
-    const context = await browser.newContext();
-    const page = await context.newPage();
+async function detectWeb3Payment(page, checkoutUrl) {
     try {
         // ─── Inject mock window.ethereum BEFORE page loads ───────────────────
-        // This ensures the page's `if (typeof window.ethereum !== 'undefined')` check passes.
         await page.addInitScript(() => {
             const mockEthereum = {
                 isMetaMask: true,
@@ -44,7 +38,6 @@ async function detectWeb3Payment(checkoutUrl) {
                         return null;
                     if (method === "eth_getBalance")
                         return "0x0";
-                    // C3 FIX: Log unrecognized methods for debugging DApp compatibility
                     window["__wdkUnknownMethod_" + method] = true;
                     return null;
                 },
@@ -67,7 +60,6 @@ async function detectWeb3Payment(checkoutUrl) {
         // ─── Navigate to page ─────────────────────────────────────────────────
         await page.goto(checkoutUrl, { waitUntil: "domcontentloaded", timeout: 20_000 });
         // ─── Strategy A: Scan for EIP-681 links ──────────────────────────────
-        // Look for links like: ethereum:0xabc...@137/transfer?address=0xabc&uint256=10000000
         const eip681Result = await page.evaluate(() => {
             const links = Array.from(document.querySelectorAll("a[href]"))
                 .map(a => a.href)
@@ -78,16 +70,13 @@ async function detectWeb3Payment(checkoutUrl) {
             const href = links[0] ?? inlineMatch?.[0] ?? null;
             if (!href)
                 return null;
-            // Parse: ethereum:0xCONTRACT@137/transfer?address=0xRECIPIENT&uint256=10000000
             const contractMatch = href.match(/ethereum:(0x[0-9a-fA-F]{40})/);
             const chainMatch = href.match(/@(\d+)/);
             const uint256Match = href.match(/uint256=(\d+)/);
-            // ✅ BUG 6 FIX: Parse recipient from 'address=' query param (not the contract address)
             const recipientMatch = href.match(/[?&]address=(0x[0-9a-fA-F]{40})/);
             return {
-                // Prefer recipient address from query param; fall back to contract only as last resort
                 to: recipientMatch?.[1] ?? contractMatch?.[1] ?? null,
-                contract: contractMatch?.[1] ?? null, // USDT contract (kept for logging)
+                contract: contractMatch?.[1] ?? null,
                 chainId: chainMatch ? parseInt(chainMatch[1]) : 137,
                 uint256: uint256Match?.[1] ?? null,
                 raw: href,
@@ -95,9 +84,8 @@ async function detectWeb3Payment(checkoutUrl) {
         });
         if (eip681Result?.to) {
             const usdtAmount = eip681Result.uint256
-                ? parseInt(eip681Result.uint256) / 1_000_000 // USDT has 6 decimals
+                ? parseInt(eip681Result.uint256) / 1_000_000
                 : null;
-            console.error(`[WEB3] ✅ EIP-681 detected: recipient=${eip681Result.to}, contract=${eip681Result.contract}, amount=${usdtAmount} USDT`);
             return {
                 detected: true,
                 method: "EIP-681",
@@ -110,55 +98,46 @@ async function detectWeb3Payment(checkoutUrl) {
             };
         }
         // ─── Strategy B: Wait for eth_sendTransaction after clicking "Pay" ────
-        // ✅ BUG 5 FIX: Auto-click common Web3 pay buttons so DApp triggers eth_sendTransaction
         const web3ButtonSelectors = [
             'button:has-text("MetaMask")', 'button:has-text("Pay with Crypto")',
             'button:has-text("Connect Wallet")', 'button:has-text("Pay with Web3")',
             'button:has-text("Pay with Wallet")', '#pay-metamask-btn',
             '[class*="web3"] button', '[class*="metamask"] button',
         ];
+        // Click buttons sequentially, small delay to let UI reaction
         for (const sel of web3ButtonSelectors) {
             try {
                 const btn = await page.$(sel);
                 if (btn && await btn.isVisible()) {
                     console.error(`[WEB3] Clicking Web3 pay button: ${sel}`);
                     await btn.click();
-                    break;
+                    await page.waitForTimeout(500);
                 }
             }
-            catch { /* selector may not exist — continue */ }
+            catch { /* skip */ }
         }
-        // Poll for captured tx (window.ethereum.request intercepted by mock)
-        const capturedTx = await Promise.race([
-            // Poll for captured tx
-            (async () => {
-                const start = Date.now();
-                while (Date.now() - start < WEB3_DETECT_TIMEOUT_MS) {
-                    const tx = await page.evaluate(() => {
-                        return window["__wdkCapturedTx"] ?? null;
-                    });
-                    if (tx)
-                        return tx;
-                    await page.waitForTimeout(500);
-                }
-                return null;
-            })(),
-        ]);
-        if (capturedTx) {
-            console.error(`[WEB3] ✅ eth_sendTransaction captured: to=${capturedTx["to"]}`);
-            return {
-                detected: true,
-                method: "eth_sendTransaction",
-                params: {
-                    to: capturedTx["to"],
-                    value: capturedTx["value"],
-                    data: capturedTx["data"],
-                    chainId: 137,
-                },
-                message: `Web3 payment detected via eth_sendTransaction. Recipient: ${capturedTx["to"]}`,
-            };
+        // Poll for captured tx
+        const start = Date.now();
+        while (Date.now() - start < WEB3_DETECT_TIMEOUT_MS) {
+            const tx = await page.evaluate(() => {
+                return window["__wdkCapturedTx"] ?? null;
+            });
+            if (tx) {
+                const capturedTx = tx;
+                return {
+                    detected: true,
+                    method: "eth_sendTransaction",
+                    params: {
+                        to: capturedTx["to"],
+                        value: capturedTx["value"],
+                        data: capturedTx["data"],
+                        chainId: 137,
+                    },
+                    message: `Web3 payment detected via eth_sendTransaction. Recipient: ${capturedTx["to"]}`,
+                };
+            }
+            await page.waitForTimeout(500);
         }
-        console.error("[WEB3] ❌ No Web3 payment detected on this page. Fallback to Fiat.");
         return {
             detected: false,
             method: null,
@@ -168,7 +147,6 @@ async function detectWeb3Payment(checkoutUrl) {
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        console.error(`[WEB3] Error during detection: ${msg}`);
         return {
             detected: false,
             method: null,
@@ -176,7 +154,4 @@ async function detectWeb3Payment(checkoutUrl) {
             message: `Detection failed: ${msg}. Defaulting to Fiat route.`,
         };
     }
-    finally {
-        await browser.close().catch(() => { });
-    }
 }

package/dist/playwright_bridge.d.ts

@@ -4,4 +4,4 @@ import type { CardData, PaymentResult } from "./types.js";
  * Card data exists ONLY in RAM and is wiped after injection.
  * Hard timeout of 60s prevents merchant page from hanging indefinitely.
  */
-export declare function fillCheckoutForm(checkoutUrl: string, cardData: CardData): Promise<PaymentResult>;
+export declare function fillCheckoutForm(checkoutUrl: string, cardData: CardData, existingPage?: import("playwright").Page): Promise<PaymentResult>;

package/dist/playwright_bridge.js

@@ -11,17 +11,22 @@ const CHECKOUT_HARD_TIMEOUT_MS = 60_000; // 60s absolute cap — prevents slow-l
  * Card data exists ONLY in RAM and is wiped after injection.
  * Hard timeout of 60s prevents merchant page from hanging indefinitely.
  */
-async function fillCheckoutForm(checkoutUrl, cardData) {
-    const browser = await playwright_1.chromium.launch({ headless: true });
-    const context = await browser.newContext();
-    const page = await context.newPage();
-    // 🔒 Wrap entire checkout flow in 60s hard timeout
-    // onTimeout: force-close browser to free memory
+async function fillCheckoutForm(checkoutUrl, cardData, existingPage) {
+    let browser = null;
+    let page;
+    if (existingPage) {
+        page = existingPage;
+    }
+    else {
+        browser = await playwright_1.chromium.launch({ headless: true });
+        const context = await browser.newContext();
+        page = await context.newPage();
+    }
     try {
-        return await (0, with_timeout_js_1.withTimeout)(_fillCheckoutFormInner(page, checkoutUrl, cardData), // ✅ BUG 8 FIX: pass URL
-        CHECKOUT_HARD_TIMEOUT_MS, 'fillCheckoutForm', async () => {
+        return await (0, with_timeout_js_1.withTimeout)(_fillCheckoutFormInner(page, checkoutUrl, cardData), CHECKOUT_HARD_TIMEOUT_MS, 'fillCheckoutForm', async () => {
             console.error('[PLAYWRIGHT] ⚠️ Hard timeout hit — force-closing browser');
-            await browser.close().catch(() => { });
+            if (browser)
+                await browser.close().catch(() => { });
         });
     }
     catch (err) {
@@ -35,145 +40,223 @@ async function fillCheckoutForm(checkoutUrl, cardData) {
         return { success: false, message: `Payment failed: ${errMsg}` };
     }
     finally {
-        // RAM wipe happens inside _fillCheckoutFormInner's finally block
-        // Ensure browser is closed even if timeout cleanup failed
-        await browser.close().catch(() => { });
+        if (browser)
+            await browser.close().catch(() => { });
     }
 }
+// ============================================================
+// HELPER: Smart fill — handles both <input> and <select>
+// Prevents crash when dropdown uses <select> instead of <input>
+// ============================================================
+async function smartFill(el, value) {
+    try {
+        const tag = await el.evaluate(e => e.tagName.toLowerCase());
+        if (tag === 'select') {
+            // Try by value first (most common: "01", "12", "2030")
+            try {
+                await el.selectOption({ value });
+                return true;
+            }
+            catch { /* next */ }
+            // Try matching option label containing the value
+            try {
+                await el.selectOption({ label: value });
+                return true;
+            }
+            catch { /* next */ }
+            // Last resort: numeric index (month "01" → index 1 if 0="Select...")
+            const idx = parseInt(value, 10);
+            if (!isNaN(idx)) {
+                try {
+                    await el.selectOption({ index: idx });
+                    return true;
+                }
+                catch { /* give up */ }
+            }
+            return false;
+        }
+        else {
+            await el.fill(value);
+            return true;
+        }
+    }
+    catch {
+        return false;
+    }
+}
+/** Try each selector in order, smartFill the first match */
+async function tryFillField(page, selectors, value) {
+    for (const selector of selectors) {
+        const el = await page.$(selector);
+        if (el) {
+            const ok = await smartFill(el, value);
+            if (ok)
+                return true;
+        }
+    }
+    return false;
+}
 /** Internal implementation — called by fillCheckoutForm inside a timeout wrapper */
-async function _fillCheckoutFormInner(page, checkoutUrl, // ✅ BUG 8 FIX: need URL to navigate to
-cardData) {
+async function _fillCheckoutFormInner(page, checkoutUrl, cardData) {
     try {
-        // ✅ BUG 8 FIX: Navigate to the checkout page (was missing — page was blank!)
-        await page.goto(checkoutUrl, { waitUntil: "domcontentloaded", timeout: 20_000 });
+        // ✅ FIX: Skip navigation if page already loaded (Single Browser reuse from auto_pay_checkout)
+        // Prevents double-navigate which would reload page and lose cart/session state.
+        const currentUrl = page.url();
+        const baseCheckoutUrl = checkoutUrl.split("?")[0];
+        if (!currentUrl || currentUrl === "about:blank" || !currentUrl.startsWith(baseCheckoutUrl)) {
+            await page.goto(checkoutUrl, { waitUntil: "domcontentloaded", timeout: 20_000 });
+        }
         // ============================================================
         // STRATEGY 1: Standard HTML form fields
+        // Covers: plain forms, Shopify, WooCommerce, custom checkouts
+        // Priority: autocomplete (W3C) → name → platform-specific → placeholder → aria-label
         // ============================================================
-        const standardSelectors = {
+        const S = {
             number: [
+                '[autocomplete="cc-number"]',
                 'input[name="cardnumber"]',
                 'input[name="card-number"]',
                 'input[name="cc-number"]',
-                'input[autocomplete="cc-number"]',
+                'input[name="card_number"]',
+                'input[name="checkout[payment][card_number]"]', // Shopify
+                'input[id="wc-stripe-cc-number"]', // WooCommerce
                 'input[data-elements-stable-field-name="cardNumber"]',
                 'input[placeholder*="card number" i]',
-                'input[placeholder*="Card number" i]',
                 'input[aria-label*="card number" i]',
             ],
             expiry: [
+                '[autocomplete="cc-exp"]',
                 'input[name="exp-date"]',
                 'input[name="cc-exp"]',
-                'input[autocomplete="cc-exp"]',
+                'input[name="expiry"]',
+                'input[name="checkout[payment][card_expiry]"]', // Shopify
                 'input[placeholder*="MM / YY" i]',
                 'input[placeholder*="MM/YY" i]',
                 'input[aria-label*="expir" i]',
             ],
             exp_month: [
-                'input[name="exp-month"]',
+                '[autocomplete="cc-exp-month"]',
                 'select[name="exp-month"]',
-                'input[autocomplete="cc-exp-month"]',
+                'select[name="exp_month"]',
+                'select[name="card_exp_month"]',
+                'select[id*="exp-month" i]',
+                'select[id*="exp_month" i]',
+                'input[name="exp-month"]',
+                'input[name="exp_month"]',
             ],
             exp_year: [
-                'input[name="exp-year"]',
+                '[autocomplete="cc-exp-year"]',
                 'select[name="exp-year"]',
-                'input[autocomplete="cc-exp-year"]',
+                'select[name="exp_year"]',
+                'select[name="card_exp_year"]',
+                'select[id*="exp-year" i]',
+                'select[id*="exp_year" i]',
+                'input[name="exp-year"]',
+                'input[name="exp_year"]',
             ],
             cvv: [
+                '[autocomplete="cc-csc"]',
                 'input[name="cvc"]',
                 'input[name="cvv"]',
                 'input[name="cc-csc"]',
-                'input[autocomplete="cc-csc"]',
+                'input[name="security_code"]',
+                'input[name="checkout[payment][card_cvc]"]', // Shopify
+                'input[id="wc-stripe-cc-cvc"]', // WooCommerce
                 'input[placeholder*="CVC" i]',
                 'input[placeholder*="CVV" i]',
+                'input[placeholder*="security" i]',
                 'input[aria-label*="security code" i]',
+                'input[aria-label*="CVC" i]',
             ],
             name: [
+                '[autocomplete="cc-name"]',
                 'input[name="ccname"]',
                 'input[name="cc-name"]',
-                'input[autocomplete="cc-name"]',
+                'input[name="card-name"]',
+                'input[name="card_name"]',
                 'input[placeholder*="name on card" i]',
+                'input[placeholder*="cardholder" i]',
                 'input[aria-label*="name on card" i]',
             ],
         };
-        // Try to fill each field
         let filledFields = 0;
         // Card Number
-        for (const selector of standardSelectors.number) {
-            const el = await page.$(selector);
-            if (el) {
-                await el.fill(cardData.number);
+        if (await tryFillField(page, S.number, cardData.number))
+            filledFields++;
+        // Expiry: try combined MM/YY first
+        const expiryValue = `${cardData.exp_month}/${cardData.exp_year.slice(-2)}`;
+        let expiryFilled = await tryFillField(page, S.expiry, expiryValue);
+        if (expiryFilled)
+            filledFields++;
+        // Expiry: fallback to separate month + year (works with both <input> AND <select>)
+        if (!expiryFilled) {
+            if (await tryFillField(page, S.exp_month, cardData.exp_month))
                 filledFields++;
-                break;
-            }
-        }
-        // Expiry (combined MM/YY format)
-        let expiryFilled = false;
-        for (const selector of standardSelectors.expiry) {
-            const el = await page.$(selector);
-            if (el) {
-                await el.fill(`${cardData.exp_month}/${cardData.exp_year.slice(-2)}`);
+            if (await tryFillField(page, S.exp_year, cardData.exp_year))
                 filledFields++;
-                expiryFilled = true;
-                break;
-            }
-        }
-        // Expiry (separate month/year fields)
-        if (!expiryFilled) {
-            for (const selector of standardSelectors.exp_month) {
-                const el = await page.$(selector);
-                if (el) {
-                    await el.fill(cardData.exp_month);
-                    filledFields++;
-                    break;
-                }
-            }
-            for (const selector of standardSelectors.exp_year) {
-                const el = await page.$(selector);
-                if (el) {
-                    await el.fill(cardData.exp_year);
-                    filledFields++;
-                    break;
-                }
-            }
         }
         // CVV
-        for (const selector of standardSelectors.cvv) {
-            const el = await page.$(selector);
-            if (el) {
-                await el.fill(cardData.cvv);
-                filledFields++;
-                break;
-            }
-        }
+        if (await tryFillField(page, S.cvv, cardData.cvv))
+            filledFields++;
         // Name on Card
-        for (const selector of standardSelectors.name) {
-            const el = await page.$(selector);
-            if (el) {
-                await el.fill(cardData.name);
-                filledFields++;
-                break;
-            }
-        }
+        if (await tryFillField(page, S.name, cardData.name))
+            filledFields++;
         // ============================================================
         // STRATEGY 2: Stripe Elements (iframe-based)
+        // Stripe renders payment inputs inside iframes from js.stripe.com.
+        // Some merchants use __privateStripeFrame* named frames.
+        // Stripe has 2 modes:
+        //   - Unified: 1 iframe with all fields (card, exp, cvc in one)
+        //   - Split: separate iframes per field (cardNumber, cardExpiry, cardCvc)
+        // We handle both by scanning ALL matching Stripe frames.
         // ============================================================
         if (filledFields === 0) {
-            const stripeFrames = page.frames().filter((f) => f.url().includes("js.stripe.com"));
+            const stripeFrames = page.frames().filter((f) => {
+                const url = f.url();
+                const name = f.name();
+                return url.includes('js.stripe.com')
+                    || url.includes('stripe.com/elements')
+                    || name.startsWith('__privateStripeFrame');
+            });
             for (const frame of stripeFrames) {
-                const cardInput = await frame.$('input[name="cardnumber"]');
-                if (cardInput) {
-                    await cardInput.fill(cardData.number);
-                    filledFields++;
+                // Card Number
+                for (const sel of [
+                    'input[name="cardnumber"]',
+                    'input[autocomplete="cc-number"]',
+                    'input[data-elements-stable-field-name="cardNumber"]',
+                ]) {
+                    const el = await frame.$(sel);
+                    if (el) {
+                        await el.fill(cardData.number);
+                        filledFields++;
+                        break;
+                    }
                 }
-                const expInput = await frame.$('input[name="exp-date"]');
-                if (expInput) {
-                    await expInput.fill(`${cardData.exp_month}${cardData.exp_year.slice(-2)}`);
-                    filledFields++;
+                // Expiry (Stripe uses MM/YY without slash)
+                for (const sel of [
+                    'input[name="exp-date"]',
+                    'input[autocomplete="cc-exp"]',
+                    'input[data-elements-stable-field-name="cardExpiry"]',
+                ]) {
+                    const el = await frame.$(sel);
+                    if (el) {
+                        await el.fill(`${cardData.exp_month}${cardData.exp_year.slice(-2)}`);
+                        filledFields++;
+                        break;
+                    }
                 }
-                const cvcInput = await frame.$('input[name="cvc"]');
-                if (cvcInput) {
-                    await cvcInput.fill(cardData.cvv);
-                    filledFields++;
+                // CVC
+                for (const sel of [
+                    'input[name="cvc"]',
+                    'input[autocomplete="cc-csc"]',
+                    'input[data-elements-stable-field-name="cardCvc"]',
+                ]) {
+                    const el = await frame.$(sel);
+                    if (el) {
+                        await el.fill(cardData.cvv);
+                        filledFields++;
+                        break;
+                    }
                 }
             }
         }

package/dist/version.d.ts

@@ -0,0 +1 @@
+export declare const CURRENT_MCP_VERSION = "1.1.1";

package/dist/version.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURRENT_MCP_VERSION = void 0;
+// Single source of truth for MCP version
+// Imported by both index.ts and wdk_backend.ts to avoid circular dependency
+exports.CURRENT_MCP_VERSION = "1.1.1";

package/dist/wdk_backend.js

@@ -20,6 +20,8 @@ exports.refundUnderspendRemote = refundUnderspendRemote;
 const key_store_js_1 = require("./lib/key-store.js");
 const API_BASE_URL = process.env.Z_ZERO_API_BASE_URL || "https://www.clawcard.store";
 const INTERNAL_SECRET = process.env.Z_ZERO_INTERNAL_SECRET || "";
+// Injected at build time — always reflects the actual running version
+const version_js_1 = require("./version.js");
 if (!(0, key_store_js_1.hasPassportKey)()) {
     console.error("❌ ERROR: Z_ZERO_API_KEY (Passport Key) is missing!");
     console.error("🔐 Get your key: https://www.clawcard.store/dashboard/agents");
@@ -40,6 +42,7 @@ async function apiRequest(endpoint, method = 'GET', body = null) {
             headers: {
                 "Authorization": `Bearer ${PASSPORT_KEY}`,
                 "Content-Type": "application/json",
+                "X-MCP-Version": version_js_1.CURRENT_MCP_VERSION,
             },
             body: body ? JSON.stringify(body) : null,
         });
@@ -54,8 +57,9 @@ async function apiRequest(endpoint, method = 'GET', body = null) {
     }
 }
 async function internalApiRequest(endpoint, method, body) {
-    if (!INTERNAL_SECRET) {
-        return { error: "CONFIG_ERROR", message: "INTERNAL_SECRET not configured" };
+    // ✅ FIX 9: Validate INTERNAL_SECRET presence and minimum length
+    if (!INTERNAL_SECRET || INTERNAL_SECRET.length < 16) {
+        return { error: "CONFIG_ERROR", message: "INTERNAL_SECRET is missing or too short (min 16 chars)" };
     }
     const url = `${API_BASE_URL.replace(/\/$/, '')}${endpoint}`;
     try {
@@ -64,6 +68,7 @@ async function internalApiRequest(endpoint, method, body) {
             headers: {
                 "x-internal-secret": INTERNAL_SECRET,
                 "Content-Type": "application/json",
+                "X-MCP-Version": version_js_1.CURRENT_MCP_VERSION,
             },
             body: body ? JSON.stringify(body) : null,
         });
@@ -94,25 +99,19 @@ async function getBalanceRemote(cardAlias) {
     // finds connected WDK wallet, queries on-chain balance)
     const data = await apiRequest('/api/wdk/balance', 'GET');
     if (data?.error) {
-        // Fallback: try custodial balance if WDK not set up yet
-        const custodialData = await apiRequest('/api/tokens/cards', 'GET');
-        if (custodialData?.cards?.[0]) {
-            return {
-                wallet_balance: custodialData.cards[0].balance,
-                currency: 'USD',
-                mode: 'custodial_fallback',
-                note: 'WDK wallet not connected yet. Showing custodial balance.'
-            };
-        }
-        return data;
+        return {
+            error: true,
+            message: 'WDK wallet not connected. Create one at https://www.clawcard.store/dashboard/agent-wallet'
+        };
     }
     return {
         wallet_balance: data.balance_usdt,
         currency: 'USDT',
-        chain: data.chain || 'polygon',
+        chain: data.chain || 'ethereum',
         address: data.address,
+        tron_address: data.tron_address,
         mode: 'wdk_onchain',
-        note: `Non-custodial WDK wallet balance (live on-chain). Address: ${data.address}`
+        note: `Non-custodial WDK wallet. On-chain USDT balance. Address: ${data.address}`
     };
 }
 // ──────────────────────────────────────────────────────────────────────────────
@@ -121,22 +120,22 @@ async function getBalanceRemote(cardAlias) {
 async function getDepositAddressesRemote() {
     const data = await apiRequest('/api/wdk/balance', 'GET');
     if (data?.error) {
-        // Fallback to custodial addresses
-        const custodial = await apiRequest('/api/tokens/cards', 'GET');
         return {
-            ...custodial,
-            note: 'WDK wallet not connected. Showing custodial deposit addresses as fallback.'
+            error: true,
+            message: 'WDK wallet not connected. Create one at https://www.clawcard.store/dashboard/agent-wallet'
         };
     }
     return {
         cards: [{ alias: 'wdk-wallet', balance: data.balance_usdt, currency: 'USDT' }],
         deposit_addresses: {
-            polygon: data.address, // Primary: USDT on Polygon (ERC-20)
-            note: 'Send USDT (Polygon/ERC-20) to fund your Agent wallet. Gasless payments via ERC-4337.'
+            ethereum: data.address,
+            tron: data.tron_address || null,
+            note: 'Send USDT to your WDK wallet. Gasless via ERC-4337 Paymaster (Ethereum) or GasFree (Tron).'
         },
         wdk_wallet: {
             address: data.address,
-            chain: data.chain || 'polygon',
+            tron_address: data.tron_address || null,
+            chain: data.chain || 'ethereum',
             balance_usdt: data.balance_usdt
         }
     };
@@ -169,10 +168,11 @@ async function issueTokenRemote(cardAlias, amount, merchant) {
         amount,
         merchant,
         created_at: Date.now(),
-        ttl_seconds: 1800,
+        ttl_seconds: 3600,
         used: false,
-        tx_hash: data.tx_hash, // On-chain tx hash (for transparency)
-        mode: 'wdk_noncustodial'
+        tx_hash: data.tx_hash,
+        mode: 'wdk_noncustodial',
+        mcp_warning: data._mcp_warning || null, // Relay backend version warning to agent
     };
 }
 // ──────────────────────────────────────────────────────────────────────────────
@@ -182,11 +182,15 @@ async function resolveTokenRemote(token) {
     const data = await internalApiRequest('/api/tokens/resolve', 'POST', { token });
     if (!data || data.error)
         return data;
+    // ✅ FIX 7: Reject incomplete card data — don't silently fallback to fake values
+    if (!data.number || !data.cvv || !data.exp) {
+        return { error: "INCOMPLETE_CARD", message: "Card data missing required fields (number/cvv/exp). Token may be invalid or expired." };
+    }
     return {
         number: data.number,
-        exp_month: data.exp?.split('/')[0] || "12",
-        exp_year: "20" + (data.exp?.split('/')[1] || "30"),
-        cvv: data.cvv || "123",
+        exp_month: data.exp.split('/')[0],
+        exp_year: "20" + data.exp.split('/')[1],
+        cvv: data.cvv,
         name: data.name || "Z-ZERO AI AGENT",
         authorized_amount: data.authorized_amount ? Number(data.authorized_amount) : undefined,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "z-zero-mcp-server",
-    "version": "1.1.0",
+    "version": "1.1.1",
     "description": "Z-ZERO MCP Server — Secure JIT Virtual Card Payment tools for AI Agents (Claude, Cursor, AutoGPT) — Real Single-Use Visa Cards",
     "main": "dist/index.js",
     "bin": "dist/index.js",