z-zero-mcp-server 1.2.1 → 1.2.3

package/dist/index.js

@@ -524,7 +524,46 @@ server.tool("set_api_key", "Activate a new Passport Key instantly, no restart ne
         .string()
         .describe("The new Passport Key to activate. Must start with 'zk_live_' or 'zk_test_'. Get from: https://www.clawcard.store/dashboard/agents"),
 }, async ({ api_key }) => {
-    const result = (0, key_store_js_1.setPassportKey)(api_key);
+    // Step 1: Format validation
+    const trimmed = api_key.trim();
+    if (!trimmed.startsWith("zk_live_") && !trimmed.startsWith("zk_test_")) {
+        return {
+            content: [{ type: "text", text: `❌ Invalid key format — must start with "zk_live_" or "zk_test_".` }],
+            isError: true,
+        };
+    }
+    // Step 2: Validate new key against Dashboard API before swapping
+    const ZZERO_API = process.env.Z_ZERO_API_BASE || "https://www.clawcard.store";
+    try {
+        const resp = await fetch(`${ZZERO_API}/api/wdk/balance`, {
+            headers: {
+                "Authorization": `Bearer ${trimmed}`,
+                "x-mcp-version": version_js_2.CURRENT_MCP_VERSION,
+            },
+            signal: AbortSignal.timeout(8000),
+        });
+        if (resp.status === 401) {
+            return {
+                content: [{ type: "text", text: `❌ Key rejected by server — invalid or deactivated. Please check your key at https://www.clawcard.store/dashboard/agents` }],
+                isError: true,
+            };
+        }
+        // 426 = version outdated, but key itself could be valid — allow swap
+        if (!resp.ok && resp.status !== 426) {
+            return {
+                content: [{ type: "text", text: `❌ Could not validate key (server returned ${resp.status}). Try again later.` }],
+                isError: true,
+            };
+        }
+    }
+    catch (err) {
+        return {
+            content: [{ type: "text", text: `❌ Could not reach server to validate key: ${err?.message || 'timeout'}. Try again later.` }],
+            isError: true,
+        };
+    }
+    // Step 3: Swap key in RAM (old key is soft-revoked — just forgotten)
+    const result = (0, key_store_js_1.setPassportKey)(trimmed);
     if (!result.ok) {
         return {
             content: [{ type: "text", text: `❌ ${result.message}` }],
@@ -537,8 +576,8 @@ server.tool("set_api_key", "Activate a new Passport Key instantly, no restart ne
                 text: JSON.stringify({
                     status: "SUCCESS",
                     message: `✅ ${result.message}`,
-                    active_key_prefix: api_key.slice(0, 12) + "...",
-                    note: "All subsequent API calls will use this key. No restart needed.",
+                    active_key_prefix: trimmed.slice(0, 12) + "...",
+                    note: "All subsequent API calls will use this key. Previous key removed from this session (soft revoke).",
                 }, null, 2),
             }],
     };
@@ -555,7 +594,6 @@ server.tool("show_api_key_status", "Check if Passport Key is configured. Shows p
                 text: JSON.stringify({
                     configured: hasKey,
                     key_prefix: hasKey ? key.slice(0, 12) + "..." : null,
-                    wallet_mode: process.env.Z_ZERO_WALLET_MODE || "custodial",
                     note: hasKey
                         ? "Key is active. Call set_api_key to update it."
                         : "No key configured. Call set_api_key with your Passport Key from https://www.clawcard.store/dashboard/agents",

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CURRENT_MCP_VERSION = "1.1.2";
+export declare const CURRENT_MCP_VERSION: string;

package/dist/version.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CURRENT_MCP_VERSION = void 0;
-// Single source of truth for MCP version
-// Imported by both index.ts and wdk_backend.ts to avoid circular dependency
-exports.CURRENT_MCP_VERSION = "1.1.2";
+// Single source of truth: reads version from package.json at runtime
+// No need to manually sync — just run `npm version patch` and publish
+// eslint-disable-next-line @typescript-eslint/no-var-requires
+exports.CURRENT_MCP_VERSION = require("../package.json").version;

package/dist/wdk_backend.js

@@ -48,7 +48,7 @@ async function apiRequest(endpoint, method = 'GET', body = null) {
         });
         if (!res.ok) {
             const err = await res.json().catch(() => ({ error: res.statusText }));
-            return { error: "API_ERROR", message: err.error || res.statusText };
+            return { error: err.error || "API_ERROR", message: err.message || err.error || res.statusText };
         }
         return await res.json();
     }
@@ -74,7 +74,7 @@ async function internalApiRequest(endpoint, method, body) {
         });
         if (!res.ok) {
             const err = await res.json().catch(() => ({ error: res.statusText }));
-            return { error: "API_ERROR", message: err.error || res.statusText };
+            return { error: err.error || "API_ERROR", message: err.message || err.error || res.statusText };
         }
         return await res.json();
     }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "z-zero-mcp-server",
-    "version": "1.2.1",
+    "version": "1.2.3",
     "description": "Z-ZERO MCP Server — Secure JIT Virtual Card Payment tools for AI Agents (Claude, Cursor, AutoGPT) — Real Single-Use Visa Cards",
     "main": "dist/index.js",
     "bin": "dist/index.js",
@@ -8,6 +8,7 @@
         "build": "tsc",
         "start": "node dist/index.js",
         "dev": "npx tsx src/index.ts",
+        "prepublishOnly": "npm run build",
         "postinstall": "echo 'IMPORTANT: Run \"npx playwright install chromium\" to enable automated checkouts.'"
     },
     "keywords": [