@zeroxyz/cli 0.0.39 → 0.0.40

package/dist/index.js

@@ -7,7 +7,7 @@ import { join as join9 } from "path";
 // package.json
 var package_default = {
   name: "@zeroxyz/cli",
-  version: "0.0.39",
+  version: "0.0.40",
   type: "module",
   bin: {
     zero: "dist/index.js",
@@ -205,7 +205,11 @@ var searchResultSchema = z.object({
   reviewCount: z.number().optional(),
   rating: ratingSchema,
   availabilityStatus: z.enum(["healthy", "degraded", "down", "unknown"]).nullable().optional(),
-  displayStatus: z.enum(["healthy", "stable", "degraded", "unhealthy", "unknown"]).optional()
+  displayStatus: z.enum(["healthy", "stable", "degraded", "unhealthy", "unknown"]).optional(),
+  // Pass-through: API stamps this on Zero-published / withzero.{ai,xyz}
+  // services so `zero search --json` consumers can render their own
+  // provenance UI. CLI doesn't render a badge today.
+  isFirstParty: z.boolean().optional().default(false)
 });
 var searchResponseSchema = z.object({
   searchId: z.string(),
@@ -258,7 +262,9 @@ var capabilityResponseSchema = z.object({
   displayStatus: z.enum(["healthy", "stable", "degraded", "unhealthy", "unknown"]).optional(),
   activationCount: z.number().optional(),
   lastUsedAt: z.string().nullable().optional(),
-  lastSuccessfullyRanAt: z.string().nullable().optional()
+  lastSuccessfullyRanAt: z.string().nullable().optional(),
+  // Pass-through (see searchResultSchema). Available on `zero get --json`.
+  isFirstParty: z.boolean().optional().default(false)
 });
 var createRunResponseSchema = z.object({
   runId: z.string()
@@ -344,6 +350,16 @@ var userDtoSchema = z.object({
   createdAt: z.union([z.string(), z.date()]).optional(),
   lastLoginAt: z.union([z.string(), z.date()]).nullable().optional()
 });
+var userWalletDtoSchema = z.object({
+  walletAddress: z.string(),
+  source: z.enum(["self_custody", "privy_embedded"]),
+  isPrimary: z.boolean(),
+  linkedAt: z.union([z.string(), z.date()])
+});
+var signResultSchema = z.object({
+  signature: z.string(),
+  walletAddress: z.string()
+});
 var deviceStartResultSchema = z.object({
   deviceCode: z.string(),
   userCode: z.string(),
@@ -361,6 +377,10 @@ var devicePollResponseSchema = z.union([
     user: userDtoSchema
   })
 ]);
+var jsonStringifyBigintSafe = (value) => JSON.stringify(
+  value,
+  (_key, v) => typeof v === "bigint" ? v.toString() : v
+);
 var buildCanonicalMessage = (method, path, body, timestamp, nonce) => {
   const bodyHash = createHash("sha256").update(body ?? "").digest("hex");
   return `${method}:${path}:${bodyHash}:${timestamp}:${nonce}`;
@@ -378,6 +398,9 @@ var ApiService = class _ApiService {
   account;
   credentials;
   onSessionRefreshed;
+  setWalletAddress = (address) => {
+    this.walletAddress = address;
+  };
   withAccount = (account) => new _ApiService(this.baseUrl, account);
   signRequest = async (method, path, body) => {
     if (!this.account) throw new Error("No private key configured");
@@ -392,13 +415,28 @@ var ApiService = class _ApiService {
       "x-zero-signature": signature
     };
   };
-  // Session credentials take precedence over EIP-191. We never combine them
-  // in a single request: if the user has signed in, the JWT is the identity
-  // the API trusts, and the wallet signing path stays out of the picture.
-  buildHeaders = async (method, path, bodyStr) => {
+  // Auth modes per request. `this.account` is only ever the local private key
+  // (the managed Privy proxy lives on PaymentService, never here), so an
+  // account here means a BYO key is present.
+  //  - "default": session JWT takes precedence over EIP-191. If signed in, the
+  //    JWT is the identity the API trusts; otherwise fall back to a wallet
+  //    signature, else anonymous. Used by session-scoped endpoints
+  //    (/users/me, sign-*, wallets) and read endpoints.
+  //  - "wallet-attributed": the action is attributed to a wallet (runs,
+  //    reviews, bug reports). Prefer the local private key (EIP-191) so the run
+  //    is attributed to the wallet that actually paid; when there's no local
+  //    key (managed user) fall back to the session Bearer and let the server
+  //    resolve the wallet from the authenticated user. We never send both — a
+  //    present session would make the server skip EIP-191 verification, so a
+  //    Bearer + wallet headers combo must never happen.
+  buildHeaders = async (method, path, bodyStr, auth) => {
     const base2 = {
       "content-type": "application/json"
     };
+    if (auth === "wallet-attributed" && this.account) {
+      const walletHeaders = await this.signRequest(method, path, bodyStr);
+      return { ...base2, ...walletHeaders };
+    }
     if (this.credentials.kind === "session") {
       base2.authorization = `Bearer ${this.credentials.accessToken}`;
       return base2;
@@ -430,12 +468,13 @@ var ApiService = class _ApiService {
     await this.onSessionRefreshed(body);
     return true;
   };
-  request = async (method, path, body) => {
+  request = async (method, path, body, opts = {}) => {
     const url = `${this.baseUrl}${path}`;
-    const bodyStr = body ? JSON.stringify(body) : void 0;
+    const bodyStr = body ? jsonStringifyBigintSafe(body) : void 0;
+    const auth = opts.auth ?? "default";
     const makeInit = async () => ({
       method,
-      headers: await this.buildHeaders(method, path, bodyStr),
+      headers: await this.buildHeaders(method, path, bodyStr, auth),
       body: bodyStr
     });
     let response = await fetch(url, await makeInit());
@@ -504,7 +543,9 @@ var ApiService = class _ApiService {
     return capabilityResponseSchema.parse(json);
   };
   createRun = async (data) => {
-    const json = await this.request("POST", "/v1/runs", data);
+    const json = await this.request("POST", "/v1/runs", data, {
+      auth: "wallet-attributed"
+    });
     return createRunResponseSchema.parse(json);
   };
   listRuns = async (params = {}) => {
@@ -514,19 +555,32 @@ var ApiService = class _ApiService {
     if (params.limit) qs.set("limit", String(params.limit));
     if (params.cursor) qs.set("cursor", params.cursor);
     const suffix = qs.toString() ? `?${qs.toString()}` : "";
-    const json = await this.request("GET", `/v1/runs${suffix}`);
+    const json = await this.request("GET", `/v1/runs${suffix}`, void 0, {
+      auth: "wallet-attributed"
+    });
     return listRunsResponseSchema.parse(json);
   };
   createReview = async (data) => {
-    const json = await this.request("POST", "/v1/reviews", data);
+    const json = await this.request("POST", "/v1/reviews", data, {
+      auth: "wallet-attributed"
+    });
     return createReviewResponseSchema.parse(json);
   };
   createReviewsBatch = async (reviews) => {
-    const json = await this.request("POST", "/v1/reviews/batch", { reviews });
+    const json = await this.request(
+      "POST",
+      "/v1/reviews/batch",
+      { reviews },
+      {
+        auth: "wallet-attributed"
+      }
+    );
     return batchReviewResponseSchema.parse(json);
   };
   createBugReport = async (data) => {
-    const json = await this.request("POST", "/v1/bug-reports", data);
+    const json = await this.request("POST", "/v1/bug-reports", data, {
+      auth: "wallet-attributed"
+    });
     return createBugReportResponseSchema.parse(json);
   };
   getFundingUrl = async (amount, provider = "coinbase") => {
@@ -543,6 +597,44 @@ var ApiService = class _ApiService {
       return null;
     }
   };
+  getWallets = async () => {
+    const json = await this.request("GET", "/v1/users/me/wallets");
+    return z.array(userWalletDtoSchema).parse(json);
+  };
+  provisionWallet = async () => {
+    const json = await this.request("POST", "/v1/users/me/wallets/provision");
+    return userWalletDtoSchema.parse(json);
+  };
+  signTypedDataRemote = async (typedData) => {
+    const json = await this.request("POST", "/v1/users/me/sign-typed-data", {
+      typedData
+    });
+    const parsed = signResultSchema.parse(json);
+    return {
+      signature: parsed.signature,
+      walletAddress: parsed.walletAddress
+    };
+  };
+  signMessageRemote = async (message) => {
+    const json = await this.request("POST", "/v1/users/me/sign-message", {
+      message
+    });
+    const parsed = signResultSchema.parse(json);
+    return {
+      signature: parsed.signature,
+      walletAddress: parsed.walletAddress
+    };
+  };
+  signTransactionRemote = async (input) => {
+    const json = await this.request("POST", "/v1/users/me/sign-transaction", {
+      unsignedTransaction: input.unsignedTransaction
+    });
+    const parsed = signResultSchema.parse(json);
+    return {
+      signature: parsed.signature,
+      walletAddress: parsed.walletAddress
+    };
+  };
 };
 
 // src/commands/bug-report-command.ts
@@ -1139,6 +1231,11 @@ var PaymentService = class {
           `Insufficient pathUSD on Tempo testnet: have ${formatUnits(tempoBalance, 6)}, need ${capturedAmount}. Fund your wallet with the Tempo testnet faucet: https://docs.tempo.xyz/quickstart/faucet`
         );
       }
+      if (this.config.managed) {
+        throw new Error(
+          `Insufficient USDC on Tempo: have ${formatUnits(tempoBalance, 6)}, need ${capturedAmount}. Managed wallets can't auto-bridge from Base yet \u2014 fund your Tempo wallet${this.account ? ` (${this.account.address})` : ""} directly, or set a local ZERO_PRIVATE_KEY to bridge.`
+        );
+      }
       await this.bridgeToTempo(requiredRaw, onProgress);
     }
     return capturedAmount;
@@ -3822,6 +3919,7 @@ var envSchema = z4.object({
   ZERO_API_URL: z4.string().default("https://api.zero.xyz"),
   ZERO_WEB_URL: z4.string().default("https://zero.xyz"),
   ZERO_PRIVATE_KEY: z4.string().optional(),
+  ZERO_SESSION_TOKEN: z4.string().optional(),
   ZERO_ENV: z4.enum(["development", "production"]).default("production")
 });
 var getEnv = () => {
@@ -3888,15 +3986,17 @@ var AnalyticsService = class {
     } else {
       const newAnonId = randomUUID();
       this.distinctId = newAnonId;
-      try {
-        const dir = dirname2(opts.configPath);
-        mkdirSync4(dir, { recursive: true });
-        const existing = existsSync5(opts.configPath) ? JSON.parse(readFileSync9(opts.configPath, "utf8")) : {};
-        writeFileSync4(
-          opts.configPath,
-          JSON.stringify({ ...existing, anonId: newAnonId }, null, 2)
-        );
-      } catch {
+      if (!process.env.VITEST) {
+        try {
+          const dir = dirname2(opts.configPath);
+          mkdirSync4(dir, { recursive: true });
+          const existing = existsSync5(opts.configPath) ? JSON.parse(readFileSync9(opts.configPath, "utf8")) : {};
+          writeFileSync4(
+            opts.configPath,
+            JSON.stringify({ ...existing, anonId: newAnonId }, null, 2)
+          );
+        } catch {
+        }
       }
     }
     const originalConsoleError = console.error;
@@ -3939,6 +4039,7 @@ var AnalyticsService = class {
     }
     if (aliasedTo === walletAddress) return;
     this.posthog.alias({ distinctId: walletAddress, alias: anonId });
+    if (process.env.VITEST) return;
     try {
       const config = existsSync5(configPath) ? JSON.parse(readFileSync9(configPath, "utf8")) : {};
       writeFileSync4(
@@ -4015,6 +4116,34 @@ var AnalyticsService = class {
   }
 };
 
+// src/services/api-account.ts
+import {
+  bytesToHex,
+  parseSignature,
+  serializeTransaction
+} from "viem";
+import { toAccount } from "viem/accounts";
+var createApiAccount = (walletAddress, api) => toAccount({
+  address: walletAddress,
+  async signMessage({ message }) {
+    const asMessage = typeof message === "string" ? message : typeof message.raw === "string" ? message.raw : bytesToHex(message.raw);
+    const { signature } = await api.signMessageRemote(asMessage);
+    return signature;
+  },
+  async signTypedData(typedData) {
+    const { signature } = await api.signTypedDataRemote(typedData);
+    return signature;
+  },
+  async signTransaction(transaction, options) {
+    const serialize = options?.serializer ?? serializeTransaction;
+    const unsigned = await serialize(transaction);
+    const { signature } = await api.signTransactionRemote({
+      unsignedTransaction: unsigned
+    });
+    return await serialize(transaction, parseSignature(signature));
+  }
+});
+
 // src/services/state-service.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { join as join6 } from "path";
@@ -4154,30 +4283,20 @@ var detectAgentHost = (env = process.env) => {
 // src/app/app-services.ts
 var CLI_VERSION = package_default.version;
 var resolveCredentials = (env, config) => {
-  if (config.session) {
-    return {
-      credentials: {
-        kind: "session",
-        accessToken: config.session.accessToken,
-        refreshToken: config.session.refreshToken,
-        userId: config.session.userId
-      },
-      privateKey: null
-    };
-  }
-  if (env.ZERO_PRIVATE_KEY) {
-    return {
-      credentials: { kind: "none" },
-      privateKey: env.ZERO_PRIVATE_KEY
-    };
-  }
-  if (config.privateKey) {
-    return {
-      credentials: { kind: "none" },
-      privateKey: config.privateKey
-    };
-  }
-  return { credentials: { kind: "none" }, privateKey: null };
+  const injectedToken = env.ZERO_SESSION_TOKEN;
+  const credentials = injectedToken ? {
+    kind: "session",
+    accessToken: injectedToken,
+    refreshToken: "",
+    userId: ""
+  } : config.session ? {
+    kind: "session",
+    accessToken: config.session.accessToken,
+    refreshToken: config.session.refreshToken,
+    userId: config.session.userId
+  } : { kind: "none" };
+  const privateKey = env.ZERO_PRIVATE_KEY ?? config.privateKey ?? null;
+  return { credentials, privateKey };
 };
 var buildOnSessionRefreshed = (configPath) => async (tokens) => {
   const current = readConfig(configPath);
@@ -4192,20 +4311,34 @@ var buildOnSessionRefreshed = (configPath) => async (tokens) => {
   };
   writeSecureFile(configPath, JSON.stringify(next, null, 2));
 };
-var getServices = (env) => {
+var getServices = async (env) => {
   const zeroDir = join7(homedir6(), ".zero");
   const configPath = join7(zeroDir, "config.json");
   const config = existsSync7(configPath) ? readConfig(configPath) : {};
   const { credentials, privateKey } = resolveCredentials(env, config);
-  const account = privateKey ? privateKeyToAccount4(privateKey) : null;
   const lowBalanceWarning = typeof config.lowBalanceWarning === "number" ? config.lowBalanceWarning : 1;
   const apiService = new ApiService(
     env.ZERO_API_URL,
-    account,
+    privateKey ? privateKeyToAccount4(privateKey) : null,
     credentials,
     buildOnSessionRefreshed(configPath)
   );
-  const paymentService = new PaymentService(account, { lowBalanceWarning });
+  let account = privateKey ? privateKeyToAccount4(privateKey) : null;
+  let managed = false;
+  if (!account && credentials.kind === "session") {
+    const address = await resolveManagedWalletAddress(apiService);
+    if (address) {
+      account = createApiAccount(address, apiService);
+      managed = true;
+    }
+  }
+  if (account && !apiService.walletAddress) {
+    apiService.setWalletAddress(account.address);
+  }
+  const paymentService = new PaymentService(account, {
+    lowBalanceWarning,
+    managed
+  });
   const stateService = new StateService(zeroDir);
   const walletService = new WalletService(
     apiService.walletAddress,
@@ -4228,16 +4361,29 @@ var getServices = (env) => {
     walletService
   };
 };
+var resolveManagedWalletAddress = async (api) => {
+  try {
+    const wallets = await api.getWallets();
+    const primary = wallets.find(
+      (w) => w.source === "privy_embedded" && w.isPrimary
+    );
+    if (primary) return primary.walletAddress;
+    const provisioned = await api.provisionWallet();
+    return provisioned.walletAddress ?? null;
+  } catch {
+    return null;
+  }
+};
 
 // src/app/app-context.ts
-var createAppContext = () => {
+var createAppContext = async () => {
   const env = getEnv();
   if (!env) {
     return null;
   }
   return {
     env,
-    services: getServices(env),
+    services: await getServices(env),
     invocation: { current: null }
   };
 };
@@ -4393,7 +4539,7 @@ var maybePrintUpdateBanner = (zeroDir, currentVersion) => {
 
 // src/index.ts
 var main = async () => {
-  const appContext = createAppContext();
+  const appContext = await createAppContext();
   if (!appContext) {
     console.error("Failed to create app context");
     process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "0.0.39",
+	"version": "0.0.40",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",