@zeroxyz/cli 1.22.0 → 1.24.0

package/dist/index.js

@@ -78449,7 +78449,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-4FP2DRQJ.js
+// ../sdk/dist/chunk-76JAOSJC.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -143768,7 +143768,7 @@ config(en_default2());
 // ../../node_modules/.pnpm/zod@4.3.6/node_modules/zod/index.js
 var zod_default = external_exports3;
 
-// ../sdk/dist/chunk-4FP2DRQJ.js
+// ../sdk/dist/chunk-76JAOSJC.js
 var createManagedAccount = (client, address2, opts = {}) => {
   const signOptions = {
     // expectedAddress pins verification to this adapter's frozen address.
@@ -144269,7 +144269,13 @@ var tempoChainLabelFromId = (chainId2) => {
 };
 var paymentHasAnchor = (payment) => payment !== null && (payment.txHash !== null || payment.session !== void 0);
 var FETCH_WARNINGS = Object.freeze({
-  paidButStill402NotRecorded: "paid_but_still_402_not_recorded",
+  // Settlement landed on-chain but upstream still answered 402 (facilitator
+  // lag / race). Still a warning worth surfacing for reconciliation — but the
+  // run IS now recorded (it was the most expensive hole in run capture: a
+  // confirmed txHash with nothing pointing at what it bought). The old key
+  // was `paid_but_still_402_not_recorded`; the "not_recorded" half is no
+  // longer true.
+  paidButStill402: "paid_but_still_402",
   paymentSettlementUnconfirmed: "payment_settlement_unconfirmed",
   paymentAmountUnknown: "payment_amount_unknown",
   mppSessionCloseFailed: "mpp_session_close_failed",
@@ -144283,9 +144289,12 @@ var FETCH_WARNINGS = Object.freeze({
   bodyTruncated: "body_truncated"
 });
 var FETCH_SKIP_REASONS = Object.freeze({
+  // The body was lost, but the capability executed (and may have charged) —
+  // so this is a warning ON a recorded run now, not a reason to drop it.
   bodyReadFailed: "body_read_failed",
-  mppSessionCloseFailedNotRecorded: "mpp_session_close_failed_not_recorded",
-  paidButStill402NotRecorded: FETCH_WARNINGS.paidButStill402NotRecorded,
+  // The paid leg threw something other than a typed timeout/payment error —
+  // most importantly a caller abort, which can land after the money moved.
+  paidLegFailed: "paid_leg_failed",
   paymentSettlementUnconfirmed: FETCH_WARNINGS.paymentSettlementUnconfirmed,
   // Pre-sign abort: deliberately NOT recorded as a run — the wallet was
   // empty before we reached the capability, so charging it as a 402 would
@@ -145383,8 +145392,9 @@ var computeOutcome = (status, payment, warnings) => {
   if (status >= 400) return "server_error";
   return "success";
 };
-var errorFetchResult = (startedAt, error48, skipReason, capabilityIdRequested, outcome, status = null) => {
+var errorFetchResult = (fetchId, startedAt, error48, skipReason, capabilityIdRequested, outcome, status = null) => {
   const result = {
+    fetchId,
     runId: null,
     ok: false,
     status,
@@ -145398,25 +145408,50 @@ var errorFetchResult = (startedAt, error48, skipReason, capabilityIdRequested, o
   if (capabilityIdRequested) result.runTrackingSkipped = [skipReason];
   return result;
 };
+var settlementFields = (payment) => {
+  if (payment === null) return {};
+  const knownAmount = payment.amount !== "unknown";
+  return {
+    ...knownAmount && {
+      costAmount: payment.amount,
+      costAsset: payment.asset
+    },
+    paymentProtocol: payment.protocol,
+    paymentChain: payment.chain,
+    paymentTxHash: payment.txHash ?? void 0,
+    paymentMode: payment.session ? "session" : "charge"
+  };
+};
 var resolveRecordingClient = (client, opts) => {
   const credentials = client.getCredentials();
   const recordingClient = opts.account ? client.withAccount(opts.account) : client;
   const canRecord = opts.account !== void 0 || credentials.kind === "account" || credentials.kind === "session";
   return { recordingClient, canRecord };
 };
-var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride) => {
-  const effectiveCapId = opts.capabilityId;
-  if (effectiveCapId === void 0) return;
+var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride, requestUrl, requestMethod) => {
+  const effectiveCapId = capabilityIdOverride ?? opts.capabilityId;
+  const urlTarget = requestUrl ? {
+    requestUrl: redactUrl(requestUrl),
+    ...requestMethod && { requestMethod }
+  } : void 0;
+  const runTarget = effectiveCapId !== void 0 ? { capabilityId: effectiveCapId, ...urlTarget } : urlTarget ?? null;
+  if (runTarget === null) return;
   const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
   if (!canRecord) return;
-  const fetchOriginForRecord = opts.capabilityId === void 0 ? "direct_url" : isShortToken(effectiveCapId) ? "from_search" : opts.fetchOrigin;
+  const fetchOriginForRecord = opts.capabilityId === void 0 ? "direct_url" : effectiveCapId !== void 0 && isShortToken(effectiveCapId) ? "from_search" : opts.fetchOrigin;
   try {
     const created = await recordingClient.runs.create({
-      capabilityId: effectiveCapId,
+      ...runTarget,
+      fetchId: result.fetchId,
       ...opts.searchId && { searchId: opts.searchId },
       ...fetchOriginForRecord && { fetchOrigin: fetchOriginForRecord },
       ...result.status !== null && { status: result.status },
+      // The SDK's verdict. HTTP status alone can't say "the capability
+      // answered 200 but the caller got nothing" — outcome can.
+      outcome: result.outcome,
       latencyMs: result.latencyMs,
+      // Carry the settlement when the failure happened AFTER we paid.
+      ...settlementFields(result.payment),
       ...opts.requestSchema && { requestSchema: opts.requestSchema },
       ...opts.walletAddress && !opts.account && { walletAddress: opts.walletAddress }
     });
@@ -145425,15 +145460,23 @@ var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride) =>
   } catch {
   }
 };
-var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested, capabilityIdOverride) => {
+var recordTimeoutRun = async (client, opts, fetchId, err, startedAt, capabilityIdRequested, capabilityIdOverride, requestUrl, requestMethod) => {
   const result = errorFetchResult(
+    fetchId,
     startedAt,
     err.message,
     "timeout",
     capabilityIdRequested,
     "network_error"
   );
-  await recordErrorFetchRun(client, opts, result);
+  await recordErrorFetchRun(
+    client,
+    opts,
+    result,
+    capabilityIdOverride,
+    requestUrl,
+    requestMethod
+  );
 };
 var sniffJsonShapeBytes = (buf) => {
   let i = 0;
@@ -145460,6 +145503,7 @@ var withDefaultContentType = (headers, body) => {
 };
 var clientFetch = async (client, url4, opts = {}) => {
   const startedAt = Date.now();
+  const fetchId = randomUUID();
   const capabilityIdRequested = opts.capabilityId !== void 0;
   const normalized = normalizeTransportEnvelopeRequest(url4, {
     method: opts.method,
@@ -145494,22 +145538,34 @@ var clientFetch = async (client, url4, opts = {}) => {
       await recordTimeoutRun(
         client,
         opts,
+        fetchId,
         err,
         startedAt,
-        capabilityIdRequested
+        capabilityIdRequested,
+        void 0,
+        requestUrl,
+        method
       );
       throw err;
     }
     if (err instanceof ZeroError) throw err;
     const errMessage = err instanceof Error ? err.message : String(err);
     const result2 = errorFetchResult(
+      fetchId,
       startedAt,
       errMessage,
       "fetch_failed_before_response",
       capabilityIdRequested,
       "network_error"
     );
-    await recordErrorFetchRun(client, opts, result2);
+    await recordErrorFetchRun(
+      client,
+      opts,
+      result2,
+      void 0,
+      requestUrl,
+      method
+    );
     return result2;
   }
   if (response.status === 402) {
@@ -145554,6 +145610,7 @@ var clientFetch = async (client, url4, opts = {}) => {
           warnings.push(FETCH_WARNINGS.mppSessionCloseFailed);
         } else if (err instanceof ZeroInsufficientFundsError) {
           return errorFetchResult(
+            fetchId,
             startedAt,
             err.message,
             FETCH_SKIP_REASONS.insufficientFunds,
@@ -145563,6 +145620,7 @@ var clientFetch = async (client, url4, opts = {}) => {
           );
         } else if (err instanceof ZeroPaymentError || err instanceof ZeroAuthError) {
           const result2 = errorFetchResult(
+            fetchId,
             startedAt,
             err.message,
             "payment_failed",
@@ -145570,23 +145628,51 @@ var clientFetch = async (client, url4, opts = {}) => {
             "payment_failed",
             402
           );
-          await recordErrorFetchRun(client, opts, result2);
+          await recordErrorFetchRun(
+            client,
+            opts,
+            result2,
+            void 0,
+            requestUrl,
+            method
+          );
           return result2;
         } else if (err instanceof ZeroTimeoutError) {
           await recordTimeoutRun(
             client,
             opts,
+            fetchId,
             err,
             startedAt,
-            capabilityIdRequested
+            capabilityIdRequested,
+            void 0,
+            requestUrl,
+            method
           );
           throw err;
         } else {
+          const failed = errorFetchResult(
+            fetchId,
+            startedAt,
+            err instanceof Error ? err.message : String(err),
+            FETCH_SKIP_REASONS.paidLegFailed,
+            capabilityIdRequested,
+            "network_error"
+          );
+          await recordErrorFetchRun(
+            client,
+            opts,
+            failed,
+            void 0,
+            requestUrl,
+            method
+          );
           throw err;
         }
       }
     } else if (requirement?.protocol === "unknown") {
       const result2 = errorFetchResult(
+        fetchId,
         startedAt,
         opts.paymentProtocol ? `Capability did not advertise the requested ${opts.paymentProtocol} payment protocol.` : "Capability returned 402 with an unrecognized payment protocol. Neither x402 nor MPP markers were detected in the response headers or body.",
         "unrecognized_402_protocol",
@@ -145594,7 +145680,14 @@ var clientFetch = async (client, url4, opts = {}) => {
         "payment_failed",
         402
       );
-      await recordErrorFetchRun(client, opts, result2);
+      await recordErrorFetchRun(
+        client,
+        opts,
+        result2,
+        void 0,
+        requestUrl,
+        method
+      );
       return result2;
     }
   }
@@ -145611,6 +145704,26 @@ var clientFetch = async (client, url4, opts = {}) => {
     if (parsed.truncated) warnings.push(FETCH_WARNINGS.bodyTruncated);
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
+      const aborted2 = {
+        fetchId,
+        runId: null,
+        ok: false,
+        status: response.status,
+        latencyMs: Date.now() - startedAt,
+        payment,
+        outcome: "network_error",
+        body: null,
+        bodyRaw: null,
+        error: "Request aborted by caller"
+      };
+      await recordErrorFetchRun(
+        client,
+        opts,
+        aborted2,
+        (await resolvePromise.catch(() => null))?.capabilityId,
+        requestUrl,
+        method
+      );
       throw new ZeroApiError("Request aborted by caller", {
         status: 0,
         cause: err
@@ -145620,8 +145733,8 @@ var clientFetch = async (client, url4, opts = {}) => {
     const skips = [];
     const settledLocally = paymentHasAnchor(payment);
     if (settledLocally && response.status === 402) {
-      warnings.push(FETCH_WARNINGS.paidButStill402NotRecorded);
-      skips.push(FETCH_WARNINGS.paidButStill402NotRecorded);
+      warnings.push(FETCH_WARNINGS.paidButStill402);
+      skips.push(FETCH_WARNINGS.paidButStill402);
     }
     if (payment !== null && !settledLocally) {
       warnings.push(FETCH_WARNINGS.paymentSettlementUnconfirmed);
@@ -145632,42 +145745,52 @@ var clientFetch = async (client, url4, opts = {}) => {
     }
     skips.push(FETCH_SKIP_REASONS.bodyReadFailed);
     const result2 = {
+      fetchId,
       runId: null,
       ok: false,
       status: response.status,
       latencyMs: Date.now() - startedAt,
       payment,
-      outcome: computeOutcome(response.status, payment, warnings),
+      // The body never arrived, so this is NOT a success even when the wire
+      // said 2xx — `ok: false` with `outcome: "success"` was a contradiction,
+      // and it's what let these rows land in the DB as clean successes.
+      // Only the bogus "success" is overridden: a more specific verdict (an
+      // MPP close-fail whose body then dropped) must survive intact.
+      outcome: (() => {
+        const computed = computeOutcome(response.status, payment, warnings);
+        return computed === "success" ? "network_error" : computed;
+      })(),
       body: null,
       bodyRaw: null,
       error: message2
     };
     if (capabilityIdRequested) result2.runTrackingSkipped = skips;
     if (warnings.length > 0) result2.warnings = warnings;
+    await recordErrorFetchRun(
+      client,
+      opts,
+      result2,
+      (await resolvePromise.catch(() => null))?.capabilityId,
+      requestUrl,
+      method
+    );
     return result2;
   }
   const settled = paymentHasAnchor(payment);
   const paidButStill402 = settled && response.status === 402;
   const settlementUnconfirmed = payment !== null && !settled;
-  if (paidButStill402) warnings.push(FETCH_WARNINGS.paidButStill402NotRecorded);
+  if (paidButStill402) warnings.push(FETCH_WARNINGS.paidButStill402);
   if (settlementUnconfirmed)
     warnings.push(FETCH_WARNINGS.paymentSettlementUnconfirmed);
   if (payment !== null && payment.amount === "unknown") {
     warnings.push(FETCH_WARNINGS.paymentAmountUnknown);
   }
   let runId = null;
-  const closeFailed = warnings.includes(FETCH_WARNINGS.mppSessionCloseFailed);
   const upstreamErrorForRecord = buildUpstreamError(
     response.status,
     bodyRaw,
     bodyEncoding
   );
-  if (capabilityIdRequested) {
-    if (paidButStill402)
-      skipReasons.push(FETCH_WARNINGS.paidButStill402NotRecorded);
-    else if (closeFailed)
-      skipReasons.push(FETCH_SKIP_REASONS.mppSessionCloseFailedNotRecorded);
-  }
   const resolvedCap = await resolvePromise;
   const effectiveCapabilityId = opts.capabilityId ?? resolvedCap?.capabilityId;
   const capabilityResolution = !capabilityIdRequested && canRecordForResolve ? resolvedCap !== null ? {
@@ -145676,7 +145799,13 @@ var clientFetch = async (client, url4, opts = {}) => {
     capabilitySlug: resolvedCap.capabilitySlug,
     matchedVia: resolvedCap.matchedVia
   } : { resolved: false } : void 0;
-  if (effectiveCapabilityId !== void 0 && !paidButStill402 && !closeFailed) {
+  const runTarget = effectiveCapabilityId !== void 0 ? {
+    capabilityId: effectiveCapabilityId,
+    requestUrl: redactUrl(requestUrl),
+    requestMethod: method
+  } : { requestUrl: redactUrl(requestUrl), requestMethod: method };
+  const fetchOutcome = computeOutcome(response.status, payment, warnings);
+  {
     const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
     if (!canRecord) {
       skipReasons.push("no_credentials");
@@ -145696,12 +145825,17 @@ var clientFetch = async (client, url4, opts = {}) => {
           }
         }
         const result2 = await recordingClient.runs.create({
-          capabilityId: effectiveCapabilityId,
+          ...runTarget,
+          fetchId,
           searchId: opts.searchId,
           // Auto-resolved runs are always direct_url — they only fire when
           // no capabilityId was supplied (the direct_url path by definition).
           ...opts.capabilityId === void 0 ? { fetchOrigin: "direct_url" } : opts.fetchOrigin && { fetchOrigin: opts.fetchOrigin },
           status: response.status,
+          // The SDK's verdict alongside the raw status. A close-fail or a
+          // dropped body answers 200 while the caller got nothing — the
+          // server must not read that as a clean success.
+          outcome: fetchOutcome,
           latencyMs,
           // Attribute to the selected wallet in session mode. Skipped when a
           // per-call `account` override records the run — that account's own
@@ -145746,12 +145880,13 @@ var clientFetch = async (client, url4, opts = {}) => {
     }
   }
   const result = {
+    fetchId,
     runId,
     ok: response.ok,
     status: response.status,
     latencyMs,
     payment,
-    outcome: computeOutcome(response.status, payment, warnings),
+    outcome: fetchOutcome,
     body,
     bodyRaw
   };
@@ -145761,7 +145896,7 @@ var clientFetch = async (client, url4, opts = {}) => {
     result.error = candidate !== null && !requestBodyEchoed(candidate, opts.body) ? candidate : `HTTP ${response.status}`;
     if (upstreamErrorForRecord) result.upstreamError = upstreamErrorForRecord;
   }
-  if (capabilityIdRequested && skipReasons.length > 0) {
+  if (skipReasons.length > 0) {
     result.runTrackingSkipped = skipReasons;
   }
   if (warnings.length > 0) result.warnings = warnings;
@@ -145770,7 +145905,7 @@ var clientFetch = async (client, url4, opts = {}) => {
   return result;
 };
 var package_default = {
-  version: "0.15.0"
+  version: "0.17.0"
 };
 var SDK_VERSION2 = package_default.version;
 var agentAuthMetadataSchema = external_exports3.object({
@@ -146875,20 +147010,80 @@ var batchReviewResponseSchema = external_exports3.object({
     failed: external_exports3.number()
   })
 });
-var Runs = class {
+var Runs = class _Runs {
   constructor(client) {
     this.client = client;
   }
-  create = (input, opts = {}) => request2(
-    this.client,
-    {
-      method: "POST",
-      path: "/v1/runs",
-      body: input,
-      signal: opts.signal
-    },
-    createRunResponseSchema
-  );
+  /**
+   * Field generations, newest first. `/v1/runs` validates `.strict()`, so an
+   * unknown key is a 400 — not a warning. An SDK newer than its API would
+   * therefore have its run REJECTED and lost, which is precisely backwards:
+   * these fields exist to stop losing runs.
+   *
+   * So we degrade one generation at a time rather than all at once — an API
+   * that knows `requestUrl` (ZERO-536) but not `fetchId` must keep recording
+   * unattributed runs, which it can't do if we strip the target as well.
+   */
+  static FIELD_GENERATIONS = [
+    // Newest: correlation + honest classification.
+    ["fetchId", "outcome"],
+    // ZERO-536: the direct-URL target. Dropping this loses attribution for an
+    // unattributed run entirely — only worth trying against a truly old API.
+    ["requestUrl", "requestMethod"]
+  ];
+  /**
+   * Record a run, degrading to whatever the server actually understands.
+   *
+   * On a 400/422 we peel off one generation of newer fields and retry, so SDK
+   * and API can be deployed in ANY order (and a self-hosted or staging API that
+   * lags still records runs). The only unrescuable case is an unattributed run
+   * against an API that predates ZERO-536: strip `requestUrl` and there is no
+   * target left to name, so that server could never have recorded it.
+   */
+  create = async (input, opts = {}) => {
+    const post = (body) => request2(
+      this.client,
+      {
+        method: "POST",
+        path: "/v1/runs",
+        body,
+        signal: opts.signal
+      },
+      createRunResponseSchema
+    );
+    let payload = { ...input };
+    let generation = 0;
+    for (; ; ) {
+      try {
+        return await post(payload);
+      } catch (err) {
+        const rejected = err instanceof ZeroApiError && (err.status === 400 || err.status === 422);
+        if (!rejected) throw err;
+        let next = null;
+        let dropped = [];
+        while (generation < _Runs.FIELD_GENERATIONS.length) {
+          const fields = _Runs.FIELD_GENERATIONS[generation++];
+          const present = (fields ?? []).filter(
+            (f) => payload[f] !== void 0
+          );
+          if (present.length === 0) continue;
+          next = { ...payload };
+          for (const field of present) delete next[field];
+          dropped = present;
+          break;
+        }
+        if (!next || next.capabilityId === void 0 && next.requestUrl === void 0) {
+          throw err;
+        }
+        payload = next;
+        this.client.logger?.({
+          level: "warn",
+          message: "runs.create rejected by an older Zero API; retrying without newer fields",
+          meta: { droppedFields: dropped }
+        });
+      }
+    }
+  };
   list = (params = {}, opts = {}) => {
     if (params.limit === 0) {
       if (opts.signal?.aborted) {
@@ -147912,7 +148107,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.22.0"};
+  version: "1.24.0"};
 
 // src/app.ts
 init_esm_shims();
@@ -149648,6 +149843,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
       let searchId;
       let displayCostAmount;
       let fetchOrigin;
+      let runIsAttributed = true;
       if (fromToken) {
         capabilityUid = capFromNoUrl?.uid ?? null;
         capabilityId = options.capability ?? "";
@@ -149661,9 +149857,6 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         displayCostAmount = capFromNoUrl?.displayCostAmount;
         fetchOrigin = "direct_slug";
       } else {
-        const resolved = await client.capabilities.resolveByUrl(resolvedUrl, options.method ?? "GET").catch(() => null);
-        capabilityUid = resolved?.capabilityId ?? null;
-        capabilityId = capabilityUid;
         fetchOrigin = "direct_url";
       }
       const resultRank = void 0;
@@ -149747,6 +149940,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         return;
       }
       const {
+        fetchId,
         runId,
         status,
         latencyMs,
@@ -149844,6 +150038,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
             matchedVia: capabilityResolution.matchedVia
           });
         } else {
+          runIsAttributed = false;
           if (walletAddress && !runId) {
             cliSkipReasons.push(
               "no capability resolved \u2014 pass --capability <uid|slug|token> or run `zero search` first so the URL can be matched"
@@ -149856,6 +150051,11 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         }
       }
       analyticsService.capture("fetch_executed", {
+        // The correlation key: joins this client event to the server's
+        // run_started / run_completed / payment_processed, and to the run
+        // row itself. Works even when runId is null — i.e. exactly when
+        // the run failed to record, which is what we most need to trace.
+        fetchId,
         url: redactUrl2(resolvedUrl),
         status: status ?? void 0,
         outcome,
@@ -149978,7 +150178,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
             ...sdkWarnings?.length && { warnings: sdkWarnings }
           })
         );
-      } else if (runId && outcomeInfo.reviewable) {
+      } else if (runId && outcomeInfo.reviewable && runIsAttributed) {
         const isTTY = process.stderr.isTTY;
         const responded2xx = status !== null && status >= 200 && status < 300;
         console.error(`
@@ -150018,6 +150218,12 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         } else {
           console.error(`  zero review ${runId} --no-success`);
         }
+      } else if (runId && !runIsAttributed) {
+        console.error(`
+  Run ID: ${runId}`);
+        console.error(
+          `  This URL isn't an indexed capability, so the run can't be reviewed. Pass --capability <uid|slug> or run \`zero search\` first to bind it to one.`
+        );
       } else if (!runId && cliSkipReasons.length > 0) {
         console.error(
           `

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.22.0",
+	"version": "1.24.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",