@zeroxyz/cli 1.27.1 → 1.29.0

package/dist/index.js

@@ -9486,12 +9486,12 @@ var init_getCallError = __esm({
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/utils/promise/withResolvers.js
 function withResolvers() {
   let resolve7 = () => void 0;
-  let reject = () => void 0;
+  let reject2 = () => void 0;
   const promise3 = new Promise((resolve_, reject_) => {
     resolve7 = resolve_;
-    reject = reject_;
+    reject2 = reject_;
   });
-  return { promise: promise3, resolve: resolve7, reject };
+  return { promise: promise3, resolve: resolve7, reject: reject2 };
 }
 var init_withResolvers = __esm({
   "../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/utils/promise/withResolvers.js"() {
@@ -9516,8 +9516,8 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait3 = 0, sort
       }
     }).catch((err) => {
       for (let i = 0; i < scheduler.length; i++) {
-        const { reject } = scheduler[i];
-        reject?.(err);
+        const { reject: reject2 } = scheduler[i];
+        reject2?.(err);
       }
     });
   };
@@ -9528,16 +9528,16 @@ function createBatchScheduler({ fn, id, shouldSplitBatch, wait: wait3 = 0, sort
   return {
     flush,
     async schedule(args) {
-      const { promise: promise3, resolve: resolve7, reject } = withResolvers();
+      const { promise: promise3, resolve: resolve7, reject: reject2 } = withResolvers();
       const split3 = shouldSplitBatch?.([...getBatchedArgs(), args]);
       if (split3)
         exec();
       const hasActiveScheduler = getScheduler().length > 0;
       if (hasActiveScheduler) {
-        setScheduler({ args, resolve: resolve7, reject });
+        setScheduler({ args, resolve: resolve7, reject: reject2 });
         return promise3;
       }
-      setScheduler({ args, resolve: resolve7, reject });
+      setScheduler({ args, resolve: resolve7, reject: reject2 });
       setTimeout(exec, wait3);
       return promise3;
     }
@@ -27585,12 +27585,12 @@ var init_getCallError2 = __esm({
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@3.25.76/node_modules/viem/_esm/utils/promise/withResolvers.js
 function withResolvers2() {
   let resolve7 = () => void 0;
-  let reject = () => void 0;
+  let reject2 = () => void 0;
   const promise3 = new Promise((resolve_, reject_) => {
     resolve7 = resolve_;
-    reject = reject_;
+    reject2 = reject_;
   });
-  return { promise: promise3, resolve: resolve7, reject };
+  return { promise: promise3, resolve: resolve7, reject: reject2 };
 }
 var init_withResolvers2 = __esm({
   "../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@3.25.76/node_modules/viem/_esm/utils/promise/withResolvers.js"() {
@@ -27615,8 +27615,8 @@ function createBatchScheduler2({ fn, id, shouldSplitBatch, wait: wait3 = 0, sort
       }
     }).catch((err) => {
       for (let i = 0; i < scheduler.length; i++) {
-        const { reject } = scheduler[i];
-        reject?.(err);
+        const { reject: reject2 } = scheduler[i];
+        reject2?.(err);
       }
     });
   };
@@ -27627,16 +27627,16 @@ function createBatchScheduler2({ fn, id, shouldSplitBatch, wait: wait3 = 0, sort
   return {
     flush,
     async schedule(args) {
-      const { promise: promise3, resolve: resolve7, reject } = withResolvers2();
+      const { promise: promise3, resolve: resolve7, reject: reject2 } = withResolvers2();
       const split3 = shouldSplitBatch?.([...getBatchedArgs(), args]);
       if (split3)
         exec();
       const hasActiveScheduler = getScheduler().length > 0;
       if (hasActiveScheduler) {
-        setScheduler({ args, resolve: resolve7, reject });
+        setScheduler({ args, resolve: resolve7, reject: reject2 });
         return promise3;
       }
-      setScheduler({ args, resolve: resolve7, reject });
+      setScheduler({ args, resolve: resolve7, reject: reject2 });
       setTimeout(exec, wait3);
       return promise3;
     }
@@ -40848,19 +40848,19 @@ function __awaiter(thisArg, _arguments, P, generator) {
       resolve7(value);
     });
   }
-  return new (P || (P = Promise))(function(resolve7, reject) {
+  return new (P || (P = Promise))(function(resolve7, reject2) {
     function fulfilled(value) {
       try {
         step(generator.next(value));
       } catch (e) {
-        reject(e);
+        reject2(e);
       }
     }
     function rejected(value) {
       try {
         step(generator["throw"](value));
       } catch (e) {
-        reject(e);
+        reject2(e);
       }
     }
     function step(result) {
@@ -41001,7 +41001,7 @@ function __asyncGenerator(thisArg, _arguments, generator) {
   }, i;
   function awaitReturn(f) {
     return function(v) {
-      return Promise.resolve(v).then(f, reject);
+      return Promise.resolve(v).then(f, reject2);
     };
   }
   function verb(n, f) {
@@ -41022,12 +41022,12 @@ function __asyncGenerator(thisArg, _arguments, generator) {
     }
   }
   function step(r) {
-    r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject) : settle3(q[0][2], r);
+    r.value instanceof __await ? Promise.resolve(r.value.v).then(fulfill, reject2) : settle3(q[0][2], r);
   }
   function fulfill(value) {
     resume("next", value);
   }
-  function reject(value) {
+  function reject2(value) {
     resume("throw", value);
   }
   function settle3(f, v) {
@@ -41055,15 +41055,15 @@ function __asyncValues(o) {
   }, i);
   function verb(n) {
     i[n] = o[n] && function(v) {
-      return new Promise(function(resolve7, reject) {
-        v = o[n](v), settle3(resolve7, reject, v.done, v.value);
+      return new Promise(function(resolve7, reject2) {
+        v = o[n](v), settle3(resolve7, reject2, v.done, v.value);
       });
     };
   }
-  function settle3(resolve7, reject, d, v) {
+  function settle3(resolve7, reject2, d, v) {
     Promise.resolve(v).then(function(v2) {
       resolve7({ value: v2, done: d });
-    }, reject);
+    }, reject2);
   }
 }
 function __makeTemplateObject(cooked, raw) {
@@ -42094,17 +42094,17 @@ var require_geturl = __commonJS({
           request3.write(Buffer.from(body));
         }
         request3.end();
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve7, reject2) => {
           if (signal) {
             signal.addListener(() => {
               if (abort) {
                 abort.abort();
               }
-              reject((0, errors_js_1.makeError)("request cancelled", "CANCELLED"));
+              reject2((0, errors_js_1.makeError)("request cancelled", "CANCELLED"));
             });
           }
           request3.on("timeout", () => {
-            reject((0, errors_js_1.makeError)("request timeout", "TIMEOUT"));
+            reject2((0, errors_js_1.makeError)("request timeout", "TIMEOUT"));
           });
           request3.once("response", (resp) => {
             const statusCode = resp.statusCode || 0;
@@ -42123,7 +42123,7 @@ var require_geturl = __commonJS({
                 try {
                   signal.checkSignal();
                 } catch (error98) {
-                  return reject(error98);
+                  return reject2(error98);
                 }
               }
               if (body2 == null) {
@@ -42142,7 +42142,7 @@ var require_geturl = __commonJS({
                 }
                 resolve7({ statusCode, statusMessage, headers: headers2, body: body2 });
               } catch (error98) {
-                reject((0, errors_js_1.makeError)("bad response data", "SERVER_ERROR", {
+                reject2((0, errors_js_1.makeError)("bad response data", "SERVER_ERROR", {
                   request: req,
                   info: { response: resp, error: error98 }
                 }));
@@ -42150,11 +42150,11 @@ var require_geturl = __commonJS({
             });
             resp.on("error", (error98) => {
               error98.response = { statusCode, statusMessage, headers: headers2, body: body2 };
-              reject(error98);
+              reject2(error98);
             });
           });
           request3.on("error", (error98) => {
-            reject(error98);
+            reject2(error98);
           });
         });
       }
@@ -56762,7 +56762,7 @@ var require_provider = __commonJS({
             return null;
           }
         }
-        const waiter = new Promise((resolve7, reject) => {
+        const waiter = new Promise((resolve7, reject2) => {
           const cancellers = [];
           const cancel2 = () => {
             cancellers.forEach((c) => c());
@@ -56773,7 +56773,7 @@ var require_provider = __commonJS({
           if (timeout > 0) {
             const timer = setTimeout(() => {
               cancel2();
-              reject((0, index_js_1.makeError)("wait for transaction timeout", "TIMEOUT"));
+              reject2((0, index_js_1.makeError)("wait for transaction timeout", "TIMEOUT"));
             }, timeout);
             cancellers.push(() => {
               clearTimeout(timer);
@@ -56785,7 +56785,7 @@ var require_provider = __commonJS({
               try {
                 resolve7(checkReceipt(receipt2));
               } catch (error98) {
-                reject(error98);
+                reject2(error98);
               }
             }
           };
@@ -56800,7 +56800,7 @@ var require_provider = __commonJS({
               } catch (error98) {
                 if ((0, index_js_1.isError)(error98, "TRANSACTION_REPLACED")) {
                   cancel2();
-                  reject(error98);
+                  reject2(error98);
                   return;
                 }
               }
@@ -57732,7 +57732,7 @@ var require_contract = __commonJS({
         }
         const provider = getProvider(this.runner);
         (0, index_js_3.assert)(provider != null, "contract runner does not support .provider", "UNSUPPORTED_OPERATION", { operation: "waitForDeployment" });
-        return new Promise((resolve7, reject) => {
+        return new Promise((resolve7, reject2) => {
           const checkCode = async () => {
             try {
               const code2 = await this.getDeployedCode();
@@ -57741,7 +57741,7 @@ var require_contract = __commonJS({
               }
               provider.once("block", checkCode);
             } catch (error98) {
-              reject(error98);
+              reject2(error98);
             }
           };
           checkCode();
@@ -60484,7 +60484,7 @@ var require_abstract_provider = __commonJS({
         if (confirms === 0) {
           return this.getTransactionReceipt(hash13);
         }
-        return new Promise(async (resolve7, reject) => {
+        return new Promise(async (resolve7, reject2) => {
           let timer = null;
           const listener = (async (blockNumber) => {
             try {
@@ -60511,7 +60511,7 @@ var require_abstract_provider = __commonJS({
               }
               timer = null;
               this.off("block", listener);
-              reject((0, index_js_6.makeError)("timeout", "TIMEOUT", { reason: "timeout" }));
+              reject2((0, index_js_6.makeError)("timeout", "TIMEOUT", { reason: "timeout" }));
             }, timeout);
           }
           listener(await this.getBlockNumber());
@@ -61476,7 +61476,7 @@ var require_provider_jsonrpc = __commonJS({
       async sendTransaction(tx) {
         const blockNumber = await this.provider.getBlockNumber();
         const hash13 = await this.sendUncheckedTransaction(tx);
-        return await new Promise((resolve7, reject) => {
+        return await new Promise((resolve7, reject2) => {
           const timeouts = [1e3, 100];
           let invalids = 0;
           const checkTx = async () => {
@@ -61492,7 +61492,7 @@ var require_provider_jsonrpc = __commonJS({
                   error98.info = {};
                 }
                 error98.info.sendTransactionHash = hash13;
-                reject(error98);
+                reject2(error98);
                 return;
               }
               if ((0, index_js_5.isError)(error98, "INVALID_ARGUMENT")) {
@@ -61502,7 +61502,7 @@ var require_provider_jsonrpc = __commonJS({
                 }
                 error98.info.sendTransactionHash = hash13;
                 if (invalids > 10) {
-                  reject(error98);
+                  reject2(error98);
                   return;
                 }
               }
@@ -61601,9 +61601,9 @@ var require_provider_jsonrpc = __commonJS({
               try {
                 const result = await this._send(payload);
                 this.emit("debug", { action: "receiveRpcResult", result });
-                for (const { resolve: resolve7, reject, payload: payload2 } of batch) {
+                for (const { resolve: resolve7, reject: reject2, payload: payload2 } of batch) {
                   if (this.destroyed) {
-                    reject((0, index_js_5.makeError)("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: payload2.method }));
+                    reject2((0, index_js_5.makeError)("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: payload2.method }));
                     continue;
                   }
                   const resp = result.filter((r) => r.id === payload2.id)[0];
@@ -61613,19 +61613,19 @@ var require_provider_jsonrpc = __commonJS({
                       info: { payload: payload2 }
                     });
                     this.emit("error", error98);
-                    reject(error98);
+                    reject2(error98);
                     continue;
                   }
                   if ("error" in resp) {
-                    reject(this.getRpcError(payload2, resp));
+                    reject2(this.getRpcError(payload2, resp));
                     continue;
                   }
                   resolve7(resp.result);
                 }
               } catch (error98) {
                 this.emit("debug", { action: "receiveRpcError", error: error98 });
-                for (const { reject } of batch) {
-                  reject(error98);
+                for (const { reject: reject2 } of batch) {
+                  reject2(error98);
                 }
               }
             })();
@@ -62058,10 +62058,10 @@ var require_provider_jsonrpc = __commonJS({
           return Promise.reject((0, index_js_5.makeError)("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: method }));
         }
         const id = this.#nextId++;
-        const promise3 = new Promise((resolve7, reject) => {
+        const promise3 = new Promise((resolve7, reject2) => {
           this.#payloads.push({
             resolve: resolve7,
-            reject,
+            reject: reject2,
             payload: { method, params, id, jsonrpc: "2.0" }
           });
         });
@@ -62113,8 +62113,8 @@ var require_provider_jsonrpc = __commonJS({
           clearTimeout(this.#drainTimer);
           this.#drainTimer = null;
         }
-        for (const { payload, reject } of this.#payloads) {
-          reject((0, index_js_5.makeError)("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: payload.method }));
+        for (const { payload, reject: reject2 } of this.#payloads) {
+          reject2((0, index_js_5.makeError)("provider destroyed; cancelled request", "UNSUPPORTED_OPERATION", { operation: payload.method }));
         }
         this.#payloads = [];
         super.destroy();
@@ -62738,10 +62738,10 @@ var require_provider_etherscan = __commonJS({
        *
        *  If %%post%%, the request is made as a POST request.
        */
-      async fetch(module2, params, post) {
+      async fetch(module2, params, post2) {
         const id = nextId++;
-        const url4 = post ? this.getPostUrl() : this.getUrl(module2, params);
-        const payload = post ? this.getPostData(module2, params) : null;
+        const url4 = post2 ? this.getPostUrl() : this.getUrl(module2, params);
+        const payload = post2 ? this.getPostData(module2, params) : null;
         this.emit("debug", { action: "sendRequest", id, url: url4, payload });
         const request3 = new index_js_4.FetchRequest(url4);
         request3.setThrottleParams({ slotInterval: 1e3 });
@@ -67057,8 +67057,8 @@ var require_provider_socket = __commonJS({
       }
       async _send(payload) {
         (0, index_js_1.assertArgument)(!Array.isArray(payload), "WebSocket does not support batch send", "payload", payload);
-        const promise3 = new Promise((resolve7, reject) => {
-          this.#callbacks.set(payload.id, { payload, resolve: resolve7, reject });
+        const promise3 = new Promise((resolve7, reject2) => {
+          this.#callbacks.set(payload.id, { payload, resolve: resolve7, reject: reject2 });
         });
         await this._waitUntilReady();
         await this._write(JSON.stringify(payload));
@@ -68348,7 +68348,7 @@ var require_provider_browser = __commonJS({
         if (timeout === 0) {
           return null;
         }
-        return await new Promise((resolve7, reject) => {
+        return await new Promise((resolve7, reject2) => {
           let found = [];
           const addProvider = (event) => {
             found.push(event.detail);
@@ -68377,7 +68377,7 @@ var require_provider_browser = __commonJS({
                       providerInfo: info
                     }));
                   } else {
-                    reject((0, index_js_1.makeError)("filter returned unknown info", "UNSUPPORTED_OPERATION", {
+                    reject2((0, index_js_1.makeError)("filter returned unknown info", "UNSUPPORTED_OPERATION", {
                       value: filtered
                     }));
                   }
@@ -72900,19 +72900,19 @@ var require_utils7 = __commonJS({
           resolve7(value);
         });
       }
-      return new (P || (P = Promise))(function(resolve7, reject) {
+      return new (P || (P = Promise))(function(resolve7, reject2) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
           } catch (e) {
-            reject(e);
+            reject2(e);
           }
         }
         function rejected(value) {
           try {
             step(generator["throw"](value));
           } catch (e) {
-            reject(e);
+            reject2(e);
           }
         }
         function step(result) {
@@ -73009,19 +73009,19 @@ var require_client = __commonJS({
           resolve7(value);
         });
       }
-      return new (P || (P = Promise))(function(resolve7, reject) {
+      return new (P || (P = Promise))(function(resolve7, reject2) {
         function fulfilled(value) {
           try {
             step(generator.next(value));
           } catch (e) {
-            reject(e);
+            reject2(e);
           }
         }
         function rejected(value) {
           try {
             step(generator["throw"](value));
           } catch (e) {
-            reject(e);
+            reject2(e);
           }
         }
         function step(result) {
@@ -73165,13 +73165,13 @@ var require_client = __commonJS({
        */
       verify(params, opts = { suppressExceptions: false }) {
         return __awaiter2(this, void 0, void 0, function* () {
-          return new Promise((resolve7, reject) => {
+          return new Promise((resolve7, reject2) => {
             var _a4, _b, _c;
             const fail = (result) => {
               if (opts.suppressExceptions) {
                 return resolve7(result);
               } else {
-                return reject(result);
+                return reject2(result);
               }
             };
             const invalidParams = (0, utils_1.checkInvalidKeys)(params, types_1.VerifyParamsKeys);
@@ -78668,7 +78668,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-MQZT5KEN.js
+// ../sdk/dist/chunk-5334O6ZN.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -80519,9 +80519,9 @@ init_esm_shims();
 init_esm_shims();
 init_utils3();
 async function wait(time5, { signal } = {}) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     if (signal?.aborted) {
-      reject(getAbortError(signal));
+      reject2(getAbortError(signal));
       return;
     }
     const cleanup = () => signal?.removeEventListener("abort", onAbort);
@@ -80532,7 +80532,7 @@ async function wait(time5, { signal } = {}) {
     const onAbort = () => {
       clearTimeout(timeout);
       cleanup();
-      reject(getAbortError(signal));
+      reject2(getAbortError(signal));
     };
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -81104,10 +81104,10 @@ init_withResolvers();
 init_esm_shims();
 init_utils3();
 function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shouldRetry3 = () => true, signal } = {}) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     const attemptRetry = async ({ count = 0 } = {}) => {
       if (signal?.aborted) {
-        reject(getAbortError(signal));
+        reject2(getAbortError(signal));
         return;
       }
       const retry = async ({ error: error98 }) => {
@@ -81116,7 +81116,7 @@ function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shoul
           try {
             await wait(delay, { signal });
           } catch (err) {
-            reject(err);
+            reject2(err);
             return;
           }
         }
@@ -81127,16 +81127,16 @@ function withRetry(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shoul
         resolve7(data);
       } catch (err) {
         if (signal?.aborted) {
-          reject(getAbortError(signal));
+          reject2(getAbortError(signal));
           return;
         }
         if (isAbortError(err)) {
-          reject(err);
+          reject2(err);
           return;
         }
         if (count < retryCount && await shouldRetry3({ count, error: err }))
           return retry({ error: err });
-        reject(err);
+        reject2(err);
       }
     };
     attemptRetry();
@@ -81383,9 +81383,9 @@ async function waitForCallsStatus(client, parameters) {
     throwOnFailure = false
   } = parameters;
   const observerId = stringify(["waitForCallsStatus", client.uid, id]);
-  const { promise: promise3, resolve: resolve7, reject } = withResolvers();
+  const { promise: promise3, resolve: resolve7, reject: reject2 } = withResolvers();
   let timer;
-  const unobserve = observe(observerId, { resolve: resolve7, reject }, (emit) => {
+  const unobserve = observe(observerId, { resolve: resolve7, reject: reject2 }, (emit) => {
     const unpoll = poll(async () => {
       const done = (fn) => {
         clearTimeout(timer);
@@ -81418,7 +81418,7 @@ async function waitForCallsStatus(client, parameters) {
   timer = timeout ? setTimeout(() => {
     unobserve();
     clearTimeout(timer);
-    reject(new WaitForCallsStatusTimeoutError({ id }));
+    reject2(new WaitForCallsStatusTimeoutError({ id }));
   }, timeout) : void 0;
   return await promise3;
 }
@@ -83259,7 +83259,7 @@ init_utils3();
 init_esm_shims();
 init_utils3();
 function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     (async () => {
       let timeoutId;
       const controller = new AbortController();
@@ -83274,10 +83274,10 @@ function withTimeout(fn, { errorInstance = new Error("timed out"), timeout, sign
         resolve7(await fn({ signal: controller?.signal || null }));
       } catch (err) {
         if (controller?.signal.aborted && isAbortError(err)) {
-          reject(errorInstance);
+          reject2(errorInstance);
           return;
         }
-        reject(err);
+        reject2(err);
       } finally {
         clearTimeout(timeoutId);
       }
@@ -87200,13 +87200,13 @@ async function waitForTransactionReceipt(client, parameters) {
   let retrying = false;
   let _unobserve;
   let _unwatch;
-  const { promise: promise3, resolve: resolve7, reject } = withResolvers();
+  const { promise: promise3, resolve: resolve7, reject: reject2 } = withResolvers();
   const timer = timeout ? setTimeout(() => {
     _unwatch?.();
     _unobserve?.();
-    reject(new WaitForTransactionReceiptTimeoutError({ hash: hash13 }));
+    reject2(new WaitForTransactionReceiptTimeoutError({ hash: hash13 }));
   }, timeout) : void 0;
-  _unobserve = observe(observerId, { onReplaced, resolve: resolve7, reject }, async (emit) => {
+  _unobserve = observe(observerId, { onReplaced, resolve: resolve7, reject: reject2 }, async (emit) => {
     receipt = await getAction(client, getTransactionReceipt, "getTransactionReceipt")({ hash: hash13 }).catch(() => void 0);
     if (receipt && confirmations <= 1) {
       clearTimeout(timer);
@@ -100663,12 +100663,12 @@ init_esm_shims();
 
 // ../../node_modules/.pnpm/axios@1.15.0/node_modules/axios/lib/core/settle.js
 init_esm_shims();
-function settle(resolve7, reject, response) {
+function settle(resolve7, reject2, response) {
   const validateStatus2 = response.config.validateStatus;
   if (!response.status || !validateStatus2 || validateStatus2(response.status)) {
     resolve7(response);
   } else {
-    reject(
+    reject2(
       new AxiosError_default(
         "Request failed with status code " + response.status,
         [AxiosError_default.ERR_BAD_REQUEST, AxiosError_default.ERR_BAD_RESPONSE][Math.floor(response.status / 100) - 4],
@@ -101469,7 +101469,7 @@ function setProxy(options, configProxy, location2) {
 }
 var isHttpAdapterSupported = typeof process !== "undefined" && utils_default.kindOf(process) === "process";
 var wrapAsync = (asyncExecutor) => {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     let onDone;
     let isDone;
     const done = (value, isRejected) => {
@@ -101483,7 +101483,7 @@ var wrapAsync = (asyncExecutor) => {
     };
     const _reject = (reason) => {
       done(reason, true);
-      reject(reason);
+      reject2(reason);
     };
     asyncExecutor(_resolve, _reject, (onDoneHandler) => onDone = onDoneHandler).catch(_reject);
   });
@@ -101526,7 +101526,7 @@ var http2Transport = {
   }
 };
 var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
-  return wrapAsync(async function dispatchHttpRequest(resolve7, reject, onDone) {
+  return wrapAsync(async function dispatchHttpRequest(resolve7, reject2, onDone) {
     let { data, lookup, family, httpVersion = 1, http2Options } = config3;
     const { responseType, responseEncoding } = config3;
     const method = config3.method.toUpperCase();
@@ -101564,7 +101564,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
         console.warn("emit error", err);
       }
     }
-    abortEmitter.once("abort", reject);
+    abortEmitter.once("abort", reject2);
     const onFinished = () => {
       if (config3.cancelToken) {
         config3.cancelToken.unsubscribe(abort);
@@ -101605,7 +101605,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
         const dataUrl = String(config3.url || fullPath || "");
         const estimated = estimateDataURLDecodedBytes(dataUrl);
         if (estimated > config3.maxContentLength) {
-          return reject(
+          return reject2(
             new AxiosError_default(
               "maxContentLength size of " + config3.maxContentLength + " exceeded",
               AxiosError_default.ERR_BAD_RESPONSE,
@@ -101616,7 +101616,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       }
       let convertedData;
       if (method !== "GET") {
-        return settle(resolve7, reject, {
+        return settle(resolve7, reject2, {
           status: 405,
           statusText: "method not allowed",
           headers: {},
@@ -101638,7 +101638,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       } else if (responseType === "stream") {
         convertedData = stream3.Readable.from(convertedData);
       }
-      return settle(resolve7, reject, {
+      return settle(resolve7, reject2, {
         data: convertedData,
         status: 200,
         statusText: "OK",
@@ -101647,7 +101647,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       });
     }
     if (supportedProtocols.indexOf(protocol) === -1) {
-      return reject(
+      return reject2(
         new AxiosError_default("Unsupported protocol " + protocol, AxiosError_default.ERR_BAD_REQUEST, config3)
       );
     }
@@ -101688,7 +101688,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       } else if (utils_default.isString(data)) {
         data = Buffer.from(data, "utf-8");
       } else {
-        return reject(
+        return reject2(
           new AxiosError_default(
             "Data after transformation must be a string, an ArrayBuffer, a Buffer, or a Stream",
             AxiosError_default.ERR_BAD_REQUEST,
@@ -101698,7 +101698,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       }
       headers.setContentLength(data.length, false);
       if (config3.maxBodyLength > -1 && data.length > config3.maxBodyLength) {
-        return reject(
+        return reject2(
           new AxiosError_default(
             "Request body larger than maxBodyLength limit",
             AxiosError_default.ERR_BAD_REQUEST,
@@ -101762,7 +101762,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       customErr.config = config3;
       customErr.url = config3.url;
       customErr.exists = true;
-      return reject(customErr);
+      return reject2(customErr);
     }
     headers.set(
       "Accept-Encoding",
@@ -101878,7 +101878,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       };
       if (responseType === "stream") {
         response.data = responseStream;
-        settle(resolve7, reject, response);
+        settle(resolve7, reject2, response);
       } else {
         const responseBuffer = [];
         let totalResponseBytes = 0;
@@ -101909,11 +101909,11 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
             lastRequest
           );
           responseStream.destroy(err);
-          reject(err);
+          reject2(err);
         });
         responseStream.on("error", function handleStreamError(err) {
           if (req.destroyed) return;
-          reject(AxiosError_default.from(err, null, config3, lastRequest));
+          reject2(AxiosError_default.from(err, null, config3, lastRequest));
         });
         responseStream.on("end", function handleStreamEnd() {
           try {
@@ -101926,9 +101926,9 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
             }
             response.data = responseData;
           } catch (err) {
-            return reject(AxiosError_default.from(err, null, config3, response.request, response));
+            return reject2(AxiosError_default.from(err, null, config3, response.request, response));
           }
-          settle(resolve7, reject, response);
+          settle(resolve7, reject2, response);
         });
       }
       abortEmitter.once("abort", (err) => {
@@ -101946,7 +101946,7 @@ var http_default = isHttpAdapterSupported && function httpAdapter(config3) {
       }
     });
     req.on("error", function handleRequestError(err) {
-      reject(AxiosError_default.from(err, null, config3, req));
+      reject2(AxiosError_default.from(err, null, config3, req));
     });
     req.on("socket", function handleRequestSocket(socket) {
       socket.setKeepAlive(true, 1e3 * 60);
@@ -102197,7 +102197,7 @@ var resolveConfig_default = (config3) => {
 // ../../node_modules/.pnpm/axios@1.15.0/node_modules/axios/lib/adapters/xhr.js
 var isXHRAdapterSupported = typeof XMLHttpRequest !== "undefined";
 var xhr_default = isXHRAdapterSupported && function(config3) {
-  return new Promise(function dispatchXhrRequest(resolve7, reject) {
+  return new Promise(function dispatchXhrRequest(resolve7, reject2) {
     const _config = resolveConfig_default(config3);
     let requestData = _config.data;
     const requestHeaders = AxiosHeaders_default.from(_config.headers).normalize();
@@ -102236,7 +102236,7 @@ var xhr_default = isXHRAdapterSupported && function(config3) {
           done();
         },
         function _reject(err) {
-          reject(err);
+          reject2(err);
           done();
         },
         response
@@ -102260,14 +102260,14 @@ var xhr_default = isXHRAdapterSupported && function(config3) {
       if (!request3) {
         return;
       }
-      reject(new AxiosError_default("Request aborted", AxiosError_default.ECONNABORTED, config3, request3));
+      reject2(new AxiosError_default("Request aborted", AxiosError_default.ECONNABORTED, config3, request3));
       request3 = null;
     };
     request3.onerror = function handleError(event) {
       const msg = event && event.message ? event.message : "Network Error";
       const err = new AxiosError_default(msg, AxiosError_default.ERR_NETWORK, config3, request3);
       err.event = event || null;
-      reject(err);
+      reject2(err);
       request3 = null;
     };
     request3.ontimeout = function handleTimeout() {
@@ -102276,7 +102276,7 @@ var xhr_default = isXHRAdapterSupported && function(config3) {
       if (_config.timeoutErrorMessage) {
         timeoutErrorMessage = _config.timeoutErrorMessage;
       }
-      reject(
+      reject2(
         new AxiosError_default(
           timeoutErrorMessage,
           transitional2.clarifyTimeoutError ? AxiosError_default.ETIMEDOUT : AxiosError_default.ECONNABORTED,
@@ -102312,7 +102312,7 @@ var xhr_default = isXHRAdapterSupported && function(config3) {
         if (!request3) {
           return;
         }
-        reject(!cancel2 || cancel2.type ? new CanceledError_default(null, config3, request3) : cancel2);
+        reject2(!cancel2 || cancel2.type ? new CanceledError_default(null, config3, request3) : cancel2);
         request3.abort();
         request3 = null;
       };
@@ -102323,7 +102323,7 @@ var xhr_default = isXHRAdapterSupported && function(config3) {
     }
     const protocol = parseProtocol(_config.url);
     if (protocol && platform_default.protocols.indexOf(protocol) === -1) {
-      reject(
+      reject2(
         new AxiosError_default(
           "Unsupported protocol " + protocol + ":",
           AxiosError_default.ERR_BAD_REQUEST,
@@ -102637,8 +102637,8 @@ var factory = (env) => {
         config3
       );
       !isStreamResponse && unsubscribe && unsubscribe();
-      return await new Promise((resolve7, reject) => {
-        settle(resolve7, reject, {
+      return await new Promise((resolve7, reject2) => {
+        settle(resolve7, reject2, {
           data: responseData,
           headers: AxiosHeaders_default.from(response.headers),
           status: response.status,
@@ -103082,7 +103082,7 @@ var CancelToken = class _CancelToken {
         token.subscribe(resolve7);
         _resolve = resolve7;
       }).then(onfulfilled);
-      promise3.cancel = function reject() {
+      promise3.cancel = function reject2() {
         token.unsubscribe(_resolve);
       };
       return promise3;
@@ -104614,8 +104614,8 @@ async function executeSteps(chainId2, request3 = {}, wallet, setState, newJson,
       websocketFailedPromise = new Promise((resolve7) => {
         resolveWebsocketFailed = resolve7;
       });
-      terminalStatusPromise = new Promise((_, reject) => {
-        rejectTerminalStatus = reject;
+      terminalStatusPromise = new Promise((_, reject2) => {
+        rejectTerminalStatus = reject2;
       });
       statusControl.closeWebSocket = trackRequestStatus({
         event: "request.status.updated",
@@ -104662,7 +104662,7 @@ async function executeSteps(chainId2, request3 = {}, wallet, setState, newJson,
     let { kind } = step;
     client.log([`Execute Steps: Begin processing step items for: ${step.action}`], LogLevel.Verbose);
     const promises = stepItems.filter((stepItem) => stepItem.status === "incomplete").map((stepItem) => {
-      return new Promise(async (resolve7, reject) => {
+      return new Promise(async (resolve7, reject2) => {
         try {
           const stepExecutionPromise = (async () => {
             switch (kind) {
@@ -104736,7 +104736,7 @@ async function executeSteps(chainId2, request3 = {}, wallet, setState, newJson,
               details: json3?.details
             });
           }
-          reject(error98);
+          reject2(error98);
         }
       });
     });
@@ -105604,7 +105604,7 @@ function execute(data) {
     }
     const { request: request3, ...restOfQuote } = quote;
     const _quote = safeStructuredClone(restOfQuote);
-    const executionPromise = new Promise((resolve7, reject) => {
+    const executionPromise = new Promise((resolve7, reject2) => {
       executeSteps(chainId2, request3, adaptedWallet, ({ steps, fees, breakdown, details, refunded, error: error98 }) => {
         if (abortController.signal.aborted) {
           console.log("Relay SDK: Execution aborted, skipping progress callback");
@@ -105628,7 +105628,7 @@ function execute(data) {
         }
       } : void 0).then((data2) => {
         resolve7({ data: data2, abortController });
-      }).catch(reject);
+      }).catch(reject2);
     });
     executionPromise.abortController = abortController;
     return executionPromise;
@@ -112457,9 +112457,9 @@ init_esm_shims();
 init_esm_shims();
 init_utils6();
 async function wait2(time5, { signal } = {}) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     if (signal?.aborted) {
-      reject(getAbortError2(signal));
+      reject2(getAbortError2(signal));
       return;
     }
     const cleanup = () => signal?.removeEventListener("abort", onAbort);
@@ -112470,7 +112470,7 @@ async function wait2(time5, { signal } = {}) {
     const onAbort = () => {
       clearTimeout(timeout);
       cleanup();
-      reject(getAbortError2(signal));
+      reject2(getAbortError2(signal));
     };
     signal?.addEventListener("abort", onAbort, { once: true });
   });
@@ -112774,10 +112774,10 @@ async function sendRawTransaction2(client, { serializedTransaction }) {
 init_esm_shims();
 init_utils6();
 function withRetry2(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shouldRetry3 = () => true, signal } = {}) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     const attemptRetry = async ({ count = 0 } = {}) => {
       if (signal?.aborted) {
-        reject(getAbortError2(signal));
+        reject2(getAbortError2(signal));
         return;
       }
       const retry = async ({ error: error98 }) => {
@@ -112786,7 +112786,7 @@ function withRetry2(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shou
           try {
             await wait2(delay, { signal });
           } catch (err) {
-            reject(err);
+            reject2(err);
             return;
           }
         }
@@ -112797,16 +112797,16 @@ function withRetry2(fn, { delay: delay_ = 100, retryCount = 2, shouldRetry: shou
         resolve7(data);
       } catch (err) {
         if (signal?.aborted) {
-          reject(getAbortError2(signal));
+          reject2(getAbortError2(signal));
           return;
         }
         if (isAbortError2(err)) {
-          reject(err);
+          reject2(err);
           return;
         }
         if (count < retryCount && await shouldRetry3({ count, error: err }))
           return retry({ error: err });
-        reject(err);
+        reject2(err);
       }
     };
     attemptRetry();
@@ -114121,7 +114121,7 @@ init_utils6();
 init_esm_shims();
 init_utils6();
 function withTimeout2(fn, { errorInstance = new Error("timed out"), timeout, signal }) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     (async () => {
       let timeoutId;
       const controller = new AbortController();
@@ -114136,10 +114136,10 @@ function withTimeout2(fn, { errorInstance = new Error("timed out"), timeout, sig
         resolve7(await fn({ signal: controller?.signal || null }));
       } catch (err) {
         if (controller?.signal.aborted && isAbortError2(err)) {
-          reject(errorInstance);
+          reject2(errorInstance);
           return;
         }
-        reject(err);
+        reject2(err);
       } finally {
         clearTimeout(timeoutId);
       }
@@ -117455,13 +117455,13 @@ async function waitForTransactionReceipt2(client, parameters) {
   let retrying = false;
   let _unobserve;
   let _unwatch;
-  const { promise: promise3, resolve: resolve7, reject } = withResolvers2();
+  const { promise: promise3, resolve: resolve7, reject: reject2 } = withResolvers2();
   const timer = timeout ? setTimeout(() => {
     _unwatch?.();
     _unobserve?.();
-    reject(new WaitForTransactionReceiptTimeoutError2({ hash: hash13 }));
+    reject2(new WaitForTransactionReceiptTimeoutError2({ hash: hash13 }));
   }, timeout) : void 0;
-  _unobserve = observe2(observerId, { onReplaced, resolve: resolve7, reject }, async (emit) => {
+  _unobserve = observe2(observerId, { onReplaced, resolve: resolve7, reject: reject2 }, async (emit) => {
     receipt = await getAction2(client, getTransactionReceipt2, "getTransactionReceipt")({ hash: hash13 }).catch(() => void 0);
     if (receipt && confirmations <= 1) {
       clearTimeout(timer);
@@ -146840,8 +146840,8 @@ function sessionManager(parameters) {
   function waitForReceipt(predicate = () => true) {
     if (receiptWaiter)
       throw new Error("receipt wait already in progress");
-    return new Promise((resolve7, reject) => {
-      receiptWaiter = { predicate, resolve: resolve7, reject };
+    return new Promise((resolve7, reject2) => {
+      receiptWaiter = { predicate, resolve: resolve7, reject: reject2 };
     });
   }
   function waitForCloseReady() {
@@ -146849,8 +146849,8 @@ function sessionManager(parameters) {
       return Promise.resolve(closeReadyReceipt);
     if (closeReadyWaiter)
       throw new Error("close-ready wait already in progress");
-    return new Promise((resolve7, reject) => {
-      closeReadyWaiter = { resolve: resolve7, reject };
+    return new Promise((resolve7, reject2) => {
+      closeReadyWaiter = { resolve: resolve7, reject: reject2 };
     });
   }
   function settleReceipt(receipt) {
@@ -147188,7 +147188,7 @@ function sessionManager(parameters) {
         }
       };
       const isExpectedReceipt = (receipt) => receipt.challengeId === challenge2.id && receipt.channelId === activeSocketChannelId;
-      const socketOpened = new Promise((resolve7, reject) => {
+      const socketOpened = new Promise((resolve7, reject2) => {
         const onOpen = () => {
           rawSocket.removeEventListener("error", onError);
           managedSocket.emit("open", { type: "open" });
@@ -147196,7 +147196,7 @@ function sessionManager(parameters) {
         };
         const onError = () => {
           rawSocket.removeEventListener("open", onOpen);
-          reject(new Error(`WebSocket connection to ${wsUrl} failed to open.`));
+          reject2(new Error(`WebSocket connection to ${wsUrl} failed to open.`));
         };
         rawSocket.addEventListener("open", onOpen, { once: true });
         rawSocket.addEventListener("error", onError, { once: true });
@@ -148849,8 +148849,8 @@ function createSingleWaiter(name) {
     wait(predicate = () => true) {
       if (waiter)
         throw new Error(`${name} wait already in progress`);
-      return new Promise((resolve7, reject) => {
-        waiter = { predicate, resolve: resolve7, reject };
+      return new Promise((resolve7, reject2) => {
+        waiter = { predicate, resolve: resolve7, reject: reject2 };
       });
     },
     settle(value) {
@@ -149454,7 +149454,7 @@ async function openWebSocketSession(parameters) {
   return managedSocket.socket;
 }
 function waitForSocketOpen(rawSocket, managedEmit, wsUrl) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     const onOpen = () => {
       rawSocket.removeEventListener("error", onError);
       managedEmit("open", { type: "open" });
@@ -149462,7 +149462,7 @@ function waitForSocketOpen(rawSocket, managedEmit, wsUrl) {
     };
     const onError = () => {
       rawSocket.removeEventListener("open", onOpen);
-      reject(new Error(`WebSocket connection to ${wsUrl} failed to open.`));
+      reject2(new Error(`WebSocket connection to ${wsUrl} failed to open.`));
     };
     rawSocket.addEventListener("open", onOpen, { once: true });
     rawSocket.addEventListener("error", onError, { once: true });
@@ -164225,6 +164225,135 @@ var ERC20_BALANCE_ABI = [
   }
 ];
 var USDC_DECIMALS = 6;
+var FETCH_DIAGNOSTIC_CODES = Object.freeze({
+  capabilityResolutionFailed: "capability_resolution_failed",
+  probeTimeout: "probe_timeout",
+  probeNetworkError: "probe_network_error",
+  challengeDecodeFailed: "challenge_decode_failed",
+  unsupportedPaymentRail: "unsupported_payment_rail",
+  invalidMaxPay: "invalid_max_pay",
+  maxPayExceeded: "max_pay_exceeded",
+  walletResolutionFailed: "wallet_resolution_failed",
+  balanceCheckFailed: "balance_check_failed",
+  insufficientFunds: "insufficient_funds",
+  bridgeFailed: "bridge_failed",
+  credentialSignFailed: "credential_sign_failed",
+  paymentFailed: "payment_failed",
+  paidReplayTimeout: "paid_replay_timeout",
+  paidReplayFailed: "paid_replay_failed",
+  paymentRejected: "payment_rejected",
+  settlementUnconfirmed: "settlement_unconfirmed",
+  settlementReceiptInvalid: "settlement_receipt_invalid",
+  sessionCloseFailed: "session_close_failed",
+  upstream4xx: "upstream_4xx",
+  upstream5xx: "upstream_5xx",
+  upstreamErrorPayload: "upstream_error_payload",
+  bodyReadFailed: "body_read_failed",
+  bodyTruncated: "body_truncated",
+  callerAborted: "caller_aborted",
+  runCreateFailed: "run_create_failed"
+});
+var UNCONFIRMED_PAYMENT_CODES = /* @__PURE__ */ new Set([
+  FETCH_DIAGNOSTIC_CODES.paidReplayTimeout,
+  FETCH_DIAGNOSTIC_CODES.paidReplayFailed,
+  FETCH_DIAGNOSTIC_CODES.paymentFailed,
+  FETCH_DIAGNOSTIC_CODES.paymentRejected,
+  FETCH_DIAGNOSTIC_CODES.settlementUnconfirmed,
+  FETCH_DIAGNOSTIC_CODES.callerAborted
+]);
+var FetchDiagnosticContext = class {
+  fetchId;
+  failureStage = null;
+  failureCode = null;
+  issues = [];
+  stageDurationsMs = {};
+  paymentProtocol = null;
+  paymentMode = null;
+  fundingSource = null;
+  constructor(fetchId) {
+    this.fetchId = fetchId;
+  }
+  recordDuration = (stage, startedAt) => {
+    const duration5 = Math.max(0, Date.now() - startedAt);
+    this.stageDurationsMs[stage] = (this.stageDurationsMs[stage] ?? 0) + duration5;
+  };
+  measure = async (stage, work) => {
+    const startedAt = Date.now();
+    try {
+      return await work();
+    } finally {
+      this.recordDuration(stage, startedAt);
+    }
+  };
+  issue = (stage, code) => {
+    if (!this.issues.some((item) => item.stage === stage && item.code === code)) {
+      this.issues.push({ stage, code });
+    }
+  };
+  fail = (stage, code) => {
+    this.issue(stage, code);
+    if (this.failureStage === null) {
+      this.failureStage = stage;
+      this.failureCode = code;
+    }
+  };
+  selectPaymentProtocol = (protocol) => {
+    this.paymentProtocol = protocol;
+  };
+  setPaymentMode = (mode) => {
+    this.paymentMode = mode;
+  };
+  setFundingSource = (source) => {
+    this.fundingSource = source;
+  };
+  snapshot = () => ({
+    failureStage: this.failureStage,
+    failureCode: this.failureCode,
+    issues: this.issues.map((issue3) => ({ ...issue3 })),
+    paymentProtocol: this.paymentProtocol,
+    paymentMode: this.paymentMode,
+    fundingSource: this.fundingSource,
+    stageDurationsMs: { ...this.stageDurationsMs }
+  });
+};
+var settlementStateFor = (payment, warnings, diagnostics) => {
+  if (warnings?.includes("mpp_session_close_failed")) return "session_open";
+  if (diagnostics?.paymentMode === "proof") return "not_attempted";
+  if (payment !== null && (payment.txHash !== null || payment.session !== void 0))
+    return "confirmed";
+  if (payment !== null) return "unconfirmed";
+  const paymentMayHaveBeenSent = diagnostics?.issues.some(
+    (issue3) => UNCONFIRMED_PAYMENT_CODES.has(issue3.code)
+  );
+  return paymentMayHaveBeenSent ? "unconfirmed" : "not_attempted";
+};
+var isCallerAbortError = (error98) => {
+  const record3 = typeof error98 === "object" && error98 !== null ? error98 : null;
+  if (record3?.name === "AbortError") return true;
+  if (record3?.code !== "api_error" || record3.status !== 0) return false;
+  const cause = typeof record3.cause === "object" && record3.cause !== null ? record3.cause : null;
+  return cause?.name === "AbortError";
+};
+var attachFetchErrorContext = (error98, fetchId, diagnostics) => {
+  if (typeof error98 !== "object" && typeof error98 !== "function" || error98 === null) {
+    return;
+  }
+  try {
+    Object.defineProperties(error98, {
+      fetchId: { configurable: true, value: fetchId },
+      diagnostics: { configurable: true, value: diagnostics }
+    });
+  } catch {
+  }
+};
+var fetchErrorContext = (error98) => {
+  if (typeof error98 !== "object" || error98 === null) return {};
+  const value = error98;
+  return {
+    ...typeof value.fetchId === "string" && { fetchId: value.fetchId },
+    ...value.diagnostics && typeof value.diagnostics === "object" ? { diagnostics: value.diagnostics } : {}
+  };
+};
 var ERROR_MAX = 500;
 var redactUrl = (raw) => {
   try {
@@ -164236,7 +164365,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.20.0"
+  version: "0.22.0"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -164587,9 +164716,9 @@ var buildAccountAuthHeaders = async (account, method, pathWithQuery, body) => {
   };
 };
 var RETRYABLE_STATUS = /* @__PURE__ */ new Set([408, 502, 503, 504]);
-var sleep = (ms, signal) => new Promise((resolve7, reject) => {
+var sleep = (ms, signal) => new Promise((resolve7, reject2) => {
   if (signal?.aborted) {
-    reject(new DOMException("Aborted", "AbortError"));
+    reject2(new DOMException("Aborted", "AbortError"));
     return;
   }
   const timer = setTimeout(() => {
@@ -164598,7 +164727,7 @@ var sleep = (ms, signal) => new Promise((resolve7, reject) => {
   }, ms);
   const onAbort = () => {
     clearTimeout(timer);
-    reject(new DOMException("Aborted", "AbortError"));
+    reject2(new DOMException("Aborted", "AbortError"));
   };
   signal?.addEventListener("abort", onAbort, { once: true });
 });
@@ -164954,15 +165083,44 @@ var isV1ShapedAccept = (accept) => {
   const v1AmountField = a.maxAmountRequired != null && a.amount == null;
   return bareNetwork || v1AmountField;
 };
-var coerceX402BodyVersion = (challenge2) => {
+var normalizeX402ChallengeVersion = (challenge2) => {
   const accepts = Array.isArray(challenge2.accepts) ? challenge2.accepts : [];
-  return { ...challenge2, x402Version: accepts.some(isV1ShapedAccept) ? 1 : 2 };
+  if (challenge2.x402Version !== 2 || !accepts.some(isV1ShapedAccept)) {
+    return challenge2;
+  }
+  return { ...challenge2, x402Version: 1 };
 };
+var responseWithHeaders = (response, headers) => new Response(response.body, {
+  status: response.status,
+  statusText: response.statusText,
+  headers
+});
 var withSynthesizedX402Header = (baseFetch) => async (input, init) => {
   const response = await baseFetch(input, init);
   if (response.status !== 402) return response;
-  if (response.headers.get("payment-required") ?? response.headers.get("x-payment-required")) {
-    return response;
+  const standardHeader = response.headers.get("payment-required");
+  const legacyHeader = response.headers.get("x-payment-required");
+  const encodedHeader = standardHeader ?? legacyHeader;
+  if (encodedHeader) {
+    let normalizedHeader = encodedHeader;
+    try {
+      const decoded = JSON.parse(
+        Buffer.from(encodedHeader, "base64").toString("utf8")
+      );
+      if (looksLikeX402Body(decoded)) {
+        normalizedHeader = encodePaymentRequiredHeader(
+          normalizeX402ChallengeVersion(
+            decoded
+          )
+        );
+      }
+    } catch {
+    }
+    if (standardHeader && normalizedHeader === standardHeader)
+      return response;
+    const headers2 = new Headers(response.headers);
+    headers2.set("PAYMENT-REQUIRED", normalizedHeader);
+    return responseWithHeaders(response, headers2);
   }
   const text = await response.clone().text();
   let parsed;
@@ -164974,7 +165132,9 @@ var withSynthesizedX402Header = (baseFetch) => async (input, init) => {
   if (!looksLikeX402Body(parsed) || parsed.x402Version === 1) {
     return response;
   }
-  const challenge2 = coerceX402BodyVersion(parsed);
+  const challenge2 = normalizeX402ChallengeVersion(
+    parsed
+  );
   const headers = new Headers(response.headers);
   headers.set(
     "PAYMENT-REQUIRED",
@@ -164991,6 +165151,154 @@ var withSynthesizedX402Header = (baseFetch) => async (input, init) => {
     headers
   });
 };
+var USDC_BASE2 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+var USDC_BASE_SEPOLIA = "0x036cbd53842c5426634e7929541ec2318f3dcf7e";
+var UINT_RE = /^[0-9]+$/;
+var EVM_ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var MAX_AMOUNT_DIGITS = 30;
+var X402_ACCEPT_SCHEMA = external_exports3.object({
+  scheme: external_exports3.string().optional(),
+  network: external_exports3.string().optional(),
+  asset: external_exports3.string().optional(),
+  amount: external_exports3.unknown().optional(),
+  maxAmountRequired: external_exports3.unknown().optional(),
+  payTo: external_exports3.unknown().optional(),
+  maxTimeoutSeconds: external_exports3.unknown().optional(),
+  extra: external_exports3.unknown().optional()
+}).passthrough();
+var X402_EXTRA_SCHEMA = external_exports3.object({ assetTransferMethod: external_exports3.unknown().optional() }).passthrough();
+var SUPPORTED_NETWORKS = {
+  base: { chain: "base", asset: USDC_BASE2, version: 1 },
+  "base-sepolia": {
+    chain: "base-sepolia",
+    asset: USDC_BASE_SEPOLIA,
+    version: 1
+  },
+  "eip155:8453": { chain: "base", asset: USDC_BASE2, version: 2 },
+  "eip155:84532": {
+    chain: "base-sepolia",
+    asset: USDC_BASE_SEPOLIA,
+    version: 2
+  }
+};
+var reject = (reason, detail) => ({ settleable: false, reason, detail });
+var classifyX402Requirement = (candidate, x402Version2) => {
+  if (x402Version2 !== void 0 && x402Version2 !== 1 && x402Version2 !== 2) {
+    return reject(
+      "unsupported_version",
+      `x402 version ${String(x402Version2)} is not supported`
+    );
+  }
+  const parsed = X402_ACCEPT_SCHEMA.safeParse(candidate);
+  if (!parsed.success) {
+    return reject("malformed_accept", "accept is not a valid object");
+  }
+  const accept = parsed.data;
+  if (accept.scheme === void 0) {
+    return reject("malformed_accept", "accept.scheme is required");
+  }
+  const scheme = accept.scheme;
+  if (scheme !== "exact") {
+    return reject(
+      "unsupported_scheme",
+      `scheme ${JSON.stringify(scheme)} is not supported`
+    );
+  }
+  const network = accept.network?.toLowerCase();
+  const supportedNetwork = network ? SUPPORTED_NETWORKS[network] : void 0;
+  if (!supportedNetwork) {
+    return reject(
+      "unsupported_network",
+      `network ${JSON.stringify(accept.network)} is not supported`
+    );
+  }
+  const effectiveVersion = x402Version2 ?? supportedNetwork.version;
+  if (supportedNetwork.version !== effectiveVersion) {
+    return reject(
+      "network_version_mismatch",
+      `network ${accept.network} uses the x402 v${supportedNetwork.version} shape, not v${effectiveVersion}`
+    );
+  }
+  if (accept.asset?.toLowerCase() !== supportedNetwork.asset.toLowerCase()) {
+    return reject(
+      "unsupported_asset",
+      `asset ${JSON.stringify(accept.asset)} is not USDC on ${supportedNetwork.chain}`
+    );
+  }
+  let transferMethod = "eip3009";
+  if (accept.extra !== void 0) {
+    const parsedExtra = X402_EXTRA_SCHEMA.safeParse(accept.extra);
+    if (!parsedExtra.success) {
+      return reject("malformed_accept", "accept.extra is not an object");
+    }
+    transferMethod = parsedExtra.data.assetTransferMethod ?? transferMethod;
+  }
+  if (transferMethod !== "eip3009" && transferMethod !== "permit2") {
+    return reject(
+      "unsupported_transfer_method",
+      `transfer method ${JSON.stringify(transferMethod)} is not supported`
+    );
+  }
+  if (effectiveVersion === 1 && transferMethod === "permit2") {
+    return reject(
+      "unsupported_transfer_method",
+      "Permit2 is only supported by the x402 v2 EVM client"
+    );
+  }
+  const amount2 = effectiveVersion === 1 ? accept.maxAmountRequired : accept.amount;
+  if (amount2 === void 0) {
+    return reject(
+      "missing_amount",
+      `x402 v${effectiveVersion} accept has no ${effectiveVersion === 1 ? "maxAmountRequired" : "amount"}`
+    );
+  }
+  if (typeof amount2 !== "string" || amount2.length > MAX_AMOUNT_DIGITS || !UINT_RE.test(amount2)) {
+    return reject(
+      "invalid_amount",
+      "payment amount must be a bounded unsigned integer string"
+    );
+  }
+  if (typeof accept.payTo !== "string" || !EVM_ADDRESS_RE.test(accept.payTo)) {
+    return reject("invalid_recipient", "accept.payTo must be an EVM address");
+  }
+  if (typeof accept.maxTimeoutSeconds !== "number" || !Number.isInteger(accept.maxTimeoutSeconds) || accept.maxTimeoutSeconds <= 0) {
+    return reject(
+      "invalid_timeout",
+      "accept.maxTimeoutSeconds must be a positive integer"
+    );
+  }
+  return {
+    settleable: true,
+    chain: supportedNetwork.chain,
+    transferMethod,
+    x402Version: effectiveVersion,
+    amount: amount2
+  };
+};
+var selectSettleableX402Requirement = (accepts, preselected, x402Version2) => {
+  const settleable = (accepts ?? []).filter(
+    (accept) => classifyX402Requirement(accept, x402Version2).settleable
+  );
+  if (settleable.length === 0) return null;
+  return settleable.find((accept) => {
+    const classification = classifyX402Requirement(accept, x402Version2);
+    return classification.settleable && classification.chain === "base";
+  }) ?? settleable[0] ?? null;
+};
+var describeX402Accepts = (accepts, x402Version2) => (accepts ?? []).map((candidate) => {
+  const parsed = X402_ACCEPT_SCHEMA.safeParse(candidate);
+  const classification = classifyX402Requirement(candidate, x402Version2);
+  if (!parsed.success) {
+    return `malformed (${classification.settleable ? "unexpectedly settleable" : classification.detail})`;
+  }
+  const accept = parsed.data;
+  const extra = X402_EXTRA_SCHEMA.safeParse(accept.extra);
+  const transferMethod = extra.success ? extra.data.assetTransferMethod : void 0;
+  const shape2 = `${accept.scheme ?? "?"}/${accept.network ?? "?"}/${accept.asset ?? "?"}/${typeof transferMethod === "string" ? transferMethod : "eip3009"}`;
+  return classification.settleable ? shape2 : `${shape2} (${classification.reason})`;
+}).join(", ") || "(none)";
+var USDC_BASE3 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+var USDC_BASE_SEPOLIA2 = "0x036cbd53842c5426634e7929541ec2318f3dcf7e";
 var NETWORK_TO_CHAIN = {
   base: "base",
   "base-sepolia": "base-sepolia",
@@ -165003,12 +165311,11 @@ var networkToChain = (network) => {
   return NETWORK_TO_CHAIN[normalized] ?? "unknown";
 };
 var MAX_PAY_RE = /^[0-9]+(\.[0-9]{1,6})?$/;
-var UINT_RE = /^[0-9]+$/;
-var MAX_AMOUNT_DIGITS = 30;
+var UINT_RE2 = /^[0-9]+$/;
+var MAX_AMOUNT_DIGITS2 = 30;
 var JIT_REVERSE_FEE_MARGIN = 50000n;
 var BRIDGE_FILL_POLL_INTERVAL_MS = 2e3;
 var BRIDGE_FILL_TIMEOUT_MS = 9e4;
-var USDC_BASE2 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
 var USDC_TEMPO2 = "0x20c000000000000000000000b9537d11c60e8b50";
 var PATHUSD_TEMPO = "0x20c0000000000000000000000000000000000000";
 var BASE_CHAIN_ID = 8453;
@@ -165053,7 +165360,7 @@ var resolveDefaultPrefund = (displayCostAmount) => {
   const bounded = scaled < floor ? floor : scaled > ceiling ? ceiling : scaled;
   return bounded.toFixed(6).replace(/\.?0+$/, "");
 };
-var isUintString = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AMOUNT_DIGITS && UINT_RE.test(v);
+var isUintString = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AMOUNT_DIGITS2 && UINT_RE2.test(v);
 var buildTempoPaymentMethods = (parameters) => [
   tempo2(parameters),
   tempo2.sessionLegacy.method(parameters)
@@ -165152,11 +165459,11 @@ var raceWithSignal = (p, signal, client) => {
     });
     return Promise.reject(new DOMException("Aborted", "AbortError"));
   }
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve7, reject2) => {
     let settled = false;
     const onAbort = () => {
       settled = true;
-      reject(new DOMException("Aborted", "AbortError"));
+      reject2(new DOMException("Aborted", "AbortError"));
     };
     signal.addEventListener("abort", onAbort, { once: true });
     p.then(
@@ -165177,7 +165484,7 @@ var raceWithSignal = (p, signal, client) => {
           return;
         }
         settled = true;
-        reject(e);
+        reject2(e);
       }
     );
   });
@@ -165201,6 +165508,8 @@ var resolveAccount = async (client, overrideAccount, signal, walletAddress) => {
     "payments.pay() requires either a client constructed with `account` or a per-call `account` override."
   );
 };
+var measureDiagnostic = (diagnostics, stage, work) => diagnostics ? diagnostics.measure(stage, work) : work();
+var isMppProofChallenge = (challenge2) => challenge2.intent === "proof" || challenge2.intent === "charge" && challenge2.request.amount === "0";
 var validateMaxPay = (maxPay) => {
   const normalized = maxPay?.trim();
   if (normalized === void 0) return null;
@@ -165233,44 +165542,83 @@ var Payments = class {
    * on the detected 402 protocol.
    */
   pay = async (input) => {
-    const maxPayUnits = validateMaxPay(input.maxPay);
-    const account = await resolveAccount(
-      this.client,
-      input.account,
-      input.signal,
-      input.walletAddress
-    );
+    input.diagnostics?.setPaymentMode("charge");
+    let maxPayUnits;
+    try {
+      maxPayUnits = validateMaxPay(input.maxPay);
+    } catch (error98) {
+      input.diagnostics?.fail(
+        "rail_select",
+        FETCH_DIAGNOSTIC_CODES.invalidMaxPay
+      );
+      throw error98;
+    }
+    let account;
+    try {
+      account = await measureDiagnostic(
+        input.diagnostics,
+        "wallet_resolve",
+        () => resolveAccount(
+          this.client,
+          input.account,
+          input.signal,
+          input.walletAddress
+        )
+      );
+    } catch (error98) {
+      input.diagnostics?.fail(
+        "wallet_resolve",
+        FETCH_DIAGNOSTIC_CODES.walletResolutionFailed
+      );
+      throw error98;
+    }
     let capturedAmount = null;
     let pendingAmountUnits = 0n;
     let identityChallengeHandled = false;
     let paidChallengeHandled = false;
     let capturedNetwork;
     let preflightError = null;
-    const x4022 = registerExactEvmScheme(new x402Client(), { signer: account });
+    const x4022 = registerExactEvmScheme(
+      new x402Client((x402Version2, requirements) => {
+        const selected = selectSettleableX402Requirement(
+          requirements,
+          void 0,
+          x402Version2
+        );
+        if (selected) return selected;
+        const fallback2 = requirements[0];
+        if (!fallback2) {
+          throw new Error(
+            "x402 challenge has no registered payment requirements"
+          );
+        }
+        return fallback2;
+      }),
+      { signer: account }
+    );
     x4022.onBeforePaymentCreation(async (context) => {
-      const selected = context.selectedRequirements;
-      if (selected) {
-        const filled = withKnownEip712Domain(selected.asset, selected.extra);
-        if (filled) selected.extra = filled;
-      }
-      const requirement = selected ?? context.paymentRequired.accepts[0];
-      if (!requirement) {
+      const requirement = context.selectedRequirements;
+      const classification = classifyX402Requirement(
+        requirement,
+        context.paymentRequired.x402Version
+      );
+      if (!classification.settleable) {
+        input.diagnostics?.fail(
+          "rail_select",
+          FETCH_DIAGNOSTIC_CODES.unsupportedPaymentRail
+        );
         return {
           abort: true,
-          reason: "x402 challenge had no payment requirements"
+          reason: `x402 challenge has no rail this wallet can settle \u2014 offered [${describeX402Accepts(context.paymentRequired.accepts, context.paymentRequired.x402Version)}], supported: USDC exact (EIP-3009 or Permit2) on base / base-sepolia`
         };
       }
+      const filled = withKnownEip712Domain(
+        requirement.asset,
+        requirement.extra
+      );
+      if (filled) requirement.extra = filled;
       capturedNetwork = requirement.network;
-      const rawAmount = requirement.amount ?? requirement.maxAmountRequired;
-      if (!rawAmount) {
-        return { abort: true, reason: "x402 requirement had no amount field" };
-      }
-      if (rawAmount.length > MAX_AMOUNT_DIGITS || !UINT_RE.test(rawAmount)) {
-        return {
-          abort: true,
-          reason: `x402 requirement amount is not an unsigned integer string: ${JSON.stringify(rawAmount)}`
-        };
-      }
+      const rawAmount = classification.amount;
       const rawAmountUnits = BigInt(rawAmount);
       pendingAmountUnits = rawAmountUnits;
       const challengeAmount = formatUnits(rawAmountUnits, 6);
@@ -165288,6 +165636,10 @@ var Payments = class {
         };
       }
       if (maxPayUnits !== null && rawAmountUnits > maxPayUnits) {
+        input.diagnostics?.fail(
+          "rail_select",
+          FETCH_DIAGNOSTIC_CODES.maxPayExceeded
+        );
         return {
           abort: true,
           reason: `Payment of ${challengeAmount} USDC exceeds maxPay ${input.maxPay}`
@@ -165297,8 +165649,16 @@ var Payments = class {
       const balanceChain = detected === "base-sepolia" ? "base-sepolia" : "base";
       let balance = null;
       try {
-        balance = await this.readUsdcBalance(account.address, balanceChain);
+        balance = await measureDiagnostic(
+          input.diagnostics,
+          "balance_check",
+          () => this.readUsdcBalance(account.address, balanceChain)
+        );
       } catch (readErr) {
+        input.diagnostics?.issue(
+          "balance_check",
+          FETCH_DIAGNOSTIC_CODES.balanceCheckFailed
+        );
         this.client.logger?.({
           level: "warn",
           message: "Pre-flight balance read failed; proceeding to attempt payment",
@@ -165309,7 +165669,12 @@ var Payments = class {
         });
       }
       if (balance !== null && balance < rawAmountUnits) {
-        if (balanceChain === "base" && await this.tryJitReverseBridge(account, rawAmountUnits, balance)) {
+        if (!input.preferMppOnX402Shortfall && balanceChain === "base" && await measureDiagnostic(
+          input.diagnostics,
+          "bridge",
+          () => this.tryJitReverseBridge(account, rawAmountUnits, balance)
+        )) {
+          input.diagnostics?.setFundingSource("jit_bridge");
           return;
         }
         const have = formatUnits(balance, 6);
@@ -165320,6 +165685,9 @@ var Payments = class {
         );
         return { abort: true, reason: preflightError.message };
       }
+      input.diagnostics?.setFundingSource(
+        balance === null ? "unknown" : rawAmountUnits === 0n ? "not_required" : "wallet_balance"
+      );
     });
     const configuredFetch = buildConfiguredFetch(this.client, {
       timeoutMs: input.timeoutMs
@@ -165366,7 +165734,19 @@ var Payments = class {
           }
         }
         pendingAmountUnits = 0n;
-        const paymentPayload = await x4022.createPaymentPayload(paymentRequired2);
+        const paymentPayload = await measureDiagnostic(
+          input.diagnostics,
+          "credential_sign",
+          () => x4022.createPaymentPayload(paymentRequired2)
+        ).catch((error98) => {
+          if (!preflightError) {
+            input.diagnostics?.fail(
+              "credential_sign",
+              FETCH_DIAGNOSTIC_CODES.credentialSignFailed
+            );
+          }
+          throw error98;
+        });
         if (pendingAmountUnits === 0n) {
           identityChallengeHandled = true;
           capturedAmount = "0";
@@ -165383,10 +165763,34 @@ var Payments = class {
           "Access-Control-Expose-Headers",
           "PAYMENT-RESPONSE,X-PAYMENT-RESPONSE"
         );
-        response = await paymentFetch(paidRequest);
+        response = await measureDiagnostic(
+          input.diagnostics,
+          "paid_replay",
+          () => paymentFetch(paidRequest)
+        ).catch((error98) => {
+          input.diagnostics?.fail(
+            "paid_replay",
+            isCallerAbortError(error98) ? FETCH_DIAGNOSTIC_CODES.callerAborted : FETCH_DIAGNOSTIC_CODES.paidReplayFailed
+          );
+          throw error98;
+        });
       }
     } catch (err) {
-      if (preflightError) throw preflightError;
+      if (preflightError) {
+        if (!input.preferMppOnX402Shortfall) {
+          input.diagnostics?.fail(
+            "balance_check",
+            FETCH_DIAGNOSTIC_CODES.insufficientFunds
+          );
+        }
+        throw preflightError;
+      }
+      if (input.diagnostics?.snapshot().failureStage === null) {
+        input.diagnostics.fail(
+          "paid_replay",
+          FETCH_DIAGNOSTIC_CODES.paymentFailed
+        );
+      }
       if (err instanceof ZeroError) throw err;
       throw new ZeroPaymentError(
         `x402 payment failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -165405,6 +165809,10 @@ var Payments = class {
           capturedNetwork = settlement.network;
         }
       } catch {
+        input.diagnostics?.issue(
+          "settlement_receipt",
+          FETCH_DIAGNOSTIC_CODES.settlementReceiptInvalid
+        );
       }
     }
     const amount2 = capturedAmount ?? "unknown";
@@ -165433,16 +165841,52 @@ var Payments = class {
    * carrying the orphaned channel for out-of-band reconciliation.
    */
   payMpp = async (input) => {
-    const maxPayUnits = validateMaxPay(input.maxPay);
-    const account = await resolveAccount(
-      this.client,
-      input.account,
-      input.signal,
-      input.walletAddress
-    );
+    let maxPayUnits;
+    try {
+      maxPayUnits = validateMaxPay(input.maxPay);
+    } catch (error98) {
+      input.diagnostics?.fail(
+        "rail_select",
+        FETCH_DIAGNOSTIC_CODES.invalidMaxPay
+      );
+      throw error98;
+    }
+    let account;
+    try {
+      account = await measureDiagnostic(
+        input.diagnostics,
+        "wallet_resolve",
+        () => resolveAccount(
+          this.client,
+          input.account,
+          input.signal,
+          input.walletAddress
+        )
+      );
+    } catch (error98) {
+      input.diagnostics?.fail(
+        "wallet_resolve",
+        FETCH_DIAGNOSTIC_CODES.walletResolutionFailed
+      );
+      throw error98;
+    }
     const configuredFetch = buildConfiguredFetch(this.client, {
       timeoutMs: input.timeoutMs
     });
+    const mppFetch = async (request22, init) => {
+      const response2 = await configuredFetch(request22, init);
+      if (response2.status !== 402 || !response2.headers.has("payment-required") && !response2.headers.has("x-payment-required")) {
+        return response2;
+      }
+      const headers = new Headers(response2.headers);
+      headers.delete("payment-required");
+      headers.delete("x-payment-required");
+      return new Response(response2.body, {
+        status: response2.status,
+        statusText: response2.statusText,
+        headers
+      });
+    };
     let capturedAmount = "unknown";
     let capturedChallenge;
     let channelEntry;
@@ -165473,7 +165917,8 @@ var Payments = class {
         // escrow-less emit can't blank an open channel's escrow.
         escrowContract: entry.escrow ?? entry.escrowContract ?? channelEntry?.escrowContract ?? "0x0000000000000000000000000000000000000000",
         cumulativeAmount: cumulative,
-        opened: wasOpened || entry.opened
+        opened: wasOpened || entry.opened,
+        descriptor: entry.descriptor ?? channelEntry?.descriptor
       };
     };
     const tempoMethodParams = {
@@ -165483,29 +165928,68 @@ var Payments = class {
     };
     const mppx = Mppx_exports.create({
       polyfill: false,
-      fetch: configuredFetch,
+      fetch: mppFetch,
       methods: buildTempoPaymentMethods(tempoMethodParams),
-      onChallenge: async (challenge2) => {
+      onChallenge: async (challenge2, { createCredential }) => {
         capturedChallenge = challenge2;
-        capturedAmount = await this.prepareTempoFunds(
-          account,
-          challenge2,
-          maxPayUnits,
-          input.displayCostAmount
+        input.diagnostics?.setPaymentMode(
+          challenge2.intent === "session" ? "session" : isMppProofChallenge(challenge2) ? "proof" : challenge2.intent === "charge" ? "charge" : "unknown"
         );
+        capturedAmount = await measureDiagnostic(
+          input.diagnostics,
+          "balance_check",
+          () => this.prepareTempoFunds(
+            account,
+            challenge2,
+            maxPayUnits,
+            input.displayCostAmount,
+            input.diagnostics
+          )
+        ).catch((error98) => {
+          if (input.diagnostics?.snapshot().failureStage === null) {
+            input.diagnostics.fail(
+              "balance_check",
+              FETCH_DIAGNOSTIC_CODES.balanceCheckFailed
+            );
+          }
+          throw error98;
+        });
+        if (challenge2.intent === "session") {
+          return measureDiagnostic(
+            input.diagnostics,
+            "credential_sign",
+            () => createCredential({
+              depositRaw: parseUnits(capturedAmount, 6).toString()
+            })
+          ).catch((error98) => {
+            input.diagnostics?.fail(
+              "credential_sign",
+              FETCH_DIAGNOSTIC_CODES.credentialSignFailed
+            );
+            throw error98;
+          });
+        }
         return void 0;
       }
     });
     let response;
     try {
-      response = await mppx.fetch(input.url, {
-        method: input.method ?? "GET",
-        headers: input.headers,
-        body: input.body,
-        signal: input.signal
-      });
+      response = await measureDiagnostic(
+        input.diagnostics,
+        "paid_replay",
+        () => mppx.fetch(input.url, {
+          method: input.method ?? "GET",
+          headers: input.headers,
+          body: input.body,
+          signal: input.signal
+        })
+      );
     } catch (err) {
       if (channelEntry?.opened) {
+        input.diagnostics?.fail(
+          "session_close",
+          FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+        );
         throw this.buildOrphanError(
           channelEntry,
           capturedChallenge,
@@ -165515,6 +165999,12 @@ var Payments = class {
           err
         );
       }
+      if (input.diagnostics?.snapshot().failureStage === null) {
+        input.diagnostics.fail(
+          "paid_replay",
+          isCallerAbortError(err) ? FETCH_DIAGNOSTIC_CODES.callerAborted : FETCH_DIAGNOSTIC_CODES.paidReplayFailed
+        );
+      }
       if (err instanceof ZeroError) throw err;
       throw new ZeroPaymentError(
         `MPP payment failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -165532,7 +166022,8 @@ var Payments = class {
         capturedAmount,
         mppx,
         signal: input.signal,
-        configuredFetch
+        configuredFetch,
+        diagnostics: input.diagnostics
       });
     }
     const sdkWarnings = [];
@@ -165544,15 +166035,21 @@ var Payments = class {
       sdkWarnings.push(FETCH_WARNINGS.sessionOpenUnobserved);
     }
     let txHash = null;
-    try {
-      const receipt = Receipt_exports.fromResponse(response);
-      txHash = receipt.reference ?? null;
-    } catch (err) {
-      this.client.logger?.({
-        level: "warn",
-        message: "Failed to parse MPP charge receipt; txHash unknown",
-        meta: { error: err instanceof Error ? err.message : String(err) }
-      });
+    if (capturedChallenge && !isMppProofChallenge(capturedChallenge)) {
+      try {
+        const receipt = Receipt_exports.fromResponse(response);
+        txHash = receipt.reference ?? null;
+      } catch (err) {
+        input.diagnostics?.issue(
+          "settlement_receipt",
+          FETCH_DIAGNOSTIC_CODES.settlementReceiptInvalid
+        );
+        this.client.logger?.({
+          level: "warn",
+          message: "Failed to parse MPP charge receipt; txHash unknown",
+          meta: { error: err instanceof Error ? err.message : String(err) }
+        });
+      }
     }
     return {
       response,
@@ -165593,7 +166090,7 @@ var Payments = class {
       cause
     });
   };
-  prepareTempoFunds = async (account, challenge2, maxPayUnits, displayCostAmount) => {
+  prepareTempoFunds = async (account, challenge2, maxPayUnits, displayCostAmount, diagnostics) => {
     const challengeRequest = challenge2.request;
     let requiredRaw;
     if (challenge2.intent === "session") {
@@ -165607,7 +166104,11 @@ var Payments = class {
       }
     } else {
       const rawAmount = challengeRequest.amount;
-      if (typeof rawAmount !== "string" || rawAmount.length > MAX_AMOUNT_DIGITS || !UINT_RE.test(rawAmount)) {
+      if (typeof rawAmount !== "string" || rawAmount.length > MAX_AMOUNT_DIGITS2 || !UINT_RE2.test(rawAmount)) {
+        diagnostics?.fail(
+          "challenge_decode",
+          FETCH_DIAGNOSTIC_CODES.challengeDecodeFailed
+        );
         throw new ZeroPaymentError(
           `MPP charge challenge amount is not an unsigned integer string: ${JSON.stringify(rawAmount)}`
         );
@@ -165615,11 +166116,13 @@ var Payments = class {
       requiredRaw = BigInt(rawAmount);
     }
     if (challenge2.intent === "session" && requiredRaw === 0n) {
+      diagnostics?.fail("rail_select", FETCH_DIAGNOSTIC_CODES.maxPayExceeded);
       throw new ZeroPaymentError(
         "This capability opens an MPP payment channel that needs a positive deposit; maxPay='0' cannot fund it. Pass a small cap (e.g. '0.05') to size the channel."
       );
     }
     if (maxPayUnits !== null && requiredRaw > maxPayUnits) {
+      diagnostics?.fail("rail_select", FETCH_DIAGNOSTIC_CODES.maxPayExceeded);
       throw new ZeroPaymentError(
         `Payment of ${formatUnits(requiredRaw, 6)} USDC exceeds maxPay ${formatUnits(maxPayUnits, 6)}`
       );
@@ -165630,6 +166133,10 @@ var Payments = class {
       challengeRequest.chainId ?? methodDetails?.chainId
     );
     if (!coerced) {
+      diagnostics?.fail(
+        "rail_select",
+        FETCH_DIAGNOSTIC_CODES.unsupportedPaymentRail
+      );
       throw new ZeroPaymentError(
         `MPP challenge has missing or unsupported chainId (expected ${TEMPO_CHAIN_ID2} or ${TEMPO_TESTNET_CHAIN_ID})`
       );
@@ -165641,15 +166148,38 @@ var Payments = class {
     if (tempoBalance < requiredRaw) {
       if (coerced.chain === "tempo-testnet") {
         const have = formatUnits(tempoBalance, 6);
+        diagnostics?.fail(
+          "balance_check",
+          FETCH_DIAGNOSTIC_CODES.insufficientFunds
+        );
         throw new ZeroInsufficientFundsError(
           `Insufficient pathUSD on Tempo testnet: have ${have}, need ${capturedAmount}. Fund via the Tempo testnet faucet: https://docs.tempo.xyz/quickstart/faucet`,
           { have, need: capturedAmount }
         );
       }
-      await this.bridgeBaseToTempo(account, requiredRaw - tempoBalance, {
-        isSessionDeposit: challenge2.intent === "session",
-        depositTotal: capturedAmount
+      await measureDiagnostic(
+        diagnostics,
+        "bridge",
+        () => this.bridgeBaseToTempo(account, requiredRaw - tempoBalance, {
+          isSessionDeposit: challenge2.intent === "session",
+          depositTotal: capturedAmount
+        })
+      ).catch((error98) => {
+        if (error98 instanceof ZeroInsufficientFundsError) {
+          diagnostics?.fail(
+            "balance_check",
+            FETCH_DIAGNOSTIC_CODES.insufficientFunds
+          );
+        } else {
+          diagnostics?.fail("bridge", FETCH_DIAGNOSTIC_CODES.bridgeFailed);
+        }
+        throw error98;
       });
+      diagnostics?.setFundingSource("jit_bridge");
+    } else {
+      diagnostics?.setFundingSource(
+        requiredRaw === 0n ? "not_required" : "wallet_balance"
+      );
     }
     return capturedAmount;
   };
@@ -165698,7 +166228,7 @@ var Payments = class {
     const quote = await getClient().actions.getQuote({
       chainId: BASE_CHAIN_ID,
       toChainId: TEMPO_CHAIN_ID2,
-      currency: USDC_BASE2,
+      currency: USDC_BASE3,
       toCurrency: USDC_TEMPO2,
       amount: bridgeAmount.toString(),
       tradeType: "EXACT_INPUT",
@@ -165792,11 +166322,11 @@ var Payments = class {
     const { viemChain, token } = (() => {
       switch (chain2) {
         case "base":
-          return { viemChain: base, token: USDC_BASE2 };
+          return { viemChain: base, token: USDC_BASE3 };
         case "base-sepolia":
           return {
             viemChain: baseSepolia,
-            token: "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
+            token: USDC_BASE_SEPOLIA2
           };
         case "tempo":
           return { viemChain: tempoChain2, token: USDC_TEMPO2 };
@@ -165830,7 +166360,8 @@ var Payments = class {
       capturedAmount,
       mppx,
       signal,
-      configuredFetch
+      configuredFetch,
+      diagnostics
     } = params;
     const challengeRequest = challenge2.request;
     const recipientRaw = challengeRequest.recipient;
@@ -165851,11 +166382,19 @@ var Payments = class {
       void 0
     );
     if (!recipient || !challengeEscrow) {
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       throw buildOrphanFromChannelEntry(
         `MPP session challenge has missing or malformed recipient/escrowContract; channel ${channelId} is open and requires reconciliation.`
       );
     }
     if (!coercedChainId) {
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       throw buildOrphanFromChannelEntry(
         `MPP session challenge has unsupported chainId (expected ${TEMPO_CHAIN_ID2} or ${TEMPO_TESTNET_CHAIN_ID}); channel ${channelId} is open and requires reconciliation.`
       );
@@ -165880,6 +166419,10 @@ var Payments = class {
       cause
     });
     if (closeAmount === 0n && !isMeteredZeroReceipt(receipt)) {
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       throw closeFailed(
         `Refusing to sign zero close credential for channel ${channelId} \u2014 neither receipt nor channelEntry produced a nonzero cumulativeAmount. Query escrow directly to recover; check logger for an earlier 'non-bigint cumulativeAmount' warning.`
       );
@@ -165890,16 +166433,31 @@ var Payments = class {
     });
     let closeCredential;
     try {
-      closeCredential = await raceWithSignal(
-        mppx.createCredential(closeChallengeResponse, {
-          action: "close",
-          channelId,
-          cumulativeAmountRaw: closeAmount.toString()
-        }),
-        signal,
-        this.client
+      closeCredential = await measureDiagnostic(
+        diagnostics,
+        "credential_sign",
+        () => raceWithSignal(
+          mppx.createCredential(closeChallengeResponse, {
+            action: "close",
+            channelId,
+            cumulativeAmountRaw: closeAmount.toString(),
+            ...channelEntry.descriptor && {
+              descriptor: channelEntry.descriptor
+            }
+          }),
+          signal,
+          this.client
+        )
       );
     } catch (err) {
+      diagnostics?.issue(
+        "credential_sign",
+        FETCH_DIAGNOSTIC_CODES.credentialSignFailed
+      );
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       throw closeFailed(
         `Session close credential build failed for channel ${channelId}: ${err instanceof Error ? err.message : String(err)}`,
         err
@@ -165907,18 +166465,30 @@ var Payments = class {
     }
     let closeResponse;
     try {
-      closeResponse = await configuredFetch(url4, {
-        method: method.toUpperCase(),
-        headers: { authorization: closeCredential },
-        signal
-      });
+      closeResponse = await measureDiagnostic(
+        diagnostics,
+        "session_close",
+        () => configuredFetch(url4, {
+          method: method.toUpperCase(),
+          headers: { authorization: closeCredential },
+          signal
+        })
+      );
     } catch (err) {
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       throw closeFailed(
         `Session close request failed for channel ${channelId}: ${err instanceof Error ? err.message : String(err)}`,
         err
       );
     }
     if (!closeResponse.ok) {
+      diagnostics?.fail(
+        "session_close",
+        FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+      );
       const errBody = await Promise.race([
         closeResponse.text().catch(() => ""),
         new Promise((resolve7) => {
@@ -165932,6 +166502,12 @@ var Payments = class {
       );
     }
     const closeReceipt = readSessionReceipt(closeResponse);
+    if (!closeReceipt) {
+      diagnostics?.issue(
+        "settlement_receipt",
+        FETCH_DIAGNOSTIC_CODES.settlementReceiptInvalid
+      );
+    }
     cancelBody(closeResponse);
     const rawCloseTx = closeReceipt?.txHash;
     const closeTxHash = typeof rawCloseTx === "string" && /^0x[0-9a-fA-F]+$/.test(rawCloseTx) ? rawCloseTx : null;
@@ -165941,7 +166517,11 @@ var Payments = class {
         protocol: "mpp",
         chain: this.tempoChainLabel(challenge2),
         txHash: closeTxHash,
-        amount: capturedAmount,
+        // `capturedAmount` is the channel prefund, not the amount the
+        // seller ultimately claimed. Once close succeeds, report the
+        // cumulative amount authorized by the close voucher so callers and
+        // run accounting do not mistake refundable liquidity for spend.
+        amount: formatUnits(closeAmount, 6),
         asset: "USDC",
         session: {
           channelId,
@@ -166000,10 +166580,28 @@ var splitWwwAuthenticateChallenges = (header) => {
   return chunks;
 };
 var isTextContentType = (contentType) => {
-  if (!contentType) return true;
+  if (!contentType) return false;
   const lower = contentType.toLowerCase();
   return TEXT_CONTENT_TYPES.some((marker) => lower.includes(marker));
 };
+var isProbablyText = (bytes) => {
+  if (bytes.byteLength === 0) return true;
+  const sample = bytes.subarray(0, Math.min(bytes.byteLength, 64 * 1024));
+  let controls = 0;
+  for (const byte of sample) {
+    if (byte === 0) return false;
+    if (byte < 32 && byte !== 9 && byte !== 10 && byte !== 13) {
+      controls++;
+    }
+  }
+  if (controls > Math.max(1, Math.floor(sample.byteLength / 100))) return false;
+  try {
+    new TextDecoder("utf-8", { fatal: true }).decode(sample);
+    return true;
+  } catch {
+    return false;
+  }
+};
 var redactUrl2 = (url4) => {
   try {
     const u = new URL(url4);
@@ -166046,6 +166644,22 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
     cancelBody2(response);
     return advertisesMpp ? { protocol: "mpp", raw: { "www-authenticate": wwwAuth } } : { protocol: "unknown", raw: { requestedProtocol: "mpp" } };
   }
+  const canSettleX402 = (raw) => {
+    if (!raw || typeof raw !== "object") return false;
+    const normalized = normalizeX402ChallengeVersion(
+      raw
+    );
+    const accepts = normalized.accepts;
+    if (!Array.isArray(accepts)) return false;
+    const x402Version2 = typeof normalized.x402Version === "number" ? normalized.x402Version : void 0;
+    return selectSettleableX402Requirement(accepts, void 0, x402Version2) !== null;
+  };
+  const preferMppFallback = (raw) => preferredProtocol === void 0 && advertisesMpp && !canSettleX402(raw);
+  const selectedX402 = (raw) => ({
+    protocol: "x402",
+    raw,
+    ...preferredProtocol === void 0 && advertisesMpp ? { fallbackProtocol: "mpp" } : {}
+  });
   const x402Header = response.headers.get("payment-required") ?? response.headers.get("x-payment-required");
   if (x402Header) {
     cancelBody2(response);
@@ -166053,9 +166667,15 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
       const decoded = JSON.parse(
         Buffer.from(x402Header, "base64").toString("utf8")
       );
-      return { protocol: "x402", raw: decoded };
+      if (preferMppFallback(decoded)) {
+        return { protocol: "mpp", raw: { "www-authenticate": wwwAuth } };
+      }
+      return selectedX402(decoded);
     } catch {
-      return { protocol: "x402", raw: { encoded: x402Header } };
+      if (preferredProtocol === void 0 && advertisesMpp) {
+        return { protocol: "mpp", raw: { "www-authenticate": wwwAuth } };
+      }
+      return selectedX402({ encoded: x402Header });
     }
   }
   const declaredLen = Number.parseInt(
@@ -166069,7 +166689,13 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
       if (text) {
         const parsed = JSON.parse(text);
         if (looksLikeX402Body(parsed)) {
-          return { protocol: "x402", raw: parsed };
+          if (preferMppFallback(parsed)) {
+            return {
+              protocol: "mpp",
+              raw: { "www-authenticate": wwwAuth }
+            };
+          }
+          return selectedX402(parsed);
         }
       }
     } catch {
@@ -166125,7 +166751,8 @@ var parseResponseBody = async (response, max) => {
   const truncated = bytes.byteLength > max;
   const view = truncated ? bytes.subarray(0, max) : bytes;
   const buf = Buffer.from(view.buffer, view.byteOffset, view.byteLength);
-  if (!isTextContentType(contentType)) {
+  const textResponse = contentType ? isTextContentType(contentType) : isProbablyText(view);
+  if (!textResponse) {
     const base645 = buf.toString("base64");
     return {
       body: base645,
@@ -166184,6 +166811,27 @@ var extractUpstreamErrorMessage = (body) => {
   }
   return void 0;
 };
+var SUCCESS_PAYLOAD_FIELDS = [
+  "data",
+  "result",
+  "results",
+  "output",
+  "content",
+  "items",
+  "url",
+  "audio_url",
+  "image_url",
+  "video_url"
+];
+var hasErrorShapedBody = (body) => {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return false;
+  const record3 = body;
+  if (record3.ok === false || record3.success === false) return true;
+  const error98 = record3.error;
+  const hasError = typeof error98 === "string" && error98.trim().length > 0 || error98 === true || typeof error98 === "object" && error98 !== null;
+  if (!hasError) return false;
+  return !SUCCESS_PAYLOAD_FIELDS.some((field) => record3[field] != null);
+};
 var extractFieldName = (message2) => {
   const patterns = [
     /(?:field|param(?:eter)?|property|key)[:\s]+["'`]?([a-z0-9_.[\]-]+)["'`]?/i,
@@ -166254,8 +166902,8 @@ var computeFixHint = (status, message2, bodyRaw) => {
   }
   return void 0;
 };
-var buildUpstreamError = (status, bodyRaw, bodyEncoding) => {
-  if (status >= 200 && status < 300) return void 0;
+var buildUpstreamError = (status, bodyRaw, bodyEncoding, errorShapedSuccess = false) => {
+  if (status >= 200 && status < 300 && !errorShapedSuccess) return void 0;
   if (bodyRaw === null || bodyRaw.length === 0) return void 0;
   if (bodyEncoding === "base64") return void 0;
   const snippet = bodyRaw.slice(0, ERROR_SNIPPET_BYTES);
@@ -166269,11 +166917,12 @@ var buildUpstreamError = (status, bodyRaw, bodyEncoding) => {
     ...fixHint && { fixHint }
   };
 };
-var computeOutcome = (status, payment, warnings) => {
+var computeOutcome = (status, payment, warnings, errorShapedSuccess = false) => {
   if (warnings.includes(FETCH_WARNINGS.mppSessionCloseFailed))
     return "payment_close_failed";
   if (status === 402 && payment !== null) return "payment_rejected";
   if (status === 402) return "payment_failed";
+  if (errorShapedSuccess) return "server_error";
   if (status >= 400) return "server_error";
   return "success";
 };
@@ -166293,9 +166942,10 @@ var errorFetchResult = (fetchId, startedAt, error98, skipReason, capabilityIdReq
   if (capabilityIdRequested) result.runTrackingSkipped = [skipReason];
   return result;
 };
-var settlementFields = (payment) => {
+var settlementFields = (payment, paymentMode) => {
   if (payment === null) return {};
   const knownAmount = payment.amount !== "unknown";
+  const mode = paymentMode && paymentMode !== "unknown" ? paymentMode : payment.session ? "session" : "charge";
   return {
     ...knownAmount && {
       costAmount: payment.amount,
@@ -166304,7 +166954,8 @@ var settlementFields = (payment) => {
     paymentProtocol: payment.protocol,
     paymentChain: payment.chain,
     paymentTxHash: payment.txHash ?? void 0,
-    paymentMode: payment.session ? "session" : "charge"
+    paymentMode: mode,
+    ...payment.session && { paymentSession: payment.session }
   };
 };
 var resolveRecordingClient = (client, opts) => {
@@ -166313,7 +166964,7 @@ var resolveRecordingClient = (client, opts) => {
   const canRecord = opts.account !== void 0 || credentials.kind === "account" || credentials.kind === "session";
   return { recordingClient, canRecord };
 };
-var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride, requestUrl, requestMethod) => {
+var recordErrorFetchRun = async (client, opts, result, diagnostics, capabilityIdOverride, requestUrl, requestMethod) => {
   const effectiveCapId = capabilityIdOverride ?? opts.capabilityId;
   const urlTarget = requestUrl ? {
     requestUrl: redactUrl2(requestUrl),
@@ -166325,27 +166976,60 @@ var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride, req
   if (!canRecord) return;
   const fetchOriginForRecord = opts.capabilityId === void 0 ? "direct_url" : effectiveCapId !== void 0 && isShortToken(effectiveCapId) ? "from_search" : opts.fetchOrigin;
   try {
-    const created = await recordingClient.runs.create({
-      ...runTarget,
-      fetchId: result.fetchId,
-      ...opts.searchId && { searchId: opts.searchId },
-      ...fetchOriginForRecord && { fetchOrigin: fetchOriginForRecord },
-      ...result.status !== null && { status: result.status },
-      // The SDK's verdict. HTTP status alone can't say "the capability
-      // answered 200 but the caller got nothing" — outcome can.
-      outcome: result.outcome,
-      latencyMs: result.latencyMs,
-      // Carry the settlement when the failure happened AFTER we paid.
-      ...settlementFields(result.payment),
-      ...opts.requestSchema && { requestSchema: opts.requestSchema },
-      ...opts.walletAddress && !opts.account && { walletAddress: opts.walletAddress }
-    });
+    const created = await diagnostics.measure(
+      "run_record",
+      () => recordingClient.runs.create({
+        ...runTarget,
+        fetchId: result.fetchId,
+        ...opts.searchId && { searchId: opts.searchId },
+        ...fetchOriginForRecord && { fetchOrigin: fetchOriginForRecord },
+        ...result.status !== null && { status: result.status },
+        // The SDK's verdict. HTTP status alone can't say "the capability
+        // answered 200 but the caller got nothing" — outcome can.
+        outcome: result.outcome,
+        latencyMs: result.latencyMs,
+        settlementState: settlementStateFor(
+          result.payment,
+          result.warnings,
+          diagnostics.snapshot()
+        ),
+        failureStage: diagnostics.snapshot().failureStage ?? void 0,
+        failureCode: diagnostics.snapshot().failureCode ?? void 0,
+        paymentProtocol: diagnostics.snapshot().paymentProtocol ?? void 0,
+        paymentMode: diagnostics.snapshot().paymentMode ?? void 0,
+        fundingSource: diagnostics.snapshot().fundingSource ?? void 0,
+        stageDurationsMs: diagnostics.snapshot().stageDurationsMs,
+        warningCodes: result.warnings,
+        // Carry the settlement when the failure happened AFTER we paid.
+        ...settlementFields(result.payment, diagnostics.snapshot().paymentMode),
+        ...opts.requestSchema && { requestSchema: opts.requestSchema },
+        ...opts.walletAddress && !opts.account && { walletAddress: opts.walletAddress }
+      })
+    );
     result.runId = created.runId;
     delete result.runTrackingSkipped;
-  } catch {
+  } catch (err) {
+    diagnostics.issue("run_record", FETCH_DIAGNOSTIC_CODES.runCreateFailed);
+    const errorMessage2 = err instanceof Error ? err.message : String(err);
+    const code = err instanceof ZeroError ? err.code : void 0;
+    const skipReason = code ? `run_create_failed:${code}: ${errorMessage2}` : `run_create_failed: ${errorMessage2}`;
+    result.runTrackingSkipped = [
+      ...result.runTrackingSkipped ?? [],
+      skipReason
+    ];
+    client.logger?.({
+      level: "warn",
+      message: "Failed to record error-path run for fetch",
+      meta: {
+        fetchId: result.fetchId,
+        stage: "run_record",
+        errorCode: code,
+        error: errorMessage2
+      }
+    });
   }
 };
-var recordTimeoutRun = async (client, opts, fetchId, err, startedAt, capabilityIdRequested, capabilityIdOverride, requestUrl, requestMethod) => {
+var recordTimeoutRun = async (client, opts, fetchId, err, startedAt, capabilityIdRequested, diagnostics, capabilityIdOverride, requestUrl, requestMethod) => {
   const result = errorFetchResult(
     fetchId,
     startedAt,
@@ -166358,6 +167042,7 @@ var recordTimeoutRun = async (client, opts, fetchId, err, startedAt, capabilityI
     client,
     opts,
     result,
+    diagnostics,
     capabilityIdOverride,
     requestUrl,
     requestMethod
@@ -166386,9 +167071,9 @@ var withDefaultContentType = (headers, body) => {
   }
   return next;
 };
-var clientFetch = async (client, url4, opts = {}) => {
+var clientFetch = async (client, url4, opts = {}, diagnostics) => {
   const startedAt = Date.now();
-  const fetchId = randomUUID();
+  const fetchId = diagnostics.fetchId;
   const capabilityIdRequested = opts.capabilityId !== void 0;
   const normalized = normalizeTransportEnvelopeRequest(url4, {
     method: opts.method,
@@ -166401,7 +167086,16 @@ var clientFetch = async (client, url4, opts = {}) => {
     client,
     opts
   );
-  const resolvePromise = !capabilityIdRequested && canRecordForResolve ? client.capabilities.resolveByUrl(redactUrl2(requestUrl), method).catch(() => null) : Promise.resolve(null);
+  const resolvePromise = !capabilityIdRequested && canRecordForResolve ? diagnostics.measure(
+    "resolve_target",
+    () => client.capabilities.resolveByUrl(redactUrl2(requestUrl), method)
+  ).catch(() => {
+    diagnostics.issue(
+      "resolve_target",
+      FETCH_DIAGNOSTIC_CODES.capabilityResolutionFailed
+    );
+    return null;
+  }) : Promise.resolve(null);
   const probeHeaders = withDefaultContentType(opts.headers, requestBody);
   const requestInit = {
     method,
@@ -166414,12 +167108,17 @@ var clientFetch = async (client, url4, opts = {}) => {
   });
   let response;
   let payment = null;
+  let paymentCloseError;
   const skipReasons = [];
   const warnings = [];
   try {
-    response = await configuredFetch(requestUrl, requestInit);
+    response = await diagnostics.measure(
+      "probe",
+      () => configuredFetch(requestUrl, requestInit)
+    );
   } catch (err) {
     if (err instanceof ZeroTimeoutError) {
+      diagnostics.fail("probe", FETCH_DIAGNOSTIC_CODES.probeTimeout);
       await recordTimeoutRun(
         client,
         opts,
@@ -166427,12 +167126,14 @@ var clientFetch = async (client, url4, opts = {}) => {
         err,
         startedAt,
         capabilityIdRequested,
+        diagnostics,
         void 0,
         requestUrl,
         method
       );
       throw err;
     }
+    diagnostics.fail("probe", FETCH_DIAGNOSTIC_CODES.probeNetworkError);
     if (err instanceof ZeroError) throw err;
     const errMessage = err instanceof Error ? err.message : String(err);
     const result2 = errorFetchResult(
@@ -166447,6 +167148,7 @@ var clientFetch = async (client, url4, opts = {}) => {
       client,
       opts,
       result2,
+      diagnostics,
       void 0,
       requestUrl,
       method
@@ -166454,14 +167156,21 @@ var clientFetch = async (client, url4, opts = {}) => {
     return result2;
   }
   if (response.status === 402) {
-    const requirement = await detectPaymentRequirement(
-      response,
-      opts.paymentProtocol
-    );
+    const requirement = await diagnostics.measure(
+      "challenge_decode",
+      () => detectPaymentRequirement(response, opts.paymentProtocol)
+    ).catch((error98) => {
+      diagnostics.fail(
+        "challenge_decode",
+        FETCH_DIAGNOSTIC_CODES.challengeDecodeFailed
+      );
+      throw error98;
+    });
     if (requirement?.protocol === "x402" || requirement?.protocol === "mpp") {
+      diagnostics.selectPaymentProtocol(requirement.protocol);
       const payCall = requirement.protocol === "x402" ? client.payments.pay : client.payments.payMpp;
       try {
-        const paid = await payCall({
+        const paymentInput = {
           url: requestUrl,
           method,
           // Fresh clone for the paid retry — same rationale as
@@ -166476,13 +167185,39 @@ var clientFetch = async (client, url4, opts = {}) => {
           timeoutMs: opts.timeoutMs,
           ...opts.displayCostAmount && {
             displayCostAmount: opts.displayCostAmount
+          },
+          // Internal correlation/stage recorder shared with the payment
+          // namespace. Never serialized onto the wire.
+          diagnostics,
+          // A default-selected dual offer should use its already-funded MPP
+          // rail before moving Tempo funds back to Base for x402. Explicit
+          // paymentProtocol="x402" calls retain the JIT-bridge behavior.
+          preferMppOnX402Shortfall: requirement.protocol === "x402" && requirement.fallbackProtocol === "mpp"
+        };
+        let paid;
+        try {
+          paid = await payCall(paymentInput);
+        } catch (error98) {
+          if (error98 instanceof ZeroInsufficientFundsError && requirement.protocol === "x402" && requirement.fallbackProtocol === "mpp") {
+            diagnostics.issue(
+              "balance_check",
+              FETCH_DIAGNOSTIC_CODES.insufficientFunds
+            );
+            diagnostics.selectPaymentProtocol("mpp");
+            paid = await client.payments.payMpp(paymentInput);
+          } else {
+            throw error98;
           }
-        });
+        }
         response = paid.response;
         payment = paid.payment;
         if (paid.warnings) warnings.push(...paid.warnings);
       } catch (err) {
         if (err instanceof ZeroSessionCloseFailedError) {
+          diagnostics.fail(
+            "session_close",
+            FETCH_DIAGNOSTIC_CODES.sessionCloseFailed
+          );
           response = err.response;
           payment = {
             protocol: "mpp",
@@ -166492,8 +167227,13 @@ var clientFetch = async (client, url4, opts = {}) => {
             asset: "USDC",
             session: err.session
           };
+          paymentCloseError = err.message;
           warnings.push(FETCH_WARNINGS.mppSessionCloseFailed);
         } else if (err instanceof ZeroInsufficientFundsError) {
+          diagnostics.fail(
+            "balance_check",
+            FETCH_DIAGNOSTIC_CODES.insufficientFunds
+          );
           return errorFetchResult(
             fetchId,
             startedAt,
@@ -166504,6 +167244,12 @@ var clientFetch = async (client, url4, opts = {}) => {
             null
           );
         } else if (err instanceof ZeroPaymentError || err instanceof ZeroAuthError) {
+          if (diagnostics.snapshot().failureStage === null) {
+            diagnostics.fail(
+              "paid_replay",
+              FETCH_DIAGNOSTIC_CODES.paymentFailed
+            );
+          }
           const result2 = errorFetchResult(
             fetchId,
             startedAt,
@@ -166517,12 +167263,17 @@ var clientFetch = async (client, url4, opts = {}) => {
             client,
             opts,
             result2,
+            diagnostics,
             void 0,
             requestUrl,
             method
           );
           return result2;
         } else if (err instanceof ZeroTimeoutError) {
+          diagnostics.fail(
+            "paid_replay",
+            FETCH_DIAGNOSTIC_CODES.paidReplayTimeout
+          );
           await recordTimeoutRun(
             client,
             opts,
@@ -166530,12 +167281,17 @@ var clientFetch = async (client, url4, opts = {}) => {
             err,
             startedAt,
             capabilityIdRequested,
+            diagnostics,
             void 0,
             requestUrl,
             method
           );
           throw err;
         } else {
+          diagnostics.fail(
+            "paid_replay",
+            isCallerAbortError(err) ? FETCH_DIAGNOSTIC_CODES.callerAborted : FETCH_DIAGNOSTIC_CODES.paidReplayFailed
+          );
           const failed = errorFetchResult(
             fetchId,
             startedAt,
@@ -166548,6 +167304,7 @@ var clientFetch = async (client, url4, opts = {}) => {
             client,
             opts,
             failed,
+            diagnostics,
             void 0,
             requestUrl,
             method
@@ -166556,6 +167313,10 @@ var clientFetch = async (client, url4, opts = {}) => {
         }
       }
     } else if (requirement?.protocol === "unknown") {
+      diagnostics.fail(
+        "rail_select",
+        FETCH_DIAGNOSTIC_CODES.unsupportedPaymentRail
+      );
       const result2 = errorFetchResult(
         fetchId,
         startedAt,
@@ -166569,6 +167330,7 @@ var clientFetch = async (client, url4, opts = {}) => {
         client,
         opts,
         result2,
+        diagnostics,
         void 0,
         requestUrl,
         method
@@ -166582,13 +167344,20 @@ var clientFetch = async (client, url4, opts = {}) => {
   let bodyRaw;
   let bodyEncoding;
   try {
-    const parsed = await parseResponseBody(response, maxResponseBytes);
+    const parsed = await diagnostics.measure(
+      "body_read",
+      () => parseResponseBody(response, maxResponseBytes)
+    );
     body = parsed.body;
     bodyRaw = parsed.bodyRaw;
     bodyEncoding = parsed.bodyEncoding;
-    if (parsed.truncated) warnings.push(FETCH_WARNINGS.bodyTruncated);
+    if (parsed.truncated) {
+      warnings.push(FETCH_WARNINGS.bodyTruncated);
+      diagnostics.issue("body_read", FETCH_DIAGNOSTIC_CODES.bodyTruncated);
+    }
   } catch (err) {
     if (err instanceof Error && err.name === "AbortError") {
+      diagnostics.fail("body_read", FETCH_DIAGNOSTIC_CODES.callerAborted);
       const aborted3 = {
         fetchId,
         runId: null,
@@ -166605,6 +167374,7 @@ var clientFetch = async (client, url4, opts = {}) => {
         client,
         opts,
         aborted3,
+        diagnostics,
         (await resolvePromise.catch(() => null))?.capabilityId,
         requestUrl,
         method
@@ -166615,6 +167385,7 @@ var clientFetch = async (client, url4, opts = {}) => {
       });
     }
     const message2 = err instanceof Error ? err.message : String(err);
+    diagnostics.fail("body_read", FETCH_DIAGNOSTIC_CODES.bodyReadFailed);
     const skips = [];
     const settledLocally = paymentHasAnchor(payment);
     if (settledLocally && response.status === 402) {
@@ -166655,6 +167426,7 @@ var clientFetch = async (client, url4, opts = {}) => {
       client,
       opts,
       result2,
+      diagnostics,
       (await resolvePromise.catch(() => null))?.capabilityId,
       requestUrl,
       method
@@ -166667,14 +167439,22 @@ var clientFetch = async (client, url4, opts = {}) => {
   if (paidButStill402) warnings.push(FETCH_WARNINGS.paidButStill402);
   if (settlementUnconfirmed)
     warnings.push(FETCH_WARNINGS.paymentSettlementUnconfirmed);
+  if (settlementUnconfirmed) {
+    diagnostics.issue(
+      "settlement_receipt",
+      FETCH_DIAGNOSTIC_CODES.settlementUnconfirmed
+    );
+  }
   if (payment !== null && payment.amount === "unknown") {
     warnings.push(FETCH_WARNINGS.paymentAmountUnknown);
   }
+  const errorShapedSuccess = response.ok && hasErrorShapedBody(body);
   let runId = null;
   const upstreamErrorForRecord = buildUpstreamError(
     response.status,
     bodyRaw,
-    bodyEncoding
+    bodyEncoding,
+    errorShapedSuccess
   );
   const resolvedCap = await resolvePromise;
   const effectiveCapabilityId = opts.capabilityId ?? resolvedCap?.capabilityId;
@@ -166689,7 +167469,26 @@ var clientFetch = async (client, url4, opts = {}) => {
     requestUrl: redactUrl2(requestUrl),
     requestMethod: method
   } : { requestUrl: redactUrl2(requestUrl), requestMethod: method };
-  const fetchOutcome = computeOutcome(response.status, payment, warnings);
+  const fetchOutcome = computeOutcome(
+    response.status,
+    payment,
+    warnings,
+    errorShapedSuccess
+  );
+  if (fetchOutcome !== "success" && diagnostics.snapshot().failureStage === null) {
+    if (fetchOutcome === "payment_rejected") {
+      diagnostics.fail("paid_replay", FETCH_DIAGNOSTIC_CODES.paymentRejected);
+    } else if (errorShapedSuccess) {
+      diagnostics.fail(
+        "upstream_response",
+        FETCH_DIAGNOSTIC_CODES.upstreamErrorPayload
+      );
+    } else if (response.status >= 500) {
+      diagnostics.fail("upstream_response", FETCH_DIAGNOSTIC_CODES.upstream5xx);
+    } else if (response.status >= 400) {
+      diagnostics.fail("upstream_response", FETCH_DIAGNOSTIC_CODES.upstream4xx);
+    }
+  }
   {
     const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
     if (!canRecord) {
@@ -166702,51 +167501,66 @@ var clientFetch = async (client, url4, opts = {}) => {
           try {
             derived = opts.deriveRunMetadata({
               status: response.status,
-              ok: response.ok,
+              ok: response.ok && !errorShapedSuccess,
               bodyRaw,
               ...bodyEncoding && { bodyEncoding }
             });
           } catch {
           }
         }
-        const result2 = await recordingClient.runs.create({
-          ...runTarget,
-          fetchId,
-          searchId: opts.searchId,
-          // Auto-resolved runs are always direct_url — they only fire when
-          // no capabilityId was supplied (the direct_url path by definition).
-          ...opts.capabilityId === void 0 ? { fetchOrigin: "direct_url" } : opts.fetchOrigin && { fetchOrigin: opts.fetchOrigin },
-          status: response.status,
-          // The SDK's verdict alongside the raw status. A close-fail or a
-          // dropped body answers 200 while the caller got nothing — the
-          // server must not read that as a clean success.
-          outcome: fetchOutcome,
-          latencyMs,
-          // Attribute to the selected wallet in session mode. Skipped when a
-          // per-call `account` override records the run — that account's own
-          // EIP-191 identity is the attribution.
-          ...opts.walletAddress && !opts.account && { walletAddress: opts.walletAddress },
-          ...opts.requestSchema && { requestSchema: opts.requestSchema },
-          ...derived?.responseSchema && {
-            responseSchema: derived.responseSchema
-          },
-          ...upstreamErrorForRecord && {
-            errorSnippetHash: upstreamErrorForRecord.snippetHash,
-            errorSnippetLength: upstreamErrorForRecord.snippetLength
-          },
-          ...payment && {
-            ...knownAmount && {
-              costAmount: payment.amount,
-              costAsset: payment.asset
+        const result2 = await diagnostics.measure(
+          "run_record",
+          () => recordingClient.runs.create({
+            ...runTarget,
+            fetchId,
+            searchId: opts.searchId,
+            // Auto-resolved runs are always direct_url — they only fire when
+            // no capabilityId was supplied (the direct_url path by definition).
+            ...opts.capabilityId === void 0 ? { fetchOrigin: "direct_url" } : opts.fetchOrigin && { fetchOrigin: opts.fetchOrigin },
+            status: response.status,
+            // The SDK's verdict alongside the raw status. A close-fail or a
+            // dropped body answers 200 while the caller got nothing — the
+            // server must not read that as a clean success.
+            outcome: fetchOutcome,
+            latencyMs,
+            settlementState: settlementStateFor(
+              payment,
+              warnings,
+              diagnostics.snapshot()
+            ),
+            failureStage: diagnostics.snapshot().failureStage ?? void 0,
+            failureCode: diagnostics.snapshot().failureCode ?? void 0,
+            fundingSource: diagnostics.snapshot().fundingSource ?? void 0,
+            stageDurationsMs: diagnostics.snapshot().stageDurationsMs,
+            warningCodes: warnings.length > 0 ? warnings : void 0,
+            // Attribute to the selected wallet in session mode. Skipped when a
+            // per-call `account` override records the run — that account's own
+            // EIP-191 identity is the attribution.
+            ...opts.walletAddress && !opts.account && { walletAddress: opts.walletAddress },
+            ...opts.requestSchema && { requestSchema: opts.requestSchema },
+            ...derived?.responseSchema && {
+              responseSchema: derived.responseSchema
             },
-            paymentProtocol: payment.protocol,
-            paymentChain: payment.chain,
-            paymentTxHash: payment.txHash ?? void 0,
-            paymentMode: payment.session ? "session" : "charge"
-          }
-        });
+            ...upstreamErrorForRecord && {
+              errorSnippetHash: upstreamErrorForRecord.snippetHash,
+              errorSnippetLength: upstreamErrorForRecord.snippetLength
+            },
+            ...payment && {
+              ...knownAmount && {
+                costAmount: payment.amount,
+                costAsset: payment.asset
+              },
+              paymentProtocol: payment.protocol,
+              paymentChain: payment.chain,
+              paymentTxHash: payment.txHash ?? void 0,
+              paymentMode: diagnostics.snapshot().paymentMode ?? (payment.session ? "session" : "charge"),
+              ...payment.session && { paymentSession: payment.session }
+            }
+          })
+        );
         runId = result2.runId;
       } catch (err) {
+        diagnostics.issue("run_record", FETCH_DIAGNOSTIC_CODES.runCreateFailed);
         const errorMessage2 = err instanceof Error ? err.message : String(err);
         const code = err instanceof ZeroError ? err.code : void 0;
         const skipMsg = code ? `run_create_failed:${code}: ${errorMessage2}` : `run_create_failed: ${errorMessage2}`;
@@ -166755,6 +167569,8 @@ var clientFetch = async (client, url4, opts = {}) => {
           level: "warn",
           message: "Failed to record run for fetch",
           meta: {
+            fetchId,
+            stage: "run_record",
             url: redactUrl2(url4),
             capabilityId: effectiveCapabilityId,
             error: errorMessage2,
@@ -166767,7 +167583,7 @@ var clientFetch = async (client, url4, opts = {}) => {
   const result = {
     fetchId,
     runId,
-    ok: response.ok,
+    ok: response.ok && !errorShapedSuccess,
     status: response.status,
     latencyMs,
     payment,
@@ -166776,11 +167592,12 @@ var clientFetch = async (client, url4, opts = {}) => {
     bodyRaw
   };
   if (bodyEncoding) result.bodyEncoding = bodyEncoding;
-  if (!response.ok) {
+  if (!response.ok || errorShapedSuccess) {
     const candidate = bodyRaw !== null && bodyRaw.length > 0 && bodyEncoding !== "base64" ? bodyRaw.slice(0, 240) : null;
     result.error = candidate !== null && !requestBodyEchoed(candidate, opts.body) ? candidate : `HTTP ${response.status}`;
     if (upstreamErrorForRecord) result.upstreamError = upstreamErrorForRecord;
   }
+  if (paymentCloseError) result.error = paymentCloseError;
   if (skipReasons.length > 0) {
     result.runTrackingSkipped = skipReasons;
   }
@@ -166843,7 +167660,6 @@ var agentZeroSessionSchema = external_exports3.object({
   user: external_exports3.object({ id: external_exports3.string() }).loose(),
   walletAddress: external_exports3.string().optional()
 }).loose();
-var JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var trimSlash = (value) => value.replace(/\/$/, "");
 var wrapNetworkError = (url4, err) => {
   const cause = err?.cause;
@@ -166853,6 +167669,80 @@ var wrapNetworkError = (url4, err) => {
     cause: err
   });
 };
+var getJson = async (fetchImpl, url4) => {
+  const response = await fetchImpl(url4).catch((err) => {
+    throw wrapNetworkError(url4, err);
+  });
+  if (!response.ok) {
+    throw new ZeroAgentAuthError(`GET ${url4} failed (${response.status})`, {
+      status: response.status
+    });
+  }
+  return await response.json();
+};
+var postJson = (fetchImpl, url4, body, schema) => post(fetchImpl, url4, "application/json", JSON.stringify(body), schema);
+var postForm = (fetchImpl, url4, fields, schema) => post(
+  fetchImpl,
+  url4,
+  "application/x-www-form-urlencoded",
+  new URLSearchParams(fields).toString(),
+  schema
+);
+var post = async (fetchImpl, url4, contentType, body, schema) => {
+  const response = await fetchImpl(url4, {
+    method: "POST",
+    headers: { "content-type": contentType },
+    body
+  }).catch((err) => {
+    throw wrapNetworkError(url4, err);
+  });
+  const text = await response.text();
+  let parsed = null;
+  try {
+    parsed = text ? JSON.parse(text) : null;
+  } catch {
+  }
+  if (!response.ok) {
+    const errBody = parsed;
+    const code = errBody?.code ?? errBody?.error;
+    throw new ZeroAgentAuthError(
+      `Agent auth request to ${url4} failed (${response.status}${typeof code === "string" ? `: ${code}` : ""})`,
+      { status: response.status, body: parsed ?? text }
+    );
+  }
+  return schema.parse(parsed);
+};
+var completeClaimAt = async (fetchImpl, claimEndpoint, input) => {
+  try {
+    const identity = await postJson(
+      fetchImpl,
+      `${claimEndpoint}/complete`,
+      { claim_token: input.claimToken, user_code: input.userCode },
+      completeClaimResponseSchema
+    );
+    return { status: "ok", ...identity };
+  } catch (err) {
+    if (err instanceof ZeroAgentAuthError && err.serverCode) {
+      if (err.serverCode === "claim_not_confirmed") {
+        return { status: "not_confirmed" };
+      }
+      if (err.serverCode === "invalid_user_code") {
+        return { status: "invalid_code" };
+      }
+      if ([
+        "user_code_expired",
+        "claim_expired",
+        "claim_revoked",
+        "already_claimed",
+        "claim_denied"
+      ].includes(err.serverCode)) {
+        return { status: "expired", code: err.serverCode };
+      }
+    }
+    throw err;
+  }
+};
+var JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var AuthAgent = class {
   constructor(client) {
     this.client = client;
@@ -166870,7 +167760,8 @@ var AuthAgent = class {
   };
   register = async () => {
     const endpoints = await this.endpoints();
-    return this.postJson(
+    return postJson(
+      this.client.fetchImpl,
       endpoints.identityEndpoint,
       { type: "anonymous" },
       identityEnvelopeSchema
@@ -166878,7 +167769,8 @@ var AuthAgent = class {
   };
   exchangeAssertion = async (identityAssertion) => {
     const endpoints = await this.endpoints();
-    return this.postForm(
+    return postForm(
+      this.client.fetchImpl,
       endpoints.tokenEndpoint,
       { grant_type: JWT_BEARER_GRANT_TYPE, assertion: identityAssertion },
       agentTokenResponseSchema
@@ -166908,7 +167800,8 @@ var AuthAgent = class {
         { status: 0 }
       );
     }
-    return this.postJson(
+    return postJson(
+      this.client.fetchImpl,
       endpoints.claimEndpoint,
       {
         type: "service_auth",
@@ -166918,8 +167811,6 @@ var AuthAgent = class {
       startClaimResponseSchema
     );
   };
-  // Submit the pairing code the human read off the hosted page. Terminal
-  // states map to a typed result; anything unexpected throws.
   completeClaim = async (input) => {
     const endpoints = await this.endpoints();
     if (!endpoints.claimEndpoint) {
@@ -166928,33 +167819,10 @@ var AuthAgent = class {
         { status: 0 }
       );
     }
-    try {
-      const identity = await this.postJson(
-        `${endpoints.claimEndpoint}/complete`,
-        { claim_token: input.claimToken, user_code: input.userCode },
-        completeClaimResponseSchema
-      );
-      return { status: "ok", ...identity };
-    } catch (err) {
-      if (err instanceof ZeroAgentAuthError && err.serverCode) {
-        if (err.serverCode === "claim_not_confirmed") {
-          return { status: "not_confirmed" };
-        }
-        if (err.serverCode === "invalid_user_code") {
-          return { status: "invalid_code" };
-        }
-        if ([
-          "user_code_expired",
-          "claim_expired",
-          "claim_revoked",
-          "already_claimed",
-          "claim_denied"
-        ].includes(err.serverCode)) {
-          return { status: "expired", code: err.serverCode };
-        }
-      }
-      throw err;
-    }
+    return completeClaimAt(this.client.fetchImpl, endpoints.claimEndpoint, {
+      claimToken: input.claimToken,
+      userCode: input.userCode
+    });
   };
   // Resolve (and cache) the agent-auth endpoints via discovery.
   endpoints = () => {
@@ -166967,13 +167835,15 @@ var AuthAgent = class {
     return this.endpointsPromise;
   };
   discover = async () => {
-    const resource = await this.getJson(
+    const resource = await getJson(
+      this.client.fetchImpl,
       `${trimSlash(this.client.baseUrl)}/.well-known/oauth-protected-resource`
     );
     let lastError = null;
     for (const server of resource.authorization_servers ?? []) {
       try {
-        const raw = await this.getJson(
+        const raw = await getJson(
+          this.client.fetchImpl,
           `${trimSlash(server)}/.well-known/oauth-authorization-server`
         );
         const metadata = agentAuthMetadataSchema.parse(raw);
@@ -166992,48 +167862,6 @@ var AuthAgent = class {
       { status: 0, cause: lastError }
     );
   };
-  getJson = async (url4) => {
-    const response = await this.client.fetchImpl(url4).catch((err) => {
-      throw wrapNetworkError(url4, err);
-    });
-    if (!response.ok) {
-      throw new ZeroAgentAuthError(`GET ${url4} failed (${response.status})`, {
-        status: response.status
-      });
-    }
-    return await response.json();
-  };
-  postJson = (url4, body, schema) => this.post(url4, "application/json", JSON.stringify(body), schema);
-  postForm = (url4, fields, schema) => this.post(
-    url4,
-    "application/x-www-form-urlencoded",
-    new URLSearchParams(fields).toString(),
-    schema
-  );
-  post = async (url4, contentType, body, schema) => {
-    const response = await this.client.fetchImpl(url4, {
-      method: "POST",
-      headers: { "content-type": contentType },
-      body
-    }).catch((err) => {
-      throw wrapNetworkError(url4, err);
-    });
-    const text = await response.text();
-    let parsed = null;
-    try {
-      parsed = text ? JSON.parse(text) : null;
-    } catch {
-    }
-    if (!response.ok) {
-      const errBody = parsed;
-      const code = errBody?.code ?? errBody?.error;
-      throw new ZeroAgentAuthError(
-        `Agent auth request to ${url4} failed (${response.status}${typeof code === "string" ? `: ${code}` : ""})`,
-        { status: response.status, body: parsed ?? text }
-      );
-    }
-    return schema.parse(parsed);
-  };
 };
 var userWalletDtoSchema = external_exports3.object({
   walletAddress: external_exports3.string(),
@@ -167144,6 +167972,294 @@ var AuthDevice = class {
     };
   };
 };
+var ID_JAG_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
+var idJagMintResponseSchema = external_exports3.object({
+  access_token: external_exports3.string(),
+  issued_token_type: external_exports3.string().optional(),
+  expires_in: external_exports3.number().optional()
+}).loose().transform((raw) => ({
+  idJag: raw.access_token,
+  issuedTokenType: raw.issued_token_type ?? ID_JAG_TOKEN_TYPE,
+  expiresIn: raw.expires_in ?? null
+}));
+var protectedResourceMetadataSchema = external_exports3.object({
+  resource: external_exports3.string().optional(),
+  resource_name: external_exports3.string().optional(),
+  authorization_servers: external_exports3.array(external_exports3.string()).optional()
+}).loose();
+var serviceAuthMetadataSchema = external_exports3.object({
+  resource: external_exports3.string().optional(),
+  resource_name: external_exports3.string().optional(),
+  token_endpoint: external_exports3.string().optional(),
+  agent_auth: external_exports3.object({
+    identity_endpoint: external_exports3.string(),
+    claim_endpoint: external_exports3.string().optional(),
+    identity_types_supported: external_exports3.array(external_exports3.string()).optional(),
+    identity_assertion: external_exports3.object({
+      assertion_types_supported: external_exports3.array(external_exports3.string()).optional(),
+      // Optional shared-audience hint: a platform fronting many
+      // storefronts advertises one audience (its AS) so a single
+      // consent covers the network.
+      audience: external_exports3.string().optional()
+    }).loose().optional()
+  }).loose()
+}).loose();
+var identityAssertionEnvelopeSchema = external_exports3.object({
+  id: external_exports3.string(),
+  identity: external_exports3.object({
+    assertion: external_exports3.string(),
+    expires_at: external_exports3.string().optional(),
+    refresh_token: external_exports3.object({ value: external_exports3.string() }).loose().optional()
+  }).loose(),
+  assertion_expires: external_exports3.string().nullable().optional()
+}).loose().transform((raw) => ({
+  registrationId: raw.id,
+  identityAssertion: raw.identity.assertion,
+  assertionExpires: raw.assertion_expires ?? raw.identity.expires_at ?? null,
+  refreshToken: raw.identity.refresh_token?.value ?? null
+}));
+var interactionRequiredBodySchema = external_exports3.object({
+  error_description: external_exports3.string().optional(),
+  claim: external_exports3.object({
+    token: external_exports3.string().optional(),
+    expires_at: external_exports3.string().optional(),
+    attempt: external_exports3.object({
+      verification_uri: external_exports3.string().optional(),
+      expires_at: external_exports3.string().optional()
+    }).loose().optional()
+  }).loose().optional()
+}).loose();
+var identityGrantSchema = external_exports3.object({ audience: external_exports3.string(), createdAt: external_exports3.string() }).loose();
+var identityGrantListSchema = external_exports3.object({ grants: external_exports3.array(identityGrantSchema) }).loose();
+var identityGrantRevokeSchema = external_exports3.object({ revoked: external_exports3.boolean() }).loose();
+var identityGrantRequestSchema = external_exports3.object({
+  requestId: external_exports3.string(),
+  approveUrl: external_exports3.string(),
+  expiresAt: external_exports3.string()
+}).loose();
+var identityGrantRequestStatusSchema = external_exports3.object({
+  requestId: external_exports3.string(),
+  status: external_exports3.enum(["pending", "approved", "denied", "expired"]),
+  audience: external_exports3.string(),
+  resourceName: external_exports3.string().nullable().optional()
+}).loose();
+var TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+var SUBJECT_TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+var JWT_BEARER_GRANT_TYPE2 = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var IDENTITY_ASSERTION_TYPE = "identity_assertion";
+var AuthIdentity = class {
+  constructor(client) {
+    this.client = client;
+  }
+  discover = async (url4) => {
+    const origin2 = new URL(url4).origin;
+    const prm = protectedResourceMetadataSchema.parse(
+      await getJson(
+        this.client.fetchImpl,
+        `${origin2}/.well-known/oauth-protected-resource`
+      )
+    );
+    let lastError = null;
+    for (const server of prm.authorization_servers ?? [origin2]) {
+      try {
+        const metadata = serviceAuthMetadataSchema.parse(
+          await getJson(
+            this.client.fetchImpl,
+            `${trimSlash(server)}/.well-known/oauth-authorization-server`
+          )
+        );
+        const agentAuth = metadata.agent_auth;
+        const assertionTypes = agentAuth.identity_assertion?.assertion_types_supported;
+        const resource = prm.resource ?? `${origin2}/`;
+        return {
+          resource,
+          mintAudience: agentAuth.identity_assertion?.audience ?? resource,
+          resourceName: prm.resource_name ?? metadata.resource_name ?? null,
+          authorizationServer: trimSlash(server),
+          identityEndpoint: agentAuth.identity_endpoint,
+          claimEndpoint: agentAuth.claim_endpoint ?? null,
+          tokenEndpoint: metadata.token_endpoint ?? `${trimSlash(server)}/oauth2/token`,
+          identityAssertionSupported: (agentAuth.identity_types_supported ?? []).includes(
+            IDENTITY_ASSERTION_TYPE
+          ) && (assertionTypes ? assertionTypes.includes(ID_JAG_TOKEN_TYPE) : true)
+        };
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw new ZeroAgentAuthError(
+      `No authorization server with an agent_auth block found at ${origin2} \u2014 agent auth is not enabled for this service.`,
+      { status: 0, cause: lastError }
+    );
+  };
+  // The minted grant is single-use (fresh jti) and minutes-lived — mint per
+  // registration, never cache.
+  mint = async (input) => {
+    const attempt = () => {
+      const credentials = this.client.getCredentials();
+      if (credentials.kind !== "session") {
+        throw new ZeroAuthError(
+          "auth_no_credentials",
+          "mint() requires session credentials \u2014 the ID-JAG asserts the signed-in user's identity."
+        );
+      }
+      return request2(
+        this.client,
+        {
+          method: "POST",
+          path: "/v1/oauth/token",
+          body: {
+            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+            subject_token: credentials.accessToken,
+            subject_token_type: SUBJECT_TOKEN_TYPE_ACCESS_TOKEN,
+            audience: input.audience,
+            requested_token_type: ID_JAG_TOKEN_TYPE
+          }
+        },
+        idJagMintResponseSchema
+      );
+    };
+    try {
+      return await attempt();
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.status === 400 && err.body?.error === "invalid_grant" && await this.client.refreshSessionOnce()) {
+        return await attempt();
+      }
+      throw err;
+    }
+  };
+  // Recoverable protocol states come back as typed outcomes; mint-bug
+  // rejections (invalid_audience, expired, …) throw. replay_detected is
+  // retried once with a freshly minted grant (single-use jti).
+  assert = async (input) => {
+    let discovery;
+    try {
+      discovery = input.discovery ?? await this.discover(input.url);
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError) {
+        return { status: "unsupported", discovery: null };
+      }
+      throw err;
+    }
+    if (!discovery.identityAssertionSupported) {
+      return { status: "unsupported", discovery };
+    }
+    try {
+      return await this.register(discovery);
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError && err.serverCode === "replay_detected") {
+        return await this.register(discovery);
+      }
+      throw err;
+    }
+  };
+  // RFC 7523 jwt-bearer. Bearer tokens are minutes-lived: exchange per work
+  // session, persist only the assertion + refresh token.
+  exchange = (input) => postForm(
+    this.client.fetchImpl,
+    input.tokenEndpoint,
+    { grant_type: JWT_BEARER_GRANT_TYPE2, assertion: input.assertion },
+    agentTokenResponseSchema
+  );
+  completeClaim = (input) => completeClaimAt(this.client.fetchImpl, input.claimEndpoint, {
+    claimToken: input.claimToken,
+    userCode: input.userCode
+  });
+  grants = (opts = {}) => request2(
+    this.client,
+    {
+      method: "GET",
+      path: "/v1/users/me/identity-grants",
+      signal: opts.signal
+    },
+    identityGrantListSchema
+  ).then((body) => body.grants);
+  // `resourceUrl` lets the server verify and display the service's
+  // name/logo on the approve page. Poll grantRequest() until decided.
+  requestGrant = (input) => request2(
+    this.client,
+    {
+      method: "POST",
+      path: "/v1/users/me/identity-grants/requests",
+      body: {
+        audience: input.audience,
+        ...input.resourceUrl ? { resourceUrl: input.resourceUrl } : {}
+      }
+    },
+    identityGrantRequestSchema
+  );
+  grantRequest = (requestId, opts = {}) => request2(
+    this.client,
+    {
+      method: "GET",
+      path: `/v1/users/me/identity-grants/requests/${requestId}`,
+      signal: opts.signal
+    },
+    identityGrantRequestStatusSchema
+  );
+  revokeGrant = (input) => request2(
+    this.client,
+    {
+      method: "DELETE",
+      path: "/v1/users/me/identity-grants",
+      query: { audience: input.audience }
+    },
+    identityGrantRevokeSchema
+  ).then((body) => body.revoked);
+  register = async (discovery) => {
+    let minted;
+    try {
+      minted = await this.mint({ audience: discovery.mintAudience });
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.body?.error === "consent_required") {
+        return { status: "consent_required", discovery };
+      }
+      throw err;
+    }
+    try {
+      const registration = await postJson(
+        this.client.fetchImpl,
+        discovery.identityEndpoint,
+        {
+          type: IDENTITY_ASSERTION_TYPE,
+          assertion_type: ID_JAG_TOKEN_TYPE,
+          assertion: minted.idJag
+        },
+        identityAssertionEnvelopeSchema
+      );
+      return { status: "ok", discovery, registration };
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError) {
+        if (err.serverCode === "issuer_not_enabled") {
+          return { status: "issuer_not_enabled", discovery };
+        }
+        const description = err.body?.error_description;
+        if (err.serverCode === "login_required") {
+          return {
+            status: "login_required",
+            discovery,
+            description: typeof description === "string" ? description : null
+          };
+        }
+        if (err.serverCode === "interaction_required") {
+          const body = interactionRequiredBodySchema.safeParse(err.body);
+          const claim3 = body.success ? body.data.claim : void 0;
+          return {
+            status: "interaction_required",
+            discovery,
+            claim: {
+              claimToken: claim3?.token ?? null,
+              claimTokenExpires: claim3?.expires_at ?? null,
+              verificationUri: claim3?.attempt?.verification_uri ?? null,
+              description: body.success ? body.data.error_description ?? null : null
+            }
+          };
+        }
+      }
+      throw err;
+    }
+  };
+};
 var userWalletsSchema = external_exports3.array(userWalletDtoSchema);
 var normalizeMessage = (message2) => {
   if (typeof message2 === "string") return message2;
@@ -167151,13 +168267,22 @@ var normalizeMessage = (message2) => {
   return bytesToHex(message2.raw);
 };
 var repackageSignFailure = (err, op) => {
-  if (err instanceof ZeroApiError && err.status === 402) {
+  if (err instanceof ZeroApiError) {
     const body = err.body;
     const detail = body && typeof body.error === "string" ? `: ${body.error}` : "";
-    throw new ZeroPaymentError(
-      `Sign endpoint refused ${op} (HTTP 402)${detail}`,
-      { cause: err }
-    );
+    if (err.status === 400 || err.status === 402) {
+      throw new ZeroPaymentError(
+        `Sign endpoint refused ${op} (HTTP ${err.status})${detail}`,
+        { cause: err }
+      );
+    }
+    if (err.status === 403 || err.status === 404) {
+      throw new ZeroAuthError(
+        "auth_error",
+        `Managed signer refused ${op} (HTTP ${err.status})${detail}`,
+        { cause: err }
+      );
+    }
   }
   throw err;
 };
@@ -167166,9 +168291,11 @@ var Auth = class {
     this.client = client;
     this.agent = new AuthAgent(client);
     this.device = new AuthDevice(client);
+    this.identity = new AuthIdentity(client);
   }
   agent;
   device;
+  identity;
   // The internal (web-app facing) user profile. Richer than profile(): full
   // wallet list with per-wallet delegation/signer/limit metadata.
   me = (opts = {}) => request2(
@@ -167583,6 +168710,13 @@ var Capabilities = class {
     }
   };
 };
+var paymentSessionSchema = external_exports3.object({
+  channelId: external_exports3.string().regex(/^0x[0-9a-fA-F]{64}$/),
+  escrowContract: external_exports3.string().regex(/^0x[0-9a-fA-F]{40}$/),
+  chainId: external_exports3.number().int().positive(),
+  recipient: external_exports3.string().regex(/^0x[0-9a-fA-F]{40}$/).nullable(),
+  cumulativeAmount: external_exports3.string().regex(/^(?:0|[1-9]\d*)$/)
+}).strict();
 var createRunResponseSchema = external_exports3.object({
   runId: external_exports3.string()
 });
@@ -167598,7 +168732,8 @@ var runListItemSchema = external_exports3.object({
     protocol: external_exports3.string(),
     chain: external_exports3.string().nullable(),
     txHash: external_exports3.string().nullable(),
-    mode: external_exports3.string().nullable()
+    mode: external_exports3.string().nullable(),
+    session: paymentSessionSchema.nullable().optional().default(null)
   }).nullable(),
   createdAt: external_exports3.coerce.date(),
   reviewed: external_exports3.boolean()
@@ -167618,7 +168753,8 @@ var runDetailSchema = external_exports3.object({
     protocol: external_exports3.string(),
     chain: external_exports3.string().nullable(),
     txHash: external_exports3.string().nullable(),
-    mode: external_exports3.string().nullable()
+    mode: external_exports3.string().nullable(),
+    session: paymentSessionSchema.nullable().optional().default(null)
   }).nullable(),
   capability: external_exports3.object({
     uid: external_exports3.string(),
@@ -167674,6 +168810,18 @@ var Runs = class _Runs {
    * unattributed runs, which it can't do if we strip the target as well.
    */
   static FIELD_GENERATIONS = [
+    // MPP channel anchor for close-failure reconciliation. Peels first so a
+    // newer SDK still records all prior diagnostics against an older API.
+    ["paymentSession"],
+    // Phase-localized observability + settlement confirmation.
+    [
+      "settlementState",
+      "failureStage",
+      "failureCode",
+      "fundingSource",
+      "stageDurationsMs",
+      "warningCodes"
+    ],
     // Newest: correlation + honest classification.
     ["fetchId", "outcome"],
     // ZERO-536: the direct-URL target. Dropping this loses attribution for an
@@ -167690,7 +168838,7 @@ var Runs = class _Runs {
    * target left to name, so that server could never have recorded it.
    */
   create = async (input, opts = {}) => {
-    const post = (body) => request2(
+    const post2 = (body) => request2(
       this.client,
       {
         method: "POST",
@@ -167704,7 +168852,7 @@ var Runs = class _Runs {
     let generation = 0;
     for (; ; ) {
       try {
-        return await post(payload);
+        return await post2(payload);
       } catch (err) {
         const rejected = err instanceof ZeroApiError && (err.status === 400 || err.status === 422);
         if (!rejected) throw err;
@@ -168172,11 +169320,7 @@ var classifyFetchError = (error98) => {
   }
 };
 var isCallerAbort = (error98) => {
-  const record3 = typeof error98 === "object" && error98 !== null ? error98 : null;
-  if (record3?.name === "AbortError") return true;
-  if (record3?.code !== "api_error" || record3.status !== 0) return false;
-  const cause = typeof record3.cause === "object" && record3.cause !== null ? record3.cause : null;
-  return cause?.name === "AbortError";
+  return isCallerAbortError(error98);
 };
 var AnalyticsEmitter = class {
   isEnabled;
@@ -168257,8 +169401,19 @@ var AnalyticsEmitter = class {
       error_class: res.outcome === "success" ? null : outcomeToErrorClass(res.outcome, res.status),
       latency_ms: res.latencyMs,
       has_payment: res.payment !== null,
-      payment_protocol: res.payment?.protocol ?? null,
+      payment_protocol: res.payment?.protocol ?? res.diagnostics?.paymentProtocol ?? null,
+      funding_source: res.diagnostics?.fundingSource ?? null,
       payment_amount: res.payment?.amount ?? null,
+      payment_chain: res.payment?.chain ?? null,
+      payment_mode: res.diagnostics?.paymentMode ?? (res.payment?.session ? "session" : res.payment ? "charge" : null),
+      has_settlement_anchor: res.diagnostics?.paymentMode !== "proof" && res.payment !== null && (res.payment.txHash !== null || res.payment.session !== void 0),
+      payment_session_channel_id: res.payment?.session?.channelId ?? null,
+      settlement_state: res.settlementState ?? null,
+      warning_codes: res.warnings ?? [],
+      failure_stage: res.diagnostics?.failureStage ?? null,
+      failure_code: res.diagnostics?.failureCode ?? null,
+      diagnostic_codes: res.diagnostics?.issues.map((issue3) => issue3.code) ?? [],
+      stage_durations_ms: res.diagnostics?.stageDurationsMs ?? {},
       // Opaque cap uid / slug / attribution token — not PII, useful for
       // joining back to the capabilities table in BI.
       capability_id: opts.capabilityId ?? null,
@@ -168277,12 +169432,20 @@ var AnalyticsEmitter = class {
       error_snippet_length: res.upstreamError?.snippetLength ?? null
     });
   }
-  fetchError(url4, opts, error98, errorClass, status) {
+  fetchError(url4, opts, error98, errorClass, status, fetchId = null, diagnostics) {
     if (!this.sink) return;
     this.emit("fetch_error", {
       url: redactUrl(url4),
       error_class: errorClass,
       status,
+      fetch_id: fetchId,
+      failure_stage: diagnostics?.failureStage ?? null,
+      failure_code: diagnostics?.failureCode ?? null,
+      payment_protocol: diagnostics?.paymentProtocol ?? null,
+      payment_mode: diagnostics?.paymentMode ?? null,
+      funding_source: diagnostics?.fundingSource ?? null,
+      diagnostic_codes: diagnostics?.issues.map((issue3) => issue3.code) ?? [],
+      stage_durations_ms: diagnostics?.stageDurationsMs ?? {},
       capability_id: opts.capabilityId ?? null,
       search_id: opts.searchId ?? null,
       error: safeErrorLabel(error98, errorClass)
@@ -168386,6 +169549,10 @@ var ZeroClient = class _ZeroClient {
   // public surface is the constructor option + emitted event types, not the
   // mutable emitter implementation.
   analytics;
+  // Every session token this client has held. Keep rotated values for the
+  // client's lifetime so a delayed rejection from an old request cannot leak
+  // the previous access/refresh token through a consumer logger.
+  sensitiveLogValues = /* @__PURE__ */ new Set();
   // Private — read via getCredentials(), mutate only via applyRefreshedTokens().
   // Keeping a single mutator funnel is what lets the transport replay
   // requests with a fresh access token after a 401 → refresh.
@@ -168436,6 +169603,9 @@ var ZeroClient = class _ZeroClient {
   refreshOverride;
   constructor(options = {}) {
     this.credentials = normalizeCredentials(options.session, options.account);
+    if (this.credentials.kind === "session") {
+      this.rememberSessionTokens(this.credentials);
+    }
     this.baseUrl = options.baseUrl ?? DEFAULT_BASE_URL;
     this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
     this.maxRetries = options.maxRetries ?? DEFAULT_MAX_RETRIES;
@@ -168443,7 +169613,7 @@ var ZeroClient = class _ZeroClient {
     this.defaultHeaders = options.defaultHeaders ?? {};
     this.fetchImpl = options.fetch ?? ((...args) => globalThis.fetch(...args));
     this.fetchOptions = options.fetchOptions;
-    this.logger = options.logger;
+    this.logger = options.logger ? (event) => options.logger?.(this.redactLogEvent(event)) : void 0;
     this.analyticsOptions = options.analytics;
     this.refreshOverride = options.refresh;
     this.withAccountCache = options._sharedAccountCache ?? /* @__PURE__ */ new Map();
@@ -168517,6 +169687,7 @@ var ZeroClient = class _ZeroClient {
   // still considered the source of truth for the current process.
   applyRefreshedTokens = async (next) => {
     if (this.credentials.kind !== "session") return;
+    this.rememberSessionTokens(next);
     this.credentials = {
       ...this.credentials,
       accessToken: next.accessToken,
@@ -168539,12 +169710,55 @@ var ZeroClient = class _ZeroClient {
   // callback). No-op outside session mode.
   setSessionTokens = (tokens2) => {
     if (this.credentials.kind !== "session") return;
+    this.rememberSessionTokens(tokens2);
     this.credentials = {
       ...this.credentials,
       accessToken: tokens2.accessToken,
       refreshToken: tokens2.refreshToken
     };
   };
+  rememberSessionTokens = (tokens2) => {
+    if (tokens2.accessToken) this.sensitiveLogValues.add(tokens2.accessToken);
+    if (tokens2.refreshToken) this.sensitiveLogValues.add(tokens2.refreshToken);
+  };
+  redactLogString = (value) => {
+    let redacted = value;
+    for (const secret of this.sensitiveLogValues) {
+      redacted = redacted.split(secret).join("[REDACTED]");
+    }
+    return redacted;
+  };
+  redactLogValue = (value, key, seen) => {
+    if (key && /(?:authorization|access[_-]?token|refresh[_-]?token|session[_-]?token)/i.test(
+      key
+    )) {
+      return "[REDACTED]";
+    }
+    if (typeof value === "string") return this.redactLogString(value);
+    if (!value || typeof value !== "object") return value;
+    if (seen.has(value)) return "[Circular]";
+    seen.add(value);
+    if (Array.isArray(value)) {
+      return value.map((item) => this.redactLogValue(item, void 0, seen));
+    }
+    return Object.fromEntries(
+      Object.entries(value).map(([childKey, childValue]) => [
+        childKey,
+        this.redactLogValue(childValue, childKey, seen)
+      ])
+    );
+  };
+  redactLogEvent = (event) => ({
+    ...event,
+    message: this.redactLogString(event.message),
+    ...event.meta && {
+      meta: this.redactLogValue(
+        event.meta,
+        void 0,
+        /* @__PURE__ */ new WeakSet()
+      )
+    }
+  });
   // Returns a new client bound to a different session, inheriting
   // transport config but with its own credential slot. Refreshes on the
   // sub-client never mutate the base — critical for multi-tenant servers
@@ -168735,8 +169949,8 @@ var ZeroClient = class _ZeroClient {
       return Promise.reject(
         abortErr(new DOMException("Aborted", "AbortError"))
       );
-    return new Promise((resolve7, reject) => {
-      const onAbort = () => reject(abortErr(new DOMException("Aborted", "AbortError")));
+    return new Promise((resolve7, reject2) => {
+      const onAbort = () => reject2(abortErr(new DOMException("Aborted", "AbortError")));
       signal.addEventListener("abort", onAbort, { once: true });
       p.then(
         (v) => {
@@ -168745,7 +169959,7 @@ var ZeroClient = class _ZeroClient {
         },
         (e) => {
           signal.removeEventListener("abort", onAbort);
-          reject(e);
+          reject2(e);
         }
       );
     });
@@ -168783,15 +169997,32 @@ var ZeroClient = class _ZeroClient {
   // path is flat on the client, same rationale as `search` above.
   // Orchestration lives in fetch.ts so this class stays readable.
   fetch = async (url4, opts = {}) => {
+    const fetchId = randomUUID();
+    const diagnostics = new FetchDiagnosticContext(fetchId);
     try {
-      const result = await clientFetch(this, url4, opts);
+      const result = await clientFetch(this, url4, opts, diagnostics);
+      result.diagnostics = diagnostics.snapshot();
+      result.settlementState = settlementStateFor(
+        result.payment,
+        result.warnings,
+        diagnostics.snapshot()
+      );
       this.analytics.fetchExecuted(url4, opts, result);
       return result;
     } catch (error98) {
       if (this.analytics.isEnabled && !isCallerAbort(error98)) {
         const { errorClass, status } = classifyFetchError(error98);
-        this.analytics.fetchError(url4, opts, error98, errorClass, status);
+        this.analytics.fetchError(
+          url4,
+          opts,
+          error98,
+          errorClass,
+          status,
+          fetchId,
+          diagnostics.snapshot()
+        );
       }
+      attachFetchErrorContext(error98, fetchId, diagnostics.snapshot());
       throw error98;
     }
   };
@@ -169026,7 +170257,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.27.1"};
+  version: "1.29.0"};
 
 // src/app.ts
 init_esm_shims();
@@ -169549,11 +170780,11 @@ var baseOpen = async (options) => {
   }
   const subprocess = childProcess.spawn(command, cliArguments, childProcessOptions);
   if (options.wait) {
-    return new Promise((resolve7, reject) => {
-      subprocess.once("error", reject);
+    return new Promise((resolve7, reject2) => {
+      subprocess.once("error", reject2);
       subprocess.once("close", (exitCode) => {
         if (!options.allowNonzeroExitCode && exitCode !== 0) {
-          reject(new Error(`Exited with code ${exitCode}`));
+          reject2(new Error(`Exited with code ${exitCode}`));
           return;
         }
         resolve7(subprocess);
@@ -169561,13 +170792,13 @@ var baseOpen = async (options) => {
     });
   }
   if (isFallbackAttempt) {
-    return new Promise((resolve7, reject) => {
-      subprocess.once("error", reject);
+    return new Promise((resolve7, reject2) => {
+      subprocess.once("error", reject2);
       subprocess.once("spawn", () => {
         subprocess.once("close", (exitCode) => {
-          subprocess.off("error", reject);
+          subprocess.off("error", reject2);
           if (exitCode !== 0) {
-            reject(new Error(`Exited with code ${exitCode}`));
+            reject2(new Error(`Exited with code ${exitCode}`));
             return;
           }
           subprocess.unref();
@@ -169577,10 +170808,10 @@ var baseOpen = async (options) => {
     });
   }
   subprocess.unref();
-  return new Promise((resolve7, reject) => {
-    subprocess.once("error", reject);
+  return new Promise((resolve7, reject2) => {
+    subprocess.once("error", reject2);
     subprocess.once("spawn", () => {
-      subprocess.off("error", reject);
+      subprocess.off("error", reject2);
       resolve7(subprocess);
     });
   });
@@ -169678,13 +170909,458 @@ var readConfig = (path3) => {
   }
 };
 
-// src/commands/auth-command.ts
+// src/commands/auth-identity-command.ts
+init_esm_shims();
 var getConfigPath = () => join$1(homedir(), ".zero", "config.json");
+var CLAIM_NOT_CONFIRMED_RETRIES = 12;
+var CLAIM_NOT_CONFIRMED_INTERVAL_S = 5;
+var CONSENT_POLL_INTERVAL_S = 3;
+var ASSERTION_EXPIRY_MARGIN_MS = 6e4;
+var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var normalizeUrl = (raw) => {
+  try {
+    return new URL(/^https?:\/\//.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    return null;
+  }
+};
+var updateServiceIdentity = (host, update2) => {
+  const path3 = getConfigPath();
+  ensureSecureDir(dirname(path3));
+  const config3 = readConfig(path3);
+  const identities = { ...config3.serviceIdentities };
+  const next = update2(identities[host] ?? {});
+  if (next === void 0) {
+    delete identities[host];
+  } else {
+    identities[host] = next;
+  }
+  writeSecureFile(
+    path3,
+    JSON.stringify({ ...config3, serviceIdentities: identities }, null, 2)
+  );
+};
+var isUsable = (expiresAt) => {
+  if (!expiresAt) return true;
+  const parsed = Date.parse(expiresAt);
+  return Number.isNaN(parsed) ? true : parsed - ASSERTION_EXPIRY_MARGIN_MS > Date.now();
+};
+var emitAccessToken = (accessToken, discovery, host, json3, reused) => {
+  if (json3) {
+    process.stdout.write(
+      `${JSON.stringify({
+        status: "ok",
+        accessToken,
+        resource: discovery.resource,
+        resourceName: discovery.resourceName,
+        tokenEndpoint: discovery.tokenEndpoint,
+        reused
+      })}
+`
+    );
+    return;
+  }
+  process.stderr.write(
+    [
+      `Signed in to ${discovery.resourceName ?? host} with your Zero identity.`,
+      "The bearer token below is short-lived \u2014 use it right away:",
+      `  zero fetch <url> -H "Authorization: Bearer <token>"`,
+      `Re-run this command for a fresh token; it reuses the stored registration.`,
+      ""
+    ].join("\n")
+  );
+  process.stdout.write(`${accessToken}
+`);
+};
+var exchangeAndEmit = async (client, discovery, host, assertion, json3, reused) => {
+  const token = await client.auth.identity.exchange({ tokenEndpoint: discovery.tokenEndpoint, assertion }).catch((err) => {
+    process.stderr.write(
+      `Token exchange at ${discovery.tokenEndpoint} failed: ${truncateError(
+        err instanceof Error ? err.message : String(err)
+      )}
+`
+    );
+    return null;
+  });
+  if (!token) return false;
+  emitAccessToken(token.accessToken, discovery, host, json3, reused);
+  return true;
+};
+var completeServiceClaim = async (client, discovery, host, claimToken, userCode, json3) => {
+  if (!discovery.claimEndpoint) {
+    process.stderr.write(
+      "The service advertises no claim endpoint \u2014 cannot complete the claim.\n"
+    );
+    return false;
+  }
+  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES; attempt++) {
+    const result = await client.auth.identity.completeClaim({
+      claimEndpoint: discovery.claimEndpoint,
+      claimToken,
+      userCode
+    }).catch((err) => {
+      process.stderr.write(
+        `
+Claim completion failed: ${truncateError(
+          err instanceof Error ? err.message : String(err)
+        )}
+`
+      );
+      return null;
+    });
+    if (result === null) return false;
+    if (result.status === "not_confirmed") {
+      if (!json3) process.stderr.write(".");
+      await sleep2(CLAIM_NOT_CONFIRMED_INTERVAL_S * 1e3);
+      continue;
+    }
+    if (result.status === "invalid_code") {
+      process.stderr.write(
+        "\nThat pairing code was not accepted. Ask the account owner to re-read the code from the claim page and try again.\n"
+      );
+      return false;
+    }
+    if (result.status === "expired") {
+      process.stderr.write(
+        `
+The claim attempt is no longer valid (${result.code}). Re-run \`zero auth identity ${host}\` for a fresh one.
+`
+      );
+      updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => rest);
+      return false;
+    }
+    updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => ({
+      ...rest,
+      assertion: result.identityAssertion,
+      ...result.assertionExpires && {
+        assertionExpires: result.assertionExpires
+      },
+      ...result.refreshToken && { refreshToken: result.refreshToken }
+    }));
+    return exchangeAndEmit(
+      client,
+      discovery,
+      host,
+      result.identityAssertion,
+      json3,
+      false
+    );
+  }
+  process.stderr.write(
+    "\nThe account owner never confirmed the claim on the page. Re-run with --claim-code once they have.\n"
+  );
+  return false;
+};
+var authIdentityCommand = (appContext) => new Command("identity").description(
+  "Sign in to a service that accepts ID-JAG identity assertion \u2014 mints one from Zero, registers it, and prints a bearer token for the service's API"
+).argument("<url>", "The service host, or any URL on it").option(
+  "--claim-code <code>",
+  "Finish an interaction_required claim with the pairing code the account owner read off the claim page"
+).option("--json", "Emit machine-readable JSON instead of human text").action(
+  async (rawUrl, opts) => {
+    const { client, analyticsService } = appContext.services;
+    const json3 = opts.json ?? false;
+    const target = normalizeUrl(rawUrl);
+    if (!target) {
+      process.stderr.write(`Not a valid URL or host: ${rawUrl}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const host = target.host;
+    const capture = (outcome2) => analyticsService.capture("auth_identity_asserted", {
+      host,
+      outcome: outcome2,
+      json: json3
+    });
+    if (client.getCredentials().kind !== "session") {
+      process.stderr.write(
+        "Identity assertion needs a signed-in Zero session. Run `zero auth login` (humans) or `zero auth agent register` + `zero auth agent claim` (agents) first.\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    let discovery;
+    try {
+      discovery = await client.auth.identity.discover(target.toString());
+    } catch (err) {
+      capture("unsupported");
+      process.stderr.write(
+        `${truncateError(err instanceof Error ? err.message : String(err))}
+This host does not appear to support agent auth. If it serves an /auth.md, follow that instead.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.claimCode) {
+      const pending = readConfig(getConfigPath()).serviceIdentities?.[host]?.pendingClaim;
+      if (!pending) {
+        process.stderr.write(
+          `No pending identity claim for ${host}. Run \`zero auth identity ${host}\` first.
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const ok = await completeServiceClaim(
+        client,
+        discovery,
+        host,
+        pending.token,
+        opts.claimCode.trim(),
+        json3
+      );
+      capture(ok ? "claim_completed" : "error");
+      if (!ok) process.exitCode = 1;
+      return;
+    }
+    if (!discovery.identityAssertionSupported) {
+      capture("unsupported");
+      process.stderr.write(
+        `${discovery.resourceName ?? host} does not accept identity assertion. Fall back to its standard agent auth (see ${target.origin}/auth.md).
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const stored = readConfig(getConfigPath()).serviceIdentities?.[host];
+    if (stored?.assertion && isUsable(stored.assertionExpires)) {
+      const token = await client.auth.identity.exchange({
+        tokenEndpoint: discovery.tokenEndpoint,
+        assertion: stored.assertion
+      }).catch(() => null);
+      if (token) {
+        capture("reused");
+        emitAccessToken(token.accessToken, discovery, host, json3, true);
+        return;
+      }
+    }
+    const runAssert = async () => {
+      try {
+        return await client.auth.identity.assert({
+          url: target.toString(),
+          discovery
+        });
+      } catch (err) {
+        capture("error");
+        if (err instanceof ZeroApiError && err.body?.error === "account_unclaimed") {
+          process.stderr.write(
+            "This Zero account has no human owner yet \u2014 identity assertion is only available on claimed accounts. Run `zero auth agent claim <email>` first.\n"
+          );
+        } else {
+          process.stderr.write(
+            `Identity assertion failed: ${truncateError(err instanceof Error ? err.message : String(err))}
+`
+          );
+        }
+        return null;
+      }
+    };
+    let outcome = await runAssert();
+    if (!outcome) {
+      process.exitCode = 1;
+      return;
+    }
+    if (outcome.status === "consent_required") {
+      const requested = await client.auth.identity.requestGrant({
+        audience: discovery.mintAudience,
+        resourceUrl: target.origin
+      }).catch((err) => {
+        process.stderr.write(
+          `Could not create the consent request: ${truncateError(err instanceof Error ? err.message : String(err))}
+`
+        );
+        return null;
+      });
+      if (!requested) {
+        capture("error");
+        process.exitCode = 1;
+        return;
+      }
+      process.stderr.write(
+        [
+          "",
+          `Signing in to ${discovery.resourceName ?? host} needs the user's one-time consent.`,
+          `Send them here to approve: ${requested.approveUrl}`,
+          `(valid until ${requested.expiresAt}; the decision is remembered on their Zero account)`,
+          "Waiting for their decision\u2026"
+        ].join("\n")
+      );
+      let decision = "expired";
+      for (; ; ) {
+        const status = await client.auth.identity.grantRequest(requested.requestId).catch(() => null);
+        if (status && status.status !== "pending") {
+          decision = status.status;
+          break;
+        }
+        process.stderr.write(".");
+        await sleep2(CONSENT_POLL_INTERVAL_S * 1e3);
+      }
+      process.stderr.write("\n");
+      if (decision === "denied") {
+        capture("consent_denied");
+        process.stderr.write(
+          "The user denied the request \u2014 not signing in.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+      if (decision === "expired") {
+        capture("consent_expired");
+        process.stderr.write(
+          "The approval link expired before the user decided. Re-run to mint a fresh one.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+      outcome = await runAssert();
+      if (!outcome) {
+        process.exitCode = 1;
+        return;
+      }
+      if (outcome.status === "consent_required") {
+        capture("error");
+        process.stderr.write(
+          "The issuer still reports consent_required after approval \u2014 retry, and report this if it persists.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+    }
+    switch (outcome.status) {
+      case "ok": {
+        updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => ({
+          ...rest,
+          registrationId: outcome.registration.registrationId,
+          assertion: outcome.registration.identityAssertion,
+          ...outcome.registration.assertionExpires && {
+            assertionExpires: outcome.registration.assertionExpires
+          },
+          ...outcome.registration.refreshToken && {
+            refreshToken: outcome.registration.refreshToken
+          },
+          ...discovery.resourceName && {
+            resourceName: discovery.resourceName
+          }
+        }));
+        const ok = await exchangeAndEmit(
+          client,
+          discovery,
+          host,
+          outcome.registration.identityAssertion,
+          json3,
+          false
+        );
+        capture(ok ? "ok" : "error");
+        if (!ok) process.exitCode = 1;
+        return;
+      }
+      case "unsupported":
+      case "issuer_not_enabled": {
+        capture(outcome.status);
+        process.stderr.write(
+          `${discovery.resourceName ?? host} does not accept Zero identity assertions${outcome.status === "issuer_not_enabled" ? " (Zero is not on its issuer trust list)" : ""}. Fall back to its standard agent auth (see ${target.origin}/auth.md).
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      case "login_required": {
+        capture("login_required");
+        process.stderr.write(
+          `The service requires a fresher Zero sign-in${outcome.description ? ` (${outcome.description})` : ""}. Run \`zero auth login\` again, then retry \u2014 nothing at the service side helps.
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      case "interaction_required": {
+        capture("interaction_required");
+        const { claim: claim3 } = outcome;
+        if (!claim3.claimToken || !claim3.verificationUri) {
+          process.stderr.write(
+            `The service requires account-owner confirmation but returned no claim handle${claim3.description ? ` (${claim3.description})` : ""}.
+`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        updateServiceIdentity(host, (current) => ({
+          ...current,
+          pendingClaim: {
+            token: claim3.claimToken,
+            verificationUri: claim3.verificationUri ?? void 0,
+            expiresAt: claim3.claimTokenExpires ?? void 0
+          }
+        }));
+        if (json3) {
+          process.stdout.write(
+            `${JSON.stringify({
+              status: "interaction_required",
+              verificationUri: claim3.verificationUri,
+              expiresAt: claim3.claimTokenExpires,
+              next: `The claim page shows the account owner a pairing code. Re-run \`zero auth identity ${host} --claim-code <code>\` with it.`
+            })}
+`
+          );
+        } else {
+          process.stderr.write(
+            [
+              "",
+              `Your email already has an account at ${discovery.resourceName ?? host} \u2014 its owner must confirm the link.`,
+              `Send them here: ${claim3.verificationUri}`,
+              "The page shows THEM a pairing code.",
+              ...claim3.claimTokenExpires ? [`(link valid until ${claim3.claimTokenExpires})`] : [],
+              ""
+            ].join("\n")
+          );
+        }
+        if (!process.stdin.isTTY) {
+          if (!json3) {
+            process.stderr.write(
+              `Once they read the code back, run: zero auth identity ${host} --claim-code <code>
+`
+            );
+          }
+          return;
+        }
+        const rl = createInterface$1({
+          input: process.stdin,
+          output: process.stderr
+        });
+        const userCode = (await rl.question("Enter the pairing code they read back: ")).trim();
+        rl.close();
+        if (!userCode) {
+          process.stderr.write(
+            `No code entered. Re-run \`zero auth identity ${host} --claim-code <code>\` when you have it.
+`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const ok = await completeServiceClaim(
+          client,
+          discovery,
+          host,
+          claim3.claimToken,
+          userCode,
+          json3
+        );
+        if (!ok) process.exitCode = 1;
+        return;
+      }
+    }
+  }
+);
+
+// src/commands/auth-command.ts
+var getConfigPath2 = () => join$1(homedir(), ".zero", "config.json");
 var FINISH_POLL_INTERVAL_S = 2;
 var FINISH_MAX_WAIT_MS = 10 * 60 * 1e3;
-var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var persistSession = (result) => {
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   ensureSecureDir(dirname(path3));
   const current = readConfig(path3);
   const next = {
@@ -169702,7 +171378,7 @@ var LEGACY_KEY_NOTICE = {
   message: "A wallet private key from a previous setup is still on this machine. Now that you're signed in, your managed Zero wallet signs payments \u2014 the old key is no longer used.",
   keep: "zero wallet set <key>"
 };
-var hasLegacyPrivateKey = () => readConfig(getConfigPath()).privateKey !== void 0;
+var hasLegacyPrivateKey = () => readConfig(getConfigPath2()).privateKey !== void 0;
 var reportSignedIn = (result, json3, la) => {
   const legacyKeyPresent = hasLegacyPrivateKey();
   la?.analytics.capture("auth_login_completed", {
@@ -169802,7 +171478,7 @@ var runFinish = async (client, deviceCode, json3, la) => {
       } else if (!json3) {
         process.stdout.write(".");
       }
-      await sleep2(FINISH_POLL_INTERVAL_S * 1e3);
+      await sleep3(FINISH_POLL_INTERVAL_S * 1e3);
       continue;
     }
     if (result.status === "expired") {
@@ -169829,7 +171505,7 @@ User code: ${start.userCode}
     });
   }
   while (Date.now() < start.expiresAt) {
-    await sleep2(start.pollInterval * 1e3);
+    await sleep3(start.pollInterval * 1e3);
     const result = await client.auth.device.poll(start.deviceCode);
     if (result.status === "pending") {
       process.stdout.write(".");
@@ -169865,7 +171541,7 @@ var authLoginCommand = (appContext) => new Command("login").description("Sign in
       return;
     }
     const mode = opts.finish ? "finish" : "interactive";
-    const hadPriorSession = readConfig(getConfigPath()).session !== void 0;
+    const hadPriorSession = readConfig(getConfigPath2()).session !== void 0;
     analyticsService.capture("auth_login_started", { mode, json: json3 });
     const la = {
       analytics: analyticsService,
@@ -169890,7 +171566,7 @@ var authLoginCommand = (appContext) => new Command("login").description("Sign in
 );
 var authLogoutCommand = (appContext) => new Command("logout").description("Sign out of Zero").action(async () => {
   const { client, analyticsService } = appContext.services;
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   const config3 = readConfig(path3);
   const hadSession = config3.session !== void 0;
   if (config3.session) {
@@ -169995,7 +171671,7 @@ var authAgentRegisterCommand = (appContext) => new Command("register").descripti
 ).option("--json", "Emit machine-readable JSON instead of human text").action(async (opts) => {
   const { client } = appContext.services;
   const json3 = opts.json ?? false;
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   if (readConfig(path3).session) {
     process.stderr.write(
       "Already signed in. Run `zero auth logout` first if you want a fresh account.\n"
@@ -170075,12 +171751,12 @@ Agent registration may not be enabled for this service yet.
     ].join("\n")
   );
 });
-var CLAIM_NOT_CONFIRMED_RETRIES = 12;
-var CLAIM_NOT_CONFIRMED_INTERVAL_S = 5;
+var CLAIM_NOT_CONFIRMED_RETRIES2 = 12;
+var CLAIM_NOT_CONFIRMED_INTERVAL_S2 = 5;
 var completeClaimAndExchange = async (agentAuth, claimToken, userCode, email5, json3) => {
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   let verified = null;
-  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES; attempt++) {
+  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES2; attempt++) {
     const result = await agentAuth.completeClaim({ claimToken, userCode }).catch((err) => {
       process.stderr.write(
         `
@@ -170092,7 +171768,7 @@ Claim completion failed: ${truncateError(err instanceof Error ? err.message : St
     if (result === null) return false;
     if (result.status === "not_confirmed") {
       if (!json3) process.stdout.write(".");
-      await sleep2(CLAIM_NOT_CONFIRMED_INTERVAL_S * 1e3);
+      await sleep3(CLAIM_NOT_CONFIRMED_INTERVAL_S2 * 1e3);
       continue;
     }
     if (result.status === "invalid_code") {
@@ -170160,7 +171836,7 @@ var authAgentClaimCommand = (appContext) => new Command("claim").description(
 ).option("--json", "Emit machine-readable JSON instead of human text").action(async (email5, opts) => {
   const { client } = appContext.services;
   const json3 = opts.json ?? false;
-  const config3 = readConfig(getConfigPath());
+  const config3 = readConfig(getConfigPath2());
   const registration = config3.agentRegistration;
   if (!registration?.claimToken) {
     process.stderr.write(
@@ -170253,13 +171929,13 @@ var authAgentCommand = (appContext) => {
   return cmd;
 };
 var ensureAuthenticated = async (client, shouldOpen = true) => {
-  const session5 = readConfig(getConfigPath()).session;
+  const session5 = readConfig(getConfigPath2()).session;
   if (session5) return;
   process.stdout.write(
     "\nZero requires authentication before handing off to Claude.\n\n"
   );
   await runInteractive(client, shouldOpen);
-  if (!readConfig(getConfigPath()).session) {
+  if (!readConfig(getConfigPath2()).session) {
     process.exitCode = 1;
     process.exit(1);
   }
@@ -170268,6 +171944,7 @@ var authCommand = (appContext) => {
   const cmd = new Command("auth").description("Authentication commands");
   cmd.addCommand(authLoginCommand(appContext).alias("register"));
   cmd.addCommand(authAgentCommand(appContext));
+  cmd.addCommand(authIdentityCommand(appContext));
   cmd.addCommand(authLogoutCommand(appContext));
   cmd.addCommand(authExchangeCommand(appContext));
   cmd.addCommand(authWhoamiCommand(appContext), { hidden: true });
@@ -170666,7 +172343,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
   "Bind this fetch to a capability (uid or slug) so a reviewable run is recorded even without a prior `zero search`"
 ).option(
   "--json",
-  "Emit {runId, ok, status, latencyMs, payment, body, bodyRaw} as JSON on stdout (for batch/non-TTY use)"
+  "Emit the full result envelope as JSON on stdout \u2014 fetchId, runId, ok, outcome, status, latencyMs, payment, settlementState, diagnostics, body, bodyRaw (plus upstreamError/warnings when present) \u2014 for batch/non-TTY use"
 ).option(
   "--raw-body",
   "With --json: keep `body` as the raw response string instead of parsing JSON. `bodyRaw` still reflects the raw text."
@@ -170864,8 +172541,19 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         });
       } catch (err) {
         const message2 = err instanceof Error ? err.message : "Fetch failed";
+        const fetchContext = fetchErrorContext(err);
         analyticsService.capture("fetch_error", {
           cliErrorClass: "network",
+          fetchId: fetchContext.fetchId,
+          failureStage: fetchContext.diagnostics?.failureStage,
+          failureCode: fetchContext.diagnostics?.failureCode,
+          paymentProtocol: fetchContext.diagnostics?.paymentProtocol,
+          paymentMode: fetchContext.diagnostics?.paymentMode,
+          fundingSource: fetchContext.diagnostics?.fundingSource,
+          diagnosticCodes: fetchContext.diagnostics?.issues?.map(
+            (issue3) => issue3.code
+          ),
+          stageDurationsMs: fetchContext.diagnostics?.stageDurationsMs,
           url: redactUrl(resolvedUrl),
           error: truncateError(message2)
         });
@@ -170874,6 +172562,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         return;
       }
       const {
+        fetchId,
         runId,
         status,
         latencyMs,
@@ -170886,7 +172575,9 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         warnings: sdkWarnings,
         runTrackingSkipped: sdkSkipReasons,
         error: resultError,
-        capabilityResolution
+        capabilityResolution,
+        settlementState,
+        diagnostics
       } = result;
       const isBinary = bodyEncoding === "base64";
       const bodyBytes = isBinary && bodyRaw ? Buffer.from(bodyRaw, "base64") : void 0;
@@ -170992,6 +172683,15 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         );
         analyticsService.capture("fetch_error", {
           cliErrorClass,
+          fetchId,
+          settlementState,
+          failureStage: diagnostics?.failureStage,
+          failureCode: diagnostics?.failureCode,
+          paymentProtocol: diagnostics?.paymentProtocol,
+          paymentMode: diagnostics?.paymentMode,
+          fundingSource: diagnostics?.fundingSource,
+          diagnosticCodes: diagnostics?.issues.map((issue3) => issue3.code),
+          stageDurationsMs: diagnostics?.stageDurationsMs,
           capabilityUid: capabilityUid ?? void 0,
           capabilitySlug: capabilitySlug ?? void 0,
           capabilityId: capabilityId ?? void 0,
@@ -171058,11 +172758,18 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         ];
         console.log(
           JSON.stringify({
+            fetchId,
             runId,
             ok,
+            // The canonical FetchOutcome discriminator — the field an
+            // agent branches on (payment_failed vs insufficient_funds
+            // vs server_error vs …). `ok` alone can't distinguish them.
+            outcome,
             status,
             latencyMs,
             payment: payment ?? null,
+            settlementState,
+            diagnostics,
             body: envBody,
             bodyRaw: status === null ? null : bodyRaw,
             ...isBinary && { bodyEncoding: "base64" },
@@ -175130,11 +176837,11 @@ var PostHogCoreStateless = class {
     let timeoutHandle;
     try {
       return await Promise.race([
-        new Promise((_, reject) => {
+        new Promise((_, reject2) => {
           timeoutHandle = safeSetTimeout(() => {
             this._logger.error("Timed out while shutting down PostHog");
             hasTimedOut = true;
-            reject("Timeout while shutting down PostHog. Some events may not have been sent.");
+            reject2("Timeout while shutting down PostHog. Some events may not have been sent.");
           }, shutdownTimeoutMs);
         }),
         doShutdown()
@@ -176583,7 +178290,7 @@ var FeatureFlagsPoller = class {
       const shutdownResult = this.cacheProvider.shutdown();
       if (shutdownResult instanceof Promise) await Promise.race([
         shutdownResult,
-        new Promise((_, reject) => setTimeout(() => reject(new Error(`Cache shutdown timeout after ${timeoutMs}ms`)), timeoutMs))
+        new Promise((_, reject2) => setTimeout(() => reject2(new Error(`Cache shutdown timeout after ${timeoutMs}ms`)), timeoutMs))
       ]);
     } catch (err) {
       this.onError?.(new Error(`Error during cache shutdown: ${err}`));
@@ -177738,7 +179445,18 @@ var mapSdkEventToCliEvent = (event) => {
           latencyMs: p.latency_ms,
           hasPayment: p.has_payment,
           paymentProtocol: orUndef(p.payment_protocol),
+          fundingSource: orUndef(p.funding_source),
           paymentAmount: dropUnknownAmount(p.payment_amount),
+          paymentChain: orUndef(p.payment_chain),
+          paymentMode: orUndef(p.payment_mode),
+          paymentSessionChannelId: orUndef(p.payment_session_channel_id),
+          hasSettlementAnchor: p.has_settlement_anchor,
+          settlementState: orUndef(p.settlement_state),
+          warningCodes: p.warning_codes,
+          failureStage: orUndef(p.failure_stage),
+          failureCode: orUndef(p.failure_code),
+          diagnosticCodes: p.diagnostic_codes,
+          stageDurationsMs: p.stage_durations_ms,
           runId: orUndef(p.run_id),
           runTracked: p.run_tracked,
           error: orUndef(p.error),