@zeroxyz/cli 1.28.0 → 1.29.0

package/dist/index.js

@@ -62738,10 +62738,10 @@ var require_provider_etherscan = __commonJS({
        *
        *  If %%post%%, the request is made as a POST request.
        */
-      async fetch(module2, params, post) {
+      async fetch(module2, params, post2) {
         const id = nextId++;
-        const url4 = post ? this.getPostUrl() : this.getUrl(module2, params);
-        const payload = post ? this.getPostData(module2, params) : null;
+        const url4 = post2 ? this.getPostUrl() : this.getUrl(module2, params);
+        const payload = post2 ? this.getPostData(module2, params) : null;
         this.emit("debug", { action: "sendRequest", id, url: url4, payload });
         const request3 = new index_js_4.FetchRequest(url4);
         request3.setThrottleParams({ slotInterval: 1e3 });
@@ -78668,7 +78668,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-PLDXIESP.js
+// ../sdk/dist/chunk-5334O6ZN.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -164365,7 +164365,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.21.0"
+  version: "0.22.0"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -167660,7 +167660,6 @@ var agentZeroSessionSchema = external_exports3.object({
   user: external_exports3.object({ id: external_exports3.string() }).loose(),
   walletAddress: external_exports3.string().optional()
 }).loose();
-var JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var trimSlash = (value) => value.replace(/\/$/, "");
 var wrapNetworkError = (url4, err) => {
   const cause = err?.cause;
@@ -167670,6 +167669,80 @@ var wrapNetworkError = (url4, err) => {
     cause: err
   });
 };
+var getJson = async (fetchImpl, url4) => {
+  const response = await fetchImpl(url4).catch((err) => {
+    throw wrapNetworkError(url4, err);
+  });
+  if (!response.ok) {
+    throw new ZeroAgentAuthError(`GET ${url4} failed (${response.status})`, {
+      status: response.status
+    });
+  }
+  return await response.json();
+};
+var postJson = (fetchImpl, url4, body, schema) => post(fetchImpl, url4, "application/json", JSON.stringify(body), schema);
+var postForm = (fetchImpl, url4, fields, schema) => post(
+  fetchImpl,
+  url4,
+  "application/x-www-form-urlencoded",
+  new URLSearchParams(fields).toString(),
+  schema
+);
+var post = async (fetchImpl, url4, contentType, body, schema) => {
+  const response = await fetchImpl(url4, {
+    method: "POST",
+    headers: { "content-type": contentType },
+    body
+  }).catch((err) => {
+    throw wrapNetworkError(url4, err);
+  });
+  const text = await response.text();
+  let parsed = null;
+  try {
+    parsed = text ? JSON.parse(text) : null;
+  } catch {
+  }
+  if (!response.ok) {
+    const errBody = parsed;
+    const code = errBody?.code ?? errBody?.error;
+    throw new ZeroAgentAuthError(
+      `Agent auth request to ${url4} failed (${response.status}${typeof code === "string" ? `: ${code}` : ""})`,
+      { status: response.status, body: parsed ?? text }
+    );
+  }
+  return schema.parse(parsed);
+};
+var completeClaimAt = async (fetchImpl, claimEndpoint, input) => {
+  try {
+    const identity = await postJson(
+      fetchImpl,
+      `${claimEndpoint}/complete`,
+      { claim_token: input.claimToken, user_code: input.userCode },
+      completeClaimResponseSchema
+    );
+    return { status: "ok", ...identity };
+  } catch (err) {
+    if (err instanceof ZeroAgentAuthError && err.serverCode) {
+      if (err.serverCode === "claim_not_confirmed") {
+        return { status: "not_confirmed" };
+      }
+      if (err.serverCode === "invalid_user_code") {
+        return { status: "invalid_code" };
+      }
+      if ([
+        "user_code_expired",
+        "claim_expired",
+        "claim_revoked",
+        "already_claimed",
+        "claim_denied"
+      ].includes(err.serverCode)) {
+        return { status: "expired", code: err.serverCode };
+      }
+    }
+    throw err;
+  }
+};
+var JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
 var AuthAgent = class {
   constructor(client) {
     this.client = client;
@@ -167687,7 +167760,8 @@ var AuthAgent = class {
   };
   register = async () => {
     const endpoints = await this.endpoints();
-    return this.postJson(
+    return postJson(
+      this.client.fetchImpl,
       endpoints.identityEndpoint,
       { type: "anonymous" },
       identityEnvelopeSchema
@@ -167695,7 +167769,8 @@ var AuthAgent = class {
   };
   exchangeAssertion = async (identityAssertion) => {
     const endpoints = await this.endpoints();
-    return this.postForm(
+    return postForm(
+      this.client.fetchImpl,
       endpoints.tokenEndpoint,
       { grant_type: JWT_BEARER_GRANT_TYPE, assertion: identityAssertion },
       agentTokenResponseSchema
@@ -167725,7 +167800,8 @@ var AuthAgent = class {
         { status: 0 }
       );
     }
-    return this.postJson(
+    return postJson(
+      this.client.fetchImpl,
       endpoints.claimEndpoint,
       {
         type: "service_auth",
@@ -167735,8 +167811,6 @@ var AuthAgent = class {
       startClaimResponseSchema
     );
   };
-  // Submit the pairing code the human read off the hosted page. Terminal
-  // states map to a typed result; anything unexpected throws.
   completeClaim = async (input) => {
     const endpoints = await this.endpoints();
     if (!endpoints.claimEndpoint) {
@@ -167745,33 +167819,10 @@ var AuthAgent = class {
         { status: 0 }
       );
     }
-    try {
-      const identity = await this.postJson(
-        `${endpoints.claimEndpoint}/complete`,
-        { claim_token: input.claimToken, user_code: input.userCode },
-        completeClaimResponseSchema
-      );
-      return { status: "ok", ...identity };
-    } catch (err) {
-      if (err instanceof ZeroAgentAuthError && err.serverCode) {
-        if (err.serverCode === "claim_not_confirmed") {
-          return { status: "not_confirmed" };
-        }
-        if (err.serverCode === "invalid_user_code") {
-          return { status: "invalid_code" };
-        }
-        if ([
-          "user_code_expired",
-          "claim_expired",
-          "claim_revoked",
-          "already_claimed",
-          "claim_denied"
-        ].includes(err.serverCode)) {
-          return { status: "expired", code: err.serverCode };
-        }
-      }
-      throw err;
-    }
+    return completeClaimAt(this.client.fetchImpl, endpoints.claimEndpoint, {
+      claimToken: input.claimToken,
+      userCode: input.userCode
+    });
   };
   // Resolve (and cache) the agent-auth endpoints via discovery.
   endpoints = () => {
@@ -167784,13 +167835,15 @@ var AuthAgent = class {
     return this.endpointsPromise;
   };
   discover = async () => {
-    const resource = await this.getJson(
+    const resource = await getJson(
+      this.client.fetchImpl,
       `${trimSlash(this.client.baseUrl)}/.well-known/oauth-protected-resource`
     );
     let lastError = null;
     for (const server of resource.authorization_servers ?? []) {
       try {
-        const raw = await this.getJson(
+        const raw = await getJson(
+          this.client.fetchImpl,
           `${trimSlash(server)}/.well-known/oauth-authorization-server`
         );
         const metadata = agentAuthMetadataSchema.parse(raw);
@@ -167809,48 +167862,6 @@ var AuthAgent = class {
       { status: 0, cause: lastError }
     );
   };
-  getJson = async (url4) => {
-    const response = await this.client.fetchImpl(url4).catch((err) => {
-      throw wrapNetworkError(url4, err);
-    });
-    if (!response.ok) {
-      throw new ZeroAgentAuthError(`GET ${url4} failed (${response.status})`, {
-        status: response.status
-      });
-    }
-    return await response.json();
-  };
-  postJson = (url4, body, schema) => this.post(url4, "application/json", JSON.stringify(body), schema);
-  postForm = (url4, fields, schema) => this.post(
-    url4,
-    "application/x-www-form-urlencoded",
-    new URLSearchParams(fields).toString(),
-    schema
-  );
-  post = async (url4, contentType, body, schema) => {
-    const response = await this.client.fetchImpl(url4, {
-      method: "POST",
-      headers: { "content-type": contentType },
-      body
-    }).catch((err) => {
-      throw wrapNetworkError(url4, err);
-    });
-    const text = await response.text();
-    let parsed = null;
-    try {
-      parsed = text ? JSON.parse(text) : null;
-    } catch {
-    }
-    if (!response.ok) {
-      const errBody = parsed;
-      const code = errBody?.code ?? errBody?.error;
-      throw new ZeroAgentAuthError(
-        `Agent auth request to ${url4} failed (${response.status}${typeof code === "string" ? `: ${code}` : ""})`,
-        { status: response.status, body: parsed ?? text }
-      );
-    }
-    return schema.parse(parsed);
-  };
 };
 var userWalletDtoSchema = external_exports3.object({
   walletAddress: external_exports3.string(),
@@ -167961,6 +167972,294 @@ var AuthDevice = class {
     };
   };
 };
+var ID_JAG_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:id-jag";
+var idJagMintResponseSchema = external_exports3.object({
+  access_token: external_exports3.string(),
+  issued_token_type: external_exports3.string().optional(),
+  expires_in: external_exports3.number().optional()
+}).loose().transform((raw) => ({
+  idJag: raw.access_token,
+  issuedTokenType: raw.issued_token_type ?? ID_JAG_TOKEN_TYPE,
+  expiresIn: raw.expires_in ?? null
+}));
+var protectedResourceMetadataSchema = external_exports3.object({
+  resource: external_exports3.string().optional(),
+  resource_name: external_exports3.string().optional(),
+  authorization_servers: external_exports3.array(external_exports3.string()).optional()
+}).loose();
+var serviceAuthMetadataSchema = external_exports3.object({
+  resource: external_exports3.string().optional(),
+  resource_name: external_exports3.string().optional(),
+  token_endpoint: external_exports3.string().optional(),
+  agent_auth: external_exports3.object({
+    identity_endpoint: external_exports3.string(),
+    claim_endpoint: external_exports3.string().optional(),
+    identity_types_supported: external_exports3.array(external_exports3.string()).optional(),
+    identity_assertion: external_exports3.object({
+      assertion_types_supported: external_exports3.array(external_exports3.string()).optional(),
+      // Optional shared-audience hint: a platform fronting many
+      // storefronts advertises one audience (its AS) so a single
+      // consent covers the network.
+      audience: external_exports3.string().optional()
+    }).loose().optional()
+  }).loose()
+}).loose();
+var identityAssertionEnvelopeSchema = external_exports3.object({
+  id: external_exports3.string(),
+  identity: external_exports3.object({
+    assertion: external_exports3.string(),
+    expires_at: external_exports3.string().optional(),
+    refresh_token: external_exports3.object({ value: external_exports3.string() }).loose().optional()
+  }).loose(),
+  assertion_expires: external_exports3.string().nullable().optional()
+}).loose().transform((raw) => ({
+  registrationId: raw.id,
+  identityAssertion: raw.identity.assertion,
+  assertionExpires: raw.assertion_expires ?? raw.identity.expires_at ?? null,
+  refreshToken: raw.identity.refresh_token?.value ?? null
+}));
+var interactionRequiredBodySchema = external_exports3.object({
+  error_description: external_exports3.string().optional(),
+  claim: external_exports3.object({
+    token: external_exports3.string().optional(),
+    expires_at: external_exports3.string().optional(),
+    attempt: external_exports3.object({
+      verification_uri: external_exports3.string().optional(),
+      expires_at: external_exports3.string().optional()
+    }).loose().optional()
+  }).loose().optional()
+}).loose();
+var identityGrantSchema = external_exports3.object({ audience: external_exports3.string(), createdAt: external_exports3.string() }).loose();
+var identityGrantListSchema = external_exports3.object({ grants: external_exports3.array(identityGrantSchema) }).loose();
+var identityGrantRevokeSchema = external_exports3.object({ revoked: external_exports3.boolean() }).loose();
+var identityGrantRequestSchema = external_exports3.object({
+  requestId: external_exports3.string(),
+  approveUrl: external_exports3.string(),
+  expiresAt: external_exports3.string()
+}).loose();
+var identityGrantRequestStatusSchema = external_exports3.object({
+  requestId: external_exports3.string(),
+  status: external_exports3.enum(["pending", "approved", "denied", "expired"]),
+  audience: external_exports3.string(),
+  resourceName: external_exports3.string().nullable().optional()
+}).loose();
+var TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+var SUBJECT_TOKEN_TYPE_ACCESS_TOKEN = "urn:ietf:params:oauth:token-type:access_token";
+var JWT_BEARER_GRANT_TYPE2 = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var IDENTITY_ASSERTION_TYPE = "identity_assertion";
+var AuthIdentity = class {
+  constructor(client) {
+    this.client = client;
+  }
+  discover = async (url4) => {
+    const origin2 = new URL(url4).origin;
+    const prm = protectedResourceMetadataSchema.parse(
+      await getJson(
+        this.client.fetchImpl,
+        `${origin2}/.well-known/oauth-protected-resource`
+      )
+    );
+    let lastError = null;
+    for (const server of prm.authorization_servers ?? [origin2]) {
+      try {
+        const metadata = serviceAuthMetadataSchema.parse(
+          await getJson(
+            this.client.fetchImpl,
+            `${trimSlash(server)}/.well-known/oauth-authorization-server`
+          )
+        );
+        const agentAuth = metadata.agent_auth;
+        const assertionTypes = agentAuth.identity_assertion?.assertion_types_supported;
+        const resource = prm.resource ?? `${origin2}/`;
+        return {
+          resource,
+          mintAudience: agentAuth.identity_assertion?.audience ?? resource,
+          resourceName: prm.resource_name ?? metadata.resource_name ?? null,
+          authorizationServer: trimSlash(server),
+          identityEndpoint: agentAuth.identity_endpoint,
+          claimEndpoint: agentAuth.claim_endpoint ?? null,
+          tokenEndpoint: metadata.token_endpoint ?? `${trimSlash(server)}/oauth2/token`,
+          identityAssertionSupported: (agentAuth.identity_types_supported ?? []).includes(
+            IDENTITY_ASSERTION_TYPE
+          ) && (assertionTypes ? assertionTypes.includes(ID_JAG_TOKEN_TYPE) : true)
+        };
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw new ZeroAgentAuthError(
+      `No authorization server with an agent_auth block found at ${origin2} \u2014 agent auth is not enabled for this service.`,
+      { status: 0, cause: lastError }
+    );
+  };
+  // The minted grant is single-use (fresh jti) and minutes-lived — mint per
+  // registration, never cache.
+  mint = async (input) => {
+    const attempt = () => {
+      const credentials = this.client.getCredentials();
+      if (credentials.kind !== "session") {
+        throw new ZeroAuthError(
+          "auth_no_credentials",
+          "mint() requires session credentials \u2014 the ID-JAG asserts the signed-in user's identity."
+        );
+      }
+      return request2(
+        this.client,
+        {
+          method: "POST",
+          path: "/v1/oauth/token",
+          body: {
+            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+            subject_token: credentials.accessToken,
+            subject_token_type: SUBJECT_TOKEN_TYPE_ACCESS_TOKEN,
+            audience: input.audience,
+            requested_token_type: ID_JAG_TOKEN_TYPE
+          }
+        },
+        idJagMintResponseSchema
+      );
+    };
+    try {
+      return await attempt();
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.status === 400 && err.body?.error === "invalid_grant" && await this.client.refreshSessionOnce()) {
+        return await attempt();
+      }
+      throw err;
+    }
+  };
+  // Recoverable protocol states come back as typed outcomes; mint-bug
+  // rejections (invalid_audience, expired, …) throw. replay_detected is
+  // retried once with a freshly minted grant (single-use jti).
+  assert = async (input) => {
+    let discovery;
+    try {
+      discovery = input.discovery ?? await this.discover(input.url);
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError) {
+        return { status: "unsupported", discovery: null };
+      }
+      throw err;
+    }
+    if (!discovery.identityAssertionSupported) {
+      return { status: "unsupported", discovery };
+    }
+    try {
+      return await this.register(discovery);
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError && err.serverCode === "replay_detected") {
+        return await this.register(discovery);
+      }
+      throw err;
+    }
+  };
+  // RFC 7523 jwt-bearer. Bearer tokens are minutes-lived: exchange per work
+  // session, persist only the assertion + refresh token.
+  exchange = (input) => postForm(
+    this.client.fetchImpl,
+    input.tokenEndpoint,
+    { grant_type: JWT_BEARER_GRANT_TYPE2, assertion: input.assertion },
+    agentTokenResponseSchema
+  );
+  completeClaim = (input) => completeClaimAt(this.client.fetchImpl, input.claimEndpoint, {
+    claimToken: input.claimToken,
+    userCode: input.userCode
+  });
+  grants = (opts = {}) => request2(
+    this.client,
+    {
+      method: "GET",
+      path: "/v1/users/me/identity-grants",
+      signal: opts.signal
+    },
+    identityGrantListSchema
+  ).then((body) => body.grants);
+  // `resourceUrl` lets the server verify and display the service's
+  // name/logo on the approve page. Poll grantRequest() until decided.
+  requestGrant = (input) => request2(
+    this.client,
+    {
+      method: "POST",
+      path: "/v1/users/me/identity-grants/requests",
+      body: {
+        audience: input.audience,
+        ...input.resourceUrl ? { resourceUrl: input.resourceUrl } : {}
+      }
+    },
+    identityGrantRequestSchema
+  );
+  grantRequest = (requestId, opts = {}) => request2(
+    this.client,
+    {
+      method: "GET",
+      path: `/v1/users/me/identity-grants/requests/${requestId}`,
+      signal: opts.signal
+    },
+    identityGrantRequestStatusSchema
+  );
+  revokeGrant = (input) => request2(
+    this.client,
+    {
+      method: "DELETE",
+      path: "/v1/users/me/identity-grants",
+      query: { audience: input.audience }
+    },
+    identityGrantRevokeSchema
+  ).then((body) => body.revoked);
+  register = async (discovery) => {
+    let minted;
+    try {
+      minted = await this.mint({ audience: discovery.mintAudience });
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.body?.error === "consent_required") {
+        return { status: "consent_required", discovery };
+      }
+      throw err;
+    }
+    try {
+      const registration = await postJson(
+        this.client.fetchImpl,
+        discovery.identityEndpoint,
+        {
+          type: IDENTITY_ASSERTION_TYPE,
+          assertion_type: ID_JAG_TOKEN_TYPE,
+          assertion: minted.idJag
+        },
+        identityAssertionEnvelopeSchema
+      );
+      return { status: "ok", discovery, registration };
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError) {
+        if (err.serverCode === "issuer_not_enabled") {
+          return { status: "issuer_not_enabled", discovery };
+        }
+        const description = err.body?.error_description;
+        if (err.serverCode === "login_required") {
+          return {
+            status: "login_required",
+            discovery,
+            description: typeof description === "string" ? description : null
+          };
+        }
+        if (err.serverCode === "interaction_required") {
+          const body = interactionRequiredBodySchema.safeParse(err.body);
+          const claim3 = body.success ? body.data.claim : void 0;
+          return {
+            status: "interaction_required",
+            discovery,
+            claim: {
+              claimToken: claim3?.token ?? null,
+              claimTokenExpires: claim3?.expires_at ?? null,
+              verificationUri: claim3?.attempt?.verification_uri ?? null,
+              description: body.success ? body.data.error_description ?? null : null
+            }
+          };
+        }
+      }
+      throw err;
+    }
+  };
+};
 var userWalletsSchema = external_exports3.array(userWalletDtoSchema);
 var normalizeMessage = (message2) => {
   if (typeof message2 === "string") return message2;
@@ -167992,9 +168291,11 @@ var Auth = class {
     this.client = client;
     this.agent = new AuthAgent(client);
     this.device = new AuthDevice(client);
+    this.identity = new AuthIdentity(client);
   }
   agent;
   device;
+  identity;
   // The internal (web-app facing) user profile. Richer than profile(): full
   // wallet list with per-wallet delegation/signer/limit metadata.
   me = (opts = {}) => request2(
@@ -168537,7 +168838,7 @@ var Runs = class _Runs {
    * target left to name, so that server could never have recorded it.
    */
   create = async (input, opts = {}) => {
-    const post = (body) => request2(
+    const post2 = (body) => request2(
       this.client,
       {
         method: "POST",
@@ -168551,7 +168852,7 @@ var Runs = class _Runs {
     let generation = 0;
     for (; ; ) {
       try {
-        return await post(payload);
+        return await post2(payload);
       } catch (err) {
         const rejected = err instanceof ZeroApiError && (err.status === 400 || err.status === 422);
         if (!rejected) throw err;
@@ -169956,7 +170257,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.28.0"};
+  version: "1.29.0"};
 
 // src/app.ts
 init_esm_shims();
@@ -170608,13 +170909,458 @@ var readConfig = (path3) => {
   }
 };
 
-// src/commands/auth-command.ts
+// src/commands/auth-identity-command.ts
+init_esm_shims();
 var getConfigPath = () => join$1(homedir(), ".zero", "config.json");
+var CLAIM_NOT_CONFIRMED_RETRIES = 12;
+var CLAIM_NOT_CONFIRMED_INTERVAL_S = 5;
+var CONSENT_POLL_INTERVAL_S = 3;
+var ASSERTION_EXPIRY_MARGIN_MS = 6e4;
+var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var normalizeUrl = (raw) => {
+  try {
+    return new URL(/^https?:\/\//.test(raw) ? raw : `https://${raw}`);
+  } catch {
+    return null;
+  }
+};
+var updateServiceIdentity = (host, update2) => {
+  const path3 = getConfigPath();
+  ensureSecureDir(dirname(path3));
+  const config3 = readConfig(path3);
+  const identities = { ...config3.serviceIdentities };
+  const next = update2(identities[host] ?? {});
+  if (next === void 0) {
+    delete identities[host];
+  } else {
+    identities[host] = next;
+  }
+  writeSecureFile(
+    path3,
+    JSON.stringify({ ...config3, serviceIdentities: identities }, null, 2)
+  );
+};
+var isUsable = (expiresAt) => {
+  if (!expiresAt) return true;
+  const parsed = Date.parse(expiresAt);
+  return Number.isNaN(parsed) ? true : parsed - ASSERTION_EXPIRY_MARGIN_MS > Date.now();
+};
+var emitAccessToken = (accessToken, discovery, host, json3, reused) => {
+  if (json3) {
+    process.stdout.write(
+      `${JSON.stringify({
+        status: "ok",
+        accessToken,
+        resource: discovery.resource,
+        resourceName: discovery.resourceName,
+        tokenEndpoint: discovery.tokenEndpoint,
+        reused
+      })}
+`
+    );
+    return;
+  }
+  process.stderr.write(
+    [
+      `Signed in to ${discovery.resourceName ?? host} with your Zero identity.`,
+      "The bearer token below is short-lived \u2014 use it right away:",
+      `  zero fetch <url> -H "Authorization: Bearer <token>"`,
+      `Re-run this command for a fresh token; it reuses the stored registration.`,
+      ""
+    ].join("\n")
+  );
+  process.stdout.write(`${accessToken}
+`);
+};
+var exchangeAndEmit = async (client, discovery, host, assertion, json3, reused) => {
+  const token = await client.auth.identity.exchange({ tokenEndpoint: discovery.tokenEndpoint, assertion }).catch((err) => {
+    process.stderr.write(
+      `Token exchange at ${discovery.tokenEndpoint} failed: ${truncateError(
+        err instanceof Error ? err.message : String(err)
+      )}
+`
+    );
+    return null;
+  });
+  if (!token) return false;
+  emitAccessToken(token.accessToken, discovery, host, json3, reused);
+  return true;
+};
+var completeServiceClaim = async (client, discovery, host, claimToken, userCode, json3) => {
+  if (!discovery.claimEndpoint) {
+    process.stderr.write(
+      "The service advertises no claim endpoint \u2014 cannot complete the claim.\n"
+    );
+    return false;
+  }
+  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES; attempt++) {
+    const result = await client.auth.identity.completeClaim({
+      claimEndpoint: discovery.claimEndpoint,
+      claimToken,
+      userCode
+    }).catch((err) => {
+      process.stderr.write(
+        `
+Claim completion failed: ${truncateError(
+          err instanceof Error ? err.message : String(err)
+        )}
+`
+      );
+      return null;
+    });
+    if (result === null) return false;
+    if (result.status === "not_confirmed") {
+      if (!json3) process.stderr.write(".");
+      await sleep2(CLAIM_NOT_CONFIRMED_INTERVAL_S * 1e3);
+      continue;
+    }
+    if (result.status === "invalid_code") {
+      process.stderr.write(
+        "\nThat pairing code was not accepted. Ask the account owner to re-read the code from the claim page and try again.\n"
+      );
+      return false;
+    }
+    if (result.status === "expired") {
+      process.stderr.write(
+        `
+The claim attempt is no longer valid (${result.code}). Re-run \`zero auth identity ${host}\` for a fresh one.
+`
+      );
+      updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => rest);
+      return false;
+    }
+    updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => ({
+      ...rest,
+      assertion: result.identityAssertion,
+      ...result.assertionExpires && {
+        assertionExpires: result.assertionExpires
+      },
+      ...result.refreshToken && { refreshToken: result.refreshToken }
+    }));
+    return exchangeAndEmit(
+      client,
+      discovery,
+      host,
+      result.identityAssertion,
+      json3,
+      false
+    );
+  }
+  process.stderr.write(
+    "\nThe account owner never confirmed the claim on the page. Re-run with --claim-code once they have.\n"
+  );
+  return false;
+};
+var authIdentityCommand = (appContext) => new Command("identity").description(
+  "Sign in to a service that accepts ID-JAG identity assertion \u2014 mints one from Zero, registers it, and prints a bearer token for the service's API"
+).argument("<url>", "The service host, or any URL on it").option(
+  "--claim-code <code>",
+  "Finish an interaction_required claim with the pairing code the account owner read off the claim page"
+).option("--json", "Emit machine-readable JSON instead of human text").action(
+  async (rawUrl, opts) => {
+    const { client, analyticsService } = appContext.services;
+    const json3 = opts.json ?? false;
+    const target = normalizeUrl(rawUrl);
+    if (!target) {
+      process.stderr.write(`Not a valid URL or host: ${rawUrl}
+`);
+      process.exitCode = 1;
+      return;
+    }
+    const host = target.host;
+    const capture = (outcome2) => analyticsService.capture("auth_identity_asserted", {
+      host,
+      outcome: outcome2,
+      json: json3
+    });
+    if (client.getCredentials().kind !== "session") {
+      process.stderr.write(
+        "Identity assertion needs a signed-in Zero session. Run `zero auth login` (humans) or `zero auth agent register` + `zero auth agent claim` (agents) first.\n"
+      );
+      process.exitCode = 1;
+      return;
+    }
+    let discovery;
+    try {
+      discovery = await client.auth.identity.discover(target.toString());
+    } catch (err) {
+      capture("unsupported");
+      process.stderr.write(
+        `${truncateError(err instanceof Error ? err.message : String(err))}
+This host does not appear to support agent auth. If it serves an /auth.md, follow that instead.
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (opts.claimCode) {
+      const pending = readConfig(getConfigPath()).serviceIdentities?.[host]?.pendingClaim;
+      if (!pending) {
+        process.stderr.write(
+          `No pending identity claim for ${host}. Run \`zero auth identity ${host}\` first.
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      const ok = await completeServiceClaim(
+        client,
+        discovery,
+        host,
+        pending.token,
+        opts.claimCode.trim(),
+        json3
+      );
+      capture(ok ? "claim_completed" : "error");
+      if (!ok) process.exitCode = 1;
+      return;
+    }
+    if (!discovery.identityAssertionSupported) {
+      capture("unsupported");
+      process.stderr.write(
+        `${discovery.resourceName ?? host} does not accept identity assertion. Fall back to its standard agent auth (see ${target.origin}/auth.md).
+`
+      );
+      process.exitCode = 1;
+      return;
+    }
+    const stored = readConfig(getConfigPath()).serviceIdentities?.[host];
+    if (stored?.assertion && isUsable(stored.assertionExpires)) {
+      const token = await client.auth.identity.exchange({
+        tokenEndpoint: discovery.tokenEndpoint,
+        assertion: stored.assertion
+      }).catch(() => null);
+      if (token) {
+        capture("reused");
+        emitAccessToken(token.accessToken, discovery, host, json3, true);
+        return;
+      }
+    }
+    const runAssert = async () => {
+      try {
+        return await client.auth.identity.assert({
+          url: target.toString(),
+          discovery
+        });
+      } catch (err) {
+        capture("error");
+        if (err instanceof ZeroApiError && err.body?.error === "account_unclaimed") {
+          process.stderr.write(
+            "This Zero account has no human owner yet \u2014 identity assertion is only available on claimed accounts. Run `zero auth agent claim <email>` first.\n"
+          );
+        } else {
+          process.stderr.write(
+            `Identity assertion failed: ${truncateError(err instanceof Error ? err.message : String(err))}
+`
+          );
+        }
+        return null;
+      }
+    };
+    let outcome = await runAssert();
+    if (!outcome) {
+      process.exitCode = 1;
+      return;
+    }
+    if (outcome.status === "consent_required") {
+      const requested = await client.auth.identity.requestGrant({
+        audience: discovery.mintAudience,
+        resourceUrl: target.origin
+      }).catch((err) => {
+        process.stderr.write(
+          `Could not create the consent request: ${truncateError(err instanceof Error ? err.message : String(err))}
+`
+        );
+        return null;
+      });
+      if (!requested) {
+        capture("error");
+        process.exitCode = 1;
+        return;
+      }
+      process.stderr.write(
+        [
+          "",
+          `Signing in to ${discovery.resourceName ?? host} needs the user's one-time consent.`,
+          `Send them here to approve: ${requested.approveUrl}`,
+          `(valid until ${requested.expiresAt}; the decision is remembered on their Zero account)`,
+          "Waiting for their decision\u2026"
+        ].join("\n")
+      );
+      let decision = "expired";
+      for (; ; ) {
+        const status = await client.auth.identity.grantRequest(requested.requestId).catch(() => null);
+        if (status && status.status !== "pending") {
+          decision = status.status;
+          break;
+        }
+        process.stderr.write(".");
+        await sleep2(CONSENT_POLL_INTERVAL_S * 1e3);
+      }
+      process.stderr.write("\n");
+      if (decision === "denied") {
+        capture("consent_denied");
+        process.stderr.write(
+          "The user denied the request \u2014 not signing in.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+      if (decision === "expired") {
+        capture("consent_expired");
+        process.stderr.write(
+          "The approval link expired before the user decided. Re-run to mint a fresh one.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+      outcome = await runAssert();
+      if (!outcome) {
+        process.exitCode = 1;
+        return;
+      }
+      if (outcome.status === "consent_required") {
+        capture("error");
+        process.stderr.write(
+          "The issuer still reports consent_required after approval \u2014 retry, and report this if it persists.\n"
+        );
+        process.exitCode = 1;
+        return;
+      }
+    }
+    switch (outcome.status) {
+      case "ok": {
+        updateServiceIdentity(host, ({ pendingClaim: _drop, ...rest }) => ({
+          ...rest,
+          registrationId: outcome.registration.registrationId,
+          assertion: outcome.registration.identityAssertion,
+          ...outcome.registration.assertionExpires && {
+            assertionExpires: outcome.registration.assertionExpires
+          },
+          ...outcome.registration.refreshToken && {
+            refreshToken: outcome.registration.refreshToken
+          },
+          ...discovery.resourceName && {
+            resourceName: discovery.resourceName
+          }
+        }));
+        const ok = await exchangeAndEmit(
+          client,
+          discovery,
+          host,
+          outcome.registration.identityAssertion,
+          json3,
+          false
+        );
+        capture(ok ? "ok" : "error");
+        if (!ok) process.exitCode = 1;
+        return;
+      }
+      case "unsupported":
+      case "issuer_not_enabled": {
+        capture(outcome.status);
+        process.stderr.write(
+          `${discovery.resourceName ?? host} does not accept Zero identity assertions${outcome.status === "issuer_not_enabled" ? " (Zero is not on its issuer trust list)" : ""}. Fall back to its standard agent auth (see ${target.origin}/auth.md).
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      case "login_required": {
+        capture("login_required");
+        process.stderr.write(
+          `The service requires a fresher Zero sign-in${outcome.description ? ` (${outcome.description})` : ""}. Run \`zero auth login\` again, then retry \u2014 nothing at the service side helps.
+`
+        );
+        process.exitCode = 1;
+        return;
+      }
+      case "interaction_required": {
+        capture("interaction_required");
+        const { claim: claim3 } = outcome;
+        if (!claim3.claimToken || !claim3.verificationUri) {
+          process.stderr.write(
+            `The service requires account-owner confirmation but returned no claim handle${claim3.description ? ` (${claim3.description})` : ""}.
+`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        updateServiceIdentity(host, (current) => ({
+          ...current,
+          pendingClaim: {
+            token: claim3.claimToken,
+            verificationUri: claim3.verificationUri ?? void 0,
+            expiresAt: claim3.claimTokenExpires ?? void 0
+          }
+        }));
+        if (json3) {
+          process.stdout.write(
+            `${JSON.stringify({
+              status: "interaction_required",
+              verificationUri: claim3.verificationUri,
+              expiresAt: claim3.claimTokenExpires,
+              next: `The claim page shows the account owner a pairing code. Re-run \`zero auth identity ${host} --claim-code <code>\` with it.`
+            })}
+`
+          );
+        } else {
+          process.stderr.write(
+            [
+              "",
+              `Your email already has an account at ${discovery.resourceName ?? host} \u2014 its owner must confirm the link.`,
+              `Send them here: ${claim3.verificationUri}`,
+              "The page shows THEM a pairing code.",
+              ...claim3.claimTokenExpires ? [`(link valid until ${claim3.claimTokenExpires})`] : [],
+              ""
+            ].join("\n")
+          );
+        }
+        if (!process.stdin.isTTY) {
+          if (!json3) {
+            process.stderr.write(
+              `Once they read the code back, run: zero auth identity ${host} --claim-code <code>
+`
+            );
+          }
+          return;
+        }
+        const rl = createInterface$1({
+          input: process.stdin,
+          output: process.stderr
+        });
+        const userCode = (await rl.question("Enter the pairing code they read back: ")).trim();
+        rl.close();
+        if (!userCode) {
+          process.stderr.write(
+            `No code entered. Re-run \`zero auth identity ${host} --claim-code <code>\` when you have it.
+`
+          );
+          process.exitCode = 1;
+          return;
+        }
+        const ok = await completeServiceClaim(
+          client,
+          discovery,
+          host,
+          claim3.claimToken,
+          userCode,
+          json3
+        );
+        if (!ok) process.exitCode = 1;
+        return;
+      }
+    }
+  }
+);
+
+// src/commands/auth-command.ts
+var getConfigPath2 = () => join$1(homedir(), ".zero", "config.json");
 var FINISH_POLL_INTERVAL_S = 2;
 var FINISH_MAX_WAIT_MS = 10 * 60 * 1e3;
-var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
+var sleep3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 var persistSession = (result) => {
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   ensureSecureDir(dirname(path3));
   const current = readConfig(path3);
   const next = {
@@ -170632,7 +171378,7 @@ var LEGACY_KEY_NOTICE = {
   message: "A wallet private key from a previous setup is still on this machine. Now that you're signed in, your managed Zero wallet signs payments \u2014 the old key is no longer used.",
   keep: "zero wallet set <key>"
 };
-var hasLegacyPrivateKey = () => readConfig(getConfigPath()).privateKey !== void 0;
+var hasLegacyPrivateKey = () => readConfig(getConfigPath2()).privateKey !== void 0;
 var reportSignedIn = (result, json3, la) => {
   const legacyKeyPresent = hasLegacyPrivateKey();
   la?.analytics.capture("auth_login_completed", {
@@ -170732,7 +171478,7 @@ var runFinish = async (client, deviceCode, json3, la) => {
       } else if (!json3) {
         process.stdout.write(".");
       }
-      await sleep2(FINISH_POLL_INTERVAL_S * 1e3);
+      await sleep3(FINISH_POLL_INTERVAL_S * 1e3);
       continue;
     }
     if (result.status === "expired") {
@@ -170759,7 +171505,7 @@ User code: ${start.userCode}
     });
   }
   while (Date.now() < start.expiresAt) {
-    await sleep2(start.pollInterval * 1e3);
+    await sleep3(start.pollInterval * 1e3);
     const result = await client.auth.device.poll(start.deviceCode);
     if (result.status === "pending") {
       process.stdout.write(".");
@@ -170795,7 +171541,7 @@ var authLoginCommand = (appContext) => new Command("login").description("Sign in
       return;
     }
     const mode = opts.finish ? "finish" : "interactive";
-    const hadPriorSession = readConfig(getConfigPath()).session !== void 0;
+    const hadPriorSession = readConfig(getConfigPath2()).session !== void 0;
     analyticsService.capture("auth_login_started", { mode, json: json3 });
     const la = {
       analytics: analyticsService,
@@ -170820,7 +171566,7 @@ var authLoginCommand = (appContext) => new Command("login").description("Sign in
 );
 var authLogoutCommand = (appContext) => new Command("logout").description("Sign out of Zero").action(async () => {
   const { client, analyticsService } = appContext.services;
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   const config3 = readConfig(path3);
   const hadSession = config3.session !== void 0;
   if (config3.session) {
@@ -170925,7 +171671,7 @@ var authAgentRegisterCommand = (appContext) => new Command("register").descripti
 ).option("--json", "Emit machine-readable JSON instead of human text").action(async (opts) => {
   const { client } = appContext.services;
   const json3 = opts.json ?? false;
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   if (readConfig(path3).session) {
     process.stderr.write(
       "Already signed in. Run `zero auth logout` first if you want a fresh account.\n"
@@ -171005,12 +171751,12 @@ Agent registration may not be enabled for this service yet.
     ].join("\n")
   );
 });
-var CLAIM_NOT_CONFIRMED_RETRIES = 12;
-var CLAIM_NOT_CONFIRMED_INTERVAL_S = 5;
+var CLAIM_NOT_CONFIRMED_RETRIES2 = 12;
+var CLAIM_NOT_CONFIRMED_INTERVAL_S2 = 5;
 var completeClaimAndExchange = async (agentAuth, claimToken, userCode, email5, json3) => {
-  const path3 = getConfigPath();
+  const path3 = getConfigPath2();
   let verified = null;
-  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES; attempt++) {
+  for (let attempt = 0; attempt < CLAIM_NOT_CONFIRMED_RETRIES2; attempt++) {
     const result = await agentAuth.completeClaim({ claimToken, userCode }).catch((err) => {
       process.stderr.write(
         `
@@ -171022,7 +171768,7 @@ Claim completion failed: ${truncateError(err instanceof Error ? err.message : St
     if (result === null) return false;
     if (result.status === "not_confirmed") {
       if (!json3) process.stdout.write(".");
-      await sleep2(CLAIM_NOT_CONFIRMED_INTERVAL_S * 1e3);
+      await sleep3(CLAIM_NOT_CONFIRMED_INTERVAL_S2 * 1e3);
       continue;
     }
     if (result.status === "invalid_code") {
@@ -171090,7 +171836,7 @@ var authAgentClaimCommand = (appContext) => new Command("claim").description(
 ).option("--json", "Emit machine-readable JSON instead of human text").action(async (email5, opts) => {
   const { client } = appContext.services;
   const json3 = opts.json ?? false;
-  const config3 = readConfig(getConfigPath());
+  const config3 = readConfig(getConfigPath2());
   const registration = config3.agentRegistration;
   if (!registration?.claimToken) {
     process.stderr.write(
@@ -171183,13 +171929,13 @@ var authAgentCommand = (appContext) => {
   return cmd;
 };
 var ensureAuthenticated = async (client, shouldOpen = true) => {
-  const session5 = readConfig(getConfigPath()).session;
+  const session5 = readConfig(getConfigPath2()).session;
   if (session5) return;
   process.stdout.write(
     "\nZero requires authentication before handing off to Claude.\n\n"
   );
   await runInteractive(client, shouldOpen);
-  if (!readConfig(getConfigPath()).session) {
+  if (!readConfig(getConfigPath2()).session) {
     process.exitCode = 1;
     process.exit(1);
   }
@@ -171198,6 +171944,7 @@ var authCommand = (appContext) => {
   const cmd = new Command("auth").description("Authentication commands");
   cmd.addCommand(authLoginCommand(appContext).alias("register"));
   cmd.addCommand(authAgentCommand(appContext));
+  cmd.addCommand(authIdentityCommand(appContext));
   cmd.addCommand(authLogoutCommand(appContext));
   cmd.addCommand(authExchangeCommand(appContext));
   cmd.addCommand(authWhoamiCommand(appContext), { hidden: true });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.28.0",
+	"version": "1.29.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",