@zeroxyz/cli 1.30.0 → 1.31.0

package/dist/index.js

@@ -93043,7 +93043,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-JDRHYLN6.js
+// ../sdk/dist/chunk-QHTPKBCA.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -166839,7 +166839,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.23.0"
+  version: "0.24.0"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -169257,6 +169257,31 @@ var redactUrl2 = (url4) => {
     return "<invalid url>";
   }
 };
+var sameEndpointUrl = (a, b) => {
+  try {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    if (ua.origin !== ub.origin || ua.pathname !== ub.pathname) return false;
+    ua.searchParams.sort();
+    ub.searchParams.sort();
+    return ua.searchParams.toString() === ub.searchParams.toString();
+  } catch {
+    return false;
+  }
+};
+var pickResolvedCapability = (response, requestUrl) => {
+  if (!response) return null;
+  if ("capabilityId" in response) return response;
+  const hits = response.candidates.filter(
+    (c) => sameEndpointUrl(c.url, requestUrl)
+  );
+  const only = hits.length === 1 ? hits[0] : void 0;
+  return only ? {
+    capabilityId: only.capabilityId,
+    capabilitySlug: only.capabilitySlug,
+    matchedVia: "exact"
+  } : null;
+};
 var ECHO_DETECT_MIN_LEN = 16;
 var ECHO_DETECT_MAX_SCAN = 64 * 1024;
 var requestBodyEchoed = (candidate, requestBody) => {
@@ -169735,7 +169760,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
   );
   const resolvePromise = !capabilityIdRequested && canRecordForResolve ? diagnostics.measure(
     "resolve_target",
-    () => client.capabilities.resolveByUrl(redactUrl2(requestUrl), method)
+    () => client.capabilities.resolveByUrl(redactUrl2(requestUrl), method, {
+      candidates: true
+    }).then((r) => pickResolvedCapability(r, requestUrl))
   ).catch(() => {
     diagnostics.issue(
       "resolve_target",
@@ -171312,11 +171339,23 @@ var capabilityResponseSchema = external_exports3.object({
   lastUsedAt: external_exports3.string().nullable().optional(),
   lastSuccessfullyRanAt: external_exports3.string().nullable().optional()
 });
-var resolveCapabilityResponseSchema = external_exports3.object({
-  capabilityId: external_exports3.string(),
-  capabilitySlug: external_exports3.string(),
-  matchedVia: external_exports3.enum(["exact", "template"])
-});
+var resolveCapabilityResponseSchema = external_exports3.union([
+  external_exports3.object({
+    capabilityId: external_exports3.string(),
+    capabilitySlug: external_exports3.string(),
+    matchedVia: external_exports3.enum(["exact", "template"])
+  }),
+  external_exports3.object({
+    candidates: external_exports3.array(
+      external_exports3.object({
+        capabilityId: external_exports3.string(),
+        capabilitySlug: external_exports3.string(),
+        url: external_exports3.string()
+      })
+    )
+  })
+]);
+var isResolvedCapability = (response) => response !== null && "capabilityId" in response;
 var Capabilities = class {
   constructor(client) {
     this.client = client;
@@ -171339,6 +171378,14 @@ var Capabilities = class {
   // The URL travels in the POST body so it stays out of access logs and is
   // never stored; the caller uses the returned capabilityId to record an
   // attributed run without the URL ever touching the run row (ZERO-335).
+  //
+  // `candidates: true` additionally asks the server for the capabilities that
+  // share this origin + path and differ only by query string. Callers redact
+  // the query before sending (it can carry credentials), which is ambiguous
+  // once a required query param is baked into a capability's url to make it
+  // callable — ten Dappier publisher models share `/zeroclick/v2/search`
+  // (ZERO-942). The server can't choose; the caller still holds the full URL,
+  // so it picks locally. Leave the flag off and the behavior is unchanged.
   resolveByUrl = async (url4, method, opts = {}) => {
     try {
       return await request2(
@@ -171346,7 +171393,7 @@ var Capabilities = class {
         {
           method: "POST",
           path: "/v1/capabilities/resolve",
-          body: { url: url4, method },
+          body: opts.candidates ? { url: url4, method, candidates: true } : { url: url4, method },
           signal: opts.signal
         },
         resolveCapabilityResponseSchema
@@ -176369,7 +176416,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.30.0"};
+  version: "1.31.0"};
 
 // src/app.ts
 init_esm_shims();
@@ -179358,7 +179405,7 @@ var getCommand = (appContext) => new Command("get").description("Get details for
           identifier,
           method
         );
-        if (resolved) {
+        if (isResolvedCapability(resolved)) {
           matches2.set(resolved.capabilityId, resolved.capabilitySlug);
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.30.0",
+	"version": "1.31.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",