@zeroxyz/cli 1.30.0 → 1.32.0

package/dist/index.js

@@ -93043,7 +93043,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-JDRHYLN6.js
+// ../sdk/dist/chunk-4H5K6DCA.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -166839,7 +166839,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.23.0"
+  version: "0.25.0"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -167352,12 +167352,12 @@ var request2 = async (client, opts, schema) => {
       }
       continue;
     }
-    const errorBody = await parseErrorBody(response);
+    const errorBody2 = await parseErrorBody(response);
     const requestId = response.headers.get("x-request-id") ?? void 0;
-    throw new ZeroApiError(errorMessageFromBody(errorBody, response.status), {
+    throw new ZeroApiError(errorMessageFromBody(errorBody2, response.status), {
       status: response.status,
       requestId,
-      body: errorBody
+      body: errorBody2
     });
   }
   throw new ZeroApiError("Exhausted retries", {
@@ -169257,6 +169257,31 @@ var redactUrl2 = (url4) => {
     return "<invalid url>";
   }
 };
+var sameEndpointUrl = (a, b) => {
+  try {
+    const ua = new URL(a);
+    const ub = new URL(b);
+    if (ua.origin !== ub.origin || ua.pathname !== ub.pathname) return false;
+    ua.searchParams.sort();
+    ub.searchParams.sort();
+    return ua.searchParams.toString() === ub.searchParams.toString();
+  } catch {
+    return false;
+  }
+};
+var pickResolvedCapability = (response, requestUrl) => {
+  if (!response) return null;
+  if ("capabilityId" in response) return response;
+  const hits = response.candidates.filter(
+    (c) => sameEndpointUrl(c.url, requestUrl)
+  );
+  const only = hits.length === 1 ? hits[0] : void 0;
+  return only ? {
+    capabilityId: only.capabilityId,
+    capabilitySlug: only.capabilitySlug,
+    matchedVia: "exact"
+  } : null;
+};
 var ECHO_DETECT_MIN_LEN = 16;
 var ECHO_DETECT_MAX_SCAN = 64 * 1024;
 var requestBodyEchoed = (candidate, requestBody) => {
@@ -169718,6 +169743,12 @@ var withDefaultContentType = (headers, body) => {
   }
   return next;
 };
+var withDefaultUserAgent = (headers) => {
+  const next = headers ? { ...headers } : {};
+  const hasUa = Object.keys(next).some((k) => k.toLowerCase() === "user-agent");
+  if (!hasUa) next["user-agent"] = `zero-sdk/${SDK_VERSION2}`;
+  return next;
+};
 var clientFetch = async (client, url4, opts = {}, diagnostics) => {
   const startedAt = Date.now();
   const fetchId = diagnostics.fetchId;
@@ -169735,7 +169766,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
   );
   const resolvePromise = !capabilityIdRequested && canRecordForResolve ? diagnostics.measure(
     "resolve_target",
-    () => client.capabilities.resolveByUrl(redactUrl2(requestUrl), method)
+    () => client.capabilities.resolveByUrl(redactUrl2(requestUrl), method, {
+      candidates: true
+    }).then((r) => pickResolvedCapability(r, requestUrl))
   ).catch(() => {
     diagnostics.issue(
       "resolve_target",
@@ -169743,7 +169776,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
     );
     return null;
   }) : Promise.resolve(null);
-  const probeHeaders = withDefaultContentType(opts.headers, requestBody);
+  const probeHeaders = withDefaultUserAgent(
+    withDefaultContentType(opts.headers, requestBody)
+  );
   const requestInit = {
     method,
     headers: probeHeaders,
@@ -169823,7 +169858,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
           // Fresh clone for the paid retry — same rationale as
           // the probe-side clone above. Re-derives the default
           // Content-Type so the paid leg matches the probe.
-          headers: withDefaultContentType(opts.headers, requestBody),
+          headers: withDefaultUserAgent(
+            withDefaultContentType(opts.headers, requestBody)
+          ),
           body: requestBody,
           maxPay: opts.maxPay,
           account: opts.account,
@@ -170253,6 +170290,214 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
     result.capabilityResolution = capabilityResolution;
   return result;
 };
+var usdAmountSchema = external_exports3.string().regex(/^\d+(?:\.\d{1,6})?$/, "Expected a decimal USD amount");
+var creditPurchaseSchema = external_exports3.object({
+  url: external_exports3.string().url(),
+  amountRequired: external_exports3.literal(true),
+  minimumUsd: usdAmountSchema
+});
+var storefrontPlanSchema = external_exports3.object({
+  id: external_exports3.string().min(1),
+  name: external_exports3.string().min(1),
+  slug: external_exports3.string().min(1),
+  billingMode: external_exports3.string().min(1),
+  purchase: creditPurchaseSchema.nullable()
+});
+var storefrontManifestSchema = external_exports3.object({
+  seller: external_exports3.object({
+    id: external_exports3.string().min(1),
+    name: external_exports3.string().min(1),
+    slug: external_exports3.string().min(1)
+  }),
+  plans: external_exports3.array(storefrontPlanSchema)
+});
+var USD_MICROS = 1000000n;
+var CENT_MICROS = 10000n;
+var parseUsdMicros = (amount2) => {
+  if (!/^\d+(?:\.\d{1,6})?$/.test(amount2)) {
+    throw new ZeroValidationError(
+      "Credit purchase amount must be a positive decimal with at most 6 fractional digits."
+    );
+  }
+  const [whole = "0", fraction = ""] = amount2.split(".");
+  return BigInt(whole) * USD_MICROS + BigInt(fraction.padEnd(6, "0"));
+};
+var formatUsdMicros = (amount2) => {
+  const whole = amount2 / USD_MICROS;
+  const fraction = (amount2 % USD_MICROS).toString().padStart(6, "0");
+  return `${whole}.${fraction}`;
+};
+var resourceOrigin = (resourceUrl) => {
+  let parsed;
+  try {
+    parsed = new URL(resourceUrl);
+  } catch (cause) {
+    throw new ZeroValidationError(
+      "Credit access requires a valid resource URL.",
+      {
+        cause
+      }
+    );
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new ZeroValidationError(
+      "Credit access only supports HTTP or HTTPS resources."
+    );
+  }
+  return parsed.origin;
+};
+var errorBody = async (response) => {
+  const text = await response.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text || null;
+  }
+};
+var Access = class {
+  constructor(client) {
+    this.client = client;
+  }
+  discoverCreditPlans = async (resourceUrl, opts = {}) => {
+    const origin2 = resourceOrigin(resourceUrl);
+    const manifestUrl = new URL("/manifest.json", origin2).href;
+    let response;
+    try {
+      response = await this.client.fetchImpl(manifestUrl, {
+        headers: { accept: "application/json" },
+        signal: opts.signal
+      });
+    } catch (cause) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: 0,
+        cause
+      });
+    }
+    if (!response.ok) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: response.status,
+        body: await errorBody(response)
+      });
+    }
+    const text = await response.text();
+    let json3;
+    try {
+      json3 = JSON.parse(text);
+    } catch (cause) {
+      throw new ZeroValidationError(
+        "Seller manifest did not contain valid JSON.",
+        { cause, body: text }
+      );
+    }
+    const parsed = storefrontManifestSchema.safeParse(json3);
+    if (!parsed.success) {
+      throw new ZeroValidationError(
+        "Seller manifest did not match the expected access schema.",
+        { cause: parsed.error, body: text }
+      );
+    }
+    const creditPlans = [];
+    for (const plan of parsed.data.plans) {
+      if (plan.billingMode !== "credit" || !plan.purchase) continue;
+      const purchaseUrl = new URL(plan.purchase.url);
+      if (purchaseUrl.origin !== origin2) {
+        throw new ZeroValidationError(
+          "Seller manifest advertised a cross-origin credit purchase URL."
+        );
+      }
+      creditPlans.push({
+        id: plan.id,
+        name: plan.name,
+        slug: plan.slug,
+        minimumUsd: formatUsdMicros(parseUsdMicros(plan.purchase.minimumUsd))
+      });
+    }
+    return {
+      resourceOrigin: origin2,
+      seller: parsed.data.seller,
+      onlyCreditPlans: parsed.data.plans.length > 0 && parsed.data.plans.every((plan) => plan.billingMode === "credit"),
+      plans: creditPlans
+    };
+  };
+  prepareCreditPurchase = async (input) => {
+    const discovery = await this.discoverCreditPlans(input.resourceUrl, {
+      signal: input.signal
+    });
+    const plan = discovery.plans.find(
+      (candidate) => candidate.id === input.planId
+    );
+    if (!plan) {
+      throw new ZeroValidationError(
+        "The requested credit plan is not purchasable in the seller's current manifest."
+      );
+    }
+    const amount2 = parseUsdMicros(input.amountUsd);
+    const minimum = parseUsdMicros(plan.minimumUsd);
+    if (amount2 <= 0n || amount2 < minimum) {
+      throw new ZeroValidationError(
+        `Credit purchase amount must be at least $${plan.minimumUsd}.`
+      );
+    }
+    if (amount2 % CENT_MICROS !== 0n) {
+      throw new ZeroValidationError(
+        "Credit purchase amount must be in whole-cent increments."
+      );
+    }
+    const manifest = storefrontManifestSchema.parse(
+      await this.fetchManifest(discovery.resourceOrigin, input.signal)
+    );
+    const current = manifest.plans.find(
+      (candidate) => candidate.id === input.planId && candidate.billingMode === "credit"
+    );
+    if (!current?.purchase) {
+      throw new ZeroValidationError(
+        "The requested credit plan is no longer purchasable."
+      );
+    }
+    const currentMinimum = parseUsdMicros(current.purchase.minimumUsd);
+    if (amount2 < currentMinimum) {
+      throw new ZeroValidationError(
+        `Credit purchase amount must be at least $${formatUsdMicros(currentMinimum)}.`
+      );
+    }
+    const purchaseUrl = new URL(current.purchase.url);
+    if (purchaseUrl.origin !== discovery.resourceOrigin) {
+      throw new ZeroValidationError(
+        "Seller manifest advertised a cross-origin credit purchase URL."
+      );
+    }
+    const amountUsd = formatUsdMicros(amount2);
+    return {
+      resourceOrigin: discovery.resourceOrigin,
+      plan: {
+        id: current.id,
+        name: current.name,
+        slug: current.slug,
+        minimumUsd: formatUsdMicros(currentMinimum)
+      },
+      url: purchaseUrl.href,
+      method: "POST",
+      body: JSON.stringify({ amountUsd }),
+      amountUsd
+    };
+  };
+  fetchManifest = async (origin2, signal) => {
+    const response = await this.client.fetchImpl(
+      new URL("/manifest.json", origin2),
+      {
+        headers: { accept: "application/json" },
+        signal
+      }
+    );
+    if (!response.ok) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: response.status,
+        body: await errorBody(response)
+      });
+    }
+    return response.json();
+  };
+};
 var agentAuthMetadataSchema = external_exports3.object({
   token_endpoint: external_exports3.string().optional(),
   agent_auth: external_exports3.object({
@@ -171312,11 +171557,23 @@ var capabilityResponseSchema = external_exports3.object({
   lastUsedAt: external_exports3.string().nullable().optional(),
   lastSuccessfullyRanAt: external_exports3.string().nullable().optional()
 });
-var resolveCapabilityResponseSchema = external_exports3.object({
-  capabilityId: external_exports3.string(),
-  capabilitySlug: external_exports3.string(),
-  matchedVia: external_exports3.enum(["exact", "template"])
-});
+var resolveCapabilityResponseSchema = external_exports3.union([
+  external_exports3.object({
+    capabilityId: external_exports3.string(),
+    capabilitySlug: external_exports3.string(),
+    matchedVia: external_exports3.enum(["exact", "template"])
+  }),
+  external_exports3.object({
+    candidates: external_exports3.array(
+      external_exports3.object({
+        capabilityId: external_exports3.string(),
+        capabilitySlug: external_exports3.string(),
+        url: external_exports3.string()
+      })
+    )
+  })
+]);
+var isResolvedCapability = (response) => response !== null && "capabilityId" in response;
 var Capabilities = class {
   constructor(client) {
     this.client = client;
@@ -171339,6 +171596,14 @@ var Capabilities = class {
   // The URL travels in the POST body so it stays out of access logs and is
   // never stored; the caller uses the returned capabilityId to record an
   // attributed run without the URL ever touching the run row (ZERO-335).
+  //
+  // `candidates: true` additionally asks the server for the capabilities that
+  // share this origin + path and differ only by query string. Callers redact
+  // the query before sending (it can carry credentials), which is ambiguous
+  // once a required query param is baked into a capability's url to make it
+  // callable — ten Dappier publisher models share `/zeroclick/v2/search`
+  // (ZERO-942). The server can't choose; the caller still holds the full URL,
+  // so it picks locally. Leave the flag off and the behavior is unchanged.
   resolveByUrl = async (url4, method, opts = {}) => {
     try {
       return await request2(
@@ -171346,7 +171611,7 @@ var Capabilities = class {
         {
           method: "POST",
           path: "/v1/capabilities/resolve",
-          body: { url: url4, method },
+          body: opts.candidates ? { url: url4, method, candidates: true } : { url: url4, method },
           signal: opts.signal
         },
         resolveCapabilityResponseSchema
@@ -172275,6 +172540,7 @@ var ZeroClient = class _ZeroClient {
   // is called. Lazy getters would tree-shake better but break the discoverable
   // `client.<tab>` ergonomics that make resource-namespaced SDKs pleasant.
   auth;
+  access;
   bugReports;
   capabilities;
   payments;
@@ -172297,6 +172563,7 @@ var ZeroClient = class _ZeroClient {
     this.analyticsOptions = options.analytics;
     this.refreshOverride = options.refresh;
     this.withAccountCache = options._sharedAccountCache ?? /* @__PURE__ */ new Map();
+    this.access = new Access(this);
     this.auth = new Auth(this);
     this.bugReports = new BugReports(this);
     this.capabilities = new Capabilities(this);
@@ -176369,7 +176636,51 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.30.0"};
+  name: "@zeroxyz/cli",
+  version: "1.32.0",
+  type: "module",
+  bin: {
+    zero: "dist/index.js",
+    zerocli: "dist/index.js"
+  },
+  files: [
+    "dist"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup",
+    "build:binary": "tsup --config tsup.binary.ts && pnpm exec pkg dist/pkg/index.cjs --config pkg.json --targets node24-macos-arm64,node24-macos-x64,node24-linux-x64,node24-linux-arm64,node24-win-x64 --output dist/bin/zero",
+    prepublishOnly: "pnpm run build",
+    dev: "ZERO_ENV=development tsx src/index.ts",
+    cli: "ZERO_ENV=development ZERO_API_URL=http://localhost:1111 tsx src/index.ts",
+    "test:integration": "vitest run --project integration",
+    "test:e2e": "tsup && vitest run --project e2e",
+    "test:online": "vitest run --project online",
+    "test:unit": "vitest run --project unit",
+    test: "pnpm run test:unit && pnpm run test:integration",
+    typecheck: "tsc"
+  },
+  devDependencies: {
+    "@clack/prompts": "^0.11.0",
+    "@types/node": "^25.0.7",
+    "@types/semver": "^7.7.1",
+    "@yao-pkg/pkg": "^6.15.0",
+    "@zero/test-fixtures": "workspace:*",
+    "@zeroxyz/sdk": "workspace:^",
+    commander: "^13.0.0",
+    open: "^11.0.0",
+    "posthog-node": "^5.29.2",
+    semver: "^7.8.5",
+    tsup: "^8.5.1",
+    tsx: "^4.21.0",
+    typescript: "^5.9.3",
+    viem: "^2.47.10",
+    vitest: "^4.0.17",
+    zod: "^4.3.5"
+  }
+};
 
 // src/app.ts
 init_esm_shims();
@@ -178626,12 +178937,20 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         process.exitCode = 1;
         return;
       }
-      const headers = {};
+      const headers = {
+        "user-agent": `zero-cli/${package_default2.version}`
+      };
       if (options.header) {
         for (const h of options.header) {
           const colonIdx = h.indexOf(":");
           if (colonIdx > 0) {
-            headers[h.slice(0, colonIdx).trim()] = h.slice(colonIdx + 1).trim();
+            const name = h.slice(0, colonIdx).trim();
+            for (const existing of Object.keys(headers)) {
+              if (existing !== name && existing.toLowerCase() === name.toLowerCase()) {
+                delete headers[existing];
+              }
+            }
+            headers[name] = h.slice(colonIdx + 1).trim();
           }
         }
       }
@@ -179358,7 +179677,7 @@ var getCommand = (appContext) => new Command("get").description("Get details for
           identifier,
           method
         );
-        if (resolved) {
+        if (isResolvedCapability(resolved)) {
           matches2.set(resolved.capabilityId, resolved.capabilitySlug);
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.30.0",
+	"version": "1.32.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",