@zeroxyz/cli 1.31.0 → 1.33.0

package/dist/index.js

@@ -93043,7 +93043,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-QHTPKBCA.js
+// ../sdk/dist/chunk-QNTZREQD.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -166839,7 +166839,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.24.0"
+  version: "0.26.0"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -167352,12 +167352,12 @@ var request2 = async (client, opts, schema) => {
       }
       continue;
     }
-    const errorBody = await parseErrorBody(response);
+    const errorBody2 = await parseErrorBody(response);
     const requestId = response.headers.get("x-request-id") ?? void 0;
-    throw new ZeroApiError(errorMessageFromBody(errorBody, response.status), {
+    throw new ZeroApiError(errorMessageFromBody(errorBody2, response.status), {
       status: response.status,
       requestId,
-      body: errorBody
+      body: errorBody2
     });
   }
   throw new ZeroApiError("Exhausted retries", {
@@ -167631,6 +167631,17 @@ var withSynthesizedX402Header = (baseFetch) => async (input, init) => {
     headers
   });
 };
+var readPaymentRejectionReason = (body) => {
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+  const b = body;
+  const str = (v) => typeof v === "string" && v.trim().length > 0 ? v.trim() : null;
+  const code = str(b.reason) ?? str(b.error);
+  if (!code) return null;
+  const outer = str(b.error);
+  const label = outer && outer !== code ? `${code} (${outer})` : code;
+  const detail = str(b.detail) ?? str(b.message) ?? str(b.hint);
+  return detail ? `${label} \u2014 ${detail}` : label;
+};
 var USDC_BASE2 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
 var USDC_BASE_SEPOLIA = "0x036cbd53842c5426634e7929541ec2318f3dcf7e";
 var UINT_RE = /^[0-9]+$/;
@@ -168280,10 +168291,23 @@ var Payments = class {
             if (text) body = JSON.parse(text);
           } catch {
           }
-          return httpClient.getPaymentRequiredResponse(
-            (name) => challengeResponse.headers.get(name),
-            body
-          );
+          try {
+            return httpClient.getPaymentRequiredResponse(
+              (name) => challengeResponse.headers.get(name),
+              body
+            );
+          } catch (err) {
+            const reason = readPaymentRejectionReason(body);
+            if (!reason) throw err;
+            input.diagnostics?.fail(
+              "paid_replay",
+              FETCH_DIAGNOSTIC_CODES.paymentRejected
+            );
+            throw new ZeroPaymentError(
+              `the seller rejected the payment: ${reason}`,
+              { cause: err }
+            );
+          }
         };
         let paymentRequired2 = await parseChallenge(response);
         const hookHeaders = await httpClient.handlePaymentRequired(paymentRequired2);
@@ -169568,6 +169592,9 @@ var computeFixHint = (status, message2, bodyRaw) => {
   if (status === 415 || /content-?type|unsupported media|media type/.test(hay)) {
     return "set the Content-Type header to what the capability expects (usually application/json), then retry";
   }
+  if ((status === 401 || status === 403) && /bearer|identity|unauthorized|credential|agent_auth/.test(hay)) {
+    return 'the seller requires an agent identity credential \u2014 run `zero auth identity <host>` and resend with `-H "Authorization: Bearer <token>"`';
+  }
   if (/required|missing|must (include|provide|have|contain)|is expected/.test(hay)) {
     const field = extractFieldName(message2 ?? "");
     return field ? `add the required field '${field}' to the request body, then retry` : "the request is missing one or more required fields \u2014 check the capability schema (`zero get <slug>`), then retry";
@@ -169743,6 +169770,12 @@ var withDefaultContentType = (headers, body) => {
   }
   return next;
 };
+var withDefaultUserAgent = (headers) => {
+  const next = headers ? { ...headers } : {};
+  const hasUa = Object.keys(next).some((k) => k.toLowerCase() === "user-agent");
+  if (!hasUa) next["user-agent"] = `zero-sdk/${SDK_VERSION2}`;
+  return next;
+};
 var clientFetch = async (client, url4, opts = {}, diagnostics) => {
   const startedAt = Date.now();
   const fetchId = diagnostics.fetchId;
@@ -169770,7 +169803,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
     );
     return null;
   }) : Promise.resolve(null);
-  const probeHeaders = withDefaultContentType(opts.headers, requestBody);
+  const probeHeaders = withDefaultUserAgent(
+    withDefaultContentType(opts.headers, requestBody)
+  );
   const requestInit = {
     method,
     headers: probeHeaders,
@@ -169850,7 +169885,9 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
           // Fresh clone for the paid retry — same rationale as
           // the probe-side clone above. Re-derives the default
           // Content-Type so the paid leg matches the probe.
-          headers: withDefaultContentType(opts.headers, requestBody),
+          headers: withDefaultUserAgent(
+            withDefaultContentType(opts.headers, requestBody)
+          ),
           body: requestBody,
           maxPay: opts.maxPay,
           account: opts.account,
@@ -170280,6 +170317,214 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
     result.capabilityResolution = capabilityResolution;
   return result;
 };
+var usdAmountSchema = external_exports3.string().regex(/^\d+(?:\.\d{1,6})?$/, "Expected a decimal USD amount");
+var creditPurchaseSchema = external_exports3.object({
+  url: external_exports3.string().url(),
+  amountRequired: external_exports3.literal(true),
+  minimumUsd: usdAmountSchema
+});
+var storefrontPlanSchema = external_exports3.object({
+  id: external_exports3.string().min(1),
+  name: external_exports3.string().min(1),
+  slug: external_exports3.string().min(1),
+  billingMode: external_exports3.string().min(1),
+  purchase: creditPurchaseSchema.nullable()
+});
+var storefrontManifestSchema = external_exports3.object({
+  seller: external_exports3.object({
+    id: external_exports3.string().min(1),
+    name: external_exports3.string().min(1),
+    slug: external_exports3.string().min(1)
+  }),
+  plans: external_exports3.array(storefrontPlanSchema)
+});
+var USD_MICROS = 1000000n;
+var CENT_MICROS = 10000n;
+var parseUsdMicros = (amount2) => {
+  if (!/^\d+(?:\.\d{1,6})?$/.test(amount2)) {
+    throw new ZeroValidationError(
+      "Credit purchase amount must be a positive decimal with at most 6 fractional digits."
+    );
+  }
+  const [whole = "0", fraction = ""] = amount2.split(".");
+  return BigInt(whole) * USD_MICROS + BigInt(fraction.padEnd(6, "0"));
+};
+var formatUsdMicros = (amount2) => {
+  const whole = amount2 / USD_MICROS;
+  const fraction = (amount2 % USD_MICROS).toString().padStart(6, "0");
+  return `${whole}.${fraction}`;
+};
+var resourceOrigin = (resourceUrl) => {
+  let parsed;
+  try {
+    parsed = new URL(resourceUrl);
+  } catch (cause) {
+    throw new ZeroValidationError(
+      "Credit access requires a valid resource URL.",
+      {
+        cause
+      }
+    );
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+    throw new ZeroValidationError(
+      "Credit access only supports HTTP or HTTPS resources."
+    );
+  }
+  return parsed.origin;
+};
+var errorBody = async (response) => {
+  const text = await response.text().catch(() => "");
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text || null;
+  }
+};
+var Access = class {
+  constructor(client) {
+    this.client = client;
+  }
+  discoverCreditPlans = async (resourceUrl, opts = {}) => {
+    const origin2 = resourceOrigin(resourceUrl);
+    const manifestUrl = new URL("/manifest.json", origin2).href;
+    let response;
+    try {
+      response = await this.client.fetchImpl(manifestUrl, {
+        headers: { accept: "application/json" },
+        signal: opts.signal
+      });
+    } catch (cause) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: 0,
+        cause
+      });
+    }
+    if (!response.ok) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: response.status,
+        body: await errorBody(response)
+      });
+    }
+    const text = await response.text();
+    let json3;
+    try {
+      json3 = JSON.parse(text);
+    } catch (cause) {
+      throw new ZeroValidationError(
+        "Seller manifest did not contain valid JSON.",
+        { cause, body: text }
+      );
+    }
+    const parsed = storefrontManifestSchema.safeParse(json3);
+    if (!parsed.success) {
+      throw new ZeroValidationError(
+        "Seller manifest did not match the expected access schema.",
+        { cause: parsed.error, body: text }
+      );
+    }
+    const creditPlans = [];
+    for (const plan of parsed.data.plans) {
+      if (plan.billingMode !== "credit" || !plan.purchase) continue;
+      const purchaseUrl = new URL(plan.purchase.url);
+      if (purchaseUrl.origin !== origin2) {
+        throw new ZeroValidationError(
+          "Seller manifest advertised a cross-origin credit purchase URL."
+        );
+      }
+      creditPlans.push({
+        id: plan.id,
+        name: plan.name,
+        slug: plan.slug,
+        minimumUsd: formatUsdMicros(parseUsdMicros(plan.purchase.minimumUsd))
+      });
+    }
+    return {
+      resourceOrigin: origin2,
+      seller: parsed.data.seller,
+      onlyCreditPlans: parsed.data.plans.length > 0 && parsed.data.plans.every((plan) => plan.billingMode === "credit"),
+      plans: creditPlans
+    };
+  };
+  prepareCreditPurchase = async (input) => {
+    const discovery = await this.discoverCreditPlans(input.resourceUrl, {
+      signal: input.signal
+    });
+    const plan = discovery.plans.find(
+      (candidate) => candidate.id === input.planId
+    );
+    if (!plan) {
+      throw new ZeroValidationError(
+        "The requested credit plan is not purchasable in the seller's current manifest."
+      );
+    }
+    const amount2 = parseUsdMicros(input.amountUsd);
+    const minimum = parseUsdMicros(plan.minimumUsd);
+    if (amount2 <= 0n || amount2 < minimum) {
+      throw new ZeroValidationError(
+        `Credit purchase amount must be at least $${plan.minimumUsd}.`
+      );
+    }
+    if (amount2 % CENT_MICROS !== 0n) {
+      throw new ZeroValidationError(
+        "Credit purchase amount must be in whole-cent increments."
+      );
+    }
+    const manifest = storefrontManifestSchema.parse(
+      await this.fetchManifest(discovery.resourceOrigin, input.signal)
+    );
+    const current = manifest.plans.find(
+      (candidate) => candidate.id === input.planId && candidate.billingMode === "credit"
+    );
+    if (!current?.purchase) {
+      throw new ZeroValidationError(
+        "The requested credit plan is no longer purchasable."
+      );
+    }
+    const currentMinimum = parseUsdMicros(current.purchase.minimumUsd);
+    if (amount2 < currentMinimum) {
+      throw new ZeroValidationError(
+        `Credit purchase amount must be at least $${formatUsdMicros(currentMinimum)}.`
+      );
+    }
+    const purchaseUrl = new URL(current.purchase.url);
+    if (purchaseUrl.origin !== discovery.resourceOrigin) {
+      throw new ZeroValidationError(
+        "Seller manifest advertised a cross-origin credit purchase URL."
+      );
+    }
+    const amountUsd = formatUsdMicros(amount2);
+    return {
+      resourceOrigin: discovery.resourceOrigin,
+      plan: {
+        id: current.id,
+        name: current.name,
+        slug: current.slug,
+        minimumUsd: formatUsdMicros(currentMinimum)
+      },
+      url: purchaseUrl.href,
+      method: "POST",
+      body: JSON.stringify({ amountUsd }),
+      amountUsd
+    };
+  };
+  fetchManifest = async (origin2, signal) => {
+    const response = await this.client.fetchImpl(
+      new URL("/manifest.json", origin2),
+      {
+        headers: { accept: "application/json" },
+        signal
+      }
+    );
+    if (!response.ok) {
+      throw new ZeroApiError("Seller manifest request failed", {
+        status: response.status,
+        body: await errorBody(response)
+      });
+    }
+    return response.json();
+  };
+};
 var agentAuthMetadataSchema = external_exports3.object({
   token_endpoint: external_exports3.string().optional(),
   agent_auth: external_exports3.object({
@@ -172322,6 +172567,7 @@ var ZeroClient = class _ZeroClient {
   // is called. Lazy getters would tree-shake better but break the discoverable
   // `client.<tab>` ergonomics that make resource-namespaced SDKs pleasant.
   auth;
+  access;
   bugReports;
   capabilities;
   payments;
@@ -172344,6 +172590,7 @@ var ZeroClient = class _ZeroClient {
     this.analyticsOptions = options.analytics;
     this.refreshOverride = options.refresh;
     this.withAccountCache = options._sharedAccountCache ?? /* @__PURE__ */ new Map();
+    this.access = new Access(this);
     this.auth = new Auth(this);
     this.bugReports = new BugReports(this);
     this.capabilities = new Capabilities(this);
@@ -176416,7 +176663,51 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 
 // package.json
 var package_default2 = {
-  version: "1.31.0"};
+  name: "@zeroxyz/cli",
+  version: "1.33.0",
+  type: "module",
+  bin: {
+    zero: "dist/index.js",
+    zerocli: "dist/index.js"
+  },
+  files: [
+    "dist"
+  ],
+  publishConfig: {
+    access: "public"
+  },
+  scripts: {
+    build: "tsup",
+    "build:binary": "tsup --config tsup.binary.ts && pnpm exec pkg dist/pkg/index.cjs --config pkg.json --targets node24-macos-arm64,node24-macos-x64,node24-linux-x64,node24-linux-arm64,node24-win-x64 --output dist/bin/zero",
+    prepublishOnly: "pnpm run build",
+    dev: "ZERO_ENV=development tsx src/index.ts",
+    cli: "ZERO_ENV=development ZERO_API_URL=http://localhost:1111 tsx src/index.ts",
+    "test:integration": "vitest run --project integration",
+    "test:e2e": "tsup && vitest run --project e2e",
+    "test:online": "vitest run --project online",
+    "test:unit": "vitest run --project unit",
+    test: "pnpm run test:unit && pnpm run test:integration",
+    typecheck: "tsc"
+  },
+  devDependencies: {
+    "@clack/prompts": "^0.11.0",
+    "@types/node": "^25.0.7",
+    "@types/semver": "^7.7.1",
+    "@yao-pkg/pkg": "^6.15.0",
+    "@zero/test-fixtures": "workspace:*",
+    "@zeroxyz/sdk": "workspace:^",
+    commander: "^13.0.0",
+    open: "^11.0.0",
+    "posthog-node": "^5.29.2",
+    semver: "^7.8.5",
+    tsup: "^8.5.1",
+    tsx: "^4.21.0",
+    typescript: "^5.9.3",
+    viem: "^2.47.10",
+    vitest: "^4.0.17",
+    zod: "^4.3.5"
+  }
+};
 
 // src/app.ts
 init_esm_shims();
@@ -178673,12 +178964,20 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         process.exitCode = 1;
         return;
       }
-      const headers = {};
+      const headers = {
+        "user-agent": `zero-cli/${package_default2.version}`
+      };
       if (options.header) {
         for (const h of options.header) {
           const colonIdx = h.indexOf(":");
           if (colonIdx > 0) {
-            headers[h.slice(0, colonIdx).trim()] = h.slice(colonIdx + 1).trim();
+            const name = h.slice(0, colonIdx).trim();
+            for (const existing of Object.keys(headers)) {
+              if (existing !== name && existing.toLowerCase() === name.toLowerCase()) {
+                delete headers[existing];
+              }
+            }
+            headers[name] = h.slice(colonIdx + 1).trim();
           }
         }
       }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.31.0",
+	"version": "1.33.0",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",