@zeroxyz/cli 1.33.0 → 1.34.1

package/dist/index.js

@@ -93043,7 +93043,7 @@ init_esm_shims();
 // ../sdk/dist/index.js
 init_esm_shims();
 
-// ../sdk/dist/chunk-QNTZREQD.js
+// ../sdk/dist/chunk-DU665LQG.js
 init_esm_shims();
 
 // ../../node_modules/.pnpm/viem@2.52.2_bufferutil@4.1.0_typescript@5.9.3_utf-8-validate@6.0.6_zod@4.3.6/node_modules/viem/_esm/index.js
@@ -166742,6 +166742,7 @@ var FetchDiagnosticContext = class {
   issues = [];
   stageDurationsMs = {};
   paymentProtocol = null;
+  paymentFallback = null;
   paymentMode = null;
   fundingSource = null;
   constructor(fetchId) {
@@ -166771,6 +166772,17 @@ var FetchDiagnosticContext = class {
       this.failureCode = code;
     }
   };
+  // A failed preferred rail is non-terminal when an advertised fallback is
+  // still safe to try. Retain its issue for observability, but let a later MPP
+  // failure become the primary failure (or leave the completed fetch clean).
+  recoverFailureForFallback = () => {
+    this.failureStage = null;
+    this.failureCode = null;
+  };
+  recordPaymentFallback = (fallback2) => {
+    this.issue(fallback2.stage, fallback2.code);
+    this.paymentFallback ??= { ...fallback2 };
+  };
   selectPaymentProtocol = (protocol) => {
     this.paymentProtocol = protocol;
   };
@@ -166785,6 +166797,7 @@ var FetchDiagnosticContext = class {
     failureCode: this.failureCode,
     issues: this.issues.map((issue3) => ({ ...issue3 })),
     paymentProtocol: this.paymentProtocol,
+    paymentFallback: this.paymentFallback === null ? null : { ...this.paymentFallback },
     paymentMode: this.paymentMode,
     fundingSource: this.fundingSource,
     stageDurationsMs: { ...this.stageDurationsMs }
@@ -166839,7 +166852,7 @@ var redactUrl = (raw) => {
 };
 var truncateError = (raw) => raw.length > ERROR_MAX ? `${raw.slice(0, ERROR_MAX)}\u2026` : raw;
 var package_default = {
-  version: "0.26.0"
+  version: "0.27.1"
 };
 var SDK_VERSION2 = package_default.version;
 var ZeroError = class extends Error {
@@ -166893,6 +166906,14 @@ var ZeroPaymentError = class extends ZeroError {
     this.name = "ZeroPaymentError";
   }
 };
+var PAYMENT_NOT_ATTEMPTED_ERRORS = /* @__PURE__ */ new WeakSet();
+var markPaymentNotAttempted = (error98) => {
+  if (typeof error98 === "object" && error98 !== null || typeof error98 === "function") {
+    PAYMENT_NOT_ATTEMPTED_ERRORS.add(error98);
+  }
+  return error98;
+};
+var isPaymentNotAttemptedError = (error98) => (typeof error98 === "object" && error98 !== null || typeof error98 === "function") && PAYMENT_NOT_ATTEMPTED_ERRORS.has(error98);
 var ZeroPermit2AllowanceError = class extends ZeroPaymentError {
   constructor(message2, options) {
     super(message2, options);
@@ -167913,7 +167934,11 @@ var FETCH_WARNINGS = Object.freeze({
   // Response body exceeded maxResponseBytes — bodyRaw / body / bodyEncoding
   // reflect the clipped prefix; consumers that wrote the body to disk got
   // a truncated file. Particularly bad for paid binary fetches.
-  bodyTruncated: "body_truncated"
+  bodyTruncated: "body_truncated",
+  // The caller's `Authorization: Bearer` could not ride the MPP paid retry:
+  // the Payment credential replaces Authorization and the 402 advertised no
+  // alternate header to move the bearer into, so it was dropped.
+  authorizationBearerDroppedByMpp: "authorization_bearer_dropped_by_mpp"
 });
 var FETCH_SKIP_REASONS = Object.freeze({
   // The body was lost, but the capability executed (and may have charged) —
@@ -168120,6 +168145,7 @@ var Payments = class {
     let pendingAmountUnits = 0n;
     let identityChallengeHandled = false;
     let paidChallengeHandled = false;
+    let positivePaymentReplayAttempted = false;
     let capturedNetwork;
     let capturedScheme = null;
     let capturedCeilingUnits = null;
@@ -168353,6 +168379,9 @@ var Payments = class {
           "Access-Control-Expose-Headers",
           "PAYMENT-RESPONSE,X-PAYMENT-RESPONSE"
         );
+        if (pendingAmountUnits > 0n) {
+          positivePaymentReplayAttempted = true;
+        }
         response = await measureDiagnostic(
           input.diagnostics,
           "paid_replay",
@@ -168389,11 +168418,14 @@ var Payments = class {
           FETCH_DIAGNOSTIC_CODES.paymentFailed
         );
       }
-      if (err instanceof ZeroError) throw err;
-      throw new ZeroPaymentError(
+      if (err instanceof ZeroError) {
+        throw !positivePaymentReplayAttempted && !isCallerAbortError(err) ? markPaymentNotAttempted(err) : err;
+      }
+      const paymentError = new ZeroPaymentError(
         `x402 payment failed: ${err instanceof Error ? err.message : String(err)}`,
         { cause: err }
       );
+      throw !positivePaymentReplayAttempted && !isCallerAbortError(err) ? markPaymentNotAttempted(paymentError) : paymentError;
     }
     const isUpto = capturedScheme === "upto" && paidChallengeHandled;
     let txHash = null;
@@ -169205,6 +169237,38 @@ var Payments = class {
     };
   };
 };
+var BEARER_VALUE = /^bearer\s+\S+$/i;
+var relocateBearerForMpp = (headers, alternateHeader) => {
+  if (!headers) return { headers, relocated: false, dropped: false };
+  const entries = Object.entries(headers);
+  const authorization = entries.find(
+    ([name]) => name.toLowerCase() === "authorization"
+  );
+  const value = authorization?.[1].trim();
+  if (!value || !BEARER_VALUE.test(value)) {
+    return { headers, relocated: false, dropped: false };
+  }
+  if (!alternateHeader) return { headers, relocated: false, dropped: true };
+  const alternate = alternateHeader.toLowerCase();
+  if (entries.some(([name]) => name.toLowerCase() === alternate)) {
+    return { headers, relocated: false, dropped: false };
+  }
+  const next = Object.fromEntries(
+    entries.filter(([name]) => name.toLowerCase() !== "authorization")
+  );
+  next[alternateHeader] = value;
+  return { headers: next, relocated: true, dropped: false };
+};
+var alternateBearerHeaderFromChallengeBody = (body) => {
+  if (!body || typeof body !== "object") return void 0;
+  const presentation = body.auth?.presentation;
+  if (!presentation || typeof presentation !== "object") return void 0;
+  const { scheme, alternateHeader } = presentation;
+  if (typeof scheme === "string" && scheme.toLowerCase() !== "bearer") {
+    return void 0;
+  }
+  return typeof alternateHeader === "string" && /^[A-Za-z0-9-]+$/.test(alternateHeader) ? alternateHeader : void 0;
+};
 var isShortToken = (id) => id.startsWith("z_") && id.indexOf(".", 2) !== -1;
 var MAX_402_PROBE_BYTES = 1024 * 1024;
 var MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
@@ -169336,9 +169400,27 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
     const scheme = challenge2.trim().split(/\s+/)[0]?.toLowerCase() ?? "";
     return MPP_SCHEME_TOKENS.has(scheme);
   }) : false;
+  const mppRequirement = (alternateBearerHeader, paymentFallback) => ({
+    protocol: "mpp",
+    raw: { "www-authenticate": wwwAuth },
+    ...alternateBearerHeader ? { alternateBearerHeader } : {},
+    ...paymentFallback ? { paymentFallback } : {}
+  });
+  const x402Fallback = (stage, code) => ({ from: "x402", to: "mpp", stage, code });
+  const readMppBearerHint = async () => {
+    try {
+      const text = await readClippedText(response, MAX_402_PROBE_BYTES);
+      return text ? alternateBearerHeaderFromChallengeBody(JSON.parse(text)) : void 0;
+    } catch {
+      return void 0;
+    }
+  };
   if (preferredProtocol === "mpp") {
-    cancelBody2(response);
-    return advertisesMpp ? { protocol: "mpp", raw: { "www-authenticate": wwwAuth } } : { protocol: "unknown", raw: { requestedProtocol: "mpp" } };
+    if (!advertisesMpp) {
+      cancelBody2(response);
+      return { protocol: "unknown", raw: { requestedProtocol: "mpp" } };
+    }
+    return mppRequirement(await readMppBearerHint());
   }
   const canSettleX402 = (raw) => {
     if (!raw || typeof raw !== "object") return false;
@@ -169351,47 +169433,71 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
     return selectSettleableX402Requirement(accepts, void 0, x402Version2) !== null;
   };
   const preferMppFallback = (raw) => preferredProtocol === void 0 && advertisesMpp && !canSettleX402(raw);
-  const selectedX402 = (raw) => ({
+  const selectedX402 = (raw, alternateBearerHeader) => ({
     protocol: "x402",
     raw,
-    ...preferredProtocol === void 0 && advertisesMpp ? { fallbackProtocol: "mpp" } : {}
+    ...preferredProtocol === void 0 && advertisesMpp ? {
+      fallbackProtocol: "mpp",
+      ...alternateBearerHeader ? { alternateBearerHeader } : {}
+    } : {}
   });
   const x402Header = response.headers.get("payment-required") ?? response.headers.get("x-payment-required");
   if (x402Header) {
-    cancelBody2(response);
+    let decoded;
+    let decodable = true;
     try {
-      const decoded = JSON.parse(
-        Buffer.from(x402Header, "base64").toString("utf8")
-      );
-      if (preferMppFallback(decoded)) {
-        return { protocol: "mpp", raw: { "www-authenticate": wwwAuth } };
-      }
-      return selectedX402(decoded);
+      decoded = JSON.parse(Buffer.from(x402Header, "base64").toString("utf8"));
     } catch {
+      decodable = false;
+    }
+    if (!decodable) {
       if (preferredProtocol === void 0 && advertisesMpp) {
-        return { protocol: "mpp", raw: { "www-authenticate": wwwAuth } };
+        return mppRequirement(
+          await readMppBearerHint(),
+          x402Fallback(
+            "challenge_decode",
+            FETCH_DIAGNOSTIC_CODES.challengeDecodeFailed
+          )
+        );
       }
+      cancelBody2(response);
       return selectedX402({ encoded: x402Header });
     }
+    if (preferMppFallback(decoded)) {
+      return mppRequirement(
+        await readMppBearerHint(),
+        x402Fallback(
+          "rail_select",
+          FETCH_DIAGNOSTIC_CODES.unsupportedPaymentRail
+        )
+      );
+    }
+    cancelBody2(response);
+    return selectedX402(decoded);
   }
   const declaredLen = Number.parseInt(
     response.headers.get("content-length") ?? "",
     10
   );
   const bodyFits = !Number.isFinite(declaredLen) || declaredLen <= MAX_402_PROBE_BYTES;
+  let bodyBearerHint;
   if (bodyFits) {
     try {
       const text = await readClippedText(response, MAX_402_PROBE_BYTES);
       if (text) {
         const parsed = JSON.parse(text);
+        bodyBearerHint = alternateBearerHeaderFromChallengeBody(parsed);
         if (looksLikeX402Body(parsed)) {
           if (preferMppFallback(parsed)) {
-            return {
-              protocol: "mpp",
-              raw: { "www-authenticate": wwwAuth }
-            };
+            return mppRequirement(
+              bodyBearerHint,
+              x402Fallback(
+                "rail_select",
+                FETCH_DIAGNOSTIC_CODES.unsupportedPaymentRail
+              )
+            );
           }
-          return selectedX402(parsed);
+          return selectedX402(parsed, bodyBearerHint);
         }
       }
     } catch {
@@ -169403,7 +169509,7 @@ var detectPaymentRequirement = async (response, preferredProtocol) => {
   }
   if (advertisesMpp) {
     cancelBody2(response);
-    return { protocol: "mpp", raw: { "www-authenticate": wwwAuth } };
+    return mppRequirement(bodyBearerHint);
   }
   cancelBody2(response);
   return { protocol: "unknown", raw: {} };
@@ -169571,9 +169677,39 @@ var extractUnrecognizedKeys = (bodyRaw) => {
   visit(parsed);
   return [...new Set(out)].slice(0, 8);
 };
+var NOT_ACCEPTING_ORDERS_HINT = "this storefront isn't accepting orders yet \u2014 don't pay or retry; pick another capability";
+var STOREFRONT_GATE_HINTS = /* @__PURE__ */ new Map([
+  [
+    "plan_required",
+    "the seller sells this call on a plan you don't hold \u2014 buy one of the plans listed in this response (POST its `purchase.url` with your identity bearer; a free trial costs nothing), then retry"
+  ],
+  [
+    "verified_email_required",
+    "the seller only serves buyers with a verified email \u2014 changing the request won't help; have the account owner verify their email on their Zero identity, then retry"
+  ],
+  [
+    "usage_not_priced",
+    "the seller hasn't priced this call on any plan, so it can't be bought right now \u2014 pick another capability"
+  ],
+  ["not_accepting_orders", NOT_ACCEPTING_ORDERS_HINT],
+  ["signing_secret_required", NOT_ACCEPTING_ORDERS_HINT]
+]);
+var STOREFRONT_GATE_CODE_RE = /\b(?:bearer|plan|verified_email|signing_secret|payment)_required\b/g;
+var storefrontGateCode = (bodyRaw) => {
+  if (!bodyRaw) return void 0;
+  try {
+    const code = JSON.parse(bodyRaw)?.error;
+    return typeof code === "string" ? code : void 0;
+  } catch {
+    return void 0;
+  }
+};
 var computeFixHint = (status, message2, bodyRaw) => {
   if (status < 400 || status >= 500) return void 0;
+  if (status === 402) return void 0;
   const hay = `${message2 ?? ""} ${bodyRaw ?? ""}`.toLowerCase();
+  const gateHint = STOREFRONT_GATE_HINTS.get(storefrontGateCode(bodyRaw) ?? "");
+  if (gateHint) return gateHint;
   if (status === 405 || /method not allowed|method_not_allowed/.test(hay)) {
     const allowed = extractAllowedMethod(`${bodyRaw ?? ""} ${message2 ?? ""}`);
     return allowed ? `the endpoint expects ${allowed}, not the method you used \u2014 retry with -X ${allowed}` : "the endpoint rejected this HTTP method \u2014 check the capability's method (`zero get <slug>`) and retry with the right -X";
@@ -169595,7 +169731,9 @@ var computeFixHint = (status, message2, bodyRaw) => {
   if ((status === 401 || status === 403) && /bearer|identity|unauthorized|credential|agent_auth/.test(hay)) {
     return 'the seller requires an agent identity credential \u2014 run `zero auth identity <host>` and resend with `-H "Authorization: Bearer <token>"`';
   }
-  if (/required|missing|must (include|provide|have|contain)|is expected/.test(hay)) {
+  if (/required|missing|must (include|provide|have|contain)|is expected/.test(
+    hay.replace(STOREFRONT_GATE_CODE_RE, "")
+  )) {
     const field = extractFieldName(message2 ?? "");
     return field ? `add the required field '${field}' to the request body, then retry` : "the request is missing one or more required fields \u2014 check the capability schema (`zero get <slug>`), then retry";
   }
@@ -169695,6 +169833,7 @@ var recordErrorFetchRun = async (client, opts, result, diagnostics, capabilityId
         failureStage: diagnostics.snapshot().failureStage ?? void 0,
         failureCode: diagnostics.snapshot().failureCode ?? void 0,
         paymentProtocol: diagnostics.snapshot().paymentProtocol ?? void 0,
+        paymentFallback: diagnostics.snapshot().paymentFallback ?? void 0,
         paymentMode: diagnostics.snapshot().paymentMode ?? void 0,
         fundingSource: diagnostics.snapshot().fundingSource ?? void 0,
         stageDurationsMs: diagnostics.snapshot().stageDurationsMs,
@@ -169877,17 +170016,28 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
     });
     if (requirement?.protocol === "x402" || requirement?.protocol === "mpp") {
       diagnostics.selectPaymentProtocol(requirement.protocol);
+      if (requirement.paymentFallback) {
+        diagnostics.recordPaymentFallback(requirement.paymentFallback);
+      }
       const payCall = requirement.protocol === "x402" ? client.payments.pay : client.payments.payMpp;
       try {
+        const paidLegHeaders = withDefaultUserAgent(
+          withDefaultContentType(opts.headers, requestBody)
+        );
+        const mppLegHeaders = () => {
+          const relocation = relocateBearerForMpp(
+            paidLegHeaders,
+            requirement.alternateBearerHeader
+          );
+          if (relocation.dropped) {
+            warnings.push(FETCH_WARNINGS.authorizationBearerDroppedByMpp);
+          }
+          return relocation.headers;
+        };
         const paymentInput = {
           url: requestUrl,
           method,
-          // Fresh clone for the paid retry — same rationale as
-          // the probe-side clone above. Re-derives the default
-          // Content-Type so the paid leg matches the probe.
-          headers: withDefaultUserAgent(
-            withDefaultContentType(opts.headers, requestBody)
-          ),
+          headers: requirement.protocol === "mpp" ? mppLegHeaders() : paidLegHeaders,
           body: requestBody,
           maxPay: opts.maxPay,
           account: opts.account,
@@ -169909,13 +170059,31 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
         try {
           paid = await payCall(paymentInput);
         } catch (error98) {
-          if ((error98 instanceof ZeroInsufficientFundsError || error98 instanceof ZeroPermit2AllowanceError) && requirement.protocol === "x402" && requirement.fallbackProtocol === "mpp") {
-            diagnostics.issue(
-              error98 instanceof ZeroInsufficientFundsError ? "balance_check" : "paid_replay",
-              error98 instanceof ZeroInsufficientFundsError ? FETCH_DIAGNOSTIC_CODES.insufficientFunds : FETCH_DIAGNOSTIC_CODES.permit2AllowanceRequired
-            );
+          if ((error98 instanceof ZeroInsufficientFundsError || error98 instanceof ZeroPermit2AllowanceError || isPaymentNotAttemptedError(error98)) && requirement.protocol === "x402" && requirement.fallbackProtocol === "mpp") {
+            if (error98 instanceof ZeroInsufficientFundsError) {
+              diagnostics.issue(
+                "balance_check",
+                FETCH_DIAGNOSTIC_CODES.insufficientFunds
+              );
+            } else if (error98 instanceof ZeroPermit2AllowanceError) {
+              diagnostics.issue(
+                "paid_replay",
+                FETCH_DIAGNOSTIC_CODES.permit2AllowanceRequired
+              );
+            }
+            const failedX402 = diagnostics.snapshot();
+            diagnostics.recordPaymentFallback({
+              from: "x402",
+              to: "mpp",
+              stage: error98 instanceof ZeroInsufficientFundsError ? "balance_check" : error98 instanceof ZeroPermit2AllowanceError ? "paid_replay" : failedX402.failureStage ?? "paid_replay",
+              code: error98 instanceof ZeroInsufficientFundsError ? FETCH_DIAGNOSTIC_CODES.insufficientFunds : error98 instanceof ZeroPermit2AllowanceError ? FETCH_DIAGNOSTIC_CODES.permit2AllowanceRequired : failedX402.failureCode ?? FETCH_DIAGNOSTIC_CODES.paymentFailed
+            });
+            diagnostics.recoverFailureForFallback();
             diagnostics.selectPaymentProtocol("mpp");
-            paid = await client.payments.payMpp(paymentInput);
+            paid = await client.payments.payMpp({
+              ...paymentInput,
+              headers: mppLegHeaders()
+            });
           } else {
             throw error98;
           }
@@ -170241,6 +170409,7 @@ var clientFetch = async (client, url4, opts = {}, diagnostics) => {
             ),
             failureStage: diagnostics.snapshot().failureStage ?? void 0,
             failureCode: diagnostics.snapshot().failureCode ?? void 0,
+            paymentFallback: diagnostics.snapshot().paymentFallback ?? void 0,
             fundingSource: diagnostics.snapshot().fundingSource ?? void 0,
             stageDurationsMs: diagnostics.snapshot().stageDurationsMs,
             warningCodes: warnings.length > 0 ? warnings : void 0,
@@ -170901,11 +171070,25 @@ var idJagMintResponseSchema = external_exports3.object({
   issuedTokenType: raw.issued_token_type ?? ID_JAG_TOKEN_TYPE,
   expiresIn: raw.expires_in ?? null
 }));
+var alternateBearerHeaderSchema = external_exports3.object({
+  scheme: external_exports3.string().optional(),
+  header: external_exports3.string(),
+  use_when: external_exports3.string().optional()
+}).loose();
 var protectedResourceMetadataSchema = external_exports3.object({
   resource: external_exports3.string().optional(),
   resource_name: external_exports3.string().optional(),
-  authorization_servers: external_exports3.array(external_exports3.string()).optional()
+  authorization_servers: external_exports3.array(external_exports3.string()).optional(),
+  zeroclick_agent_authorization: alternateBearerHeaderSchema.optional()
 }).loose();
+var HEADER_NAME = /^[A-Za-z0-9-]+$/;
+var alternateBearerHeaderFrom = (advertised) => {
+  if (!advertised) return null;
+  if (advertised.scheme && advertised.scheme.toLowerCase() !== "bearer") {
+    return null;
+  }
+  return HEADER_NAME.test(advertised.header) ? advertised.header : null;
+};
 var serviceAuthMetadataSchema = external_exports3.object({
   resource: external_exports3.string().optional(),
   resource_name: external_exports3.string().optional(),
@@ -171000,7 +171183,10 @@ var AuthIdentity = class {
           tokenEndpoint: metadata.token_endpoint ?? `${trimSlash(server)}/oauth2/token`,
           identityAssertionSupported: (agentAuth.identity_types_supported ?? []).includes(
             IDENTITY_ASSERTION_TYPE
-          ) && (assertionTypes ? assertionTypes.includes(ID_JAG_TOKEN_TYPE) : true)
+          ) && (assertionTypes ? assertionTypes.includes(ID_JAG_TOKEN_TYPE) : true),
+          alternateBearerHeader: alternateBearerHeaderFrom(
+            prm.zeroclick_agent_authorization
+          )
         };
       } catch (err) {
         lastError = err;
@@ -171656,14 +171842,30 @@ var paymentSessionSchema = external_exports3.object({
   recipient: external_exports3.string().regex(/^0x[0-9a-fA-F]{40}$/).nullable(),
   cumulativeAmount: external_exports3.string().regex(/^(?:0|[1-9]\d*)$/)
 }).strict();
+var paymentFallbackSchema = external_exports3.object({
+  from: external_exports3.string(),
+  to: external_exports3.string(),
+  stage: external_exports3.string(),
+  code: external_exports3.string()
+}).strict();
 var createRunResponseSchema = external_exports3.object({
   runId: external_exports3.string()
 });
 var runListItemSchema = external_exports3.object({
   uid: external_exports3.string(),
-  capabilityUid: external_exports3.string(),
-  capabilitySlug: external_exports3.string(),
-  capabilityName: external_exports3.string(),
+  // ZERO-844 — null on an unattributed (direct-URL) run. Those are only
+  // returned when the caller passes `includeUnattributed`, so a caller that
+  // doesn't opt in never sees a null here.
+  capabilityUid: external_exports3.string().nullable(),
+  capabilitySlug: external_exports3.string().nullable(),
+  capabilityName: external_exports3.string().nullable(),
+  // The redacted unindexed target, populated only when there is no capability.
+  // Older servers omit these; default rather than require so the SDK stays
+  // forward- and backward-compatible.
+  requestHost: external_exports3.string().nullable().optional().default(null),
+  requestPathTemplate: external_exports3.string().nullable().optional().default(null),
+  requestMethod: external_exports3.string().nullable().optional().default(null),
+  attributed: external_exports3.boolean().optional().default(true),
   status: external_exports3.number().nullable(),
   latencyMs: external_exports3.number().nullable(),
   cost: external_exports3.object({ amount: external_exports3.string(), asset: external_exports3.string().nullable() }).nullable(),
@@ -171674,6 +171876,7 @@ var runListItemSchema = external_exports3.object({
     mode: external_exports3.string().nullable(),
     session: paymentSessionSchema.nullable().optional().default(null)
   }).nullable(),
+  paymentFallback: paymentFallbackSchema.nullable().optional().default(null),
   createdAt: external_exports3.coerce.date(),
   reviewed: external_exports3.boolean()
 });
@@ -171695,6 +171898,9 @@ var runDetailSchema = external_exports3.object({
     mode: external_exports3.string().nullable(),
     session: paymentSessionSchema.nullable().optional().default(null)
   }).nullable(),
+  paymentFallback: paymentFallbackSchema.nullable().optional().default(null),
+  // ZERO-844 — null on an unattributed (direct-URL) run, which the server only
+  // returns when `includeUnattributed` is passed.
   capability: external_exports3.object({
     uid: external_exports3.string(),
     slug: external_exports3.string(),
@@ -171703,7 +171909,14 @@ var runDetailSchema = external_exports3.object({
     method: external_exports3.string(),
     whatItDoes: external_exports3.string().nullable(),
     tags: external_exports3.array(external_exports3.string())
-  }),
+  }).nullable(),
+  // The redacted unindexed target — the counterpart to `capability` for a run
+  // that has none. Exactly one of the two is non-null.
+  target: external_exports3.object({
+    host: external_exports3.string().nullable(),
+    pathTemplate: external_exports3.string().nullable(),
+    method: external_exports3.string().nullable()
+  }).nullable().optional().default(null),
   reviewed: external_exports3.boolean()
 });
 var createReviewResponseSchema = external_exports3.object({
@@ -171749,6 +171962,8 @@ var Runs = class _Runs {
    * unattributed runs, which it can't do if we strip the target as well.
    */
   static FIELD_GENERATIONS = [
+    // Structured trace of a safe payment-rail fallback.
+    ["paymentFallback"],
     // MPP channel anchor for close-failure reconciliation. Peels first so a
     // newer SDK still records all prior diagnostics against an older API.
     ["paymentSession"],
@@ -171844,6 +172059,8 @@ var Runs = class _Runs {
     if (params2.capabilityId !== void 0)
       query.capabilityId = params2.capabilityId;
     if (params2.unreviewed !== void 0) query.unreviewed = params2.unreviewed;
+    if (params2.includeUnattributed !== void 0)
+      query.includeUnattributed = params2.includeUnattributed;
     if (params2.limit !== void 0) query.limit = params2.limit;
     if (params2.cursor !== void 0) query.cursor = params2.cursor;
     if (params2.walletAddress !== void 0) {
@@ -171865,6 +172082,8 @@ var Runs = class _Runs {
     {
       method: "GET",
       path: `/v1/runs/${runId}`,
+      // ZERO-844 — without this an unattributed (direct-URL) run 404s.
+      query: opts.includeUnattributed !== void 0 ? { includeUnattributed: opts.includeUnattributed } : {},
       signal: opts.signal
     },
     runDetailSchema
@@ -172374,6 +172593,10 @@ var AnalyticsEmitter = class {
       latency_ms: res.latencyMs,
       has_payment: res.payment !== null,
       payment_protocol: res.payment?.protocol ?? res.diagnostics?.paymentProtocol ?? null,
+      payment_fallback_from: res.diagnostics?.paymentFallback?.from ?? null,
+      payment_fallback_to: res.diagnostics?.paymentFallback?.to ?? null,
+      payment_fallback_stage: res.diagnostics?.paymentFallback?.stage ?? null,
+      payment_fallback_code: res.diagnostics?.paymentFallback?.code ?? null,
       funding_source: res.diagnostics?.fundingSource ?? null,
       payment_amount: res.payment?.amount ?? null,
       payment_chain: res.payment?.chain ?? null,
@@ -172414,6 +172637,10 @@ var AnalyticsEmitter = class {
       failure_stage: diagnostics?.failureStage ?? null,
       failure_code: diagnostics?.failureCode ?? null,
       payment_protocol: diagnostics?.paymentProtocol ?? null,
+      payment_fallback_from: diagnostics?.paymentFallback?.from ?? null,
+      payment_fallback_to: diagnostics?.paymentFallback?.to ?? null,
+      payment_fallback_stage: diagnostics?.paymentFallback?.stage ?? null,
+      payment_fallback_code: diagnostics?.paymentFallback?.code ?? null,
       payment_mode: diagnostics?.paymentMode ?? null,
       funding_source: diagnostics?.fundingSource ?? null,
       diagnostic_codes: diagnostics?.issues.map((issue3) => issue3.code) ?? [],
@@ -176664,7 +176891,7 @@ var placeholderFor = (fieldName, propSchema) => String(sampleValueFor(fieldName,
 // package.json
 var package_default2 = {
   name: "@zeroxyz/cli",
-  version: "1.33.0",
+  version: "1.34.1",
   type: "module",
   bin: {
     zero: "dist/index.js",
@@ -177405,6 +177632,7 @@ var emitAccessToken = (accessToken, discovery, host, json3, reused) => {
         resource: discovery.resource,
         resourceName: discovery.resourceName,
         tokenEndpoint: discovery.tokenEndpoint,
+        alternateBearerHeader: discovery.alternateBearerHeader,
         reused
       })}
 `
@@ -177416,6 +177644,11 @@ var emitAccessToken = (accessToken, discovery, host, json3, reused) => {
       `Signed in to ${discovery.resourceName ?? host} with your Zero identity.`,
       "The bearer token below is short-lived \u2014 use it right away:",
       `  zero fetch <url> -H "Authorization: Bearer <token>"`,
+      ...discovery.alternateBearerHeader ? [
+        "Paying over MPP (a 402 answered with a Payment credential)? The payment takes Authorization, so send the token as:",
+        `  zero fetch <url> -H "${discovery.alternateBearerHeader}: Bearer <token>"`,
+        "(zero fetch moves a Bearer Authorization there itself when the 402 advertises it.)"
+      ] : [],
       `Re-run this command for a fresh token; it reuses the stored registration.`,
       ""
     ].join("\n")
@@ -178663,7 +178896,7 @@ Bulk bug-report complete: ${ok} ok, ${failed} failed`
             const [latest] = list2.runs;
             if (latest) {
               run = latest.uid;
-              capability = capability ?? latest.capabilityUid;
+              capability = capability ?? latest.capabilityUid ?? void 0;
             }
           } catch {
           }
@@ -178767,6 +179000,7 @@ init_esm_shims();
 var MAX_INLINE_REQUEST_BODY_BYTES = 10 * 1024 * 1024;
 var MAX_FILE_REQUEST_BODY_BYTES = 500 * 1024 * 1024;
 var MAX_RESPONSE_BYTES2 = MAX_FILE_REQUEST_BODY_BYTES;
+var paymentFallbackFor = (diagnostics) => diagnostics?.paymentFallback ?? null;
 var formatPaymentLine = (payment) => {
   const base2 = `Paid ${payment.amount} ${payment.asset} via ${payment.protocol} on ${payment.chain}`;
   return payment.authorizedAmount && payment.authorizedAmount !== payment.amount ? `${base2} (authorized up to ${payment.authorizedAmount})` : base2;
@@ -178989,7 +179223,6 @@ var fetchCommand = (appContext) => new Command("fetch").description(
       let searchId;
       let displayCostAmount;
       let fetchOrigin;
-      let runIsAttributed = true;
       if (fromToken) {
         capabilityUid = capFromNoUrl?.uid ?? null;
         capabilityId = options.capability ?? "";
@@ -179092,12 +179325,19 @@ var fetchCommand = (appContext) => new Command("fetch").description(
       } catch (err) {
         const message2 = err instanceof Error ? err.message : "Fetch failed";
         const fetchContext = fetchErrorContext(err);
+        const paymentFallback2 = paymentFallbackFor(
+          fetchContext.diagnostics
+        );
         analyticsService.capture("fetch_error", {
           cliErrorClass: "network",
           fetchId: fetchContext.fetchId,
           failureStage: fetchContext.diagnostics?.failureStage,
           failureCode: fetchContext.diagnostics?.failureCode,
           paymentProtocol: fetchContext.diagnostics?.paymentProtocol,
+          paymentFallbackFrom: paymentFallback2?.from,
+          paymentFallbackTo: paymentFallback2?.to,
+          paymentFallbackStage: paymentFallback2?.stage,
+          paymentFallbackCode: paymentFallback2?.code,
           paymentMode: fetchContext.diagnostics?.paymentMode,
           fundingSource: fetchContext.diagnostics?.fundingSource,
           diagnosticCodes: fetchContext.diagnostics?.issues?.map(
@@ -179129,11 +179369,17 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         settlementState,
         diagnostics
       } = result;
+      const paymentFallback = paymentFallbackFor(diagnostics);
       const isBinary = bodyEncoding === "base64";
       const bodyBytes = isBinary && bodyRaw ? Buffer.from(bodyRaw, "base64") : void 0;
       if (payment && payment.amount !== "unknown" && outcome !== "payment_close_failed") {
         log2(formatPaymentLine(payment));
       }
+      if (paymentFallback && !options.json) {
+        console.error(
+          `  Payment fallback: ${paymentFallback.from} \u2192 ${paymentFallback.to} (${paymentFallback.stage}: ${paymentFallback.code})`
+        );
+      }
       if (payment?.session && outcome === "success") {
         const recipient = payment.session.recipient;
         const recipientLabel = recipient ? `\u2192 ${recipient.slice(0, 8)}...` : "\u2192 (unknown recipient)";
@@ -179192,6 +179438,13 @@ var fetchCommand = (appContext) => new Command("fetch").description(
 `
         );
       }
+      if (sdkWarnings?.includes(
+        FETCH_WARNINGS.authorizationBearerDroppedByMpp
+      ) && !options.json) {
+        console.error(
+          "\n  WARNING: your `Authorization: Bearer` header did not reach the service: the MPP payment credential takes Authorization on the paid retry, and the 402 advertised no alternate header for the bearer. If the service accepts it elsewhere (its /.well-known/oauth-protected-resource or auth.md says where), send it in that header instead.\n"
+        );
+      }
       if (sdkWarnings?.length && outcome !== "payment_close_failed" && !options.json) {
         for (const w of sdkWarnings) {
           if (w === FETCH_WARNINGS.bodyTruncated) continue;
@@ -179210,10 +179463,9 @@ var fetchCommand = (appContext) => new Command("fetch").description(
             matchedVia: capabilityResolution.matchedVia
           });
         } else {
-          runIsAttributed = false;
           if (walletAddress && !runId) {
             cliSkipReasons.push(
-              "no capability resolved \u2014 pass --capability <uid|slug|token> or run `zero search` first so the URL can be matched"
+              "no run was recorded for this call \u2014 retry, or pass --capability <uid|slug|token> so the URL can be matched"
             );
           }
           analyticsService.capture("capability_resolution_missed", {
@@ -179236,6 +179488,10 @@ var fetchCommand = (appContext) => new Command("fetch").description(
           failureStage: diagnostics?.failureStage,
           failureCode: diagnostics?.failureCode,
           paymentProtocol: diagnostics?.paymentProtocol,
+          paymentFallbackFrom: paymentFallback?.from,
+          paymentFallbackTo: paymentFallback?.to,
+          paymentFallbackStage: paymentFallback?.stage,
+          paymentFallbackCode: paymentFallback?.code,
           paymentMode: diagnostics?.paymentMode,
           fundingSource: diagnostics?.fundingSource,
           diagnosticCodes: diagnostics?.issues.map((issue3) => issue3.code),
@@ -179335,7 +179591,7 @@ var fetchCommand = (appContext) => new Command("fetch").description(
             ...sdkWarnings?.length && { warnings: sdkWarnings }
           })
         );
-      } else if (runId && outcomeInfo.reviewable && runIsAttributed) {
+      } else if (runId && outcomeInfo.reviewable) {
         const isTTY = process.stderr.isTTY;
         const responded2xx = status !== null && status >= 200 && status < 300;
         console.error(`
@@ -179375,12 +179631,6 @@ var fetchCommand = (appContext) => new Command("fetch").description(
         } else {
           console.error(`  zero review ${runId} --no-success`);
         }
-      } else if (runId && !runIsAttributed) {
-        console.error(`
-  Run ID: ${runId}`);
-        console.error(
-          `  This URL isn't an indexed capability, so the run can't be reviewed. Pass --capability <uid|slug> or run \`zero search\` first to bind it to one.`
-        );
       } else if (!runId && cliSkipReasons.length > 0) {
         console.error(
           `
@@ -180899,12 +181149,19 @@ var formatDetail = (r) => {
   lines.push(`Result:     ${r.errorClass ?? "\u2014"}`);
   lines.push(`Reviewed:   ${r.reviewed ? "yes" : "no"}`);
   lines.push("");
-  lines.push(`Capability: ${r.capability.name} (${r.capability.slug})`);
-  lines.push(`URL:        ${r.capability.method} ${r.capability.url}`);
-  if (r.capability.whatItDoes)
-    lines.push(`What:       ${r.capability.whatItDoes}`);
-  if (r.capability.tags.length > 0)
-    lines.push(`Tags:       ${r.capability.tags.join(", ")}`);
+  if (r.capability) {
+    lines.push(`Capability: ${r.capability.name} (${r.capability.slug})`);
+    lines.push(`URL:        ${r.capability.method} ${r.capability.url}`);
+    if (r.capability.whatItDoes)
+      lines.push(`What:       ${r.capability.whatItDoes}`);
+    if (r.capability.tags.length > 0)
+      lines.push(`Tags:       ${r.capability.tags.join(", ")}`);
+  } else {
+    lines.push(`Capability: \u2014 (direct URL, not indexed)`);
+    lines.push(
+      `Target:     ${[r.target?.method, r.target?.host, r.target?.pathTemplate].filter(Boolean).join(" ") || "\u2014"}`
+    );
+  }
   if (r.cost) {
     const { amount: amount2, asset } = r.cost;
     lines.push(`Cost:       ${asset ? `${amount2} ${asset}` : amount2}`);
@@ -180921,7 +181178,9 @@ var runsDetailCommand = (appContext) => new Command("detail").description("Show
   const { json: json3 } = cmd.opts();
   try {
     const { client } = appContext.services;
-    const run = await client.runs.get(runId);
+    const run = await client.runs.get(runId, {
+      includeUnattributed: true
+    });
     if (json3) {
       console.log(JSON.stringify(run, null, 2));
       return;
@@ -180963,6 +181222,10 @@ Examples:
         const result = await client.runs.list({
           capabilityId: options.capability,
           unreviewed: options.unreviewed,
+          // ZERO-844 — direct-URL runs are reviewable, so they belong in
+          // the list an agent sweeps before finishing a task. Always on
+          // here; the flag exists for older SDK consumers, not for us.
+          includeUnattributed: true,
           ...options.walletAddress ? { walletAddress: options.walletAddress } : {},
           limit: options.limit
         });
@@ -180981,8 +181244,9 @@ Examples:
           const latency = r.latencyMs != null ? `${r.latencyMs}ms` : "\u2014";
           const cost = formatCost2(r.cost);
           const payment = formatPayment(r.payment);
+          const label = r.capabilitySlug ?? [r.requestMethod, r.requestHost, r.requestPathTemplate].filter(Boolean).join(" ") ?? "(direct URL)";
           console.log(
-            `[${mark2}] ${r.uid}  ${r.capabilitySlug}  status=${status}  ${latency}  ${cost}  ${payment}  ${when}`
+            `[${mark2}] ${r.uid}  ${label}  status=${status}  ${latency}  ${cost}  ${payment}  ${when}`
           );
         }
         if (result.nextCursor) {
@@ -185993,6 +186257,10 @@ var mapSdkEventToCliEvent = (event) => {
           latencyMs: p.latency_ms,
           hasPayment: p.has_payment,
           paymentProtocol: orUndef(p.payment_protocol),
+          paymentFallbackFrom: orUndef(p.payment_fallback_from),
+          paymentFallbackTo: orUndef(p.payment_fallback_to),
+          paymentFallbackStage: orUndef(p.payment_fallback_stage),
+          paymentFallbackCode: orUndef(p.payment_fallback_code),
           fundingSource: orUndef(p.funding_source),
           paymentAmount: dropUnknownAmount(p.payment_amount),
           paymentChain: orUndef(p.payment_chain),

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@zeroxyz/cli",
-	"version": "1.33.0",
+	"version": "1.34.1",
 	"type": "module",
 	"bin": {
 		"zero": "dist/index.js",