@zeroxyz/sdk 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@zeroxyz/sdk` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) — with the pre-1.0 caveat that minor versions may include breaking changes.
 
+## 0.4.0
+
+### Added
+
+- Pre-flight **balance gate** on paid `client.fetch()` / `payments.pay()` / `payments.payMpp()`. Before signing a paid leg the SDK reads the payer's USDC balance (x402 → Base; MPP → Tempo, including the Base→Tempo bridge math) and, if it can't cover the call, aborts with the new `ZeroInsufficientFundsError` instead of signing a doomed transaction. Previously an empty wallet signed anyway, the chain rejected, and the run was recorded at status 402 → the server classified it `payment_gated`, **indistinguishable from a capability that correctly payment-gates** — so unfunded wallets silently dinged cap reliability. (#585)
+- New `FetchOutcome` value **`insufficient_funds`** and new error class **`ZeroInsufficientFundsError`** (`ZeroErrorCode` `insufficient_funds`, carrying `have` / `need`). On this outcome `client.fetch()` records **no run** (`status: null`, `runTrackingSkipped` includes `insufficient_funds_not_recorded`) — a wallet condition is never charged against the capability; the wallet funnel stays observable via the `fetch_executed.outcome` analytics event. (#585)
+
+### Notes
+
+- The balance read is **fail-open**: an RPC error proceeds to attempt payment rather than re-introducing a false `payment_gated`. Free capabilities are unaffected — a non-402 response never enters the payment path, and a `0`-amount challenge passes the gate (`balance < 0` is never true). The `maxPay` contract is unchanged. (#585)
+
 ## 0.3.0
 
 ### Added

package/README.md

@@ -118,9 +118,15 @@ switch (result.outcome) {
   case "success":
     // 2xx/3xx — result.body / result.bodyRaw are populated.
     break;
+  case "insufficient_funds":
+    // Wallet balance is too low to cover the challenge amount. No payment
+    // was attempted. Top off via `zero wallet fund` (CLI) or fund the
+    // wallet before retrying. result.error is a ZeroInsufficientFundsError
+    // with .have and .need fields.
+    break;
   case "payment_failed":
-    // Couldn't pay: over your maxPay, insufficient balance, or an
-    // unrecognized 402 protocol. Nothing settled — generally safe to retry.
+    // Couldn't pay: over your maxPay or an unrecognized 402 protocol.
+    // Nothing settled — generally safe to retry.
     break;
   case "payment_rejected":
     // Paid, but the capability still returned 402 (a settlement/facilitator
@@ -277,10 +283,11 @@ The SDK throws typed errors instead of strings. Match them with `instanceof`:
 
 ```ts
 import {
-  ZeroApiError,                // a 4xx/5xx from Zero's own API
-  ZeroAuthError,               // missing auth, failed refresh, expired session
-  ZeroPaymentError,            // payment failed before settlement
-  ZeroSessionCloseFailedError, // MPP session-close voucher rejected
+  ZeroApiError,                  // a 4xx/5xx from Zero's own API
+  ZeroAuthError,                 // missing auth, failed refresh, expired session
+  ZeroInsufficientFundsError,    // wallet balance too low; .have and .need in USDC
+  ZeroPaymentError,              // payment failed before settlement
+  ZeroSessionCloseFailedError,   // MPP session-close voucher rejected
   ZeroTimeoutError,            // the configured timeout was exceeded
   ZeroConfigurationError,      // invalid ClientOptions
   ZeroWalletError,             // a wallet read or write failed
@@ -301,7 +308,7 @@ try {
 }
 ```
 
-`client.fetch()` reserves throwing for programmer errors — bad config, missing credentials, and the like. Expected runtime failures (`network_error`, `payment_failed`, an upstream `5xx`) come back as a `FetchResult` with the matching `outcome`, so you handle them by branching on the result rather than by catching.
+`client.fetch()` reserves throwing for programmer errors — bad config, missing credentials, and the like. Expected runtime failures (`insufficient_funds`, `network_error`, `payment_failed`, an upstream `5xx`) come back as a `FetchResult` with the matching `outcome`, so you handle them by branching on the result rather than by catching.
 
 ## Logging
 

package/dist/{chunk-LVK77C6A.cjs → chunk-ED754B5U.cjs}

@@ -79,6 +79,16 @@ var ZeroPaymentError = class extends ZeroError {
     this.name = "ZeroPaymentError";
   }
 };
+var ZeroInsufficientFundsError = class extends ZeroError {
+  have;
+  need;
+  constructor(message, init) {
+    super("insufficient_funds", message, { cause: init.cause });
+    this.name = "ZeroInsufficientFundsError";
+    this.have = init.have;
+    this.need = init.need;
+  }
+};
 var ZeroSessionCloseFailedError = class extends ZeroError {
   session;
   response;
@@ -425,7 +435,12 @@ var FETCH_SKIP_REASONS = Object.freeze({
   bodyReadFailed: "body_read_failed",
   mppSessionCloseFailedNotRecorded: "mpp_session_close_failed_not_recorded",
   paidButStill402NotRecorded: FETCH_WARNINGS.paidButStill402NotRecorded,
-  paymentSettlementUnconfirmed: FETCH_WARNINGS.paymentSettlementUnconfirmed
+  paymentSettlementUnconfirmed: FETCH_WARNINGS.paymentSettlementUnconfirmed,
+  // Pre-sign abort: deliberately NOT recorded as a run — the wallet was
+  // empty before we reached the capability, so charging it as a 402 would
+  // corrupt cap reliability. The wallet funnel is tracked via the
+  // fetch_executed.outcome analytics event instead.
+  insufficientFunds: "insufficient_funds_not_recorded"
 });
 var MAX_RECEIPT_HEADER_BYTES = 8 * 1024;
 var decodeSessionReceiptHeader = (header) => {
@@ -567,6 +582,7 @@ var Payments = class {
     );
     let capturedAmount = null;
     let capturedNetwork;
+    let preflightError = null;
     const x402 = client.registerExactEvmScheme(new client$1.x402Client(), { signer: account });
     x402.onBeforePaymentCreation(async (context) => {
       const selected = context.selectedRequirements;
@@ -600,6 +616,29 @@ var Payments = class {
           reason: `Payment of ${capturedAmount} USDC exceeds maxPay ${input.maxPay}`
         };
       }
+      const detected = networkToChain(capturedNetwork);
+      const balanceChain = detected === "base-sepolia" ? "base-sepolia" : "base";
+      let balance = null;
+      try {
+        balance = await this.readUsdcBalance(account.address, balanceChain);
+      } catch (readErr) {
+        this.client.logger?.({
+          level: "warn",
+          message: "Pre-flight balance read failed; proceeding to attempt payment",
+          meta: {
+            chain: balanceChain,
+            error: readErr instanceof Error ? readErr.message : String(readErr)
+          }
+        });
+      }
+      if (balance !== null && balance < rawAmountUnits) {
+        const have = viem.formatUnits(balance, 6);
+        preflightError = new ZeroInsufficientFundsError(
+          `wallet has ${have} USDC on Base, needs ${capturedAmount}.`,
+          { have, need: capturedAmount }
+        );
+        return { abort: true, reason: preflightError.message };
+      }
     });
     const configuredFetch = buildConfiguredFetch(this.client, {
       timeoutMs: input.timeoutMs
@@ -620,6 +659,7 @@ var Payments = class {
         signal: input.signal
       });
     } catch (err) {
+      if (preflightError) throw preflightError;
       if (err instanceof ZeroError) throw err;
       throw new ZeroPaymentError(
         `x402 payment failed: ${err instanceof Error ? err.message : String(err)}`,
@@ -864,23 +904,29 @@ var Payments = class {
     );
     if (tempoBalance < requiredRaw) {
       if (coerced.chain === "tempo-testnet") {
-        throw new ZeroPaymentError(
-          `Insufficient pathUSD on Tempo testnet: have ${viem.formatUnits(tempoBalance, 6)}, need ${capturedAmount}. Fund via the Tempo testnet faucet: https://docs.tempo.xyz/quickstart/faucet`
+        const have = viem.formatUnits(tempoBalance, 6);
+        throw new ZeroInsufficientFundsError(
+          `Insufficient pathUSD on Tempo testnet: have ${have}, need ${capturedAmount}. Fund via the Tempo testnet faucet: https://docs.tempo.xyz/quickstart/faucet`,
+          { have, need: capturedAmount }
         );
       }
-      await this.bridgeBaseToTempo(account, requiredRaw - tempoBalance);
+      await this.bridgeBaseToTempo(account, requiredRaw - tempoBalance, {
+        isSessionDeposit: challenge.intent === "session",
+        depositTotal: capturedAmount
+      });
     }
     return capturedAmount;
   };
-  bridgeBaseToTempo = async (account, requiredAmount) => {
+  bridgeBaseToTempo = async (account, requiredAmount, depositContext) => {
     this.ensureRelayClient();
     const baseBalance = await this.readUsdcBalance(account.address, "base");
     const buffer = calculateBuffer(baseBalance);
     const bridgeAmount = requiredAmount + buffer;
     if (baseBalance < bridgeAmount) {
-      throw new ZeroPaymentError(
-        `Insufficient Base USDC to bridge: have ${viem.formatUnits(baseBalance, 6)}, need ${viem.formatUnits(bridgeAmount, 6)} (${viem.formatUnits(requiredAmount, 6)} + ${viem.formatUnits(buffer, 6)} buffer). This capability uses an MPP payment channel, which is pre-funded up front. Either fund your wallet on Base, or pass \`maxPay\` to size a smaller channel (e.g. \`maxPay: '0.05'\` for a ~5-cent channel sized for a single cheap call).`
-      );
+      const have = viem.formatUnits(baseBalance, 6);
+      const need = viem.formatUnits(bridgeAmount, 6);
+      const message = depositContext?.isSessionDeposit ? `wallet has ${have} USDC on Base, but this capability pre-funds a ${depositContext.depositTotal} USDC MPP payment channel up front (the channel is deposited before the call, so it asks for more than a single charge). Needs ${need} on Base to open it \u2014 fund the wallet, or pass a smaller \`maxPay\` (e.g. '0.05') to size the channel down to one cheap call.` : `wallet has ${have} USDC on Base, needs ${need} to fund this capability's MPP payment channel (${viem.formatUnits(requiredAmount, 6)} + ${viem.formatUnits(buffer, 6)} buffer). Tip: pass a smaller \`maxPay\` (e.g. '0.05') to size a cheaper channel.`;
+      throw new ZeroInsufficientFundsError(message, { have, need });
     }
     this.client.logger?.({
       level: "info",
@@ -1100,7 +1146,7 @@ var Payments = class {
 
 // package.json
 var package_default = {
-  version: "0.3.0"};
+  version: "0.5.0"};
 
 // src/version.ts
 var SDK_VERSION = package_default.version;
@@ -1757,6 +1803,11 @@ var capabilityResponseSchema = zod.z.object({
   lastUsedAt: zod.z.string().nullable().optional(),
   lastSuccessfullyRanAt: zod.z.string().nullable().optional()
 });
+var resolveCapabilityResponseSchema = zod.z.object({
+  capabilityId: zod.z.string(),
+  capabilitySlug: zod.z.string(),
+  matchedVia: zod.z.enum(["exact", "template"])
+});
 
 // src/namespaces/capabilities.ts
 var Capabilities = class {
@@ -1773,6 +1824,31 @@ var Capabilities = class {
     },
     capabilityResponseSchema
   );
+  // Resolve a raw endpoint URL + method back to the capability that owns it,
+  // for the `zero fetch <url>` case where the client has no local search
+  // context to match against (a memoized/cross-session URL). Returns null on
+  // 404 — i.e. no match or an ambiguous multi-match, both of which the server
+  // reports as 404 (resolveByUrl fails closed rather than mis-attribute).
+  // The URL travels in the POST body so it stays out of access logs and is
+  // never stored; the caller uses the returned capabilityId to record an
+  // attributed run without the URL ever touching the run row (ZERO-335).
+  resolveByUrl = async (url, method, opts = {}) => {
+    try {
+      return await request(
+        this.client,
+        {
+          method: "POST",
+          path: "/v1/capabilities/resolve",
+          body: { url, method },
+          signal: opts.signal
+        },
+        resolveCapabilityResponseSchema
+      );
+    } catch (err) {
+      if (err instanceof ZeroApiError && err.status === 404) return null;
+      throw err;
+    }
+  };
 };
 var createRunResponseSchema = zod.z.object({
   runId: zod.z.string()
@@ -2353,14 +2429,17 @@ var resolveRecordingClient = (client, opts) => {
   const canRecord = opts.account !== void 0 || credentials.kind === "account" || credentials.kind === "session";
   return { recordingClient, canRecord };
 };
-var recordErrorFetchRun = async (client, opts, result) => {
-  if (opts.capabilityId === void 0) return;
+var recordErrorFetchRun = async (client, opts, result, capabilityIdOverride) => {
+  const effectiveCapId = opts.capabilityId;
+  if (effectiveCapId === void 0) return;
   const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
   if (!canRecord) return;
+  const fetchOriginForRecord = opts.capabilityId === void 0 ? "direct_url" : opts.fetchOrigin;
   try {
     const created = await recordingClient.runs.create({
-      capabilityId: opts.capabilityId,
+      capabilityId: effectiveCapId,
       ...opts.searchId && { searchId: opts.searchId },
+      ...fetchOriginForRecord && { fetchOrigin: fetchOriginForRecord },
       ...result.status !== null && { status: result.status },
       latencyMs: result.latencyMs,
       ...opts.requestSchema && { requestSchema: opts.requestSchema }
@@ -2370,7 +2449,7 @@ var recordErrorFetchRun = async (client, opts, result) => {
   } catch {
   }
 };
-var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested) => {
+var recordTimeoutRun = async (client, opts, err, startedAt, capabilityIdRequested, capabilityIdOverride) => {
   const result = errorFetchResult(
     startedAt,
     err.message,
@@ -2407,6 +2486,11 @@ var clientFetch = async (client, url, opts = {}) => {
   const startedAt = Date.now();
   const capabilityIdRequested = opts.capabilityId !== void 0;
   const method = opts.method ?? (opts.body !== void 0 ? "POST" : "GET");
+  const { canRecord: canRecordForResolve } = resolveRecordingClient(
+    client,
+    opts
+  );
+  const resolvePromise = !capabilityIdRequested && canRecordForResolve ? client.capabilities.resolveByUrl(redactUrl(url), method).catch(() => null) : Promise.resolve(null);
   const probeHeaders = withDefaultContentType(opts.headers, opts.body);
   const requestInit = {
     method,
@@ -2482,6 +2566,15 @@ var clientFetch = async (client, url, opts = {}) => {
             session: err.session
           };
           warnings.push(FETCH_WARNINGS.mppSessionCloseFailed);
+        } else if (err instanceof ZeroInsufficientFundsError) {
+          return errorFetchResult(
+            startedAt,
+            err.message,
+            FETCH_SKIP_REASONS.insufficientFunds,
+            capabilityIdRequested,
+            "insufficient_funds",
+            null
+          );
         } else if (err instanceof ZeroPaymentError || err instanceof ZeroAuthError) {
           const result2 = errorFetchResult(
             startedAt,
@@ -2589,7 +2682,15 @@ var clientFetch = async (client, url, opts = {}) => {
     else if (closeFailed)
       skipReasons.push(FETCH_SKIP_REASONS.mppSessionCloseFailedNotRecorded);
   }
-  if (opts.capabilityId !== void 0 && !paidButStill402 && !closeFailed) {
+  const resolvedCap = await resolvePromise;
+  const effectiveCapabilityId = opts.capabilityId ?? resolvedCap?.capabilityId;
+  const capabilityResolution = !capabilityIdRequested && canRecordForResolve ? resolvedCap !== null ? {
+    resolved: true,
+    capabilityId: resolvedCap.capabilityId,
+    capabilitySlug: resolvedCap.capabilitySlug,
+    matchedVia: resolvedCap.matchedVia
+  } : { resolved: false } : void 0;
+  if (effectiveCapabilityId !== void 0 && !paidButStill402 && !closeFailed) {
     const { recordingClient, canRecord } = resolveRecordingClient(client, opts);
     if (!canRecord) {
       skipReasons.push("no_credentials");
@@ -2609,8 +2710,11 @@ var clientFetch = async (client, url, opts = {}) => {
           }
         }
         const result2 = await recordingClient.runs.create({
-          capabilityId: opts.capabilityId,
+          capabilityId: effectiveCapabilityId,
           searchId: opts.searchId,
+          // Auto-resolved runs are always direct_url — they only fire when
+          // no capabilityId was supplied (the direct_url path by definition).
+          ...opts.capabilityId === void 0 ? { fetchOrigin: "direct_url" } : opts.fetchOrigin && { fetchOrigin: opts.fetchOrigin },
           status: response.status,
           latencyMs,
           ...opts.requestSchema && { requestSchema: opts.requestSchema },
@@ -2643,7 +2747,7 @@ var clientFetch = async (client, url, opts = {}) => {
           message: "Failed to record run for fetch",
           meta: {
             url: redactUrl(url),
-            capabilityId: opts.capabilityId,
+            capabilityId: effectiveCapabilityId,
             error: errorMessage2,
             errorCode: code
           }
@@ -2671,6 +2775,8 @@ var clientFetch = async (client, url, opts = {}) => {
     result.runTrackingSkipped = skipReasons;
   }
   if (warnings.length > 0) result.warnings = warnings;
+  if (capabilityResolution !== void 0)
+    result.capabilityResolution = capabilityResolution;
   return result;
 };
 var searchResultSchema = zod.z.object({
@@ -3114,5 +3220,5 @@ exports.coerceTempoChainId = coerceTempoChainId;
 exports.createManagedAccount = createManagedAccount;
 exports.paymentHasAnchor = paymentHasAnchor;
 exports.tempoChainLabelFromId = tempoChainLabelFromId;
-//# sourceMappingURL=chunk-LVK77C6A.cjs.map
-//# sourceMappingURL=chunk-LVK77C6A.cjs.map
+//# sourceMappingURL=chunk-ED754B5U.cjs.map
+//# sourceMappingURL=chunk-ED754B5U.cjs.map