@zeroxyz/sdk 0.9.0 → 0.11.0

package/dist/{chunk-T6JT5NV5.js → chunk-T77VVLOM.js}

@@ -1,5 +1,6 @@
 import { serializeTransaction, parseSignature, formatUnits, isAddress, getAddress, parseUnits, createWalletClient, http, createPublicClient, bytesToHex } from 'viem';
 import { toAccount, privateKeyToAccount, mnemonicToAccount } from 'viem/accounts';
+import { base, baseSepolia } from 'viem/chains';
 import { getClient, adaptViemWallet, createClient, convertViemChainToRelayChain, MAINNET_RELAY_API } from '@relayprotocol/relay-sdk';
 import { x402Client } from '@x402/core/client';
 import { x402HTTPClient, decodePaymentResponseHeader, encodePaymentRequiredHeader } from '@x402/core/http';
@@ -8,7 +9,6 @@ import { createSIWxClientHook } from '@x402/extensions/sign-in-with-x';
 import { wrapFetchWithPayment } from '@x402/fetch';
 import { Receipt, Challenge } from 'mppx';
 import { Mppx, tempo } from 'mppx/client';
-import { base, baseSepolia } from 'viem/chains';
 import { createHash } from 'crypto';
 import { z } from 'zod';
 
@@ -43,6 +43,28 @@ var createManagedAccount = (client, address) => toAccount({
     return await serialize(transaction, parseSignature(signature));
   }
 });
+var USDC_BASE = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+var USDC_TEMPO = "0x20c000000000000000000000b9537d11c60e8b50";
+var TEMPO_CHAIN_ID = 4217;
+var baseChain = base;
+var tempoChain = {
+  id: TEMPO_CHAIN_ID,
+  name: "Tempo",
+  nativeCurrency: { name: "USD", symbol: "USD", decimals: 18 },
+  rpcUrls: {
+    default: { http: ["https://rpc.tempo.xyz"] }
+  }
+};
+var ERC20_BALANCE_ABI = [
+  {
+    inputs: [{ name: "account", type: "address" }],
+    name: "balanceOf",
+    outputs: [{ name: "", type: "uint256" }],
+    stateMutability: "view",
+    type: "function"
+  }
+];
+var USDC_DECIMALS = 6;
 
 // src/errors.ts
 var ZeroError = class extends Error {
@@ -71,6 +93,25 @@ var ZeroAuthError = class extends ZeroError {
     this.name = "ZeroAuthError";
   }
 };
+var ZeroAgentAuthError = class extends ZeroError {
+  status;
+  body;
+  constructor(message, init) {
+    super("auth_error", message, { cause: init.cause });
+    this.name = "ZeroAgentAuthError";
+    this.status = init.status;
+    this.body = init.body;
+  }
+  // The error code the SERVER sent, distinct from ZeroError's `code`
+  // discriminator. WorkOS error bodies carry {code, message}; OAuth-style
+  // ones carry {error}.
+  get serverCode() {
+    const body = this.body;
+    if (typeof body?.code === "string") return body.code;
+    if (typeof body?.error === "string") return body.error;
+    return null;
+  }
+};
 var ZeroPaymentError = class extends ZeroError {
   constructor(message, options) {
     super("payment_error", message, options);
@@ -430,15 +471,15 @@ var networkToChain = (network) => {
 var MAX_PAY_RE = /^[0-9]+(\.[0-9]{1,6})?$/;
 var UINT_RE = /^[0-9]+$/;
 var MAX_AMOUNT_DIGITS = 30;
-var USDC_BASE = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
-var USDC_TEMPO = "0x20c000000000000000000000b9537d11c60e8b50";
+var USDC_BASE2 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
+var USDC_TEMPO2 = "0x20c000000000000000000000b9537d11c60e8b50";
 var PATHUSD_TEMPO = "0x20c0000000000000000000000000000000000000";
 var BASE_CHAIN_ID = 8453;
-var TEMPO_CHAIN_ID = 4217;
+var TEMPO_CHAIN_ID2 = 4217;
 var TEMPO_TESTNET_CHAIN_ID = 42431;
 var DEFAULT_PREFUND = "1";
-var tempoChain = {
-  id: TEMPO_CHAIN_ID,
+var tempoChain2 = {
+  id: TEMPO_CHAIN_ID2,
   name: "Tempo",
   nativeCurrency: { name: "USD", symbol: "USD", decimals: 18 },
   rpcUrls: { default: { http: ["https://rpc.tempo.xyz"] } }
@@ -449,7 +490,7 @@ var tempoTestnetChain = {
   nativeCurrency: { name: "USD", symbol: "USD", decimals: 18 },
   rpcUrls: { default: { http: ["https://rpc.moderato.tempo.xyz"] } }
 };
-var ERC20_BALANCE_ABI = [
+var ERC20_BALANCE_ABI2 = [
   {
     inputs: [{ name: "account", type: "address" }],
     name: "balanceOf",
@@ -478,7 +519,7 @@ var resolveDefaultPrefund = (displayCostAmount) => {
 var isUintString = (v) => typeof v === "string" && v.length > 0 && v.length <= MAX_AMOUNT_DIGITS && UINT_RE.test(v);
 var coerceTempoChainId = (raw) => {
   const id = typeof raw === "number" && Number.isFinite(raw) ? raw : typeof raw === "string" && /^-?[0-9]+$/.test(raw) ? Number(raw) : null;
-  if (id === TEMPO_CHAIN_ID) return { id, chain: "tempo" };
+  if (id === TEMPO_CHAIN_ID2) return { id, chain: "tempo" };
   if (id === TEMPO_TESTNET_CHAIN_ID) return { id, chain: "tempo-testnet" };
   return null;
 };
@@ -965,7 +1006,7 @@ var Payments = class {
     );
     if (!coerced) {
       throw new ZeroPaymentError(
-        `MPP challenge has missing or unsupported chainId (expected ${TEMPO_CHAIN_ID} or ${TEMPO_TESTNET_CHAIN_ID})`
+        `MPP challenge has missing or unsupported chainId (expected ${TEMPO_CHAIN_ID2} or ${TEMPO_TESTNET_CHAIN_ID})`
       );
     }
     const tempoBalance = await this.readUsdcBalance(
@@ -1009,9 +1050,9 @@ var Payments = class {
     });
     const quote = await getClient().actions.getQuote({
       chainId: BASE_CHAIN_ID,
-      toChainId: TEMPO_CHAIN_ID,
-      currency: USDC_BASE,
-      toCurrency: USDC_TEMPO,
+      toChainId: TEMPO_CHAIN_ID2,
+      currency: USDC_BASE2,
+      toCurrency: USDC_TEMPO2,
       amount: bridgeAmount.toString(),
       tradeType: "EXACT_INPUT",
       user: account.address,
@@ -1042,7 +1083,7 @@ var Payments = class {
       // Tempo tx hash on the Base transport.
       chains: [
         convertViemChainToRelayChain(base),
-        convertViemChainToRelayChain(tempoChain)
+        convertViemChainToRelayChain(tempoChain2)
       ]
     });
     this.relayInitialized = true;
@@ -1051,14 +1092,14 @@ var Payments = class {
     const { viemChain, token } = (() => {
       switch (chain) {
         case "base":
-          return { viemChain: base, token: USDC_BASE };
+          return { viemChain: base, token: USDC_BASE2 };
         case "base-sepolia":
           return {
             viemChain: baseSepolia,
             token: "0x036CbD53842c5426634e7929541eC2318f3dCF7e"
           };
         case "tempo":
-          return { viemChain: tempoChain, token: USDC_TEMPO };
+          return { viemChain: tempoChain2, token: USDC_TEMPO2 };
         case "tempo-testnet":
           return { viemChain: tempoTestnetChain, token: PATHUSD_TEMPO };
       }
@@ -1066,7 +1107,7 @@ var Payments = class {
     const client = createPublicClient({ chain: viemChain, transport: http() });
     return await client.readContract({
       address: token,
-      abi: ERC20_BALANCE_ABI,
+      abi: ERC20_BALANCE_ABI2,
       functionName: "balanceOf",
       args: [address]
     });
@@ -1116,7 +1157,7 @@ var Payments = class {
     }
     if (!coercedChainId) {
       throw buildOrphanFromChannelEntry(
-        `MPP session challenge has unsupported chainId (expected ${TEMPO_CHAIN_ID} or ${TEMPO_TESTNET_CHAIN_ID}); channel ${channelId} is open and requires reconciliation.`
+        `MPP session challenge has unsupported chainId (expected ${TEMPO_CHAIN_ID2} or ${TEMPO_TESTNET_CHAIN_ID}); channel ${channelId} is open and requires reconciliation.`
       );
     }
     const receipt = readSessionReceipt(response);
@@ -1436,16 +1477,89 @@ var extractUpstreamErrorMessage = (body) => {
   }
   return void 0;
 };
+var extractFieldName = (message) => {
+  const patterns = [
+    /(?:field|param(?:eter)?|property|key)[:\s]+["'`]?([a-z0-9_.[\]-]+)["'`]?/i,
+    /["'`]([a-z0-9_.[\]-]+)["'`]\s*(?:is\s+)?(?:required|missing|expected)/i,
+    // Quotes REQUIRED here — an unquoted token after "required"/"missing"
+    // is usually a generic noun ("required parameters", "missing fields"),
+    // not a field name. Only trust it when the seller quoted it.
+    /(?:required|missing|expected)[:\s]+["'`]([a-z0-9_.[\]-]+)["'`]/i
+  ];
+  for (const p of patterns) {
+    const match = message.match(p);
+    if (match?.[1]) return match[1];
+  }
+  return void 0;
+};
+var extractAllowedMethod = (text) => {
+  const listed = text.match(
+    /allowed[^[]*\[\s*["'`]?(GET|POST|PUT|PATCH|DELETE|HEAD)/i
+  );
+  if (listed?.[1]) return listed[1].toUpperCase();
+  const useVerb = text.match(/\buse\s+(GET|POST|PUT|PATCH|DELETE|HEAD)\b/i);
+  if (useVerb?.[1]) return useVerb[1].toUpperCase();
+  return void 0;
+};
+var extractUnrecognizedKeys = (bodyRaw) => {
+  if (!bodyRaw) return [];
+  const parsed = tryParseJson(bodyRaw);
+  if (parsed === null || typeof parsed !== "object") return [];
+  const out = [];
+  const visit = (node) => {
+    if (!node || typeof node !== "object") return;
+    const o = node;
+    if (Array.isArray(o.keys)) {
+      for (const k of o.keys) if (typeof k === "string") out.push(k);
+    }
+    for (const v of Object.values(o)) {
+      if (Array.isArray(v)) v.forEach(visit);
+      else if (v && typeof v === "object") visit(v);
+    }
+  };
+  visit(parsed);
+  return [...new Set(out)].slice(0, 8);
+};
+var computeFixHint = (status, message, bodyRaw) => {
+  if (status < 400 || status >= 500) return void 0;
+  const hay = `${message ?? ""} ${bodyRaw ?? ""}`.toLowerCase();
+  if (status === 405 || /method not allowed|method_not_allowed/.test(hay)) {
+    const allowed = extractAllowedMethod(`${bodyRaw ?? ""} ${message ?? ""}`);
+    return allowed ? `the endpoint expects ${allowed}, not the method you used \u2014 retry with -X ${allowed}` : "the endpoint rejected this HTTP method \u2014 check the capability's method (`zero get <slug>`) and retry with the right -X";
+  }
+  if (/invalid json|not valid json|malformed|unexpected token|json ?parse|could not parse|failed to parse|jsondecode/.test(
+    hay
+  )) {
+    return "the request body isn't valid JSON \u2014 check quoting/escaping (single-quote the -d value or use @file), then retry";
+  }
+  if (/unrecognized[_ ]?key|unexpected key|unknown (field|key|propert)|additional (?:propert|field)|not allowed in object/.test(
+    hay
+  )) {
+    const keys = extractUnrecognizedKeys(bodyRaw ?? null);
+    return keys.length ? `remove the unexpected field(s) ${keys.map((k) => `'${k}'`).join(", ")} from the request body, then retry` : "the request body has fields the capability doesn't accept \u2014 send only the documented fields, then retry";
+  }
+  if (status === 415 || /content-?type|unsupported media|media type/.test(hay)) {
+    return "set the Content-Type header to what the capability expects (usually application/json), then retry";
+  }
+  if (/required|missing|must (include|provide|have|contain)|is expected/.test(hay)) {
+    const field = extractFieldName(message ?? "");
+    return field ? `add the required field '${field}' to the request body, then retry` : "the request is missing one or more required fields \u2014 check the capability schema (`zero get <slug>`), then retry";
+  }
+  return void 0;
+};
 var buildUpstreamError = (status, bodyRaw, bodyEncoding) => {
   if (status >= 200 && status < 300) return void 0;
   if (bodyRaw === null || bodyRaw.length === 0) return void 0;
   if (bodyEncoding === "base64") return void 0;
   const snippet = bodyRaw.slice(0, ERROR_SNIPPET_BYTES);
+  const message = extractUpstreamErrorMessage(bodyRaw);
+  const fixHint = computeFixHint(status, message, bodyRaw);
   return {
     status,
-    message: extractUpstreamErrorMessage(bodyRaw),
+    message,
     snippetHash: createHash("sha256").update(snippet).digest("hex"),
-    snippetLength: snippet.length
+    snippetLength: snippet.length,
+    ...fixHint && { fixHint }
   };
 };
 var computeOutcome = (status, payment, warnings) => {
@@ -1836,77 +1950,64 @@ var clientFetch = async (client, url, opts = {}) => {
 
 // package.json
 var package_default = {
-  version: "0.9.0"};
+  version: "0.11.0"};
 
 // src/version.ts
 var SDK_VERSION = package_default.version;
-var userWalletDtoSchema = z.object({
-  walletAddress: z.string(),
-  source: z.enum(["self_custody", "privy_embedded"]),
-  isPrimary: z.boolean(),
-  linkedAt: z.union([z.string(), z.date()]).nullable().optional(),
-  delegationGranted: z.boolean(),
-  signerQuorumId: z.string().nullable(),
-  // Per-transaction USDC cap in base units (6 dp). null = unlimited, 0 = free-only.
-  maxTransactionUsdcBaseUnits: z.number().int().nullable()
-});
-var welcomeBonusSummarySchema = z.object({
-  status: z.string(),
-  amountUsd: z.number()
-});
-var internalUserDtoSchema = z.object({
+var agentAuthMetadataSchema = z.object({
+  token_endpoint: z.string().optional(),
+  agent_auth: z.object({
+    identity_endpoint: z.string(),
+    claim_endpoint: z.string().optional()
+  }).loose()
+}).loose();
+var identityEnvelopeSchema = z.object({
   id: z.string(),
-  email: z.string().nullable(),
-  createdAt: z.union([z.string(), z.date()]).optional(),
-  lastLoginAt: z.union([z.string(), z.date()]).nullable().optional(),
-  onboardingCompleted: z.boolean().optional(),
-  delegationGranted: z.boolean().optional(),
-  wallets: z.array(userWalletDtoSchema).optional(),
-  balance: z.object({ amount: z.string(), asset: z.string() }).nullable().optional(),
-  welcomeBonus: welcomeBonusSummarySchema.nullable().optional()
-});
-var publicUserDtoSchema = z.object({
-  user: z.object({
-    id: z.string(),
-    email: z.string().nullable()
-  }),
-  walletAddress: z.string().nullable(),
-  balance: z.object({ amount: z.string(), asset: z.string() }).nullable(),
-  welcomeBonus: welcomeBonusSummarySchema.nullable()
-});
-var signResponseSchema = z.object({
-  signature: z.string().regex(/^0x[0-9a-fA-F]+$/, "must be 0x-prefixed hex"),
-  walletAddress: z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be 0x-prefixed 40-char hex address")
-});
-
-// src/schemas/device.ts
-var deviceStartResponseSchema = z.object({
-  deviceCode: z.string(),
-  userCode: z.string(),
-  verificationUri: z.string(),
-  pollInterval: z.number(),
-  expiresAt: z.number()
-});
-var devicePollResponseSchema = z.union([
-  // userCode + verificationUri are optional: older API deployments don't
-  // echo them on pending.
-  z.object({
-    error: z.literal("authorization_pending"),
-    userCode: z.string().optional(),
-    verificationUri: z.string().optional()
-  }),
-  z.object({ error: z.literal("expired_token") }),
-  z.object({
-    accessToken: z.string(),
-    refreshToken: z.string(),
-    expiresIn: z.number(),
-    user: internalUserDtoSchema
-  })
-]);
-var sessionExchangeResponseSchema = z.object({
-  token: z.string(),
-  expiresAt: z.number()
-});
+  identity: z.object({
+    assertion: z.string(),
+    expires_at: z.string().optional(),
+    refresh_token: z.object({ value: z.string() }).loose().optional()
+  }).loose(),
+  claim: z.object({
+    token: z.string().optional(),
+    expires_at: z.string().optional()
+  }).loose().optional()
+}).loose().transform((raw) => ({
+  registrationId: raw.id,
+  identityAssertion: raw.identity.assertion,
+  assertionExpires: raw.identity.expires_at ?? null,
+  refreshToken: raw.identity.refresh_token?.value ?? null,
+  claimToken: raw.claim?.token ?? null,
+  claimTokenExpires: raw.claim?.expires_at ?? null
+}));
+var agentTokenResponseSchema = z.object({ access_token: z.string() }).loose().transform((raw) => ({ accessToken: raw.access_token }));
+var startClaimResponseSchema = z.object({
+  attempt: z.object({
+    verification_uri: z.string(),
+    expires_at: z.string().optional()
+  }).loose()
+}).loose().transform((raw) => ({
+  verificationUri: raw.attempt.verification_uri,
+  expiresAt: raw.attempt.expires_at ?? null
+}));
+var completeClaimResponseSchema = z.object({
+  identity: z.object({
+    assertion: z.string(),
+    expires_at: z.string().optional(),
+    refresh_token: z.object({ value: z.string() }).loose().optional()
+  }).loose()
+}).loose().transform((raw) => ({
+  identityAssertion: raw.identity.assertion,
+  assertionExpires: raw.identity.expires_at ?? null,
+  refreshToken: raw.identity.refresh_token?.value ?? null
+}));
+var agentZeroSessionSchema = z.object({
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresIn: z.number(),
+  user: z.object({ id: z.string() }).loose(),
+  walletAddress: z.string().optional()
+}).loose();
 var refreshResponseSchema = z.object({
   accessToken: z.string(),
   refreshToken: z.string()
@@ -2142,6 +2243,268 @@ var request = async (client, opts, schema) => {
   });
 };
 
+// src/namespaces/auth-agent.ts
+var JWT_BEARER_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+var trimSlash = (value) => value.replace(/\/$/, "");
+var wrapNetworkError = (url, err) => {
+  const cause = err?.cause;
+  const causeMessage = cause instanceof Error ? cause.code ?? cause.message : err instanceof Error ? err.message : String(err);
+  return new ZeroAgentAuthError(`Could not reach ${url} (${causeMessage})`, {
+    status: 0,
+    cause: err
+  });
+};
+var AuthAgent = class {
+  constructor(client) {
+    this.client = client;
+  }
+  endpointsPromise = null;
+  // Fully autonomous signup: register anonymously at the AuthKit domain,
+  // exchange the identity assertion for a WorkOS access token, exchange that
+  // for a Zero session. The claim token and identity assertion are returned
+  // exactly once — the caller persists them.
+  signup = async () => {
+    const registration = await this.register();
+    const token = await this.exchangeAssertion(registration.identityAssertion);
+    const session = await this.exchangeAtZero(token.accessToken);
+    return { registration, session };
+  };
+  register = async () => {
+    const endpoints = await this.endpoints();
+    return this.postJson(
+      endpoints.identityEndpoint,
+      { type: "anonymous" },
+      identityEnvelopeSchema
+    );
+  };
+  exchangeAssertion = async (identityAssertion) => {
+    const endpoints = await this.endpoints();
+    return this.postForm(
+      endpoints.tokenEndpoint,
+      { grant_type: JWT_BEARER_GRANT_TYPE, assertion: identityAssertion },
+      agentTokenResponseSchema
+    );
+  };
+  // POST /v1/auth/agent/exchange — WorkOS agent access token → Zero session
+  // pair (+ the implicitly provisioned wallet address). The post-claim token
+  // goes through here too: the server binds the claiming human.
+  exchangeAtZero = (accessToken, opts = {}) => request(
+    this.client,
+    {
+      method: "POST",
+      path: "/v1/auth/agent/exchange",
+      body: { accessToken },
+      signal: opts.signal
+    },
+    agentZeroSessionSchema
+  );
+  // Mint a claim attempt. The human opens the returned verification URI,
+  // signs in as `email`, and the page shows THEM a pairing code to read back
+  // to the agent — completeClaim() submits it.
+  startClaim = async (input) => {
+    const endpoints = await this.endpoints();
+    if (!endpoints.claimEndpoint) {
+      throw new ZeroAgentAuthError(
+        "The authorization server advertises no claim endpoint.",
+        { status: 0 }
+      );
+    }
+    return this.postJson(
+      endpoints.claimEndpoint,
+      {
+        type: "service_auth",
+        claim_token: input.claimToken,
+        login_hint: input.email
+      },
+      startClaimResponseSchema
+    );
+  };
+  // Submit the pairing code the human read off the hosted page. Terminal
+  // states map to a typed result; anything unexpected throws.
+  completeClaim = async (input) => {
+    const endpoints = await this.endpoints();
+    if (!endpoints.claimEndpoint) {
+      throw new ZeroAgentAuthError(
+        "The authorization server advertises no claim endpoint.",
+        { status: 0 }
+      );
+    }
+    try {
+      const identity = await this.postJson(
+        `${endpoints.claimEndpoint}/complete`,
+        { claim_token: input.claimToken, user_code: input.userCode },
+        completeClaimResponseSchema
+      );
+      return { status: "ok", ...identity };
+    } catch (err) {
+      if (err instanceof ZeroAgentAuthError && err.serverCode) {
+        if (err.serverCode === "claim_not_confirmed") {
+          return { status: "not_confirmed" };
+        }
+        if (err.serverCode === "invalid_user_code") {
+          return { status: "invalid_code" };
+        }
+        if ([
+          "user_code_expired",
+          "claim_expired",
+          "claim_revoked",
+          "already_claimed",
+          "claim_denied"
+        ].includes(err.serverCode)) {
+          return { status: "expired", code: err.serverCode };
+        }
+      }
+      throw err;
+    }
+  };
+  // Resolve (and cache) the agent-auth endpoints via discovery.
+  endpoints = () => {
+    if (!this.endpointsPromise) {
+      this.endpointsPromise = this.discover().catch((err) => {
+        this.endpointsPromise = null;
+        throw err;
+      });
+    }
+    return this.endpointsPromise;
+  };
+  discover = async () => {
+    const resource = await this.getJson(
+      `${trimSlash(this.client.baseUrl)}/.well-known/oauth-protected-resource`
+    );
+    let lastError = null;
+    for (const server of resource.authorization_servers ?? []) {
+      try {
+        const raw = await this.getJson(
+          `${trimSlash(server)}/.well-known/oauth-authorization-server`
+        );
+        const metadata = agentAuthMetadataSchema.parse(raw);
+        return {
+          authorizationServer: trimSlash(server),
+          identityEndpoint: metadata.agent_auth.identity_endpoint,
+          claimEndpoint: metadata.agent_auth.claim_endpoint ?? null,
+          tokenEndpoint: metadata.token_endpoint ?? `${trimSlash(server)}/oauth2/token`
+        };
+      } catch (err) {
+        lastError = err;
+      }
+    }
+    throw new ZeroAgentAuthError(
+      "No authorization server with an agent_auth block found \u2014 agent registration is not enabled for this service.",
+      { status: 0, cause: lastError }
+    );
+  };
+  getJson = async (url) => {
+    const response = await this.client.fetchImpl(url).catch((err) => {
+      throw wrapNetworkError(url, err);
+    });
+    if (!response.ok) {
+      throw new ZeroAgentAuthError(`GET ${url} failed (${response.status})`, {
+        status: response.status
+      });
+    }
+    return await response.json();
+  };
+  postJson = (url, body, schema) => this.post(url, "application/json", JSON.stringify(body), schema);
+  postForm = (url, fields, schema) => this.post(
+    url,
+    "application/x-www-form-urlencoded",
+    new URLSearchParams(fields).toString(),
+    schema
+  );
+  post = async (url, contentType, body, schema) => {
+    const response = await this.client.fetchImpl(url, {
+      method: "POST",
+      headers: { "content-type": contentType },
+      body
+    }).catch((err) => {
+      throw wrapNetworkError(url, err);
+    });
+    const text = await response.text();
+    let parsed = null;
+    try {
+      parsed = text ? JSON.parse(text) : null;
+    } catch {
+    }
+    if (!response.ok) {
+      const errBody = parsed;
+      const code = errBody?.code ?? errBody?.error;
+      throw new ZeroAgentAuthError(
+        `Agent auth request to ${url} failed (${response.status}${typeof code === "string" ? `: ${code}` : ""})`,
+        { status: response.status, body: parsed ?? text }
+      );
+    }
+    return schema.parse(parsed);
+  };
+};
+var userWalletDtoSchema = z.object({
+  walletAddress: z.string(),
+  source: z.enum(["self_custody", "privy_embedded"]),
+  isPrimary: z.boolean(),
+  linkedAt: z.union([z.string(), z.date()]).nullable().optional(),
+  importedAt: z.union([z.string(), z.date()]).nullable().optional(),
+  delegationGranted: z.boolean(),
+  signerQuorumId: z.string().nullable(),
+  // Per-transaction USDC cap in base units (6 dp). null = unlimited, 0 = free-only.
+  maxTransactionUsdcBaseUnits: z.number().int().nullable()
+});
+var welcomeBonusSummarySchema = z.object({
+  status: z.string(),
+  amountUsd: z.number()
+});
+var internalUserDtoSchema = z.object({
+  id: z.string(),
+  email: z.string().nullable(),
+  createdAt: z.union([z.string(), z.date()]).optional(),
+  lastLoginAt: z.union([z.string(), z.date()]).nullable().optional(),
+  onboardingCompleted: z.boolean().optional(),
+  delegationGranted: z.boolean().optional(),
+  wallets: z.array(userWalletDtoSchema).optional(),
+  balance: z.object({ amount: z.string(), asset: z.string() }).nullable().optional(),
+  welcomeBonus: welcomeBonusSummarySchema.nullable().optional()
+});
+var publicUserDtoSchema = z.object({
+  user: z.object({
+    id: z.string(),
+    email: z.string().nullable()
+  }),
+  walletAddress: z.string().nullable(),
+  balance: z.object({ amount: z.string(), asset: z.string() }).nullable(),
+  welcomeBonus: welcomeBonusSummarySchema.nullable()
+});
+var signResponseSchema = z.object({
+  signature: z.string().regex(/^0x[0-9a-fA-F]+$/, "must be 0x-prefixed hex"),
+  walletAddress: z.string().regex(/^0x[0-9a-fA-F]{40}$/, "must be 0x-prefixed 40-char hex address")
+});
+
+// src/schemas/device.ts
+var deviceStartResponseSchema = z.object({
+  deviceCode: z.string(),
+  userCode: z.string(),
+  verificationUri: z.string(),
+  pollInterval: z.number(),
+  expiresAt: z.number()
+});
+var devicePollResponseSchema = z.union([
+  // userCode + verificationUri are optional: older API deployments don't
+  // echo them on pending.
+  z.object({
+    error: z.literal("authorization_pending"),
+    userCode: z.string().optional(),
+    verificationUri: z.string().optional()
+  }),
+  z.object({ error: z.literal("expired_token") }),
+  z.object({
+    accessToken: z.string(),
+    refreshToken: z.string(),
+    expiresIn: z.number(),
+    user: internalUserDtoSchema
+  })
+]);
+var sessionExchangeResponseSchema = z.object({
+  token: z.string(),
+  expiresAt: z.number()
+});
+
 // src/namespaces/auth-device.ts
 var AuthDevice = class {
   constructor(client) {
@@ -2203,8 +2566,10 @@ var repackageSignFailure = (err, op) => {
 var Auth = class {
   constructor(client) {
     this.client = client;
+    this.agent = new AuthAgent(client);
     this.device = new AuthDevice(client);
   }
+  agent;
   device;
   // The internal (web-app facing) user profile. Richer than profile(): full
   // wallet list with per-wallet delegation/signer/limit metadata.
@@ -2411,8 +2776,12 @@ var createBugReportResponseSchema = z.object({
     searchId: z.number().nullable()
   })
 });
-
-// src/namespaces/bug-reports.ts
+var TEN_MIN_MS = 10 * 60 * 1e3;
+var autoIdempotencyKey = (description, contextSeed) => {
+  const bucket = Math.floor(Date.now() / TEN_MIN_MS);
+  const seed = `${description}|${contextSeed ?? ""}|${bucket}`;
+  return `auto-${createHash("sha256").update(seed).digest("hex").slice(0, 16)}`;
+};
 var BugReports = class {
   constructor(client) {
     this.client = client;
@@ -2420,16 +2789,26 @@ var BugReports = class {
   // POST /v1/bug-reports. Wallet-attributed server-side; the SDK client's
   // active credential drives attribution (account-mode → EIP-191 from the
   // wallet, session-mode → Bearer + server resolves the user's wallet).
-  create = (input, opts = {}) => request(
-    this.client,
-    {
-      method: "POST",
-      path: "/v1/bug-reports",
-      body: input,
-      signal: opts.signal
-    },
-    createBugReportResponseSchema
-  );
+  // When `idempotencyKey` is omitted, one is auto-derived from the description
+  // and (optional) contextSeed, bucketed to 10-minute windows so accidental
+  // retries within the window dedup naturally.
+  create = (input, opts = {}) => {
+    const { contextSeed, ...rest } = input;
+    const withKey = {
+      ...rest,
+      idempotencyKey: input.idempotencyKey ?? autoIdempotencyKey(input.description, contextSeed)
+    };
+    return request(
+      this.client,
+      {
+        method: "POST",
+        path: "/v1/bug-reports",
+        body: withKey,
+        signal: opts.signal
+      },
+      createBugReportResponseSchema
+    );
+  };
 };
 var ratingSchema = z.object({
   score: z.string(),
@@ -2489,6 +2868,9 @@ var capabilityResponseSchema = z.object({
     "unknown_unparsed",
     "unprobed"
   ]).optional(),
+  // ZERO-147 — provenance of displayCostAmount (settled | probe | registry |
+  // unknown). `settled` means the shown price is reconciled from real charges.
+  priceSource: z.string().nullable().optional(),
   requiresHandshake: z.boolean().optional(),
   reviewCount: z.number(),
   rating: ratingSchema,
@@ -2753,50 +3135,39 @@ var Runs = class {
     batchReviewResponseSchema
   );
 };
-var USDC_BASE2 = "0x833589fcd6edb6e08f4c7c32d4f71b54bda02913";
-var USDC_TEMPO2 = "0x20c000000000000000000000b9537d11c60e8b50";
-var TEMPO_CHAIN_ID2 = 4217;
-var baseChain = base;
-var tempoChain2 = {
-  id: TEMPO_CHAIN_ID2,
-  name: "Tempo",
-  nativeCurrency: { name: "USD", symbol: "USD", decimals: 18 },
-  rpcUrls: {
-    default: { http: ["https://rpc.tempo.xyz"] }
-  }
-};
-var ERC20_BALANCE_ABI2 = [
-  {
-    inputs: [{ name: "account", type: "address" }],
-    name: "balanceOf",
-    outputs: [{ name: "", type: "uint256" }],
-    stateMutability: "view",
-    type: "function"
-  }
-];
-var USDC_DECIMALS = 6;
-
-// src/namespaces/wallet.ts
 var fundingUrlResponseSchema = z.object({ url: z.string() });
 var userWalletListSchema = z.array(userWalletDtoSchema);
-var migrateAuthorizationResponseSchema = z.object({
-  transactionHash: z.string()
-});
 var errorMessage = (reason) => reason instanceof Error ? reason.message : String(reason);
 var Wallet = class {
   constructor(client) {
     this.client = client;
   }
   clients = {};
-  // The configured wallet address, or null if the client wasn't constructed
-  // with an account. Stable read — does not hit the network.
-  get address() {
+  // The configured account's address, or null when the client runs in
+  // session/no-credential mode. Local read — never hits the network.
+  get configuredAddress() {
     const credentials = this.client.getCredentials();
     if (credentials.kind !== "account") return null;
     return credentials.account.address;
   }
+  // The wallet address this client acts as. Account mode resolves locally
+  // (no network). Session mode resolves the user's managed (Privy-embedded)
+  // wallet, provisioning one on first call if the user has none yet. Throws
+  // on network/auth failure — callers that want a null-fallback should wrap
+  // in try/catch (the CLI does this in `resolveManagedWalletAddress`).
+  address = async (opts = {}) => {
+    const configured = this.configuredAddress;
+    if (configured) return configured;
+    const wallets = await this.list(opts);
+    const primary = wallets.find(
+      (w) => w.source === "privy_embedded" && w.isPrimary
+    );
+    if (primary) return primary.walletAddress;
+    const provisioned = await this.provision(opts);
+    return provisioned.walletAddress;
+  };
   balance = async (opts = {}) => {
-    const target = opts.address ?? this.address;
+    const target = opts.address ?? this.configuredAddress;
     if (!target) {
       throw new ZeroWalletError(
         "balance() requires either an `address` option or a client constructed with an account"
@@ -2856,21 +3227,48 @@ var Wallet = class {
     },
     userWalletDtoSchema
   );
-  // Relays a BYO-wallet-signed EIP-3009 ReceiveWithAuthorization, sweeping
-  // USDC from the BYO wallet to the user's Zero wallet on Base via the
-  // gas-paying relayer. The SDK does not author the authorization (chain
-  // nonce + EIP-712 domain coupling stays caller-side); it only forwards
-  // the signed payload. Session-only.
-  migrateAuthorization = (authorization, opts = {}) => request(
+  // Link an existing self-custody wallet to the session user by private key.
+  // Session-only. 409s when the wallet is already linked (to this or another
+  // profile — the error message says which).
+  import = (opts) => request(
     this.client,
     {
       method: "POST",
-      path: "/v1/users/me/wallets/migrate",
-      body: { authorization },
+      path: "/v1/users/me/wallets/import",
+      body: {
+        privateKey: opts.privateKey,
+        ...opts.makePrimary !== void 0 ? { makePrimary: opts.makePrimary } : {}
+      },
+      signal: opts.signal
+    },
+    userWalletDtoSchema
+  );
+  // Make one of the session user's linked wallets the primary payer.
+  // Session-only. 404s when the address isn't linked to the user.
+  setPrimary = (opts) => request(
+    this.client,
+    {
+      method: "PATCH",
+      path: "/v1/users/me/wallets/primary",
+      body: { walletAddress: opts.walletAddress },
       signal: opts.signal
     },
-    migrateAuthorizationResponseSchema
+    userWalletDtoSchema
   );
+  // Unlink a wallet from the session user. Session-only. 409s on the primary
+  // wallet or a non-zero balance (the error message says which); 404s when
+  // the address isn't linked. Responds 204 — resolves to void.
+  remove = async (opts) => {
+    await request(
+      this.client,
+      {
+        method: "DELETE",
+        path: `/v1/users/me/wallets/${opts.walletAddress}`,
+        signal: opts.signal
+      },
+      z.undefined()
+    );
+  };
   // Routes by identity: account mode signs EIP-191 against /v1/wallet/fund-url,
   // session mode hits /v1/users/me/fund-url (Bearer-authed, wallet resolved
   // server-side). Both honor `provider` (coinbase | stripe).
@@ -2906,7 +3304,7 @@ var Wallet = class {
     if (!this.clients.tempo) {
       this.clients.tempo = createPublicClient({
         // biome-ignore lint/suspicious/noExplicitAny: tempo is a custom chain object that viem's stricter Chain type rejects shape-wise but accepts at runtime
-        chain: tempoChain2,
+        chain: tempoChain,
         transport: http()
       });
     }
@@ -2922,10 +3320,10 @@ var Wallet = class {
    */
   readChainBalance = async (chain, address) => {
     const publicClient = this.getPublicClient(chain);
-    const tokenAddress = chain === "base" ? USDC_BASE2 : USDC_TEMPO2;
+    const tokenAddress = chain === "base" ? USDC_BASE : USDC_TEMPO;
     const balance = await publicClient.readContract({
       address: tokenAddress,
-      abi: ERC20_BALANCE_ABI2,
+      abi: ERC20_BALANCE_ABI,
       functionName: "balanceOf",
       args: [address]
     });
@@ -2963,6 +3361,10 @@ var searchResultSchema = z.object({
   url: z.string(),
   urlTemplate: z.string().nullable().optional(),
   cost: z.object({ amount: z.string(), asset: z.string() }),
+  // ZERO-199 — the server-resolved price. Prefer `pricing.summary` over
+  // deriving a label from `cost.amount` (which flattens usage-priced caps).
+  // Optional: absent on older API deploys.
+  pricing: z.object({ kind: z.string(), summary: z.string() }).optional(),
   // Payment protocol (x402 | mpp) for this result. The server emits it; the SDK
   // previously stripped it, leaving an agent unable to tell which handshake to
   // engage from a search row. Optional/nullable so older deploys still parse
@@ -3356,6 +3758,26 @@ var ZeroClient = class _ZeroClient {
   // path is flat on the client, same rationale as `search` above.
   // Orchestration lives in fetch.ts so this class stays readable.
   fetch = (url, opts = {}) => clientFetch(this, url, opts);
+  // Poll the API server's /health endpoint until it responds OK. Useful for
+  // warming up a cold container before spawning a subprocess that needs the
+  // API ready. Resolves when healthy, resolves (silently) when maxAttempts
+  // is exhausted — never throws, so callers proceed regardless of outcome.
+  ping = async (opts = {}) => {
+    const { maxAttempts = 20, timeoutMs = 2e3, retryDelayMs = 500 } = opts;
+    const healthUrl = `${this.baseUrl}/health`;
+    for (let i = 0; i < maxAttempts; i++) {
+      try {
+        const res = await this.fetchImpl(healthUrl, {
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+        if (res.ok) return;
+      } catch {
+      }
+      if (i < maxAttempts - 1) {
+        await new Promise((r) => setTimeout(r, retryDelayMs));
+      }
+    }
+  };
   // No-op today. Reserved for an explicit drain/cancel handle once
   // long-running consumers need one — do NOT rely on this to abort
   // in-flight requests or flush recording. Consumers needing
@@ -3364,6 +3786,6 @@ var ZeroClient = class _ZeroClient {
   };
 };
 
-export { Auth, AuthDevice, BUG_REPORT_CATEGORIES, BugReports, Capabilities, DEFAULT_BASE_URL, DEFAULT_MAX_RETRIES, DEFAULT_TIMEOUT_MS, FETCH_SKIP_REASONS, FETCH_WARNINGS, Payments, Runs, SDK_VERSION, TEMPO_CHAIN_ID, TEMPO_TESTNET_CHAIN_ID, Wallet, ZeroApiError, ZeroAuthError, ZeroClient, ZeroConfigurationError, ZeroError, ZeroPaymentError, ZeroSessionCloseFailedError, ZeroTimeoutError, ZeroValidationError, ZeroWalletError, asSchemaNode, coerceTempoChainId, createManagedAccount, extractInputEnvelope, isShortToken, normalizeTransportEnvelopeRequest, paymentHasAnchor, tempoChainLabelFromId, unwrapTransportEnvelope };
-//# sourceMappingURL=chunk-T6JT5NV5.js.map
-//# sourceMappingURL=chunk-T6JT5NV5.js.map
+export { Auth, AuthAgent, AuthDevice, BUG_REPORT_CATEGORIES, BugReports, Capabilities, DEFAULT_BASE_URL, DEFAULT_MAX_RETRIES, DEFAULT_TIMEOUT_MS, FETCH_SKIP_REASONS, FETCH_WARNINGS, Payments, Runs, SDK_VERSION, TEMPO_CHAIN_ID2 as TEMPO_CHAIN_ID, TEMPO_TESTNET_CHAIN_ID, USDC_BASE, USDC_DECIMALS, USDC_TEMPO, Wallet, ZeroAgentAuthError, ZeroApiError, ZeroAuthError, ZeroClient, ZeroConfigurationError, ZeroError, ZeroPaymentError, ZeroSessionCloseFailedError, ZeroTimeoutError, ZeroValidationError, ZeroWalletError, asSchemaNode, coerceTempoChainId, createManagedAccount, extractInputEnvelope, isShortToken, normalizeTransportEnvelopeRequest, paymentHasAnchor, tempoChainLabelFromId, unwrapTransportEnvelope };
+//# sourceMappingURL=chunk-T77VVLOM.js.map
+//# sourceMappingURL=chunk-T77VVLOM.js.map