@actionway/cli 0.18.3 → 0.18.5

package/README.md

@@ -33,6 +33,7 @@ actionway init
 - **命令面 = 明码写出的注册表**（无 profile flag、无运行期分叉）：
   - `tools search / inspect / call` 是长尾 capability 的规范发现与执行面；
   - 高频 typed command 继续提供参数与文件 UX，但投影到同一个 Tool Call；
+  - `account invitation` 获取或首次创建当前账户的永久邀请码、链接和服务端本地化分享文案；
   - `account usage / wallet / transactions` 只读 Actionway Business 数据；
   - 本壳另有 `init` / `doctor` / `update` / `login` / `logout` / `whoami`，cli-core
   继续提供 wait/poll 与已冻结的共享 typed commands。
@@ -63,6 +64,7 @@ pnpm cli logout          # 删除本机凭据；重复执行也是成功的幂
 pnpm cli update --check  # 查新版（24h 缓存）
 pnpm cli -- tools search "generate a product image"
 pnpm cli -- tools inspect media.image.generate
+pnpm cli -- account invitation --locale zh-cn
 pnpm cli -- account usage
 pnpm cli -- account usage --from 2026-08-01 --to 2026-09-01 --service generate-image
 pnpm cli -- account transactions --from 2026-08-01 --kind top_up

package/assets/skill/actionway/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: actionway
-description: Use the local Actionway CLI to discover, inspect, price, and call Actionway capabilities; continue asynchronous jobs or confirmed calls; read Actionway account usage, wallet, and transactions; authenticate; or update the CLI. Trigger when a local Agent can complete a task through `actionway`, when a `job_ref` or `call_ref` must be continued, or when the user asks about Actionway tools or account data.
+description: Use the local Actionway CLI to discover, inspect, price, and call Actionway capabilities; continue asynchronous jobs or confirmed calls; get the signed-in user's Actionway invitation, account usage, wallet, and transactions; authenticate; or update the CLI. Trigger when a local Agent can complete a task through `actionway`, when a `job_ref` or `call_ref` must be continued, or when the user asks about Actionway tools or account data.
 metadata:
   version: "0.0.0-dev"
 ---
@@ -23,7 +23,8 @@ Use the installed `actionway` CLI and its server-backed Capability Registry as t
 - If Search returns `clarification_required`, ask its bounded question. If it returns candidates, choose only a supported `tool_ref` and run `actionway tools inspect <tool_ref>` before the generic call. Inspect is the authority for the current input Schema, variants, effects, guidance, and Actionway USD price.
 - `actionway search` is the Web Search business capability. Capability discovery is always `actionway tools search`.
 - Use a high-frequency typed command only when `actionway --help` exposes an exact fit. Read `actionway <command> --help` and, when available, `--print-schema`; typed commands are parameter/file conveniences over the same Tool Call, confirmation, billing, and Job path.
-- For account questions, use only the requested read command: `actionway account usage`, `actionway account wallet`, or `actionway account transactions`.
+- When the signed-in user asks to generate, show, copy, or share their invitation, run `actionway account invitation --locale <zh-cn|zh-tw|en|ja>` using the conversation language. Return the server-provided `code`, `url`, and `message`; do not invent reward amounts or rewrite promotion terms. The first request creates one permanent code and later requests return that same code.
+- For other account questions, use only the requested read command: `actionway account usage`, `actionway account wallet`, or `actionway account transactions`.
 
 ## Inspect and call
 

package/dist/index.js

@@ -12434,7 +12434,7 @@ var REFRESH_SKEW_S = 30;
 var TOKEN_TIMEOUT_MS = 2e4;
 var DISCOVERY_TIMEOUT_MS = 1e4;
 var SESSION_TIMEOUT_MS = 2e4;
-var DEFAULT_LOGIN_TIMEOUT_MS = 12e4;
+var DEFAULT_LOGIN_TIMEOUT_MS = 12e5;
 function stripSlash(url) {
   return url.replace(/\/+$/, "");
 }
@@ -12521,7 +12521,15 @@ async function fetchCliOAuthConfig(gateway, fetchImpl = fetch) {
     signal: AbortSignal.timeout(DISCOVERY_TIMEOUT_MS)
   });
   if (!response.ok) {
-    throw new Error(`Actionway login configuration is unavailable (${response.status})`);
+    let detail = "";
+    try {
+      const body2 = await response.json();
+      const code = typeof body2?.error?.code === "string" ? body2.error.code : "";
+      const message = typeof body2?.error?.message === "string" ? body2.error.message : "";
+      detail = [code, message].filter(Boolean).join(": ");
+    } catch {
+    }
+    throw new Error(`Actionway login configuration is unavailable (${response.status}${detail ? `; ${detail}` : ""})`);
   }
   const body = await response.json();
   if (typeof body !== "object" || body === null || !("issuer" in body) || typeof body.issuer !== "string" || !("client_id" in body) || typeof body.client_id !== "string" || !body.issuer.trim() || !body.client_id.trim()) {
@@ -12694,14 +12702,21 @@ async function waitForCode(state, timeoutMs) {
   const port = server.address().port;
   const timer = setTimeout(() => {
     rejectCode(
-      new CliError("E_BACKEND", `login timed out after ${Math.round(timeoutMs / 1e3)} seconds`, "run `actionway login` again")
+      new CliError(
+        "E_BACKEND",
+        `login timed out after ${Math.round(timeoutMs / 1e3)} seconds`,
+        "run `actionway login` again and ask the user to finish the browser sign-in promptly; pass --timeout-seconds <n> to allow more time"
+      )
     );
     server.close();
   }, timeoutMs);
   return {
     redirectUri: `http://127.0.0.1:${port}/callback`,
     code: code.finally(() => clearTimeout(timer)),
-    close: () => new Promise((resolve3) => server.listening ? server.close(() => resolve3()) : resolve3())
+    close: () => {
+      clearTimeout(timer);
+      return new Promise((resolve3) => server.listening ? server.close(() => resolve3()) : resolve3());
+    }
   };
 }
 async function readJsonObject(response) {
@@ -12720,8 +12735,14 @@ async function tokenRequest(issuer, body, fetchImpl) {
   });
   const value = await readJsonObject(response);
   if (!response.ok || typeof value.access_token !== "string") {
-    const message = typeof value.error_description === "string" ? value.error_description : "token request failed";
-    throw new CliError("E_BACKEND", message);
+    const code = typeof value.error === "string" ? value.error : "";
+    const description = typeof value.error_description === "string" ? value.error_description : "";
+    const message = [code, description].filter(Boolean).join(": ") || "token request failed";
+    throw new CliError(
+      "E_BACKEND",
+      message,
+      code === "invalid_client" ? "the client_id/issuer pair does not belong to one Actionway environment: clear ACTIONWAY_OAUTH_CLIENT_ID and ACTIONWAY_OAUTH_ISSUER (or drop --client-id/--issuer) and run `actionway login` again to rediscover both; if no overrides are set, the stored credentials are stale \u2014 run `actionway logout` then `actionway login`" : void 0
+    );
   }
   return {
     accessToken: value.access_token,
@@ -12796,19 +12817,44 @@ async function login(options = {}) {
   const onNotice = options.onNotice ?? ((message) => process.stderr.write(`${message}
 `));
   const gateway = resolveGatewayUrl(options.gateway, env);
+  const gatewaySource = options.gateway?.trim() ? "flag" : (env.ACTIONWAY_GATEWAY_URL ?? "").trim() ? "env" : "default";
   let clientId = options.clientId?.trim() || (env.ACTIONWAY_OAUTH_CLIENT_ID ?? "").trim();
   let issuer = options.issuer?.trim() || (env.ACTIONWAY_OAUTH_ISSUER ?? "").trim();
+  const clientIdSource = options.clientId?.trim() ? "flag" : (env.ACTIONWAY_OAUTH_CLIENT_ID ?? "").trim() ? "env" : "discovery";
+  const issuerSource = options.issuer?.trim() ? "flag" : (env.ACTIONWAY_OAUTH_ISSUER ?? "").trim() ? "env" : "discovery";
+  const authContext = () => ({
+    gateway_url: gateway,
+    gateway_source: gatewaySource,
+    ...issuer ? { issuer } : {},
+    issuer_source: issuerSource,
+    ...clientId ? { client_id: clientId } : {},
+    client_id_source: clientIdSource
+  });
+  const withAuthContext = (error) => {
+    if (error instanceof CliError) {
+      throw new CliError(error.code, error.message, error.hint, { ...error.extra ?? {}, auth_context: authContext() });
+    }
+    throw error;
+  };
+  if (!!clientId !== !!issuer) {
+    throw new CliError(
+      "E_SCHEMA",
+      "client_id and issuer overrides must be provided together",
+      "pass both --client-id and --issuer (or set both ACTIONWAY_OAUTH_CLIENT_ID and ACTIONWAY_OAUTH_ISSUER), or neither to use discovery",
+      { auth_context: authContext() }
+    );
+  }
   if (!clientId || !issuer) {
     let discovered;
     try {
       discovered = await fetchCliOAuthConfig(gateway, fetchImpl);
     } catch (error) {
       const message = error instanceof Error ? error.message : String(error);
-      throw new CliError(
+      return withAuthContext(new CliError(
         "E_BACKEND",
         `login failed: ${message}`,
-        "retry later or pass --client-id and --issuer explicitly"
-      );
+        "check auth_context.gateway_url is the intended Actionway environment (unset ACTIONWAY_GATEWAY_URL or fix --gateway if not) and run `actionway login` again; if the gateway is correct, the environment is misconfigured \u2014 report this error to the user instead of retrying (passing both --client-id and --issuer explicitly remains available as a temporary override)"
+      ));
     }
     clientId ||= discovered.clientId;
     issuer ||= discovered.issuer;
@@ -12865,6 +12911,8 @@ ${authorizeUrl}`);
     };
     saveCredentials(credentials, env);
     return { credentials, account };
+  } catch (error) {
+    return withAuthContext(error);
   } finally {
     await callback.close();
   }
@@ -12917,7 +12965,7 @@ function failFromError2(err, fallbackHint) {
   });
 }
 function registerAuthCommands(program2) {
-  program2.command("login").description("Authenticate with Actionway in the browser (Clerk OAuth with PKCE).").option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (default: discovered from the public origin)").option("--issuer <url>", "Actionway OAuth issuer (default: discovered from the public origin)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--no-browser", "print the authorize URL instead of opening a browser").action(async (opts) => {
+  program2.command("login").description("Authenticate with Actionway in the browser (Clerk OAuth with PKCE).").option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer; default: both discovered from the public origin)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id; default: both discovered from the public origin)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--no-browser", "print the authorize URL instead of opening a browser").action(async (opts) => {
     try {
       const { credentials, account } = await login({
         ...opts.gateway ? { gateway: opts.gateway } : {},
@@ -12967,6 +13015,10 @@ function failAccount(error) {
   }
   fail({ code: "E_BACKEND", message: error instanceof Error ? error.message : String(error) });
 }
+function invitationEndpoint(locale = "en") {
+  const parameters = new URLSearchParams({ locale });
+  return `v1/account/invitation?${parameters.toString()}`;
+}
 function accountEndpoint(path, options) {
   const parameters = new URLSearchParams();
   for (const [name, value] of [
@@ -12992,7 +13044,8 @@ async function read(endpoint, getTransport3) {
   }
 }
 function registerAccountCommands(program2, getTransport3) {
-  const account = program2.command("account").description("Read your Actionway USD wallet, service usage, and wallet transactions.");
+  const account = program2.command("account").description("Access your Actionway invitation, USD wallet, service usage, and wallet transactions.");
+  account.command("invitation").description("Get or create your permanent invitation code, link, and localized share message.").option("--locale <locale>", "Share-message locale: zh-cn, zh-tw, en, or ja.", "en").action((options) => read(invitationEndpoint(options.locale), getTransport3));
   account.command("usage").description("Query held, charged, released, and free capability calls.").option("--limit <count>", "Maximum records in this page (1-100).").option("--cursor <cursor>", "Opaque nextCursor returned by the previous page.").option("--from <date>", "Inclusive ISO date or timestamp (UTC for date-only values).").option("--to <date>", "Exclusive ISO date or timestamp (UTC for date-only values).").option("--status <status>", "held, settled, or expired.").option("--service <service-id>", "Exact public serviceId.").option("--pricing-kind <kind>", "priced or free.").action((options) => read(accountEndpoint("usage", options), getTransport3));
   account.command("wallet").description("Show the current available and held Actionway USD wallet balance.").action(() => read("v1/account/wallet", getTransport3));
   account.command("transactions").description("Query wallet top-ups, charges, promotions, refunds, and other fund movements.").option("--limit <count>", "Maximum records in this page (1-50).").option("--cursor <cursor>", "Opaque nextCursor returned by the previous page.").option("--from <date>", "Inclusive ISO date or timestamp (UTC for date-only values).").option("--to <date>", "Exclusive ISO date or timestamp (UTC for date-only values).").option("--status <status>", "pending, succeeded, or failed.").option("--kind <kind>", "top_up, charge, refund, dispute, or promotion kind.").action((options) => read(accountEndpoint("transactions", options), getTransport3));
@@ -13415,7 +13468,7 @@ function failFromError3(err) {
 function registerInitCommand(program2) {
   program2.command("init").description(
     "Complete browser authentication and stage the Actionway Skill for your agent to install. The CLI never writes into an agent's own configuration directory."
-  ).option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id").option("--issuer <url>", "Actionway OAuth issuer").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--install-session-id <uuid>", "onboarding install session id").option("--no-browser", "print the authorize URL instead of opening a browser").addOption(new Option("--skill-only").hideHelp()).action(async (opts) => {
+  ).option("--gateway <url>", "Actionway public origin").option("--client-id <id>", "Actionway OAuth client id (must be paired with --issuer)").option("--issuer <url>", "Actionway OAuth issuer (must be paired with --client-id)").option("--timeout-seconds <n>", "how long to wait for browser authentication").option("--install-session-id <uuid>", "onboarding install session id").option("--no-browser", "print the authorize URL instead of opening a browser").addOption(new Option("--skill-only").hideHelp()).action(async (opts) => {
     try {
       const skill = materializeSkill();
       if (opts.skillOnly) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actionway/cli",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "actionway CLI 的本地端壳：Clerk OAuth 鉴权 + cli-core 共享命令面 + init / update / skill 物化 / 版本三链路（终端用户本地 Codex / Claude Code 使用）",
   "type": "module",
   "bin": {
@@ -19,8 +19,8 @@
     "tsx": "^4.20.0",
     "typescript": "7.0.2",
     "vitest": "^3.2.7",
-    "@actionway/contracts": "0.1.0",
-    "@actionway/cli-core": "0.1.0"
+    "@actionway/cli-core": "0.1.0",
+    "@actionway/contracts": "0.1.0"
   },
   "engines": {
     "node": ">=20"