@alipay/alipay-aipay 1.5.0 → 1.5.1-beta

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alipay/alipay-aipay",
-  "version": "1.5.0",
+  "version": "1.5.1-beta",
   "description": "支付宝 AI 付 Skill 安装包 - 安装 Agent Skill，并检测/后台准备 alipay-cli；jq 可通过 --with-jq 尝试准备",
   "type": "module",
   "bin": {

package/skill/VERSION

@@ -1 +1 @@
-1.5.0
+1.5.1-beta

package/skill/references/integration/flow.md

@@ -21,11 +21,11 @@
 
 ### 标准消息执行规则
 
-对客消息遵守 `SKILL.md` 唯一目录和 stdout 规则。无托管入口时，动态值只来自本轮实际项目、脚本输出、校验结果或用户确认，并只用动作处受控命令构造；无变量传 `{}`：
+对客消息遵守 `SKILL.md` 唯一目录和 stdout 规则。展示命令禁止追加 `2>&1`、管道、`grep/sed/awk/tee` 或临时包装；托管消息禁止拆回 `jq/printf/renderer`。无托管入口时，动态值只来自本轮实际项目、脚本输出、校验结果或用户确认，并使用 renderer `--input-json`；无变量传 `{}`：
 
 ```bash
 node ../normal/scripts/render_customer_message.mjs --schema <messageId> --variant <VARIANT>
-printf '%s' "$MESSAGE_INPUT_JSON" | node ../normal/scripts/render_customer_message.mjs <messageId> --variant <VARIANT>
+node ../normal/scripts/render_customer_message.mjs <messageId> --variant <VARIANT> --input-json "$MESSAGE_INPUT_JSON"
 ```
 
 直接调用 renderer 前先查同一 `messageId + variant` schema；托管消息必须用 `integration_message_runner.mjs` 或登记脚本。失败停步，不手写兜底或猜枚举；成功时 stdout 是唯一正文。脚本终态满足后立即转移，不追加命令复核。
@@ -545,29 +545,22 @@ node ../normal/scripts/integration_message_runner.mjs safety-closeout --variant
 
 **校验完整性要求**：内部必须覆盖 `modules/checklist.md` 的密钥与安全、异步通知、适用接口覆盖、支付结果处理、按量付费专项、退款和上线前七类校验，不得只检查上方三个摘要项。通过时默认对客只输出通过结论和下一步；部分通过或未通过时只输出实际未完成项、人工待验证项和下一步。步骤 5/6 已展示的沙箱配置、联调或付款体验结论不在 checklist 结果中重复。通过项与不适用项无需逐行展开，用户要求明细时再输出完整逐项结果。精简输出不得导致任何适用校验被跳过。
 
-先在内部汇总 checklist 证据。发现本轮范围内可直接修复的代码或配置缺口时，先修复并重新执行受影响检查；在仍可继续自动修复期间不得渲染中间 checklist 结果。只有已通过、只剩人工待验证，或本轮无法继续修复时，才生成最终 `CHECKLIST_RESULT_JSON` 并渲染一次对客结论。
+先在内部汇总 checklist 证据。发现本轮范围内可直接修复的代码或配置缺口时，先修复并重新执行受影响检查；在仍可继续自动修复期间不得渲染中间 checklist 结果。只有已通过、只剩人工待验证，或本轮无法继续修复时，才生成最终对客结论参数并渲染一次。
 
-对客结论统一使用 `integration.checklist.result`，并严格按当前产品选择 `AIPAY`、`WEBPAY` 或 `APPPAY` 变体；整体结论、失败/部分通过项和人工待验证项必须来自最终一轮 checklist 实际证据。必须从本 flow 所在目录执行下列 runner；runner stdout 是唯一对客正文，必须把 stdout 原文作为当前回复正文发给用户：
-
-```bash
-printf '%s' "$CHECKLIST_RESULT_JSON" \
-  | node ../normal/scripts/integration_message_runner.mjs checklist-result --variant <AIPAY|WEBPAY|APPPAY> --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT"
-```
-
-上方 stdin 命令保持用于 Unix/macOS/Linux。Windows 不使用 shell 管道或续行符，按当前产品在 PowerShell 中执行对应单行命令；参数值仍来自同一最终 checklist 事实：
+对客结论统一使用 `integration.checklist.result`，并严格按当前产品选择 `AIPAY`、`WEBPAY` 或 `APPPAY` 变体；整体结论、失败/部分通过项和人工待验证项必须来自最终一轮 checklist 实际证据。必须从本 flow 所在目录执行当前产品对应单行 runner；runner stdout 是唯一对客正文，必须把 stdout 原文作为当前回复正文发给用户：
 
 <!-- ALIPAY_AIPAY_PRODUCT:aipay:START -->
-```powershell
+```bash
 node ../normal/scripts/integration_message_runner.mjs checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:webpay:START -->
-```powershell
+```bash
 node ../normal/scripts/integration_message_runner.mjs checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:apppay:START -->
-```powershell
+```bash
 node ../normal/scripts/integration_message_runner.mjs checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->

package/skill/references/integration/modules/checklist.md

@@ -132,14 +132,9 @@
 
 Unix/macOS/Linux 的 `sandboxConfigState` 必须复用 integration flow 的固定脚本终态。Windows 必须复用步骤 1/3 记录的 `READY|VERIFY_PENDING`。待配置时不在本步骤重跑创建或复核，不读取当前配置，把配置后置校验、摘要和适用沙箱测试列入未完成；若代码实现与其他安全检查均通过，整体结果为“部分通过”，否则按其他缺口判为“未通过”。
 
-```bash
-printf '%s' "$CHECKLIST_RESULT_JSON" \
-  | node ../../normal/scripts/integration_message_runner.mjs checklist-result --variant <AIPAY|WEBPAY|APPPAY> --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT"
-```
+按当前产品执行对应单行 runner，禁止管道、临时 JSON 包装或二次渲染：
 
-上方 stdin 命令保持用于 Unix/macOS/Linux。Windows 不使用管道或续行符，按当前产品执行对应 PowerShell 单行命令：
-
-```powershell
+```bash
 node ../../normal/scripts/integration_message_runner.mjs checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 node ../../normal/scripts/integration_message_runner.mjs checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 node ../../normal/scripts/integration_message_runner.mjs checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"

package/skill/references/integration/modules/code-examples/php/4-/346/214/211/351/207/217/344/273/230/350/264/271/A2MPaymentDemo.php

@@ -14,43 +14,164 @@
  * 4. 返回资源内容
  * 
  * 依赖安装：
- * composer require alipay/alipay-sdk
+ * composer require alipaysdk/openapi
  */
 
-// ==================== 配置信息（实际使用时请从配置中心读取）====================
-define('ALIPAY_CONFIG', [
-    'appId' => '<APP_ID>',
-    'privateKey' => '<APP_PRIVATE_KEY>', // 请填写您的应用私钥（PKCS#1 格式）
-    'alipayPublicKey' => '<ALIPAY_PUBLIC_KEY>', // 请填写您的支付宝公钥
-    // 默认用于本 Skill 的快速沙箱联调；生产部署时设置 ALIPAY_GATEWAY=https://openapi.alipay.com/gateway.do
-    'gateway' => getenv('ALIPAY_GATEWAY') ?: 'https://openapi-sandbox.dl.alipaydev.com/gateway.do',
-    'sellerId' => '<SELLER_ID_2088>', // 商户 ID（2088 格式）
-    'serviceId' => 'api_mock_service_id', // 仅用于沙箱联调；上线前替换为服务市场真实 serviceId
-    'merchantPrivateKey' => '<APP_PRIVATE_KEY>' // 请填写您的应用私钥（用于商家签名）
-]);
-
 define('RESOURCE_CONFIG', [
     'path' => '/demo/a2m/resource',
     'goodsName' => 'AI 生成内容服务'
 ]);
 
+// ==================== 配置信息（实际使用时请从配置中心读取）====================
+
+/**
+ * 返回第一个非空配置值。
+ */
+function firstNonBlank(...$values) {
+    foreach ($values as $value) {
+        if ($value !== false && $value !== null && $value !== '') {
+            return (string)$value;
+        }
+    }
+    return '';
+}
+
+/**
+ * 读取 Skill 快速沙箱配置。示例支持放在项目根目录或 src/ 等子目录下运行。
+ */
+function loadSandboxConfig() {
+    $candidatePaths = [
+        getcwd() . '/.alipay-sandbox.json',
+        __DIR__ . '/.alipay-sandbox.json',
+        dirname(__DIR__) . '/.alipay-sandbox.json',
+    ];
+
+    $visited = [];
+    foreach ($candidatePaths as $path) {
+        if (isset($visited[$path])) {
+            continue;
+        }
+        $visited[$path] = true;
+
+        if (!is_file($path)) {
+            continue;
+        }
+
+        $config = json_decode((string)file_get_contents($path), true);
+        if (is_array($config)) {
+            return $config;
+        }
+    }
+
+    return [];
+}
+
+/**
+ * 加载支付宝配置。
+ *
+ * Unix/macOS/Linux 快速沙箱生成的真实商家 PID 位于 .alipay-sandbox.json 的 appIds[0].pid。
+ * 生产环境请通过环境变量或配置中心显式设置同一生产应用的 appId、应用私钥、支付宝公钥、
+ * 商户 PID 和服务市场真实 serviceId。
+ */
+function loadAlipayConfig() {
+    $sandbox = loadSandboxConfig();
+    $sandboxApp = [];
+    if (isset($sandbox['appIds']) && is_array($sandbox['appIds']) && isset($sandbox['appIds'][0]) && is_array($sandbox['appIds'][0])) {
+        $sandboxApp = $sandbox['appIds'][0];
+    }
+
+    $privateKey = firstNonBlank(
+        getenv('ALIPAY_AIPAY_PRIVATE_KEY'),
+        $sandboxApp['appPrivatePkcsKey'] ?? null,
+        $sandbox['appPrivatePkcsKey'] ?? null,
+        '<APP_PRIVATE_KEY>'
+    );
+
+    return [
+        'appId' => firstNonBlank(
+            getenv('ALIPAY_AIPAY_APP_ID'),
+            $sandboxApp['appId'] ?? null,
+            $sandbox['appId'] ?? null,
+            '<APP_ID>'
+        ),
+        'privateKey' => $privateKey, // PHP 使用 PKCS#1 格式应用私钥
+        'alipayPublicKey' => firstNonBlank(
+            getenv('ALIPAY_AIPAY_PUBLIC_KEY'),
+            $sandboxApp['alipayPublicKey'] ?? null,
+            $sandbox['alipayPublicKey'] ?? null,
+            '<ALIPAY_PUBLIC_KEY>'
+        ),
+        // 默认用于本 Skill 的快速沙箱联调；生产部署时设置 ALIPAY_AIPAY_GATEWAY=https://openapi.alipay.com/gateway.do
+        'gateway' => firstNonBlank(
+            getenv('ALIPAY_AIPAY_GATEWAY'),
+            getenv('ALIPAY_GATEWAY'),
+            $sandbox['gateway'] ?? null,
+            'https://openapi-sandbox.dl.alipaydev.com/gateway.do'
+        ),
+        'sellerId' => firstNonBlank(
+            getenv('ALIPAY_AIPAY_SELLER_ID'),
+            $sandboxApp['pid'] ?? null,
+            $sandboxApp['uid'] ?? null,
+            $sandbox['sellerId'] ?? null,
+            '<SELLER_ID_2088>'
+        ), // 商户 PID（2088 格式）
+        'sellerName' => firstNonBlank(getenv('ALIPAY_AIPAY_SELLER_NAME'), '测试商户'),
+        'serviceId' => firstNonBlank(getenv('ALIPAY_AIPAY_SERVICE_ID'), 'api_mock_service_id'), // 仅用于沙箱联调；上线前替换为服务市场真实 serviceId
+        'merchantPrivateKey' => $privateKey // 用于商家账单签名
+    ];
+}
+
+define('ALIPAY_CONFIG', loadAlipayConfig());
+
 /**
  * 初始化 SDK
  */
 function initAlipayClient() {
-    require_once 'aop/AopClient.php';
-    require_once 'aop/AlipayConfig.php';
-    
-    $config = new AlipayConfig();
-    $config->setServerUrl(ALIPAY_CONFIG['gateway']);
-    $config->setAppId(ALIPAY_CONFIG['appId']);
-    $config->setPrivateKey(ALIPAY_CONFIG['privateKey']);
-    $config->setFormat('json');
-    $config->setAlipayPublicKey(ALIPAY_CONFIG['alipayPublicKey']);
-    $config->setCharset('UTF-8');
-    $config->setSignType('RSA2');
-    
-    return new AopClient($config);
+    loadAopSdk();
+
+    if (!class_exists('\AopClient')) {
+        throw new RuntimeException('未找到支付宝 PHP SDK，请先执行：composer require alipaysdk/openapi');
+    }
+
+    $client = new \AopClient();
+    $client->gatewayUrl = ALIPAY_CONFIG['gateway'];
+    $client->appId = ALIPAY_CONFIG['appId'];
+    $client->rsaPrivateKey = ALIPAY_CONFIG['privateKey'];
+    $client->alipayrsaPublicKey = ALIPAY_CONFIG['alipayPublicKey'];
+    $client->format = 'json';
+    $client->postCharset = 'UTF-8';
+    $client->signType = 'RSA2';
+
+    return $client;
+}
+
+/**
+ * 加载官方 alipaysdk/openapi v2 AOP 客户端。
+ */
+function loadAopSdk() {
+    $candidateRoots = [
+        getcwd(),
+        __DIR__,
+        dirname(__DIR__),
+    ];
+
+    $visited = [];
+    foreach ($candidateRoots as $root) {
+        if (isset($visited[$root])) {
+            continue;
+        }
+        $visited[$root] = true;
+
+        $autoload = $root . '/vendor/autoload.php';
+        if (is_file($autoload)) {
+            require_once $autoload;
+        }
+
+        $aopClient = $root . '/vendor/alipaysdk/openapi/v2/aop/AopClient.php';
+        if (is_file($aopClient)) {
+            require_once $aopClient;
+        }
+    }
 }
 
 /**
@@ -190,7 +311,7 @@ function createPaymentRequiredResponse() {
                 'seller_unique_id' => ALIPAY_CONFIG['sellerId']
             ],
             'method' => [
-                'seller_name' => '测试商户',
+                'seller_name' => ALIPAY_CONFIG['sellerName'],
                 'seller_id' => ALIPAY_CONFIG['sellerId'],
                 'seller_app_id' => ALIPAY_CONFIG['appId'],
                 'goods_name' => $goodsName,
@@ -281,7 +402,7 @@ function verifyPaymentAndDeliverResource($paymentProof) {
         $request->setBizContent(json_encode($model, JSON_UNESCAPED_UNICODE));
         $responseResult = $alipayClient->execute($request);
         $responseApiName = str_replace('.', '_', $request->getApiMethodName()) . '_response';
-        $verifyResponse = $responseResult->$responseApiName;
+        $verifyResponse = $responseResult->$responseApiName ?? (object)[];
         
         // 3. 验证失败，返回错误
         if (empty($verifyResponse->code) || $verifyResponse->code !== '10000') {
@@ -303,7 +424,8 @@ function verifyPaymentAndDeliverResource($paymentProof) {
         error_log("支付凭证验证成功：tradeNo={$verifyTradeNo}, outTradeNo={$verifyOutTradeNo}");
         
         // 5. 校验凭证有效性（active=true 表示凭证有效）
-        if ($active !== true) {
+        $isActive = $active === true || $active === 'true' || $active === '1' || $active === 1;
+        if (!$isActive) {
             error_log("支付凭证无效或已过期：outTradeNo={$verifyOutTradeNo}");
             jsonResponse([
                 'code' => 'INVALID_PAYMENT_PROOF',
@@ -354,6 +476,7 @@ function verifyPaymentAndDeliverResource($paymentProof) {
         //     'serviceResult' => $serviceResult
         // ]);
 
+        // 优先使用 alipay.aipay.agent.payment.verify 返回的真实 trade_no；沙箱字段为空时回退到 Payment-Proof 中的 trade_no。
         $fulfillmentTradeNo = $verifyTradeNo ?: $tradeNo;
         error_log("资源已生成，准备发送履约确认：outTradeNo={$verifyOutTradeNo}, tradeNo={$fulfillmentTradeNo}");
 
@@ -436,7 +559,7 @@ function sendFulfillmentConfirm($tradeNo) {
         
         $responseResult = $alipayClient->execute($request);
         $responseApiName = str_replace('.', '_', $request->getApiMethodName()) . '_response';
-        $response = $responseResult->$responseApiName;
+        $response = $responseResult->$responseApiName ?? (object)[];
         
         if (!empty($response->code) && $response->code === '10000') {
             error_log("履约确认成功：tradeNo={$tradeNo}");
@@ -454,6 +577,183 @@ function sendFulfillmentConfirm($tradeNo) {
     }
 }
 
+// 官方 alipaysdk/openapi 当前未内置以下两个 A2M Request 类，示例在本地补齐 AOP 客户端会调用的方法。
+if (!class_exists('AlipayAipayAgentPaymentVerifyRequest')) {
+    final class AlipayAipayAgentPaymentVerifyRequest
+    {
+        private $bizContent = '';
+        private $apiParas = [];
+        private $apiVersion = '1.0';
+        private $needEncrypt = false;
+        private $terminalType = null;
+        private $terminalInfo = null;
+        private $prodCode = null;
+        private $notifyUrl = null;
+        private $returnUrl = null;
+
+        public function setBizContent($bizContent) {
+            $this->bizContent = $bizContent;
+            $this->apiParas['biz_content'] = $bizContent;
+        }
+
+        public function getBizContent() {
+            return $this->bizContent;
+        }
+
+        public function getApiMethodName() {
+            return 'alipay.aipay.agent.payment.verify';
+        }
+
+        public function getApiParas() {
+            return $this->apiParas;
+        }
+
+        public function getApiVersion() {
+            return $this->apiVersion;
+        }
+
+        public function setApiVersion($apiVersion) {
+            $this->apiVersion = $apiVersion;
+        }
+
+        public function getNeedEncrypt() {
+            return $this->needEncrypt;
+        }
+
+        public function setNeedEncrypt($needEncrypt) {
+            $this->needEncrypt = $needEncrypt;
+        }
+
+        public function getTerminalType() {
+            return $this->terminalType;
+        }
+
+        public function setTerminalType($terminalType) {
+            $this->terminalType = $terminalType;
+        }
+
+        public function getTerminalInfo() {
+            return $this->terminalInfo;
+        }
+
+        public function setTerminalInfo($terminalInfo) {
+            $this->terminalInfo = $terminalInfo;
+        }
+
+        public function getProdCode() {
+            return $this->prodCode;
+        }
+
+        public function setProdCode($prodCode) {
+            $this->prodCode = $prodCode;
+        }
+
+        public function getNotifyUrl() {
+            return $this->notifyUrl;
+        }
+
+        public function setNotifyUrl($notifyUrl) {
+            $this->notifyUrl = $notifyUrl;
+        }
+
+        public function getReturnUrl() {
+            return $this->returnUrl;
+        }
+
+        public function setReturnUrl($returnUrl) {
+            $this->returnUrl = $returnUrl;
+        }
+    }
+}
+
+if (!class_exists('AlipayAipayAgentFulfillmentConfirmRequest')) {
+    final class AlipayAipayAgentFulfillmentConfirmRequest
+    {
+        private $bizContent = '';
+        private $apiParas = [];
+        private $apiVersion = '1.0';
+        private $needEncrypt = false;
+        private $terminalType = null;
+        private $terminalInfo = null;
+        private $prodCode = null;
+        private $notifyUrl = null;
+        private $returnUrl = null;
+
+        public function setBizContent($bizContent) {
+            $this->bizContent = $bizContent;
+            $this->apiParas['biz_content'] = $bizContent;
+        }
+
+        public function getBizContent() {
+            return $this->bizContent;
+        }
+
+        public function getApiMethodName() {
+            return 'alipay.aipay.agent.fulfillment.confirm';
+        }
+
+        public function getApiParas() {
+            return $this->apiParas;
+        }
+
+        public function getApiVersion() {
+            return $this->apiVersion;
+        }
+
+        public function setApiVersion($apiVersion) {
+            $this->apiVersion = $apiVersion;
+        }
+
+        public function getNeedEncrypt() {
+            return $this->needEncrypt;
+        }
+
+        public function setNeedEncrypt($needEncrypt) {
+            $this->needEncrypt = $needEncrypt;
+        }
+
+        public function getTerminalType() {
+            return $this->terminalType;
+        }
+
+        public function setTerminalType($terminalType) {
+            $this->terminalType = $terminalType;
+        }
+
+        public function getTerminalInfo() {
+            return $this->terminalInfo;
+        }
+
+        public function setTerminalInfo($terminalInfo) {
+            $this->terminalInfo = $terminalInfo;
+        }
+
+        public function getProdCode() {
+            return $this->prodCode;
+        }
+
+        public function setProdCode($prodCode) {
+            $this->prodCode = $prodCode;
+        }
+
+        public function getNotifyUrl() {
+            return $this->notifyUrl;
+        }
+
+        public function setNotifyUrl($notifyUrl) {
+            $this->notifyUrl = $notifyUrl;
+        }
+
+        public function getReturnUrl() {
+            return $this->returnUrl;
+        }
+
+        public function setReturnUrl($returnUrl) {
+            $this->returnUrl = $returnUrl;
+        }
+    }
+}
+
 // ==================== 路由处理 ====================
 
 // 简单路由

package/skill/references/integration/modules/sandbox/a2m-sandbox-test.md

@@ -218,7 +218,7 @@ Payment-Proof 参考结构：
 
 测试结束后使用 `a2m.test.result`：只有脚本退出码和本模块要求的组合证据都成立时选择 `PASSED`；其他情况选择 `FAILED` 并传入实际证据与确定恢复动作。不得把用户付款体验、沙箱配置落盘或任意 2xx 响应替代通过证据。
 
-输出测试结论后，使用 `a2m.payment.experience/FULL` 展示付款链接和已经通过快速沙箱字段校验的实际买家账号。缺少任一账号字段时，当前沙箱配置必须已经在前置校验进入待配置状态，不得执行本联调或输出付款体验，也不得编造缺失凭据。随后使用 `sandbox.android.client` 统一输出 Android-only 官方下载与失败兜底。两条消息都不增加阻塞点，也不反向改变服务端联调结论。
+输出测试结论后，使用 `a2m.payment.experience/FULL` 展示付款链接和已经通过快速沙箱字段校验的实际买家账号。缺少任一账号字段时，当前沙箱配置必须已经在前置校验进入待配置状态，不得执行本联调或输出付款体验，也不得编造缺失凭据。随后执行 `node ../../../normal/scripts/integration_message_runner.mjs sandbox-android-client` 统一输出 Android-only 官方下载与失败兜底。两条消息都不增加阻塞点，也不反向改变服务端联调结论。
 
 最后必须提醒用户：
 

package/skill/references/integration/modules/sandbox/sandbox-setup-guide.md

@@ -174,7 +174,7 @@ renderer 固定输出唯一摘要表、密钥字段已落盘提示和“配置
 
 `curl` 调用下单接口并取得 HTML 支付表单只属于接口冒烟检查，不能替代用户付款指引，也不能据此标记步骤 6 完成。必须提供用户可在浏览器中打开的支付页面地址；页面打开沙箱收银台后，以下两种体验方式同时告知用户，由用户自行二选一。
 
-紧接当前系统对应的网站支付付款指引渲染 `sandbox.android.client`，统一输出 Android-only、官方直链、直链/页面二维码失败后的开放平台沙箱工具页，以及禁止 iOS、应用市场、第三方站点和自编 URL 的口径。
+紧接当前系统对应的网站支付付款指引执行 `node ../../../normal/scripts/integration_message_runner.mjs sandbox-android-client`，统一输出 Android-only、官方直链、直链/页面二维码失败后的开放平台沙箱工具页，以及禁止 iOS、应用市场、第三方站点和自编 URL 的口径。
 
 `resultPageInstruction` 必须按实际回跳分支二选一，禁止同时输出两项：
 

package/skill/references/normal/rejection-guide.md

@@ -10,8 +10,7 @@
 当用户提及以下不支持的产品时，使用 `json/customer-messages.json` 的 `product.unsupported`，传入用户实际产品名。必须执行：
 
 ```bash
-MESSAGE_INPUT_JSON=$(jq -cn --arg productName "$PRODUCT_NAME" '{productName:$productName}')
-printf '%s' "$MESSAGE_INPUT_JSON" | node scripts/render_customer_message.mjs product.unsupported --variant DEFAULT
+node scripts/integration_message_runner.mjs product-unsupported --product-name "$PRODUCT_NAME"
 ```
 
 支持范围、开放平台文档、传统支付集成 Skill 和商家平台链接只在消息目录维护；本文件不复制标准正文。

package/skill/references/normal/scripts/integration_message_runner.mjs

@@ -856,6 +856,12 @@ function runProductClarify() {
   return renderMessage('product.clarify', 'DEFAULT', {});
 }
 
+function runProductUnsupported(args) {
+  return renderMessage('product.unsupported', 'DEFAULT', {
+    productName: required(args, 'product-name')
+  });
+}
+
 function runWindowsSandboxSetup() {
   return renderMessage('sandbox.windows.manual_setup', 'DEFAULT', {});
 }
@@ -868,6 +874,10 @@ function runA2mTestStart() {
   return renderMessage('a2m.test.start', 'DEFAULT', {});
 }
 
+function runSandboxAndroidClient() {
+  return renderMessage('sandbox.android.client', 'DEFAULT', {});
+}
+
 function runServiceNotReady(args) {
   return renderMessage('integration.service.not_ready', 'DEFAULT', {
     recoveryAction: required(args, 'recovery-action')
@@ -984,6 +994,10 @@ async function main() {
     console.log(runProductClarify());
     return;
   }
+  if (command === 'product-unsupported') {
+    console.log(runProductUnsupported(args));
+    return;
+  }
   if (command === 'windows-sandbox-setup') {
     console.log(runWindowsSandboxSetup());
     return;
@@ -996,6 +1010,10 @@ async function main() {
     console.log(runA2mTestStart());
     return;
   }
+  if (command === 'sandbox-android-client') {
+    console.log(runSandboxAndroidClient());
+    return;
+  }
   if (command === 'service-not-ready') {
     console.log(runServiceNotReady(args));
     return;
@@ -1012,7 +1030,7 @@ async function main() {
     console.log(await runChecklistResult(args));
     return;
   }
-  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|start-confirm|checklist-scope-receipt|a2m-execution-guard|a2m-execution-result|context-required|product-clarify|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
+  throw new Error('用法: integration_message_runner.mjs <resolve-project|locate-projects|start-confirm|checklist-scope-receipt|a2m-execution-guard|a2m-execution-result|context-required|product-clarify|product-unsupported|windows-sandbox-setup|local-acceptance-notice|a2m-test-start|sandbox-android-client|service-not-ready|safety-closeout|windows-sandbox-summary|checklist-result> ...');
 }
 
 if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {