@itpay/cli 2.1.0 → 2.1.2

package/dist/src/client/backend.js

@@ -11,6 +11,12 @@ export class BackendClient {
             throw new Error("Invalid Sell route");
         return this.http.request(request.path, { method: request.method, ...(request.body !== undefined ? { body: request.body } : {}) });
     }
+    agentAccountStatus() {
+        return this.http.get('/v1/agent-device-account-bindings');
+    }
+    bindAgentAccount(input) {
+        return this.http.post('/v1/agent-device-account-bindings', input);
+    }
     readyz() {
         return this.http.get("/v1/readyz");
     }

package/dist/src/commands/readyz.js

@@ -8,7 +8,7 @@ export async function runReadyz(backend, options = {}) {
         status: response.status,
         result: { backend: "available", backend_url: backendURL, environment, ...(options.agentType ? { agent_type: options.agentType } : {}) },
         instruction: environment === "development"
-            ? "ItPay sandbox 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 sandbox Backend。"
+            ? `ItPay 开发环境 ${backendURL} 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 Backend。`
             : "ItPay 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；不要默认开始购买。",
         next: { command: "itpay skill show itpay --json", reason: "加载完整操作与安全规则" },
         recovery: [],

package/dist/src/commands/services.js

@@ -656,6 +656,25 @@ function servicesNextEnvelope(model) {
         const id = execution.service_execution_id;
         const paymentVerified = model.payment_bindings.some((binding) => binding.status === "payment_verified") || model.checkout_bindings.some((binding) => binding.status === "payment_verified");
         const state = model.workflow?.status === "payment" && paymentVerified ? "running" : model.workflow?.status ?? "input_required";
+        if (state === "failed" && ["login_required", "rate_limited"].includes(model.workflow?.error_code ?? "")) {
+            const login = model.workflow?.error_code === "login_required";
+            return {
+                status: login ? "login_required" : "rate_limited",
+                result: { service_execution_id: id, service_id: execution.service_id },
+                instruction: login ? "匿名免费额度已用完。使用官方网页登录并绑定当前 Agent，完成后重新发起查询；不需要付款。" : "已达到登录账号每分钟查询上限。请等到下一分钟再发起查询，不要连续重试。",
+                next: login ? { command: "itpay auth login --json", reason: "登录继续免费查询" } : null,
+                recovery: [],
+            };
+        }
+        if (state === "human_action" && model.workflow?.human_action) {
+            return {
+                status: "confirmation_required",
+                result: { service_execution_id: id, service_id: execution.service_id, human_action: model.workflow.human_action },
+                instruction: "请展示待确认的位置，请用户明确确认后，按 input_schema 填写 --input 字段。继续同一执行，不重新查询；这一步不是购买确认。",
+                next: { command: `itpay services action ${id} --action ${model.workflow.human_action.action_type} --actor-type human --status approved --input <key=value> --json`, reason: "用户确认后继续当前查询" },
+                recovery: [],
+            };
+        }
         const recovery = state === "recovery_required" || state === "failed";
         let command = `itpay services next ${id} --json`;
         if (state === "payment")
@@ -701,7 +720,7 @@ function servicesNextEnvelope(model) {
             recovery: [],
         };
     }
-    if (isTerminalServiceExecutionStatus(execution.status) && !(model.workflow_entry && currentDelivery && ["completed", "delivery_completed"].includes(execution.status))) {
+    if (isTerminalServiceExecutionStatus(execution.status) && !(model.workflow_entry && (currentDelivery || serviceDeliveryMode(model) === "agent_visible_result") && ["completed", "delivery_completed"].includes(execution.status))) {
         const paid = model.checkout_bindings.some((binding) => binding.status === "payment_verified") || Boolean(currentDelivery?.order_id);
         const paidFailure = execution.status === "failed" && paid;
         return {
@@ -905,6 +924,9 @@ function serviceAllowedActionCommand(model, action) {
 }
 function serviceDeliveryMode(model) {
     const delivery = model.current_delivery ?? model.delivery_bindings.at(-1);
+    const entry = model.capabilities.find(capability => capability.capability_id === model.workflow_entry?.capability_id);
+    if (!delivery && model.workflow?.status === "completed" && entry?.requires_payment === false && !entry.vault_required)
+        return "agent_visible_result";
     const explicit = String(delivery?.redacted_summary?.delivery_mode ?? "");
     if (explicit)
         return explicit;

package/dist/src/main.js

@@ -1,3 +1,4 @@
+import { agentAuth } from "./state/account_auth.js";
 import { registerSell } from "./sell/commands.js";
 import { readFileSync as readWorkflowInputFile } from "node:fs";
 import { runServicesRun } from "./commands/services.js";
@@ -291,6 +292,19 @@ program
         });
     }
 });
+const authCmd = program.command("auth").description("Log in and bind this enrolled Agent to your ItPay account");
+for (const action of ["login", "status"]) {
+    authCmd.command(action).option("--json", "output JSON").action(async (options) => {
+        const config = loadConfig();
+        try {
+            const result = await agentAuth(action, config.baseURL, newBackendClient(config));
+            process.stdout.write(JSON.stringify(result) + "\n");
+        }
+        catch (error) {
+            reportCLIError(error, { jsonOutput: Boolean(options.json), code: "account_login_failed", instruction: "完成官方网页登录后重试 itpay auth status；不要清除设备登记。" });
+        }
+    });
+}
 // --- device ---------------------------------------------------------------
 const deviceCmd = program.command("device").description("Recover the current official Backend registration after an operator-confirmed reset");
 deviceCmd

package/dist/src/sell/commands.js

@@ -1,4 +1,4 @@
-import { sellerAuth } from "./auth.js";
+import { sellerAuth } from "../state/account_auth.js";
 import { registerSync } from "./sync.js";
 import { preview } from "./preview.js";
 import { serveSellMCP } from "./mcp.js";

package/dist/src/{sell/auth.js → state/account_auth.js}

@@ -2,11 +2,11 @@ import { createHash } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, resolve } from 'node:path';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, rmSync } from 'node:fs';
-export function sellerAuthPath(baseURL, env = process.env) {
-    return resolve(env.HOME || homedir(), '.itpay-v3', `seller-${createHash('sha256').update(baseURL).digest('hex').slice(0, 16)}.json`);
+export function sellerAuthPath(baseURL, env = process.env, purpose = "seller") {
+    return resolve(env.HOME || homedir(), '.itpay-v3', `${purpose}-${createHash('sha256').update(baseURL).digest('hex').slice(0, 16)}.json`);
 }
-function read(baseURL, env = process.env) {
-    const path = sellerAuthPath(baseURL, env);
+function read(baseURL, env = process.env, purpose = "seller") {
+    const path = sellerAuthPath(baseURL, env, purpose);
     if (!existsSync(path))
         return;
     const state = JSON.parse(readFileSync(path, 'utf8'));
@@ -14,8 +14,8 @@ function read(baseURL, env = process.env) {
         throw new Error('Seller session backend mismatch');
     return state;
 }
-function save(state, env = process.env) {
-    const path = sellerAuthPath(state.baseURL, env);
+function save(state, env = process.env, purpose = "seller") {
+    const path = sellerAuthPath(state.baseURL, env, purpose);
     mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
     const tmp = `${path}.${process.pid}.tmp`;
     writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
@@ -25,26 +25,45 @@ export function sellerSessionToken(baseURL, env = process.env) {
     const state = read(baseURL, env);
     return state?.expiresAt && Date.parse(state.expiresAt) > Date.now() ? state.sessionToken : undefined;
 }
-export async function sellerAuth(action, baseURL, env = process.env, fetcher = fetch) {
+export function sellerAuth(action, baseURL, env = process.env, fetcher = fetch) {
+    return accountAuth(action, baseURL, env, fetcher);
+}
+export function agentAuth(action, baseURL, backend, env = process.env, fetcher = fetch) {
+    return accountAuth(action, baseURL, env, fetcher, backend);
+}
+async function accountAuth(action, baseURL, env, fetcher, backend) {
+    const purpose = backend ? 'agent-login' : 'seller';
+    const command = backend ? 'itpay auth status' : 'itpay sell auth status';
+    if (backend) {
+        const current = await backend.agentAccountStatus();
+        if (current.status === 'authenticated')
+            return current;
+    }
     async function request(path, init = {}) {
         const response = await fetcher(baseURL + path, { ...init, redirect: 'error', signal: AbortSignal.timeout(15000) });
         if (!response.ok)
-            throw new Error(`Seller authorization failed (${response.status}); retry login if expired`);
+            throw new Error(`ItPay authorization failed (${response.status}); retry login if expired`);
         return response;
     }
     if (action === 'login') {
-        const response = await request('/v1/dashboard/auth-sessions', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ provider: 'alipay', return_to: '/seller' }) });
+        const response = await request('/v1/dashboard/auth-sessions', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ provider: 'alipay', return_to: backend ? '/' : '/seller' }) });
         const result = await response.json();
         const url = new URL(result.start_url, baseURL);
-        if (url.origin !== new URL(baseURL).origin)
+        const sameOrigin = url.origin === new URL(baseURL).origin;
+        const alipay = url.origin === 'https://openauth.alipay.com' && url.pathname === '/oauth2/publicAppAuthorize.htm' && !url.username && !url.password;
+        if (!sameOrigin && !alipay)
             throw new Error('Unexpected authorization origin');
-        const startToken = url.searchParams.get('start_token');
+        const fragment = new URLSearchParams(url.hash.replace(/^#dashboard-auth\?/, ''));
+        const state = url.searchParams.get('state')?.split('.');
+        const startToken = alipay
+            ? (state?.length === 2 && state[0] === result.dashboard_auth_session_id ? state[1] : undefined)
+            : url.searchParams.get('start_token') || fragment.get('start_token');
         if (!startToken || !result.poll_token || !result.dashboard_auth_session_id)
             throw new Error('Incomplete authorization response');
-        save({ baseURL, sessionID: result.dashboard_auth_session_id, pollToken: result.poll_token, startToken }, env);
-        return { status: 'authorization_required', authorization_url: url.href, instruction: 'Complete ItPay login in the browser, then run itpay sell auth status.' };
+        save({ baseURL, sessionID: result.dashboard_auth_session_id, pollToken: result.poll_token, startToken }, env, purpose);
+        return { status: 'authorization_required', authorization_url: url.href, instruction: `Complete ItPay login in the browser, then run ${command}.` };
     }
-    const state = read(baseURL, env);
+    const state = read(baseURL, env, purpose);
     if (action === 'logout') {
         const token = sellerSessionToken(baseURL, env);
         if (token)
@@ -52,7 +71,7 @@ export async function sellerAuth(action, baseURL, env = process.env, fetcher = f
         rmSync(sellerAuthPath(baseURL, env), { force: true });
         return { status: 'logged_out' };
     }
-    if (sellerSessionToken(baseURL, env))
+    if (!backend && sellerSessionToken(baseURL, env))
         return { status: 'authenticated', base_url: baseURL, expires_at: state?.expiresAt };
     if (!state?.sessionID || !state.pollToken || !state.startToken)
         return { status: 'login_required' };
@@ -60,6 +79,13 @@ export async function sellerAuth(action, baseURL, env = process.env, fetcher = f
     const progress = await (await request(`${path}?poll_token=${encodeURIComponent(state.pollToken)}`)).json();
     if (progress.status !== 'completed')
         return { status: progress.status, instruction: 'Finish login and email verification in the browser.' };
+    if (backend) {
+        const result = await backend.bindAgentAccount({ dashboard_auth_session_id: state.sessionID, start_token: state.startToken });
+        if (result.status !== 'authenticated')
+            throw new Error('Agent binding did not complete');
+        rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+        return result;
+    }
     const claimed = await request(`${path}/claim?start_token=${encodeURIComponent(state.startToken)}`, { method: 'POST' });
     const token = /(?:^|[, ]+)itpay_buyer_session=([^;]+)/.exec(claimed.headers.get('set-cookie') ?? '')?.[1];
     const session = await claimed.json();

package/dist/src/state/config.js

@@ -1,4 +1,4 @@
-import { sellerSessionToken } from "../sell/auth.js";
+import { sellerSessionToken } from "./account_auth.js";
 // CLI configuration loader. Production defaults to app.itpay.ai; supported public overrides
 // are the official sandbox and dev Backends. Checkout
 // display-token persistence belongs to the cart session file, protected with
@@ -15,8 +15,8 @@ import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
 export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.0";
-export const API_CONTRACT_REVISION = "sha256:bedacd161be3576aeed35c7a4f54ea4fedae65a88d1e024f0445f969a1fc1fc2";
+export const CLI_VERSION = "2.1.2";
+export const API_CONTRACT_REVISION = "sha256:8fc92bcea2b2c5205139382e73295fbabf3ff9b0ae001a7e8d748d3bb6857061";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";

package/dist/src/state/device_authority.js

@@ -2,7 +2,7 @@ import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, ran
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
-const PROTECTED_PATHS = ["/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault"];
+const PROTECTED_PATHS = ["/v1/agent-device-account-bindings", "/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault"];
 export class DeviceAuthority {
     baseURL;
     backendKey;

package/docs/cli-reference/commands/auth.md

@@ -0,0 +1,9 @@
+# Account login
+
+Use `itpay auth login --json` to enroll the current Agent and open the official ItPay Web login. After the user finishes login and email verification, run `itpay auth status --json` to bind this enrolled Agent to the account. Keep declaring the actual `--agent-type` on both commands.
+
+For dev, keep `ITPAY_BACKEND_URL=https://dev.itpay.ai` on every command. Login state and device registration are isolated from production.
+
+Railway exact and smart query services each allow two anonymous queries after enrollment. After login, queries remain free within the published per-minute limits. On `login_required`, finish login and start a new query. On `rate_limited`, wait until the next minute; do not clear device state or retry in a loop.
+
+The Agent receives no general account bearer token. This binding reuses the existing stable device-account ownership mechanism; switching account owners is not supported. Seller authoring continues to use `itpay sell auth` separately.

package/docs/cli-reference/commands/sell.md

@@ -23,7 +23,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +36,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -1339,4 +1340,4 @@ Options:
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.

package/docs/cli-reference/index.md

@@ -2,7 +2,7 @@
 
 本目录是 ItPay CLI 的规范性命令合同。它定义命令应向人和 Agent 返回什么、如何指导下一步，以及失败后如何恢复。当前实现与本文档不一致时，以本文档作为后续校准目标。
 
-> **统一产品边界：** `itpay` 是唯一公开的 CLI 入口，`$itpay` 是对应的用户侧 Skill 调用方式。当前入口同时覆盖购买新服务、查询订单、查看经用户授权的已购内容和退款；Seller 流程未来仍使用同一入口，当前尚未实现。不得为这些意图拆分新的产品入口。
+> **统一产品边界：** `itpay` 是唯一公开的 CLI 入口，`$itpay` 是对应的用户侧 Skill 调用方式。当前入口同时覆盖购买新服务、查询订单、查看经用户授权的已购内容和退款；Seller 流程使用同一入口的 `itpay sell` 命令。不得为这些意图拆分新的产品入口。
 
 企知道可以作为示例数据出现，但任何命令、字段、状态和 instruction 都不得依赖某个服务。服务差异只能来自 Catalog、Service Contract、Capability metadata 和服务端状态。
 
@@ -34,6 +34,7 @@ Commander 自动提供的 `itpay help [command]` 与 `itpay <group> help [subcom
   - [`itpay catalog list`](commands/catalog/list.md)
 - [`itpay install`](commands/install.md) - 查看指定 Agent 的安装说明
 - [`itpay skill show`](commands/skill.md) - 一次读取完整内置 ItPay Skill
+- [`itpay auth login / status`](commands/auth.md) - 官方登录并绑定当前已登记 Agent，继续免费查询
 - [`itpay device recover`](commands/device.md) - 仅恢复运营已确认重建的 Backend registration
 - [`itpay docs`](commands/docs/index.md)
   - [`itpay docs list`](commands/docs/list.md)

package/docs/sell.md

@@ -1,5 +1,11 @@
 # Sell Agent guide
 
+The railway acceptance release `2.1.2` is published under npm's `next` tag,
+not `latest`. Install this explicit version for dev acceptance and set
+`ITPAY_BACKEND_URL=https://dev.itpay.ai` on every command. Its API contract requires
+the matching dev backend release; do not use it against the older production
+backend. Promote the npm latest tag only after production compatibility is verified.
+
 `itpay sell` is the Seller command namespace. Buyer `services` commands remain separate. Read `itpay sell guide --json` first, authenticate with `itpay sell auth login` and complete the standard ItPay browser login, then run `itpay sell auth status`, then use `sell status` to select the user's existing merchant. An unverified merchant must finish KYB and payout setup in the dashboard.
 
 ## Local-first workflow
@@ -23,7 +29,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +42,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -53,4 +60,4 @@ Example local MCP configuration (use the existing authenticated CLI account):
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.0",
+  "version": "2.1.2",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -22,7 +22,8 @@
     "assets/"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "next"
   },
   "keywords": [
     "itpay",