@itpay/cli 2.1.1 → 2.1.2

package/dist/src/commands/readyz.js

@@ -8,7 +8,7 @@ export async function runReadyz(backend, options = {}) {
         status: response.status,
         result: { backend: "available", backend_url: backendURL, environment, ...(options.agentType ? { agent_type: options.agentType } : {}) },
         instruction: environment === "development"
-            ? "ItPay sandbox 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 sandbox Backend。"
+            ? `ItPay 开发环境 ${backendURL} 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 Backend。`
             : "ItPay 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；不要默认开始购买。",
         next: { command: "itpay skill show itpay --json", reason: "加载完整操作与安全规则" },
         recovery: [],

package/dist/src/commands/services.js

@@ -666,6 +666,15 @@ function servicesNextEnvelope(model) {
                 recovery: [],
             };
         }
+        if (state === "human_action" && model.workflow?.human_action) {
+            return {
+                status: "confirmation_required",
+                result: { service_execution_id: id, service_id: execution.service_id, human_action: model.workflow.human_action },
+                instruction: "请展示待确认的位置，请用户明确确认后，按 input_schema 填写 --input 字段。继续同一执行，不重新查询；这一步不是购买确认。",
+                next: { command: `itpay services action ${id} --action ${model.workflow.human_action.action_type} --actor-type human --status approved --input <key=value> --json`, reason: "用户确认后继续当前查询" },
+                recovery: [],
+            };
+        }
         const recovery = state === "recovery_required" || state === "failed";
         let command = `itpay services next ${id} --json`;
         if (state === "payment")

package/dist/src/state/account_auth.js

@@ -49,9 +49,15 @@ async function accountAuth(action, baseURL, env, fetcher, backend) {
         const response = await request('/v1/dashboard/auth-sessions', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ provider: 'alipay', return_to: backend ? '/' : '/seller' }) });
         const result = await response.json();
         const url = new URL(result.start_url, baseURL);
-        if (url.origin !== new URL(baseURL).origin)
+        const sameOrigin = url.origin === new URL(baseURL).origin;
+        const alipay = url.origin === 'https://openauth.alipay.com' && url.pathname === '/oauth2/publicAppAuthorize.htm' && !url.username && !url.password;
+        if (!sameOrigin && !alipay)
             throw new Error('Unexpected authorization origin');
-        const startToken = url.searchParams.get('start_token');
+        const fragment = new URLSearchParams(url.hash.replace(/^#dashboard-auth\?/, ''));
+        const state = url.searchParams.get('state')?.split('.');
+        const startToken = alipay
+            ? (state?.length === 2 && state[0] === result.dashboard_auth_session_id ? state[1] : undefined)
+            : url.searchParams.get('start_token') || fragment.get('start_token');
         if (!startToken || !result.poll_token || !result.dashboard_auth_session_id)
             throw new Error('Incomplete authorization response');
         save({ baseURL, sessionID: result.dashboard_auth_session_id, pollToken: result.poll_token, startToken }, env, purpose);

package/dist/src/state/config.js

@@ -15,8 +15,8 @@ import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
 export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.1";
-export const API_CONTRACT_REVISION = "sha256:b8593e4d73782a3ddeb5d070df1db572e422dd0aa08083372bc8971b5412b643";
+export const CLI_VERSION = "2.1.2";
+export const API_CONTRACT_REVISION = "sha256:8fc92bcea2b2c5205139382e73295fbabf3ff9b0ae001a7e8d748d3bb6857061";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";

package/docs/cli-reference/commands/sell.md

@@ -23,7 +23,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +36,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -1339,4 +1340,4 @@ Options:
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.

package/docs/sell.md

@@ -1,5 +1,11 @@
 # Sell Agent guide
 
+The railway acceptance release `2.1.2` is published under npm's `next` tag,
+not `latest`. Install this explicit version for dev acceptance and set
+`ITPAY_BACKEND_URL=https://dev.itpay.ai` on every command. Its API contract requires
+the matching dev backend release; do not use it against the older production
+backend. Promote the npm latest tag only after production compatibility is verified.
+
 `itpay sell` is the Seller command namespace. Buyer `services` commands remain separate. Read `itpay sell guide --json` first, authenticate with `itpay sell auth login` and complete the standard ItPay browser login, then run `itpay sell auth status`, then use `sell status` to select the user's existing merchant. An unverified merchant must finish KYB and payout setup in the dashboard.
 
 ## Local-first workflow
@@ -23,7 +29,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +42,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -53,4 +60,4 @@ Example local MCP configuration (use the existing authenticated CLI account):
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.1",
+  "version": "2.1.2",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -22,7 +22,8 @@
     "assets/"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "next"
   },
   "keywords": [
     "itpay",