@itpay/cli 2.1.1 → 2.1.3

package/dist/src/commands/readyz.js

@@ -8,7 +8,7 @@ export async function runReadyz(backend, options = {}) {
         status: response.status,
         result: { backend: "available", backend_url: backendURL, environment, ...(options.agentType ? { agent_type: options.agentType } : {}) },
         instruction: environment === "development"
-            ? "ItPay sandbox 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 sandbox Backend。"
+            ? `ItPay 开发环境 ${backendURL} 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；后续必须执行返回的完整命令并保持同一 Backend。`
             : "ItPay 可用。先完整读取内置 Skill，再根据用户意图选择新服务、已购内容、订单或退款入口；不要默认开始购买。",
         next: { command: "itpay skill show itpay --json", reason: "加载完整操作与安全规则" },
         recovery: [],

package/dist/src/commands/services.js

@@ -666,6 +666,15 @@ function servicesNextEnvelope(model) {
                 recovery: [],
             };
         }
+        if (state === "human_action" && model.workflow?.human_action) {
+            return {
+                status: "confirmation_required",
+                result: { service_execution_id: id, service_id: execution.service_id, human_action: model.workflow.human_action },
+                instruction: "请展示待确认的位置，请用户明确确认后，按 input_schema 填写 --input 字段。继续同一执行，不重新查询；这一步不是购买确认。",
+                next: { command: `itpay services action ${id} --action ${model.workflow.human_action.action_type} --actor-type human --status approved --input <key=value> --json`, reason: "用户确认后继续当前查询" },
+                recovery: [],
+            };
+        }
         const recovery = state === "recovery_required" || state === "failed";
         let command = `itpay services next ${id} --json`;
         if (state === "payment")

package/dist/src/sell/contract.js

@@ -8,7 +8,7 @@ export const SELL_GUIDE = {
         "Use the authenticated user's existing merchant. KYB and payout changes remain in the dashboard.",
         "Resolve every API against its declared method, Content-Type, parameters, response schema and locked version. Ask for missing inputs; never guess credentials or change contracts.",
         "Only saved versions may run. A run is not a saved version. Local evidence cannot grant platform test approval.",
-        "Public workflows are acyclic, synchronous, per-call; include exactly one payment step and delivery on every success path. Unsupported nodes block publication.",
+        "Use the platform node catalog and validator for supported pricing, quotas, confirmation and durable fulfillment. Every paid success path must cross payment and delivery gates.",
         "Use own credentials for local requests. Platform-managed credentials stay on the platform. Mark execution location honestly.",
         "Present side effects before live tests. Unknown results stop automatic retries. Local payment/refund/delivery gates are simulated, never real funds.",
         "Show the exact workflow and version before user confirmation. Preview price, delivery and current terms before explicit submission approval.",
@@ -44,6 +44,8 @@ export const SELL_OPERATIONS = [
     { command: "pricing get", method: "GET", path: `${draft}/workflow`, scope: read, fields: {}, description: "Read the current price and refund policy" },
     { command: "pricing set", method: "PUT", path: `${draft}/pricing`, scope: write, fields: { expected_revision: "number", pricing: "object", policy: "object" }, description: "Set per-call price and platform refund policy" },
     { command: "verify", method: "POST", path: `${draft}/validation-runs`, scope: test, fields: { workflow_version_id: "string", expected_semantic_revision: "number", expected_fixture_revision: "number" }, description: "Start platform verification for an explicitly saved version", confirmation: true },
+    { command: "tests start-checkout", method: "POST", path: `${draft}/live-checkout-tests`, scope: test, fields: { expected_revision: "number", agent_instance_id: "string" }, description: "Dev admin only: freeze one success fixture into a private real-checkout test bound to your registered Agent. Payment still requires user confirmation; this does not publish the service.", confirmation: true },
+    { command: "tests accept-checkout", method: "POST", path: `${draft}/live-checkout-tests/{execution_id}/accept`, scope: test, fields: {}, description: "Record server-observed issued tickets and completed delivery as evidence for the exact tested revision. Never synthesizes payment or issuance.", confirmation: true },
     { command: "runs get", method: "GET", path: `${draft}/validation-runs/{run_id}`, scope: read, fields: {}, description: "Inspect platform test nodes and diagnostics" },
     { command: "runs confirm", method: "POST", path: `${draft}/validation-runs/{run_id}/confirm`, scope: test, fields: { risk_hash: "string" }, description: "Confirm the exact disclosed platform test side effects", confirmation: true },
     { command: "submission preview", method: "GET", path: `${org}/guide`, scope: read, fields: { draft_id: "string" }, description: "Read publication readiness and required agreements" },

package/dist/src/state/account_auth.js

@@ -49,9 +49,15 @@ async function accountAuth(action, baseURL, env, fetcher, backend) {
         const response = await request('/v1/dashboard/auth-sessions', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ provider: 'alipay', return_to: backend ? '/' : '/seller' }) });
         const result = await response.json();
         const url = new URL(result.start_url, baseURL);
-        if (url.origin !== new URL(baseURL).origin)
+        const sameOrigin = url.origin === new URL(baseURL).origin;
+        const alipay = url.origin === 'https://openauth.alipay.com' && url.pathname === '/oauth2/publicAppAuthorize.htm' && !url.username && !url.password;
+        if (!sameOrigin && !alipay)
             throw new Error('Unexpected authorization origin');
-        const startToken = url.searchParams.get('start_token');
+        const fragment = new URLSearchParams(url.hash.replace(/^#dashboard-auth\?/, ''));
+        const state = url.searchParams.get('state')?.split('.');
+        const startToken = alipay
+            ? (state?.length === 2 && state[0] === result.dashboard_auth_session_id ? state[1] : undefined)
+            : url.searchParams.get('start_token') || fragment.get('start_token');
         if (!startToken || !result.poll_token || !result.dashboard_auth_session_id)
             throw new Error('Incomplete authorization response');
         save({ baseURL, sessionID: result.dashboard_auth_session_id, pollToken: result.poll_token, startToken }, env, purpose);

package/dist/src/state/config.js

@@ -15,8 +15,8 @@ import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
 export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.1";
-export const API_CONTRACT_REVISION = "sha256:b8593e4d73782a3ddeb5d070df1db572e422dd0aa08083372bc8971b5412b643";
+export const CLI_VERSION = "2.1.3";
+export const API_CONTRACT_REVISION = "sha256:7f8e09ecee0ab32e3eed3690341fa5bbf6d955dbb464fd79ce0e340667b1085e";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";

package/docs/cli-reference/commands/sell.md

@@ -23,7 +23,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +36,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -1339,4 +1340,25 @@ Options:
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+
+## Private dev live checkout acceptance
+
+`itpay sell tests start-checkout --merchant-id <merchant> --draft-id <draft> --input-json <file> --confirm --json`
+
+Requires the dev server in live Provider mode, an account-scoped platform admin session,
+and an active enrolled Agent already bound to the same buyer. The JSON contains
+`expected_revision` and `agent_instance_id`. Save exactly one success fixture first.
+This queues a private canary execution; it does not publish a service or pay for a ticket.
+Disclose the live query side effects before using `--confirm`.
+
+Resume the returned `service_execution_id` using the normal workflow commands through
+that Agent. The user confirms the route and submits passenger details in the protected
+Checkout page. Only a verified payment callback permits supplier creation/payment.
+
+`itpay sell tests accept-checkout --merchant-id <merchant> --draft-id <draft> --execution-id <execution> --confirm --json`
+
+Records server-observed completed delivery and issued tickets for the exact frozen
+workflow, fixture and dependency hashes. Pending, partial, manual-recovery, unpaid or
+changed tests cannot pass. No payment or issuance assertions are accepted as input.
+Then use the normal submission and admin review flow; this test alone is not publication.

package/docs/sell.md

@@ -1,5 +1,11 @@
 # Sell Agent guide
 
+The railway acceptance release `2.1.2` is published under npm's `next` tag,
+not `latest`. Install this explicit version for dev acceptance and set
+`ITPAY_BACKEND_URL=https://dev.itpay.ai` on every command. Its API contract requires
+the matching dev backend release; do not use it against the older production
+backend. Promote the npm latest tag only after production compatibility is verified.
+
 `itpay sell` is the Seller command namespace. Buyer `services` commands remain separate. Read `itpay sell guide --json` first, authenticate with `itpay sell auth login` and complete the standard ItPay browser login, then run `itpay sell auth status`, then use `sell status` to select the user's existing merchant. An unverified merchant must finish KYB and payout setup in the dashboard.
 
 ## Local-first workflow
@@ -23,7 +29,8 @@ All platform operations accept `--input-json <file>` for their declared fields a
 
 ## Invariants
 
-- Current public runtime is synchronous, acyclic, single entry, per-call pricing, one payment node, and delivery on success. Quota, prepaid consumption and async workflows are not publishable.
+- The current runtime accepts bounded, acyclic, single-entry workflows with multiple API nodes. Free queries can use quota and explicit human confirmation; paid workflows use one payment node and either fixed per-call pricing or a trusted pre-payment dynamic quote. Prepaid balance billing remains unsupported.
+- Protected railway fulfillment resumes through the platform booking Owner only after verified payment and Web passenger confirmation. A standalone API probe cannot supply a payment identity or passenger records. Follow the server Guide for actual acceptance and publication blockers; local graph validation is not live ticket-issuance evidence.
 - Local reports are diagnostics, not platform approval evidence. Platform verification is required; existing valid evidence may be reused. Admin approval never repeats Provider calls.
 - Every visual view reads the same YAML. Layout is presentation only.
 - Disclosure/confirmation binds the version being acted on. Do not turn `--confirm` into blanket permission for later changes.
@@ -35,7 +42,7 @@ The local `.itpay-sell` directory contains private fixtures, reports and the enc
 
 Local reports never substitute for the platform verification gate. Repeated upload of an unchanged saved version reuses its cloud version; a changed cloud revision or fixture revision requires explicit pull/review.
 
-For repository builds, run `scripts/v3/build-sell-runtime.sh`, build `apps/web/vite.sell-preview.config.ts`, and then build/package `apps/cli`. Packaging rejects missing native binaries or preview assets. `scripts/v3/sync-sell-contract.mjs --check` verifies that the CLI command contracts match the backend/MCP package.
+For CLI repository builds, run `node scripts/fetch-sell-runtime.mjs` to obtain the exact checksummed native runtime in `seller-runtime.lock.json`, then `npm run test:package`. The committed `assets/sell-preview` directory supplies the local Builder. Packaging rejects missing native binaries or preview assets; do not substitute an arbitrary local binary for the locked release.
 
 Example local MCP configuration (use the existing authenticated CLI account):
 
@@ -53,4 +60,25 @@ Example local MCP configuration (use the existing authenticated CLI account):
 
 ## Seller login and dev
 
-Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login --json` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status --json`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout --json` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+Use `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth login` to receive the normal ItPay authorization link. After browser login and required email verification, run `ITPAY_BACKEND_URL=https://dev.itpay.ai itpay sell auth status`. The CLI claims its own account session through the standard API and stores it in an owner-only file; never copy tokens or browser cookies. `itpay sell auth logout` revokes this session. Keep the same backend prefix on subsequent commands; production, dev, and sandbox state are isolated. Agent device enrollment does not grant Seller organization access.
+
+## Private dev live checkout acceptance
+
+`itpay sell tests start-checkout --merchant-id <merchant> --draft-id <draft> --input-json <file> --confirm --json`
+
+Requires the dev server in live Provider mode, an account-scoped platform admin session,
+and an active enrolled Agent already bound to the same buyer. The JSON contains
+`expected_revision` and `agent_instance_id`. Save exactly one success fixture first.
+This queues a private canary execution; it does not publish a service or pay for a ticket.
+Disclose the live query side effects before using `--confirm`.
+
+Resume the returned `service_execution_id` using the normal workflow commands through
+that Agent. The user confirms the route and submits passenger details in the protected
+Checkout page. Only a verified payment callback permits supplier creation/payment.
+
+`itpay sell tests accept-checkout --merchant-id <merchant> --draft-id <draft> --execution-id <execution> --confirm --json`
+
+Records server-observed completed delivery and issued tickets for the exact frozen
+workflow, fixture and dependency hashes. Pending, partial, manual-recovery, unpaid or
+changed tests cannot pass. No payment or issuance assertions are accepted as input.
+Then use the normal submission and admin review flow; this test alone is not publication.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.1",
+  "version": "2.1.3",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -22,7 +22,8 @@
     "assets/"
   ],
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "tag": "next"
   },
   "keywords": [
     "itpay",