@itpay/cli 2.1.41 → 2.1.44

package/dist/src/state/account_auth.js

@@ -0,0 +1,354 @@
+import { HttpError } from '../client/http.js';
+import { HttpTransportError } from '../client/transport.js';
+import { DeviceAuthorizationError, DeviceStateError, DeviceLockBusyError } from './device_authority.js';
+import { createHash } from 'node:crypto';
+import { dirname, resolve } from 'node:path';
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, rmSync } from 'node:fs';
+import { writeLocalPNG } from '../render/qr.js';
+import { TaskJournal } from './task_journal.js';
+import { taskJournalPath } from './config.js';
+export function sellerAuthPath(baseURL, env = process.env, purpose = "seller") {
+    return resolve(stateDir(env), `${purpose}-${createHash('sha256').update(baseURL).digest('hex').slice(0, 16)}.json`);
+}
+function read(baseURL, env = process.env, purpose = "seller") {
+    const path = sellerAuthPath(baseURL, env, purpose);
+    if (!existsSync(path))
+        return;
+    const state = JSON.parse(readFileSync(path, 'utf8'));
+    if (state.baseURL !== baseURL)
+        throw new Error('Seller session backend mismatch');
+    return state;
+}
+function save(state, env = process.env, purpose = "seller") {
+    const path = sellerAuthPath(state.baseURL, env, purpose);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${process.pid}.tmp`;
+    writeFileSync(tmp, JSON.stringify(state), { mode: 0o600 });
+    renameSync(tmp, path);
+}
+export function sellerSessionToken(baseURL, env = process.env) {
+    const state = read(baseURL, env);
+    return state?.expiresAt && Date.parse(state.expiresAt) > Date.now() ? state.sessionToken : undefined;
+}
+export function sellerAuth(action, baseURL, env = process.env, fetcher = fetch) {
+    return accountAuth(action, baseURL, env, fetcher);
+}
+export function agentAuth(action, baseURL, backend, env = process.env, fetcher = fetch) {
+    return accountAuth(action, baseURL, env, fetcher, backend);
+}
+// AUTH01: dashboard session stages stay distinct — the human must know exactly
+// what the official page still needs instead of a generic "pending".
+const ACTIVE_SESSION_STAGES = ['created', 'waiting_provider', 'email_verification_required', 'merge_confirmation_required'];
+function stageInstruction(stage) {
+    if (stage === 'email_verification_required') {
+        return '官方页返回显式或历史身份验证状态；按页面当前要求完成验证。普通登录只需一种有效身份，不要求补齐邮箱和手机。完成后恢复原执行。';
+    }
+    if (stage === 'merge_confirmation_required') {
+        return '官方页需要用户核对两侧账号证明及主账号，再明确确认或取消合并；这不是付款确认。不要替用户同意，不自动重启原服务或授权请求。';
+    }
+    return '用户仍在官方页面完成登录；保留当前 handoff，不要生成新二维码或新请求。';
+}
+// AUTH07: distinct outcomes stay distinct — a technical failure is never
+// reported as a user denial, and a missing session is its own state.
+const TERMINAL_SESSION_STATES = {
+    expired: {
+        status: 'auth_expired',
+        instruction: '授权请求已过期。重新运行 itpay auth login 生成新请求；之前的查询输入在服务端保留，可恢复。',
+    },
+    failed: {
+        status: 'auth_failed',
+        instruction: '官方授权因技术原因未完成（不是用户拒绝）。重新运行 itpay auth login 生成新请求。',
+    },
+    cancelled: {
+        status: 'auth_cancelled',
+        instruction: '用户在官方页取消了授权；停止登录。只有用户明确重新要求授权时才发起新的登录。',
+    },
+    denied: {
+        status: 'auth_denied',
+        instruction: '官方授权被拒绝；停止登录，不自动创建新请求。只有用户明确重新要求授权时才重新登录。',
+    },
+};
+class AuthRequestError extends Error {
+    httpStatus;
+    constructor(httpStatus, message) {
+        super(message);
+        this.httpStatus = httpStatus;
+        this.name = 'AuthRequestError';
+    }
+}
+// AUTH03: transport/read uncertainty never maps to "denied" or a new session —
+// the stored session stays on disk and the caller retries the same poll.
+function authStatusUnknown(sessionID, error, failureStage = "authorization_status_read") {
+    // These errors have definite compatibility/identity/state facts. Let the
+    // command boundary report them rather than turning them into polling.
+    if ((error instanceof HttpError && error.status < 500)
+        || (error instanceof AuthRequestError && error.httpStatus < 500)
+        || error instanceof DeviceAuthorizationError || error instanceof DeviceStateError
+        || error instanceof DeviceLockBusyError)
+        throw error;
+    const hostFailure = error && typeof error === "object" && "code" in error
+        && (error.code === "CODEBUDDY_BROKER_DENY" || error.code === "CODEBUDDY_BROKER_OUTCOME_UNKNOWN");
+    const failure = error instanceof HttpTransportError
+        ? { category: error.code, attempts: error.attempts, source: "network_transport" }
+        : error instanceof HttpError || error instanceof AuthRequestError
+            ? { category: "http_server_error", http_status: error instanceof HttpError ? error.status : error.httpStatus, source: "http_response" }
+            : hostFailure ? { category: "host_operation_unavailable", source: "host_broker" }
+                : { category: "authorization_status_unavailable", source: "unclassified" };
+    return {
+        status: 'auth_status_unknown',
+        result: { ...failure, failure_stage: failureStage, ...(sessionID ? { dashboard_auth_session_id: sessionID } : {}) },
+        instruction: hostFailure || failure.source === 'unclassified'
+            ? '本轮授权检查未完成，底层原因尚未确定；保留设备和已有授权，请维护方核对当前失败阶段及宿主结果，不自动登录、换身份或盲目重复修改。'
+            : sessionID
+                ? '读取官方授权状态失败；原授权请求已保留。稍后重读同一状态，不要新建授权、不要清除本地登记。'
+                : '本轮账号绑定检查未完成，设备与绑定状态尚未确认；没有保存的授权请求。结束本轮，网络或服务恢复后可重新检查，不发起登录。',
+        next: sessionID && !hostFailure && failure.source !== 'unclassified' ? { command: 'itpay auth status --json', reason: '稍后重读同一授权状态', poll_after_ms: 5000 } : null,
+        recovery: [],
+    };
+}
+function sessionGone(env, purpose, baseURL, sessionID) {
+    rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+    return {
+        status: 'auth_session_missing',
+        result: sessionID ? { dashboard_auth_session_id: sessionID } : {},
+        instruction: '之前的授权请求在服务端已不存在。重新运行 itpay auth login 生成新请求。',
+        next: { command: 'itpay auth login --json', reason: '重新发起官方授权' },
+        recovery: [],
+    };
+}
+// AUTH04: a successful bind resumes the SAME task that paused for login —
+// from the local task journal, never a placeholder and never a guess at the
+// latest order.
+function authenticatedEnvelope(env, phoneVerified) {
+    const paused = new TaskJournal(taskJournalPath(env)).pausedTasks()
+        .filter((task) => task.stage === 'login_required' || task.stage === 'quota_paused');
+    const resumable = paused.filter((task) => typeof task.resume_command === 'string');
+    const result = { bound: true, phone_verified: phoneVerified };
+    let instruction = '登录与绑定已完成，告知用户可继续之前的查询；已注册账号查询不消耗试用次数，仍受正常限流。';
+    let next = null;
+    if (resumable.length === 1) {
+        next = { command: resumable[0].resume_command, reason: '恢复登录前暂停的同一查询' };
+    }
+    else if (resumable.length > 1) {
+        result.paused_executions = resumable.map((task) => ({
+            service_execution_id: task.service_execution_id,
+            ...(task.service_id ? { service_id: task.service_id } : {}),
+            resume_command: task.resume_command,
+        }));
+        instruction += ' 有多个暂停的查询：只恢复与当前用户目标对应的那一个，不要一次恢复全部。';
+    }
+    else {
+        instruction += ' 当前没有待恢复的暂停查询；不构造恢复命令。';
+    }
+    return { status: 'authenticated', result, instruction, next, recovery: [] };
+}
+async function accountAuth(action, baseURL, env, fetcher, backend) {
+    const purpose = backend ? 'agent-login' : 'seller';
+    const command = backend ? 'itpay auth status' : 'itpay sell auth status';
+    if (backend) {
+        try {
+            const current = await backend.agentAccountStatus();
+            if (current.status === 'authenticated')
+                return authenticatedEnvelope(env, current.phone_verified === true);
+        }
+        catch (error) {
+            if (error instanceof AuthRequestError)
+                throw error;
+            // AUTH03: even the binding-status probe can hit transport failure; the
+            // truthful state is "unknown", never an implicit unbound or a fresh login.
+            return authStatusUnknown(read(baseURL, env, purpose)?.sessionID, error, "account_binding_probe");
+        }
+    }
+    async function request(path, init = {}) {
+        const response = await fetcher(baseURL + path, { ...init, redirect: 'error', signal: AbortSignal.timeout(15000) });
+        if (!response.ok)
+            throw new AuthRequestError(response.status, `ItPay authorization failed (${response.status}); retry login if expired`);
+        return response;
+    }
+    function pollOpenSession(state) {
+        return request(`/v1/dashboard/auth-sessions/${encodeURIComponent(state.sessionID)}?poll_token=${encodeURIComponent(state.pollToken)}`)
+            .then((response) => response.json());
+    }
+    async function bindSavedSession(state) {
+        const bound = await backend.bindAgentAccount({ dashboard_auth_session_id: state.sessionID, start_token: state.startToken });
+        if (bound.status !== 'authenticated')
+            throw new Error('Agent binding did not complete');
+        rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+        return authenticatedEnvelope(env, bound.phone_verified === true);
+    }
+    if (action === 'login') {
+        if (backend) {
+            const open = read(baseURL, env, purpose);
+            if (open?.sessionID && open.pollToken && open.startToken) {
+                try {
+                    const current = await pollOpenSession(open);
+                    // AUTH02: a completed-but-unbound session binds in place; never
+                    // create a second auth session for the same login.
+                    if (current.status === 'completed')
+                        return await bindSavedSession(open);
+                    if (ACTIVE_SESSION_STAGES.includes(current.status)) {
+                        const url = open.authURL ?? '';
+                        const qr = url ? await writeLocalPNG(url).catch(() => undefined) : undefined;
+                        return {
+                            status: 'auth_pending',
+                            result: {
+                                dashboard_auth_session_id: open.sessionID,
+                                stage: current.status,
+                                expires_at: current.expires_at,
+                                methods: ['phone', 'email', 'alipay', 'wechat'],
+                            },
+                            // SEC01: the handoff URL carries one-time credentials — it goes
+                            // to the human only, never into logs, prompts, or PR material.
+                            handoff: {
+                                url,
+                                contains_credentials: true,
+                                ...(qr ? { qr_local_path: qr.filePath, markdown: `![ItPay 官方授权二维码](${qr.filePath})` } : {}),
+                            },
+                            instruction: `${stageInstruction(current.status)} 沿用同一链接或二维码；不要生成新请求。`,
+                            next: { command: 'itpay auth status --json', reason: '用户完成页面登录后确认绑定', poll_after_ms: 5000 },
+                            recovery: [],
+                        };
+                    }
+                    const terminal = TERMINAL_SESSION_STATES[current.status];
+                    if (terminal) {
+                        rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+                        // Fall through to a fresh session only after a definitive
+                        // terminal state; anything else keeps the stored session.
+                    }
+                    else {
+                        return authStatusUnknown(open.sessionID);
+                    }
+                }
+                catch (error) {
+                    if (error instanceof AuthRequestError && (error.httpStatus === 404 || error.httpStatus === 410)) {
+                        rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+                        // The explicit login call may open one fresh session now. Status
+                        // remains read-only and still reports the missing old session.
+                    }
+                    else {
+                        return authStatusUnknown(open.sessionID, error);
+                    }
+                }
+            }
+        }
+        const response = await request('/v1/dashboard/auth-sessions', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ return_to: backend ? '/' : '/seller' }) });
+        const result = await response.json();
+        const url = new URL(result.start_url, baseURL);
+        const sameOrigin = url.origin === new URL(baseURL).origin;
+        const alipay = url.origin === 'https://openauth.alipay.com' && url.pathname === '/oauth2/publicAppAuthorize.htm' && !url.username && !url.password;
+        const local = response.headers.get('X-ItPay-Environment') === 'local_simulation'
+            && new URL(baseURL).protocol === 'http:' && new URL(baseURL).hostname === '127.0.0.1'
+            && url.protocol === 'http:' && url.hostname === '127.0.0.1' && !url.username && !url.password;
+        if (!sameOrigin && !alipay && !local)
+            throw new Error('Unexpected authorization origin');
+        const fragment = new URLSearchParams(url.hash.replace(/^#dashboard-auth\?/, ''));
+        const state = url.searchParams.get('state')?.split('.');
+        const startToken = alipay
+            ? (state?.length === 2 && state[0] === result.dashboard_auth_session_id ? state[1] : undefined)
+            : url.searchParams.get('start_token') || fragment.get('start_token');
+        if (!startToken || !result.poll_token || !result.dashboard_auth_session_id)
+            throw new Error('Incomplete authorization response');
+        save({ baseURL, sessionID: result.dashboard_auth_session_id, pollToken: result.poll_token, startToken, authURL: url.href }, env, purpose);
+        if (backend) {
+            const qr = await writeLocalPNG(url.href).catch(() => undefined);
+            return {
+                status: 'auth_pending',
+                result: {
+                    dashboard_auth_session_id: result.dashboard_auth_session_id,
+                    stage: 'created',
+                    expires_at: result.expires_at,
+                    methods: ['phone', 'email', 'alipay', 'wechat'],
+                },
+                handoff: {
+                    url: url.href,
+                    contains_credentials: true,
+                    ...(qr ? { qr_local_path: qr.filePath, markdown: `![ItPay 官方授权二维码](${qr.filePath})` } : {}),
+                },
+                instruction: '把官方授权页或二维码交给用户。用户在页面内选择手机号验证码、邮箱或钱包完成登录；不要替用户输入手机号或验证码，start_token 不要写入聊天记录或日志。',
+                next: { command: 'itpay auth status --json', reason: '用户完成页面登录后确认绑定', poll_after_ms: 5000 },
+                recovery: [],
+            };
+        }
+        return { status: 'authorization_required', authorization_url: url.href, instruction: `Complete ItPay login in the browser, then run ${command}.` };
+    }
+    const state = read(baseURL, env, purpose);
+    if (action === 'logout') {
+        const token = sellerSessionToken(baseURL, env);
+        if (token)
+            await request('/v1/me/logout', { method: 'POST', headers: { Authorization: `Bearer ${token}` } });
+        rmSync(sellerAuthPath(baseURL, env), { force: true });
+        return { status: 'logged_out' };
+    }
+    if (!backend && sellerSessionToken(baseURL, env))
+        return { status: 'authenticated', base_url: baseURL, expires_at: state?.expiresAt };
+    if (!state?.sessionID || !state.pollToken || !state.startToken) {
+        // AUTH07: a bare `status` with no session is its own truthful state, not a
+        // failure and not an implicit login.
+        if (!backend)
+            return { status: 'login_required' };
+        return {
+            status: 'login_required',
+            result: {},
+            instruction: '当前设备尚未绑定账号，也没有进行中的授权请求。需要时运行 itpay auth login 发起官方登录。',
+            next: { command: 'itpay auth login --json', reason: '需要账号绑定时发起官方授权' },
+            recovery: [],
+        };
+    }
+    let progress;
+    try {
+        progress = await pollOpenSession(state);
+    }
+    catch (error) {
+        if (error instanceof AuthRequestError && (error.httpStatus === 404 || error.httpStatus === 410)) {
+            return sessionGone(env, purpose, baseURL, state.sessionID);
+        }
+        return authStatusUnknown(state.sessionID, error);
+    }
+    if (progress.status !== 'completed') {
+        if (backend) {
+            const terminal = TERMINAL_SESSION_STATES[progress.status];
+            if (terminal) {
+                rmSync(sellerAuthPath(baseURL, env, purpose), { force: true });
+                return {
+                    status: terminal.status,
+                    result: { dashboard_auth_session_id: state.sessionID, stage: progress.status },
+                    instruction: terminal.instruction,
+                    next: ['denied', 'cancelled'].includes(progress.status) ? null : { command: 'itpay auth login --json', reason: '需要登录时重新发起官方授权' },
+                    recovery: [],
+                };
+            }
+            return {
+                status: 'auth_pending',
+                result: {
+                    dashboard_auth_session_id: state.sessionID,
+                    stage: progress.status,
+                    ...(progress.expires_at ? { expires_at: progress.expires_at } : {}),
+                },
+                instruction: stageInstruction(progress.status),
+                next: { command: 'itpay auth status --json', reason: '轮询同一授权请求', poll_after_ms: 5000 },
+                recovery: [],
+            };
+        }
+        return { status: progress.status, instruction: 'Finish login and email verification in the browser.' };
+    }
+    if (backend) {
+        try {
+            return await bindSavedSession(state);
+        }
+        catch (error) {
+            if (error instanceof AuthRequestError)
+                throw error;
+            // Binding outcome unknown: keep the session so a retry can still bind
+            // the same completed login instead of creating a new one.
+            return authStatusUnknown(state.sessionID, error);
+        }
+    }
+    const claimed = await request(`/v1/dashboard/auth-sessions/${encodeURIComponent(state.sessionID)}/claim?start_token=${encodeURIComponent(state.startToken)}`, { method: 'POST' });
+    const token = /(?:^|[, ]+)itpay_buyer_session=([^;]+)/.exec(claimed.headers.get('set-cookie') ?? '')?.[1];
+    const session = await claimed.json();
+    if (!token || !session.expires_at || !(Date.parse(session.expires_at) > Date.now()))
+        throw new Error('Incomplete Seller session');
+    save({ baseURL, sessionToken: token, expiresAt: session.expires_at }, env);
+    return { status: 'authenticated', base_url: baseURL, expires_at: session.expires_at };
+}
+import { stateDir } from "./config.js";

package/dist/src/state/cart_session.js

@@ -55,9 +55,12 @@ export class CartSession {
             ...(this.state.lastDisplayToken ? { lastDisplayToken: this.state.lastDisplayToken } : {}),
             ...(this.state.lastCheckoutURL ? { lastCheckoutURL: this.state.lastCheckoutURL } : {}),
         };
+        const contents = JSON.stringify(toSave, null, 2);
+        if (existsSync(path) && readFileSync(path, "utf-8") === contents)
+            return;
         mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
         const temporary = `${path}.${process.pid}.${randomUUID()}.tmp`;
-        writeFileSync(temporary, JSON.stringify(toSave, null, 2), { encoding: "utf-8", mode: 0o600 });
+        writeFileSync(temporary, contents, { encoding: "utf-8", mode: 0o600 });
         chmodSync(temporary, 0o600);
         renameSync(temporary, path);
         chmodSync(path, 0o600);

package/dist/src/state/client_context.js

@@ -64,6 +64,8 @@ export function defaultHostForAgentType(agentType) {
         return "plain-chat";
     if (normalized === "zcode")
         return "plain-chat";
+    if (normalized === "doubao-work")
+        return "plain-chat";
     if (normalized === "openclaw")
         return undefined;
     return "terminal";
@@ -77,3 +79,73 @@ export function validateContext(host, target) {
     }
     return undefined;
 }
+export function normalizeViewer(raw) {
+    const v = raw?.trim().toLowerCase();
+    if (v === "desktop" || v === "mobile")
+        return v;
+    return "unknown";
+}
+export function normalizeLocality(raw) {
+    const v = raw?.trim().toLowerCase();
+    if (v === "same_device" || v === "remote" || v === "cloud")
+        return v;
+    return "unknown";
+}
+// Conservative declared capability table per host. Terminal/desktop agent
+// hosts run where a human watches a screen and a system browser exists;
+// IM hosts can send links/buttons but cannot be assumed to open pages;
+// plain-chat surfaces get links and copyable entries only.
+export function hostCapabilities(host) {
+    switch (host) {
+        case "terminal":
+        case "codex":
+        case "claude-code":
+            return {
+                user_visible_browser: "unknown",
+                system_browser: "yes",
+                clickable_https: "yes",
+                image_visible: host === "terminal" ? "no" : "unknown",
+                native_url_button: "no",
+                user_visible_terminal: "yes",
+                other_device_scan: "yes",
+                send_message: "yes",
+            };
+        case "telegram":
+        case "feishu":
+        case "lark":
+            return {
+                user_visible_browser: "no",
+                system_browser: "no",
+                clickable_https: "yes",
+                image_visible: "yes",
+                native_url_button: "yes",
+                user_visible_terminal: "no",
+                other_device_scan: "unknown",
+                send_message: "yes",
+            };
+        case "discord":
+        case "whatsapp":
+            return {
+                user_visible_browser: "no",
+                system_browser: "no",
+                clickable_https: "yes",
+                image_visible: "yes",
+                native_url_button: "unknown",
+                user_visible_terminal: "no",
+                other_device_scan: "unknown",
+                send_message: "yes",
+            };
+        case "plain-chat":
+        default:
+            return {
+                user_visible_browser: "no",
+                system_browser: "unknown",
+                clickable_https: "yes",
+                image_visible: "no",
+                native_url_button: "unknown",
+                user_visible_terminal: "no",
+                other_device_scan: "unknown",
+                send_message: "yes",
+            };
+    }
+}

package/dist/src/state/config.js

@@ -1,7 +1,9 @@
-// CLI configuration loader. Production defaults to app.itpay.ai; the only
-// allowed override is the official dev Backend. Checkout
+import { sellerSessionToken } from "./account_auth.js";
+// CLI configuration loader. Production defaults to app.itpay.ai; supported public overrides
+// are the official sandbox and dev Backends. Checkout
 // display-token persistence belongs to the cart session file, protected with
 // owner-only permissions. Provider secrets are explicitly out of scope here.
+import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { mkdirSync } from "node:fs";
 import { resolve } from "node:path";
@@ -12,11 +14,13 @@ import { DeviceAuthority } from "./device_authority.js";
 import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
-export const CLI_VERSION = "2.1.41";
-export const API_CONTRACT_REVISION = "sha256:b97025ee4e6f7539757d6aedbe193dd65b3a0f84f1111f678abb5e757065f888";
+export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
+export const CLI_VERSION = "2.1.44";
+export const API_CONTRACT_REVISION = "sha256:c1e1f459c1d3844f6eeae21535b532abb2e48c3e320173c4faccd62992890dcd";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";
+const TASK_JOURNAL_FILENAME = "tasks.json";
 export function cliDistribution(env = process.env) {
     if (env.ITPAY_DISTRIBUTION === "openclaw-skill-bundle")
         return "openclaw-skill-bundle";
@@ -27,7 +31,7 @@ export function cliDistribution(env = process.env) {
 export class BackendOverrideError extends Error {
     code = "backend_override_forbidden";
     constructor() {
-        super(`ITPAY_BACKEND_URL only supports ${DEFAULT_BASE_URL} or ${DEV_BASE_URL}`);
+        super(`ITPAY_BACKEND_URL only supports ${DEFAULT_BASE_URL}, ${SANDBOX_BASE_URL}, or ${DEV_BASE_URL}`);
         this.name = "BackendOverrideError";
     }
 }
@@ -35,26 +39,34 @@ export function resolveBackendURL(env = process.env) {
     const requested = env.ITPAY_BACKEND_URL?.trim();
     if (!requested || requested === DEFAULT_BASE_URL || requested === `${DEFAULT_BASE_URL}/`)
         return DEFAULT_BASE_URL;
+    if (requested === SANDBOX_BASE_URL || requested === `${SANDBOX_BASE_URL}/`)
+        return SANDBOX_BASE_URL;
     if (requested === DEV_BASE_URL || requested === `${DEV_BASE_URL}/`)
         return DEV_BASE_URL;
+    if (env.ITPAY_CLI_DEV === "1" && /^http:\/\/(localhost|127\.0\.0\.1):\d+\/?$/.test(requested))
+        return requested.replace(/\/$/, "");
     throw new BackendOverrideError();
 }
 export function qualifyBackendCommand(command, env = process.env) {
     const requested = env.ITPAY_BACKEND_URL?.trim();
-    if (requested !== DEV_BASE_URL && requested !== `${DEV_BASE_URL}/`)
+    if (!requested)
         return command;
-    if (!command.startsWith("itpay ") || command.startsWith(`ITPAY_BACKEND_URL=${DEV_BASE_URL} `))
+    const target = resolveBackendURL(env);
+    if (target === DEFAULT_BASE_URL)
         return command;
-    return `ITPAY_BACKEND_URL=${DEV_BASE_URL} ${command}`;
+    if (!command.startsWith("itpay ") || command.startsWith(`ITPAY_BACKEND_URL=${target} `))
+        return command;
+    return `ITPAY_BACKEND_URL=${target} ${command}`;
 }
 function stateFilename(filename, baseURL) {
-    if (baseURL !== DEV_BASE_URL)
+    if (baseURL === DEFAULT_BASE_URL)
         return filename;
+    const suffix = baseURL === SANDBOX_BASE_URL ? "sandbox" : baseURL === DEV_BASE_URL ? "dev" : `local-${createHash("sha256").update(baseURL).digest("hex").slice(0, 16)}`;
     const dot = filename.lastIndexOf(".");
-    return dot < 0 ? `${filename}.dev` : `${filename.slice(0, dot)}.dev${filename.slice(dot)}`;
+    return dot < 0 ? `${filename}.${suffix}` : `${filename.slice(0, dot)}.${suffix}${filename.slice(dot)}`;
 }
-function stateDir(env) {
-    return resolve(env.HOME || homedir(), CART_SESSION_DEFAULT_DIR);
+export function stateDir(env = process.env) {
+    return env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), CART_SESSION_DEFAULT_DIR);
 }
 export function cartSessionPath(env = process.env) {
     if (env.ITPAY_CART_SESSION_PATH) {
@@ -64,6 +76,16 @@ export function cartSessionPath(env = process.env) {
     mkdirSync(dir, { recursive: true });
     return resolve(dir, stateFilename(CART_SESSION_FILENAME, resolveBackendURL(env)));
 }
+// Task journal (AUTH04): paused Service Executions per backend, so a login
+// completion can resume the SAME task instead of guessing from the latest order.
+export function taskJournalPath(env = process.env) {
+    if (env.ITPAY_TASK_JOURNAL_PATH) {
+        return resolve(env.ITPAY_TASK_JOURNAL_PATH);
+    }
+    const dir = stateDir(env);
+    mkdirSync(dir, { recursive: true });
+    return resolve(dir, stateFilename(TASK_JOURNAL_FILENAME, resolveBackendURL(env)));
+}
 export function loadConfig(env = process.env) {
     const baseURL = resolveBackendURL(env);
     const bearerToken = env.ITPAY_BEARER_TOKEN || undefined;
@@ -74,7 +96,7 @@ export function loadConfig(env = process.env) {
     const ideImageDirOverride = env.ITPAY_IDE_IMAGE_DIR_OVERRIDE;
     return {
         baseURL,
-        environment: baseURL === DEV_BASE_URL ? "development" : "production",
+        environment: baseURL === DEFAULT_BASE_URL ? "production" : "development",
         ...(agentType ? { agentType } : {}),
         checkoutCurrency,
         idempotencyKey,
@@ -104,7 +126,15 @@ export function newBackendClient(config) {
             "X-ItPay-CLI-Version": CLI_VERSION,
             "X-ItPay-Contract-Revision": API_CONTRACT_REVISION,
         },
-        requestAuthorizer: (input) => authority.authorizationHeaders(input),
+        requestAuthorizer: (input) => {
+            if (/^\/v1\/(seller\/organizations(?:\/|\?|$)|library\/)/.test(input.path)) {
+                const token = config.bearerToken ?? sellerSessionToken(config.baseURL);
+                if (!token)
+                    throw new Error("Seller login required; run itpay sell auth login");
+                return Promise.resolve({ Authorization: `Bearer ${token}` });
+            }
+            return authority.authorizationHeaders(input);
+        },
         recoverAuthorization: () => authority.recoverAuthorization(),
     });
     return new BackendClient(http);