@itpay/cli 2.1.62 → 2.1.63

package/dist/src/main.js

@@ -3741,7 +3741,7 @@ __name(safeParseJson, "safeParseJson");
 
 // src/state/hub_credentials.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname2, resolve } from "node:path";
 
 // src/state/file_lock.ts
@@ -3963,12 +3963,7 @@ function importHubKeyUnlocked(apiKey, baseURL, env = process.env) {
     api_key: apiKey,
     created_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
-  const tmp = `${path2}.${randomUUID2()}.tmp`;
-  writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", mode: 384 });
-  chmodSync2(tmp, 384);
-  renameSync(tmp, path2);
-  chmodSync2(path2, 384);
+  saveHubProfileUnlocked(file.profiles["default"], env);
   return { key_prefix: apiKey.slice(0, 14) };
 }
 __name(importHubKeyUnlocked, "importHubKeyUnlocked");
@@ -4011,21 +4006,61 @@ function storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject,
     token_url: hubOAuthConfig(env).tokenURL,
     created_at: (/* @__PURE__ */ new Date()).toISOString()
   };
-  mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
-  const tmp = `${path2}.${randomUUID2()}.tmp`;
-  writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", mode: 384 });
-  chmodSync2(tmp, 384);
-  renameSync(tmp, path2);
-  chmodSync2(path2, 384);
+  saveHubProfileUnlocked(file.profiles["default"], env);
 }
 __name(storeHubSessionUnlocked, "storeHubSessionUnlocked");
+function saveHubProfileUnlocked(profile, env) {
+  const path2 = hubCredentialsPath(env);
+  const tmp = `${path2}.${randomUUID2()}.tmp`;
+  try {
+    const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+    file.profiles.default = profile;
+    mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
+    writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", flag: "wx", mode: 384 });
+    chmodSync2(tmp, 384);
+    renameSync(tmp, path2);
+  } catch {
+    throw new Error("credential_persistence_failed: could not save the original connection; stop and check private storage before retrying");
+  } finally {
+    try {
+      unlinkSync2(tmp);
+    } catch {
+    }
+  }
+}
+__name(saveHubProfileUnlocked, "saveHubProfileUnlocked");
+async function probeHubIdentity(resource, accessToken) {
+  let response;
+  try {
+    response = await fetch(`${resource}/v1/me`, {
+      headers: { Authorization: `Bearer ${accessToken}`, "X-ItPay-OAuth-Resource": resource },
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  }
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) throw new Error("authorization_required: original connection identity rejected");
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  }
+  try {
+    const identity = await response.json();
+    if (!identity || typeof identity !== "object" || Array.isArray(identity)) throw new Error();
+    const me = identity;
+    if (typeof me.buyer_id !== "string" || !me.buyer_id || typeof me.consumer_id !== "string" || !me.consumer_id) throw new Error();
+    return { buyer_id: me.buyer_id, consumer_id: me.consumer_id };
+  } catch {
+    throw new Error("connection_verification_pending: identity response invalid; preserve the original connection and references, do not reconnect");
+  }
+}
+__name(probeHubIdentity, "probeHubIdentity");
 function storedHubToken(env = process.env) {
   const path2 = hubCredentialsPath(env);
   if (!existsSync(path2)) return void 0;
   try {
     const file = JSON.parse(readFileSync2(path2, "utf8"));
     const p = file.profiles["default"];
-    if (!p?.access_token) return void 0;
+    if (!p?.access_token || p.identity_verification_pending) return void 0;
     if (p.expires_at && Date.parse(p.expires_at) <= Date.now()) return void 0;
     return p.access_token;
   } catch {
@@ -4043,31 +4078,68 @@ async function connectedHubToken(env = process.env, rejectedToken) {
   return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
     const p = storedHubProfile(env);
     if (!p?.access_token || !p.subject) throw new Error("authorization_required: reconnect ItPay");
-    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
-    if (p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
     const cfg = hubOAuthConfig(env);
-    if (!p.refresh_token || p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID) {
+    if (p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID || !p.consumer_id) {
       throw new Error("authorization_required: connection configuration changed");
     }
-    const response = await fetch(p.token_url, {
-      method: "POST",
-      headers: { "Content-Type": "application/x-www-form-urlencoded" },
-      body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
-      signal: AbortSignal.timeout(1e4)
-    });
-    if (!response.ok) throw new Error("authorization_required: connection refresh rejected");
-    const token = await response.json();
-    if (!token.access_token || token.token_type?.toLowerCase() !== "bearer" || !Number.isFinite(token.expires_in) || token.expires_in <= 0) {
-      throw new Error("authorization_required: invalid refresh response");
-    }
-    const who = await fetch(`${cfg.resource}/v1/me`, { headers: { Authorization: `Bearer ${token.access_token}` }, signal: AbortSignal.timeout(1e4) });
-    if (!who.ok) throw new Error("authorization_required: refreshed identity rejected");
-    const identity = await who.json();
-    if (identity.buyer_id !== p.subject || identity.consumer_id && identity.consumer_id !== p.consumer_id) {
+    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
+    if (!p.identity_verification_pending && p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
+    let candidate = p;
+    if (!p.identity_verification_pending || !(Date.parse(p.expires_at ?? "") > Date.now())) {
+      if (!p.refresh_token) throw new Error("authorization_required: reconnect the original ItPay connection");
+      let response;
+      try {
+        response = await fetch(p.token_url, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
+          signal: AbortSignal.timeout(1e4)
+        });
+      } catch {
+        throw new Error("connection_verification_pending: refresh outcome unknown; preserve the original connection and references, do not repeat authorization or business requests");
+      }
+      if (!response.ok) {
+        let rejected = response.status === 401 || response.status === 403;
+        if (response.status === 400) {
+          try {
+            const problem = await response.json();
+            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
+          } catch {
+          }
+        }
+        if (rejected) throw new Error("authorization_required: connection refresh rejected");
+        throw new Error("connection_verification_pending: refresh unavailable; preserve the original connection and references");
+      }
+      let token;
+      try {
+        token = await response.json();
+      } catch {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      if (!token || typeof token.access_token !== "string" || !token.access_token || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || (!Number.isFinite(Date.now() + token.expires_in * 1e3) || Date.now() + token.expires_in * 1e3 > 864e13) || token.refresh_token !== void 0 && (typeof token.refresh_token !== "string" || !token.refresh_token)) {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      const now = Date.now();
+      candidate = {
+        ...p,
+        access_token: token.access_token,
+        refresh_token: token.refresh_token ?? p.refresh_token,
+        expires_at: new Date(now + token.expires_in * 1e3).toISOString(),
+        refresh_after: new Date(now + token.expires_in * 1e3 - Math.min(3e4, Math.max(100, token.expires_in * 100))).toISOString(),
+        identity_verification_pending: true
+      };
+      saveHubProfileUnlocked(candidate, env);
+    }
+    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
+    if (identity.buyer_id !== p.subject || identity.consumer_id !== p.consumer_id) {
       throw new Error("authorization_required: refreshed identity changed");
     }
-    storeHubSessionUnlocked(token.access_token, token.refresh_token ?? p.refresh_token, token.expires_in, p.subject, cfg.resource, env, p.consumer_id);
-    return token.access_token;
+    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) {
+      throw new Error("connection_verification_pending: token expired during identity check; preserve the original connection and references");
+    }
+    delete candidate.identity_verification_pending;
+    saveHubProfileUnlocked(candidate, env);
+    return candidate.access_token;
   });
 }
 __name(connectedHubToken, "connectedHubToken");
@@ -4095,13 +4167,14 @@ function loadHubConfig(env = process.env) {
 }
 __name(loadHubConfig, "loadHubConfig");
 function toSdkConfig(cfg) {
+  const base = { baseUrl: cfg.baseURL, resource: cfg.baseURL.replace(/\/+$/, "") };
   if (cfg.bearerToken) {
-    return { baseUrl: cfg.baseURL, token: cfg.bearerToken };
+    return { ...base, token: cfg.bearerToken };
   }
   if (cfg.apiKey) {
-    return { baseUrl: cfg.baseURL, token: cfg.apiKey, apiKeyHeader: "X-ItPay-Key" };
+    return { ...base, token: cfg.apiKey, apiKeyHeader: "X-ItPay-Key" };
   }
-  return { baseUrl: cfg.baseURL };
+  return base;
 }
 __name(toSdkConfig, "toSdkConfig");
 var HubClient2 = class {
@@ -4167,14 +4240,14 @@ var HubClient2 = class {
       let token;
       if (this.cfg.sessionEnv) {
         token = await connectedHubToken(this.cfg.sessionEnv);
-        this.sdk = new HubClient({ baseUrl: this.cfg.baseURL, token });
+        this.sdk = new HubClient(toSdkConfig({ ...this.cfg, bearerToken: token }));
       }
       try {
         return await fn();
       } catch (err) {
         if (!(err instanceof HubApiError) || err.status !== 401 || err.envelope.error.code !== "unauthenticated" || !this.cfg.sessionEnv || !token) throw err;
         const refreshed = await connectedHubToken(this.cfg.sessionEnv, token);
-        this.sdk = new HubClient({ baseUrl: this.cfg.baseURL, token: refreshed });
+        this.sdk = new HubClient(toSdkConfig({ ...this.cfg, bearerToken: refreshed }));
         return await fn();
       }
     } catch (err) {
@@ -5807,7 +5880,7 @@ var HubTaskRequestError = class extends Error {
     super(error instanceof Error ? error.message : "original Hub request did not return a receipt");
     this.requestID = task.request_id;
     this.references = { request_id: task.request_id, ...task.run_id ? { run_id: task.run_id } : {}, ...task.intent_id ? { intent_id: task.intent_id } : {} };
-    this.code = error instanceof HttpError ? error.code : ["authorization_required", "idempotency_conflict", "invalid_state"].find((code) => this.message.startsWith(code + ":")) ?? "hub_request_unknown";
+    this.code = error instanceof HttpError ? error.code : ["authorization_required", "connection_verification_pending", "credential_persistence_failed", "idempotency_conflict", "invalid_state"].find((code) => this.message.startsWith(code + ":")) ?? "hub_request_unknown";
   }
 };
 async function dispatchOriginalTask(client, store, task, options) {
@@ -6177,12 +6250,15 @@ async function runHubConnect(options) {
     plainResult: ["\u6253\u5F00\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\uFF1A", `  ${authorizeURL}`]
   });
   const tokens = await done;
-  const meResponse = await fetch(`${cfg.resource}/v1/me`, {
-    headers: { Authorization: `Bearer ${tokens.accessToken}` },
-    signal: AbortSignal.timeout(1e4)
-  });
-  if (!meResponse.ok) throw new Error("authorization_required: could not verify connected identity");
-  const me = await meResponse.json();
+  let me;
+  try {
+    me = await probeHubIdentity(cfg.resource, tokens.accessToken);
+  } catch (error) {
+    if (error instanceof Error && error.message.startsWith("connection_verification_pending:")) {
+      throw new Error("connection_not_saved: identity verification unavailable; this connection was not saved and the existing connection was not replaced");
+    }
+    throw error;
+  }
   if (!me.buyer_id || (!me.consumer_id || me.consumer_id !== `oauth:${cfg.clientID}` && !me.consumer_id.startsWith(`oauth:${cfg.clientID}:`))) throw new Error("authorization_required: OAuth consumer mismatch");
   const subject = me.buyer_id;
   storeHubSession(tokens.accessToken, tokens.refreshToken, tokens.expiresIn, subject, cfg.resource, process.env, me.consumer_id);
@@ -6206,12 +6282,12 @@ __name(runHubConnect, "runHubConnect");
 
 // src/commands/api_commands.ts
 function reportCLIError(error, contract) {
-  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && error.message.startsWith("authorization_required:") ? "authorization_required" : contract?.code ?? "command_failed";
+  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && ["authorization_required", "connection_not_saved", "connection_verification_pending", "credential_persistence_failed"].some((code2) => error.message.startsWith(code2 + ":")) ? error.message.split(":", 1)[0] : contract?.code ?? "command_failed";
   const auth = code === "authorization_required" || code === "unauthenticated";
   const taskID = error instanceof HubTaskRequestError ? error.requestID : void 0;
   const references = error instanceof HubTaskRequestError ? error.references : void 0;
   const recover = taskID ? { command: qualifyItPayCommand(references?.run_id ? `itpay api run-status ${references.run_id}${contract?.jsonOutput ? " --json" : ""}` : `itpay api resume ${taskID}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: "\u8BFB\u53D6\u6216\u6062\u590D\u540C\u4E00\u539F\u4EFB\u52A1\uFF0C\u4E0D\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42" } : null;
-  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error) }, ...references ? { result: references } : {}, instruction: auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth ? { command: qualifyItPayCommand(`itpay api connect${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
+  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error) }, ...references ? { result: references } : {}, instruction: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF0C\u5C1A\u672A\u4FDD\u5B58\uFF1B\u539F\u6709\u8FDE\u63A5\u672A\u66FF\u6362\u3002\u670D\u52A1\u6062\u590D\u540E\u6309\u539F\u914D\u7F6E\u6B63\u5E38 connect\uFF0C\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_verification_pending" ? "\u539F\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u5F15\u7528\uFF0C\u4E0D\u91CD\u65B0\u6388\u6743\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002\u7A0D\u540E\u53EA\u8BFB\u6838\u5BF9\u539F\u4EFB\u52A1\u3002" : code === "credential_persistence_failed" ? "\u539F\u8FDE\u63A5\u672A\u80FD\u5B89\u5168\u843D\u76D8\uFF1B\u505C\u6B62\u91CD\u8BD5\u5E76\u6838\u5BF9\u79C1\u6709\u5B58\u50A8\uFF0C\u4E0D\u6E05\u72B6\u6001\u6216\u6362\u8EAB\u4EFD\u3002" : auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth || code === "connection_not_saved" ? { command: qualifyItPayCommand(`itpay api connect${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u672A\u4FDD\u5B58\uFF1B\u6309\u539F\u914D\u7F6E\u5B8C\u6210\u6B63\u5E38\u8FDE\u63A5" : "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required", "credential_persistence_failed"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
   process.exitCode = 1;
 }
 __name(reportCLIError, "reportCLIError");
@@ -6677,7 +6753,7 @@ __name(streamSSE, "streamSSE");
 
 // src/state/device_key.ts
 import { createHash as createHash5, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID as randomUUID6 } from "node:crypto";
-import { constants, closeSync, fstatSync, linkSync, lstatSync as lstatSync2, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync8, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "node:fs";
+import { constants, closeSync, fstatSync, linkSync, lstatSync as lstatSync2, mkdirSync as mkdirSync5, openSync, readFileSync as readFileSync8, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname4 } from "node:path";
 function invalid(code) {
   return Object.assign(new Error(code), { code });
@@ -6729,7 +6805,7 @@ function createDeviceKey(path2, existingIdentity) {
     return canonical;
   } finally {
     try {
-      unlinkSync2(temp);
+      unlinkSync3(temp);
     } catch (error) {
       throw Object.assign(error instanceof Error ? error : new Error("Key temporary cleanup failed"), { deviceStateOperation: "cleanup_private_key_temporary", canonicalKeyPublished: canonicalPublished });
     }
@@ -6739,7 +6815,7 @@ __name(createDeviceKey, "createDeviceKey");
 
 // src/state/device_session_cache.ts
 import { createHash as createHash6, randomUUID as randomUUID7 } from "node:crypto";
-import { constants as constants2, closeSync as closeSync2, fstatSync as fstatSync2, linkSync as linkSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync6, openSync as openSync2, readFileSync as readFileSync9, renameSync as renameSync4, readdirSync as readdirSync2, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "node:fs";
+import { constants as constants2, closeSync as closeSync2, fstatSync as fstatSync2, linkSync as linkSync2, lstatSync as lstatSync3, mkdirSync as mkdirSync6, openSync as openSync2, readFileSync as readFileSync9, renameSync as renameSync4, readdirSync as readdirSync2, unlinkSync as unlinkSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { join as join3 } from "node:path";
 function invalid2(code) {
   return Object.assign(new Error(code), { code });
@@ -6782,7 +6858,7 @@ function writeComplete(path2, text2, createOnly) {
     return true;
   } finally {
     try {
-      unlinkSync3(temp);
+      unlinkSync4(temp);
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -7346,7 +7422,7 @@ __name(checkAuthorizationBudget, "checkAuthorizationBudget");
 
 // src/state/operation_journal.ts
 import { createHash as createHash8, randomUUID as randomUUID9 } from "node:crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync4, linkSync as linkSync3, mkdirSync as mkdirSync7, readFileSync as readFileSync11, unlinkSync as unlinkSync4, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync4, linkSync as linkSync3, mkdirSync as mkdirSync7, readFileSync as readFileSync11, unlinkSync as unlinkSync5, writeFileSync as writeFileSync7 } from "node:fs";
 import { basename, resolve as resolve4 } from "node:path";
 var OperationJournal = class {
   constructor(legacyPath) {
@@ -7386,7 +7462,7 @@ var OperationJournal = class {
       }
     } finally {
       try {
-        unlinkSync4(temporaryPath);
+        unlinkSync5(temporaryPath);
       } catch (error) {
         if (error.code !== "ENOENT") throw error;
       }
@@ -12179,7 +12255,7 @@ __name(railAftercareOrder, "railAftercareOrder");
 
 // src/state/task_journal.ts
 import { randomUUID as randomUUID10, createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync5, linkSync as linkSync4, lstatSync as lstatSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync12, readdirSync as readdirSync4, unlinkSync as unlinkSync5, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync5, linkSync as linkSync4, lstatSync as lstatSync5, mkdirSync as mkdirSync9, readFileSync as readFileSync12, readdirSync as readdirSync4, unlinkSync as unlinkSync6, writeFileSync as writeFileSync8 } from "node:fs";
 import { join as join4 } from "node:path";
 var PAUSED_STAGES = /* @__PURE__ */ new Set(["login_required", "rate_limited", "quota_paused", "auth_pending", "awaiting_input"]);
 var TERMINAL_STAGES = /* @__PURE__ */ new Set(["completed", "delivered", "issued", "failed", "cancelled", "refunded"]);
@@ -12302,7 +12378,7 @@ var TaskJournal = class {
       linkSync4(temp, target2);
     } finally {
       try {
-        unlinkSync5(temp);
+        unlinkSync6(temp);
       } catch (e) {
         if (!object2(e) || e.code !== "ENOENT") throw e;
       }

package/dist/src/state/config.js

@@ -1,4 +1,4 @@
-const CLI_VERSION = "2.1.62";
+const CLI_VERSION = "2.1.63";
 const API_CONTRACT_REVISION = "sha256:f20af3780a0e12a79a6ca9507ba65167a4018338495af66d87931e55619b618a";
 export {
   API_CONTRACT_REVISION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.62",
+  "version": "2.1.63",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -148,5 +148,5 @@
     "services",
     "api"
   ],
-  "gitHead": "3a37b928152232141542065996bb2c76e748e21e"
+  "gitHead": "176112cd3f6ee08a740ae35b9a921d9340d03f10"
 }