@itpay/cli 2.1.63 → 2.1.65

package/dist/src/main.js

@@ -3064,268 +3064,804 @@ var require_commander = __commonJS({
   }
 });
 
-// src/commands/admin.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+// src/state/hub_credentials.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, resolve } from "node:path";
 
-// node_modules/@itpay/hub-client/dist/index.js
-var HUB_CONTRACT_REVISION = "hub.v1.2026-10-26.integration1";
-var isRunReceipt = /* @__PURE__ */ __name((r) => "run_id" in r, "isRunReceipt");
-var HubApiError = class extends Error {
-  static {
-    __name(this, "HubApiError");
-  }
-  status;
-  envelope;
-  constructor(status, envelope) {
-    super(`${status} ${envelope.error.code}: ${envelope.error.message}`);
-    this.status = status;
-    this.envelope = envelope;
-    this.name = "HubApiError";
-  }
-  get code() {
-    return this.envelope.error.code;
-  }
-};
-var HubClient = class {
-  static {
-    __name(this, "HubClient");
-  }
-  baseUrl;
-  token;
-  resource;
-  apiKeyHeader;
-  fetchImpl;
-  budgets;
-  constructor(opts) {
-    this.resource = opts.resource;
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.token = opts.token;
-    this.apiKeyHeader = opts.apiKeyHeader ?? "Authorization";
-    this.fetchImpl = opts.fetchImpl ?? fetch;
-    this.budgets = { metadata: 5e3, status: 5e3, action: 15e3, ...opts.requestBudgetsMs };
-    for (const value of Object.values(this.budgets))
-      if (!Number.isFinite(value) || value <= 0)
-        throw new Error("request budget must be finite and positive");
-  }
-  async request(method, path2, opts = {}) {
-    const url = new URL(this.baseUrl + path2);
-    for (const [k, v] of Object.entries(opts.query ?? {})) {
-      if (v !== void 0)
-        url.searchParams.set(k, String(v));
+// src/state/file_lock.ts
+import { chmodSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+var STALE_MS = 3e4;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+__name(sleepSync, "sleepSync");
+function ownerAlive(path2) {
+  try {
+    const st = lstatSync(path2);
+    if (st.isSymbolicLink()) return false;
+    if (Date.now() - st.mtimeMs < STALE_MS) return true;
+    const token = readFileSync(path2, "utf8");
+    const pid = Number(/^(\d+):/.exec(token)?.[1]);
+    if (!Number.isInteger(pid) || pid <= 0) return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
     }
-    const headers = { Accept: "application/json", "X-ItPay-Hub-Contract": HUB_CONTRACT_REVISION };
-    if (this.resource)
-      headers["X-ItPay-OAuth-Resource"] = this.resource;
-    if (this.token)
-      headers[this.apiKeyHeader] = this.apiKeyHeader === "Authorization" ? `Bearer ${this.token}` : this.token;
-    if (opts.body !== void 0)
-      headers["Content-Type"] = "application/json";
-    if (opts.idempotencyKey)
-      headers["Idempotency-Key"] = opts.idempotencyKey;
-    if (opts.payerCurrency)
-      headers["ItPay-Payment-Currency"] = opts.payerCurrency;
-    const init = { method, headers };
-    if (opts.body !== void 0)
-      init.body = JSON.stringify(opts.body);
-    const stage = path2.startsWith("/v1/runs/") && method === "GET" ? "status" : method === "GET" || path2 === "/v1/discover" ? "metadata" : "action";
-    const timeoutMs = Math.min(opts.timeoutMs ?? this.budgets[stage], this.budgets[stage]);
-    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
-      throw new Error("request budget exhausted");
-    const controller = new AbortController();
-    let timer;
-    const aborted = new Promise((_, reject) => {
-      controller.signal.addEventListener("abort", () => reject(new HubApiError(0, { error: { code: opts.signal?.aborted ? "request_cancelled" : "request_timeout", message: method === "POST" && path2 !== "/v1/discover" ? "Request outcome is unknown; read the original request/run before exact-key recovery. No automatic write retry." : `Hub ${stage} read timed out after ${timeoutMs} ms; no spending-budget conclusion. Keep the original reference and read it later.`, details: { stage, method, path: path2 } } })), { once: true });
-      timer = setTimeout(() => controller.abort(), timeoutMs);
-    });
-    const cancel = /* @__PURE__ */ __name(() => controller.abort(), "cancel");
-    opts.signal?.addEventListener("abort", cancel, { once: true });
-    if (opts.signal?.aborted)
-      controller.abort();
+  } catch {
+    return false;
+  }
+}
+__name(ownerAlive, "ownerAlive");
+function withFileLock(lockPath, fn) {
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
+  const token = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + 15e3;
+  for (; ; ) {
     try {
-      return await Promise.race([(async () => {
-        const res = await this.fetchImpl(url, { ...init, signal: controller.signal });
-        const serverRevision = res.headers.get("X-ItPay-Hub-Contract");
-        if (serverRevision && serverRevision !== HUB_CONTRACT_REVISION)
-          throw new HubApiError(409, { error: { code: "contract_mismatch", message: "Hub/SDK contract mismatch; install the paired CLI/MCP candidate before executing", details: { expected: HUB_CONTRACT_REVISION, received: serverRevision } } });
-        const text2 = await res.text();
-        const payload = text2 ? JSON.parse(text2) : void 0;
-        if (!res.ok) {
-          const p = payload;
-          if (opts.intentResponse && p && typeof p.intent_id === "string") {
-            return payload;
-          }
-          const raw = payload;
-          const envelope = raw && raw.error && typeof raw.error.code === "string" ? raw : { error: { code: "internal", message: `HTTP ${res.status}` } };
-          throw new HubApiError(res.status, envelope);
+      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
+      chmodSync(lockPath, 384);
+      break;
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EEXIST") throw error;
+      if (!ownerAlive(lockPath)) {
+        try {
+          unlinkSync(lockPath);
+        } catch {
         }
-        return payload;
-      })(), aborted]);
-    } finally {
-      clearTimeout(timer);
-      opts.signal?.removeEventListener("abort", cancel);
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error(`task store lock busy: ${lockPath}`);
+      sleepSync(20);
     }
   }
-  listCommerceTransactions(cursor) {
-    return this.request("GET", "/v1/me/transactions" + (cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""));
-  }
-  getPurchaseCollectionOptions(transactionId) {
-    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection-options`);
-  }
-  getPurchaseCollection(transactionId) {
-    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection`);
-  }
-  requestPurchaseCollection(transactionId, body) {
-    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection`, { body });
-  }
-  refreshPurchaseCollection(transactionId) {
-    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection/refresh`, { body: {} });
-  }
-  getSupplementCollectionOptions(caseId) {
-    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection-options`);
-  }
-  getSupplementCollection(caseId) {
-    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection`);
-  }
-  requestSupplementCollection(caseId, body) {
-    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection`, { body });
-  }
-  refreshSupplementCollection(caseId) {
-    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection/refresh`, { body: {} });
-  }
-  getCommerceTransaction(id) {
-    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(id)}`);
-  }
-  confirmCommerceAfterSales(id, body, idempotencyKey) {
-    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(id)}/after-sales`, { body, idempotencyKey });
-  }
-  getCommerceAfterSales(id) {
-    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(id)}`);
-  }
-  getCommerceRefund(id) {
-    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(id)}`);
-  }
-  getCommerceAfterSalesQuoteOptions(transactionId, cursor) {
-    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/quote-options${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`);
-  }
-  prepareCommerceAfterSalesQuote(transactionId, body, idempotencyKey) {
-    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/quote-requests`, { body, idempotencyKey });
-  }
-  getCommerceQuoteCredentialRequirements(requestId) {
-    return this.request("GET", `/v1/me/quote-requests/${encodeURIComponent(requestId)}/credential-requirements`);
-  }
-  getCommerceCaseCredentialRequirements(caseId) {
-    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/credential-requirements`);
-  }
-  getCommerceRefundCredentialRequirements(refundId, mode) {
-    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(refundId)}/credential-requirements/${mode}`);
-  }
-  startCommerceAfterSalesQuote(requestId, body) {
-    return this.request("POST", `/v1/me/quote-requests/${encodeURIComponent(requestId)}/execution`, { body });
-  }
-  getCommerceAfterSalesQuoteRequest(requestId) {
-    return this.request("GET", `/v1/me/quote-requests/${encodeURIComponent(requestId)}`);
-  }
-  getCommerceAfterSalesExecution(caseId) {
-    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/execution`);
-  }
-  startCommerceAfterSalesExecution(caseId, body) {
-    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/execution`, { body });
-  }
-  getCommerceRefundExecutionAuthorization(refundId) {
-    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(refundId)}/execution-authorization`);
-  }
-  authorizeCommerceRefundExecution(refundId, body) {
-    return this.request("POST", `/v1/me/refunds/${encodeURIComponent(refundId)}/execution-authorization`, { body });
+  try {
+    return fn();
+  } finally {
+    try {
+      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
+    } catch {
+    }
   }
-  requestCommerceRefund(caseId, body, idempotencyKey) {
-    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/refunds`, { body, idempotencyKey });
+}
+__name(withFileLock, "withFileLock");
+async function withAsyncFileLock(lockPath, fn) {
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
+  const token = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + 2e4;
+  for (; ; ) {
+    try {
+      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (!ownerAlive(lockPath)) {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("credential refresh lock busy");
+      await new Promise((resolve10) => setTimeout(resolve10, 20));
+    }
   }
-  requestSupplementRefund(caseId, body, idempotencyKey) {
-    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/supplement-refunds`, { body, idempotencyKey });
+  try {
+    return await fn();
+  } finally {
+    try {
+      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
+    } catch {
+    }
   }
-  createAPIIngestion(body, idempotencyKey) {
-    return this.request("POST", "/v1/me/api-ingestions", { body, idempotencyKey });
-  }
-  listAPIIngestions() {
-    return this.request("GET", "/v1/me/api-ingestions");
-  }
-  getAPIIngestion(jobId) {
-    return this.request("GET", `/v1/me/api-ingestions/${encodeURIComponent(jobId)}`);
+}
+__name(withAsyncFileLock, "withAsyncFileLock");
+
+// src/state/hub_oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+function hubOAuthConfig(env = process.env) {
+  const devHub = (env.ITPAY_HUB_URL ?? "").replace(/\/+$/, "") === "https://market-v4-dev.itpay.ai";
+  const issuer = (env.ITPAY_HUB_OAUTH_ISSUER ?? (devHub ? "https://auth-v4-dev.itpay.ai" : "http://localhost:24444")).replace(/\/+$/, "");
+  return {
+    authorizeURL: `${issuer}/oauth2/auth`,
+    tokenURL: `${issuer}/oauth2/token`,
+    clientID: env.ITPAY_HUB_OAUTH_CLIENT ?? "itpay-cli-local",
+    resource: (env.ITPAY_HUB_URL ?? "http://localhost:18090").replace(/\/+$/, ""),
+    scope: env.ITPAY_HUB_OAUTH_SCOPE ?? "openid offline_access itpay.hub"
+  };
+}
+__name(hubOAuthConfig, "hubOAuthConfig");
+function pkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+__name(pkce, "pkce");
+async function runConnectFlow(cfg, timeoutMs = 3e5) {
+  const { verifier, challenge } = pkce();
+  const state = randomBytes(16).toString("hex");
+  const server = createServer();
+  const done = new Promise((resolvePromise, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("connect timed out waiting for browser authorization"));
+    }, timeoutMs);
+    server.on("request", (req, res) => {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const finish = /* @__PURE__ */ __name((ok, msg) => {
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(`<!doctype html><meta charset="utf-8"><title>ItPay</title><body style="font-family:system-ui;padding:3em;text-align:center"><h2>${msg.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;")}</h2><p>\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u56DE\u5230\u7EC8\u7AEF\u7EE7\u7EED\u3002</p></body>`);
+      }, "finish");
+      (async () => {
+        if (u.pathname !== "/callback") return finish(false, "\u65E0\u6548\u7684\u56DE\u8C03");
+        if (u.searchParams.get("state") !== state) return finish(false, "state \u4E0D\u5339\u914D");
+        if (u.searchParams.get("error")) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "\u6388\u6743\u88AB\u62D2\u7EDD");
+          reject(new Error("authorization_required: consent denied"));
+          return;
+        }
+        const code = u.searchParams.get("code");
+        if (!code) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "\u7F3A\u5C11 code");
+          reject(new Error("missing code"));
+          return;
+        }
+        const form = new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: `http://127.0.0.1:${server.address().port}/callback`,
+          client_id: cfg.clientID,
+          code_verifier: verifier,
+          resource: cfg.resource
+        });
+        const tok = await fetch(cfg.tokenURL, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: form,
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (!tok.ok) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "token \u4EA4\u6362\u5931\u8D25");
+          reject(new Error(`token endpoint ${tok.status}`));
+          return;
+        }
+        const t = await tok.json();
+        clearTimeout(timer);
+        server.close();
+        finish(true, "ItPay \u5DF2\u8FDE\u63A5");
+        resolvePromise({ accessToken: t.access_token, refreshToken: t.refresh_token, expiresIn: t.expires_in });
+      })().catch((e) => {
+        clearTimeout(timer);
+        server.close();
+        reject(e);
+      });
+    });
+  });
+  await new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolvePromise());
+  });
+  const port = server.address().port;
+  const authorizeURL = `${cfg.authorizeURL}?` + new URLSearchParams({
+    response_type: "code",
+    client_id: cfg.clientID,
+    redirect_uri: `http://127.0.0.1:${port}/callback`,
+    scope: cfg.scope,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    resource: cfg.resource
+  }).toString();
+  return { authorizeURL, done };
+}
+__name(runConnectFlow, "runConnectFlow");
+
+// src/state/hub_credentials.ts
+import { homedir } from "node:os";
+function hubCredentialsPath(env = process.env) {
+  const dir = env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), ".itpay-v3");
+  const suffix = createHash2("sha256").update(env.ITPAY_HUB_URL ?? "http://localhost:18090").digest("hex").slice(0, 12);
+  return resolve(dir, `hub-credentials.${suffix}.json`);
+}
+__name(hubCredentialsPath, "hubCredentialsPath");
+function importHubKeyUnlocked(apiKey, baseURL, env = process.env) {
+  if (!/^itk_[A-Za-z0-9_-]{8,}$/.test(apiKey)) {
+    throw new Error("invalid key format \u2014 expected an itk_ API key");
   }
-  retryAPIIngestion(jobId) {
-    return this.request("POST", `/v1/me/api-ingestions/${encodeURIComponent(jobId)}/retry`, { body: {} });
+  const path2 = hubCredentialsPath(env);
+  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+  file.profiles["default"] = {
+    base_url: baseURL,
+    key_prefix: apiKey.slice(0, 14),
+    api_key: apiKey,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveHubProfileUnlocked(file.profiles["default"], env);
+  return { key_prefix: apiKey.slice(0, 14) };
+}
+__name(importHubKeyUnlocked, "importHubKeyUnlocked");
+function storedHubKey(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    return file.profiles["default"]?.api_key;
+  } catch {
+    return void 0;
   }
-  discover(req = {}) {
-    return this.request("POST", "/v1/discover", { body: req });
+}
+__name(storedHubKey, "storedHubKey");
+function storedHubKeyPrefix(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    return file.profiles["default"]?.key_prefix;
+  } catch {
+    return void 0;
   }
-  inspect(operationId) {
-    return this.request("GET", `/v1/operations/${encodeURIComponent(operationId)}`);
+}
+__name(storedHubKeyPrefix, "storedHubKeyPrefix");
+function storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
+  const path2 = hubCredentialsPath(env);
+  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+  const issuedAt = Date.now();
+  const margin = Math.min(3e4, Math.max(100, expiresIn * 100));
+  file.profiles["default"] = {
+    base_url: baseURL,
+    access_token: accessToken,
+    ...refreshToken ? { refresh_token: refreshToken } : {},
+    expires_at: new Date(issuedAt + expiresIn * 1e3).toISOString(),
+    refresh_after: new Date(issuedAt + expiresIn * 1e3 - margin).toISOString(),
+    ...subject ? { subject } : {},
+    consumer_id: consumerID ?? `oauth:${hubOAuthConfig(env).clientID}`,
+    client_id: hubOAuthConfig(env).clientID,
+    token_url: hubOAuthConfig(env).tokenURL,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveHubProfileUnlocked(file.profiles["default"], env);
+}
+__name(storeHubSessionUnlocked, "storeHubSessionUnlocked");
+function saveHubProfileUnlocked(profile, env) {
+  const path2 = hubCredentialsPath(env);
+  const tmp = `${path2}.${randomUUID2()}.tmp`;
+  try {
+    const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+    file.profiles.default = profile;
+    mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
+    writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", flag: "wx", mode: 384 });
+    chmodSync2(tmp, 384);
+    renameSync(tmp, path2);
+  } catch {
+    throw new Error("credential_persistence_failed: could not save the original connection; stop and check private storage before retrying");
+  } finally {
+    try {
+      unlinkSync2(tmp);
+    } catch {
+    }
   }
-  /** The single run-creation entry. Always sends expected_publication_id. */
-  run(operationId, admission, idempotencyKey, payment = {}) {
-    return this.request("POST", `/v1/operations/${encodeURIComponent(operationId)}/runs`, {
-      body: admission,
-      idempotencyKey,
-      payerCurrency: payment.payerCurrency,
-      intentResponse: true
+}
+__name(saveHubProfileUnlocked, "saveHubProfileUnlocked");
+async function probeHubIdentity(resource, accessToken) {
+  let response;
+  try {
+    response = await fetch(`${resource}/v1/me`, {
+      headers: { Authorization: `Bearer ${accessToken}`, "X-ItPay-OAuth-Resource": resource },
+      signal: AbortSignal.timeout(1e4)
     });
+  } catch {
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
   }
-  getRun(runId, options = {}) {
-    const { actionRef, ...budget } = options;
-    const query = actionRef === void 0 ? "" : `?${new URLSearchParams({ action_ref: actionRef })}`;
-    return this.request("GET", `/v1/runs/${encodeURIComponent(runId)}${query}`, budget);
-  }
-  serviceAction(runId, actionRef, input, idempotencyKey, expectedPurpose) {
-    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/service-actions`, { body: { action_ref: actionRef, input, ...expectedPurpose ? { expected_purpose: expectedPurpose } : {} }, idempotencyKey });
-  }
-  servicePurchaseReview(runId) {
-    return this.request("GET", `/v1/runs/${encodeURIComponent(runId)}/purchase`);
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) throw new Error("authorization_required: original connection identity rejected");
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
   }
-  servicePurchaseConfirm(runId, input) {
-    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/purchase/confirm`, { body: input });
+  try {
+    const identity = await response.json();
+    if (!identity || typeof identity !== "object" || Array.isArray(identity)) throw new Error();
+    const me = identity;
+    if (typeof me.buyer_id !== "string" || !me.buyer_id || typeof me.consumer_id !== "string" || !me.consumer_id) throw new Error();
+    return { buyer_id: me.buyer_id, consumer_id: me.consumer_id };
+  } catch {
+    throw new Error("connection_verification_pending: identity response invalid; preserve the original connection and references, do not reconnect");
   }
-  servicePurchaseResume(runId) {
-    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/purchase/resume`, { body: {} });
+}
+__name(probeHubIdentity, "probeHubIdentity");
+function storedHubToken(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2) || existsSync(path2 + ".recovery.json")) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    const p = file.profiles["default"];
+    if (!p?.access_token || p.identity_verification_pending) return void 0;
+    if (p.expires_at && Date.parse(p.expires_at) <= Date.now()) return void 0;
+    return p.access_token;
+  } catch {
+    return void 0;
   }
-  serviceAftercare(runId, mode, caseId, input = {}, idempotencyKey) {
-    if (!["directory", "get", "create", "respond", "cancel"].includes(mode))
-      throw new Error("unsupported original aftercare mode");
-    if (["get", "respond", "cancel"].includes(mode) && !caseId)
-      throw new Error("original case required");
-    const root = `/v1/runs/${encodeURIComponent(runId)}/aftercare`;
-    if (mode === "directory")
-      return this.request("GET", root);
-    if (mode === "get")
-      return this.request("GET", `${root}/${encodeURIComponent(caseId)}`);
-    return this.request("POST", mode === "create" ? root : `${root}/${encodeURIComponent(caseId)}/${mode}`, { body: input, ...idempotencyKey ? { idempotencyKey } : {} });
+}
+__name(storedHubToken, "storedHubToken");
+function storedHubProfile(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  return JSON.parse(readFileSync2(path2, "utf8")).profiles.default;
+}
+__name(storedHubProfile, "storedHubProfile");
+async function connectedHubToken(env = process.env, rejectedToken) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    if (existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_verification_pending: original recovery pending; only api recover-connection may verify its candidate, no business retry");
+    const p = storedHubProfile(env);
+    if (!p?.access_token || !p.subject) throw new Error("authorization_required: reconnect ItPay");
+    const cfg = hubOAuthConfig(env);
+    if (p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID || !p.consumer_id) {
+      throw new Error("authorization_required: connection configuration changed");
+    }
+    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
+    if (!p.identity_verification_pending && p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
+    let candidate = p;
+    if (!p.identity_verification_pending || !(Date.parse(p.expires_at ?? "") > Date.now())) {
+      if (!p.refresh_token) throw new Error("authorization_required: reconnect the original ItPay connection");
+      let response;
+      try {
+        response = await fetch(p.token_url, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
+          signal: AbortSignal.timeout(1e4)
+        });
+      } catch {
+        throw new Error("connection_verification_pending: refresh outcome unknown; preserve the original connection and references, do not repeat authorization or business requests");
+      }
+      if (!response.ok) {
+        let rejected = response.status === 401 || response.status === 403;
+        if (response.status === 400) {
+          try {
+            const problem = await response.json();
+            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
+          } catch {
+          }
+        }
+        if (rejected) throw new Error("authorization_required: connection refresh rejected");
+        throw new Error("connection_verification_pending: refresh unavailable; preserve the original connection and references");
+      }
+      let token;
+      try {
+        token = await response.json();
+      } catch {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      if (!token || typeof token.access_token !== "string" || !token.access_token || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || (!Number.isFinite(Date.now() + token.expires_in * 1e3) || Date.now() + token.expires_in * 1e3 > 864e13) || token.refresh_token !== void 0 && (typeof token.refresh_token !== "string" || !token.refresh_token)) {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      const now = Date.now();
+      candidate = {
+        ...p,
+        access_token: token.access_token,
+        refresh_token: token.refresh_token ?? p.refresh_token,
+        expires_at: new Date(now + token.expires_in * 1e3).toISOString(),
+        refresh_after: new Date(now + token.expires_in * 1e3 - Math.min(3e4, Math.max(100, token.expires_in * 100))).toISOString(),
+        identity_verification_pending: true
+      };
+      saveHubProfileUnlocked(candidate, env);
+    }
+    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
+    if (identity.buyer_id !== p.subject || identity.consumer_id !== p.consumer_id) {
+      throw new Error("authorization_required: refreshed identity changed");
+    }
+    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) {
+      throw new Error("connection_verification_pending: token expired during identity check; preserve the original connection and references");
+    }
+    delete candidate.identity_verification_pending;
+    saveHubProfileUnlocked(candidate, env);
+    return candidate.access_token;
+  });
+}
+__name(connectedHubToken, "connectedHubToken");
+function importHubKey(apiKey, baseURL, env = process.env) {
+  return withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => importHubKeyUnlocked(apiKey, baseURL, env));
+}
+__name(importHubKey, "importHubKey");
+async function recoverHubConnection(env = process.env) {
+  await withOriginalHubCandidate(env);
+}
+__name(recoverHubConnection, "recoverHubConnection");
+async function readOriginalHubReceipt(requestKey, env = process.env) {
+  if (!requestKey || requestKey.length > 512 || /[\r\n\0]/.test(requestKey)) throw new Error("receipt_denied: exact original request key required");
+  return withOriginalHubCandidate(env, requestKey);
+}
+__name(readOriginalHubReceipt, "readOriginalHubReceipt");
+async function withOriginalHubCandidate(env, receiptRequest) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    const original = storedHubProfile(env), cfg = hubOAuthConfig(env);
+    if (!original?.subject || !original.consumer_id || !original.refresh_token || original.api_key || original.base_url !== cfg.resource || original.client_id !== cfg.clientID || original.token_url !== cfg.tokenURL || env.ITPAY_HUB_KEY || env.ITPAY_HUB_TOKEN) throw new Error("connection_recovery_denied: original OAuth binding and refresh proof required; preserve profile and tasks");
+    const path2 = hubCredentialsPath(env) + ".recovery.json";
+    const binding = { base_url: original.base_url, subject: original.subject, consumer_id: original.consumer_id, client_id: original.client_id, token_url: original.token_url };
+    const save = /* @__PURE__ */ __name((pending2) => {
+      const tmp = path2 + "." + randomUUID2() + ".tmp";
+      try {
+        writeFileSync2(tmp, JSON.stringify(pending2), { flag: "wx", mode: 384 });
+        renameSync(tmp, path2);
+      } finally {
+        try {
+          unlinkSync2(tmp);
+        } catch {
+        }
+      }
+    }, "save");
+    let pending;
+    let refreshSource = original;
+    if (existsSync(path2)) {
+      try {
+        pending = JSON.parse(readFileSync2(path2, "utf8"));
+      } catch {
+        throw new Error("connection_recovery_denied: private recovery material unreadable; preserve original profile");
+      }
+      if (!pending || typeof pending !== "object" || JSON.stringify(pending.binding) !== JSON.stringify(binding)) throw new Error("connection_recovery_denied: recovery binding changed; preserve original profile");
+      if (pending.phase !== "candidate" || !pending.profile) throw new Error("connection_verification_pending: refresh outcome unknown; preserve private recovery material, do not repeat refresh or connect");
+      if (!Object.entries(binding).every(([k, v]) => pending.profile[k] === v)) throw new Error("connection_recovery_denied: private candidate binding mismatch; preserve original profile");
+    }
+    if (!pending || !(Date.parse(pending.profile?.expires_at ?? "") > Date.now())) {
+      refreshSource = pending?.profile ?? original;
+      if (!refreshSource.refresh_token) throw new Error("connection_recovery_denied: original refresh proof unavailable; preserve profile and candidate");
+      save({ binding, phase: "refresh_unknown", profile: refreshSource });
+      let response2;
+      try {
+        response2 = await fetch(cfg.tokenURL, { method: "POST", redirect: "error", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshSource.refresh_token, client_id: cfg.clientID, resource: cfg.resource }), signal: AbortSignal.timeout(1e4) });
+      } catch {
+        throw new Error("connection_verification_pending: refresh outcome unknown; preserve original profile and private recovery material");
+      }
+      if (!response2.ok) {
+        let rejected = response2.status === 401 || response2.status === 403;
+        if (response2.status === 400) {
+          try {
+            const problem = await response2.json();
+            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
+          } catch {
+          }
+        }
+        if (rejected) throw new Error("connection_recovery_denied: original refresh proof rejected; preserve profile and tasks, do not create a replacement connection");
+        throw new Error("connection_verification_pending: refresh unavailable or outcome unknown; preserve original profile and private recovery material");
+      }
+      let t;
+      try {
+        t = await response2.json();
+      } catch {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve private recovery material");
+      }
+      if (!t || typeof t !== "object" || typeof t.access_token !== "string" || !t.access_token || typeof t.token_type !== "string" || t.token_type.toLowerCase() !== "bearer" || typeof t.expires_in !== "number" || !Number.isFinite(t.expires_in) || t.expires_in <= 0 || Date.now() + t.expires_in * 1e3 > 864e13 || t.refresh_token !== void 0 && (typeof t.refresh_token !== "string" || !t.refresh_token)) throw new Error("connection_verification_pending: invalid refresh response; preserve private recovery material");
+      const now = Date.now();
+      pending = { binding, phase: "candidate", profile: { ...original, access_token: t.access_token, refresh_token: t.refresh_token ?? refreshSource.refresh_token, expires_at: new Date(now + t.expires_in * 1e3).toISOString(), refresh_after: new Date(now + t.expires_in * 1e3 - Math.min(3e4, Math.max(100, t.expires_in * 100))).toISOString(), identity_verification_pending: true } };
+      save(pending);
+    }
+    const candidate = pending.profile;
+    if (!Object.entries(binding).every(([k, v]) => candidate[k] === v)) throw new Error("connection_recovery_denied: private candidate binding mismatch; preserve original profile");
+    if (!candidate.access_token || !(Date.parse(candidate.expires_at ?? "") > Date.now())) throw new Error("connection_recovery_denied: recovery candidate expired; preserve private proof and request owner review");
+    if (receiptRequest !== void 0) {
+      let response2;
+      try {
+        response2 = await fetch(cfg.resource + "/v1/requests/" + encodeURIComponent(receiptRequest), { method: "GET", redirect: "error", headers: { Authorization: "Bearer " + candidate.access_token, "X-ItPay-OAuth-Resource": cfg.resource, "X-ItPay-Receipt-Only": "1", "X-ItPay-Expected-Buyer": binding.subject, "X-ItPay-Expected-Consumer": binding.consumer_id }, signal: AbortSignal.timeout(1e4) });
+      } catch {
+        throw new Error("receipt_unavailable: original receipt unavailable; preserve profile and private candidate");
+      }
+      if (!response2.ok) throw new Error("receipt_denied: original receipt rejected; preserve profile and private candidate");
+      const result2 = await response2.json();
+      if (result2?.request_id !== receiptRequest || result2.read_only !== true || typeof result2.run?.run_id !== "string") throw new Error("receipt_denied: invalid original receipt reply");
+      return result2;
+    }
+    let response;
+    try {
+      response = await fetch(cfg.resource + "/v1/connection/recover", { method: "POST", redirect: "error", headers: { "Content-Type": "application/json", Authorization: "Bearer " + candidate.access_token, "X-ItPay-OAuth-Resource": cfg.resource }, body: JSON.stringify({ expected_buyer_id: binding.subject, expected_consumer_id: binding.consumer_id }), signal: AbortSignal.timeout(1e4) });
+    } catch {
+      throw new Error("connection_verification_pending: recovery outcome unknown; preserve original profile and candidate; retry only this recovery, never business");
+    }
+    if (response.status === 409) throw new Error("connection_recovery_conflict: another active connection requires owner review; preserve original profile, tasks and candidate");
+    if (response.status >= 500 || response.status === 404 || response.status === 405) throw new Error("connection_verification_pending: paired recovery owner unavailable; preserve profile and candidate");
+    if (!response.ok) throw new Error("connection_recovery_denied: owner rejected original binding; preserve profile, tasks and private candidate");
+    let result;
+    try {
+      result = await response.json();
+    } catch {
+      throw new Error("connection_verification_pending: recovery reply invalid; preserve original profile and candidate");
+    }
+    if (!result || typeof result !== "object" || result.buyer_id !== binding.subject || result.consumer_id !== binding.consumer_id || result.status !== "recovered") throw new Error("connection_recovery_denied: owner recovery binding mismatch; preserve original profile");
+    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
+    if (identity.buyer_id !== binding.subject || identity.consumer_id !== binding.consumer_id) throw new Error("connection_recovery_denied: verified original identity mismatch; preserve profile and tasks");
+    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) throw new Error("connection_verification_pending: candidate expired during verification; preserve original profile");
+    delete candidate.identity_verification_pending;
+    saveHubProfileUnlocked(candidate, env);
+    unlinkSync2(path2);
+  });
+}
+__name(withOriginalHubCandidate, "withOriginalHubCandidate");
+async function withNewHubSession(action, env = process.env) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    if (storedHubProfile(env) || existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_recovery_denied: existing connection preserved; use api recover-connection, never replace it");
+    return action((access, refresh, seconds, subject, base, consumer) => {
+      if (storedHubProfile(env) || existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_recovery_denied: original profile appeared; new connection not saved");
+      storeHubSessionUnlocked(access, refresh, seconds, subject, base, env, consumer);
+    });
+  });
+}
+__name(withNewHubSession, "withNewHubSession");
+
+// src/commands/admin.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+
+// node_modules/@itpay/hub-client/dist/index.js
+var HUB_CONTRACT_REVISION = "hub.v1.2026-10-26.integration1";
+var isRunReceipt = /* @__PURE__ */ __name((r) => "run_id" in r, "isRunReceipt");
+var HubApiError = class extends Error {
+  static {
+    __name(this, "HubApiError");
   }
-  createAPIPaymentRequest(intentId, payment = {}) {
-    return this.request("POST", `/v1/intents/${encodeURIComponent(intentId)}/payment-request`, { payerCurrency: payment.payerCurrency });
+  status;
+  envelope;
+  constructor(status, envelope) {
+    super(`${status} ${envelope.error.code}: ${envelope.error.message}`);
+    this.status = status;
+    this.envelope = envelope;
+    this.name = "HubApiError";
   }
-  getAPIPaymentRequest(intentId) {
-    return this.request("GET", `/v1/intents/${encodeURIComponent(intentId)}/payment-request`);
+  get code() {
+    return this.envelope.error.code;
   }
-  continueIntent(intentId, idempotencyKey, body = {}) {
-    return this.request("POST", `/v1/intents/${encodeURIComponent(intentId)}/continue`, {
-      body,
-      idempotencyKey,
-      intentResponse: true
-    });
+};
+var HubClient = class {
+  static {
+    __name(this, "HubClient");
   }
-  me() {
-    return this.request("GET", "/v1/me");
+  baseUrl;
+  token;
+  resource;
+  apiKeyHeader;
+  fetchImpl;
+  budgets;
+  constructor(opts) {
+    this.resource = opts.resource;
+    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
+    this.token = opts.token;
+    this.apiKeyHeader = opts.apiKeyHeader ?? "Authorization";
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.budgets = { metadata: 5e3, status: 5e3, action: 15e3, ...opts.requestBudgetsMs };
+    for (const value of Object.values(this.budgets))
+      if (!Number.isFinite(value) || value <= 0)
+        throw new Error("request budget must be finite and positive");
   }
-  usage() {
-    return this.request("GET", "/v1/me/usage");
+  async request(method, path2, opts = {}) {
+    const url = new URL(this.baseUrl + path2);
+    for (const [k, v] of Object.entries(opts.query ?? {})) {
+      if (v !== void 0)
+        url.searchParams.set(k, String(v));
+    }
+    const headers = { Accept: "application/json", "X-ItPay-Hub-Contract": HUB_CONTRACT_REVISION };
+    if (this.resource)
+      headers["X-ItPay-OAuth-Resource"] = this.resource;
+    if (this.token)
+      headers[this.apiKeyHeader] = this.apiKeyHeader === "Authorization" ? `Bearer ${this.token}` : this.token;
+    if (opts.body !== void 0)
+      headers["Content-Type"] = "application/json";
+    if (opts.idempotencyKey)
+      headers["Idempotency-Key"] = opts.idempotencyKey;
+    if (opts.payerCurrency)
+      headers["ItPay-Payment-Currency"] = opts.payerCurrency;
+    const init = { method, headers };
+    if (opts.body !== void 0)
+      init.body = JSON.stringify(opts.body);
+    const stage = (path2.startsWith("/v1/runs/") || path2.startsWith("/v1/requests/")) && method === "GET" ? "status" : method === "GET" || path2 === "/v1/discover" ? "metadata" : "action";
+    const timeoutMs = Math.min(opts.timeoutMs ?? this.budgets[stage], this.budgets[stage]);
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0)
+      throw new Error("request budget exhausted");
+    const controller = new AbortController();
+    let timer;
+    const aborted = new Promise((_, reject) => {
+      controller.signal.addEventListener("abort", () => reject(new HubApiError(0, { error: { code: opts.signal?.aborted ? "request_cancelled" : "request_timeout", message: method === "POST" && path2 !== "/v1/discover" ? "Request outcome is unknown; read the original request/run before exact-key recovery. No automatic write retry." : `Hub ${stage} read timed out after ${timeoutMs} ms; no spending-budget conclusion. Keep the original reference and read it later.`, details: { stage, method, path: path2 } } })), { once: true });
+      timer = setTimeout(() => controller.abort(), timeoutMs);
+    });
+    const cancel = /* @__PURE__ */ __name(() => controller.abort(), "cancel");
+    opts.signal?.addEventListener("abort", cancel, { once: true });
+    if (opts.signal?.aborted)
+      controller.abort();
+    try {
+      return await Promise.race([(async () => {
+        const res = await this.fetchImpl(url, { ...init, signal: controller.signal });
+        const serverRevision = res.headers.get("X-ItPay-Hub-Contract");
+        if (serverRevision && serverRevision !== HUB_CONTRACT_REVISION)
+          throw new HubApiError(409, { error: { code: "contract_mismatch", message: "Hub/SDK contract mismatch; install the paired CLI/MCP candidate before executing", details: { expected: HUB_CONTRACT_REVISION, received: serverRevision } } });
+        const text2 = await res.text();
+        const payload = text2 ? JSON.parse(text2) : void 0;
+        if (!res.ok) {
+          const p = payload;
+          if (opts.intentResponse && p && typeof p.intent_id === "string") {
+            return payload;
+          }
+          const raw = payload;
+          const envelope = raw && raw.error && typeof raw.error.code === "string" ? raw : { error: { code: "internal", message: `HTTP ${res.status}` } };
+          throw new HubApiError(res.status, envelope);
+        }
+        return payload;
+      })(), aborted]);
+    } finally {
+      clearTimeout(timer);
+      opts.signal?.removeEventListener("abort", cancel);
+    }
   }
-  wallet() {
-    return this.request("GET", "/v1/me/wallet");
+  listCommerceTransactions(cursor) {
+    return this.request("GET", "/v1/me/transactions" + (cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""));
   }
-  walletTransactions(opts = {}) {
-    return this.request("GET", "/v1/me/wallet/transactions", { query: opts });
+  getPurchaseCollectionOptions(transactionId) {
+    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection-options`);
   }
-  topupSkus() {
-    return this.request("GET", "/v1/topup-skus");
+  getPurchaseCollection(transactionId) {
+    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection`);
+  }
+  requestPurchaseCollection(transactionId, body) {
+    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection`, { body });
+  }
+  refreshPurchaseCollection(transactionId) {
+    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/collection/refresh`, { body: {} });
+  }
+  getSupplementCollectionOptions(caseId) {
+    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection-options`);
+  }
+  getSupplementCollection(caseId) {
+    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection`);
+  }
+  requestSupplementCollection(caseId, body) {
+    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection`, { body });
+  }
+  refreshSupplementCollection(caseId) {
+    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/collection/refresh`, { body: {} });
+  }
+  getCommerceTransaction(id) {
+    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(id)}`);
+  }
+  confirmCommerceAfterSales(id, body, idempotencyKey) {
+    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(id)}/after-sales`, { body, idempotencyKey });
+  }
+  getCommerceAfterSales(id) {
+    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(id)}`);
+  }
+  getCommerceRefund(id) {
+    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(id)}`);
+  }
+  getCommerceAfterSalesQuoteOptions(transactionId, cursor) {
+    return this.request("GET", `/v1/me/transactions/${encodeURIComponent(transactionId)}/quote-options${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`);
+  }
+  prepareCommerceAfterSalesQuote(transactionId, body, idempotencyKey) {
+    return this.request("POST", `/v1/me/transactions/${encodeURIComponent(transactionId)}/quote-requests`, { body, idempotencyKey });
+  }
+  getCommerceQuoteCredentialRequirements(requestId) {
+    return this.request("GET", `/v1/me/quote-requests/${encodeURIComponent(requestId)}/credential-requirements`);
+  }
+  getCommerceCaseCredentialRequirements(caseId) {
+    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/credential-requirements`);
+  }
+  getCommerceRefundCredentialRequirements(refundId, mode) {
+    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(refundId)}/credential-requirements/${mode}`);
+  }
+  startCommerceAfterSalesQuote(requestId, body) {
+    return this.request("POST", `/v1/me/quote-requests/${encodeURIComponent(requestId)}/execution`, { body });
+  }
+  getCommerceAfterSalesQuoteRequest(requestId) {
+    return this.request("GET", `/v1/me/quote-requests/${encodeURIComponent(requestId)}`);
+  }
+  getCommerceAfterSalesExecution(caseId) {
+    return this.request("GET", `/v1/me/after-sales/${encodeURIComponent(caseId)}/execution`);
+  }
+  startCommerceAfterSalesExecution(caseId, body) {
+    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/execution`, { body });
+  }
+  getCommerceRefundExecutionAuthorization(refundId) {
+    return this.request("GET", `/v1/me/refunds/${encodeURIComponent(refundId)}/execution-authorization`);
+  }
+  authorizeCommerceRefundExecution(refundId, body) {
+    return this.request("POST", `/v1/me/refunds/${encodeURIComponent(refundId)}/execution-authorization`, { body });
+  }
+  requestCommerceRefund(caseId, body, idempotencyKey) {
+    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/refunds`, { body, idempotencyKey });
+  }
+  requestSupplementRefund(caseId, body, idempotencyKey) {
+    return this.request("POST", `/v1/me/after-sales/${encodeURIComponent(caseId)}/supplement-refunds`, { body, idempotencyKey });
+  }
+  createAPIIngestion(body, idempotencyKey) {
+    return this.request("POST", "/v1/me/api-ingestions", { body, idempotencyKey });
+  }
+  listAPIIngestions() {
+    return this.request("GET", "/v1/me/api-ingestions");
+  }
+  getAPIIngestion(jobId) {
+    return this.request("GET", `/v1/me/api-ingestions/${encodeURIComponent(jobId)}`);
+  }
+  retryAPIIngestion(jobId) {
+    return this.request("POST", `/v1/me/api-ingestions/${encodeURIComponent(jobId)}/retry`, { body: {} });
+  }
+  discover(req = {}) {
+    return this.request("POST", "/v1/discover", { body: req });
+  }
+  inspect(operationId) {
+    return this.request("GET", `/v1/operations/${encodeURIComponent(operationId)}`);
+  }
+  /** The single run-creation entry. Always sends expected_publication_id. */
+  run(operationId, admission, idempotencyKey, payment = {}) {
+    return this.request("POST", `/v1/operations/${encodeURIComponent(operationId)}/runs`, {
+      body: admission,
+      idempotencyKey,
+      payerCurrency: payment.payerCurrency,
+      intentResponse: true
+    });
+  }
+  getRun(runId, options = {}) {
+    const { actionRef, ...budget } = options;
+    const query = actionRef === void 0 ? "" : `?${new URLSearchParams({ action_ref: actionRef })}`;
+    return this.request("GET", `/v1/runs/${encodeURIComponent(runId)}${query}`, budget);
+  }
+  serviceAction(runId, actionRef, input, idempotencyKey, expectedPurpose) {
+    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/service-actions`, { body: { action_ref: actionRef, input, ...expectedPurpose ? { expected_purpose: expectedPurpose } : {} }, idempotencyKey });
+  }
+  servicePurchaseReview(runId) {
+    return this.request("GET", `/v1/runs/${encodeURIComponent(runId)}/purchase`);
+  }
+  servicePurchaseConfirm(runId, input) {
+    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/purchase/confirm`, { body: input });
+  }
+  servicePurchaseResume(runId) {
+    return this.request("POST", `/v1/runs/${encodeURIComponent(runId)}/purchase/resume`, { body: {} });
+  }
+  serviceAftercare(runId, mode, caseId, input = {}, idempotencyKey) {
+    if (!["directory", "get", "create", "respond", "cancel"].includes(mode))
+      throw new Error("unsupported original aftercare mode");
+    if (["get", "respond", "cancel"].includes(mode) && !caseId)
+      throw new Error("original case required");
+    const root = `/v1/runs/${encodeURIComponent(runId)}/aftercare`;
+    if (mode === "directory")
+      return this.request("GET", root);
+    if (mode === "get")
+      return this.request("GET", `${root}/${encodeURIComponent(caseId)}`);
+    return this.request("POST", mode === "create" ? root : `${root}/${encodeURIComponent(caseId)}/${mode}`, { body: input, ...idempotencyKey ? { idempotencyKey } : {} });
+  }
+  createAPIPaymentRequest(intentId, payment = {}) {
+    return this.request("POST", `/v1/intents/${encodeURIComponent(intentId)}/payment-request`, { payerCurrency: payment.payerCurrency });
+  }
+  getAPIPaymentRequest(intentId) {
+    return this.request("GET", `/v1/intents/${encodeURIComponent(intentId)}/payment-request`);
+  }
+  /** Read-only original request lookup. Never admits, continues, funds or retries a write. */
+  getRequest(requestID) {
+    return this.request("GET", `/v1/requests/${encodeURIComponent(requestID)}`);
+  }
+  continueIntent(intentId, idempotencyKey, body = {}) {
+    return this.request("POST", `/v1/intents/${encodeURIComponent(intentId)}/continue`, {
+      body,
+      idempotencyKey,
+      intentResponse: true
+    });
+  }
+  me() {
+    return this.request("GET", "/v1/me");
+  }
+  usage() {
+    return this.request("GET", "/v1/me/usage");
+  }
+  wallet() {
+    return this.request("GET", "/v1/me/wallet");
+  }
+  walletTransactions(opts = {}) {
+    return this.request("GET", "/v1/me/wallet/transactions", { query: opts });
+  }
+  topupSkus() {
+    return this.request("GET", "/v1/topup-skus");
   }
   createTopup(req, idempotencyKey) {
     return this.request("POST", "/v1/me/topups", { body: req, idempotencyKey });
@@ -3449,708 +3985,295 @@ var HttpTransportError = class extends Error {
     this.causeCode = causeCode;
     this.name = "HttpTransportError";
   }
-  code;
-  attempts;
-  causeCode;
-  static {
-    __name(this, "HttpTransportError");
-  }
-  retryable = true;
-  diagnostics = [];
-};
-function asTransientTransportError(error, attempts) {
-  if (isAbort(error)) return void 0;
-  const causeCode = findCauseCode(error);
-  const code = causeCode ? classifyCauseCode(causeCode) : classifyFetchFailure(error);
-  return code ? new HttpTransportError(code, attempts, causeCode, error) : void 0;
-}
-__name(asTransientTransportError, "asTransientTransportError");
-function classifyCauseCode(code) {
-  switch (code) {
-    case "ECONNRESET":
-      return "network_connection_reset";
-    case "ETIMEDOUT":
-    case "UND_ERR_CONNECT_TIMEOUT":
-    case "UND_ERR_HEADERS_TIMEOUT":
-    case "UND_ERR_BODY_TIMEOUT":
-      return "network_timeout";
-    case "EAI_AGAIN":
-      return "network_dns_temporary";
-    case "ENETUNREACH":
-    case "EHOSTUNREACH":
-      return "network_unreachable";
-    case "ECONNREFUSED":
-      return "network_connection_refused";
-    case "UND_ERR_SOCKET":
-      return "network_socket_error";
-    default:
-      return void 0;
-  }
-}
-__name(classifyCauseCode, "classifyCauseCode");
-function classifyFetchFailure(error) {
-  return error instanceof TypeError && error.message === "fetch failed" ? "network_transport_failed" : void 0;
-}
-__name(classifyFetchFailure, "classifyFetchFailure");
-function findCauseCode(error) {
-  const seen = /* @__PURE__ */ new Set();
-  let current = error;
-  while (current && typeof current === "object" && !seen.has(current)) {
-    seen.add(current);
-    const code = current.code;
-    if (typeof code === "string" && code !== "") return code;
-    current = current.cause;
-  }
-  return void 0;
-}
-__name(findCauseCode, "findCauseCode");
-function isAbort(error) {
-  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
-}
-__name(isAbort, "isAbort");
-function transportMessage(code) {
-  switch (code) {
-    case "network_connection_reset":
-      return "network connection was reset";
-    case "network_timeout":
-      return "network connection timed out";
-    case "network_dns_temporary":
-      return "DNS lookup was temporarily unavailable";
-    case "network_unreachable":
-      return "network was unreachable";
-    case "network_connection_refused":
-      return "network connection was refused";
-    case "network_socket_error":
-      return "network socket failed";
-    case "network_transport_failed":
-      return "network transport failed";
-  }
-}
-__name(transportMessage, "transportMessage");
-
-// src/client/http.ts
-var HttpError = class extends Error {
-  static {
-    __name(this, "HttpError");
-  }
-  executionContext;
-  diagnostics = [];
-  status;
-  code;
-  payload;
-  constructor(status, payload, fallbackMessage) {
-    super(payload?.message || fallbackMessage);
-    this.status = status;
-    this.code = payload?.code || "unknown_error";
-    this.payload = payload;
-  }
-};
-var HttpClient = class _HttpClient {
-  static {
-    __name(this, "HttpClient");
-  }
-  localSimulation = false;
-  static MAX_TRANSPORT_RETRIES = 2;
-  baseURL;
-  fetchImpl;
-  defaultHeaders;
-  requestAuthorizer;
-  recoverAuthorization;
-  transportRetryDelayMs;
-  onDiagnostic;
-  constructor(config) {
-    this.baseURL = config.baseURL.replace(/\/$/, "");
-    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
-    this.defaultHeaders = {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      ...config.defaultHeaders ?? {}
-    };
-    this.requestAuthorizer = config.requestAuthorizer;
-    this.recoverAuthorization = config.recoverAuthorization;
-    this.onDiagnostic = config.onDiagnostic;
-    this.transportRetryDelayMs = Math.max(0, config.transportRetryDelayMs ?? 200);
-  }
-  async request(path2, options = {}) {
-    const controller = new AbortController();
-    const abort = /* @__PURE__ */ __name(() => controller.abort(options.signal?.reason), "abort");
-    options.signal?.addEventListener("abort", abort, { once: true });
-    if (options.signal?.aborted) abort();
-    const remaining = (options.deadline ?? Date.now() + 3e4) - Date.now();
-    const timeoutReason = new DOMException("request deadline reached", "TimeoutError");
-    if (remaining <= 0) controller.abort(timeoutReason);
-    const timer = remaining > 0 ? setTimeout(() => controller.abort(timeoutReason), remaining) : void 0;
-    const requestStarted = Date.now();
-    const diagnostics = [];
-    let abortListener;
-    const cancelled = new Promise((_, reject) => {
-      abortListener = /* @__PURE__ */ __name(() => reject(controller.signal.reason), "abortListener");
-      if (controller.signal.aborted) abortListener();
-      else controller.signal.addEventListener("abort", abortListener, { once: true });
-    });
-    try {
-      return await Promise.race([this.performRequest(path2, { ...options, signal: controller.signal }, diagnostics), cancelled]);
-    } catch (error) {
-      if (controller.signal.aborted && !options.signal?.aborted) {
-        const timeout = new HttpTransportError("network_timeout", Math.max(1, diagnostics.length), "DEADLINE_EXCEEDED", error);
-        if (diagnostics.length === 0) diagnostics.push({ method: options.method ?? "GET", route_template: safeRouteTemplate(new URL(path2, this.baseURL).pathname), attempt: 1, attempt_ms: Math.max(0, remaining), total_ms: Math.max(0, remaining), phase: "unknown", cause_code: "DEADLINE_EXCEEDED" });
-        const last = diagnostics.at(-1);
-        if (last) last.total_ms = Date.now() - requestStarted;
-        timeout.diagnostics = diagnostics;
-        throw timeout;
-      }
-      if (error instanceof HttpError || error instanceof HttpTransportError) error.diagnostics = diagnostics;
-      throw error;
-    } finally {
-      if (timer !== void 0) clearTimeout(timer);
-      options.signal?.removeEventListener("abort", abort);
-      if (abortListener) controller.signal.removeEventListener("abort", abortListener);
-    }
-  }
-  async performRequest(path2, options, diagnostics) {
-    const url = path2.startsWith("http") ? path2 : this.baseURL + path2;
-    const method = options.method ?? "GET";
-    const body = options.body !== void 0 ? JSON.stringify(options.body) : "";
-    const requestPath = new URL(url).pathname + new URL(url).search;
-    const replaySafe = method === "GET" || Boolean(options.idempotencyKey) || options.replaySafe === true;
-    const started = Date.now();
-    let authorizationRecovered = false;
-    let transportRetries = 0;
-    for (; ; ) {
-      options.signal?.throwIfAborted();
-      const attemptStarted = Date.now();
-      const attempt = diagnostics.length + 1;
-      let phase = "unknown";
-      let requestID;
-      const diagnostic = { method, route_template: safeRouteTemplate(new URL(url).pathname), attempt, attempt_ms: 0, total_ms: Date.now() - started, phase };
-      diagnostics.push(diagnostic);
-      const abortAttempt = /* @__PURE__ */ __name(() => record("DEADLINE_OR_ABORT"), "abortAttempt");
-      const record = /* @__PURE__ */ __name((causeCode) => {
-        options.signal?.removeEventListener("abort", abortAttempt);
-        Object.assign(diagnostic, { attempt_ms: Date.now() - attemptStarted, total_ms: Date.now() - started, phase, ...requestID ? { request_id: requestID } : {}, ...causeCode ? { cause_code: causeCode } : {} });
-        this.onDiagnostic?.(diagnostic);
-      }, "record");
-      options.signal?.addEventListener("abort", abortAttempt, { once: true });
-      const headers = { ...this.defaultHeaders, ...options.responseType === "png" ? { Accept: "image/png" } : {} };
-      try {
-        if (this.requestAuthorizer) {
-          Object.assign(headers, await this.requestAuthorizer({ method, path: requestPath, body, ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} }));
-        }
-      } catch (error2) {
-        record(error2 instanceof HttpTransportError ? error2.causeCode : "AUTHORIZATION_FAILED");
-        if (error2 instanceof HttpTransportError) throw error2;
-        throw asTransientTransportError(error2, 1) ?? error2;
-      }
-      options.signal?.throwIfAborted();
-      if (options.bearer) headers.Authorization = `Bearer ${options.bearer}`;
-      if (options.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
-      let response;
-      let text2;
-      try {
-        response = await this.fetchImpl(url, {
-          method,
-          headers,
-          ...options.responseType === "png" ? { redirect: "error" } : {},
-          ...options.body !== void 0 ? { body } : {},
-          ...options.signal ? { signal: options.signal } : {}
-        });
-        phase = "response_body";
-        diagnostic.phase = phase;
-        const headerID = response.headers.get("X-ItPay-Request-ID");
-        if (headerID && /^req_[a-f0-9]{1,64}$/.test(headerID)) {
-          requestID = headerID;
-          diagnostic.request_id = headerID;
-        }
-        if (response.ok && options.responseType === "png") {
-          const bytes = new Uint8Array(await response.arrayBuffer());
-          const magic = [137, 80, 78, 71, 13, 10, 26, 10];
-          if (response.headers.get("Content-Type")?.split(";")[0] !== "image/png" || bytes.length > 10 * 1024 * 1024 || !magic.every((value, index) => bytes[index] === value)) throw new Error("invalid official PNG response");
-          record();
-          return bytes;
-        }
-        text2 = await response.text();
-        this.localSimulation = response.headers.get("X-ItPay-Environment") === "local_simulation";
-      } catch (error2) {
-        if (options.signal?.aborted) {
-          record("DEADLINE_OR_ABORT");
-          throw error2;
-        }
-        const transportError = asTransientTransportError(error2, transportRetries + 1);
-        record(transportError?.causeCode ?? "UNKNOWN_TRANSPORT_FAILURE");
-        if (!transportError) throw error2;
-        if (replaySafe && transportRetries < _HttpClient.MAX_TRANSPORT_RETRIES) {
-          transportRetries += 1;
-          await delay(this.transportRetryDelayMs * 2 ** (transportRetries - 1), options.signal);
-          continue;
-        }
-        throw asTransientTransportError(error2, transportRetries + 1) ?? error2;
-      }
-      record(response.ok ? void 0 : `HTTP_${response.status}`);
-      const parsed = text2.length > 0 ? safeParseJson(text2) : void 0;
-      if (response.ok) return parsed;
-      const error = new HttpError(response.status, parsed, `HTTP ${response.status}`);
-      if (!authorizationRecovered && error.status === 401 && error.code === "agent_device_session_required" && this.recoverAuthorization) {
-        authorizationRecovered = true;
-        options.signal?.throwIfAborted();
-        await this.recoverAuthorization({ ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} });
-        options.signal?.throwIfAborted();
-        continue;
-      }
-      throw error;
-    }
-  }
-  get(path2, options = {}) {
-    return this.request(path2, { ...options, method: "GET" });
-  }
-  post(path2, body, options = {}) {
-    return this.request(path2, { ...options, method: "POST", body });
-  }
-  delete(path2, options = {}) {
-    return this.request(path2, { ...options, method: "DELETE" });
-  }
-};
-function delay(milliseconds, signal) {
-  signal?.throwIfAborted();
-  if (milliseconds === 0) return Promise.resolve();
-  return new Promise((resolve10, reject) => {
-    const abort = /* @__PURE__ */ __name(() => {
-      clearTimeout(timer);
-      reject(signal?.reason);
-    }, "abort");
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", abort);
-      resolve10();
-    }, milliseconds);
-    signal?.addEventListener("abort", abort, { once: true });
-  });
-}
-__name(delay, "delay");
-function safeRouteTemplate(path2) {
-  const staticSegments = /* @__PURE__ */ new Set(["v1", "v3", "readyz", "service-executions", "service-definitions", "services", "advance", "actions", "checkout", "checkouts", "presentation", "capabilities", "invoke", "result-items", "events", "orders", "refunds", "cancel", "cart", "carts", "items", "quotes", "quote", "agent-device-enrollments", "agent-device-sessions", "verify", "auth-sessions"]);
-  return path2.split("/").map((segment) => staticSegments.has(segment) ? segment : segment ? "{value}" : "").join("/");
-}
-__name(safeRouteTemplate, "safeRouteTemplate");
-function safeParseJson(text2) {
-  try {
-    return JSON.parse(text2);
-  } catch {
-    return void 0;
-  }
-}
-__name(safeParseJson, "safeParseJson");
-
-// src/state/hub_credentials.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, resolve } from "node:path";
-
-// src/state/file_lock.ts
-import { chmodSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { randomUUID } from "node:crypto";
-var STALE_MS = 3e4;
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-__name(sleepSync, "sleepSync");
-function ownerAlive(path2) {
-  try {
-    const st = lstatSync(path2);
-    if (st.isSymbolicLink()) return false;
-    if (Date.now() - st.mtimeMs < STALE_MS) return true;
-    const token = readFileSync(path2, "utf8");
-    const pid = Number(/^(\d+):/.exec(token)?.[1]);
-    if (!Number.isInteger(pid) || pid <= 0) return false;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch {
-      return false;
-    }
-  } catch {
-    return false;
-  }
-}
-__name(ownerAlive, "ownerAlive");
-function withFileLock(lockPath, fn) {
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
-  const token = `${process.pid}:${randomUUID()}`;
-  const deadline = Date.now() + 15e3;
-  for (; ; ) {
-    try {
-      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
-      chmodSync(lockPath, 384);
-      break;
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EEXIST") throw error;
-      if (!ownerAlive(lockPath)) {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error(`task store lock busy: ${lockPath}`);
-      sleepSync(20);
-    }
-  }
-  try {
-    return fn();
-  } finally {
-    try {
-      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
-    } catch {
-    }
-  }
-}
-__name(withFileLock, "withFileLock");
-async function withAsyncFileLock(lockPath, fn) {
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
-  const token = `${process.pid}:${randomUUID()}`;
-  const deadline = Date.now() + 2e4;
-  for (; ; ) {
-    try {
-      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      if (!ownerAlive(lockPath)) {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error("credential refresh lock busy");
-      await new Promise((resolve10) => setTimeout(resolve10, 20));
-    }
-  }
-  try {
-    return await fn();
-  } finally {
-    try {
-      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
-    } catch {
-    }
-  }
-}
-__name(withAsyncFileLock, "withAsyncFileLock");
-
-// src/state/hub_oauth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-function hubOAuthConfig(env = process.env) {
-  const devHub = (env.ITPAY_HUB_URL ?? "").replace(/\/+$/, "") === "https://market-v4-dev.itpay.ai";
-  const issuer = (env.ITPAY_HUB_OAUTH_ISSUER ?? (devHub ? "https://auth-v4-dev.itpay.ai" : "http://localhost:24444")).replace(/\/+$/, "");
-  return {
-    authorizeURL: `${issuer}/oauth2/auth`,
-    tokenURL: `${issuer}/oauth2/token`,
-    clientID: env.ITPAY_HUB_OAUTH_CLIENT ?? "itpay-cli-local",
-    resource: (env.ITPAY_HUB_URL ?? "http://localhost:18090").replace(/\/+$/, ""),
-    scope: env.ITPAY_HUB_OAUTH_SCOPE ?? "openid offline_access itpay.hub"
-  };
-}
-__name(hubOAuthConfig, "hubOAuthConfig");
-function pkce() {
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-__name(pkce, "pkce");
-async function runConnectFlow(cfg, timeoutMs = 3e5) {
-  const { verifier, challenge } = pkce();
-  const state = randomBytes(16).toString("hex");
-  const server = createServer();
-  const done = new Promise((resolvePromise, reject) => {
-    const timer = setTimeout(() => {
-      server.close();
-      reject(new Error("connect timed out waiting for browser authorization"));
-    }, timeoutMs);
-    server.on("request", (req, res) => {
-      const u = new URL(req.url ?? "/", "http://127.0.0.1");
-      const finish = /* @__PURE__ */ __name((ok, msg) => {
-        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(`<!doctype html><meta charset="utf-8"><title>ItPay</title><body style="font-family:system-ui;padding:3em;text-align:center"><h2>${msg.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;")}</h2><p>\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u56DE\u5230\u7EC8\u7AEF\u7EE7\u7EED\u3002</p></body>`);
-      }, "finish");
-      (async () => {
-        if (u.pathname !== "/callback") return finish(false, "\u65E0\u6548\u7684\u56DE\u8C03");
-        if (u.searchParams.get("state") !== state) return finish(false, "state \u4E0D\u5339\u914D");
-        if (u.searchParams.get("error")) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "\u6388\u6743\u88AB\u62D2\u7EDD");
-          reject(new Error("authorization_required: consent denied"));
-          return;
-        }
-        const code = u.searchParams.get("code");
-        if (!code) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "\u7F3A\u5C11 code");
-          reject(new Error("missing code"));
-          return;
-        }
-        const form = new URLSearchParams({
-          grant_type: "authorization_code",
-          code,
-          redirect_uri: `http://127.0.0.1:${server.address().port}/callback`,
-          client_id: cfg.clientID,
-          code_verifier: verifier,
-          resource: cfg.resource
-        });
-        const tok = await fetch(cfg.tokenURL, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: form,
-          signal: AbortSignal.timeout(1e4)
-        });
-        if (!tok.ok) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "token \u4EA4\u6362\u5931\u8D25");
-          reject(new Error(`token endpoint ${tok.status}`));
-          return;
-        }
-        const t = await tok.json();
-        clearTimeout(timer);
-        server.close();
-        finish(true, "ItPay \u5DF2\u8FDE\u63A5");
-        resolvePromise({ accessToken: t.access_token, refreshToken: t.refresh_token, expiresIn: t.expires_in });
-      })().catch((e) => {
-        clearTimeout(timer);
-        server.close();
-        reject(e);
-      });
-    });
-  });
-  await new Promise((resolvePromise, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolvePromise());
-  });
-  const port = server.address().port;
-  const authorizeURL = `${cfg.authorizeURL}?` + new URLSearchParams({
-    response_type: "code",
-    client_id: cfg.clientID,
-    redirect_uri: `http://127.0.0.1:${port}/callback`,
-    scope: cfg.scope,
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    resource: cfg.resource
-  }).toString();
-  return { authorizeURL, done };
-}
-__name(runConnectFlow, "runConnectFlow");
-
-// src/state/hub_credentials.ts
-import { homedir } from "node:os";
-function hubCredentialsPath(env = process.env) {
-  const dir = env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), ".itpay-v3");
-  const suffix = createHash2("sha256").update(env.ITPAY_HUB_URL ?? "http://localhost:18090").digest("hex").slice(0, 12);
-  return resolve(dir, `hub-credentials.${suffix}.json`);
-}
-__name(hubCredentialsPath, "hubCredentialsPath");
-function importHubKeyUnlocked(apiKey, baseURL, env = process.env) {
-  if (!/^itk_[A-Za-z0-9_-]{8,}$/.test(apiKey)) {
-    throw new Error("invalid key format \u2014 expected an itk_ API key");
+  code;
+  attempts;
+  causeCode;
+  static {
+    __name(this, "HttpTransportError");
   }
-  const path2 = hubCredentialsPath(env);
-  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-  file.profiles["default"] = {
-    base_url: baseURL,
-    key_prefix: apiKey.slice(0, 14),
-    api_key: apiKey,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveHubProfileUnlocked(file.profiles["default"], env);
-  return { key_prefix: apiKey.slice(0, 14) };
+  retryable = true;
+  diagnostics = [];
+};
+function asTransientTransportError(error, attempts) {
+  if (isAbort(error)) return void 0;
+  const causeCode = findCauseCode(error);
+  const code = causeCode ? classifyCauseCode(causeCode) : classifyFetchFailure(error);
+  return code ? new HttpTransportError(code, attempts, causeCode, error) : void 0;
 }
-__name(importHubKeyUnlocked, "importHubKeyUnlocked");
-function storedHubKey(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    return file.profiles["default"]?.api_key;
-  } catch {
-    return void 0;
+__name(asTransientTransportError, "asTransientTransportError");
+function classifyCauseCode(code) {
+  switch (code) {
+    case "ECONNRESET":
+      return "network_connection_reset";
+    case "ETIMEDOUT":
+    case "UND_ERR_CONNECT_TIMEOUT":
+    case "UND_ERR_HEADERS_TIMEOUT":
+    case "UND_ERR_BODY_TIMEOUT":
+      return "network_timeout";
+    case "EAI_AGAIN":
+      return "network_dns_temporary";
+    case "ENETUNREACH":
+    case "EHOSTUNREACH":
+      return "network_unreachable";
+    case "ECONNREFUSED":
+      return "network_connection_refused";
+    case "UND_ERR_SOCKET":
+      return "network_socket_error";
+    default:
+      return void 0;
   }
 }
-__name(storedHubKey, "storedHubKey");
-function storedHubKeyPrefix(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    return file.profiles["default"]?.key_prefix;
-  } catch {
-    return void 0;
+__name(classifyCauseCode, "classifyCauseCode");
+function classifyFetchFailure(error) {
+  return error instanceof TypeError && error.message === "fetch failed" ? "network_transport_failed" : void 0;
+}
+__name(classifyFetchFailure, "classifyFetchFailure");
+function findCauseCode(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const code = current.code;
+    if (typeof code === "string" && code !== "") return code;
+    current = current.cause;
   }
+  return void 0;
 }
-__name(storedHubKeyPrefix, "storedHubKeyPrefix");
-function storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
-  const path2 = hubCredentialsPath(env);
-  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-  const issuedAt = Date.now();
-  const margin = Math.min(3e4, Math.max(100, expiresIn * 100));
-  file.profiles["default"] = {
-    base_url: baseURL,
-    access_token: accessToken,
-    ...refreshToken ? { refresh_token: refreshToken } : {},
-    expires_at: new Date(issuedAt + expiresIn * 1e3).toISOString(),
-    refresh_after: new Date(issuedAt + expiresIn * 1e3 - margin).toISOString(),
-    ...subject ? { subject } : {},
-    consumer_id: consumerID ?? `oauth:${hubOAuthConfig(env).clientID}`,
-    client_id: hubOAuthConfig(env).clientID,
-    token_url: hubOAuthConfig(env).tokenURL,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveHubProfileUnlocked(file.profiles["default"], env);
+__name(findCauseCode, "findCauseCode");
+function isAbort(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 }
-__name(storeHubSessionUnlocked, "storeHubSessionUnlocked");
-function saveHubProfileUnlocked(profile, env) {
-  const path2 = hubCredentialsPath(env);
-  const tmp = `${path2}.${randomUUID2()}.tmp`;
-  try {
-    const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-    file.profiles.default = profile;
-    mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
-    writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", flag: "wx", mode: 384 });
-    chmodSync2(tmp, 384);
-    renameSync(tmp, path2);
-  } catch {
-    throw new Error("credential_persistence_failed: could not save the original connection; stop and check private storage before retrying");
-  } finally {
-    try {
-      unlinkSync2(tmp);
-    } catch {
-    }
+__name(isAbort, "isAbort");
+function transportMessage(code) {
+  switch (code) {
+    case "network_connection_reset":
+      return "network connection was reset";
+    case "network_timeout":
+      return "network connection timed out";
+    case "network_dns_temporary":
+      return "DNS lookup was temporarily unavailable";
+    case "network_unreachable":
+      return "network was unreachable";
+    case "network_connection_refused":
+      return "network connection was refused";
+    case "network_socket_error":
+      return "network socket failed";
+    case "network_transport_failed":
+      return "network transport failed";
   }
 }
-__name(saveHubProfileUnlocked, "saveHubProfileUnlocked");
-async function probeHubIdentity(resource, accessToken) {
-  let response;
-  try {
-    response = await fetch(`${resource}/v1/me`, {
-      headers: { Authorization: `Bearer ${accessToken}`, "X-ItPay-OAuth-Resource": resource },
-      signal: AbortSignal.timeout(1e4)
-    });
-  } catch {
-    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+__name(transportMessage, "transportMessage");
+
+// src/client/http.ts
+var HttpError = class extends Error {
+  static {
+    __name(this, "HttpError");
   }
-  if (!response.ok) {
-    if (response.status === 401 || response.status === 403) throw new Error("authorization_required: original connection identity rejected");
-    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  executionContext;
+  diagnostics = [];
+  status;
+  code;
+  payload;
+  constructor(status, payload, fallbackMessage) {
+    super(payload?.message || fallbackMessage);
+    this.status = status;
+    this.code = payload?.code || "unknown_error";
+    this.payload = payload;
   }
-  try {
-    const identity = await response.json();
-    if (!identity || typeof identity !== "object" || Array.isArray(identity)) throw new Error();
-    const me = identity;
-    if (typeof me.buyer_id !== "string" || !me.buyer_id || typeof me.consumer_id !== "string" || !me.consumer_id) throw new Error();
-    return { buyer_id: me.buyer_id, consumer_id: me.consumer_id };
-  } catch {
-    throw new Error("connection_verification_pending: identity response invalid; preserve the original connection and references, do not reconnect");
+};
+var HttpClient = class _HttpClient {
+  static {
+    __name(this, "HttpClient");
   }
-}
-__name(probeHubIdentity, "probeHubIdentity");
-function storedHubToken(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    const p = file.profiles["default"];
-    if (!p?.access_token || p.identity_verification_pending) return void 0;
-    if (p.expires_at && Date.parse(p.expires_at) <= Date.now()) return void 0;
-    return p.access_token;
-  } catch {
-    return void 0;
+  localSimulation = false;
+  static MAX_TRANSPORT_RETRIES = 2;
+  baseURL;
+  fetchImpl;
+  defaultHeaders;
+  requestAuthorizer;
+  recoverAuthorization;
+  transportRetryDelayMs;
+  onDiagnostic;
+  constructor(config) {
+    this.baseURL = config.baseURL.replace(/\/$/, "");
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.defaultHeaders = {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      ...config.defaultHeaders ?? {}
+    };
+    this.requestAuthorizer = config.requestAuthorizer;
+    this.recoverAuthorization = config.recoverAuthorization;
+    this.onDiagnostic = config.onDiagnostic;
+    this.transportRetryDelayMs = Math.max(0, config.transportRetryDelayMs ?? 200);
   }
-}
-__name(storedHubToken, "storedHubToken");
-function storedHubProfile(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  return JSON.parse(readFileSync2(path2, "utf8")).profiles.default;
-}
-__name(storedHubProfile, "storedHubProfile");
-async function connectedHubToken(env = process.env, rejectedToken) {
-  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
-    const p = storedHubProfile(env);
-    if (!p?.access_token || !p.subject) throw new Error("authorization_required: reconnect ItPay");
-    const cfg = hubOAuthConfig(env);
-    if (p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID || !p.consumer_id) {
-      throw new Error("authorization_required: connection configuration changed");
+  async request(path2, options = {}) {
+    const controller = new AbortController();
+    const abort = /* @__PURE__ */ __name(() => controller.abort(options.signal?.reason), "abort");
+    options.signal?.addEventListener("abort", abort, { once: true });
+    if (options.signal?.aborted) abort();
+    const remaining = (options.deadline ?? Date.now() + 3e4) - Date.now();
+    const timeoutReason = new DOMException("request deadline reached", "TimeoutError");
+    if (remaining <= 0) controller.abort(timeoutReason);
+    const timer = remaining > 0 ? setTimeout(() => controller.abort(timeoutReason), remaining) : void 0;
+    const requestStarted = Date.now();
+    const diagnostics = [];
+    let abortListener;
+    const cancelled = new Promise((_, reject) => {
+      abortListener = /* @__PURE__ */ __name(() => reject(controller.signal.reason), "abortListener");
+      if (controller.signal.aborted) abortListener();
+      else controller.signal.addEventListener("abort", abortListener, { once: true });
+    });
+    try {
+      return await Promise.race([this.performRequest(path2, { ...options, signal: controller.signal }, diagnostics), cancelled]);
+    } catch (error) {
+      if (controller.signal.aborted && !options.signal?.aborted) {
+        const timeout = new HttpTransportError("network_timeout", Math.max(1, diagnostics.length), "DEADLINE_EXCEEDED", error);
+        if (diagnostics.length === 0) diagnostics.push({ method: options.method ?? "GET", route_template: safeRouteTemplate(new URL(path2, this.baseURL).pathname), attempt: 1, attempt_ms: Math.max(0, remaining), total_ms: Math.max(0, remaining), phase: "unknown", cause_code: "DEADLINE_EXCEEDED" });
+        const last = diagnostics.at(-1);
+        if (last) last.total_ms = Date.now() - requestStarted;
+        timeout.diagnostics = diagnostics;
+        throw timeout;
+      }
+      if (error instanceof HttpError || error instanceof HttpTransportError) error.diagnostics = diagnostics;
+      throw error;
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+      if (abortListener) controller.signal.removeEventListener("abort", abortListener);
     }
-    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
-    if (!p.identity_verification_pending && p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
-    let candidate = p;
-    if (!p.identity_verification_pending || !(Date.parse(p.expires_at ?? "") > Date.now())) {
-      if (!p.refresh_token) throw new Error("authorization_required: reconnect the original ItPay connection");
-      let response;
+  }
+  async performRequest(path2, options, diagnostics) {
+    const url = path2.startsWith("http") ? path2 : this.baseURL + path2;
+    const method = options.method ?? "GET";
+    const body = options.body !== void 0 ? JSON.stringify(options.body) : "";
+    const requestPath = new URL(url).pathname + new URL(url).search;
+    const replaySafe = method === "GET" || Boolean(options.idempotencyKey) || options.replaySafe === true;
+    const started = Date.now();
+    let authorizationRecovered = false;
+    let transportRetries = 0;
+    for (; ; ) {
+      options.signal?.throwIfAborted();
+      const attemptStarted = Date.now();
+      const attempt = diagnostics.length + 1;
+      let phase = "unknown";
+      let requestID;
+      const diagnostic = { method, route_template: safeRouteTemplate(new URL(url).pathname), attempt, attempt_ms: 0, total_ms: Date.now() - started, phase };
+      diagnostics.push(diagnostic);
+      const abortAttempt = /* @__PURE__ */ __name(() => record("DEADLINE_OR_ABORT"), "abortAttempt");
+      const record = /* @__PURE__ */ __name((causeCode) => {
+        options.signal?.removeEventListener("abort", abortAttempt);
+        Object.assign(diagnostic, { attempt_ms: Date.now() - attemptStarted, total_ms: Date.now() - started, phase, ...requestID ? { request_id: requestID } : {}, ...causeCode ? { cause_code: causeCode } : {} });
+        this.onDiagnostic?.(diagnostic);
+      }, "record");
+      options.signal?.addEventListener("abort", abortAttempt, { once: true });
+      const headers = { ...this.defaultHeaders, ...options.responseType === "png" ? { Accept: "image/png" } : {} };
       try {
-        response = await fetch(p.token_url, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
-          signal: AbortSignal.timeout(1e4)
-        });
-      } catch {
-        throw new Error("connection_verification_pending: refresh outcome unknown; preserve the original connection and references, do not repeat authorization or business requests");
-      }
-      if (!response.ok) {
-        let rejected = response.status === 401 || response.status === 403;
-        if (response.status === 400) {
-          try {
-            const problem = await response.json();
-            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
-          } catch {
-          }
+        if (this.requestAuthorizer) {
+          Object.assign(headers, await this.requestAuthorizer({ method, path: requestPath, body, ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} }));
         }
-        if (rejected) throw new Error("authorization_required: connection refresh rejected");
-        throw new Error("connection_verification_pending: refresh unavailable; preserve the original connection and references");
+      } catch (error2) {
+        record(error2 instanceof HttpTransportError ? error2.causeCode : "AUTHORIZATION_FAILED");
+        if (error2 instanceof HttpTransportError) throw error2;
+        throw asTransientTransportError(error2, 1) ?? error2;
       }
-      let token;
+      options.signal?.throwIfAborted();
+      if (options.bearer) headers.Authorization = `Bearer ${options.bearer}`;
+      if (options.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
+      let response;
+      let text2;
       try {
-        token = await response.json();
-      } catch {
-        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+        response = await this.fetchImpl(url, {
+          method,
+          headers,
+          ...options.responseType === "png" ? { redirect: "error" } : {},
+          ...options.body !== void 0 ? { body } : {},
+          ...options.signal ? { signal: options.signal } : {}
+        });
+        phase = "response_body";
+        diagnostic.phase = phase;
+        const headerID = response.headers.get("X-ItPay-Request-ID");
+        if (headerID && /^req_[a-f0-9]{1,64}$/.test(headerID)) {
+          requestID = headerID;
+          diagnostic.request_id = headerID;
+        }
+        if (response.ok && options.responseType === "png") {
+          const bytes = new Uint8Array(await response.arrayBuffer());
+          const magic = [137, 80, 78, 71, 13, 10, 26, 10];
+          if (response.headers.get("Content-Type")?.split(";")[0] !== "image/png" || bytes.length > 10 * 1024 * 1024 || !magic.every((value, index) => bytes[index] === value)) throw new Error("invalid official PNG response");
+          record();
+          return bytes;
+        }
+        text2 = await response.text();
+        this.localSimulation = response.headers.get("X-ItPay-Environment") === "local_simulation";
+      } catch (error2) {
+        if (options.signal?.aborted) {
+          record("DEADLINE_OR_ABORT");
+          throw error2;
+        }
+        const transportError = asTransientTransportError(error2, transportRetries + 1);
+        record(transportError?.causeCode ?? "UNKNOWN_TRANSPORT_FAILURE");
+        if (!transportError) throw error2;
+        if (replaySafe && transportRetries < _HttpClient.MAX_TRANSPORT_RETRIES) {
+          transportRetries += 1;
+          await delay(this.transportRetryDelayMs * 2 ** (transportRetries - 1), options.signal);
+          continue;
+        }
+        throw asTransientTransportError(error2, transportRetries + 1) ?? error2;
       }
-      if (!token || typeof token.access_token !== "string" || !token.access_token || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || (!Number.isFinite(Date.now() + token.expires_in * 1e3) || Date.now() + token.expires_in * 1e3 > 864e13) || token.refresh_token !== void 0 && (typeof token.refresh_token !== "string" || !token.refresh_token)) {
-        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      record(response.ok ? void 0 : `HTTP_${response.status}`);
+      const parsed = text2.length > 0 ? safeParseJson(text2) : void 0;
+      if (response.ok) return parsed;
+      const error = new HttpError(response.status, parsed, `HTTP ${response.status}`);
+      if (!authorizationRecovered && error.status === 401 && error.code === "agent_device_session_required" && this.recoverAuthorization) {
+        authorizationRecovered = true;
+        options.signal?.throwIfAborted();
+        await this.recoverAuthorization({ ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} });
+        options.signal?.throwIfAborted();
+        continue;
       }
-      const now = Date.now();
-      candidate = {
-        ...p,
-        access_token: token.access_token,
-        refresh_token: token.refresh_token ?? p.refresh_token,
-        expires_at: new Date(now + token.expires_in * 1e3).toISOString(),
-        refresh_after: new Date(now + token.expires_in * 1e3 - Math.min(3e4, Math.max(100, token.expires_in * 100))).toISOString(),
-        identity_verification_pending: true
-      };
-      saveHubProfileUnlocked(candidate, env);
-    }
-    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
-    if (identity.buyer_id !== p.subject || identity.consumer_id !== p.consumer_id) {
-      throw new Error("authorization_required: refreshed identity changed");
-    }
-    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) {
-      throw new Error("connection_verification_pending: token expired during identity check; preserve the original connection and references");
+      throw error;
     }
-    delete candidate.identity_verification_pending;
-    saveHubProfileUnlocked(candidate, env);
-    return candidate.access_token;
+  }
+  get(path2, options = {}) {
+    return this.request(path2, { ...options, method: "GET" });
+  }
+  post(path2, body, options = {}) {
+    return this.request(path2, { ...options, method: "POST", body });
+  }
+  delete(path2, options = {}) {
+    return this.request(path2, { ...options, method: "DELETE" });
+  }
+};
+function delay(milliseconds, signal) {
+  signal?.throwIfAborted();
+  if (milliseconds === 0) return Promise.resolve();
+  return new Promise((resolve10, reject) => {
+    const abort = /* @__PURE__ */ __name(() => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    }, "abort");
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve10();
+    }, milliseconds);
+    signal?.addEventListener("abort", abort, { once: true });
   });
 }
-__name(connectedHubToken, "connectedHubToken");
-function importHubKey(apiKey, baseURL, env = process.env) {
-  return withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => importHubKeyUnlocked(apiKey, baseURL, env));
+__name(delay, "delay");
+function safeRouteTemplate(path2) {
+  const staticSegments = /* @__PURE__ */ new Set(["v1", "v3", "readyz", "service-executions", "service-definitions", "services", "advance", "actions", "checkout", "checkouts", "presentation", "capabilities", "invoke", "result-items", "events", "orders", "refunds", "cancel", "cart", "carts", "items", "quotes", "quote", "agent-device-enrollments", "agent-device-sessions", "verify", "auth-sessions"]);
+  return path2.split("/").map((segment) => staticSegments.has(segment) ? segment : segment ? "{value}" : "").join("/");
 }
-__name(importHubKey, "importHubKey");
-function storeHubSession(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
-  withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env, consumerID));
+__name(safeRouteTemplate, "safeRouteTemplate");
+function safeParseJson(text2) {
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return void 0;
+  }
 }
-__name(storeHubSession, "storeHubSession");
+__name(safeParseJson, "safeParseJson");
 
 // src/client/hub.ts
 function loadHubConfig(env = process.env) {
@@ -4202,6 +4325,9 @@ var HubClient2 = class {
   runStatus(runID) {
     return this.wrap(() => this.sdk.getRun(runID));
   }
+  getRequest(requestID) {
+    return this.wrap(() => this.sdk.getRequest(requestID));
+  }
   continueIntent(intentID, idempotencyKey) {
     return this.wrap(() => this.sdk.continueIntent(intentID, idempotencyKey));
   }
@@ -4254,13 +4380,47 @@ var HubClient2 = class {
       if (err instanceof HubApiError) {
         throw new HttpError(err.status, {
           code: err.envelope.error.code,
-          message: err.envelope.error.message
+          message: err.envelope.error.message,
+          ...safeDetailsPayload(err.envelope.error.details)
         }, `hub request failed`);
       }
       throw err;
     }
   }
 };
+function safeHubErrorDetails(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return void 0;
+  const d = raw;
+  const out = {};
+  if (d.stage === "metadata" || d.stage === "status" || d.stage === "action") out.stage = d.stage;
+  if (typeof d.method === "string" && ["GET", "POST", "PUT", "DELETE", "PATCH"].includes(d.method)) out.method = d.method;
+  if (typeof d.path === "string") {
+    const path2 = d.path.split(/[?#]/, 1)[0];
+    const routes = [
+      [/^\/v1\/operations\/[^/\s]+\/runs$/, "/v1/operations/{operation_id}/runs"],
+      [/^\/v1\/operations\/[^/\s]+$/, "/v1/operations/{operation_id}"],
+      [/^\/v1\/requests\/[^/\s]+$/, "/v1/requests/{request_id}"],
+      [/^\/v1\/runs\/[^/\s]+$/, "/v1/runs/{run_id}"],
+      [/^\/v1\/intents\/[^/\s]+\/continue$/, "/v1/intents/{intent_id}/continue"]
+    ];
+    const matched = routes.find(([pattern]) => pattern.test(path2));
+    if (matched) out.path = matched[1];
+    else if (["/v1/discover", "/v1/me", "/v1/me/wallet", "/v1/me/usage"].includes(path2)) out.path = path2;
+  }
+  return Object.keys(out).length ? out : void 0;
+}
+__name(safeHubErrorDetails, "safeHubErrorDetails");
+function safeDetailsPayload(raw) {
+  const details = safeHubErrorDetails(raw);
+  return details ? { details } : {};
+}
+__name(safeDetailsPayload, "safeDetailsPayload");
+function hubErrorDetails(error) {
+  if (error instanceof HttpError) return safeHubErrorDetails(error.payload?.details);
+  if (error && typeof error === "object" && "details" in error) return safeHubErrorDetails(error.details);
+  return void 0;
+}
+__name(hubErrorDetails, "hubErrorDetails");
 
 // src/commands/admin.ts
 var actions = /* @__PURE__ */ new Set(["operations_list", "ingestions_list", "import_github", "ingestion_status", "ingestion_retry", "credentials_list", "credential_put", "source_requirements", "source_bind", "acceptance_status", "acceptance_set"]);
@@ -4446,8 +4606,11 @@ var HubTaskStore = class {
     if (!existsSync2(file)) return void 0;
     return withFileLock(`${file}.lock`, () => {
       const existing = this.readTask(file);
-      if (STATUS_RANK[existing.status] >= STATUS_RANK.succeeded) return existing;
-      const next = { ...existing, ...patch, request_id: requestID, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
+      if (existing.run_id && patch.run_id && existing.run_id !== patch.run_id || existing.intent_id && patch.intent_id && existing.intent_id !== patch.intent_id) {
+        throw new Error("invalid_state: authoritative receipt changed the original task binding");
+      }
+      const terminal = STATUS_RANK[existing.status] >= STATUS_RANK.succeeded;
+      const next = { ...existing, ...patch, ...terminal ? { status: existing.status, terminal: true, pending_stage: null, next: null, blocking_reason: void 0 } : {}, request_id: requestID, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
       this.writeTask(file, next);
       return next;
     });
@@ -4466,7 +4629,7 @@ var HubTaskStore = class {
   }
   /** Bind a migrated/legacy task to the current scope on explicit access. */
   bindScope(task, file) {
-    if (task.hub_origin && task.key_prefix !== void 0) return task;
+    if (task.hub_origin && (task.key_prefix !== void 0 || !this.scopeFields.key_prefix)) return task;
     const bound = { ...task, ...this.scopeFields, updated_at: (/* @__PURE__ */ new Date()).toISOString() };
     this.writeTask(file, bound);
     return bound;
@@ -5827,19 +5990,60 @@ function readHubCredentialSelection(credentialID, sourceSpec) {
   return { source_credentials: Object.fromEntries(entries) };
 }
 __name(readHubCredentialSelection, "readHubCredentialSelection");
-async function waitForRun(client, runID, seconds) {
+function runTerminal(rec) {
+  if (typeof rec.terminal === "boolean") return rec.terminal;
+  return ["succeeded", "failed", "cancelled"].includes(rec.execution_state) && ["free", "captured", "released", "refunded", "partially_refunded"].includes(rec.settlement_state);
+}
+__name(runTerminal, "runTerminal");
+function runPendingStage(rec) {
+  if (runTerminal(rec)) return null;
+  if (rec.pending_stage) return rec.pending_stage;
+  if (["succeeded", "failed", "cancelled"].includes(rec.execution_state)) return "settlement";
+  if (rec.execution_state === "unknown" || rec.settlement_state === "reconciling") return "reconciliation";
+  return rec.execution_state === "queued" || rec.execution_state === "accepted" ? "queued" : "unknown";
+}
+__name(runPendingStage, "runPendingStage");
+function updateFromRun(store, task, rec) {
+  if (!rec.run_id || rec.operation_id && rec.operation_id !== task.operation_id || rec.publication_id && rec.publication_id !== task.publication_id) {
+    throw new Error("invalid_state: authoritative run does not match the original task");
+  }
+  const terminal = runTerminal(rec);
+  return store.update(task.request_id, {
+    run_id: rec.run_id,
+    blocking_reason: void 0,
+    status: terminal ? rec.execution_state === "succeeded" ? "succeeded" : "failed" : rec.execution_state === "unknown" ? "unknown" : "dispatched",
+    terminal,
+    pending_stage: runPendingStage(rec),
+    next: terminal ? null : { read_only: { method: "GET", path: `/v1/runs/${encodeURIComponent(rec.run_id)}` } },
+    state_source: "hub",
+    state_stale: (task.terminal === true || ["succeeded", "failed"].includes(task.status)) && !terminal,
+    last_checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+    refresh_error: (task.terminal === true || ["succeeded", "failed"].includes(task.status)) && !terminal ? "inconsistent_receipt" : void 0
+  });
+}
+__name(updateFromRun, "updateFromRun");
+function validateWait(seconds) {
+  if (!Number.isFinite(seconds) || !Number.isFinite(seconds * 1e3 + Date.now()) || seconds < 0) throw new Error("invalid_input: --wait must be a finite nonnegative number of seconds");
+}
+__name(validateWait, "validateWait");
+async function waitForRun(client, runID, seconds, initial) {
+  validateWait(seconds);
   const deadline = Date.now() + seconds * 1e3;
   let delay3 = 500;
+  if (initial && (runTerminal(initial) || seconds === 0)) return initial;
+  let latest = initial;
   for (; ; ) {
+    if (latest && Date.now() >= deadline) return latest;
     const rec = await client.runStatus(runID);
-    if (["succeeded", "failed", "cancelled"].includes(rec.execution_state)) return rec;
-    if (Date.now() >= deadline) return rec;
-    await new Promise((r) => setTimeout(r, delay3));
+    latest = rec;
+    if (runTerminal(rec) || Date.now() >= deadline) return rec;
+    await new Promise((r) => setTimeout(r, Math.min(delay3, Math.max(0, deadline - Date.now()))));
     delay3 = Math.min(delay3 * 2, 5e3);
   }
 }
 __name(waitForRun, "waitForRun");
 async function runHubRun(operationID2, options) {
+  validateWait(options.waitSeconds ?? 0);
   const selections = readHubCredentialSelection(options.credentialId, options.sourceCredentials);
   const client = hub();
   const store = new HubTaskStore();
@@ -5854,11 +6058,11 @@ async function runHubRun(operationID2, options) {
     ...options.maxCharge ? { max_charge_atoms: options.maxCharge } : {}
   });
   if (!created && task.input_digest !== digest) {
-    throw new Error(`idempotency_conflict: request ${task.request_id} already exists with different input/publication/credential selection \u2014 use a new --request-id or "itpay api resume ${task.request_id}"`);
+    throw new Error(`idempotency_conflict: original request ${task.request_id} has different frozen facts; preserve its identity, input and publication, do not replace it with a new request`);
   }
   if (!created && task.run_id) {
     const rec = await waitForRun(client, task.run_id, options.waitSeconds ?? 0);
-    store.update(task.request_id, { status: rec.execution_state === "succeeded" ? "succeeded" : rec.execution_state === "failed" ? "failed" : "dispatched" });
+    updateFromRun(store, task, rec);
     renderRun(rec, options.jsonOutput, "replayed");
     return;
   }
@@ -5876,9 +6080,11 @@ var HubTaskRequestError = class extends Error {
   requestID;
   references;
   code;
+  details;
   constructor(error, task) {
     super(error instanceof Error ? error.message : "original Hub request did not return a receipt");
     this.requestID = task.request_id;
+    this.details = hubErrorDetails(error);
     this.references = { request_id: task.request_id, ...task.run_id ? { run_id: task.run_id } : {}, ...task.intent_id ? { intent_id: task.intent_id } : {} };
     this.code = error instanceof HttpError ? error.code : ["authorization_required", "connection_verification_pending", "credential_persistence_failed", "idempotency_conflict", "invalid_state"].find((code) => this.message.startsWith(code + ":")) ?? "hub_request_unknown";
   }
@@ -5906,13 +6112,11 @@ async function dispatchOriginalTask(client, store, task, options) {
       return;
     }
     let rec = admission;
-    store.update(task.request_id, { run_id: rec.run_id });
+    updateFromRun(store, task, rec);
     if (options.waitSeconds) {
-      rec = await waitForRun(client, rec.run_id, options.waitSeconds);
+      rec = await waitForRun(client, rec.run_id, options.waitSeconds, rec);
     }
-    store.update(task.request_id, {
-      status: rec.execution_state === "succeeded" ? "succeeded" : rec.execution_state === "failed" ? "failed" : "dispatched"
-    });
+    updateFromRun(store, task, rec);
     renderRun(rec, options.jsonOutput);
   } catch (error) {
     throw new HubTaskRequestError(error, store.get(task.request_id) ?? task);
@@ -5923,29 +6127,43 @@ function renderRun(rec, jsonOutput, note) {
   const charged = rec.actual_charge ? atomsToYuan(rec.actual_charge.amount_atoms) : "\u8D39\u7528\u56DE\u6267\u672A\u63D0\u4F9B";
   writeCommandEnvelope({
     status: rec.execution_state === "succeeded" ? "executed" : rec.execution_state,
-    result: { run_id: rec.run_id, execution_state: rec.execution_state, settlement_state: rec.settlement_state, ...rec.delivery_state ? { delivery_state: rec.delivery_state } : {}, actual_charge: rec.actual_charge ?? null, result: rec.result ?? null, error: rec.error ?? null, ...note ? { note } : {} },
+    result: { terminal: runTerminal(rec), pending_stage: runPendingStage(rec), next: runTerminal(rec) ? null : rec.next ?? { read_only: { method: "GET", path: `/v1/runs/${encodeURIComponent(rec.run_id)}` } }, run_id: rec.run_id, execution_state: rec.execution_state, settlement_state: rec.settlement_state, ...rec.delivery_state ? { delivery_state: rec.delivery_state } : {}, actual_charge: rec.actual_charge ?? null, result: rec.result ?? null, error: rec.error ?? null, first_error: rec.first_error ?? null, ...note ? { note } : {} },
     instruction: rec.execution_state === "succeeded" ? `\u6267\u884C\u72B6\u6001\u4E3A succeeded\uFF1B\u4EA4\u4ED8\u72B6\u6001 ${rec.delivery_state ?? "\u672A\u63D0\u4F9B"}\uFF0C\u7ED3\u7B97\u72B6\u6001 ${rec.settlement_state ?? "\u672A\u63D0\u4F9B"}\uFF0C\u5B9E\u9645\u8D39\u7528\u56DE\u6267 ${charged}\u3002\u4EC5\u636E\u5B9E\u9645 result \u548C\u4EA4\u4ED8\u4E8B\u5B9E\u56DE\u7B54\uFF0C\u7A7A\u503C\u4E0D\u4EE3\u8868\u67E5\u8BE2\u6210\u529F\u4E14\u96F6\u6761\u3002` : `\u6267\u884C\u72B6\u6001 ${rec.execution_state}\uFF08${rec.error?.code ?? "\u65E0\u9519\u8BEF\u4EE3\u7801"}\uFF09\uFF0C\u7ED3\u7B97\u72B6\u6001 ${rec.settlement_state ?? "\u672A\u63D0\u4F9B"}\uFF0C\u5B9E\u9645\u8D39\u7528\u56DE\u6267 ${charged}\uFF1B\u7528 itpay api run-status ${rec.run_id} \u67E5\u8BE2\u539F\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u590D\u53D1\u8D77\u3002`,
-    next: ["succeeded", "failed"].includes(rec.execution_state) ? null : { command: `itpay api run-status ${rec.run_id}`, reason: "\u67E5\u8BE2\u539F run \u72B6\u6001\uFF0C\u4E0D\u65B0\u5EFA\u8BF7\u6C42" },
+    next: runTerminal(rec) ? null : { command: `itpay api run-status ${rec.run_id}`, reason: "\u53EA\u8BFB\u67E5\u8BE2\u539F run \u72B6\u6001\uFF0C\u4E0D\u65B0\u5EFA\u8BF7\u6C42", read_only: { method: "GET", path: `/v1/runs/${encodeURIComponent(rec.run_id)}` } },
     recovery: []
   }, {
     jsonOutput: Boolean(jsonOutput),
-    plainResult: [`run ${rec.run_id}  ${rec.execution_state}  ${rec.settlement_state}  ${charged}${note ? "  (" + note + ")" : ""}`]
+    plainResult: [`run ${rec.run_id}  ${rec.execution_state}  ${rec.settlement_state}  ${charged}${note ? "  (" + note + ")" : ""}`, ...rec.first_error ? [`first_error: ${rec.first_error.code}`] : []]
   });
 }
 __name(renderRun, "renderRun");
 async function renderBlockedTask(task, admission, jsonOutput) {
-  if (!admission && task.intent_id) {
-    try {
-      const payment2 = await hub().getAPIPaymentRequest(task.intent_id);
-      admission = { intent_id: task.intent_id, blocking_reason: "insufficient_balance", payment_request: payment2, required_action: payment2.collection_action };
-    } catch {
+  if (!admission) {
+    const store = new HubTaskStore();
+    const stored = store.get(task.request_id);
+    if (!stored) throw new Error("not_found: original local task is unavailable");
+    const snapshot = await refreshOriginalTask(hub(), store, stored);
+    const updated = store.get(task.request_id);
+    if (snapshot?.run) {
+      renderRun(snapshot.run, jsonOutput);
+      return;
     }
+    writeCommandEnvelope({
+      status: updated.state_stale ? "unknown" : updated.blocking_reason ?? "blocked",
+      result: { request_id: task.request_id, intent_id: updated.intent_id, run_id: updated.run_id, terminal: updated.terminal ?? false, pending_stage: updated.pending_stage ?? "unknown", state_stale: updated.state_stale, next: snapshot?.next ?? null },
+      instruction: "\u539F\u8BF7\u6C42\u53EA\u8BFB\u72B6\u6001\uFF1B\u672A\u53D6\u5F97\u5F53\u524D\u5B98\u65B9\u529E\u7406\u52A8\u4F5C\u4E0D\u4EE3\u8868\u4F59\u989D\u4E0D\u8DB3\u3002\u4FDD\u7559\u539F\u5F15\u7528\uFF0C\u505C\u6B62\u81EA\u52A8\u6062\u590D\u6216\u5145\u503C\u3002",
+      next: { command: `itpay api tasks --refresh --request-id ${task.request_id}${jsonOutput ? " --json" : ""}`, reason: "\u53EA\u8BFB\u5237\u65B0\u8FD9\u4E00\u7B14\u539F\u5F15\u7528", read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent(store.idempotencyKey(task.request_id))}` } },
+      recovery: []
+    }, { jsonOutput: Boolean(jsonOutput) });
+    return;
   }
   const intentID = admission?.intent_id ?? task.intent_id;
   const action = admission?.required_action;
   const reason = admission?.blocking_reason ?? "blocked";
   const payment = admission?.payment_request;
   const paymentRequired = payment && /^[1-9][0-9]*$/.test(String(payment.payer_minor_amount ?? ""));
+  const readOnlyNext = { command: `itpay api tasks --refresh --request-id ${task.request_id}${jsonOutput ? " --json" : ""}`, reason: "\u53EA\u8BFB\u6838\u5BF9\u539F\u8BF7\u6C42", read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent("cli-req-" + task.request_id)}` } };
+  const progress = { terminal: false, pending_stage: admission?.pending_stage ?? (["authorization_denied", "authorization_revoked", "budget_exceeded"].includes(reason) ? "authorization" : reason === "insufficient_balance" ? "funding" : "unknown"), next: admission?.next ?? { read_only: readOnlyNext.read_only } };
   if (action && !paymentRequired) {
     let target2;
     try {
@@ -5955,11 +6173,18 @@ async function renderBlockedTask(task, admission, jsonOutput) {
     }
     const approval = ["authorization_denied", "budget_exceeded"].includes(reason);
     const instruction = approval ? "\u8BF7\u5728\u5B98\u65B9\u9875\u9762\u6838\u5BF9\u8BE5 Agent\u3001API \u6548\u679C\u8303\u56F4\u548C\u6D88\u8D39\u9884\u7B97\uFF0C\u660E\u786E\u6279\u51C6\u540E\u6062\u590D\u540C\u4E00\u539F\u8BF7\u6C42\u3002\u6D88\u8D39\u6388\u6743\u4E0D\u4F1A\u5145\u503C\u6216\u81EA\u52A8\u6263\u6B3E\u3002" : reason === "insufficient_balance" ? "\u4F59\u989D\u4E0D\u8DB3\uFF1B\u8BF7\u5728\u5B98\u65B9\u5145\u503C\u9875\u6838\u5BF9\u539F\u8BF7\u6C42\u548C\u5B9E\u9645\u91D1\u989D\uFF0C\u5230\u8D26\u540E\u6062\u590D\u540C\u4E00\u539F\u8BF7\u6C42\u3002" : "\u8BF7\u5728\u5B98\u65B9\u9875\u9762\u5B8C\u6210\u6240\u9700\u64CD\u4F5C\uFF0C\u518D\u67E5\u8BE2\u540C\u4E00\u539F\u8BF7\u6C42\u3002";
-    writeCommandEnvelope({ status: reason, result: { request_id: task.request_id, intent_id: intentID, ...admission ?? {} }, ...target2 ? { handoff: { type: "open_url", url: target2, label: action.label ?? "\u6253\u5F00\u5B98\u65B9\u9875\u9762" } } : {}, instruction: target2 ? instruction : "\u672A\u53D6\u5F97\u53EF\u7528\u5B98\u65B9\u64CD\u4F5C\u94FE\u63A5\uFF1B\u4FDD\u7559\u539F\u8BF7\u6C42\u5E76\u6838\u5BF9\u5F53\u524D\u72B6\u6001\u3002", next: target2 ? { command: qualifyItPayCommand(`itpay api resume ${task.request_id}${jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: approval ? "\u5B8C\u6210\u6D88\u8D39\u6388\u6743\u540E\u6062\u590D\u540C\u4E00\u539F\u8BF7\u6C42" : "\u5B8C\u6210\u5B98\u65B9\u64CD\u4F5C\u540E\u67E5\u8BE2\u540C\u4E00\u539F\u8BF7\u6C42" } : null, recovery: [] }, { jsonOutput: Boolean(jsonOutput), plainResult: [`request ${task.request_id} blocked intent ${intentID ?? "-"}`, ...target2 ? [target2] : []] });
+    writeCommandEnvelope({ status: reason, result: { request_id: task.request_id, intent_id: intentID, ...admission ?? {}, ...progress }, ...target2 ? { handoff: { type: "open_url", url: target2, label: action.label ?? "\u6253\u5F00\u5B98\u65B9\u9875\u9762" } } : {}, instruction: target2 ? instruction : "\u672A\u53D6\u5F97\u53EF\u7528\u5B98\u65B9\u64CD\u4F5C\u94FE\u63A5\uFF1B\u4FDD\u7559\u539F\u8BF7\u6C42\u5E76\u6838\u5BF9\u5F53\u524D\u72B6\u6001\u3002", next: { command: `itpay api tasks --refresh --request-id ${task.request_id}${jsonOutput ? " --json" : ""}`, reason: "\u53EA\u8BFB\u6838\u5BF9\u539F\u8BF7\u6C42", read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent("cli-req-" + task.request_id)}` } }, recovery: target2 ? [{ command: qualifyItPayCommand(`itpay api resume ${task.request_id}${jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: approval ? "\u4EC5\u5B8C\u6210\u6D88\u8D39\u6388\u6743\u540E\u7EED\u8DD1\u540C\u4E00\u539F\u8BF7\u6C42\uFF1B\u6B64\u52A8\u4F5C\u53EF\u80FD\u5199\u5165" : "\u4EC5\u5B8C\u6210\u5B98\u65B9\u64CD\u4F5C\u4E14\u660E\u786E\u5141\u8BB8\u6062\u590D\u540E\u7EED\u8DD1\u539F\u8BF7\u6C42\uFF1B\u6B64\u52A8\u4F5C\u53EF\u80FD\u5199\u5165" }] : [] }, { jsonOutput: Boolean(jsonOutput), plainResult: [`request ${task.request_id} blocked intent ${intentID ?? "-"}`, ...target2 ? [target2] : []] });
     return;
   }
   const handoff = action && paymentRequired ? await renderPaymentHandoff({ action, requestID: task.request_id, amountMinor: Number(admission?.payment_request?.payer_minor_amount ?? 0), currency: admission?.payment_request?.payer_currency ?? "CNY", jsonOutput: Boolean(jsonOutput) }) : null;
-  writeCommandEnvelope({ status: admission?.blocking_reason ?? "blocked", result: { request_id: task.request_id, intent_id: intentID, ...admission ?? {}, ...handoff ? { qr_kind: action.branded === true ? "branded_payment_card" : "official_checkout_link" } : {} }, ...handoff ? { handoff: handoff.handoff } : {}, instruction: handoff?.instruction ?? "\u5F53\u524D\u6CA1\u6709\u53EF\u7528\u7684\u5B98\u65B9\u54C1\u724C\u4ED8\u6B3E\u5361\u7247\u6216\u6536\u94F6\u53F0\u94FE\u63A5\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\uFF0C\u67E5\u8BE2\u72B6\u6001\uFF1B\u4E0D\u8981\u751F\u6210\u6216\u5C55\u793A raw QR\u3002", next: handoff?.next ?? { command: `itpay api resume ${task.request_id}`, reason: "\u6062\u590D\u540C\u4E00\u539F\u8BF7\u6C42" }, recovery: [] }, { jsonOutput: Boolean(jsonOutput), plainResult: [`request ${task.request_id} blocked intent ${intentID ?? "-"}`, ...handoff ? [JSON.stringify(handoff.handoff)] : []] });
+  writeCommandEnvelope({
+    status: reason,
+    result: { request_id: task.request_id, intent_id: intentID, ...admission, ...progress, ...handoff ? { qr_kind: action.branded === true ? "branded_payment_card" : "official_checkout_link" } : {} },
+    ...handoff ? { handoff: handoff.handoff } : {},
+    instruction: handoff?.instruction ?? "\u5C1A\u65E0\u5F53\u524D\u53EF\u7528\u7684\u5B98\u65B9\u529E\u7406\u52A8\u4F5C\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\uFF0C\u53EA\u8BFB\u6838\u5BF9\u72B6\u6001\uFF1B\u4E0D\u63A8\u6D4B\u4F59\u989D\u3001\u4E0D\u5145\u503C\u6216\u91CD\u53D1\u3002",
+    next: readOnlyNext,
+    recovery: handoff?.next ? [{ ...handoff.next, reason: "\u4EC5\u5B8C\u6210\u539F\u5B98\u65B9\u4ED8\u6B3E\u4E14\u5141\u8BB8\u7EE7\u7EED\u540E\u6062\u590D\u540C\u4E00\u8BF7\u6C42\uFF1B\u6B64\u52A8\u4F5C\u53EF\u80FD\u5199\u5165" }] : []
+  }, { jsonOutput: Boolean(jsonOutput), plainResult: [`request ${task.request_id} blocked intent ${intentID ?? "-"}`, ...handoff ? [JSON.stringify(handoff.handoff)] : []] });
 }
 __name(renderBlockedTask, "renderBlockedTask");
 async function runHubWallet(options) {
@@ -6134,8 +6359,8 @@ async function runHubContinue(intentID, options) {
   writeCommandEnvelope({
     status: res.state ?? res.status ?? "open",
     result: res,
-    instruction: res.run && res.run.execution_state === "succeeded" ? `\u8FD0\u884C\u5B8C\u6210\uFF0C\u5DF2\u6309\u4EF7\u683C\u5361\u7ED3\u7B97 ${res.run.actual_charge ? atomsToYuan(res.run.actual_charge.amount_atoms) : "\xA50.000000"}\u3002` : "\u7EED\u8DD1\u672A\u6210\u529F\u6216\u4ECD\u5728\u9014\u4E2D\uFF1B\u540C\u4E00 intent_id \u53EF\u5B89\u5168\u91CD\u8BD5\u3002",
-    next: null,
+    instruction: res.run && runTerminal(res.run) ? `\u539F\u8FD0\u884C\u5DF2\u7ED3\u675F\uFF0C\u5B9E\u9645\u8D39\u7528 ${res.run.actual_charge ? atomsToYuan(res.run.actual_charge.amount_atoms) : "\u56DE\u6267\u672A\u63D0\u4F9B"}\uFF1B\u53EA\u636E\u6743\u5A01\u4EA4\u4ED8\u4E8B\u5B9E\u56DE\u7B54\u3002` : "\u539F intent \u5DF2\u63D0\u4EA4\u7EED\u8DD1\u6216\u4ECD\u5F85\u6240\u9700\u64CD\u4F5C\uFF1B\u4FDD\u7559\u539F\u5F15\u7528\uFF0C\u4EC5\u53EA\u8BFB\u6838\u5BF9\uFF0C\u4E0D\u81EA\u52A8\u518D\u6B21 POST \u6216\u5145\u503C\u3002",
+    next: res.run && !runTerminal(res.run) ? { command: `itpay api run-status ${res.run.run_id}${options.jsonOutput ? " --json" : ""}`, reason: "\u53EA\u8BFB\u67E5\u8BE2\u539F\u8FD0\u884C", read_only: { method: "GET", path: `/v1/runs/${encodeURIComponent(res.run.run_id)}` } } : null,
     recovery: []
   }, {
     jsonOutput: Boolean(options.jsonOutput),
@@ -6144,6 +6369,7 @@ async function runHubContinue(intentID, options) {
 }
 __name(runHubContinue, "runHubContinue");
 async function runHubResume(requestID, options) {
+  validateWait(options.waitSeconds ?? 0);
   const client = hub();
   const store = new HubTaskStore();
   const task = store.get(requestID);
@@ -6153,15 +6379,17 @@ async function runHubResume(requestID, options) {
   try {
     if (task.run_id) {
       const rec = await waitForRun(client, task.run_id, options.waitSeconds ?? 0);
-      store.update(requestID, { status: rec.execution_state === "succeeded" ? "succeeded" : rec.execution_state === "failed" ? "failed" : "dispatched" });
+      updateFromRun(store, task, rec);
       renderRun(rec, options.jsonOutput);
       return;
     }
     if (task.intent_id) {
       const res = await client.continueIntent(task.intent_id, `cli-continue-${requestID}`);
       if (res.run) {
-        store.update(requestID, { run_id: res.run.run_id, status: res.run.execution_state === "succeeded" ? "succeeded" : "dispatched" });
-        renderRun(res.run, options.jsonOutput);
+        updateFromRun(store, task, res.run);
+        const rec = await waitForRun(client, res.run.run_id, options.waitSeconds ?? 0, res.run);
+        updateFromRun(store, task, rec);
+        renderRun(rec, options.jsonOutput);
       } else {
         const state = res.blocking_reason ?? res.state ?? res.status ?? "blocked";
         store.update(requestID, { blocking_reason: state });
@@ -6179,22 +6407,65 @@ async function runHubResume(requestID, options) {
   }
 }
 __name(runHubResume, "runHubResume");
+async function refreshOriginalTask(client, store, task) {
+  try {
+    const snapshot = await client.getRequest(store.idempotencyKey(task.request_id));
+    if (snapshot.request_id !== store.idempotencyKey(task.request_id) || task.intent_id && snapshot.intent_id && task.intent_id !== snapshot.intent_id || task.run_id && snapshot.run?.run_id !== task.run_id) {
+      throw new Error("invalid_state: authoritative request binding differs");
+    }
+    if (snapshot.run) {
+      if (snapshot.run.operation_id !== task.operation_id || snapshot.run.publication_id !== task.publication_id) throw new Error("invalid_state: authoritative request changed the frozen operation/publication");
+      updateFromRun(store, task, snapshot.run);
+    } else if (snapshot.intent) store.update(task.request_id, {
+      intent_id: snapshot.intent.intent_id,
+      blocking_reason: snapshot.intent.blocking_reason,
+      status: snapshot.terminal && snapshot.intent.status !== "succeeded" ? "failed" : snapshot.intent.status === "open" ? "blocked" : "unknown",
+      terminal: snapshot.terminal,
+      pending_stage: snapshot.pending_stage,
+      next: snapshot.terminal ? null : { read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent(store.idempotencyKey(task.request_id))}` } },
+      state_source: "hub",
+      state_stale: false,
+      last_checked_at: (/* @__PURE__ */ new Date()).toISOString(),
+      refresh_error: void 0
+    });
+    else throw new Error("invalid_state: original request has no authoritative binding");
+    return snapshot;
+  } catch (error) {
+    store.update(task.request_id, { status: "unknown", blocking_reason: void 0, terminal: false, pending_stage: "unknown", next: { read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent(store.idempotencyKey(task.request_id))}` } }, state_source: "hub", state_stale: true, last_checked_at: (/* @__PURE__ */ new Date()).toISOString(), refresh_error: error instanceof HttpError && error.status === 404 ? "not_found" : error instanceof Error && error.message.startsWith("invalid_state:") ? "binding_conflict" : "unavailable" });
+    return void 0;
+  }
+}
+__name(refreshOriginalTask, "refreshOriginalTask");
 async function runHubTasks(options) {
-  const tasks = new HubTaskStore().list();
+  const store = new HubTaskStore();
+  const tasks = options.requestID ? [store.get(options.requestID)].filter((t) => !!t) : store.list();
+  const selected = tasks.slice(0, 20);
+  if (options.refresh) {
+    const client = hub();
+    for (const task of selected) await refreshOriginalTask(client, store, task);
+  }
+  const refreshed = new Set(options.refresh ? selected.map((t) => t.request_id) : []);
+  const items = tasks.map((task) => {
+    const current = store.get(task.request_id);
+    return { ...current, terminal: current.terminal ?? false, pending_stage: current.terminal ? null : current.pending_stage ?? "unknown", next: current.terminal ? null : current.next ?? { read_only: { method: "GET", path: `/v1/requests/${encodeURIComponent(store.idempotencyKey(task.request_id))}` } }, ...!refreshed.has(task.request_id) ? { state_stale: true, state_source: "local" } : {} };
+  });
   writeCommandEnvelope({
     status: "listed",
-    result: { items: tasks },
-    instruction: "\u672C\u5730\u4EFB\u52A1\u8D26\u672C\uFF1Bitpay api resume <request_id> \u6062\u590D\uFF0Citpay api run-status <run_id> \u67E5\u8BE2\u3002",
+    result: { items, refresh_attempted_count: refreshed.size, refreshed_count: items.filter((t) => refreshed.has(t.request_id) && !t.state_stale).length, refresh_limit: 20 },
+    instruction: options.refresh ? "\u53EA\u8BFB\u5237\u65B0\u539F\u8BF7\u6C42\uFF1Bunknown/stale\u8868\u793A\u672A\u53D6\u5F97\u5F53\u524D\u6743\u5A01\u72B6\u6001\uFF0C\u4E0D\u4EE3\u8868\u9700\u8981\u5145\u503C\u6216\u53EF\u4EE5\u91CD\u53D1\u3002\u6BCF\u6B21\u6700\u591A20\u6761\uFF1B\u53EF\u7528 --request-id \u9650\u5B9A\u539F\u5F15\u7528\u3002" : "\u672C\u5730\u4EFB\u52A1\u5FEB\u7167\uFF0C\u53EF\u80FD\u5DF2\u8FC7\u671F\uFF1B\u7528 tasks --refresh \u53EA\u8BFB\u6838\u5BF9\u6743\u5A01\u72B6\u6001\u3002\u6B64\u5217\u8868\u4E0D\u6388\u6743\u7EED\u8DD1\u6216\u5145\u503C\u3002",
     next: null,
     recovery: []
-  }, {
-    jsonOutput: Boolean(options.jsonOutput),
-    plainResult: tasks.map((t) => `${t.request_id}  ${t.operation_id}  ${t.status}  ${t.run_id ?? t.intent_id ?? "-"}`)
-  });
+  }, { jsonOutput: Boolean(options.jsonOutput), plainResult: items.map((t) => `${t.request_id}  ${t.operation_id}  ${t.status}  ${t.run_id ?? t.intent_id ?? "-"}${t.state_stale ? "  stale" : ""}`) });
 }
 __name(runHubTasks, "runHubTasks");
 async function runHubRunStatus(runID, options) {
   const rec = await hub().runStatus(runID);
+  let store;
+  try {
+    store = new HubTaskStore();
+  } catch {
+  }
+  if (store) for (const task of store.list().filter((t) => t.run_id === runID)) updateFromRun(store, task, rec);
   renderRun(rec, options.jsonOutput);
 }
 __name(runHubRunStatus, "runHubRunStatus");
@@ -6231,63 +6502,82 @@ async function runHubCredentialsImport(options) {
 }
 __name(runHubCredentialsImport, "runHubCredentialsImport");
 async function runHubConnect(options) {
-  const cfg = hubOAuthConfig();
-  const { authorizeURL, done } = await runConnectFlow(cfg);
-  if (options.jsonOutput) process.stderr.write(`Open to authorize ItPay: ${authorizeURL}
+  return withNewHubSession(async (storeNewHubSession) => {
+    if (storedHubProfile()) throw new Error("connection_recovery_denied: existing connection preserved; use api recover-connection for exact-binding recovery, do not replace it");
+    const cfg = hubOAuthConfig();
+    const { authorizeURL, done } = await runConnectFlow(cfg);
+    if (options.jsonOutput) process.stderr.write(`Open to authorize ItPay: ${authorizeURL}
 `);
-  else writeCommandEnvelope({
-    status: "authorization_required",
-    result: {
-      authorize_url: authorizeURL,
-      client_id: cfg.clientID,
-      resource: cfg.resource
-    },
-    instruction: "\u5728\u6D4F\u89C8\u5668\u5B8C\u6210\u4E00\u6B21\u6388\u6743\uFF1BCLI \u7B49\u5F85\u56DE\u8C03\u540E\u81EA\u52A8\u7ED1\u5B9A\u3002",
-    next: null,
-    recovery: []
-  }, {
-    jsonOutput: Boolean(options.jsonOutput),
-    plainResult: ["\u6253\u5F00\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\uFF1A", `  ${authorizeURL}`]
-  });
-  const tokens = await done;
-  let me;
-  try {
-    me = await probeHubIdentity(cfg.resource, tokens.accessToken);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("connection_verification_pending:")) {
-      throw new Error("connection_not_saved: identity verification unavailable; this connection was not saved and the existing connection was not replaced");
+    else writeCommandEnvelope({
+      status: "authorization_required",
+      result: {
+        authorize_url: authorizeURL,
+        client_id: cfg.clientID,
+        resource: cfg.resource
+      },
+      instruction: "\u5728\u6D4F\u89C8\u5668\u5B8C\u6210\u4E00\u6B21\u6388\u6743\uFF1BCLI \u7B49\u5F85\u56DE\u8C03\u540E\u81EA\u52A8\u7ED1\u5B9A\u3002",
+      next: null,
+      recovery: []
+    }, {
+      jsonOutput: Boolean(options.jsonOutput),
+      plainResult: ["\u6253\u5F00\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\uFF1A", `  ${authorizeURL}`]
+    });
+    const tokens = await done;
+    let me;
+    try {
+      me = await probeHubIdentity(cfg.resource, tokens.accessToken);
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("connection_verification_pending:")) {
+        throw new Error("connection_not_saved: identity verification unavailable; this connection was not saved and the existing connection was not replaced");
+      }
+      throw error;
     }
-    throw error;
-  }
-  if (!me.buyer_id || (!me.consumer_id || me.consumer_id !== `oauth:${cfg.clientID}` && !me.consumer_id.startsWith(`oauth:${cfg.clientID}:`))) throw new Error("authorization_required: OAuth consumer mismatch");
-  const subject = me.buyer_id;
-  storeHubSession(tokens.accessToken, tokens.refreshToken, tokens.expiresIn, subject, cfg.resource, process.env, me.consumer_id);
-  writeCommandEnvelope({
-    status: "connected",
-    result: {
-      hub: cfg.resource,
-      subject: subject ?? null,
-      expires_in: tokens.expiresIn,
-      refresh_token: Boolean(tokens.refreshToken)
-    },
-    instruction: "\u5DF2\u8FDE\u63A5\u3002\u53EF\u4EE5 itpay api discover / run\uFF1B\u5145\u503C\u8BF7\u5728\u7F51\u9875\u6216 topup \u547D\u4EE4\u4E2D\u660E\u786E\u8FDB\u884C\u3002",
-    next: { command: "itpay api doctor --json", reason: "\u9A8C\u8BC1\u8FDE\u63A5\u4E0E\u76EE\u5F55\u53EF\u7528" },
-    recovery: []
-  }, {
-    jsonOutput: Boolean(options.jsonOutput),
-    plainResult: [`\u5DF2\u8FDE\u63A5 ${cfg.resource}${subject ? ` (${subject})` : ""}`]
+    if (!me.buyer_id || (!me.consumer_id || me.consumer_id !== `oauth:${cfg.clientID}` && !me.consumer_id.startsWith(`oauth:${cfg.clientID}:`))) throw new Error("authorization_required: OAuth consumer mismatch");
+    const subject = me.buyer_id;
+    storeNewHubSession(tokens.accessToken, tokens.refreshToken, tokens.expiresIn, subject, cfg.resource, me.consumer_id);
+    writeCommandEnvelope({
+      status: "connected",
+      result: {
+        hub: cfg.resource,
+        subject: subject ?? null,
+        expires_in: tokens.expiresIn,
+        refresh_token: Boolean(tokens.refreshToken)
+      },
+      instruction: "\u5DF2\u8FDE\u63A5\u3002\u53EF\u4EE5 itpay api discover / run\uFF1B\u5145\u503C\u8BF7\u5728\u7F51\u9875\u6216 topup \u547D\u4EE4\u4E2D\u660E\u786E\u8FDB\u884C\u3002",
+      next: { command: "itpay api doctor --json", reason: "\u9A8C\u8BC1\u8FDE\u63A5\u4E0E\u76EE\u5F55\u53EF\u7528" },
+      recovery: []
+    }, {
+      jsonOutput: Boolean(options.jsonOutput),
+      plainResult: [`\u5DF2\u8FDE\u63A5 ${cfg.resource}${subject ? ` (${subject})` : ""}`]
+    });
   });
 }
 __name(runHubConnect, "runHubConnect");
+async function runHubRecoverConnection(options) {
+  await recoverHubConnection();
+  writeCommandEnvelope({ status: "ok", result: { status: "recovered", original_binding_preserved: true, business_calls: 0 }, instruction: "\u539F\u8FDE\u63A5\u5DF2\u6838\u5BF9\u5E76\u6062\u590D\u3002\u4EC5\u4F7F\u7528\u539F\u5F15\u7528 tasks --refresh \u6216 run-status \u8BFB\u53D6\uFF1B\u672C\u6B21\u672A\u7EED\u8DD1\u3001\u6D3E\u53D1\u6216\u6263\u8D39\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
+}
+__name(runHubRecoverConnection, "runHubRecoverConnection");
+async function runHubOriginalReceipt(requestKey, options) {
+  const receipt = await readOriginalHubReceipt(requestKey);
+  writeCommandEnvelope({ status: "ok", result: receipt, instruction: "\u4EC5\u56DE\u8BFB\u539F consumer \u7684\u4FDD\u5B58\u7ED3\u679C\u4E0E\u5B9E\u9645\u8D39\u7528\uFF1B\u539F\u8FDE\u63A5\u672A\u6FC0\u6D3B\uFF0C\u5176\u4ED6\u8FDE\u63A5\u4FDD\u6301\u6D3B\u8DC3\u3002\u672C\u6B21\u4E0D\u6388\u6743\u7EED\u8DD1\u6216\u65B0\u4E1A\u52A1\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
+}
+__name(runHubOriginalReceipt, "runHubOriginalReceipt");
 
 // src/commands/api_commands.ts
 function reportCLIError(error, contract) {
-  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && ["authorization_required", "connection_not_saved", "connection_verification_pending", "credential_persistence_failed"].some((code2) => error.message.startsWith(code2 + ":")) ? error.message.split(":", 1)[0] : contract?.code ?? "command_failed";
+  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && ["connection_recovery_conflict", "connection_recovery_denied", "authorization_required", "connection_not_saved", "connection_verification_pending", "credential_persistence_failed"].some((code2) => error.message.startsWith(code2 + ":")) ? error.message.split(":", 1)[0] : contract?.code ?? "command_failed";
+  let original = false;
+  try {
+    original = Boolean(storedHubProfile()?.consumer_id);
+  } catch {
+    original = true;
+  }
   const auth = code === "authorization_required" || code === "unauthenticated";
   const taskID = error instanceof HubTaskRequestError ? error.requestID : void 0;
   const references = error instanceof HubTaskRequestError ? error.references : void 0;
-  const recover = taskID ? { command: qualifyItPayCommand(references?.run_id ? `itpay api run-status ${references.run_id}${contract?.jsonOutput ? " --json" : ""}` : `itpay api resume ${taskID}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: "\u8BFB\u53D6\u6216\u6062\u590D\u540C\u4E00\u539F\u4EFB\u52A1\uFF0C\u4E0D\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42" } : null;
-  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error) }, ...references ? { result: references } : {}, instruction: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF0C\u5C1A\u672A\u4FDD\u5B58\uFF1B\u539F\u6709\u8FDE\u63A5\u672A\u66FF\u6362\u3002\u670D\u52A1\u6062\u590D\u540E\u6309\u539F\u914D\u7F6E\u6B63\u5E38 connect\uFF0C\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_verification_pending" ? "\u539F\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u5F15\u7528\uFF0C\u4E0D\u91CD\u65B0\u6388\u6743\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002\u7A0D\u540E\u53EA\u8BFB\u6838\u5BF9\u539F\u4EFB\u52A1\u3002" : code === "credential_persistence_failed" ? "\u539F\u8FDE\u63A5\u672A\u80FD\u5B89\u5168\u843D\u76D8\uFF1B\u505C\u6B62\u91CD\u8BD5\u5E76\u6838\u5BF9\u79C1\u6709\u5B58\u50A8\uFF0C\u4E0D\u6E05\u72B6\u6001\u6216\u6362\u8EAB\u4EFD\u3002" : auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth || code === "connection_not_saved" ? { command: qualifyItPayCommand(`itpay api connect${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u672A\u4FDD\u5B58\uFF1B\u6309\u539F\u914D\u7F6E\u5B8C\u6210\u6B63\u5E38\u8FDE\u63A5" : "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required", "credential_persistence_failed"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
+  const recover = taskID ? { command: qualifyItPayCommand(references?.run_id ? `itpay api run-status ${references.run_id}${contract?.jsonOutput ? " --json" : ""}` : `itpay api tasks --refresh --request-id ${taskID}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: "\u53EA\u8BFB\u6838\u5BF9\u540C\u4E00\u539F\u4EFB\u52A1\uFF0C\u4E0D\u521B\u5EFA\u6216\u7EED\u8DD1\u8BF7\u6C42", read_only: { method: "GET", path: references?.run_id ? `/v1/runs/${encodeURIComponent(references.run_id)}` : `/v1/requests/${encodeURIComponent("cli-req-" + taskID)}` } } : null;
+  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error), ...hubErrorDetails(error) ? { details: hubErrorDetails(error) } : {} }, ...references ? { result: references } : {}, instruction: code === "connection_recovery_conflict" ? "\u5DF2\u6709\u5176\u4ED6active\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8FDE\u63A5\u3001\u4EFB\u52A1\u4E0E\u79C1\u6709\u5019\u9009\uFF0C\u4EA4owner\u88C1\u51B3\uFF0C\u4E0D\u66FF\u6362\u6216\u64A4\u9500\u5176\u4ED6\u8FDE\u63A5\u3002" : code === "connection_recovery_denied" ? "\u539F\u8FDE\u63A5\u6062\u590D\u672A\u901A\u8FC7\uFF1B\u4FDD\u7559\u539Fprofile\u3001\u4EFB\u52A1\u53CA\u79C1\u6709\u6062\u590D\u6750\u6599\uFF0C\u4E0D\u65B0\u5EFAconnect\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF0C\u5C1A\u672A\u4FDD\u5B58\uFF1B\u539F\u6709\u8FDE\u63A5\u672A\u66FF\u6362\u3002\u670D\u52A1\u6062\u590D\u540E\u6309\u539F\u914D\u7F6E\u6B63\u5E38 connect\uFF0C\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_verification_pending" ? "\u539F\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u5F15\u7528\uFF0C\u4E0D\u91CD\u65B0\u6388\u6743\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002\u7A0D\u540E\u53EA\u8BFB\u6838\u5BF9\u539F\u4EFB\u52A1\u3002" : code === "credential_persistence_failed" ? "\u539F\u8FDE\u63A5\u672A\u80FD\u5B89\u5168\u843D\u76D8\uFF1B\u505C\u6B62\u91CD\u8BD5\u5E76\u6838\u5BF9\u79C1\u6709\u5B58\u50A8\uFF0C\u4E0D\u6E05\u72B6\u6001\u6216\u6362\u8EAB\u4EFD\u3002" : auth && original ? "\u539F\u8FDE\u63A5\u5931\u6548\uFF1B\u4EC5\u7528 api recover-connection \u9A8C\u8BC1\u539F\u6388\u6743\u6062\u590D\uFF0C\u4FDD\u7559\u539Fprofile\u548C\u4EFB\u52A1\uFF0C\u4E0D\u65B0\u5EFA\u8FDE\u63A5\u6216\u91CD\u53D1\u4E1A\u52A1\u3002" : auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth || code === "connection_not_saved" ? { command: qualifyItPayCommand(`itpay api ${original ? "recover-connection" : "connect"}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u672A\u4FDD\u5B58\uFF1B\u6309\u539F\u914D\u7F6E\u5B8C\u6210\u6B63\u5E38\u8FDE\u63A5" : "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required", "credential_persistence_failed"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
   process.exitCode = 1;
 }
 __name(reportCLIError, "reportCLIError");
@@ -6307,6 +6597,21 @@ function registerAPICommands(program3) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_connect_failed", instruction: "\u786E\u8BA4 ITPAY_HUB_URL \u53EF\u8FBE\u4E14\u6D4F\u89C8\u5668\u6388\u6743\u5DF2\u5B8C\u6210\u3002", recovery: [] });
     }
   });
+  hubCmd.command("original-receipt <request_key>").description("Read only the original consumer's saved run result and charge; never activate or resume").option("--json", "output JSON").action(async (requestKey, options) => {
+    try {
+      await runHubOriginalReceipt(requestKey, { jsonOutput: Boolean(options.json) });
+    } catch {
+      writeCommandEnvelope({ status: "error", error: { code: "receipt_unavailable", message: "\u539F\u5386\u53F2\u56DE\u6267\u672A\u53D6\u5F97\u3002" }, instruction: "\u4FDD\u7559\u539F\u8EAB\u4EFD\u4E0E\u79C1\u6709\u5019\u9009\uFF0C\u4EA4 owner \u6838\u5BF9\uFF0C\u4E0D\u6062\u590D/\u65B0\u5EFA\u8FDE\u63A5\u6216\u7EED\u8DD1\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.json) });
+      process.exitCode = 1;
+    }
+  });
+  hubCmd.command("recover-connection").description("Recover the exact original OAuth consumer with its original refresh proof; no browser or business retry").option("--json", "output JSON").action(async (options) => {
+    try {
+      await runHubRecoverConnection({ jsonOutput: Boolean(options.json) });
+    } catch (error) {
+      reportCLIError(error, { jsonOutput: Boolean(options.json), code: "connection_recovery_denied", instruction: "\u4FDD\u7559\u539F\u8FDE\u63A5\u53CA\u4EFB\u52A1\uFF1B\u4E0D\u5F97\u65B0\u5EFA\u8FDE\u63A5\u66FF\u4EE3\u3002", recovery: [] });
+    }
+  });
   hubCmd.command("discover").description("Search the published API catalog").option("--query <text>").option("--kinds <kinds>", "comma-separated kinds").option("--effect-classes <classes>", "comma-separated effect classes").option("--limit <n>", "max items", "50").option("--json", "output JSON").action(async (options) => {
     try {
       await runHubDiscover({
@@ -6343,21 +6648,21 @@ function registerAPICommands(program3) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_run_failed", instruction: "\u786E\u8BA4 publication_id \u4E0E input \u7B26\u5408 inspect \u8FD4\u56DE\u7684\u5951\u7EA6\u3002", recovery: [] });
     }
   });
-  hubCmd.command("resume").description("Resume a persisted task by request_id \u2014 same key, never a new request").argument("<request_id>").option("--wait <seconds>", "poll run status until terminal", "0").option("--json", "output JSON").action(async (requestID, options) => {
+  hubCmd.command("resume").description("Resume the original task (may POST its intent once); --wait only reads the bound run").argument("<request_id>").option("--wait <seconds>", "poll run status until terminal", "0").option("--json", "output JSON").action(async (requestID, options) => {
     try {
       await runHubResume(requestID, { waitSeconds: Number(options.wait), jsonOutput: Boolean(options.json) });
     } catch (error) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_resume_failed", instruction: "request_id \u6765\u81EA itpay api tasks\u3002", recovery: [] });
     }
   });
-  hubCmd.command("tasks").description("List durable Hub tasks (request \u2192 run/intent binding)").option("--json", "output JSON").action(async (options) => {
+  hubCmd.command("tasks").description("List local Hub task snapshots; --refresh reads original authoritative bindings only").option("--refresh", "read-only refresh of at most 20 original requests").option("--request-id <id>", "select one original local request").option("--json", "output JSON").action(async (options) => {
     try {
-      await runHubTasks({ jsonOutput: Boolean(options.json) });
+      await runHubTasks({ jsonOutput: Boolean(options.json), refresh: Boolean(options.refresh), requestID: options.requestId });
     } catch (error) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_tasks_failed", instruction: "\u672C\u5730\u4EFB\u52A1\u8D26\u672C\u4E0D\u53EF\u8BFB\u3002", recovery: [] });
     }
   });
-  hubCmd.command("run-status").description("Query an existing run \u2014 never creates a new request").argument("<run_id>").option("--json", "output JSON").action(async (runID, options) => {
+  hubCmd.command("run-status").description("Query an existing run once (read-only); --wait is not supported").showHelpAfterError("run-status is a single read and rejects --wait; inspect api resume --help only for an authorized original-task continuation.").addHelpText("after", "\nrun-status accepts no --wait. Use resume <request_id> --wait only when continuing that original task is authorized; an intent resume may perform a write.").argument("<run_id>").option("--json", "output JSON").action(async (runID, options) => {
     try {
       await runHubRunStatus(runID, { jsonOutput: Boolean(options.json) });
     } catch (error) {
@@ -16795,7 +17100,7 @@ import { createHash as createHash12 } from "node:crypto";
 
 // src/state/skill_identity.generated.ts
 var CANONICAL_SKILL_SHA256 = "4a38087a41ed4b9b6e879726b93bdef99ca67fccd2a0f9837123d5b334b046c0";
-var CANONICAL_API_SKILL_SHA256 = "dffec781d5053bbdb93ec555ad2b1b4a7cad55c2281a3c9c19597a4a9418bde6";
+var CANONICAL_API_SKILL_SHA256 = "4faa2890ce35283256611d28d216d044e06e209e9d532597e4bba9079e66eb21";
 
 // src/commands/skill.ts
 import { existsSync as existsSync9, readFileSync as readFileSync16 } from "node:fs";