@itpay/cli 2.1.64 → 2.1.65

package/dist/src/main.js

@@ -3064,6 +3064,538 @@ var require_commander = __commonJS({
   }
 });
 
+// src/state/hub_credentials.ts
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { dirname as dirname2, resolve } from "node:path";
+
+// src/state/file_lock.ts
+import { chmodSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomUUID } from "node:crypto";
+var STALE_MS = 3e4;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+__name(sleepSync, "sleepSync");
+function ownerAlive(path2) {
+  try {
+    const st = lstatSync(path2);
+    if (st.isSymbolicLink()) return false;
+    if (Date.now() - st.mtimeMs < STALE_MS) return true;
+    const token = readFileSync(path2, "utf8");
+    const pid = Number(/^(\d+):/.exec(token)?.[1]);
+    if (!Number.isInteger(pid) || pid <= 0) return false;
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  } catch {
+    return false;
+  }
+}
+__name(ownerAlive, "ownerAlive");
+function withFileLock(lockPath, fn) {
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
+  const token = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + 15e3;
+  for (; ; ) {
+    try {
+      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
+      chmodSync(lockPath, 384);
+      break;
+    } catch (error) {
+      const code = error.code;
+      if (code !== "EEXIST") throw error;
+      if (!ownerAlive(lockPath)) {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error(`task store lock busy: ${lockPath}`);
+      sleepSync(20);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    try {
+      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
+    } catch {
+    }
+  }
+}
+__name(withFileLock, "withFileLock");
+async function withAsyncFileLock(lockPath, fn) {
+  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
+  const token = `${process.pid}:${randomUUID()}`;
+  const deadline = Date.now() + 2e4;
+  for (; ; ) {
+    try {
+      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      if (!ownerAlive(lockPath)) {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+        continue;
+      }
+      if (Date.now() > deadline) throw new Error("credential refresh lock busy");
+      await new Promise((resolve10) => setTimeout(resolve10, 20));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    try {
+      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
+    } catch {
+    }
+  }
+}
+__name(withAsyncFileLock, "withAsyncFileLock");
+
+// src/state/hub_oauth.ts
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+function hubOAuthConfig(env = process.env) {
+  const devHub = (env.ITPAY_HUB_URL ?? "").replace(/\/+$/, "") === "https://market-v4-dev.itpay.ai";
+  const issuer = (env.ITPAY_HUB_OAUTH_ISSUER ?? (devHub ? "https://auth-v4-dev.itpay.ai" : "http://localhost:24444")).replace(/\/+$/, "");
+  return {
+    authorizeURL: `${issuer}/oauth2/auth`,
+    tokenURL: `${issuer}/oauth2/token`,
+    clientID: env.ITPAY_HUB_OAUTH_CLIENT ?? "itpay-cli-local",
+    resource: (env.ITPAY_HUB_URL ?? "http://localhost:18090").replace(/\/+$/, ""),
+    scope: env.ITPAY_HUB_OAUTH_SCOPE ?? "openid offline_access itpay.hub"
+  };
+}
+__name(hubOAuthConfig, "hubOAuthConfig");
+function pkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+__name(pkce, "pkce");
+async function runConnectFlow(cfg, timeoutMs = 3e5) {
+  const { verifier, challenge } = pkce();
+  const state = randomBytes(16).toString("hex");
+  const server = createServer();
+  const done = new Promise((resolvePromise, reject) => {
+    const timer = setTimeout(() => {
+      server.close();
+      reject(new Error("connect timed out waiting for browser authorization"));
+    }, timeoutMs);
+    server.on("request", (req, res) => {
+      const u = new URL(req.url ?? "/", "http://127.0.0.1");
+      const finish = /* @__PURE__ */ __name((ok, msg) => {
+        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
+        res.end(`<!doctype html><meta charset="utf-8"><title>ItPay</title><body style="font-family:system-ui;padding:3em;text-align:center"><h2>${msg.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;")}</h2><p>\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u56DE\u5230\u7EC8\u7AEF\u7EE7\u7EED\u3002</p></body>`);
+      }, "finish");
+      (async () => {
+        if (u.pathname !== "/callback") return finish(false, "\u65E0\u6548\u7684\u56DE\u8C03");
+        if (u.searchParams.get("state") !== state) return finish(false, "state \u4E0D\u5339\u914D");
+        if (u.searchParams.get("error")) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "\u6388\u6743\u88AB\u62D2\u7EDD");
+          reject(new Error("authorization_required: consent denied"));
+          return;
+        }
+        const code = u.searchParams.get("code");
+        if (!code) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "\u7F3A\u5C11 code");
+          reject(new Error("missing code"));
+          return;
+        }
+        const form = new URLSearchParams({
+          grant_type: "authorization_code",
+          code,
+          redirect_uri: `http://127.0.0.1:${server.address().port}/callback`,
+          client_id: cfg.clientID,
+          code_verifier: verifier,
+          resource: cfg.resource
+        });
+        const tok = await fetch(cfg.tokenURL, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: form,
+          signal: AbortSignal.timeout(1e4)
+        });
+        if (!tok.ok) {
+          clearTimeout(timer);
+          server.close();
+          finish(false, "token \u4EA4\u6362\u5931\u8D25");
+          reject(new Error(`token endpoint ${tok.status}`));
+          return;
+        }
+        const t = await tok.json();
+        clearTimeout(timer);
+        server.close();
+        finish(true, "ItPay \u5DF2\u8FDE\u63A5");
+        resolvePromise({ accessToken: t.access_token, refreshToken: t.refresh_token, expiresIn: t.expires_in });
+      })().catch((e) => {
+        clearTimeout(timer);
+        server.close();
+        reject(e);
+      });
+    });
+  });
+  await new Promise((resolvePromise, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => resolvePromise());
+  });
+  const port = server.address().port;
+  const authorizeURL = `${cfg.authorizeURL}?` + new URLSearchParams({
+    response_type: "code",
+    client_id: cfg.clientID,
+    redirect_uri: `http://127.0.0.1:${port}/callback`,
+    scope: cfg.scope,
+    state,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    resource: cfg.resource
+  }).toString();
+  return { authorizeURL, done };
+}
+__name(runConnectFlow, "runConnectFlow");
+
+// src/state/hub_credentials.ts
+import { homedir } from "node:os";
+function hubCredentialsPath(env = process.env) {
+  const dir = env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), ".itpay-v3");
+  const suffix = createHash2("sha256").update(env.ITPAY_HUB_URL ?? "http://localhost:18090").digest("hex").slice(0, 12);
+  return resolve(dir, `hub-credentials.${suffix}.json`);
+}
+__name(hubCredentialsPath, "hubCredentialsPath");
+function importHubKeyUnlocked(apiKey, baseURL, env = process.env) {
+  if (!/^itk_[A-Za-z0-9_-]{8,}$/.test(apiKey)) {
+    throw new Error("invalid key format \u2014 expected an itk_ API key");
+  }
+  const path2 = hubCredentialsPath(env);
+  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+  file.profiles["default"] = {
+    base_url: baseURL,
+    key_prefix: apiKey.slice(0, 14),
+    api_key: apiKey,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveHubProfileUnlocked(file.profiles["default"], env);
+  return { key_prefix: apiKey.slice(0, 14) };
+}
+__name(importHubKeyUnlocked, "importHubKeyUnlocked");
+function storedHubKey(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    return file.profiles["default"]?.api_key;
+  } catch {
+    return void 0;
+  }
+}
+__name(storedHubKey, "storedHubKey");
+function storedHubKeyPrefix(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    return file.profiles["default"]?.key_prefix;
+  } catch {
+    return void 0;
+  }
+}
+__name(storedHubKeyPrefix, "storedHubKeyPrefix");
+function storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
+  const path2 = hubCredentialsPath(env);
+  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+  const issuedAt = Date.now();
+  const margin = Math.min(3e4, Math.max(100, expiresIn * 100));
+  file.profiles["default"] = {
+    base_url: baseURL,
+    access_token: accessToken,
+    ...refreshToken ? { refresh_token: refreshToken } : {},
+    expires_at: new Date(issuedAt + expiresIn * 1e3).toISOString(),
+    refresh_after: new Date(issuedAt + expiresIn * 1e3 - margin).toISOString(),
+    ...subject ? { subject } : {},
+    consumer_id: consumerID ?? `oauth:${hubOAuthConfig(env).clientID}`,
+    client_id: hubOAuthConfig(env).clientID,
+    token_url: hubOAuthConfig(env).tokenURL,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveHubProfileUnlocked(file.profiles["default"], env);
+}
+__name(storeHubSessionUnlocked, "storeHubSessionUnlocked");
+function saveHubProfileUnlocked(profile, env) {
+  const path2 = hubCredentialsPath(env);
+  const tmp = `${path2}.${randomUUID2()}.tmp`;
+  try {
+    const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
+    file.profiles.default = profile;
+    mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
+    writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", flag: "wx", mode: 384 });
+    chmodSync2(tmp, 384);
+    renameSync(tmp, path2);
+  } catch {
+    throw new Error("credential_persistence_failed: could not save the original connection; stop and check private storage before retrying");
+  } finally {
+    try {
+      unlinkSync2(tmp);
+    } catch {
+    }
+  }
+}
+__name(saveHubProfileUnlocked, "saveHubProfileUnlocked");
+async function probeHubIdentity(resource, accessToken) {
+  let response;
+  try {
+    response = await fetch(`${resource}/v1/me`, {
+      headers: { Authorization: `Bearer ${accessToken}`, "X-ItPay-OAuth-Resource": resource },
+      signal: AbortSignal.timeout(1e4)
+    });
+  } catch {
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  }
+  if (!response.ok) {
+    if (response.status === 401 || response.status === 403) throw new Error("authorization_required: original connection identity rejected");
+    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  }
+  try {
+    const identity = await response.json();
+    if (!identity || typeof identity !== "object" || Array.isArray(identity)) throw new Error();
+    const me = identity;
+    if (typeof me.buyer_id !== "string" || !me.buyer_id || typeof me.consumer_id !== "string" || !me.consumer_id) throw new Error();
+    return { buyer_id: me.buyer_id, consumer_id: me.consumer_id };
+  } catch {
+    throw new Error("connection_verification_pending: identity response invalid; preserve the original connection and references, do not reconnect");
+  }
+}
+__name(probeHubIdentity, "probeHubIdentity");
+function storedHubToken(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2) || existsSync(path2 + ".recovery.json")) return void 0;
+  try {
+    const file = JSON.parse(readFileSync2(path2, "utf8"));
+    const p = file.profiles["default"];
+    if (!p?.access_token || p.identity_verification_pending) return void 0;
+    if (p.expires_at && Date.parse(p.expires_at) <= Date.now()) return void 0;
+    return p.access_token;
+  } catch {
+    return void 0;
+  }
+}
+__name(storedHubToken, "storedHubToken");
+function storedHubProfile(env = process.env) {
+  const path2 = hubCredentialsPath(env);
+  if (!existsSync(path2)) return void 0;
+  return JSON.parse(readFileSync2(path2, "utf8")).profiles.default;
+}
+__name(storedHubProfile, "storedHubProfile");
+async function connectedHubToken(env = process.env, rejectedToken) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    if (existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_verification_pending: original recovery pending; only api recover-connection may verify its candidate, no business retry");
+    const p = storedHubProfile(env);
+    if (!p?.access_token || !p.subject) throw new Error("authorization_required: reconnect ItPay");
+    const cfg = hubOAuthConfig(env);
+    if (p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID || !p.consumer_id) {
+      throw new Error("authorization_required: connection configuration changed");
+    }
+    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
+    if (!p.identity_verification_pending && p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
+    let candidate = p;
+    if (!p.identity_verification_pending || !(Date.parse(p.expires_at ?? "") > Date.now())) {
+      if (!p.refresh_token) throw new Error("authorization_required: reconnect the original ItPay connection");
+      let response;
+      try {
+        response = await fetch(p.token_url, {
+          method: "POST",
+          headers: { "Content-Type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
+          signal: AbortSignal.timeout(1e4)
+        });
+      } catch {
+        throw new Error("connection_verification_pending: refresh outcome unknown; preserve the original connection and references, do not repeat authorization or business requests");
+      }
+      if (!response.ok) {
+        let rejected = response.status === 401 || response.status === 403;
+        if (response.status === 400) {
+          try {
+            const problem = await response.json();
+            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
+          } catch {
+          }
+        }
+        if (rejected) throw new Error("authorization_required: connection refresh rejected");
+        throw new Error("connection_verification_pending: refresh unavailable; preserve the original connection and references");
+      }
+      let token;
+      try {
+        token = await response.json();
+      } catch {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      if (!token || typeof token.access_token !== "string" || !token.access_token || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || (!Number.isFinite(Date.now() + token.expires_in * 1e3) || Date.now() + token.expires_in * 1e3 > 864e13) || token.refresh_token !== void 0 && (typeof token.refresh_token !== "string" || !token.refresh_token)) {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      }
+      const now = Date.now();
+      candidate = {
+        ...p,
+        access_token: token.access_token,
+        refresh_token: token.refresh_token ?? p.refresh_token,
+        expires_at: new Date(now + token.expires_in * 1e3).toISOString(),
+        refresh_after: new Date(now + token.expires_in * 1e3 - Math.min(3e4, Math.max(100, token.expires_in * 100))).toISOString(),
+        identity_verification_pending: true
+      };
+      saveHubProfileUnlocked(candidate, env);
+    }
+    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
+    if (identity.buyer_id !== p.subject || identity.consumer_id !== p.consumer_id) {
+      throw new Error("authorization_required: refreshed identity changed");
+    }
+    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) {
+      throw new Error("connection_verification_pending: token expired during identity check; preserve the original connection and references");
+    }
+    delete candidate.identity_verification_pending;
+    saveHubProfileUnlocked(candidate, env);
+    return candidate.access_token;
+  });
+}
+__name(connectedHubToken, "connectedHubToken");
+function importHubKey(apiKey, baseURL, env = process.env) {
+  return withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => importHubKeyUnlocked(apiKey, baseURL, env));
+}
+__name(importHubKey, "importHubKey");
+async function recoverHubConnection(env = process.env) {
+  await withOriginalHubCandidate(env);
+}
+__name(recoverHubConnection, "recoverHubConnection");
+async function readOriginalHubReceipt(requestKey, env = process.env) {
+  if (!requestKey || requestKey.length > 512 || /[\r\n\0]/.test(requestKey)) throw new Error("receipt_denied: exact original request key required");
+  return withOriginalHubCandidate(env, requestKey);
+}
+__name(readOriginalHubReceipt, "readOriginalHubReceipt");
+async function withOriginalHubCandidate(env, receiptRequest) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    const original = storedHubProfile(env), cfg = hubOAuthConfig(env);
+    if (!original?.subject || !original.consumer_id || !original.refresh_token || original.api_key || original.base_url !== cfg.resource || original.client_id !== cfg.clientID || original.token_url !== cfg.tokenURL || env.ITPAY_HUB_KEY || env.ITPAY_HUB_TOKEN) throw new Error("connection_recovery_denied: original OAuth binding and refresh proof required; preserve profile and tasks");
+    const path2 = hubCredentialsPath(env) + ".recovery.json";
+    const binding = { base_url: original.base_url, subject: original.subject, consumer_id: original.consumer_id, client_id: original.client_id, token_url: original.token_url };
+    const save = /* @__PURE__ */ __name((pending2) => {
+      const tmp = path2 + "." + randomUUID2() + ".tmp";
+      try {
+        writeFileSync2(tmp, JSON.stringify(pending2), { flag: "wx", mode: 384 });
+        renameSync(tmp, path2);
+      } finally {
+        try {
+          unlinkSync2(tmp);
+        } catch {
+        }
+      }
+    }, "save");
+    let pending;
+    let refreshSource = original;
+    if (existsSync(path2)) {
+      try {
+        pending = JSON.parse(readFileSync2(path2, "utf8"));
+      } catch {
+        throw new Error("connection_recovery_denied: private recovery material unreadable; preserve original profile");
+      }
+      if (!pending || typeof pending !== "object" || JSON.stringify(pending.binding) !== JSON.stringify(binding)) throw new Error("connection_recovery_denied: recovery binding changed; preserve original profile");
+      if (pending.phase !== "candidate" || !pending.profile) throw new Error("connection_verification_pending: refresh outcome unknown; preserve private recovery material, do not repeat refresh or connect");
+      if (!Object.entries(binding).every(([k, v]) => pending.profile[k] === v)) throw new Error("connection_recovery_denied: private candidate binding mismatch; preserve original profile");
+    }
+    if (!pending || !(Date.parse(pending.profile?.expires_at ?? "") > Date.now())) {
+      refreshSource = pending?.profile ?? original;
+      if (!refreshSource.refresh_token) throw new Error("connection_recovery_denied: original refresh proof unavailable; preserve profile and candidate");
+      save({ binding, phase: "refresh_unknown", profile: refreshSource });
+      let response2;
+      try {
+        response2 = await fetch(cfg.tokenURL, { method: "POST", redirect: "error", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: refreshSource.refresh_token, client_id: cfg.clientID, resource: cfg.resource }), signal: AbortSignal.timeout(1e4) });
+      } catch {
+        throw new Error("connection_verification_pending: refresh outcome unknown; preserve original profile and private recovery material");
+      }
+      if (!response2.ok) {
+        let rejected = response2.status === 401 || response2.status === 403;
+        if (response2.status === 400) {
+          try {
+            const problem = await response2.json();
+            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
+          } catch {
+          }
+        }
+        if (rejected) throw new Error("connection_recovery_denied: original refresh proof rejected; preserve profile and tasks, do not create a replacement connection");
+        throw new Error("connection_verification_pending: refresh unavailable or outcome unknown; preserve original profile and private recovery material");
+      }
+      let t;
+      try {
+        t = await response2.json();
+      } catch {
+        throw new Error("connection_verification_pending: invalid refresh response; preserve private recovery material");
+      }
+      if (!t || typeof t !== "object" || typeof t.access_token !== "string" || !t.access_token || typeof t.token_type !== "string" || t.token_type.toLowerCase() !== "bearer" || typeof t.expires_in !== "number" || !Number.isFinite(t.expires_in) || t.expires_in <= 0 || Date.now() + t.expires_in * 1e3 > 864e13 || t.refresh_token !== void 0 && (typeof t.refresh_token !== "string" || !t.refresh_token)) throw new Error("connection_verification_pending: invalid refresh response; preserve private recovery material");
+      const now = Date.now();
+      pending = { binding, phase: "candidate", profile: { ...original, access_token: t.access_token, refresh_token: t.refresh_token ?? refreshSource.refresh_token, expires_at: new Date(now + t.expires_in * 1e3).toISOString(), refresh_after: new Date(now + t.expires_in * 1e3 - Math.min(3e4, Math.max(100, t.expires_in * 100))).toISOString(), identity_verification_pending: true } };
+      save(pending);
+    }
+    const candidate = pending.profile;
+    if (!Object.entries(binding).every(([k, v]) => candidate[k] === v)) throw new Error("connection_recovery_denied: private candidate binding mismatch; preserve original profile");
+    if (!candidate.access_token || !(Date.parse(candidate.expires_at ?? "") > Date.now())) throw new Error("connection_recovery_denied: recovery candidate expired; preserve private proof and request owner review");
+    if (receiptRequest !== void 0) {
+      let response2;
+      try {
+        response2 = await fetch(cfg.resource + "/v1/requests/" + encodeURIComponent(receiptRequest), { method: "GET", redirect: "error", headers: { Authorization: "Bearer " + candidate.access_token, "X-ItPay-OAuth-Resource": cfg.resource, "X-ItPay-Receipt-Only": "1", "X-ItPay-Expected-Buyer": binding.subject, "X-ItPay-Expected-Consumer": binding.consumer_id }, signal: AbortSignal.timeout(1e4) });
+      } catch {
+        throw new Error("receipt_unavailable: original receipt unavailable; preserve profile and private candidate");
+      }
+      if (!response2.ok) throw new Error("receipt_denied: original receipt rejected; preserve profile and private candidate");
+      const result2 = await response2.json();
+      if (result2?.request_id !== receiptRequest || result2.read_only !== true || typeof result2.run?.run_id !== "string") throw new Error("receipt_denied: invalid original receipt reply");
+      return result2;
+    }
+    let response;
+    try {
+      response = await fetch(cfg.resource + "/v1/connection/recover", { method: "POST", redirect: "error", headers: { "Content-Type": "application/json", Authorization: "Bearer " + candidate.access_token, "X-ItPay-OAuth-Resource": cfg.resource }, body: JSON.stringify({ expected_buyer_id: binding.subject, expected_consumer_id: binding.consumer_id }), signal: AbortSignal.timeout(1e4) });
+    } catch {
+      throw new Error("connection_verification_pending: recovery outcome unknown; preserve original profile and candidate; retry only this recovery, never business");
+    }
+    if (response.status === 409) throw new Error("connection_recovery_conflict: another active connection requires owner review; preserve original profile, tasks and candidate");
+    if (response.status >= 500 || response.status === 404 || response.status === 405) throw new Error("connection_verification_pending: paired recovery owner unavailable; preserve profile and candidate");
+    if (!response.ok) throw new Error("connection_recovery_denied: owner rejected original binding; preserve profile, tasks and private candidate");
+    let result;
+    try {
+      result = await response.json();
+    } catch {
+      throw new Error("connection_verification_pending: recovery reply invalid; preserve original profile and candidate");
+    }
+    if (!result || typeof result !== "object" || result.buyer_id !== binding.subject || result.consumer_id !== binding.consumer_id || result.status !== "recovered") throw new Error("connection_recovery_denied: owner recovery binding mismatch; preserve original profile");
+    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
+    if (identity.buyer_id !== binding.subject || identity.consumer_id !== binding.consumer_id) throw new Error("connection_recovery_denied: verified original identity mismatch; preserve profile and tasks");
+    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) throw new Error("connection_verification_pending: candidate expired during verification; preserve original profile");
+    delete candidate.identity_verification_pending;
+    saveHubProfileUnlocked(candidate, env);
+    unlinkSync2(path2);
+  });
+}
+__name(withOriginalHubCandidate, "withOriginalHubCandidate");
+async function withNewHubSession(action, env = process.env) {
+  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
+    if (storedHubProfile(env) || existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_recovery_denied: existing connection preserved; use api recover-connection, never replace it");
+    return action((access, refresh, seconds, subject, base, consumer) => {
+      if (storedHubProfile(env) || existsSync(hubCredentialsPath(env) + ".recovery.json")) throw new Error("connection_recovery_denied: original profile appeared; new connection not saved");
+      storeHubSessionUnlocked(access, refresh, seconds, subject, base, env, consumer);
+    });
+  });
+}
+__name(withNewHubSession, "withNewHubSession");
+
 // src/commands/admin.ts
 import { readFileSync as readFileSync3 } from "node:fs";
 
@@ -3369,792 +3901,379 @@ var HubClient = class {
   adminInventory(query = {}) {
     return this.request("GET", "/v1/admin/operations", { query });
   }
-  adminOperation(operationId) {
-    return this.request("GET", `/v1/admin/operations/${encodeURIComponent(operationId)}`);
-  }
-  saveAPIDraft(body) {
-    return this.request("POST", "/v1/admin/apis", { body });
-  }
-  intakeAPI(body) {
-    return this.request("POST", "/v1/admin/intakes", { body });
-  }
-  intakeReport(intakeId) {
-    return this.request("GET", `/v1/admin/intakes/${encodeURIComponent(intakeId)}`);
-  }
-  validateAPI(operationId, body) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/validate`, { body });
-  }
-  reviewAPI(operationId, body) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/review`, { body });
-  }
-  activateAPI(operationId) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/activate`, { body: {} });
-  }
-  recordAPIHealth(operationId, status, sampleCount = 1) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/health`, { body: { status, sample_count: sampleCount } });
-  }
-  publishAPI(operationId, body) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/publish`, { body });
-  }
-  rollbackAPI(operationId, body) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/rollback`, { body });
-  }
-  setAPIAccepting(operationId, accepting, body) {
-    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/${accepting ? "unsuspend" : "suspend"}`, { body });
-  }
-  probePermits(operationId, digest) {
-    return this.request("GET", `/v1/admin/operations/${encodeURIComponent(operationId)}/probe-permits`, { query: { digest } });
-  }
-  /** Account-session only. Raw supplier secrets are write-only. */
-  userCredentials() {
-    return this.request("GET", "/v1/me/credentials");
-  }
-  /** Account-session only; exact publication requirements, never secret values. */
-  nativeCredentialRequirements(operationId, publicationId) {
-    return this.request("GET", `/v1/operations/${encodeURIComponent(operationId)}/credential-requirements`, { query: { publication_id: publicationId } });
-  }
-  credentialProviders() {
-    return this.request("GET", "/v1/me/credential-providers");
-  }
-  saveUserCredential(body) {
-    return this.request("POST", "/v1/me/credentials", { body });
-  }
-  revokeUserCredential(id, expectedVersion) {
-    return this.request("DELETE", `/v1/me/credentials/${encodeURIComponent(id)}`, { body: { expected_version: expectedVersion } });
-  }
-  credentials() {
-    return this.request("GET", "/v1/admin/credentials");
-  }
-  /** One-time secret upload. Never use this payload in logs, URLs or persistence. */
-  rotateCredential(ref, body) {
-    return this.request("POST", `/v1/admin/credentials/${encodeURIComponent(ref)}/rotate`, { body });
-  }
-  revokeCredential(ref, expectedVersion) {
-    return this.request("POST", `/v1/admin/credentials/${encodeURIComponent(ref)}/revoke`, { body: { expected_version: expectedVersion } });
-  }
-  paymentReconciliation() {
-    return this.request("GET", "/v1/admin/payment-reconciliation");
-  }
-  compensatePayment(eventId, reason, idempotencyKey) {
-    return this.request("POST", `/v1/admin/collection-events/${encodeURIComponent(eventId)}/refund`, { body: { reason }, idempotencyKey });
-  }
-  switchTopupChannel(topupId, channel, mode, expectedCollectionRef, idempotencyKey) {
-    return this.request("POST", `/v1/me/topups/${encodeURIComponent(topupId)}/switch-channel`, { body: { channel, mode, expected_collection_ref: expectedCollectionRef }, idempotencyKey });
-  }
-};
-
-// src/client/transport.ts
-var HttpTransportError = class extends Error {
-  constructor(code, attempts, causeCode, cause) {
-    const suffix = attempts > 1 ? ` after ${attempts} attempts` : "";
-    super(`${transportMessage(code)} before a complete HTTP response was received${suffix}`, { cause });
-    this.code = code;
-    this.attempts = attempts;
-    this.causeCode = causeCode;
-    this.name = "HttpTransportError";
-  }
-  code;
-  attempts;
-  causeCode;
-  static {
-    __name(this, "HttpTransportError");
-  }
-  retryable = true;
-  diagnostics = [];
-};
-function asTransientTransportError(error, attempts) {
-  if (isAbort(error)) return void 0;
-  const causeCode = findCauseCode(error);
-  const code = causeCode ? classifyCauseCode(causeCode) : classifyFetchFailure(error);
-  return code ? new HttpTransportError(code, attempts, causeCode, error) : void 0;
-}
-__name(asTransientTransportError, "asTransientTransportError");
-function classifyCauseCode(code) {
-  switch (code) {
-    case "ECONNRESET":
-      return "network_connection_reset";
-    case "ETIMEDOUT":
-    case "UND_ERR_CONNECT_TIMEOUT":
-    case "UND_ERR_HEADERS_TIMEOUT":
-    case "UND_ERR_BODY_TIMEOUT":
-      return "network_timeout";
-    case "EAI_AGAIN":
-      return "network_dns_temporary";
-    case "ENETUNREACH":
-    case "EHOSTUNREACH":
-      return "network_unreachable";
-    case "ECONNREFUSED":
-      return "network_connection_refused";
-    case "UND_ERR_SOCKET":
-      return "network_socket_error";
-    default:
-      return void 0;
+  adminOperation(operationId) {
+    return this.request("GET", `/v1/admin/operations/${encodeURIComponent(operationId)}`);
   }
-}
-__name(classifyCauseCode, "classifyCauseCode");
-function classifyFetchFailure(error) {
-  return error instanceof TypeError && error.message === "fetch failed" ? "network_transport_failed" : void 0;
-}
-__name(classifyFetchFailure, "classifyFetchFailure");
-function findCauseCode(error) {
-  const seen = /* @__PURE__ */ new Set();
-  let current = error;
-  while (current && typeof current === "object" && !seen.has(current)) {
-    seen.add(current);
-    const code = current.code;
-    if (typeof code === "string" && code !== "") return code;
-    current = current.cause;
+  saveAPIDraft(body) {
+    return this.request("POST", "/v1/admin/apis", { body });
   }
-  return void 0;
-}
-__name(findCauseCode, "findCauseCode");
-function isAbort(error) {
-  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
-}
-__name(isAbort, "isAbort");
-function transportMessage(code) {
-  switch (code) {
-    case "network_connection_reset":
-      return "network connection was reset";
-    case "network_timeout":
-      return "network connection timed out";
-    case "network_dns_temporary":
-      return "DNS lookup was temporarily unavailable";
-    case "network_unreachable":
-      return "network was unreachable";
-    case "network_connection_refused":
-      return "network connection was refused";
-    case "network_socket_error":
-      return "network socket failed";
-    case "network_transport_failed":
-      return "network transport failed";
+  intakeAPI(body) {
+    return this.request("POST", "/v1/admin/intakes", { body });
   }
-}
-__name(transportMessage, "transportMessage");
-
-// src/client/http.ts
-var HttpError = class extends Error {
-  static {
-    __name(this, "HttpError");
+  intakeReport(intakeId) {
+    return this.request("GET", `/v1/admin/intakes/${encodeURIComponent(intakeId)}`);
   }
-  executionContext;
-  diagnostics = [];
-  status;
-  code;
-  payload;
-  constructor(status, payload, fallbackMessage) {
-    super(payload?.message || fallbackMessage);
-    this.status = status;
-    this.code = payload?.code || "unknown_error";
-    this.payload = payload;
+  validateAPI(operationId, body) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/validate`, { body });
   }
-};
-var HttpClient = class _HttpClient {
-  static {
-    __name(this, "HttpClient");
+  reviewAPI(operationId, body) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/review`, { body });
   }
-  localSimulation = false;
-  static MAX_TRANSPORT_RETRIES = 2;
-  baseURL;
-  fetchImpl;
-  defaultHeaders;
-  requestAuthorizer;
-  recoverAuthorization;
-  transportRetryDelayMs;
-  onDiagnostic;
-  constructor(config) {
-    this.baseURL = config.baseURL.replace(/\/$/, "");
-    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
-    this.defaultHeaders = {
-      "Content-Type": "application/json",
-      Accept: "application/json",
-      ...config.defaultHeaders ?? {}
-    };
-    this.requestAuthorizer = config.requestAuthorizer;
-    this.recoverAuthorization = config.recoverAuthorization;
-    this.onDiagnostic = config.onDiagnostic;
-    this.transportRetryDelayMs = Math.max(0, config.transportRetryDelayMs ?? 200);
+  activateAPI(operationId) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/activate`, { body: {} });
   }
-  async request(path2, options = {}) {
-    const controller = new AbortController();
-    const abort = /* @__PURE__ */ __name(() => controller.abort(options.signal?.reason), "abort");
-    options.signal?.addEventListener("abort", abort, { once: true });
-    if (options.signal?.aborted) abort();
-    const remaining = (options.deadline ?? Date.now() + 3e4) - Date.now();
-    const timeoutReason = new DOMException("request deadline reached", "TimeoutError");
-    if (remaining <= 0) controller.abort(timeoutReason);
-    const timer = remaining > 0 ? setTimeout(() => controller.abort(timeoutReason), remaining) : void 0;
-    const requestStarted = Date.now();
-    const diagnostics = [];
-    let abortListener;
-    const cancelled = new Promise((_, reject) => {
-      abortListener = /* @__PURE__ */ __name(() => reject(controller.signal.reason), "abortListener");
-      if (controller.signal.aborted) abortListener();
-      else controller.signal.addEventListener("abort", abortListener, { once: true });
-    });
-    try {
-      return await Promise.race([this.performRequest(path2, { ...options, signal: controller.signal }, diagnostics), cancelled]);
-    } catch (error) {
-      if (controller.signal.aborted && !options.signal?.aborted) {
-        const timeout = new HttpTransportError("network_timeout", Math.max(1, diagnostics.length), "DEADLINE_EXCEEDED", error);
-        if (diagnostics.length === 0) diagnostics.push({ method: options.method ?? "GET", route_template: safeRouteTemplate(new URL(path2, this.baseURL).pathname), attempt: 1, attempt_ms: Math.max(0, remaining), total_ms: Math.max(0, remaining), phase: "unknown", cause_code: "DEADLINE_EXCEEDED" });
-        const last = diagnostics.at(-1);
-        if (last) last.total_ms = Date.now() - requestStarted;
-        timeout.diagnostics = diagnostics;
-        throw timeout;
-      }
-      if (error instanceof HttpError || error instanceof HttpTransportError) error.diagnostics = diagnostics;
-      throw error;
-    } finally {
-      if (timer !== void 0) clearTimeout(timer);
-      options.signal?.removeEventListener("abort", abort);
-      if (abortListener) controller.signal.removeEventListener("abort", abortListener);
-    }
+  recordAPIHealth(operationId, status, sampleCount = 1) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/health`, { body: { status, sample_count: sampleCount } });
   }
-  async performRequest(path2, options, diagnostics) {
-    const url = path2.startsWith("http") ? path2 : this.baseURL + path2;
-    const method = options.method ?? "GET";
-    const body = options.body !== void 0 ? JSON.stringify(options.body) : "";
-    const requestPath = new URL(url).pathname + new URL(url).search;
-    const replaySafe = method === "GET" || Boolean(options.idempotencyKey) || options.replaySafe === true;
-    const started = Date.now();
-    let authorizationRecovered = false;
-    let transportRetries = 0;
-    for (; ; ) {
-      options.signal?.throwIfAborted();
-      const attemptStarted = Date.now();
-      const attempt = diagnostics.length + 1;
-      let phase = "unknown";
-      let requestID;
-      const diagnostic = { method, route_template: safeRouteTemplate(new URL(url).pathname), attempt, attempt_ms: 0, total_ms: Date.now() - started, phase };
-      diagnostics.push(diagnostic);
-      const abortAttempt = /* @__PURE__ */ __name(() => record("DEADLINE_OR_ABORT"), "abortAttempt");
-      const record = /* @__PURE__ */ __name((causeCode) => {
-        options.signal?.removeEventListener("abort", abortAttempt);
-        Object.assign(diagnostic, { attempt_ms: Date.now() - attemptStarted, total_ms: Date.now() - started, phase, ...requestID ? { request_id: requestID } : {}, ...causeCode ? { cause_code: causeCode } : {} });
-        this.onDiagnostic?.(diagnostic);
-      }, "record");
-      options.signal?.addEventListener("abort", abortAttempt, { once: true });
-      const headers = { ...this.defaultHeaders, ...options.responseType === "png" ? { Accept: "image/png" } : {} };
-      try {
-        if (this.requestAuthorizer) {
-          Object.assign(headers, await this.requestAuthorizer({ method, path: requestPath, body, ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} }));
-        }
-      } catch (error2) {
-        record(error2 instanceof HttpTransportError ? error2.causeCode : "AUTHORIZATION_FAILED");
-        if (error2 instanceof HttpTransportError) throw error2;
-        throw asTransientTransportError(error2, 1) ?? error2;
-      }
-      options.signal?.throwIfAborted();
-      if (options.bearer) headers.Authorization = `Bearer ${options.bearer}`;
-      if (options.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
-      let response;
-      let text2;
-      try {
-        response = await this.fetchImpl(url, {
-          method,
-          headers,
-          ...options.responseType === "png" ? { redirect: "error" } : {},
-          ...options.body !== void 0 ? { body } : {},
-          ...options.signal ? { signal: options.signal } : {}
-        });
-        phase = "response_body";
-        diagnostic.phase = phase;
-        const headerID = response.headers.get("X-ItPay-Request-ID");
-        if (headerID && /^req_[a-f0-9]{1,64}$/.test(headerID)) {
-          requestID = headerID;
-          diagnostic.request_id = headerID;
-        }
-        if (response.ok && options.responseType === "png") {
-          const bytes = new Uint8Array(await response.arrayBuffer());
-          const magic = [137, 80, 78, 71, 13, 10, 26, 10];
-          if (response.headers.get("Content-Type")?.split(";")[0] !== "image/png" || bytes.length > 10 * 1024 * 1024 || !magic.every((value, index) => bytes[index] === value)) throw new Error("invalid official PNG response");
-          record();
-          return bytes;
-        }
-        text2 = await response.text();
-        this.localSimulation = response.headers.get("X-ItPay-Environment") === "local_simulation";
-      } catch (error2) {
-        if (options.signal?.aborted) {
-          record("DEADLINE_OR_ABORT");
-          throw error2;
-        }
-        const transportError = asTransientTransportError(error2, transportRetries + 1);
-        record(transportError?.causeCode ?? "UNKNOWN_TRANSPORT_FAILURE");
-        if (!transportError) throw error2;
-        if (replaySafe && transportRetries < _HttpClient.MAX_TRANSPORT_RETRIES) {
-          transportRetries += 1;
-          await delay(this.transportRetryDelayMs * 2 ** (transportRetries - 1), options.signal);
-          continue;
-        }
-        throw asTransientTransportError(error2, transportRetries + 1) ?? error2;
-      }
-      record(response.ok ? void 0 : `HTTP_${response.status}`);
-      const parsed = text2.length > 0 ? safeParseJson(text2) : void 0;
-      if (response.ok) return parsed;
-      const error = new HttpError(response.status, parsed, `HTTP ${response.status}`);
-      if (!authorizationRecovered && error.status === 401 && error.code === "agent_device_session_required" && this.recoverAuthorization) {
-        authorizationRecovered = true;
-        options.signal?.throwIfAborted();
-        await this.recoverAuthorization({ ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} });
-        options.signal?.throwIfAborted();
-        continue;
-      }
-      throw error;
-    }
+  publishAPI(operationId, body) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/publish`, { body });
+  }
+  rollbackAPI(operationId, body) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/rollback`, { body });
   }
-  get(path2, options = {}) {
-    return this.request(path2, { ...options, method: "GET" });
+  setAPIAccepting(operationId, accepting, body) {
+    return this.request("POST", `/v1/admin/operations/${encodeURIComponent(operationId)}/${accepting ? "unsuspend" : "suspend"}`, { body });
   }
-  post(path2, body, options = {}) {
-    return this.request(path2, { ...options, method: "POST", body });
+  probePermits(operationId, digest) {
+    return this.request("GET", `/v1/admin/operations/${encodeURIComponent(operationId)}/probe-permits`, { query: { digest } });
   }
-  delete(path2, options = {}) {
-    return this.request(path2, { ...options, method: "DELETE" });
+  /** Account-session only. Raw supplier secrets are write-only. */
+  userCredentials() {
+    return this.request("GET", "/v1/me/credentials");
   }
-};
-function delay(milliseconds, signal) {
-  signal?.throwIfAborted();
-  if (milliseconds === 0) return Promise.resolve();
-  return new Promise((resolve10, reject) => {
-    const abort = /* @__PURE__ */ __name(() => {
-      clearTimeout(timer);
-      reject(signal?.reason);
-    }, "abort");
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", abort);
-      resolve10();
-    }, milliseconds);
-    signal?.addEventListener("abort", abort, { once: true });
-  });
-}
-__name(delay, "delay");
-function safeRouteTemplate(path2) {
-  const staticSegments = /* @__PURE__ */ new Set(["v1", "v3", "readyz", "service-executions", "service-definitions", "services", "advance", "actions", "checkout", "checkouts", "presentation", "capabilities", "invoke", "result-items", "events", "orders", "refunds", "cancel", "cart", "carts", "items", "quotes", "quote", "agent-device-enrollments", "agent-device-sessions", "verify", "auth-sessions"]);
-  return path2.split("/").map((segment) => staticSegments.has(segment) ? segment : segment ? "{value}" : "").join("/");
-}
-__name(safeRouteTemplate, "safeRouteTemplate");
-function safeParseJson(text2) {
-  try {
-    return JSON.parse(text2);
-  } catch {
-    return void 0;
+  /** Account-session only; exact publication requirements, never secret values. */
+  nativeCredentialRequirements(operationId, publicationId) {
+    return this.request("GET", `/v1/operations/${encodeURIComponent(operationId)}/credential-requirements`, { query: { publication_id: publicationId } });
   }
-}
-__name(safeParseJson, "safeParseJson");
-
-// src/state/hub_credentials.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { chmodSync as chmodSync2, existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { dirname as dirname2, resolve } from "node:path";
-
-// src/state/file_lock.ts
-import { chmodSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-import { randomUUID } from "node:crypto";
-var STALE_MS = 3e4;
-function sleepSync(ms) {
-  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
-}
-__name(sleepSync, "sleepSync");
-function ownerAlive(path2) {
-  try {
-    const st = lstatSync(path2);
-    if (st.isSymbolicLink()) return false;
-    if (Date.now() - st.mtimeMs < STALE_MS) return true;
-    const token = readFileSync(path2, "utf8");
-    const pid = Number(/^(\d+):/.exec(token)?.[1]);
-    if (!Number.isInteger(pid) || pid <= 0) return false;
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch {
-      return false;
-    }
-  } catch {
-    return false;
+  credentialProviders() {
+    return this.request("GET", "/v1/me/credential-providers");
   }
-}
-__name(ownerAlive, "ownerAlive");
-function withFileLock(lockPath, fn) {
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
-  const token = `${process.pid}:${randomUUID()}`;
-  const deadline = Date.now() + 15e3;
-  for (; ; ) {
-    try {
-      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
-      chmodSync(lockPath, 384);
-      break;
-    } catch (error) {
-      const code = error.code;
-      if (code !== "EEXIST") throw error;
-      if (!ownerAlive(lockPath)) {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error(`task store lock busy: ${lockPath}`);
-      sleepSync(20);
-    }
+  saveUserCredential(body) {
+    return this.request("POST", "/v1/me/credentials", { body });
   }
-  try {
-    return fn();
-  } finally {
-    try {
-      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
-    } catch {
-    }
+  revokeUserCredential(id, expectedVersion) {
+    return this.request("DELETE", `/v1/me/credentials/${encodeURIComponent(id)}`, { body: { expected_version: expectedVersion } });
   }
-}
-__name(withFileLock, "withFileLock");
-async function withAsyncFileLock(lockPath, fn) {
-  mkdirSync(dirname(lockPath), { recursive: true, mode: 448 });
-  const token = `${process.pid}:${randomUUID()}`;
-  const deadline = Date.now() + 2e4;
-  for (; ; ) {
-    try {
-      writeFileSync(lockPath, token, { encoding: "utf8", flag: "wx", mode: 384 });
-      break;
-    } catch (error) {
-      if (error.code !== "EEXIST") throw error;
-      if (!ownerAlive(lockPath)) {
-        try {
-          unlinkSync(lockPath);
-        } catch {
-        }
-        continue;
-      }
-      if (Date.now() > deadline) throw new Error("credential refresh lock busy");
-      await new Promise((resolve10) => setTimeout(resolve10, 20));
-    }
+  credentials() {
+    return this.request("GET", "/v1/admin/credentials");
   }
-  try {
-    return await fn();
-  } finally {
-    try {
-      if (readFileSync(lockPath, "utf8") === token) unlinkSync(lockPath);
-    } catch {
-    }
+  /** One-time secret upload. Never use this payload in logs, URLs or persistence. */
+  rotateCredential(ref, body) {
+    return this.request("POST", `/v1/admin/credentials/${encodeURIComponent(ref)}/rotate`, { body });
   }
-}
-__name(withAsyncFileLock, "withAsyncFileLock");
-
-// src/state/hub_oauth.ts
-import { createHash, randomBytes } from "node:crypto";
-import { createServer } from "node:http";
-function hubOAuthConfig(env = process.env) {
-  const devHub = (env.ITPAY_HUB_URL ?? "").replace(/\/+$/, "") === "https://market-v4-dev.itpay.ai";
-  const issuer = (env.ITPAY_HUB_OAUTH_ISSUER ?? (devHub ? "https://auth-v4-dev.itpay.ai" : "http://localhost:24444")).replace(/\/+$/, "");
-  return {
-    authorizeURL: `${issuer}/oauth2/auth`,
-    tokenURL: `${issuer}/oauth2/token`,
-    clientID: env.ITPAY_HUB_OAUTH_CLIENT ?? "itpay-cli-local",
-    resource: (env.ITPAY_HUB_URL ?? "http://localhost:18090").replace(/\/+$/, ""),
-    scope: env.ITPAY_HUB_OAUTH_SCOPE ?? "openid offline_access itpay.hub"
-  };
-}
-__name(hubOAuthConfig, "hubOAuthConfig");
-function pkce() {
-  const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
-  return { verifier, challenge };
-}
-__name(pkce, "pkce");
-async function runConnectFlow(cfg, timeoutMs = 3e5) {
-  const { verifier, challenge } = pkce();
-  const state = randomBytes(16).toString("hex");
-  const server = createServer();
-  const done = new Promise((resolvePromise, reject) => {
-    const timer = setTimeout(() => {
-      server.close();
-      reject(new Error("connect timed out waiting for browser authorization"));
-    }, timeoutMs);
-    server.on("request", (req, res) => {
-      const u = new URL(req.url ?? "/", "http://127.0.0.1");
-      const finish = /* @__PURE__ */ __name((ok, msg) => {
-        res.writeHead(ok ? 200 : 400, { "Content-Type": "text/html; charset=utf-8" });
-        res.end(`<!doctype html><meta charset="utf-8"><title>ItPay</title><body style="font-family:system-ui;padding:3em;text-align:center"><h2>${msg.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;")}</h2><p>\u53EF\u4EE5\u5173\u95ED\u6B64\u9875\u9762\uFF0C\u56DE\u5230\u7EC8\u7AEF\u7EE7\u7EED\u3002</p></body>`);
-      }, "finish");
-      (async () => {
-        if (u.pathname !== "/callback") return finish(false, "\u65E0\u6548\u7684\u56DE\u8C03");
-        if (u.searchParams.get("state") !== state) return finish(false, "state \u4E0D\u5339\u914D");
-        if (u.searchParams.get("error")) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "\u6388\u6743\u88AB\u62D2\u7EDD");
-          reject(new Error("authorization_required: consent denied"));
-          return;
-        }
-        const code = u.searchParams.get("code");
-        if (!code) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "\u7F3A\u5C11 code");
-          reject(new Error("missing code"));
-          return;
-        }
-        const form = new URLSearchParams({
-          grant_type: "authorization_code",
-          code,
-          redirect_uri: `http://127.0.0.1:${server.address().port}/callback`,
-          client_id: cfg.clientID,
-          code_verifier: verifier,
-          resource: cfg.resource
-        });
-        const tok = await fetch(cfg.tokenURL, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: form,
-          signal: AbortSignal.timeout(1e4)
-        });
-        if (!tok.ok) {
-          clearTimeout(timer);
-          server.close();
-          finish(false, "token \u4EA4\u6362\u5931\u8D25");
-          reject(new Error(`token endpoint ${tok.status}`));
-          return;
-        }
-        const t = await tok.json();
-        clearTimeout(timer);
-        server.close();
-        finish(true, "ItPay \u5DF2\u8FDE\u63A5");
-        resolvePromise({ accessToken: t.access_token, refreshToken: t.refresh_token, expiresIn: t.expires_in });
-      })().catch((e) => {
-        clearTimeout(timer);
-        server.close();
-        reject(e);
-      });
-    });
-  });
-  await new Promise((resolvePromise, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", () => resolvePromise());
-  });
-  const port = server.address().port;
-  const authorizeURL = `${cfg.authorizeURL}?` + new URLSearchParams({
-    response_type: "code",
-    client_id: cfg.clientID,
-    redirect_uri: `http://127.0.0.1:${port}/callback`,
-    scope: cfg.scope,
-    state,
-    code_challenge: challenge,
-    code_challenge_method: "S256",
-    resource: cfg.resource
-  }).toString();
-  return { authorizeURL, done };
-}
-__name(runConnectFlow, "runConnectFlow");
+  revokeCredential(ref, expectedVersion) {
+    return this.request("POST", `/v1/admin/credentials/${encodeURIComponent(ref)}/revoke`, { body: { expected_version: expectedVersion } });
+  }
+  paymentReconciliation() {
+    return this.request("GET", "/v1/admin/payment-reconciliation");
+  }
+  compensatePayment(eventId, reason, idempotencyKey) {
+    return this.request("POST", `/v1/admin/collection-events/${encodeURIComponent(eventId)}/refund`, { body: { reason }, idempotencyKey });
+  }
+  switchTopupChannel(topupId, channel, mode, expectedCollectionRef, idempotencyKey) {
+    return this.request("POST", `/v1/me/topups/${encodeURIComponent(topupId)}/switch-channel`, { body: { channel, mode, expected_collection_ref: expectedCollectionRef }, idempotencyKey });
+  }
+};
 
-// src/state/hub_credentials.ts
-import { homedir } from "node:os";
-function hubCredentialsPath(env = process.env) {
-  const dir = env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), ".itpay-v3");
-  const suffix = createHash2("sha256").update(env.ITPAY_HUB_URL ?? "http://localhost:18090").digest("hex").slice(0, 12);
-  return resolve(dir, `hub-credentials.${suffix}.json`);
-}
-__name(hubCredentialsPath, "hubCredentialsPath");
-function importHubKeyUnlocked(apiKey, baseURL, env = process.env) {
-  if (!/^itk_[A-Za-z0-9_-]{8,}$/.test(apiKey)) {
-    throw new Error("invalid key format \u2014 expected an itk_ API key");
+// src/client/transport.ts
+var HttpTransportError = class extends Error {
+  constructor(code, attempts, causeCode, cause) {
+    const suffix = attempts > 1 ? ` after ${attempts} attempts` : "";
+    super(`${transportMessage(code)} before a complete HTTP response was received${suffix}`, { cause });
+    this.code = code;
+    this.attempts = attempts;
+    this.causeCode = causeCode;
+    this.name = "HttpTransportError";
   }
-  const path2 = hubCredentialsPath(env);
-  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-  file.profiles["default"] = {
-    base_url: baseURL,
-    key_prefix: apiKey.slice(0, 14),
-    api_key: apiKey,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveHubProfileUnlocked(file.profiles["default"], env);
-  return { key_prefix: apiKey.slice(0, 14) };
+  code;
+  attempts;
+  causeCode;
+  static {
+    __name(this, "HttpTransportError");
+  }
+  retryable = true;
+  diagnostics = [];
+};
+function asTransientTransportError(error, attempts) {
+  if (isAbort(error)) return void 0;
+  const causeCode = findCauseCode(error);
+  const code = causeCode ? classifyCauseCode(causeCode) : classifyFetchFailure(error);
+  return code ? new HttpTransportError(code, attempts, causeCode, error) : void 0;
 }
-__name(importHubKeyUnlocked, "importHubKeyUnlocked");
-function storedHubKey(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    return file.profiles["default"]?.api_key;
-  } catch {
-    return void 0;
+__name(asTransientTransportError, "asTransientTransportError");
+function classifyCauseCode(code) {
+  switch (code) {
+    case "ECONNRESET":
+      return "network_connection_reset";
+    case "ETIMEDOUT":
+    case "UND_ERR_CONNECT_TIMEOUT":
+    case "UND_ERR_HEADERS_TIMEOUT":
+    case "UND_ERR_BODY_TIMEOUT":
+      return "network_timeout";
+    case "EAI_AGAIN":
+      return "network_dns_temporary";
+    case "ENETUNREACH":
+    case "EHOSTUNREACH":
+      return "network_unreachable";
+    case "ECONNREFUSED":
+      return "network_connection_refused";
+    case "UND_ERR_SOCKET":
+      return "network_socket_error";
+    default:
+      return void 0;
   }
 }
-__name(storedHubKey, "storedHubKey");
-function storedHubKeyPrefix(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    return file.profiles["default"]?.key_prefix;
-  } catch {
-    return void 0;
+__name(classifyCauseCode, "classifyCauseCode");
+function classifyFetchFailure(error) {
+  return error instanceof TypeError && error.message === "fetch failed" ? "network_transport_failed" : void 0;
+}
+__name(classifyFetchFailure, "classifyFetchFailure");
+function findCauseCode(error) {
+  const seen = /* @__PURE__ */ new Set();
+  let current = error;
+  while (current && typeof current === "object" && !seen.has(current)) {
+    seen.add(current);
+    const code = current.code;
+    if (typeof code === "string" && code !== "") return code;
+    current = current.cause;
   }
+  return void 0;
 }
-__name(storedHubKeyPrefix, "storedHubKeyPrefix");
-function storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
-  const path2 = hubCredentialsPath(env);
-  const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-  const issuedAt = Date.now();
-  const margin = Math.min(3e4, Math.max(100, expiresIn * 100));
-  file.profiles["default"] = {
-    base_url: baseURL,
-    access_token: accessToken,
-    ...refreshToken ? { refresh_token: refreshToken } : {},
-    expires_at: new Date(issuedAt + expiresIn * 1e3).toISOString(),
-    refresh_after: new Date(issuedAt + expiresIn * 1e3 - margin).toISOString(),
-    ...subject ? { subject } : {},
-    consumer_id: consumerID ?? `oauth:${hubOAuthConfig(env).clientID}`,
-    client_id: hubOAuthConfig(env).clientID,
-    token_url: hubOAuthConfig(env).tokenURL,
-    created_at: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveHubProfileUnlocked(file.profiles["default"], env);
+__name(findCauseCode, "findCauseCode");
+function isAbort(error) {
+  return error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError");
 }
-__name(storeHubSessionUnlocked, "storeHubSessionUnlocked");
-function saveHubProfileUnlocked(profile, env) {
-  const path2 = hubCredentialsPath(env);
-  const tmp = `${path2}.${randomUUID2()}.tmp`;
-  try {
-    const file = existsSync(path2) ? JSON.parse(readFileSync2(path2, "utf8")) : { schema_version: "itpay.hub_credentials.v1", profiles: {} };
-    file.profiles.default = profile;
-    mkdirSync2(dirname2(path2), { recursive: true, mode: 448 });
-    writeFileSync2(tmp, JSON.stringify(file, null, 2), { encoding: "utf8", flag: "wx", mode: 384 });
-    chmodSync2(tmp, 384);
-    renameSync(tmp, path2);
-  } catch {
-    throw new Error("credential_persistence_failed: could not save the original connection; stop and check private storage before retrying");
-  } finally {
-    try {
-      unlinkSync2(tmp);
-    } catch {
-    }
+__name(isAbort, "isAbort");
+function transportMessage(code) {
+  switch (code) {
+    case "network_connection_reset":
+      return "network connection was reset";
+    case "network_timeout":
+      return "network connection timed out";
+    case "network_dns_temporary":
+      return "DNS lookup was temporarily unavailable";
+    case "network_unreachable":
+      return "network was unreachable";
+    case "network_connection_refused":
+      return "network connection was refused";
+    case "network_socket_error":
+      return "network socket failed";
+    case "network_transport_failed":
+      return "network transport failed";
   }
 }
-__name(saveHubProfileUnlocked, "saveHubProfileUnlocked");
-async function probeHubIdentity(resource, accessToken) {
-  let response;
-  try {
-    response = await fetch(`${resource}/v1/me`, {
-      headers: { Authorization: `Bearer ${accessToken}`, "X-ItPay-OAuth-Resource": resource },
-      signal: AbortSignal.timeout(1e4)
-    });
-  } catch {
-    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+__name(transportMessage, "transportMessage");
+
+// src/client/http.ts
+var HttpError = class extends Error {
+  static {
+    __name(this, "HttpError");
   }
-  if (!response.ok) {
-    if (response.status === 401 || response.status === 403) throw new Error("authorization_required: original connection identity rejected");
-    throw new Error("connection_verification_pending: identity check unavailable; preserve the original connection and references, do not reconnect");
+  executionContext;
+  diagnostics = [];
+  status;
+  code;
+  payload;
+  constructor(status, payload, fallbackMessage) {
+    super(payload?.message || fallbackMessage);
+    this.status = status;
+    this.code = payload?.code || "unknown_error";
+    this.payload = payload;
   }
-  try {
-    const identity = await response.json();
-    if (!identity || typeof identity !== "object" || Array.isArray(identity)) throw new Error();
-    const me = identity;
-    if (typeof me.buyer_id !== "string" || !me.buyer_id || typeof me.consumer_id !== "string" || !me.consumer_id) throw new Error();
-    return { buyer_id: me.buyer_id, consumer_id: me.consumer_id };
-  } catch {
-    throw new Error("connection_verification_pending: identity response invalid; preserve the original connection and references, do not reconnect");
+};
+var HttpClient = class _HttpClient {
+  static {
+    __name(this, "HttpClient");
   }
-}
-__name(probeHubIdentity, "probeHubIdentity");
-function storedHubToken(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  try {
-    const file = JSON.parse(readFileSync2(path2, "utf8"));
-    const p = file.profiles["default"];
-    if (!p?.access_token || p.identity_verification_pending) return void 0;
-    if (p.expires_at && Date.parse(p.expires_at) <= Date.now()) return void 0;
-    return p.access_token;
-  } catch {
-    return void 0;
+  localSimulation = false;
+  static MAX_TRANSPORT_RETRIES = 2;
+  baseURL;
+  fetchImpl;
+  defaultHeaders;
+  requestAuthorizer;
+  recoverAuthorization;
+  transportRetryDelayMs;
+  onDiagnostic;
+  constructor(config) {
+    this.baseURL = config.baseURL.replace(/\/$/, "");
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.defaultHeaders = {
+      "Content-Type": "application/json",
+      Accept: "application/json",
+      ...config.defaultHeaders ?? {}
+    };
+    this.requestAuthorizer = config.requestAuthorizer;
+    this.recoverAuthorization = config.recoverAuthorization;
+    this.onDiagnostic = config.onDiagnostic;
+    this.transportRetryDelayMs = Math.max(0, config.transportRetryDelayMs ?? 200);
   }
-}
-__name(storedHubToken, "storedHubToken");
-function storedHubProfile(env = process.env) {
-  const path2 = hubCredentialsPath(env);
-  if (!existsSync(path2)) return void 0;
-  return JSON.parse(readFileSync2(path2, "utf8")).profiles.default;
-}
-__name(storedHubProfile, "storedHubProfile");
-async function connectedHubToken(env = process.env, rejectedToken) {
-  return withAsyncFileLock(`${hubCredentialsPath(env)}.refresh.lock`, async () => {
-    const p = storedHubProfile(env);
-    if (!p?.access_token || !p.subject) throw new Error("authorization_required: reconnect ItPay");
-    const cfg = hubOAuthConfig(env);
-    if (p.base_url !== cfg.resource || p.token_url !== cfg.tokenURL || p.client_id !== cfg.clientID || !p.consumer_id) {
-      throw new Error("authorization_required: connection configuration changed");
+  async request(path2, options = {}) {
+    const controller = new AbortController();
+    const abort = /* @__PURE__ */ __name(() => controller.abort(options.signal?.reason), "abort");
+    options.signal?.addEventListener("abort", abort, { once: true });
+    if (options.signal?.aborted) abort();
+    const remaining = (options.deadline ?? Date.now() + 3e4) - Date.now();
+    const timeoutReason = new DOMException("request deadline reached", "TimeoutError");
+    if (remaining <= 0) controller.abort(timeoutReason);
+    const timer = remaining > 0 ? setTimeout(() => controller.abort(timeoutReason), remaining) : void 0;
+    const requestStarted = Date.now();
+    const diagnostics = [];
+    let abortListener;
+    const cancelled = new Promise((_, reject) => {
+      abortListener = /* @__PURE__ */ __name(() => reject(controller.signal.reason), "abortListener");
+      if (controller.signal.aborted) abortListener();
+      else controller.signal.addEventListener("abort", abortListener, { once: true });
+    });
+    try {
+      return await Promise.race([this.performRequest(path2, { ...options, signal: controller.signal }, diagnostics), cancelled]);
+    } catch (error) {
+      if (controller.signal.aborted && !options.signal?.aborted) {
+        const timeout = new HttpTransportError("network_timeout", Math.max(1, diagnostics.length), "DEADLINE_EXCEEDED", error);
+        if (diagnostics.length === 0) diagnostics.push({ method: options.method ?? "GET", route_template: safeRouteTemplate(new URL(path2, this.baseURL).pathname), attempt: 1, attempt_ms: Math.max(0, remaining), total_ms: Math.max(0, remaining), phase: "unknown", cause_code: "DEADLINE_EXCEEDED" });
+        const last = diagnostics.at(-1);
+        if (last) last.total_ms = Date.now() - requestStarted;
+        timeout.diagnostics = diagnostics;
+        throw timeout;
+      }
+      if (error instanceof HttpError || error instanceof HttpTransportError) error.diagnostics = diagnostics;
+      throw error;
+    } finally {
+      if (timer !== void 0) clearTimeout(timer);
+      options.signal?.removeEventListener("abort", abort);
+      if (abortListener) controller.signal.removeEventListener("abort", abortListener);
     }
-    const refreshAt = p.refresh_after ? Date.parse(p.refresh_after) : Date.parse(p.expires_at ?? "") - 3e4;
-    if (!p.identity_verification_pending && p.access_token !== rejectedToken && refreshAt > Date.now()) return p.access_token;
-    let candidate = p;
-    if (!p.identity_verification_pending || !(Date.parse(p.expires_at ?? "") > Date.now())) {
-      if (!p.refresh_token) throw new Error("authorization_required: reconnect the original ItPay connection");
-      let response;
+  }
+  async performRequest(path2, options, diagnostics) {
+    const url = path2.startsWith("http") ? path2 : this.baseURL + path2;
+    const method = options.method ?? "GET";
+    const body = options.body !== void 0 ? JSON.stringify(options.body) : "";
+    const requestPath = new URL(url).pathname + new URL(url).search;
+    const replaySafe = method === "GET" || Boolean(options.idempotencyKey) || options.replaySafe === true;
+    const started = Date.now();
+    let authorizationRecovered = false;
+    let transportRetries = 0;
+    for (; ; ) {
+      options.signal?.throwIfAborted();
+      const attemptStarted = Date.now();
+      const attempt = diagnostics.length + 1;
+      let phase = "unknown";
+      let requestID;
+      const diagnostic = { method, route_template: safeRouteTemplate(new URL(url).pathname), attempt, attempt_ms: 0, total_ms: Date.now() - started, phase };
+      diagnostics.push(diagnostic);
+      const abortAttempt = /* @__PURE__ */ __name(() => record("DEADLINE_OR_ABORT"), "abortAttempt");
+      const record = /* @__PURE__ */ __name((causeCode) => {
+        options.signal?.removeEventListener("abort", abortAttempt);
+        Object.assign(diagnostic, { attempt_ms: Date.now() - attemptStarted, total_ms: Date.now() - started, phase, ...requestID ? { request_id: requestID } : {}, ...causeCode ? { cause_code: causeCode } : {} });
+        this.onDiagnostic?.(diagnostic);
+      }, "record");
+      options.signal?.addEventListener("abort", abortAttempt, { once: true });
+      const headers = { ...this.defaultHeaders, ...options.responseType === "png" ? { Accept: "image/png" } : {} };
       try {
-        response = await fetch(p.token_url, {
-          method: "POST",
-          headers: { "Content-Type": "application/x-www-form-urlencoded" },
-          body: new URLSearchParams({ grant_type: "refresh_token", refresh_token: p.refresh_token, client_id: p.client_id, resource: cfg.resource }),
-          signal: AbortSignal.timeout(1e4)
-        });
-      } catch {
-        throw new Error("connection_verification_pending: refresh outcome unknown; preserve the original connection and references, do not repeat authorization or business requests");
-      }
-      if (!response.ok) {
-        let rejected = response.status === 401 || response.status === 403;
-        if (response.status === 400) {
-          try {
-            const problem = await response.json();
-            rejected = ["invalid_grant", "invalid_client", "unauthorized_client"].includes(problem?.error ?? "");
-          } catch {
-          }
+        if (this.requestAuthorizer) {
+          Object.assign(headers, await this.requestAuthorizer({ method, path: requestPath, body, ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} }));
         }
-        if (rejected) throw new Error("authorization_required: connection refresh rejected");
-        throw new Error("connection_verification_pending: refresh unavailable; preserve the original connection and references");
+      } catch (error2) {
+        record(error2 instanceof HttpTransportError ? error2.causeCode : "AUTHORIZATION_FAILED");
+        if (error2 instanceof HttpTransportError) throw error2;
+        throw asTransientTransportError(error2, 1) ?? error2;
       }
-      let token;
+      options.signal?.throwIfAborted();
+      if (options.bearer) headers.Authorization = `Bearer ${options.bearer}`;
+      if (options.idempotencyKey) headers["Idempotency-Key"] = options.idempotencyKey;
+      let response;
+      let text2;
       try {
-        token = await response.json();
-      } catch {
-        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+        response = await this.fetchImpl(url, {
+          method,
+          headers,
+          ...options.responseType === "png" ? { redirect: "error" } : {},
+          ...options.body !== void 0 ? { body } : {},
+          ...options.signal ? { signal: options.signal } : {}
+        });
+        phase = "response_body";
+        diagnostic.phase = phase;
+        const headerID = response.headers.get("X-ItPay-Request-ID");
+        if (headerID && /^req_[a-f0-9]{1,64}$/.test(headerID)) {
+          requestID = headerID;
+          diagnostic.request_id = headerID;
+        }
+        if (response.ok && options.responseType === "png") {
+          const bytes = new Uint8Array(await response.arrayBuffer());
+          const magic = [137, 80, 78, 71, 13, 10, 26, 10];
+          if (response.headers.get("Content-Type")?.split(";")[0] !== "image/png" || bytes.length > 10 * 1024 * 1024 || !magic.every((value, index) => bytes[index] === value)) throw new Error("invalid official PNG response");
+          record();
+          return bytes;
+        }
+        text2 = await response.text();
+        this.localSimulation = response.headers.get("X-ItPay-Environment") === "local_simulation";
+      } catch (error2) {
+        if (options.signal?.aborted) {
+          record("DEADLINE_OR_ABORT");
+          throw error2;
+        }
+        const transportError = asTransientTransportError(error2, transportRetries + 1);
+        record(transportError?.causeCode ?? "UNKNOWN_TRANSPORT_FAILURE");
+        if (!transportError) throw error2;
+        if (replaySafe && transportRetries < _HttpClient.MAX_TRANSPORT_RETRIES) {
+          transportRetries += 1;
+          await delay(this.transportRetryDelayMs * 2 ** (transportRetries - 1), options.signal);
+          continue;
+        }
+        throw asTransientTransportError(error2, transportRetries + 1) ?? error2;
       }
-      if (!token || typeof token.access_token !== "string" || !token.access_token || typeof token.token_type !== "string" || token.token_type.toLowerCase() !== "bearer" || typeof token.expires_in !== "number" || !Number.isFinite(token.expires_in) || token.expires_in <= 0 || (!Number.isFinite(Date.now() + token.expires_in * 1e3) || Date.now() + token.expires_in * 1e3 > 864e13) || token.refresh_token !== void 0 && (typeof token.refresh_token !== "string" || !token.refresh_token)) {
-        throw new Error("connection_verification_pending: invalid refresh response; preserve the original connection and references");
+      record(response.ok ? void 0 : `HTTP_${response.status}`);
+      const parsed = text2.length > 0 ? safeParseJson(text2) : void 0;
+      if (response.ok) return parsed;
+      const error = new HttpError(response.status, parsed, `HTTP ${response.status}`);
+      if (!authorizationRecovered && error.status === 401 && error.code === "agent_device_session_required" && this.recoverAuthorization) {
+        authorizationRecovered = true;
+        options.signal?.throwIfAborted();
+        await this.recoverAuthorization({ ...options.signal ? { signal: options.signal } : {}, ...options.deadline !== void 0 ? { deadline: options.deadline } : {} });
+        options.signal?.throwIfAborted();
+        continue;
       }
-      const now = Date.now();
-      candidate = {
-        ...p,
-        access_token: token.access_token,
-        refresh_token: token.refresh_token ?? p.refresh_token,
-        expires_at: new Date(now + token.expires_in * 1e3).toISOString(),
-        refresh_after: new Date(now + token.expires_in * 1e3 - Math.min(3e4, Math.max(100, token.expires_in * 100))).toISOString(),
-        identity_verification_pending: true
-      };
-      saveHubProfileUnlocked(candidate, env);
-    }
-    const identity = await probeHubIdentity(cfg.resource, candidate.access_token);
-    if (identity.buyer_id !== p.subject || identity.consumer_id !== p.consumer_id) {
-      throw new Error("authorization_required: refreshed identity changed");
-    }
-    if (!(Date.parse(candidate.expires_at ?? "") > Date.now())) {
-      throw new Error("connection_verification_pending: token expired during identity check; preserve the original connection and references");
+      throw error;
     }
-    delete candidate.identity_verification_pending;
-    saveHubProfileUnlocked(candidate, env);
-    return candidate.access_token;
+  }
+  get(path2, options = {}) {
+    return this.request(path2, { ...options, method: "GET" });
+  }
+  post(path2, body, options = {}) {
+    return this.request(path2, { ...options, method: "POST", body });
+  }
+  delete(path2, options = {}) {
+    return this.request(path2, { ...options, method: "DELETE" });
+  }
+};
+function delay(milliseconds, signal) {
+  signal?.throwIfAborted();
+  if (milliseconds === 0) return Promise.resolve();
+  return new Promise((resolve10, reject) => {
+    const abort = /* @__PURE__ */ __name(() => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    }, "abort");
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", abort);
+      resolve10();
+    }, milliseconds);
+    signal?.addEventListener("abort", abort, { once: true });
   });
 }
-__name(connectedHubToken, "connectedHubToken");
-function importHubKey(apiKey, baseURL, env = process.env) {
-  return withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => importHubKeyUnlocked(apiKey, baseURL, env));
+__name(delay, "delay");
+function safeRouteTemplate(path2) {
+  const staticSegments = /* @__PURE__ */ new Set(["v1", "v3", "readyz", "service-executions", "service-definitions", "services", "advance", "actions", "checkout", "checkouts", "presentation", "capabilities", "invoke", "result-items", "events", "orders", "refunds", "cancel", "cart", "carts", "items", "quotes", "quote", "agent-device-enrollments", "agent-device-sessions", "verify", "auth-sessions"]);
+  return path2.split("/").map((segment) => staticSegments.has(segment) ? segment : segment ? "{value}" : "").join("/");
 }
-__name(importHubKey, "importHubKey");
-function storeHubSession(accessToken, refreshToken, expiresIn, subject, baseURL, env = process.env, consumerID) {
-  withFileLock(`${hubCredentialsPath(env)}.refresh.lock`, () => storeHubSessionUnlocked(accessToken, refreshToken, expiresIn, subject, baseURL, env, consumerID));
+__name(safeRouteTemplate, "safeRouteTemplate");
+function safeParseJson(text2) {
+  try {
+    return JSON.parse(text2);
+  } catch {
+    return void 0;
+  }
 }
-__name(storeHubSession, "storeHubSession");
+__name(safeParseJson, "safeParseJson");
 
 // src/client/hub.ts
 function loadHubConfig(env = process.env) {
@@ -6383,63 +6502,82 @@ async function runHubCredentialsImport(options) {
 }
 __name(runHubCredentialsImport, "runHubCredentialsImport");
 async function runHubConnect(options) {
-  const cfg = hubOAuthConfig();
-  const { authorizeURL, done } = await runConnectFlow(cfg);
-  if (options.jsonOutput) process.stderr.write(`Open to authorize ItPay: ${authorizeURL}
+  return withNewHubSession(async (storeNewHubSession) => {
+    if (storedHubProfile()) throw new Error("connection_recovery_denied: existing connection preserved; use api recover-connection for exact-binding recovery, do not replace it");
+    const cfg = hubOAuthConfig();
+    const { authorizeURL, done } = await runConnectFlow(cfg);
+    if (options.jsonOutput) process.stderr.write(`Open to authorize ItPay: ${authorizeURL}
 `);
-  else writeCommandEnvelope({
-    status: "authorization_required",
-    result: {
-      authorize_url: authorizeURL,
-      client_id: cfg.clientID,
-      resource: cfg.resource
-    },
-    instruction: "\u5728\u6D4F\u89C8\u5668\u5B8C\u6210\u4E00\u6B21\u6388\u6743\uFF1BCLI \u7B49\u5F85\u56DE\u8C03\u540E\u81EA\u52A8\u7ED1\u5B9A\u3002",
-    next: null,
-    recovery: []
-  }, {
-    jsonOutput: Boolean(options.jsonOutput),
-    plainResult: ["\u6253\u5F00\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\uFF1A", `  ${authorizeURL}`]
-  });
-  const tokens = await done;
-  let me;
-  try {
-    me = await probeHubIdentity(cfg.resource, tokens.accessToken);
-  } catch (error) {
-    if (error instanceof Error && error.message.startsWith("connection_verification_pending:")) {
-      throw new Error("connection_not_saved: identity verification unavailable; this connection was not saved and the existing connection was not replaced");
+    else writeCommandEnvelope({
+      status: "authorization_required",
+      result: {
+        authorize_url: authorizeURL,
+        client_id: cfg.clientID,
+        resource: cfg.resource
+      },
+      instruction: "\u5728\u6D4F\u89C8\u5668\u5B8C\u6210\u4E00\u6B21\u6388\u6743\uFF1BCLI \u7B49\u5F85\u56DE\u8C03\u540E\u81EA\u52A8\u7ED1\u5B9A\u3002",
+      next: null,
+      recovery: []
+    }, {
+      jsonOutput: Boolean(options.jsonOutput),
+      plainResult: ["\u6253\u5F00\u6D4F\u89C8\u5668\u5B8C\u6210\u6388\u6743\uFF1A", `  ${authorizeURL}`]
+    });
+    const tokens = await done;
+    let me;
+    try {
+      me = await probeHubIdentity(cfg.resource, tokens.accessToken);
+    } catch (error) {
+      if (error instanceof Error && error.message.startsWith("connection_verification_pending:")) {
+        throw new Error("connection_not_saved: identity verification unavailable; this connection was not saved and the existing connection was not replaced");
+      }
+      throw error;
     }
-    throw error;
-  }
-  if (!me.buyer_id || (!me.consumer_id || me.consumer_id !== `oauth:${cfg.clientID}` && !me.consumer_id.startsWith(`oauth:${cfg.clientID}:`))) throw new Error("authorization_required: OAuth consumer mismatch");
-  const subject = me.buyer_id;
-  storeHubSession(tokens.accessToken, tokens.refreshToken, tokens.expiresIn, subject, cfg.resource, process.env, me.consumer_id);
-  writeCommandEnvelope({
-    status: "connected",
-    result: {
-      hub: cfg.resource,
-      subject: subject ?? null,
-      expires_in: tokens.expiresIn,
-      refresh_token: Boolean(tokens.refreshToken)
-    },
-    instruction: "\u5DF2\u8FDE\u63A5\u3002\u53EF\u4EE5 itpay api discover / run\uFF1B\u5145\u503C\u8BF7\u5728\u7F51\u9875\u6216 topup \u547D\u4EE4\u4E2D\u660E\u786E\u8FDB\u884C\u3002",
-    next: { command: "itpay api doctor --json", reason: "\u9A8C\u8BC1\u8FDE\u63A5\u4E0E\u76EE\u5F55\u53EF\u7528" },
-    recovery: []
-  }, {
-    jsonOutput: Boolean(options.jsonOutput),
-    plainResult: [`\u5DF2\u8FDE\u63A5 ${cfg.resource}${subject ? ` (${subject})` : ""}`]
+    if (!me.buyer_id || (!me.consumer_id || me.consumer_id !== `oauth:${cfg.clientID}` && !me.consumer_id.startsWith(`oauth:${cfg.clientID}:`))) throw new Error("authorization_required: OAuth consumer mismatch");
+    const subject = me.buyer_id;
+    storeNewHubSession(tokens.accessToken, tokens.refreshToken, tokens.expiresIn, subject, cfg.resource, me.consumer_id);
+    writeCommandEnvelope({
+      status: "connected",
+      result: {
+        hub: cfg.resource,
+        subject: subject ?? null,
+        expires_in: tokens.expiresIn,
+        refresh_token: Boolean(tokens.refreshToken)
+      },
+      instruction: "\u5DF2\u8FDE\u63A5\u3002\u53EF\u4EE5 itpay api discover / run\uFF1B\u5145\u503C\u8BF7\u5728\u7F51\u9875\u6216 topup \u547D\u4EE4\u4E2D\u660E\u786E\u8FDB\u884C\u3002",
+      next: { command: "itpay api doctor --json", reason: "\u9A8C\u8BC1\u8FDE\u63A5\u4E0E\u76EE\u5F55\u53EF\u7528" },
+      recovery: []
+    }, {
+      jsonOutput: Boolean(options.jsonOutput),
+      plainResult: [`\u5DF2\u8FDE\u63A5 ${cfg.resource}${subject ? ` (${subject})` : ""}`]
+    });
   });
 }
 __name(runHubConnect, "runHubConnect");
+async function runHubRecoverConnection(options) {
+  await recoverHubConnection();
+  writeCommandEnvelope({ status: "ok", result: { status: "recovered", original_binding_preserved: true, business_calls: 0 }, instruction: "\u539F\u8FDE\u63A5\u5DF2\u6838\u5BF9\u5E76\u6062\u590D\u3002\u4EC5\u4F7F\u7528\u539F\u5F15\u7528 tasks --refresh \u6216 run-status \u8BFB\u53D6\uFF1B\u672C\u6B21\u672A\u7EED\u8DD1\u3001\u6D3E\u53D1\u6216\u6263\u8D39\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
+}
+__name(runHubRecoverConnection, "runHubRecoverConnection");
+async function runHubOriginalReceipt(requestKey, options) {
+  const receipt = await readOriginalHubReceipt(requestKey);
+  writeCommandEnvelope({ status: "ok", result: receipt, instruction: "\u4EC5\u56DE\u8BFB\u539F consumer \u7684\u4FDD\u5B58\u7ED3\u679C\u4E0E\u5B9E\u9645\u8D39\u7528\uFF1B\u539F\u8FDE\u63A5\u672A\u6FC0\u6D3B\uFF0C\u5176\u4ED6\u8FDE\u63A5\u4FDD\u6301\u6D3B\u8DC3\u3002\u672C\u6B21\u4E0D\u6388\u6743\u7EED\u8DD1\u6216\u65B0\u4E1A\u52A1\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
+}
+__name(runHubOriginalReceipt, "runHubOriginalReceipt");
 
 // src/commands/api_commands.ts
 function reportCLIError(error, contract) {
-  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && ["authorization_required", "connection_not_saved", "connection_verification_pending", "credential_persistence_failed"].some((code2) => error.message.startsWith(code2 + ":")) ? error.message.split(":", 1)[0] : contract?.code ?? "command_failed";
+  const code = error instanceof HubTaskRequestError ? error.code : error instanceof HttpError ? error.code : error instanceof Error && ["connection_recovery_conflict", "connection_recovery_denied", "authorization_required", "connection_not_saved", "connection_verification_pending", "credential_persistence_failed"].some((code2) => error.message.startsWith(code2 + ":")) ? error.message.split(":", 1)[0] : contract?.code ?? "command_failed";
+  let original = false;
+  try {
+    original = Boolean(storedHubProfile()?.consumer_id);
+  } catch {
+    original = true;
+  }
   const auth = code === "authorization_required" || code === "unauthenticated";
   const taskID = error instanceof HubTaskRequestError ? error.requestID : void 0;
   const references = error instanceof HubTaskRequestError ? error.references : void 0;
   const recover = taskID ? { command: qualifyItPayCommand(references?.run_id ? `itpay api run-status ${references.run_id}${contract?.jsonOutput ? " --json" : ""}` : `itpay api tasks --refresh --request-id ${taskID}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: "\u53EA\u8BFB\u6838\u5BF9\u540C\u4E00\u539F\u4EFB\u52A1\uFF0C\u4E0D\u521B\u5EFA\u6216\u7EED\u8DD1\u8BF7\u6C42", read_only: { method: "GET", path: references?.run_id ? `/v1/runs/${encodeURIComponent(references.run_id)}` : `/v1/requests/${encodeURIComponent("cli-req-" + taskID)}` } } : null;
-  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error), ...hubErrorDetails(error) ? { details: hubErrorDetails(error) } : {} }, ...references ? { result: references } : {}, instruction: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF0C\u5C1A\u672A\u4FDD\u5B58\uFF1B\u539F\u6709\u8FDE\u63A5\u672A\u66FF\u6362\u3002\u670D\u52A1\u6062\u590D\u540E\u6309\u539F\u914D\u7F6E\u6B63\u5E38 connect\uFF0C\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_verification_pending" ? "\u539F\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u5F15\u7528\uFF0C\u4E0D\u91CD\u65B0\u6388\u6743\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002\u7A0D\u540E\u53EA\u8BFB\u6838\u5BF9\u539F\u4EFB\u52A1\u3002" : code === "credential_persistence_failed" ? "\u539F\u8FDE\u63A5\u672A\u80FD\u5B89\u5168\u843D\u76D8\uFF1B\u505C\u6B62\u91CD\u8BD5\u5E76\u6838\u5BF9\u79C1\u6709\u5B58\u50A8\uFF0C\u4E0D\u6E05\u72B6\u6001\u6216\u6362\u8EAB\u4EFD\u3002" : auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth || code === "connection_not_saved" ? { command: qualifyItPayCommand(`itpay api connect${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u672A\u4FDD\u5B58\uFF1B\u6309\u539F\u914D\u7F6E\u5B8C\u6210\u6B63\u5E38\u8FDE\u63A5" : "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required", "credential_persistence_failed"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
+  writeCommandEnvelope({ status: "error", error: { code, message: error instanceof Error ? error.message : String(error), ...hubErrorDetails(error) ? { details: hubErrorDetails(error) } : {} }, ...references ? { result: references } : {}, instruction: code === "connection_recovery_conflict" ? "\u5DF2\u6709\u5176\u4ED6active\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8FDE\u63A5\u3001\u4EFB\u52A1\u4E0E\u79C1\u6709\u5019\u9009\uFF0C\u4EA4owner\u88C1\u51B3\uFF0C\u4E0D\u66FF\u6362\u6216\u64A4\u9500\u5176\u4ED6\u8FDE\u63A5\u3002" : code === "connection_recovery_denied" ? "\u539F\u8FDE\u63A5\u6062\u590D\u672A\u901A\u8FC7\uFF1B\u4FDD\u7559\u539Fprofile\u3001\u4EFB\u52A1\u53CA\u79C1\u6709\u6062\u590D\u6750\u6599\uFF0C\u4E0D\u65B0\u5EFAconnect\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF0C\u5C1A\u672A\u4FDD\u5B58\uFF1B\u539F\u6709\u8FDE\u63A5\u672A\u66FF\u6362\u3002\u670D\u52A1\u6062\u590D\u540E\u6309\u539F\u914D\u7F6E\u6B63\u5E38 connect\uFF0C\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002" : code === "connection_verification_pending" ? "\u539F\u8FDE\u63A5\u6821\u9A8C\u6682\u672A\u5B8C\u6210\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u5F15\u7528\uFF0C\u4E0D\u91CD\u65B0\u6388\u6743\u3001\u4E0D\u91CD\u53D1\u4E1A\u52A1\u3002\u7A0D\u540E\u53EA\u8BFB\u6838\u5BF9\u539F\u4EFB\u52A1\u3002" : code === "credential_persistence_failed" ? "\u539F\u8FDE\u63A5\u672A\u80FD\u5B89\u5168\u843D\u76D8\uFF1B\u505C\u6B62\u91CD\u8BD5\u5E76\u6838\u5BF9\u79C1\u6709\u5B58\u50A8\uFF0C\u4E0D\u6E05\u72B6\u6001\u6216\u6362\u8EAB\u4EFD\u3002" : auth && original ? "\u539F\u8FDE\u63A5\u5931\u6548\uFF1B\u4EC5\u7528 api recover-connection \u9A8C\u8BC1\u539F\u6388\u6743\u6062\u590D\uFF0C\u4FDD\u7559\u539Fprofile\u548C\u4EFB\u52A1\uFF0C\u4E0D\u65B0\u5EFA\u8FDE\u63A5\u6216\u91CD\u53D1\u4E1A\u52A1\u3002" : auth ? "\u5148\u5B8C\u6210 ItPay API \u6B63\u5E38\u8FDE\u63A5\uFF1B\u4FDD\u7559\u539F\u8EAB\u4EFD\u548C\u4EFB\u52A1\uFF0C\u4E0D\u8981\u521B\u5EFA\u66FF\u4EE3\u8BF7\u6C42\u3002" : ["idempotency_conflict", "invalid_state"].includes(code) ? "\u539F\u4EFB\u52A1\u8BB0\u5F55\u4E0D\u4E00\u81F4\uFF1B\u4FDD\u7559\u8BB0\u5F55\u6838\u5BF9\uFF0C\u4E0D\u80FD\u4FEE\u6539\u51BB\u7ED3\u53C2\u6570\u7EE7\u7EED\u53D1\u9001\u3002" : taskID ? "\u539F\u8BF7\u6C42\u5C1A\u672A\u53D6\u5F97\u53EF\u7528\u56DE\u6267\uFF1B\u8FD9\u4E0D\u4EE3\u8868\u672A\u5230\u8FBE\u670D\u52A1\u5668\u3002\u4FDD\u7559\u539F\u8BF7\u6C42\u6062\u590D\uFF0C\u4E0D\u91CD\u65B0\u8C03\u7528\u6216\u5145\u503C\u3002" : hubFailureInstruction(error, contract?.instruction ?? "Check the command and current Hub connection; preserve original tasks."), next: auth || code === "connection_not_saved" ? { command: qualifyItPayCommand(`itpay api ${original ? "recover-connection" : "connect"}${contract?.jsonOutput ? " --json" : ""}`, declaredAgentType()), reason: code === "connection_not_saved" ? "\u672C\u6B21\u8FDE\u63A5\u672A\u4FDD\u5B58\uFF1B\u6309\u539F\u914D\u7F6E\u5B8C\u6210\u6B63\u5E38\u8FDE\u63A5" : "\u6B63\u5E38\u6388\u6743\u540E\u7EE7\u7EED\u539F\u4EFB\u52A1" } : ["idempotency_conflict", "invalid_state", "forbidden", "publication_changed", "credential_revalidation_required", "credential_persistence_failed"].includes(code) ? null : recover, recovery: auth && recover ? [recover] : contract?.recovery ?? [] }, { jsonOutput: contract?.jsonOutput ?? process.argv.includes("--json") });
   process.exitCode = 1;
 }
 __name(reportCLIError, "reportCLIError");
@@ -6459,6 +6597,21 @@ function registerAPICommands(program3) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_connect_failed", instruction: "\u786E\u8BA4 ITPAY_HUB_URL \u53EF\u8FBE\u4E14\u6D4F\u89C8\u5668\u6388\u6743\u5DF2\u5B8C\u6210\u3002", recovery: [] });
     }
   });
+  hubCmd.command("original-receipt <request_key>").description("Read only the original consumer's saved run result and charge; never activate or resume").option("--json", "output JSON").action(async (requestKey, options) => {
+    try {
+      await runHubOriginalReceipt(requestKey, { jsonOutput: Boolean(options.json) });
+    } catch {
+      writeCommandEnvelope({ status: "error", error: { code: "receipt_unavailable", message: "\u539F\u5386\u53F2\u56DE\u6267\u672A\u53D6\u5F97\u3002" }, instruction: "\u4FDD\u7559\u539F\u8EAB\u4EFD\u4E0E\u79C1\u6709\u5019\u9009\uFF0C\u4EA4 owner \u6838\u5BF9\uFF0C\u4E0D\u6062\u590D/\u65B0\u5EFA\u8FDE\u63A5\u6216\u7EED\u8DD1\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.json) });
+      process.exitCode = 1;
+    }
+  });
+  hubCmd.command("recover-connection").description("Recover the exact original OAuth consumer with its original refresh proof; no browser or business retry").option("--json", "output JSON").action(async (options) => {
+    try {
+      await runHubRecoverConnection({ jsonOutput: Boolean(options.json) });
+    } catch (error) {
+      reportCLIError(error, { jsonOutput: Boolean(options.json), code: "connection_recovery_denied", instruction: "\u4FDD\u7559\u539F\u8FDE\u63A5\u53CA\u4EFB\u52A1\uFF1B\u4E0D\u5F97\u65B0\u5EFA\u8FDE\u63A5\u66FF\u4EE3\u3002", recovery: [] });
+    }
+  });
   hubCmd.command("discover").description("Search the published API catalog").option("--query <text>").option("--kinds <kinds>", "comma-separated kinds").option("--effect-classes <classes>", "comma-separated effect classes").option("--limit <n>", "max items", "50").option("--json", "output JSON").action(async (options) => {
     try {
       await runHubDiscover({
@@ -16947,7 +17100,7 @@ import { createHash as createHash12 } from "node:crypto";
 
 // src/state/skill_identity.generated.ts
 var CANONICAL_SKILL_SHA256 = "4a38087a41ed4b9b6e879726b93bdef99ca67fccd2a0f9837123d5b334b046c0";
-var CANONICAL_API_SKILL_SHA256 = "c980493480f855edf508e68be576003bcf169b6949ab707dfe516622621e8193";
+var CANONICAL_API_SKILL_SHA256 = "4faa2890ce35283256611d28d216d044e06e209e9d532597e4bba9079e66eb21";
 
 // src/commands/skill.ts
 import { existsSync as existsSync9, readFileSync as readFileSync16 } from "node:fs";