@itpay/cli 2.1.64 → 2.1.65

package/dist/src/state/config.js

@@ -1,4 +1,4 @@
-const CLI_VERSION = "2.1.64";
+const CLI_VERSION = "2.1.65";
 const API_CONTRACT_REVISION = "sha256:f20af3780a0e12a79a6ca9507ba65167a4018338495af66d87931e55619b618a";
 export {
   API_CONTRACT_REVISION,

package/docs/cli-reference/api.md

@@ -34,3 +34,21 @@ The current local candidate includes this reference and the independent API Skil
 ## Entry selection
 
 For a new task, prefer the official pinned ItPay CLI when execution is permitted and available in the current host. Install only through the host-permitted official installation path when authorized. Services tasks use the Services Skill; API tasks use the independent API Skill and `itpay api`. CLI calls HTTP APIs directly, never MCP transport. Without permitted CLI capability, use the corresponding ItPay-hosted user Services MCP or Hub MCP and only its actually available tools; ordinary users do not self-host another MCP. Platform-required workflows and explicit connection tests follow the actual available capability. Entry selection never authorizes a permission bypass: preserve the original identity, entry, request/run and current grant after acceptance or an unknown result. Continue across entries only when the owner explicitly supports recovery under the same actual authority; CLI errors never license a substitute transaction or raw HTTP workaround.
+
+
+## Original OAuth connection recovery
+
+`itpay api recover-connection --json` is an explicit, noninteractive identity operation. It uses only the selected original profile's refresh proof, verifies the authority-issued original buyer/client/resource/consumer at the server, then checks `/v1/me` before committing that same binding. It never creates a connection, grant, run, continuation, hold or charge. Existing `api connect` refuses to replace a saved profile. Account equality or a client-family prefix is not original-connection proof.
+
+Keep the original state directory and endpoint configuration. Missing/revoked proof, a wrong account or consumer, or an unavailable paired server stops recovery and preserves the original profile and local tasks. A rotated session is kept in a private `.recovery.json` candidate until verification succeeds; ordinary business commands stop while it exists. An unknown refresh result must not be retried automatically. An unknown recovery reply can reuse the same unexpired candidate via this recovery command without another refresh. Never delete recovery material or restore an old rotated refresh token to bypass this stop. An expired candidate can rotate its saved same-binding refresh proof; it never reuses the consumed original refresh. Lost or rejected original proof needs owner review, not a replacement login.
+
+After successful recovery, only read original references with `api tasks --refresh --request-id <original_request_id> --json` or `api run-status <original_run_id> --json`. Recovery does not authorize `resume`, a new run or a payment. Interactive new-login recovery without original delegation proof is unsupported; stop and report the required evidence category instead of asking the user to log in blindly.
+
+If another active connection occupies the original client slot, recovery returns `connection_recovery_conflict` without replacing or revoking it. Preserve both connections and the private candidate for owner review; do not delete a connection to force recovery.
+
+
+### Original consumer historical receipt
+
+`itpay api original-receipt <exact_original_request_key> --json` reads a saved run result and actual charge using the original OAuth consumer. It does not activate the original connection, displace another active connection, resume a run or authorize spending. Use the exact original admission key (including any `cli-req-` prefix), not a new task key. This requires the paired historical receipt server and a still-valid, unrevoked original delegation.
+
+A refreshed token stays in the existing private recovery candidate; the operational profile and tasks remain unchanged. Normal business commands continue to stop while recovery is pending. Lost GET replies may reuse the candidate; an unknown refresh result stops further refresh. Rejected proof or unavailable pairing requires owner review, never a replacement login or connection revocation. Expired saved results are not regenerated; retained charge facts remain readable. No automatic continuation is offered.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.64",
+  "version": "2.1.65",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -148,5 +148,5 @@
     "services",
     "api"
   ],
-  "gitHead": "1e5b2e4cbc612afbb963612015e29eefd735d006"
+  "gitHead": "9838867719610e7d25120c5874c0cc50bcaa292e"
 }

package/skills/itpay-api/SKILL.md

@@ -28,3 +28,14 @@ Read the full authoritative `terminal`, `pending_stage`, execution, settlement a
 Wallet atoms use the returned scale; don't confuse them with Payment minor units. Insufficient funds does not authorize a top-up. Only create an explicitly requested top-up using the advertised SKU/channel and supported presentation; keep the original intent. Native host confirmation and business consent are separate. Do not route around channel policy through Services, another CLI or raw HTTP.
 
 Show useful results, actual charges/limits and required human action plainly. A Payment URL/QR or callback does not prove credit, completion or fulfillment. Payment unknown/refund pending stays unresolved until the owner reports facts. Do not expose credentials, raw private requests or customer data. The API command reference is optional and only needed for the current command.
+
+
+## Original OAuth connection recovery
+
+`itpay api recover-connection --json` is an explicit, noninteractive identity operation. It uses only the selected original profile's refresh proof, verifies the authority-issued original buyer/client/resource/consumer at the server, then checks `/v1/me` before committing that same binding. It never creates a connection, grant, run, continuation, hold or charge. Existing `api connect` refuses to replace a saved profile. Account equality or a client-family prefix is not original-connection proof.
+
+Keep the original state directory and endpoint configuration. Missing/revoked proof, a wrong account or consumer, or an unavailable paired server stops recovery and preserves the original profile and local tasks. A rotated session is kept in a private `.recovery.json` candidate until verification succeeds; ordinary business commands stop while it exists. An unknown refresh result must not be retried automatically. An unknown recovery reply can reuse the same unexpired candidate via this recovery command without another refresh. Never delete recovery material or restore an old rotated refresh token to bypass this stop. An expired candidate can rotate its saved same-binding refresh proof; it never reuses the consumed original refresh. Lost or rejected original proof needs owner review, not a replacement login.
+
+After successful recovery, only read original references with `api tasks --refresh --request-id <original_request_id> --json` or `api run-status <original_run_id> --json`. Recovery does not authorize `resume`, a new run or a payment. Interactive new-login recovery without original delegation proof is unsupported; stop and report the required evidence category instead of asking the user to log in blindly.
+
+If another active connection occupies the original client slot, recovery returns `connection_recovery_conflict` without replacing or revoking it. Preserve both connections and the private candidate for owner review; do not delete a connection to force recovery.