@itpay/cli 2.1.66 → 2.1.67

package/THIRD-PARTY-NOTICES.txt

@@ -1,6 +1,6 @@
 Third-party packages reachable from the ItPay Buyer runtime.
 
-===== @itpay/hub-client@0.1.0-integration.7286bd58df4a (UNLICENSED) =====
+===== @itpay/hub-client@0.1.0-integration.27c2f6955647 (UNLICENSED) =====
 --- LICENSE ---
 UNLICENSED
 

package/dist/src/main.js

@@ -6167,7 +6167,7 @@ async function runHubWallet(options) {
     };
   } else result = { available_atoms: bal.available.amount_atoms, held_atoms: bal.held.amount_atoms, currency: bal.available.currency, scale: bal.available.scale, period_limit_atoms: null, topup_url: bal.topup_url ?? null, scope: "account_balance", identity };
   result.owner_billing_url = bal.owner_billing_url ?? bal.topup_url ?? null;
-  writeCommandEnvelope({ status: "ready", result, instruction: options.usage || options.transactions ? "\u4EC5\u5F53\u524D\u51ED\u636E\u8303\u56F4\uFF1Bruns \u5305\u542B\u5931\u8D25\uFF0C\u4E0D\u662F\u6210\u529F\u4EA4\u4ED8\u6570\u3002\u673A\u5668\u6D41\u6C34\u53EA\u542B\u672C\u51ED\u636E\u6D88\u8D39/\u6D88\u8D39\u9000\u6B3E\uFF0C\u622A\u65AD\u4E0D\u80FD\u5F53\u5168\u91CF\u3002\u5168\u8D26\u53F7\u5145\u503C\u3001\u51BB\u7ED3\u53CA\u539F\u6B3E\u9000\u6B3E\u8BF7\u672C\u4EBA\u6253\u5F00\u8D26\u5355\u5165\u53E3\u3002" : "\u4F59\u989D\u5C5E\u4E8E\u8D26\u53F7\uFF0C\u4E0D\u4EE3\u8868\u672C\u8FDE\u63A5\u6D88\u8D39\u989D\u5EA6\u3002\u4E3B\u52A8\u5145\u503C\u6253\u5F00\u5B98\u65B9\u5165\u53E3\uFF0C\u7531\u672C\u4EBA\u9009\u6863\u5E76\u4ED8\u6B3E\uFF1B\u94FE\u63A5\u4E0D\u662F\u5145\u503C\u8BA2\u5355\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
+  writeCommandEnvelope({ status: "ready", result, instruction: options.usage || options.transactions ? "\u4EC5\u5F53\u524D\u51ED\u636E\u8303\u56F4\uFF1Bruns \u5305\u542B\u5931\u8D25\uFF0C\u4E0D\u662F\u6210\u529F\u4EA4\u4ED8\u6570\u3002\u673A\u5668\u6D41\u6C34\u53EA\u542B\u672C\u51ED\u636E\u6D88\u8D39/\u6D88\u8D39\u9000\u6B3E\uFF0C\u622A\u65AD\u4E0D\u80FD\u5F53\u5168\u91CF\u3002\u5168\u8D26\u53F7\u5145\u503C\u3001\u51BB\u7ED3\u53CA\u539F\u6B3E\u9000\u6B3E\u8BF7\u672C\u4EBA\u6253\u5F00\u8D26\u5355\u5165\u53E3\u3002" : "\u4F59\u989D\u5C5E\u4E8E\u8D26\u53F7\uFF0C\u4E0D\u4EE3\u8868\u672C\u8FDE\u63A5\u6D88\u8D39\u989D\u5EA6\u3002\u4E3B\u52A8\u5145\u503C\u6253\u5F00\u5B98\u65B9\u5165\u53E3\uFF0C\u7531\u672C\u4EBA\u9009\u6863\u5E76\u4ED8\u6B3E\uFF1B\u94FE\u63A5\u4E0D\u662F\u5145\u503C\u8BA2\u5355\u3002\u4E5F\u53EF\u4EE5\u544A\u8BC9\u6211\u91D1\u989D\uFF0C\u76F4\u63A5\u7ED9\u4F60\u626B\u7801\u4ED8\u6B3E\u3002", next: null, recovery: [] }, { jsonOutput: Boolean(options.jsonOutput) });
 }
 __name(runHubWallet, "runHubWallet");
 async function runHubDoctor(options) {
@@ -7893,28 +7893,138 @@ function registerAgentCommand(program3) {
 }
 __name(registerAgentCommand, "registerAgentCommand");
 
+// src/commands/wallet_topup.ts
+import { randomUUID as randomUUID14 } from "node:crypto";
+import { existsSync as existsSync12, mkdirSync as mkdirSync15, readdirSync as readdirSync5, readFileSync as readFileSync17, writeFileSync as writeFileSync14, renameSync as renameSync10 } from "node:fs";
+import { join as join9 } from "node:path";
+
+// src/render/browser.ts
+import { spawn } from "node:child_process";
+import { platform } from "node:os";
+function isPresentableURL(raw, baseURL, env = process.env) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url.username || url.password) return false;
+  if (env.ITPAY_CLI_DEV === "1" && /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(url.origin)) return true;
+  if (url.protocol !== "https:") return false;
+  const allowedOrigins = new Set(OFFICIAL_BACKEND_URLS);
+  if (baseURL) {
+    try {
+      allowedOrigins.add(new URL(baseURL).origin);
+    } catch {
+    }
+  }
+  return allowedOrigins.has(url.origin);
+}
+__name(isPresentableURL, "isPresentableURL");
+function openInSystemBrowser(raw, baseURL, env = process.env) {
+  if (!isPresentableURL(raw, baseURL, env)) {
+    return Promise.resolve({ status: "failed", reason: "url_rejected" });
+  }
+  const [command, args] = openerArgv(raw);
+  if (!command) {
+    return Promise.resolve({ status: "unavailable", reason: "no system opener on this platform" });
+  }
+  return new Promise((resolvePromise) => {
+    const child = spawn(command, args, { detached: true, stdio: "ignore" });
+    child.once("error", (error) => resolvePromise({ status: "failed", reason: error.message }));
+    child.once("spawn", () => {
+      child.unref();
+      resolvePromise({ status: "dispatch_accepted", argv: [command, ...args] });
+    });
+  });
+}
+__name(openInSystemBrowser, "openInSystemBrowser");
+function openerArgv(url) {
+  switch (platform()) {
+    case "darwin":
+      return ["open", [url]];
+    case "win32":
+      return ["cmd.exe", ["/c", "start", "", url]];
+    case "linux":
+    case "freebsd":
+    case "openbsd":
+      return ["xdg-open", [url]];
+    default:
+      return [void 0, []];
+  }
+}
+__name(openerArgv, "openerArgv");
+
+// src/commands/wallet_topup.ts
+async function walletTopup(options) {
+  const cfg = loadHubConfig(), api = new HubClient2(cfg), me = await api.me();
+  const root = join9(hubTasksDir(), ".funding");
+  mkdirSync15(root, { recursive: true, mode: 448 });
+  let path2;
+  if (options.topupStatus) {
+    const name = readdirSync5(root).find((name2) => {
+      try {
+        return JSON.parse(readFileSync17(join9(root, name2), "utf8")).topup_id === options.topupStatus;
+      } catch {
+        return false;
+      }
+    });
+    if (!name) throw Error("not_found: original top-up is not in this installation");
+    path2 = join9(root, name);
+  } else {
+    if (!options.topup || !/^\d+(?:\.\d{1,2})?$/.test(options.topup)) throw Error("invalid_input: enter a positive CNY amount with at most two decimal places");
+    path2 = join9(root, encodeURIComponent(options.topup) + ".json");
+  }
+  await withAsyncFileLock(path2 + ".lock", async () => {
+    let saved = existsSync12(path2) ? JSON.parse(readFileSync17(path2, "utf8")) : void 0;
+    if (saved && saved.buyer_id !== me.buyer_id) throw Error("authorization_required: original top-up account changed");
+    if (!options.topupStatus && saved?.topup_id && ["credited", "failed", "closed_unpaid"].includes(saved.status ?? "")) {
+      writeFileSync14(join9(root, "receipt-" + encodeURIComponent(saved.topup_id) + ".json"), JSON.stringify(saved), { mode: 384 });
+    }
+    if (!options.topupStatus && (!saved || saved.status === "credited" || saved.status === "failed" || saved.status === "closed_unpaid")) saved = { key: "cli-wallet-" + randomUUID14(), amount: options.topup, buyer_id: me.buyer_id, ...options.request ? { request_id: options.request } : {} };
+    if (!saved) throw Error("not_found: original top-up is unavailable");
+    if (options.request) saved.request_id = options.request;
+    const task = saved.request_id ? new HubTaskStore().get(saved.request_id) : void 0;
+    if (saved.request_id && !task?.intent_id) throw Error("invalid_state: keep the original request; no funding intent is available");
+    const save2 = /* @__PURE__ */ __name(() => {
+      const tmp = path2 + ".tmp";
+      writeFileSync14(tmp, JSON.stringify(saved), { mode: 384 });
+      renameSync10(tmp, path2);
+    }, "save");
+    save2();
+    const data = options.topupStatus ? await api.topupStatus(options.topupStatus) : await api.createTopup({ amount_cny: saved.amount, payer_currency: "CNY", ...task?.intent_id ? { continuation_id: task.intent_id } : {} }, saved.key);
+    saved.topup_id = data.topup_id;
+    saved.status = data.status;
+    save2();
+    const browser = data.page_url && !options.topupStatus && !options.noOpen ? await openInSystemBrowser(data.page_url, cfg.baseURL) : { status: "unavailable", reason: "host link presentation" };
+    const next = data.status === "credited" ? saved.request_id ? { command: `itpay api call --pending ${saved.request_id}${options.jsonOutput ? " --json" : ""}`, reason: "\u5230\u8D26\u540E\u7EE7\u7EED\u81EA\u5DF1\u7684\u539F\u8BF7\u6C42" } : null : { command: `itpay api wallet --topup-status ${data.topup_id}${options.jsonOutput ? " --json" : ""}`, reason: "\u53EA\u8BFB\u6838\u5BF9\u539F\u5145\u503C\uFF1B\u672C\u4EBA\u4ED8\u6B3E\u540E\u7EE7\u7EED" };
+    writeCommandEnvelope({ status: data.status, result: { ...data, browser, ...saved.request_id ? { request_id: saved.request_id } : {} }, instruction: data.status === "credited" ? `\u8D26\u53F7 ${data.account_hint ?? ""} \u5DF2\u5230\u8D26 \xA5${data.amount ?? saved.amount}\u3002\u4E0D\u8981\u91CD\u590D\u4ED8\u6B3E\uFF1B\u5982\u6709\u539F\u8BF7\u6C42\uFF0C\u7EE7\u7EED\u8FD4\u56DE\u7684\u539F call --pending\u3002\u5145\u503C\u4E0D\u589E\u52A0\u6D88\u8D39\u6388\u6743\u3002` : `${data.notice ? data.notice + "\u3002" : ""}\u4E3A\u8D26\u53F7 ${data.account_hint ?? ""} \u5145\u503C \xA5${data.amount ?? saved.amount}\u3002\u53EF\u626B\u7801\u6216\u6253\u5F00\u540C\u5355\u6536\u94F6\u53F0\uFF1B\u6309\u5BBF\u4E3B\u80FD\u529B\u5C55\u793A\u5B98\u65B9\u56FE\u7247\u3002${data.expires_at ? "\u6709\u6548\u81F3 " + data.expires_at + "\u3002" : ""}\u5C55\u793A\u80FD\u529B\u4E0D\u8DB3\u65F6\u7167\u5E38\u4F7F\u7528\u540C\u5355\u94FE\u63A5\u529E\u7406\u3002\u5145\u503C\u4E0D\u589E\u52A0\u6D88\u8D39\u6388\u6743\u3002`, next, recovery: [] }, { jsonOutput: options.jsonOutput });
+  });
+}
+__name(walletTopup, "walletTopup");
+
 // src/state/hub_show_cache.ts
 import { createHash as createHash13 } from "node:crypto";
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync17, renameSync as renameSync10, unlinkSync as unlinkSync9, writeFileSync as writeFileSync14 } from "node:fs";
-import { dirname as dirname11, join as join9 } from "node:path";
+import { mkdirSync as mkdirSync16, readFileSync as readFileSync18, renameSync as renameSync11, unlinkSync as unlinkSync9, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname11, join as join10 } from "node:path";
 function cachePath(operation) {
   const origin2 = loadHubConfig().baseURL;
   const key = createHash13("sha256").update(origin2 + "\0" + operation).digest("hex");
-  return join9(dirname11(hubCredentialsPath()), "shown", key + ".json");
+  return join10(dirname11(hubCredentialsPath()), "shown", key + ".json");
 }
 __name(cachePath, "cachePath");
 function saveShown(value) {
   const path2 = cachePath(value.operation_id);
-  mkdirSync15(dirname11(path2), { recursive: true, mode: 448 });
+  mkdirSync16(dirname11(path2), { recursive: true, mode: 448 });
   withFileLock(path2 + ".lock", () => {
     const temporary = path2 + "." + process.pid + ".tmp";
     const publication = createHash13("sha256").update(value.current_publication_id).digest("hex");
     const versioned = path2 + "." + publication;
     try {
-      writeFileSync14(temporary, JSON.stringify(value), { mode: 384 });
-      renameSync10(temporary, versioned);
-      writeFileSync14(temporary, JSON.stringify({ publication: versioned }), { mode: 384 });
-      renameSync10(temporary, path2);
+      writeFileSync15(temporary, JSON.stringify(value), { mode: 384 });
+      renameSync11(temporary, versioned);
+      writeFileSync15(temporary, JSON.stringify({ publication: versioned }), { mode: 384 });
+      renameSync11(temporary, path2);
     } finally {
       try {
         unlinkSync9(temporary);
@@ -7927,9 +8037,9 @@ __name(saveShown, "saveShown");
 function loadShown(operation) {
   try {
     const path2 = cachePath(operation);
-    const pointer = JSON.parse(readFileSync17(path2, "utf8"));
+    const pointer = JSON.parse(readFileSync18(path2, "utf8"));
     if (!pointer.publication.startsWith(path2 + ".") || !/^[a-f0-9]{64}$/.test(pointer.publication.slice(path2.length + 1))) throw new Error("invalid display pointer");
-    const value = JSON.parse(readFileSync17(pointer.publication, "utf8"));
+    const value = JSON.parse(readFileSync18(pointer.publication, "utf8"));
     if (value.operation_id === operation && value.current_publication_id && value.input_schema && value.price_card.mode !== "unconfigured") return value;
   } catch {
   }
@@ -7984,6 +8094,9 @@ function render(task, snapshot, json) {
   const run = snapshot.run;
   if (run) {
     const zero2 = run.captured_atoms === "0" && run.held_atoms === "0";
+    const balanceNotice = run.low_balance;
+    const firstNotice = Boolean(balanceNotice && !task.low_balance_notified);
+    if (firstNotice) new HubTaskStore().update(task.request_id, { low_balance_notified: true });
     writeCommandEnvelope({
       status: run.execution_state === "succeeded" ? "succeeded" : snapshot.terminal ? "failed" : "pending",
       result: {
@@ -7994,6 +8107,7 @@ function render(task, snapshot, json) {
         delivery_state: run.delivery_state,
         captured_atoms: run.captured_atoms ?? null,
         held_atoms: run.held_atoms ?? null,
+        ...firstNotice ? { low_balance: balanceNotice } : {},
         result: run.result ?? null,
         result_expires_at: run.result_expires_at ?? null,
         error: run.error ?? null,
@@ -8006,6 +8120,7 @@ function render(task, snapshot, json) {
     return;
   }
   const reason = snapshot.intent?.blocking_reason ?? "unknown";
+  const uncharged = ["insufficient_balance", "authorization_denied", "authorization_revoked", "budget_exceeded"].includes(reason);
   const target2 = snapshot.required_action?.web_action?.target ?? snapshot.required_action?.target;
   const changed = snapshot.terminal && reason === "publication_changed";
   const price = safePriceChange(snapshot.price_change);
@@ -8013,9 +8128,9 @@ function render(task, snapshot, json) {
   const label = price?.current_price ? "CNY " + priceLabel({ mode: "per_call", amount_atoms: price.current_price.amount_atoms }) : "\u6682\u4E0D\u53EF\u8BFB\u53D6";
   writeCommandEnvelope({
     status: changed ? "price_changed" : reason,
-    result: { request_id: task.request_id, intent_id: task.intent_id, captured_atoms: zero ? "0" : null, held_atoms: zero ? "0" : null, ...price ? { price_change: price } : {}, ...price?.current_price ? { current_price: price.current_price } : {} },
+    result: { request_id: task.request_id, intent_id: task.intent_id, account: snapshot.account_hint, captured_atoms: zero || uncharged ? "0" : null, held_atoms: zero || uncharged ? "0" : null, ...price ? { price_change: price } : {}, ...price?.current_price ? { current_price: price.current_price } : {} },
     ...target2 && !changed ? { handoff: { type: "open_url", url: target2, label: "\u6253\u5F00\u5B98\u65B9\u9875\u9762" } } : {},
-    instruction: changed ? `\u5F53\u524D\u4EF7\u683C ${label}\u3002${zero ? "\u539F\u8BF7\u6C42\u5DF2\u7ED3\u675F\uFF0C\u6263\u8D390\u3001\u51BB\u7ED30\uFF0C\u672C\u6B21\u6CA1\u6263\u94B1\u3002\u5148 show \u6838\u5BF9\u5F53\u524D\u5546\u54C1\uFF0C\u8BF4\u660E\u65B0\u4EF7\u5E76\u53D6\u5F97\u660E\u786E\u540C\u610F\u540E\u518D\u7528\u65B0 call\u3002" : "\u539F\u8BF7\u6C42\u8D39\u7528\u4ECD\u987B\u6838\u5BF9\u3002\u5148 status \u539F\u8BF7\u6C42\uFF0C\u672A\u786E\u8BA4\u96F6\u6263\u8D39\u548C\u96F6\u51BB\u7ED3\u524D\u4E0D\u8981\u65B0 call\u3002"}` : reason === "insufficient_balance" ? "\u8BF7\u5728\u539F\u5355\u5B98\u65B9\u9875\u9762\u5145\u503C\uFF0C\u5230\u8D26\u540E\u7EE7\u7EED\u539F\u8BF7\u6C42\u3002" : "\u4FDD\u7559\u539F\u8BF7\u6C42\uFF0C\u6309\u5B98\u65B9\u64CD\u4F5C\u5B8C\u6210\u6388\u6743\u6216\u6838\u5BF9\u3002",
+    instruction: changed ? `\u5F53\u524D\u4EF7\u683C ${label}\u3002${zero ? "\u539F\u8BF7\u6C42\u5DF2\u7ED3\u675F\uFF0C\u6263\u8D390\u3001\u51BB\u7ED30\uFF0C\u672C\u6B21\u6CA1\u6263\u94B1\u3002\u5148 show \u6838\u5BF9\u5F53\u524D\u5546\u54C1\uFF0C\u8BF4\u660E\u65B0\u4EF7\u5E76\u53D6\u5F97\u660E\u786E\u540C\u610F\u540E\u518D\u7528\u65B0 call\u3002" : "\u539F\u8BF7\u6C42\u8D39\u7528\u4ECD\u987B\u6838\u5BF9\u3002\u5148 status \u539F\u8BF7\u6C42\uFF0C\u672A\u786E\u8BA4\u96F6\u6263\u8D39\u548C\u96F6\u51BB\u7ED3\u524D\u4E0D\u8981\u65B0 call\u3002"}` : reason === "insufficient_balance" ? "\u8BF7\u5728\u539F\u5355\u5B98\u65B9\u9875\u9762\u5145\u503C\uFF0C\u5230\u8D26\u540E\u7EE7\u7EED\u539F\u8BF7\u6C42\u3002\u4E5F\u53EF\u4EE5\u544A\u8BC9\u6211\u91D1\u989D\uFF0C\u76F4\u63A5\u7ED9\u4F60\u626B\u7801\u4ED8\u6B3E\u3002" : "\u4FDD\u7559\u539F\u8BF7\u6C42\uFF0C\u6309\u5B98\u65B9\u64CD\u4F5C\u5B8C\u6210\u6388\u6743\u6216\u6838\u5BF9\u3002",
     next: changed && zero ? { command: `itpay api show ${task.operation_id}${json ? " --json" : ""}`, reason: "\u67E5\u770B\u5F53\u524D\u7528\u9014\u4E0E\u4EF7\u683C" } : changed ? statusAction(task.request_id, json) : snapshot.terminal ? null : pendingAction(task.request_id, json),
     recovery: []
   }, { jsonOutput: json });
@@ -8168,7 +8283,7 @@ async function shelfCall(operation, options) {
 __name(shelfCall, "shelfCall");
 
 // src/commands/admin.ts
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 var actions = /* @__PURE__ */ new Set(["operations_list", "ingestions_list", "import_github", "ingestion_status", "ingestion_retry", "credentials_list", "credential_put", "source_requirements", "source_bind", "acceptance_status", "acceptance_set"]);
 function parseAdminInput(action, raw) {
   if (!actions.has(action)) throw Error("unknown admin action");
@@ -8181,7 +8296,7 @@ __name(parseAdminInput, "parseAdminInput");
 async function runAdminCommand(action, source) {
   if (source !== "-" && !source.startsWith("@")) throw Error("Use stdin or a private file, never secret command arguments");
   if (action === "credential_put" && source !== "-") throw Error("credential_put accepts stdin only");
-  const raw = readFileSync18(source === "-" ? 0 : source.slice(1), "utf8");
+  const raw = readFileSync19(source === "-" ? 0 : source.slice(1), "utf8");
   const args = parseAdminInput(action, raw);
   const cfg = loadHubConfig();
   if (!cfg.apiKey || cfg.bearerToken) throw Error("Explicit scoped ITPAY_HUB_KEY required");
@@ -8322,8 +8437,12 @@ function registerAPICommands(program3) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_doctor_failed", instruction: "\u6309\u8F93\u51FA\u9010\u6761\u4FEE\u590D\u672C\u5730\u6808\u3002", recovery: [] });
     }
   });
-  hubCmd.command("wallet").description("Read wallet, current credential usage or scoped transactions").option("--usage", "read current Key/Consumer usage; not account-wide").option("--transactions", "read scoped transactions; owner history uses the official page").option("--json", "output JSON").action(async (options) => {
+  hubCmd.command("wallet").description("Read wallet or prepare an explicit own-wallet top-up").option("--topup <amount>", "prepare a CNY wallet top-up; minimum 10 CNY").option("--topup-status <topup_id>", "read the original top-up").option("--request <request_id>", "retain your original pending API request").option("--no-open", "this host does not open a browser; retain the same payment links").option("--usage", "read current Key/Consumer usage; not account-wide").option("--transactions", "read scoped transactions; owner history uses the official page").option("--json", "output JSON").action(async (options) => {
     try {
+      if (options.topup || options.topupStatus) {
+        await walletTopup({ topup: options.topup, topupStatus: options.topupStatus, request: options.request, noOpen: options.open === false, jsonOutput: Boolean(options.json) });
+        return;
+      }
       await runHubWallet({ jsonOutput: Boolean(options.json), usage: Boolean(options.usage), transactions: Boolean(options.transactions) });
     } catch (error) {
       reportCLIError(error, { jsonOutput: Boolean(options.json), code: "hub_wallet_failed", instruction: "\u786E\u8BA4\u539F\u5B89\u88C5\u7684\u8FDE\u63A5\u8EAB\u4EFD\u3002", recovery: [] });
@@ -15331,65 +15450,8 @@ function projectCheckoutPresentation(presentation, model) {
 }
 __name(projectCheckoutPresentation, "projectCheckoutPresentation");
 
-// src/render/browser.ts
-import { spawn } from "node:child_process";
-import { platform } from "node:os";
-function isPresentableURL(raw, baseURL, env = process.env) {
-  let url;
-  try {
-    url = new URL(raw);
-  } catch {
-    return false;
-  }
-  if (url.username || url.password) return false;
-  if (env.ITPAY_CLI_DEV === "1" && /^http:\/\/(localhost|127\.0\.0\.1)(:\d+)?$/.test(url.origin)) return true;
-  if (url.protocol !== "https:") return false;
-  const allowedOrigins = new Set(OFFICIAL_BACKEND_URLS);
-  if (baseURL) {
-    try {
-      allowedOrigins.add(new URL(baseURL).origin);
-    } catch {
-    }
-  }
-  return allowedOrigins.has(url.origin);
-}
-__name(isPresentableURL, "isPresentableURL");
-function openInSystemBrowser(raw, baseURL, env = process.env) {
-  if (!isPresentableURL(raw, baseURL, env)) {
-    return Promise.resolve({ status: "failed", reason: "url_rejected" });
-  }
-  const [command, args] = openerArgv(raw);
-  if (!command) {
-    return Promise.resolve({ status: "unavailable", reason: "no system opener on this platform" });
-  }
-  return new Promise((resolvePromise) => {
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
-    child.once("error", (error) => resolvePromise({ status: "failed", reason: error.message }));
-    child.once("spawn", () => {
-      child.unref();
-      resolvePromise({ status: "dispatch_accepted", argv: [command, ...args] });
-    });
-  });
-}
-__name(openInSystemBrowser, "openInSystemBrowser");
-function openerArgv(url) {
-  switch (platform()) {
-    case "darwin":
-      return ["open", [url]];
-    case "win32":
-      return ["cmd.exe", ["/c", "start", "", url]];
-    case "linux":
-    case "freebsd":
-    case "openbsd":
-      return ["xdg-open", [url]];
-    default:
-      return [void 0, []];
-  }
-}
-__name(openerArgv, "openerArgv");
-
 // src/render/terminal_image.ts
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 import path from "node:path";
 function supportsInlineTerminalImages() {
   return Boolean(process.env.ITERM_SESSION_ID) || process.env.TERM_PROGRAM === "iTerm.app";
@@ -15398,7 +15460,7 @@ __name(supportsInlineTerminalImages, "supportsInlineTerminalImages");
 function renderInlineTerminalImage(filePath, out) {
   if (!supportsInlineTerminalImages()) return;
   try {
-    const buf = readFileSync19(filePath);
+    const buf = readFileSync20(filePath);
     const name = path.basename(filePath);
     const nameB64 = Buffer.from(name).toString("base64");
     const dataB64 = buf.toString("base64");
@@ -17285,8 +17347,8 @@ var {
 } = import_index.default;
 
 // src/state/cart_session.ts
-import { chmodSync as chmodSync7, existsSync as existsSync12, mkdirSync as mkdirSync16, readFileSync as readFileSync20, renameSync as renameSync11, writeFileSync as writeFileSync15 } from "node:fs";
-import { randomUUID as randomUUID14 } from "node:crypto";
+import { chmodSync as chmodSync7, existsSync as existsSync13, mkdirSync as mkdirSync17, readFileSync as readFileSync21, renameSync as renameSync12, writeFileSync as writeFileSync16 } from "node:fs";
+import { randomUUID as randomUUID15 } from "node:crypto";
 import { dirname as dirname12 } from "node:path";
 var CartSession = class _CartSession {
   static {
@@ -17299,9 +17361,9 @@ var CartSession = class _CartSession {
   }
   static loadFromFile(path2, currency) {
     const session = new _CartSession(currency);
-    if (existsSync12(path2)) {
+    if (existsSync13(path2)) {
       try {
-        const raw = readFileSync20(path2, "utf-8");
+        const raw = readFileSync21(path2, "utf-8");
         const persisted = JSON.parse(raw);
         if (Array.isArray(persisted.items)) {
           persisted.items.forEach((item) => {
@@ -17335,12 +17397,12 @@ var CartSession = class _CartSession {
       ...this.state.lastCheckoutURL ? { lastCheckoutURL: this.state.lastCheckoutURL } : {}
     };
     const contents = JSON.stringify(toSave, null, 2);
-    if (existsSync12(path2) && readFileSync20(path2, "utf-8") === contents) return;
-    mkdirSync16(dirname12(path2), { recursive: true, mode: 448 });
-    const temporary = `${path2}.${process.pid}.${randomUUID14()}.tmp`;
-    writeFileSync15(temporary, contents, { encoding: "utf-8", mode: 384 });
+    if (existsSync13(path2) && readFileSync21(path2, "utf-8") === contents) return;
+    mkdirSync17(dirname12(path2), { recursive: true, mode: 448 });
+    const temporary = `${path2}.${process.pid}.${randomUUID15()}.tmp`;
+    writeFileSync16(temporary, contents, { encoding: "utf-8", mode: 384 });
     chmodSync7(temporary, 384);
-    renameSync11(temporary, path2);
+    renameSync12(temporary, path2);
     chmodSync7(path2, 384);
   }
   add(item) {
@@ -17467,14 +17529,14 @@ import { createHash as createHash14 } from "node:crypto";
 
 // src/state/skill_identity.generated.ts
 var CANONICAL_SKILL_SHA256 = "8dd5c3a00d3ff35ce8490e3703d012dd4c936c1827b2a5541f630783e2877a67";
-var CANONICAL_API_SKILL_SHA256 = "9c69ea354e255ef5d71ec2d7c473446fc6b4e2e33ab6bebcea3472cd22bfe80a";
+var CANONICAL_API_SKILL_SHA256 = "c37e2efb288bf4545c828671afacb3f783f3e7020dbb4cccd0b7d273e636e84e";
 
 // src/commands/skill.ts
-import { existsSync as existsSync14, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync23 } from "node:fs";
 import { resolve as resolve10 } from "node:path";
 
 // src/state/package_resources.ts
-import { existsSync as existsSync13, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync14, readFileSync as readFileSync22 } from "node:fs";
 import { basename as basename2, dirname as dirname13, resolve as resolve9 } from "node:path";
 import { fileURLToPath } from "node:url";
 function packageResourcePath(...segments) {
@@ -17482,7 +17544,7 @@ function packageResourcePath(...segments) {
   const root = resolve9(dirname13(modulePath), "..", "..");
   if (!basename2(modulePath).startsWith("package_resources.") && basename2(modulePath) !== "main.js") throw new Error("unsupported CLI resource layout");
   const metadata = resolve9(root, "package.json");
-  if (!existsSync13(metadata) || JSON.parse(readFileSync21(metadata, "utf8")).name !== "@itpay/cli") throw new Error("current CLI package resources are unavailable");
+  if (!existsSync14(metadata) || JSON.parse(readFileSync22(metadata, "utf8")).name !== "@itpay/cli") throw new Error("current CLI package resources are unavailable");
   return resolve9(root, ...segments);
 }
 __name(packageResourcePath, "packageResourcePath");
@@ -17506,7 +17568,7 @@ function runSkillShow(name, options = {}) {
   const original = packagedSkill();
   let content;
   try {
-    content = readFileSync22(findSkillPath(), "utf8");
+    content = readFileSync23(findSkillPath(), "utf8");
   } catch (error) {
     if (process.env.ITPAY_CLI_SKILLS_DIR) {
       const cause = error && typeof error === "object" && "code" in error ? String(error.code) : "read_failed";
@@ -17554,8 +17616,8 @@ ${CODEX_WAIT_GUIDANCE}
 __name(runSkillShow, "runSkillShow");
 function packagedSkill() {
   let path2 = findSkillPath(false);
-  if (!existsSync14(path2) && process.env.ITPAY_CLI_SKILLS_DIR) path2 = findSkillPath();
-  const content = readFileSync22(path2, "utf8");
+  if (!existsSync15(path2) && process.env.ITPAY_CLI_SKILLS_DIR) path2 = findSkillPath();
+  const content = readFileSync23(path2, "utf8");
   if (createHash14("sha256").update(content).digest("hex") !== CANONICAL_SKILL_SHA256) {
     throw new CommandContractError("skill_override_mismatch", "Skill does not match this pinned CLI build", "\u4F7F\u7528\u5F53\u524D\u5305\u540C\u6E90\u7684\u5B8C\u6574 Skill\uFF1B\u4FDD\u7559\u539F\u4EFB\u52A1\u548C\u8EAB\u4EFD\uFF0C\u4E0D\u5B89\u88C5\u53E6\u4E00\u5957 CLI\u3002", []);
   }
@@ -17567,7 +17629,7 @@ function findSkillPath(allowOverride = true) {
   if (allowOverride && process.env.ITPAY_CLI_SKILLS_DIR) {
     const configuredRoot = resolve10(process.env.ITPAY_CLI_SKILLS_DIR);
     const directPath = resolve10(configuredRoot, "SKILL.md");
-    if (existsSync14(directPath)) return directPath;
+    if (existsSync15(directPath)) return directPath;
     return resolve10(configuredRoot, ITPAY_SKILL, "SKILL.md");
   }
   return packageResourcePath("skills", ITPAY_SKILL, "SKILL.md");
@@ -17583,7 +17645,7 @@ __name(validateSkill, "validateSkill");
 function showAPISkill(options) {
   let content;
   try {
-    content = readFileSync22(packageResourcePath("skills", "itpay-api", "SKILL.md"), "utf8");
+    content = readFileSync23(packageResourcePath("skills", "itpay-api", "SKILL.md"), "utf8");
   } catch {
     throw new CommandContractError(
       "skill_unavailable",
@@ -19695,7 +19757,7 @@ function writeCartNextEnvelope(envelope, options) {
 __name(writeCartNextEnvelope, "writeCartNextEnvelope");
 
 // src/commands/docs.ts
-import { readFileSync as readFileSync23, readdirSync as readdirSync5 } from "node:fs";
+import { readFileSync as readFileSync24, readdirSync as readdirSync6 } from "node:fs";
 import { resolve as resolve11 } from "node:path";
 function runDocsList(options = {}) {
   const topics = loadDocs().map(({ topic, title, purpose }) => ({ topic, title, purpose }));
@@ -19770,12 +19832,12 @@ function runDocsSearch(query, options = {}) {
 __name(runDocsSearch, "runDocsSearch");
 function loadDocs() {
   const docsDir = findDocsDir();
-  const files = readdirSync5(docsDir).filter((file) => file.endsWith(".json")).sort();
-  const docs = files.map((file) => parseDoc(readFileSync23(resolve11(docsDir, file), "utf8"), file));
+  const files = readdirSync6(docsDir).filter((file) => file.endsWith(".json")).sort();
+  const docs = files.map((file) => parseDoc(readFileSync24(resolve11(docsDir, file), "utf8"), file));
   if (process.env.ITPAY_CLI_DOCS_DIR) {
     const canonical = packageResourcePath("docs", "agent", "buyer");
-    const expectedFiles = readdirSync5(canonical).filter((file) => file.endsWith(".json")).sort();
-    if (JSON.stringify(files) !== JSON.stringify(expectedFiles) || files.some((file, index) => JSON.stringify(docs[index]) !== JSON.stringify(parseDoc(readFileSync23(resolve11(canonical, file), "utf8"), file)))) {
+    const expectedFiles = readdirSync6(canonical).filter((file) => file.endsWith(".json")).sort();
+    if (JSON.stringify(files) !== JSON.stringify(expectedFiles) || files.some((file, index) => JSON.stringify(docs[index]) !== JSON.stringify(parseDoc(readFileSync24(resolve11(canonical, file), "utf8"), file)))) {
       throw new CommandContractError(
         "docs_override_mismatch",
         "configured Buyer docs differ from the current package",

package/dist/src/state/config.js

@@ -1,4 +1,4 @@
-const CLI_VERSION = "2.1.66";
+const CLI_VERSION = "2.1.67";
 const API_CONTRACT_REVISION = "sha256:f20af3780a0e12a79a6ca9507ba65167a4018338495af66d87931e55619b618a";
 export {
   API_CONTRACT_REVISION,

package/docs/cli-reference/api.md

@@ -27,3 +27,8 @@ A `price_changed` receipt includes `current_price` (CNY, scale 6, atoms) and ver
 Use a secret manager to inject ITPAY_HUB_KEY or pipe a private secret source to `itpay api credentials import --json`. Never pass the secret in argv or chat. With --profile, import into that same installation; an explicit environment Key remains selected. It does not need OAuth. Saved OAuth and Key remain private; the last explicit import/connect selects the credential, while a Key environment override selects that Key. Supplying both environment bearer and Key is an error. Requests remain isolated by original credential; neither a new Key nor OAuth can take over old requests.
 
 Check `wallet` identity.account_hint and credential_kind; matching hints identify the same wallet, not the same consumer. Invalid/revoked Key or insufficient Key scope points to the official /me/keys page, without OAuth fallback. Hub MCP accepts Key only through its existing X-ItPay-Key protocol header; normal ChatGPT MCP uses OAuth. Do not paste a Key into chat or put it in a Bearer field. Services identity is independent.
+
+
+### 本人钱包定额充值
+
+`itpay api wallet --topup 30 --json` 准备本人钱包的人民币充值，按分报价，最低 ¥10。若为已有挂起请求充值，加 `--request <原 request_id>`；付款后按返回 next 读取原充值并继续原 call --pending。CLI 在宿主可打开浏览器时主动打开官方 page_url，同时返回 checkout_url 和 image。`--no-open` 用于无浏览器打开能力的宿主。`wallet --topup-status <topup_id>` 只读原充值。OAuth/API Hub Key 准备充值不要求消费 grant；充值不会增加调用额度、商户收款或退款权限。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "2.1.66",
+  "version": "2.1.67",
   "description": "The ItPay CLI for services, orders, and human-authorized purchased content.",
   "type": "module",
   "bin": {
@@ -110,7 +110,7 @@
     "node": ">=18"
   },
   "devDependencies": {
-    "@itpay/hub-client": "file:dependencies/itpay-hub-client-0.1.0-integration.7286bd58df4a.tgz",
+    "@itpay/hub-client": "file:dependencies/itpay-hub-client-0.1.0-integration.27c2f6955647.tgz",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@types/node": "^22.7.5",
     "@types/qrcode": "^1.5.5",
@@ -148,5 +148,5 @@
     "services",
     "api"
   ],
-  "gitHead": "f0a951df3d1152e1255523d647f4602ee5b76659"
+  "gitHead": "d3e88d44ef74e7f8d762f04fb5105731c77b69cb"
 }

package/skills/itpay-api/SKILL.md

@@ -48,3 +48,14 @@ New task-driven installations use one official Agent connection page. Each busin
 A user may securely inject ITPAY_HUB_KEY or import the selected Key with api credentials import through private stdin. Never ask for it in chat, put it in argv/logs, or echo it. A Key authorizes API Hub only within its catalog, effects and spending grant. It does not authorize Services or payment writes. An explicit environment Key wins over a saved OAuth connection; importing a Key selects it while preserving OAuth privately. An explicit normal connect selects OAuth. Never switch credentials to resume an existing request: its original task namespace remains isolated.
 
 For an API task with a selected Key, agent prepares only that API installation and reads its identity without OAuth. Read wallet identity.credential_kind and account_hint before work; all hosts in a shared-wallet test must show the same hint. If mismatched, stop that new task and have the owner select the intended Key or normally reconnect the intended account; keep all existing requests and do not revoke another host. Invalid/revoked Key or insufficient scope directs the owner to /me/keys and secure stdin import, never automatic OAuth fallback. A top-up URL is navigation, not a created top-up; /hub/mcp is a protocol connection URL, not a payment page.
+
+
+## Amount-based own-wallet top-up
+
+When the user only asks to top up, return wallet.topup_url and say: “也可以告诉我金额，直接给你扫码付款。” For insufficient_balance, keep the original request and its continuation link with the same hint. Never turn these two cases into an unsolicited payment order.
+
+When an amount is explicit, run `itpay api wallet --topup 30 --json` (use the user's amount). If continuing a saved insufficient-balance task, add `--request <original request_id>`. OAuth and valid api_hub Keys can prepare their own wallet top-up without a spending grant. The server quotes positive CNY amounts in cents, minimum ¥10; for a smaller amount say “最低 ¥10，本单按 ¥10”. The reply and official card must identify the masked credited account, actual amount and expiry.
+
+When browser capability is available, immediately open the returned official page_url. Provide the same checkout_url and, where supported, the returned official image. Scan and click are user choices. Limited display capability does not stop payment; a link-only host can use the same checkout. Do not draw or reconstruct QR codes. `--no-open` expresses a host without browser opening. Poll the returned original top-up status; when credited follow the returned original call --pending, never create another business request. A shared funding card does not transfer another connection's task.
+
+Report low_balance once per notification_id with available_atoms, compared_price_atoms and the official wallet link. Key authorization/budget failures use the exact server-issued Key settings link, never a top-up to bypass a grant. Funding never enables API spending or merchant payment/refund permission.