@viceme-ai/cli 0.23.1 → 0.24.1

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [0.24.1] - 2026-09-02
+
+### Fixes
+
+- 修复工具购买鉴权并持久恢复同一订单 (`1e07d2a`)
+- 隐藏网站收费配置细节 (`6a146a2`)
+
+### Other Changes
+
+- 刷新官方 Skill 清单 (`87ed5f6`)
+- 说明付费解锁来源策略 (`dd838be`)
+
+## [0.24.0] - 2026-09-02
+
+### Features
+
+- 添加网站做同款官方技能 (`d0214a8`)
+- 实现复刻源码购买安装 (`bb8348a`)
+- 添加复刻源码安全原子安装器 (`ab783dd`)
+- 实现网站源码复刻发布 (`017d439`)
+- 添加网站复刻登录权限 (`babd2bf`)
+
+### Fixes
+
+- 明确发布条目选择与免费改价影响 (`048f616`)
+- 加固复刻发布与确认边界 (`4ace44f`)
+- 加固复刻安装与支付恢复 (`9935180`)
+- 锁定复刻交易响应与恢复状态 (`1ec51ee`)
+- 收紧复刻响应关系校验 (`36e35aa`)
+- 严格校验复刻交易响应 (`1df96cb`)
+- 加固复刻源码安装恢复 (`1d99cf2`)
+- 对齐复刻包摘要格式 (`c40641c`)
+
+### Other Changes
+
+- 覆盖复刻安装崩溃恢复边界 (`ca95dea`)
+
 ## [0.23.1] - 2026-09-02
 
 ### Fixes

package/README.md

@@ -93,9 +93,9 @@ viceme auth login
 viceme merchant accounts
 
 # Upload the real private draft and open its Owner Preview before pricing.
-viceme skill publish --path ./my-skill
+viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0
 # With multiple active Merchant accounts, select the confirmed account:
-# viceme skill publish --path ./my-skill --merchant <merchant-account-id>
+# viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0 --merchant <merchant-account-id>
 
 # Continue the same unpriced draft and upload media candidates.
 viceme skill publish --resume <publication-id>
@@ -170,12 +170,11 @@ Select a target explicitly with `viceme install --agent codex`, `claude`,
 | `become-a-creator` | apply for, claim, or check creator qualification for every creator workflow. |
 | `sell-a-skill` | publish or update a paid or free downloadable Skill; websites, services, and generic goods are out of scope. |
 | `viceme-skill-use` | resolve free, purchased, or purchase-required access, install the selected Skill, and continue the original task. |
-| `charge-for-your-work` | integrate an existing website access configuration into host code after the shared creator qualification check. |
+| `charge-for-your-work` | configure follow or paid unlock for an existing website and integrate it into host code after the shared creator qualification check; platform resources stay internal. |
 | `let-people-interact` | branch between danmaku, open tips, or both; danmaku-bearing routes require a published Website Work with an exact canonical Origin, while Tip can use any eligible published Merchant Work and either Mounted or Headless UI; none requires DNS ownership verification. |
+| `let-others-make-a-copy` | publish a complete website source ZIP with a root `VICEME-REPLICA.md`, then integrate the platform-provided replica prompt into the creator's own site. |
 
-`let-others-make-a-copy` is the reserved public name for remix delivery, but no official Skill is
-available until that product workflow is implemented. Buyer-side `viceme-skill-use` keeps its
-existing name because it is not a creator workflow.
+Buyer-side `viceme-skill-use` keeps its existing name because it is not a creator workflow.
 
 The Agent Skills own the conversational workflow and approval rules. The CLI
 owns deterministic local work and API calls. This separation lets an Agent
@@ -261,7 +260,7 @@ Never copy an access token into the conversation.
 | `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
 | `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
 | `viceme skill listing bind <listing-id> --path <path>` | Explicitly bind a source to a selected owned Listing. |
-| `viceme skill publish --path <path> [--merchant <id>]` | Freeze the selected owned Merchant, upload the real private package, and return its Owner Preview before pricing. The flag is required only when multiple active Merchants exist. |
+| `viceme skill publish --path <path> --edition-key <key> --edition-order <order> [--merchant <id>]` | Freeze the selected owned Merchant, upload the real private package, and return its Owner Preview before pricing. Edition selection is always explicit; --merchant is required only when multiple active Merchants exist. |
 | `viceme skill publish --resume <id>` | Continue the same unpriced Draft and upload media candidates without starting a platform model. |
 | `viceme publication review <id>` | Read the authoritative bilingual copy, price, selected media, and review state. |
 | `viceme publication suggest <id> --input ...` | Apply Agent-generated bilingual copy and media with Draft revision protection. |
@@ -272,6 +271,8 @@ Never copy an access token into the conversation.
 | `viceme publication update ...` | Replace the complete listing draft from a strict JSON file. |
 | `viceme publication confirm ...` | Confirm the exact current review digest. |
 | `viceme publication publish ...` | Make a confirmed listing public. |
+| `viceme replica publish ...` | Validate a complete source ZIP with a root `VICEME-REPLICA.md`, publish an immutable version, and return the stable code and creator-site prompts. |
+| `viceme replica install <code> --target <new-directory>` | Create and display the authoritative Quote without an order; rerun with `--confirm` only after the buyer explicitly approves it. |
 | `viceme update` | Update the CLI and matching official Skills together. |
 | `viceme merchant accounts` | List ordinary MerchantAccounts where the current User is the OWNER member. |
 | `viceme merchant work ...` | Create, inspect, update, and publish Merchant Works, including Website Works. |
@@ -287,14 +288,18 @@ The page hosting Tip UI and the selected Work are separate resources. No
 engagement route requires Website ownership or DNS verification. A Tip-only
 integration does not register the host as a Website Work. Danmaku-only and
 combined routes still use a published Website Work whose canonical Origin
-exactly matches the deployment Origin.
+exactly matches the deployment Origin. The current release likewise does not
+require DNS TXT verification or a registered embedding Origin for Website
+follow/paid access.
 
 The combined route uses one published Website Work because danmaku requires
 that identity. Tip itself adds no domain or Commerce Application gate, and
 engagement does not create or mutate Website Widget applications. Website
-follow/paid access and its `WEBSITE_WIDGET`/`HOSTED_CHECKOUT` resources retain
-their ownership-verification rules and remain owned by publishing and the Shop
-platform.
+follow/paid access and its platform-managed `WEBSITE_WIDGET` resources are
+provisioned internally by the charging flow and Shop, with no Origin/DNS or
+checkout-parent gate.
+Separately configured domain-bound `HOSTED_CHECKOUT` applications and signed
+webhooks retain their ownership-verification rules.
 
 Without matching optional trusted-source attribution, ViceMe still records the
 actual browser source as an unverified Origin; it does not reject an open tip.

package/README.zh.md

@@ -82,7 +82,7 @@ viceme auth status
 viceme auth login
 
 # 定价前先上传真实私有草稿，并打开创作者预览。
-viceme skill publish --path ./my-skill
+viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0
 
 # 继续同一个未定价草稿并上传候选媒体。
 viceme skill publish --resume <publication-id>
@@ -155,10 +155,10 @@ npx --yes @viceme-ai/cli@latest install
 | `become-a-creator` | 为所有创作者玩法申请、认领或检查创作者资格。 |
 | `sell-a-skill` | 发布或更新可下载的付费或免费 Skill；网站、服务与普通商品不属于此 Skill。 |
 | `viceme-skill-use` | 解析免费、已购买或待购买的访问状态，安装所选 Skill，并继续原任务。 |
-| `charge-for-your-work` | 把已有网站关注或付费访问配置接入宿主代码，并复用统一的创作者资格检查。 |
+| `charge-for-your-work` | 为现有网站配置关注或付费解锁并接入宿主代码；复用统一创作者资格检查，平台资源保持为内部实现。 |
 | `let-people-interact` | 分支处理仅弹幕、开放赞赏或两者；包含弹幕的路线要求已发布且 canonical Origin 精确匹配的 Website Work，Tip 可使用任意合格且已发布的 Merchant Work，并选择 Mounted 或 Headless UI；三个分支均不要求 DNS 所有权验证。 |
+| `let-others-make-a-copy` | 发布包含根级 `VICEME-REPLICA.md` 的完整网站源码 ZIP，并把平台返回的“做同款”提示词接入创作者原站。 |
 
-`let-others-make-a-copy` 是“做同款”交付的保留公开名；对应产品流程实现前不提供官方 Skill。
 买家侧 `viceme-skill-use` 不属于创作者玩法，因此保持现有名称。
 
 Agent Skills 负责对话流程和授权规则；CLI 负责确定性本地操作与 API 调用。因此 Agent
@@ -235,7 +235,7 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 | `viceme skill listing prepare --path <path>` | 创建或恢复稳定的创作者私有预览，并保存本地绑定。 |
 | `viceme skill listing get <listing-id>` | 读取权威的私有 Listing 状态。 |
 | `viceme skill listing bind <listing-id> --path <path>` | 将来源明确绑定到用户选定且拥有的 Listing。 |
-| `viceme skill publish --path <path>` | 定价前上传真实私有包并返回创作者预览。 |
+| `viceme skill publish --path <path> --edition-key <key> --edition-order <order>` | 明确新增或更新的 Skill 条目，定价前上传真实私有包并返回创作者预览。 |
 | `viceme skill publish --resume <id>` | 继续同一个未定价 Draft 并上传媒体候选，不启动平台模型。 |
 | `viceme publication review <id>` | 读取权威双语文案、价格、选定素材和审核状态。 |
 | `viceme publication suggest <id> --input ...` | 以 Draft revision 保护提交 Agent 生成的双语文案与媒体选择。 |
@@ -246,6 +246,8 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 | `viceme publication update ...` | 用严格 JSON 文件替换完整 Listing Draft。 |
 | `viceme publication confirm ...` | 确认当前精确 Review Digest。 |
 | `viceme publication publish ...` | 公开已经确认的 Listing。 |
+| `viceme replica publish ...` | 校验含根级 `VICEME-REPLICA.md` 的完整源码 ZIP，发布不可变版本并返回稳定口令与自站提示词。 |
+| `viceme replica install <口令> --target <新目录>` | 创建并展示真实 Quote，不创建订单；买家明确确认后原样追加 `--confirm` 才购买并原子安装。 |
 | `viceme update` | 同时更新 CLI 与匹配版本的官方 Skills。 |
 | `viceme merchant accounts` | 列出当前 User 通过 OWNER 成员关系经营的普通 MerchantAccount。 |
 | `viceme merchant work ...` | 创建、查看、更新和发布 Merchant Work，包括 Website Work。 |
@@ -259,12 +261,14 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 
 承载赞赏 UI 的页面与被赞赏 Work 是两个独立资源。三个互动分支均不要求 Website
 ownership 或 DNS 验证。仅接入赞赏不会把宿主页登记为 Website Work；仅弹幕和组合
-仍使用 canonical Origin 与部署 Origin 精确匹配的已发布 Website Work。
+仍使用 canonical Origin 与部署 Origin 精确匹配的已发布 Website Work。当前版本的网站关注/付费
+解锁同样不要求 DNS TXT 或登记嵌入 Origin。
 
 组合路线只因弹幕要求而共用一个已发布 Website Work。Tip 本身不增加域名或
 Commerce Application 门禁，互动流程也不创建或修改 Website Widget。网站关注/付费
-访问及其 `WEBSITE_WIDGET`、`HOSTED_CHECKOUT` 资源仍保留所有权验证规则，并由发布
-流程和 Shop 平台负责。
+访问及其平台托管 `WEBSITE_WIDGET` 资源由收费接入流程和 Shop 在内部完成，但暂不执行 Origin/DNS
+或 checkout iframe 宿主门禁。另行配置的域名绑定 `HOSTED_CHECKOUT` 与签名 Webhook 仍保留所有权
+验证规则。
 
 没有匹配可选可信来源归因时，ViceMe 仍会把实际浏览器来源记录为未验证 Origin，
 不会因此拒绝开放赞赏。

package/checksums.txt

@@ -1,6 +1,6 @@
-e40c85961bcd3a45b0a332a57aa3c986e3e2561f279163dcb187d8d1d83842e1  viceme_0.23.1_darwin_amd64
-3f8ba9cc4640f0d581857c3984cde1538a800b72f7a064323b01c60fc4b0ace3  viceme_0.23.1_darwin_arm64
-aa87ce5f9d7204ad10841368ee84bd3b422cc02384dae5821dec1056949bc65c  viceme_0.23.1_linux_amd64
-9176def64983b41465f9a2ea2af7fa15e048f48e1808f6d7b450d98470c2421b  viceme_0.23.1_linux_arm64
-a59c228dafa1619af39b442da3eec82b8e79096521cafce6d3ec3e5d11721485  viceme_0.23.1_windows_amd64.exe
-b584adc4f0d9ef487a562771a709943dbbe6aa0043bffb5aa68b54cbd4c94378  viceme_0.23.1_windows_arm64.exe
+928799ccb0c883247819738927a47df01ab9163ba174236d2782212817cf7b0e  viceme_0.24.1_darwin_amd64
+e639e02de19b60854ac5a966faf5cfe9753341d25520ba0d98397afdb6cf6caa  viceme_0.24.1_darwin_arm64
+9d4f8c49de8efb4250b4967b8bda6f17b015c7ae97d7023b7b65615790864739  viceme_0.24.1_linux_amd64
+1b7bbb89719871cdc55ee53fb32823226c59199bd5e85250ffae64b57603c330  viceme_0.24.1_linux_arm64
+1aa042cd487399d3e4e37aac51c7fa9522af1ff9115515562ff07f0851a41a76  viceme_0.24.1_windows_amd64.exe
+45db5077bd2d308368cd7062810fe5b8f340a9a6ea1e883f6f047a84d1e84496  viceme_0.24.1_windows_arm64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.23.1",
+  "version": "0.24.1",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {