@viceme-ai/cli 0.45.6 → 0.46.0

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [0.46.0] - 2026-09-23
+
+### Features
+
+- 增加隔离的 dev CLI 构建交付与恢复工具 (`e544c11`)
+
+### Fixes
+
+- 将入口运行文件更新统一到 install (`50fce7f`)
+- 恢复尚未写完新增文件的入口更新 (`1dfbac1`)
+- 刷新网页入口运行包并恢复过期支付订单 (`f75105e`)
+- 把渠道包的购买和试用说明移出 SKILL.md (`ea130ca`)
+- 明确 WorkBuddy 支付页工具与通用 Markdown 链接 (`1c8e7b7`)
+- 使用独立 dev 域名根路径发布测试包 (`59c6a03`)
+- 修正 CN dev S3 分发域名 (`d92b52d`)
+- 导出渠道 Skill 时读取指定运行环境 (`f3b7b33`)
+- 将 dev Replica 产物的域名校验绑定测试环境 (`34026c0`)
+- 避免 dev 构建检查生成未跟踪缓存 (`910ad62`)
+- 补齐订阅与通用订单的公共支付入口 (`39deff8`)
+
+### Other Changes
+
+- 对齐 Python 支付展示契约断言 (`d2958ad`)
+- 统一发布后 main 到 dev 的回灌规则 (`7f2e1bb`)
+- 对齐生产门禁并仅发布国内 dev 存储 (`5f8360e`)
+- 更新单商品 Skill 说明 (`390ac2f`)
+- 删除 Skill 系列元数据并更新发布契约 (`882662e`)
+- 明确新版付款运行包配套切换要求 (`29ce19e`)
+- 移除 Skill 系列发布与严格已购安装参数 (`39ea16e`)
+- 统一公共支付展示并退役本地付款卡片 (`c01164e`)
+
 ## [0.45.6] - 2026-09-22
 
 ### Fixes

package/README.md

@@ -93,9 +93,9 @@ viceme auth login
 viceme merchant accounts
 
 # Upload the real private draft and open its Owner Preview before pricing.
-viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0
+viceme skill publish --path ./my-skill
 # With multiple active Merchant accounts, select the confirmed account:
-# viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0 --merchant <merchant-account-id>
+# viceme skill publish --path ./my-skill --merchant <merchant-account-id>
 
 # Continue the same unpriced draft and upload media candidates.
 viceme skill publish --resume <publication-id>
@@ -305,7 +305,7 @@ Never copy an access token into the conversation.
 | `viceme skill listing prepare --path <path>` | Create or recover the stable private owner preview and persist the local binding. |
 | `viceme skill listing get <listing-id>` | Read the authoritative private Listing state. |
 | `viceme skill listing bind <listing-id> --path <path>` | Explicitly bind a source to a selected owned Listing. |
-| `viceme skill publish --path <path> --edition-key <key> --edition-order <order> [--merchant <id>]` | Freeze the selected owned Merchant, upload the real private package, and return its Owner Preview before pricing. Edition selection is always explicit; --merchant is required only when multiple active Merchants exist. |
+| `viceme skill publish --path <path> [--merchant <id>]` | Freeze the selected owned Merchant, upload the real private package, and return its Owner Preview before pricing. --merchant is required only when multiple active Merchants exist. |
 | `viceme skill publish --resume <id>` | Continue the same unpriced Draft and upload media candidates without starting a platform model. |
 | `viceme publication review <id>` | Read the authoritative bilingual copy, price, selected media, and review state. |
 | `viceme publication suggest <id> --input ...` | Apply Agent-generated bilingual copy and media with Draft revision protection. |
@@ -335,7 +335,7 @@ Never copy an access token into the conversation.
 | `viceme merchant work website-verification ...` | Create, inspect, verify, or revoke DNS ownership for one Website Work. |
 | `viceme merchant work sdk-access ...` | Manage hosted `danmaku`/`tip` and follow/paid access on one Work. Hosted and access domains preserve each other; creation returns permanent public `keys.test` and `keys.live` identifiers, not credentials. |
 | `viceme merchant commerce-application ...` | Manage Commerce Applications. For open tips, a matching application is optional trusted-source attribution rather than an authorization gate. |
-| `viceme merchant product ...` | List, suspend, or archive Products (downloadable Skill editions and website access products). |
+| `viceme merchant product ...` | List, suspend, or archive Products (downloadable Skills and website access products). |
 | `viceme commerce ...` | Install and run a signed purchase Skill through session, quote, payment order, and same-session status commands. |
 
 Run `viceme <command> --help` for the full flags and JSON fields.

package/README.zh.md

@@ -82,7 +82,7 @@ viceme auth status
 viceme auth login
 
 # 定价前先上传真实私有草稿，并打开创作者预览。
-viceme skill publish --path ./my-skill --edition-key my-skill --edition-order 0
+viceme skill publish --path ./my-skill
 
 # 继续同一个未定价草稿并上传候选媒体。
 viceme skill publish --resume <publication-id>
@@ -261,7 +261,7 @@ Endpoint 必须使用 HTTPS；只有 localhost 和 loopback 本地开发可以
 | `viceme skill listing prepare --path <path>` | 创建或恢复稳定的创作者私有预览，并保存本地绑定。 |
 | `viceme skill listing get <listing-id>` | 读取权威的私有 Listing 状态。 |
 | `viceme skill listing bind <listing-id> --path <path>` | 将来源明确绑定到用户选定且拥有的 Listing。 |
-| `viceme skill publish --path <path> --edition-key <key> --edition-order <order>` | 明确新增或更新的 Skill 条目，定价前上传真实私有包并返回创作者预览。 |
+| `viceme skill publish --path <path>` | 新增 Skill 或更新原作品，定价前上传真实私有包并返回创作者预览。 |
 | `viceme skill publish --resume <id>` | 继续同一个未定价 Draft 并上传媒体候选，不启动平台模型。 |
 | `viceme publication review <id>` | 读取权威双语文案、价格、选定素材和审核状态。 |
 | `viceme publication suggest <id> --input ...` | 以 Draft revision 保护提交 Agent 生成的双语文案与媒体选择。 |

package/checksums.txt

@@ -1,6 +1,6 @@
-7f68ae9244e61ac6c454cc125fd86c2c94e39b33a427447d04fc63f301ee9764  viceme_0.45.6_darwin_amd64
-66480f8606265fb4795129a5ba777b08cc99a92f53df2ea9c10a4968e868a240  viceme_0.45.6_darwin_arm64
-c797656f9945294f3eb6a933c15f35c7e85fb7c3479337e44ab5bffbc2f43ae8  viceme_0.45.6_linux_amd64
-276cc8db6fdff331efc506d1098a02163fd08e402ae4a13c378467adcf18ba2e  viceme_0.45.6_linux_arm64
-5511bc02e0b182e9c7d70de65484ef5b6aa85fc4e114b178ad028e7ab426e159  viceme_0.45.6_windows_amd64.exe
-5ecdfb4aa0433d0eab9106ec70e4c85b79869a2cb3c9deb6c18e3b3dfa791885  viceme_0.45.6_windows_arm64.exe
+67a3b3a7da0b4fc10eb1bacca2dfb42d294bc383e96beba69a5e0c9b14662c05  viceme_0.46.0_darwin_amd64
+d781f8fb52739b02348960450e04b223232f800d340151ee78d07f49998d9163  viceme_0.46.0_darwin_arm64
+4f9932cd4c4df7835d181a8768a7eacb3c0c3fda5cfcfa32bf2a99272c42c92d  viceme_0.46.0_linux_amd64
+b9ce0c91084a7d753656f39435a74508b95edf02360a11508f7d852079a9c708  viceme_0.46.0_linux_arm64
+3c1b6ba1cb0a767f542f7b0df84a1ccf272f9f5880dfa5b9fa846d796855b8f5  viceme_0.46.0_windows_amd64.exe
+56935a6881deaab00b1a563c502e0c53ca0a5e94e6bdb3203998f1de361d25b2  viceme_0.46.0_windows_arm64.exe

package/docs/releasing.md

@@ -25,6 +25,7 @@
    六平台二进制、checksum、npm OIDC、CN/Global 安装清单及镜像发布流程。
 7. npm 与双区域发布成功后发送飞书总结。独立发布显示原 PR 作者的真实 @ 和
    “单独发布”，不归属给 approve/merge 操作者。映射见 `.github/feishu-users.json`。
+8. 按[发布后同步 main 到 dev](#发布后同步-main-到-dev)回灌本次发布历史。
 
 多个候选 PR 可以开发并行，但生产发布按顺序处理。准备前功能分支必须包含最新
 main；前一个发布合入后，下一个候选需同步 main、解决版本冲突、重新进入 dev 验收
@@ -36,8 +37,8 @@ main；前一个发布合入后，下一个候选需同步 main、解决版本
 把已验收的 dev 向 main 提 Ready PR，仍自动准备版本，并由 Release App 将生成提交
 写回 dev。原 Release PR 更新后运行完整检查，评审合并触发相同发布流水线。
 手动触发版本准备仅允许在 main 工作流上操作 dev。该模式不显示“单独发布”。
-生产发布后，通过 PR 将 main 同步回 dev；仅当两侧 tree 完全一致时才能只记录 ancestry，
-不得用丢弃改动的合并策略处理实际差异。
+生产发布后，按[发布后同步 main 到 dev](#发布后同步-main-到-dev)回灌完整发布历史，
+包括自动版本提交和 main 的发布合并节点；不得用丢弃改动的合并策略处理实际差异。
 
 ## dev 集成冲突
 
@@ -61,6 +62,74 @@ git merge 'origin/feat(cli)/example'
 不能只根据 PR 标题判断，也不要求批量 rebase。生产 hotfix 和不可变标签恢复保留
 既有边界；hotfix 不走普通自动准备，恢复不能创建新版本或冒充独立发布。
 
+## 发布后同步 main 到 dev
+
+本仓库统一采用 `hotfix → main → dev`：Hotfix 合入 main 并完成发布验证后，
+通过 `main → dev` PR 同步生产修复和完整发布历史。普通独立发布、整体发布后也按
+本节同步。只把 hotfix 来源分支合入 dev、或 cherry-pick 相同代码，不构成完整回灌；
+还须确认 main 的发布合并提交已进入 dev 历史。这是本仓库的约定，不是所有 Git
+分支模型的通用要求。
+
+### 无冲突时
+
+1. 拉取最新 main/dev，记录本次待同步的 main SHA 与 dev 基线。
+2. 检查完整差异与实际合并结果；main 可能包含多个已发布改动，不能仅按 hotfix
+   标题判断范围。提交 `main → dev` PR，记录来源 SHA、验证结果和关联发布 PR。
+3. Review 和必需检查通过后，使用 **Merge commit**，不得 squash/rebase。
+   没有文件变化的历史同步仍须保留父提交关系，不能因 diff 为空而省略。
+
+### 有冲突或 GitHub 的比较结果异常时
+
+先在本地针对准确的两个 SHA 计算合并结果。GitHub 显示冲突不等于一定需要修改
+业务代码；但也不能仅因本地无冲突就跳过合并结果与 CI 验证。
+
+从最新 main 创建专用回灌分支，合入 dev，在该分支解决冲突：
+
+```bash
+git fetch origin main dev
+sync_main_sha="$(git rev-parse origin/main)"
+sync_dev_sha="$(git rev-parse origin/dev)"
+git switch -c 'chore(repo)/integrate-main-into-dev-<unique-id>' "$sync_main_sha"
+git merge --no-ff --no-commit "$sync_dev_sha"
+# 若有冲突，逐段解决并 git add 明确的文件；保留生产修复与 dev 的未发布功能。
+git diff --name-only --diff-filter=U
+git diff --cached --check
+git diff --cached "$sync_dev_sha" --stat
+# 确认无未解决冲突、完成差异审查和适用验证，再创建合并提交。
+git commit -m 'chore(repo): 同步 main 发布历史到 dev'
+git push -u origin HEAD
+# 从该回灌分支向 dev 提 PR，使用 Merge commit。
+```
+
+分支名中的 `<unique-id>` 替换为本次发布标识。此分支只用于回灌 dev，禁止向 main
+提 PR 或作为功能发布来源；不得向原功能分支、hotfix 分支或 main 合入 dev。
+这与功能开发分支的独立发布规则不同。不要在来源为 main 的 PR 上点击解决冲突
+或 Update branch，把 dev 写回生产分支。不得使用 `git merge -s ours` 或整文件覆盖
+来隐藏真实冲突。若 main 已是 dev 的祖先，无须重复创建同步提交。
+
+比较时以 dev 为目标：main 与 dev 本身文件不同是正常的。只有**实际合并结果的
+Git tree 与 dev 基线一致**，才能说明这次同步没有文件变化；不能预设每次回灌
+都是零差异。有实际代码变化或冲突解决时，按受影响范围验证。
+
+新回灌 PR 建立后，关联并关闭被替代的直接 main → dev PR。目标分支若有推进，
+在专用回灌分支同步最新 dev 并重新验证，原 main 基线功能分支保持独立。
+
+### 合入后的完成条件
+
+```bash
+git fetch origin main dev
+git merge-base --is-ancestor "$sync_main_sha" origin/dev
+```
+
+`sync_main_sha` 使用本次 PR 记录的准确发布 SHA；成功只证明历史包含关系，
+不代表部署或业务验收通过。检查相关功能 PR 相对最新 dev 的文件列表，确认只含
+本次预期范围，再结束回灌并按发布规则清理来源分支。
+
+如果本地比较与 GitHub Compare 已正确，而原 PR 的 Files changed 仍显示旧内容，
+先核对来源/目标 SHA 和共同基点，等待刷新；必要时关闭再重新打开同一个未合并 PR，
+随后复核文件列表与检查状态。不要为刷新显示修改业务文件、重写历史，或将 dev
+合回功能分支。刷新显示不能替代真实的历史同步。
+
 ## One-time repository setup
 
 Register a private organization-owned GitHub App named `ViceMe CLI Release Bot`.
@@ -290,7 +359,7 @@ originate from merging an eligible repository-owned Release PR into `main`.
 
 ## Shared host payment presentation
 
-`skills/use-a-skill/references/host-presentation.md` owns host image syntax,
+`payments/host-presentation.md` owns host image syntax,
 page tools, capability checks and fallbacks. The CLI embeds this source directly;
 the no-CLI runtime includes the identical bytes as `guides/host-presentation.md`.
 Exported purchase entries also include it beside `references/purchase.md` so
@@ -300,11 +369,10 @@ Do not add host policy branches to Go/Python or duplicate them in Widget docs.
 After an edit, run `make release-manifest`, `make check` and
 `make npm-package-check`; the digest-addressed runtime and official Skill bundle
 must ship together. Shop's runtime archive validator must accept
-`guides/host-presentation.md` before publishing this generation. Its optional
-allowlist entry preserves compatibility with the previous seven-member runtime.
-Rollback may use the previous runtime while that Shop validator remains deployed.
-A validator rollback must follow a runtime rollback, since the old validator
-rejects the additional member. No database or payment-state migration is needed.
+`guides/host-presentation.md` and make the retired `widgets/payment.html`
+optional before publishing this generation. This accepts both old immutable
+runtime bundles and the new PNG-only payment runtime. Roll back the runtime
+before rolling back the validator. No database or payment-state migration is needed.
 Existing exported packages and installed Skills retain their bundled guidance;
 re-export/reinstall through their normal explicit update path to obtain changes.
 Do not mutate existing purchase credentials or orders to refresh instructions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@viceme-ai/cli",
-  "version": "0.45.6",
+  "version": "0.46.0",
   "description": "Install the ViceMe creator CLI and official Agent Skills",
   "type": "module",
   "bin": {