@xiashe/cli 0.1.28 → 0.1.30

package/README.md

@@ -28,6 +28,8 @@ xiashe payment bridge-info
 # After the Agent shows the Skill and purpose and the user explicitly agrees:
 xiashe payment pay --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>" --intent-summary "使用付费 Skill：<name>" --confirm
 xiashe payment status --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>"
+# Only for an Alipay support-assisted read-only query. This is not out_trade_no or Payment-Proof.
+xiashe payment status --resource-url "https://<payment-resource-site>/payment/alipay-ai-collect/skills/<skillCatalogId>?orderId=<id>" --business-no "<32-character outShakeNo>"
 ```
 
 Local state is stored in `~/.xiashe/config.json`.
@@ -50,7 +52,7 @@ Production defaults:
 
 - `xiashe payment bridge-info` checks only that the official buyer CLI can run. It does not check wallet authorization, merchant activation, or whether a transaction can be created. `payment doctor` remains a manual wallet-status diagnostic only.
 - `xiashe payment pay` requests the resource once, saves its exact 402 request in a private local file, and passes that file plus one stable session id to the official buyer CLI. It requires an HTTPS AI-Collect resource URL, a visible purchase-purpose summary, and `--confirm`.
-- `xiashe payment status` resumes the same local attempt with its official query credential and returns a normalized status only. No wallet protocol payload or proof is printed. A QR or confirmation image is exposed only as `officialMedia` when the official wallet emitted that image in the same invocation; the bridge never generates one itself.
+- `xiashe payment status` resumes the same local attempt with its official query credential and returns a normalized status only. If Alipay support provides the documented 32-character `outShakeNo` (sometimes called a business order number), use `--out-shake-no` or `--business-no` for one read-only status query; it is validated, never stored, and cannot create a payment or acknowledge fulfillment. No wallet protocol payload or proof is printed. A QR or confirmation image is exposed only as `officialMedia` when the official wallet emitted that image in the same invocation; the bridge never generates one itself.
 - `xiashe payment preflight` requests the seller resource once and validates the public field shape of its 402 bill without opening a wallet or creating a trade. It does not prove that Alipay accepts the seller signature, service binding, or merchant activation. `xiashe payment diagnose` is read-only. It reports the last stored safe diagnosis for that local attempt, including allow-listed official error/sub-codes, message, and request/trace identifiers when present, without contacting Alipay, replaying the resource, or exposing its local query credential.
 
 An Agent must never add `--confirm` before the user has explicitly agreed to the displayed purpose. If the wallet is unavailable, obtain permission before running the official `@alipay/agent-payment` setup, then run `payment doctor` again.

package/bin/xiashe.mjs

@@ -104,7 +104,7 @@ Usage:
   ${c} payment bridge-info|doctor
   ${c} payment preflight --resource-url <https-url>
   ${c} payment pay --resource-url <https-url> --intent-summary <text> --confirm [--wallet-timeout-ms <ms>]
-  ${c} payment status --resource-url <https-url>
+  ${c} payment status --resource-url <https-url> [--out-shake-no <32-char>|--business-no <32-char>]
   ${c} payment diagnose --resource-url <https-url>
   ${c} payment support-report --resource-url <https-url>
 
@@ -1218,7 +1218,15 @@ async function cmdPayment(sub, args, global) {
   }
   if (sub === 'status') {
     const resourceUrl = requireArg(flags['resource-url'] || flags.resourceUrl || flags.r, '--resource-url');
-    const result = await queryAlipay402Resource({ resourceUrl }, { timeoutMs: global.timeoutMs });
+    const outShakeNo = flags['out-shake-no'] || flags.outShakeNo;
+    const businessNo = flags['business-no'] || flags.businessNo;
+    if (outShakeNo && businessNo && String(outShakeNo) !== String(businessNo)) {
+      fail('Use one matching --out-shake-no or --business-no value.', EXIT_USAGE);
+    }
+    const result = await queryAlipay402Resource({
+      resourceUrl,
+      ...(outShakeNo || businessNo ? { outShakeNo: outShakeNo || businessNo } : {})
+    }, { timeoutMs: global.timeoutMs });
     print(result, global);
     return;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/cli",
-  "version": "0.1.28",
+  "version": "0.1.30",
   "type": "module",
   "bin": {
     "xiashe": "bin/xiashe.mjs"
@@ -10,7 +10,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@xiashe/sdk": "0.1.28"
+    "@xiashe/sdk": "0.1.30"
   },
   "engines": {
     "node": ">=20"