@xiashe/sdk 0.1.23 → 0.1.25

package/alipayWallet.mjs

@@ -41,6 +41,8 @@ const SAFE_OFFICIAL_FAILURE_CODES = new Set([
   'SELLER_ID_EMPTY',
   'TRADE_STATUS_INVALID'
 ]);
+const SAFE_OFFICIAL_FIELD_VALUE = /^[A-Za-z][A-Za-z0-9_.:-]{2,127}$/;
+const SAFE_OFFICIAL_ERROR_MESSAGE = /^(?!.*(?:https?:\/\/|payment[-_ ]?needed|payment[-_ ]?proof|seller_signature|authorization\s*:|runtimeToken|client[_ -]?session|(?:access|refresh)[_-]?token|credential|\b[A-Za-z0-9_-]{80,}\b)).{1,240}$/i;
 
 const OFFICIAL_ERROR_DIAGNOSES = {
   PAYMENT_NEEDED_REJECTED: {
@@ -142,6 +144,52 @@ function safeDiagnostic(value) {
   return SENSITIVE_OUTPUT.test(text) ? 'protocol_payload_processed' : 'official_wallet_response_received';
 }
 
+function explicitJsonString(output, fields) {
+  for (const field of fields) {
+    const match = output.match(new RegExp(`"${field}"\\s*:\\s*("(?:\\\\.|[^"\\\\])*")`, 'i'));
+    if (!match) continue;
+    try {
+      const value = JSON.parse(match[1]);
+      if (typeof value === 'string') return value;
+    } catch {
+      // Do not fall back to arbitrary vendor text: it can carry protocol data.
+    }
+  }
+  return null;
+}
+
+/**
+ * The official client may include Payment-Needed, Payment-Proof, credentials,
+ * or mutable diagnostic text. Persist only explicit, bounded support fields.
+ */
+function safeOfficialDiagnostic(stdout, stderr) {
+  const output = `${stdout}\n${stderr}`;
+  const pick = (fields) => {
+    const value = explicitJsonString(output, fields);
+    return value && SAFE_OFFICIAL_FIELD_VALUE.test(value) ? value : null;
+  };
+  const code = pick(['errorCode', 'error_code', 'previous_error', 'code']);
+  const message = explicitJsonString(output, ['errorMsg', 'subMsg', 'error_message', 'message']);
+  return {
+    code,
+    subCode: pick(['subCode', 'sub_code']),
+    requestId: pick(['requestId', 'request_id']),
+    traceId: pick(['traceId', 'trace_id']),
+    // For known downstream codes, our normalized recovery text is safer and
+    // more useful than arbitrary vendor prose. TRADE_PROGRESS_FAILED is the
+    // one generic wallet-creation code where the official short message adds
+    // context without exposing protocol material.
+    ...(code?.toUpperCase() === 'TRADE_PROGRESS_FAILED' && message && SAFE_OFFICIAL_ERROR_MESSAGE.test(message.trim())
+      ? { message: safeText(message, 240) }
+      : {})
+  };
+}
+
+function safeRuntimeVersion(stdout, stderr) {
+  const match = `${stdout}\n${stderr}`.match(/\balipay-bot(?:-cli)?\s+v?(\d+\.\d+\.\d+(?:[-+][A-Za-z0-9.-]+)?)/i);
+  return match?.[1] || null;
+}
+
 function normalizeResourceUrl(value) {
   let url;
   try {
@@ -340,10 +388,10 @@ function walletFailureCode(stdout, stderr, exitCode) {
  * credentials, URLs, trade identifiers, or PayGuard internals.
  */
 function safeOfficialFailureCode(stdout, stderr) {
-  const output = `${stdout}\n${stderr}`;
-  const candidates = [
-    ...output.matchAll(/(?:"(?:errorCode|code|sub_code|previous_error)"|\b(?:errorCode|code|sub_code|previous_error)\b)\s*[:=]\s*["']?([A-Z][A-Z0-9_]{2,80})/ig)
-  ].map((match) => match[1].toUpperCase());
+  const official = safeOfficialDiagnostic(stdout, stderr);
+  const candidates = [official.code, official.subCode]
+    .filter(Boolean)
+    .map((candidate) => candidate.toUpperCase());
   return candidates.find((candidate) => SAFE_OFFICIAL_FAILURE_CODES.has(candidate)) || null;
 }
 
@@ -358,12 +406,17 @@ function safeMerchantDiagnosticCode(stdout, stderr) {
 }
 
 function paymentFailureDiagnosis(failureCode, stdout, stderr) {
+  const official = safeOfficialDiagnostic(stdout, stderr);
   const officialCode = safeOfficialFailureCode(stdout, stderr);
   const merchantDiagnostic = safeMerchantDiagnosticCode(stdout, stderr);
   const base = {
     code: failureCode,
     stage: 'official_wallet_trade_creation',
-    nextStep: '不要重复付款；保留诊断代码和本次 attemptId 以便定位。'
+    nextStep: '不要重复付款；保留诊断代码和本次 attemptId 以便定位。',
+    ...(official.subCode ? { officialSubCode: official.subCode } : {}),
+    ...(official.requestId ? { officialRequestId: official.requestId } : {}),
+    ...(official.traceId ? { officialTraceId: official.traceId } : {}),
+    ...(official.message ? { officialMessage: official.message } : {})
   };
   if (officialCode && OFFICIAL_ERROR_DIAGNOSES[officialCode]) {
     return {
@@ -435,6 +488,10 @@ function paymentFailureUserVisible(diagnosis) {
     `诊断代码：${diagnosis.code}`,
     `失败阶段：${diagnosis.stage}`,
     ...(diagnosis.officialCode ? [`官方返回代码：${diagnosis.officialCode}`] : []),
+    ...(diagnosis.officialSubCode ? [`官方子码：${diagnosis.officialSubCode}`] : []),
+    ...(diagnosis.officialMessage ? [`官方消息：${diagnosis.officialMessage}`] : []),
+    ...(diagnosis.officialRequestId ? [`官方请求标识：${diagnosis.officialRequestId}`] : []),
+    ...(diagnosis.officialTraceId ? [`官方追踪标识：${diagnosis.officialTraceId}`] : []),
     ...(diagnosis.merchantDiagnostic ? [`商家验证诊断：${diagnosis.merchantDiagnostic}`] : []),
     `下一步：${diagnosis.nextStep}`
   ];
@@ -576,8 +633,14 @@ export async function preflightAlipay402Resource(input, options = {}) {
     walletInvoked: false,
     resourceStatus: resource.responseStatus,
     message: validation.ok
-      ? '虾舍已为该资源签发结构有效的支付宝 402 账单；尚未调用钱包或创建交易。'
+      ? '虾舍已为该资源签发字段结构有效的支付宝 402 账单；尚未调用钱包或创建交易，且未验证支付宝端服务状态、已登记公钥或账单签名。'
       : '虾舍资源返回了 402，但账单结构不符合支付宝 AI收要求；未调用钱包。',
+    validationScope: {
+      billFields: true,
+      sellerSignatureVerifiedByAlipay: false,
+      merchantServiceVerifiedByAlipay: false,
+      transactionCreationVerified: false
+    },
     checks: validation.checks
   };
 }
@@ -622,11 +685,15 @@ export async function checkAlipayWallet(options = {}) {
 /** Checks that the official buyer CLI is present, without querying wallet state. */
 export async function getAlipayWalletBridgeInfo(options = {}) {
   const { stdout, stderr } = await runOfficialCli(['--version'], options);
+  const runtimeVersion = safeRuntimeVersion(stdout, stderr);
   return {
     ok: true,
-    state: 'available',
+    state: 'runtime_available',
     provider: 'alipay-agent-payment',
-    message: '支付宝官方付款桥已可用；付款时将由支付宝 App 请求确认。',
+    message: '已找到支付宝官方钱包程序；这只表示程序可执行，尚未检查钱包授权或交易资格。',
+    walletStateChecked: false,
+    transactionCreationVerified: false,
+    ...(runtimeVersion ? { runtimeVersion } : {}),
     diagnostic: safeDiagnostic(stdout || stderr)
   };
 }
@@ -811,3 +878,62 @@ export async function diagnoseAlipay402Resource(input, options = {}) {
     updatedAt: state.updatedAt || null
   };
 }
+
+/**
+ * Creates a deliberately redacted support summary for an already-failed
+ * official-wallet attempt. This never invokes the wallet, re-fetches the
+ * resource, or reads/prints the Payment-Needed payload. It is intended for
+ * the official `alipay-bot problem-feedback` flow, where a generic wallet
+ * trade-creation error otherwise leaves an operator with no safe facts to
+ * report.
+ */
+export async function createAlipay402SupportReport(input, options = {}) {
+  const resourceUrl = normalizeResourceUrl(input?.resourceUrl);
+  const state = await readPaymentState(resourceUrl, options);
+  if (!state) {
+    return {
+      ok: false,
+      status: 'no_local_attempt',
+      provider: 'alipay-agent-payment',
+      walletInvoked: false,
+      message: '没有找到本地付款尝试，无法生成问题反馈材料。'
+    };
+  }
+
+  const failureCode = state.lastFailureCode || null;
+  const diagnosis = state.lastDiagnosis || null;
+  const failedBeforeConfirmation = !state.queryCredential?.value &&
+    ['failed', 'wallet_command_failed'].includes(state.status);
+  const { stdout, stderr } = await runOfficialCli(['--version'], options);
+  const runtimeVersion = safeRuntimeVersion(stdout, stderr) || null;
+  const lines = [
+    '[环节]：402 支付 / 官方钱包创建交易',
+    `[结果]：${failedBeforeConfirmation ? '未创建可确认交易，未获得 Payment-Proof' : '请以本地诊断状态为准'}`,
+    `[桥接诊断]：${diagnosis?.code || failureCode || 'unknown'}`,
+    `[官方代码]：${diagnosis?.officialCode || '未返回'}`,
+    `[官方运行时]：${runtimeVersion || '未知'}`,
+    `[发生时间]：${state.updatedAt || state.createdAt || '未知'}`,
+    '[已确认]：卖方资源返回字段结构有效的 402 账单；本次未生成可查询交易凭证。',
+    '[请协助]：返回本次 TRADE_PROGRESS_FAILED 的子码、requestId/traceId，以及交易创建被拒绝的具体校验项。'
+  ];
+  return {
+    ok: true,
+    status: 'support_report_ready',
+    provider: 'alipay-agent-payment',
+    walletInvoked: false,
+    report: {
+      category: 'ALIPAY_402_TRADE_CREATION_FAILED',
+      attemptId: `alipay-402:${state.resourceDigest.slice(0, 16)}`,
+      occurredAt: state.updatedAt || state.createdAt || null,
+      officialRuntimeVersion: runtimeVersion,
+      failureCode,
+      ...(diagnosis?.officialCode ? { officialCode: diagnosis.officialCode } : {}),
+      ...(diagnosis?.officialSubCode ? { officialSubCode: diagnosis.officialSubCode } : {}),
+      billShapeValidated: state.merchantResource?.billShapeValidated === true,
+      paymentNeededReceived: state.merchantResource?.paymentNeededReceived === true,
+      queryCredentialCreated: Boolean(state.queryCredential?.value),
+      text: lines.join('\n')
+    },
+    message: '已生成脱敏的问题反馈材料；其中不包含订单号、资源 URL、账单、Payment-Proof 或钱包凭证。'
+  };
+}

package/index.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { ConvexHttpClient } from 'convex/browser';
 import { anyApi as api } from 'convex/server';
 
-export const VERSION = '0.1.23';
+export const VERSION = '0.1.25';
 
 export const DEFAULTS = {
   cn: {
@@ -1365,5 +1365,6 @@ export {
   preflightAlipay402Resource,
   payAlipay402Resource,
   queryAlipay402Resource,
-  diagnoseAlipay402Resource
+  diagnoseAlipay402Resource,
+  createAlipay402SupportReport
 } from './alipayWallet.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/sdk",
-  "version": "0.1.23",
+  "version": "0.1.25",
   "type": "module",
   "main": "index.mjs",
   "exports": {