@xiashe/sdk 0.1.26 → 0.1.28

package/alipayWallet.mjs

@@ -321,9 +321,18 @@ function walletStateFromOutput(stdout, stderr) {
 }
 
 function queryCredentialFromOutput(output) {
-  const tradeNo = output.match(/(?:"tradeNo"|trade\s*no|交易(?:流水)?号)\s*[":：=]\s*["']?([A-Za-z0-9_-]{8,128})/i)?.[1] || null;
-  const outShakeNo = output.match(/(?:"outShakeNo"|out[_ -]?shake[_ -]?no|外部(?:摇一摇)?编号)\s*[":：=]\s*["']?([A-Za-z0-9_-]{8,128})/i)?.[1] || null;
-  return tradeNo ? { type: 'trade_no', value: tradeNo } : outShakeNo ? { type: 'out_shake_no', value: outShakeNo } : null;
+  // The official wallet has used both camelCase and snake_case JSON fields.
+  // Match either spelling without forwarding the raw wallet output.
+  const tradeNo = output.match(/(?:["']?trade[\s_-]*no["']?|交易(?:流水)?号)\s*[":：=]\s*["']?([A-Za-z0-9._-]{8,128})/i)?.[1] || null;
+  const outShakeNo = output.match(/(?:["']?out[\s_-]*shake[\s_-]*no["']?|外部(?:摇一摇)?编号)\s*[":：=]\s*["']?([A-Za-z0-9_-]{8,128})/i)?.[1] || null;
+  // An outShakeNo is the preferred 402 status-query credential, but only its
+  // documented 32-character AI Pay form may select that query path.
+  const validOutShakeNo = outShakeNo && outShakeNo.length === 32 && outShakeNo.slice(10, 14) === '8282';
+  return validOutShakeNo
+    ? { type: 'out_shake_no', value: outShakeNo }
+    : tradeNo
+      ? { type: 'trade_no', value: tradeNo }
+      : null;
 }
 
 function paymentStatusFromOutput(stdout, stderr) {
@@ -476,6 +485,14 @@ function paymentFailureDiagnosis(failureCode, stdout, stderr) {
       ...(officialCode ? { officialCode } : {})
     };
   }
+  if (failureCode === 'wallet_query_credential_missing') {
+    return {
+      ...base,
+      stage: 'official_wallet_query_credential',
+      nextStep: '支付宝钱包没有返回可继续查询的交易凭据。不要继续付款或重复付款；如支付宝已显示扣款，请由商户按交易号对账并提交问题反馈。',
+      ...(officialCode ? { officialCode } : {})
+    };
+  }
   return {
     ...base,
     ...(officialCode ? { officialCode } : {})
@@ -484,7 +501,9 @@ function paymentFailureDiagnosis(failureCode, stdout, stderr) {
 
 function paymentFailureUserVisible(diagnosis) {
   const lines = [
-    '支付宝付款未创建可确认交易。',
+    diagnosis.code === 'wallet_query_credential_missing'
+      ? '支付宝钱包未返回可继续查询的交易凭据，当前付款状态无法确认。'
+      : '支付宝付款未创建可确认交易。',
     `诊断代码：${diagnosis.code}`,
     `失败阶段：${diagnosis.stage}`,
     ...(diagnosis.officialCode ? [`官方返回代码：${diagnosis.officialCode}`] : []),
@@ -506,6 +525,9 @@ function paymentMessage(status) {
 }
 
 function paymentFailureMessage(failureCode) {
+  if (failureCode === 'wallet_query_credential_missing') {
+    return '支付宝钱包返回待确认，但未返回可继续查询的交易凭据。无法确认是否已付款，因此不会授予付费 Skill 权益；请勿再次付款。';
+  }
   if (failureCode === 'wallet_trade_progress_failed') {
     return '支付宝钱包未能创建可确认的交易；未授予付费 Skill 权益。官方钱包没有给出可归因的原因，不能据此判断为 Agent 不受支持、账单签名错误或已扣款；请勿重复付款。';
   }
@@ -762,22 +784,31 @@ export async function payAlipay402Resource(input, options = {}) {
   ], options);
   const result = paymentStatusFromOutput(walletInvocation.stdout, walletInvocation.stderr);
   const commandFailed = walletInvocation.exitCode !== 0 && result.status === 'unknown';
-  const status = commandFailed ? 'wallet_command_failed' : result.status;
+  const missingQueryCredential = result.status === 'pending_confirmation' && !result.credential;
+  const status = commandFailed
+    ? 'wallet_command_failed'
+    : missingQueryCredential
+      ? 'failed'
+      : result.status;
   const failed = commandFailed || status === 'failed';
+  const failureCode = missingQueryCredential
+    ? 'wallet_query_credential_missing'
+    : failed
+      ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode)
+      : undefined;
   const officialMedia = ['pending_confirmation', 'completed'].includes(status)
     ? await officialWalletMedia(walletInvocation.stdout, walletInvocation.stderr)
     : null;
   state.status = status;
   state.queryCredential = result.credential;
-  state.lastFailureCode = failed ? walletFailureCode(walletInvocation.stdout, walletInvocation.stderr, walletInvocation.exitCode) : null;
+  state.lastFailureCode = failureCode ?? null;
   state.lastDiagnosis = failed
-    ? paymentFailureDiagnosis(state.lastFailureCode, walletInvocation.stdout, walletInvocation.stderr)
+    ? paymentFailureDiagnosis(failureCode, walletInvocation.stdout, walletInvocation.stderr)
     : null;
   state.lastWalletDiagnostic = result.diagnostic;
   state.updatedAt = new Date().toISOString();
   await writePaymentState(state, options);
   if (status === 'completed') await rm(paths.paymentNeededPath, { force: true });
-  const failureCode = failed ? state.lastFailureCode : undefined;
   return publicPaymentResult(state, status, result.diagnostic, {
     commandFailed: failed,
     failureCode,
@@ -883,7 +914,16 @@ export async function diagnoseAlipay402Resource(input, options = {}) {
   // optional command after a failed payment.
   if (state.lastFailureCode === 'wallet_trade_progress_failed') {
     const support = await createAlipay402SupportReport({ resourceUrl }, options);
-    if (support.ok && support.report) result.supportReport = support.report;
+    if (support.ok && support.report) {
+      result.supportReport = support.report;
+      // Some Agents intentionally present only `userVisible` from a bridge
+      // result. Put the already-redacted support text there as well so the
+      // only useful evidence from this generic upstream error is not silently
+      // dropped by a client-side response mapper.
+      result.userVisible = [result.userVisible, '', '支付宝支持诊断：', support.report.text]
+        .filter((line) => typeof line === 'string' && line.length > 0)
+        .join('\n');
+    }
   }
   return result;
 }

package/index.mjs

@@ -6,7 +6,7 @@ import path from 'node:path';
 import { ConvexHttpClient } from 'convex/browser';
 import { anyApi as api } from 'convex/server';
 
-export const VERSION = '0.1.26';
+export const VERSION = '0.1.27';
 
 export const DEFAULTS = {
   cn: {
@@ -22,6 +22,7 @@ export const DEFAULTS = {
     market: 'intl',
     locale: 'en',
     convexUrl: 'https://adept-porcupine-970.convex.cloud',
+    // agentpie.app is the production Worker gateway for public and Agent APIs.
     actionsUrl: 'https://agentpie.app',
     mcpUrl: 'https://agentpie.app/mcp/xiashe',
     agentClaimUrl: 'https://agentpie.app/agent-gateway/claim',
@@ -409,8 +410,8 @@ export class XiasheClient {
     return this.mutation(api.auth.signInWithPassword, { email, password });
   }
 
-  async registerWithPassword(email, password, displayName = '') {
-    return this.mutation(api.auth.registerWithPassword, { email, password, displayName });
+  async registerWithPassword(email, password, displayName = '', verificationCode = '') {
+    return this.mutation(api.auth.registerWithPassword, { email, password, displayName, verificationCode });
   }
 
   async requestEmailCode(email, mode = 'login') {
@@ -421,6 +422,19 @@ export class XiasheClient {
     return this.mutation(api.auth.verifyEmailCode, { email, code, mode, displayName });
   }
 
+  /**
+   * Creates the same short-lived, creator-scoped connection code that the
+   * dashboard's “Add Skill” flow uses. This intentionally requires an
+   * authenticated local AgentPie session; it is not a publish bypass.
+   */
+  async issueCreatorSkillClaimCode({ label = '' } = {}) {
+    const normalizedLabel = String(label || '').trim().slice(0, 320);
+    return this.mutation(
+      api.creatorSkillRegistry.issueClaimCode,
+      this.authArgs(normalizedLabel ? { label: normalizedLabel } : {})
+    );
+  }
+
   async whoami() {
     return this.query(api.users.getById, this.authArgs({ userId: this.profile.session.userId }));
   }
@@ -734,8 +748,8 @@ export class XiasheClient {
   }
 
   async verifyCreatorAlipayAppConfig(creatorAlipayAppId, options = {}) {
-    return this.mutation(
-      api.marketplaceBilling.verifyCreatorAlipayAppConfig,
+    return this.action(
+      api.marketplaceBilling.verifyCreatorAlipayAppConfigAsync,
       this.authArgs({
         creatorAlipayAppId,
         uploadedToAlipay: options.uploadedToAlipay !== false
@@ -843,7 +857,7 @@ export class XiasheClient {
   }
 
   alipayAiCollectPaymentResourceUrl(orderIdOrUrl, options = {}) {
-    const value = String(orderIdOrUrl || options.orderId || options.paymentResourceUrl || '').trim();
+    const value = String(orderIdOrUrl || options.paymentResourceUrl || '').trim();
     if (!value) {
       throw new XiasheError('Missing Alipay AI Collect order id or payment resource URL.', {
         code: 'ALIPAY_AI_COLLECT_RESOURCE_REQUIRED'
@@ -852,13 +866,12 @@ export class XiasheClient {
     if (/^https?:\/\//i.test(value)) {
       return value;
     }
-    const actionsUrl = normalizeBaseUrl(options.actionsUrl || this.profile.actionsUrl);
-    if (!actionsUrl) {
-      throw new XiasheError('Missing actions URL for Alipay AI Collect payment resource.', {
-        code: 'ACTIONS_URL_REQUIRED'
-      });
-    }
-    return `${actionsUrl}/payment/alipay-ai-collect?orderId=${encodeURIComponent(value)}`;
+    // Resource URLs are registered and signed per Skill. An order id alone
+    // cannot safely reconstruct one: doing so would silently return to the
+    // retired merchant-wide /payment/alipay-ai-collect route.
+    throw new XiasheError('Use the paymentResourceUrl returned by checkout; an order id alone is not a payment resource URL.', {
+      code: 'ALIPAY_AI_COLLECT_RESOURCE_URL_REQUIRED'
+    });
   }
 
   async getAlipayAiCollectPaymentNeeded(orderIdOrUrl, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xiashe/sdk",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "type": "module",
   "main": "index.mjs",
   "exports": {