moltspay 1.6.0 → 2.0.0

package/dist/client/index.mjs

@@ -1,7 +1,7 @@
 // src/client/node/index.ts
 import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, statSync, chmodSync } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 import { Wallet as Wallet2, ethers as ethers2 } from "ethers";
 
 // src/chains/index.ts
@@ -328,6 +328,16 @@ function networkToChainName(network) {
 // src/client/core/base64.ts
 var BufferCtor = globalThis.Buffer;
 
+// src/client/core/errors.ts
+var MoltsPayError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MoltsPayError";
+    this.code = code;
+  }
+};
+
 // src/client/core/eip3009.ts
 var EIP3009_TYPES = {
   TransferWithAuthorization: [
@@ -464,6 +474,733 @@ function findChainByChainId(chainId) {
   return void 0;
 }
 
+// src/client/alipay/index.ts
+import { randomUUID } from "crypto";
+import { mkdir, writeFile } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
+
+// src/client/alipay/cli.ts
+import { spawn } from "child_process";
+
+// src/client/alipay/log.ts
+var RANK = { off: 0, info: 1, debug: 2 };
+function normalizeLevel(v) {
+  const s = (v ?? "").toLowerCase();
+  return s === "info" || s === "debug" ? s : "off";
+}
+var level = normalizeLevel(process.env.MOLTSPAY_ALIPAY_LOG);
+var sink = (line) => {
+  process.stderr.write(line + "\n");
+};
+function enabledFor(want) {
+  return RANK[level] >= RANK[want];
+}
+function render(event, fields) {
+  const parts = ["[moltspay:alipay]", String(fields.ts), event];
+  if (fields.flow) parts.push(`flow=${fields.flow}`);
+  if (fields.step) parts.push(`step=${fields.step}`);
+  if (typeof fields.ms === "number") parts.push(`${fields.ms}ms`);
+  for (const [k, v] of Object.entries(fields)) {
+    if (["ts", "level", "event", "flow", "step", "ms"].includes(k)) continue;
+    parts.push(`${k}=${typeof v === "string" ? v : JSON.stringify(v)}`);
+  }
+  return parts.join(" ");
+}
+function emit(lvl, event, fields) {
+  if (!enabledFor(lvl)) return;
+  const full = { ts: (/* @__PURE__ */ new Date()).toISOString(), level: lvl, event, ...fields };
+  try {
+    sink(render(event, full), full);
+  } catch {
+  }
+}
+var alipayLog = {
+  info: (event, fields = {}) => emit("info", event, fields),
+  debug: (event, fields = {}) => emit("debug", event, fields),
+  /** True if anything at all would be logged (cheap guard for hot paths). */
+  enabled: () => level !== "off"
+};
+async function timeStep(step, flow, fn) {
+  if (!alipayLog.enabled()) return fn();
+  const t0 = Date.now();
+  alipayLog.debug("step.start", { flow, step });
+  try {
+    const out = await fn();
+    alipayLog.info("step.end", { flow, step, ms: Date.now() - t0, ok: true });
+    return out;
+  } catch (err) {
+    alipayLog.info("step.end", {
+      flow,
+      step,
+      ms: Date.now() - t0,
+      ok: false,
+      err: err instanceof Error ? err.message : String(err)
+    });
+    throw err;
+  }
+}
+
+// src/client/alipay/cli.ts
+var ALLOWED_ENV = /* @__PURE__ */ new Set([
+  "AIPAY_OUTPUT_CHANNEL",
+  "AIPAY_SESSION_ID",
+  "AIPAY_FRAMEWORK",
+  "AIPAY_MODEL",
+  "AIPAY_OS",
+  // Minimal survival set for spawn to find the binary and a home dir.
+  "PATH",
+  "HOME"
+]);
+function filterEnv(env) {
+  return Object.fromEntries(
+    Object.entries(env).filter(([k]) => ALLOWED_ENV.has(k))
+  );
+}
+function makeLineSplitter(onLine) {
+  let buf = "";
+  return (chunk) => {
+    buf += chunk.toString("utf-8");
+    let nl;
+    while ((nl = buf.indexOf("\n")) !== -1) {
+      onLine(buf.slice(0, nl));
+      buf = buf.slice(nl + 1);
+    }
+  };
+}
+function profileEnv(step, flow) {
+  const want = process.env.MOLTSPAY_ALIPAY_CLI_PROFILE;
+  const hook = process.env.MOLTSPAY_ALIPAY_CLI_PROFILE_HOOK;
+  if (!want || !hook) return {};
+  const steps = want.split(",").map((s) => s.trim());
+  if (!steps.includes("all") && !steps.includes(step)) return {};
+  const dir = process.env.MOLTSPAY_ALIPAY_CLI_PROFILE_DIR || "/tmp";
+  const safe = `${flow ?? "noflow"}-${step}-${Date.now()}`.replace(/[^a-zA-Z0-9._-]/g, "_");
+  const out = `${dir}/cli-profile-${safe}.json`;
+  alipayLog.info("cli.profile", { flow, step, out });
+  return {
+    NODE_OPTIONS: `--require=${hook}`,
+    MOLTSPAY_CLI_PROFILE_OUT: out
+  };
+}
+var runCli = (args, opts = {}) => {
+  const bin = opts.bin ?? "alipay-bot";
+  const step = opts.step ?? args[0] ?? "(no-arg)";
+  const startedAt = Date.now();
+  const lines = [];
+  const collect = (line) => {
+    lines.push(line);
+    alipayLog.debug("cli.line", {
+      flow: opts.flow,
+      step,
+      ms: Date.now() - startedAt,
+      preview: line.slice(0, 120)
+    });
+    opts.onLine?.(line);
+  };
+  alipayLog.debug("step.start", { flow: opts.flow, step });
+  return new Promise((resolve, reject) => {
+    const child = spawn(bin, args, {
+      env: { ...filterEnv(process.env), ...profileEnv(step, opts.flow), ...opts.env ?? {} }
+    });
+    if (opts.signal) {
+      if (opts.signal.aborted) child.kill("SIGTERM");
+      opts.signal.addEventListener("abort", () => child.kill("SIGTERM"), { once: true });
+    }
+    let sawByte = false;
+    const onChunk = (stream) => (chunk) => {
+      const ms = Date.now() - startedAt;
+      if (!sawByte) {
+        sawByte = true;
+        alipayLog.debug("cli.firstbyte", { flow: opts.flow, step, ms });
+      }
+      alipayLog.debug("cli.chunk", { flow: opts.flow, step, ms, stream, bytes: chunk.length });
+    };
+    const onStdout = makeLineSplitter(collect);
+    const onStderr = makeLineSplitter(collect);
+    child.stdout?.on("data", onChunk("out"));
+    child.stderr?.on("data", onChunk("err"));
+    child.stdout?.on("data", onStdout);
+    child.stderr?.on("data", onStderr);
+    child.on("error", (err) => {
+      alipayLog.info("cli.exit", {
+        flow: opts.flow,
+        step,
+        ms: Date.now() - startedAt,
+        ok: false,
+        err: err.message
+      });
+      reject(err);
+    });
+    child.on("close", (code) => {
+      alipayLog.info("cli.exit", {
+        flow: opts.flow,
+        step,
+        ms: Date.now() - startedAt,
+        ok: (code ?? 1) === 0,
+        code: code ?? 1
+      });
+      resolve({ exitCode: code ?? 1, lines });
+    });
+  });
+};
+
+// src/client/alipay/install.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+
+// src/client/alipay/errors.ts
+var AlipayCliNotFoundError = class extends MoltsPayError {
+  constructor(message) {
+    super("ALIPAY_CLI_NOT_FOUND", message);
+    this.name = "AlipayCliNotFoundError";
+  }
+};
+var AlipayCliVersionError = class extends MoltsPayError {
+  constructor(message) {
+    super("ALIPAY_CLI_VERSION", message);
+    this.name = "AlipayCliVersionError";
+  }
+};
+var NeedsWalletSetupError = class extends MoltsPayError {
+  constructor(message = "Alipay wallet not set up. Run: moltspay alipay apply") {
+    super("ALIPAY_NEEDS_WALLET_SETUP", message);
+    this.name = "NeedsWalletSetupError";
+  }
+};
+var AlipayPaymentRejectedError = class extends MoltsPayError {
+  constructor(message) {
+    super("ALIPAY_PAYMENT_REJECTED", message);
+    this.name = "AlipayPaymentRejectedError";
+  }
+};
+var AlipayPaymentTimeoutError = class extends MoltsPayError {
+  constructor(message) {
+    super("ALIPAY_PAYMENT_TIMEOUT", message);
+    this.name = "AlipayPaymentTimeoutError";
+  }
+};
+var AlipayProtocolError = class extends MoltsPayError {
+  constructor(message) {
+    super("ALIPAY_PROTOCOL", message);
+    this.name = "AlipayProtocolError";
+  }
+};
+var UnsupportedRailError = class extends MoltsPayError {
+  constructor(rail, message) {
+    super("UNSUPPORTED_RAIL", message ?? `Rail not supported by server: ${rail}`);
+    this.rail = rail;
+    this.name = "UnsupportedRailError";
+  }
+};
+
+// src/client/alipay/install.ts
+var execFileAsync = promisify(execFile);
+var MIN_CLI_VERSION = "0.3.15";
+function semverLt(a, b) {
+  const pa = a.split(".").map((n) => parseInt(n, 10));
+  const pb = b.split(".").map((n) => parseInt(n, 10));
+  for (let i = 0; i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y) return x < y;
+  }
+  return false;
+}
+function parseVersion(stdout) {
+  return stdout.match(/v?(\d+\.\d+\.\d+)/)?.[1] ?? null;
+}
+var defaultGetVersion = async () => {
+  const { stdout } = await execFileAsync("alipay-bot", ["--version"]);
+  return stdout;
+};
+async function ensureCliUncached(getVersion) {
+  let stdout;
+  try {
+    stdout = await getVersion();
+  } catch (e) {
+    if (e?.code === "ENOENT") {
+      throw new AlipayCliNotFoundError(
+        "alipay-bot not installed. Run: npx -y @alipay/agent-payment install-cli"
+      );
+    }
+    throw e;
+  }
+  const version = parseVersion(stdout);
+  if (!version || semverLt(version, MIN_CLI_VERSION)) {
+    throw new AlipayCliVersionError(
+      `alipay-bot ${version ?? "?"} found, need \u2265 ${MIN_CLI_VERSION}. Run: npx -y @alipay/agent-payment@latest update`
+    );
+  }
+  return version;
+}
+var cachedVersion = null;
+var inflight = null;
+async function ensureCli(getVersion = defaultGetVersion) {
+  if (getVersion !== defaultGetVersion) {
+    return ensureCliUncached(getVersion);
+  }
+  if (cachedVersion) return cachedVersion;
+  if (!inflight) {
+    inflight = ensureCliUncached(getVersion).then((v) => {
+      cachedVersion = v;
+      return v;
+    }).finally(() => {
+      inflight = null;
+    });
+  }
+  return inflight;
+}
+
+// src/client/alipay/poll.ts
+var POLL_INTERVAL_MS = 3e3;
+var POLL_MAX_INFLIGHT = 2;
+function resolveMaxInflight(override) {
+  if (override !== void 0) return Math.max(1, Math.floor(override));
+  const raw = process.env.MOLTSPAY_ALIPAY_POLL_MAX_INFLIGHT;
+  if (raw !== void 0 && raw.trim() !== "") {
+    const n = Number(raw);
+    if (Number.isFinite(n) && n >= 1) return Math.floor(n);
+  }
+  return POLL_MAX_INFLIGHT;
+}
+function resolveLaunchGap(override) {
+  if (override !== void 0) return Math.max(0, override);
+  const raw = process.env.MOLTSPAY_ALIPAY_POLL_LAUNCH_MS;
+  if (raw !== void 0 && raw.trim() !== "") {
+    const n = Number(raw);
+    if (Number.isFinite(n) && n >= 0) return n;
+  }
+  return POLL_INTERVAL_MS;
+}
+function parseStatus(lines) {
+  const raw = lines.join("\n").trim();
+  try {
+    const json = JSON.parse(raw);
+    if (json && typeof json === "object") {
+      if (typeof json.success === "boolean") {
+        if (json.success) return "paid";
+        const err = String(json.errorCode ?? "").toUpperCase();
+        if (/UNPAID|WAIT|PENDING|PROCESS|NOTPAY/.test(err)) return "pending";
+        if (/CLOSED|CANCEL|FAIL|REJECT|REFUSE|TIMEOUT|EXPIRE/.test(err)) return "rejected";
+        return "pending";
+      }
+      if (typeof json.code !== "undefined") {
+        if (Number(json.code) === 200) return "paid";
+        const msg = `${json.message ?? ""}${json.reason ?? ""}`;
+        if (/关闭|失败|拒绝|取消|超时|已撤销/.test(msg)) return "rejected";
+        return "pending";
+      }
+      if (typeof json.body === "string") {
+        return classifyReportText(json.body);
+      }
+    }
+  } catch {
+  }
+  return classifyReportText(raw);
+}
+function classifyReportText(s) {
+  const text = s.toUpperCase();
+  if (/查询支付状态成功并获取资源/.test(s) || /资源响应状态[^0-9\n]{0,8}200/.test(s) || /TRADE_SUCCESS|TRADE_FINISHED|"STATUS":\s*"FULFILLED"/.test(text)) return "paid";
+  if (/TRADE_CLOSED|REJECTED|REFUSE|CANCEL/.test(text) || /交易关闭|支付失败|已拒绝|已取消|已撤销|交易超时/.test(s)) return "rejected";
+  if (/WAIT_BUYER_PAY|UNPAID|PENDING|WAITING/.test(text) || /交易未支付|等待付款|待支付|未支付/.test(s)) return "pending";
+  return "unknown";
+}
+function defaultSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) return reject(new Error("aborted"));
+    const t = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(t);
+        reject(new Error("aborted"));
+      },
+      { once: true }
+    );
+  });
+}
+var LAUNCH = /* @__PURE__ */ Symbol("launch");
+async function pollUntil(tradeNo, resourceUrl, opts) {
+  const runner = opts.runner ?? runCli;
+  const sleep = opts.sleep ?? defaultSleep;
+  const now = opts.now ?? Date.now;
+  const maxInflight = resolveMaxInflight(opts.maxInflight);
+  const launchGap = resolveLaunchGap(opts.launchIntervalMs);
+  const args = [
+    "402-query-payment-status",
+    "-t",
+    tradeNo,
+    "-r",
+    resourceUrl,
+    ...opts.method ? ["-m", opts.method] : [],
+    ...opts.data ? ["-d", opts.data] : []
+  ];
+  const internal = new AbortController();
+  const signal = opts.signal ? AbortSignal.any([opts.signal, internal.signal]) : internal.signal;
+  let tick = 0;
+  let lastLaunch = -Infinity;
+  const inflight2 = /* @__PURE__ */ new Set();
+  const launch = () => {
+    tick += 1;
+    const myTick = tick;
+    lastLaunch = now();
+    const run = (async () => {
+      const { lines } = await runner(args, {
+        signal,
+        step: "query-payment-status",
+        flow: tradeNo
+      });
+      const status = parseStatus(lines);
+      alipayLog.debug("poll.tick", { flow: tradeNo, tick: myTick, status });
+      return { status, lines };
+    })();
+    const tracked = run.finally(() => {
+      inflight2.delete(tracked);
+    });
+    inflight2.add(tracked);
+  };
+  try {
+    for (; ; ) {
+      if (opts.signal?.aborted) throw new Error("aborted");
+      const expired = now() >= opts.deadline;
+      if (expired && inflight2.size === 0) {
+        throw new AlipayPaymentTimeoutError(
+          `Payment ${tradeNo} not completed before pay_before deadline`
+        );
+      }
+      while (!expired && inflight2.size < maxInflight && now() - lastLaunch >= launchGap) {
+        launch();
+      }
+      const waiters = [...inflight2];
+      if (!expired && inflight2.size < maxInflight) {
+        const untilNext = Math.max(0, launchGap - (now() - lastLaunch));
+        waiters.push(sleep(untilNext, signal).then(() => LAUNCH, () => LAUNCH));
+      }
+      const winner = await Promise.race(waiters);
+      if (winner === LAUNCH) continue;
+      if (winner.status === "paid") return { status: "paid", lines: winner.lines };
+      if (winner.status === "rejected") {
+        throw new AlipayPaymentRejectedError(`Payment ${tradeNo} was rejected`);
+      }
+    }
+  } finally {
+    internal.abort();
+    for (const p of inflight2) p.catch(() => void 0);
+  }
+}
+
+// src/client/alipay/index.ts
+var TRADE_NO_RE = /^\d{32}$/;
+function resolveSessionId(explicit, envSession) {
+  return explicit ?? envSession ?? randomUUID();
+}
+function assertTradeNo(t) {
+  if (!TRADE_NO_RE.test(t)) {
+    throw new AlipayProtocolError(`invalid tradeNo (expect 32 digits): ${t}`);
+  }
+}
+function parseTradeNo(lines) {
+  for (const line of lines) {
+    const labeled = line.match(/trade[_-]?no["'\s:=]+(\d{32})/i);
+    if (labeled) return labeled[1];
+    const bare = line.match(/\b(\d{32})\b/);
+    if (bare) return bare[1];
+  }
+  return null;
+}
+function parsePaymentUrl(lines) {
+  let paymentUrl;
+  let shortenUrl;
+  for (const line of lines) {
+    const m = line.match(/(alipays?:\/\/\S+|https?:\/\/\S+)/i);
+    if (!m) continue;
+    const url = m[1].replace(/[)\]`>]+$/, "");
+    if (/short|qr\.alipay|surl|\/s\//i.test(line) && !shortenUrl) shortenUrl = url;
+    else if (!paymentUrl) paymentUrl = url;
+  }
+  if (!paymentUrl && shortenUrl) paymentUrl = shortenUrl;
+  return { paymentUrl, shortenUrl };
+}
+function extractMedia(line) {
+  const m = line.match(/^\s*MEDIA:\s*(.+?)\s*$/);
+  return m ? m[1] : null;
+}
+function isWalletReady(lines) {
+  const text = lines.join("\n").trim();
+  try {
+    const json = JSON.parse(text);
+    if (json && typeof json.code !== "undefined") return Number(json.code) === 200;
+  } catch {
+  }
+  return !/未开通|未开启|NOT[_\s-]*(OPEN|BOUND|SET)|NEEDS?[_\s-]*SETUP|NO[_\s-]*WALLET/i.test(text);
+}
+function extractResourceFromReport(report) {
+  const label = report.search(/资源响应体/);
+  const start = report.indexOf("{", label === -1 ? 0 : label);
+  if (start === -1) return void 0;
+  let depth = 0, inStr = false, esc = false;
+  for (let i = start; i < report.length; i++) {
+    const ch = report[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === "\\") esc = true;
+      else if (ch === '"') inStr = false;
+      continue;
+    }
+    if (ch === '"') inStr = true;
+    else if (ch === "{") depth++;
+    else if (ch === "}" && --depth === 0) {
+      const slice = report.slice(start, i + 1);
+      try {
+        const obj = JSON.parse(slice);
+        const r = obj?.resourceResponse ?? obj?.result ?? obj?.data ?? obj?.body ?? obj;
+        return typeof r === "string" ? r : JSON.stringify(r);
+      } catch {
+        return slice;
+      }
+    }
+  }
+  return void 0;
+}
+function extractBody(lines) {
+  const text = lines.join("\n").trim();
+  try {
+    const json = JSON.parse(text);
+    if (json && typeof json === "object") {
+      if (json.resourceResponse !== void 0 && json.resourceResponse !== null) {
+        const rr = json.resourceResponse;
+        const r = typeof rr === "object" ? rr.result ?? rr.data ?? rr.body ?? rr : rr;
+        return typeof r === "string" ? r : JSON.stringify(r);
+      }
+      if (typeof json.body === "string") {
+        const inner = extractResourceFromReport(json.body);
+        return inner ?? json.body;
+      }
+      const body = json.data ?? json.result ?? json.body ?? json.resource;
+      if (body !== void 0) return typeof body === "string" ? body : JSON.stringify(body);
+      return text;
+    }
+  } catch {
+  }
+  const idx = lines.findIndex((l) => /^\s*BODY:/.test(l));
+  if (idx !== -1) {
+    const first = lines[idx].replace(/^\s*BODY:\s*/, "");
+    return [first, ...lines.slice(idx + 1)].join("\n").trim();
+  }
+  return lines.filter((l) => !/^\s*(MEDIA|STATUS|INFO):/.test(l)).join("\n").trim();
+}
+var DEFAULT_WALLET_TTL_MS = 10 * 60 * 1e3;
+function resolveWalletTtlMs() {
+  const raw = process.env.MOLTSPAY_ALIPAY_WALLET_TTL_MS;
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_WALLET_TTL_MS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_WALLET_TTL_MS;
+}
+var walletReadyUntil = /* @__PURE__ */ new Map();
+var DEFAULT_INTENT_TTL_MS = 10 * 60 * 1e3;
+function resolveIntentTtlMs() {
+  const raw = process.env.MOLTSPAY_ALIPAY_INTENT_TTL_MS;
+  if (raw === void 0 || raw.trim() === "") return DEFAULT_INTENT_TTL_MS;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : DEFAULT_INTENT_TTL_MS;
+}
+var intentDoneUntil = /* @__PURE__ */ new Map();
+var AlipayClient = class {
+  sessionId;
+  configDir;
+  framework;
+  runner;
+  getVersion;
+  now;
+  /** Only the default runner may use the process-level wallet cache. */
+  walletCacheable;
+  /** Only the default runner may use the process-level payment-intent cache. */
+  intentCacheable;
+  constructor(opts = {}) {
+    this.sessionId = resolveSessionId(opts.sessionId, process.env.AIPAY_SESSION_ID);
+    this.configDir = opts.configDir ?? join2(homedir2(), ".moltspay");
+    this.framework = opts.framework ?? process.env.AIPAY_FRAMEWORK ?? "openclaw";
+    this.runner = opts.runner ?? runCli;
+    this.getVersion = opts.getVersion;
+    this.now = opts.now ?? Date.now;
+    this.walletCacheable = opts.cacheWallet ?? !opts.runner;
+    this.intentCacheable = opts.cacheIntent ?? !opts.runner;
+  }
+  /**
+   * Throws NeedsWalletSetupError unless alipay-bot reports an opened wallet.
+   *
+   * Skips the ~22s `check-wallet` spawn entirely when a prior call cached a
+   * "ready" verdict within the TTL (see {@link DEFAULT_WALLET_TTL_MS}).
+   */
+  async checkWallet(signal, flow) {
+    const ttlMs = resolveWalletTtlMs();
+    const cacheKey = `${this.configDir}::${this.framework}`;
+    const useCache = this.walletCacheable && ttlMs > 0;
+    if (useCache) {
+      const until = walletReadyUntil.get(cacheKey);
+      if (until !== void 0 && this.now() < until) {
+        alipayLog.info("wallet.cache", { flow, step: "check-wallet", hit: true, ttlMsLeft: until - this.now() });
+        return;
+      }
+    }
+    const { lines } = await this.runner(["check-wallet"], { signal, step: "check-wallet", flow });
+    if (!isWalletReady(lines)) {
+      if (this.walletCacheable) walletReadyUntil.delete(cacheKey);
+      throw new NeedsWalletSetupError(
+        "Alipay wallet not opened. Run: moltspay alipay apply (then: moltspay alipay bind)"
+      );
+    }
+    if (useCache) {
+      walletReadyUntil.set(cacheKey, this.now() + ttlMs);
+      alipayLog.info("wallet.cache", { flow, step: "check-wallet", hit: false, cachedForMs: ttlMs });
+    }
+  }
+  /** Run the full 8-step flow and resolve with the resource body. */
+  async pay402(opts) {
+    const { resourceUrl, requirement, signal } = opts;
+    const extra = requirement.extra ?? {};
+    const paymentNeededHeader = String(extra.payment_needed_header ?? "");
+    if (!paymentNeededHeader) {
+      throw new AlipayProtocolError("alipay requirement missing extra.payment_needed_header");
+    }
+    const flow = this.sessionId;
+    const flowStart = this.now();
+    alipayLog.info("flow.start", { flow, resource: resourceUrl });
+    const media = [];
+    const onLine = (line) => {
+      const m = extractMedia(line);
+      if (m) media.push(m);
+      else opts.onLine?.(line);
+    };
+    const intentSummary = opts.intentSummary?.trim() || `\u652F\u4ED8 ${requirement.amount ?? ""} ${requirement.asset ?? "CNY"}`.trim();
+    await timeStep("ensure-cli", flow, () => ensureCli(this.getVersion));
+    const intentTtlMs = resolveIntentTtlMs();
+    const intentKey = `${this.configDir}::${this.framework}`;
+    const useIntentCache = this.intentCacheable && intentTtlMs > 0;
+    const intentUntil = useIntentCache ? intentDoneUntil.get(intentKey) : void 0;
+    if (intentUntil !== void 0 && this.now() < intentUntil) {
+      alipayLog.info("intent.cache", { flow, step: "payment-intent", hit: true, ttlMsLeft: intentUntil - this.now() });
+    } else {
+      await this.runner(
+        [
+          "payment-intent",
+          "--session-id",
+          this.sessionId,
+          "--intent-summary",
+          intentSummary,
+          "--framework",
+          this.framework
+        ],
+        { onLine, signal, step: "payment-intent", flow }
+      );
+      if (useIntentCache) {
+        intentDoneUntil.set(intentKey, this.now() + intentTtlMs);
+        alipayLog.info("intent.cache", { flow, step: "payment-intent", hit: false, cachedForMs: intentTtlMs });
+      }
+    }
+    await this.checkWallet(signal, flow);
+    const reqId = String(extra.out_trade_no ?? randomUUID());
+    const dir = join2(this.configDir, "alipay");
+    await mkdir(dir, { recursive: true });
+    const challengeFile = join2(dir, `402_${reqId}.txt`);
+    await writeFile(challengeFile, paymentNeededHeader, "utf-8");
+    const payArgs = [
+      "402-buyer-pay",
+      "-f",
+      challengeFile,
+      "-r",
+      resourceUrl,
+      "-s",
+      this.sessionId,
+      "-i",
+      intentSummary,
+      "-w",
+      this.framework
+    ];
+    if (opts.method) payArgs.push("-m", opts.method);
+    if (opts.data) payArgs.push("-d", opts.data);
+    const payRun = await this.runner(payArgs, { onLine, signal, step: "402-buyer-pay", flow });
+    const tradeNo = parseTradeNo(payRun.lines);
+    if (!tradeNo) {
+      throw new AlipayProtocolError("402-buyer-pay did not return a tradeNo");
+    }
+    assertTradeNo(tradeNo);
+    const { paymentUrl, shortenUrl } = parsePaymentUrl(payRun.lines);
+    if (paymentUrl) {
+      alipayLog.info("flow.pending", { flow, tradeNo, ms: this.now() - flowStart });
+      opts.onPaymentPending?.({ paymentUrl, shortenUrl, tradeNo });
+    }
+    const pendingAt = this.now();
+    const windowMs = (requirement.maxTimeoutSeconds ?? 30 * 60) * 1e3;
+    const deadline = this.now() + (opts.timeoutMs ?? windowMs);
+    const poll = await pollUntil(tradeNo, resourceUrl, {
+      // No onLine: the status-poll output embeds the resource and must not reach
+      // the log stream — the body is surfaced via the return value below (§9.3).
+      deadline,
+      signal,
+      runner: this.runner,
+      now: this.now,
+      // Re-fetch the resource the same way it was paid (POST + body), else the
+      // status poll defaults to GET and 404s on a POST-only `/execute`.
+      method: opts.method,
+      data: opts.data
+    });
+    alipayLog.info("flow.settled", { flow, tradeNo, ms: this.now() - pendingAt });
+    const body = extractBody(poll.lines);
+    void this.runner(["402-buyer-fulfillment-ack", "-t", tradeNo], {
+      onLine,
+      signal,
+      step: "402-buyer-fulfillment-ack",
+      flow
+    }).catch(() => void 0);
+    return { body, payment: { tradeNo, outTradeNo: reqId }, media };
+  }
+};
+
+// src/client/alipay/router.ts
+var ALIPAY_RAIL = "alipay";
+function railOf(req) {
+  if (req.scheme === "alipay-aipay" || req.network === ALIPAY_RAIL) return ALIPAY_RAIL;
+  return networkToChainName(req.network) ?? req.network;
+}
+function findRail(accepts, rail) {
+  const requirement = accepts.find((r) => railOf(r) === rail);
+  return requirement ? { rail, requirement } : null;
+}
+function selectRail(input) {
+  const { serverAccepts, explicitRail, preference, availability } = input;
+  if (!serverAccepts || serverAccepts.length === 0) {
+    throw new UnsupportedRailError(explicitRail ?? "unknown", "Server offered no payment options");
+  }
+  if (explicitRail) {
+    const hit = findRail(serverAccepts, explicitRail);
+    if (!hit) {
+      const offered = serverAccepts.map(railOf);
+      throw new UnsupportedRailError(
+        explicitRail,
+        `Server doesn't accept rail '${explicitRail}'. Offered: ${offered.join(", ")}`
+      );
+    }
+    return hit;
+  }
+  if (preference) {
+    for (const pref of preference) {
+      const hit = findRail(serverAccepts, pref);
+      if (hit) return hit;
+    }
+  }
+  if (availability?.evmReady) {
+    const evm = serverAccepts.find((r) => railOf(r) !== ALIPAY_RAIL);
+    if (evm) return { rail: railOf(evm), requirement: evm };
+  }
+  if (availability?.alipayReady) {
+    const hit = findRail(serverAccepts, ALIPAY_RAIL);
+    if (hit) return hit;
+  }
+  return { rail: railOf(serverAccepts[0]), requirement: serverAccepts[0] };
+}
+
 // src/client/node/index.ts
 var DEFAULT_CONFIG = {
   chain: "base",
@@ -480,9 +1217,13 @@ var MoltsPayClient = class {
   signer = null;
   todaySpending = 0;
   lastSpendingReset = 0;
+  railPreference;
+  alipaySessionId;
   constructor(options = {}) {
-    this.configDir = options.configDir || join2(homedir2(), ".moltspay");
+    this.configDir = options.configDir || join3(homedir3(), ".moltspay");
     this.config = this.loadConfig();
+    this.railPreference = options.railPreference ?? this.config.railPreference;
+    this.alipaySessionId = options.alipaySessionId;
     this.walletData = this.loadWallet();
     this.loadSpending();
     if (this.walletData) {
@@ -560,6 +1301,9 @@ var MoltsPayClient = class {
    * @param options - Payment options (token selection)
    */
   async pay(serverUrl, service, params, options = {}) {
+    if (options.rail === ALIPAY_RAIL) {
+      return this.payViaAlipay(serverUrl, service, params, options);
+    }
     if (!this.wallet || !this.walletData) {
       throw new Error("Client not initialized. Run: npx moltspay init");
     }
@@ -751,6 +1495,76 @@ Please specify: --chain <chain_name>`
     console.log(`[MoltsPay] Success! Payment: ${result.payment?.status || "claimed"}`);
     return result.result || result;
   }
+  /**
+   * Pay for a service over the Alipay fiat rail (2.0.0).
+   *
+   * Unlike the crypto path this needs no EVM wallet — it shells out to
+   * alipay-bot via {@link AlipayClient}. Flow: hit the resource with no
+   * payment to get the 402 challenge, confirm the server actually offers the
+   * alipay rail (selectRail), then run the 8-step state machine and return the
+   * resource body.
+   */
+  async payViaAlipay(serverUrl, service, params, options) {
+    const flow = this.alipaySessionId;
+    let executeUrl = `${serverUrl}/execute`;
+    try {
+      const services = await timeStep(
+        "discover-services",
+        flow,
+        () => this.getServices(serverUrl)
+      );
+      const svc = services.services?.find((s) => s.id === service);
+      if (svc?.endpoint) executeUrl = `${serverUrl}${svc.endpoint}`;
+    } catch {
+    }
+    const requestBody = options.rawData ? { service, ...params } : { service, params };
+    const bodyJson = JSON.stringify(requestBody);
+    const res = await timeStep(
+      "challenge-402",
+      flow,
+      () => fetch(executeUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: bodyJson
+      })
+    );
+    if (res.status !== 402) {
+      const data = await res.json().catch(() => ({}));
+      if (res.ok && data.result) return data.result;
+      throw new Error(data.error || `Expected 402, got ${res.status}`);
+    }
+    const header = res.headers.get(PAYMENT_REQUIRED_HEADER);
+    if (!header) throw new Error("Missing x-payment-required header on 402");
+    const parsed = JSON.parse(Buffer.from(header, "base64").toString("utf-8"));
+    const accepts = Array.isArray(parsed) ? parsed : parsed.accepts ?? [parsed];
+    const { requirement } = selectRail({
+      serverAccepts: accepts,
+      explicitRail: ALIPAY_RAIL,
+      preference: this.railPreference,
+      availability: { evmReady: this.isInitialized }
+    });
+    const onLine = options.onLine ?? ((line) => process.stdout.write(line + "\n"));
+    const alipay = new AlipayClient({
+      sessionId: this.alipaySessionId,
+      configDir: this.configDir
+    });
+    const result = await alipay.pay402({
+      resourceUrl: executeUrl,
+      requirement,
+      method: "POST",
+      data: bodyJson,
+      onLine,
+      onPaymentPending: options.onPaymentPending,
+      timeoutMs: options.timeoutMs,
+      signal: options.signal
+    });
+    try {
+      const json = JSON.parse(result.body);
+      return json.result ?? json;
+    } catch {
+      return { body: result.body, payment: result.payment, media: result.media };
+    }
+  }
   /**
    * Handle MPP (Machine Payments Protocol) payment flow
    * Called when pay() detects WWW-Authenticate header in 402 response
@@ -1091,7 +1905,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
   }
   // --- Config & Wallet Management ---
   loadConfig() {
-    const configPath = join2(this.configDir, "config.json");
+    const configPath = join3(this.configDir, "config.json");
     if (existsSync2(configPath)) {
       const content = readFileSync2(configPath, "utf-8");
       return { ...DEFAULT_CONFIG, ...JSON.parse(content) };
@@ -1100,14 +1914,14 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
   }
   saveConfig() {
     mkdirSync2(this.configDir, { recursive: true });
-    const configPath = join2(this.configDir, "config.json");
+    const configPath = join3(this.configDir, "config.json");
     writeFileSync2(configPath, JSON.stringify(this.config, null, 2));
   }
   /**
    * Load spending data from disk
    */
   loadSpending() {
-    const spendingPath = join2(this.configDir, "spending.json");
+    const spendingPath = join3(this.configDir, "spending.json");
     if (existsSync2(spendingPath)) {
       try {
         const data = JSON.parse(readFileSync2(spendingPath, "utf-8"));
@@ -1130,7 +1944,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
    */
   saveSpending() {
     mkdirSync2(this.configDir, { recursive: true });
-    const spendingPath = join2(this.configDir, "spending.json");
+    const spendingPath = join3(this.configDir, "spending.json");
     const data = {
       date: this.lastSpendingReset || (/* @__PURE__ */ new Date()).setHours(0, 0, 0, 0),
       amount: this.todaySpending,
@@ -1139,7 +1953,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
     writeFileSync2(spendingPath, JSON.stringify(data, null, 2));
   }
   loadWallet() {
-    const walletPath = join2(this.configDir, "wallet.json");
+    const walletPath = join3(this.configDir, "wallet.json");
     if (existsSync2(walletPath)) {
       if (process.platform !== "win32") {
         try {
@@ -1169,7 +1983,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
       privateKey: wallet.privateKey,
       createdAt: Date.now()
     };
-    const walletPath = join2(configDir, "wallet.json");
+    const walletPath = join3(configDir, "wallet.json");
     writeFileSync2(walletPath, JSON.stringify(walletData, null, 2), { mode: 384 });
     const config = {
       chain: options.chain,
@@ -1178,7 +1992,7 @@ Run: npx moltspay approve --chain ${chainName} --spender ${spender}`
         maxPerDay: options.maxPerDay
       }
     };
-    const configPath = join2(configDir, "config.json");
+    const configPath = join3(configDir, "config.json");
     writeFileSync2(configPath, JSON.stringify(config, null, 2));
     return { address: wallet.address, configDir };
   }