tixbit 0.2.4 → 0.3.1

package/dist/cli.js

@@ -2,6 +2,8 @@
 
 // src/cli.ts
 import { Command } from "commander";
+import { readFile as readFile3 } from "fs/promises";
+import { randomUUID as randomUUID3 } from "crypto";
 
 // src/safety.ts
 function usdCents(raw) {
@@ -41,6 +43,235 @@ function redact(value, secrets = []) {
   return value;
 }
 
+// src/seller.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { mkdir, readFile, writeFile, rename, unlink, lstat, chmod } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var SELLER_ORIGIN = "https://mcp.tixbit.com";
+var SELLER_CALLBACK = `${SELLER_ORIGIN}/cli/callback`;
+var DEFAULT_SELLER_CLIENT_ID = "tixbit-client.eyJ0eXAiOiJjbGllbnQiLCJpYXQiOjE3OTIxOTI4MDAsImNsaWVudE5hbWUiOiJUaXhCaXQgQ0xJIiwicmVkaXJlY3RVcmlzIjpbImh0dHBzOi8vbWNwLnRpeGJpdC5jb20vY2xpL2NhbGxiYWNrIl0sInNjb3BlIjoibWNwOnJlYWQgaW52ZW50b3J5OnJlYWQgc2VsbGVyOndyaXRlIn0.C9ijXrH07kd2p15Dd1z5yzfVsz4XoBUJI90GP9Rbg7k";
+var SELLER_SCOPES = "mcp:read inventory:read seller:write";
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var disclosures = ["ada", "twenty_one_plus", "obstructed_view", "limited_view", "standing_room", "aisle_seat"];
+var SellerError = class extends Error {
+  constructor(code, message, action, retryable = false) {
+    super(message);
+    this.code = code;
+    this.action = action;
+    this.retryable = retryable;
+  }
+};
+function sellerId(value) {
+  if (!uuid.test(value)) throw new TypeError("Review and attempt IDs must be UUID v4 values");
+  return value;
+}
+function text(value, label, max) {
+  if (typeof value !== "string" || !value.trim() || value.length > max || /[\x00-\x1f\x7f]/.test(value)) throw new TypeError(`${label} must be nonempty text (max ${max} characters)`);
+  return value.trim();
+}
+function normalizeSellerOperation(operation, value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("Expected a JSON object");
+  const b = value;
+  const allowed = operation === "seller.create" ? ["externalEventId", "section", "quantity", "priceCents", "termsAccepted", "row", "seatNumbers", "generalAdmission", "faceValueCents", "disclosures", "notes", "ownedImportId"] : operation === "seller.reprice" ? ["listingId", "priceCents"] : ["listingId"];
+  for (const key of Object.keys(b)) if (!allowed.includes(key)) throw new TypeError(`Unsupported seller field: ${key}. Quantity edits and fulfillment/payment changes are unavailable.`);
+  const result = {};
+  if (operation !== "seller.create") result.listingId = text(b.listingId, "listingId", 128);
+  if (operation !== "seller.delist") {
+    if (!Number.isSafeInteger(b.priceCents) || b.priceCents < 100 || b.priceCents > 5e6) throw new TypeError("priceCents must be an integer from 100 to 5000000 (USD per ticket)");
+    result.priceCents = b.priceCents;
+  }
+  if (operation === "seller.create") {
+    result.externalEventId = text(b.externalEventId, "externalEventId", 128);
+    result.section = text(b.section, "section", 128);
+    if (!Number.isInteger(b.quantity) || b.quantity < 1 || b.quantity > 20) throw new TypeError("quantity must be an integer from 1 to 20");
+    if (b.termsAccepted !== true) throw new TypeError("Seller approval requires termsAccepted: true");
+    result.quantity = b.quantity;
+    result.termsAccepted = true;
+    for (const key of ["row", "notes", "ownedImportId"]) if (b[key] !== void 0) result[key] = text(b[key], key, key === "notes" ? 280 : key === "row" ? 64 : 100);
+    if (b.generalAdmission !== void 0) {
+      if (typeof b.generalAdmission !== "boolean") throw new TypeError("generalAdmission must be a boolean");
+      result.generalAdmission = b.generalAdmission;
+    }
+    if (b.seatNumbers !== void 0) {
+      if (!Array.isArray(b.seatNumbers) || b.seatNumbers.length > 0 && b.seatNumbers.length !== b.quantity || new Set(b.seatNumbers).size !== b.seatNumbers.length) throw new TypeError("seatNumbers must contain one distinct seat per ticket");
+      result.seatNumbers = b.seatNumbers.map((s) => text(s, "seatNumber", 16));
+    }
+    if (b.faceValueCents !== void 0) {
+      if (!Number.isSafeInteger(b.faceValueCents) || b.faceValueCents < 0 || b.faceValueCents > 5e6) throw new TypeError("faceValueCents must be a nonnegative integer");
+      result.faceValueCents = b.faceValueCents;
+    }
+    if (b.ownedImportId !== void 0 && !/^ori_[0-9a-f-]{36}$/i.test(String(b.ownedImportId))) throw new TypeError("ownedImportId must be a TixBit-owned resale import ID");
+    if (b.generalAdmission === true && (b.row || Array.isArray(b.seatNumbers) && b.seatNumbers.length)) throw new TypeError("General admission cannot include a row or seat numbers");
+    if (b.generalAdmission !== true && (!b.row || !b.ownedImportId && (!Array.isArray(b.seatNumbers) || !b.seatNumbers.length))) throw new TypeError("Reserved seating requires row and exact seatNumbers matching quantity; use generalAdmission: true only for GA tickets");
+    if (Array.isArray(b.seatNumbers) && b.seatNumbers.some((s) => /^(tbd|unknown|n\/?a|pending)$/i.test(s.trim()))) throw new TypeError("Exact seat numbers are required; placeholder seats are not accepted");
+    if (b.disclosures !== void 0) {
+      if (!Array.isArray(b.disclosures) || b.disclosures.some((d) => !disclosures.includes(d))) throw new TypeError(`disclosures must use: ${disclosures.join(", ")}`);
+      result.disclosures = [...new Set(b.disclosures)];
+    }
+  }
+  return result;
+}
+var SellerStore = class {
+  constructor(directory = join(homedir(), ".config", "tixbit", "seller")) {
+    this.directory = directory;
+  }
+  async save(name, value) {
+    await mkdir(this.directory, { recursive: true, mode: 448 });
+    const info = await lstat(this.directory);
+    if (info.isSymbolicLink() || !info.isDirectory()) throw new TypeError("Seller state directory must be a real directory");
+    await chmod(this.directory, 448);
+    const temporary = join(this.directory, `.${randomUUID()}.tmp`);
+    await writeFile(temporary, JSON.stringify(value), { mode: 384, flag: "wx" });
+    await rename(temporary, join(this.directory, name));
+  }
+  async load(name) {
+    try {
+      const path = join(this.directory, name);
+      const info = await lstat(path);
+      if (!info.isFile() || info.isSymbolicLink() || (info.mode & 63) !== 0) throw new Error();
+      return JSON.parse(await readFile(path, "utf8"));
+    } catch {
+      throw new SellerError("LOCAL_STATE_MISSING", "Private seller session or review is missing or unreadable.", "Run sell login, or prepare a new review after checking inventory.");
+    }
+  }
+  async remove(name) {
+    await unlink(join(this.directory, name)).catch(() => {
+    });
+  }
+};
+var SellerClient = class {
+  constructor(store = new SellerStore(), fetcher = fetch) {
+    this.store = store;
+    this.fetcher = fetcher;
+  }
+  async request(path, body, token) {
+    let response;
+    try {
+      response = await this.fetcher(`${SELLER_ORIGIN}${path}`, { method: body === void 0 ? "GET" : "POST", headers: { ...body === void 0 ? {} : { "Content-Type": "application/json" }, ...token ? { Authorization: `Bearer ${token}` } : {} }, ...body === void 0 ? {} : { body: JSON.stringify(body) }, redirect: "error", signal: AbortSignal.timeout(3e4) });
+    } catch {
+      throw new SellerError("SELLER_OUTCOME_UNKNOWN", "The seller service response was not received.", "For a confirm, retry the SAME review ID. For prepare, check inventory before preparing another attempt.", true);
+    }
+    const data = await response.json().catch(() => null);
+    if (!response.ok) {
+      const errors = {
+        authentication_required: { message: "Seller sign-in is required.", action: "Run tixbit sell login to authorize this CLI." },
+        seller_unavailable: { message: "Seller account support is not configured.", action: "Ask the operator to configure the seller account bridge and approved OAuth client." },
+        permission_required: { message: "Current seller account permission is required.", action: "Check seller ownership, sign in to the correct account, and reconnect to grant inventory:read and seller:write." },
+        invalid_request: { message: "The seller request is invalid.", action: "Check required fields, exact event and seat IDs, quantity, price in cents and UUID attempt. Correct the request before preparing again." },
+        invalid_content_type: { message: "The seller request requires JSON.", action: "Use the documented CLI JSON input or send application/json to the API." },
+        account_unavailable: { message: "The seller account service is temporarily unavailable.", action: path === "/api/seller/confirm" ? "Read review status and inventory before retrying. Retain the SAME review ID and confirmation; do not prepare a new mutation attempt." : "Retry the read when service recovers. For preparation, reconcile inventory and the existing attempt before preparing again." },
+        review_or_listing_unavailable: { message: "The review or owned listing is unavailable.", action: "Run sell list to refresh owned inventory. Use an owned listing or review ID and check that the review has not expired." },
+        review_conflict: { message: "The seller review changed, expired or requires reconciliation.", action: "Read sell review and sell list. Retain the existing confirmation; never repeat an uncertain mutation with a new attempt." }
+      };
+      const code = typeof data?.error?.code === "string" && Object.hasOwn(errors, data.error.code) ? data.error.code : null;
+      if (code) {
+        const known = errors[code];
+        throw new SellerError(code, known.message, known.action, data.error.retryable === true);
+      }
+      throw new SellerError(`SELLER_HTTP_${response.status}`, `Seller request failed (HTTP ${response.status}).`, "Check command input and service status. Reconcile review status and inventory before retrying any mutation.", false);
+    }
+    if (!data || typeof data !== "object" || Array.isArray(data)) throw new SellerError("INVALID_SELLER_RESPONSE", "Seller service returned an invalid response.", "Check review status and inventory before another attempt.");
+    return redact(data, [token ?? ""]);
+  }
+  async token() {
+    const session = await this.store.load("session.json");
+    if (!session.accessToken || !Number.isFinite(session.expiresAt) || session.expiresAt <= Date.now()) throw new SellerError("SELLER_LOGIN_EXPIRED", "Seller sign-in has expired.", "Run sell login again. Saved reviews can be checked after sign-in.");
+    return session.accessToken;
+  }
+  capabilities() {
+    return this.request("/api/seller/capabilities");
+  }
+  async inventory() {
+    return this.request("/api/seller/inventory", void 0, await this.token());
+  }
+  async status(id) {
+    const inventory = await this.inventory();
+    if (!id) return inventory;
+    const listing = inventory.listings?.find((l) => l.listingId === id);
+    if (!listing) throw new SellerError("LISTING_NOT_FOUND", "Listing not found in this seller account.", "Run sell list and choose an owned listing ID.");
+    return { listing };
+  }
+  async prepare(operation, body, attempt = randomUUID()) {
+    sellerId(attempt);
+    const normalized = normalizeSellerOperation(operation, body);
+    const token = await this.token();
+    try {
+      await this.store.load(`attempt-${attempt}.json`);
+      throw new SellerError("ATTEMPT_ALREADY_SENT", "This preparation attempt has already been sent.", "Check sell list and sell review before starting a new attempt.");
+    } catch (error) {
+      if (!(error instanceof SellerError) || error.code !== "LOCAL_STATE_MISSING") throw error;
+    }
+    await this.store.save(`attempt-${attempt}.json`, { operation, body: normalized, attempt });
+    let result;
+    try {
+      result = await this.request("/api/seller/prepare", { operation, body: normalized, attempt }, token);
+    } catch (error) {
+      if (error instanceof SellerError) error.action += ` Preparation attempt: ${attempt}.`;
+      throw error;
+    }
+    if (!result.review || !uuid.test(result.review.id) || result.confirmation?.reviewId !== result.review.id || !/^[A-Za-z0-9_-]{43}$/.test(result.confirmation.nonce)) throw new SellerError("INVALID_SELLER_REVIEW", "Invalid server review.", "Check inventory before another attempt.");
+    await this.store.save(`review-${result.review.id}.json`, result);
+    return { review: result.review, attempt, action: `Review the operation and seller terms. To approve: tixbit sell confirm ${result.review.id} --confirm. To abandon: tixbit sell cancel ${result.review.id}. Submission does not guarantee a live marketplace listing.` };
+  }
+  async review(id) {
+    return this.request(`/api/seller/reviews/${sellerId(id)}`, void 0, await this.token());
+  }
+  async confirm(id, approved) {
+    if (approved !== true) throw new TypeError("Explicit approval requires --confirm after reviewing the prepared operation");
+    const saved = await this.store.load(`review-${sellerId(id)}.json`);
+    if (saved.confirmation?.reviewId !== id) throw new TypeError("Review identity mismatch");
+    return this.request("/api/seller/confirm", saved.confirmation, await this.token());
+  }
+  async cancel(id) {
+    const saved = await this.store.load(`review-${sellerId(id)}.json`);
+    return this.request("/api/seller/cancel", saved.confirmation, await this.token());
+  }
+  async logout() {
+    await this.store.remove("session.json");
+    await this.store.remove("login.json");
+    return { signedIn: false, action: "Local credentials removed. To revoke an existing grant, use your TixBit account connections." };
+  }
+  async authStatus() {
+    try {
+      const session = await this.store.load("session.json");
+      return { signedIn: session.expiresAt > Date.now(), expiresAt: session.expiresAt, action: "Run sell list to validate current server access. Local status does not prove the grant is still active." };
+    } catch {
+      return { signedIn: false, action: "Run tixbit sell login to sign in with the built-in public CLI client." };
+    }
+  }
+  async startLogin(clientId = DEFAULT_SELLER_CLIENT_ID) {
+    text(clientId, "clientId", 8192);
+    const pending = { clientId, state: randomBytes(32).toString("base64url"), verifier: randomBytes(32).toString("base64url"), expiresAt: Date.now() + 6e5 };
+    await this.store.save("login.json", pending);
+    const url = new URL(`${SELLER_ORIGIN}/api/oauth/authorize`);
+    for (const [key, value] of Object.entries({ response_type: "code", client_id: clientId, redirect_uri: SELLER_CALLBACK, scope: SELLER_SCOPES, resource: `${SELLER_ORIGIN}/api/mcp`, state: pending.state, code_challenge: createHash("sha256").update(pending.verifier).digest("base64url"), code_challenge_method: "S256" })) url.searchParams.set(key, value);
+    return { signInUrl: url.toString(), action: "Open this URL in your browser, sign in and approve seller access. Then run tixbit sell login --complete and paste the full callback URL on stdin. Never paste tokens or browser cookies.", expiresAt: pending.expiresAt };
+  }
+  async completeLogin(callback) {
+    const pending = await this.store.load("login.json");
+    let url;
+    try {
+      url = new URL(callback.trim());
+    } catch {
+      throw new TypeError("Paste the full TixBit callback URL from your browser");
+    }
+    if (url.origin + url.pathname !== SELLER_CALLBACK || url.hash || url.username || url.password || pending.expiresAt <= Date.now() || url.searchParams.get("state") !== pending.state || url.searchParams.getAll("state").length !== 1 || url.searchParams.getAll("code").length !== 1 || !url.searchParams.get("code") || url.searchParams.has("error")) throw new TypeError("Callback URL, state, or login expiry does not match. Run sell login again.");
+    await this.store.remove("login.json");
+    let response;
+    try {
+      response = await this.fetcher(`${SELLER_ORIGIN}/api/oauth/token`, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded" }, body: new URLSearchParams({ grant_type: "authorization_code", client_id: pending.clientId, redirect_uri: SELLER_CALLBACK, resource: `${SELLER_ORIGIN}/api/mcp`, code: url.searchParams.get("code"), code_verifier: pending.verifier }), redirect: "error", signal: AbortSignal.timeout(3e4) });
+    } catch {
+      throw new SellerError("LOGIN_EXCHANGE_FAILED", "Could not complete login.", "Run sell login again; do not reuse an uncertain authorization code.");
+    }
+    const result = await response.json().catch(() => null);
+    await this.store.remove("login.json");
+    if (!response.ok || typeof result?.access_token !== "string" || !result.access_token || result.token_type?.toLowerCase() !== "bearer" || !Number.isFinite(result.expires_in) || result.expires_in <= 0) throw new SellerError("LOGIN_EXCHANGE_FAILED", "Seller authorization was not granted.", "Run sell login again. Ask the operator to approve the CLI client and seller scopes if unavailable.");
+    await this.store.save("session.json", { accessToken: result.access_token, clientId: pending.clientId, expiresAt: Date.now() + result.expires_in * 1e3 });
+    return { signedIn: true, expiresIn: result.expires_in, action: "Run tixbit sell list to inspect your inventory." };
+  }
+};
+
 // src/cli.ts
 import { createRequire as createRequire2 } from "module";
 
@@ -425,7 +656,8 @@ var TixBitClient = class {
         }),
         signal: controller.signal
       });
-      const body = await response.json().catch(() => ({}));
+      const value = await response.json().catch(() => void 0);
+      const body = value && typeof value === "object" && !Array.isArray(value) ? value : {};
       const orderReference = normalizeOrderReference(body.orderReference);
       const receiptUrl = normalizeReceiptUrl(body.receiptUrl);
       if (response.status >= 500 && body.status !== "manual_review_required") {
@@ -458,21 +690,21 @@ var TixBitClient = class {
           action: "Configure the official mppx payment client, then retry with the same idempotency key."
         };
       }
+      if (response.ok && (!isPurchaseStatus(body.status) || body.status === "fulfilled" && (body.success !== true || !orderReference))) {
+        return {
+          success: false,
+          status: "pending",
+          idempotencyKey,
+          orderReference,
+          receiptUrl,
+          error: {
+            code: "PURCHASE_OUTCOME_AMBIGUOUS",
+            message: "The server did not return a confirmed purchase outcome."
+          },
+          action: "Check the order with the same idempotency key. Do not create a new payment or purchase attempt."
+        };
+      }
       if (isPurchaseStatus(body.status)) {
-        if (body.status === "fulfilled" && response.ok && body.success === true && !orderReference) {
-          return {
-            success: false,
-            status: "pending",
-            idempotencyKey,
-            orderReference: null,
-            receiptUrl,
-            error: {
-              code: "PURCHASE_OUTCOME_AMBIGUOUS",
-              message: "The purchase response did not include an order reference."
-            },
-            action: "Retry with the same idempotency key. Do not create a new payment or purchase attempt."
-          };
-        }
         if (body.status === "fulfilled" && (!response.ok || body.success !== true)) {
           return rejectedPurchaseResult(
             idempotencyKey,
@@ -868,10 +1100,10 @@ var TixBitTimeoutError = class extends Error {
 
 // src/link.ts
 import { execFile } from "child_process";
-import { randomUUID } from "crypto";
-import { mkdir, readFile, rename, writeFile } from "fs/promises";
-import { homedir } from "os";
-import { dirname, join } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+import { mkdir as mkdir2, readFile as readFile2, rename as rename2, writeFile as writeFile2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { dirname, join as join2 } from "path";
 import { createRequire } from "module";
 import { promisify } from "util";
 import { Challenge } from "mppx";
@@ -887,7 +1119,7 @@ function linkCliEntry() {
     throw new LinkCheckoutError("LINK_NODE_UNSUPPORTED", "TixBit needs Node.js 22 or later.");
   }
   try {
-    return join(dirname(require2.resolve("@stripe/link-cli/package.json")), "dist", "cli.js");
+    return join2(dirname(require2.resolve("@stripe/link-cli/package.json")), "dist", "cli.js");
   } catch {
     throw new LinkCheckoutError("LINK_CLI_MISSING", "The bundled Link CLI is missing. Reinstall TixBit, then retry.");
   }
@@ -905,20 +1137,20 @@ function paymentEndpoint() {
 }
 function statePath(orderReference) {
   if (!ORDER_REFERENCE.test(orderReference)) throw new LinkCheckoutError("INVALID_ORDER_REFERENCE", "Enter the order reference shown by link start.");
-  const base = process.env.XDG_STATE_HOME || join(homedir(), ".local", "state");
-  return join(base, "tixbit", "link", `${orderReference}.json`);
+  const base = process.env.XDG_STATE_HOME || join2(homedir2(), ".local", "state");
+  return join2(base, "tixbit", "link", `${orderReference}.json`);
 }
 async function saveState(state) {
   const path = statePath(state.orderReference);
-  await mkdir(dirname(path), { recursive: true, mode: 448 });
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  await writeFile(temporary, JSON.stringify(state), { mode: 384, flag: "wx" });
-  await rename(temporary, path);
+  await mkdir2(dirname(path), { recursive: true, mode: 448 });
+  const temporary = `${path}.${randomUUID2()}.tmp`;
+  await writeFile2(temporary, JSON.stringify(state), { mode: 384, flag: "wx" });
+  await rename2(temporary, path);
 }
 async function loadState(orderReference) {
   let value;
   try {
-    value = JSON.parse(await readFile(statePath(orderReference), "utf8"));
+    value = JSON.parse(await readFile2(statePath(orderReference), "utf8"));
   } catch {
     throw new LinkCheckoutError("CHECKOUT_NOT_FOUND", "This Link checkout was not found on this device.");
   }
@@ -1002,7 +1234,7 @@ function approvalUrl(value) {
 }
 async function startLinkPurchase(input) {
   linkCliEntry();
-  const purchase = normalizePurchaseTicketsParams({ ...input, idempotencyKey: randomUUID() });
+  const purchase = normalizePurchaseTicketsParams({ ...input, idempotencyKey: randomUUID2() });
   if (!Number.isSafeInteger(input.maxAmountCents) || input.maxAmountCents <= 0) {
     throw new LinkCheckoutError("INVALID_MAX_PRICE", "Set a positive total price limit.");
   }
@@ -1061,35 +1293,39 @@ async function startLinkPurchase(input) {
     action: `Approve in Link, then run: tixbit link complete ${body.orderReference}`
   };
 }
+function purchaseOutcome(state, result) {
+  if (result.orderReference && result.orderReference !== state.orderReference) {
+    throw new LinkCheckoutError("ORDER_REFERENCE_CHANGED", "TixBit returned a different order reference. Check the order before another payment.");
+  }
+  const sameOrder = result.orderReference === state.orderReference;
+  const terminalFailure = sameOrder && (result.status === "payment_failed" || result.status === "rejected");
+  const manualReview = sameOrder && result.status === "manual_review_required";
+  const fulfilled = sameOrder && result.success && result.status === "fulfilled";
+  return {
+    success: fulfilled,
+    status: fulfilled || manualReview || terminalFailure ? result.status : "pending",
+    orderReference: state.orderReference,
+    amountCents: state.amountCents,
+    ...sameOrder && result.order ? { order: result.order } : {},
+    ...sameOrder && result.receiptUrl ? { receiptUrl: result.receiptUrl } : {},
+    ...!fulfilled ? {
+      error: sameOrder && (manualReview || terminalFailure) && result.error ? result.error : { code: "PURCHASE_OUTCOME_AMBIGUOUS", message: "The order is still being checked." },
+      action: terminalFailure || manualReview ? result.action ?? "Contact TixBit support with this order reference. Do not submit another payment." : "Run the same complete command again later. Do not start another payment or purchase."
+    } : {}
+  };
+}
 async function completeLinkPurchase(orderReference) {
   const state = await loadState(orderReference);
-  if (state.result && ["fulfilled", "payment_failed", "rejected"].includes(state.result.status)) return state.result;
+  const ambiguousLegacyResult = state.paymentAttempted && state.result?.status === "rejected" && /^HTTP_2\d\d$/.test(state.result.error?.code ?? "");
+  if (state.result && !ambiguousLegacyResult && ["fulfilled", "payment_failed", "rejected"].includes(state.result.status)) return state.result;
   if (state.paymentAttempted) {
     const request2 = JSON.parse(state.requestBody);
     const result2 = await new TixBitClient({ paymentEndpoint: paymentEndpoint(), timeoutMs: 3e4 }).purchaseTickets(request2);
-    if (result2.orderReference && result2.orderReference !== orderReference) {
-      throw new LinkCheckoutError("ORDER_REFERENCE_CHANGED", "TixBit returned a different order reference. Check the order before another payment.");
-    }
-    if (state.result?.status === "manual_review_required" && result2.status !== "fulfilled") {
+    const output3 = purchaseOutcome(state, result2);
+    if (state.result?.status === "manual_review_required" && !output3.success) {
       return state.result;
     }
-    const sameOrder = result2.orderReference === orderReference;
-    const terminalFailure = sameOrder && (result2.status === "payment_failed" || result2.status === "rejected");
-    const manualReview = sameOrder && result2.status === "manual_review_required";
-    const fulfilled = sameOrder && result2.success && result2.status === "fulfilled";
-    const output3 = {
-      success: fulfilled,
-      status: fulfilled || manualReview || terminalFailure ? result2.status : "pending",
-      orderReference,
-      amountCents: state.amountCents,
-      ...sameOrder && result2.order ? { order: result2.order } : {},
-      ...sameOrder && result2.receiptUrl ? { receiptUrl: result2.receiptUrl } : {},
-      ...!fulfilled ? {
-        error: sameOrder && (manualReview || terminalFailure) && result2.error ? result2.error : { code: "PURCHASE_OUTCOME_AMBIGUOUS", message: "The order is still being checked." },
-        action: terminalFailure || manualReview ? result2.action ?? "Contact TixBit support with this order reference. Do not submit another payment." : "Run the same complete command again later. Do not start another payment or purchase."
-      } : {}
-    };
-    if (output3.success || terminalFailure || output3.status === "manual_review_required") {
+    if (ambiguousLegacyResult || output3.success || ["payment_failed", "rejected", "manual_review_required"].includes(output3.status)) {
       state.result = output3;
       await saveState(state);
     }
@@ -1160,21 +1396,15 @@ async function completeLinkPurchase(orderReference) {
   const request = JSON.parse(state.requestBody);
   const result = await client2.purchaseTickets(request);
   if (challengeChanged) throw new LinkCheckoutError("CHALLENGE_CHANGED", "The order or payment amount changed. No payment was submitted.");
-  if (result.orderReference && result.orderReference !== orderReference) {
-    throw new LinkCheckoutError("ORDER_REFERENCE_CHANGED", "TixBit returned a different order reference. Check the order before another payment.");
-  }
-  const output2 = {
-    success: result.success,
-    status: decline ? "payment_failed" : result.status,
+  const outcome = purchaseOutcome(state, result);
+  const output2 = decline ? {
+    success: false,
+    status: "payment_failed",
     orderReference,
     amountCents: state.amountCents,
-    ...result.order && !decline ? { order: result.order } : {},
-    ...result.receiptUrl && !decline ? { receiptUrl: result.receiptUrl } : {},
-    ...!result.success ? {
-      error: decline ? { code: "CARD_DECLINED", message: "Stripe declined the card selected in Link." } : result.error,
-      action: decline ? "Select another card in Link and start a new spend approval. No ticket was issued." : result.status === "pending" ? "Payment may have succeeded. Do not retry or start another checkout. Contact TixBit support with this order reference." : result.action
-    } : {}
-  };
+    error: { code: "CARD_DECLINED", message: "Stripe declined the card selected in Link." },
+    action: "Select another card in Link and start a new spend approval. No ticket was issued."
+  } : outcome;
   state.result = output2;
   await saveState(state);
   return output2;
@@ -1190,6 +1420,7 @@ var client = (() => {
 })();
 var packageJson = createRequire2(import.meta.url)("../package.json");
 function output(data, json) {
+  data = JSON.parse(JSON.stringify(data, (key, value) => /nonce|verifier/i.test(key) ? "[REDACTED]" : value));
   data = redact(data, [process.env.TIXBIT_LINK_TOKEN ?? "", process.env.TIXBIT_ACCESS_TOKEN ?? "", process.env.MPPX_PRIVATE_KEY ?? ""]);
   if (data && typeof data === "object" && !Array.isArray(data)) {
     data = { success: true, ...data };
@@ -1266,11 +1497,15 @@ function formatItem(item) {
   return JSON.stringify(item, null, 2);
 }
 function handleError(err) {
+  if (err instanceof SellerError) {
+    output({ success: false, error: { code: err.code, message: err.message, retryable: err.retryable }, action: err.action }, true);
+    process.exit(1);
+  }
   const msg = err instanceof TypeError || err instanceof RangeError ? err.message : "Request failed. Check input and service availability; do not retry an uncertain write.";
   output({ success: false, error: { code: "COMMAND_FAILED", message: msg } }, true);
   process.exit(1);
 }
-var program = new Command().name("tixbit").description("Search events, browse listings, and buy TixBit tickets").version(packageJson.version);
+var program = new Command().name("tixbit").description("Search events, buy tickets, and manage your own seller listings").version(packageJson.version);
 program.command("search [query]").description("Search for events by keyword, city, state, or category").option("--city <city>", "Filter by city").option("--state <state>", "Filter by state (2-letter code)").option("--category <slug>", "Filter by category slug (e.g. nba-basketball)").option("--league <league>", "Filter by league abbreviation (e.g. NBA)").option("--event-type <type>", "SPORT, CONCERT, THEATER, or ALL").option("--performer-id <id>", "Filter by public performer ID").option("--venue-id <id>", "Filter by public venue ID").option("--parking <mode>", "Parking filter: exclude, only, or include").option("--near-lat <lat>", "Latitude for manual location filtering").option("--near-lng <lng>", "Longitude for manual location filtering").option("--location-mode <mode>", "Location mode: inferred, manual, or none").option("--start-date <date>", "Events on or after this date (ISO)").option("--end-date <date>", "Events on or before this date (ISO)").option("--page <n>", "Page number", "1").option("--size <n>", "Results per page", "10").option("--json", "Output raw JSON (for agents)", true).action(async (query, opts) => {
   try {
     const params = {
@@ -1387,38 +1622,57 @@ program.command("buy <listingId>").description("Quote or confirm Stripe Link che
     handleError(error);
   }
 });
-var sell = program.command("sell").description("Seller browser sign-in or optional authorized user integration");
-sell.command("list").option("--json", "Output JSON", true).action(async () => {
+var seller = new SellerClient();
+var sell = program.command("sell").description("Sign in, review and confirm seller inventory changes");
+var sellerAction = (fn) => async (...args) => {
   try {
-    output(await client.listSellerListings(process.env.TIXBIT_ACCESS_TOKEN ?? ""), true);
+    output(await fn(...args), true);
   } catch (error) {
     handleError(error);
   }
-});
-sell.command("create").option("--confirm", "Approve listing creation and seller terms", false).option("--json", "Output JSON", true).action(async (opts) => {
-  try {
-    if (!opts.confirm) throw new TypeError("sell create requires --confirm and approved listing JSON on stdin");
-    if (!process.env.TIXBIT_ACCESS_TOKEN) {
-      output(await client.listSellerListings(), true);
-      return;
-    }
-    if (process.stdin.isTTY) throw new TypeError("Provide listing JSON on stdin");
-    let input = "";
-    for await (const chunk of process.stdin) {
-      input += chunk.toString();
-      if (Buffer.byteLength(input) > 65536) throw new TypeError("Listing JSON exceeds 64 KiB");
-    }
+};
+async function readSellerInput(file) {
+  if (file) {
+    const input2 = await readFile3(file, "utf8");
+    if (Buffer.byteLength(input2) > 65536) throw new TypeError("Input exceeds 64 KiB");
+    return input2;
+  }
+  if (process.stdin.isTTY) process.stderr.write("Paste input, then press Ctrl-D to finish.\n");
+  let input = "";
+  for await (const chunk of process.stdin) {
+    input += chunk.toString();
+    if (Buffer.byteLength(input) > 65536) throw new TypeError("Input exceeds 64 KiB");
+  }
+  return input;
+}
+sell.command("capabilities").description("Discover public seller support, limits and configuration readiness").action(sellerAction(() => seller.capabilities()));
+sell.command("login").description("Authorize the CLI through browser OAuth with PKCE; no browser cookies or manual tokens").option("--client-id <id>", "Override the built-in public OAuth client ID (or TIXBIT_SELLER_CLIENT_ID)").option("--complete", "Read the full callback URL from stdin and securely finish authorization").action(sellerAction(async (opts) => {
+  if (opts.complete) return seller.completeLogin(await readSellerInput());
+  const clientId = opts.clientId ?? process.env.TIXBIT_SELLER_CLIENT_ID ?? DEFAULT_SELLER_CLIENT_ID;
+  return seller.startLogin(clientId);
+}));
+sell.command("auth-status").description("Check local login expiry without exposing credentials").action(sellerAction(() => seller.authStatus()));
+sell.command("logout").description("Remove local CLI credentials; account grants can be revoked in TixBit").action(sellerAction(() => seller.logout()));
+sell.command("list").description("Read inventory owned by the signed-in seller").option("--json", "Output JSON", true).action(sellerAction(() => seller.inventory()));
+sell.command("status [listingId]").description("Read current owned listing status (or all inventory)").action(sellerAction((id) => seller.status(id)));
+sell.command("review <reviewId>").description("Reconcile a saved review and any completed result").action(sellerAction((id) => seller.review(id)));
+sell.command("confirm <reviewId>").description("Submit exactly the saved preview; reuse the same review ID after an uncertain response").requiredOption("--confirm", "Approve this previously reviewed operation and seller terms").action(sellerAction((id, opts) => seller.confirm(id, opts.confirm)));
+sell.command("cancel <reviewId>").description("Abandon a prepared review without changing a listing").action(sellerAction((id) => seller.cancel(id)));
+for (const name of ["create", "reprice", "delist"]) {
+  sell.command(name).description(`${name === "create" ? "Prepare a listing" : name === "reprice" ? "Prepare a per-ticket price change" : "Prepare removal of an owned listing"}; JSON file or stdin, review before confirm`).option("--file <path>", "Read approved listing/operation JSON from a file (default stdin)").option("--attempt <uuid>", "Stable UUID v4 preparation attempt ID").option("--dry-run", "Validate locally and print preview; no authenticated requests").option("--json", "Output JSON", true).action(sellerAction(async (opts) => {
     let body;
     try {
-      body = JSON.parse(input);
-    } catch {
-      throw new TypeError("Invalid listing JSON on stdin");
+      body = JSON.parse(await readSellerInput(opts.file));
+    } catch (error) {
+      if (error instanceof SyntaxError) throw new TypeError("Invalid seller JSON. Use --help for input options.");
+      throw error;
     }
-    output(await client.createSellerListing(body, process.env.TIXBIT_ACCESS_TOKEN ?? "", opts.confirm), true);
-  } catch (error) {
-    handleError(error);
-  }
-});
+    const operation = `seller.${name}`;
+    const normalized = normalizeSellerOperation(operation, body);
+    if (opts.dryRun) return { dryRun: true, operation, body: normalized, action: "Validate event, date, section, seats, per-ticket USD price and terms with the seller. Omit --dry-run to obtain a server review; no listing was changed." };
+    return seller.prepare(operation, normalized, opts.attempt ?? randomUUID3());
+  }));
+}
 program.command("checkout <listingId>").description("Get a checkout link to buy tickets for a listing").requiredOption("--quantity <n>", "Number of tickets to buy").option("--json", "Output raw JSON", true).action(async (listingId, opts) => {
   try {
     const quantity = Number(opts.quantity);
@@ -1713,7 +1967,7 @@ function describePosition(section, allSections) {
 function configureCommands(command) {
   command.exitOverride();
   command.configureOutput({
-    writeOut: (text) => output({ help: text }, true),
+    writeOut: (text2) => output({ help: text2 }, true),
     writeErr: () => {
     }
   });

package/dist/index.d.ts

@@ -504,4 +504,71 @@ declare function assertMppChallenge(challenge: {
     request: Record<string, unknown>;
 }, maxAmountCents: number): void;
 
-export { type AgentResult, type BrowseEventsParams, type BrowseEventsResult, type BuyTicketsParams, type CheckoutLink, type CheckoutParams, type GetListingResult, type GetListingsParams, type GetListingsResult, type GetSeatmapParams, type LocationMode, type ParkingFilter, type PurchaseOrder, type PurchaseStatus, type PurchaseTicketsParams, type PurchaseTicketsResult, type SearchEventsParams, type SearchEventsResult, type SeatmapLabel, type SeatmapResult, type SeatmapSection, type SeatmapVenue, type SeatmapZone, TixBitApiError, TixBitClient, type TixBitConfig, type TixBitEvent, type TixBitEventDetail, type TixBitListing, type TixBitListingDisclosure, TixBitTimeoutError, assertMppChallenge };
+declare const DEFAULT_SELLER_CLIENT_ID = "tixbit-client.eyJ0eXAiOiJjbGllbnQiLCJpYXQiOjE3OTIxOTI4MDAsImNsaWVudE5hbWUiOiJUaXhCaXQgQ0xJIiwicmVkaXJlY3RVcmlzIjpbImh0dHBzOi8vbWNwLnRpeGJpdC5jb20vY2xpL2NhbGxiYWNrIl0sInNjb3BlIjoibWNwOnJlYWQgaW52ZW50b3J5OnJlYWQgc2VsbGVyOndyaXRlIn0.C9ijXrH07kd2p15Dd1z5yzfVsz4XoBUJI90GP9Rbg7k";
+type SellerOperation = "seller.create" | "seller.reprice" | "seller.delist";
+declare class SellerError extends Error {
+    code: string;
+    action: string;
+    retryable: boolean;
+    constructor(code: string, message: string, action: string, retryable?: boolean);
+}
+/** Strictly validate the actual seller API contract; no payment or fulfillment fields. */
+declare function normalizeSellerOperation(operation: SellerOperation, value: unknown): Record<string, unknown>;
+/** Credentials and confirmation capabilities stay in private files, never stdout or argv. */
+declare class SellerStore {
+    directory: string;
+    constructor(directory?: string);
+    save(name: string, value: unknown): Promise<void>;
+    load<T>(name: string): Promise<T>;
+    remove(name: string): Promise<void>;
+}
+declare class SellerClient {
+    store: SellerStore;
+    private fetcher;
+    constructor(store?: SellerStore, fetcher?: typeof fetch);
+    private request;
+    token(): Promise<string>;
+    capabilities(): Promise<any>;
+    inventory(): Promise<any>;
+    status(id?: string): Promise<any>;
+    prepare(operation: SellerOperation, body: unknown, attempt?: string): Promise<{
+        review: {
+            id: string;
+            operation: {
+                name: SellerOperation;
+                body: Record<string, unknown>;
+            };
+            expiresAt: number;
+        };
+        attempt: string;
+        action: string;
+    }>;
+    review(id: string): Promise<any>;
+    confirm(id: string, approved: boolean): Promise<any>;
+    cancel(id: string): Promise<any>;
+    logout(): Promise<{
+        signedIn: boolean;
+        action: string;
+    }>;
+    authStatus(): Promise<{
+        signedIn: boolean;
+        expiresAt: number;
+        action: string;
+    } | {
+        signedIn: boolean;
+        action: string;
+        expiresAt?: undefined;
+    }>;
+    startLogin(clientId?: string): Promise<{
+        signInUrl: string;
+        action: string;
+        expiresAt: number;
+    }>;
+    completeLogin(callback: string): Promise<{
+        signedIn: boolean;
+        expiresIn: any;
+        action: string;
+    }>;
+}
+
+export { type AgentResult, type BrowseEventsParams, type BrowseEventsResult, type BuyTicketsParams, type CheckoutLink, type CheckoutParams, DEFAULT_SELLER_CLIENT_ID, type GetListingResult, type GetListingsParams, type GetListingsResult, type GetSeatmapParams, type LocationMode, type ParkingFilter, type PurchaseOrder, type PurchaseStatus, type PurchaseTicketsParams, type PurchaseTicketsResult, type SearchEventsParams, type SearchEventsResult, type SeatmapLabel, type SeatmapResult, type SeatmapSection, type SeatmapVenue, type SeatmapZone, SellerClient, SellerError, type SellerOperation, SellerStore, TixBitApiError, TixBitClient, type TixBitConfig, type TixBitEvent, type TixBitEventDetail, type TixBitListing, type TixBitListingDisclosure, TixBitTimeoutError, assertMppChallenge, normalizeSellerOperation };