@itpay/cli 0.1.0 → 0.1.2

package/bin/itp

@@ -9,7 +9,7 @@ import { fileURLToPath } from "node:url";
 import QRCode from "qrcode";
 
 const VERSION = "0.1.2";
-const DEFAULT_API_BASE = process.env.ITPAY_API_BASE || process.env.ITPAY_CORE_BASE_URL || process.env.VOLTAGENT_API_BASE || "http://localhost:3000";
+const DEFAULT_API_BASE = process.env.ITPAY_API_BASE || process.env.ITPAY_CORE_BASE_URL || "http://localhost:3000";
 const CONFIG_DIR = path.join(os.homedir(), ".itp");
 const CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
 const STATE_PATH = path.join(CONFIG_DIR, "state.json");
@@ -193,15 +193,6 @@ async function main() {
       output({
         version: VERSION,
         commands: [
-          "auth register",
-          "auth register --host gemini --display chat --no-wait --json",
-          "auth login",
-          "auth device start",
-          "auth device poll <auth_id>",
-          "setup --credits 100 --method alipay",
-          "setup --plan credit-300 --method alipay",
-          "setup --plan credit-300 --method alipay --host gemini --display chat --json",
-          "setup --credits 100 --target codex --method alipay --install-runtime",
           "buy var_pubg_couple_skin_cny20 --sandbox --email buyer@example.com --phone +8613800000000 --json",
           "buy var_pubg_couple_skin_cny20 --sandbox --email buyer@example.com --phone +8613800000000 --no-wait --json",
           "buyer catalog search --query 企业工商 --category business_data_api --provider itpay_enterprise_data --json",
@@ -236,30 +227,7 @@ async function main() {
           "resume --json",
           "resume --run-id <run_id> --host gemini --display none --json",
           "runs list|current|show <run_id>|forget <run_id>",
-          "auth status",
-          "account show",
           "account login-link",
-          "account set-password --password-stdin",
-          "plans list",
-          "plans show <plan>",
-          "checkout create --credits 100 --method alipay",
-          "checkout create --plan credit-300 --method alipay --idempotency-key <uuid>",
-          "checkout qr <checkout_id>",
-          "checkout open",
-          "checkout recover <checkout_id>",
-          "checkout list --limit 20",
-          "payment wait <checkout_id> --timeout 120",
-          "balance",
-          "usage --today --model <model>",
-          "grants list",
-          "grants show <grant_id>",
-          "grants install <grant_id> --target codex",
-          "grants revoke <grant_id>",
-          "keys list",
-          "keys rotate --grant <grant_id>",
-          "keys revoke --grant <grant_id>",
-          "token issue --grant <grant_id> --stdout",
-          "sync",
           "skill show",
           "skill show --role buyer --json",
           "skill path --role buyer",
@@ -870,6 +838,7 @@ async function buyer(command, rest, flags) {
     if (subcommand === "grants") {
       const action = rest[1] && !String(rest[1]).startsWith("--") ? rest[1] : "list";
       if (action === "list") {
+        await ensureBuyerSessionForVaultAccess(flags);
         const grants = await listBuyerAgentReadGrants(flags);
         output(buyerRunOutput({
           status: "agent_read_grants",
@@ -881,6 +850,7 @@ async function buyer(command, rest, flags) {
       if (action === "read" || action === "show") {
         const grantID = flags.grant || flags.grant_id || flags.agent_read_grant_id || positional(rest, 2);
         if (!grantID) throw new Error("agent_read_grant_id is required");
+        await ensureBuyerSessionForVaultAccess(flags);
         const view = await readBuyerAgentReadGrant(grantID, flags);
         output(buyerRunOutput({
           status: "agent_read_grant_view",
@@ -891,6 +861,7 @@ async function buyer(command, rest, flags) {
       }
     }
     if (subcommand === "read") {
+      await ensureBuyerSessionForVaultAccess(flags);
       const view = await readBuyerVaultArtifactGrant(flags);
       output(buyerRunOutput({
         status: "agent_read_grant_view",
@@ -1357,6 +1328,35 @@ async function maybeClaimBuyerSessionForCheckout(checkout, flags = {}) {
   return await maybeClaimBuyerSessionFromAuthAction(action, flags);
 }
 
+async function ensureBuyerSessionForVaultAccess(flags = {}) {
+  if (readSessionToken()) return null;
+  const checkoutID =
+    flags.checkout ||
+    flags.checkout_id ||
+    readState().last_core_checkout_id ||
+    readState().last_core_auth_checkout_id;
+  if (checkoutID) {
+    try {
+      const checkout = await getBuyerCheckout(checkoutID, flags);
+      rememberCoreAuthAction(checkout.checkout_id || checkoutID, checkout.human_action);
+      const claimed = await maybeClaimBuyerSessionForCheckout(checkout, { ...flags, quiet: true });
+      if (claimed || readSessionToken()) return claimed;
+    } catch {
+      // Continue with the locally remembered auth action below.
+    }
+    const action = readCoreAuthAction(checkoutID);
+    const claimed = await maybeClaimBuyerSessionFromAuthAction(action, { ...flags, quiet: true });
+    if (claimed || readSessionToken()) return claimed;
+  }
+  const state = readState();
+  const entries = Object.entries(state.core_auth_actions || {});
+  for (const [, action] of entries.reverse()) {
+    const claimed = await maybeClaimBuyerSessionFromAuthAction(action, { ...flags, quiet: true });
+    if (claimed || readSessionToken()) return claimed;
+  }
+  return null;
+}
+
 function parseBuyerAuthActionURL(action) {
   const rawURL = action?.url || action?.auth_url || "";
   if (!rawURL) return {};
@@ -2456,20 +2456,20 @@ function installClaudeCode(grantId, credentials, dryRun) {
 
 function installCodex(grantId, credentials, dryRun) {
   const configPath = path.join(os.homedir(), ".codex", "config.toml");
-  const envPath = path.join(CONFIG_DIR, "voltagent.env");
+  const envPath = path.join(CONFIG_DIR, "itpay.env");
   const existing = readText(configPath, "");
   const block = [
-    'model_provider = "voltagent"',
+    'model_provider = "itpay"',
     'model = "openai-code-default"',
     "",
-    "[model_providers.voltagent]",
-    'name = "VoltaGent"',
+    "[model_providers.itpay]",
+    'name = "ItPay"',
     `base_url = "${escapeTomlString(credentials.openai_base_url)}"`,
-    'env_key = "VOLTAGENT_API_KEY"'
+    'env_key = "ITPAY_API_KEY"'
   ].join("\n");
-  const nextConfig = replaceManagedBlock(existing, "voltagent", block);
+  const nextConfig = replaceManagedBlock(existing, "itpay", block);
   const configWrite = writeTextWithBackup(configPath, nextConfig, 0o600, dryRun);
-  const envWrite = writeTextWithBackup(envPath, `export VOLTAGENT_API_KEY=${quoteShell(credentials.key)}\n`, 0o600, dryRun);
+  const envWrite = writeTextWithBackup(envPath, `export ITPAY_API_KEY=${quoteShell(credentials.key)}\n`, 0o600, dryRun);
   return {
     target: "codex",
     grant_id: grantId,
@@ -2479,7 +2479,7 @@ function installCodex(grantId, credentials, dryRun) {
       { path: envPath, action: envWrite.action, backup_path: envWrite.backup_path || null }
     ],
     warnings: [
-      "Codex reads VOLTAGENT_API_KEY from its process environment; source ~/.itp/voltagent.env before starting Codex if your launcher does not load it."
+      "Codex reads ITPAY_API_KEY from its process environment; source ~/.itp/itpay.env before starting Codex if your launcher does not load it."
     ]
   };
 }
@@ -2489,7 +2489,7 @@ function installOpenClaw(grantId, credentials, dryRun) {
   const current = readJSON(configPath, {});
   current.models = current.models || {};
   current.models.providers = current.models.providers || {};
-  current.models.providers.voltagent = {
+  current.models.providers.itpay = {
     baseUrl: credentials.openai_base_url,
     api: "openai-compatible",
     apiKey: credentials.key,
@@ -2689,7 +2689,7 @@ async function skill(command, flags) {
   if (!command || command === "show" || command === "read") {
     const content = fs.readFileSync(skillPath, "utf8");
     if (flags.json) {
-      output({ skill: role === "voltagent" ? "voltagent" : "itpay-buyer", role, path: skillPath, content });
+      output({ skill: "itpay-buyer", role, path: skillPath, content });
     } else {
       process.stdout.write(content.endsWith("\n") ? content : `${content}\n`);
     }
@@ -2697,7 +2697,7 @@ async function skill(command, flags) {
   }
   if (command === "path") {
     if (flags.json) {
-      output({ skill: role === "voltagent" ? "voltagent" : "itpay-buyer", role, path: skillPath });
+      output({ skill: "itpay-buyer", role, path: skillPath });
     } else {
       process.stdout.write(`${skillPath}\n`);
     }
@@ -2709,7 +2709,6 @@ async function skill(command, flags) {
 function normalizeSkillRole(role) {
   const normalized = String(role || "buyer").trim().toLowerCase();
   if (normalized === "buyer" || normalized === "itpay-buyer") return "buyer";
-  if (normalized === "voltagent" || normalized === "legacy") return "voltagent";
   if (normalized === "merchant" || normalized === "itpay-merchant") {
     throw new Error("merchant skill is not packaged yet; use --role buyer for current external-agent tests");
   }
@@ -2717,8 +2716,8 @@ function normalizeSkillRole(role) {
 }
 
 function resolveSkillPath(role = "buyer") {
-  const skillDirName = role === "voltagent" ? "voltagent" : "itpay-buyer";
-  const envPath = role === "buyer" ? process.env.ITPAY_BUYER_SKILL_PATH : process.env.ITPAY_CLI_SKILL_PATH;
+  const skillDirName = "itpay-buyer";
+  const envPath = process.env.ITPAY_BUYER_SKILL_PATH;
   const candidates = [
     envPath,
     process.env.ITPAY_CLI_SKILL_PATH,
@@ -2771,7 +2770,7 @@ async function doctorModelCheck(target, credentials) {
 function runtimeConfigStatus(target) {
   const paths = {
     "claude-code": [path.join(os.homedir(), ".claude", "settings.json")],
-    codex: [path.join(os.homedir(), ".codex", "config.toml"), path.join(CONFIG_DIR, "voltagent.env")],
+    codex: [path.join(os.homedir(), ".codex", "config.toml"), path.join(CONFIG_DIR, "itpay.env")],
     openclaw: [path.join(os.homedir(), ".openclaw", "config.json")]
   };
   return (paths[target] || []).map((file) => ({
@@ -3989,7 +3988,7 @@ function writeSessionCredentials(response) {
 
 function storeSessionCredential(response) {
   const token = response.session_token;
-  const ref = `voltagent:session:${response.account_id}:${response.device_id}`;
+  const ref = `itpay:session:${response.account_id}:${response.device_id}`;
   const nativeStore = writeNativeSecret(ref, token);
   if (nativeStore.ok) {
     return {
@@ -4071,7 +4070,7 @@ function deleteGrantCredential(grantId) {
 }
 
 function grantSecretRef(grantId) {
-  return `voltagent:${grantId}`;
+  return `itpay:${grantId}`;
 }
 
 function detectNativeCredentialStore() {
@@ -4093,7 +4092,7 @@ function writeNativeSecret(ref, secret) {
         "-a",
         ref,
         "-s",
-        "VoltaGent",
+        "ItPay",
         "-w",
         secret,
         "-U"
@@ -4107,9 +4106,9 @@ function writeNativeSecret(ref, secret) {
     try {
       execFileSync("secret-tool", [
         "store",
-        "--label=VoltaGent",
+        "--label=ItPay",
         "service",
-        "VoltaGent",
+        "ItPay",
         "account",
         ref
       ], { input: secret, stdio: ["pipe", "ignore", "ignore"] });
@@ -4141,7 +4140,7 @@ function readNativeSecret(store, ref) {
         "-a",
         ref,
         "-s",
-        "VoltaGent",
+        "ItPay",
         "-w"
       ], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     }
@@ -4149,7 +4148,7 @@ function readNativeSecret(store, ref) {
       return execFileSync("secret-tool", [
         "lookup",
         "service",
-        "VoltaGent",
+        "ItPay",
         "account",
         ref
       ], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -4168,14 +4167,14 @@ function deleteNativeSecret(store, ref) {
         "-a",
         ref,
         "-s",
-        "VoltaGent"
+        "ItPay"
       ], { stdio: "ignore" });
     }
     if (store === "secret-tool") {
       execFileSync("secret-tool", [
         "clear",
         "service",
-        "VoltaGent",
+        "ItPay",
         "account",
         ref
       ], { stdio: "ignore" });

package/docs/agent/buyer/cart-checkout.json

@@ -94,7 +94,7 @@
     "When auth completes, CLI should claim and store the buyer session so a repeat purchase by the same agent/device can skip auth."
   ],
   "forbidden": [
-    "Do not call legacy checkout directly for CORE-028 external-agent tests.",
+    "Use the UCP cart and buyer checkout commands for external-agent tests.",
     "Do not pass a different variant in checkout after cart is created.",
     "Do not create a second cart/checkout after a retryable timeout unless the user asks to abandon the previous one.",
     "Do not buy enterprise precise lookup with only a vague brand/short name unless you have resolved the exact registered company name.",

package/docs/agent/buyer/human-claim-ui.json

@@ -30,12 +30,13 @@
     "The claim link is short-lived and single-use.",
     "The agent may explain that ItPay intentionally separates agent operations from raw secret access.",
     "If the human wants the agent to analyze or use the delivered result, ask them to click 'Give to Agent / 一键给 Agent' in the ItPay page and confirm with Passkey.",
-    "After the human grants access, the agent should discover the grant with `itp buyer vault grants list ...`; do not ask the human to paste the grant id.",
+    "After the human grants access, the agent should discover the grant with `itp buyer vault grants list --checkout <checkout_id> --json`; do not ask the human to paste the grant id. The CLI restores the buyer agent session from the checkout auth handoff when possible.",
     "If the human later wants the agent to install or use something, wait for an explicit human-granted install/capability flow."
   ],
   "forbidden": [
     "Do not ask the human to paste the claim link or key into chat.",
     "Do not fetch the claim page with CLI, curl, browser automation, or an agent tool.",
+    "Do not ask the human for auth session IDs, display tokens, buyer session tokens, or portal tokens.",
     "Do not store raw content in local run files."
   ],
   "next_docs": [

package/docs/agent/buyer/vault-agent-read.json

@@ -10,7 +10,7 @@
     "A checkout/order has delivered a vault artifact and the human granted agent-readable access."
   ],
   "required_state": {
-    "needs": ["authenticated buyer account session", "current agent device binding", "order_id or checkout_id or vault_artifact_id"],
+    "needs": ["checkout_id or authenticated buyer account session", "current agent device binding", "order_id or checkout_id or vault_artifact_id"],
     "must_not_need": ["human portal token", "claim token", "passkey credential", "raw protected payload", "grant id copied by the human"]
   },
   "commands": [
@@ -37,14 +37,16 @@
   ],
   "agent_rules": [
     "Only read through `buyer vault` commands after the human has explicitly approved the agent grant in the ItPay portal.",
+    "Prefer `itp buyer vault grants list --checkout <checkout_id> --json`; the CLI can automatically restore the buyer agent session from the checkout auth handoff when possible.",
     "Do not ask the human to copy or paste `agent_read_grant_id`; discover it with `buyer vault grants list`.",
     "If no grant is returned, tell the human to open their ItPay account portal, reveal with Passkey, choose fields, and confirm one-key agent authorization.",
     "Use only fields returned in the grant view. Do not infer that unreturned fields are accessible.",
-    "If the command returns 401 or buyer_session_invalid, run `itp buyer auth status --json` and ask the human to reauthorize through a normal checkout/account flow."
+    "If the command still returns 401 or buyer_session_invalid after using `--checkout`, run `itp buyer checkout status <checkout_id> --json`, then retry `itp buyer vault grants list --checkout <checkout_id> --json`. Ask the human to reauthorize only if the checkout/auth handoff has expired."
   ],
   "forbidden": [
+    "Do not open, click through, scrape, or automate the human web UI yourself.",
     "Do not open, scrape, or screenshot the human portal to obtain protected content.",
-    "Do not request passkey credentials, portal tokens, claim links, claim tokens, storage refs, provider AppCode, provider keys, or raw payloads.",
+    "Do not request passkey credentials, portal tokens, claim links, claim tokens, auth session IDs, display tokens, session tokens, storage refs, provider AppCode, provider keys, or raw payloads.",
     "Do not use another agent's grant id. Grants are scoped to the exact buyer account session and agent device.",
     "Do not cache selected fields beyond the task context unless the user explicitly asks you to create a local artifact."
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@itpay/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "ItPay CLI, buyer skill, and agent-readable docs for agent-native commerce.",
   "type": "module",
   "bin": {
@@ -14,8 +14,6 @@
     "docs/",
     "install.sh",
     "install.ps1",
-    "smoke.sh",
-    "e2e-local.sh",
     "README.md",
     "LICENSE"
   ],
@@ -28,7 +26,6 @@
   },
   "keywords": [
     "itpay",
-    "voltagent",
     "agent",
     "cli",
     "claude-code",

package/skills/itpay-buyer/SKILL.md

@@ -126,9 +126,11 @@ registered name or run fuzzy search first.
    `delivery_claimable`, `check_email`, and `claim_link_sent`, but must not
    fetch or reveal protected content.
 11. If the human uses Passkey to authorize agent-readable vault access, do not
-    ask them to paste content, portal text, claim links, or grant IDs. Run
+    ask them to paste content, portal text, claim links, session tokens, auth
+    session IDs, display tokens, or grant IDs. Run
     `itp buyer vault grants list ...` and then `itp buyer vault read ...`.
-    Use only the fields returned by that command.
+    The CLI automatically restores the buyer agent session from the checkout
+    auth handoff when possible. Use only the fields returned by that command.
 12. If the user asks you to analyze, compare, summarize, install, or otherwise
     use a delivered result, you may ask them to open the ItPay claim/account
     page, click "Give to Agent / 一键给 Agent", choose fields, and confirm with
@@ -140,6 +142,10 @@ registered name or run fuzzy search first.
     broad keyword. For enterprise precise lookup, `company_name_or_credit_no`
     must be exact; otherwise warn the user that the query may waste the paid
     lookup.
+15. Do not operate ItPay by opening the human web UI yourself. Use the CLI for
+    catalog, cart, checkout, payment wait, delivery status, grant discovery,
+    and vault reads. Browser/UI pages are for the human to scan, pay, claim,
+    reveal, and approve.
 
 ## Docs Directory
 

package/e2e-local.sh

@@ -1,134 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-ROOT=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-API_BASE=${VOLTAGENT_API_BASE:-http://localhost:3000}
-NODE=${NODE:-$(command -v node)}
-
-TMP_HOME=$(mktemp -d "${TMPDIR:-/tmp}/voltagent-itp-e2e-home.XXXXXX")
-TMP_SETUP_HOME=$(mktemp -d "${TMPDIR:-/tmp}/voltagent-itp-setup-home.XXXXXX")
-TMP_SETUP_NOWAIT_HOME=$(mktemp -d "${TMPDIR:-/tmp}/voltagent-itp-setup-nowait-home.XXXXXX")
-
-cleanup() {
-  rm -rf "$TMP_HOME" "$TMP_SETUP_HOME" "$TMP_SETUP_NOWAIT_HOME"
-}
-trap cleanup EXIT INT TERM
-
-itp_home() {
-  itp_home_dir="$1"
-  shift
-  attempt=0
-  while :; do
-    err_file="$itp_home_dir/itp-error.log"
-    if out=$(HOME="$itp_home_dir" PATH=/nonexistent VOLTAGENT_API_BASE="$API_BASE" "$NODE" "$ROOT/bin/itp" "$@" 2>"$err_file"); then
-      printf '%s' "$out"
-      return 0
-    fi
-    status=$?
-    error_text=$(cat "$err_file" 2>/dev/null || true)
-    attempt=$((attempt + 1))
-    if [ "$attempt" -lt 6 ] && printf '%s' "$error_text" | grep -q 'request failed: 429'; then
-      sleep "$attempt"
-      continue
-    fi
-    printf '%s\n' "$error_text" >&2
-    return "$status"
-  done
-}
-
-itp() {
-  itp_home "$TMP_HOME" "$@"
-}
-
-json_get() {
-  "$NODE" -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const v=JSON.parse(d); const path=process.argv[1].split('.'); let cur=v; for (const p of path) cur=cur?.[p]; if (cur === undefined || cur === null) process.exit(2); process.stdout.write(String(cur));})" "$1"
-}
-
-json_assert() {
-  "$NODE" -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{const v=JSON.parse(d); const fn = new Function('v', process.argv[1]); if (!fn(v)) process.exit(1);})" "$1"
-}
-
-printf 'checking server %s\n' "$API_BASE" >&2
-curl -fsS "$API_BASE/api/status" >/dev/null
-curl -fsS "$API_BASE/api/itp/plans" | json_assert "return v.success === true && v.data.plans.some(p => p.plan_id === 'credit-100') && v.data.unit_rule === '1 credit = 1 CNY'" >/dev/null
-
-printf 'running one-command setup flow\n' >&2
-SETUP=$(itp_home "$TMP_SETUP_HOME" setup --credits 100 --method fake --mock-approve --allow-fake --offline --json)
-printf '%s' "$SETUP" | json_assert "return v.status === 'grant_ready' && v.target === 'generic' && v.grant_id && v.base_url && v.openai_base_url && v.credential && v.credential.stored === true && v.auth && v.auth.session_stored === true && v.runtime_install.status === 'skipped'"
-test ! -f "$TMP_SETUP_HOME/.codex/config.toml"
-TOKEN_FROM_SETUP=$(HOME="$TMP_SETUP_HOME" PATH=/nonexistent VOLTAGENT_API_BASE="$API_BASE" "$NODE" "$ROOT/bin/itp" token issue --grant "$(printf '%s' "$SETUP" | json_get grant_id)" --stdout)
-case "$TOKEN_FROM_SETUP" in
-  sk-*) ;;
-  *) echo "setup token issue did not return sk-* token" >&2; exit 1 ;;
-esac
-
-printf 'checking setup no-wait auth handoff\n' >&2
-SETUP_NOWAIT=$(itp_home "$TMP_SETUP_NOWAIT_HOME" setup --credits 100 --method fake --allow-fake --no-wait --json)
-printf '%s' "$SETUP_NOWAIT" | json_assert "return v.status === 'waiting_human_auth' && v.action === 'scan_alipay_auth' && v.run_id && v.auth_id && v.user_code && v.verification_uri_complete && v.human_action && v.human_action.display.length > 0"
-SETUP_NOWAIT_STATUS=$(itp_home "$TMP_SETUP_NOWAIT_HOME" status --json)
-printf '%s' "$SETUP_NOWAIT_STATUS" | json_assert "return v.status === 'waiting_human_auth' && v.run_id && v.auth_id && v.next && v.next.command.includes('resume')"
-SETUP_RESUMED=$(itp_home "$TMP_SETUP_NOWAIT_HOME" resume --mock-approve --allow-fake --offline --json)
-printf '%s' "$SETUP_RESUMED" | json_assert "return v.status === 'grant_ready' && v.run_id && v.grant_id && v.credential && v.credential.stored === true"
-
-USERNAME="e2e-$(date +%Y%m%d%H%M%S)-$$"
-printf 'registering %s\n' "$USERNAME" >&2
-AUTH=$(itp auth register --runtime codex --mock-approve --allow-fake --alipay-user-id "2088$RANDOM$RANDOM" --json)
-printf '%s' "$AUTH" | json_assert "return v.account_id && v.device_id && v.session_stored === true"
-
-ACCOUNT=$(itp account show --json)
-printf '%s' "$ACCOUNT" | json_assert "return v.password_set === false && v.account && v.account.account_id"
-
-printf 'setting first password\n' >&2
-printf 'secret123\n' | itp account set-password --password-stdin --json | json_assert "return v.password_set === true"
-ACCOUNT=$(itp account show --json)
-printf '%s' "$ACCOUNT" | json_assert "return v.password_set === true"
-
-printf 'creating fake checkout\n' >&2
-CHECKOUT=$(itp checkout create --credits 100 --method fake --allow-fake --idempotency-key "e2e-$USERNAME" --json)
-CHECKOUT_ID=$(printf '%s' "$CHECKOUT" | json_get checkout_id)
-GRANT_ID=$(printf '%s' "$CHECKOUT" | json_get grant_id)
-printf '%s' "$CHECKOUT" | json_assert "return v.status === 'grant_issued' && v.grant_id && !v.payment.cashier_url"
-
-printf 'waiting payment %s\n' "$CHECKOUT_ID" >&2
-PAYMENT=$(itp payment wait "$CHECKOUT_ID" --timeout 10 --json)
-printf '%s' "$PAYMENT" | json_assert "return v.status === 'grant_issued' && v.grant_id"
-
-printf 'installing grant %s\n' "$GRANT_ID" >&2
-INSTALL=$(itp grants install "$GRANT_ID" --target codex --json)
-printf '%s' "$INSTALL" | json_assert "return v.grant_id && v.credential && v.credential.credential_store"
-
-printf 'installing codex profile in temp HOME\n' >&2
-itp install codex --grant "$GRANT_ID" --offline --no-test --json | json_assert "return v.target === 'codex' && v.grant_id"
-test -f "$TMP_HOME/.codex/config.toml"
-test -f "$TMP_HOME/.itp/voltagent.env"
-
-BALANCE=$(itp balance --json)
-printf '%s' "$BALANCE" | json_assert "return v.active_grants === 1 && v.credits_remaining === '100.000000'"
-
-ORDERS=$(itp checkout list --limit 5 --json)
-printf '%s' "$ORDERS" | json_assert "return Array.isArray(v.orders) && v.orders.some(o => o.checkout_id === '$CHECKOUT_ID')"
-
-USAGE=$(itp usage --grant "$GRANT_ID" --json)
-printf '%s' "$USAGE" | json_assert "return v.grant_id === '$GRANT_ID' && v.total && v.total.requests === 0"
-
-printf 'rotating grant key\n' >&2
-ROTATE=$(itp keys rotate --grant "$GRANT_ID" --json)
-printf '%s' "$ROTATE" | json_assert "return v.grant_id === '$GRANT_ID' && v.credential && v.credential.credential_store"
-TOKEN=$(itp token issue --grant "$GRANT_ID" --stdout)
-case "$TOKEN" in
-  sk-*) ;;
-  *) echo "token issue did not return sk-* token" >&2; exit 1 ;;
-esac
-
-printf 'revoking grant\n' >&2
-REVOKE=$(itp grants revoke "$GRANT_ID" --json)
-printf '%s' "$REVOKE" | json_assert "return v.status === 'revoked'"
-BALANCE=$(itp balance --json)
-printf '%s' "$BALANCE" | json_assert "return v.active_grants === 0"
-
-printf 'voltagent local e2e ok\n'
-printf 'server: %s\n' "$API_BASE"
-printf 'account: %s\n' "$(printf '%s' "$AUTH" | json_get account_id)"
-printf 'checkout: %s\n' "$CHECKOUT_ID"
-printf 'grant: %s\n' "$GRANT_ID"
-printf 'temp_home_cleaned_on_exit: %s\n' "$TMP_HOME"