@itpay/cli 0.1.10 → 0.2.0

package/docs/agent/buyer/cart-checkout.json

@@ -5,7 +5,7 @@
   "title": "Cart-First Checkout",
   "purpose": "Teach the agent to use the UCP cart handoff, including CORE-033 multi-item carts, instead of bypassing cart.",
   "when_to_use": [
-    "The user selected one or more public catalog variants.",
+    "The user selected one or more public catalog purchase options.",
     "The agent needs an estimate before checkout.",
     "The agent needs to create a checkout from cart_id.",
     "A first-time wild agent may receive auth_qr as a first-purchase auth-to-payment entry before payment is verified."
@@ -14,7 +14,7 @@
     "needs": [
       "catalog_variant_id or catalog_variant_ids",
       "buyer email for secure delivery",
-      "product-specific required input fields before cart creation"
+      "service-declared required input fields before cart creation"
     ],
     "optional": [
       "buyer phone"
@@ -27,14 +27,14 @@
   },
   "commands": [
     {
-      "intent": "create a cart estimate for the selected UCP Variant.id",
+      "intent": "create a cart estimate for the selected purchase option",
       "command": "itp buyer cart create --variant <variant_id> --json",
-      "success_signal": "response.cart.cart_id is present and agent_next_actions includes create_checkout_from_cart"
+      "success_signal": "response.cart.cart_id is present and response.cart_guidance tells the agent to show the cart to the human before checkout"
     },
     {
-      "intent": "create a multi-item cart estimate for selected UCP Variant.id values",
+      "intent": "create a multi-item cart estimate for selected purchase options",
       "command": "itp buyer cart create --variants <variant_id_1>,<variant_id_2> --quantities 1,2 --json",
-      "success_signal": "response.cart.line_items contains every selected variant and response.cart.amount is the estimated total"
+      "success_signal": "response.cart.line_items contains every selected purchase option and response.cart_guidance.double_check_required is true"
     },
     {
       "intent": "create an enterprise fuzzy search cart with required query input",
@@ -49,7 +49,7 @@
     {
       "intent": "view the current cart state without relying on model memory",
       "command": "itp buyer cart show <cart_id> --json",
-      "success_signal": "response.cart.line_items and response.cart.totals reflect the server-side cart"
+      "success_signal": "response.cart.line_items and response.cart.totals reflect the server-side cart; show these fields to the human before checkout"
     },
     {
       "intent": "add one more selected UCP Variant.id to an existing cart before checkout",
@@ -74,15 +74,19 @@
   ],
   "agent_rules": [
     "CORE-033 supports multiple cart lines and bounded positive quantities when all items belong to the same supported settlement/provider group.",
-    "Before cart creation, inspect product metadata input_schema_json and collect every required input field. Do not wait until after payment to ask for required query inputs.",
-    "Enterprise fuzzy search requires input.company_name. This can be a keyword, brand, short name, or partial company name supplied by the user, such as 京东.",
-    "Enterprise precise lookup requires input.company_name_or_credit_no. This must be a complete China mainland registered company name or unified social credit code. If the user only provides a brand/short name, resolve the exact name first or use fuzzy search before precise lookup.",
+    "Before cart creation, inspect product/selection metadata and input_schema_json. The service provider declares whether input is fuzzy, exact, or human/sensitive; the agent must not guess.",
+    "If service metadata says fuzzy input is allowed, collect the declared field, for example input.company_name can be a keyword, brand, short name, or partial company name such as 京东.",
+    "If service metadata says exact input is required, collect the declared exact field, for example input.company_name_or_credit_no must be a complete China mainland registered company name or unified social credit code.",
+    "If service metadata says input is sensitive, personal, or human-authorized, do not collect it in chat. Continue through the ItPay human authorization/input flow.",
     "Use --input key=value for service-specific inputs. For multiple query lines, prefer separate cart add commands so each line locks its own input.",
     "Cart line identity includes variant, offer, price, provider product, and normalized input. Only a completely identical line should merge by increasing quantity.",
     "If the same variant has a different company_name, company_name_or_credit_no, page number, setting, or any other input value, it must remain a separate cart line.",
     "Before checkout create, confirm buyer email is available for secure delivery. If it is missing, ask the human for the email before checkout; do not guess or use a placeholder.",
     "Use cart_id as the checkout handoff.",
     "Use buyer cart show before changing an existing cart and whenever you need current cart contents. Do not rely on chat memory for cart state.",
+    "After cart create/add/remove/show, present the cart contents to the human: service, purchase option, each input, quantity, price, and delivery mode.",
+    "If the cart has more than one line item, double-check every line with the human unless the user's prompt was already explicit and the server cart exactly matches it.",
+    "Cart confirmation is mandatory before checkout create. Selected service is not the same as confirmed cart.",
     "Use buyer cart add/remove before checkout when the user changes their mind. After checkout is created, treat the cart as locked.",
     "Do not override cart line_items during checkout.",
     "Cart, checkout, and catalog JSON money fields use minor units. For CNY, amount=10 or expected_amount=10 means CNY 0.10. Tell humans the display_amount or converted major-unit amount, never interpret amount as yuan.",
@@ -90,16 +94,21 @@
     "If the same cart is retried, expect the same checkout unless contact/client reference changes.",
     "The backend revalidates catalog, price, and delivery requirements.",
     "For first purchase, auth_qr means the ItPay first-purchase entry: provider login/registration/profile consent first, then ItPay should continue the same checkout to payment.",
+    "If this agent/device already has a valid buyer session token, checkout should skip auth_qr and can continue toward payment_intent_id.",
     "After presenting auth_qr, run buyer checkout resume and keep it active/waiting. Do not stop at QR display unless the human explicitly asks you to pause.",
     "Do not tell the user auth_qr is a completed payment or payment proof.",
     "For first purchase, show the ItPay auth entry as one human orchestration entry; after provider OAuth callback the same checkout exposes payment.",
     "After showing auth_qr, poll checkout or run buyer checkout resume until identity_status becomes identity_resolved and payment_intent_id appears.",
     "When auth completes, CLI should claim and store the buyer session so a repeat purchase by the same agent/device can skip auth.",
-    "If checkout status/resume returns buyer_session.status=buyer_session_saved, the agent is now bound to that buyer account on this device. Continue with payment, delivery polling, or buyer vault commands; do not ask the human for a buyer session token."
+    "If checkout status/resume returns buyer_session.status=buyer_session_saved, the agent is now bound to that buyer account on this device. Continue with payment, delivery polling, or buyer vault commands; do not ask the human for a buyer session token.",
+    "Do not enter payment unless both conditions are true: a valid/saved buyer session exists and payment_intent_id exists.",
+    "If payment_intent_id exists but buyer_session is missing, do not show payment QR. Resume/status the same checkout until the buyer session is saved or verified."
   ],
   "forbidden": [
     "Use the UCP cart and buyer checkout commands for external-agent tests.",
     "Do not pass a different variant in checkout after cart is created.",
+    "Do not create checkout before showing the cart contents and getting confirmation.",
+    "Do not show a payment QR when buyer_session is missing, even if payment_intent_id is present.",
     "Do not create a second cart/checkout after a retryable timeout unless the user asks to abandon the previous one.",
     "Do not buy enterprise precise lookup with only a vague brand/short name unless you have resolved the exact registered company name.",
     "Do not claim enterprise API raw results are visible to the agent; they are delivered to the human Vault/claim UI."

package/docs/agent/buyer/catalog-search.json

@@ -3,10 +3,10 @@
   "role": "buyer",
   "topic": "catalog-search",
   "title": "Catalog Search For Buyer Agents",
-  "purpose": "Help the agent find public ItPay services without login and without expensive repeated full searches.",
+  "purpose": "Help the agent read the service shelf, search the public ItPay service catalog, and choose a purchase option without guessing.",
   "when_to_use": [
     "The user describes a need but has not chosen a service.",
-    "The agent needs product and variant details before recommendation.",
+    "The agent needs service and purchase option details before recommendation.",
     "The agent needs to search standardized API products such as ItPay enterprise data APIs."
   ],
   "required_state": {
@@ -14,10 +14,15 @@
     "must_not_need": ["buyer login", "payment intent", "ops token"]
   },
   "commands": [
+    {
+      "intent": "inspect the service shelf before guessing keywords or facets",
+      "command": "itp buyer shelf manifest --json",
+      "success_signal": "response.snapshot_version and response.snapshot_url are present; use snapshot/delta when the agent needs a shopping-list view of available services"
+    },
     {
       "intent": "search public catalog by natural language query",
       "command": "itp buyer catalog search --query \"企业工商信息 查询\" --json",
-      "success_signal": "response.products contains variants with id, title, price, metadata"
+      "success_signal": "response.products contains services with purchase options, id, title, price, metadata, and response.catalog_guidance explains how to choose safely"
     },
     {
       "intent": "search API services by stable category and safe facets",
@@ -30,43 +35,45 @@
       "success_signal": "response.products includes the fuzzy enterprise search product before precise lookup"
     },
     {
-      "intent": "get exact product details for a selected variant",
+      "intent": "get exact service details for a selected purchase option",
       "command": "itp buyer catalog get --variant <variant_id> --json",
-      "success_signal": "response.selection.catalog_variant_id matches the selected variant"
-    },
-    {
-      "intent": "discover low-cost shelf sync endpoints for repeated reads",
-      "command": "itp buyer shelf manifest --json",
-      "success_signal": "response.snapshot_version and response.snapshot_url are present"
+      "success_signal": "response.selection.catalog_variant_id matches the selected purchase option and response.catalog_guidance says to explain before cart creation"
     }
   ],
   "agent_rules": [
+    "Terminology: product means 服务, variant means 购买选项, variant_id means 购买选项 ID, catalog means 服务目录, shelf means 目录清单.",
+    "Before searching, remember the local agent does not know the current service catalog. Use this doc and the shelf manifest/snapshot as the shopping-list view when keywords or facets are unclear.",
+    "Catalog search is structured ItPay catalog search, not general web search. Convert the user's request into query plus category/provider/use-case/input-facet filters.",
     "Full search is allowed for explicit user search, not as a polling loop.",
     "For repeated discovery, prefer shelf manifest/snapshot/delta.",
     "For API services, map user intent to category/facet filters before relying on keyword ranking.",
     "Use stable categories: business_data_api, business_verification_api, identity_verification_api, phone_verification_api, risk_compliance_api, location_weather_api, finance_data_api.",
     "Use safe facets such as --use-case, --input-facet, --output-facet, --sensitivity-level, --delivery-mode, and --provider.",
-    "Use product and variant metadata to explain options in user language.",
+    "Use service and purchase option metadata to explain options in user language.",
+    "If search returns zero products, do not invent a service or conclude too early. Loosen filters, change query terms, or go back to the shelf.",
+    "If search returns many products, narrow with category/provider/use-case/input-facet before recommending.",
+    "If search returns a small set, compare service description, price, required input, sensitivity level, and delivery mode.",
     "Money values from catalog JSON use minor units. For CNY, amount=10 means CNY 0.10, not CNY 10. Prefer display_amount when present, or divide amount/amount_minor by 100 before telling the user.",
     "For products with requires_human_input=true, do not ask for identity numbers or phone numbers in chat; rely on ItPay human authorization/input.",
-    "Do not create checkout until the user intent maps to one selected variant or the user confirms a cart."
+    "Selecting a service is not buying. Explain the selected service and purchase option to the human, then ask for confirmation before cart creation.",
+    "Do not create checkout until the user intent maps to one selected purchase option and the user confirms the purchase."
   ],
   "forbidden": [
     "Do not require login for discovery.",
-    "Do not invent catalog items or variant IDs.",
+    "Do not invent catalog items, services, purchase options, or variant IDs.",
     "Do not assume search result order means the user has approved purchase."
   ],
   "next_docs": [
     {
-      "condition": "Need to recommend among variants",
+      "condition": "Need to recommend among services or purchase options",
       "topic": "product-recommendation",
       "command": "itp docs show product-recommendation --role buyer --json"
     },
     {
-      "condition": "The user has chosen a variant",
+      "condition": "The user has chosen and confirmed a purchase option",
       "topic": "cart-checkout",
       "command": "itp docs show cart-checkout --role buyer --json"
     }
   ],
-  "search_terms": ["catalog", "search", "shelf", "product", "variant", "api", "enterprise_data", "category", "facet", "business_data_api", "企业查询", "工商信息", "企业工商数据精准查询", "企业工商数据模糊查询", "搜索", "商品"]
+  "search_terms": ["catalog", "search", "shelf", "product", "variant", "purchase option", "api", "enterprise_data", "category", "facet", "business_data_api", "企业查询", "工商信息", "企业工商数据精准查询", "企业工商数据模糊查询", "搜索", "商品", "服务目录", "目录清单", "购买选项"]
 }

package/docs/agent/buyer/human-claim-ui.json

@@ -30,6 +30,8 @@
     "The claim link is short-lived and single-use.",
     "The agent may explain that ItPay intentionally separates agent operations from raw secret access.",
     "If the human wants the agent to analyze or use the delivered result, ask them to click 'Give to Agent / 一键给 Agent' in the ItPay page and confirm with Passkey.",
+    "Use clear user guidance: open the ItPay email or order/claim page, find 'Give to Agent / 一键给 Agent', select the fields the agent may read, then confirm with Passkey/WebAuthn.",
+    "Tell the user they do not need to copy claim links, tokens, portal text, grant ids, or raw results into chat. The agent will discover the grant with CLI after approval.",
     "After the human grants access, the agent should discover the grant with `itp buyer vault grants list --checkout <checkout_id> --json`; do not ask the human to paste the grant id. The CLI restores the buyer agent session from the checkout auth handoff when possible.",
     "If `buyer vault grants list` returns buyer_session.status=buyer_session_saved, the agent should proceed with the returned grant list; the saved session is intentionally not printed.",
     "If the human later wants the agent to install or use something, wait for an explicit human-granted install/capability flow."

package/docs/agent/buyer/payment-qr.json

@@ -30,6 +30,7 @@
     "If human_action.kind is auth_qr, present the ItPay first-purchase entry URL/QR and explain it starts account login/registration/profile authorization and should continue to payment for the same checkout after approval.",
     "For auth_qr, the ItPay auth entry is the primary handoff. oauth_start_url is fallback/debug and should not replace the ItPay orchestration page.",
     "For auth_qr, do not call payment-intent creation directly or create a new checkout; poll checkout or run buyer checkout resume until payment_intent_id appears.",
+    "Payment QR display requires both a valid/saved buyer session and payment_intent_id. If payment_intent_id appears before buyer_session is saved, run buyer checkout resume/status instead of showing payment QR.",
     "Do not stop after showing auth_qr unless the human explicitly asks you to pause. Keep waiting/resuming the same checkout so the post-auth payment handoff can continue.",
     "Do not describe auth_qr as payment success or payment proof. Only payment_intent.verified proves payment.",
     "MUST show local_qr_path first when present. Many agent clients do not reliably render remote QR images; local_qr_path is the most reliable desktop/chat display artifact.",

package/docs/agent/buyer/payment-wait.json

@@ -27,9 +27,13 @@
     }
   ],
   "agent_rules": [
+    "Payment wait is a recovery loop around the same payment_intent_id, not a one-shot command.",
     "wait.timeout is a heartbeat, not a payment failure.",
-    "Continue waiting with the same payment_intent_id unless the command reaches its overall timeout or the user cancels.",
+    "Continue waiting with the same payment_intent_id unless the user explicitly cancels.",
+    "If the network drops, the process is interrupted, or there is no response, rerun payment wait with the same payment_intent_id or run checkout status/resume with the same checkout_id.",
+    "If status is unclear, tell the human it is unclear and continue querying the same payment_intent_id/checkout_id. Do not create a new checkout.",
     "Payment success is payment_intent.verified only.",
+    "Human text such as 'I paid' is not proof; continue waiting until payment_intent.verified.",
     "After verified, poll checkout or delivery status."
   ],
   "forbidden": [

package/docs/agent/buyer/qr-refresh.json

@@ -28,7 +28,9 @@
   "agent_rules": [
     "QR refresh is display recovery only. ItPay may return the same QR again when the current provider QR is still valid.",
     "Use the same payment_intent_id.",
+    "If QR does not render, first use the returned local_qr_path, qr_png_url, or preferred_qr_url. Do not generate a new QR from guessed provider payload.",
     "For Alipay sandbox order-not-found, first ask the human to wait and scan/open the same QR/page again; use refresh only after that wait has failed.",
+    "If refresh succeeds, show only the returned ItPay QR/display URL and continue waiting on the same payment_intent_id.",
     "After refresh, continue waiting through the normal wait contract."
   ],
   "forbidden": [

package/docs/agent/buyer/quickstart.json

@@ -17,7 +17,7 @@
     {
       "intent": "verify whether this agent/device already has a server-valid buyer session",
       "command": "itp status --refresh --json",
-      "success_signal": "response.status is idle when authenticated, or response.next.command tells the agent how to start human auth"
+      "success_signal": "response.status is idle when authenticated, or response.next.command tells the agent how to start human auth; if response.recoverable_context.found is true, compare it with the current user intent before continuing or ignoring it"
     },
     {
       "intent": "list the available agent docs topics",
@@ -27,7 +27,7 @@
     {
       "intent": "search the public catalog for the current user request",
       "command": "itp buyer catalog search --query \"<user request>\" --json",
-      "success_signal": "response.products contains public products and variants"
+      "success_signal": "response.products contains public services and purchase options; response.catalog_guidance tells the agent how to compare and when to ask the human"
     },
     {
       "intent": "search standardized API services with category/facet filters when intent is clear",
@@ -43,7 +43,9 @@
   "agent_rules": [
     "Use --json for every ItPay command.",
     "Use `itp status --refresh --json` before account, order, refund, or repeat-purchase decisions. Plain local memory is not identity.",
-    "Search and explain options before buying unless the user already named a variant.",
+    "If `status --refresh` returns `recoverable_context.found=true`, do not blindly resume or blindly ignore it. Decide whether the old task is related to the current user intent; continue related tasks, ignore clearly unrelated tasks, and ask the human when unsure.",
+    "If the catalog is unclear, read catalog-search docs and use buyer shelf manifest/snapshot as the shopping-list view before guessing keywords.",
+    "Search and explain purchase options before buying unless the user already named a purchase option ID.",
     "Add the selected UCP Variant.id to cart; do not bypass cart for CORE-028 flows.",
     "When explaining prices, remember ItPay JSON money fields use minor units. For CNY, amount=10 means CNY 0.10. Prefer display_amount when present.",
     "Before checkout, make sure a buyer delivery email is available. If no email is known from the current buyer context, ask the human for it before creating checkout.",

package/docs/agent/buyer/recovery.json

@@ -34,7 +34,10 @@
   "agent_rules": [
     "Prefer resume over creating a new checkout.",
     "A timeout does not prove failure.",
+    "Network failure, broken connection, no response, or interrupted agent run does not prove payment failure.",
     "Use the same checkout_id/cart_id/payment_intent_id whenever possible.",
+    "For payment recovery, first retry payment wait or checkout status/resume with the same IDs. Escalate to QR refresh only for display/scanner problems.",
+    "If payment status is unknown, say it is unknown and keep checking the same payment/checkout; do not guess paid/unpaid.",
     "Report safe error messages only."
   ],
   "forbidden": [

package/docs/agent/buyer/secure-delivery.json

@@ -35,7 +35,9 @@
     "Agent-visible status may say delivery_claimable/check_email/claim_link_sent.",
     "Raw protected content is human-first unless the human later shares it outside ItPay.",
     "If the user wants analysis, comparison, installation help, or structured use of the delivered result, you may ask the human to use the ItPay page's 'Give to Agent / 一键给 Agent' Passkey flow.",
+    "When guiding the human, be concrete: open the delivery email or ItPay order page, click Give to Agent / 一键给 Agent, choose fields, and confirm with Passkey/WebAuthn.",
     "If the human uses the portal's one-key agent authorization, discover the resulting grant with buyer vault commands; do not ask the human to paste content or grant IDs.",
+    "If no grant appears, explain that authorization may not be completed, may not have synced, may target a different checkout/order, or may have expired/revoked.",
     "Do not ask the human to paste the key into chat."
   ],
   "forbidden": [

package/docs/agent/buyer/vault-agent-read.json

@@ -41,7 +41,11 @@
     "If the response includes buyer_session.status=buyer_session_saved, continue directly to `buyer vault grants read <agent_read_grant_id> --json`; do not ask the human for session tokens, auth IDs, or grant IDs.",
     "Do not ask the human to copy or paste `agent_read_grant_id`; discover it with `buyer vault grants list`.",
     "If no grant is returned, tell the human to open their ItPay account portal, reveal with Passkey, choose fields, and confirm one-key agent authorization.",
+    "If no grant is returned, explain likely causes: the human has not authorized yet, selected the wrong order/page, authorization has not synced yet, checkout/order/artifact does not match, buyer session expired, or the grant expired/revoked.",
+    "When no grant is returned, retry the same checkout/order after a short wait before asking for reauthorization. Do not ask the human to copy grant ids or tokens.",
     "Use only fields returned in the grant view. Do not infer that unreturned fields are accessible.",
+    "When a grant view is returned, tell the user which fields are readable. If expires_at, ttl, or valid_until is present, tell the user the time limit; if no expiry is returned, say the response did not include an explicit expiry.",
+    "If the returned fields are not enough for the user's task, ask the human to reopen Give to Agent and add the needed fields. Do not ask them to paste the missing raw content.",
     "If the command still returns 401 or buyer_session_invalid after using `--checkout`, run `itp buyer checkout status <checkout_id> --json`, then retry `itp buyer vault grants list --checkout <checkout_id> --json`. Ask the human to reauthorize only if the checkout/auth handoff has expired."
   ],
   "forbidden": [

package/install.ps1

@@ -2,17 +2,21 @@ $ErrorActionPreference = "Stop"
 
 $SourceDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $ItpBin = Join-Path $SourceDir "bin\itp"
+$LibDir = Join-Path $SourceDir "lib"
 $SkillsDir = Join-Path $SourceDir "skills"
 $DocsDir = Join-Path $SourceDir "docs"
 $NodeModules = Join-Path $SourceDir "node_modules"
+$PackageFile = Join-Path $SourceDir "package.json"
 $Prefix = if ($env:ITP_PREFIX) { $env:ITP_PREFIX } else { Join-Path $HOME ".local" }
 $TargetDir = Join-Path $Prefix "bin"
 $TargetScript = Join-Path $TargetDir "itp.js"
 $TargetCmd = Join-Path $TargetDir "itp.cmd"
-$ModuleTarget = Join-Path $TargetDir "node_modules"
+$LibTarget = Join-Path $Prefix "lib"
+$ModuleTarget = Join-Path $Prefix "node_modules"
 $ShareTargetDir = Join-Path $Prefix "share\itpay_cli"
 $SkillsTarget = Join-Path $ShareTargetDir "skills"
 $DocsTarget = Join-Path $ShareTargetDir "docs"
+$PackageTarget = Join-Path $ShareTargetDir "package.json"
 
 if (!(Test-Path $ItpBin)) {
   throw "itp binary not found at $ItpBin"
@@ -20,24 +24,32 @@ if (!(Test-Path $ItpBin)) {
 
 New-Item -ItemType Directory -Force -Path $TargetDir | Out-Null
 Copy-Item -Force $ItpBin $TargetScript
+if (Test-Path $LibDir) {
+  if (Test-Path $LibTarget) {
+    Remove-Item -Recurse -Force $LibTarget
+  }
+  Copy-Item -Recurse -Force $LibDir $LibTarget
+}
 if (Test-Path $NodeModules) {
   if (Test-Path $ModuleTarget) {
     Remove-Item -Recurse -Force $ModuleTarget
   }
   Copy-Item -Recurse -Force $NodeModules $ModuleTarget
 }
+New-Item -ItemType Directory -Force -Path $ShareTargetDir | Out-Null
+if (Test-Path $PackageFile) {
+  Copy-Item -Force $PackageFile $PackageTarget
+}
 if (Test-Path $SkillsDir) {
   if (Test-Path $SkillsTarget) {
     Remove-Item -Recurse -Force $SkillsTarget
   }
-  New-Item -ItemType Directory -Force -Path $ShareTargetDir | Out-Null
   Copy-Item -Recurse -Force $SkillsDir $SkillsTarget
 }
 if (Test-Path $DocsDir) {
   if (Test-Path $DocsTarget) {
     Remove-Item -Recurse -Force $DocsTarget
   }
-  New-Item -ItemType Directory -Force -Path $ShareTargetDir | Out-Null
   Copy-Item -Recurse -Force $DocsDir $DocsTarget
 }
 Set-Content -Path $TargetCmd -Encoding ASCII -Value @"

package/install.sh

@@ -3,6 +3,7 @@ set -eu
 
 SOURCE_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 ITP_BIN="$SOURCE_DIR/bin/itp"
+LIB_DIR="$SOURCE_DIR/lib"
 SKILLS_DIR="$SOURCE_DIR/skills"
 DOCS_DIR="$SOURCE_DIR/docs"
 NODE_MODULES="$SOURCE_DIR/node_modules"
@@ -10,7 +11,9 @@ PREFIX="${ITP_PREFIX:-$HOME/.local}"
 TARGET_DIR="$PREFIX/bin"
 TARGET="$TARGET_DIR/itp"
 SHARE_TARGET_DIR="$PREFIX/share/itpay_cli"
-MODULE_TARGET="$TARGET_DIR/node_modules"
+LIB_TARGET="$PREFIX/lib"
+MODULE_TARGET="$PREFIX/node_modules"
+PACKAGE_FILE="$SOURCE_DIR/package.json"
 
 if [ ! -f "$ITP_BIN" ]; then
   echo "itp binary not found at $ITP_BIN" >&2
@@ -22,21 +25,31 @@ chmod +x "$ITP_BIN"
 cp "$ITP_BIN" "$TARGET"
 chmod +x "$TARGET"
 
+if [ -d "$LIB_DIR" ]; then
+  rm -rf "$LIB_TARGET"
+  cp -R "$LIB_DIR" "$LIB_TARGET"
+  find "$LIB_TARGET" -type f -exec chmod 0644 {} \;
+fi
+
 if [ -d "$NODE_MODULES" ]; then
   rm -rf "$MODULE_TARGET"
   cp -R "$NODE_MODULES" "$MODULE_TARGET"
 fi
 
+mkdir -p "$SHARE_TARGET_DIR"
+if [ -f "$PACKAGE_FILE" ]; then
+  cp "$PACKAGE_FILE" "$SHARE_TARGET_DIR/package.json"
+  chmod 0644 "$SHARE_TARGET_DIR/package.json"
+fi
+
 if [ -d "$SKILLS_DIR" ]; then
   rm -rf "$SHARE_TARGET_DIR/skills"
-  mkdir -p "$SHARE_TARGET_DIR"
   cp -R "$SKILLS_DIR" "$SHARE_TARGET_DIR/skills"
   find "$SHARE_TARGET_DIR/skills" -type f -exec chmod 0644 {} \;
 fi
 
 if [ -d "$DOCS_DIR" ]; then
   rm -rf "$SHARE_TARGET_DIR/docs"
-  mkdir -p "$SHARE_TARGET_DIR"
   cp -R "$DOCS_DIR" "$SHARE_TARGET_DIR/docs"
   find "$SHARE_TARGET_DIR/docs" -type f -exec chmod 0644 {} \;
 fi