@itpay/cli 0.2.16 → 2.0.0-rc.1

package/docs/agent/buyer/human-claim-ui.json

@@ -1,77 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "human-claim-ui",
-  "title": "Human Claim UI",
-  "purpose": "Explain the human-only claim page boundary to an agent.",
-  "when_to_use": [
-    "The human received a secure delivery email.",
-    "The user asks why the agent cannot see the key.",
-    "The delivery status says claim_link_sent or check_email."
-  ],
-  "required_state": {
-    "needs": [
-      "delivery status or human email"
-    ],
-    "must_not_need": [
-      "claim token in agent context",
-      "raw content in CLI output"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "show agent-safe delivery status only",
-      "command": "itp buyer deliveries list --checkout <checkout_id> --host <client> --json",
-      "success_signal": "response.secrets.raw_content_included == false"
-    },
-    {
-      "intent": "check whether the human has granted this agent a scoped view",
-      "command": "itp buyer vault grants list --checkout <checkout_id> --host <client> --json",
-      "success_signal": "count > 0 means the human approved agent-readable access for this exact agent device"
-    }
-  ],
-  "agent_rules": [
-    "The human claim page is for the human buyer, not the agent.",
-    "The claim link is short-lived and single-use.",
-    "The agent may explain that ItPay intentionally separates agent operations from raw secret access.",
-    "If the human wants the agent to analyze or use the delivered result, ask them to click 'Give to Agent / 一键给 Agent' in the ItPay page and confirm with Passkey.",
-    "Use clear user guidance: open the ItPay email or order/claim page, find 'Give to Agent / 一键给 Agent', select the fields the agent may read, then confirm with Passkey/WebAuthn.",
-    "Tell the user they do not need to copy claim links, tokens, portal text, grant ids, or raw results into chat. The agent will discover the grant with CLI after approval.",
-    "After the human grants access, the agent should discover the grant with `itp buyer vault grants list --checkout <checkout_id> --host <client> --json`; do not ask the human to paste the grant id. The CLI restores the buyer agent session from the checkout auth handoff when possible.",
-    "If `buyer vault grants list` returns buyer_session.status=buyer_session_saved, the agent should proceed with the returned grant list; the saved session is intentionally not printed.",
-    "If the human later wants the agent to install or use something, wait for an explicit human-granted install/capability flow."
-  ],
-  "forbidden": [
-    "Do not ask the human to paste the claim link or key into chat.",
-    "Do not fetch the claim page with CLI, curl, browser automation, or an agent tool.",
-    "Do not ask the human for auth session IDs, display tokens, buyer session tokens, or portal tokens.",
-    "Do not store raw content in local run files."
-  ],
-  "next_docs": [
-    {
-      "condition": "The human wants to view their account or other orders later",
-      "topic": "account-portal",
-      "command": "itp docs show account-portal --role buyer --json"
-    },
-    {
-      "condition": "The human approved agent-readable fields",
-      "topic": "vault-agent-read",
-      "command": "itp docs show vault-agent-read --role buyer --json"
-    },
-    {
-      "condition": "The user asks why this boundary exists",
-      "topic": "safety-policy",
-      "command": "itp docs show safety-policy --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "claim ui",
-    "claim page",
-    "human",
-    "single use",
-    "reveal",
-    "领取页",
-    "人类",
-    "查看密钥"
-  ]
-}

package/docs/agent/buyer/payment-qr.json

@@ -1,97 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "payment-qr",
-  "title": "Payment QR Display",
-  "purpose": "Teach the agent how to present ItPay-hosted human QR images without corrupting or replacing them.",
-  "when_to_use": [
-    "Checkout returns human_action.kind=auth_qr for the first-purchase auth-to-payment entry.",
-    "PaymentIntent has been created.",
-    "The CLI returned human_action.kind=payment_qr, qr_png_url, preferred_qr_url, or qr_image_url.",
-    "The human needs to scan with the payment provider."
-  ],
-  "required_state": {
-    "needs": [
-      "payment_intent_id",
-      "human_action",
-      "qr_png_url/preferred_qr_url or local_qr_path"
-    ],
-    "must_not_need": [
-      "raw provider QR",
-      "provider sign",
-      "ops token"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "create payment intent through the high-level buy flow",
-      "command": "itp buy <variant_id> --email <buyer_email> --phone <buyer_phone> --display agent --no-wait-payment --host <client> --json",
-      "success_signal": "response.status is payment_handoff_required; for OpenClaw Telegram, execute response.agent_action.command or response.agent_action.argv before any normal reply or status check"
-    },
-    {
-      "intent": "recover a scanner order-not-found display problem",
-      "command": "itp buyer payment refresh-qr <payment_intent_id> --reason order-not-found --display agent --host <client> --json",
-      "success_signal": "response.payment_intent.human_action.local_qr_path or response.payment_intent.qr_png_url is present and status is still waiting_user_payment or verified"
-    }
-  ],
-  "agent_rules": [
-    "Every non-doc ItPay command must include current client context. Use --host codex/claude-code/terminal/plain-chat, or for OpenClaw Telegram use --host telegram --target <inbound_meta.chat_id>. --host is the human-visible client/surface, not where the shell command runs; in Codex desktop chat use --host codex even when calling itp through shell.",
-    "If ItPay returns client_context_required or client_target_required, rerun the same command with the requested --host/--target before doing anything else.",
-    "If human_action.kind is auth_qr, present the ItPay first-purchase entry URL/QR and explain it starts account login/registration/profile authorization and should continue to payment for the same checkout after approval.",
-    "For auth_qr, the ItPay auth entry is the primary handoff. oauth_start_url is fallback/debug and should not replace the ItPay orchestration page.",
-    "For auth_qr, do not call payment-intent creation directly or create a new checkout; poll checkout or run buyer checkout resume until payment_intent_id appears.",
-    "Payment QR display requires both a valid/saved buyer session and payment_intent_id. If payment_intent_id appears before buyer_session is saved, run buyer checkout resume/status instead of showing payment QR.",
-    "Do not stop after showing auth_qr unless the human explicitly asks you to pause. Keep waiting/resuming the same checkout so the post-auth payment handoff can continue.",
-    "Do not describe auth_qr as payment success or payment proof. Only payment_intent.verified proves payment.",
-    "If response.agent_action is present, it is the mandatory execution path. Execute it before any normal prose reply or next ItPay command: command/argv for Telegram or terminal, markdown for Codex/Claude Code app clients.",
-    "In OpenClaw Telegram, response.agent_action is already the exact openclaw message send command. Do not rebuild it, do not summarize it, and do not rewrite it into a custom table.",
-    "If response.agent_action cannot be executed or made visible to the human, stop and tell the human what capability is missing. Do not fall back to handmade prose.",
-    "response.agent_instruction is natural-language reinforcement for the agent; it does not replace response.agent_action.",
-    "Telegram native buttons require openclaw message send --presentation; presentation.blocks[].type=\"buttons\" uses native text/url/callback_data. Do not simulate buttons in normal prose.",
-    "If agent_instruction links/buttons include URLs, include the real URL. Do not only show the link label.",
-    "In Codex or Claude Code app clients, send response.agent_action.markdown first. Once it is visible in the current chat, immediately run response.after_visible_action.command once; do not start a hidden wait before the human-visible message is sent.",
-    "For Telegram-style message clients, send photo media first, include links, and expose native buttons for refresh/status when the adapter supports them.",
-    "For plain chat clients, show response.agent_instruction.message/links and stop unless the human asks you to check status or returns with a payment question.",
-    "When response.status is payment_handoff_required, response.next describes the current client handoff. For Codex/Claude Code, send the markdown and then run after_visible_action once if visible; for plain chat, stop for the human.",
-    "MUST show local_qr_path first when present. Many agent clients do not reliably render remote QR images; local_qr_path is the most reliable desktop/chat display artifact.",
-    "If local_qr_path is not present, show qr_png_url or preferred_qr_url as the primary scannable QR. This is an ItPay-hosted human QR image; it may render the native provider payment code for scanner reliability, but the agent must not request or decode the raw provider payload.",
-    "Use qr_image_url/SVG only as a fallback when PNG/local rendering is unavailable.",
-    "For mobile users, present mobile_wallet_url as a clickable payment button when present.",
-    "payment_entry_url is the stable ItPay status/payment page. qr_png_url/local_qr_path is usually the better desktop scanner artifact.",
-    "The provider can briefly show order not found even after precreate succeeded. Tell the human to wait 30-60 seconds and retry the same QR/page. Do not create a new checkout, do not create a new payment intent, and do not repeatedly refresh unless the ItPay page or CLI explicitly asks for recovery.",
-    "Opening the payment page must not be treated as paid.",
-    "Do not run payment wait before the QR/link has been sent to the human. If response.after_visible_action.command exists and you can confirm the handoff is visible, run it once by default; if unsure, stop and wait for the human.",
-    "If response.after_visible_action was not run, or after the human says they paid/clicks a platform status button later, run response.after_human_response.check_payment_command for the same payment_intent_id."
-  ],
-  "forbidden": [
-    "Do not encode payment_entry_url into a new QR yourself when qr_png_url/local_qr_path is available.",
-    "Do not encode mobile_wallet_url into a new QR yourself.",
-    "Do not request or display raw provider QR payloads.",
-    "Do not bypass the ItPay auth orchestration page by making oauth_start_url the primary user-facing link.",
-    "Do not rewrite, shorten, summarize, or translate QR URLs.",
-    "Do not expose raw provider QR payload in chat.",
-    "Do not treat QR display as payment success."
-  ],
-  "next_docs": [
-    {
-      "condition": "QR is visible to the human",
-      "topic": "payment-wait",
-      "command": "itp docs show payment-wait --role buyer --json"
-    },
-    {
-      "condition": "the payment provider says order not found after waiting on the same QR/page",
-      "topic": "qr-refresh",
-      "command": "itp docs show qr-refresh --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "qr",
-    "payment qr",
-    "alipay",
-    "scan",
-    "order not found",
-    "二维码",
-    "扫码",
-    "付款码"
-  ]
-}

package/docs/agent/buyer/payment-wait.json

@@ -1,84 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "payment-wait",
-  "title": "Payment Wait Contract",
-  "purpose": "Teach the agent to wait for human payment through the ItPay event wait contract instead of sleeping or guessing.",
-  "when_to_use": [
-    "The human is scanning or paying.",
-    "PaymentIntent status is waiting_user_payment.",
-    "The CLI returned agent_wait metadata."
-  ],
-  "required_state": {
-    "needs": [
-      "payment_intent_id"
-    ],
-    "optional": [
-      "cursor"
-    ],
-    "must_not_need": [
-      "ops token",
-      "provider query permission",
-      "human text proof"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "wait for payment verified event",
-      "command": "itp buyer payment wait <payment_intent_id> --timeout 1 --host <client> --json",
-      "success_signal": "response.payment_event.event_type is payment_intent.verified or wait.timeout"
-    },
-    {
-      "intent": "resume checkout after verified event",
-      "command": "itp buyer checkout status <checkout_id> --host <client> --json",
-      "success_signal": "response.delivery.status or response.checkout.status is returned"
-    }
-  ],
-  "agent_rules": [
-    "Every payment wait/status command must include the same client context as the handoff command. For OpenClaw Telegram, keep --host telegram --target <same chat_id>.",
-    "If payment wait returns payment_handoff_required with response.agent_action, execute it before any later status check: command/argv for Telegram or terminal, markdown for Codex/Claude Code app clients. If only response.agent_instruction is present, follow it exactly before any later status check.",
-    "Start payment status checks only after the QR image/link has already been sent to the human. In Codex/Claude Code app clients, after_visible_action.command is the default one-round status check once the handoff is visible.",
-    "If you run payment wait without a short timeout while payment is still pending, CLI returns payment_handoff_required and the human handoff instruction instead of long-polling.",
-    "Payment wait/status check is a recovery loop around the same payment_intent_id, not a one-shot command.",
-    "wait.timeout is a heartbeat, not a payment failure.",
-    "In Codex or Claude Code app clients, after showing QR and confirming it is visible, run after_visible_action.command once. If it times out, explain that the same QR/link remains valid and pause for the human or continue only if they ask.",
-    "Continue checking the same payment_intent_id unless the user explicitly cancels or asks you to pause.",
-    "If the network drops, the process is interrupted, or there is no response, rerun payment wait with the same payment_intent_id or run checkout status/resume with the same checkout_id.",
-    "If status is unclear, tell the human it is unclear and continue querying the same payment_intent_id/checkout_id. Do not create a new checkout.",
-    "Payment success is payment_intent.verified only.",
-    "Human text such as 'I paid' is not proof; continue waiting until payment_intent.verified.",
-    "After verified, poll checkout or delivery status."
-  ],
-  "forbidden": [
-    "Do not accept 'I paid' as proof.",
-    "Do not run provider query recovery from buyer flow.",
-    "Do not create a duplicate checkout merely because one wait cycle timed out.",
-    "Do not call worker run-once."
-  ],
-  "next_docs": [
-    {
-      "condition": "payment_intent.verified received",
-      "topic": "secure-delivery",
-      "command": "itp docs show secure-delivery --role buyer --json"
-    },
-    {
-      "condition": "wait timeout or interrupted agent run",
-      "topic": "recovery",
-      "command": "itp docs show recovery --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "wait",
-    "long poll",
-    "timeout",
-    "still waiting",
-    "paid",
-    "payment",
-    "等待",
-    "付款",
-    "付款成功",
-    "没返回",
-    "一直等",
-    "超时"
-  ]
-}

package/docs/agent/buyer/product-recommendation.json

@@ -1,80 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "product-recommendation",
-  "title": "Product Recommendation Rules",
-  "purpose": "Help the agent explain public product variants before checkout without overclaiming fulfillment or payment status.",
-  "when_to_use": [
-    "The user asks what to buy.",
-    "Catalog search returned multiple variants.",
-    "The user's request is fuzzy, such as company lookup, identity verification, phone verification, low budget, premium skin, or ten draw."
-  ],
-  "required_state": {
-    "needs": [
-      "catalog product or search result"
-    ],
-    "must_not_need": [
-      "buyer profile values",
-      "payment status",
-      "raw delivery content"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "refresh exact product detail before recommendation",
-      "command": "itp buyer catalog get --variant <variant_id> --host <client> --json",
-      "success_signal": "response.product.variants includes current price and availability"
-    }
-  ],
-  "agent_rules": [
-    "Map user intent to the variant description and price.",
-    "Catalog JSON money fields use minor units. For CNY, amount=10 means CNY 0.10 and amount=50 means CNY 0.50. Use display_amount when present, or divide by 100 before explaining price to the user.",
-    "For API products, explain what the API checks or returns, quota unit, sensitivity level, required human input, and whether Passkey/WebAuthn reveal is required.",
-    "If metadata says agent_may_view_raw_result=false, tell the user secure delivery/reveal is human-first and do not request the raw result.",
-    "For enterprise fuzzy search, tell the user the required input is a company keyword/short name/brand. The user can say something broad like 京东; the service is designed to return candidates.",
-    "For enterprise precise lookup, warn that the input must be the exact registered company name or unified social credit code. If the user is vague, use fuzzy search or other knowledge/search to lock the correct entity before checkout.",
-    "For enterprise precise lookup, examples of acceptable input are 北京京东世纪贸易有限公司 or a unified social credit code; examples of insufficient input are 京东, 那个京东商城, 大众知道那个京东.",
-    "For regulated_identity or personal_sensitive products, do not collect identity numbers or phone numbers in chat; direct the flow through ItPay human authorization/input.",
-    "For the CORE-028 PUBG sandbox pack: 20 CNY is low-cost couple skin, 40 CNY is premium skin, 288 CNY is ten-draw supply pack.",
-    "Tell the user the service is a sandbox test service when applicable.",
-    "Ask for confirmation before buying if the user's intent is ambiguous."
-  ],
-  "forbidden": [
-    "Do not promise real game delivery for a sandbox service.",
-    "Do not hide the price.",
-    "Do not choose a more expensive variant without a clear user signal."
-  ],
-  "next_docs": [
-    {
-      "condition": "User confirmed the variant",
-      "topic": "cart-checkout",
-      "command": "itp docs show cart-checkout --role buyer --json"
-    },
-    {
-      "condition": "Need to search again",
-      "topic": "catalog-search",
-      "command": "itp docs show catalog-search --role buyer --json"
-    },
-    {
-      "condition": "Need to know how to pass required API product input into cart",
-      "topic": "cart-checkout",
-      "command": "itp docs show cart-checkout --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "recommend",
-    "compare",
-    "which one",
-    "variant",
-    "option",
-    "api",
-    "sensitivity",
-    "quota",
-    "passkey",
-    "推荐",
-    "怎么选",
-    "区别",
-    "敏感等级",
-    "查询次数"
-  ]
-}

package/docs/agent/buyer/qr-refresh.json

@@ -1,67 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "qr-refresh",
-  "title": "QR Refresh Recovery",
-  "purpose": "Teach the agent how to recover scanner problems without changing payment truth or creating a second order.",
-  "when_to_use": [
-    "The human reports the payment provider says order not found after waiting 30-60 seconds on the same QR/page.",
-    "The QR expired or the wallet cannot load it.",
-    "The payment intent is still not verified."
-  ],
-  "required_state": {
-    "needs": [
-      "payment_intent_id"
-    ],
-    "must_not_need": [
-      "ops token",
-      "provider query",
-      "new checkout"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "ask ItPay for same-intent display recovery",
-      "command": "itp buyer payment refresh-qr <payment_intent_id> --reason order-not-found --host <client> --json",
-      "success_signal": "response.payment_intent.qr_png_url or response.payment_intent.qr_image_url is present"
-    },
-    {
-      "intent": "continue waiting after refresh",
-      "command": "itp buyer payment wait <payment_intent_id> --timeout 1 --host <client> --json",
-      "success_signal": "payment_event.event_type == payment_intent.verified"
-    }
-  ],
-  "agent_rules": [
-    "QR refresh is display recovery only. ItPay may return the same QR again when the current provider QR is still valid.",
-    "Use the same payment_intent_id.",
-    "If QR does not render, first use the returned local_qr_path, qr_png_url, or preferred_qr_url. Do not generate a new QR from guessed provider payload.",
-    "For provider order-not-found, first ask the human to wait and scan/open the same QR/page again; use refresh only after that wait has failed.",
-    "If refresh succeeds, show only the returned ItPay QR/display URL and continue waiting on the same payment_intent_id.",
-    "After refresh, continue waiting through the normal wait contract."
-  ],
-  "forbidden": [
-    "Do not treat refresh as paid.",
-    "Do not query Alipay from buyer flow.",
-    "Do not create a new checkout unless the user explicitly abandons the old one."
-  ],
-  "next_docs": [
-    {
-      "condition": "refreshed QR is visible",
-      "topic": "payment-wait",
-      "command": "itp docs show payment-wait --role buyer --json"
-    },
-    {
-      "condition": "refresh fails",
-      "topic": "recovery",
-      "command": "itp docs show recovery --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "refresh",
-    "order not found",
-    "expired qr",
-    "qr unavailable",
-    "刷新",
-    "订单不存在"
-  ]
-}

package/docs/agent/buyer/recovery.json

@@ -1,85 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "recovery",
-  "title": "Safe Recovery",
-  "purpose": "Teach the agent how to recover without duplicating orders or crossing into ops authority.",
-  "when_to_use": [
-    "A command timed out.",
-    "The agent lost local context.",
-    "The human reports QR scan trouble.",
-    "Checkout or delivery is pending."
-  ],
-  "required_state": {
-    "needs": [
-      "last known checkout_id, payment_intent_id, or variant_id"
-    ],
-    "must_not_need": [
-      "ops token",
-      "provider raw payload",
-      "claim token"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "resume checkout state",
-      "command": "itp buyer checkout resume <checkout_id> --host <client> --json",
-      "success_signal": "response.status and agent_next_actions describe the safe next action"
-    },
-    {
-      "intent": "wait again on the same payment intent",
-      "command": "itp buyer payment wait <payment_intent_id> --timeout 1 --host <client> --json",
-      "success_signal": "response.payment_event.event_type is payment_intent.verified or still waiting"
-    },
-    {
-      "intent": "refresh display QR only",
-      "command": "itp buyer payment refresh-qr <payment_intent_id> --reason order-not-found --host <client> --json",
-      "success_signal": "response.payment_intent.qr_image_url is present"
-    }
-  ],
-  "agent_rules": [
-    "Prefer resume over creating a new checkout.",
-    "A timeout does not prove failure.",
-    "Network failure, broken connection, no response, or interrupted agent run does not prove payment failure.",
-    "Use the same checkout_id/cart_id/payment_intent_id whenever possible.",
-    "For payment recovery, first retry payment wait or checkout status/resume with the same IDs. Escalate to QR refresh only for display/scanner problems.",
-    "If payment status is unknown, say it is unknown and keep checking the same payment/checkout; do not guess paid/unpaid.",
-    "Report safe error messages only."
-  ],
-  "forbidden": [
-    "Do not call ops sandbox worker or provider query from buyer flow.",
-    "Do not create duplicate checkout after transient wait timeout.",
-    "Do not ask the user to paste secrets, claim links, or raw provider data."
-  ],
-  "next_docs": [
-    {
-      "condition": "QR needs display refresh",
-      "topic": "qr-refresh",
-      "command": "itp docs show qr-refresh --role buyer --json"
-    },
-    {
-      "condition": "Payment still waiting",
-      "topic": "payment-wait",
-      "command": "itp docs show payment-wait --role buyer --json"
-    },
-    {
-      "condition": "Delivery is claimable",
-      "topic": "secure-delivery",
-      "command": "itp docs show secure-delivery --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "recover",
-    "resume",
-    "timeout",
-    "lost",
-    "retry",
-    "stuck",
-    "恢复",
-    "重试",
-    "卡住",
-    "没返回",
-    "断了",
-    "找不到"
-  ]
-}

package/docs/agent/buyer/safety-policy.json

@@ -1,70 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "safety-policy",
-  "title": "Buyer Agent Safety Policy",
-  "purpose": "Define the non-negotiable safety rules for ItPay buyer agents.",
-  "when_to_use": [
-    "The agent is unsure whether a command or data access is allowed.",
-    "The user asks the agent to reveal, fetch, or paste protected content.",
-    "The agent is deciding between buyer and ops commands."
-  ],
-  "required_state": {
-    "needs": [
-      "role=buyer"
-    ],
-    "must_not_need": [
-      "ops token",
-      "raw secret access"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "read this safety policy",
-      "command": "itp docs show safety-policy --role buyer --json",
-      "success_signal": "forbidden list is present"
-    },
-    {
-      "intent": "return to quickstart after safety check",
-      "command": "itp docs show quickstart --role buyer --json",
-      "success_signal": "quickstart topic is returned"
-    }
-  ],
-  "agent_rules": [
-    "Buyer agent authority is public discovery, cart/checkout creation, QR presentation, payment wait, and redacted delivery status.",
-    "Payment success must be verified by ItPay, not by user text or local inference.",
-    "Secure delivery is human-first.",
-    "If a request requires raw secret access, explain that ItPay blocks agent access by design."
-  ],
-  "forbidden": [
-    "No ops token in buyer flow.",
-    "No worker run-once in buyer flow.",
-    "No provider query recovery in buyer flow.",
-    "No fixture evidence route.",
-    "No raw key, redeem code, claim token, claim URL, storage ref, provider raw payload, buyer profile value, or session token in chat.",
-    "No QR URL rewriting.",
-    "No fake/mock/offline payment unless the user explicitly asks for offline simulation."
-  ],
-  "next_docs": [
-    {
-      "condition": "Need the normal flow",
-      "topic": "quickstart",
-      "command": "itp docs show quickstart --role buyer --json"
-    },
-    {
-      "condition": "Need delivery boundary details",
-      "topic": "secure-delivery",
-      "command": "itp docs show secure-delivery --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "policy",
-    "forbidden",
-    "security",
-    "secret",
-    "ops",
-    "安全",
-    "禁止",
-    "权限"
-  ]
-}

package/docs/agent/buyer/secure-delivery.json

@@ -1,90 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "secure-delivery",
-  "title": "Secure Delivery Status",
-  "purpose": "Teach the agent how to handle ItPay secure delivery without seeing protected content.",
-  "when_to_use": [
-    "Payment was verified.",
-    "Checkout status mentions delivery_claimable, check_email, or claim_link_sent.",
-    "The user asks where the purchased key/content is."
-  ],
-  "required_state": {
-    "needs": [
-      "checkout_id"
-    ],
-    "must_not_need": [
-      "claim token",
-      "claim link",
-      "raw key",
-      "storage ref"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "check redacted delivery status",
-      "command": "itp buyer checkout status <checkout_id> --host <client> --json",
-      "success_signal": "delivery.sensitive_content_redacted == true"
-    },
-    {
-      "intent": "list agent-safe delivery state",
-      "command": "itp buyer deliveries list --checkout <checkout_id> --host <client> --json",
-      "success_signal": "response.deliveries contains no raw content or claim token"
-    },
-    {
-      "intent": "after the human says they granted agent access, discover the current agent's grants",
-      "command": "itp buyer vault grants list --checkout <checkout_id> --host <client> --json",
-      "success_signal": "response.agent_readable_grants contains only grants for this exact agent device"
-    }
-  ],
-  "agent_rules": [
-    "Tell the human to check email or the ItPay human claim UI.",
-    "Agent-visible status may say delivery_claimable/check_email/claim_link_sent.",
-    "Raw protected content is human-first unless the human later shares it outside ItPay.",
-    "If the user wants analysis, comparison, installation help, or structured use of the delivered result, you may ask the human to use the ItPay page's 'Give to Agent / 一键给 Agent' Passkey flow.",
-    "When guiding the human, be concrete: open the delivery email or ItPay order page, click Give to Agent / 一键给 Agent, choose fields, and confirm with Passkey/WebAuthn.",
-    "If the human uses the portal's one-key agent authorization, discover the resulting grant with buyer vault commands; do not ask the human to paste content or grant IDs.",
-    "If no grant appears, explain that authorization may not be completed, may not have synced, may target a different checkout/order, or may have expired/revoked.",
-    "Do not ask the human to paste the key into chat."
-  ],
-  "forbidden": [
-    "Do not call the secure claim URL as an agent API.",
-    "Do not request or print claim token, claim URL, raw key, redeem code, or storage ref.",
-    "Do not scrape the human claim UI.",
-    "Do not claim installation is complete unless a later human-granted install flow says so."
-  ],
-  "next_docs": [
-    {
-      "condition": "Human asks what the claim page is",
-      "topic": "human-claim-ui",
-      "command": "itp docs show human-claim-ui --role buyer --json"
-    },
-    {
-      "condition": "Human asks to view account or order history",
-      "topic": "account-portal",
-      "command": "itp docs show account-portal --role buyer --json"
-    },
-    {
-      "condition": "Human says they approved agent access with Passkey",
-      "topic": "vault-agent-read",
-      "command": "itp docs show vault-agent-read --role buyer --json"
-    },
-    {
-      "condition": "Delivery is not ready yet",
-      "topic": "recovery",
-      "command": "itp docs show recovery --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "delivery",
-    "claim",
-    "email",
-    "key",
-    "redeem",
-    "secure delivery",
-    "交付",
-    "邮件",
-    "领取",
-    "密钥"
-  ]
-}