@itpay/cli 0.2.17 → 2.0.0-rc.1

package/docs/agent/buyer/vault-agent-read.json

@@ -1,95 +0,0 @@
-{
-  "schema_version": "itp.agent_doc.v1",
-  "role": "buyer",
-  "topic": "vault-agent-read",
-  "title": "Human-Approved Vault Agent Read",
-  "purpose": "Teach the agent how to read only the artifact fields that the human explicitly approved with Passkey.",
-  "when_to_use": [
-    "The human opened the ItPay account portal and selected one-key agent authorization.",
-    "The user asks whether the agent can now see a purchased report or selected fields.",
-    "A checkout/order has delivered a vault artifact and the human granted agent-readable access."
-  ],
-  "required_state": {
-    "needs": [
-      "checkout_id or authenticated buyer account session",
-      "current agent device binding",
-      "order_id or checkout_id or vault_artifact_id"
-    ],
-    "must_not_need": [
-      "human portal token",
-      "claim token",
-      "passkey credential",
-      "raw protected payload",
-      "grant id copied by the human"
-    ]
-  },
-  "commands": [
-    {
-      "intent": "check whether this agent has active human-approved grants for a checkout",
-      "command": "itp buyer vault grants list --checkout <checkout_id> --host <client> --json",
-      "success_signal": "response.agent_readable_grants is an array; count > 0 means the human has granted this exact agent access"
-    },
-    {
-      "intent": "check whether this agent has active human-approved grants for one order or artifact",
-      "command": "itp buyer vault grants list --order <order_id> --artifact <vault_artifact_id> --host <client> --json",
-      "success_signal": "only grants scoped to this logged-in agent device are returned"
-    },
-    {
-      "intent": "read a discovered grant view",
-      "command": "itp buyer vault grants read <agent_read_grant_id> --host <client> --json",
-      "success_signal": "response.grant contains selected_fields, structured_view, or summary according to the human-approved scope"
-    },
-    {
-      "intent": "convenience read by order/artifact without asking the human for grant id",
-      "command": "itp buyer vault read --order <order_id> --artifact <vault_artifact_id> --host <client> --json",
-      "success_signal": "the CLI discovers the active grant and reads its scoped view"
-    }
-  ],
-  "agent_rules": [
-    "Only read through `buyer vault` commands after the human has explicitly approved the agent grant in the ItPay portal.",
-    "Prefer `itp buyer vault grants list --checkout <checkout_id> --host <client> --json`; the CLI can automatically restore the buyer agent session from the checkout auth handoff when possible.",
-    "If the response includes buyer_session.status=buyer_session_saved, continue directly to `buyer vault grants read <agent_read_grant_id> --host <client> --json`; do not ask the human for session tokens, auth IDs, or grant IDs.",
-    "Do not ask the human to copy or paste `agent_read_grant_id`; discover it with `buyer vault grants list`.",
-    "If no grant is returned, tell the human to open their ItPay account portal, reveal with Passkey, choose fields, and confirm one-key agent authorization.",
-    "If no grant is returned, explain likely causes: the human has not authorized yet, selected the wrong order/page, authorization has not synced yet, checkout/order/artifact does not match, buyer session expired, or the grant expired/revoked.",
-    "When no grant is returned, retry the same checkout/order after a short wait before asking for reauthorization. Do not ask the human to copy grant ids or tokens.",
-    "Use only fields returned in the grant view. Do not infer that unreturned fields are accessible.",
-    "When a grant view is returned, tell the user which fields are readable. If expires_at, ttl, or valid_until is present, tell the user the time limit; if no expiry is returned, say the response did not include an explicit expiry.",
-    "If the returned fields are not enough for the user's task, ask the human to reopen Give to Agent and add the needed fields. Do not ask them to paste the missing raw content.",
-    "If the command still returns 401 or buyer_session_invalid after using `--checkout`, run `itp buyer checkout status <checkout_id> --host <client> --json`, then retry `itp buyer vault grants list --checkout <checkout_id> --host <client> --json`. Ask the human to reauthorize only if the checkout/auth handoff has expired."
-  ],
-  "forbidden": [
-    "Do not open, click through, scrape, or automate the human web UI yourself.",
-    "Do not open, scrape, or screenshot the human portal to obtain protected content.",
-    "Do not request passkey credentials, portal tokens, claim links, claim tokens, auth session IDs, display tokens, session tokens, storage refs, provider AppCode, provider keys, or raw payloads.",
-    "Do not use another agent's grant id. Grants are scoped to the exact buyer account session and agent device.",
-    "Do not cache selected fields beyond the task context unless the user explicitly asks you to create a local artifact."
-  ],
-  "next_docs": [
-    {
-      "condition": "The human needs a portal link to grant access",
-      "topic": "account-portal",
-      "command": "itp docs show account-portal --role buyer --json"
-    },
-    {
-      "condition": "The order was delivered but no grant exists",
-      "topic": "secure-delivery",
-      "command": "itp docs show secure-delivery --role buyer --json"
-    },
-    {
-      "condition": "The agent is unsure what it may read",
-      "topic": "safety-policy",
-      "command": "itp docs show safety-policy --role buyer --json"
-    }
-  ],
-  "search_terms": [
-    "vault",
-    "agent read",
-    "passkey grant",
-    "one key agent",
-    "授权给 agent",
-    "可读授权",
-    "字段授权",
-    "查看报告"
-  ]
-}

package/install.ps1

@@ -1,65 +0,0 @@
-$ErrorActionPreference = "Stop"
-
-$SourceDir = Split-Path -Parent $MyInvocation.MyCommand.Path
-$ItpBin = Join-Path $SourceDir "bin\itp"
-$LibDir = Join-Path $SourceDir "lib"
-$SkillsDir = Join-Path $SourceDir "skills"
-$DocsDir = Join-Path $SourceDir "docs"
-$NodeModules = Join-Path $SourceDir "node_modules"
-$PackageFile = Join-Path $SourceDir "package.json"
-$Prefix = if ($env:ITP_PREFIX) { $env:ITP_PREFIX } else { Join-Path $HOME ".local" }
-$TargetDir = Join-Path $Prefix "bin"
-$TargetScript = Join-Path $TargetDir "itp.js"
-$TargetCmd = Join-Path $TargetDir "itp.cmd"
-$LibTarget = Join-Path $Prefix "lib"
-$ModuleTarget = Join-Path $Prefix "node_modules"
-$ShareTargetDir = Join-Path $Prefix "share\itpay_cli"
-$SkillsTarget = Join-Path $ShareTargetDir "skills"
-$DocsTarget = Join-Path $ShareTargetDir "docs"
-$PackageTarget = Join-Path $ShareTargetDir "package.json"
-
-if (!(Test-Path $ItpBin)) {
-  throw "itp binary not found at $ItpBin"
-}
-
-New-Item -ItemType Directory -Force -Path $TargetDir | Out-Null
-Copy-Item -Force $ItpBin $TargetScript
-if (Test-Path $LibDir) {
-  if (Test-Path $LibTarget) {
-    Remove-Item -Recurse -Force $LibTarget
-  }
-  Copy-Item -Recurse -Force $LibDir $LibTarget
-}
-if (Test-Path $NodeModules) {
-  if (Test-Path $ModuleTarget) {
-    Remove-Item -Recurse -Force $ModuleTarget
-  }
-  Copy-Item -Recurse -Force $NodeModules $ModuleTarget
-}
-New-Item -ItemType Directory -Force -Path $ShareTargetDir | Out-Null
-if (Test-Path $PackageFile) {
-  Copy-Item -Force $PackageFile $PackageTarget
-}
-if (Test-Path $SkillsDir) {
-  if (Test-Path $SkillsTarget) {
-    Remove-Item -Recurse -Force $SkillsTarget
-  }
-  Copy-Item -Recurse -Force $SkillsDir $SkillsTarget
-}
-if (Test-Path $DocsDir) {
-  if (Test-Path $DocsTarget) {
-    Remove-Item -Recurse -Force $DocsTarget
-  }
-  Copy-Item -Recurse -Force $DocsDir $DocsTarget
-}
-Set-Content -Path $TargetCmd -Encoding ASCII -Value @"
-@echo off
-node "%~dp0itp.js" %*
-"@
-
-Write-Output "Installed itp to $TargetCmd"
-if (($env:Path -split ';') -notcontains $TargetDir) {
-  Write-Output "Add $TargetDir to PATH before running itp."
-} else {
-  & $TargetCmd --version
-}

package/install.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env sh
-set -eu
-
-SOURCE_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
-ITP_BIN="$SOURCE_DIR/bin/itp"
-LIB_DIR="$SOURCE_DIR/lib"
-SKILLS_DIR="$SOURCE_DIR/skills"
-DOCS_DIR="$SOURCE_DIR/docs"
-NODE_MODULES="$SOURCE_DIR/node_modules"
-PREFIX="${ITP_PREFIX:-$HOME/.local}"
-TARGET_DIR="$PREFIX/bin"
-TARGET="$TARGET_DIR/itp"
-SHARE_TARGET_DIR="$PREFIX/share/itpay_cli"
-LIB_TARGET="$PREFIX/lib"
-MODULE_TARGET="$PREFIX/node_modules"
-PACKAGE_FILE="$SOURCE_DIR/package.json"
-
-if [ ! -f "$ITP_BIN" ]; then
-  echo "itp binary not found at $ITP_BIN" >&2
-  exit 1
-fi
-
-mkdir -p "$TARGET_DIR"
-chmod +x "$ITP_BIN"
-cp "$ITP_BIN" "$TARGET"
-chmod +x "$TARGET"
-
-if [ -d "$LIB_DIR" ]; then
-  rm -rf "$LIB_TARGET"
-  cp -R "$LIB_DIR" "$LIB_TARGET"
-  find "$LIB_TARGET" -type f -exec chmod 0644 {} \;
-fi
-
-if [ -d "$NODE_MODULES" ]; then
-  rm -rf "$MODULE_TARGET"
-  cp -R "$NODE_MODULES" "$MODULE_TARGET"
-fi
-
-mkdir -p "$SHARE_TARGET_DIR"
-if [ -f "$PACKAGE_FILE" ]; then
-  cp "$PACKAGE_FILE" "$SHARE_TARGET_DIR/package.json"
-  chmod 0644 "$SHARE_TARGET_DIR/package.json"
-fi
-
-if [ -d "$SKILLS_DIR" ]; then
-  rm -rf "$SHARE_TARGET_DIR/skills"
-  cp -R "$SKILLS_DIR" "$SHARE_TARGET_DIR/skills"
-  find "$SHARE_TARGET_DIR/skills" -type f -exec chmod 0644 {} \;
-fi
-
-if [ -d "$DOCS_DIR" ]; then
-  rm -rf "$SHARE_TARGET_DIR/docs"
-  cp -R "$DOCS_DIR" "$SHARE_TARGET_DIR/docs"
-  find "$SHARE_TARGET_DIR/docs" -type f -exec chmod 0644 {} \;
-fi
-
-case ":$PATH:" in
-  *":$TARGET_DIR:"*) ;;
-  *)
-    echo "Installed itp to $TARGET"
-    echo "Add $TARGET_DIR to PATH before running itp."
-    exit 0
-    ;;
-esac
-
-"$TARGET" --version

package/lib/account-status.js

@@ -1,157 +0,0 @@
-import { coreApi } from "./http.js";
-import { noRecoverableContext } from "./buyer.js";
-import { cliCommand, output, readConfig, readCredentials, readSessionToken, safeErrorMessage } from "./env.js";
-
-async function accountOverviewStatus(flags = {}) {
-  const config = readConfig();
-  const credentials = readCredentials();
-  const hasLocalSession = Boolean(readSessionToken(credentials) || flags.access_token);
-  const base = {
-    schema_version: "itp.agent.v1",
-    status: hasLocalSession ? "account_status_unavailable" : "unauthenticated",
-    phase: hasLocalSession ? "account_status_unavailable" : "unauthenticated",
-    authenticated: false,
-    session_verified: !hasLocalSession,
-    auth_source: hasLocalSession ? "local_files_unverified" : "local_files",
-    account_id: config.account_id || null,
-    buyer_account_id: config.account_id || null,
-    device_id: config.device_id || null,
-    agent_device_id: config.device_id || null,
-    linked_providers: [],
-    order_count: 0,
-    created_at: null,
-    device: config.device_id ? { agent_device_id: config.device_id } : null,
-    next: hasLocalSession
-      ? { type: "retry_status", command: cliCommand("status", "--json"), safe_for_agent: true }
-      : { type: "start_auth", command: cliCommand("setup", "--plan", "credit-300", "--method", "alipay", "--json"), safe_for_agent: true },
-    recoverable_context: noRecoverableContext(),
-    agent_next_actions: hasLocalSession
-      ? ["run_status_refresh", "view_orders", "create_refund_if_needed", "list_agent_read_grants"]
-      : ["start_human_auth_if_unauthenticated"],
-    secrets: { raw_key_included: false, session_token_included: false }
-  };
-  if (!hasLocalSession) return base;
-
-  try {
-    const me = await coreApi("/v1/me", { method: "GET" }, flags);
-    const authenticated = Boolean(me.authenticated);
-    const accountID = me.buyer_account_id || config.account_id || null;
-    const deviceID = me.agent_device_id || me.device?.agent_device_id || config.device_id || null;
-    return {
-      ...base,
-      status: authenticated ? "idle" : "unauthenticated",
-      phase: authenticated ? "idle" : "unauthenticated",
-      authenticated,
-      session_verified: true,
-      auth_source: "core",
-      account_id: accountID,
-      buyer_account_id: accountID,
-      device_id: deviceID,
-      agent_device_id: deviceID,
-      linked_providers: Array.isArray(me.linked_providers) ? me.linked_providers : [],
-      order_count: Number.isFinite(Number(me.order_count)) ? Number(me.order_count) : 0,
-      created_at: me.created_at || null,
-      device: me.device || (deviceID ? { agent_device_id: deviceID } : null),
-      next: authenticated
-        ? { type: "buyer_ready", command: cliCommand("buyer", "auth", "status", "--json"), safe_for_agent: true }
-        : base.next,
-      agent_next_actions: authenticated
-        ? ["search_catalog", "view_orders", "create_refund_if_needed", "list_agent_read_grants"]
-        : ["start_human_auth_if_unauthenticated"],
-      backend: {
-        environment: me.environment || null,
-        backend_version: me.backend_version || null
-      }
-    };
-  } catch (error) {
-    return {
-      ...base,
-      error: safeErrorMessage(error)
-    };
-  }
-}
-
-function outputAccountStatus(status, flags = {}) {
-  if (flags.json) {
-    output(status);
-    return;
-  }
-  console.log(formatStatusText(status));
-}
-
-function formatStatusText(status = {}) {
-  if (!status.authenticated) {
-    const lines = [
-      `Account:  ${status.account_id ? `${status.account_id} (unverified)` : "not signed in"}`,
-      "Linked:   -",
-      "Orders:   -",
-      `Device:   ${formatDeviceLine(status.device, status.device_id) || "-"}`
-    ];
-    if (status.error) lines.push(`Error:    ${status.error}`);
-    return lines.join("\n");
-  }
-  const linked = Array.isArray(status.linked_providers) && status.linked_providers.length
-    ? status.linked_providers.join(", ")
-    : "-";
-  return [
-    `Account:  ${status.buyer_account_id || status.account_id || "-"}`,
-    `Linked:   ${linked}`,
-    `Orders:   ${Number.isFinite(Number(status.order_count)) ? Number(status.order_count) : 0}`,
-    `Device:   ${formatDeviceLine(status.device, status.device_id) || "-"}`
-  ].join("\n");
-}
-
-function formatDeviceLine(device, fallbackID = "") {
-  const displayName = String(device?.display_name || "").trim();
-  const deviceID = String(device?.agent_device_id || fallbackID || "").trim();
-  const label = displayName || deviceID;
-  if (!label) return "";
-  const status = String(device?.status || "").trim();
-  return status ? `${label} (${status})` : label;
-}
-
-async function refreshBuyerSessionForStatus(flags = {}) {
-  const config = readConfig();
-  const credentials = readCredentials();
-  if (!readSessionToken(credentials)) {
-    return {
-      authenticated: false,
-      session_verified: true,
-      account_id: config.account_id || null,
-      device_id: config.device_id || null,
-      auth_source: "core_no_session"
-    };
-  }
-  try {
-    const status = await coreApi("/v1/me/auth/status", { method: "GET" }, flags);
-    return {
-      authenticated: true,
-      session_verified: true,
-      account_id: status.buyer_account_id || config.account_id || null,
-      device_id: config.device_id || null,
-      account_status: status.account_status || null,
-      auth_source: "core"
-    };
-  } catch (error) {
-    return {
-      authenticated: false,
-      session_verified: true,
-      account_id: config.account_id || null,
-      device_id: config.device_id || null,
-      auth_source: "core",
-      error: safeErrorMessage(error)
-    };
-  }
-}
-
-function nextActionForAuthStatus(auth = {}, flags = {}) {
-  if (auth.authenticated && auth.session_verified === false) {
-    return { type: "verify_buyer_session", command: cliCommand("status", "--refresh", "--json"), safe_for_agent: true };
-  }
-  if (auth.authenticated) {
-    return { type: "buyer_ready", command: cliCommand("buyer", "auth", "status", "--json"), safe_for_agent: true };
-  }
-  return { type: "start_auth", command: cliCommand("setup", "--plan", "credit-300", "--method", "alipay", "--json"), safe_for_agent: true };
-}
-
-export { accountOverviewStatus, outputAccountStatus, refreshBuyerSessionForStatus, nextActionForAuthStatus };