@itpay/cli 2.1.34 → 2.1.41

package/dist/src/state/client_context.js

@@ -64,8 +64,6 @@ export function defaultHostForAgentType(agentType) {
         return "plain-chat";
     if (normalized === "zcode")
         return "plain-chat";
-    if (normalized === "doubao-work")
-        return "plain-chat";
     if (normalized === "openclaw")
         return undefined;
     return "terminal";
@@ -79,73 +77,3 @@ export function validateContext(host, target) {
     }
     return undefined;
 }
-export function normalizeViewer(raw) {
-    const v = raw?.trim().toLowerCase();
-    if (v === "desktop" || v === "mobile")
-        return v;
-    return "unknown";
-}
-export function normalizeLocality(raw) {
-    const v = raw?.trim().toLowerCase();
-    if (v === "same_device" || v === "remote" || v === "cloud")
-        return v;
-    return "unknown";
-}
-// Conservative declared capability table per host. Terminal/desktop agent
-// hosts run where a human watches a screen and a system browser exists;
-// IM hosts can send links/buttons but cannot be assumed to open pages;
-// plain-chat surfaces get links and copyable entries only.
-export function hostCapabilities(host) {
-    switch (host) {
-        case "terminal":
-        case "codex":
-        case "claude-code":
-            return {
-                user_visible_browser: "unknown",
-                system_browser: "yes",
-                clickable_https: "yes",
-                image_visible: host === "terminal" ? "no" : "unknown",
-                native_url_button: "no",
-                user_visible_terminal: "yes",
-                other_device_scan: "yes",
-                send_message: "yes",
-            };
-        case "telegram":
-        case "feishu":
-        case "lark":
-            return {
-                user_visible_browser: "no",
-                system_browser: "no",
-                clickable_https: "yes",
-                image_visible: "yes",
-                native_url_button: "yes",
-                user_visible_terminal: "no",
-                other_device_scan: "unknown",
-                send_message: "yes",
-            };
-        case "discord":
-        case "whatsapp":
-            return {
-                user_visible_browser: "no",
-                system_browser: "no",
-                clickable_https: "yes",
-                image_visible: "yes",
-                native_url_button: "unknown",
-                user_visible_terminal: "no",
-                other_device_scan: "unknown",
-                send_message: "yes",
-            };
-        case "plain-chat":
-        default:
-            return {
-                user_visible_browser: "no",
-                system_browser: "unknown",
-                clickable_https: "yes",
-                image_visible: "no",
-                native_url_button: "unknown",
-                user_visible_terminal: "no",
-                other_device_scan: "unknown",
-                send_message: "yes",
-            };
-    }
-}

package/dist/src/state/config.js

@@ -1,9 +1,7 @@
-import { sellerSessionToken } from "./account_auth.js";
-// CLI configuration loader. Production defaults to app.itpay.ai; supported public overrides
-// are the official sandbox and dev Backends. Checkout
+// CLI configuration loader. Production defaults to app.itpay.ai; the only
+// allowed override is the official dev Backend. Checkout
 // display-token persistence belongs to the cart session file, protected with
 // owner-only permissions. Provider secrets are explicitly out of scope here.
-import { createHash } from "node:crypto";
 import { homedir } from "node:os";
 import { mkdirSync } from "node:fs";
 import { resolve } from "node:path";
@@ -14,13 +12,11 @@ import { DeviceAuthority } from "./device_authority.js";
 import { OperationJournal } from "./operation_journal.js";
 export const DEFAULT_BASE_URL = "https://app.itpay.ai";
 export const DEV_BASE_URL = "https://dev.itpay.ai";
-export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.34";
-export const API_CONTRACT_REVISION = "sha256:80d69dbad36debbe4bdfbe468127a934c87b657e7795f369bb04de54863da476";
+export const CLI_VERSION = "2.1.41";
+export const API_CONTRACT_REVISION = "sha256:b97025ee4e6f7539757d6aedbe193dd65b3a0f84f1111f678abb5e757065f888";
 const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
 const CART_SESSION_FILENAME = "cart.json";
 const OPERATION_JOURNAL_FILENAME = "operations.json";
-const TASK_JOURNAL_FILENAME = "tasks.json";
 export function cliDistribution(env = process.env) {
     if (env.ITPAY_DISTRIBUTION === "openclaw-skill-bundle")
         return "openclaw-skill-bundle";
@@ -31,7 +27,7 @@ export function cliDistribution(env = process.env) {
 export class BackendOverrideError extends Error {
     code = "backend_override_forbidden";
     constructor() {
-        super(`ITPAY_BACKEND_URL only supports ${DEFAULT_BASE_URL}, ${SANDBOX_BASE_URL}, or ${DEV_BASE_URL}`);
+        super(`ITPAY_BACKEND_URL only supports ${DEFAULT_BASE_URL} or ${DEV_BASE_URL}`);
         this.name = "BackendOverrideError";
     }
 }
@@ -39,34 +35,26 @@ export function resolveBackendURL(env = process.env) {
     const requested = env.ITPAY_BACKEND_URL?.trim();
     if (!requested || requested === DEFAULT_BASE_URL || requested === `${DEFAULT_BASE_URL}/`)
         return DEFAULT_BASE_URL;
-    if (requested === SANDBOX_BASE_URL || requested === `${SANDBOX_BASE_URL}/`)
-        return SANDBOX_BASE_URL;
     if (requested === DEV_BASE_URL || requested === `${DEV_BASE_URL}/`)
         return DEV_BASE_URL;
-    if (env.ITPAY_CLI_DEV === "1" && /^http:\/\/(localhost|127\.0\.0\.1):\d+\/?$/.test(requested))
-        return requested.replace(/\/$/, "");
     throw new BackendOverrideError();
 }
 export function qualifyBackendCommand(command, env = process.env) {
     const requested = env.ITPAY_BACKEND_URL?.trim();
-    if (!requested)
+    if (requested !== DEV_BASE_URL && requested !== `${DEV_BASE_URL}/`)
         return command;
-    const target = resolveBackendURL(env);
-    if (target === DEFAULT_BASE_URL)
+    if (!command.startsWith("itpay ") || command.startsWith(`ITPAY_BACKEND_URL=${DEV_BASE_URL} `))
         return command;
-    if (!command.startsWith("itpay ") || command.startsWith(`ITPAY_BACKEND_URL=${target} `))
-        return command;
-    return `ITPAY_BACKEND_URL=${target} ${command}`;
+    return `ITPAY_BACKEND_URL=${DEV_BASE_URL} ${command}`;
 }
 function stateFilename(filename, baseURL) {
-    if (baseURL === DEFAULT_BASE_URL)
+    if (baseURL !== DEV_BASE_URL)
         return filename;
-    const suffix = baseURL === SANDBOX_BASE_URL ? "sandbox" : baseURL === DEV_BASE_URL ? "dev" : `local-${createHash("sha256").update(baseURL).digest("hex").slice(0, 16)}`;
     const dot = filename.lastIndexOf(".");
-    return dot < 0 ? `${filename}.${suffix}` : `${filename.slice(0, dot)}.${suffix}${filename.slice(dot)}`;
+    return dot < 0 ? `${filename}.dev` : `${filename.slice(0, dot)}.dev${filename.slice(dot)}`;
 }
-export function stateDir(env = process.env) {
-    return env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), CART_SESSION_DEFAULT_DIR);
+function stateDir(env) {
+    return resolve(env.HOME || homedir(), CART_SESSION_DEFAULT_DIR);
 }
 export function cartSessionPath(env = process.env) {
     if (env.ITPAY_CART_SESSION_PATH) {
@@ -76,16 +64,6 @@ export function cartSessionPath(env = process.env) {
     mkdirSync(dir, { recursive: true });
     return resolve(dir, stateFilename(CART_SESSION_FILENAME, resolveBackendURL(env)));
 }
-// Task journal (AUTH04): paused Service Executions per backend, so a login
-// completion can resume the SAME task instead of guessing from the latest order.
-export function taskJournalPath(env = process.env) {
-    if (env.ITPAY_TASK_JOURNAL_PATH) {
-        return resolve(env.ITPAY_TASK_JOURNAL_PATH);
-    }
-    const dir = stateDir(env);
-    mkdirSync(dir, { recursive: true });
-    return resolve(dir, stateFilename(TASK_JOURNAL_FILENAME, resolveBackendURL(env)));
-}
 export function loadConfig(env = process.env) {
     const baseURL = resolveBackendURL(env);
     const bearerToken = env.ITPAY_BEARER_TOKEN || undefined;
@@ -96,7 +74,7 @@ export function loadConfig(env = process.env) {
     const ideImageDirOverride = env.ITPAY_IDE_IMAGE_DIR_OVERRIDE;
     return {
         baseURL,
-        environment: baseURL === DEFAULT_BASE_URL ? "production" : "development",
+        environment: baseURL === DEV_BASE_URL ? "development" : "production",
         ...(agentType ? { agentType } : {}),
         checkoutCurrency,
         idempotencyKey,
@@ -126,15 +104,7 @@ export function newBackendClient(config) {
             "X-ItPay-CLI-Version": CLI_VERSION,
             "X-ItPay-Contract-Revision": API_CONTRACT_REVISION,
         },
-        requestAuthorizer: (input) => {
-            if (/^\/v1\/(seller\/organizations(?:\/|\?|$)|library\/)/.test(input.path)) {
-                const token = config.bearerToken ?? sellerSessionToken(config.baseURL);
-                if (!token)
-                    throw new Error("Seller login required; run itpay sell auth login");
-                return Promise.resolve({ Authorization: `Bearer ${token}` });
-            }
-            return authority.authorizationHeaders(input);
-        },
+        requestAuthorizer: (input) => authority.authorizationHeaders(input),
         recoverAuthorization: () => authority.recoverAuthorization(),
     });
     return new BackendClient(http);

package/dist/src/state/device_authority.js

@@ -1,7 +1,8 @@
 import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
+import { homedir } from "node:os";
 import { dirname, resolve } from "node:path";
-const PROTECTED_PATHS = ["/v1/agent-device-account-bindings", "/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault", "/v1/rail/phone-links"];
+const PROTECTED_PATHS = ["/v1/carts", "/v1/service-executions", "/v1/agent-instances", "/v1/orders", "/v1/refunds", "/v1/me", "/v1/vault"];
 export class DeviceAuthority {
     baseURL;
     backendKey;
@@ -16,7 +17,7 @@ export class DeviceAuthority {
         this.backendKey = normalizeBackendKey(options.baseURL);
         this.requestedAgentType = options.requestedAgentType;
         this.compatibilityHeaders = options.compatibilityHeaders;
-        const root = resolve(stateDir(), "device");
+        const root = resolve(homedir(), ".itpay-v3", "device");
         this.statePath = options.statePath ?? resolve(root, "identity.json");
         this.privateKeyPath = options.privateKeyPath ?? resolve(root, "device-private.pem");
         this.fetchImpl = (options.fetchImpl ?? globalThis.fetch).bind(globalThis);
@@ -42,24 +43,21 @@ export class DeviceAuthority {
     }
     async ensureAuthorization() {
         if (!this.pending) {
-            this.pending = this.cachedAuthorization() ?? withFileLock(`${this.statePath}.lock`, () => this.prepareAuthorization());
-            this.pending = this.pending.finally(() => {
+            this.pending = withFileLock(`${this.statePath}.lock`, () => this.prepareAuthorization()).finally(() => {
                 this.pending = undefined;
             });
         }
         return this.pending;
     }
-    cachedAuthorization() {
-        const agentType = this.requestedAgentType;
-        if (!agentType)
-            return undefined;
-        const state = this.readState();
-        const registration = state?.registrations[this.backendKey];
-        const session = registration?.sessions[agentType];
-        if (!registration?.agentInstances[agentType] || !session || Date.parse(session.expiresAt) <= Date.now() + 60_000)
-            return undefined;
-        const privateKey = this.readPrivateKey();
-        return privateKey ? Promise.resolve({ state: registration, agentType, session, privateKey }) : undefined;
+    async status() {
+        // Readiness needs a current server proof, not an unexpired cached token.
+        return withFileLock(`${this.statePath}.lock`, async () => {
+            const auth = await this.prepareAuthorization(true);
+            if (!auth.session.token || !(Date.parse(auth.session.expiresAt) > Date.now())) {
+                throw new Error('Device verification returned an invalid session');
+            }
+            return { agent_type: auth.agentType, expires_at: auth.session.expiresAt };
+        });
     }
     async recoverAuthorization() {
         await withFileLock(`${this.statePath}.lock`, async () => {
@@ -73,9 +71,6 @@ export class DeviceAuthority {
             this.writeState(state);
         });
     }
-    repairLock() {
-        return inspectAndRecoverLock(`${this.statePath}.lock`);
-    }
     async recoverBackendReset() {
         return withFileLock(`${this.statePath}.lock`, async () => {
             const state = this.readState();
@@ -88,28 +83,7 @@ export class DeviceAuthority {
             return { removed: true, agentTypes };
         });
     }
-    async resetDeviceKey() {
-        return withFileLock(`${this.statePath}.lock`, async () => {
-            const state = this.readState();
-            const removedBackends = state ? Object.keys(state.registrations).sort() : [];
-            // Delete the key first: if the process dies before the state write, the
-            // next run treats the missing key as a fresh install and completes the
-            // reset itself; it can never pair a new key with stale registrations.
-            if (existsSync(this.privateKeyPath)) {
-                try {
-                    unlinkSync(this.privateKeyPath);
-                }
-                catch (error) {
-                    if (error.code !== "ENOENT") {
-                        throw asDeviceStateError(error, "remove_private_key") ?? error;
-                    }
-                }
-            }
-            this.writeState(emptyDeviceState());
-            return { removedBackends };
-        });
-    }
-    async prepareAuthorization() {
+    async prepareAuthorization(forceSession = false) {
         let state = this.readState() ?? emptyDeviceState();
         const agentType = this.requestedAgentType;
         if (!agentType) {
@@ -119,14 +93,8 @@ export class DeviceAuthority {
         if (!privateKey) {
             const pair = generateKeyPairSync("ed25519");
             privateKey = pair.privateKey;
-            // Persist an empty state before the new key ever reaches disk so a crash
-            // can never pair the new key with registrations bound to the old one.
-            // A crash between the two writes leaves either no key (fresh retry) or a
-            // key with no registrations (the backend re-attaches to the existing
-            // device instead of creating a duplicate).
-            state = emptyDeviceState();
-            this.writeState(state);
             this.writePrivateKey(pair.privateKey.export({ format: "pem", type: "pkcs8" }).toString());
+            state = emptyDeviceState();
         }
         let registration = state.registrations[this.backendKey];
         if (!registration && state.legacyRegistration) {
@@ -144,21 +112,7 @@ export class DeviceAuthority {
             registration = await this.enroll(agentType, privateKey);
         }
         state.registrations[this.backendKey] = registration;
-        let session;
-        try {
-            session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, false);
-        }
-        catch (error) {
-            if (!isUnknownDeviceRegistration(error))
-                throw error;
-            // The backend lost this registration (e.g. its identity store was
-            // rebuilt). Drop the stale record and enroll once: the same key either
-            // re-attaches to the surviving device or creates a fresh one.
-            delete state.registrations[this.backendKey];
-            registration = await this.enroll(agentType, privateKey);
-            state.registrations[this.backendKey] = registration;
-            session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, false);
-        }
+        const session = await this.ensureRegistrationAgentType(registration, agentType, privateKey, forceSession);
         this.writeState(state);
         return { state: registration, agentType, session, privateKey };
     }
@@ -192,23 +146,16 @@ export class DeviceAuthority {
         if (!publicJWK.x)
             throw new Error("unable to export Ed25519 public key");
         const publicKey = Buffer.from(publicJWK.x, "base64url").toString("base64");
-        try {
-            const started = await this.publicJSON("/v1/agent-device-enrollments", { public_key: publicKey, agent_type: agentType });
-            const proof = enrollmentProofMessage(started.agent_device_enrollment_id, started.challenge);
-            const verified = await this.publicJSON(`/v1/agent-device-enrollments/${encodeURIComponent(started.agent_device_enrollment_id)}/verify`, { challenge: started.challenge, signature: sign(null, Buffer.from(proof), privateKey).toString("base64") });
-            return {
-                deviceID: verified.agent_device_id,
-                deviceKeyID: verified.agent_device_key_id,
-                quotaLineageID: verified.quota_lineage_id,
-                agentInstances: { [verified.agent_type]: verified.agent_instance_id },
-                sessions: {},
-            };
-        }
-        catch (error) {
-            if (error instanceof DeviceAuthorizationError)
-                error.enrollmentFailed = true;
-            throw error;
-        }
+        const started = await this.publicJSON("/v1/agent-device-enrollments", { public_key: publicKey, agent_type: agentType });
+        const proof = enrollmentProofMessage(started.agent_device_enrollment_id, started.challenge);
+        const verified = await this.publicJSON(`/v1/agent-device-enrollments/${encodeURIComponent(started.agent_device_enrollment_id)}/verify`, { challenge: started.challenge, signature: sign(null, Buffer.from(proof), privateKey).toString("base64") });
+        return {
+            deviceID: verified.agent_device_id,
+            deviceKeyID: verified.agent_device_key_id,
+            quotaLineageID: verified.quota_lineage_id,
+            agentInstances: { [verified.agent_type]: verified.agent_instance_id },
+            sessions: {},
+        };
     }
     async ensureSession(state, agentType, privateKey, force = false) {
         const existing = state.sessions[agentType];
@@ -251,7 +198,6 @@ export class DeviceAuthority {
             method: "POST",
             headers: { "Content-Type": "application/json", Accept: "application/json", ...this.compatibilityHeaders, ...extraHeaders },
             body,
-            signal: AbortSignal.timeout(15_000),
         });
         const payload = await response.json().catch(() => ({}));
         if (!response.ok)
@@ -297,7 +243,6 @@ export class DeviceAuthority {
 export class DeviceAuthorizationError extends Error {
     status;
     code;
-    enrollmentFailed = false;
     constructor(status, code, message) {
         super(message);
         this.status = status;
@@ -308,32 +253,20 @@ export class DeviceAuthorizationError extends Error {
 export class DeviceStateError extends Error {
     operation;
     causeCode;
-    blockedPath;
     code = "device_state_unwritable";
-    constructor(operation, causeCode, blockedPath) {
+    constructor(operation, causeCode) {
         super(`ItPay device state operation failed: ${operation} (${causeCode})`);
         this.operation = operation;
         this.causeCode = causeCode;
-        this.blockedPath = blockedPath;
         this.name = "DeviceStateError";
     }
 }
-export class DeviceLockBusyError extends Error {
-    code = "device_lock_busy";
-    constructor() {
-        super("ItPay device identity is being updated by another process");
-        this.name = "DeviceLockBusyError";
-    }
-}
 function emptyDeviceState() {
     return { schemaVersion: "itpay.device.v2", registrations: {} };
 }
 function canMovePastLegacyRegistration(error) {
     return error instanceof DeviceAuthorizationError && (error.code === "agent_device_revoked" || error.status === 404);
 }
-function isUnknownDeviceRegistration(error) {
-    return error instanceof DeviceAuthorizationError && (error.code === "agent_device_not_found" || error.status === 404);
-}
 function normalizeBackendKey(value) {
     const url = new URL(value);
     url.search = "";
@@ -369,9 +302,9 @@ async function withFileLock(path, run) {
     catch (error) {
         throw asDeviceStatePathError(error, "prepare_lock") ?? error;
     }
-    const ownerToken = `${process.pid}:${randomUUID()}`;
+    const ownerToken = randomUUID();
     let acquired = false;
-    for (let attempt = 0; attempt < 800; attempt += 1) {
+    for (let attempt = 0; attempt < 200; attempt += 1) {
         try {
             writeFileSync(path, ownerToken, { encoding: "utf8", flag: "wx", mode: 0o600 });
             chmodSync(path, 0o600);
@@ -382,12 +315,20 @@ async function withFileLock(path, run) {
             const code = error.code;
             if (code !== "EEXIST")
                 throw asDeviceStateError(error, "acquire_lock") ?? error;
-            inspectAndRecoverLock(path);
+            try {
+                if (Date.now() - statSync(path).mtimeMs > 30_000)
+                    moveLockAside(path, "stale", "remove_stale_lock");
+            }
+            catch (statError) {
+                if (statError.code !== "ENOENT") {
+                    throw asDeviceStateError(statError, "inspect_lock") ?? statError;
+                }
+            }
             await new Promise((resolve) => setTimeout(resolve, 25));
         }
     }
     if (!acquired)
-        throw new DeviceLockBusyError();
+        throw new Error("timed out waiting for ItPay device identity lock");
     try {
         return await run();
     }
@@ -395,46 +336,6 @@ async function withFileLock(path, run) {
         releaseLock(path, ownerToken);
     }
 }
-function inspectAndRecoverLock(path) {
-    let token;
-    let age;
-    try {
-        const lockStat = statSync(path);
-        age = Date.now() - lockStat.mtimeMs;
-        token = lockStat.isDirectory() ? "" : readFileSync(path, "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return "absent";
-        throw asDeviceStateError(error, "inspect_lock") ?? error;
-    }
-    const ownerPID = /^(\d+):[0-9a-f-]+$/.exec(token)?.[1];
-    if (ownerPID) {
-        try {
-            process.kill(Number(ownerPID), 0);
-            return "active";
-        }
-        catch (error) {
-            if (error.code !== "ESRCH")
-                return "active";
-        }
-    }
-    else if (age <= 30_000) {
-        return "active";
-    }
-    // Recheck the exact owner before moving the lock; another process may have renewed it.
-    try {
-        if (token ? readFileSync(path, "utf8") !== token : !statSync(path).isDirectory())
-            return "active";
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return "absent";
-        throw asDeviceStateError(error, "inspect_lock") ?? error;
-    }
-    moveLockAside(path, "stale", "remove_stale_lock");
-    return "recovered";
-}
 function releaseLock(path, ownerToken) {
     try {
         if (readFileSync(path, "utf8") !== ownerToken)
@@ -464,11 +365,10 @@ function moveLockAside(path, suffix, operation) {
 function asDeviceStateError(error, operation) {
     const code = error.code;
     return code === "EACCES" || code === "EPERM" || code === "EROFS" || code === "ENOTDIR" || code === "EISDIR"
-        ? new DeviceStateError(operation, code, error.path)
+        ? new DeviceStateError(operation, code)
         : undefined;
 }
 function asDeviceStatePathError(error, operation) {
     const code = error.code;
-    return code === "EEXIST" ? new DeviceStateError(operation, code, error.path) : asDeviceStateError(error, operation);
+    return code === "EEXIST" ? new DeviceStateError(operation, code) : asDeviceStateError(error, operation);
 }
-import { stateDir } from "./config.js";

package/docs/agent/buyer/cart-checkout.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public CLI entry point, and $itpay is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are buy and sell: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.",
   "topic": "cart-checkout",
   "title": "Canonical Cart And Checkout Routing",
   "purpose": "Use the canonical server Cart and route service-backed lines through Service Execution without hardcoded service logic.",
@@ -32,12 +32,11 @@
     }
   ],
   "agent_rules": [
-    "The Backend Cart is business truth; the current backend-isolated local cart state file only stores local recovery handles and explicit drafts.",
+    "The Backend Cart is business truth; ~/.itpay-v3/cart.json only stores local recovery handles and explicit drafts.",
     "Run the exact next.command returned by the CLI. Do not extract or invent a capability from a raw list.",
-    "Railway query and booking use distinct Service Executions for one purchase journey. Start another execution for an independent intent.",
-    "Only non-rail capabilities explicitly requiring delivery email may ask its purpose and value. Railway notification contact belongs to the protected checkout page with verified account email reuse; the Agent must not guess or collect it in chat.",
-    "A lost Checkout response is retried with the same Cart and persisted idempotency operation.",
-    "A single railway service checkout normally follows its booking execution; Cart is used only when the returned flow calls for it."
+    "One service intent uses one Service Execution. Start another execution for another independent intent.",
+    "Ask for email only when the selected capability requires protected delivery; never invent contact data.",
+    "A lost Checkout response is retried with the same Cart and persisted idempotency operation."
   ],
   "forbidden": [
     "Do not call ordinary buy for a service-backed Cart line.",

package/docs/agent/buyer/catalog-list.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public CLI entry point, and $itpay is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are buy and sell: Buyer workflows are available now; Seller workflows will use the same entry point and are not implemented yet.",
   "topic": "catalog-list",
   "title": "Browse ItPay V3 Service Catalog",
   "purpose": "Explain available services, outcomes, conditions, and prices in human language without exposing catalog identifiers.",
@@ -20,8 +20,7 @@
     "item_format": "Explain the title, what the human receives, any auxiliary discovery step, and the published price.",
     "service_flow": "Explain discovery as an auxiliary identity-confirmation step, including free quota and paid continuation. Present primary_service as the actual paid outcome. Read all values from the manifest.",
     "variant_selection": "Internal IDs are for the Agent's next command only and are never shown or requested from the human.",
-    "price_note": "amount_minor is in minor units (e.g., 10000 = 100.00 CNY). The CLI formats prices as XX.YY currency automatically.",
-    "railway": "Railway entries point to itpay docs show rail-booking; use its query and booking contracts instead of a generic start→invoke→cart sequence."
+    "price_note": "amount_minor is in minor units (e.g., 10000 = 100.00 CNY). The CLI formats prices as XX.YY currency automatically."
   },
   "agent_rules": [
     "Use catalog list only when the human asks for a new service, not when they want an earlier purchase.",
@@ -29,32 +28,15 @@
     "Explain the customer journey from service_flow instead of presenting every variant as an unrelated service.",
     "State free quota, paid continuation price, email requirement, and claim purpose exactly as published; do not exaggerate or omit conditions.",
     "Ask the human to choose only when multiple services could satisfy the goal; never make them choose an internal variant or offer ID.",
-    "Use each service’s returned input contract; railway planning and booking follow rail-booking, not a universal Cart route."
+    "After services start, submit service keywords only through the returned capability command's --input key=value options; --target is never a search keyword."
   ],
   "human_language": {
-    "prefer": [
-      "服务",
-      "查询",
-      "报告",
-      "免费次数",
-      "价格",
-      "你会得到什么"
-    ],
-    "avoid": [
-      "service_id",
-      "variant_id",
-      "offer_id",
-      "capability",
-      "manifest"
-    ]
+    "prefer": ["服务", "查询", "报告", "免费次数", "价格", "你会得到什么"],
+    "avoid": ["service_id", "variant_id", "offer_id", "capability", "manifest"]
   },
   "next_docs": [
     {
-      "condition": "Railway service selected",
-      "topic": "rail-booking"
-    },
-    {
-      "condition": "Non-rail Buyer selected a service and wants to purchase",
+      "condition": "Buyer selected a service and wants to purchase",
       "topic": "cart-checkout",
       "file": "docs/agent/buyer/cart-checkout.json"
     }