@itpay/cli 2.1.45 → 2.1.47

package/dist/src/state/config.js

@@ -1,144 +1,6 @@
-import { sellerSessionToken } from "./account_auth.js";
-// CLI configuration loader. Production defaults to app.itpay.ai; supported public overrides
-// are the official sandbox and dev Backends. Checkout
-// display-token persistence belongs to the cart session file, protected with
-// owner-only permissions. Provider secrets are explicitly out of scope here.
-import { createHash } from "node:crypto";
-import { homedir } from "node:os";
-import { mkdirSync } from "node:fs";
-import { resolve } from "node:path";
-import { HttpClient } from "../client/http.js";
-import { BackendClient } from "../client/backend.js";
-import { declaredAgentType } from "./agent_type.js";
-import { DeviceAuthority } from "./device_authority.js";
-import { OperationJournal } from "./operation_journal.js";
-export const DEFAULT_BASE_URL = "https://app.itpay.ai";
-export const DEV_BASE_URL = "https://dev.itpay.ai";
-export const SANDBOX_BASE_URL = "https://sandbox.itpay.ai";
-export const CLI_VERSION = "2.1.45";
-export const API_CONTRACT_REVISION = "sha256:c1e1f459c1d3844f6eeae21535b532abb2e48c3e320173c4faccd62992890dcd";
-const CART_SESSION_DEFAULT_DIR = ".itpay-v3";
-const CART_SESSION_FILENAME = "cart.json";
-const OPERATION_JOURNAL_FILENAME = "operations.json";
-const TASK_JOURNAL_FILENAME = "tasks.json";
-export function cliDistribution(env = process.env) {
-    if (env.ITPAY_DISTRIBUTION === "openclaw-skill-bundle")
-        return "openclaw-skill-bundle";
-    if (env.ITPAY_DISTRIBUTION === "kimi-plugin-bundle")
-        return "kimi-plugin-bundle";
-    return "npm";
-}
-export class BackendOverrideError extends Error {
-    code = "backend_override_forbidden";
-    constructor() {
-        super(`ITPAY_BACKEND_URL only supports ${DEFAULT_BASE_URL}, ${SANDBOX_BASE_URL}, or ${DEV_BASE_URL}`);
-        this.name = "BackendOverrideError";
-    }
-}
-export function resolveBackendURL(env = process.env) {
-    const requested = env.ITPAY_BACKEND_URL?.trim();
-    if (!requested || requested === DEFAULT_BASE_URL || requested === `${DEFAULT_BASE_URL}/`)
-        return DEFAULT_BASE_URL;
-    if (requested === SANDBOX_BASE_URL || requested === `${SANDBOX_BASE_URL}/`)
-        return SANDBOX_BASE_URL;
-    if (requested === DEV_BASE_URL || requested === `${DEV_BASE_URL}/`)
-        return DEV_BASE_URL;
-    if (env.ITPAY_CLI_DEV === "1" && /^http:\/\/(localhost|127\.0\.0\.1):\d+\/?$/.test(requested))
-        return requested.replace(/\/$/, "");
-    throw new BackendOverrideError();
-}
-export function qualifyBackendCommand(command, env = process.env) {
-    const requested = env.ITPAY_BACKEND_URL?.trim();
-    if (!requested)
-        return command;
-    const target = resolveBackendURL(env);
-    if (target === DEFAULT_BASE_URL)
-        return command;
-    if (!command.startsWith("itpay ") || command.startsWith(`ITPAY_BACKEND_URL=${target} `))
-        return command;
-    return `ITPAY_BACKEND_URL=${target} ${command}`;
-}
-function stateFilename(filename, baseURL) {
-    if (baseURL === DEFAULT_BASE_URL)
-        return filename;
-    const suffix = baseURL === SANDBOX_BASE_URL ? "sandbox" : baseURL === DEV_BASE_URL ? "dev" : `local-${createHash("sha256").update(baseURL).digest("hex").slice(0, 16)}`;
-    const dot = filename.lastIndexOf(".");
-    return dot < 0 ? `${filename}.${suffix}` : `${filename.slice(0, dot)}.${suffix}${filename.slice(dot)}`;
-}
-export function stateDir(env = process.env) {
-    return env.ITPAY_STATE_DIR ? resolve(env.ITPAY_STATE_DIR) : resolve(env.HOME || homedir(), CART_SESSION_DEFAULT_DIR);
-}
-export function cartSessionPath(env = process.env) {
-    if (env.ITPAY_CART_SESSION_PATH) {
-        return resolve(env.ITPAY_CART_SESSION_PATH);
-    }
-    const dir = stateDir(env);
-    mkdirSync(dir, { recursive: true });
-    return resolve(dir, stateFilename(CART_SESSION_FILENAME, resolveBackendURL(env)));
-}
-// Task journal (AUTH04): paused Service Executions per backend, so a login
-// completion can resume the SAME task instead of guessing from the latest order.
-export function taskJournalPath(env = process.env) {
-    if (env.ITPAY_TASK_JOURNAL_PATH) {
-        return resolve(env.ITPAY_TASK_JOURNAL_PATH);
-    }
-    const dir = stateDir(env);
-    mkdirSync(dir, { recursive: true });
-    return resolve(dir, stateFilename(TASK_JOURNAL_FILENAME, resolveBackendURL(env)));
-}
-export function loadConfig(env = process.env) {
-    const baseURL = resolveBackendURL(env);
-    const bearerToken = env.ITPAY_BEARER_TOKEN || undefined;
-    const agentType = declaredAgentType(env);
-    const checkoutCurrency = env.ITPAY_CURRENCY || "CNY";
-    const idempotencyKey = env.ITPAY_IDEMPOTENCY_KEY || `cli_${shortRandom()}`;
-    const ideImageAttach = env.ITPAY_IDE_IMAGE_ATTACH !== "0";
-    const ideImageDirOverride = env.ITPAY_IDE_IMAGE_DIR_OVERRIDE;
-    return {
-        baseURL,
-        environment: baseURL === DEFAULT_BASE_URL ? "production" : "development",
-        ...(agentType ? { agentType } : {}),
-        checkoutCurrency,
-        idempotencyKey,
-        ...(!env.ITPAY_IDEMPOTENCY_KEY ? { operationJournal: new OperationJournal(resolve(stateDir(env), stateFilename(OPERATION_JOURNAL_FILENAME, baseURL))) } : {}),
-        ideImageAttach,
-        ...(ideImageDirOverride ? { ideImageDirOverride } : {}),
-        ...(bearerToken ? { bearerToken } : {}),
-    };
-}
-export function operationID(config, operationKey) {
-    if (config.operationJournal)
-        return config.operationJournal.getOrCreate(operationKey);
-    return Promise.resolve(config.idempotencyKey);
-}
-export function newBackendClient(config) {
-    const authority = new DeviceAuthority({
-        baseURL: config.baseURL,
-        ...(config.agentType ? { requestedAgentType: config.agentType } : {}),
-        compatibilityHeaders: {
-            "X-ItPay-CLI-Version": CLI_VERSION,
-            "X-ItPay-Contract-Revision": API_CONTRACT_REVISION,
-        },
-    });
-    const http = new HttpClient({
-        baseURL: config.baseURL,
-        defaultHeaders: {
-            "X-ItPay-CLI-Version": CLI_VERSION,
-            "X-ItPay-Contract-Revision": API_CONTRACT_REVISION,
-        },
-        requestAuthorizer: (input) => {
-            if (/^\/v1\/(seller\/organizations(?:\/|\?|$)|library\/)/.test(input.path)) {
-                const token = config.bearerToken ?? sellerSessionToken(config.baseURL);
-                if (!token)
-                    throw new Error("Seller login required; run itpay sell auth login");
-                return Promise.resolve({ Authorization: `Bearer ${token}` });
-            }
-            return authority.authorizationHeaders(input);
-        },
-        recoverAuthorization: () => authority.recoverAuthorization(),
-    });
-    return new BackendClient(http);
-}
-function shortRandom() {
-    return Math.random().toString(36).slice(2, 10) + Math.random().toString(36).slice(2, 6);
-}
+const CLI_VERSION = "2.1.47";
+const API_CONTRACT_REVISION = "sha256:3f4a94cd1755773ef7b2ff08cfca2e5adf33c0b4888af593dd832ffc52939365";
+export {
+  API_CONTRACT_REVISION,
+  CLI_VERSION
+};

package/docs/agent/buyer/cart-checkout.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "cart-checkout",
   "title": "Canonical Cart And Checkout Routing",
   "purpose": "Use the canonical server Cart and route service-backed lines through Service Execution without hardcoded service logic.",

package/docs/agent/buyer/catalog-list.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "catalog-list",
   "title": "Browse ItPay V3 Service Catalog",
   "purpose": "Explain available services, outcomes, conditions, and prices in human language without exposing catalog identifiers.",

package/docs/agent/buyer/identity-and-sessions.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "identity-and-sessions",
   "title": "Device Identity And Session Recovery",
   "purpose": "Explain stable local identity, official Backend-scoped registrations, Agent Type instances, and bounded automatic session recovery.",

package/docs/agent/buyer/install-and-setup.json

@@ -1,45 +1,35 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the public CLI entry point for Buyer services and existing itpay sell Seller workflows.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "install-and-setup",
   "title": "Install And Identify The ItPay Agent Runtime",
-  "purpose": "Select the real Agent Type, verify one official Backend, and load the packaged Skill through one linear setup path.",
+  "purpose": "Install in one host-permitted persistent npm location, prepare the real Agent once, and enable the same-package Skill.",
   "when_to_use": [
     "The CLI is being installed or upgraded.",
     "The agent needs to confirm its stable runtime identity and default output Host."
   ],
   "commands": [
     {
-      "intent": "read this installed package Skill before network checks",
-      "command": "itpay skill show itpay --json",
-      "success_signal": "complete packaged Skill is read; the same version need not be read twice"
-    },
-    {
-      "intent": "list supported Agent Types",
+      "intent": "identify actual supported Agent Type if needed",
       "command": "itpay install --json",
-      "success_signal": "status is install_targets and exactly nine supported Agent Type definitions are returned"
+      "success_signal": "select actual agent_type without asking the human"
     },
     {
-      "intent": "read setup for the real runtime",
-      "command": "itpay install <agent_type> --json",
-      "success_signal": "status is instructions_ready and next is a readyz command using that exact Agent Type"
+      "intent": "prepare device and report authoritative account state",
+      "command": "itpay setup --agent-type <agent_type> --json",
+      "success_signal": "setup_ready with device_status ready and account_status authenticated or login_required; not proof Skill is enabled"
     },
     {
-      "intent": "verify the selected official Backend",
-      "command": "<execute the exact next.command returned by install>",
-      "success_signal": "ready proves Backend liveness only; retain the actual Agent Type and Backend, then verify device access"
-    },
-    {
-      "intent": "verify device access after Backend liveness",
-      "command": "itpay auth status --json",
-      "success_signal": "authenticated or successful login_required proves device access; pending/unknown is not ready"
+      "intent": "read and enable complete same-package Skill",
+      "command": "itpay skill show itpay --json",
+      "success_signal": "read original Skill and persist it using the host official skill mechanism; retain actual path/version"
     }
   ],
   "agent_rules": [
-    "For first setup, read the complete Skill from this installed package before network checks. Select the actual Agent Type once through install and retain the same launcher and Backend. Do not reread the same version Skill, repeat initialization for ordinary tasks, or start login or business to prove setup.",
-    "Run installation separately and preserve full output and its exit code. Nonzero stops preparation even if an older CLI runs. Same-version reuse requires verified executable, registry channel target, contract and official source; do not force or bypass host protection.",
-    "Report ItPay ready only after Backend and device checks succeed; otherwise preparation is incomplete. Account login is not required for setup.",
+    "Use standard npm with one host-permitted persistent tool location or global prefix. Fix the exact entry, actual Agent Type and Backend; do not change HOME/npm configuration or an existing project dependency. Do not use floating npx.",
+    "Run setup once after installation or upgrade, then read and enable the current package Skill before business. Same-version already-read/enabled Skill needs no repeat. No automatic login or business to prove setup.",
+    "Preserve actual npm error and nonzero exit. ENOTEMPTY is an old package/retirement directory conflict, not proof host policy forbids writes; broker wrappers do not establish the underlying cause. Stop repeated installation; only precisely authorized old-package cleanup, never identity deletion. setup_ready requires authoritative device/account checks; unknown/404/incompatibility is not ready.",
     "The current public setup link selects the channel and matching contract: latest/app for production, next/dev for beta. Do not let an old bundle or memory override this choice.",
     "Production defaults to https://app.itpay.ai. Testing may set ITPAY_BACKEND_URL to the exact official URL the configured official test Backend only when explicitly requested; follow the CLI allowlist.",
     "If Backend compatibility cannot be verified, stop this round. minimum_cli_version is a protocol floor, not a verified matching artifact. Ask the maintainer for the matching distribution; do not guess a version or downgrade.",

package/docs/agent/buyer/orders-refunds.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "orders-refunds",
   "title": "Order, Delivery, Customer Care And Refund Recovery",
   "purpose": "Explain paid-order and delivery problems to the human, then read or manage the same owned Order without guessing payment, consumption, or refund state.",

package/docs/agent/buyer/payment-flow.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "payment-flow",
   "title": "Human Checkout Handoff And Payment Verification",
   "purpose": "Show the ItPay Checkout to the human and recover authoritative payment state without creating duplicate payment resources.",

package/docs/agent/buyer/purchased-content.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "1.0",
-  "product_scope": "buyer",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "purchased-content",
   "title": "Previously Purchased Content And Account History",
   "purpose": "Distinguish a previous purchase from a new service request, obtain one time-limited read authorization, and resume the original list, orders, or read command.",

package/docs/agent/buyer/quickstart.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "quickstart",
   "title": "Route One Human Intent Through ItPay",
   "purpose": "Choose the correct first action from the human's words and continue through one authoritative CLI envelope at a time.",

package/docs/agent/buyer/rail-booking.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point, and $itpay is its user-facing Skill invocation. Under that one product entry point, the two top-level commerce actions are buy and sell: Buyer workflows are available now; Seller workflows use the same entry point via itpay sell.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "rail-booking",
   "title": "Railway Query, Planning, and Ticket Booking",
   "purpose": "One railway route from understanding the request to saved results, booking, protected checkout, order status and refunds.",
@@ -125,21 +125,22 @@
     "whole_journey": "Use the returned complete ticket plan booking_template: ordered selections (2–3 legs) from one owner/snapshot/revision/plan, or selection for one leg. One booking, one refreshed whole quote, one checkout, one order and one payment; each leg issues separately without connection or joint-seat guarantees. Raw legs are single-leg compatibility only; never hand-compose multi-leg legs when complete selections are missing or expired. Do not combine different plans or choose per-leg payment by default. Historical details without a whole-journey template do not prove whole-journey support."
   },
   "review_and_checkout": {
-    "review": "Copy the returned complete interaction.input_template.input, current revision and notice. For a whole journey, each ordered leg has its own seat_type and an object preference per passenger; default auto, never null/string arrays. Use known choices and confirm only missing genuine terms consent or material changes. Set accept_non_guaranteed=true only after real consent; delegation or choosing a train alone is not terms consent. The false default is protection, not a broken template; if consent is missing, ask the returned review.consent_question once. Seat/berth placement requests differ from the whole-journey separate-issuance and partial-outcome terms; use the current notice.",
+    "review": "Copy the returned complete interaction.input_template.file_content (input is the identical compatibility alias), current revision and notice. For a whole journey, each ordered leg has its own seat_type and an object preference per passenger; default auto, never null/string arrays. Use known choices and confirm only missing genuine terms consent or material changes. Set accept_non_guaranteed=true only after real consent; delegation or choosing a train alone is not terms consent. The false default is protection, not a broken template; if consent is missing, ask the returned review.consent_question once. Seat/berth placement requests differ from the whole-journey separate-issuance and partial-outcome terms; use the current notice.",
     "equivalent_correction": "If only seat code spelling changes while train, actual seat class, party, price and terms are identical, reuse an existing explicit human approval. Material draft changes or missing approval require human confirmation. Reuse accepted original endpoints, no-seat, overnight and incomplete-coverage facts when unchanged; never silently substitute the destination.",
     "checkout": "Present the complete itinerary, total and single official handoff: one payment, separate issuance. The human enters one passenger set on that page; verified account notification email is reused there and can be changed for this order. Do not ask or guess traveler identity/email in chat. Use the returned checkout payment deadline, not an estimated duration. Handoff is not payment, and payment is not all legs issued."
   },
   "continue_and_aftercare": {
     "same_execution": "Read the same booking/checkout/order. Report issued only when every leg is confirmed issued; partial or unknown outcomes keep the same order and successful tickets, reconcile before retry, and explain the affected leg. No automatic rebuy or full-refund promise.",
     "saved_vs_live": "A saved snapshot remains historical evidence after expiry. Real-time booking or quote credentials may expire and require the documented fresh validation path; rereading an old token does not renew it.",
-    "refund": "For railway refund/change use itpay aftercare list --order <order_id> --json. Select returned leg/passenger targets from the user’s request, explain scope and manual processing, submit the complete current template. Request acceptance is not supplier success or money returned. Read the same case; concrete change proposals need current-revision consent and actual fee facts. No automatic change payment or replacement purchase."
+    "refund": "For railway refund/change use itpay aftercare list --order <order_id> --json. Select returned leg/passenger targets from the user’s request, explain scope and manual processing, submit the complete current template. Request acceptance is not supplier success or money returned. Read the same case; concrete change proposals need current-revision consent and actual fee facts. No automatic change payment or replacement purchase.",
+    "waiting": "Use the returned bounded same-task next command: up to 60 seconds per continuation, 120 seconds cumulative automatic waiting. Collect the same host session output before continuing. Budget expiry means still processing, not no trains or failed. Human terms, unresolved payment and terminal outcomes stop automatic polling."
   },
   "exceptional_branches": {
     "login_required": "Use itpay auth login --json, complete the official handoff, then execute the returned recovery command for the same paused query. Login returning a command does not execute it.",
     "rate_limited": "Respect returned retry_after and continue the same execution.",
     "booking_review_invalid": "Read the same booking review and use the returned seat code; reuse real consent only under the strict equivalent-correction rule.",
     "booking_review_changed": "Read the current revision and compare material terms; confirm new terms only when changed.",
-    "selection_stale": "Saved result stays readable, but follow the current owner action for new live inventory and quote evidence; do not assume reread refreshes the token.",
+    "selection_stale": "Saved details never refresh inventory or renew credentials. Only when the current server response proves safe_new_query and no existing purchase, write the complete original public query file, without reuse_from, and refresh once. Match the full itinerary, trains, seat classes and price to the original choice rather than selecting the new rank 1. Reuse genuine unchanged consent; explain and confirm material changes. Existing booking or unknown payment restores only the same purchase. Failed purchase-history evidence stops automatic refresh; do not loop on historical details.",
     "unknown_paid_outcome": "Read the same checkout/order before any mutation. Never repeat payment or create a new order on an unknown outcome.",
     "lock": "Normal device authorization uses no legacy lock. Preserve identity and old lock files; follow the actual error stage, not a generic lock-repair command.",
     "empty": "Report verified scope, failures and missing evidence separately. Do not guess a new date or station as a generic repair. Explain checked scope first, then propose at most two evidence-backed directions. Ask consent before changing a locked endpoint; after consent copy the complete original input and change only the accepted side in a new query.",
@@ -172,5 +173,6 @@
     "journey_terms": "workflow:confirm_booking and booking_review_invalid recovery accept agent-reported genuine consent; default false, never infer from purchase delegation.",
     "ordinary_human_action": "Use its published actor rule; do not generalize railway permission.",
     "price_approval": "approve_purchase uses actor-type agent with the unchanged server-scoped approval template and genuine matching approval; candidate choice is not price approval."
-  }
+  },
+  "consent_template_semantics": "Template false means approval is not recorded, not that the human must answer again. When user_answer_required is absent, check explicit chat or recorded consent for the current scope, party, price and terms; reuse it unchanged, ask only for missing consent or material differences, and never invent approval."
 }

package/docs/agent/buyer/rail-fast-checkout.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer_agent",
-  "product_scope": "itpay_rail",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "rail-fast-checkout",
   "title": "Rail Fast Checkout — Delegated Purchase Supplement",
   "purpose": "Short delegated-purchase supplement to rail-booking; host presentation differences only.",

package/docs/agent/buyer/render-hosts.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point for Buyer services and the existing itpay sell Seller workflow; $itpay is its user-facing Skill invocation.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "render-hosts",
   "title": "Agent Type And Human Handoff Rendering",
   "purpose": "Use only the handoff fields returned for the current Agent Type and make Checkout or read authorization genuinely visible on that surface.",

package/docs/agent/buyer/service-feedback.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "itp.agent_doc.v1",
   "role": "buyer",
-  "product_scope": "itpay is the single public CLI entry point. Service feedback records one safe Agent postmortem for an existing order item; a human rating and comment are optional and it never replaces delivery recovery, refund policy, or customer care.",
+  "product_scope": "itpay is the single public Buyer CLI entry point, and $itpay is its user-facing Skill invocation. It covers services, railway planning and booking, orders, authorized purchased content and refunds.",
   "topic": "service-feedback",
   "title": "Record A Completed Service Postmortem",
   "purpose": "Finish the original order outcome first, then persist safe process context and any explicit human rating or comment without exposing commands or internal identifiers.",

package/docs/cli-reference/agent-types.md

@@ -1,6 +1,6 @@
 # Agent Type And Host Contract
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 `--agent-type` 表示哪类运行时在运行 CLI，用于 Agent 实例归属和定制 instruction。`--host` 表示输出展示在哪里；`--target` 只是在某些 Host 中指定 chat/channel/open ID。三者不可混用，窗口、任务和对话也不是身份。
 

package/docs/cli-reference/commands/auth.md

@@ -93,4 +93,3 @@ Terminal and error states:
 - Login never grants Vault content, passenger history, or another Agent's authority. Other devices/platforms enroll and authorize separately.
 - After `authenticated`, server-side identity is re-read; an anonymous execution blocked at the quota step resumes with `services run <service> --execution <id> --json` — no new execution, no re-asked itinerary.
 - Refusing or cancelling login deletes nothing: saved results and purchase options remain usable.
-- Seller authoring uses `itpay sell auth` separately.

package/docs/cli-reference/commands/buy.md

@@ -1,6 +1,6 @@
 # `itpay buy`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/add.md

@@ -1,6 +1,6 @@
 # `itpay cart add`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 服务报价的批准边界
 

package/docs/cli-reference/commands/cart/clear.md

@@ -1,6 +1,6 @@
 # `itpay cart clear`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/index.md

@@ -1,6 +1,6 @@
 # `itpay cart`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 命令范围
 

package/docs/cli-reference/commands/cart/next.md

@@ -1,6 +1,6 @@
 # `itpay cart next`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 服务报价的批准边界
 

package/docs/cli-reference/commands/cart/remove.md

@@ -1,6 +1,6 @@
 # `itpay cart remove`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/cart/show.md

@@ -1,6 +1,6 @@
 # `itpay cart show`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/catalog/index.md

@@ -1,6 +1,6 @@
 # `itpay catalog`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 命令范围
 

package/docs/cli-reference/commands/catalog/list.md

@@ -1,6 +1,6 @@
 # `itpay catalog list`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/checkout.md

@@ -1,6 +1,6 @@
 # `itpay checkout`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/docs/index.md

@@ -1,6 +1,6 @@
 # `itpay docs`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 命令范围
 

package/docs/cli-reference/commands/docs/list.md

@@ -1,6 +1,6 @@
 # `itpay docs list`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/docs/search.md

@@ -1,6 +1,6 @@
 # `itpay docs search`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/docs/show.md

@@ -1,6 +1,6 @@
 # `itpay docs show`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/install.md

@@ -1,6 +1,6 @@
 # `itpay install`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 
@@ -8,7 +8,7 @@
 
 **上游：** 当前 npm CLI 或平台 bundle 已经可执行。
 
-**下游：** 先读取本包完整 Skill，使用真实 Agent Type 执行 `readyz`，再按返回的同 Backend/type 命令检查 `auth status`。authenticated 或成功 login_required 才证明设备访问可用；后者仍未登录，不自动发起授权或业务。
+**下游：** 使用真实 Agent Type 执行 `setup`，再读取并启用同包 Skill。authenticated 或成功 login_required 才证明设备访问可用；后者仍未登录，不自动发起授权或业务。
 
 ## 语法与参数
 
@@ -35,8 +35,8 @@ itpay install [target] [--json]
   },
   "instruction": "在 Codex Desktop 中始终传这个 Agent Type；付款时把返回的二维码和链接实际展示到当前对话。",
   "next": {
-    "command": "itpay --agent-type codex-desktop readyz --json",
-    "reason": "验证当前官方 ItPay API 的可用性"
+    "command": "itpay --agent-type codex-desktop setup --json",
+    "reason": "准备当前宿主并确认设备与账号状态"
   },
   "recovery": [
     {
@@ -63,8 +63,8 @@ OpenClaw 额外明确没有默认入口：
   },
   "instruction": "保持 openclaw Agent Type；每个展示命令都从当前可信会话上下文显式传 --host，IM 入口同时传 --target。Telegram 使用返回的原生 message action，其他入口展示标准二维码和付款链接。",
   "next": {
-    "command": "itpay --agent-type openclaw readyz --json",
-    "reason": "验证当前官方 ItPay API 的可用性"
+    "command": "itpay --agent-type openclaw setup --json",
+    "reason": "准备当前宿主并确认设备与账号状态"
   },
   "recovery": [
     {
@@ -100,7 +100,7 @@ OpenClaw 额外明确没有默认入口：
       }
     ]
   },
-  "instruction": "识别当前真实运行平台，从 result.agent_types 选择对应 agent_type，并由 Agent 自行运行 itpay install <agent_type> --json；不要让用户运行命令，也不要临时更换 Agent Type。",
+  "instruction": "识别当前真实运行平台，从 result.agent_types 选择对应 agent_type，并由 Agent 自行运行 itpay setup --agent-type <agent_type> --json；不要让用户运行命令，也不要临时更换 Agent Type。",
   "next": null,
   "recovery": [
     {

package/docs/cli-reference/commands/next.md

@@ -1,6 +1,6 @@
 # `itpay next`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/order.md

@@ -1,6 +1,6 @@
 # `itpay order`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义
 

package/docs/cli-reference/commands/pay.md

@@ -1,6 +1,6 @@
 # `itpay pay`
 
-> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The same entry point supports Buyer workflows and the existing `itpay sell` Seller workflow.
+> **Product boundary:** `itpay` is the single public CLI entry point, and `$itpay` is its user-facing Skill invocation. The public package provides Buyer workflows; Seller authoring source is maintained separately.
 
 ## 范围与意义