@mongoui/skills 0.1.4 → 0.1.6

package/skills/flink-flight-api/flink-openapi-integration/scripts/flink_signed_request.py

@@ -0,0 +1,188 @@
+#!/usr/bin/env python3
+"""Generate or send signed requests for the Flink open-platform gateway.
+
+Examples:
+  python scripts/flink_signed_request.py ^
+    --method POST ^
+    --path /openapi/v1/flink/zh_CN/airlines/list ^
+    --body-json "{\"page\":1,\"pageSize\":20}" ^
+    --app-key open_app_xxx ^
+    --app-secret sk_xxx
+
+  python scripts/flink_signed_request.py ^
+    --method GET ^
+    --path /openapi/v1/flink/fields ^
+    --query orderNo=dd20251020161158787680281 ^
+    --app-key open_app_xxx ^
+    --app-secret sk_xxx ^
+    --send
+"""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import hmac
+import json
+import os
+import sys
+import time
+import urllib.parse
+import urllib.request
+import uuid
+from pathlib import Path
+
+
+def sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def parse_query_items(items: list[str]) -> list[tuple[str, str]]:
+    pairs: list[tuple[str, str]] = []
+    for item in items:
+        if "=" not in item:
+            raise ValueError(f"invalid query item: {item!r}; expected key=value")
+        key, value = item.split("=", 1)
+        pairs.append((key, value))
+    return pairs
+
+
+def canonical_query(pairs: list[tuple[str, str]]) -> str:
+    ordered = sorted(pairs, key=lambda item: (item[0], item[1]))
+    return "&".join(
+        f"{urllib.parse.quote(key, safe='~-._')}={urllib.parse.quote(value, safe='~-._')}"
+        for key, value in ordered
+    )
+
+
+def build_sign_payload(
+    method: str,
+    path: str,
+    query_string: str,
+    body_bytes: bytes,
+    timestamp: str,
+    nonce: str,
+    app_key: str,
+) -> str:
+    return "\n".join(
+        [
+            method.upper(),
+            path,
+            query_string,
+            sha256_hex(body_bytes),
+            timestamp,
+            nonce,
+            app_key,
+        ]
+    )
+
+
+def sign(secret: str, payload: str) -> str:
+    return hmac.new(secret.encode("utf-8"), payload.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def load_body(args: argparse.Namespace) -> bytes:
+    if args.body_file:
+        return Path(args.body_file).read_bytes()
+    if args.body_json is None:
+        return b""
+    parsed = json.loads(args.body_json)
+    return json.dumps(parsed, ensure_ascii=False, separators=(",", ":")).encode("utf-8")
+
+
+def build_url(base_url: str, path: str, query_string: str) -> str:
+    base = base_url.rstrip("/")
+    url = f"{base}{path}"
+    if query_string:
+        url = f"{url}?{query_string}"
+    return url
+
+
+def build_headers(app_key: str, timestamp: str, nonce: str, signature: str, has_body: bool) -> dict[str, str]:
+    headers = {
+        "Accept": "application/json",
+        "X-OP-App-Key": app_key,
+        "X-OP-Timestamp": timestamp,
+        "X-OP-Nonce": nonce,
+        "X-OP-Sign": signature,
+    }
+    if has_body:
+        headers["Content-Type"] = "application/json"
+    return headers
+
+
+def send_request(method: str, url: str, headers: dict[str, str], body_bytes: bytes, timeout: float) -> tuple[int, str]:
+    request = urllib.request.Request(url=url, data=body_bytes or None, headers=headers, method=method.upper())
+    try:
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            return response.status, response.read().decode("utf-8", errors="replace")
+    except urllib.error.HTTPError as exc:
+        return exc.code, exc.read().decode("utf-8", errors="replace")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Generate or send a signed Flink open-platform request.")
+    parser.add_argument("--base-url", default=os.getenv("OPEN_PLATFORM_BASE_URL", "http://127.0.0.1:8671"))
+    parser.add_argument("--method", required=True)
+    parser.add_argument("--path", required=True)
+    parser.add_argument("--query", action="append", default=[], help="Repeatable key=value query parameter")
+    parser.add_argument("--body-json", help="JSON string request body")
+    parser.add_argument("--body-file", help="Path to a raw request body file")
+    parser.add_argument("--app-key", default=os.getenv("OPEN_PLATFORM_APP_KEY") or os.getenv("OPEN_PLATFORM_OPEN_APP_ID"))
+    parser.add_argument("--app-secret", default=os.getenv("OPEN_PLATFORM_APP_SECRET") or os.getenv("OPEN_PLATFORM_OPEN_SECRET"))
+    parser.add_argument("--timestamp", default=str(int(time.time())))
+    parser.add_argument("--nonce", default=uuid.uuid4().hex)
+    parser.add_argument("--send", action="store_true")
+    parser.add_argument("--timeout", type=float, default=15.0)
+    args = parser.parse_args()
+
+    if not args.app_key or not args.app_secret:
+        print("app key and app secret are required", file=sys.stderr)
+        return 2
+
+    try:
+        query_pairs = parse_query_items(args.query)
+        body_bytes = load_body(args)
+    except Exception as exc:  # pragma: no cover - simple CLI error path
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    query_string = canonical_query(query_pairs)
+    payload = build_sign_payload(
+        method=args.method,
+        path=args.path,
+        query_string=query_string,
+        body_bytes=body_bytes,
+        timestamp=args.timestamp,
+        nonce=args.nonce,
+        app_key=args.app_key,
+    )
+    signature = sign(args.app_secret, payload)
+    headers = build_headers(args.app_key, args.timestamp, args.nonce, signature, bool(body_bytes))
+    url = build_url(args.base_url, args.path, query_string)
+
+    print("URL:")
+    print(url)
+    print()
+    print("Canonical String:")
+    print(payload)
+    print()
+    print("Headers:")
+    print(json.dumps(headers, ensure_ascii=False, indent=2))
+    if body_bytes:
+        print()
+        print("Body:")
+        print(body_bytes.decode("utf-8", errors="replace"))
+
+    if not args.send:
+        return 0
+
+    status, response_text = send_request(args.method, url, headers, body_bytes, args.timeout)
+    print()
+    print(f"HTTP {status}")
+    print(response_text)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skills/glink-hotel-api/glink-openapi-integration/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: glink-openapi-integration
+description: Integrate with the Glink hotel OpenAPI exposed through the Open Platform runtime gateway. Use when Codex needs to read, verify, explain, test, or implement against `docs/swagger/glink-api.json` or Glink route code; choose Glink hotel endpoints; generate or debug `X-OP-*` signatures; explain sandbox or production credential issuance/reset; or drive Chinese/English requests about Glink 酒店 static data, hotel search, hotel info, product detail, booking, payment, order, cancel, order status push/callback, checkout, invoice, and balance workflows.
+---
+
+# Glink OpenAPI Integration
+
+## Quick Start
+
+Use this skill when the task is "call Glink through the open platform".
+
+Start with the smallest current source that answers the request:
+
+- Prefer the repository source of truth when it exists: `docs/swagger/glink-api.json`, route handlers, DTOs, and tests.
+- Read `references/auth-and-credentials.md` for signing, headers, key acquisition, reset, and auth troubleshooting.
+- Read `references/api-workflows.md` for hotel search, booking, cancel, checkout, invoice, and balance workflows.
+- Read `references/endpoint-index.md` for a compact endpoint map and platform-managed field caveats, then verify fragile fields against the current swagger or code.
+- Use `scripts/glink_signed_request.py` to generate headers, inspect the canonical string, or send a signed request.
+
+## Working Rules
+
+Follow this workflow:
+
+1. Confirm the environment: `sandbox` and `production` credentials are separate.
+2. Confirm whether the user is asking for documentation, code changes, local smoke testing, or live API calls.
+3. Confirm the public path under `/openapi/v1/glink/*`.
+4. Build the minimum valid request body from swagger/code first, using `references/endpoint-index.md` as navigation.
+5. Sign the exact public path, sorted query string, and raw body bytes with the platform secret.
+6. Evaluate both HTTP status and response envelope `code`, not HTTP status alone.
+
+When the user asks for the Open Platform Glink hotel onboarding or booking flow, apply this required sequence:
+
+1. Static bootstrap: `queryCityList` -> `queryHotelIdList` by city -> `queryHotelInfo` for hotel/room static data, then persist mapping locally.
+2. Static maintenance: run `queryHotelIncrement`, then call `queryHotelInfo` for changed hotel IDs and update or disconnect local mappings when needed.
+3. List pricing: run `queryHotelLowestPrice` for mapped hotels, normally as a daily job after the Glink price refresh window, and use it as list-page display/reference data.
+4. Detail pricing: before `queryProductDetail`, check the local saleable hotel ID cache; skip hotels not in the saleable list. Use `bookType=1` products as bookable candidates.
+5. Booking: call `checkBooking` with the actual room count before entering or submitting the order flow; call it again before `createOrder` when the local order is ready.
+6. Payment and confirmation: after `createOrder`, call `payOrder` only after local customer payment succeeds or the platform has decided the Glink order should be confirmed.
+7. Confirmation result: treat Glink order operation push/callback as primary and idempotent; use `queryOrderDetail` only as low-frequency compensation before final confirmation or cancellation.
+8. Cancellation: call `cancelOrder` for unpaid timeout such as 30 minutes or customer cancellation. If the cancellation API returns success, update the local order and do not keep polling for another status push.
+
+Do not violate these rules:
+
+- Always send `X-OP-App-Key`, `X-OP-Timestamp`, `X-OP-Nonce`, and `X-OP-Sign`.
+- Never send Glink-side `partnerCode`, `signature`, `requestType`, or Glink-side `timestamp`.
+- Never wrap the payload in Glink-style `header` or `businessRequest`; send only business fields.
+- Never invent credentials or secrets. Use explicit user-provided values or environment variables.
+- Treat `code=SUCCESS` as success. Treat `code=SUPPLIER_BIZ_ERROR` as a business failure even if HTTP status is `200`.
+- Keep timestamp skew within `+-5` minutes.
+- Reuse of the same nonce under the same app key can trigger `NONCE_REPLAY`.
+- If a swagger schema still shows Glink-managed fields as required, follow the route description first and omit those platform-managed downstream fields from the client payload.
+- Do not frequently poll order status. Stop polling once the order is confirmed or canceled; rely on idempotent push/callback handling as the source of truth for confirmation progress.
+- Do not query real-time products for hotels outside the cached saleable hotel list; it wastes integration quota and usually returns no useful sellable data.
+
+## Typical Requests
+
+Use these patterns by default:
+
+- Static data: city, country, district, business area, and brand lookup calls
+- Catalog sync: `queryCityList` -> `queryHotelIdList` -> `queryHotelInfo`; maintain with `queryHotelIncrement` -> `queryHotelInfo`
+- Search and booking: mapped saleable hotel IDs -> `queryHotelLowestPrice` for list display -> `queryProductDetail` for hotel detail -> `checkBooking` -> optional second `checkBooking` -> `createOrder` -> `payOrder` -> order push/callback primary, `queryOrderDetail` as compensation
+- Order aftercare: `cancelOrder`, Glink order push/callback, `queryOrderDetail`, `queryOrderCheckDetailInfo`, `checkoutApply`, `queryCheckoutDetail`
+- Finance: `createInvoice`, `queryCreditBalance`
+
+## Output Expectations
+
+When answering or coding with this skill:
+
+- Prefer concrete request examples over abstract summaries.
+- Name the source used when the current swagger/code and bundled references disagree.
+- State which environment the credential belongs to.
+- State whether the payload should contain only business fields.
+- Call out Glink-managed field residue in the swagger when relevant.
+- Call out auth failures with the likely root cause and the exact header or field to inspect.
+- For code changes, keep Glink downstream auth and platform gateway auth clearly separated.

package/skills/glink-hotel-api/glink-openapi-integration/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "Glink OpenAPI 接入"
+  short_description: "Glink 酒店开放接口鉴权、签名和业务调用"
+  default_prompt: "Use $glink-openapi-integration to implement or debug Glink hotel OpenAPI auth, signatures, endpoint selection, and order workflows."

package/skills/glink-hotel-api/glink-openapi-integration/references/api-workflows.md

@@ -0,0 +1,110 @@
+# Glink API Workflows
+
+## Static Data
+
+Use these calls to build hotel search prerequisites:
+
+- `glink.queryCountryList`
+- `glink.queryCityList`
+- `glink.queryHotCityList`
+- `glink.queryDistrictList`
+- `glink.queryDistrictAndBusiness`
+- `glink.queryBusinessList`
+- `glink.queryHotelPlateList`
+- `glink.queryCityAndHotelByKeyword`
+
+These APIs usually feed city selection, district filters, brand filters, and keyword suggestions.
+
+For the required Open Platform Glink onboarding flow, build local hotel and room mapping in this order:
+
+1. `glink.queryCityList`
+   - Get Glink city codes used by the platform hotel flow.
+2. `glink.queryHotelIdList`
+   - Use the city code to fetch the account's saleable hotel ID list and cache it locally.
+3. `glink.queryHotelInfo`
+   - Fetch hotel and room static data for the cached hotel IDs. Persist only the fields needed for local hotel and room mapping.
+4. `glink.queryHotelIncrement`
+   - Periodically fetch changed hotel IDs, including added, updated, or deleted hotels.
+5. `glink.queryHotelInfo`
+   - Rehydrate changed hotel IDs and decide whether local mappings should be updated or disconnected.
+
+## Hotel Search And Product Selection
+
+Use this sequence for discovery and pricing:
+
+1. `glink.getDestination` or `glink.queryCityAndHotelByKeyword`
+   - Resolve the destination or keyword to a city or hotel scope.
+2. `glink.getHotelSearch` or `glink.findHotelList`
+   - Search hotels using city, dates, room count, and optional filters.
+3. `glink.queryHotelLowestPrice`
+   - Pull summary pricing for selected hotel IDs.
+4. `glink.queryProductDetail`
+   - Read real-time sellable products for a selected hotel and stay range.
+5. `glink.queryHotelInfo`, `glink.queryHotelImage`, or `glink.queryHotelMainInfoByHotelIds`
+   - Hydrate hotel details for display or validation.
+
+Use `queryHotelAllList`, `queryHotelIdList`, and `queryHotelIncrement` when synchronizing hotel catalogs rather than serving live booking UX.
+
+For the Open Platform Glink flow, prefer the local mapped catalog over broad live search during booking:
+
+- Use `glink.queryHotelLowestPrice` for mapped hotels to refresh daily starting prices. It is list-page reference/display data and should normally be refreshed once daily after the Glink price refresh window, for example after 05:00.
+- Before calling `glink.queryProductDetail`, verify that the hotel is still in the cached saleable hotel ID list. Do not query products for hotels outside the saleable list.
+- Use `glink.queryProductDetail` when the customer enters a hotel detail or booking path. Treat products with `bookType=1` as bookable candidates, then confirm with `checkBooking`.
+
+## Booking Flow
+
+Use this sequence for a normal hotel booking flow:
+
+1. `glink.queryProductDetail`
+   - Identify the exact sellable room and rate.
+2. `glink.checkBooking`
+   - Perform pre-booking validation with the actual room count. Use this before showing or entering the final order submission path.
+3. `glink.createOrder`
+   - Submit the order with guest, contact, amount, and price item details. When the local order has been created and is ready to submit, call `checkBooking` again first if there is any delay or state change risk.
+4. `glink.payOrder`
+   - Notify Glink after local customer payment succeeds, or after the platform has decided the Glink order should be confirmed.
+5. Glink order operation push/callback
+   - Treat the push/callback as the primary confirmation result channel. The receiver must be idempotent.
+6. `glink.queryOrderDetail`
+   - Use as low-frequency compensation only before final confirmation or cancellation. Do not keep polling confirmed or canceled orders.
+
+Key order identifiers:
+
+- `coOrderCode`: your platform-side order number
+- `fcOrderCode`: Glink-side order number when available
+
+Prefer carrying both once they appear, because several aftercare APIs accept one or both.
+
+## Order Aftercare
+
+Use these calls after booking:
+
+- `glink.cancelOrder`
+  - Cancel an order when policy permits, when the customer asks to cancel, or when the local unpaid timeout is reached, such as 30 minutes. If cancellation returns success, update the local order and do not continue polling for another push.
+- Glink order operation push/callback
+  - This is required for order confirmation progress after `payOrder`. It may not appear as a public `/openapi/v1/glink/*` request route in swagger because it is an inbound callback capability; inspect platform callback route code before implementing.
+- `glink.queryOrderCheckDetailInfo`
+  - Read extended order or check-in related detail.
+- `glink.checkoutApply`
+  - Submit a checkout or refund-like aftercare request for an order.
+- `glink.queryCheckoutDetail`
+  - Query the checkout task by `taskOrderCode`.
+
+## Finance
+
+Use these calls for financial follow-up:
+
+- `glink.createInvoice`
+  - Submit invoice information using business fields only.
+  - Ignore Glink-managed `partnerCode` and `sign` even if they appear in the swagger schema.
+- `glink.queryCreditBalance`
+  - Read remaining credit balance.
+
+## Business Handling Rules
+
+- Do not treat HTTP `200` as enough; inspect `code`.
+- Do not rebuild Glink headers or wrapper payloads; the runtime gateway handles downstream authentication and wrapping.
+- Preserve Glink order identifiers from earlier responses instead of recomputing them.
+- Keep local saleable hotel ID cache and hotel/room mappings current before pricing and booking.
+- Avoid integration quota waste: skip `queryProductDetail` for hotels not in the saleable hotel cache.
+- Push/callback is primary for order confirmation; `queryOrderDetail` is only a compensation path and should not be frequent.

package/skills/glink-hotel-api/glink-openapi-integration/references/auth-and-credentials.md

@@ -0,0 +1,157 @@
+# Glink Auth And Credentials
+
+## Required Headers
+
+Send these headers on every Glink open-platform request:
+
+- `X-OP-App-Key`
+- `X-OP-Timestamp`
+- `X-OP-Nonce`
+- `X-OP-Sign`
+
+Optional headers that can help tracing or idempotency:
+
+- `X-OP-Client-Request-Id`
+- `X-Trace-Id`
+- `X-Idempotency-Key`
+
+`X-OP-App-Key` is the issued `open_app_id`.
+
+## Signature Algorithm
+
+Build the canonical string in this exact order, separated by newline characters:
+
+```text
+METHOD
+PATH
+CANONICAL_QUERY
+BODY_SHA256
+TIMESTAMP
+NONCE
+APP_KEY
+```
+
+Rules:
+
+- Uppercase `METHOD`.
+- Use the exact public request path, for example `/openapi/v1/glink/queryBusinessList`.
+- Sort query parameters by key and then value before joining them as `k=v&k2=v2`.
+- Hash the raw request body bytes with SHA256 and use the lowercase hex digest.
+- Use the request timestamp exactly as sent in `X-OP-Timestamp`.
+- Use the request nonce exactly as sent in `X-OP-Nonce`.
+- Use the same `open_app_id` that is sent in `X-OP-App-Key`.
+- Sign the canonical string with the plain `open_app_secret` using HMAC-SHA256, then output lowercase hex.
+
+Notes:
+
+- Timestamp may be Unix seconds, Unix milliseconds, or RFC3339.
+- The platform validates timestamp drift within roughly `+-5` minutes.
+- Nonce must be unique for the same app key in a short time window.
+- For empty bodies, hash the empty byte string.
+
+## Platform Wrapping Rules
+
+Glink downstream authentication is handled by the runtime gateway.
+
+Client responsibilities:
+
+- Send only business fields.
+- Sign the public open-platform request.
+
+Do not send:
+
+- `partnerCode`
+- `signature` or `sign` used by Glink downstream auth
+- `requestType`
+- Glink-side `timestamp`
+- wrapper objects like `header` or `businessRequest`
+
+Important exception handling:
+
+- `createInvoice` currently still exposes `partnerCode` and `sign` in schema examples and required lists.
+- The route description still says the platform fills those fields automatically.
+- Prefer the route description and treat those fields as platform-managed downstream fields.
+
+## Credential Acquisition
+
+Treat credentials as environment-specific.
+
+Sandbox:
+
+1. The developer applies for app access.
+2. The operator activates the app access with `env_type=sandbox`.
+3. The platform records sandbox Glink mapping and issues a sandbox `open_app_id/open_app_secret`.
+4. The app access becomes `sandbox_active`.
+
+Production:
+
+1. The developer submits production access after sandbox work is complete.
+2. The operator approves production with `env_type=production`.
+3. The platform issues a production `open_app_id/open_app_secret`.
+4. The production credential becomes usable only after the app access reaches `production_active`.
+
+Important constraints:
+
+- Sandbox and production credentials are separate and not interchangeable.
+- Developers can see platform credentials only.
+- Developers cannot see Glink downstream secrets.
+
+## How To View Or Reset Keys
+
+Developer portal APIs:
+
+- `GET /api/portal/apps/{app_id}/credentials`
+  - Returns the credential list for the app.
+  - Includes `open_app_id`, `provider_code`, `env_type`, `open_secret_version`, and masked secret data.
+  - Does not return the plain secret in normal list queries.
+- `POST /api/portal/apps/{app_id}/credentials/reset`
+  - Resets the platform secret and returns `plain_open_secret`.
+  - If the app has more than one credential mapping, pass both `provider_code` and `env_type`.
+
+Response fields that matter:
+
+- `open_app_id`: the App Key to place into `X-OP-App-Key`
+- `open_secret_masked`: masked secret for display only
+- `open_secret_version`: useful for rotation tracking
+- `plain_open_secret`: returned only on first issuance or reset
+
+Practical guidance:
+
+- If a developer says "I can only see a masked secret", instruct them to use the reset endpoint or the corresponding portal UI action.
+- If the task is only to call sandbox APIs, do not assume production credentials work.
+- If the app has both sandbox and production mappings, always name the target `env_type` explicitly.
+
+## Common Auth Failures
+
+- `APP_KEY_INVALID`
+  - Wrong `open_app_id`, wrong environment, or the credential does not exist.
+- `SIGN_ERROR`
+  - Wrong secret, wrong path, wrong query ordering, wrong body hash, or newline formatting mismatch.
+- `TIMESTAMP_EXPIRED`
+  - Clock skew exceeds the allowed window.
+- `NONCE_REPLAY`
+  - Nonce was reused under the same app key.
+- `PRODUCT_FORBIDDEN`
+  - The app is not enabled for the product, the mapping is not active, or an IP whitelist rule failed.
+
+## Response Contract
+
+The platform wraps business responses in a common envelope:
+
+```json
+{
+  "request_id": "req_xxx",
+  "trace_id": "trc_xxx",
+  "downstream_request_id": "optional",
+  "code": "SUCCESS",
+  "message": "ok",
+  "data": {}
+}
+```
+
+Interpretation:
+
+- `request_id` and `trace_id` are platform-side tracing keys.
+- `downstream_request_id` is the Glink request identifier when available.
+- `code=SUCCESS` means the business call succeeded.
+- `code=SUPPLIER_BIZ_ERROR` means Glink returned a business error and can still arrive with HTTP `200`.

package/skills/glink-hotel-api/glink-openapi-integration/references/endpoint-index.md

@@ -0,0 +1,130 @@
+# Glink Endpoint Index
+
+All routes are public gateway routes. Sign the public path, not the downstream Glink path.
+
+## Static Data
+
+- `glink.queryBusinessList`
+  - `POST /openapi/v1/glink/queryBusinessList`
+  - Required body fields: `cityCode`
+- `glink.queryCountryList`
+  - `POST /openapi/v1/glink/queryCountryList`
+  - Required body fields: none
+- `glink.queryHotelPlateList`
+  - `POST /openapi/v1/glink/queryHotelPlateList`
+  - Required body fields: none
+- `glink.queryHotCityList`
+  - `POST /openapi/v1/glink/queryHotCityList`
+  - Required body fields: none
+- `glink.queryDistrictList`
+  - `POST /openapi/v1/glink/queryDistrictList`
+  - Required body fields: `cityCode`
+- `glink.queryDistrictAndBusiness`
+  - `POST /openapi/v1/glink/queryDistrictAndBusiness`
+  - Required body fields: `cityCode`
+- `glink.queryCityList`
+  - `POST /openapi/v1/glink/queryCityList`
+  - Required body fields: `countryCode`
+
+## Hotel Query
+
+- `glink.queryCityAndHotelByKeyword`
+  - `POST /openapi/v1/glink/queryCityAndHotelByKeyword`
+  - Required body fields: `keyWord`
+- `glink.getDestination`
+  - `POST /openapi/v1/glink/getDestination`
+  - Required body fields: `keyWord`
+  - Swagger example uses `keyword`; double-check the field naming against current backend behavior before coding around it.
+- `glink.getHotelSearch`
+  - `POST /openapi/v1/glink/getHotelSearch`
+  - Required body fields: none
+  - Common fields: `cityCode`, `checkInDate`, `checkOutDate`, `roomNum`, `language`
+- `glink.findHotelList`
+  - `POST /openapi/v1/glink/findHotelList`
+  - Required body fields from schema: `roomFacilityCodes`, `hotelFacilityCodes`, `checkInDate`, `checkOutDate`, `distance`
+  - Treat this as a high-friction route and inspect the real example payload before implementing.
+- `glink.queryHotelAllList`
+  - `POST /openapi/v1/glink/queryHotelAllList`
+  - Required body fields: none
+
+## Hotel Info
+
+- `glink.queryHotelIdList`
+  - `POST /openapi/v1/glink/queryHotelIdList`
+  - Required body fields: none
+  - The Open Platform Glink onboarding flow commonly uses `cityCode` to fetch the account's saleable hotel IDs for that city; verify the current swagger/code example before generating strict DTOs.
+- `glink.queryHotelInfo`
+  - `POST /openapi/v1/glink/queryHotelInfo`
+  - Required body fields: `hotelIds`
+- `glink.queryHotelIncrement`
+  - `POST /openapi/v1/glink/queryHotelIncrement`
+  - Required body fields: `startTime`, `endTime`
+  - Swagger example uses `lastUpdateTime`; inspect schema versus example before generating code.
+- `glink.queryHotelImage`
+  - `POST /openapi/v1/glink/queryHotelImage`
+  - Required body fields: `hotelIds`
+  - Swagger example uses `hotelId`; inspect schema versus example before generating code.
+- `glink.queryHotelMainInfoByHotelIds`
+  - `POST /openapi/v1/glink/queryHotelMainInfoByHotelIds`
+  - Required body fields: `language`
+
+## Product Info
+
+- `glink.queryHotelLowestPrice`
+  - `POST /openapi/v1/glink/queryHotelLowestPrice`
+  - Required body fields: `hotelIds`
+- `glink.queryProductDetail`
+  - `POST /openapi/v1/glink/queryProductDetail`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomNum`
+
+## Order Info
+
+- `glink.checkBooking`
+  - `POST /openapi/v1/glink/checkBooking`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomId`, `ratePlanId`, `roomNum`, `supplyCode`
+- `glink.createOrder`
+  - `POST /openapi/v1/glink/createOrder`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomId`, `ratePlanId`, `roomNum`, `supplyCode`, `totalAmount`, `coOrderCode`, `priceItems`, `guestInfos`, `linkMan`, `linkPhone`, `arriveTime`, `latestArriveTime`
+- `glink.payOrder`
+  - `POST /openapi/v1/glink/payOrder`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- `glink.cancelOrder`
+  - `POST /openapi/v1/glink/cancelOrder`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`, `cancelReson`
+- `glink.queryOrderDetail`
+  - `POST /openapi/v1/glink/queryOrderDetail`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- Glink order operation push/callback
+  - Required by the Open Platform Glink booking flow after `payOrder`.
+  - This is an inbound callback capability rather than a normal public `/openapi/v1/glink/*` request route in the current endpoint list. Before implementing, inspect route code or product requirements for the platform callback URL, signature/auth expectations, idempotency key, and retry handling.
+- `glink.queryOrderCheckDetailInfo`
+  - `POST /openapi/v1/glink/queryOrderCheckDetailInfo`
+  - Required body fields: none
+  - Common fields: `coOrderCode`, `fcOrderCode`
+- `glink.checkoutApply`
+  - `POST /openapi/v1/glink/checkoutApply`
+  - Required body fields: `fcOrderCode`, `checkoutReason`, `checkoutRoomInfoList`
+- `glink.queryCheckoutDetail`
+  - `POST /openapi/v1/glink/queryCheckoutDetail`
+  - Required body fields: `taskOrderCode`
+  - Swagger example uses order codes instead of `taskOrderCode`; inspect the live contract before coding.
+
+## Finance
+
+- `glink.createInvoice`
+  - `POST /openapi/v1/glink/createInvoice`
+  - Business-required fields to focus on: `orderCode`, `invoiceTypeInteger`, `invoiceHeader`, `amount`, `applyId`, `invoiceTitleType`, `getMethod`
+  - Schema still marks `partnerCode` and `sign` as required, but route docs say the platform injects Glink auth fields. Do not send Glink-managed fields from the client.
+- `glink.queryCreditBalance`
+  - `POST /openapi/v1/glink/queryCreditBalance`
+  - Required body fields: none
+
+## Global Notes
+
+- Most Glink routes accept plain business JSON bodies with no wrapper objects.
+- Platform error responses can return `401`, `403`, `404`, `500`, `502`, or `504`.
+- Common auth-related `401` codes are `APP_KEY_INVALID`, `SIGN_ERROR`, `TIMESTAMP_EXPIRED`, and `NONCE_REPLAY`.
+- Common `403` cause is `PRODUCT_FORBIDDEN`.