@mongoui/skills 0.1.9 → 0.2.1

package/skills/bms-api/references/source-manifest.json

@@ -0,0 +1,5 @@
+{
+  "api_version": "1.4.0",
+  "operation_count": 131,
+  "source_sha256": "2d220ee1629074fd0af5914ff4b78be813dcc39e4e68f7e686863ce5948da5a2"
+}

package/skills/bms-api/scripts/bms_signed_request.py

@@ -0,0 +1,103 @@
+#!/usr/bin/env python3
+"""Sign BMS JSON requests offline; use --send explicitly for a network request."""
+import argparse
+import hashlib
+import hmac
+import json
+import os
+from pathlib import Path
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+
+TOKEN_EXCEPTIONS = {'/openapi/v1/bms/auth/token', '/openapi/v1/bms/auth/customer/register'}
+
+def canonical_query(raw):
+    # Match pkg/crypto/signature.go: decode form query before sorting; no re-encoding.
+    return '&'.join(key+'='+value for key, value in sorted(urllib.parse.parse_qsl(raw, keep_blank_values=True)))
+
+def sign_request(method, path, raw_query, body, app_id, secret, timestamp, nonce):
+    canonical = '\n'.join([method.upper(), path, canonical_query(raw_query), hashlib.sha256(body).hexdigest(), timestamp.strip(), nonce.strip(), app_id.strip()])
+    signature = hmac.new(secret.encode(), canonical.encode(), hashlib.sha256).hexdigest()
+    return canonical, {'X-OP-App-Key': app_id.strip(), 'X-OP-Timestamp': timestamp.strip(), 'X-OP-Nonce': nonce.strip(), 'X-OP-Sign': signature}
+
+def redact(value):
+    if isinstance(value, dict):
+        return {key: '<redacted>' if any(word in key.lower() for word in ['secret', 'token', 'password', 'aeskey', 'sign']) else redact(item) for key, item in value.items()}
+    if isinstance(value, list):
+        return [redact(item) for item in value]
+    return value
+
+class NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--method', required=True)
+    parser.add_argument('--path', required=True, help='Complete public path without query')
+    parser.add_argument('--query', default='', help='Actual URL query string; percent-encoded when needed')
+    body_group = parser.add_mutually_exclusive_group()
+    body_group.add_argument('--body-json')
+    body_group.add_argument('--body-file', type=Path, help='Exact UTF-8 JSON body bytes')
+    parser.add_argument('--base-url', default=os.getenv('OPEN_API_BASE_URL'))
+    parser.add_argument('--timestamp', default=str(int(time.time())))
+    parser.add_argument('--nonce', default=uuid.uuid4().hex)
+    parser.add_argument('--send', action='store_true')
+    parser.add_argument('--timeout', type=float, default=20)
+    args = parser.parse_args()
+    app_id = os.getenv('OPEN_APP_ID', '').strip()
+    secret = os.getenv('OPEN_APP_SECRET', '')
+    token = os.getenv('BMS_TOKEN', '').strip()
+    if not app_id or not secret:
+        parser.error('Set OPEN_APP_ID and OPEN_APP_SECRET in the server environment.')
+    if not args.path.startswith('/openapi/v1/bms/') or '?' in args.path or '#' in args.path:
+        parser.error('--path must be the full public BMS path, without query or fragment.')
+    try:
+        if args.body_file:
+            body = args.body_file.read_bytes()
+            json.loads(body)
+        elif args.body_json is not None:
+            body = json.dumps(json.loads(args.body_json), ensure_ascii=False, separators=(',', ':')).encode()
+        else:
+            body = b''
+    except (OSError, ValueError):
+        parser.error('Body must be valid JSON; multipart and file downloads need a separate client.')
+    canonical, headers = sign_request(args.method, args.path, args.query, body, app_id, secret, args.timestamp, args.nonce)
+    headers['Accept'] = 'application/json'
+    if body:
+        headers['Content-Type'] = 'application/json'
+    if args.path not in TOKEN_EXCEPTIONS:
+        if args.send and not token:
+            parser.error('Business requests require BMS_TOKEN from this environment.')
+        if token:
+            headers['token'] = token
+    if not args.send:
+        print(json.dumps({'mode':'offline', 'method':args.method.upper(), 'path':args.path, 'canonical_string':canonical, 'headers':redact(headers), 'body_bytes':len(body), 'token_required':args.path not in TOKEN_EXCEPTIONS}, ensure_ascii=False, indent=2))
+        return 0
+    parsed = urllib.parse.urlsplit(args.base_url or '')
+    if parsed.scheme not in {'http','https'} or not parsed.netloc or parsed.username or parsed.query or parsed.fragment or parsed.path.rstrip('/'):
+        parser.error('Set OPEN_API_BASE_URL to the selected Open Platform gateway origin, without credentials, path, query or fragment.')
+    url = args.base_url.rstrip('/')+args.path+('?' + args.query if args.query else '')
+    request = urllib.request.Request(url, data=body if body else None, headers=headers, method=args.method.upper())
+    try:
+        response = urllib.request.build_opener(NoRedirect()).open(request, timeout=args.timeout)
+        with response:
+            status, data = response.status, response.read()
+    except urllib.error.HTTPError as error:
+        status, data = error.code, error.read()
+    except (urllib.error.URLError, TimeoutError):
+        print('Request outcome unknown. Query the business record before replaying a write.', file=sys.stderr)
+        return 1
+    print('HTTP', status)
+    try:
+        print(json.dumps(redact(json.loads(data)), ensure_ascii=False, indent=2))
+    except (ValueError, UnicodeError):
+        print('Non-JSON response; use a binary-capable client for exports.')
+    return 0 if 200 <= status < 300 else 1
+
+if __name__ == '__main__':
+    raise SystemExit(main())

package/skills/glink-hotel-api/SKILL.md

@@ -1,5 +1,5 @@
 ---
-name: glink-hotel-api
+name: glink-hotel-api
 description: Integrate with the Glink hotel OpenAPI exposed through the Open Platform runtime gateway. Use when Codex needs to read, verify, explain, test, or implement against `docs/swagger/glink-api.json` or Glink route code; choose Glink hotel endpoints; generate or debug `X-OP-*` signatures; explain sandbox or production credential issuance/reset; or drive Chinese/English requests about Glink hotel static data, hotel search, hotel info, product detail, booking, payment, order, cancel, order status push/callback, checkout, invoice, and balance workflows.
 ---
 
@@ -14,11 +14,11 @@ Start with the smallest current source that answers the request:
 - Prefer the repository source of truth when it exists: `docs/swagger/glink-api.json`, route handlers, DTOs, and tests.
 - Treat the current DHub shared document and `docs/swagger/glink-api.json` as the route source of truth; older bundled notes can be stale.
 - Customer-facing explanations should use only our short interface paths such as `/search/destination`, `/booking/createOrder`, and `/order/orderDetail`.
-- Read `references/auth-and-credentials.md` for signing, headers, key acquisition, reset, and auth troubleshooting.
-- Read `references/api-workflows.md` for hotel search, booking, cancel, checkout, invoice, and balance workflows.
-- Read `references/endpoint-index.md` for a compact endpoint map and platform-managed field caveats, then verify fragile fields against the current swagger or code.
-- Read `references/field-and-enum-notes.md` for current response-shape changes, renamed fields, enum-like values, and practical scenarios reflected by the latest swagger examples.
-- Use `scripts/glink_signed_request.py` to generate headers, inspect the canonical string, or send a signed request.
+- Read `references/auth-and-credentials.md` for signing, headers, key acquisition, reset, and auth troubleshooting.
+- Read `references/api-workflows.md` for hotel search, booking, cancel, checkout, invoice, and balance workflows.
+- Read `references/endpoint-index.md` for a compact endpoint map and platform-managed field caveats, then verify fragile fields against the current swagger or code.
+- Read `references/field-and-enum-notes.md` for current response-shape changes, renamed fields, enum-like values, and practical scenarios reflected by the latest swagger examples.
+- Use `scripts/glink_signed_request.py` to generate headers, inspect the canonical string, or send a signed request.
 
 ## Working Rules
 

package/skills/glink-hotel-api/references/api-workflows.md

@@ -38,14 +38,14 @@ These APIs usually feed country/city selection, district filters, POI filters, b
 
 For Standard API Integration, build local hotel and room mapping in this order:
 
-1. `/search/hotelIdList`
-   - Fetch the account's saleable hotel ID list and cache it locally.
-   - Use `pageNo` and `pageSize` for pagination; current examples default to `pageNo=1` and `pageSize=1000`.
-   - Read `totalCount` for the total count when returned.
-2. `/hotel/detail`
-   - Fetch hotel and room static data for the cached hotel IDs. Persist only the fields needed for local hotel and room mapping.
-   - Current static fields use `facility`, `popularFacility`, `roomInfos`, `latBaidu`, `lngBaidu`, `groupName`, and `brandName`.
-   - Room bed structures expose object `bedInfos[]` for both bedroom and living room beds.
+1. `/search/hotelIdList`
+   - Fetch the account's saleable hotel ID list and cache it locally.
+   - Use `pageNo` and `pageSize` for pagination; current examples default to `pageNo=1` and `pageSize=1000`.
+   - Read `totalCount` for the total count when returned.
+2. `/hotel/detail`
+   - Fetch hotel and room static data for the cached hotel IDs. Persist only the fields needed for local hotel and room mapping.
+   - Current static fields use `facility`, `popularFacility`, `roomInfos`, `latBaidu`, `lngBaidu`, `groupName`, and `brandName`.
+   - Room bed structures expose object `bedInfos[]` for both bedroom and living room beds.
 3. `/hotel/increment`
    - Periodically fetch changed hotel IDs, including added, updated, or deleted hotels.
 4. `/hotel/detail`
@@ -77,16 +77,16 @@ Mandatory interfaces:
 
 Recommended sequence:
 
-1. `/search/destination`
-   - Resolve the destination keyword into an Open Platform destination ID.
-   - The response `data` is an array of flat destination objects. Use `destinationType` and `source` to decide whether the match is a hotel, city, district, business area, Google/Baidu result, or another type.
-2. `/search/hotelFilters`
-   - Fetch filter conditions when the UI needs hotel filters.
-3. `/search/hotelList`
-   - Search destination-based hotel results using the destination ID, stay dates, and optional filters.
-   - List items use `latBaidu` and `lngBaidu`; `groupName` and `brandName` can be displayed when present.
-4. `/hotel/detail` and optionally `/hotel/images`
-   - Read richer hotel details and media for client display after the hotel list returns candidates.
+1. `/search/destination`
+   - Resolve the destination keyword into an Open Platform destination ID.
+   - The response `data` is an array of flat destination objects. Use `destinationType` and `source` to decide whether the match is a hotel, city, district, business area, Google/Baidu result, or another type.
+2. `/search/hotelFilters`
+   - Fetch filter conditions when the UI needs hotel filters.
+3. `/search/hotelList`
+   - Search destination-based hotel results using the destination ID, stay dates, and optional filters.
+   - List items use `latBaidu` and `lngBaidu`; `groupName` and `brandName` can be displayed when present.
+4. `/hotel/detail` and optionally `/hotel/images`
+   - Read richer hotel details and media for client display after the hotel list returns candidates.
 5. `/hotel/lowestPrice`
    - Optional but useful for list-page price reference when the experience needs a stable starting-price display.
 6. `/booking/productDetails`
@@ -110,12 +110,12 @@ Use this sequence for both Standard API Integration and Lightweight Integration
 
 1. `/booking/productDetails`
    - Identify the exact sellable room and rate.
-2. `/booking/availabilityCheck`
-   - Perform pre-booking validation with the actual room count. Use this before showing or entering the final order submission path.
-   - Use response-level `breakfastNum` and `breakfastType`. Tax breakdown is under `priceItems[].taxDetail` and `roomTaxDetail`.
-3. `/booking/createOrder`
-   - Submit the order with guest, contact, amount, and price item details. When the local order has been created and is ready to submit, call `/booking/availabilityCheck` again first if there is any delay or state change risk.
-   - Use `guestInfos[].guestType` for the guest type dictionary. Do not send the old nested `guestInfos[].nationality` field.
+2. `/booking/availabilityCheck`
+   - Perform pre-booking validation with the actual room count. Use this before showing or entering the final order submission path.
+   - Use response-level `breakfastNum` and `breakfastType`. Tax breakdown is under `priceItems[].taxDetail` and `roomTaxDetail`.
+3. `/booking/createOrder`
+   - Submit the order with guest, contact, amount, and price item details. When the local order has been created and is ready to submit, call `/booking/availabilityCheck` again first if there is any delay or state change risk.
+   - Use `guestInfos[].guestType` for the guest type dictionary. Do not send the old nested `guestInfos[].nationality` field.
 4. `/booking/payOrder`
    - Notify payment after local customer payment succeeds, or after the platform has decided the order should be confirmed.
 5. `/notify/orderStatus`
@@ -134,17 +134,17 @@ Prefer carrying both once they appear, because several aftercare APIs accept one
 
 Use these calls after booking:
 
-- `/order/cancelOrder`
-  - Cancel an order when policy permits, when the customer asks to cancel, or when the local unpaid timeout is reached, such as 30 minutes. Send `cancelReason` when there is a customer or platform reason to record. If cancellation returns success, update the local order and do not continue polling for another push.
+- `/order/cancelOrder`
+  - Cancel an order when policy permits, when the customer asks to cancel, or when the local unpaid timeout is reached, such as 30 minutes. Send `cancelReason` when there is a customer or platform reason to record. If cancellation returns success, update the local order and do not continue polling for another push.
 - `/notify/orderStatus`
   - Required for order confirmation progress after `/booking/payOrder`; implement idempotency.
 - `/order/checkInDetail`
   - Read extended order or check-in related detail.
 - `/order/checkoutRequest`
   - Submit a checkout or refund-like aftercare request for an order.
-- `/order/checkoutDetail`
-  - Query the checkout task by `taskOrderCode`.
-  - Use `paymentType` to distinguish prepaid and pay-at-hotel orders. Read `refundDetailList[]` for refund channel/time/amount/bill data and `checkoutDetailPriceItemList[].originalSalePrice` for original daily sale price.
+- `/order/checkoutDetail`
+  - Query the checkout task by `taskOrderCode`.
+  - Use `paymentType` to distinguish prepaid and pay-at-hotel orders. Read `refundDetailList[]` for refund channel/time/amount/bill data and `checkoutDetailPriceItemList[].originalSalePrice` for original daily sale price.
 
 ## Finance
 
@@ -161,8 +161,8 @@ Use these calls for financial follow-up:
 
 - Do not treat HTTP `200` as enough; inspect `code`.
 - Use only our short interface paths in customer-facing docs and workflows.
-- Preserve FCG order identifiers from earlier responses instead of recomputing them.
-- In `/order/orderDetail`, use `roomGuestNumbers[]` for room-level adult and child counts. Use `originalAmount` for order original amount, and top-level `nationality` as country or region code.
-- Keep local saleable hotel ID cache and hotel/room mappings current before pricing and booking.
+- Preserve FCG order identifiers from earlier responses instead of recomputing them.
+- In `/order/orderDetail`, use `roomGuestNumbers[]` for room-level adult and child counts. Use `originalAmount` for order original amount, and top-level `nationality` as country or region code.
+- Keep local saleable hotel ID cache and hotel/room mappings current before pricing and booking.
 - Avoid integration quota waste: skip `/booking/productDetails` for hotels not in the saleable hotel cache.
 - Push/callback is primary for order confirmation; `/order/orderDetail` is only a compensation path and should not be frequent.

package/skills/glink-hotel-api/references/endpoint-index.md

@@ -13,21 +13,21 @@ Integration mode shortcuts:
 
 ## Region Static Data
 
-- `/region/countries`
-  - Method: `POST`
-  - Required body fields: none.
-  - Response `data` is an array of country objects directly; there is no `countries` wrapper.
-- `/region/cities`
-  - Method: `POST`
-  - Common body fields: `countryCode`, `language`.
-  - Response `data` is an array of province/city-group objects directly; there is no `provinces` wrapper.
-- `/region/popularCities`
-  - Method: `POST`
-  - Required body fields: none.
-  - Response `data` is an array directly; fields include `latBaidu`, `lngBaidu`, `timeZone`, and `areaType`.
-- `/region/businesses`
-  - Method: `POST`
-  - Common body fields: `cityCode`, `language`.
+- `/region/countries`
+  - Method: `POST`
+  - Required body fields: none.
+  - Response `data` is an array of country objects directly; there is no `countries` wrapper.
+- `/region/cities`
+  - Method: `POST`
+  - Common body fields: `countryCode`, `language`.
+  - Response `data` is an array of province/city-group objects directly; there is no `provinces` wrapper.
+- `/region/popularCities`
+  - Method: `POST`
+  - Required body fields: none.
+  - Response `data` is an array directly; fields include `latBaidu`, `lngBaidu`, `timeZone`, and `areaType`.
+- `/region/businesses`
+  - Method: `POST`
+  - Common body fields: `cityCode`, `language`.
 - `/region/districts`
   - Method: `POST`
   - Common body fields: `cityCode`, `language`.
@@ -37,24 +37,24 @@ Integration mode shortcuts:
 
 ## Hotel Info
 
-- `/search/hotelIdList`
-  - Method: `POST`
-  - Common body fields: `cityCode`, `pageNo`, `pageSize`.
-  - Use `pageNo >= 1` and `pageSize >= 1`; examples default to `pageNo=1`, `pageSize=1000`.
-  - Response pagination uses `totalCount`, not `total`; pagination fields may be absent.
-  - Use for saleable hotel ID bootstrap and cache refresh.
-- `/hotel/popularIdList`
-  - Method: `POST`
-  - Common body fields: `pageNo`, `pageSize`.
-- `/hotel/detail`
-  - Method: `POST`
-  - Required body fields: `hotelIds`.
-  - Current response uses `facility`, `popularFacility`, `applicableRoomTypes`, `openingDate`, `groupId`, `groupName`, `brandId`, `brandName`, `latBaidu`, `lngBaidu`, `wiredBroadband`, `wirelessBroadband`, `comment.averageScore`, and `comment.source`.
-  - Meeting images are under `hotelMeetingInfos[].meetingImages`; do not expect derived size URLs in that node.
-  - Room bed info under both `roomBeds` and `livingRoomBeds` uses object `bedInfos[]` with `bedTypeCode`, `bedName`, `bedWidth`, and `bedNum`.
-- `/hotel/increment`
-  - Method: `POST`
-  - Common body fields: `startTime`, `endTime`, `maxId`, `pageSize`.
+- `/search/hotelIdList`
+  - Method: `POST`
+  - Common body fields: `cityCode`, `pageNo`, `pageSize`.
+  - Use `pageNo >= 1` and `pageSize >= 1`; examples default to `pageNo=1`, `pageSize=1000`.
+  - Response pagination uses `totalCount`, not `total`; pagination fields may be absent.
+  - Use for saleable hotel ID bootstrap and cache refresh.
+- `/hotel/popularIdList`
+  - Method: `POST`
+  - Common body fields: `pageNo`, `pageSize`.
+- `/hotel/detail`
+  - Method: `POST`
+  - Required body fields: `hotelIds`.
+  - Current response uses `facility`, `popularFacility`, `applicableRoomTypes`, `openingDate`, `groupId`, `groupName`, `brandId`, `brandName`, `latBaidu`, `lngBaidu`, `wiredBroadband`, `wirelessBroadband`, `comment.averageScore`, and `comment.source`.
+  - Meeting images are under `hotelMeetingInfos[].meetingImages`; do not expect derived size URLs in that node.
+  - Room bed info under both `roomBeds` and `livingRoomBeds` uses object `bedInfos[]` with `bedTypeCode`, `bedName`, `bedWidth`, and `bedNum`.
+- `/hotel/increment`
+  - Method: `POST`
+  - Common body fields: `startTime`, `endTime`, `maxId`, `pageSize`.
 - `/hotel/lowestPrice`
   - Method: `POST`
   - Common body fields: `hotelIds`, `checkInDate`, `checkOutDate`, `checkInType`.
@@ -67,48 +67,48 @@ Integration mode shortcuts:
 
 ## Search And Booking
 
-- `/search/destination`
-  - Method: `POST`
-  - Common body fields: `keyWord`, `cityCode`, `destinationType`, `source`.
-  - Response `data` is an array directly. Destination item fields are flat and include `destinationId`, `destinationType`, `source`, name/code fields, `hotelId`, `latGoogle`, `lngGoogle`, `latBaidu`, and `lngBaidu`.
-- `/search/hotelFilters`
-  - Method: `POST`
-  - Common body fields: `destinationId`, `language`, `lngGoogle`, `latGoogle`, `distance`.
-- `/search/hotelList`
-  - Method: `POST`
-  - Common body fields: `destinationId`, `lngGoogle`, `latGoogle`, `checkInDate`, `checkOutDate`, filters, `distance`, `currentPage`, `pageSize`.
-  - Response list items use `latBaidu` and `lngBaidu`; items may include `groupName` and `brandName`.
-- `/booking/productDetails`
-  - Method: `POST`
-  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomNum`, `numberOfAdults`.
-  - Product response removed `reminder`. `taxAndFeeDetails` and `feeItems` are objects, not arrays. `priceItems[].taxDetail` includes numeric `roomPrice`, `taxFee`, `salesTax`, and `otherTax`.
-- `/booking/availabilityCheck`
-  - Method: `POST`
-  - Required body fields: `hotelId`, `roomId`, `ratePlanId`, `checkInDate`, `checkOutDate`, `roomNum`, `supplyCode`.
-  - Response-level `breakfastNum` and `breakfastType` are outside `priceItems`. `roomTaxDetail` is an object. `priceItems[].taxDetail` contains room and tax breakdown. `roomStatus` is not exposed.
-- `/booking/createOrder`
-  - Method: `POST`
-  - Required body fields: `hotelId`, `roomId`, `ratePlanId`, `checkInDate`, `checkOutDate`, `roomNum`, `supplyCode`, `totalAmount`, `coOrderCode`, `priceItems`, `guestInfos`, `linkMan`, `linkPhone`, `arriveTime`, `latestArriveTime`.
-  - Use `guestInfos[].guestType` for guest type; do not send `guestInfos[].nationality`.
-- `/booking/payOrder`
-  - Method: `POST`
-  - Common body fields: `coOrderCode`, `fcOrderCode`.
+- `/search/destination`
+  - Method: `POST`
+  - Common body fields: `keyWord`, `cityCode`, `destinationType`, `source`.
+  - Response `data` is an array directly. Destination item fields are flat and include `destinationId`, `destinationType`, `source`, name/code fields, `hotelId`, `latGoogle`, `lngGoogle`, `latBaidu`, and `lngBaidu`.
+- `/search/hotelFilters`
+  - Method: `POST`
+  - Common body fields: `destinationId`, `language`, `lngGoogle`, `latGoogle`, `distance`.
+- `/search/hotelList`
+  - Method: `POST`
+  - Common body fields: `destinationId`, `lngGoogle`, `latGoogle`, `checkInDate`, `checkOutDate`, filters, `distance`, `currentPage`, `pageSize`.
+  - Response list items use `latBaidu` and `lngBaidu`; items may include `groupName` and `brandName`.
+- `/booking/productDetails`
+  - Method: `POST`
+  - Required body fields: `hotelId`, `checkInDate`, `checkOutDate`, `roomNum`, `numberOfAdults`.
+  - Product response removed `reminder`. `taxAndFeeDetails` and `feeItems` are objects, not arrays. `priceItems[].taxDetail` includes numeric `roomPrice`, `taxFee`, `salesTax`, and `otherTax`.
+- `/booking/availabilityCheck`
+  - Method: `POST`
+  - Required body fields: `hotelId`, `roomId`, `ratePlanId`, `checkInDate`, `checkOutDate`, `roomNum`, `supplyCode`.
+  - Response-level `breakfastNum` and `breakfastType` are outside `priceItems`. `roomTaxDetail` is an object. `priceItems[].taxDetail` contains room and tax breakdown. `roomStatus` is not exposed.
+- `/booking/createOrder`
+  - Method: `POST`
+  - Required body fields: `hotelId`, `roomId`, `ratePlanId`, `checkInDate`, `checkOutDate`, `roomNum`, `supplyCode`, `totalAmount`, `coOrderCode`, `priceItems`, `guestInfos`, `linkMan`, `linkPhone`, `arriveTime`, `latestArriveTime`.
+  - Use `guestInfos[].guestType` for guest type; do not send `guestInfos[].nationality`.
+- `/booking/payOrder`
+  - Method: `POST`
+  - Common body fields: `coOrderCode`, `fcOrderCode`.
 - `/search/creditBalance`
   - Method: `POST`
   - Required body fields: none; send `{}` or omit body according to the SDK/runtime caller.
 
 ## Order Info
 
-- `/order/orderDetail`
-  - Method: `POST`
-  - Common body fields: `coOrderCode`, `fcOrderCode`.
-  - Response uses `roomGuestNumbers[]` for room-level adult/child counts. It may include `originalAmount`, top-level `nationality`, and `guestInfos[].guestType`.
-- `/order/cancelOrder`
-  - Method: `POST`
-  - Common body fields: `coOrderCode`, `fcOrderCode`, `cancelReason`.
-- `/order/checkInDetail`
-  - Method: `POST`
-  - Common body fields: `coOrderCode`, `fcOrderCode`.
+- `/order/orderDetail`
+  - Method: `POST`
+  - Common body fields: `coOrderCode`, `fcOrderCode`.
+  - Response uses `roomGuestNumbers[]` for room-level adult/child counts. It may include `originalAmount`, top-level `nationality`, and `guestInfos[].guestType`.
+- `/order/cancelOrder`
+  - Method: `POST`
+  - Common body fields: `coOrderCode`, `fcOrderCode`, `cancelReason`.
+- `/order/checkInDetail`
+  - Method: `POST`
+  - Common body fields: `coOrderCode`, `fcOrderCode`.
 - `/order/invoiceRequest`
   - Method: `POST`
   - Business fields to focus on: `orderCode`, `invoiceTypeInteger`, `invoiceHeader`, `amount`, `applyId`, `invoiceTitleType`, `getMethod`.
@@ -118,10 +118,10 @@ Integration mode shortcuts:
 - `/order/checkoutRequest`
   - Method: `POST`
   - Required body fields: `fcOrderCode`, `supplierRefundNumber`, `checkoutReason`, `refundType`, `checkoutRooms`.
-- `/order/checkoutDetail`
-  - Method: `POST`
-  - Common body fields: `taskOrderCode`.
-  - Response includes hotel/product context, `paymentType`, `refundDetailList[]`, and `checkoutDetailPriceItemList[].originalSalePrice`.
+- `/order/checkoutDetail`
+  - Method: `POST`
+  - Common body fields: `taskOrderCode`.
+  - Response includes hotel/product context, `paymentType`, `refundDetailList[]`, and `checkoutDetailPriceItemList[].originalSalePrice`.
 
 ## Callback Capabilities
 
@@ -140,9 +140,9 @@ Integration mode shortcuts:
 
 ## Global Notes
 
-- Current Glink swagger route count may include outbound request APIs and callback APIs; verify against `docs/swagger/glink-api.json`.
-- Most Glink routes accept plain business JSON bodies with no wrapper objects.
-- For response-shape changes and enum-like values, read `field-and-enum-notes.md` before generating DTOs or examples.
-- Platform error responses can return `401`, `403`, `404`, `500`, `502`, or `504`.
+- Current Glink swagger route count may include outbound request APIs and callback APIs; verify against `docs/swagger/glink-api.json`.
+- Most Glink routes accept plain business JSON bodies with no wrapper objects.
+- For response-shape changes and enum-like values, read `field-and-enum-notes.md` before generating DTOs or examples.
+- Platform error responses can return `401`, `403`, `404`, `500`, `502`, or `504`.
 - Common auth-related `401` codes are `APP_KEY_INVALID`, `SIGN_ERROR`, `TIMESTAMP_EXPIRED`, and `NONCE_REPLAY`.
 - Common `403` cause is `PRODUCT_FORBIDDEN`.

package/skills/tmc-api/SKILL.md

@@ -0,0 +1,63 @@
+---
+name: tmc-api
+description: Work with the TMC white-label OpenAPI exposed through the Open Platform runtime gateway. Use when Codex needs to read, verify, explain, test, document, or implement against `docs/swagger/tmc-api.json`; choose exact TMC endpoints; include complete request/response fields and types; generate customer-facing TMC onboarding, organization, employee, traveler, approval, travel policy, flight, hotel, payment, attachment, certificate, webhook, and aftersale workflows; or debug Open Platform signing, `token`, sandbox, and production TMC calls.
+---
+
+# TMC API
+
+## Quick Start
+
+Use this skill when the task is about TMC white-label OpenAPI integration, customer-facing workflow explanation, interface field lookup, signed requests, or implementation against the Open Platform TMC gateway.
+
+Start from the smallest reference that answers the request:
+
+- Read `references/endpoint-index.md` for the complete 94-operation endpoint map.
+- Read `references/endpoint-details.md` when the answer must include exact request parameters, request body fields, response fields, nested types, examples, or webhook payload fields.
+- Read `references/api-workflows.md` when the user asks for customer process, interaction flow, or test-case-aligned business coverage. It maps the extracted 224 Listify test cases to concrete interfaces.
+- Read `references/auth-and-calling.md` for Open Platform signature rules, runtime path prefixing, token handling, and call validation.
+- Use `scripts/tmc_signed_request.py` to generate headers, inspect the canonical signing string, or send a signed local/sandbox request.
+
+## Source Of Truth
+
+- Current English swagger: `open-platform-go/docs/swagger/tmc-api.en-US.json`.
+- Simplified Chinese swagger: `open-platform-go/docs/swagger/tmc-api.json`; use it only when the user specifically needs Chinese wording.
+- Customer-facing short paths omit `/openapi/v1/tmc`, for example `/flight/search`.
+- Signing and actual gateway calls must use the full runtime path, for example `/openapi/v1/tmc/flight/search`.
+- The Listify test-case page is Chinese flow evidence, not an interface specification. Preserve source case IDs for traceability, but explain customer workflows in English unless the user asks for Chinese.
+
+## Working Rules
+
+Follow this workflow:
+
+1. Confirm whether the user needs customer documentation, exact field tables, code changes, signed request debugging, or live/local API calls.
+2. Choose the flow area first: identity/org/employee/traveler, approval, travel policy, flight booking, flight aftersale, hotel booking, hotel aftersale, payment, attachments, certificates, or webhook callbacks.
+3. Use `references/api-workflows.md` to connect the business scenario or test case to concrete endpoint paths.
+4. Use `references/endpoint-details.md` for all payload details; do not invent request or response fields.
+5. For signed calls, use `/openapi/v1/tmc` in the canonical path and include `X-OP-App-Key`, `X-OP-Timestamp`, `X-OP-Nonce`, and `X-OP-Sign`.
+6. Call `/auth/token` with `externalUserId` first, then pass the returned TMC `token` header on business APIs.
+7. Evaluate both HTTP status and response envelope `code`; non-zero business `code` is a business failure even when HTTP is 200.
+
+## Common Flow Skeletons
+
+- Identity and enterprise context: `/auth/token` -> `/departments` -> `/employees` or `/employees/{userId}`.
+- Organization and staff setup: `/departments` -> `/email-domains` -> `/employees` -> `/employees/{userId}` -> certificate APIs when needed.
+- Traveler setup: `/guests/add` -> `/guests` -> `/guests/{id}` -> guest certificate APIs.
+- Approval setup: `/approval-policies` -> `/approval-policies/page` -> `/approval-policies/{policyId}` -> `/approvals/page` -> `/approvals/{approvalNo}` -> `/approvals/audit` or `/approvals/resubmit`.
+- Travel policy setup: hotel and flight policy CRUD/page/enable APIs -> `/travel-policies/users/{employeeId}`.
+- Flight booking: dictionary APIs -> `/booking-users/list` -> `/flight/search` -> `/flight/cabin` -> `/flight/verify` -> `/flight/order/init` -> `/flight/order/policy-check` -> `/flight/order` -> `/payments/payOrder` -> `/flight/orders/{orderCode}`.
+- Flight aftersale: `/flight/aftersale/capability` -> refund or change remaining-query APIs -> apply/detail/confirm-or-cancel APIs.
+- Hotel booking: `/hotel/locations` -> `/hotel/search/filters` -> `/hotel/search` -> `/hotel/{hotelId}` -> `/hotel/products/search` -> `/hotel/check-booking` -> `/hotel/order/policy-check` -> `/hotel/order` -> `/payments/payOrder` -> `/hotel/orders/{orderCode}`.
+- Hotel early checkout: `/hotel/early-checkout/can-apply` -> `/hotel/early-checkout/apply` -> `/hotel/early-checkout/detail`.
+- Attachments: `/attachments/upload` and `/attachments/download`.
+- Webhooks: read the webhook section in `references/endpoint-details.md`; treat callbacks as customer interaction surface even though they are not part of the 94 request operations.
+
+## Output Expectations
+
+When answering with this skill:
+
+- Use concrete method + path pairs, not only abstract process names.
+- Include field names, types, required flags, and nested structures from `endpoint-details.md` when the user asks for parameters.
+- Mention whether a path is a customer-facing short path or a signed runtime path when auth/signing is relevant.
+- Keep test-case-derived process descriptions tied to exact interfaces.
+- State the source used when swagger, local code, and extracted test cases disagree.
+- Never expose or invent credentials, app secrets, tokens, or tenant data.

package/skills/tmc-api/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "TMC API Integration"
+  short_description: "TMC white-label OpenAPI auth, fields, workflows, and debugging"
+  default_prompt: "Use $tmc-api to explain or implement TMC OpenAPI authentication, endpoint selection, request/response fields, and customer workflows."