tixbit 0.3.0 → 0.3.1

package/README.md

@@ -8,7 +8,7 @@ No command requires a TixBit developer API key. Public discovery and links need
 
 Run `tixbit auth` for public browser sign-in and wallet setup links. This command does not create a CLI session. Open the returned TixBit sign-in page, then complete checkout or selling in your browser. Do not copy browser cookies or bearer tokens.
 
-Seller-capable builds use `tixbit sell login` for browser OAuth with PKCE and explicit seller consent. The 0.3.0 release candidate includes an issued public CLI client, but 0.3.0 is not yet published, the client is not production-allowlisted, and seller account configuration is absent. Seller sign-in is not currently ready for end users. Website sign-in alone does not create a CLI session. The `buy` web checkout route does not issue Link spend requests; it expects a token from an authorized integration.
+Seller-capable builds use `tixbit sell login` for browser OAuth with PKCE and explicit seller consent. CLI 0.3.0 or newer includes a public OAuth client and requires an enabled seller connection. Run `sell capabilities` before signing in; if `configured` is false or the endpoint is unavailable, operator setup is still pending. Website sign-in alone does not create a CLI session. The `buy` web checkout route does not issue Link spend requests; it expects a token from an authorized integration.
 
 For wallet setup, use [official Link onboarding](https://link.com/agents): install `@stripe/link-cli` and run `link-cli onboard`. This requires your Link account, not a developer API key. A Link spend request is a separate approval for a selected purchase. See [Link agent checkout](#link-agent-checkout).
 
@@ -159,20 +159,17 @@ Seller JSON uses the existing web API schema. Example after seller approval:
 
 ### Sell your own tickets
 
-Release prerequisites: `0.3.0` is an unpublished candidate. Its built-in public
-OAuth client has been issued, but has not been approved or allowlisted in
-production, and the seller account bridge is not configured. The commands below
-describe the intended workflow after publication and authorized server setup;
-they do not mean seller sign-in currently works.
-
-After a seller-capable `0.3.0` or newer release is published, install it with
-`npm install -g tixbit@latest` and verify `tixbit --version`. Installing today's
-published release does not install this candidate. Before signing in, operators
-must deploy the companion seller service, configure its account bridge and
-approve the exact built-in client in the required allowlists. Then check
-`sell capabilities`; `configured: true` alone does not prove this client or user
-has seller access. End users will not need a developer API key or manual client
-setup once those prerequisites are complete.
+Seller commands require CLI `0.3.0` or newer and an enabled seller connection.
+Install with `npm install -g tixbit@latest`, verify `tixbit --version`, and run
+`sell capabilities` before signing in. If `configured: false` or the endpoint
+is unavailable, operator setup or deployment is still pending; public discovery
+can continue. `configured: true` alone does not prove client approval or user
+eligibility.
+
+The CLI includes a public OAuth client, so end users need no developer API key
+or manual client setup once the companion seller service and account bridge
+are enabled and the exact client has been approved in the required allowlists.
+The workflow below applies when those prerequisites are satisfied.
 
 ```sh
 tixbit sell --help
@@ -226,8 +223,8 @@ marketplace eligibility and sale-state checks still apply.
 
 The distributable [seller skill](skills/tixbit-selling/SKILL.md) includes exact
 workflows, installation and troubleshooting. Copy the complete directory into
-your agent's skills directory; it is included in this candidate's package contents
-and will ship with the seller-capable npm release after publication.
+your agent's skills directory; the complete skill is included in the seller-capable
+npm package.
 
 MPP `purchase` retains the official mppx path but now requires `--confirm`, `--max-price`, and an explicit `--idempotency-key` before wallet loading. Its challenge hook checks the pathUSD atomic amount before any credential is created, rejects unknown assets/recurring intents, and permits only one payment challenge. The cap covers the ticket charge; network fees, if any, are managed separately by the wallet. SDK callers who inject their own `paymentFetch` own its authorization policy: use `assertMppChallenge` in `onChallenge` as shown below and get user approval before calling `purchaseTickets`. Do not register credential-producing event handlers that bypass this hook.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tixbit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Search events, buy tickets, and review and manage your own TixBit seller listings",
   "type": "module",
   "main": "./dist/index.js",

package/skills/tixbit-selling/SKILL.md

@@ -13,17 +13,15 @@ or disclose credentials.
 
 ## Install and discover
 
-Current readiness: `0.3.0` is an unpublished release candidate. The built-in
-public OAuth client has been issued, but it has not been approved or allowlisted
-in production, and seller account configuration is absent. Do not promise that
-seller sign-in works or direct users to complete seller login yet. Public search
-can continue without OAuth.
-
-The following installation and workflows apply after TixBit publishes a
-seller-capable `0.3.0` or newer release and operators deploy/configure the
-companion seller service and approve its exact client in both required
-allowlists. Use Node.js 22.12+. `npm install -g tixbit@latest` installs the
-currently published version; it will not obtain this candidate before publication:
+Use Node.js 22.12+, CLI `0.3.0` or newer, and an enabled seller connection.
+Install the latest published CLI, verify its version, and run `sell capabilities`
+before signing in. If `configured: false` or the endpoint is unavailable,
+operator setup or deployment is still pending: stop seller login and changes;
+public search can continue without OAuth.
+
+Operators must deploy/configure the companion seller service and account bridge
+and approve the exact public client in the required allowlists. Installing the
+CLI alone does not establish those prerequisites or grant seller access.
 
 ```sh
 npm install -g tixbit@latest
@@ -39,15 +37,14 @@ true` alone does not prove this user can sell.
 
 Copy the entire `tixbit-selling` directory into `$CODEX_HOME/skills/` (default
 `~/.codex/skills/`) for Codex, or `~/.claude/skills/` for Claude Code. Keep its
-`references` and `agents` directories. The candidate package includes this skill
-under `skills/tixbit-selling`; it becomes available through npm when the
-seller-capable release is published.
+`references` and `agents` directories. The seller-capable npm package includes this skill
+under `skills/tixbit-selling`.
 
 ## Sign in on this machine
 
-Proceed only after the release and operator configuration prerequisites above
-are complete. The candidate includes an issued public OAuth client; issuance
-alone grants no production approval or access. Check `sell capabilities` and
+Proceed only after the version and enabled-connection prerequisites above
+are complete. The CLI includes a public OAuth client; issuance alone grants no
+production approval or access. Check `sell capabilities` and
 stop if support is unavailable. Even `configured: true` does not prove client
 approval or user eligibility. Once configured and approved, end users need no
 developer API key or manual client setup and can start login with:
@@ -160,10 +157,9 @@ See [seller workflows](references/workflows.md) for repricing and delisting.
 
 ## Operator client configuration
 
-The built-in public client is issued but not yet production-approved. Operators
-must separately authorize configuration and add its exact ID to the required
-allowlists; this skill does not perform those actions. Once ready, end users
-use that built-in client. For a separate approved integration,
+Operators must separately authorize seller configuration and approve the
+built-in public client in the required allowlists; this skill does not perform
+those actions. Once ready, end users use that built-in client. For a separate approved integration,
 `--client-id` or `TIXBIT_SELLER_CLIENT_ID` overrides it. A client ID is public;
 registration alone grants no seller access. Operators can follow the
 [explicit client provisioning procedure](https://github.com/tixbit/tixbit-monorepo/blob/main/docs/runbooks/mcp-cli-provisioning.md).

package/skills/tixbit-selling/references/troubleshooting.md

@@ -2,9 +2,9 @@
 
 | Result | Next action |
 | --- | --- |
-| `sell` missing / npm still installs an older release | 0.3.0 is currently unpublished. Wait for a seller-capable release, then verify the installed version and `sell --help`. |
+| `sell` missing / npm still installs an older release | Install an available seller-capable release (0.3.0 or newer), then verify the installed version and `sell --help`. If none is published, wait for release. |
 | Capabilities `configured: false` / HTTP 503 | Stop seller work. Operator approval/configuration of account bridge, SQLite, keys and exact client allowlist is required. Public search can continue. |
-| Client/scopes rejected | The issued built-in client is not yet production-approved or allowlisted. Stop and ask the operator to complete authorized setup; updating the CLI alone does not grant access. Do not self-register to bypass approval. |
+| Client/scopes rejected | Stop and ask the operator to verify enabled seller configuration and exact client allowlisting; updating the CLI alone does not grant access. Do not self-register to bypass approval. |
 | Repeated browser sign-in | Operator checks canonical origins, matching Privy app and verified-session cookies. Never copy browser tokens. |
 | Callback/state invalid | Restart login on the same machine. Paste the full URL through stdin in `sell login --complete`; never remove state or use a bare code. |
 | HTTP 401 / expired session | Sign in again and review permissions. |

package/skills/tixbit-selling/references/workflows.md

@@ -1,10 +1,10 @@
 # Seller workflows
 
-These workflows apply after publication of a seller-capable 0.3.0 or newer
-release and authorized production seller configuration/client allowlisting.
-The current candidate is unpublished; its issued public client is not yet
-production-approved, and account configuration is absent. Do not attempt seller
-sign-in or mutations until those prerequisites are complete.
+These workflows require CLI 0.3.0 or newer and an enabled seller connection,
+including authorized account configuration and exact client allowlisting. Run
+`sell capabilities` first. If `configured: false` or the endpoint is unavailable,
+operator setup or deployment is pending; stop seller sign-in and mutations until
+those prerequisites are complete.
 
 
 ## Reprice owned tickets