❌ Prohibited: Directly modify .ts / .tsx / .js files in the user's project
❌ Prohibited: Modify alipay-sdk-config.ts or similar payment configuration files
✅ Correct: Output configuration content for the user to copy manually
✅ Correct: Inform the user of the file path and specific content that needs to be modified

❌ Prohibited: Automatically generate public keys or key pairs for users
❌ Prohibited: Tell users that we can "help generate public keys" or "help generate key pairs"
❌ Prohibited: Provide any key generation code, commands, or scripts
❌ Prohibited: Request, receive, or process users' private key information
❌ Prohibited: Call createKeyConfirmPage when the user has not explicitly provided a publicKey
❌ Prohibited: Automatically generate, infer, complete, rewrite, or add prefixes/suffixes to publicKey

✅ Mandatory: Guide users to the official key generation tool of the Alipay Open Platform
✅ Mandatory: Only accept complete publicKey explicitly provided by users
✅ Mandatory: Remind users to properly store their private keys and never disclose them to anyone

✅ Mandatory: Strictly follow the call examples and parameter structures in the skill documentation
✅ Mandatory: Use the complete parameters defined in the documentation, do not omit any parameters
✅ Mandatory: Use --json and 2>/dev/null together
❌ Prohibited: Infer or guess parameter names on your own
❌ Prohibited: Omit parameters defined in the documentation (including "ctx":{})
❌ Prohibited: Add extra parameters not defined in the documentation
❌ Prohibited: Modify the JSON nested structure of parameters

✅ Mandatory: Set the PLATFORM environment variable before each alipay-cli call
✅ Mandatory: DEV_TOOL_NAME comes from Step 1 intelligent recognition, fill in "unknown" if missing
❌ Prohibited: Call alipay-cli directly without setting the PLATFORM environment variable
❌ Prohibited: Hardcode the PLATFORM value (e.g., PLATFORM=claudeCode)
❌ Prohibited: Use semicolon ; to connect commands (may cause environment variable leakage)

❌ Prohibited to disclose: https://opengw.alipay.com/oauth/device (this link cannot be used for authorization)
✅ Correct link: https://aipay.alipay.com/cli-auth?deviceCode=xxx&productCode=xxx&mccCode=xxx&platform=xxx

❌ Prohibited to display: QR code prompts, alipays:// protocol links
✅ Mandatory: Output confirmPageUrl in Markdown link format
✅ Mandatory: Wait for user confirmation before proceeding with subsequent steps

❌ Prohibited: Continue executing subsequent operations after detecting insufficient authorization scope
❌ Prohibited: Re-login directly without executing logout
✅ Mandatory: Execute logout first, then re-authorize after detection
✅ Mandatory: Use the correct scope when re-authorizing (determined based on the current salesCode)

TaskCreate({ subject: "Environment Check", description: "Check alipay-cli installation status and operating environment" })
TaskCreate({ subject: "Solution Planning", description: "Recommend products and business categories based on user business" })
TaskCreate({ subject: "Login Authorization", description: "Alipay OAuth authorization login" })
TaskCreate({ subject: "Information Collection", description: "Collect website screenshots (only when PC Website Payment is not signed)" })
TaskCreate({ subject: "Onboarding Promotion", description: "Contract signing, service registration, application publication" })
TaskCreate({ subject: "Process Completion", description: "Output onboarding results" })

{
  "productName": "PC Website Payment|AI Pay",
  "salesCode": "I1080300001000041203|I1080300001000160457",
  "scope": "app:all,fast_instant_trade_pay:write|app:all,machine_pay:write,agmnt:write",
  "mccCode": "Axxxx_Bxxxx",
  "mccName": "Level 1 Category > Level 2 Category",
  "collect_information": {
    "pc_home_page_image": "fileKey (only for PC Website Payment)",
    "pc_shop_page_image": "fileKey (only for PC Website Payment)",
    "pc_payment_image": "fileKey (only for PC Website Payment)"
  }
}

Step 1: Environment Check → Step 2: Solution Planning → Step 3: Login Authorization
    → Step 3.1: Contract Signing Status Query (sub-operation) → Determine subsequent process
    → Step 4: Information Collection (conditional execution)
    → Step 5: Onboarding Promotion (contract signing + service registration + application publication)
    → Step 6: Process Completion

if ! export PLATFORM=${DEV_TOOL_NAME} && alipay-cli version &>/dev/null; then
  echo "🔄 Installing alipay-cli..."
  curl -fsSL https://opengw.alipay.com/alipaycli/install | bash
fi

export PLATFORM=${DEV_TOOL_NAME} && alipay-cli mcp call ar-query.queryArInfosBySalesProd \
  -d '{"request":{"salesProductCodes":["<salesCode>"]},"ctx":{}}' --json 2>/dev/null

📋 PC Website Payment requires 3 website screenshots:
  1. Homepage screenshot  2. Product page screenshot  3. Payment page screenshot
Please upload the screenshots to continue.

# Upload screenshot to get fileKey
export PLATFORM=${DEV_TOOL_NAME} && alipay-cli file upload "$FILE_PATH" -s payMerchantcodeSkill --json 2>/dev/null

✅ Mandatory: Before executing contract signing-related operations → Read references/product-sign.md first
✅ Mandatory: Before executing application publication-related operations → Read references/app-release.md first
✅ Mandatory: Before executing service market registration-related operations → Read references/service-registration.md first
✅ Mandatory: Before executing login authorization-related operations → Read references/authorization.md first
❌ Prohibited: Call any MCP methods directly without reading the documentation
❌ Prohibited: Guess or infer MCP method names, parameter names, or parameter structures based on memory
❌ Prohibited: Fabricate MCP methods that do not exist in the documentation (such as deleteService, updateApplication, etc.)
❌ Prohibited: Bring the ctx parameter habit from the contract signing module into the application publication module
❌ Prohibited: Bring the no-ctx habit from the application publication module into the contract signing module

Let me first help you plan the solution, then complete the onboarding process step by step.
---
📋 Based on your [user business description], I recommend the following solution:

| Item | Information |
|------|------|
| Product Type | [Product Name] |
| Business Category | [Level 1 Category] > [Level 2 Category] ([mccCode]) |

Please confirm if the solution is appropriate? We will proceed to the next step after confirmation.

📋 Understood, here are other options in the [Level 1 Category] category for you:

| No. | Business Category | Applicable Scenario |
|------|----------|----------|
| 1 | [Level 1 Category] > [Level 2 Category 1] | [Applicable Scenario 1] |
| 2 | [Level 1 Category] > [Level 2 Category 2] | [Applicable Scenario 2] |

Please select the number, or continue describing your business scenario.

📋 Contract Signing Information:
  • Signing Status: [Status]
  • Rate: [Rate Value]

> Due to possible periodic promotional activities by Alipay, the actual rate may be lower than the rate shown on this page. Please refer to the corresponding expense bill for details.

🎉 Alipay Merchant Onboarding Process Completed!

| Module | Item | Information |
|------|------|------|
| 📦 Product Information | Product Type | [Product Name] |
| 📦 Product Information | Business Category | [Category Name] |
| 📋 Contract Signing Information | Signing Status | [Status] |
| 📋 Contract Signing Information | Rate | [Rate Value] (if applicable) |
| 📱 Application Information | App ID | [appId] |
| 📱 Application Information | App Status | [Status] |

> Due to possible periodic promotional activities by Alipay, the actual rate may be lower than the rate shown on this page. Please refer to the corresponding expense bill for details.

if echo "$RESULT" | grep -qiE "HTTP 401|Authorization is empty|mccCode.*is not auth|salesProductCodes.*is not auth|scope.*is not auth|Authorization information mismatch"; then
  # → Execute scripts/handle_scope_mismatch.sh
fi