Tianyi Account AST Direct Authentication v7.1

What It Solves

When business plugins or upstream skills need a Tianyi account idToken, direct API calls often lack a trusted authentication credential. This skill wraps Tianyi AST QR login and /ast/verify direct validation into one stable path, so each business does not re-implement QR polling, ticket status, and local session recovery.

How It Works

The core path is singular: complete direct authentication through /ast/verify, without gateway mode and without calling /ast/introspect.

• Read direct_auth_init.json or explicit caller parameters.
• Check agent_session.json with the bundled Python helper.
• Resolve the business appId; if the session is valid, call /ast/verify.
• If the session is missing, expired, malformed, or near expiry, call /ast/login/start and /ast/login/qrcode, then show the QR image and login link.
• After the user confirms login, query /ast/login/status/{ticket}.
• On success, persist the local session and identity material, then call /ast/verify to return idToken and expiresAt.

Boundaries

It is intended to be used by other skills or code plugins as an authentication dependency. Success requires the status endpoint to return success, agent_session.json to be saved, and direct authentication to return idToken and expiresAt. Do not expose agentSessionToken, private key material, signing plaintext, local file paths, or appId to the caller, and do not use it for refresh, logout, or gateway fallback.