@cometchat/skills-cli 2.4.1 → 3.0.0

package/dist/registry/v6/production/astro/cometchat-token.ts.tpl

@@ -1,86 +0,0 @@
-/**
- * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
- *
- * Astro API route. The Auth Key NEVER leaves the server. The client calls
- * this endpoint to get a short-lived auth token, then passes it to
- * CometChatUIKit.loginWithAuthToken().
- *
- * Generated by `cometchat production-auth`. Customize freely:
- *   - Add real authentication: read the user's session cookie / JWT here
- *   - Map your app's user IDs to CometChat UIDs
- *   - Add rate limiting if exposed publicly
- *
- * Astro requirement: your astro.config.mjs must have `output: 'server'` or
- * `output: 'hybrid'` for API routes to work. Static-only Astro builds
- * cannot run server-side endpoints.
- *
- * Security note: this file MUST NOT use PUBLIC_* env vars for the Auth Key.
- * The whole point is to keep the Auth Key out of the browser.
- */
-import type { APIRoute } from "astro";
-
-const COMETCHAT_APP_ID = import.meta.env.PUBLIC_COMETCHAT_APP_ID!;
-const COMETCHAT_REGION = import.meta.env.PUBLIC_COMETCHAT_REGION!;
-// IMPORTANT: server-only — no PUBLIC_ prefix
-const COMETCHAT_AUTH_KEY = import.meta.env.COMETCHAT_AUTH_KEY!;
-
-export const GET: APIRoute = async ({ request }) => {
-  const url = new URL(request.url);
-  // ⚠ Replace this with your real auth: read the session, extract the user ID,
-  // then map it to a CometChat UID. Do not trust the query param in production.
-  const uid = url.searchParams.get("uid") ?? "cometchat-uid-1";
-
-  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
-    return new Response(
-      JSON.stringify({ error: "CometChat credentials not configured on the server" }),
-      { status: 500, headers: { "Content-Type": "application/json" } },
-    );
-  }
-
-  try {
-    const res = await fetch(
-      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          appid: COMETCHAT_APP_ID,
-          apikey: COMETCHAT_AUTH_KEY,
-        },
-      },
-    );
-
-    if (!res.ok) {
-      const text = await res.text();
-      return new Response(
-        JSON.stringify({ error: `CometChat token mint failed (${res.status})`, detail: text }),
-        { status: 502, headers: { "Content-Type": "application/json" } },
-      );
-    }
-
-    const body = (await res.json()) as { data?: { authToken?: string } };
-    const authToken = body.data?.authToken;
-    if (!authToken) {
-      return new Response(
-        JSON.stringify({ error: "CometChat returned no authToken in response" }),
-        { status: 502, headers: { "Content-Type": "application/json" } },
-      );
-    }
-
-    return new Response(JSON.stringify({ authToken, uid }), {
-      status: 200,
-      headers: { "Content-Type": "application/json" },
-    });
-  } catch (err) {
-    return new Response(
-      JSON.stringify({
-        error: "Token mint failed",
-        detail: err instanceof Error ? err.message : String(err),
-      }),
-      { status: 500, headers: { "Content-Type": "application/json" } },
-    );
-  }
-};
-
-// Astro requires this for non-static routes
-export const prerender = false;

package/dist/registry/v6/production/astro.template.json

@@ -1,51 +0,0 @@
-{
-  "$schema": "../../schemas/template.schema.json",
-  "version": "1.0.0",
-  "experience_id": 1,
-  "framework": "astro",
-  "sdk_compatibility": ">=6.0.0 <7.0.0",
-  "default_placement": "dedicated-route",
-  "deps": [],
-  "env_vars": [
-    {
-      "name": "COMETCHAT_AUTH_KEY",
-      "required": true,
-      "secret": true,
-      "description": "Server-side only Auth Key (no PUBLIC_ prefix). Used by the /api/cometchat-token endpoint to mint user-scoped auth tokens. Remove PUBLIC_COMETCHAT_AUTH_KEY from .env — that variable is for development only and exposes the key to the browser."
-    },
-    {
-      "name": "PUBLIC_COMETCHAT_APP_ID",
-      "required": true,
-      "description": "Same as before — App ID is safe to expose"
-    },
-    {
-      "name": "PUBLIC_COMETCHAT_REGION",
-      "required": true,
-      "description": "Same as before — region is safe to expose"
-    }
-  ],
-  "files": [
-    {
-      "path": "src/pages/api/cometchat-token.ts",
-      "action": "create",
-      "template_ref": "cometchat-token.ts.tpl",
-      "owned": true
-    }
-  ],
-  "verify_rules": [],
-  "next_steps": [
-    "1. Make sure your astro.config.mjs has output: 'server' or 'hybrid' (API endpoints need SSR-capable output).",
-    "2. Add COMETCHAT_AUTH_KEY (NO PUBLIC_ prefix) to .env with your CometChat Auth Key.",
-    "3. REMOVE PUBLIC_COMETCHAT_AUTH_KEY from .env (keep APP_ID and REGION).",
-    "4. In src/cometchat/ChatApp.tsx, replace the login flow:",
-    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
-    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
-    "           .then(r => r.json())",
-    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
-    "           .then(setUser)",
-    "           .catch(e => setError(String(e)));",
-    "5. Replace 'cometchat-uid-1' with your real authenticated user's ID.",
-    "6. Restart the dev server (`npm run dev`) so the new env var takes effect.",
-    "7. The Auth Key is now ONLY in server memory — never sent to the browser."
-  ]
-}

package/dist/registry/v6/production/nextjs/route.ts.tpl

@@ -1,79 +0,0 @@
-/**
- * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
- *
- * This is the production-mode replacement for client-side login(UID) + Auth Key.
- * The Auth Key NEVER leaves the server. The client calls this endpoint to get
- * a short-lived auth token, then passes it to CometChatUIKit.loginWithAuthToken().
- *
- * Generated by `cometchat production-auth`. Customize freely:
- *   - Add real authentication: read the user's session cookie / JWT here, do
- *     not trust the `?uid=` query param in production.
- *   - Map your app's user IDs to CometChat UIDs.
- *   - Add rate limiting if exposed publicly.
- *   - Cache tokens per UID for short windows to reduce CometChat API load.
- *
- * Security note: this file MUST NOT use NEXT_PUBLIC_* env vars for the Auth Key.
- * The whole point of this endpoint is to keep the Auth Key out of the browser.
- */
-import { NextRequest, NextResponse } from "next/server";
-
-const COMETCHAT_APP_ID = process.env.NEXT_PUBLIC_COMETCHAT_APP_ID!;
-const COMETCHAT_REGION = process.env.NEXT_PUBLIC_COMETCHAT_REGION!;
-// IMPORTANT: server-only — no NEXT_PUBLIC_ prefix
-const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
-
-export async function GET(request: NextRequest) {
-  // ⚠ Replace this with your real auth: read the session, extract the user ID,
-  // then map it to a CometChat UID. Do not trust the query param in production.
-  const uid = request.nextUrl.searchParams.get("uid") ?? "cometchat-uid-1";
-
-  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
-    return NextResponse.json(
-      { error: "CometChat credentials not configured on the server" },
-      { status: 500 },
-    );
-  }
-
-  try {
-    // Mint a fresh auth token for this UID via the CometChat REST API.
-    // Endpoint: POST https://{appId}.api-{region}.cometchat.io/v3/users/{uid}/auth_tokens
-    const res = await fetch(
-      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          appid: COMETCHAT_APP_ID,
-          apikey: COMETCHAT_AUTH_KEY,
-        },
-      },
-    );
-
-    if (!res.ok) {
-      const text = await res.text();
-      return NextResponse.json(
-        { error: `CometChat token mint failed (${res.status})`, detail: text },
-        { status: 502 },
-      );
-    }
-
-    const body = (await res.json()) as { data?: { authToken?: string } };
-    const authToken = body.data?.authToken;
-    if (!authToken) {
-      return NextResponse.json(
-        { error: "CometChat returned no authToken in response" },
-        { status: 502 },
-      );
-    }
-
-    return NextResponse.json({ authToken, uid });
-  } catch (err) {
-    return NextResponse.json(
-      { error: "Token mint failed", detail: err instanceof Error ? err.message : String(err) },
-      { status: 500 },
-    );
-  }
-}
-
-// Disable static rendering — this is a dynamic API route
-export const dynamic = "force-dynamic";

package/dist/registry/v6/production/nextjs.template.json

@@ -1,50 +0,0 @@
-{
-  "$schema": "../../schemas/template.schema.json",
-  "version": "1.0.0",
-  "experience_id": 1,
-  "framework": "nextjs",
-  "sdk_compatibility": ">=6.0.0 <7.0.0",
-  "default_placement": "dedicated-route",
-  "deps": [],
-  "env_vars": [
-    {
-      "name": "COMETCHAT_AUTH_KEY",
-      "required": true,
-      "secret": true,
-      "description": "Server-side only Auth Key (no NEXT_PUBLIC_ prefix). Used by the /api/cometchat-token endpoint to mint user-scoped auth tokens. Remove NEXT_PUBLIC_COMETCHAT_AUTH_KEY from .env.local — that variable is for development only and exposes the key to the browser."
-    },
-    {
-      "name": "NEXT_PUBLIC_COMETCHAT_APP_ID",
-      "required": true,
-      "description": "Same as before — App ID is safe to expose"
-    },
-    {
-      "name": "NEXT_PUBLIC_COMETCHAT_REGION",
-      "required": true,
-      "description": "Same as before — region is safe to expose"
-    }
-  ],
-  "files": [
-    {
-      "path": "src/app/api/cometchat-token/route.ts",
-      "action": "create",
-      "template_ref": "route.ts.tpl",
-      "owned": true
-    }
-  ],
-  "verify_rules": [],
-  "next_steps": [
-    "1. Add COMETCHAT_AUTH_KEY (NO NEXT_PUBLIC_ prefix) to .env.local with your CometChat Auth Key.",
-    "2. REMOVE NEXT_PUBLIC_COMETCHAT_AUTH_KEY from .env.local (keep APP_ID and REGION).",
-    "3. In src/app/cometchat/CometChatNoSSR.tsx, replace the login flow:",
-    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
-    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
-    "           .then(r => r.json())",
-    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
-    "           .then(setUser)",
-    "           .catch(e => setError(String(e)));",
-    "4. Replace the hardcoded 'cometchat-uid-1' with your real authenticated user's ID.",
-    "5. Restart the dev server (`npm run dev`) so the new env var takes effect.",
-    "6. The Auth Key is now ONLY in server memory — never sent to the browser."
-  ]
-}

package/dist/registry/v6/production/react-router/api.cometchat-token.ts.tpl

@@ -1,73 +0,0 @@
-/**
- * /api/cometchat-token — server-side endpoint that mints CometChat auth tokens.
- *
- * React Router v7 framework mode loader. The Auth Key NEVER leaves the
- * server. The client calls this endpoint to get a short-lived auth token,
- * then passes it to CometChatUIKit.loginWithAuthToken().
- *
- * Generated by `cometchat production-auth`. Customize freely:
- *   - Add real authentication: read the user's session cookie / JWT here
- *   - Map your app's user IDs to CometChat UIDs
- *   - Add rate limiting if exposed publicly
- *
- * Security note: this file MUST NOT use VITE_* env vars for the Auth Key.
- * The whole point is to keep the Auth Key out of the browser.
- */
-import type { LoaderFunctionArgs } from "react-router";
-
-const COMETCHAT_APP_ID = process.env.VITE_COMETCHAT_APP_ID!;
-const COMETCHAT_REGION = process.env.VITE_COMETCHAT_REGION!;
-// IMPORTANT: server-only — no VITE_ prefix
-const COMETCHAT_AUTH_KEY = process.env.COMETCHAT_AUTH_KEY!;
-
-export async function loader({ request }: LoaderFunctionArgs) {
-  const url = new URL(request.url);
-  // ⚠ Replace this with your real auth: read the session, extract the user ID,
-  // then map it to a CometChat UID. Do not trust the query param in production.
-  const uid = url.searchParams.get("uid") ?? "cometchat-uid-1";
-
-  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
-    return Response.json(
-      { error: "CometChat credentials not configured on the server" },
-      { status: 500 },
-    );
-  }
-
-  try {
-    const res = await fetch(
-      `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3/users/${encodeURIComponent(uid)}/auth_tokens`,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          appid: COMETCHAT_APP_ID,
-          apikey: COMETCHAT_AUTH_KEY,
-        },
-      },
-    );
-
-    if (!res.ok) {
-      const text = await res.text();
-      return Response.json(
-        { error: `CometChat token mint failed (${res.status})`, detail: text },
-        { status: 502 },
-      );
-    }
-
-    const body = (await res.json()) as { data?: { authToken?: string } };
-    const authToken = body.data?.authToken;
-    if (!authToken) {
-      return Response.json(
-        { error: "CometChat returned no authToken in response" },
-        { status: 502 },
-      );
-    }
-
-    return Response.json({ authToken, uid });
-  } catch (err) {
-    return Response.json(
-      { error: "Token mint failed", detail: err instanceof Error ? err.message : String(err) },
-      { status: 500 },
-    );
-  }
-}

package/dist/registry/v6/production/react-router.template.json

@@ -1,58 +0,0 @@
-{
-  "$schema": "../../schemas/template.schema.json",
-  "version": "1.0.0",
-  "experience_id": 1,
-  "framework": "react-router",
-  "sdk_compatibility": ">=6.0.0 <7.0.0",
-  "default_placement": "dedicated-route",
-  "deps": [],
-  "env_vars": [
-    {
-      "name": "COMETCHAT_AUTH_KEY",
-      "required": true,
-      "secret": true,
-      "description": "Server-side only Auth Key (no VITE_ prefix). Used by the /api/cometchat-token loader to mint user-scoped auth tokens. Remove VITE_COMETCHAT_AUTH_KEY from .env — that variable is for development only and exposes the key to the browser."
-    },
-    {
-      "name": "VITE_COMETCHAT_APP_ID",
-      "required": true,
-      "description": "Same as before — App ID is safe to expose"
-    },
-    {
-      "name": "VITE_COMETCHAT_REGION",
-      "required": true,
-      "description": "Same as before — region is safe to expose"
-    }
-  ],
-  "files": [
-    {
-      "path": "app/routes/api.cometchat-token.ts",
-      "action": "create",
-      "template_ref": "api.cometchat-token.ts.tpl",
-      "owned": true
-    },
-    {
-      "path": "app/routes.ts",
-      "action": "patch",
-      "patch_mode": "insert-before",
-      "anchor": "] satisfies RouteConfig",
-      "patch_content": "  route(\"api/cometchat-token\", \"routes/api.cometchat-token.ts\"),\n",
-      "skip_if_exists": "routes/api.cometchat-token.ts"
-    }
-  ],
-  "verify_rules": [],
-  "next_steps": [
-    "1. Add COMETCHAT_AUTH_KEY (NO VITE_ prefix) to .env with your CometChat Auth Key.",
-    "2. REMOVE VITE_COMETCHAT_AUTH_KEY from .env (keep APP_ID and REGION).",
-    "3. In app/cometchat/CometChatNoSSR.tsx, replace the login flow:",
-    "   FROM: CometChatUIKit.login('cometchat-uid-1').then(setUser).catch(setError);",
-    "   TO:   fetch('/api/cometchat-token?uid=' + encodeURIComponent(userId))",
-    "           .then(r => r.json())",
-    "           .then(data => CometChatUIKit.loginWithAuthToken(data.authToken))",
-    "           .then(setUser)",
-    "           .catch(e => setError(String(e)));",
-    "4. Replace 'cometchat-uid-1' with your real authenticated user's ID.",
-    "5. Restart the dev server (`npm run dev`) so the new env var takes effect.",
-    "6. The Auth Key is now ONLY in server memory — never sent to the browser."
-  ]
-}

package/dist/registry/v6/user-mgmt/astro/cometchat-user.ts.tpl

@@ -1,164 +0,0 @@
-/**
- * /api/cometchat-user — server-side CometChat user management.
- *
- * Astro API route. Handles POST (create), PUT (update), DELETE.
- * The Auth Key NEVER leaves the server.
- *
- * Requires astro.config.mjs to have `output: 'server'` or `'hybrid'`.
- *
- * Generated by `cometchat add-user-mgmt`.
- *
- * SECURITY: this template is unauthenticated by design — add your own
- * session check before exposing it publicly.
- */
-import type { APIRoute } from "astro";
-
-const COMETCHAT_APP_ID = import.meta.env.PUBLIC_COMETCHAT_APP_ID!;
-const COMETCHAT_REGION = import.meta.env.PUBLIC_COMETCHAT_REGION!;
-const COMETCHAT_AUTH_KEY = import.meta.env.COMETCHAT_AUTH_KEY!;
-
-const COMETCHAT_API_BASE = `https://${COMETCHAT_APP_ID}.api-${COMETCHAT_REGION}.cometchat.io/v3`;
-
-const baseHeaders = {
-  "Content-Type": "application/json",
-  appid: COMETCHAT_APP_ID,
-  apikey: COMETCHAT_AUTH_KEY,
-};
-
-function json(data: unknown, status = 200) {
-  return new Response(JSON.stringify(data), {
-    status,
-    headers: { "Content-Type": "application/json" },
-  });
-}
-
-function validateUid(uid: unknown): string | null {
-  if (typeof uid !== "string" || uid.length === 0) return "uid is required";
-  if (uid.length > 100) return "uid must be ≤100 characters";
-  if (!/^[a-zA-Z0-9_-]+$/.test(uid)) {
-    return "uid must contain only alphanumeric characters, hyphens, and underscores";
-  }
-  return null;
-}
-
-function configError() {
-  if (!COMETCHAT_APP_ID || !COMETCHAT_REGION || !COMETCHAT_AUTH_KEY) {
-    return json({ error: "CometChat credentials not configured on the server" }, 500);
-  }
-  return null;
-}
-
-export const POST: APIRoute = async ({ request }) => {
-  const cfgErr = configError();
-  if (cfgErr) return cfgErr;
-
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "Invalid JSON body" }, 400);
-  }
-  const uidError = validateUid(body.uid);
-  if (uidError) return json({ error: uidError }, 400);
-  if (!body.name) return json({ error: "name is required" }, 400);
-
-  try {
-    const res = await fetch(`${COMETCHAT_API_BASE}/users`, {
-      method: "POST",
-      headers: baseHeaders,
-      body: JSON.stringify({
-        uid: body.uid,
-        name: body.name,
-        ...(body.avatar && { avatar: body.avatar }),
-        ...(body.metadata && { metadata: body.metadata }),
-        ...(body.tags && { tags: body.tags }),
-      }),
-    });
-    if (!res.ok) {
-      const detail = await res.text();
-      return json(
-        { error: `CometChat user create failed (${res.status})`, detail },
-        res.status === 409 ? 409 : 502,
-      );
-    }
-    const data = await res.json();
-    return json({ user: data.data }, 201);
-  } catch (err) {
-    return json(
-      { error: "Create failed", detail: err instanceof Error ? err.message : String(err) },
-      500,
-    );
-  }
-};
-
-export const PUT: APIRoute = async ({ request }) => {
-  const cfgErr = configError();
-  if (cfgErr) return cfgErr;
-
-  let body;
-  try {
-    body = await request.json();
-  } catch {
-    return json({ error: "Invalid JSON body" }, 400);
-  }
-  const uidError = validateUid(body.uid);
-  if (uidError) return json({ error: uidError }, 400);
-
-  const updates: Record<string, unknown> = {};
-  if (body.name !== undefined) updates.name = body.name;
-  if (body.avatar !== undefined) updates.avatar = body.avatar;
-  if (body.metadata !== undefined) updates.metadata = body.metadata;
-  if (body.tags !== undefined) updates.tags = body.tags;
-  if (Object.keys(updates).length === 0) {
-    return json({ error: "No fields to update" }, 400);
-  }
-
-  try {
-    const res = await fetch(`${COMETCHAT_API_BASE}/users/${encodeURIComponent(body.uid)}`, {
-      method: "PUT",
-      headers: baseHeaders,
-      body: JSON.stringify(updates),
-    });
-    if (!res.ok) {
-      const detail = await res.text();
-      return json({ error: `CometChat user update failed (${res.status})`, detail }, 502);
-    }
-    const data = await res.json();
-    return json({ user: data.data });
-  } catch (err) {
-    return json(
-      { error: "Update failed", detail: err instanceof Error ? err.message : String(err) },
-      500,
-    );
-  }
-};
-
-export const DELETE: APIRoute = async ({ request }) => {
-  const cfgErr = configError();
-  if (cfgErr) return cfgErr;
-
-  const url = new URL(request.url);
-  const uid = url.searchParams.get("uid");
-  const uidError = validateUid(uid);
-  if (uidError) return json({ error: uidError }, 400);
-
-  try {
-    const res = await fetch(`${COMETCHAT_API_BASE}/users/${encodeURIComponent(uid as string)}`, {
-      method: "DELETE",
-      headers: baseHeaders,
-      body: JSON.stringify({ permanent: true }),
-    });
-    if (!res.ok) {
-      const detail = await res.text();
-      return json({ error: `CometChat user delete failed (${res.status})`, detail }, 502);
-    }
-    return json({ deleted: uid });
-  } catch (err) {
-    return json(
-      { error: "Delete failed", detail: err instanceof Error ? err.message : String(err) },
-      500,
-    );
-  }
-};
-
-export const prerender = false;

package/dist/registry/v6/user-mgmt/astro.template.json

@@ -1,33 +0,0 @@
-{
-  "$schema": "../../schemas/template.schema.json",
-  "version": "1.0.0",
-  "experience_id": 1,
-  "framework": "astro",
-  "sdk_compatibility": ">=6.0.0 <7.0.0",
-  "default_placement": "dedicated-route",
-  "deps": [],
-  "env_vars": [
-    {
-      "name": "COMETCHAT_AUTH_KEY",
-      "required": true,
-      "secret": true,
-      "description": "Server-side only Auth Key (no PUBLIC_ prefix)."
-    }
-  ],
-  "files": [
-    {
-      "path": "src/pages/api/cometchat-user.ts",
-      "action": "create",
-      "template_ref": "cometchat-user.ts.tpl",
-      "owned": true
-    }
-  ],
-  "verify_rules": [],
-  "next_steps": [
-    "1. Make sure your astro.config.mjs has output: 'server' or 'hybrid'.",
-    "2. Endpoint at /api/cometchat-user supports POST (create), PUT (update), DELETE.",
-    "3. Add COMETCHAT_AUTH_KEY (no PUBLIC_ prefix) to .env.",
-    "4. Wire it into your sign-up flow when an app user is created.",
-    "5. SECURITY: this template is unauthenticated. Add session checks before deploying."
-  ]
-}