@commercelayer/agent-cli 0.8.1 → 1.0.0-dev.1

package/dist/schema.js

@@ -0,0 +1,182 @@
+// The schema of a noun, as the contract's schema document has it (section 5.1), and what the
+// engine makes of it: for every verb, the flags it takes and where each one goes (body, query or
+// filter). A plain noun (markets, orders, carts, about 60 of them) has no code in the CLI: its
+// schema is read from GET /v1/schema/<noun>. Built-in nouns (sandbox, loops, report) write theirs
+// in the same document format, so one reader serves both.
+import { closest, fail, fixWith } from './errors.js';
+const FIELD_TYPES = ['string', 'integer', 'number', 'money', 'boolean', 'date', 'datetime', 'enum', 'object', 'array', 'ref'];
+export const FILTER_OPS = ['eq', 'in', 'gt', 'gte', 'lt', 'lte', 'start', 'cont', 'null'];
+const CREDENTIALS = { none: 'none', organization: 'organization', login: 'login', 'organization|login': 'organization|login' };
+const STANDARD = ['list', 'get', 'create', 'update', 'delete'];
+const METHOD = { list: 'GET', get: 'GET', create: 'POST', update: 'PATCH', delete: 'DELETE' };
+export function parseSchema(raw, expected) {
+    const doc = raw;
+    if (!doc || typeof doc !== 'object' || typeof doc.noun !== 'string' || !Array.isArray(doc.verbs))
+        bad(expected, 'it has no noun or no verbs');
+    const fields = (doc.fields ?? []).map((f) => field(f, doc.noun));
+    const verbs = {};
+    for (const v of doc.verbs) {
+        if (!v || typeof v.verb !== 'string')
+            bad(doc.noun, 'a verb has no name');
+        const name = v.verb;
+        const flags = {};
+        if (name === 'list')
+            listFlags(flags, fields, doc);
+        if (name === 'create')
+            for (const f of fields)
+                if (f.create === 'required' || f.create === 'optional')
+                    flags[f.name] = flag(f, 'body', f.create === 'required');
+        if (name === 'update')
+            for (const f of fields)
+                if (f.update)
+                    flags[f.name] = flag(f, 'body', false);
+        const method = v.method?.toUpperCase() ?? METHOD[name] ?? 'POST';
+        // A name in body refers to a field of the document. On a GET it is a query parameter.
+        const own = (list) => (list ?? []).filter((x) => x !== '...' && !(name === 'list' && x === 'waiting')).map((x) => (typeof x === 'string' ? byName(fields, x) : field(x, doc.noun)));
+        for (const f of own(v.body))
+            if (!flags[f.name] || f.create === 'required')
+                flags[f.name] = flag(f, method === 'GET' ? 'query' : 'body', Boolean(f.required || (name === 'create' && f.create === 'required')));
+        for (const f of own(v.query))
+            flags[f.name] = flag(f, 'query', Boolean(f.required));
+        fileInputs(flags, fields, own(v.body));
+        if (v.secret) {
+            flags.out = { type: 'string', to: 'local', description: 'The file the secret is written to, mode 600. By default one under ~/.config/c11r/secrets/<org>/.' };
+            flags.format = { type: 'enum', to: 'local', values: ['env', 'json'], description: 'env: KEY=value lines, for a .env file; json: one JSON object. By default as the API answers it.' };
+        }
+        const destructive = Boolean(v.destructive);
+        const state = v.state ?? 'sandbox';
+        if (v.credential !== undefined && !CREDENTIALS[v.credential])
+            bad(doc.noun, `verb ${name} has credential ${String(v.credential)}`);
+        verbs[name] = {
+            name,
+            description: v.effect ?? (STANDARD.includes(name) ? standardDescription(name, doc.noun) : ''),
+            method,
+            id: v.path ? /\{[^}]+\}/.test(v.path) : !['list', 'create'].includes(name),
+            destructive,
+            // A policy never deletes nor returns money, whatever else the document says.
+            loopable: Boolean(v.loopable) && !v.deletes && !v.returns_money && name !== 'delete',
+            live: v.live !== false,
+            state,
+            plan: v.plan ?? null,
+            credential: v.credential ? CREDENTIALS[v.credential] : state === 'none' ? 'none' : 'organization',
+            secret: Boolean(v.secret),
+            idAlternative: Array.isArray(v.id_alternative) ? v.id_alternative.filter((x) => typeof x === 'string' && flags[x]) : [],
+            confirmIf: Array.isArray(v.confirm_if) ? v.confirm_if.filter((x) => typeof x === 'string') : [],
+            refused: v.served === false ? { by: v.refused_by ?? 'the API' } : null,
+            path: v.path ? v.path.replace(/^\/v\d+(?=\/)/, '') : null,
+            flags,
+        };
+    }
+    return {
+        noun: doc.noun,
+        description: doc.description ?? '',
+        skill: doc.skill ?? null,
+        verbs,
+        id: doc.id ? { accepts: doc.id.accepts ?? [], example: doc.id.example ?? null } : null,
+        waiting: doc.waiting ?? null,
+        loop: doc.loop ?? null,
+        doc,
+    };
+}
+/**
+ * A secret field gets --<name>-file in place of its own flag: the value never sits in a command
+ * line or a shell history. A document field keeps its flag (inline JSON) and gets --file, or
+ * --<name>-file when the verb has more than one.
+ */
+function fileInputs(flags, fields, body) {
+    const doc = (k) => fields.find((f) => f.name === k) ?? body.find((f) => f.name === k);
+    const keys = Object.keys(flags).filter((k) => flags[k].to === 'body' || flags[k].to === 'query');
+    for (const k of keys.filter((k) => doc(k)?.secret_input)) {
+        const f = flags[k];
+        delete flags[k];
+        flags[`${k}_file`] = {
+            type: 'string',
+            to: 'local',
+            input: { kind: 'secret', target: k, required: Boolean(f.required), target_type: f.type },
+            description: `${f.description ? `${f.description.replace(/\.?$/, '.')} ` : ''}A file with ${k}, as JSON or KEY=value lines, readable only by its owner (mode 600). Never given as a flag value; without the file, c11r asks in a terminal. Never printed.`,
+        };
+    }
+    const docs = keys.filter((k) => flags[k] && doc(k)?.file_input);
+    for (const k of docs) {
+        flags[docs.length === 1 ? 'file' : `${k}_file`] = {
+            type: 'string',
+            to: 'local',
+            input: { kind: 'document', target: k, required: Boolean(flags[k].required), target_type: flags[k].type },
+            description: `A JSON file with ${k}, in place of ${toFlag(k)}.`,
+        };
+    }
+}
+const toFlag = (key) => `--${key.replace(/_/g, '-')}`;
+function listFlags(flags, fields, doc) {
+    for (const f of fields) {
+        for (const op of f.filter ?? []) {
+            const key = op === 'eq' ? f.name : `${f.name}.${op}`;
+            const base = flag(f, 'filter', false);
+            if (op === 'in')
+                flags[key] = { ...base, type: 'array', items: f.type === 'array' ? f.items : f.type, filter: { field: f.name, op } };
+            else if (op === 'null')
+                flags[key] = { ...base, type: 'boolean', values: undefined, filter: { field: f.name, op } };
+            else
+                flags[key] = { ...base, filter: { field: f.name, op } };
+        }
+    }
+    if (doc.waiting)
+        flags.waiting = { type: 'boolean', to: 'query', description: doc.waiting.meaning ?? 'Only what needs a decision now.' };
+    flags.page = { type: 'integer', to: 'query', description: 'The page to return, from 1.' };
+    flags.limit = { type: 'integer', to: 'query', description: 'How many to return on a page.' };
+    const sortable = fields.filter((f) => f.sort).map((f) => f.name);
+    if (sortable.length)
+        flags.sort = { type: 'string', to: 'query', description: `A field to sort by (${sortable.join(', ')}); a leading minus sorts descending.` };
+}
+/** A field named in a verb's body. One the document does not define is taken as a string. */
+function byName(fields, name) {
+    return fields.find((x) => x.name === name) ?? { name, type: 'string' };
+}
+function field(f, noun) {
+    if (!f || typeof f.name !== 'string')
+        bad(noun, 'a field has no name');
+    if (!FIELD_TYPES.includes(f.type))
+        bad(noun, `field ${f.name} has type ${String(f.type)}`);
+    return f;
+}
+function flag(f, to, required) {
+    return {
+        type: f.type,
+        to,
+        ...(f.values ? { values: f.values } : {}),
+        ...(f.items ? { items: f.items } : {}),
+        ...(f.properties?.length ? { properties: Object.fromEntries(f.properties.map((p) => [p.name, p.type])) } : {}),
+        ...(f.noun ? { noun: f.noun } : {}),
+        ...(required ? { required: true } : {}),
+        ...(f.description ? { description: f.description } : {}),
+    };
+}
+function bad(noun, why) {
+    fail('invalid_response', `The API's schema${noun ? ` for ${noun}` : ''} is not one c11r reads: ${why}.`, { next_step: { action: 'none' } });
+}
+function standardDescription(verb, noun) {
+    return ({
+        list: `Lists the ${noun}, filtered by any of the flags.`,
+        get: `Returns one of the ${noun} by id.`,
+        create: `Creates one of the ${noun} from the flags.`,
+        update: `Changes the given fields of one of the ${noun}; the others stay as they are.`,
+        delete: `Deletes one of the ${noun}. It cannot be undone.`,
+    }[verb] ?? '');
+}
+/** The verb, or unknown_verb naming the ones there are. */
+export function verbOf(schema, verb) {
+    const names = Object.keys(schema.verbs);
+    if (!verb)
+        fail('missing_argument', `c11r ${schema.noun} needs a verb: ${names.join(', ')}.`, { details: { verbs: names }, next_step: fixWith(`c11r ${schema.noun} --help`) });
+    const v = schema.verbs[verb];
+    if (!v) {
+        const standard = STANDARD.includes(verb);
+        // Whether Commerce Layer has it or this API does not serve it yet, the CLI cannot tell.
+        fail('unknown_verb', `${schema.noun} has no verb ${verb}${standard ? ' in this API' : ''}. Its verbs are ${names.join(', ')}.`, {
+            did_you_mean: closest(verb, names),
+            details: { verbs: names },
+            next_step: fixWith(`c11r ${schema.noun} --help`),
+        });
+    }
+    return v;
+}

package/dist/schemas.js

@@ -0,0 +1,72 @@
+// Where plain nouns' schemas come from: GET /v1/schema for the list, GET /v1/schema/<noun> for
+// one (contract section 5), cached on disk for a few minutes so a command costs one request, not
+// two. Schemas are the same at every state, so no token is sent. C11R_SCHEMA_CACHE=0 turns the
+// cache off.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { CliError, closest, fail, fixWith } from './errors.js';
+import { apiUrl, request } from './http.js';
+import { parseSchema } from './schema.js';
+import { VERSION } from './version.js';
+const TTL_MS = 10 * 60_000;
+function cacheFile(key) {
+    if (process.env.C11R_SCHEMA_CACHE === '0')
+        return null;
+    const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');
+    const host = crypto.createHash('sha256').update(apiUrl()).digest('hex').slice(0, 12);
+    return path.join(base, 'c11r', `schema-${VERSION}-${host}`, `${key}.json`);
+}
+async function cached(key, load) {
+    const file = cacheFile(key);
+    if (file) {
+        try {
+            if (Date.now() - fs.statSync(file).mtimeMs < TTL_MS)
+                return JSON.parse(fs.readFileSync(file, 'utf8'));
+        }
+        catch {
+            // Not cached, or unreadable: load it.
+        }
+    }
+    const value = await load();
+    if (file) {
+        try {
+            fs.mkdirSync(path.dirname(file), { recursive: true });
+            fs.writeFileSync(file, JSON.stringify(value));
+        }
+        catch {
+            // A read-only home is fine: no cache.
+        }
+    }
+    return value;
+}
+const anonymous = { live: false, token: null };
+/** Every noun of the spec the API knows, served or not yet. */
+export async function apiNouns() {
+    const data = await cached('_index', async () => (await request({ method: 'GET', path: '/schema' }, anonymous)).data);
+    return Array.isArray(data?.nouns) ? data.nouns : [];
+}
+/** One plain noun's schema, or unknown_noun with close matches. */
+export async function apiSchema(noun, builtins) {
+    if (!/^[a-z][a-z0-9-]*$/.test(noun))
+        unknownNoun(noun, builtins);
+    let doc;
+    try {
+        doc = await cached(noun, async () => (await request({ method: 'GET', path: `/schema/${noun}` }, anonymous)).data);
+    }
+    catch (e) {
+        if (e instanceof CliError && e.kind === 'not_found') {
+            const known = await apiNouns().catch(() => []);
+            unknownNoun(noun, [...builtins, ...known.map((n) => n.noun)]);
+        }
+        if (e instanceof CliError && e.kind === 'unavailable') {
+            fail('schema_unavailable', `c11r reads the fields and verbs of ${noun} from the API, and could not: ${e.body.message}`, { next_step: e.body.next_step ?? { action: 'retry_later' }, details: { cause: e.code } });
+        }
+        throw e;
+    }
+    return parseSchema(doc, noun);
+}
+function unknownNoun(noun, known) {
+    fail('unknown_noun', `c11r has no noun ${noun}.`, { did_you_mean: closest(noun, known), next_step: fixWith('c11r help') });
+}

package/dist/secrets.js

@@ -0,0 +1,204 @@
+// Secrets in answers (contract section 22). credentials create and credentials token answer a
+// secret once, in data.secret: the CLI writes it to a file with mode 600 and prints the file, the
+// format and a hint, never the value. The file is checked before the request is sent, so a create
+// does not make a secret that then has nowhere to go.
+//
+// Default file: ~/.config/c11r/secrets/<org>/<credential name>.env (or <id>-token.env for a token),
+// outside the project so it cannot be committed. --out picks another; --format env|json. A file
+// there already is replaced only with --yes. A file inside a git repository that git does not
+// ignore gets the warning secret_not_ignored.
+import { spawnSync } from 'node:child_process';
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { markOutWritten } from './config.js';
+import { fail } from './errors.js';
+export function secretsDir() {
+    const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+    return path.join(base, 'c11r', 'secrets');
+}
+const safe = (s) => s.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '') || 'credential';
+/** Where the secret will go, checked now: writable, not a link, not there already unless --yes. */
+export function planSecret(opts) {
+    const out = opts.values.out;
+    const format = opts.values.format ?? null;
+    const base = opts.verb === 'token' ? `${safe(opts.id ?? 'credential')}-token` : safe(String(opts.values.name ?? opts.id ?? 'credential'));
+    const file = out ? path.resolve(out) : path.join(secretsDir(), safe(opts.org ?? 'default'), base);
+    const plan = { file: out || !format ? file : `${file}.${format}`, format, fixed: Boolean(out), overwrite: opts.yes };
+    const candidates = plan.fixed || format ? [plan.file] : [`${file}.env`, `${file}.json`];
+    for (const c of candidates) {
+        let st = null;
+        try {
+            st = fs.lstatSync(c);
+        }
+        catch {
+            // Not there: fine.
+        }
+        if (st?.isSymbolicLink())
+            fail('insecure_file', `${c} is a symbolic link. c11r writes a secret only to a plain file.`, { path: 'out' });
+        if (st && !st.isFile())
+            fail('invalid_value', `${c} is not a file.`, { path: 'out' });
+        if (st && !opts.yes) {
+            fail('conflict', `${c} exists. c11r replaces it only with --yes, or writes the secret elsewhere with --out.`, { path: 'out', next_step: { action: 'fix_request', command: null }, details: { file: c } }, 'rejected');
+        }
+    }
+    const dir = path.dirname(candidates[0]);
+    const existing = nearestExisting(dir);
+    try {
+        fs.accessSync(existing, fs.constants.W_OK);
+    }
+    catch {
+        fail('invalid_value', `${dir} cannot be written by this user, so the secret would have nowhere to go.`, { path: 'out' });
+    }
+    return plan;
+}
+function nearestExisting(dir) {
+    let d = dir;
+    while (!fs.existsSync(d)) {
+        const up = path.dirname(d);
+        if (up === d)
+            break;
+        d = up;
+    }
+    return d;
+}
+const RECORD_LINE = '# c11r-record: ';
+/** Writes data.secret to its file and answers the envelope without the value. */
+export function writeSecret(r, plan, ctx) {
+    const data = (r.data ?? {});
+    const secret = data.secret;
+    // credentials answer { credential: {...}, secret }, other nouns the record itself and secret.
+    const rec = (data.credential && typeof data.credential === 'object' ? data.credential : data);
+    const str = (v) => (typeof v === 'string' || typeof v === 'number' ? String(v) : null);
+    const credentialId = str(rec.id) ?? ctx.id;
+    const record = { noun: ctx.noun, id: credentialId ?? null, name: str(rec.name), code: str(rec.code) };
+    const format = plan.format ?? (secret.format === 'json' ? 'json' : 'env');
+    const file = plan.fixed || plan.format ? plan.file : `${plan.file}.${format}`;
+    const env = secret.env && Object.keys(secret.env).length ? { ...secret.env } : { [`CL_${(secret.kind ?? 'secret').toUpperCase()}`]: String(secret.value ?? '') };
+    // The endpoint goes with every secret, so the file is enough to call Commerce Layer.
+    if (!env.CL_BASE_ENDPOINT && typeof data.base_endpoint === 'string')
+        env.CL_BASE_ENDPOINT = data.base_endpoint;
+    const written = new Date().toISOString();
+    const content = format === 'json'
+        ? JSON.stringify({ org: ctx.org, record, kind: secret.kind ?? null, value: secret.value ?? null, expires_at: secret.expires_at ?? null, env, written_at: written }, null, 2) + '\n'
+        : [
+            `# ${secret.kind ?? 'secret'} of ${ctx.noun} ${credentialId ?? '?'} in ${ctx.org ?? '?'}, written by c11r at ${written}.`,
+            `${RECORD_LINE}${JSON.stringify({ org: ctx.org, ...record })}`,
+            '# Keep it out of git.',
+            ...Object.entries(env).map(([k, v]) => `${k}=${v}`),
+            '',
+        ].join('\n');
+    try {
+        atomicWrite(file, content, plan.overwrite);
+    }
+    catch (e) {
+        const id = credentialId ?? '<id>';
+        const created = ctx.verb === 'create';
+        fail('secret_not_written', `The API answered the ${secret.kind ?? 'secret'} of credential ${id} once, and c11r could not write it to ${file}: ${e.message}. It was not printed, and the API cannot show it again. ${created ? `c11r credentials token ${id} gives a working token now; for a new secret, create another credential and delete ${id}.` : `c11r credentials token ${id} gives another token.`}`, { path: 'out', next_step: { action: 'fix_request', command: `c11r credentials token ${id}` }, details: { credential_id: credentialId ?? null, file } });
+    }
+    // An --out file is not removed with its credential: remember that one exists, for the warning.
+    if (plan.fixed && ctx.org)
+        markOutWritten(ctx.org, true);
+    // The API says the secret is shown once: c11r kept it in the file, and printed none of it.
+    const warnings = r.warnings.filter((w) => w.code !== 'secret_shown_once' && w.code !== 'token_shown_once');
+    if (!ignoredByGit(file))
+        warnings.push({ code: 'secret_not_ignored', message: `${file} is inside a git repository and git does not ignore it: add it to .gitignore before any commit.`, path: 'out' });
+    const { value: _value, env: _env, ...rest } = secret;
+    return {
+        ...r,
+        data: { ...data, secret: { kind: rest.kind ?? null, file, format, hint: rest.hint ?? null, mode: '600', expires_at: rest.expires_at ?? null } },
+        warnings,
+    };
+}
+/** What a dry run says about the file: where it would go and whether one is there. */
+export function describePlan(plan) {
+    const files = plan.fixed || plan.format ? [plan.file] : [`${plan.file}.env`, `${plan.file}.json`];
+    return { file: files[0], format: plan.format ?? 'env', would_overwrite: files.some((f) => fs.existsSync(f)), writable: true };
+}
+function atomicWrite(file, content, overwrite) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    if (!overwrite && fs.existsSync(file))
+        throw new Error('the file appeared meanwhile');
+    const tmp = path.join(path.dirname(file), `.${path.basename(file)}.${crypto.randomBytes(6).toString('hex')}.tmp`);
+    fs.writeFileSync(tmp, content, { mode: 0o600, flag: 'wx' });
+    try {
+        fs.chmodSync(tmp, 0o600);
+        fs.renameSync(tmp, file);
+    }
+    catch (e) {
+        fs.rmSync(tmp, { force: true });
+        throw e;
+    }
+}
+/** True unless the file is inside a git repository that does not ignore it. */
+function ignoredByGit(file) {
+    const r = spawnSync('git', ['check-ignore', '-q', path.basename(file)], { cwd: path.dirname(file), stdio: 'ignore' });
+    // 0 ignored, 1 not ignored, 128 not a repository (or no git).
+    return r.status !== 1;
+}
+/** The folder of an organization's secret files. */
+export const orgSecretsDir = (org) => path.join(secretsDir(), safe(org));
+/** The record a file in the secrets folder belongs to, or null when c11r did not write it. */
+function recordOf(text) {
+    const line = text.split('\n').find((l) => l.startsWith(RECORD_LINE));
+    try {
+        const v = line ? JSON.parse(line.slice(RECORD_LINE.length)) : JSON.parse(text).record;
+        return v && typeof v === 'object' && typeof v.noun === 'string' ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * After a delete: the files c11r wrote in the organization's secrets folder for that record (a
+ * credential's secret and tokens, a webhook's shared secret), found by the noun and the id, name
+ * or code each file records. Files written with --out elsewhere are not tracked.
+ */
+export function removeRecordFiles(org, noun, keys) {
+    const dir = orgSecretsDir(org);
+    const wanted = new Set(keys.filter((k) => typeof k === 'string' && k !== ''));
+    let names;
+    try {
+        names = fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const removed = [];
+    for (const n of names) {
+        const file = path.join(dir, n);
+        let text;
+        try {
+            if (!fs.lstatSync(file).isFile())
+                continue;
+            text = fs.readFileSync(file, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const rec = recordOf(text);
+        if (!rec || rec.noun !== noun || ![rec.id, rec.name, rec.code].some((k) => k !== null && wanted.has(k)))
+            continue;
+        fs.rmSync(file);
+        removed.push(file);
+    }
+    if (removed.length) {
+        try {
+            fs.rmdirSync(dir);
+        }
+        catch {
+            // Not empty: other records' files stay.
+        }
+    }
+    return removed;
+}
+/** After sandbox destroy: the organization's whole secrets folder. Null if there was none. */
+export function removeOrgSecrets(org) {
+    const dir = orgSecretsDir(org);
+    if (!fs.existsSync(dir))
+        return null;
+    fs.rmSync(dir, { recursive: true, force: true });
+    return dir;
+}
+export const OUT_NOT_TRACKED = { code: 'out_files_not_tracked', message: 'Only files in c11r\'s secrets folder (~/.config/c11r/secrets/<org>/) are removed with what they belong to. A file written with --out is not tracked: delete it where it was written.' };

package/dist/version.js

@@ -1,9 +1,5 @@
-// The CLI's version and how it names itself on the wire.
+// The CLI's version, from package.json, and the User-Agent every request carries.
 import { createRequire } from 'node:module';
-/** The package version, read from package.json so a release bumps it in one place. */
-export const VERSION = createRequire(import.meta.url)('../package.json').version;
-/** The User-Agent of every request: the API answers cli_outdated when a newer CLI exists. */
-export const USER_AGENT = `c11r/${VERSION} (node/${process.versions.node.split('.')[0]})`;
-/** The one way to run the CLI that is always current, whatever is installed. */
-export const NPX = 'npx -y @commercelayer/agent-cli@latest';
-export const LATEST_HINT = `${NPX} always runs the newest version, even where a c11r binary is installed.`;
+const pkg = createRequire(import.meta.url)('../package.json');
+export const VERSION = pkg.version;
+export const USER_AGENT = `c11r/${VERSION} (node ${process.versions.node}; ${process.platform})`;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "0.8.1",
-  "description": "c11r: the Commerce Layer CLI for coding agents. Builds a sandbox store that people and shopping agents can buy from.",
+  "version": "1.0.0-dev.1",
+  "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [
     "commercelayer",
@@ -24,20 +24,15 @@
     "README.md"
   ],
   "scripts": {
-    "build": "rm -rf dist.next && tsc -p tsconfig.json --outDir dist.next && chmod +x dist.next/bin.js dist.next/api/server.js && rm -rf dist.old && { mv dist dist.old 2>/dev/null; mv dist.next dist; } && rm -rf dist.old",
+    "build": "rm -rf dist.next && tsc -p tsconfig.json --outDir dist.next && chmod +x dist.next/bin.js && rm -rf dist.old && { mv dist dist.old 2>/dev/null; mv dist.next dist; } && rm -rf dist.old",
     "dev": "tsx src/bin.ts",
-    "stub-api": "tsx src/api/server.ts",
-    "test": "npm run build && vitest run",
-    "prepublishOnly": "npm run build"
+    "test": "npm run build && vitest run"
   },
   "dependencies": {
-    "imapflow": "^2.10.2",
-    "postal-mime": "^4.2.0",
     "yaml": "^2.6.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "happy-dom": "^21.0.4",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
     "vitest": "^3.0.0"