@oneaddress/setup 2.6.0 → 2.7.0

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "2.6.0" : "?";
+var WIZARD_VERSION = true ? "2.7.0" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -2093,6 +2093,7 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
   // nothing, which is indistinguishable from a wedged UI.
   let replaying = false;
   screen.key(['r'], () => {
+    if (promptOpen) return;
     if (!onReplay || replaying) return;
     replaying = true;
     replayNote = 'Replaying\u2026';
@@ -2109,32 +2110,84 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
       .finally(() => { replaying = false; redraw(); });
   });
 
+  // A ONE-LINE PATH PROMPT DRAWN OVER THE DASHBOARD.
+  //
+  // \`screen.key\` handlers are GLOBAL in blessed and keep firing while a textbox
+  // has focus, so [r], [d] and [q] would all act on keystrokes meant for the
+  // path. \`promptOpen\` gates every one of them. Without it, typing a Windows
+  // path containing a \`d\` arms a dismissal behind the prompt, and the \`q\` in
+  // \`C:\\\\Users\\\\qmark\` quits the receiver mid-sentence.
+  let promptOpen = false;
+  function askForPath(initial: string, onAnswer: (dir: string) => void): void {
+    promptOpen = true;
+    const box = blessed.textbox({
+      parent: screen,
+      top: 'center', left: 'center', width: '80%', height: 3,
+      border: { type: 'line' },
+      style: { border: { fg: AMBER }, fg: CREAM },
+      label: ' Export to which folder?  Enter accepts, Esc cancels ',
+      inputOnFocus: true,
+      keys: true,
+    });
+    // PRE-FILLED WITH THE RESOLVED DEFAULT, not left empty. The answer to
+    // "where does this go" has to be visible BEFORE the write, and an empty box
+    // asks the partner to know something the dashboard never told them.
+    box.setValue(initial);
+    screen.render();
+    box.readInput((_err, value) => {
+      promptOpen = false;
+      box.destroy();
+      screen.render();
+      // Escape gives no value. Treated as cancel, NOT as "use the default":
+      // a partner who hits Esc has changed their mind about writing a file.
+      if (typeof value !== 'string') { exportNote = 'Export cancelled.'; redraw(); return; }
+      onAnswer(value.trim());
+    });
+  }
+
   // [e] EXPORTS THE FAULT LIST. Metadata only, no payloads: see exportHeld.
   // Bound unconditionally for the same reason [r] is, so pressing it on a clean
   // receiver says there is nothing to export rather than appearing to hang.
+  //
+  // IT ASKS WHERE, EVERY TIME (Tim's call). \`exportDir\` in
+  // \`oneaddress.config.json\` and \`ONEADDRESS_EXPORT_DIR\` still decide the
+  // DEFAULT, but they were the only ways to choose and neither is visible from
+  // the dashboard - reported from a real run as "it looks like export location
+  // cannot be picked". Pressing Enter on the pre-filled prompt is byte-for-byte
+  // the old behaviour, so nothing that worked before needs changing.
   screen.key(['e'], () => {
+    if (promptOpen) return;
     if (heldCount() === 0) {
       replayNote = 'Nothing held, so nothing to export.';
       redraw();
       return;
     }
+    askForPath(config.exportDir || process.cwd(), (dir) => { writeExport(dir); redraw(); });
+  });
+
+  /**
+   * Write the fault export, and say where it landed.
+   *
+   * Shared by [e] and [d] rather than duplicated, because [d] exports FIRST and
+   * the two must agree on the destination and on the message. Returns whether
+   * it succeeded, which is what lets [d] refuse to discard anything after a
+   * failed write.
+   */
+  function writeExport(dir: string): boolean {
     try {
-      // NO ARGUMENT. \`exportHeld\` resolves \`config.exportDir\`, then
-      // \`ONEADDRESS_EXPORT_DIR\`, then the working directory, and returns an
-      // ABSOLUTE path. Passing \`process.cwd()\` here is what made the setting
-      // unreachable from the one key that uses it.
-      const { path, count } = exportHeld();
+      const { path, count } = exportHeld(dir);
       exportNote = \`Saved \${count} to \${path}\`;
       replayNote = '';
+      return true;
     } catch (err) {
       // NAMES THE DIRECTORY IT TRIED. "EACCES" on its own sends a partner to
       // search for a file that was never written.
-      exportNote = \`Export FAILED writing to \${config.exportDir || process.cwd()}: \` +
+      exportNote = \`Export FAILED writing to \${dir || process.cwd()}: \` +
         \`\${err instanceof Error ? err.message : String(err)}\`;
       replayNote = '';
+      return false;
     }
-    redraw();
-  });
+  }
 
   // [d] DISMISSES. TWO PRESSES, and the first one only asks.
   //
@@ -2145,10 +2198,19 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
   // working correctly, with nothing on screen that clears it. Reported from a
   // real run: "I do wish the conformance wouldn't come up as a fault."
   //
-  // WHY THE RECEIVER DOES NOT JUST RECOGNISE THE PROBE. Everything that
-  // identifies one is chosen by the sender. See the \`dismissed_at\` docstring in
-  // \`quarantine.ts\`: suppressing a fault panel on a sender-supplied value hides
-  // real held dispatches from the one person whose job is to notice them.
+  // THE RECEIVER DOES RECOGNISE THE PROBE NOW, AND THIS PARAGRAPH USED TO SAY
+  // OTHERWISE. It argued the receiver could not, because "everything that
+  // identifies one is chosen by the sender". That over-weighted the attacker:
+  // anyone able to forge a signed dispatch already holds the webhook secret and
+  // can make this receiver APPLY a bogus address change, so hiding a quarantine
+  // row is not the prize. The real question was signed versus unsigned, and
+  // \`conformance: true\` rides inside the signed body. A drill is classified, not
+  // suppressed - still written, still counted, drawn calmly rather than as an
+  // alarm - so [d] is no longer the only way to clear a passing run.
+  //
+  // IT STILL EXISTS, because a drill is not the only thing that gets held: a
+  // genuinely undecryptable dispatch from a key that has since been rotated is
+  // never going to replay, and without this the panel stays red forever.
   //
   // IRREVERSIBLE, SO IT IS CONFIRMED. Dismissal discards the held payload, which
   // is the point (see \`dismissHeld\`) and also means a mistaken press cannot be
@@ -2163,6 +2225,7 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
   // that was described makes the question and the action the same question.
   let dismissArmedFor: number | null = null;
   screen.key(['d'], () => {
+    if (promptOpen) return;
     const held = heldCount();
     if (held === 0) {
       dismissArmedFor = null;
@@ -2179,9 +2242,29 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
       return;
     }
     dismissArmedFor = null;
+    // EXPORTED BEFORE IT IS DISCARDED, ALWAYS.
+    //
+    // \`exportHeld\` reads \`heldDispatches()\`, which filters out dismissed rows,
+    // so [d] then [e] exported NOTHING and the record was unrecoverable from the
+    // UI. The payload is meant to go - it is an encrypted consumer address on a
+    // third party's disk - but the metadata is the part you would send to
+    // support, and dismissing destroyed exactly that. Reported from a real run:
+    // "if they dismiss a fault, does that mean they cant export and record it?"
+    //
+    // WRITTEN WITHOUT ASKING, unlike [e]. The partner is one keypress from
+    // discarding the evidence and an extra prompt here is a prompt at the worst
+    // possible moment; the default destination is the right answer for a record
+    // nobody asked for. A FAILED write ABORTS the dismissal rather than
+    // proceeding, because "we could not save the record, so we destroyed it" is
+    // the one outcome nothing recovers from.
+    if (!writeExport(config.exportDir || process.cwd())) {
+      replayNote = 'Dismiss ABORTED: nothing was discarded because the record could not be saved.';
+      redraw();
+      return;
+    }
     try {
       const n = dismissHeld();
-      replayNote = \`Dismissed \${n}. Nothing left held.\`;
+      replayNote = \`Dismissed \${n}. Nothing left held - the record was exported first.\`;
     } catch (err) {
       replayNote = \`Dismiss failed: \${err instanceof Error ? err.message : String(err)}\`;
     }
@@ -2189,6 +2272,7 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
   });
 
   screen.key(['q', 'C-c'], () => {
+    if (promptOpen) return;
     detach();
     screen.destroy();
     onQuit();
@@ -6456,8 +6540,9 @@ export async function ask(prompt: string): Promise<string> {
  * Show what this receiver holds: the roster, and every change it has applied.
  *
  * Usage:
- *   npm run show          \u2014 the roster and the last 20 changes
- *   npm run show 100      \u2014 the last 100 changes
+ *   npm run show          \u2014 a LIVE branded view, refreshing as changes land
+ *   npm run show 100      \u2014 keep 100 changes on screen instead of 20
+ *   npm run show > f.txt  \u2014 plain one-shot text, for a file or a pipe
  *
  * ## Why this script exists
  *
@@ -6468,6 +6553,23 @@ export async function ask(prompt: string): Promise<string> {
  * dispatch: "where do I look to prove it end to end?" The dashboard's LAST
  * CHANGE panel shows one change and nothing showed the rest.
  *
+ * ## Why it STREAMS rather than printing once
+ *
+ * The first version printed a snapshot and exited, which answers "did it land"
+ * only if you already knew to run it again. Watching a dispatch arrive meant
+ * re-running it by hand and diffing two screenfuls in your head. It holds the
+ * screen now and polls, so a change appears as it is applied.
+ *
+ * POLLED, NOT SUBSCRIBED, and that is forced rather than lazy: this is a
+ * SEPARATE PROCESS from the receiver, so there is no event to listen to. SQLite
+ * readers do not block writers, so a poll costs the running receiver nothing.
+ * The screen is only redrawn when the rendered content actually CHANGES, so an
+ * idle receiver is not repainting a terminal once a second.
+ *
+ * NON-TTY FALLS BACK TO ONE-SHOT TEXT. \`npm run show > out.txt\`, a pipe, and a
+ * CI log have no terminal to hold, and a blessed screen drawn into a pipe
+ * produces escape-code soup. Same rule the dashboard itself follows.
+ *
  * It prompts for the password for the same reason \`src/index.ts\` does, and for
  * the same reason it must do so BEFORE importing the store: the database
  * derives its keys on import.
@@ -6478,8 +6580,17 @@ export async function ask(prompt: string): Promise<string> {
  * in the connector's own store.
  */
 import 'dotenv/config';
+import blessed from 'blessed';
 import { config } from '../src/config.js';
 import { ask, databaseIsLocked } from '../src/unlock.js';
+import { HEX, ONE_ROWS, ADDRESS_ROWS, terminalFitsFullMark } from '../src/brand.js';
+
+const AMBER = HEX.amber.toLowerCase();
+const CREAM = HEX.cream.toLowerCase();
+const DIM = '#8a7f6a';
+
+/** Escape blessed's tag syntax so a customer's name can never inject markup. */
+const esc = (s: unknown): string => String(s ?? '').replace(/[{}]/g, '');
 
 function fmt(a: Record<string, string> | null): string {
   if (!a) return '(nothing on file)';
@@ -6495,18 +6606,32 @@ async function askPassword(): Promise<void> {
   if (answer) process.env.ONEADDRESS_DB_PASSPHRASE = answer;
 }
 
-async function main(): Promise<void> {
-  if (config.mode === 'inbox') {
-    console.log('\\n  This receiver is in inbox mode: it holds no customer records and no key.');
-    console.log('  Your connector applied the change and holds the result. Look there.\\n');
-    return;
-  }
+type Store = typeof import('../src/store.js');
 
-  await askPassword();
+/** The roster, as display rows. */
+function rosterRows(store: Store): string[] {
+  return store.allCustomers().map((c) => {
+    let addr: Record<string, string> | null = null;
+    try { addr = JSON.parse(c.address) as Record<string, string>; } catch { addr = null; }
+    return \`  \${esc(c.account_number).padEnd(20)} \${esc(c.name).padEnd(24)} \${esc(fmt(addr))}\`;
+  });
+}
 
-  const limit = Number(process.argv[2]) > 0 ? Number(process.argv[2]) : 20;
-  const store = await import('../src/store.js');
+/** Applied changes, newest first, as display rows with both sides. */
+function changeRows(store: Store, limit: number): string[] {
+  const out: string[] = [];
+  for (const h of store.addressHistory(limit)) {
+    const prev = h.prev_address as unknown as Record<string, string> | null;
+    const now  = h.address as unknown as Record<string, string>;
+    out.push(\`  {\${DIM}-fg}\${esc(h.recorded_at)}{/}  {\${CREAM}-fg}\${esc(h.account_number)}{/}  \${esc(h.name)}\`);
+    out.push(\`      {\${DIM}-fg}was:{/} \${esc(fmt(prev))}\`);
+    out.push(\`      {\${AMBER}-fg}now:{/} \${esc(fmt(now))}\`);
+  }
+  return out;
+}
 
+/** One-shot plain text. The pipe, the file, the CI log. */
+function printOnce(store: Store, limit: number): void {
   const roster = store.allCustomers();
   console.log(\`\\n  ON FILE (\${roster.length})\\n\`);
   for (const c of roster) {
@@ -6514,7 +6639,6 @@ async function main(): Promise<void> {
     try { addr = JSON.parse(c.address) as Record<string, string>; } catch { addr = null; }
     console.log(\`  \${c.account_number.padEnd(14)} \${c.name.padEnd(24)} \${fmt(addr)}\`);
   }
-
   const changes = store.addressHistory(limit);
   console.log(\`\\n  APPLIED CHANGES (\${changes.length}, newest first)\\n\`);
   if (changes.length === 0) {
@@ -6529,6 +6653,86 @@ async function main(): Promise<void> {
   console.log('');
 }
 
+/** The live view: the mark, the roster, the changes, refreshed as they land. */
+function stream(store: Store, limit: number): void {
+  const screen = blessed.screen({ smartCSR: true, title: 'What this receiver holds \u2014 OneAddress' });
+
+  // Same rule as the dashboard: the pixel wordmark needs 88 columns, and below
+  // that it wraps and reads as broken rather than as large.
+  const wide = terminalFitsFullMark(Number(screen.width));
+  const markHeight = wide ? 9 : 3;
+  blessed.box({
+    parent: screen, top: 0, left: 0, width: '100%', height: markHeight,
+    tags: true, padding: { left: 2 },
+    content: wide
+      ? ONE_ROWS.map((row, i) => \`{\${CREAM}-fg}\${row}{/} {\${AMBER}-fg}\${ADDRESS_ROWS[i]}{/}\`).join('\\n')
+      : \`{\${CREAM}-fg}{bold}One{/bold}{/}{\${AMBER}-fg}{bold}Address{/bold}{/}\`,
+  });
+
+  const rosterBox = blessed.box({
+    parent: screen, top: markHeight, left: 0, width: '100%', height: 'shrink',
+    tags: true, padding: { left: 1, right: 1 },
+    border: { type: 'line' }, style: { border: { fg: AMBER } },
+    label: ' ON FILE ',
+  });
+
+  const changesBox = blessed.box({
+    parent: screen, top: markHeight + 3, left: 0, width: '100%', bottom: 1,
+    tags: true, padding: { left: 1, right: 1 }, scrollable: true, alwaysScroll: true,
+    border: { type: 'line' }, style: { border: { fg: AMBER } },
+    label: ' APPLIED CHANGES \u2014 newest first ',
+  });
+
+  blessed.box({
+    parent: screen, bottom: 0, left: 0, width: '100%', height: 1,
+    tags: true, padding: { left: 2 },
+    content: \`{\${DIM}-fg}live \u2014 updates as dispatches land{/}   {\${CREAM}-fg}[q]{/} quit\`,
+  });
+
+  // ONLY REDRAWN WHEN THE CONTENT CHANGES. A poll that repaints unconditionally
+  // makes an idle receiver flicker once a second and destroys any scrollback
+  // position the operator had.
+  let last = '';
+  const tick = (): void => {
+    const roster = rosterRows(store);
+    const changes = changeRows(store, limit);
+    const next = roster.join('\\n') + '\\u0000' + changes.join('\\n');
+    if (next === last) return;
+    last = next;
+    rosterBox.height = roster.length + 2;
+    rosterBox.setContent(roster.join('\\n') || '  (nobody on file yet)');
+    changesBox.top = markHeight + roster.length + 2;
+    changesBox.setContent(changes.join('\\n') || '  None yet. Send a dispatch and this fills in.');
+    screen.render();
+  };
+
+  screen.key(['q', 'C-c', 'escape'], () => { screen.destroy(); process.exit(0); });
+  tick();
+  screen.render();
+  // DELIBERATELY NOT unref'd. An unref'd timer does not hold the event loop
+  // open, and with the screen drawn there is nothing else pending, so the
+  // process would exit the instant it finished painting.
+  setInterval(tick, 1000);
+}
+
+async function main(): Promise<void> {
+  if (config.mode === 'inbox') {
+    console.log('\\n  This receiver is in inbox mode: it holds no customer records and no key.');
+    console.log('  Your connector applied the change and holds the result. Look there.\\n');
+    return;
+  }
+
+  await askPassword();
+
+  const limit = Number(process.argv[2]) > 0 ? Number(process.argv[2]) : 20;
+  const store = await import('../src/store.js');
+
+  // A pipe, a file or a CI log has no terminal to hold, and a blessed screen
+  // drawn into one produces escape-code soup rather than output.
+  if (!process.stdout.isTTY) { printOnce(store, limit); return; }
+  stream(store, limit);
+}
+
 void main().catch((err: unknown) => {
   console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
@@ -11903,7 +12107,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto2 = require("crypto");
-var PKG_VERSION = true ? "2.6.0" : "dev";
+var PKG_VERSION = true ? "2.7.0" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto2.createHmac)("sha256", secret).update(message).digest("hex");
@@ -12972,6 +13176,9 @@ OneAddress and a leak of either must not also hand somebody your customers' addr
       "No private key is collected for an inbox receiver. It belongs in your connector,\nwhich is the only process that decrypts. This one is meant never to hold one, and\nit refuses to start if it finds one in its environment."
     );
   } else {
+    M2.info(
+      "It looks like one of these:\n  -----BEGIN PRIVATE KEY-----      (a .pem file, paste the whole thing)\n  MIGHAgEAMB...                    (the base64 body, copied from My Profile)\n  C:\\keys\\oneaddress.pem            (or just the path to the file)\nThis is your PRIVATE key, not the public one shown next to it in the portal."
+    );
     const privateKeyRaw = await he({
       message: "Your ECDH Private Key",
       placeholder: "Paste the base64 key body from My Profile, or enter a path to the .pem file",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {