@oneaddress/setup 2.9.0 → 2.10.0

package/dist/index.js

@@ -856,7 +856,7 @@ var _R = ["\u2588\u2588\u2588\u2588\u2588\u2588 ", "\u2588\u2588   \u2588\u2588"
 var _S = [" \u2588\u2588\u2588\u2588\u2588\u2588", "\u2588\u2588     ", "\u2588\u2588     ", " \u2588\u2588\u2588\u2588\u2588 ", "     \u2588\u2588", "     \u2588\u2588", "\u2588\u2588\u2588\u2588\u2588\u2588 "];
 var ONE_ROWS = Array.from({ length: 7 }, (_3, i) => [_O[i], _N[i], _E[i]].join(" "));
 var ADDR_ROWS = Array.from({ length: 7 }, (_3, i) => [_A[i], _D2[i], _D2[i], _R[i], _E[i], _S[i], _S[i]].join(" "));
-var WIZARD_VERSION = true ? "2.9.0" : "?";
+var WIZARD_VERSION = true ? "2.10.0" : "?";
 function printCompactHeader() {
   const INNER = 42;
   const TOP = fn("\u250C") + dm("\u2500".repeat(INNER)) + fn("\u2510");
@@ -1023,6 +1023,7 @@ data.db-shm
       name: "customers.json",
       content: `{
   "//": "YOUR CUSTOMER ROSTER \u2014 edit this file to your customers (account number, name, and the address you hold on file today). src/store.ts seeds from here on startup; point loadRoster at your real customer database when you outgrow the file. Override the path with the ONEADDRESS_CUSTOMERS env var.",
+  "//plaintext": "THIS FILE IS PLAINTEXT AND IS NOT ENCRYPTED. It is a seed you author and control, so treat it like any other file of customer data in your repo: keep it out of version control if it holds real people. The receiver's ENCRYPTED/UNENCRYPTED banner refers to its own database (records at rest, under ONEADDRESS_DB_PASSPHRASE), not to this file. Addresses that ARRIVE from OneAddress land in that database, never here.",
   "customers": [
     { "account_number": "AUR-583920", "name": "Tim Hooper",       "address": { "street": "12 Old Mill Road",     "suburb": "Parramatta",      "state": "NSW", "postcode": "2150" } },
     { "account_number": "AUR-104772", "name": "Olivia Robinson",  "address": { "street": "5 Rosewood Lane",      "suburb": "Brisbane",        "state": "QLD", "postcode": "4000" } },
@@ -1907,7 +1908,14 @@ export function startDashboard({ partnerName, port, onQuit, onReplay, stats }: T
     status.setContent(
       \`{\${AMBER}-fg}{bold}\${esc(partnerName)}{/}   \` +
       \`{\${DIM}-fg}listening{/} {\${CREAM}-fg}:\${port}/webhook{/}   \` +
-      \`{\${DIM}-fg}customer file{/} \${vault}   \` +
+      // "customer file" WAS THE WRONG WORDS FOR THE RIGHT VALUE, and it
+      // misread exactly as you would expect. store.encrypted is about the
+      // personal columns of THIS RECEIVER'S DATABASE. The only file a partner
+      // has been told to open is customers.json, which is a plaintext SEED
+      // that src/store.ts inserts from on startup - so a header reading
+      // "customer file ENCRYPTED" above a cleartext customers.json looked
+      // like a false claim about encryption. It was never measuring that file.
+      \`{\${DIM}-fg}records at rest{/} \${vault}   \` +
       // A DASH RATHER THAN A ZERO when the store declines to count. Zero is a
       // claim ("you have no customers") and would be a lie on a receiver
       // pointed at a real customer table, where counting every row forty times
@@ -12502,7 +12510,7 @@ async function scaffold(platform, outputDir, partnerId, webhookSecret, webhookUr
 
 // src/register.ts
 var import_node_crypto2 = require("crypto");
-var PKG_VERSION = true ? "2.9.0" : "dev";
+var PKG_VERSION = true ? "2.10.0" : "dev";
 var REGISTER_URL = "https://partners.oneaddress.io/api/partner/installs";
 function hmacSha256(secret, message) {
   return (0, import_node_crypto2.createHmac)("sha256", secret).update(message).digest("hex");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneaddress/setup",
-  "version": "2.9.0",
+  "version": "2.10.0",
   "description": "Interactive setup wizard for OneAddress partner webhook integrations",
   "main": "dist/index.js",
   "bin": {