@optima-chat/dev-skills 0.7.33 → 0.7.36

package/dist/bin/helpers/billing-http.js

@@ -0,0 +1,153 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateEnv = validateEnv;
+exports.getServiceToken = getServiceToken;
+exports.callBilling = callBilling;
+exports.callSkills = callSkills;
+const child_process_1 = require("child_process");
+const infisical_secrets_1 = require("./infisical-secrets");
+const db_utils_1 = require("./db-utils");
+const USER_AUTH_URLS = {
+    stage: 'https://auth.stage.optima.onl',
+    prod: 'https://auth.optima.onl',
+};
+/**
+ * Validate the --env flag value at command entry, before any I/O.
+ *
+ * Without this, a typo like `--env staging` flows downstream and surfaces as
+ * a confusing error: entitlement subcommands hit resolveUserId first (SSH
+ * tunnel to RDS_HOSTS[undefined] → cryptic ssh failure), product subcommands
+ * reach getServiceToken (USER_AUTH_URLS[undefined] → "Unknown env"). All
+ * fail-closed (no wrong-env write), but the UX diverges per subcommand.
+ * Every runX handler calls this first so the error is uniform and immediate.
+ */
+function validateEnv(env) {
+    if (env !== 'stage' && env !== 'prod') {
+        throw new Error(`--env must be "stage" or "prod" (got: ${env})`);
+    }
+    return env;
+}
+// T1 discovered: client_id differs per env (stage=dev-skills-ubd3qz6n,
+// prod=dev-skills-hinxa0rs). Both stored in Infisical alongside the
+// secret at /shared-secrets/oauth-clients/.
+const DEV_SKILLS_OAUTH_PATH = '/shared-secrets/oauth-clients';
+const DEV_SKILLS_CLIENT_ID_KEY = 'DEV_SKILLS_OAUTH_CLIENT_ID';
+const DEV_SKILLS_CLIENT_SECRET_KEY = 'DEV_SKILLS_OAUTH_CLIENT_SECRET';
+// ───── Cache (process-lifetime) ─────────────────────────────────────────────
+// One CLI invocation does at most a handful of HTTP calls. We mint the M2M
+// token once and reuse it. Cross-invocation re-mint is fine — JWT TTL is
+// typically ≥1h, far longer than any single CLI run.
+//
+// NOT handled (acceptable for admin CLI):
+//   * Token expiry mid-invocation — a long-stalled revoke (list call + 5min
+//     pause + refund call) could in theory expire. Operator can retry.
+//   * Infisical 5xx retry — getInfisicalToken is sync execSync curl with no
+//     retry; any transient failure surfaces immediately. Re-run the CLI.
+const tokenCache = {};
+const billingUrlCache = {};
+const skillsUrlCache = {};
+function getBillingUrl(env) {
+    if (billingUrlCache[env])
+        return billingUrlCache[env];
+    const url = (0, infisical_secrets_1.fetchInfisicalSecret)(env, '/shared-secrets/domain-urls', 'BILLING_URL');
+    billingUrlCache[env] = url;
+    return url;
+}
+function getSkillsUrl(env) {
+    if (skillsUrlCache[env])
+        return skillsUrlCache[env];
+    const url = (0, infisical_secrets_1.fetchInfisicalSecret)(env, '/shared-secrets/domain-urls', 'SKILLS_REGISTRY_URL');
+    skillsUrlCache[env] = url;
+    return url;
+}
+function getServiceToken(env) {
+    if (tokenCache[env])
+        return tokenCache[env];
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const tok = (0, db_utils_1.getInfisicalToken)(cfg);
+    // Fetch BOTH client_id and client_secret from Infisical — they differ per env.
+    const clientId = (0, infisical_secrets_1.fetchInfisicalSecret)(env, DEV_SKILLS_OAUTH_PATH, DEV_SKILLS_CLIENT_ID_KEY, cfg, tok);
+    const clientSecret = (0, infisical_secrets_1.fetchInfisicalSecret)(env, DEV_SKILLS_OAUTH_PATH, DEV_SKILLS_CLIENT_SECRET_KEY, cfg, tok);
+    const authUrl = USER_AUTH_URLS[env];
+    if (!authUrl)
+        throw new Error(`Unknown env: ${env}`);
+    const body = `grant_type=client_credentials&client_id=${encodeURIComponent(clientId)}&client_secret=${encodeURIComponent(clientSecret)}`;
+    const response = (0, child_process_1.execSync)(`curl -s -X POST '${authUrl}/api/v1/oauth/token' -H 'Content-Type: application/x-www-form-urlencoded' -d '${body}'`, { encoding: 'utf-8' });
+    let parsed;
+    try {
+        parsed = JSON.parse(response);
+    }
+    catch {
+        throw new Error(`user-auth token endpoint returned non-JSON (${env}): ${response.slice(0, 200)}`);
+    }
+    if (!parsed.access_token) {
+        throw new Error(`user-auth token mint failed (${env}): ${response.slice(0, 200)}`);
+    }
+    tokenCache[env] = parsed.access_token;
+    return parsed.access_token;
+}
+function formatServiceError(status, statusText, body) {
+    let parsed = null;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch { /* non-JSON */ }
+    // Dominant Wave 1.5 envelope: flat { error: "CODE_STRING", message: "..." }
+    // emitted by billing's global error handler (app.ts:99-118) for ALL
+    // BillingError throws + validation errors + internal errors. Most inline
+    // route returns also use this shape (admin-products.ts:110,144,184-185,etc).
+    if (parsed && typeof parsed.error === 'string') {
+        return `❌ Error [${status}] ${parsed.error}: ${parsed.message ?? '(no message)'}`;
+    }
+    // Less-common nested envelope: { error: { code, message } } — used by a
+    // few inline 400/404 returns in admin-products.ts toggle-channel handler
+    // (lines 92-93, 100-101, 114-117). Possibly extends to other routes
+    // post-Wave-1.5 as standardization lands.
+    if (parsed && typeof parsed.error === 'object' && parsed.error !== null) {
+        const code = parsed.error.code ?? 'UNKNOWN';
+        const msg = parsed.error.message ?? '(no message)';
+        return `❌ Error [${status}] ${code}: ${msg}`;
+    }
+    // Non-envelope fallback (raw 502 from upstream LB, crashed handler before
+    // error middleware, plain-text body, etc.)
+    return `❌ Error [${status}] ${statusText}\n   Response body (first 500 bytes): ${body.slice(0, 500)}`;
+}
+/**
+ * Authenticated call to an Optima service (billing or skills — same dev-skills
+ * M2M token works for both). Returns `{status, body}` on 2xx; throws Error with
+ * formatted message on non-2xx. Single retry on 5xx (no backoff — admin CLI).
+ */
+async function callService(baseUrl, env, method, path, body) {
+    const url = `${baseUrl}${path}`;
+    const token = getServiceToken(env);
+    const doFetch = async () => fetch(url, {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    let res = await doFetch();
+    if (res.status >= 500) {
+        res = await doFetch();
+    }
+    const text = await res.text();
+    if (!res.ok) {
+        throw new Error(formatServiceError(res.status, res.statusText, text));
+    }
+    let parsed;
+    try {
+        parsed = text ? JSON.parse(text) : undefined;
+    }
+    catch {
+        throw new Error(`Service returned non-JSON 2xx body: ${text.slice(0, 200)}`);
+    }
+    return { status: res.status, body: parsed };
+}
+async function callBilling(env, method, path, body) {
+    return callService(getBillingUrl(env), env, method, path, body);
+}
+async function callSkills(env, method, path, body) {
+    return callService(getSkillsUrl(env), env, method, path, body);
+}

package/dist/bin/helpers/confirm-prompt.js

@@ -0,0 +1,54 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.confirmIfProd = confirmIfProd;
+const readline = __importStar(require("readline"));
+/**
+ * On prod, print the resolved action and require typing "yes" to proceed.
+ * No-op on stage or when --yes was passed. Exits 1 if user declines.
+ */
+async function confirmIfProd(env, actionDescription, skipFlag) {
+    if (env !== 'prod' || skipFlag)
+        return;
+    console.log(`\n⚠️  About to perform on PROD:\n${actionDescription}\n`);
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const answer = await new Promise((resolve) => {
+        rl.question('Type "yes" to confirm: ', (a) => { rl.close(); resolve(a.trim()); });
+    });
+    if (answer !== 'yes') {
+        console.error('❌ Aborted by user.');
+        process.exit(1);
+    }
+}

package/dist/bin/helpers/entitlement/grant.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGrant = runGrant;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+const db_utils_1 = require("../db-utils");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-entitlement grant --email <user> --product-key <slug> --justification "..." [options]
+
+Required:
+  --email <user-email>             Resolved to userId via user-auth DB
+  --product-key <productKey>
+  --justification "..."            Required by billing (400 otherwise); stored on entitlement.justification
+
+Optional:
+  --yes                            Skip prod confirmation prompt (no-op on stage)
+  --env stage|prod                 (default: stage)
+
+Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy=<clientId>.`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--email':
+                out.email = next;
+                i++;
+                break;
+            case '--product-key':
+                out.productKey = next;
+                i++;
+                break;
+            case '--justification':
+                out.justification = next;
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.email)
+        throw new Error('--email required');
+    if (!out.productKey)
+        throw new Error('--product-key required');
+    if (!out.justification)
+        throw new Error('--justification required (billing returns 400 otherwise)');
+    return out;
+}
+async function runGrant(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(cfg);
+    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: GRANT product '${args.productKey}' to user ${args.email} (userId=${userId}) on ${args.env.toUpperCase()}\nJustification: ${args.justification}`, args.yes);
+    console.log(`\n🎁 Granting ${args.productKey} to ${args.email}...`);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/grant-entitlement', {
+        userId,
+        productKey: args.productKey,
+        justification: args.justification,
+    });
+    console.log(`✓ Granted entitlement (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+}

package/dist/bin/helpers/entitlement/list.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runList = runList;
+const billing_http_1 = require("../billing-http");
+const db_utils_1 = require("../db-utils");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-entitlement list --email <user-email> [options]
+
+Required:
+  --email <user-email>             Resolved to userId via user-auth DB
+
+Optional:
+  --env stage|prod                 (default: stage)`);
+        process.exit(0);
+    }
+    const out = { env: 'stage' };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--email':
+                out.email = next;
+                i++;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.email)
+        throw new Error('--email required');
+    return out;
+}
+async function runList(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(cfg);
+    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
+    const rows = res.body.entitlements ?? [];
+    if (rows.length === 0) {
+        console.log(`(no entitlements for ${args.email} on ${args.env})`);
+        return;
+    }
+    // Newest first per spec
+    rows.sort((a, b) => b.purchasedAt.localeCompare(a.purchasedAt));
+    console.log(`${rows.length} entitlement(s) for ${args.email}:\n`);
+    console.log('id'.padEnd(38) + ' | ' + 'productKey'.padEnd(32) + ' | ' + 'status'.padEnd(9) + ' | ' + 'source'.padEnd(12) + ' | purchasedAt              | refundedAt');
+    console.log('-'.repeat(140));
+    for (const r of rows) {
+        console.log(r.id.padEnd(38) + ' | ' +
+            r.productKey.padEnd(32) + ' | ' +
+            r.status.padEnd(9) + ' | ' +
+            r.source.padEnd(12) + ' | ' +
+            r.purchasedAt.padEnd(24) + ' | ' +
+            (r.refundedAt ?? ''));
+    }
+}

package/dist/bin/helpers/entitlement/revoke.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRevoke = runRevoke;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+const db_utils_1 = require("../db-utils");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-entitlement revoke --email <user> --product-key <slug> --reason "..." [options]
+
+Required:
+  --email <user-email>             Resolved to userId via user-auth DB
+  --product-key <productKey>
+  --reason "..."                   Required by billing (400 otherwise); stored on entitlement.refundReason
+
+Optional:
+  --yes                            Skip prod confirmation prompt (no-op on stage)
+  --env stage|prod                 (default: stage)
+
+Refuses non-ADMIN_GRANT sources (PAYMENT, PARTNER) with source-specific
+error pointing to the right reversal flow.`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--email':
+                out.email = next;
+                i++;
+                break;
+            case '--product-key':
+                out.productKey = next;
+                i++;
+                break;
+            case '--reason':
+                out.reason = next;
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.email)
+        throw new Error('--email required');
+    if (!out.productKey)
+        throw new Error('--product-key required');
+    if (!out.reason)
+        throw new Error('--reason required (billing returns 400 otherwise)');
+    return out;
+}
+const PAYMENT_REFUSAL = `refusing to revoke a PAYMENT-source entitlement via CLI; this would leave the customer charged but unentitled. Use the Stripe refund flow which calls Stripe refund API + records refundedAmountCents + emits webhook. Manual psql is the escape hatch if absolutely necessary.`;
+const PARTNER_REFUSAL = `refusing to revoke a PARTNER-source entitlement via CLI; PARTNER grants are issued out-of-band and must be reversed via the partner contract / process that issued them. Manual psql is the escape hatch if absolutely necessary.`;
+async function runRevoke(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(cfg);
+    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    // Step 1: Fetch user's entitlements
+    const listRes = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
+    const all = listRes.body.entitlements ?? [];
+    // Step 2: Filter for ACTIVE + matching productKey
+    const matches = all.filter((e) => e.status === 'ACTIVE' && e.productKey === args.productKey);
+    // Step 3: Validate count (partial unique index enforces ≤1 ACTIVE)
+    if (matches.length === 0) {
+        throw new Error(`no active entitlement for (user=${args.email}, product=${args.productKey}) on ${args.env}`);
+    }
+    if (matches.length > 1) {
+        throw new Error(`unexpected: ${matches.length} ACTIVE entitlements for (user, product) — partial unique constraint should prevent this. Inspect with: optima-entitlement list --email ${args.email}`);
+    }
+    const target = matches[0];
+    // Step 4: Validate source
+    if (target.source === 'PAYMENT')
+        throw new Error(PAYMENT_REFUSAL);
+    if (target.source === 'PARTNER')
+        throw new Error(PARTNER_REFUSAL);
+    if (target.source !== 'ADMIN_GRANT')
+        throw new Error(`unknown entitlement source: ${target.source}`);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: REVOKE entitlement ${target.id} (productKey=${target.productKey}) for user ${args.email} (userId=${userId}) on ${args.env.toUpperCase()}\nReason: ${args.reason}`, args.yes);
+    // Step 5: Refund
+    // refundAmountCents=0 is always correct for ADMIN_GRANT (priceCents=0,
+    // no upstream charge). Pass explicitly so billing's auto-compute
+    // (which requires refundWindowDays on the Product) doesn't 400 with
+    // MANUAL_REFUND_AMOUNT_REQUIRED for products that lack a refund policy.
+    // PAYMENT/PARTNER sources are already refused in step 4 above, so
+    // this branch only ever runs for ADMIN_GRANT (priceCents=0) — Stripe
+    // refund path in billing (admin-products.ts:296-307) is gated on
+    // source=PAYMENT and won't trigger here.
+    console.log(`\n♻️  Revoking entitlement ${target.id} for ${args.email}...`);
+    const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/refund-entitlement', {
+        entitlementId: target.id,
+        refundReason: args.reason,
+        refundAmountCents: 0,
+    });
+    console.log(`✓ Revoked entitlement (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+}

package/dist/bin/helpers/entitlement.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const grant_1 = require("./entitlement/grant");
+const list_1 = require("./entitlement/list");
+const revoke_1 = require("./entitlement/revoke");
+function printHelp() {
+    console.log(`Usage: optima-entitlement <subcommand> [options]
+
+Subcommands:
+  grant      Admin-grant a product entitlement to a user
+  revoke     Revoke an admin-granted entitlement (refuses PAYMENT / PARTNER sources)
+  list       List a user's entitlements, newest first
+
+Run 'optima-entitlement <subcommand> --help' for subcommand-specific options.`);
+}
+async function main() {
+    const [, , subcommand, ...rest] = process.argv;
+    if (!subcommand || subcommand === '-h' || subcommand === '--help') {
+        printHelp();
+        process.exit(0);
+    }
+    switch (subcommand) {
+        case 'list':
+            await (0, list_1.runList)(rest);
+            break;
+        case 'grant':
+            await (0, grant_1.runGrant)(rest);
+            break;
+        case 'revoke':
+            await (0, revoke_1.runRevoke)(rest);
+            break;
+        default:
+            console.error(`Unknown subcommand: ${subcommand}`);
+            printHelp();
+            process.exit(1);
+    }
+}
+main().catch((err) => { console.error(err.message); process.exit(1); });

package/dist/bin/helpers/infisical-secrets.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchInfisicalSecret = fetchInfisicalSecret;
+const child_process_1 = require("child_process");
+const db_utils_1 = require("./db-utils");
+/**
+ * Fetch a single secret value from Infisical given env + path + name.
+ *
+ * env mapping: 'stage' → Infisical env slug 'staging'; 'prod' → 'prod'
+ * (matches dev-skills convention documented at
+ *  ~/.claude/projects/-mnt-d-work-projects-optima/memory/optima_infisical_env_naming.md).
+ *
+ * Returns the raw secretValue string. Throws if the secret is missing.
+ */
+function fetchInfisicalSecret(env, secretPath, secretName, config, token) {
+    const cfg = config ?? (0, db_utils_1.getInfisicalConfig)();
+    const tok = token ?? (0, db_utils_1.getInfisicalToken)(cfg);
+    const envSlug = env === 'stage' ? 'staging' : env;
+    const encodedPath = encodeURIComponent(secretPath);
+    const encodedName = encodeURIComponent(secretName);
+    const response = (0, child_process_1.execSync)(`curl -s "${cfg.url}/api/v3/secrets/raw/${encodedName}?workspaceId=${cfg.projectId}&environment=${envSlug}&secretPath=${encodedPath}" -H "Authorization: Bearer ${tok}"`, { encoding: 'utf-8' });
+    let parsed;
+    try {
+        parsed = JSON.parse(response);
+    }
+    catch {
+        throw new Error(`Infisical raw secret fetch returned non-JSON for ${secretPath}/${secretName} (${envSlug}): ${response.slice(0, 200)}`);
+    }
+    if (!parsed.secret?.secretValue) {
+        throw new Error(`Infisical secret not found: env=${envSlug} path=${secretPath} name=${secretName} (response: ${response.slice(0, 200)})`);
+    }
+    return parsed.secret.secretValue;
+}

package/dist/bin/helpers/plugin/set-default.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetDefault = runSetDefault;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-plugin set-default --slug <slug> --default true|false [options]
+
+Required:
+  --slug <slug>
+  --default true|false   Sets Plugin.defaultForUser
+
+Optional:
+  --yes                  Skip prod confirmation prompt (no-op on stage)
+  --env stage|prod       (default: stage)
+
+Note: no skill-sync broadcast — changes what NEW user syncs receive; does not
+retroactively add/remove the plugin for existing users until their next sync.`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--slug':
+                out.slug = next;
+                i++;
+                break;
+            case '--default':
+                if (next !== 'true' && next !== 'false')
+                    throw new Error('--default must be true or false');
+                out.default = next === 'true';
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.slug)
+        throw new Error('--slug required');
+    if (out.default === undefined)
+        throw new Error('--default required (true|false)');
+    return out;
+}
+async function runSetDefault(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: set defaultForUser=${args.default} on plugin '${args.slug}' (${args.env.toUpperCase()})`, args.yes);
+    console.log(`\n🔧 Setting defaultForUser=${args.default} on ${args.slug} (${args.env.toUpperCase()})...`);
+    const res = await (0, billing_http_1.callSkills)(args.env, 'PATCH', `/api/admin/plugins/${encodeURIComponent(args.slug)}`, { defaultForUser: args.default });
+    console.log(`✓ Updated plugin (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+}

package/dist/bin/helpers/plugin/set-paid.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runSetPaid = runSetPaid;
+const billing_http_1 = require("../billing-http");
+const confirm_prompt_1 = require("../confirm-prompt");
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(`Usage: optima-plugin set-paid --slug <slug> --paid true|false [options]
+
+Required:
+  --slug <slug>
+  --paid true|false    Sets Plugin.isPaid (the user-facing paid/free gate)
+
+Optional:
+  --yes                Skip prod confirmation prompt (no-op on stage)
+  --env stage|prod     (default: stage)
+
+Note: salesUrl is NOT settable here (skills PATCH is strict; salesUrl is
+publish-time-only via plugin.json metadata). When isPaid=true and salesUrl is
+null, the 402 falls back to sales.optima.onl.`);
+        process.exit(0);
+    }
+    const out = { env: 'stage', yes: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--slug':
+                out.slug = next;
+                i++;
+                break;
+            case '--paid':
+                if (next !== 'true' && next !== 'false')
+                    throw new Error('--paid must be true or false');
+                out.paid = next === 'true';
+                i++;
+                break;
+            case '--yes':
+                out.yes = true;
+                break;
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            default: throw new Error(`Unknown arg: ${a}`);
+        }
+    }
+    if (!out.slug)
+        throw new Error('--slug required');
+    if (out.paid === undefined)
+        throw new Error('--paid required (true|false)');
+    return out;
+}
+async function runSetPaid(argv) {
+    const args = parseArgs(argv);
+    (0, billing_http_1.validateEnv)(args.env);
+    await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: set isPaid=${args.paid} on plugin '${args.slug}' (${args.env.toUpperCase()})`, args.yes);
+    console.log(`\n💰 Setting isPaid=${args.paid} on ${args.slug} (${args.env.toUpperCase()})...`);
+    const res = await (0, billing_http_1.callSkills)(args.env, 'PATCH', `/api/admin/plugins/${encodeURIComponent(args.slug)}`, { isPaid: args.paid });
+    console.log(`✓ Updated plugin (HTTP ${res.status}):`);
+    console.log(JSON.stringify(res.body, null, 2));
+    if (args.paid) {
+        console.log(`\nℹ️  Reminder: ensure a billing Product + channel exists for '${args.slug}' (optima-product) or users will 402 with no purchase path. salesUrl is publish-time-only (currently shown above).`);
+    }
+}