bitlabs-cli-linux-amd64 1.0.9 → 2.0.2

package/schemas/evidence.schema.json

@@ -0,0 +1,110 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "const": "1"
+    },
+    "setup_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)[A-Za-z0-9][A-Za-z0-9_-]{0,79}$"
+    },
+    "plan_sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "app_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)[A-Za-z0-9][A-Za-z0-9_-]{0,79}$"
+    },
+    "environment": {
+      "type": "string",
+      "enum": [
+        "staging",
+        "production"
+      ]
+    },
+    "recipe": {
+      "const": "iframe-node-sqlite-v1"
+    },
+    "implementation_revision": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{40}$"
+    },
+    "checks": {
+      "type": "array",
+      "maxItems": 9,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "id": {
+            "type": "string",
+            "enum": [
+              "client_build",
+              "signature_fixtures",
+              "wallet_transactions",
+              "reconciliation",
+              "debug_isolation",
+              "callback_registered",
+              "signed_callback_observed",
+              "wallet_test_isolation",
+              "production_approval"
+            ]
+          },
+          "status": {
+            "type": "string",
+            "enum": [
+              "PASS",
+              "FAIL",
+              "NOT_RUN",
+              "HUMAN_CONFIRMED"
+            ]
+          },
+          "source": {
+            "type": "string",
+            "enum": [
+              "local_test",
+              "server_receipt",
+              "human"
+            ]
+          },
+          "observed_at": {
+            "type": "string"
+          },
+          "implementation_revision": {
+            "type": "string"
+          },
+          "artifact_sha256": {
+            "type": "string",
+            "pattern": "^[a-f0-9]{64}$"
+          },
+          "note": {
+            "type": "string",
+            "maxLength": 300
+          }
+        },
+        "required": [
+          "id",
+          "status",
+          "source",
+          "observed_at",
+          "implementation_revision"
+        ]
+      }
+    }
+  },
+  "required": [
+    "schema_version",
+    "setup_id",
+    "plan_sha256",
+    "app_id",
+    "environment",
+    "recipe",
+    "implementation_revision",
+    "checks"
+  ],
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "BitLabs reported completion evidence v1",
+  "description": "Imported evidence is not an authenticated attestation. CLI enforces source/status/age/revision binding."
+}

package/schemas/result.schema.json

@@ -0,0 +1,79 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "const": "1"
+    },
+    "setup_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)[A-Za-z0-9][A-Za-z0-9_-]{0,79}$"
+    },
+    "plan_sha256": {
+      "type": "string",
+      "pattern": "^[a-f0-9]{64}$"
+    },
+    "app_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)[A-Za-z0-9][A-Za-z0-9_-]{0,79}$"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "HUMAN_ACTION_REQUIRED",
+        "RECONCILIATION_REQUIRED",
+        "CONFIGURATION_VERIFIED"
+      ]
+    },
+    "changes": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "internal_identifier": {
+            "type": "string",
+            "enum": [
+              "general.name",
+              "general.link",
+              "app.features.offers.enabled",
+              "app.features.surveys.enabled"
+            ]
+          },
+          "before": {
+            "type": [
+              "string",
+              "boolean",
+              "null"
+            ]
+          },
+          "after": {
+            "type": [
+              "string",
+              "boolean"
+            ]
+          }
+        },
+        "required": [
+          "internal_identifier",
+          "before",
+          "after"
+        ]
+      }
+    },
+    "next_actions": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "required": [
+    "schema_version",
+    "setup_id",
+    "plan_sha256",
+    "status",
+    "next_actions"
+  ],
+  "$schema": "https://json-schema.org/draft/2020-12/schema"
+}

package/schemas/setup.example.json

@@ -0,0 +1,33 @@
+{
+  "schema_version": "1",
+  "setup_id": "publisher-staging-001",
+  "workspace_id": "workspace-example",
+  "app": {
+    "mode": "existing",
+    "id": "app-example"
+  },
+  "environment": "staging",
+  "integration": "iframe",
+  "recipe": "iframe-node-sqlite-v1",
+  "provisioning": "dashboard",
+  "demand": [
+    "surveys"
+  ],
+  "currency": {
+    "label": "Coins",
+    "base_units_per_usd": "100",
+    "user_reward_share_percent": "60",
+    "scale": 0,
+    "rounding": "floor",
+    "preserve_existing": true
+  },
+  "callback": {
+    "url": "https://publisher.example/bitlabs/callback",
+    "reconciliation_policy": "review"
+  },
+  "release": {
+    "version": "unreleased",
+    "source_revision": "unreleased",
+    "artifact_sha256": ""
+  }
+}

package/schemas/setup.schema.json

@@ -0,0 +1,243 @@
+{
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "schema_version": {
+      "const": "1"
+    },
+    "setup_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)(?=[A-Za-z0-9_-]*[A-Za-z0-9])[A-Za-z0-9_-]{1,80}(?![\\s\\S])"
+    },
+    "workspace_id": {
+      "type": "string",
+      "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)(?=[A-Za-z0-9_-]*[A-Za-z0-9])[A-Za-z0-9_-]{1,80}(?![\\s\\S])"
+    },
+    "app": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "mode": {
+          "type": "string",
+          "enum": [
+            "existing",
+            "create"
+          ]
+        },
+        "id": {
+          "type": "string",
+          "pattern": "^(?![Bb][Ll][Pp][Uu][Bb]_)(?=[A-Za-z0-9_-]*[A-Za-z0-9])[A-Za-z0-9_-]{1,80}(?![\\s\\S])"
+        },
+        "name": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 100
+        },
+        "product_url": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://[^?#@]+$"
+        }
+      },
+      "required": [
+        "mode"
+      ],
+      "oneOf": [
+        {
+          "properties": {
+            "mode": {
+              "const": "existing"
+            }
+          },
+          "required": [
+            "id"
+          ],
+          "not": {
+            "required": [
+              "name"
+            ]
+          }
+        },
+        {
+          "properties": {
+            "mode": {
+              "const": "create"
+            }
+          },
+          "required": [
+            "name"
+          ],
+          "not": {
+            "required": [
+              "id"
+            ]
+          }
+        }
+      ]
+    },
+    "environment": {
+      "type": "string",
+      "enum": [
+        "staging",
+        "production"
+      ]
+    },
+    "integration": {
+      "const": "iframe"
+    },
+    "recipe": {
+      "const": "iframe-node-sqlite-v1"
+    },
+    "provisioning": {
+      "type": "string",
+      "enum": [
+        "dashboard",
+        "helper"
+      ]
+    },
+    "demand": {
+      "type": "array",
+      "minItems": 1,
+      "maxItems": 2,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "enum": [
+          "offers",
+          "surveys"
+        ]
+      }
+    },
+    "currency": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "label": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 80
+        },
+        "base_units_per_usd": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]{0,9})(\\.[0-9]{1,6})?$"
+        },
+        "user_reward_share_percent": {
+          "type": "string",
+          "pattern": "^(0|[1-9][0-9]{0,9})(\\.[0-9]{1,6})?$"
+        },
+        "scale": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 6
+        },
+        "rounding": {
+          "type": "string",
+          "enum": [
+            "floor",
+            "exact"
+          ]
+        },
+        "preserve_existing": {
+          "type": "boolean"
+        }
+      },
+      "required": [
+        "label",
+        "base_units_per_usd",
+        "scale",
+        "rounding",
+        "preserve_existing"
+      ]
+    },
+    "callback": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "url": {
+          "type": "string",
+          "format": "uri",
+          "pattern": "^https://[^?#@]+$"
+        },
+        "reconciliation_policy": {
+          "type": "string",
+          "enum": [
+            "review",
+            "full-reversal"
+          ]
+        }
+      },
+      "required": [
+        "url",
+        "reconciliation_policy"
+      ]
+    },
+    "release": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "version": {
+          "type": "string"
+        },
+        "source_revision": {
+          "type": "string"
+        },
+        "artifact_sha256": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "version",
+        "source_revision",
+        "artifact_sha256"
+      ],
+      "oneOf": [
+        {
+          "properties": {
+            "version": {
+              "const": "unreleased"
+            },
+            "source_revision": {
+              "const": "unreleased"
+            },
+            "artifact_sha256": {
+              "const": ""
+            }
+          }
+        },
+        {
+          "properties": {
+            "version": {
+              "type": "string",
+              "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(-[A-Za-z0-9.-]+)?$"
+            },
+            "source_revision": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{40}$"
+            },
+            "artifact_sha256": {
+              "type": "string",
+              "pattern": "^[a-f0-9]{64}$"
+            }
+          }
+        }
+      ]
+    }
+  },
+  "required": [
+    "schema_version",
+    "setup_id",
+    "workspace_id",
+    "app",
+    "environment",
+    "integration",
+    "recipe",
+    "provisioning",
+    "demand",
+    "currency",
+    "callback",
+    "release"
+  ],
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "BitLabs secret-free setup manifest v1",
+  "description": "CLI validation additionally enforces public HTTPS hosts, bounded decimal values and no control characters. No credentials are accepted."
+}

package/site/README.md

@@ -0,0 +1,38 @@
+# Dashboard setup form and release site
+
+## Ready-to-hand-over copy button
+
+For the dashboard team, use the source-only package described in [dashboard-team-handoff.md](../docs/dashboard-team-handoff.md). Generate it with `python3 scripts/build-dashboard-handoff.py`, then deliver `handoff/bitlabs-dashboard-button.zip`. It contains a working standalone demo, reusable button assets and a complete copied prompt with code/tests. It needs no dashboard/API access, private repository URL, helper binary, release metadata or callback URL to start. Supplying selected workspace/app IDs is an optional local integration by the dashboard team. The copied prompt starts a managed-first local CLI 2.0.2 workflow: ask one question at a time, workspace first, secure management access next, then inspect apps/settings before unresolved preferences. Missing/old CLI installations use the exact public 2.0.2 release before credentials; dashboard-only setup is the fallback if secure access is unavailable or declined.
+
+The button's context is a secret-free kickoff, not a completed helper manifest. The agent keeps sanitized management checkpoints separately. The strict helper schema still supports only `provisioning: dashboard|helper`; never add a Management key to the widget or pretend `managed` is a supported manifest value. Use the matching CLI 2.0.2 release for named app discovery and exact public App Token retrieval.
+
+## Optional release-bound provisioning form
+
+The form below is a separate advanced surface. Its release controls do not gate the source-only copy button.
+
+The form supports the first iframe/Node/SQLite recipe, prefilled workspace/app IDs, secret-free JSON and one pinned prompt. For this optional legacy form only, existing-app/dashboard-managed staging is preselected; this does not change the managed-first question order in the primary copy button. It never takes a private credential. The dashboard embed must supply `window.BITLABS_DASHBOARD_CONTEXT = {workspace_id, app_id}` from authenticated server context. These values prefill read-only fields; they are metadata and do not confer authorization.
+
+`onboarding/START.md` is the canonical workflow router. The source-only button bundles its specialized instructions from `onboarding/dashboard-prompt.md` together with the reference code and tests. The optional form still requires its own reviewed platform-specific release configuration; publishing the source-only button does not configure it. A preview of this optional form has copying/downloading disabled:
+
+```text
+./site/build.sh --preview
+node --test site/test/*.test.cjs
+```
+
+Publication requires a real, reviewed release configuration and existing helper executable:
+
+```text
+./site/build.sh --release-config /reviewed/release.json --release-dir /reviewed/artifacts
+```
+
+The configuration contains exactly `version` (semver), `source_revision` (full Git commit), `artifact_sha256` (SHA256 of the **bitlabs-onboard executable**, not an archive), `artifact_file` (basename under release-dir), `platform` (darwin/linux/windows-amd64/arm64), `source_repository` (the actual reviewed GitHub owner/repository matching the checkout origin), and `guide_url` (the exact GitHub blob or raw URL for `onboarding/START.md` at that commit). Do not invent these values or point to a nonexistent release. The build verifies the local executable digest, matching checked-out commit, and clean source tree including untracked files. Review repository ownership and release provenance before publication; passing structural checks does not prove ownership.
+
+Each config applies to one helper platform. The dashboard/release publisher must select the publisher's machine platform and inject its matching reviewed config as `window.BITLABS_ONBOARDING_RELEASE`. The prompt names that platform and executable digest. The helper itself verifies the executable digest and compiled version/revision before credentialed provisioning. A wrong platform digest cannot authorize provisioning.
+
+For the dashboard, embed the built `docs/onboard-button.html` only after the release is reviewed. No production dashboard code is present in this repository; actual dashboard wiring remains a separate deployment. No hosting deployment is performed by the build.
+
+## Public download site
+
+Use [distribution-release.md](../docs/distribution-release.md) and `scripts/build-distribution-site.py` for the public site. It publishes the source-only button, complete hosted guide, CLI archives and preserved release history. The optional advanced form above is not the public landing page. Its guide must be publicly accessible at a reviewed immutable location before use by external publishers; a private source-repository URL is insufficient.
+
+The public homepage uses `landing.html`: one centered reference-style copy button. It uses the exact existing source prompt from the handoff bundle. Copy feedback stays in the button; clipboard refusal downloads the same complete prompt. Guides, downloads and handoff routes remain directly accessible.