ckweb-cli 0.5.0 → 0.6.0-beta.0

package/README.md

@@ -110,8 +110,8 @@ ckweb seo traffic "example.com"
 ### Admin Commands (requires admin key)
 | Group | Commands |
 |-------|----------|
-| `admin orders` | list, search, get, complete, refund, refund-keep-access, switch-product (engineer_kit/marketing_kit), resend-emails, resend-github-invite, export, stats (--start, --end, --status, --provider, --vat-requested) |
-| `admin users` | get, update, update-github, update-rates, set-tier, export, stats (--start, --end) |
+| `admin orders` | list, search, get, invoice (--output), complete, refund, refund-keep-access, switch-product (engineer_kit/marketing_kit), resend-emails, resend-github-invite, export, stats (--start, --end, --status, --provider, --vat-requested) |
+| `admin users` | get, update, update-github, update-rates, set-tier, delete-orphan (--reason), export, stats (--start, --end) |
 | `admin referrals` | stats, user-stats, diagnose, export, tiers-stats |
 | `admin revenue` | stats (--product, --no-team), export, maintainer, costs, add-cost, update-cost, delete-cost, reports |
 | `admin payouts` | list (--search, --status, --limit, --offset), update, export, export-detailed, request-csv |
@@ -198,7 +198,7 @@ pnpm test:e2e   # Run e2e tests against the real claudekit API
 
 `pnpm test:e2e` builds the CLI and exercises the published binary against the real claudekit API.
 Requires both `CKWEB_API_KEY` and `CKWEB_ADMIN_API_KEY` in `.env` (or shell env).
-These tests run on PRs and on `main` push, and gate the npm publish step in `release.yml`.
+These tests run on PRs and on `main` push, gate the npm publish step in `release.yml`, and are duplicated inside the configured beta release workflow for `dev`.
 
 ## Releasing
 
@@ -218,6 +218,26 @@ Bump rules (`auto` mode):
 - `feat:` → minor
 - `fix:` / `perf:` → patch
 - `BREAKING CHANGE` or `feat!:` / `fix!:` → major
+
+### Beta releases
+
+Beta release automation is configured in `.github/workflows/beta-release.yml` for pushes to `dev` and manual dispatch.
+
+The beta lane:
+- Runs install, lint, unit/integration tests, build, and real API e2e tests.
+- Computes semver prereleases like `0.5.2-beta.0`, `0.5.2-beta.1`.
+- Updates root `CHANGELOG.md`.
+- Checks that the target npm version does not already exist.
+- Runs `npm publish --tag beta --dry-run` before pushing the beta version commit and tag.
+- Pushes the beta commit/tag atomically to `dev`, then publishes with npm dist-tag `beta`.
+
+Install beta builds with:
+
+```bash
+npm install -g ckweb-cli@beta
+```
+
+Current status: configured locally in this branch, not yet verified by a real `dev` workflow run.
 - no relevant commits → skipped
 
 The workflow bumps `package.json`, creates `chore(release): vX.Y.Z` commit + tag,

package/dist/index.js

@@ -182,8 +182,7 @@ function isRecentRoute(path2) {
   const normalized = path2.startsWith("/") ? path2 : `/${path2}`;
   return RECENT_ROUTES.some((re) => re.test(normalized));
 }
-async function fetchApi(method, path2, options = {}) {
-  const { body, params, timeout = DEFAULT_TIMEOUT, noAuth = false, adminAuth = false } = options;
+function resolveApiKey(noAuth, adminAuth) {
   let apiKey;
   if (!noAuth) {
     if (adminAuth) {
@@ -198,6 +197,9 @@ async function fetchApi(method, path2, options = {}) {
       }
     }
   }
+  return apiKey;
+}
+function buildUrl(path2, params) {
   const baseUrl = getBaseUrl().replace(/\/?$/, "/");
   const url = new URL(path2.replace(/^\//, ""), baseUrl);
   if (params) {
@@ -205,59 +207,109 @@ async function fetchApi(method, path2, options = {}) {
       url.searchParams.set(key, value);
     }
   }
+  return url;
+}
+function buildHeaders(apiKey, hasBody) {
   const headers = {
-    "Content-Type": "application/json",
-    "User-Agent": `ckweb-cli/${"0.5.0"}`
+    "User-Agent": `ckweb-cli/${"0.6.0-beta.0"}`
   };
+  if (hasBody) {
+    headers["Content-Type"] = "application/json";
+  }
   if (apiKey) {
     headers["x-api-key"] = apiKey;
   }
+  return headers;
+}
+async function parseResponseBody(response) {
+  const contentType = response.headers.get("content-type") || "";
+  if (contentType.includes("application/json")) {
+    return response.json();
+  }
+  return response.text();
+}
+function throwResponseError(response, path2, data) {
+  const errorBody = data && typeof data === "object" ? data : {};
+  const message = errorBody.error || errorBody.message || (typeof data === "string" && data.trim() ? data : `HTTP ${response.status}`);
+  const code = errorBody.code;
+  if (response.status === 401 || response.status === 403) {
+    throw new AuthError(message);
+  }
+  if (response.status === 404 && isRecentRoute(path2)) {
+    throw new ApiError(
+      `${message} \u2014 this command may require a newer claudekit-web release; the endpoint ${path2} is not yet deployed.`,
+      response.status,
+      code
+    );
+  }
+  throw new ApiError(message, response.status, code);
+}
+function createTimeout(timeout) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeout);
+  return { controller, timer };
+}
+function normalizeRequestError(err, timeout) {
+  if (err instanceof AuthError || err instanceof ApiError) {
+    throw err;
+  }
+  if (err instanceof DOMException && err.name === "AbortError") {
+    throw new NetworkError(`Request timed out after ${timeout / 1e3}s`);
+  }
+  if (err instanceof TypeError) {
+    throw new NetworkError();
+  }
+  throw err;
+}
+async function fetchApi(method, path2, options = {}) {
+  const { body, params, timeout = DEFAULT_TIMEOUT, noAuth = false, adminAuth = false } = options;
+  const apiKey = resolveApiKey(noAuth, adminAuth);
+  const url = buildUrl(path2, params);
+  const headers = buildHeaders(apiKey, body !== void 0);
+  const { controller, timer } = createTimeout(timeout);
   try {
     const response = await fetch(url.toString(), {
       method,
       headers,
-      body: body ? JSON.stringify(body) : void 0,
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
       signal: controller.signal
     });
     clearTimeout(timer);
-    const contentType = response.headers.get("content-type") || "";
-    let data;
-    if (contentType.includes("application/json")) {
-      data = await response.json();
-    } else {
-      data = await response.text();
-    }
+    const data = await parseResponseBody(response);
     if (!response.ok) {
-      const errorBody = data;
-      const message = errorBody?.error || errorBody?.message || `HTTP ${response.status}`;
-      const code = errorBody?.code;
-      if (response.status === 401 || response.status === 403) {
-        throw new AuthError(message);
-      }
-      if (response.status === 404 && isRecentRoute(path2)) {
-        throw new ApiError(
-          `${message} \u2014 this command may require a newer claudekit-web release; the endpoint ${path2} is not yet deployed.`,
-          response.status,
-          code
-        );
-      }
-      throw new ApiError(message, response.status, code);
+      throwResponseError(response, path2, data);
     }
     return data;
   } catch (err) {
     clearTimeout(timer);
-    if (err instanceof AuthError || err instanceof ApiError) {
-      throw err;
-    }
-    if (err instanceof DOMException && err.name === "AbortError") {
-      throw new NetworkError(`Request timed out after ${timeout / 1e3}s`);
-    }
-    if (err instanceof TypeError) {
-      throw new NetworkError();
+    normalizeRequestError(err, timeout);
+  }
+}
+async function fetchApiBinary(method, path2, options = {}) {
+  const { body, params, timeout = DEFAULT_TIMEOUT, noAuth = false, adminAuth = false } = options;
+  const apiKey = resolveApiKey(noAuth, adminAuth);
+  const url = buildUrl(path2, params);
+  const headers = buildHeaders(apiKey, body !== void 0);
+  const { controller, timer } = createTimeout(timeout);
+  try {
+    const response = await fetch(url.toString(), {
+      method,
+      headers,
+      body: body !== void 0 ? JSON.stringify(body) : void 0,
+      signal: controller.signal
+    });
+    clearTimeout(timer);
+    if (!response.ok) {
+      const data = await parseResponseBody(response);
+      throwResponseError(response, path2, data);
     }
-    throw err;
+    return {
+      bytes: new Uint8Array(await response.arrayBuffer()),
+      headers: response.headers
+    };
+  } catch (err) {
+    clearTimeout(timer);
+    normalizeRequestError(err, timeout);
   }
 }
 
@@ -1189,6 +1241,10 @@ function registerWaitlistCommand(program2) {
   });
 }
 
+// src/commands/admin/admin-orders.ts
+import { dirname, resolve } from "path";
+import { statSync, writeFileSync } from "fs";
+
 // src/commands/admin/admin-utils.ts
 import * as readline6 from "readline/promises";
 async function confirm(message) {
@@ -1212,6 +1268,35 @@ var ORDER_COLUMNS2 = [
   { key: "paymentProvider", header: "Provider", width: 12 },
   { key: "createdAt", header: "Created", width: 22 }
 ];
+function assertInvoiceOutputPath(output) {
+  const resolved = resolve(output);
+  const parent = dirname(resolved);
+  try {
+    if (!statSync(parent).isDirectory()) {
+      throw new CliError(`Output parent is not a directory: ${parent}`);
+    }
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
+    if (code === "ENOENT") {
+      throw new CliError(`Output directory does not exist: ${parent}`);
+    }
+    if (err instanceof CliError) throw err;
+    throw err;
+  }
+  try {
+    const existing = statSync(resolved);
+    if (existing.isDirectory()) {
+      throw new CliError(`Output path is a directory: ${resolved}`);
+    }
+    throw new CliError(`Output file already exists: ${resolved}`);
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? err.code : void 0;
+    if (code === "ENOENT") {
+      return resolved;
+    }
+    throw err;
+  }
+}
 function registerAdminOrdersCommand(admin) {
   const orders = admin.command("orders").description("Admin order management");
   orders.command("list").description("List all orders").option("--provider <name>", "Filter by payment provider").action(async function() {
@@ -1252,6 +1337,18 @@ function registerAdminOrdersCommand(admin) {
       handleError(err);
     }
   });
+  orders.command("invoice <id>").description("Download order invoice PDF").requiredOption("--output <file>", "Output PDF path").action(async function(id) {
+    try {
+      ensureAdminAuth();
+      validateId(id, "order ID");
+      const outputPath = assertInvoiceOutputPath(this.opts().output);
+      const result = await fetchApiBinary("GET", `/admin/orders/${id}/pdf`, { adminAuth: true });
+      writeFileSync(outputPath, Buffer.from(result.bytes), { flag: "wx" });
+      printSuccess(`Invoice saved to ${outputPath}`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
   orders.command("complete <id>").description("Mark an order as complete").action(async function(id) {
     try {
       ensureAdminAuth();
@@ -1483,6 +1580,33 @@ function registerAdminUsersCommand(admin) {
       handleError(err);
     }
   });
+  users.command("delete-orphan <id>").description("Hard-delete a safe orphan user").requiredOption("--reason <text>", "Audit reason for deleting the orphan user").action(async function(id) {
+    try {
+      ensureAdminAuth();
+      validateId(id, "user ID");
+      const { reason } = this.opts();
+      if (!reason || String(reason).trim().length === 0) {
+        throw new CliError("--reason is required.");
+      }
+      const ok = await confirm(`Hard-delete orphan user ${id}? This cannot be undone.`);
+      if (!ok) {
+        console.log("Aborted.");
+        return;
+      }
+      const data = await fetchApi("DELETE", `/admin/users/${id}/orphan`, {
+        adminAuth: true,
+        body: { reason }
+      });
+      const outputOpts = getOutputOpts(this);
+      if (outputOpts.json) {
+        formatOutput(data, outputOpts);
+        return;
+      }
+      printSuccess(`Orphan user ${id} deleted.`);
+    } catch (err) {
+      handleError(err);
+    }
+  });
   users.command("export").description("Export users as CSV").option("--start <date>", "Start date (ISO 8601)").option("--end <date>", "End date (ISO 8601)").option("--search <text>", "Search text").action(async function() {
     try {
       ensureAdminAuth();
@@ -3003,7 +3127,7 @@ function registerAdminCommand(program2) {
 // src/index.ts
 loadDotenvFiles();
 var program = new Command();
-program.name("ckweb").description("CLI for interacting with ClaudeKit.cc API").version("0.5.0");
+program.name("ckweb").description("CLI for interacting with ClaudeKit.cc API").version("0.6.0-beta.0");
 program.option("--json", "Output as JSON").option("--table", "Output as table").option("--quiet", "Minimal output");
 registerAuthCommand(program);
 registerHealthCommand(program);