drivethrough-cli 0.1.28 → 0.1.29

package/dist/main.mjs

@@ -21659,7 +21659,7 @@ var init_names = __esm({
 });
 
 // ../schema/src/integrations.ts
-var SECRET_NAME, ROUTE_METHODS, ROUTE_CACHE_SECONDS, SCHEDULE_EVERY, MAX_SECRETS, Headers2, RouteConfig, ActionConfig, PullConfig, ScheduleConfig, SecretsList, RoutesConfig, ActionsConfig, SchedulesConfig, HOUR, FIXED;
+var SECRET_NAME, ROUTE_METHODS, ROUTE_CACHE_SECONDS, SCHEDULE_EVERY, MAX_SECRETS, WEBHOOK_VERIFY, Headers2, RouteConfig, ActionConfig, PullConfig, ScheduleConfig, WebhookConfig, SecretsList, RoutesConfig, ActionsConfig, SchedulesConfig, WebhooksConfig, HOUR, FIXED;
 var init_integrations = __esm({
   "../schema/src/integrations.ts"() {
     "use strict";
@@ -21669,6 +21669,7 @@ var init_integrations = __esm({
     ROUTE_CACHE_SECONDS = { "0": 0, "30s": 30, "1m": 60, "5m": 300, "15m": 900, "1h": 3600 };
     SCHEDULE_EVERY = ["1h", "3h", "6h", "12h", "1d", "1w", "1mo"];
     MAX_SECRETS = 20;
+    WEBHOOK_VERIFY = ["stripe", "github", "standard", "hmac_sha256", "url_token"];
     Headers2 = external_exports.record(external_exports.string(), external_exports.string().max(4096));
     RouteConfig = external_exports.object({
       /** Literal https URL: host plus an optional base path. */
@@ -21703,10 +21704,22 @@ var init_integrations = __esm({
       rotate: external_exports.string().optional(),
       pull: PullConfig.optional()
     }).strict();
+    WebhookConfig = external_exports.object({
+      verify: external_exports.enum(WEBHOOK_VERIFY, {
+        error: 'verify must be one of "stripe", "github", "standard", "hmac_sha256", "url_token". There is no unverified webhook.'
+      }),
+      /** The declared secret holding the signing secret (or the URL token). */
+      secret: external_exports.string().min(1),
+      /** hmac_sha256 only: the header carrying the signature. */
+      header: external_exports.string().optional(),
+      into: external_exports.string().min(1),
+      map: external_exports.record(external_exports.string(), external_exports.string())
+    }).strict();
     SecretsList = external_exports.array(external_exports.string().regex(SECRET_NAME, "secret names are UPPER_CASE letters, numbers and underscores, like ALPACA_KEY")).max(MAX_SECRETS);
     RoutesConfig = external_exports.record(external_exports.string(), RouteConfig);
     ActionsConfig = external_exports.record(external_exports.string(), ActionConfig);
     SchedulesConfig = external_exports.record(external_exports.string(), ScheduleConfig);
+    WebhooksConfig = external_exports.record(external_exports.string(), WebhookConfig);
     HOUR = 36e5;
     FIXED = {
       "1h": HOUR,
@@ -21798,13 +21811,14 @@ var init_site_config = __esm({
       /** Pro (§3): additive custom-schema SQL applied to the site database. */
       schema: external_exports.string().max(2e4).optional(),
       /**
-       * Declared integrations (Pro) — see integrations.ts. All four are optional
+       * Declared integrations (Pro) — see integrations.ts. All five are optional
        * and additive: a bundle without them means exactly what it always did.
        */
       secrets: SecretsList.optional(),
       routes: RoutesConfig.optional(),
       actions: ActionsConfig.optional(),
-      schedules: SchedulesConfig.optional()
+      schedules: SchedulesConfig.optional(),
+      webhooks: WebhooksConfig.optional()
     }).strict();
     REMOVED_KEYS = {
       indexes: 'The "indexes" key was replaced by "query" \u2014 see query.<type>.fields.'
@@ -40226,7 +40240,7 @@ var init_output_schemas = __esm({
       manage_integrations: external_exports.looseObject({
         ok,
         // secrets
-        url: external_exports.string().optional().describe("secrets: the one-time link to relay to the user (they paste keys there, never in chat)"),
+        url: external_exports.string().optional().describe("secrets: the one-time link to relay to the user (they paste keys there, never in chat); test of a webhook: the URL the other service POSTs to"),
         session: external_exports.string().optional().describe(`secrets: pass back with action "secrets" after the user says they're done`),
         expires_at: external_exports.string().optional(),
         names: external_exports.array(external_exports.string()).optional().describe("secrets: the names the link asks for"),
@@ -40237,17 +40251,19 @@ var init_output_schemas = __esm({
         routes: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: declared routes"),
         actions: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: declared actions, their fields and triggering types"),
         schedules: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: each schedule's enabled, next_at, last_run_at, last_status, failures, disabled_reason"),
+        webhooks: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("status: each webhook's url (what the other service POSTs to), verify, secret_set, last_event_at, last_status and setup steps"),
         action_log: external_exports.array(external_exports.unknown()).optional().describe("status: the latest 20 outcomes, newest first"),
         // test
         target: external_exports.string().optional(),
-        kind: external_exports.string().optional().describe('test: "route", "action" or "schedule"'),
+        kind: external_exports.string().optional().describe('test: "route", "action", "schedule" or "webhook"'),
         status: external_exports.string().optional().describe('test: "ok", "failed", "skipped", "plan" or "quota"'),
         http_status: external_exports.number().nullish().describe("test: the upstream's HTTP status"),
         duration_ms: external_exports.number().optional(),
         body_preview: external_exports.string().nullish().describe("test: first 1 KB of the upstream response, secrets redacted"),
         error: external_exports.string().nullish(),
+        row: external_exports.record(external_exports.string(), external_exports.unknown()).nullish().describe("test, webhook targets: the row an event like the sample would store (nothing is written)"),
         next: external_exports.string().optional()
-      }).describe('"secrets" \u2192 a link or the set/unset map; "status" \u2192 everything declared plus recent outcomes; "test" \u2192 one live run')
+      }).describe('"secrets" \u2192 a link or the set/unset map; "status" \u2192 everything declared plus recent outcomes; "test" \u2192 one live run, or a webhook dry run')
     };
   }
 });
@@ -41134,16 +41150,16 @@ function registerTools(server, ctx) {
     {
       outputSchema: OUTPUT_SCHEMAS.manage_integrations,
       title: "Manage integrations",
-      description: `Connect a site to another service's API \u2014 get its keys set, check what's running, and test it \u2014 with no server code (Pro plan). (1) THE SETUP NEEDS NO TOOL: declare it in drivethrough.json and deploy. "secrets" names the keys; "routes" proxies same-origin paths under /api/ext/<name> to an upstream, allowing only the listed methods and path prefixes and adding secret headers server-side (\${NAME}); "actions" POST a JSON body ({{field}} reads a row's field) when a type with "on_write" gets a row; "schedules" run every 1h/3h/6h/12h/1d/1w/1mo \u2014 "rotate" sends the next row of a type through an action, "pull" saves a route's JSON response as a new row ("map" uses $.dotted.paths; numeric strings become numbers). No cron strings, no times of day, no timezones. Two complete examples \u2014 a read-only brokerage dashboard that also snapshots equity hourly for a chart: \`${INTEGRATION_EXAMPLE_A}\` \u2014 and a display that shows a quote when the owner clicks, and cycles through saved quotes every 3 hours: \`${INTEGRATION_EXAMPLE_B}\`. Every mistake is refused at deploy time with the corrected snippet \u2014 follow it. (2) SECRETS, TWO STEPS, like create_upload: action "secrets" returns a one-time link (10 minutes, no sign-in) \u2014 send it to the user as a clickable link and have them paste the keys there. NEVER ask for a key in the chat, and never put one in a file. When they say they're done, call again with the returned session to confirm every name is set. A deploy that needs an unset secret is refused with a fresh link already in the error \u2014 relay that one. Pass names to rotate a key that is already set. (3) TEST BEFORE YOU SAY IT WORKS: action "test" with target = a route plus path ("/api/ext/alpaca/v2/account"), an action name (with fields: the row values it uses), or a schedule name runs it once, now, for real (a schedule test inserts its row or advances its rotation) and returns the upstream's status and a redacted preview. Read the preview \u2014 a 200 with an error body is still a failure. action "status" shows secrets set/unset, routes, schedules (next run, last result, failures) and the latest outcomes. (4) WHAT FIRES AN ACTION: only a row written through the page-facing POST /api/data (a visitor's form, or the owner's own button on the page). write_db, imports and schedule pulls do NOT fire actions \u2014 to trigger one by hand, test it. Route access defaults to the owner only; set "access": "viewers" or "public" for pages others use. Schedules pause after 10 failures in a row (the owner gets one email); a deploy or a successful test re-enables them.`,
+      description: `Connect a site to another service's API \u2014 get its keys set, check what's running, and test it \u2014 with no server code (Pro plan). (1) THE SETUP NEEDS NO TOOL: declare it in drivethrough.json and deploy. "secrets" names the keys; "routes" proxies same-origin paths under /api/ext/<name> to an upstream, allowing only the listed methods and path prefixes and adding secret headers server-side (\${NAME}); "actions" POST a JSON body ({{field}} reads a row's field) when a type with "on_write" gets a row; "schedules" run every 1h/3h/6h/12h/1d/1w/1mo \u2014 "rotate" sends the next row of a type through an action, "pull" saves a route's JSON response as a new row ("map" uses $.dotted.paths; numeric strings become numbers); "webhooks" receive events another service POSTs to https://<site>/api/hook/<name> \u2014 "verify" is "stripe", "github", "standard" (Standard Webhooks: Resend, Clerk, Svix\u2026), "hmac_sha256" (with "header": the signature header's name) or, only for services that can't sign, "url_token"; "secret" names the declared secret; each verified event is mapped ("map", same $.paths) into a row of "into", which fires that type's on_write. Unverified, duplicate and replayed deliveries are never stored. No cron strings, no times of day, no timezones. Two complete examples \u2014 a read-only brokerage dashboard that also snapshots equity hourly for a chart: \`${INTEGRATION_EXAMPLE_A}\` \u2014 and a display that shows a quote when the owner clicks, and cycles through saved quotes every 3 hours: \`${INTEGRATION_EXAMPLE_B}\`. Every mistake is refused at deploy time with the corrected snippet \u2014 follow it. (2) SECRETS, TWO STEPS, like create_upload: action "secrets" returns a one-time link (10 minutes, no sign-in) \u2014 send it to the user as a clickable link and have them paste the keys there. NEVER ask for a key in the chat, and never put one in a file. When they say they're done, call again with the returned session to confirm every name is set. A deploy that needs an unset secret is refused with a fresh link already in the error \u2014 relay that one. Pass names to rotate a key that is already set. A webhook's secret comes FROM the other service: tell the user to add a webhook there pointing at its URL (status and the deploy error give it) and paste the signing secret it shows into the link page; a url_token secret is generated on the link page, which then shows the full URL to paste. (3) TEST BEFORE YOU SAY IT WORKS: action "test" with target = a route plus path ("/api/ext/alpaca/v2/account"), an action name (with fields: the row values it uses), or a schedule name runs it once, now, for real (a schedule test inserts its row or advances its rotation) and returns the upstream's status and a redacted preview. Read the preview \u2014 a 200 with an error body is still a failure. A webhook target ("/api/hook/payments", with fields: sample values) is a dry run that shows the row such an event would store; real delivery is proven by the other service's own "send test event" and then status. action "status" shows secrets set/unset, routes, schedules (next run, last result, failures), webhooks (URL, last event) and the latest outcomes. (4) WHAT FIRES AN ACTION: only a row written through the page-facing POST /api/data (a visitor's form, or the owner's own button on the page). write_db, imports and schedule pulls do NOT fire actions \u2014 to trigger one by hand, test it. Route access defaults to the owner only; set "access": "viewers" or "public" for pages others use. Schedules pause after 10 failures in a row (the owner gets one email); a deploy or a successful test re-enables them.`,
       // Open-world: tests call a third-party API on the user's behalf.
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true },
       inputSchema: {
         site: external_exports.string().describe("Site name or id"),
-        action: external_exports.enum(["secrets", "status", "test"]).describe('"secrets": get a link for the user to set keys (or, with session, confirm they are set); "status": what is declared and how it ran; "test": run one route, action or schedule now'),
+        action: external_exports.enum(["secrets", "status", "test"]).describe('"secrets": get a link for the user to set keys (or, with session, confirm they are set); "status": what is declared and how it ran; "test": run one route, action or schedule now, or dry-run a webhook'),
         names: external_exports.array(external_exports.string()).optional().describe("secrets: which secret names the link asks for. Default: every declared secret that is still unset. Include a set one to replace (rotate) it."),
         session: external_exports.string().optional().describe("secrets: the session a previous call returned \u2014 confirms what is set now instead of minting a new link"),
-        target: external_exports.string().optional().describe('test: a route key plus path ("/api/ext/weather/v1/forecast?city=Oslo"), an action name, or a schedule name'),
-        fields: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).optional().describe("test, action targets only: the row values the action's {{field}} references use")
+        target: external_exports.string().optional().describe('test: a route key plus path ("/api/ext/weather/v1/forecast?city=Oslo"), an action name, a schedule name, or a webhook path ("/api/hook/payments")'),
+        fields: external_exports.record(external_exports.string(), external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()])).optional().describe("test, action and webhook targets only: for an action, the row values its {{field}} references use; for a webhook, sample values for the fields its map fills")
       }
     },
     async ({
@@ -41167,18 +41183,27 @@ function registerTools(server, ctx) {
             const secrets2 = await setMap();
             const declared = secrets2.filter((s2) => s2.declared);
             const unset = declared.filter((s2) => !s2.set).map((s2) => s2.name);
+            if (declared.length === 0) {
+              return ok2({
+                session,
+                set: Object.fromEntries(secrets2.map((s2) => [s2.name, s2.set])),
+                next: "This site has no deployed secrets list yet, so deploy again now \u2014 the deploy checks every secret it needs and answers with a fresh link if one is still missing."
+              });
+            }
             return ok2({
               session,
               set: Object.fromEntries(secrets2.map((s2) => [s2.name, s2.set])),
               all_set: unset.length === 0,
-              next: unset.length ? `Still unset: ${unset.join(", ")}. Ask the user to finish on the page \u2014 or, if the link was used or expired, call this tool with action "secrets" again for a fresh one.` : "Every declared secret is set. Deploy (or redeploy) the site, then test each route, action and schedule."
+              next: unset.length ? `Still unset: ${unset.join(", ")}. Ask the user to finish on the page \u2014 or, if the link was used or expired, call this tool with action "secrets" again for a fresh one.` : "Every declared secret is set. Deploy (or redeploy) the site, then test each route, action, schedule and webhook."
             });
           }
           const link = await ctx.api.request("POST", `${sitePath(site2)}/secrets/link`, {
             body: names ? { names } : {}
           });
           const secrets = await setMap();
-          return ok2({ ...link, set: Object.fromEntries(secrets.map((s2) => [s2.name, s2.set])) });
+          const set2 = Object.fromEntries((link.names ?? []).map((name) => [name, false]));
+          for (const s2 of secrets) set2[s2.name] = s2.set;
+          return ok2({ ...link, set: set2 });
         }
         if (action === "status") {
           return ok2(await ctx.api.request("GET", `${sitePath(site2)}/integrations`));
@@ -41188,7 +41213,7 @@ function registerTools(server, ctx) {
             error: {
               code: "target_required",
               message: 'action "test" needs a target.',
-              next: 'Pass target: a route plus path ("/api/ext/name/path"), an action name, or a schedule name. action "status" lists them.'
+              next: 'Pass target: a route plus path ("/api/ext/name/path"), an action name, a schedule name, or a webhook path ("/api/hook/name"). action "status" lists them.'
             }
           });
         }
@@ -41290,6 +41315,7 @@ No server code. Declare it in drivethrough.json and the platform enforces it:
 - "routes": {"/api/ext/weather": {"upstream": "https://api.example.com", "methods": ["GET"], "paths": ["/v1/forecast"], "headers": {"Authorization": "Bearer \${WEATHER_KEY}"}, "access": "public", "cache": "5m", "query": true}} \u2192 the page fetches /api/ext/weather/v1/forecast?city=\u2026 same-origin; the key is added server-side and only the listed methods and path prefixes go through.
 - "actions": {"notify": {"post": "https://\u2026", "headers": {\u2026}, "body": {"text": "{{message}}"}}} plus "on_write": "notify" on a type \u2192 each row a page POSTs to /api/data fires the call. {{field}} reads the row; \${NAME} reads a secret.
 - "schedules": {"name": {"every": "1h"|"3h"|"6h"|"12h"|"1d"|"1w"|"1mo", "rotate": "<type>", "action": "<action>"}} cycles rows through an action; {"every": \u2026, "pull": {"route", "path", "into": "<type>", "map": {"field": "$.json.path"}}} saves a route's JSON as rows (for charts and history).
+- "webhooks": {"payments": {"verify": "stripe", "secret": "STRIPE_WEBHOOK_SECRET", "into": "payment", "map": {"amount": "$.data.object.amount"}}} \u2192 the other service POSTs events to https://<site>/api/hook/payments; each is verified ("stripe", "github", "standard", "hmac_sha256" + "header", or "url_token" for services that can't sign) and stored as a row, which fires that type's on_write. Give the event type "read": "owner" unless visitors should see it.
 Deploy, relay the secrets link if the deploy asks for one, then manage_integrations {action: "test"} each piece before telling the user it works. Full examples are in manage_integrations' description.
 
 Custom domains (paid plans): manage_domain attaches a domain the user already owns. After attaching, check_domain {action: "connect"} looks up one-click setup at their registrar (relay the URL when offered, else the exact DNS records from attach), and check_domain {action: "status"} polls until "active" \u2014 DNS seen, then TLS issued.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "drivethrough-cli",
-  "version": "0.1.28",
+  "version": "0.1.29",
   "description": "Agent-first hosting CLI. Say what you want. Stay in the car.",
   "type": "module",
   "license": "MIT",