mayar 0.1.1 → 0.1.7

package/README.md

@@ -13,14 +13,14 @@ npx mayar --help
 Or from source:
 
 ```bash
-git clone https://github.com/moerdowo/mayar-cli.git
+git clone https://github.com/mayarid/mayar-cli.git
 cd mayar-cli
 npm link        # exposes a `mayar` command on your PATH
 ```
 
 ## First run
 
-The first time you invoke any command, the CLI prints an ASCII banner and asks for your production API key (input is masked). Paste it once; it's stored at `~/.mayar/config.json` (chmod 600) and reused on subsequent runs.
+The first time you invoke any command, the CLI prints an ASCII banner and asks for your production API key (input is masked). Paste it once; it's stored at `~/.config/mayar/config.json` (chmod 600, follows the [XDG Base Directory](https://specification.freedesktop.org/basedir-spec/latest/) spec) and reused on subsequent runs.
 
 ```bash
 mayar balance
@@ -29,7 +29,7 @@ mayar balance
 # Welcome to Mayar CLI.
 # No API key found. Get yours from https://web.mayar.id → Integration → API Key.
 # Paste your production API key: ************
-# ✓ Saved to /Users/you/.mayar/config.json
+# ✓ Saved to /Users/you/.config/mayar/config.json
 ```
 
 You can also run `mayar init` explicitly to (re-)configure the key, or pass `--api-key <key>` on any invocation to override.
@@ -38,11 +38,13 @@ You can also run `mayar init` explicitly to (re-)configure the key, or pass `--a
 
 ```
 Setup
-  init                                  Run first-time setup
+  init                                  Run first-time setup (interactive, masked input)
+  api-key <key>                         Save API key non-interactively (e.g. for scripts)
   config show                           Show masked saved key
   config reset                          Remove the saved key
 
 Account
+  whoami                                Show merchant identity (decoded from JWT key) + verify
   balance                               GET /hl/v1/balance
 
 Invoices
@@ -85,13 +87,18 @@ Webhooks
 
 Global flags
   --json                Output raw JSON instead of pretty tables
-  --api-key <key>       Override saved key for this run
+  --api-key <key>       Use this API key for the run (also accepts --api-key=KEY)
   --page N              Pagination page (default 1)
   --pageSize N          Pagination page size (default 10)
   -h, --help            Show help
   -v, --version         Show version
+
+Environment
+  MAYAR_API_KEY         Used when --api-key is not given and no config is saved
 ```
 
+Resolution order: `--api-key` flag → `MAYAR_API_KEY` env → saved config.
+
 ## Examples
 
 ```bash
@@ -141,9 +148,11 @@ mayar invoice list --json | jq '.data[] | {id, status}'
 
 | Key      | Value                                      |
 | -------- | ------------------------------------------ |
-| Path     | `~/.mayar/config.json` (chmod 600)         |
+| Path     | `$XDG_CONFIG_HOME/mayar/config.json`, defaulting to `~/.config/mayar/config.json` (chmod 600) |
 | Endpoint | `https://api.mayar.id` (production, fixed) |
 
+Legacy installs that wrote to `~/.mayar/config.json` are migrated automatically on first run.
+
 To rotate keys: `mayar config reset && mayar init`.
 
 ## Notes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mayar",
-  "version": "0.1.1",
+  "version": "0.1.7",
   "description": "Zero-dependency Node.js CLI for the Mayar API (production endpoint).",
   "bin": {
     "mayar": "bin/mayar.js"
@@ -23,13 +23,13 @@
   ],
   "author": "Frianto Moerdowo <frianto@duck.com>",
   "license": "MIT",
-  "homepage": "https://github.com/moerdowo/mayar-cli#readme",
+  "homepage": "https://github.com/mayarid/mayar-cli#readme",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/moerdowo/mayar-cli.git"
+    "url": "git+https://github.com/mayarid/mayar-cli.git"
   },
   "bugs": {
-    "url": "https://github.com/moerdowo/mayar-cli/issues"
+    "url": "https://github.com/mayarid/mayar-cli/issues"
   },
   "files": [
     "bin",

package/src/cli.js

@@ -10,10 +10,12 @@ ${ui.bold('Usage:')}
 
 ${ui.bold('Setup:')}
   init                                Run first-time setup (or re-configure API key)
+  api-key <key>                       Save API key non-interactively
   config show                         Show config path and masked API key
   config reset                        Remove the saved API key
 
 ${ui.bold('Account:')}
+  whoami                              Show identity behind the saved API key
   balance                             Get account balance
 
 ${ui.bold('Invoices:')}
@@ -56,14 +58,18 @@ ${ui.bold('Webhooks:')}
 
 ${ui.bold('Global flags:')}
   --json                Output raw JSON instead of formatted tables
-  --api-key <key>       Override saved API key for this run
+  --api-key <key>       Use this API key for the run (overrides env + saved config)
   --page N              Pagination page (default 1)
   --pageSize N          Pagination page size (default 10)
   -h, --help            Show help
   -v, --version         Show version
 
+${ui.bold('Environment:')}
+  MAYAR_API_KEY         Used when --api-key is not given and no config is saved
+
+${ui.dim('Resolution order: --api-key flag > MAYAR_API_KEY env > saved config.')}
 ${ui.dim('Endpoint: https://api.mayar.id (production only)')}
-${ui.dim('Config:   ~/.mayar/config.json (chmod 600)')}
+${ui.dim('Config:   ~/.config/mayar/config.json (chmod 600)')}
 `;
 
 function parseFlags(argv) {
@@ -75,6 +81,7 @@ function parseFlags(argv) {
     if (a === '--json') flags.json = true;
     else if (a === '--force') flags.force = true;
     else if (a === '--api-key') flags.apiKey = argv[++i];
+    else if (a.startsWith('--api-key=')) flags.apiKey = a.slice('--api-key='.length);
     else if (a === '--page') flags.page = argv[++i];
     else if (a === '--pageSize' || a === '--page-size') flags.pageSize = argv[++i];
     else if (a === '--data') flags.data = argv[++i];
@@ -93,6 +100,7 @@ function parseFlags(argv) {
 
 async function ensureKey(flags) {
   if (flags.apiKey) return flags.apiKey;
+  if (process.env.MAYAR_API_KEY) return process.env.MAYAR_API_KEY;
   const cfg = config.load();
   if (cfg && cfg.apiKey) return cfg.apiKey;
   // First-run flow
@@ -124,6 +132,10 @@ async function run(argv) {
       const init = require('./commands/init');
       return await init.run({ flags });
     }
+    if (cmd === 'api-key' || cmd === 'apikey') {
+      const apikey = require('./commands/apikey');
+      return await apikey.run({ positional: [sub, ...rest].filter((x) => x !== undefined) });
+    }
     if (cmd === 'config') {
       if (sub === 'show') {
         const cfg = config.load();
@@ -145,6 +157,7 @@ async function run(argv) {
     }
 
     const handlers = {
+      whoami:       './commands/whoami',
       balance:      './commands/balance',
       invoice:      './commands/invoice',
       product:      './commands/product',

package/src/commands/apikey.js

@@ -0,0 +1,22 @@
+const config = require('../config');
+const ui = require('../ui');
+
+async function run({ positional }) {
+  const [key] = positional;
+  if (!key || !key.trim()) {
+    throw new Error('Usage: mayar api-key <your-api-key>');
+  }
+  const trimmed = key.trim();
+  const existing = config.load() || {};
+  config.save({
+    ...existing,
+    apiKey: trimmed,
+    endpoint: 'production',
+    savedAt: new Date().toISOString(),
+  });
+  const masked = trimmed.slice(0, 6) + '…' + trimmed.slice(-4);
+  process.stdout.write(ui.green(`✓ API key saved (${masked})`) + '\n');
+  process.stdout.write(ui.dim(config.file) + '\n');
+}
+
+module.exports = { run };

package/src/commands/whoami.js

@@ -0,0 +1,64 @@
+const api = require('../api');
+const ui = require('../ui');
+
+function decodeJwt(token) {
+  const parts = token.split('.');
+  if (parts.length !== 3) return null;
+  try {
+    const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+    const pad = padded.length % 4 === 0 ? '' : '='.repeat(4 - (padded.length % 4));
+    const json = Buffer.from(padded + pad, 'base64').toString('utf8');
+    return JSON.parse(json);
+  } catch (_) {
+    return null;
+  }
+}
+
+function fmtTs(s) {
+  if (!s) return '';
+  if (typeof s === 'number') return new Date(s * 1000).toISOString();
+  return String(s);
+}
+
+async function run({ apiKey, flags }) {
+  const masked = apiKey.slice(0, 6) + '…' + apiKey.slice(-4);
+  const decoded = decodeJwt(apiKey);
+  const res = await api.request('GET', '/hl/v1/balance', { apiKey });
+  const valid = res.status >= 200 && res.status < 300;
+
+  if (flags.json) {
+    ui.jsonOut({
+      apiKey: masked,
+      valid,
+      status: res.status,
+      decoded,
+      balance: valid ? (res.body && res.body.data) : null,
+      error: valid ? null : (res.body && (res.body.messages || res.body.message)) || null,
+    });
+    return;
+  }
+
+  process.stdout.write(`${ui.bold('API key:')}    ${masked}\n`);
+  process.stdout.write(`${ui.bold('Endpoint:')}   ${api.BASE_URL}\n`);
+  if (decoded) {
+    const name = decoded.name || decoded.merchantName || decoded.fullName;
+    const id = decoded.accountId || decoded.userId || decoded.sub || decoded.id;
+    const email = decoded.email || decoded.merchantEmail;
+    if (name)  process.stdout.write(`${ui.bold('Name:')}       ${name}\n`);
+    if (email) process.stdout.write(`${ui.bold('Email:')}      ${email}\n`);
+    if (id)    process.stdout.write(`${ui.bold('Account ID:')} ${id}\n`);
+    if (decoded.exp) process.stdout.write(`${ui.bold('Expires:')}    ${fmtTs(decoded.exp)}\n`);
+  } else {
+    process.stdout.write(ui.dim('(API key is not a decodable JWT — skipping local profile)') + '\n');
+  }
+
+  if (valid) {
+    process.stdout.write(ui.green('✓ Key is valid (verified via /hl/v1/balance)') + '\n');
+  } else {
+    const msg = (res.body && (res.body.messages || res.body.message)) || res.raw || '';
+    process.stdout.write(ui.red(`✗ Key rejected (HTTP ${res.status}) — ${msg}`) + '\n');
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { run };

package/src/config.js

@@ -2,10 +2,27 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 
-const dir = path.join(os.homedir(), '.mayar');
+const xdgConfigHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+const dir = path.join(xdgConfigHome, 'mayar');
 const file = path.join(dir, 'config.json');
 
+const legacyDir = path.join(os.homedir(), '.mayar');
+const legacyFile = path.join(legacyDir, 'config.json');
+
+function migrateLegacy() {
+  if (fs.existsSync(file)) return;
+  if (!fs.existsSync(legacyFile)) return;
+  try {
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    fs.copyFileSync(legacyFile, file);
+    try { fs.chmodSync(file, 0o600); } catch (_) {}
+    fs.unlinkSync(legacyFile);
+    try { fs.rmdirSync(legacyDir); } catch (_) {}
+  } catch (_) {}
+}
+
 function load() {
+  migrateLegacy();
   try {
     return JSON.parse(fs.readFileSync(file, 'utf8'));
   } catch (_) {