paymongo-cli 1.4.4 → 1.4.6

package/.github/copilot-instructions.md

@@ -1,95 +1,95 @@
-# PayMongo CLI - AI Agent Instructions
-
-## Project Overview
-PayMongo CLI is a TypeScript-based developer tool for PayMongo payment integration with local webhook forwarding via ngrok tunneling. It uses **ESM modules** (`"type": "module"`) with Commander.js for CLI commands.
-
-## Architecture
-
-### Code Structure
-```
-src/
-├── commands/      # CLI commands (commander.js) - one file per top-level command
-├── services/      # Core business logic
-│   ├── api/       # ApiClient - PayMongo V1 API wrapper with retries & caching
-│   ├── config/    # ConfigManager - .paymongo file handling via cosmiconfig
-│   └── web/       # Express + Socket.io for GUI dashboard
-├── types/         # TypeScript definitions + Zod schemas
-└── utils/         # Shared utilities (errors, logging, cache, validation)
-```
-
-### Key Patterns
-
-**Error Handling** - Always use custom error classes from `src/utils/errors.ts`:
-```typescript
-import { PayMongoError, NetworkError, ConfigError, ApiKeyError } from '../utils/errors.js';
-throw new PayMongoError('User-friendly message', 'ERROR_CODE', 400);
-```
-
-**Retry Logic** - Use `withRetry()` for network operations:
-```typescript
-import { withRetry } from '../utils/errors.js';
-const result = await withRetry(() => apiCall(), { maxRetries: 3, silent: true });
-```
-
-**Lazy Loading** - Import heavy dependencies inside functions to keep CLI startup fast (<100ms):
-```typescript
-// ✓ Correct - lazy load inside action
-.action(async () => {
-  const { confirm } = await import('@inquirer/prompts');
-});
-// ✗ Wrong - top-level import slows startup
-import { confirm } from '@inquirer/prompts';
-```
-
-**ESM Imports** - Always use `.js` extension for local imports:
-```typescript
-import ConfigManager from '../services/config/manager.js';
-```
-
-## Configuration
-- Project config: `.paymongo` (JSON, managed via `ConfigManager`)
-- Global credentials: `~/.paymongo/credentials.enc` (AES-256-CBC encrypted)
-- Validation: Zod schemas in `src/types/schemas.ts`
-
-## Development Workflow
-
-### Commands
-```bash
-npm run build          # Compile TypeScript
-npm run dev            # Watch mode compilation
-npm link               # Test CLI globally as 'paymongo'
-npm test               # Jest with ESM (--experimental-vm-modules)
-npm run lint:fix       # ESLint auto-fix
-```
-
-### Testing Strategy
-- **Mocking ESM**: Use `jest.unstable_mockModule()` before dynamic imports
-- Structure: `tests/unit/`, `tests/integration/`
-- Mock external services (axios, ngrok, filesystem)
-
-Example test pattern:
-```typescript
-jest.unstable_mockModule('axios', () => ({ default: mockAxios }));
-const { ApiClient } = await import('../../src/services/api/client.js');
-```
-
-## Code Conventions
-
-### TypeScript
-- Strict mode enabled with `noImplicitAny`, `noUncheckedIndexedAccess`
-- Avoid `any` - use proper types from `src/types/paymongo.ts`
-- Config validation via Zod: `validateConfig()` from `src/types/schemas.ts`
-
-### Commit Messages
-Follow conventional commits: `feat:`, `fix:`, `docs:`, `test:`, `refactor:`
-
-### Security
-- Never log API keys or sensitive data
-- Use `ConfigManager` for credential access
-- Keep `.paymongo` and `.env` in `.gitignore`
-
-## Key Files Reference
-- [src/services/api/client.ts](src/services/api/client.ts) - API wrapper with interceptors
-- [src/utils/errors.ts](src/utils/errors.ts) - Error classes + `withRetry()`
-- [src/types/schemas.ts](src/types/schemas.ts) - Zod validation schemas
-- [src/services/config/manager.ts](src/services/config/manager.ts) - Config file handling
+# PayMongo CLI - AI Agent Instructions
+
+## Project Overview
+PayMongo CLI is a TypeScript-based developer tool for PayMongo payment integration with local webhook forwarding via ngrok tunneling. It uses **ESM modules** (`"type": "module"`) with Commander.js for CLI commands.
+
+## Architecture
+
+### Code Structure
+```
+src/
+├── commands/      # CLI commands (commander.js) - one file per top-level command
+├── services/      # Core business logic
+│   ├── api/       # ApiClient - PayMongo V1 API wrapper with retries & caching
+│   ├── config/    # ConfigManager - .paymongo file handling via cosmiconfig
+│   └── web/       # Express + Socket.io for GUI dashboard
+├── types/         # TypeScript definitions + Zod schemas
+└── utils/         # Shared utilities (errors, logging, cache, validation)
+```
+
+### Key Patterns
+
+**Error Handling** - Always use custom error classes from `src/utils/errors.ts`:
+```typescript
+import { PayMongoError, NetworkError, ConfigError, ApiKeyError } from '../utils/errors.js';
+throw new PayMongoError('User-friendly message', 'ERROR_CODE', 400);
+```
+
+**Retry Logic** - Use `withRetry()` for network operations:
+```typescript
+import { withRetry } from '../utils/errors.js';
+const result = await withRetry(() => apiCall(), { maxRetries: 3, silent: true });
+```
+
+**Lazy Loading** - Import heavy dependencies inside functions to keep CLI startup fast (<100ms):
+```typescript
+// ✓ Correct - lazy load inside action
+.action(async () => {
+  const { confirm } = await import('@inquirer/prompts');
+});
+// ✗ Wrong - top-level import slows startup
+import { confirm } from '@inquirer/prompts';
+```
+
+**ESM Imports** - Always use `.js` extension for local imports:
+```typescript
+import ConfigManager from '../services/config/manager.js';
+```
+
+## Configuration
+- Project config: `.paymongo` (JSON, managed via `ConfigManager`)
+- Global credentials: `~/.paymongo/credentials.enc` (AES-256-CBC encrypted)
+- Validation: Zod schemas in `src/types/schemas.ts`
+
+## Development Workflow
+
+### Commands
+```bash
+npm run build          # Compile TypeScript
+npm run dev            # Watch mode compilation
+npm link               # Test CLI globally as 'paymongo'
+npm test               # Jest with ESM (--experimental-vm-modules)
+npm run lint:fix       # ESLint auto-fix
+```
+
+### Testing Strategy
+- **Mocking ESM**: Use `jest.unstable_mockModule()` before dynamic imports
+- Structure: `tests/unit/`, `tests/integration/`
+- Mock external services (axios, ngrok, filesystem)
+
+Example test pattern:
+```typescript
+jest.unstable_mockModule('axios', () => ({ default: mockAxios }));
+const { ApiClient } = await import('../../src/services/api/client.js');
+```
+
+## Code Conventions
+
+### TypeScript
+- Strict mode enabled with `noImplicitAny`, `noUncheckedIndexedAccess`
+- Avoid `any` - use proper types from `src/types/paymongo.ts`
+- Config validation via Zod: `validateConfig()` from `src/types/schemas.ts`
+
+### Commit Messages
+Follow conventional commits: `feat:`, `fix:`, `docs:`, `test:`, `refactor:`
+
+### Security
+- Never log API keys or sensitive data
+- Use `ConfigManager` for credential access
+- Keep `.paymongo` and `.env` in `.gitignore`
+
+## Key Files Reference
+- [src/services/api/client.ts](src/services/api/client.ts) - API wrapper with interceptors
+- [src/utils/errors.ts](src/utils/errors.ts) - Error classes + `withRetry()`
+- [src/types/schemas.ts](src/types/schemas.ts) - Zod validation schemas
+- [src/services/config/manager.ts](src/services/config/manager.ts) - Config file handling

package/CHANGELOG.md

@@ -7,6 +7,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.6] - 2026-02-03
+
+### Changed
+
+- **Config Validation** - Allowed loading configs without API keys and normalized optional fields to avoid setup lockouts.
+- **Webhook Signatures** - Standardized signature verification format across dev server, trigger, and generated templates.
+- **CLI Startup** - Lazy-loaded prompt dependencies in several commands for faster startup.
+
+### Fixed
+
+- **Analytics Persistence** - Stored analytics in a safe user directory with test override support.
+- **Dev Auto-Register** - Respected `dev.autoRegisterWebhook` in the dev command.
+- **Team Import** - Enabled `--force` to overwrite existing keys during team import.
+- **Config Import** - Validated imports with schema and normalized missing optional fields.
+
+## [1.4.5] - 2026-02-01
+
+### Changed
+
+- **Credential Encryption** - Migrated stored credentials to AES-256-GCM with scrypt-derived keys and per-machine salt, with automatic legacy AES-256-CBC migration on load.
+- **Init .gitignore Handling** - Made `.env` and `.paymongo` ignore entries idempotent and appended with a consistent header when missing.
+
+### Fixed
+
+- **API Key Errors** - Standardized missing secret key handling to throw `ApiKeyError` in the API client.
+- **Test Reliability** - Updated login and template tests for new encryption payloads and added DevServer webhook signature verification coverage.
+
 ## [1.4.4] - 2026-01-27
 
 ### Changed

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 Leodyver Semilla
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+MIT License
+
+Copyright (c) 2026 Leodyver Semilla
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.