primitive-admin 1.1.0-alpha.9 → 1.1.0

package/dist/src/commands/webhooks.js

@@ -0,0 +1,633 @@
+import { readFileSync, statSync } from "fs";
+import { ApiClient } from "../lib/api-client.js";
+import { resolveAppId, getServerUrl } from "../lib/config.js";
+import { deliverWebhookTest, } from "../lib/webhook-deliver.js";
+import { success, error, info, keyValue, result as printResult, formatTable, formatId, formatDate, formatStatus, json, divider, dim, warn, } from "../lib/output.js";
+import { assertSupportedFlags, buildWebhookEnvelope, } from "../lib/log-inspection.js";
+import { confirmPrompt } from "../lib/confirm-prompt.js";
+import { parseStatusFilter } from "../lib/object-status-filter.js";
+import { signingSecretStatusWarning, signingSecretHealthWarning, previousSigningSecretWarning, formatGracePeriodMs, } from "../lib/signing-secret-status.js";
+import { normalizeCliListEnvelope } from "../lib/paginate.js";
+import { pageCursorOption, pageLimitOption, parsePageLimit, printEmptyPage, printPageHint, } from "../lib/list-options.js";
+/**
+ * Platform ceiling on a webhook body (`MAX_WEBHOOK_BODY_BYTES_LIMIT`, 25 MiB).
+ * A per-webhook cap can be lower — that one is the server's call and comes back
+ * as a `body_too_large` verdict. This bound only stops the CLI from reading and
+ * encoding a file no webhook could ever accept.
+ */
+const MAX_VERIFY_BODY_BYTES = 25 * 1024 * 1024;
+export function registerWebhooksCommands(program) {
+    const webhooks = program
+        .command("webhooks")
+        .description("Manage inbound webhooks that trigger workflows")
+        .addHelpText("after", `
+Examples:
+  $ primitive webhooks list
+  $ primitive secrets set STRIPE_WEBHOOK_SECRET --value whsec_...
+  $ primitive config create webhook stripe-events   # then edit webhooks/stripe-events.toml and: primitive config push
+  $ primitive webhooks get 01HXY...
+  $ primitive webhooks rotate-secret 01HXY... --secret "{{secrets.STRIPE_WEBHOOK_SECRET_NEXT}}"
+  $ primitive webhooks events 01HXY...
+  $ primitive webhooks archive 01HXY...   # retire it (soft delete)
+  $ primitive webhooks test 01HXY... --payload '{"event":"test"}'
+  $ primitive webhooks verify 01HXY... --header 'Stripe-Signature: t=...,v1=...' --body-file captured.json
+`);
+    // Server-side configuration is authored in TOML and applied with `config push`
+    // (issue #2645) — this group no longer carries config-setting flags.
+    webhooks.addHelpText("after", `
+Configuration lives in webhooks/<key>.toml:
+  $ primitive config fields webhook        # the file's keys, types and defaults
+  $ primitive config create webhook <key>  # scaffold one locally
+  $ primitive config set webhook/<key> <path>=<value>
+  $ primitive config push --only webhook/<key>
+`);
+    // List webhooks
+    webhooks
+        .command("list")
+        .description("List webhooks")
+        .argument("[app-id]", "App ID (uses current app if not specified)")
+        .option("--app <app-id>", "App ID")
+        .option("--status <status>", "Filter by status: active, inactive, archived")
+        .addOption(pageLimitOption())
+        .addOption(pageCursorOption())
+        .option("--json", "Output as JSON")
+        .action(async (appId, options) => {
+        const limit = parsePageLimit(options.limit);
+        const resolvedAppId = resolveAppId(appId, options);
+        const client = new ApiClient();
+        try {
+            // #2803 — `paused` is gone; refuse it by name rather than returning the
+            // empty list a canonical filter would produce.
+            const status = parseStatusFilter("webhooks", options.status, [
+                "active",
+                "inactive",
+                "archived",
+            ]);
+            // One page (#3646). This used to drain every page so an app near the
+            // per-app cap of 50 was not silently truncated at the route's default
+            // of 25 (#2232); `--limit`/`--cursor` are how a caller asks for the
+            // rest now, and the envelope says whether there is any.
+            const page = normalizeCliListEnvelope(await client.listWebhooks(resolvedAppId, {
+                status,
+                limit,
+                cursor: options.cursor,
+            }));
+            const items = page.items;
+            if (options.json) {
+                json(page);
+                return;
+            }
+            if (items.length === 0) {
+                printEmptyPage(page, "webhooks");
+                return;
+            }
+            console.log(formatTable(items, [
+                { header: "KEY", key: "webhookKey" },
+                { header: "NAME", key: "displayName" },
+                { header: "SCHEME", key: "verificationScheme" },
+                { header: "WORKFLOW", key: "workflowKey" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "LAST TRIGGERED", key: "lastTriggeredAt", format: formatDate },
+            ]));
+            printPageHint(page);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("get")
+        .description("Get webhook details")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.getWebhook(resolvedAppId, webhookId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            printResult("Webhook ID", result.webhookId);
+            printResult("Key", result.webhookKey);
+            printResult("Name", result.displayName);
+            printResult("Description", result.description || "-");
+            printResult("Status", formatStatus(result.status));
+            printResult("Workflow Key", result.workflowKey);
+            printResult("Verification Scheme", result.verificationScheme);
+            printResult("Signing Secret", result.signingSecret || "-");
+            printResult("Previous Signing Secret", result.previousSigningSecret || "-");
+            // The grace slot's own status, so an operator can tell "no previous
+            // key" from "a raw value is still live there" — both print the previous
+            // secret as `-`, because a withheld value is never echoed (#2383).
+            printResult("Previous Signing Secret Status", result.previousSigningSecretStatus || "-");
+            // A stored value that is not a reference is never echoed, so say what
+            // it is here rather than showing an empty field: a legacy literal from
+            // before reference-only still verifies deliveries, a malformed
+            // reference does not (#2332). Same wording as `config pull`.
+            const signingSecretWarning = signingSecretStatusWarning(result.signingSecretStatus, {
+                subject: "Signing secret",
+                blocks: "this webhook cannot be updated or rotated",
+            });
+            if (signingSecretWarning)
+                warn(signingSecretWarning);
+            // The grace slot gets its own line: a raw value there keeps verifying
+            // deliveries even though the row's current slot reads as migrated
+            // (#2383). The lever is the grace period, not a migration.
+            const previousWarning = previousSigningSecretWarning(result.previousSigningSecretStatus, { subject: "Previous signing secret" });
+            if (previousWarning)
+                warn(previousWarning);
+            // The health axis, per slot — anything that is not `ok`.
+            const healthWarning = signingSecretHealthWarning(result.signingSecretHealth, { subject: "Signing secret" });
+            if (healthWarning)
+                warn(healthWarning);
+            const previousHealthWarning = signingSecretHealthWarning(result.previousSigningSecretHealth, { subject: "Previous signing secret" });
+            if (previousHealthWarning)
+                warn(previousHealthWarning);
+            divider();
+            info("Configuration:");
+            printResult("  Tolerance Seconds", String(result.toleranceSeconds ?? "-"));
+            printResult("  Deduplication", result.deduplicationEnabled ? "enabled" : "disabled");
+            printResult("  Dedup Window", result.deduplicationWindowMs ? `${result.deduplicationWindowMs}ms` : "-");
+            printResult("  Max Body Bytes", result.maxBodyBytes ? `${result.maxBodyBytes}` : "default (5 MiB)");
+            // Not a truthiness test: a stored `0` means immediate cutover, which is
+            // the opposite of the unset case's 24 h default (#2383).
+            printResult("  Grace Period", formatGracePeriodMs(result.secretGracePeriodMs));
+            printResult("  Allowed IPs", result.allowedIpCidrs || "-");
+            printResult("  Input Mapping", result.inputMapping || "-");
+            divider();
+            printResult("Last Triggered", result.lastTriggeredAt ? formatDate(result.lastTriggeredAt) : "never");
+            printResult("Created", formatDate(result.createdAt));
+            printResult("Modified", formatDate(result.modifiedAt));
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // #2645 criterion 9 / #2803 — the operational verbs. They are the only
+    // writers of `status`, which is server-owned and no longer a `[webhook]`
+    // TOML key: `config push` can neither set nor clear it, so pushing a file
+    // pulled before a pause no longer puts the endpoint back in service.
+    webhooks
+        .command("disable")
+        .description("Take a webhook out of service now. Inbound deliveries are refused with a 410; the committed configuration is unchanged.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.setWebhookAvailability(resolvedAppId, webhookId, "disable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook disabled: ${result.webhookKey || webhookId}`);
+            info("Deliveries are refused with a 410 — `primitive webhooks enable` puts it back.");
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("enable")
+        .description("Put a webhook back in service.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.setWebhookAvailability(resolvedAppId, webhookId, "enable");
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook enabled: ${result.webhookKey || webhookId}`);
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // #2907 — the delete flow's CLI spelling. Not a second writer of `status`:
+    // this is the plain `DELETE` the server has always answered by writing the
+    // tombstone, which until now only the admin API and the console could reach.
+    // Named `archive`, not `delete`, because a configuration noun gets no
+    // `delete` verb (docs/cli-design.md) and prune-by-push stays the only CLI
+    // hard-delete path.
+    webhooks
+        .command("archive")
+        .description("Retire a webhook (soft delete). Delete-lifecycle, not `disable`: the row is kept, keeps its key and its capped slot, and there is no un-archive.")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("-y, --yes", "Skip confirmation prompt")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+What archiving a webhook costs:
+  Inbound deliveries are refused, as they are for a disabled webhook.
+  The archived row still holds its webhookKey AND its slot under the per-app
+  webhook cap (50) — archiving frees neither, which is why an archived row a
+  delivery still reaches is not free.
+  \`primitive webhooks enable\` refuses an archived webhook; there is no
+  un-archive.
+
+Reclaiming the key and the slot means hard-deleting the row:
+  $ rm webhooks/<key>.toml
+  $ primitive config push --prune     # confirmed; hard-deletes the row
+  # or hard-delete it in the console, then re-add the file and push.
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (!options.yes) {
+            let confirmed;
+            try {
+                confirmed = await confirmPrompt(`Archive webhook ${webhookId}? Deliveries stop, the row keeps its key ` +
+                    `and its capped slot, and there is no un-archive.`);
+            }
+            catch (err) {
+                error(err.message);
+                process.exit(1);
+            }
+            if (!confirmed) {
+                info("Cancelled.");
+                return;
+            }
+        }
+        const client = new ApiClient();
+        try {
+            // The soft delete: no `hard`, so the server writes the tombstone. The
+            // `--hard` path stays out of the CLI surface — prune-by-push owns it.
+            const result = await client.deleteWebhook(resolvedAppId, webhookId);
+            if (options.json) {
+                json(result);
+                return;
+            }
+            success(`Webhook archived: ${webhookId}`);
+            info("Deliveries are refused. The row still holds its key and its capped slot — reclaim both by removing its file and running a confirmed `primitive config push --prune`.");
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    webhooks
+        .command("rotate-secret")
+        .description("Rotate the signing secret for a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .requiredOption("--secret <ref>", "New signing secret, as a {{secrets.KEY}} reference to an app secret")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            const result = await client.rotateWebhookSecret(resolvedAppId, webhookId, {
+                signingSecret: options.secret,
+            });
+            if (options.json) {
+                json(result);
+                return;
+            }
+            // Rotation now returns the serialized webhook on both surfaces, and
+            // both references are plain text (the secret values live only in the
+            // secret store), so print them rather than a masked value.
+            success("Signing secret rotated.");
+            if (result.signingSecret) {
+                keyValue("Signing Secret", result.signingSecret);
+            }
+            if (result.previousSigningSecret) {
+                keyValue("Previous Signing Secret", result.previousSigningSecret);
+            }
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // List webhook events
+    webhooks
+        .command("events")
+        .description("View webhook event history")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--limit <n>", "Number of events to show", "20")
+        .option("--cursor <cursor>", "Pagination cursor from a previous page")
+        // Declared so they can be rejected with a clear message instead of being
+        // silently ignored — status/time filtering on webhook events is deferred to
+        // Phase B (issue #1967). See assertSupportedFlags below.
+        .option("--status <status>", "(not supported yet — deferred to Phase B)")
+        .option("--from <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--to <iso>", "(not supported yet — deferred to Phase B)")
+        .option("--json", "Output as JSON")
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        const client = new ApiClient();
+        try {
+            // The webhook-events route serves limit + cursor only; reject the
+            // Phase B filters cleanly rather than dropping them silently.
+            assertSupportedFlags("webhook events", { status: options.status, from: options.from, to: options.to }, ["limit", "cursor"]);
+            const page = await client.listWebhookEvents(resolvedAppId, webhookId, {
+                limit: parseInt(options.limit),
+                ...(options.cursor && { cursor: options.cursor }),
+            });
+            if (options.json) {
+                json(buildWebhookEnvelope(page.items, page));
+                return;
+            }
+            const printCursorHint = () => {
+                if (!page.nextCursor)
+                    return;
+                console.log();
+                dim(`More events. Use --cursor ${page.nextCursor} for the next page.`);
+            };
+            if (!page.items || page.items.length === 0) {
+                info("No events found.");
+                printCursorHint();
+                return;
+            }
+            console.log(formatTable(page.items, [
+                { header: "EVENT ID", key: "eventId", format: formatId },
+                { header: "EXTERNAL ID", key: "externalEventId" },
+                { header: "STATUS", key: "status", format: formatStatus },
+                { header: "HTTP", key: "httpStatus" },
+                { header: "REASON", key: "rejectionReason" },
+                { header: "CREATED", key: "createdAt", format: formatDate },
+            ]));
+            printCursorHint();
+        }
+        catch (err) {
+            error(err.message);
+            process.exit(1);
+        }
+    });
+    // Test webhook
+    webhooks
+        .command("test")
+        .description("Sign a test payload for a webhook (returns body + headers)")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--payload <json>", "Test payload as JSON, signed verbatim. Pass the event " +
+        "object directly (e.g. '{\"type\":\"event\",\"data\":{…}}'); it is used " +
+        "as-is. Omit it to sign a canned webhook.test ping.")
+        .option("--deliver", "Post the signed payload to the webhook's real receive endpoint, " +
+        "firing the function (or workflow) for real and reporting the run")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+By default this command only SIGNS: it prints the signature headers and the
+signed body, posts nothing, and so starts no run and records no delivery.
+
+--deliver posts that signed body to the webhook's receive endpoint,
+POST /app/{appId}/webhook/{webhookKey} — the same unauthenticated path a
+provider uses, so signature verification, handshake rules, deduplication and
+dispatch all run for real. That is a real delivery: a real event row is written
+and the signed body's dedup key is spent (permanently on the 'github' scheme).
+It reports the delivery's event id and the run id, and exits non-zero unless a
+dispatch was positively confirmed; --json carries an outcome of
+"dispatched" | "refused" | "unconfirmed".
+
+The value of --payload is signed exactly as given (WYSIWYG). A JSON object is
+used as the test body verbatim, so a wrapped payload such as '{"payload":{…}}'
+signs the literal wrapper — do not wrap the event. Omitting --payload (or
+passing a non-object such as an array) signs the canned
+{"type":"webhook.test", …} ping.
+`)
+        .action(async (webhookId, options) => {
+        const code = await runWebhooksTest(webhookId, options);
+        if (code !== 0)
+            process.exit(code);
+    });
+    // Verify a captured delivery's signature
+    webhooks
+        .command("verify")
+        .description("Check whether signature headers you captured verify against a webhook")
+        .argument("<webhook-id>", "Webhook ID")
+        .option("--app <app-id>", "App ID (uses current app if not specified)")
+        .option("--header <name: value>", "A header from the captured delivery. Repeatable.", (value, previous) => [...(previous || []), value], [])
+        .option("--body <text>", "The captured delivery body, as text")
+        .option("--body-file <path>", "Read the captured delivery body from a file")
+        .option("--json", "Output as JSON")
+        .addHelpText("after", `
+Runs the webhook's configured verifier over the body and headers you supply and
+reports whether that signature checks out — the useful question when a real
+delivery was rejected 401, and the only way to check a scheme the platform holds
+only public key material for (discord, jwt, plaid), which \`webhooks test\`
+cannot preview.
+
+Nothing is delivered: no workflow runs, and no delivery is recorded (this check
+never appears in \`primitive webhooks events\`).
+
+It answers SIGNATURE verification only. A real delivery is also subject to the
+webhook's status and IP allowlist before verification, and to handshake rules
+and deduplication after it.
+
+Exits 0 when the signature verifies and non-zero otherwise, so it composes in a
+script.
+
+  $ primitive webhooks verify 01HXY... \\
+      --header 'Stripe-Signature: t=1754...,v1=abc...' \\
+      --body-file captured-delivery.json
+`)
+        .action(async (webhookId, options) => {
+        const resolvedAppId = resolveAppId(undefined, options);
+        if (options.body !== undefined && options.bodyFile !== undefined) {
+            error("Pass --body or --body-file, not both.");
+            process.exit(1);
+        }
+        let rawBody;
+        let bodyBase64;
+        if (options.bodyFile !== undefined) {
+            let bytes;
+            try {
+                // Size first: a mistakenly-passed large file should be a clear CLI
+                // error rather than a buffer the command tries to base64 and ship.
+                const { size } = statSync(options.bodyFile);
+                if (size > MAX_VERIFY_BODY_BYTES) {
+                    error(`--body-file is ${size} bytes, over the ${MAX_VERIFY_BODY_BYTES}-byte platform maximum for a webhook body. A delivery that large is refused before its signature is checked.`);
+                    process.exit(1);
+                    return;
+                }
+                bytes = readFileSync(options.bodyFile);
+            }
+            catch (err) {
+                error(`Could not read --body-file: ${err.message}`);
+                process.exit(1);
+                return;
+            }
+            // A signature is over BYTES. Decoding a capture that is not valid
+            // UTF-8 replaces each bad byte with U+FFFD, so sending it as `rawBody`
+            // would check the signature against bytes the provider never sent and
+            // report a confident `sig_invalid` — the wrong answer in exactly the
+            // case this command exists for. `bodyBase64` carries those bytes
+            // intact, so only a body that round-trips losslessly goes as text.
+            const asText = bytes.toString("utf-8");
+            if (Buffer.from(asText, "utf-8").equals(bytes)) {
+                rawBody = asText;
+            }
+            else {
+                bodyBase64 = bytes.toString("base64");
+            }
+        }
+        else {
+            // An empty body is a legitimate delivery, so an omitted --body means
+            // "the delivery carried no body" rather than "no body was supplied".
+            rawBody = options.body ?? "";
+        }
+        // Ordered pairs, not an object: a real capture can carry the same field
+        // name on more than one line, which an object cannot represent.
+        const headers = [];
+        for (const entry of (options.header || [])) {
+            const separator = entry.indexOf(":");
+            if (separator <= 0) {
+                error(`Invalid --header '${entry}'. Use 'Name: value'.`);
+                process.exit(1);
+            }
+            headers.push([
+                entry.slice(0, separator).trim(),
+                entry.slice(separator + 1).trim(),
+            ]);
+        }
+        const client = new ApiClient();
+        try {
+            const result = await client.verifyWebhook(resolvedAppId, webhookId, {
+                headers,
+                // Exactly one body form — the server refuses a request naming both.
+                ...(bodyBase64 !== undefined ? { bodyBase64 } : { rawBody }),
+            });
+            if (options.json) {
+                json(result);
+            }
+            else if (result.verified) {
+                success("Signature verified.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                if (result.dedupKey)
+                    keyValue("  Dedup key", String(result.dedupKey));
+                if (result.externalEventId) {
+                    keyValue("  Event ID", String(result.externalEventId));
+                }
+            }
+            else {
+                error("Signature did NOT verify.");
+                keyValue("  Scheme", String(result.verificationScheme));
+                keyValue("  Reason", String(result.rejectionReason || "unknown"));
+            }
+            if (result.webhookStatus && result.webhookStatus !== "active") {
+                warn(`This webhook is ${result.webhookStatus} — a live delivery would be refused before its signature was checked.`);
+            }
+            if (!result.verified)
+                process.exit(1);
+        }
+        catch (err) {
+            error(err?.code ? `${err.message} (${err.code})` : err.message);
+            process.exit(1);
+        }
+    });
+}
+/**
+ * `primitive webhooks test [--deliver]` — the command body, exported so its
+ * wiring and its outcome mapping are testable without a network (#3321).
+ *
+ * Returns the process exit code rather than calling `process.exit` itself:
+ * `0` for a signed preview, and in delivered mode `0` only when a dispatch was
+ * positively confirmed.
+ */
+export async function runWebhooksTest(webhookId, options, deps = {}) {
+    const resolvedAppId = resolveAppId(undefined, options);
+    let payload = {};
+    if (options.payload) {
+        try {
+            payload = JSON.parse(options.payload);
+        }
+        catch {
+            error("Invalid JSON in --payload");
+            return 1;
+        }
+    }
+    const client = (deps.client ?? new ApiClient());
+    if (options.deliver) {
+        const result = await deliverWebhookTest({
+            appId: resolvedAppId,
+            webhookId,
+            payload,
+            serverUrl: (deps.serverUrl ?? getServerUrl)(),
+        }, {
+            client,
+            ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+            ...(deps.sleep ? { sleep: deps.sleep } : {}),
+            // Said before anything is delivered, and in the terminal rather than
+            // only in the guide: a diagnostic that mutates the app has to announce
+            // it where the user is looking (#3321 criterion 4). It goes to stderr,
+            // so `--json` keeps one clean object on stdout.
+            onBeforeDeliver: (notice) => notice.forEach((line) => warn(line)),
+        });
+        if (options.json) {
+            json(result);
+        }
+        else if (result.outcome === "dispatched") {
+            success(result.headline);
+            result.details.forEach((line) => info(line));
+        }
+        else {
+            // A refusal the server explained keeps the established convention: the
+            // prose explains, the code is what an operator searches for (#2445).
+            if (result.refusal) {
+                error(result.refusal.code
+                    ? `${result.refusal.message} (${result.refusal.code})`
+                    : result.refusal.message);
+                if (result.delivery === null)
+                    info("Nothing was delivered.");
+            }
+            else {
+                error(result.headline);
+            }
+            result.details.forEach((line) => info(line));
+        }
+        return result.outcome === "dispatched" ? 0 : 1;
+    }
+    try {
+        const result = await client.testWebhook(resolvedAppId, webhookId, payload);
+        if (options.json) {
+            json(result);
+            return 0;
+        }
+        if (result.success) {
+            success("Test payload signed. Nothing was delivered — re-run with --deliver " +
+                "to post it to the receive endpoint for real, or post the signed " +
+                "body (--json shows the exact rawBody) with these headers yourself.");
+            if (result.signatureHeaders) {
+                divider();
+                info("Generated Signature Headers:");
+                for (const [header, value] of Object.entries(result.signatureHeaders)) {
+                    keyValue(`  ${header}`, String(value));
+                }
+            }
+            if (result.payload) {
+                divider();
+                info("Test Payload:");
+                console.log(JSON.stringify(result.payload, null, 2));
+            }
+        }
+        else {
+            error(`Test failed: ${result.message || result.errorCode || "unknown error"}`);
+        }
+        return 0;
+    }
+    catch (err) {
+        // The server refuses a preview it cannot sign with a coded 400 — the
+        // scheme holds only public key material, the row still stores a raw
+        // secret, the signing secret is unset or unresolvable (#2445). Print
+        // the machine-readable code alongside the message, the established
+        // convention here: the prose explains, the code is what an operator
+        // searches for or reports.
+        error(err?.code ? `${err.message} (${err.code})` : err.message);
+        return 1;
+    }
+}
+//# sourceMappingURL=webhooks.js.map