toolaby 1.0.0

package/README.md

@@ -0,0 +1,31 @@
+# toolaby
+
+The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
+
+```sh
+npx toolaby login                    # once: a code to approve in your browser
+npx toolaby wire wow--screenzard     # in your extension's folder
+```
+
+## What it does
+
+**`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there, and the command is signed in as you from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on your own tools.
+
+**`toolaby wire <tool-id>`**, run in your extension's folder, wires that extension to your tool:
+
+- it adds the Wall's files — a small client library, a config with your tool's id and public key, and the Wall's popup, which stands in front of yours;
+- it adds three lines to your `manifest.json` (a permission and your Wall address) and creates a background file if you have none;
+- your own code does not change. When your popup opens, the Wall's page checks what the Free plan holds and either sends the person straight to your popup or shows sign-in, the free-use meter or the plans.
+
+If the extension is built with WXT, CRXJS or Plasmo, the command puts the same files where that build expects them and prints the few lines to paste into the framework's config, because the framework generates the manifest itself. Nothing is installed from npm.
+
+**`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
+
+**`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
+
+## Where things live
+
+- Your session: `~/.config/toolaby/credentials.json`, readable by you alone (mode 600). `toolaby logout` deletes it after revoking it.
+- `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names another Wall (the default is `https://toolaby.app`).
+
+The files the command writes into your extension contain nothing secret: your tool's id, your Wall's address and the *public* key your extension verifies licences with — the same things every copy of your extension carries once it is published.

package/bin.mjs

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+// The Toolaby command line.
+//
+//   toolaby login                     sign in: a code to approve in the browser (Better Auth's device flow)
+//   toolaby wire <tool-id>            wire the extension in this folder to your tool — plain, WXT, CRXJS or Plasmo
+//   toolaby create <tool-id>          make a new, minimal extension for your tool in <tool-id>/
+//   toolaby tools                     your tools, with the ids the commands want
+//   toolaby whoami · logout · help
+//
+// Signed in, the command acts as you and only on your tools, as Clerk's and
+// Stripe's do: nothing is fetched for a tool your workspaces do not own. The
+// session lives in ~/.config/toolaby/credentials.json (mode 600), one per
+// Wall; `logout` revokes it on the server before forgetting it. TOOLABY_TOKEN
+// stands in for the file where there is no home (CI); TOOLABY_WALL for the
+// Wall's address (https://toolaby.app unless told).
+//
+// The wiring rules — what a folder is and what its manifest needs — are the
+// platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
+// so this and the dashboard's Wire button never disagree.
+import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSync, chmodSync, unlinkSync } from 'node:fs';
+import { join, resolve, dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { spawn } from 'node:child_process';
+import { wireManifest, WORKER_LINES } from './lib/manifest.js';
+import { detectProject, CODE_FILES, filesToWrite } from './lib/project.js';
+
+const VERSION = '1.0.0';
+const CLIENT_ID = 'toolaby-cli';
+const argv = process.argv.slice(2);
+const command = argv.find((a) => !a.startsWith('--')) ?? 'help';
+const rest = argv.filter((a) => a !== command);
+const positional = rest.filter((a) => !a.startsWith('--'));
+const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[i + 1] && !rest[i + 1].startsWith('--') ? rest[i + 1] : d; };
+const flag = (k) => rest.includes(k);
+const wall = (opt('--wall') ?? process.env.TOOLABY_WALL ?? 'https://toolaby.app').replace(/\/$/, '');
+const out = (s = '') => console.log(s);
+const fail = (s) => { console.error(`\n  ${s}\n`); process.exit(1); };
+
+// ── The session: one per Wall, in the user's config, readable by them alone ─────────────────────────────────────────
+const CONFIG_DIR = join(process.env.XDG_CONFIG_HOME || join(homedir(), '.config'), 'toolaby');
+const CREDENTIALS = join(CONFIG_DIR, 'credentials.json');
+const readCredentials = () => { try { return JSON.parse(readFileSync(CREDENTIALS, 'utf8')); } catch { return {}; } };
+function writeCredentials(all) {
+  mkdirSync(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  writeFileSync(CREDENTIALS, JSON.stringify(all, null, 2) + '\n', { mode: 0o600 });
+  try { chmodSync(CREDENTIALS, 0o600); } catch { /* not every filesystem has modes */ }
+}
+const storedToken = () => process.env.TOOLABY_TOKEN || readCredentials()[wall]?.token || null;
+
+async function api(path, { method = 'GET', body, token = storedToken(), raw = false } = {}) {
+  const res = await fetch(`${wall}${path}`, {
+    method,
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': `toolaby-cli/${VERSION}`, ...(token ? { Authorization: `Bearer ${token}` } : {}) },
+    body: body ? JSON.stringify(body) : undefined,
+  }).catch((e) => { throw new Error(`Could not reach ${wall}: ${e.message}`); });
+  if (raw) return res;
+  const json = await res.json().catch(() => ({}));
+  return { status: res.status, ok: res.ok, json };
+}
+
+// ── login: RFC 8628, the way GitHub's and Stripe's command lines sign in ─────────────────────────────────────────────
+function openBrowser(url) {
+  const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] : ['xdg-open', [url]];
+  try { spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => {}).unref(); } catch { /* the URL is printed anyway */ }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function login() {
+  const start = await api('/api/dev-auth/device/code', { method: 'POST', body: { client_id: CLIENT_ID }, token: null });
+  if (!start.ok || !start.json.device_code) fail(`The Wall at ${wall} did not start a sign-in (HTTP ${start.status}). Is the address right? --wall names another.`);
+  const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
+  const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
+  const page = link.startsWith('http') ? link : `${wall}${link}`;
+  out(`\n  Sign in to the Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  openBrowser(page);
+  let every = Math.max(1, Number(interval) || 5) * 1000;
+  const until = Date.now() + Number(expires_in) * 1000;
+  process.stdout.write('  Waiting for your approval');
+  while (Date.now() < until) {
+    await sleep(every);
+    process.stdout.write('.');
+    const poll = await api('/api/dev-auth/device/token', { method: 'POST', body: { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code, client_id: CLIENT_ID }, token: null });
+    if (poll.ok && poll.json.access_token) {
+      const token = poll.json.access_token;
+      const me = await api('/api/cli/me', { token });
+      const email = me.ok ? me.json.email : null;
+      const all = readCredentials();
+      all[wall] = { token, email, at: new Date().toISOString() };
+      writeCredentials(all);
+      out(`\n\n  Signed in${email ? ` as ${email}` : ''}. The session is in ${CREDENTIALS}; \`toolaby logout\` revokes it.\n`);
+      return token;
+    }
+    const why = poll.json.error;
+    if (why === 'slow_down') every += 5000;
+    else if (why === 'expired_token') fail('The code expired before it was approved. Run `toolaby login` again.');
+    else if (why === 'access_denied') fail('The sign-in was denied in the browser. Nothing was signed in.');
+    else if (why && why !== 'authorization_pending') fail(`The Wall answered "${why}"${poll.json.error_description ? `: ${poll.json.error_description}` : ''}.`);
+  }
+  fail('The code expired before it was approved. Run `toolaby login` again.');
+}
+
+/** A token to act with: the stored one, else a sign-in right here — `wire` in a fresh terminal is one command, not two. */
+async function tokenOrLogin() {
+  return storedToken() ?? (await login());
+}
+
+async function whoami() {
+  const token = storedToken();
+  if (!token) fail(`Not signed in to ${wall}. Run \`toolaby login\`.`);
+  const me = await api('/api/cli/me', { token });
+  if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
+  out(`\n  ${me.json.email}  ·  ${wall}\n`);
+  for (const w of me.json.workspaces) out(`    ${w.name}  (${w.slug}, ${w.role})  ${w.site}`);
+  out();
+}
+
+async function logout() {
+  const all = readCredentials();
+  const entry = all[wall];
+  if (!entry && !process.env.TOOLABY_TOKEN) { out(`\n  Not signed in to ${wall}.\n`); return; }
+  // Revoked on the server first; forgotten here whatever the server said — but the difference is reported.
+  const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? process.env.TOOLABY_TOKEN }).catch(() => ({ ok: false, status: 0 }));
+  delete all[wall];
+  writeCredentials(all);
+  out(res.ok ? `\n  Signed out of ${wall}: the session was revoked and forgotten.\n` : `\n  The session was forgotten here, but the Wall could not be reached to revoke it (HTTP ${res.status}); it expires on its own, or sign it out from the dashboard.\n`);
+  if (process.env.TOOLABY_TOKEN) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
+}
+
+async function tools() {
+  const token = await tokenOrLogin();
+  const res = await api('/api/cli/tools', { token });
+  if (res.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
+  if (!res.json.tools.length) { out('\n  No tools yet. Make one in the dashboard, then `toolaby wire <tool-id>` in your extension\'s folder.\n'); return; }
+  out();
+  for (const t of res.json.tools) out(`    ${t.slug.padEnd(40)} ${t.name}${t.bundle ? '  (bundle)' : ''}   ${t.site}`);
+  out();
+}
+
+// ── wire and create ─────────────────────────────────────────────────────────────────────────────────────────────────
+const SKIP = new Set(['node_modules', '.git', '.output', 'dist', 'build', '.wxt', '.plasmo', '.next']);
+function listTree(dir, depth, prefix = '', acc = new Set()) {
+  for (const name of readdirSync(dir)) {
+    const path = `${prefix}${name}`;
+    acc.add(path);
+    let isDir = false;
+    try { isDir = statSync(join(dir, name)).isDirectory(); } catch { /* gone */ }
+    if (isDir && depth > 0 && !SKIP.has(name)) listTree(join(dir, name), depth - 1, `${path}/`, acc);
+  }
+  return acc;
+}
+const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; } };
+const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
+
+/** The tool's files from the Wall, as the signed-in developer: a tool of theirs, or a clear no. */
+async function filesFor(slug, scaffold) {
+  const token = await tokenOrLogin();
+  const res = await api(`/api/cli/wiring/${slug}${scaffold ? '?scaffold=1' : ''}`, { token });
+  if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold); }
+  if (res.status === 404) fail(res.json.message ?? `No tool "${slug}" in your workspaces.`);
+  if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+  return res.json;
+}
+
+async function wire() {
+  const slug = positional[0];
+  if (!isId(slug)) fail('usage: toolaby wire <tool-id> [--into <folder>] [--force]   — `toolaby tools` lists your ids');
+  const dir = resolve(opt('--into') ?? '.');
+  if (!existsSync(dir)) fail(`${dir} does not exist`);
+  const tree = listTree(dir, 3);
+  const has = (p) => tree.has(p.replace(/\/$/, ''));
+  const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
+  if (has('manifest.json') && !manifest) fail('manifest.json could not be read as JSON.');
+  const plan = await filesFor(slug, false);
+  const site = plan.site;
+  const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site });
+  if (project.kind === 'unknown') fail(`${dir} has no manifest.json and is not a WXT, CRXJS or Plasmo project — run this inside your extension's folder, or point --into at it.`);
+
+  // The extension's own popup: the manifest's, or — wired before — the one the existing configuration remembers.
+  const configPath = join(dir, `${project.codeDir}toolaby.config.js`);
+  const remembered = existsSync(configPath) ? readFileSync(configPath, 'utf8').match(/appPopup:\s*'([^']*)'/)?.[1] || null : null;
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered }) : null;
+  const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
+  const targets = filesToWrite(project, appPopup);
+  const present = targets.filter((f) => existsSync(join(dir, f)));
+  if (present.length && !flag('--force')) fail(`${present.join(', ')} already in ${dir}; add --force to replace them.`);
+  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
+  for (const path of targets) write(path, plan.files[path.split('/').pop()].replaceAll('__APP_POPUP__', appPopup ?? ''));
+  const did = [];
+  let ownWorker = null;
+  if (wiring) {
+    if (wiring.writeWorker) write(wiring.writeWorker, WORKER_LINES);
+    if (wiring.did.length) write('manifest.json', JSON.stringify(wiring.manifest, null, 2) + '\n');
+    did.push(...wiring.did);
+    if (wiring.ownWorker) ownWorker = wiring.ownWorker;
+  } else if (project.createWorker) {
+    write(project.createWorker.file, project.createWorker.content);
+    did.push(`a background entry, ${project.createWorker.file} (it starts the platform)`);
+  } else if (project.worker) {
+    ownWorker = { file: project.worker, classic: false };
+  }
+
+  out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}\n`);
+  out(`  Written: ${targets.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
+  for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
+  if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
+  out(`  Next: ${project.kind === 'plain' ? '' : 'build or start the dev server, then '}chrome://extensions → reload it. The tool's Set up page says "checked in" the moment it starts.`);
+  if (project.note) out(`  ${project.note}\n`);
+  else if (appPopup) out(`  Your popup opens as before; what the Free plan holds (Pricing, in the dashboard) decides when the Wall's panel takes its place.\n`);
+  else out(`  No popup to stand in front of: count a use where your feature runs — the Set up page shows the line.\n`);
+}
+
+async function create() {
+  const slug = positional[0];
+  if (!isId(slug)) fail('usage: toolaby create <tool-id> [--dir <folder>]   — `toolaby tools` lists your ids');
+  const dir = resolve(opt('--dir') ?? slug);
+  if (existsSync(dir)) fail(`${dir} already exists`);
+  const plan = await filesFor(slug, true);
+  const write = (rel, content) => { mkdirSync(dirname(join(dir, rel)), { recursive: true }); writeFileSync(join(dir, rel), content); };
+  for (const f of ['manifest.json', ...CODE_FILES, 'background.js', 'popup.html', 'popup.css', 'popup.js', 'README.md']) write(f, plan.files[f].replaceAll('__APP_POPUP__', ''));
+  for (const s of [16, 48, 128]) {
+    const res = await fetch(`${wall}/boilerplate/icons/icon${s}.png`);
+    write(join('icons', `icon${s}.png`), Buffer.from(await res.arrayBuffer()));
+  }
+  out(`\n  ${plan.name} → ${dir}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. Click the icon: the popup shows what the Free plan holds; Buy opens ${plan.site}/tools/${slug}\n\n  Edit background.js: your work goes behind toolaby.gate().\n`);
+}
+
+function help() {
+  out(`
+  toolaby — the Toolaby command line (${VERSION})
+
+    toolaby login                      sign in: a code to approve in the browser
+    toolaby wire <tool-id>             wire the extension in this folder to your tool
+                                       --into <folder>   another folder     --force   replace the platform's files
+    toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
+    toolaby tools                      your tools, with their ids
+    toolaby whoami · logout
+
+    --wall <url>   the Wall to talk to (https://toolaby.app; TOOLABY_WALL)      TOOLABY_TOKEN   a session, for CI
+`);
+}
+
+const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, create, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
+const run = commands[command];
+if (!run) { console.error(`\n  Unknown command "${command}".`); help(); process.exit(1); }
+run().catch((e) => fail(e.message));

package/lib/manifest.js

@@ -0,0 +1,52 @@
+// Generated from wall/src/packages/wiring/manifest.ts by wall/scripts/pack-create.mjs — edit there.
+/**
+ * What wiring an extension does to its manifest — the same in the browser
+ * (Wire my extension, from the tool's page) and in the terminal
+ * (`toolaby wire`, packages/toolaby-cli/bin.mjs):
+ * the storage permission; the platform's address as a host permission and
+ * for externally_connectable (the site's sign-in and purchase handoffs); a
+ * module service worker when the manifest names none, or names one that is
+ * not there; and the Wall's popup in front of the extension's own, which
+ * the configuration then remembers. Pure: given the manifest and what is
+ * on disk, it says what to write.
+ */
+export const WALL_POPUP = 'toolaby-popup.html';
+export const WORKER_LINES = "import { toolaby } from './toolaby.js';\n\ntoolaby.startBackground();\n";
+export function wireManifest(input, o) {
+    const manifest = JSON.parse(JSON.stringify(input));
+    const did = [];
+    const add = (list, value) => { const arr = Array.isArray(list) ? [...list] : []; if (!arr.includes(value))
+        arr.push(value); return arr; };
+    if (!(Array.isArray(manifest.permissions) && manifest.permissions.includes('storage'))) {
+        manifest.permissions = add(manifest.permissions, 'storage');
+        did.push('the "storage" permission');
+    }
+    if (!(Array.isArray(manifest.host_permissions) && manifest.host_permissions.includes(`${o.site}/*`))) {
+        manifest.host_permissions = add(manifest.host_permissions, `${o.site}/*`);
+        did.push(`a host permission for ${o.site}`);
+    }
+    const ec = manifest.externally_connectable ?? {};
+    if (!(Array.isArray(ec.matches) && ec.matches.includes(`${o.site}/*`))) {
+        manifest.externally_connectable = { ...ec, matches: add(ec.matches, `${o.site}/*`) };
+        did.push(`externally_connectable for ${o.site}`);
+    }
+    // The extension's own popup: the manifest's, or the one remembered when the manifest already names the Wall's.
+    const declared = typeof manifest.action?.default_popup === 'string' ? manifest.action.default_popup : null;
+    const appPopup = declared && declared !== WALL_POPUP ? declared : declared === WALL_POPUP ? (o.remembered || null) : null;
+    if (appPopup && declared !== WALL_POPUP) {
+        manifest.action = { ...manifest.action, default_popup: WALL_POPUP };
+        did.push(`the Wall's popup in front of ${appPopup}: it opens on to yours while the device may, and shows the panel when it may not`);
+    }
+    const named = typeof manifest.background?.service_worker === 'string' && manifest.background.service_worker.trim() ? manifest.background.service_worker.trim() : null;
+    let writeWorker = null;
+    let ownWorker = null;
+    if (!named || !o.has(named)) {
+        writeWorker = named ?? (o.has('background.js') ? 'toolaby.background.js' : 'background.js');
+        manifest.background = { service_worker: writeWorker, type: 'module' };
+        did.push(`a service worker, ${writeWorker} (two lines: it starts the platform)`);
+    }
+    else {
+        ownWorker = { file: named, classic: manifest.background?.type !== 'module' };
+    }
+    return { manifest, did, writeWorker, ownWorker, appPopup };
+}

package/lib/project.js

@@ -0,0 +1,116 @@
+// Generated from wall/src/packages/wiring/project.ts by wall/scripts/pack-create.mjs — edit there.
+/** Always written, where the build imports from: the client, its config and types, and the panel a popup of the developer's own can draw. */
+export const CODE_FILES = ['toolaby.config.js', 'toolaby.js', 'toolaby-client.module.js', 'toolaby.d.ts', 'paywall.js', 'paywall.css'];
+/** The Wall's popup, where the build copies files as they are; it imports the panel beside it, so the panel goes there too when that is elsewhere. */
+export const POPUP_FILES = ['toolaby-popup.html', 'toolaby-popup.js', 'toolaby-popup.css'];
+export const PANEL_FILES = ['paywall.js', 'paywall.css'];
+/** Every file a wiring writes, with its path: the code files, and — with a popup to stand in front of — the Wall's popup and, beside it, the panel. */
+export const filesToWrite = (p, appPopup) => [
+    ...CODE_FILES.map((f) => `${p.codeDir}${f}`),
+    ...(appPopup ? [...POPUP_FILES, ...(p.popupDir !== p.codeDir ? PANEL_FILES : [])].map((f) => `${p.popupDir}${f}`) : []),
+];
+/** The import of toolaby.js from a file at `from`, both relative to the root. */
+export function importPath(from, codeDir = '') {
+    const depth = from.split('/').length - 1;
+    const up = depth === 0 ? './' : '../'.repeat(depth);
+    return `${up}${codeDir}toolaby.js`;
+}
+const dep = (pkg, name) => !!(pkg?.dependencies?.[name] || pkg?.devDependencies?.[name]);
+const first = (has, candidates) => candidates.find(has) ?? null;
+export function detectProject(o) {
+    const { has, packageJson: pkg, manifest, site } = o;
+    const wxt = dep(pkg, 'wxt') || !!first(has, ['wxt.config.ts', 'wxt.config.js', 'wxt.config.mts', 'wxt.config.mjs']);
+    const plasmo = dep(pkg, 'plasmo');
+    const crxjs = dep(pkg, '@crxjs/vite-plugin');
+    if (wxt) {
+        // srcDir: the root, or src/ when the entrypoints live there.
+        const src = !has('entrypoints') && has('src/entrypoints') ? 'src/' : '';
+        const worker = first(has, [`${src}entrypoints/background.ts`, `${src}entrypoints/background.js`, `${src}entrypoints/background/index.ts`, `${src}entrypoints/background/index.js`]);
+        const popup = first(has, [`${src}entrypoints/popup.html`, `${src}entrypoints/popup/index.html`]);
+        const appPopup = popup ? 'popup.html' : null;
+        const workerFile = worker ?? `${src}entrypoints/background.ts`;
+        const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\nexport default defineBackground(() => {\n  toolaby.startBackground();\n});\n`;
+        const code = [
+            `// wxt.config.ts — what the Wall needs in the manifest${appPopup ? ', and its popup in front of yours' : ''}`,
+            `export default defineConfig({`,
+            `  manifest: {`,
+            `    permissions: ['storage'],`,
+            `    host_permissions: ['${site}/*'],`,
+            `    externally_connectable: { matches: ['${site}/*'] },`,
+            `  },`,
+            ...(appPopup ? [
+                `  hooks: {`,
+                `    // WXT names your popup entrypoint after merging the manifest above; the hook runs after that.`,
+                `    'build:manifestGenerated': (_, manifest) => {`,
+                `      manifest.action = { ...manifest.action, default_popup: 'toolaby-popup.html' };`,
+                `    },`,
+                `  },`,
+            ] : []),
+            `});`,
+        ].join('\n');
+        return {
+            kind: 'wxt', label: 'WXT', codeDir: '', popupDir: `${src}public/`, manifestFile: null, wrapper: true, appPopup, worker,
+            createWorker: worker ? null : { file: workerFile, content: workerLines },
+            workerLines, snippets: [{ file: first(has, ['wxt.config.ts', 'wxt.config.js', 'wxt.config.mts', 'wxt.config.mjs']) ?? 'wxt.config.ts', language: 'ts', code }],
+        };
+    }
+    if (plasmo) {
+        // Plasmo builds only the pages its own manifest names (popup.tsx → popup.html, from .plasmo/), and its manifest
+        // override replaces `action` whole: a page of ours in front of the popup would leave the popup unbuilt. So no
+        // wrapper here — the gate goes in the popup's code, one call, and the panel is a function away (paywall.js).
+        const src = has('src') && !first(has, ['popup.tsx', 'popup.html', 'background.ts', 'background.js']) ? 'src/' : '';
+        const worker = first(has, [`${src}background.ts`, `${src}background.js`, `${src}background/index.ts`, `${src}background/index.js`]);
+        const workerFile = worker ?? `${src}background.ts`;
+        const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
+        const code = JSON.stringify({ manifest: { permissions: ['storage'], host_permissions: [`${site}/*`], externally_connectable: { matches: [`${site}/*`] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
+        return {
+            kind: 'plasmo', label: 'Plasmo', codeDir: '', popupDir: '', manifestFile: null, wrapper: false, appPopup: null, worker,
+            createWorker: worker ? null : { file: workerFile, content: workerLines },
+            workerLines, snippets: [{ file: 'package.json', language: 'json', code }],
+            note: 'Plasmo builds only the pages its manifest names, so the Wall\'s popup cannot stand in front of yours: ask the gate in your popup — the lines under Fine-tune.',
+        };
+    }
+    if (crxjs && !has('manifest.json')) {
+        const configFile = first(has, ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'manifest.js', 'src/manifest.ts', 'src/manifest.js']);
+        const source = o.manifestSource ?? '';
+        const declared = source.match(/default_popup:\s*['"]([^'"]+)['"]/)?.[1] ?? null;
+        const appPopup = declared && declared !== 'toolaby-popup.html' ? declared : null;
+        const worker = source.match(/service_worker:\s*['"]([^'"]+)['"]/)?.[1] ?? first(has, ['src/background.ts', 'src/background.js', 'background.ts', 'background.js']);
+        const workerFile = worker ?? 'src/background.ts';
+        const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
+        const code = [
+            `// ${configFile ?? 'manifest.config.ts'} — add inside defineManifest({ … })`,
+            `permissions: ['storage'],`,
+            `host_permissions: ['${site}/*'],`,
+            `externally_connectable: { matches: ['${site}/*'] },`,
+            ...(appPopup ? [`action: { default_popup: 'toolaby-popup.html' },`] : []),
+            ...(worker ? [] : [`background: { service_worker: '${workerFile}', type: 'module' },`]),
+        ].join('\n');
+        // CRXJS builds only the pages the manifest names; once ours is the popup, theirs stays built as a Vite input.
+        const viteFile = first(has, ['vite.config.ts', 'vite.config.js', 'vite.config.mts', 'vite.config.mjs']) ?? 'vite.config.ts';
+        const vite = [
+            `// ${viteFile} — CRXJS builds only the pages the manifest names: this keeps your popup built, for the Wall's to hand over to`,
+            `export default defineConfig({`,
+            `  plugins: [crx({ manifest })],`,
+            `  build: { rollupOptions: { input: { popup: '${appPopup}' } } },`,
+            `});`,
+        ].join('\n');
+        return {
+            kind: 'crxjs', label: 'CRXJS', codeDir: '', popupDir: '', manifestFile: null, wrapper: true, appPopup, worker: worker && has(worker) ? worker : null,
+            createWorker: worker && has(worker) ? null : { file: workerFile, content: workerLines },
+            workerLines, snippets: [{ file: configFile ?? 'manifest.config.ts', language: 'ts', code }, ...(appPopup ? [{ file: viteFile, language: 'ts', code: vite }] : [])],
+        };
+    }
+    if (has('manifest.json')) {
+        // A plain extension, or CRXJS with a real manifest.json: the manifest is edited (wireManifest), everything at the root.
+        const declared = typeof manifest?.action?.default_popup === 'string' ? manifest.action.default_popup : null;
+        const named = typeof manifest?.background?.service_worker === 'string' ? manifest.background.service_worker : null;
+        const workerFile = named && has(named) ? named : 'background.js';
+        return {
+            kind: crxjs ? 'crxjs' : 'plain', label: crxjs ? 'CRXJS' : 'a plain extension', codeDir: '', popupDir: '', manifestFile: 'manifest.json', wrapper: true,
+            appPopup: declared && declared !== 'toolaby-popup.html' ? declared : null, worker: named && has(named) ? named : null, createWorker: null,
+            workerLines: `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`, snippets: [],
+        };
+    }
+    return { kind: 'unknown', label: 'unknown', codeDir: '', popupDir: '', manifestFile: null, wrapper: false, appPopup: null, worker: null, createWorker: null, workerLines: '', snippets: [] };
+}

package/package.json

@@ -0,0 +1,13 @@
+{
+  "name": "toolaby",
+  "version": "1.0.0",
+  "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one.",
+  "type": "module",
+  "bin": { "toolaby": "./bin.mjs" },
+  "files": ["bin.mjs", "lib", "README.md"],
+  "engines": { "node": ">=18" },
+  "keywords": ["chrome-extension", "toolaby", "licensing", "cli"],
+  "homepage": "https://toolaby.app",
+  "repository": { "type": "git", "url": "https://github.com/miltostave/Toolaby.git", "directory": "packages/toolaby-cli" },
+  "license": "MIT"
+}