toolaby 1.0.3 → 1.2.0

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby            # once (or run every command through `npx -y toolaby …`)
-toolaby login               # once: a code to approve in your browser
-toolaby wire <tool-id>      # in your extension's folder; `toolaby tools` lists your ids
+npm i -g toolaby              # once (or run every command through `npx -y toolaby …`)
+toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
+toolaby wire <tool-id> --live # the same, on Live: the store build
 ```
 
+Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
+
 ## What it does
 
 **`toolaby login`** signs you in. It shows a code and opens the Toolaby dashboard; you approve the code there — as the account the dashboard is signed in to — and the command is signed in as that account from then on. It works the way GitHub's and Stripe's command lines sign in, and only ever acts on that account's own tools.
@@ -27,6 +29,6 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 ## Where things live
 
 - Your session: `~/.config/toolaby/credentials.json`, readable by you alone (mode 600). `toolaby logout` deletes it after revoking it.
-- `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names another Wall (the default is `https://toolaby.app`).
+- The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names any other Wall.
 
 The files the command writes into your extension contain nothing secret: your tool's id, your Wall's address and the *public* key your extension verifies licences with — the same things every copy of your extension carries once it is published.

package/bin.mjs

@@ -7,12 +7,16 @@
 //   toolaby tools                     your tools, with the ids the commands want
 //   toolaby whoami · logout · help
 //
+// Test and live, as Stripe's command line has them: every command acts on
+// the TEST Wall (test.toolaby.app) unless told `--live`, so the everyday
+// command is the safe one and going live is a word you type on purpose.
 // Signed in, the command acts as you and only on your tools, as Clerk's and
 // Stripe's do: nothing is fetched for a tool your workspaces do not own. The
 // session lives in ~/.config/toolaby/credentials.json (mode 600), one per
-// Wall; `logout` revokes it on the server before forgetting it. TOOLABY_TOKEN
-// stands in for the file where there is no home (CI); TOOLABY_WALL for the
-// Wall's address (https://toolaby.app unless told).
+// side; a command that needs one and has none signs you in on the spot.
+// `logout` revokes it on the server before forgetting it. TOOLABY_TOKEN
+// stands in for the file where there is no home (CI); TOOLABY_WALL or
+// `--wall <url>` names any other Wall (a laptop's, a self-hosted one).
 //
 // The wiring rules — what a folder is and what its manifest needs — are the
 // platform's own (wall/src/packages/wiring), carried here transpiled in lib/,
@@ -24,7 +28,7 @@ import { spawn } from 'node:child_process';
 import { wireManifest, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, filesToWrite, BUILD_COPY_NOTE } from './lib/project.js';
 
-const VERSION = '1.0.3';
+const VERSION = '1.2.0';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -33,7 +37,11 @@ const rest = argv.filter((a) => a !== command);
 const positional = rest.filter((a) => !a.startsWith('--'));
 const opt = (k, d = null) => { const i = rest.indexOf(k); return i >= 0 && rest[i + 1] && !rest[i + 1].startsWith('--') ? rest[i + 1] : d; };
 const flag = (k) => rest.includes(k);
-const wall = (opt('--wall') ?? process.env.TOOLABY_WALL ?? 'https://toolaby.app').replace(/\/$/, '');
+const WALLS = { test: 'https://test.toolaby.app', live: 'https://toolaby.app' };
+const live = flag('--live');
+const wall = (opt('--wall') ?? process.env.TOOLABY_WALL ?? (live ? WALLS.live : WALLS.test)).replace(/\/$/, '');
+/** The side, for every message: what a developer must never be unsure of. */
+const side = wall === WALLS.live ? 'Live' : wall === WALLS.test ? 'Test' : wall;
 const out = (s = '') => console.log(s);
 const fail = (s) => { console.error(`\n  ${s}\n`); process.exit(1); };
 
@@ -72,7 +80,7 @@ async function login() {
   const { device_code, user_code, verification_uri, verification_uri_complete, interval = 5, expires_in = 600 } = start.json;
   const link = verification_uri_complete || `${verification_uri}?user_code=${encodeURIComponent(user_code)}`;
   const page = link.startsWith('http') ? link : `${wall}${link}`;
-  out(`\n  Sign in to the Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
+  out(`\n  Sign in to the ${side} Wall to continue.\n\n    Open   ${page}\n    Code   ${user_code}   (approve it there — it expires in ${Math.round(expires_in / 60)} minutes)\n`);
   openBrowser(page);
   let every = Math.max(1, Number(interval) || 5) * 1000;
   const until = Date.now() + Number(expires_in) * 1000;
@@ -88,7 +96,7 @@ async function login() {
       const all = readCredentials();
       all[wall] = { token, email, at: new Date().toISOString() };
       writeCredentials(all);
-      out(`\n\n  Signed in${email ? ` as ${email}` : ''}.\n`);
+      out(`\n\n  Signed in${email ? ` as ${email}` : ''} · ${side}.\n`);
       return token;
     }
     const why = poll.json.error;
@@ -107,11 +115,11 @@ async function tokenOrLogin() {
 
 async function whoami() {
   const token = storedToken();
-  if (!token) fail(`Not signed in to ${wall}. Run \`toolaby login\`.`);
+  if (!token) fail(`Not signed in to ${side} (${wall}). Run \`toolaby login${live ? ' --live' : ''}\`.`);
   const me = await api('/api/cli/me', { token });
   if (me.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
   if (!me.ok) fail(`The Wall answered HTTP ${me.status}.`);
-  out(`\n  ${me.json.email}  ·  ${wall}\n`);
+  out(`\n  ${me.json.email}  ·  ${side}  ·  ${wall}\n`);
   for (const w of me.json.workspaces) out(`    ${w.name}  (${w.slug}, ${w.role})  ${w.site}`);
   out();
 }
@@ -119,22 +127,22 @@ async function whoami() {
 async function logout() {
   const all = readCredentials();
   const entry = all[wall];
-  if (!entry && !process.env.TOOLABY_TOKEN) { out(`\n  Not signed in to ${wall}.\n`); return; }
+  if (!entry && !process.env.TOOLABY_TOKEN) { out(`\n  Not signed in to ${side} (${wall}).\n`); return; }
   // Revoked on the server first; forgotten here whatever the server said — but the difference is reported.
   const res = await api('/api/dev-auth/sign-out', { method: 'POST', body: {}, token: entry?.token ?? process.env.TOOLABY_TOKEN }).catch(() => ({ ok: false, status: 0 }));
   delete all[wall];
   writeCredentials(all);
-  out(res.ok ? `\n  Signed out of ${wall}: the session was revoked and forgotten.\n` : `\n  The session was forgotten here, but the Wall could not be reached to revoke it (HTTP ${res.status}); it expires on its own, or sign it out from the dashboard.\n`);
+  out(res.ok ? `\n  Signed out of ${side} (${wall}): the session was revoked and forgotten.\n` : `\n  The session was forgotten here, but the Wall could not be reached to revoke it (HTTP ${res.status}); it expires on its own, or sign it out from the dashboard.\n`);
   if (process.env.TOOLABY_TOKEN) out('  TOOLABY_TOKEN is set in this shell and still authenticates.\n');
 }
 
 async function tools() {
   const token = await tokenOrLogin();
   const res = await api('/api/cli/tools', { token });
-  if (res.status === 401) fail(`The session for ${wall} is no longer valid. Run \`toolaby login\`.`);
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
   if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
-  if (!res.json.tools.length) { out('\n  No tools yet. Make one in the dashboard, then `toolaby wire <tool-id>` in your extension\'s folder.\n'); return; }
-  out();
+  if (!res.json.tools.length) { out(`\n  No tools on ${side} yet. Make one in the dashboard, then \`toolaby wire <tool-id>${live ? ' --live' : ''}\` in your extension's folder.\n`); return; }
+  out(`\n  ${side}\n`);
   for (const t of res.json.tools) out(`    ${t.slug.padEnd(40)} ${t.name}${t.bundle ? '  (bundle)' : ''}   ${t.site}`);
   out();
 }
@@ -155,10 +163,11 @@ const readJson = (path) => { try { return JSON.parse(readFileSync(path, 'utf8'))
 const isId = (s) => typeof s === 'string' && /^[a-z0-9][a-z0-9-]{1,118}$/.test(s);
 
 /** The tool's files from the Wall, as the signed-in developer: a tool of theirs, or a clear no. */
-async function filesFor(slug, scaffold) {
+async function filesFor(slug, scaffold, manifestKey = null) {
   const token = await tokenOrLogin();
-  const res = await api(`/api/cli/wiring/${slug}${scaffold ? '?scaffold=1' : ''}`, { token });
-  if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold); }
+  const q = new URLSearchParams(); if (scaffold) q.set('scaffold', '1'); if (manifestKey) q.set('manifestKey', manifestKey);
+  const res = await api(`/api/cli/wiring/${slug}${q.size ? `?${q}` : ''}`, { token });
+  if (res.status === 401) { out('  The stored session is no longer valid; signing in again.'); await login(); return filesFor(slug, scaffold, manifestKey); }
   if (res.status === 404) {
     // Say who the command is: the tool may well exist — in a workspace of another account of theirs.
     const me = await api('/api/cli/me', { token }).catch(() => null);
@@ -178,17 +187,19 @@ async function wire() {
   const has = (p) => tree.has(p.replace(/\/$/, ''));
   const manifest = has('manifest.json') ? readJson(join(dir, 'manifest.json')) : null;
   if (has('manifest.json') && !manifest) fail('manifest.json could not be read as JSON.');
-  const plan = await filesFor(slug, false);
+  // A key the manifest already has is the identity the platform adopts; otherwise the platform's goes in.
+  const plan = await filesFor(slug, false, typeof manifest?.key === 'string' ? manifest.key : null);
   const site = plan.site;
+  const manifestKey = plan.identity?.manifestKey ?? null;
   const configSource = ['manifest.config.ts', 'manifest.config.js', 'manifest.ts', 'src/manifest.ts'].find(has);
-  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site, tree });
+  const project = detectProject({ has, packageJson: has('package.json') ? readJson(join(dir, 'package.json')) : null, manifest, manifestSource: configSource ? readFileSync(join(dir, configSource), 'utf8') : null, site, tree, manifestKey });
   // Nothing recognised: nothing is written and nothing guessed. A manifest below the top is where to point --into; otherwise the Set up page's Do it myself has the files and the three things to paste.
   if (project.kind === 'unknown') fail(`${dir} has no manifest.json at the top and is not a WXT, CRXJS or Plasmo project${project.foundManifest ? ` — there is one at ${project.foundManifest}: run this with --into ${dirname(project.foundManifest) || '.'}` : ''}.\n  Nothing was written. For a layout of your own, the tool's Set up page → Do it myself has the files and the three things to paste.`);
 
   // The extension's own popup: the manifest's, or — wired before — the one the existing configuration remembers.
   const configPath = join(dir, `${project.codeDir}toolaby.config.js`);
   const remembered = existsSync(configPath) ? readFileSync(configPath, 'utf8').match(/appPopup:\s*'([^']*)'/)?.[1] || null : null;
-  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered }) : null;
+  const wiring = project.manifestFile && manifest ? wireManifest(manifest, { site, has, remembered, manifestKey }) : null;
   const appPopup = wiring ? wiring.appPopup : project.wrapper ? (project.appPopup ?? remembered) : null;
   const targets = filesToWrite(project, appPopup);
   const present = targets.filter((f) => existsSync(join(dir, f)));
@@ -209,7 +220,7 @@ async function wire() {
     ownWorker = { file: project.worker, classic: false };
   }
 
-  out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}\n`);
+  out(`\n  ${plan.name} → ${dir}${project.kind === 'plain' ? '' : `  (${project.label})`}  ·  ${side}${side === 'Test' ? ' (the tk_test_ key; `--live` for the store build)' : ''}\n`);
   out(`  Written: ${targets.join(', ')}${did.length ? `,\n           ${did.join(',\n           ')}` : ''}.\n`);
   for (const sn of project.snippets) out(`  Add to ${sn.file} — yours to paste, the manifest being generated:\n\n${sn.code.split('\n').map((l) => `     ${l}`).join('\n')}\n`);
   if (ownWorker) out(`  Your background, ${ownWorker.file}: add${ownWorker.classic ? ' — after giving "background" a "type": "module" in manifest.json (importScripts() is not available in a module worker)' : ''}:\n\n${project.workerLines.trimEnd().split('\n').map((l) => `     ${l}`).join('\n')}\n`);
@@ -239,14 +250,15 @@ function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
 
-    toolaby login                      sign in: a code to approve in the browser
-    toolaby wire <tool-id>             wire the extension in this folder to your tool
+    toolaby wire <tool-id>             wire the extension in this folder to your tool, on Test
+    toolaby wire <tool-id> --live      the same, on Live: the store build
                                        --into <folder>   another folder     --force   replace the platform's files
     toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
     toolaby tools                      your tools, with their ids
-    toolaby whoami · logout
+    toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
 
-    --wall <url>   the Wall to talk to (https://toolaby.app; TOOLABY_WALL)      TOOLABY_TOKEN   a session, for CI
+    Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
+    --wall <url> or TOOLABY_WALL names any other Wall; TOOLABY_TOKEN a session, for CI.
 `);
 }
 

package/lib/manifest.js

@@ -6,15 +6,25 @@
  * the storage permission; the platform's address as a host permission and
  * for externally_connectable (the site's sign-in and purchase handoffs); a
  * module service worker when the manifest names none, or names one that is
- * not there; and the Wall's popup in front of the extension's own, which
- * the configuration then remembers. Pure: given the manifest and what is
- * on disk, it says what to write.
+ * not there; the Wall's popup in front of the extension's own, which the
+ * configuration then remembers; and the extension's identity — the `key`
+ * that fixes its id, which the tool key is bound to (identity.ts) — unless
+ * the manifest has one of its own, which is then the identity the platform
+ * adopts. Pure: given the manifest and what is on disk, it says what to
+ * write.
  */
 export const WALL_POPUP = 'toolaby-popup.html';
 export const WORKER_LINES = "import { toolaby } from './toolaby.js';\n\ntoolaby.startBackground();\n";
 export function wireManifest(input, o) {
     const manifest = JSON.parse(JSON.stringify(input));
     const did = [];
+    // The identity: the manifest's own key stays (the platform adopts it); otherwise the platform's goes in, and the unpacked extension's id is known before it loads.
+    const own = typeof manifest.key === 'string' && manifest.key.trim() ? manifest.key.trim() : null;
+    if (!own && o.manifestKey) {
+        manifest.key = o.manifestKey;
+        did.push('a "key", so the extension keeps one id across reloads and machines');
+    }
+    const manifestKey = own ?? o.manifestKey ?? null;
     const add = (list, value) => { const arr = Array.isArray(list) ? [...list] : []; if (!arr.includes(value))
         arr.push(value); return arr; };
     if (!(Array.isArray(manifest.permissions) && manifest.permissions.includes('storage'))) {
@@ -48,5 +58,5 @@ export function wireManifest(input, o) {
     else {
         ownWorker = { file: named, classic: manifest.background?.type !== 'module' };
     }
-    return { manifest, did, writeWorker, ownWorker, appPopup };
+    return { manifest, did, writeWorker, ownWorker, appPopup, manifestKey };
 }

package/lib/project.js

@@ -21,6 +21,7 @@ const dep = (pkg, name) => !!(pkg?.dependencies?.[name] || pkg?.devDependencies?
 const first = (has, candidates) => candidates.find(has) ?? null;
 export function detectProject(o) {
     const { has, packageJson: pkg, manifest, site } = o;
+    const keyLine = o.manifestKey ? `key: '${o.manifestKey}',` : null;
     const scripts = pkg?.scripts ?? {};
     const built = !!scripts.build || has('dist') || has('build');
     const wxt = dep(pkg, 'wxt') || !!first(has, ['wxt.config.ts', 'wxt.config.js', 'wxt.config.mts', 'wxt.config.mjs']);
@@ -38,6 +39,7 @@ export function detectProject(o) {
             `// wxt.config.ts — what the Wall needs in the manifest${appPopup ? ', and its popup in front of yours' : ''}`,
             `export default defineConfig({`,
             `  manifest: {`,
+            ...(keyLine ? [`    ${keyLine} // the extension's id, known to the platform`] : []),
             `    permissions: ['storage'],`,
             `    host_permissions: ['${site}/*'],`,
             `    externally_connectable: { matches: ['${site}/*'] },`,
@@ -66,7 +68,7 @@ export function detectProject(o) {
         const worker = first(has, [`${src}background.ts`, `${src}background.js`, `${src}background/index.ts`, `${src}background/index.js`]);
         const workerFile = worker ?? `${src}background.ts`;
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
-        const code = JSON.stringify({ manifest: { permissions: ['storage'], host_permissions: [`${site}/*`], externally_connectable: { matches: [`${site}/*`] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
+        const code = JSON.stringify({ manifest: { ...(o.manifestKey ? { key: o.manifestKey } : {}), permissions: ['storage'], host_permissions: [`${site}/*`], externally_connectable: { matches: [`${site}/*`] } } }, null, 2).replace(/^\{\n|\n\}$/g, '');
         return {
             kind: 'plasmo', label: 'Plasmo', codeDir: '', popupDir: '', manifestFile: null, wrapper: false, appPopup: null, worker, built: false, foundManifest: null,
             createWorker: worker ? null : { file: workerFile, content: workerLines },
@@ -84,6 +86,7 @@ export function detectProject(o) {
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
         const code = [
             `// ${configFile ?? 'manifest.config.ts'} — add inside defineManifest({ … })`,
+            ...(keyLine && !/\bkey:/.test(source) ? [`${keyLine} // the extension's id, known to the platform`] : []),
             `permissions: ['storage'],`,
             `host_permissions: ['${site}/*'],`,
             `externally_connectable: { matches: ['${site}/*'] },`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolaby",
-  "version": "1.0.3",
+  "version": "1.2.0",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one.",
   "type": "module",
   "bin": { "toolaby": "./bin.mjs" },