toolaby 1.2.0 → 1.4.0

package/bin.mjs

@@ -5,6 +5,11 @@
 //   toolaby wire <tool-id>            wire the extension in this folder to your tool — plain, WXT, CRXJS or Plasmo
 //   toolaby create <tool-id>          make a new, minimal extension for your tool in <tool-id>/
 //   toolaby tools                     your tools, with the ids the commands want
+//   toolaby webhooks events           the six events, with an example of each
+//   toolaby webhooks trigger <event>  send an example delivery: to your registered endpoints, or with --to straight to a local server
+//   toolaby webhooks endpoints        the workspace's endpoints
+//   toolaby webhooks add <url>        register an endpoint; the secret is printed once
+//   toolaby webhooks remove <id>      remove one
 //   toolaby whoami · logout · help
 //
 // Test and live, as Stripe's command line has them: every command acts on
@@ -25,10 +30,11 @@ import { mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync, statSy
 import { join, resolve, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { spawn } from 'node:child_process';
+import { createHmac, randomBytes } from 'node:crypto';
 import { wireManifest, WORKER_LINES } from './lib/manifest.js';
 import { detectProject, CODE_FILES, filesToWrite, BUILD_COPY_NOTE } from './lib/project.js';
 
-const VERSION = '1.2.0';
+const VERSION = '1.4.0';
 const CLIENT_ID = 'toolaby-cli';
 const argv = process.argv.slice(2);
 // `--version` and `--help` are commands of their own; every other command is the first bare word.
@@ -246,6 +252,90 @@ async function create() {
   out(`\n  ${plan.name} → ${dir}\n\n    1. chrome://extensions → Developer mode → Load unpacked → ${dir}\n    2. Click the icon: the popup shows what the Free plan holds; Buy opens ${plan.site}/tools/${slug}\n\n  Edit background.js: your work goes behind toolaby.gate().\n`);
 }
 
+// ── webhooks: the catalogue, and a delivery on demand ───────────────────────────────────────────────────────────────
+//
+// `trigger <event>` sends the catalogue's example of the event through the
+// Wall to every endpoint the workspace registered — signed, logged, retried,
+// as a real one. `trigger <event> --to <url>` skips the Wall: the command
+// signs the example itself, Standard Webhooks style, with a secret you name
+// (or one it prints) and POSTs it to the URL — a server on localhost, no
+// tunnel, no deploy — so a handler can be written and run before anything
+// is registered.
+const DEV_SECRET = 'whsec_dG9vbGFieS1kZXYtd2ViaG9vay1zZWNyZXQtMDAwMQ==';
+async function catalogue() {
+  const res = await api('/api/cli/webhooks/events', { token: await tokenOrLogin() });
+  if (res.status === 401) fail(`The session for ${side} is no longer valid. Run \`toolaby login${live ? ' --live' : ''}\`.`);
+  if (!res.ok) fail(`The Wall answered HTTP ${res.status}.`);
+  return res.json.events;
+}
+async function webhooks() {
+  const sub = positional[0];
+  if (sub === 'events') {
+    const events = await catalogue();
+    out(`\n  ${side}\n`);
+    for (const e of events) out(`    ${e.type.padEnd(26)} ${e.description}`);
+    out(`\n  toolaby webhooks trigger <event>            → your registered endpoints\n  toolaby webhooks trigger <event> --to <url>  → a local server, signed with a secret you name\n`);
+    return;
+  }
+  if (sub === 'trigger') {
+    const type = positional[1];
+    if (!type) fail('usage: toolaby webhooks trigger <event> [--to <url>] [--secret <whsec_…>]   — `toolaby webhooks events` lists them');
+    const to = opt('--to');
+    if (!to) {
+      const res = await api('/api/cli/webhooks/trigger', { method: 'POST', body: { type, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
+      if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+      out(`\n  Sent ${res.json.sent} to every endpoint of ${res.json.workspace} · ${side}. Its id is ${res.json.id}; the delivery log is under Configure → Webhooks.\n`);
+      return;
+    }
+    const events = await catalogue();
+    const event = events.find((e) => e.type === type);
+    if (!event) fail(`No event "${type}". \`toolaby webhooks events\` lists them.`);
+    const secret = opt('--secret') ?? DEV_SECRET;
+    if (!/^whsec_[A-Za-z0-9+/=]+$/.test(secret)) fail('--secret must be a Standard Webhooks secret: whsec_ followed by base64.');
+    const id = `msg_${randomBytes(12).toString('base64url')}`;
+    const timestamp = Math.floor(Date.now() / 1000);
+    const body = JSON.stringify({ id: `evt_${type.replace('.', '_')}_${Date.now().toString(36)}`, type, created: timestamp, livemode: false, data: event.example });
+    const signature = 'v1,' + createHmac('sha256', Buffer.from(secret.slice(6), 'base64')).update(`${id}.${timestamp}.${body}`).digest('base64');
+    let res;
+    try {
+      res = await fetch(to, { method: 'POST', headers: { 'Content-Type': 'application/json', 'webhook-id': id, 'webhook-timestamp': String(timestamp), 'webhook-signature': signature, 'User-Agent': `toolaby-cli/${VERSION}` }, body });
+    } catch (e) { fail(`Could not reach ${to}: ${e.message}`); }
+    const text = (await res.text()).slice(0, 200);
+    out(`\n  POST ${to}  →  ${res.status}${text ? `  ${text.replace(/\s+/g, ' ')}` : ''}`);
+    out(`  ${type}, signed with ${opt('--secret') ? 'your secret' : `${DEV_SECRET} — set WALL_WEBHOOK_SECRET to it to verify`}.\n`);
+    if (res.status >= 300) out('  A real delivery would be retried until your server answers 2xx.\n');
+    return;
+  }
+  if (sub === 'endpoints') {
+    const ws = opt('--workspace');
+    const res = await api(`/api/cli/webhooks/endpoints${ws ? `?workspace=${encodeURIComponent(ws)}` : ''}`, { token: await tokenOrLogin() });
+    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+    out(`\n  ${res.json.workspace} · ${side}\n`);
+    if (res.json.endpoints.length === 0) out('    None yet. `toolaby webhooks add <url>` registers one.');
+    for (const e of res.json.endpoints) out(`    ${e.id}  ${e.disabled ? 'paused ' : 'on     '} ${e.url}${e.description ? `  — ${e.description}` : ''}${e.events.length ? `  (${e.events.join(', ')})` : ''}`);
+    out();
+    return;
+  }
+  if (sub === 'add') {
+    const url = positional[1];
+    if (!url) fail('usage: toolaby webhooks add <url> [--description <text>] [--events a.b,c.d] [--workspace <slug>]');
+    const events = (opt('--events') ?? '').split(',').map((e) => e.trim()).filter(Boolean);
+    const res = await api('/api/cli/webhooks/endpoints', { method: 'POST', body: { url, description: opt('--description') ?? '', events, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
+    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+    out(`\n  Added ${res.json.id} → ${res.json.url} · ${res.json.workspace} · ${side}\n\n  Signing secret, shown once — keep it where your server keeps secrets:\n\n    ${res.json.secret}\n`);
+    return;
+  }
+  if (sub === 'remove') {
+    const id = positional[1];
+    if (!id) fail('usage: toolaby webhooks remove <ep_…> [--workspace <slug>]   — `toolaby webhooks endpoints` lists them');
+    const res = await api('/api/cli/webhooks/endpoints', { method: 'DELETE', body: { id, workspace: opt('--workspace') ?? undefined }, token: await tokenOrLogin() });
+    if (!res.ok) fail(res.json.message ?? `The Wall answered HTTP ${res.status}.`);
+    out(`\n  Removed ${res.json.removed} · ${res.json.workspace} · ${side}. Deliveries to it stop at once.\n`);
+    return;
+  }
+  fail('usage: toolaby webhooks events | trigger <event> [--to <url>] | endpoints | add <url> | remove <id>');
+}
+
 function help() {
   out(`
   toolaby — the Toolaby command line (${VERSION})
@@ -255,6 +345,9 @@ function help() {
                                        --into <folder>   another folder     --force   replace the platform's files
     toolaby create <tool-id>           a new, minimal extension for your tool, in <tool-id>/   --dir <folder>
     toolaby tools                      your tools, with their ids
+    toolaby webhooks events            the six events, with an example of each
+    toolaby webhooks trigger <event>   an example delivery to your endpoints; --to <url> sends it to a local server instead
+    toolaby webhooks endpoints         your endpoints; add <url> registers one (secret shown once), remove <id> removes one
     toolaby login · whoami · logout    the session, per side; a command that needs one signs you in itself
 
     Every command acts on Test (test.toolaby.app) unless told --live (toolaby.app).
@@ -262,7 +355,7 @@ function help() {
 `);
 }
 
-const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, create, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
+const commands = { login: async () => { await login(); }, logout, whoami, tools, wire, create, webhooks, help, '--help': help, '-h': help, '--version': () => out(VERSION), '-v': () => out(VERSION) };
 const run = commands[command];
 if (!run) { console.error(`\n  Unknown command "${command}".`); help(); process.exit(1); }
 Promise.resolve().then(run).catch((e) => fail(e.message));

package/lib/project.js

@@ -3,12 +3,15 @@
 export const BUILD_COPY_NOTE = 'A build ships this extension: make sure it copies the platform\'s files to its output — toolaby.js, toolaby.config.js, toolaby-client.module.js, paywall.js, paywall.css and toolaby-popup.* — the way it copies your popup.html.';
 /** Always written, where the build imports from: the client, its config and types, and the panel a popup of the developer's own can draw. */
 export const CODE_FILES = ['toolaby.config.js', 'toolaby.js', 'toolaby-client.module.js', 'toolaby.d.ts', 'paywall.js', 'paywall.css'];
+/** Beside the client when the build generates the manifest: the fragment it spreads in, derived from the key (boilerplate/toolaby.manifest.js). */
+export const MANIFEST_HELPER = ['toolaby.manifest.js', 'toolaby.manifest.d.ts'];
 /** The Wall's popup, where the build copies files as they are; it imports the panel beside it, so the panel goes there too when that is elsewhere. */
 export const POPUP_FILES = ['toolaby-popup.html', 'toolaby-popup.js', 'toolaby-popup.css'];
 export const PANEL_FILES = ['paywall.js', 'paywall.css'];
 /** Every file a wiring writes, with its path: the code files, and — with a popup to stand in front of — the Wall's popup and, beside it, the panel. */
 export const filesToWrite = (p, appPopup) => [
     ...CODE_FILES.map((f) => `${p.codeDir}${f}`),
+    ...(p.manifestFile ? [] : MANIFEST_HELPER.map((f) => `${p.codeDir}${f}`)),
     ...(appPopup ? [...POPUP_FILES, ...(p.popupDir !== p.codeDir ? PANEL_FILES : [])].map((f) => `${p.popupDir}${f}`) : []),
 ];
 /** The import of toolaby.js from a file at `from`, both relative to the root. */
@@ -21,7 +24,6 @@ const dep = (pkg, name) => !!(pkg?.dependencies?.[name] || pkg?.devDependencies?
 const first = (has, candidates) => candidates.find(has) ?? null;
 export function detectProject(o) {
     const { has, packageJson: pkg, manifest, site } = o;
-    const keyLine = o.manifestKey ? `key: '${o.manifestKey}',` : null;
     const scripts = pkg?.scripts ?? {};
     const built = !!scripts.build || has('dist') || has('build');
     const wxt = dep(pkg, 'wxt') || !!first(has, ['wxt.config.ts', 'wxt.config.js', 'wxt.config.mts', 'wxt.config.mjs']);
@@ -36,14 +38,11 @@ export function detectProject(o) {
         const workerFile = worker ?? `${src}entrypoints/background.ts`;
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\nexport default defineBackground(() => {\n  toolaby.startBackground();\n});\n`;
         const code = [
-            `// wxt.config.ts — what the Wall needs in the manifest${appPopup ? ', and its popup in front of yours' : ''}`,
+            `// wxt.config.ts — the Wall's needs in the manifest come from toolaby.config.js${appPopup ? ', and its popup goes in front of yours' : ''}`,
+            `import { manifest as toolaby } from './toolaby.manifest.js';`,
+            ``,
             `export default defineConfig({`,
-            `  manifest: {`,
-            ...(keyLine ? [`    ${keyLine} // the extension's id, known to the platform`] : []),
-            `    permissions: ['storage'],`,
-            `    host_permissions: ['${site}/*'],`,
-            `    externally_connectable: { matches: ['${site}/*'] },`,
-            `  },`,
+            `  manifest: { ...toolaby }, // the extension's id, the storage permission, the Wall's address`,
             ...(appPopup ? [
                 `  hooks: {`,
                 `    // WXT names your popup entrypoint after merging the manifest above; the hook runs after that.`,
@@ -85,11 +84,10 @@ export function detectProject(o) {
         const workerFile = worker ?? 'src/background.ts';
         const workerLines = `import { toolaby } from '${importPath(workerFile)}';\n\ntoolaby.startBackground();\n`;
         const code = [
-            `// ${configFile ?? 'manifest.config.ts'} — add inside defineManifest({ … })`,
-            ...(keyLine && !/\bkey:/.test(source) ? [`${keyLine} // the extension's id, known to the platform`] : []),
-            `permissions: ['storage'],`,
-            `host_permissions: ['${site}/*'],`,
-            `externally_connectable: { matches: ['${site}/*'] },`,
+            `// ${configFile ?? 'manifest.config.ts'} — the Wall's needs come from toolaby.config.js: import once, spread inside defineManifest({ … })`,
+            `import { manifest as toolaby } from '${importPath(configFile ?? 'manifest.config.ts').replace(/toolaby\.js$/, 'toolaby.manifest.js')}';`,
+            ``,
+            `...toolaby, // the extension's id, the storage permission, the Wall's address`,
             ...(appPopup ? [`action: { default_popup: 'toolaby-popup.html' },`] : []),
             ...(worker ? [] : [`background: { service_worker: '${workerFile}', type: 'module' },`]),
         ].join('\n');

package/package.json

@@ -1,13 +1,30 @@
 {
   "name": "toolaby",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "The Toolaby command line: sign in once, then wire any Chrome extension to your tool on the Wall — sign-in, the Free plan, licences and subscriptions — or start a new one.",
   "type": "module",
-  "bin": { "toolaby": "./bin.mjs" },
-  "files": ["bin.mjs", "lib", "README.md"],
-  "engines": { "node": ">=18" },
-  "keywords": ["chrome-extension", "toolaby", "licensing", "cli"],
+  "bin": {
+    "toolaby": "bin.mjs"
+  },
+  "files": [
+    "bin.mjs",
+    "lib",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "chrome-extension",
+    "toolaby",
+    "licensing",
+    "cli"
+  ],
   "homepage": "https://toolaby.app",
-  "repository": { "type": "git", "url": "https://github.com/miltostave/Toolaby.git", "directory": "packages/toolaby-cli" },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/miltostave/Toolaby.git",
+    "directory": "packages/toolaby-cli"
+  },
   "license": "MIT"
 }