toolaby 1.6.1 → 1.6.3

package/README.md

@@ -3,11 +3,13 @@
 The Toolaby command line. It puts the Wall — sign-in, a Free plan, paid plans, licences and subscriptions — into a Chrome extension you already have, or makes a new one for you.
 
 ```sh
-npm i -g toolaby              # once (or run every command through `npx -y toolaby …`)
+npm i -g toolaby              # once (or run every command through `npx -y toolaby@latest …`)
 toolaby wire <tool-id>        # in your extension's folder, on Test; signs you in first if it must
 toolaby wire <tool-id> --live # the same, on Live: the store build
 ```
 
+In a repository you did not write, use the installed command: `npx` can run a `toolaby` the project carries, or fetch one from a registry the project's `.npmrc` names.
+
 Every command acts on the test Wall (`test.toolaby.app`) unless told `--live` (`toolaby.app`), as Stripe's command line does. `toolaby tools` lists your ids on either side.
 
 ## What it does
@@ -24,14 +26,14 @@ If the extension is built with WXT, CRXJS or Plasmo, the command puts the same f
 
 **`toolaby create <tool-id>`** makes a new, minimal extension in a folder named after the tool, ready for *Load unpacked*.
 
-**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `*.env`, `credentials.json`, source maps) are left out and named; `--allow-private` packs them. Dotfiles and links that lead out of the folder are never packed. Nothing is sent anywhere.
+**`toolaby pack [folder]`** makes the zip for the Chrome Web Store from your built extension: the manifest's `key` left out (the store refuses one it did not issue), and refused if the build carries a Test key or points at `localhost`. A store zip is public, so files that look private (`*.pem`, `*.key`, `*.p12` and other keys, `id_rsa` and the other SSH keys, certificates, `*.env`, `credentials.json`, a service account's key such as `firebase-adminsdk-….json`, `_netrc`, source maps) are left out and named, and so is a file of any name that holds a private key or a live secret (a Stripe live key, a webhook secret, an AWS access key, a GitHub, Slack or npm token, a password in an address). A build copies what a link in `public/` points at, so `pack` also leaves out a file with the same bytes as one of the project's private files or the command's own session, a folder that is a git repository's own, and a file named as an image that holds none, and it names the links in `public/`. `--allow-private` packs what it left out. Dotfiles and links are never packed. Nothing is sent anywhere.
 
 **`toolaby tools`** lists your tools and their ids. **`toolaby whoami`** says who you are signed in as. **`toolaby logout`** signs the command out and revokes its session on the server.
 
 ## Where things live
 
 - Your session: `~/.config/toolaby/credentials.json`, readable by you alone (mode 600). `toolaby logout` deletes it after revoking it.
-- The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI). `TOOLABY_WALL` or `--wall <url>` names any other Wall.
+- The session is per side. `TOOLABY_TOKEN` stands in for the file where there is no home directory (CI), and is sent to one Wall only: Live (`toolaby.app`), or the one `TOOLABY_TOKEN_WALL` names — `TOOLABY_TOKEN_WALL=https://test.toolaby.app` for a Test session. If that Wall refuses it, the session `toolaby login` stored for that Wall is used instead. `TOOLABY_WALL` or `--wall <url>` names any other Wall.
 
 `wire` and `create` write only inside the folder they work on, and never through a symbolic link. A manifest, a framework's config or a Wall that names a place outside it (`../`, an absolute path, a link) is refused before anything is written. `create` writes only the files it knows a new extension has.