feat(cli): use js api client 7.2.0

Author: Plopix

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [5.27.0]
+
+- bumped `@crystallize/js-api-client` to ^7.2.0 (renamed `signature` → `signatureStatus`, `backendToken` → `backendTokenStatus` on the decrypter result; `envelope.config` → `envelope.configuration`; new `tenantId`, `event`, `signatureSecret`, `staticAuthToken` fields on `CrystallizePluginPayload`) and bumped `jose` to ^6 (drops the `KeyLike` re-export in favor of native `CryptoKey`).
+- `plugin decrypt-payload` lean output now dumps every protocol section the payload carries: `[Envelope]` (tenantId / tenantIdentifier / installationId / pluginIdentifier / revisionId / event), `[Configuration]`, `[Context]`, `[Secrets]`, `[Plugin Tokens]` (signatureSecret / staticAuthToken), `[JWT]` (envelope iss / aud / sub / iat / nbf / exp / jti) and `[Backend Token]` — sections only render when present, so webhook vs iframe variants stay scannable.
+- `plugin decrypt-payload` lean output formats `iat` / `nbf` / `exp` claims as `<unix-seconds> (<ISO-8601>)` for at-a-glance freshness checks.
+
 ## [5.26.0]
 
 - added `plugin encrypt-secret` command to encrypt a single secret value with a vendor public JWK (RSA-OAEP-256 / A256GCM), producing a compact JWE on stdout — the same shape Crystallize's UI generates for an `envelope.encryptedSecrets[fieldName]` entry; useful for local dev / testing where the UI is not in the loop. Plaintext can be passed via `--value`, piped on stdin, or pasted interactively. Output round-trips through `plugin decrypt-payload` with the matching private JWK.

bun.lockb

@@ -1,6 +1,6 @@
 {
     "name": "@crystallize/cli",
-    "version": "5.26.0",
+    "version": "5.27.0",
     "description": "Crystallize CLI",
     "license": "MIT",
     "contributors": [
@@ -13,16 +13,16 @@
         "test": "bun test"
     },
     "dependencies": {
-        "@crystallize/js-api-client": "^7.0.0",
+        "@crystallize/js-api-client": "^7.2.0",
         "@crystallize/schema": "^6.12.0",
         "awilix": "^13.0.3",
         "cli-spinners": "^3.4.0",
         "commander": "^14.0.3",
         "ink": "^6.8.0",
         "ink-link": "^5.0.0",
         "ink-text-input": "^6.0.0",
-        "jose": "^5.10.0",
-        "jotai": "^2.19.0",
+        "jose": "^6.2.3",
+        "jotai": "^2.20.0",
         "json-to-graphql-query": "^2.3.0",
         "marked": "^17.0.5",
         "marked-terminal": "^7.3.0",
@@ -32,7 +32,7 @@
         "react": "^19.2.4",
         "signale": "^1.4.0",
         "tar": "^7.5.13",
-        "zod": "^4.3.6"
+        "zod": "^4.4.3"
     },
     "devDependencies": {
         "@commitlint/cli": "^20.5.0",

package.json

@@ -3,7 +3,7 @@ import { mkdtemp, readFile, writeFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { CompactEncrypt, SignJWT, exportJWK, generateKeyPair, importJWK, type JWK, type KeyLike } from 'jose';
+import { CompactEncrypt, SignJWT, exportJWK, generateKeyPair, importJWK, type JWK } from 'jose';
 
 const CLI = path.resolve(import.meta.dir, '../../index.ts');
 
@@ -54,7 +54,7 @@ const encryptBytesForVendor = async (publicJwk: JWK, plaintext: Uint8Array, cty?
 type Issuer = {
     jwksFilePath: string;
     issuer: string;
-    signer: KeyLike;
+    signer: CryptoKey;
     kid: string;
 };
 
@@ -66,7 +66,7 @@ const makeJwksIssuer = async (dir: string): Promise<Issuer> => {
     return {
         jwksFilePath,
         issuer: 'https://api.crystallize.example',
-        signer: privateKey as KeyLike,
+        signer: privateKey,
         kid: 'core-sign-1',
     };
 };
@@ -112,11 +112,12 @@ const buildProtocolPayload = async (args: {
     }
 
     const envelopeClaims: Record<string, unknown> = {
-        installationId: 'inst-1',
+        tenantId: 'tenant-1',
         tenantIdentifier: 'acme',
+        installationId: 'inst-1',
         pluginIdentifier: audience,
         revisionId: 'rev-1',
-        config: { brand: 'Acme' },
+        configuration: { brand: 'Acme' },
         encryptedSecrets,
         ...envelopeExtras,
     };
@@ -238,30 +239,37 @@ describe('plugin decrypt-payload', () => {
         expect(result.status).toBe(0);
         const out = JSON.parse(result.stdout);
         expect(out.protectedHeader.cty).toBe('JWT');
-        expect(out.signature).toEqual({
+        expect(out.signatureStatus).toEqual({
             verified: true,
             issuer: issuer.issuer,
             audience,
             algorithm: 'RS256',
         });
         expect(out.envelope.iss).toBe(issuer.issuer);
         expect(out.envelope.aud).toBe(audience);
-        expect(out.envelope.installationId).toBe('inst-1');
+        expect(out.envelope.tenantId).toBe('tenant-1');
         expect(out.envelope.tenantIdentifier).toBe('acme');
+        expect(out.envelope.installationId).toBe('inst-1');
+        expect(out.envelope.configuration).toEqual({ brand: 'Acme' });
         expect(out.envelope.entityContext).toEqual({ orderId: 'ord-42' });
         expect(out.secrets).toEqual({ StripeApiKey: 'sk_live_abc', WebhookSecret: 'whsec_def' });
         expect(out.plaintext).toBeNull();
     });
 
-    test('lean default output has [Secrets] / [Configuration] / [Context] / [Token] sections — no JSON, no headers', async () => {
+    test('lean default output dumps every protocol section — no JSON, no headers', async () => {
         const { publicJwk } = await loadVendorKeys(workDir);
         const audience = 'com.vendor.test';
         const jwe = await buildProtocolPayload({
             vendorPublic: publicJwk,
             issuer,
             audience,
             secretsPlain: { StripeApiKey: 'sk_live_abc' },
-            envelopeExtras: { entityContext: { orderId: 'ord-42' } },
+            envelopeExtras: {
+                entityContext: { orderId: 'ord-42' },
+                event: 'install',
+                signatureSecret: 'whsec_lean',
+                staticAuthToken: 'static_lean_token',
+            },
             backendTokenExtras: { act: { pluginIdentifier: audience } },
         });
         const result = runDecryptLean(
@@ -281,20 +289,60 @@ describe('plugin decrypt-payload', () => {
             workDir,
         );
         expect(result.status).toBe(0);
-        expect(result.stdout).toContain('[Secrets]');
-        expect(result.stdout).toContain('StripeApiKey');
-        expect(result.stdout).toContain('sk_live_abc');
+        // Identity
+        expect(result.stdout).toContain('[Envelope]');
+        expect(result.stdout).toContain('tenantId');
+        expect(result.stdout).toContain('tenant-1');
+        expect(result.stdout).toContain('tenantIdentifier');
+        expect(result.stdout).toContain('acme');
+        expect(result.stdout).toContain('installationId');
+        expect(result.stdout).toContain('inst-1');
+        expect(result.stdout).toContain('pluginIdentifier');
+        expect(result.stdout).toContain('revisionId');
+        expect(result.stdout).toContain('event');
+        expect(result.stdout).toContain('install');
+        // Configuration / Context
         expect(result.stdout).toContain('[Configuration]');
         expect(result.stdout).toContain('brand');
         expect(result.stdout).toContain('[Context]');
         expect(result.stdout).toContain('orderId');
-        expect(result.stdout).toContain('[Token]');
+        // Secrets
+        expect(result.stdout).toContain('[Secrets]');
+        expect(result.stdout).toContain('StripeApiKey');
+        expect(result.stdout).toContain('sk_live_abc');
+        // Plugin tokens (raw envelope fields)
+        expect(result.stdout).toContain('[Plugin Tokens]');
+        expect(result.stdout).toContain('signatureSecret');
+        expect(result.stdout).toContain('whsec_lean');
+        expect(result.stdout).toContain('staticAuthToken');
+        // Envelope JWT claims
+        expect(result.stdout).toContain('[JWT]');
+        expect(result.stdout).toContain('iss');
+        expect(result.stdout).toContain(issuer.issuer);
+        expect(result.stdout).toContain('exp');
+        // Backend token
+        expect(result.stdout).toContain('[Backend Token]');
         // No JSON doc, no protected headers in lean mode.
         expect(result.stdout).not.toContain('"protectedHeader"');
         expect(result.stdout).not.toContain('"innerProtectedHeader"');
         expect(result.stderr).not.toContain('outer JWE header');
     });
 
+    test('lean output omits sections that the payload does not carry', async () => {
+        const { publicJwk } = await loadVendorKeys(workDir);
+        const jwe = await encryptBytesForVendor(publicJwk, new TextEncoder().encode('not a jwt'));
+        const result = runDecryptLean(
+            ['--private-key', path.join(workDir, 'private.jwk.json'), '--payload', jwe],
+            workDir,
+        );
+        expect(result.status).toBe(0);
+        expect(result.stdout).toContain('[Plaintext]');
+        expect(result.stdout).not.toContain('[Envelope]');
+        expect(result.stdout).not.toContain('[JWT]');
+        expect(result.stdout).not.toContain('[Backend Token]');
+        expect(result.stdout).not.toContain('[Plugin Tokens]');
+    });
+
     test('--json flag still emits the structured document', async () => {
         const { publicJwk } = await loadVendorKeys(workDir);
         const jwe = await encryptBytesForVendor(publicJwk, new TextEncoder().encode('hello'));

src/command/plugin/decrypt-payload.test.ts

@@ -67,58 +67,99 @@ const readFromStdin = async (isTty: boolean, logger: Logger): Promise<string> =>
 
 const looksLikeCompactJwe = (value: string): boolean => value.split('.').length === 5;
 
+const TIME_CLAIMS = new Set(['iat', 'nbf', 'exp']);
+
+const formatTimestamp = (value: unknown): string => {
+    if (typeof value !== 'number' || !Number.isFinite(value)) return formatValue(value);
+    // accept seconds (JWT default) or milliseconds (best-effort heuristic).
+    const ms = value > 1e12 ? value : value * 1000;
+    const iso = new Date(ms).toISOString();
+    return `${value} ${pc.dim(`(${iso})`)}`;
+};
+
 const formatValue = (value: unknown): string => {
     if (value === null || value === undefined) return pc.dim('—');
     if (typeof value === 'string') return value;
     if (typeof value === 'number' || typeof value === 'boolean') return String(value);
     return JSON.stringify(value);
 };
 
+const formatClaim = (key: string, value: unknown): string =>
+    TIME_CLAIMS.has(key) ? formatTimestamp(value) : formatValue(value);
+
 const renderSection = (write: (s: string) => void, title: string, status: string | null, rows: [string, unknown][]) => {
     if (rows.length === 0) return;
     write('');
     write(pc.bold(pc.cyan(`[${title}]`)) + (status ? ' ' + status : ''));
     const width = Math.max(...rows.map(([k]) => k.length));
     for (const [k, v] of rows) {
-        write(`  ${pc.green(k.padEnd(width))}  ${formatValue(v)}`);
+        write(`  ${pc.green(k.padEnd(width))}  ${formatClaim(k, v)}`);
     }
 };
 
+const pickRows = (source: Record<string, unknown> | null | undefined, keys: readonly string[]): [string, unknown][] =>
+    source ? keys.filter((k) => source[k] !== undefined).map((k) => [k, source[k]]) : [];
+
+const ENVELOPE_IDENTITY_KEYS = [
+    'tenantId',
+    'tenantIdentifier',
+    'installationId',
+    'pluginIdentifier',
+    'revisionId',
+    'event',
+] as const;
+
+const ENVELOPE_TOKEN_KEYS = ['signatureSecret', 'staticAuthToken'] as const;
+
+const ENVELOPE_JWT_KEYS = ['iss', 'aud', 'sub', 'iat', 'nbf', 'exp', 'jti'] as const;
+
+const BACKEND_TOKEN_KEYS = ['sub', 'aud', 'iss', 'iat', 'nbf', 'exp', 'jti', 'act'] as const;
+
 const renderLean = (d: DecryptedPluginPayload): void => {
     const write = (s: string) => process.stdout.write(s + '\n');
+    const env = d.envelope as Record<string, unknown> | null;
 
-    const secrets = Object.entries(d.secrets);
-    renderSection(write, 'Secrets', null, secrets);
+    renderSection(write, 'Envelope', null, pickRows(env, ENVELOPE_IDENTITY_KEYS));
 
-    const config = d.envelope?.config;
+    const configuration = env?.configuration;
     renderSection(
         write,
         'Configuration',
         null,
-        config && typeof config === 'object' && !Array.isArray(config) ? Object.entries(config) : [],
+        configuration && typeof configuration === 'object' && !Array.isArray(configuration)
+            ? Object.entries(configuration)
+            : [],
     );
 
-    const context = d.envelope?.entityContext;
+    const context = env?.entityContext;
     renderSection(
         write,
         'Context',
         null,
         context && typeof context === 'object' && !Array.isArray(context) ? Object.entries(context) : [],
     );
 
-    if (d.backendToken) {
-        const status = d.backendToken.verified
+    renderSection(write, 'Secrets', null, Object.entries(d.secrets));
+
+    renderSection(write, 'Plugin Tokens', null, pickRows(env, ENVELOPE_TOKEN_KEYS));
+
+    renderSection(write, 'JWT', null, pickRows(env, ENVELOPE_JWT_KEYS));
+
+    if (d.backendTokenStatus) {
+        const status = d.backendTokenStatus.verified
             ? pc.green('(verified)')
-            : d.backendToken.skipped
+            : d.backendTokenStatus.skipped
               ? pc.dim('(not verified)')
               : pc.red('(verification FAILED)');
-        const claims = (d.backendToken.claims ?? {}) as Record<string, unknown>;
-        const keys = ['sub', 'aud', 'iss', 'iat', 'nbf', 'exp', 'jti', 'act'] as const;
-        const rows: [string, unknown][] = keys.filter((k) => k in claims).map((k) => [k, claims[k]]);
-        renderSection(write, 'Token', status, rows);
+        renderSection(
+            write,
+            'Backend Token',
+            status,
+            pickRows(d.backendTokenStatus.claims as Record<string, unknown> | undefined, BACKEND_TOKEN_KEYS),
+        );
     }
 
-    if (d.envelope === null && d.plaintext !== null) {
+    if (env === null && d.plaintext !== null) {
         write('');
         write(pc.bold(pc.cyan('[Plaintext]')));
         write(`  ${d.plaintext}`);
@@ -174,7 +215,7 @@ export const createPluginDecryptPayloadCommand = ({ logger, flySystem, crystalli
     command.addOption(
         new Option(
             '--json',
-            'Emit the full structured JSON document (protectedHeader, innerProtectedHeader, envelope, secrets, signature, backendToken) instead of the lean human view.',
+            'Emit the full structured JSON document (protectedHeader, innerProtectedHeader, envelope, secrets, signatureStatus, backendTokenStatus) instead of the lean human view.',
         ).default(false),
     );
     command.addOption(
@@ -192,18 +233,21 @@ ${pc.bold('What this command does (§ reference to the plugin payload protocol):
      enforcing ${pc.cyan('issuer')}, ${pc.cyan('audience')}, ${pc.cyan('RS256')}, and a clock tolerance window.
   3. Decrypt each per-field ciphertext in ${pc.cyan('envelope.encryptedSecrets')} with the same private key.
   4. Optionally verify ${pc.cyan('envelope.backendToken')} (--verify-backend-token).
-  5. Print a lean summary (${pc.cyan('[Secrets]')} / ${pc.cyan('[Configuration]')} / ${pc.cyan('[Context]')} / ${pc.cyan('[Token]')})
-     to stdout. Use ${pc.cyan('--json')} for a full structured document (suitable for ${pc.cyan('jq')}),
-     and ${pc.cyan('-v/--verbose')} to surface protected headers and the "no applicable key" hint.
+  5. Print a lean summary to stdout. Sections appear only when the payload carries them:
+     ${pc.cyan('[Envelope]')} (tenantId/tenantIdentifier/installationId/pluginIdentifier/revisionId/event),
+     ${pc.cyan('[Configuration]')}, ${pc.cyan('[Context]')} (iframe entityContext), ${pc.cyan('[Secrets]')} (decrypted per-field),
+     ${pc.cyan('[Plugin Tokens]')} (signatureSecret/staticAuthToken), ${pc.cyan('[JWT]')} (envelope iss/aud/sub/iat/nbf/exp/jti),
+     ${pc.cyan('[Backend Token]')} (verification status + claims). Use ${pc.cyan('--json')} for a full structured document
+     (suitable for ${pc.cyan('jq')}), and ${pc.cyan('-v/--verbose')} to surface protected headers and the "no applicable key" hint.
 
 ${pc.bold('Enabling verification:')}
   Pass ${pc.cyan('--audience <your-plugin-id>')}. The JWKS URL and issuer default from the env above;
   override either with ${pc.cyan('--jwks-url')} / ${pc.cyan('--jwks-file')} / ${pc.cyan('--issuer')} if you're pointing at a mock.
 
 ${pc.bold('Signature failures are NOT fatal:')}
   When --jwks-url is set and verification fails (e.g. running against a mock issuer on local dev), the
-  envelope is still decoded and secrets still decrypted, with ${pc.cyan('signature.verified = false')} and the
-  failure reason. Treat the envelope as untrusted in that case.
+  envelope is still decoded and secrets still decrypted, with ${pc.cyan('signatureStatus.verified = false')} and
+  the failure reason. Treat the envelope as untrusted in that case.
 
 ${pc.bold('Security:')}
   The emitted JSON contains decrypted secrets in cleartext. Never paste or redirect it to shared logs.
@@ -329,22 +373,22 @@ ${pc.bold('Examples:')}
 
         const errLine = (msg: string) => process.stderr.write(msg + '\n');
 
-        if (decrypted.signature.verified) {
+        if (decrypted.signatureStatus.verified) {
             errLine(pc.green('✔ ') + 'signature verified');
-        } else if (decrypted.signature.skipped) {
+        } else if (decrypted.signatureStatus.skipped) {
             if (flags.verbose) {
-                errLine(pc.yellow('⚠ ') + `signature not verified: ${decrypted.signature.reason}`);
+                errLine(pc.yellow('⚠ ') + `signature not verified: ${decrypted.signatureStatus.reason}`);
             }
         } else {
-            errLine(pc.red('✖ ') + `signature FAILED: ${decrypted.signature.reason}`);
+            errLine(pc.red('✖ ') + `signature FAILED: ${decrypted.signatureStatus.reason}`);
             if (flags.verbose && decrypted.innerProtectedHeader) {
                 const h = decrypted.innerProtectedHeader;
                 errLine(
                     pc.dim(
                         `  inner JWS header: kid=${JSON.stringify(h.kid)}, alg=${JSON.stringify(h.alg)} — compare with JWKS at ${flags.jwksFile ?? flags.jwksUrl}`,
                     ),
                 );
-                if (decrypted.signature.reason?.includes('no applicable key')) {
+                if (decrypted.signatureStatus.reason?.includes('no applicable key')) {
                     errLine(
                         pc.dim(
                             '  hint: "no applicable key" means the JWKS was loaded but no key matches the JWT header.',

src/command/plugin/decrypt-payload.ts

@@ -41,9 +41,10 @@ const handler = async (
         accessTokenId: envelope.message.credentials.ACCESS_TOKEN_ID,
         accessTokenSecret: envelope.message.credentials.ACCESS_TOKEN_SECRET,
     });
-    const operations = OperationsSchema.parse(operationsContent);
+    const schema = OperationsSchema as unknown as { parse: (input: unknown) => { operations: unknown[] } };
+    const parsed = schema.parse(operationsContent);
     logger.debug(
-        `Operations file parsed successfully. ${pc.bold(pc.yellow(operations.operations.length))} operation(s) found.`,
+        `Operations file parsed successfully. ${pc.bold(pc.yellow(parsed.operations.length))} operation(s) found.`,
     );
 
     const key = await uploadMassOperationFileContent(JSON.stringify(operationsContent), {