CHANGELOG.md

Changelog

All notable changes to this project will be documented in this file.

[5.31.0]

• bumped @crystallize/js-api-client to ^7.3.0 and @crystallize/schema to ^6.13.0

[5.30.0]

• reverse-DNS identifier
• optional plugin URL renamed from vendor url
• fix docs link

[5.28.0]

• added plugin create <folder> [skeleton-identifier] command to scaffold a new Crystallize plugin from a selectable git skeleton: downloads the skeleton tarball (re-rooting an optional monorepo subfolder), generates an RSA JWK keypair (reusing plugin keygen's generator, writing public.jwk.json 0644 / private.jwk.json 0600 and ensuring private.jwk.json is gitignored even in a fresh non-git folder), substitutes mustache tokens, and installs dependencies. Interactive Ink journey by default; fully scriptable headless path via --no-interactive (--name, --identifier, --author, --vendor-url, --bits, --kid, --no-install).
• plugin create token substitution covers file contents and file/directory names across the scaffold (skipping node_modules/.git, binary files, and symlinks): {{plugin_name}}, {{plugin_identifier}}, {{author_name}}, {{vendor_url}}, {{public_jwk}}, {{private_jwk}}, {{kid}}.
• plugin create materializes *.dist templates to their final filenames before token substitution (e.g. .env.dist → .env, dev-payload.config.jsonc.dist → dev-payload.config.jsonc), without overwriting an existing target, so the generated files receive their tokens too.
• the no-lockfile dependency-install default for plugin create is npm (lockfiles still auto-detect bun/pnpm/npm/yarn).
• added bash completion for the new plugin create command.

[5.27.0]

• bumped @crystallize/js-api-client to ^7.2.0 (renamed signature → signatureStatus, backendToken → backendTokenStatus on the decrypter result; envelope.config → envelope.configuration; new tenantId, event, signatureSecret, staticAuthToken fields on CrystallizePluginPayload) and bumped jose to ^6 (drops the KeyLike re-export in favor of native CryptoKey).
• plugin decrypt-payload lean output now dumps every protocol section the payload carries: [Envelope] (tenantId / tenantIdentifier / installationId / pluginIdentifier / revisionId / event), [Configuration], [Context], [Secrets], [Plugin Tokens] (signatureSecret / staticAuthToken), [JWT] (envelope iss / aud / sub / iat / nbf / exp / jti) and [Backend Token] — sections only render when present, so webhook vs iframe variants stay scannable.
• plugin decrypt-payload lean output formats iat / nbf / exp claims as <unix-seconds> (<ISO-8601>) for at-a-glance freshness checks.

[5.26.0]

• added plugin encrypt-secret command to encrypt a single secret value with a vendor public JWK (RSA-OAEP-256 / A256GCM), producing a compact JWE on stdout — the same shape Crystallize's UI generates for an envelope.encryptedSecrets[fieldName] entry; useful for local dev / testing where the UI is not in the loop. Plaintext can be passed via --value, piped on stdin, or pasted interactively. Output round-trips through plugin decrypt-payload with the matching private JWK.
• plugin encrypt-secret rejects private JWKs (those carrying d) and non-RSA keys with exit 2, so a private.jwk.json cannot be passed by mistake.
• added bash completion for the new plugin encrypt-secret command.

[5.25.0]

• added plugin keygen command to generate an RSA JWK keypair (RSA-OAEP-256 / A256GCM) for a Crystallize plugin revision; writes public.jwk.json (0644) and private.jwk.json (0600) or emits both to stdout with --stdout; refuses to clobber existing files without --force (exit 3) and offers to add the private file to a discovered .gitignore
• added plugin decrypt-payload command implementing the full Crystallize plugin payload protocol: outer JWE → inner JWS (RS256) verification against a JWKS → per-field encryptedSecrets decryption → optional backendToken verification (--verify-backend-token); payload can be pasted interactively, piped on stdin, or passed with --payload; signature failures are non-fatal — the envelope + secrets are still reported with the failure reason so you can inspect untrusted payloads against mock issuers. The decrypt pipeline itself is delegated to createPluginPayloadDecrypter from @crystallize/js-api-client.
• plugin decrypt-payload default output is a lean human view ([Secrets], [Configuration], [Context], [Token]); pass --json for the full structured document (protected headers, envelope claims, signature status, backend token status) and -v/--verbose for the "no applicable key" diagnostic (inner JWS kid/alg vs JWKS)
• plugin decrypt-payload auto-derives --jwks-url and --issuer from the CRYSTALLIZE_ENVIRONMENT env var (prod: https://api.crystallize.com, staging: https://api-dev.crystallize.digital); pass --audience <plugin-id> to enable verification. JWKS can alternatively be loaded from a local file via --jwks-file (offline / local-dev friendly).
• added bash completion for the new plugin keygen and plugin decrypt-payload commands
• bumped @crystallize/js-api-client to ^7.0.0 and @crystallize/schema to ^6.12.0
• added jose as a runtime dependency (used by plugin keygen)

[5.24.0]

• added mass-operation validate command to locally validate a Mass Operation file against the schema, with per-operation grouped error display and non-zero exit on failure (no credentials or network required, CI-friendly)

[5.23.1]

• fix mass-operation dump-content-model generating thousands of duplicate shape/create and piece/create placeholders on tenants with cyclic content models (cycles are now deduplicated across the whole graph, and adjacency edges are deduplicated)

[5.23.0]

• added update command to self-update the CLI binary in-place
• startup update notification now hints at crystallize update instead of showing the curl reinstall command

[5.22.1]

• fix dump mass-operation dump-content-model command when the tenant has no Piece.

[5.22.0]

• added add-mcp command to add the Crystallize MCP server to your environment
• added add-skills command to add Crystallize AI skills
• added update-skills command to update Crystallize AI skills
• added bash completion for serve, add-mcp, add-skills, update-skills commands
• bumped @crystallize/schema to 6.11.0
• updated libraries (awilix, commander, ink, jotai, marked, meow, tar, zod, TypeScript 6)
• moved from prettier to oxfmt for code formatting

[5.21.1]

• update the version checker to fetch the remote changelog file instead and get proper changes.

[5.21.0]

• display operation logs in real-time during mass-operation run, with color-coded status and a final drain to ensure all logs are shown

[5.20.0]

• bump the schema lib to 6.9.0
• add a new mass-operation add-operation command to help people create their mass operation file.

[5.15.0]

• bump the schema lib to 6.8.0

[5.14.0]

• bump the schema lib to 6.7.0

[5.13.0]

• bump the schema lib to 6.6.0

[5.12.0]

• bump the schema lib to 6.5.0
• adding a new check on start to check if the CLI running version is the last one

[5.11.4]

• bump the schema lib to 6.3.4

[5.11.4]

• bump the libs for pricelists fix

[5.11.3]

• really bump the libs for topics

[5.11.2]

• really bump the libs.

[5.11.1]

• really bump the libs.

[5.11.0]

• bump libs and schema lib to 6.0.0.

[5.10.1]

• bump libs and schema lib to 5.3.

[5.10.0]

• add an option to dump the model without any item id references.

[5.9.3]

• bump libs and schema lib to 5.2.

[5.9.2]

• bump libs and schema lib to 5.1.

[5.9.1]

• added more errors on the serve command when authentication is failing.

[5.9.0]

• piece name are now maintained in the content model dump.

[5.8.2]

• move a log to a debug log.

[5.8.1]

• allow relative path in bynary uploads.

[5.8.0]

• update libs.
• use new js-api-client.
• handle file uploads in extra mutations.

[5.7.6]

• adds codes to messages that are streamed to FE while tenant is being updated with selected template.

[5.7.5]

• schema 4.0.0
• compatible with Mass Operations for Customers.

[5.7.4]

• replace all iteration of the placeholders in the install process.

[5.7.3]

• Enable CORS.

[5.7.2]

• Expose the Crystallize Env in the web server default response.

[5.7.1]

• simplify building.

[5.7.0]

• expose the CLI enroll command.
• add the enroll command.

[5.6.0]

• bumping libs.

[5.5.0]

• bump Bun version to 1.2.4.
• call the bashcompinit if complete does not exist in the shell for autocompletion.

[5.4.6]

• really fixing typo introduced in 5.4.4.

[5.4.5]

• fix typo introduced in 5.4.4.

[5.4.4]

• adding the product configurator boilerplate.
• a bit more messages on the install trace.

[5.4.3]

• fix the completion file.
• add documentation.
• add doc command.

[5.4.2]

• add the Furnitut boilerplate.

[5.4.1]

• Fix duplicates in the content model dump.

[5.4.0]

• add a command to upload assets.
• add a command to execute mutations with dependencies.

[5.3.0]

• fix tenantId that was not setup on the .env file after installation.
• add discovery api tenant ignition.

[5.2.2]

• fix bug introduced in the 5.2.1 for tenant create command.

[5.2.1]

• capability to replace Root Tenant Id and Vat Type in the install process from the extra mutation.

[5.2.0]

Added

• new boilerplates
• dump content model as Mass Operations.
• create invite(s) command.
• get Shop Auth token command.
• get Static Auth token command.
• get Pim Auth token command.

Fixed

• added missing tenant in the completion command list.

[5.1.0]

Added

• CHANGELOG.md file is not present and can be used.
• add the changelog command.
• script completion file is installed on program run, and the install bash is reloading the SHELL.
• create tenant command.

Changed

• revamped the command organization. (BC).

[5.0.1]

Added

• (internal) Make it work on the Crystallize Staging environement.

[5.0.0]

This is the new version that will live in the future, built on top of Bun.js it is shipped through Github and does not require anything on the user side.

Added

• login command to save your credentials ~/.crystallize/credentials.json.
• whoami tells you who is logged-in via ~/.crystallize/credentials.json.
• (wip) install-boilerplate to install boilerplates.
• run-mass-operation to run Mass Operation files.

[4.x]

The 4.x version called @crystallize/cli-next, hosted in NPMJS is now deprecated, it was mainly used to install boilerplates, dump and import. tenant data. It was using @crystallize/import-utilities which is now deprecated in favor of Mass Operation.

[3.x]

The 3.x version called @crystallize/cli, hosted in NPMJS is now deprecated, it was mainly used to install old-legacy boilerplates.