@adobe/aem-cli 16.17.1 → 16.18.1

package/src/content/da-api.js

@@ -0,0 +1,198 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import mime from 'mime';
+import processQueue from '@adobe/helix-shared-process-queue';
+import { getFetch } from '../fetch-utils.js';
+import { CONTENT_IO_CONCURRENCY } from './content-shared.js';
+
+const DA_ADMIN = 'https://admin.da.live';
+
+/** Response header used to page past the per-request list limit (e.g. 1000 items). */
+const LIST_CONTINUATION_HEADER = 'da-continuation-token';
+
+/** Safety cap on list pages per directory (avoids infinite loops if the API misbehaves). */
+const LIST_MAX_PAGES = 50000;
+
+export function getContentType(ext) {
+  return mime.getType(ext) || 'application/octet-stream';
+}
+
+export class DaClient {
+  constructor(token) {
+    this.token = token;
+    this.fetch = getFetch(false);
+  }
+
+  get authHeader() {
+    return { Authorization: `Bearer ${this.token}` };
+  }
+
+  /**
+   * Lists the contents of a directory, following {@link LIST_CONTINUATION_HEADER} until complete.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath - path starting with /
+   * @returns {Promise<Array<{path, name, ext?, lastModified}>>}
+   */
+  async list(org, repo, daPath) {
+    const url = `${DA_ADMIN}/list/${org}/${repo}${daPath}`;
+    const aggregated = [];
+    let continuation = null;
+
+    for (let page = 0; page < LIST_MAX_PAGES; page += 1) {
+      const headers = { ...this.authHeader };
+      if (continuation) {
+        headers[LIST_CONTINUATION_HEADER] = continuation;
+      }
+      // eslint-disable-next-line no-await-in-loop
+      const res = await this.fetch(url, { headers });
+      if (res.status === 401) {
+        throw new Error('Unauthorized: invalid or missing token');
+      }
+      if (!res.ok) {
+        throw new Error(`List failed for ${daPath}: ${res.status} ${res.statusText}`);
+      }
+      // eslint-disable-next-line no-await-in-loop
+      const body = await res.json();
+      if (!Array.isArray(body)) {
+        throw new Error(`List response for ${daPath} must be a JSON array`);
+      }
+      aggregated.push(...body);
+
+      const next = res.headers.get(LIST_CONTINUATION_HEADER);
+      if (!next || next === continuation) {
+        return aggregated;
+      }
+      continuation = next;
+    }
+
+    return aggregated;
+  }
+
+  /**
+   * Recursively lists all files under a path using a non-recursive queue-based approach.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} [daPath='/']
+   * @param {(discoveredCount: number) => void} [onDiscovered] - cumulative file count per discovery
+   * @returns {Promise<Array<{path, name, ext, lastModified}>>}
+   */
+  async listAll(org, repo, daPath = '/', onDiscovered = undefined) {
+    const prefix = `/${org}/${repo}`;
+    const files = [];
+    let dirsToProcess = [daPath];
+
+    while (dirsToProcess.length > 0) {
+      const nextDirs = [];
+      // eslint-disable-next-line no-await-in-loop
+      await processQueue(
+        dirsToProcess,
+        async (currentPath) => {
+          const items = await this.list(org, repo, currentPath);
+          for (const item of items) {
+            if (item.ext !== undefined) {
+              files.push(item);
+              if (onDiscovered) {
+                onDiscovered(files.length);
+              }
+            } else {
+              nextDirs.push(item.path.replace(prefix, '') || '/');
+            }
+          }
+        },
+        CONTENT_IO_CONCURRENCY,
+      );
+      dirsToProcess = nextDirs;
+    }
+
+    return files;
+  }
+
+  /**
+   * Fetches the raw content of a file.
+   * @returns {Promise<Response|null>}
+   */
+  async getSource(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, { headers: this.authHeader });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (res.status === 404) {
+      return null;
+    }
+    if (!res.ok) {
+      throw new Error(`GET failed for ${daPath}: ${res.status} ${res.statusText}`);
+    }
+    return res;
+  }
+
+  /**
+   * Uploads a file via PUT.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath
+   * @param {Buffer} buffer
+   * @param {string} contentType
+   * @returns {Promise<object>} API response body
+   */
+  async putSource(org, repo, daPath, buffer, contentType) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, {
+      method: 'PUT',
+      headers: { ...this.authHeader, 'Content-Type': contentType },
+      body: buffer,
+    });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (!res.ok) {
+      throw new Error(`PUT failed for ${daPath}: ${res.status} ${res.statusText}`);
+    }
+    return res.json();
+  }
+
+  /**
+   * Deletes a file or folder. Idempotent.
+   */
+  async deleteSource(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, {
+      method: 'DELETE',
+      headers: this.authHeader,
+    });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    return res.ok || res.status === 204;
+  }
+
+  /**
+   * Returns the current lastModified for a file via a HEAD request.
+   * @param {string} org
+   * @param {string} repo
+   * @param {string} daPath - e.g. /blog/post.html
+   * @returns {Promise<number|null>}
+   */
+  async getRemoteLastModified(org, repo, daPath) {
+    const url = `${DA_ADMIN}/source/${org}/${repo}${daPath}`;
+    const res = await this.fetch(url, { method: 'HEAD', headers: this.authHeader });
+    if (res.status === 401) {
+      throw new Error('Unauthorized: invalid or missing token');
+    }
+    if (!res.ok) {
+      return null;
+    }
+    const lastModified = res.headers.get('last-modified');
+    return lastModified ? new Date(lastModified).getTime() : null;
+  }
+}

package/src/content/da-auth.js

@@ -0,0 +1,209 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import http from 'http';
+import path from 'path';
+import fse from 'fs-extra';
+import open from 'open';
+import { ensureGitIgnored } from './content-git.js';
+
+const IMS_ORIGIN = 'https://ims-na1.adobelogin.com';
+const CLIENT_ID = 'darkalley';
+const SCOPE = 'ab.manage,AdobeID,gnav,openid,org.read,read_organizations,session,aem.frontend.all,additional_info.ownerOrg,additional_info.projectedProductContext,account_cluster.read';
+const CALLBACK_PORT = 9898;
+const REDIRECT_URI = `http://localhost:${CALLBACK_PORT}/callback`;
+
+/** Token file stored in the project's .hlx folder, alongside the site token. */
+export const DA_TOKEN_FILE = path.join('.hlx', '.da-token.json');
+
+// ─── Token storage ───────────────────────────────────────────────────────────
+
+async function loadStoredToken(tokenFile) {
+  if (!await fse.pathExists(tokenFile)) {
+    return null;
+  }
+  try {
+    return await fse.readJson(tokenFile);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Saves the DA token to the project's .hlx folder and ensures the file is git-ignored,
+ * following the same pattern as saveSiteTokenToFile in config-utils.js.
+ * @param {string} projectDir
+ * @param {object} tokenData
+ */
+async function saveDaTokenToFile(projectDir, tokenData) {
+  const tokenFile = path.join(projectDir, DA_TOKEN_FILE);
+  await fse.ensureDir(path.dirname(tokenFile));
+  await fse.writeJson(tokenFile, tokenData, { spaces: 2 });
+
+  await ensureGitIgnored(projectDir, DA_TOKEN_FILE);
+}
+
+// ─── Token validity ──────────────────────────────────────────────────────────
+
+function isTokenExpired(stored) {
+  if (stored.expires_at) {
+    // 60 second early buffer for clock skew
+    return Date.now() >= (stored.expires_at - 60_000);
+  }
+  // legacy stored tokens without expires_at — treat as expired
+  return true;
+}
+
+// ─── OAuth flow ──────────────────────────────────────────────────────────────
+
+/**
+ * Starts a local HTTP server that handles the implicit flow callback.
+ *
+ * IMS redirects to http://localhost:{port}/callback#access_token=TOKEN
+ * The fragment never reaches the server, so /callback serves a tiny HTML page
+ * that reads the fragment via JS and forwards the token to /token, then
+ * redirects the browser to https://tools.aem.live/cli/logged-in on success.
+ *
+ * @returns {Promise<{token: string, expiresIn: number|null}>}
+ */
+function waitForToken() {
+  return new Promise((resolve, reject) => {
+    let timeout;
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
+
+      // Step 1: IMS lands here with the token in the fragment.
+      // Serve a page that extracts it and calls /token.
+      if (url.pathname === '/callback') {
+        res.writeHead(200, { 'Content-Type': 'text/html' });
+        res.end(`<!DOCTYPE html><html><head><title>Logging in...</title></head><body>
+<script>
+  const p = new URLSearchParams(window.location.hash.substring(1));
+  const token = p.get('access_token');
+  const expiresIn = p.get('expires_in');
+  const error = p.get('error');
+  const dest = token
+    ? '/token?access_token=' + encodeURIComponent(token) + (expiresIn ? '&expires_in=' + encodeURIComponent(expiresIn) : '')
+    : '/token?error=' + encodeURIComponent(error || 'unknown');
+  const loggedInUrl = 'https://tools.aem.live/cli/logged-in';
+  if (!token) {
+    fetch(dest);
+    document.body.innerHTML = '<h2>Login failed.</h2>';
+    const errP = document.createElement('p');
+    errP.textContent = error || 'Unknown error';
+    document.body.appendChild(errP);
+  } else {
+    fetch(dest)
+      .then(() => { window.location.href = loggedInUrl; })
+      .catch(() => {
+        document.body.innerHTML = '<h2>Login failed.</h2><p>Could not complete login.</p>';
+      });
+  }
+</script></body></html>`);
+        return;
+      }
+
+      // Step 2: the page above calls /token with the token as a query param.
+      if (url.pathname === '/token') {
+        const token = url.searchParams.get('access_token');
+        const expiresIn = url.searchParams.get('expires_in');
+        const error = url.searchParams.get('error');
+        res.writeHead(200);
+        res.end();
+        clearTimeout(timeout);
+        server.close();
+        if (token) {
+          resolve({ token, expiresIn: expiresIn ? parseInt(expiresIn, 10) : null });
+        } else {
+          reject(new Error(`Login failed: ${error || 'unknown error'}`));
+        }
+        return;
+      }
+
+      res.writeHead(404);
+      res.end();
+    });
+
+    server.listen(CALLBACK_PORT, 'localhost');
+    server.on('error', (err) => reject(new Error(`Could not start callback server on port ${CALLBACK_PORT}: ${err.message}`)));
+
+    timeout = setTimeout(() => {
+      server.close();
+      reject(new Error('Login timed out (5 minutes). Please try again.'));
+    }, 5 * 60 * 1000);
+  });
+}
+
+/**
+ * Runs the implicit OAuth login flow.
+ * @param {object} log
+ * @param {string} projectDir
+ * @returns {Promise<string>} access token
+ */
+async function login(log, projectDir) {
+  const params = new URLSearchParams({
+    response_type: 'token',
+    client_id: CLIENT_ID,
+    scope: SCOPE,
+    redirect_uri: REDIRECT_URI,
+  });
+  const authUrl = `${IMS_ORIGIN}/ims/authorize/v2?${params}`;
+
+  log.info('Opening browser for da.live login...');
+  log.info(`If the browser does not open automatically, visit:\n  ${authUrl}\n`);
+  log.info('Waiting for login to complete...');
+
+  await open(authUrl);
+
+  const { token, expiresIn } = await waitForToken();
+
+  await saveDaTokenToFile(projectDir, {
+    access_token: token,
+    expires_at: expiresIn ? Date.now() + (expiresIn * 1000) : null,
+  });
+
+  log.info(`Login successful. Token saved to ${path.join(projectDir, DA_TOKEN_FILE)}`);
+  return token;
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────────
+
+/**
+ * Returns a valid da.live access token. Triggers browser login if needed.
+ *
+ * Priority:
+ *  1. Caller-supplied token (--token flag) — used as-is, not persisted
+ *  2. Stored token in .hlx/.da-token.json that is still valid
+ *  3. Full browser implicit login flow
+ *
+ * @param {object} log
+ * @param {string} [override] token supplied via CLI --token flag
+ * @param {string} projectDir project root directory (token stored in .hlx/ here)
+ * @returns {Promise<string>} valid access token
+ */
+export async function getValidToken(log, override, projectDir) {
+  if (override) {
+    return override;
+  }
+
+  const tokenFile = path.join(projectDir, DA_TOKEN_FILE);
+  const stored = await loadStoredToken(tokenFile);
+
+  if (stored?.access_token && !isTokenExpired(stored)) {
+    return stored.access_token;
+  }
+
+  if (stored?.access_token) {
+    log.info('Stored token has expired. Re-authenticating...');
+  }
+
+  return login(log, projectDir);
+}

package/src/content/diff.cmd.js

@@ -0,0 +1,123 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import fs from 'fs';
+import path from 'path';
+import fse from 'fs-extra';
+import git from 'isomorphic-git';
+import { createTwoFilesPatch } from 'diff';
+import chalk from 'chalk-template';
+import { DaClient } from './da-api.js';
+import { getValidToken } from './da-auth.js';
+import { CONTENT_DIR, CONFIG_FILE } from './content-shared.js';
+
+function printPatch(patch) {
+  for (const line of patch.split('\n')) {
+    if (line.startsWith('+++') || line.startsWith('---')) {
+      process.stdout.write(chalk`{bold ${line}}\n`);
+    } else if (line.startsWith('@@')) {
+      process.stdout.write(chalk`{cyan ${line}}\n`);
+    } else if (line.startsWith('+')) {
+      process.stdout.write(chalk`{green ${line}}\n`);
+    } else if (line.startsWith('-')) {
+      process.stdout.write(chalk`{red ${line}}\n`);
+    } else {
+      process.stdout.write(`${line}\n`);
+    }
+  }
+}
+
+export default class DiffCommand {
+  constructor(logger) {
+    this.log = logger;
+    this._dir = process.cwd();
+    this._filePath = null;
+  }
+
+  withDirectory(dir) {
+    this._dir = dir;
+    return this;
+  }
+
+  withToken(token) {
+    this._token = token;
+    return this;
+  }
+
+  withFilePath(filePath) {
+    this._filePath = filePath || null;
+    return this;
+  }
+
+  async run() {
+    const { log } = this;
+    const contentDir = path.resolve(this._dir, CONTENT_DIR);
+    const configPath = path.join(contentDir, CONFIG_FILE);
+
+    if (!await fse.pathExists(configPath)) {
+      throw new Error('No config found. Run \'aem content clone\' first.');
+    }
+    const { org, repo } = await fse.readJson(configPath);
+
+    const matrix = await git.statusMatrix({ fs, dir: contentDir });
+    let changedPaths = matrix
+      .filter(([, head, workdir]) => (head === 0 && workdir === 2)
+        || (head === 1 && workdir === 2)
+        || (head === 1 && workdir === 0))
+      .map(([filepath]) => `/${filepath}`);
+
+    if (this._filePath) {
+      const needle = this._filePath.startsWith('/') ? this._filePath : `/${this._filePath}`;
+      changedPaths = changedPaths.filter((p) => p === needle);
+      if (changedPaths.length === 0) {
+        log.info(`No local changes detected for ${needle}`);
+        return;
+      }
+    }
+
+    if (changedPaths.length === 0) {
+      log.info('Nothing to diff. No local changes vs last commit.');
+      return;
+    }
+
+    const token = await getValidToken(log, this._token, this._dir);
+    const client = new DaClient(token);
+
+    await Promise.all(changedPaths.map(async (daPath) => {
+      const localPath = path.join(contentDir, ...daPath.split('/').filter(Boolean));
+
+      const localBuffer = await fse.pathExists(localPath)
+        ? await fse.readFile(localPath)
+        : Buffer.from('');
+
+      const remoteRes = await client.getSource(org, repo, daPath);
+
+      const localText = localBuffer.toString('utf-8');
+      const remoteText = remoteRes ? await remoteRes.text() : '';
+
+      const patch = createTwoFilesPatch(
+        `a${daPath}`,
+        `b${daPath}`,
+        remoteText,
+        localText,
+        '',
+        '',
+        { context: 3 },
+      );
+
+      if (!patch.includes('\n@@')) {
+        return;
+      }
+
+      printPatch(patch);
+    }));
+  }
+}

package/src/content/diff.js

@@ -0,0 +1,45 @@
+/*
+ * Copyright 2026 Adobe. All rights reserved.
+ * This file is licensed to you under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License. You may obtain a copy
+ * of the License at http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under
+ * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
+ * OF ANY KIND, either express or implied. See the License for the specific language
+ * governing permissions and limitations under the License.
+ */
+import { getOrCreateLogger } from '../log-common.js';
+
+export default function diff() {
+  let executor;
+  return {
+    set executor(value) {
+      executor = value;
+    },
+    command: 'diff [path]',
+    description: 'Show diff between local and remote content',
+    builder: (yargs) => {
+      yargs
+        .positional('path', {
+          describe: 'File to diff (e.g. /blog/post.html). Diffs all modified files if omitted.',
+          type: 'string',
+        })
+        .option('token', {
+          describe: 'IMS Bearer token for da.live authentication',
+          type: 'string',
+        })
+        .help();
+    },
+    handler: async (argv) => {
+      if (!executor) {
+        const DiffCommand = (await import('./diff.cmd.js')).default;
+        executor = new DiffCommand(getOrCreateLogger(argv));
+      }
+      await executor
+        .withToken(argv.token)
+        .withFilePath(argv.path)
+        .run();
+    },
+  };
+}