@ggui-ai/cli 0.1.0-rc.1

package/dist/internal/ggui-json.d.ts

@@ -0,0 +1,53 @@
+/** Canonical filename — duplicated from `@ggui-ai/project-config` so
+ * this helper stays free of that dependency. The constant lives in one
+ * place per package; updates ride along on a project-config bump. */
+export declare const GGUI_JSON_FILENAME = "ggui.json";
+/** How many parent directories to walk before giving up. Mirrors the
+ * convention used by `gadget-search.ts#findGguiJson` + the upstream
+ * `@ggui-ai/project-config/node` helper. */
+export declare const FIND_MAX_DEPTH = 8;
+/**
+ * Walk up from `startDir` looking for the first `ggui.json` ancestor.
+ * Returns the absolute path or `null` if none found within
+ * {@link FIND_MAX_DEPTH} parent directories.
+ *
+ * Mirrors the algorithm in `@ggui-ai/project-config/node`'s
+ * `findGguiJson`. Duplicated here (rather than imported) so the
+ * publish/install/search subcommands don't pull the full project-config
+ * dependency tree — the boundary justification matches the existing
+ * `gadget-search.ts` rationale.
+ */
+export declare function findGguiJson(startDir: string): string | null;
+/**
+ * Object shape of a successfully-decoded ggui.json. Always a plain
+ * JSON object at the root — arrays / scalars / null are rejected by
+ * the schema-side parser at boot, but this helper is structural so we
+ * narrow to "object-or-die" explicitly.
+ */
+export type GguiJsonObject = {
+    [key: string]: unknown;
+};
+/**
+ * Read + structurally validate a ggui.json file from a known path.
+ * Returns the decoded JSON object on success or a descriptive error
+ * string. The shape is left as `GguiJsonObject` (string-keyed unknown)
+ * because callers walk the tree by path; running the full
+ * `@ggui-ai/project-config` parser here would couple gadget-install
+ * to the entire manifest's schema posture.
+ */
+export declare function readGguiJson(path: string): {
+    value: GguiJsonObject;
+} | {
+    error: string;
+};
+/**
+ * Write a decoded ggui.json back to disk. Preserves a 2-space indent
+ * with a trailing newline — matches the formatting `prettier` would
+ * apply, so the gadget-install diff stays minimal in operator repos
+ * that run prettier on commit. We do NOT round-trip JSON5 / comments
+ * (ggui.json is plain JSON per `@ggui-ai/project-config`); any
+ * pre-existing comments would have failed the original `JSON.parse`
+ * already.
+ */
+export declare function writeGguiJson(path: string, value: GguiJsonObject): void;
+//# sourceMappingURL=ggui-json.d.ts.map

package/dist/internal/ggui-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ggui-json.d.ts","sourceRoot":"","sources":["../../src/internal/ggui-json.ts"],"names":[],"mappings":"AAqBA;;qEAEqE;AACrE,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;4CAE4C;AAC5C,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU5D;AAED;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAyB/C;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,IAAI,CAEvE"}

package/dist/internal/ggui-json.js

@@ -0,0 +1,92 @@
+/**
+ * Minimal ggui.json read/write helpers shared by gadget subcommands.
+ *
+ * Shared by the publish and install subcommands so neither has to
+ * duplicate the path-walk + JSON IO scaffolding. The parser is
+ * deliberately structural (no schema parse): install touches
+ * `app.gadgets` only, so a malformed `theme` block elsewhere in the
+ * file shouldn't prevent an install from rewriting the array.
+ *
+ * The shape returned is the raw decoded JSON. Callers narrow the
+ * sub-objects they touch (e.g. `app.gadgets`) and run the
+ * full schema parser themselves if they want round-trip validation —
+ * keeps this helper minimal + zero-dep against `@ggui-ai/project-config`.
+ */
+import { existsSync, readFileSync, writeFileSync, } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+/** Canonical filename — duplicated from `@ggui-ai/project-config` so
+ * this helper stays free of that dependency. The constant lives in one
+ * place per package; updates ride along on a project-config bump. */
+export const GGUI_JSON_FILENAME = 'ggui.json';
+/** How many parent directories to walk before giving up. Mirrors the
+ * convention used by `gadget-search.ts#findGguiJson` + the upstream
+ * `@ggui-ai/project-config/node` helper. */
+export const FIND_MAX_DEPTH = 8;
+/**
+ * Walk up from `startDir` looking for the first `ggui.json` ancestor.
+ * Returns the absolute path or `null` if none found within
+ * {@link FIND_MAX_DEPTH} parent directories.
+ *
+ * Mirrors the algorithm in `@ggui-ai/project-config/node`'s
+ * `findGguiJson`. Duplicated here (rather than imported) so the
+ * publish/install/search subcommands don't pull the full project-config
+ * dependency tree — the boundary justification matches the existing
+ * `gadget-search.ts` rationale.
+ */
+export function findGguiJson(startDir) {
+    let dir = resolve(startDir);
+    for (let i = 0; i <= FIND_MAX_DEPTH; i++) {
+        const candidate = join(dir, GGUI_JSON_FILENAME);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+    return null;
+}
+/**
+ * Read + structurally validate a ggui.json file from a known path.
+ * Returns the decoded JSON object on success or a descriptive error
+ * string. The shape is left as `GguiJsonObject` (string-keyed unknown)
+ * because callers walk the tree by path; running the full
+ * `@ggui-ai/project-config` parser here would couple gadget-install
+ * to the entire manifest's schema posture.
+ */
+export function readGguiJson(path) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8');
+    }
+    catch (err) {
+        return {
+            error: `failed to read ${path}: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(raw);
+    }
+    catch (err) {
+        return {
+            error: `${path} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (decoded === null || typeof decoded !== 'object' || Array.isArray(decoded)) {
+        return { error: `${path} is not a JSON object` };
+    }
+    return { value: decoded };
+}
+/**
+ * Write a decoded ggui.json back to disk. Preserves a 2-space indent
+ * with a trailing newline — matches the formatting `prettier` would
+ * apply, so the gadget-install diff stays minimal in operator repos
+ * that run prettier on commit. We do NOT round-trip JSON5 / comments
+ * (ggui.json is plain JSON per `@ggui-ai/project-config`); any
+ * pre-existing comments would have failed the original `JSON.parse`
+ * already.
+ */
+export function writeGguiJson(path, value) {
+    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, 'utf-8');
+}

package/dist/internal/key-store.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Resolve the default private-key path for an npm scope.
+ *
+ *   - `@mapbox/foo-gadget` → `~/.ggui/keys/@mapbox/private.key`
+ *   - `@you/widgets`       → `~/.ggui/keys/@you/private.key`
+ *
+ * The `artifactId` argument is the full `<scope>/<name>`; this helper
+ * strips the name and uses the scope.
+ */
+export declare function getPrivateKeyPath(scope: string): string;
+export declare function getPublicKeyPath(scope: string): string;
+/**
+ * Extract the npm scope from a `<scope>/<name>` artifactId. Throws on
+ * malformed input — the parser layer should have caught it first.
+ */
+export declare function scopeOf(artifactId: string): string;
+/**
+ * Read a raw 32-byte private key from disk. Returns null when the
+ * file does not exist (the caller decides whether to generate vs.
+ * error). Throws when the file exists but is the wrong length —
+ * silent truncation would produce a broken signature.
+ */
+export declare function readPrivateKey(path: string): Uint8Array | null;
+/**
+ * Write a 32-byte private key to disk with mode `0o600` + an
+ * accompanying public-key file alongside. Atomic via write-temp +
+ * rename so a crash mid-write doesn't strand a partial blob.
+ */
+export declare function writePrivateKey(scope: string, privateKey: Uint8Array, publicKey: Uint8Array): void;
+/**
+ * Returns true when both halves exist on disk for `scope`. Used by
+ * the publish flow to decide between "load existing" vs. "generate
+ * new + register".
+ */
+export declare function hasKeypair(scope: string): boolean;
+/**
+ * stat helper — exported for tests that want to assert mode bits
+ * survived the round-trip.
+ */
+export declare function statPrivateKey(scope: string): {
+    mode: number;
+} | null;
+//# sourceMappingURL=key-store.d.ts.map

package/dist/internal/key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-store.d.ts","sourceRoot":"","sources":["../../src/internal/key-store.ts"],"names":[],"mappings":"AA6BA;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAQlD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAS9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,UAAU,EACtB,SAAS,EAAE,UAAU,GACpB,IAAI,CAyBN;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAKrE"}

package/dist/internal/key-store.js

@@ -0,0 +1,128 @@
+/**
+ * Local Ed25519 signing-key store for `ggui gadget publish`.
+ *
+ * Layout: `~/.ggui/keys/<scope>/private.key` (raw 32-byte seed) +
+ * `public.key` next to it (raw 32-byte public). One directory per
+ * npm scope so an author publishing multiple gadgets under the same
+ * scope reuses one key; switching scopes generates a new keypair on
+ * next first-publish.
+ *
+ * **Why raw bytes.** PEM/JWK wrappers add format-decode failure
+ * modes. The signer in `gadget-signing.ts` consumes raw seeds; the
+ * round-trip is "read 32 bytes → sign". Operators copying keys
+ * between machines `cat`-with-mode-0600 the file.
+ *
+ * **Mode 0o600.** Same discipline as `~/.ggui/auth.json` — the
+ * private key is a secret equivalent to a long-lived password.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { getConfigDir } from '../paths.js';
+/**
+ * Resolve the default private-key path for an npm scope.
+ *
+ *   - `@mapbox/foo-gadget` → `~/.ggui/keys/@mapbox/private.key`
+ *   - `@you/widgets`       → `~/.ggui/keys/@you/private.key`
+ *
+ * The `artifactId` argument is the full `<scope>/<name>`; this helper
+ * strips the name and uses the scope.
+ */
+export function getPrivateKeyPath(scope) {
+    const dir = join(getConfigDir(), 'keys', scope);
+    return join(dir, 'private.key');
+}
+export function getPublicKeyPath(scope) {
+    const dir = join(getConfigDir(), 'keys', scope);
+    return join(dir, 'public.key');
+}
+/**
+ * Extract the npm scope from a `<scope>/<name>` artifactId. Throws on
+ * malformed input — the parser layer should have caught it first.
+ */
+export function scopeOf(artifactId) {
+    const slash = artifactId.indexOf('/');
+    if (slash === -1 || !artifactId.startsWith('@')) {
+        throw new Error(`key-store: artifactId must be \`<scope>/<name>\` (got ${artifactId})`);
+    }
+    return artifactId.slice(0, slash);
+}
+/**
+ * Read a raw 32-byte private key from disk. Returns null when the
+ * file does not exist (the caller decides whether to generate vs.
+ * error). Throws when the file exists but is the wrong length —
+ * silent truncation would produce a broken signature.
+ */
+export function readPrivateKey(path) {
+    if (!existsSync(path))
+        return null;
+    const buf = readFileSync(path);
+    if (buf.length !== 32) {
+        throw new Error(`key-store: ${path} is not a 32-byte Ed25519 seed (got ${buf.length} bytes)`);
+    }
+    return new Uint8Array(buf);
+}
+/**
+ * Write a 32-byte private key to disk with mode `0o600` + an
+ * accompanying public-key file alongside. Atomic via write-temp +
+ * rename so a crash mid-write doesn't strand a partial blob.
+ */
+export function writePrivateKey(scope, privateKey, publicKey) {
+    if (privateKey.length !== 32) {
+        throw new Error(`key-store: private key must be 32 bytes (got ${privateKey.length})`);
+    }
+    if (publicKey.length !== 32) {
+        throw new Error(`key-store: public key must be 32 bytes (got ${publicKey.length})`);
+    }
+    const privPath = getPrivateKeyPath(scope);
+    const pubPath = getPublicKeyPath(scope);
+    const dir = dirname(privPath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    else {
+        try {
+            chmodSync(dir, 0o700);
+        }
+        catch {
+            // best-effort
+        }
+    }
+    writeAtomic(privPath, Buffer.from(privateKey), 0o600);
+    writeAtomic(pubPath, Buffer.from(publicKey), 0o644);
+}
+/**
+ * Returns true when both halves exist on disk for `scope`. Used by
+ * the publish flow to decide between "load existing" vs. "generate
+ * new + register".
+ */
+export function hasKeypair(scope) {
+    return existsSync(getPrivateKeyPath(scope));
+}
+/**
+ * stat helper — exported for tests that want to assert mode bits
+ * survived the round-trip.
+ */
+export function statPrivateKey(scope) {
+    const path = getPrivateKeyPath(scope);
+    if (!existsSync(path))
+        return null;
+    const s = statSync(path);
+    return { mode: s.mode };
+}
+function writeAtomic(target, bytes, mode) {
+    const tmp = `${target}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, bytes, { mode });
+    try {
+        chmodSync(tmp, mode);
+    }
+    catch {
+        // best-effort
+    }
+    renameSync(tmp, target);
+    try {
+        chmodSync(target, mode);
+    }
+    catch {
+        // best-effort
+    }
+}

package/dist/internal/oidc-token.d.ts

@@ -0,0 +1,52 @@
+export interface OidcResolveOptions {
+    /** `--identity-token <jwt>` flag value (cosign convention). */
+    readonly identityTokenFlag?: string;
+    /** Environment snapshot — keeps the resolver pure for tests. */
+    readonly env: NodeJS.ProcessEnv;
+    /** Is stdout attached to a TTY? Gates the interactive browser flow. */
+    readonly isTty: boolean;
+    /**
+     * Override the issuer for the interactive flow. Default:
+     * `https://oauth2.sigstore.dev/auth`.
+     */
+    readonly issuer?: string;
+    /**
+     * Test seam: when `false`, skip the interactive flow entirely + throw
+     * `no_token_available` instead. Production callers leave it `true`
+     * (or omit it).
+     */
+    readonly interactive?: boolean;
+    /** Test seam: inject `fetch`. Production = `globalThis.fetch`. */
+    readonly fetch?: typeof fetch;
+    /** Test seam: write status lines. Production = `process.stdout.write`. */
+    readonly stdout?: (line: string) => void;
+    /**
+     * Test seam: ask the operator for a value (used by the non-TTY
+     * fallback inside the interactive branch). Production = stdin prompt.
+     */
+    readonly prompt?: (label: string) => Promise<string>;
+    /**
+     * Test seam: open the issuer URL in the operator's browser. Production
+     * prints the URL + relies on the user clicking it. The `open` package
+     * isn't a workspace dep yet, so the default impl just prints — this
+     * seam lets tests + future wiring swap it.
+     */
+    readonly openBrowser?: (url: string) => Promise<void>;
+}
+export interface OidcResolveResult {
+    /** The resolved OIDC token (JWT). */
+    readonly token: string;
+    /** Where the token came from. */
+    readonly source: 'flag' | 'env' | 'github-actions' | 'interactive';
+}
+/**
+ * Sentinel error thrown when no OIDC source produces a usable token.
+ * Carries a `code` discriminant so callers can map back into a
+ * structured `PublishError`.
+ */
+export declare class OidcResolutionError extends Error {
+    readonly code: 'no_token_available' | 'github_actions_fetch_failed' | 'interactive_failed';
+    constructor(code: 'no_token_available' | 'github_actions_fetch_failed' | 'interactive_failed', message: string);
+}
+export declare function resolveOidcToken(opts: OidcResolveOptions): Promise<OidcResolveResult>;
+//# sourceMappingURL=oidc-token.d.ts.map

package/dist/internal/oidc-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-token.d.ts","sourceRoot":"","sources":["../../src/internal/oidc-token.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,kBAAkB;IACjC,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,iBAAiB;IAChC,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,GAAG,gBAAgB,GAAG,aAAa,CAAC;CACpE;AAED;;;;GAIG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EACT,oBAAoB,GACpB,6BAA6B,GAC7B,oBAAoB,CAAC;gBAEvB,IAAI,EACA,oBAAoB,GACpB,6BAA6B,GAC7B,oBAAoB,EACxB,OAAO,EAAE,MAAM;CAMlB;AAWD,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAgD5B"}