@memoket-ai/cli 2.0.1

package/scripts/publish.js

@@ -0,0 +1,227 @@
+// publish.js — pick a build target (dev|test|prod), bake it, and publish to
+// npm with the chosen env baked into the tarball. Skips `prepack` so the
+// interactive choice isn't clobbered back to prod.
+//
+//   node scripts/publish.js [target] [flags]   # target optional, interactive if missing
+//   node scripts/publish.js --dry-run          # verify tarball + auth, no upload
+//
+// Flags:
+//   --dry-run           validate tarball + auth without uploading
+//   --yes               skip the pre-publish confirmation prompt
+//   --tag=<name>        npm dist-tag (default: latest). Non-latest triggers
+//                       an automatic prerelease version bump.
+//                       e.g. --tag=dev on 2.0.0 → version 2.0.1-dev.0
+//
+// LOCAL-PUBLISH GUARD: this script is intentionally blocked from doing a real
+// `npm publish` outside of CI. The IP-restricted NPM_TOKEN provides the same
+// guarantee at the network layer; this guard is a fast, local fail-safe so a
+// `node scripts/publish.js prod` on a developer machine errors immediately
+// rather than reaching npm and being rejected there. To run a real publish
+// locally, set `CI=true` (e.g. `CI=true node scripts/publish.js prod`).
+//
+// Auth (one of):
+//   - GH Actions secrets.NPM_TOKEN         (production publish path)
+//   - `CI=true` env + npm login (local dev — only effective for dry-run; live
+//     publish from a developer machine is still rejected by the IP-allowlist
+//     on the production token)
+//
+// Re-publish rules (enforced by npm):
+//   - the same version cannot be re-published; bump version in package.json first
+
+import { spawn, spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
+import { readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const root = join(__dirname, "..");
+
+const TARGETS = ["dev", "test", "prod"];
+const argv = process.argv.slice(2);
+const flagValue = (name) => {
+  const pref = `--${name}=`;
+  const hit = argv.find((a) => a.startsWith(pref));
+  return hit ? hit.slice(pref.length) : null;
+};
+const dryRun = argv.includes("--dry-run");
+const inCI = process.env.CI === "true";
+const explicitTag = flagValue("tag");
+const targetArg = argv.find((a) => !a.startsWith("--") && !a.includes("="));
+
+// Local-publish guard: block real `npm publish` from a developer machine.
+// Dry-run is always allowed (useful for "what would I publish" sanity checks).
+if (!inCI && !dryRun) {
+  console.error("✗ local publish blocked: this script only publishes from CI.");
+  console.error("  Set CI=true to override (e.g. `CI=true node scripts/publish.js prod`)");
+  console.error("  The IP-restricted NPM_TOKEN will still reject the actual upload outside GH Actions.");
+  console.error("  For a real publish, use the GitHub Actions dispatch workflow or push a release tag.");
+  process.exit(1);
+}
+
+async function promptTarget() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    console.log("Select environment to publish:");
+    for (const [i, t] of TARGETS.entries()) console.log(`  ${i + 1}) ${t}`);
+    rl.question("> ", (answer) => {
+      rl.close();
+      const idx = parseInt(answer, 10) - 1;
+      const t = TARGETS[idx];
+      if (!t) {
+        console.error(`✗ invalid choice: ${answer}`);
+        process.exit(1);
+      }
+      resolve(t);
+    });
+  });
+}
+
+const target = (targetArg ? targetArg.toLowerCase() : await promptTarget());
+
+if (!TARGETS.includes(target)) {
+  console.error(`✗ unknown publish target: ${target}`);
+  console.error(`  expected one of: ${TARGETS.join(", ")}`);
+  process.exit(1);
+}
+
+const pkgPath = join(root, "package.json");
+const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+const registry = (pkg.publishConfig && pkg.publishConfig.registry) || "https://registry.npmjs.org";
+const access = (pkg.publishConfig && pkg.publishConfig.access) || "public";
+
+// resolve dist-tag: explicit --tag wins; otherwise prompt
+let tag = explicitTag;
+if (!tag) {
+  tag = await promptTag();
+}
+if (tag !== "latest" && !/^[a-z0-9][a-z0-9._-]{0,213}$/i.test(tag)) {
+  console.error(`✗ invalid dist-tag: ${tag}`);
+  process.exit(1);
+}
+
+async function promptTag() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => {
+    console.log("Select npm dist-tag:");
+    console.log("  1) latest   (production)");
+    console.log("  2) dev      (prerelease, auto-bumps version)");
+    console.log("  3) rc       (prerelease, auto-bumps version)");
+    rl.question("> ", (answer) => {
+      rl.close();
+      const map = { 1: "latest", 2: "dev", 3: "rc" };
+      const t = map[parseInt(answer, 10)];
+      if (!t) {
+        console.error(`✗ invalid choice: ${answer}`);
+        process.exit(1);
+      }
+      resolve(t);
+    });
+  });
+}
+
+function bumpVersion(preid) {
+  // `npm version prerelease --preid=dev` mutates package.json in place
+  // 2.0.0 → 2.0.1-dev.0, then 2.0.1-dev.0 → 2.0.1-dev.1, etc.
+  const r = spawnSync("npm", ["version", "prerelease", `--preid=${preid}`, "--no-git-tag-version"], {
+    cwd: root,
+    stdio: "inherit",
+  });
+  if (r.status !== 0) {
+    console.error(`✗ npm version bump failed (exit ${r.status})`);
+    process.exit(r.status ?? 1);
+  }
+}
+
+function rollbackVersion() {
+  // restore package.json from git (the bump above is the only uncommitted change)
+  spawnSync("git", ["checkout", "--", "package.json"], { cwd: root, stdio: "ignore" });
+}
+
+function checkNotPublished(version) {
+  const r = spawnSync("npm", ["view", `${pkg.name}@${version}`, "version"], {
+    cwd: root,
+    encoding: "utf8",
+  });
+  if (r.status === 0) {
+    console.error(`✗ ${pkg.name}@${version} is already published on npm`);
+    console.error(`  bump the version or pick a different dist-tag.`);
+    process.exit(1);
+  }
+}
+
+const skipConfirm = argv.includes("--yes") || dryRun;
+
+async function confirmPublish(version) {
+  if (skipConfirm) return;
+  console.log("");
+  console.log("About to publish:");
+  console.log(`  package:   ${pkg.name}@${version}`);
+  console.log(`  target:    ${target}`);
+  console.log(`  tag:       ${tag}`);
+  console.log(`  registry:  ${registry}`);
+  console.log(`  access:    ${access}`);
+  if (dryRun) console.log("  mode:      --dry-run (no upload)");
+  console.log("");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => {
+    rl.question("Continue? [y/N] > ", resolve);
+  });
+  rl.close();
+  if (!/^y(es)?$/i.test(answer.trim())) {
+    if (tag !== "latest") rollbackVersion();
+    console.error("✗ aborted by user");
+    process.exit(1);
+  }
+}
+
+// 1) bump version if non-latest (dry-run will roll back after)
+if (tag !== "latest") {
+  bumpVersion(tag);
+}
+// re-read package.json after possible bump
+const pkgAfter = JSON.parse(readFileSync(pkgPath, "utf8"));
+const version = pkgAfter.version;
+
+checkNotPublished(version);
+
+// 2) bake the chosen env
+const build = spawn(process.execPath, [join(root, "scripts", "build.js"), target], {
+  stdio: "inherit",
+});
+build.on("exit", async (code) => {
+  if (code !== 0) {
+    console.error(`✗ build failed (exit ${code})`);
+    process.exit(code ?? 1);
+  }
+  await confirmPublish(version);
+  publish();
+});
+
+function publish() {
+  // 3) npm publish with --ignore-scripts (don't let prepack clobber our bake)
+  //    and --access public (matches package.json publishConfig).
+  //    --provenance is intentionally NOT passed: the source repo is private,
+  //    and npm refuses provenance bundles from private repos (would leak
+  //    build metadata into a public Sigstore transparency log). The package
+  //    itself is published public; only the source stays private.
+  const args = ["publish", "--ignore-scripts", `--access=${access}`];
+  if (tag !== "latest") args.push(`--tag=${tag}`);
+  if (dryRun) args.push("--dry-run");
+
+  console.log(`→ npm ${args.join(" ")}`);
+
+  const pub = spawn("npm", args, { stdio: "inherit", cwd: root });
+  pub.on("exit", (code) => {
+    if (code !== 0) {
+      console.error(`✗ npm publish failed (exit ${code})`);
+      if (dryRun && tag !== "latest") rollbackVersion();
+      process.exit(code ?? 1);
+    }
+    console.log(`✓ published ${pkgAfter.name}@${version} (tag=${tag}, target=${target})${dryRun ? " (dry-run)" : ""}`);
+    if (dryRun && tag !== "latest") {
+      rollbackVersion();
+      console.log(`→ rolled back package.json (dry-run side-effect)`);
+    }
+  });
+}

package/src/auth-basic.js

@@ -0,0 +1,65 @@
+// Non-browser login: email + password → gateway POST /auth/v1/login → save userToken to auth.json.
+// Runs alongside the existing browser OAuth login; userToken is used as a Bearer for
+// `token issue` / `/v1/api-tokens`.
+
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
+import { apiBaseFromMCPURL } from "./http-integration.js";
+
+// authPath 是 userToken 的持久化位置（长期持有；与浏览器 OAuth 的 credentials.json 分开）。
+export async function authPath() {
+  const home = process.env.HOME || process.env.USERPROFILE || "";
+  if (!home) throw new Error("cannot determine home directory");
+  const sep = process.platform === "win32" ? "\\" : "/";
+  return `${home}${sep}.memoket${sep}auth.json`;
+}
+
+async function prompt(question) {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return (await rl.question(question)).trim();
+  } finally {
+    rl.close();
+  }
+}
+
+// loginBasic 用邮箱密码换 userToken 并落库。email/password 可来自参数、环境变量或交互输入。
+export async function loginBasic(mcpURL, { email, password } = {}) {
+  email = email || process.env.MEMOKET_EMAIL || (await prompt("Email: "));
+  password = password || process.env.MEMOKET_PASSWORD || (await prompt("Password: "));
+  if (!email || !password) throw new Error("email and password are required");
+
+  const apiBase = apiBaseFromMCPURL(mcpURL);
+  const res = await fetch(`${apiBase}/auth/v1/login`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ email, password }),
+    signal: AbortSignal.timeout(30_000),
+  });
+  const text = await res.text();
+  let data = {};
+  try {
+    data = JSON.parse(text);
+  } catch {
+    /* non-json */
+  }
+  if (res.status < 200 || res.status >= 300 || !data.userToken) {
+    const detail = data?.error?.message || text || res.statusText;
+    throw new Error(`login failed (${res.status}): ${detail}`);
+  }
+
+  const p = await authPath();
+  await mkdir(p.replace(/[\\/][^\\/]*$/, ""), { recursive: true });
+  await writeFile(p, JSON.stringify({ userToken: data.userToken }, null, 2), { mode: 0o600 });
+  return p;
+}
+
+// loadUserToken 读回 userToken（无则 null）。
+export async function loadUserToken() {
+  try {
+    const p = await authPath();
+    return JSON.parse(await readFile(p, "utf8")).userToken || null;
+  } catch {
+    return null;
+  }
+}