@moloodev/cli 0.0.0-stage → 0.3.0

package/src/publish-bundle.ts

@@ -0,0 +1,149 @@
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import type { Plugin } from "esbuild";
+import { rewriteThreeLoaders } from "./three-local-loaders";
+
+const staticIcons = createRequire(import.meta.url).resolve("@moloodev/ui/kind-icon-static");
+
+export function publishBundlePlugin(): Plugin {
+  return {
+    name: "publish-bundle",
+    setup(build) {
+      build.onResolve({ filter: /\/kind-icon-load$/ }, (args) => {
+        if (!args.importer.endsWith(`${join("components", "ui", "kind-icon.tsx")}`)) return undefined;
+        return { path: staticIcons };
+      });
+      build.onLoad({ filter: /\.(?:js|mjs|cjs)$/ }, async (args) => {
+        const rewrite = rewriterFor(args.path);
+        if (rewrite === undefined) return undefined;
+        return { contents: rewrite(await readFile(args.path, "utf8")), loader: "js" };
+      });
+    },
+  };
+}
+
+function rewriterFor(pathname: string): ((source: string) => string) | undefined {
+  if (pathname.endsWith("/three/build/three.core.js")) return rewriteThreeLoaders;
+  if (pathname.endsWith("/zod/v4/core/util.js")) return rewriteZodUtil;
+  if (pathname.endsWith("/zod/v4/core/doc.js")) return rewriteZodDoc;
+  if (pathname.endsWith("/zod/v4/core/compile.js")) return rewriteZodCompile;
+  if (pathname.endsWith("/prismjs/prism.js")) return rewritePrism;
+  if (pathname.endsWith("/react-dom-server.browser.production.js")) return rewriteReactServerBind;
+  if (pathname.endsWith("/react-dom-server-legacy.browser.production.js")) return rewriteReactServerBind;
+  if (pathname.endsWith("/@e965/xlsx/xlsx.mjs")) return rewriteXlsx;
+  if (pathname.endsWith("/modern-json-react/dist/index.mjs")) return rewriteJsonSearch;
+  if (pathname.endsWith("/@xyflow/react/dist/esm/index.js")) return rewriteXyflow;
+  return undefined;
+}
+
+function rewriteZodUtil(source: string): string {
+  const from = [
+    "    try {",
+    "        const F = Function;",
+    '        new F("");',
+    "        return true;",
+    "    }",
+    "    catch (_) {",
+    "        return false;",
+    "    }",
+  ].join("\n");
+  const next = replaceOnce(source, from, "    return false;", "zod allowsEval");
+  if (next.includes("const F = Function")) throw new Error("publish bundle: zod allowsEval still probes Function");
+  return next;
+}
+
+function rewriteZodDoc(source: string): string {
+  const start = source.indexOf("    compile() {");
+  const close = source.indexOf("\n    }", start);
+  if (start < 0 || close < 0) throw new Error("publish bundle: zod doc compile() is missing");
+  const next = `${source.slice(0, start)}    compile() {\n        throw new Error("zod jit is disabled");\n    }${source.slice(close + "\n    }".length)}`;
+  if (next.includes("const F = Function")) throw new Error("publish bundle: zod doc still builds a function");
+  return next;
+}
+
+function rewriteZodCompile(source: string): string {
+  const start = source.indexOf("    const F = Function;");
+  const marker = "fn = factory(...constantValues);";
+  const end = source.indexOf(marker, start);
+  if (start < 0 || end < 0) throw new Error("publish bundle: zod compile() is missing");
+  const replacement = [
+    "    let fn;",
+    "    try {",
+    '        throw new Error("zod jit is disabled");',
+  ].join("\n");
+  const next = source.slice(0, start) + replacement + source.slice(end + marker.length);
+  if (next.includes("const F = Function") || next.includes("new F(")) {
+    throw new Error("publish bundle: zod compile() still builds a function");
+  }
+  return next;
+}
+
+function rewriteReactServerBind(source: string): string {
+  const next = replaceOnce(
+    source,
+    "var bind = Function.prototype.bind,",
+    "var bind = function (thisArg) { return this.bind.apply(this, arguments); },",
+    "react-dom server bind",
+  );
+  if (/\bFunction\b/.test(next)) throw new Error("publish bundle: react-dom server still names Function");
+  return next;
+}
+
+function rewritePrism(source: string): string {
+  const next = replaceOnce(source, "var worker = new Worker(_.filename);", "var worker = null;", "prism worker")
+    .replace("xhr.open('GET', src, true);", "error(FAILURE_EMPTY_MESSAGE); return;");
+  if (next.includes("xhr.open(")) throw new Error("publish bundle: prism file load remains");
+  if (next.includes("new Worker")) throw new Error("publish bundle: prism worker remains");
+  return next;
+}
+
+function rewriteXlsx(source: string): string {
+  const next = replaceOnce(
+    source,
+    'var out = File(fname); out.open("w"); out.encoding = "binary";',
+    'throw new Error("extendscript save is unavailable");',
+    "xlsx save",
+  );
+  const both = replaceOnce(
+    next,
+    'var infile = File(path); infile.open("r"); infile.encoding = "binary";',
+    'throw new Error("extendscript read is unavailable");',
+    "xlsx read",
+  );
+  if (both.includes(".open(")) throw new Error("publish bundle: xlsx open() remains");
+  return both;
+}
+
+function rewriteJsonSearch(source: string): string {
+  const shortcut = replaceOnce(source, "y&&g.open()", "false", "json search shortcut");
+  const next = replaceOnce(
+    shortcut,
+    "g.isActive?g.close():g.open()",
+    "g.isActive?g.close():void 0",
+    "json search toggle",
+  );
+  if (next.includes(".open(")) throw new Error("publish bundle: json search open() remains");
+  return next;
+}
+
+function rewriteXyflow(source: string): string {
+  const memoCalls = [
+    "const MiniMapNode = memo(",
+    "const NodeComponentWrapper = memo(",
+    "var MiniMapNodes$1 = memo(",
+    "const MiniMap = memo(",
+  ];
+  let next = source;
+  for (const call of memoCalls) {
+    next = replaceOnce(next, call, call.replace("= memo(", "= /* @__PURE__ */ memo("), call);
+  }
+  return replaceOnce(next, "MiniMapComponent.displayName = 'MiniMap';\n", "", "minimap displayName");
+}
+
+function replaceOnce(source: string, from: string, to: string, label: string): string {
+  const index = source.indexOf(from);
+  if (index < 0) throw new Error(`publish bundle: missing ${label}`);
+  if (source.indexOf(from, index + from.length) !== -1) throw new Error(`publish bundle: ${label} is not unique`);
+  return source.slice(0, index) + to + source.slice(index + from.length);
+}

package/src/publish.ts

@@ -0,0 +1,124 @@
+import { createHash } from "node:crypto";
+import { putScriptUpload } from "@moloodev/editor-store/upload";
+import { getApiOrigin } from "@moloodev/platform";
+import { builtinEditors } from "@moloodev/platform/builtin-editors";
+import { buildEditorPackage } from "./editor-views";
+
+const DEFAULT_SERVICE = "editor-origin-build";
+
+export function publishEndpoint(apiUrl?: string): string {
+  return `${apiBase(apiUrl)}/v1/revisions/publish`;
+}
+
+export function uploadEndpoint(apiUrl?: string): string {
+  return `${apiBase(apiUrl)}/v1/revisions/uploads`;
+}
+
+export async function publishEditor(input: {
+  manifest: Record<string, unknown>;
+  script: string;
+  token: string;
+  apiUrl?: string;
+  service?: string;
+}): Promise<{ status: number; body: string }> {
+  const uploadUrl = uploadEndpoint(input.apiUrl);
+  const publishUrl = publishEndpoint(input.apiUrl);
+  const service = input.service ?? DEFAULT_SERVICE;
+  const issued = await fetch(uploadUrl, {
+    method: "POST",
+    headers: serviceHeaders(input.token, service),
+  });
+  const issuedBody = await issued.text();
+  if (issued.status !== 201) return { status: issued.status, body: issuedBody };
+  const upload = readUpload(issuedBody);
+  if (upload === undefined) return { status: issued.status, body: issuedBody };
+
+  const bytes = Buffer.from(input.script, "utf8");
+  try {
+    await putScriptUpload(upload.token, upload.pathname, bytes);
+  } catch {
+    return { status: 0, body: "upload_failed" };
+  }
+
+  const response = await fetch(publishUrl, {
+    method: "POST",
+    headers: {
+      ...serviceHeaders(input.token, service),
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      manifest: input.manifest,
+      editorId: reservedEditorId(input.manifest),
+      upload: {
+        pathname: upload.pathname,
+        sha256: createHash("sha256").update(bytes).digest("hex"),
+      },
+    }),
+  });
+  return { status: response.status, body: await response.text() };
+}
+
+export async function publishEditorPackage(
+  packageRoot: string,
+  options: { token?: string; apiUrl?: string; service?: string } = {},
+): Promise<{ id: string; status: number; body: string }> {
+  const token = (options.token ?? process.env.MOLOO_SERVICE_TOKEN ?? "").trim();
+  if (token.length === 0) throw new Error("MOLOO_SERVICE_TOKEN is empty");
+  const built = await buildEditorPackage(packageRoot);
+  const result = await publishEditor({
+    manifest: built.manifest,
+    script: built.script,
+    token,
+    apiUrl: options.apiUrl,
+    service: options.service,
+  });
+  return { id: built.id, ...result };
+}
+
+function serviceHeaders(token: string, service: string): Record<string, string> {
+  return {
+    "x-moloo-service-token": token,
+    "x-moloo-service": service,
+  };
+}
+
+function readUpload(text: string): { pathname: string; token: string } | undefined {
+  let value: unknown;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return undefined;
+  }
+  if (!isRecord(value)) return undefined;
+  const data = value.data;
+  if (!isRecord(data)) return undefined;
+  const pathname = data.pathname;
+  const token = data.token;
+  if (typeof pathname !== "string" || typeof token !== "string") return undefined;
+  return { pathname, token };
+}
+
+function apiBase(apiUrl: string | undefined): string {
+  const raw = apiUrl?.trim() ?? "";
+  const base = raw.length === 0 ? getApiOrigin("production") : raw;
+  let url: URL;
+  try {
+    url = new URL(base);
+  } catch {
+    throw new Error("publish API origin is invalid");
+  }
+  if (url.protocol !== "https:") throw new Error("publish API origin must be https");
+  return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+}
+
+export function reservedEditorId(manifest: Record<string, unknown>): string {
+  const id = manifest.id;
+  if (typeof id !== "string") throw new Error("builtin manifest id is missing");
+  const row = builtinEditors.find((item) => `${item.publisherHandle}.${item.slug}` === id);
+  if (row === undefined) throw new Error(`builtin editor ${id} is missing`);
+  return row.id;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/src/read-editor-manifest.ts

@@ -0,0 +1,113 @@
+import { readFileSync } from "node:fs";
+import { parse } from "@babel/parser";
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function literal(node: unknown): unknown {
+  if (!isRecord(node) || typeof node.type !== "string") {
+    throw new Error("Manifest values must be static literals");
+  }
+  switch (node.type) {
+    case "StringLiteral":
+    case "NumericLiteral":
+    case "BooleanLiteral":
+      return node.value;
+    case "NullLiteral":
+      return null;
+    case "UnaryExpression":
+      if (
+        node.operator === "-" &&
+        isRecord(node.argument) &&
+        node.argument.type === "NumericLiteral" &&
+        typeof node.argument.value === "number"
+      ) {
+        return -node.argument.value;
+      }
+      throw new Error("Manifest values must be static literals");
+    case "ArrayExpression":
+      if (!Array.isArray(node.elements)) {
+        throw new Error("Manifest values must be static literals");
+      }
+      return node.elements.map(literal);
+    case "ObjectExpression": {
+      if (!Array.isArray(node.properties)) {
+        throw new Error("Manifest properties must be static literals");
+      }
+      const entries = node.properties.map((property: unknown): [string, unknown] => {
+        if (
+          !isRecord(property) ||
+          property.type !== "ObjectProperty" ||
+          property.computed === true ||
+          property.shorthand === true ||
+          !isRecord(property.key) ||
+          (property.key.type !== "Identifier" && property.key.type !== "StringLiteral")
+        ) {
+          throw new Error("Manifest properties must be static literals");
+        }
+        const key = property.key.type === "Identifier" ? property.key.name : property.key.value;
+        if (typeof key !== "string") {
+          throw new Error("Manifest properties must be static literals");
+        }
+        return [key, literal(property.value)];
+      });
+      if (new Set(entries.map(([key]) => key)).size !== entries.length) {
+        throw new Error("Duplicate manifest property");
+      }
+      return Object.fromEntries(entries);
+    }
+    default:
+      throw new Error(`Manifest values must be static literals: ${node.type}`);
+  }
+}
+
+/** Read literal declarations without importing an editor or executing its code. */
+export function readEditorManifest(file: string): Record<string, unknown> {
+  const ast = parse(readFileSync(file, "utf8"), { sourceType: "module", plugins: ["typescript"] });
+  let declaration;
+  for (const statement of ast.program.body) {
+    if (statement.type === "ImportDeclaration") {
+      if (
+        !["@moloodev/editor-sdk/view", "@moloodev/editor-sdk/commands", "@moloodev/editor-sdk/commands/editor-document"].includes(statement.source.value) ||
+        statement.specifiers.some((item) => item.type !== "ImportSpecifier" || item.imported.type !== "Identifier" || item.imported.name !== "defineEditorManifest" || item.local.name !== "defineEditorManifest")
+      ) {
+        throw new Error(`Invalid static manifest import: ${file}`);
+      }
+      continue;
+    }
+    if (statement.type !== "ExportDefaultDeclaration" || declaration) {
+      throw new Error(`Expected one static manifest declaration: ${file}`);
+    }
+    declaration = statement.declaration;
+  }
+  if (
+    declaration?.type !== "CallExpression" ||
+    declaration.callee.type !== "Identifier" ||
+    declaration.callee.name !== "defineEditorManifest" ||
+    declaration.arguments.length !== 1
+  ) {
+    throw new Error(`Expected export default defineEditorManifest({...}): ${file}`);
+  }
+  const input = literal(declaration.arguments[0]);
+  if (!isRecord(input)) throw new Error(`Manifest must be an object: ${file}`);
+  if ("icon" in input && input.icon !== undefined && (typeof input.icon !== "string" || !/^tabler:[a-z0-9]+(-[a-z0-9]+)*$/.test(input.icon))) {
+    throw new Error("Invalid editor manifest: icon must be tabler:{name}");
+  }
+  const contributes = input.contributes ?? {};
+  if (!isRecord(contributes)) throw new Error(`Manifest contributes must be an object: ${file}`);
+  if (input.layoutVersion != null && (typeof input.layoutVersion !== "number" || !Number.isInteger(input.layoutVersion) || input.layoutVersion < 1)) {
+    throw new Error("Invalid editor manifest: layoutVersion must be a positive integer");
+  }
+  return {
+    ...input,
+    categories: input.categories ?? [],
+    capabilities: input.capabilities ?? [],
+    contributes: {
+      commands: contributes.commands ?? [],
+      menus: contributes.menus ?? [],
+      keybindings: contributes.keybindings ?? [],
+      ...(contributes.configuration ? { configuration: contributes.configuration } : {}),
+    },
+  };
+}

package/src/three-local-loaders.ts

@@ -0,0 +1,102 @@
+/** Published views receive authorized asset bytes from the host, not network URLs.
+ * Replace only Three's I/O methods; parsers, textures and renderers stay upstream.
+ * Exact method markers fail the build if an upstream update changes this boundary.
+ */
+export function rewriteThreeLoaders(source: string): string {
+  let next = replaceLoad(
+    source,
+    "FileLoader",
+    `
+    url = this.manager.resolveURL(url ?? '');
+    this.manager.itemStart(url);
+    queueMicrotask(() => {
+      try {
+        const match = /^data:([^,]*),(.*)$/s.exec(url);
+        if (!match) throw new Error('Only host-provided data resources are supported');
+        const encoded = match[1].endsWith(';base64');
+        const bytes = encoded
+          ? Uint8Array.from(atob(match[2]), character => character.charCodeAt(0))
+          : new TextEncoder().encode(decodeURIComponent(match[2]));
+        const text = () => new TextDecoder().decode(bytes);
+        let value;
+        switch (this.responseType) {
+          case 'arraybuffer': value = bytes.buffer; break;
+          case 'blob': value = new Blob([bytes], { type: this.mimeType || match[1].split(';')[0] }); break;
+          case 'json': value = JSON.parse(text()); break;
+          case 'document': throw new Error('Document resources are unsupported');
+          default: value = text();
+        }
+        if (onLoad) onLoad(value);
+      } catch (error) {
+        if (onError) onError(error);
+        this.manager.itemError(url);
+      } finally {
+        this.manager.itemEnd(url);
+      }
+    });
+  `,
+  );
+  next = replaceLoad(
+    next,
+    "ImageBitmapLoader",
+    `
+    url = this.manager.resolveURL(url ?? '');
+    this.manager.itemStart(url);
+    const finishError = (error) => {
+      if (onError) onError(error);
+      this.manager.itemError(url);
+      this.manager.itemEnd(url);
+    };
+    if (!url.startsWith('data:') && !url.startsWith('blob:')) {
+      queueMicrotask(() => finishError(new Error('Only local image resources are supported')));
+      return;
+    }
+    const image = document.createElementNS('http://www.w3.org/1999/xhtml', 'img');
+    image.onload = () => {
+      createImageBitmap(image, this.options).then(bitmap => {
+        try { if (onLoad) onLoad(bitmap); }
+        finally { this.manager.itemEnd(url); }
+      }, finishError);
+    };
+    image.onerror = finishError;
+    image.src = url;
+  `,
+  );
+  // TextureLoader and older browsers use ImageLoader instead of ImageBitmapLoader.
+  const start = next.indexOf("class ImageLoader extends Loader {");
+  const marker = "\t\turl = this.manager.resolveURL( url );";
+  const index = next.indexOf(marker, start);
+  if (start < 0 || index < 0)
+    throw new Error("publish bundle: Three ImageLoader is missing");
+  const end = index + marker.length;
+  return (
+    next.slice(0, end) +
+    `
+    if (!url.startsWith('data:') && !url.startsWith('blob:')) {
+      this.manager.itemStart(url);
+      queueMicrotask(() => {
+        try { if (onError) onError(new Error('Only local image resources are supported')); }
+        finally { this.manager.itemError(url); this.manager.itemEnd(url); }
+      });
+      return;
+    }
+` +
+    next.slice(end)
+  );
+}
+
+function replaceLoad(source: string, name: string, body: string): string {
+  const start = source.indexOf(`class ${name} extends Loader {`);
+  const method = source.indexOf(
+    "\n\tload( url, onLoad, onProgress, onError ) {",
+    start,
+  );
+  const end = source.indexOf("\n\t}", method);
+  if (start < 0 || method < 0 || end < 0)
+    throw new Error(`publish bundle: Three ${name}.load is missing`);
+  return (
+    source.slice(0, method) +
+    `\n\tload( url, onLoad, onProgress, onError ) {${body}\n\t}` +
+    source.slice(end + 3)
+  );
+}

package/src/view-page.ts

@@ -0,0 +1,57 @@
+import { connectEditorView, type EditorView } from "@moloodev/editor-sdk/view";
+
+export type HandshakePageDeps = {
+  readonly search: string;
+  readonly editorId: string;
+  postMessage(
+    message: unknown,
+    targetOrigin: string,
+    transfer: readonly MessagePort[],
+  ): void;
+  createChannel(): MessageChannel;
+  setHandshake(value: string): void;
+};
+
+/** Handshake only. The dataset records `ok` or the failure code from the existing channel. */
+export function startHandshakePage(deps: HandshakePageDeps): EditorView {
+  const view = connectEditorView({
+    parent: singleParent(deps.search),
+    editorId: deps.editorId,
+    postMessage: deps.postMessage,
+    createChannel: deps.createChannel,
+  });
+  void view.handshake.then((result) => {
+    deps.setHandshake(result.ok ? "ok" : result.code);
+  });
+  return view;
+}
+
+function singleParent(search: string): string | null {
+  const values = new URLSearchParams(search).getAll("parent");
+  if (values.length !== 1) return null;
+  const parent = values[0];
+  if (parent === undefined || parent.length === 0) return null;
+  return parent;
+}
+
+function wireWindow(): void {
+  if (typeof document === "undefined") return;
+  const root = document.documentElement;
+  startHandshakePage({
+    search: window.location.search,
+    editorId: root.dataset.editorId ?? "",
+    postMessage(message, targetOrigin, transfer) {
+      const ports: Transferable[] = [];
+      for (const port of transfer) ports.push(port);
+      window.parent.postMessage(message, targetOrigin, ports);
+    },
+    createChannel() {
+      return new MessageChannel();
+    },
+    setHandshake(value) {
+      root.dataset.handshake = value;
+    },
+  });
+}
+
+wireWindow();

package/src/yjs-log.ts

@@ -0,0 +1,16 @@
+export const BOLD = Symbol("bold");
+export const UNBOLD = Symbol("unbold");
+export const RED = Symbol("red");
+export const ORANGE = Symbol("orange");
+
+function words(args: readonly unknown[]): unknown[] {
+  return args.filter((arg) => typeof arg !== "symbol");
+}
+
+export function print(...args: unknown[]): void {
+  console.log(...words(args));
+}
+
+export function warn(...args: unknown[]): void {
+  console.warn(...words(args));
+}

package/README.md

@@ -1,3 +0,0 @@
-# Temporary Holding Version
-
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.