@moloodev/cli 0.2.2 → 0.4.0

package/README.md

@@ -0,0 +1,3 @@
+`moloo editor dev` does not support the local app host because the parent app origin is fixed to production (`https://app.moloo.dev`).
+
+The view server defaults to `http://127.0.0.1:4310`. Use `moloo editor dev --view-port 4451` to select another port. Click **로컬 뷰 연결** in the app and allow browser local network access when prompted. If a connection fails, the app displays the browser error or manifest HTTP status; check the CLI and the app's browser site permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moloodev/cli",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "type": "module",
   "bin": {
     "moloo": "./bin/moloo.mjs"
@@ -13,27 +13,24 @@
   },
   "dependencies": {
     "@babel/parser": "7.29.8",
+    "@napi-rs/keyring": "2.1.2",
     "@tailwindcss/vite": "^4.3.3",
     "esbuild": "^0.28.2",
+    "open": "11.0.2",
     "shadcn": "^4.21.0",
     "tailwindcss": "^4.3.3",
     "tw-animate-css": "^1.4.0",
-    "vite": "^8.2.2",
     "tsx": "^4.23.13",
-    "@tabler/icons-react": "^3.46.0",
-    "react": "^19.2.8",
-    "react-dom": "^19.2.8",
-    "@moloodev/editor-store": "0.2.2",
-    "@moloodev/editor-sdk": "0.2.2",
-    "@moloodev/platform": "0.2.2",
-    "@moloodev/ui": "0.2.2"
+    "vite": "^8.2.2",
+    "@moloodev/editor-sdk": "0.4.0",
+    "@moloodev/platform": "0.4.0",
+    "@moloodev/editor-store": "0.4.0",
+    "@moloodev/ui": "0.4.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
     "typescript": "^7.0.2",
-    "@types/react": "^19.2.18",
-    "@types/react-dom": "^19.2.7",
-    "@moloodev/typescript-config": "0.2.2"
+    "@moloodev/typescript-config": "0.4.0"
   },
   "publishConfig": {
     "access": "public"
@@ -41,11 +38,13 @@
   "files": [
     "bin",
     "src",
-    "!src/**/*.test.ts",
-    "!src/**/*.test.tsx"
+    "!src/**/*.test.ts"
   ],
+  "engines": {
+    "node": ">=24"
+  },
   "scripts": {
     "typecheck": "tsc --noEmit",
-    "test": "tsx --test 'src/**/*.test.ts'"
+    "test": "node --import tsx --test 'src/**/*.test.ts'"
   }
 }

package/src/auth.ts

@@ -0,0 +1,158 @@
+import { getIdOrigin, getApiOrigin } from "@moloodev/platform";
+import { credentialStore, type CredentialStore, type Tokens } from "./credentials";
+import { BrowserUnavailable, browserLogin, deviceLogin, oauthPost, readTokens, SCOPE } from "./oauth";
+
+export const ISSUER = `${getIdOrigin("production")}/api/auth`;
+
+export function canOpenBrowser(
+  env = process.env,
+  platform = process.platform,
+  interactive = Boolean(process.stdin.isTTY && process.stdout.isTTY),
+): boolean {
+  return Boolean(
+    interactive &&
+    !env.CI &&
+    !env.SSH_CONNECTION &&
+    (platform !== "linux" || env.DISPLAY || env.WAYLAND_DISPLAY),
+  );
+}
+
+async function authorizeLogin(issuer: string, scope: string, device = false): Promise<Tokens> {
+  try {
+    return await (
+      device || !canOpenBrowser()
+        ? deviceLogin(issuer, scope)
+        : browserLogin(issuer, async (url) => {
+            const { default: open } = await import("open");
+            const launcher = await open(url, { wait: false });
+            await new Promise<void>((resolve, reject) => {
+              const exited = (code: number | null) =>
+                code === 0 ? resolve() : reject(new Error("Browser launch failed"));
+              if (launcher.exitCode !== null) exited(launcher.exitCode);
+              else {
+                launcher.once("error", reject);
+                launcher.once("close", exited);
+              }
+            });
+          }, scope)
+    );
+  } catch (error) {
+    if (!(error instanceof BrowserUnavailable)) throw error;
+    return deviceLogin(issuer, scope);
+  }
+}
+
+async function replaceTokens(
+  store: CredentialStore,
+  issuer: string,
+  previous: Tokens | null,
+  tokens: Tokens,
+) {
+  try {
+    await store.write(tokens);
+  } catch (error) {
+    await revokeTokens(issuer, tokens).catch(() => {});
+    throw error;
+  }
+  if (previous) await revokeTokens(issuer, previous).catch(() => {});
+}
+
+export async function login(
+  device: boolean,
+  store = credentialStore(ISSUER),
+  issuer = ISSUER,
+  authorize = authorizeLogin,
+) {
+  // Check keychain availability before starting an authorization that cannot be saved.
+  const previous = await store.read();
+  const tokens = await authorize(issuer, SCOPE, device);
+  await replaceTokens(store, issuer, previous, tokens);
+  console.log("Logged in.");
+}
+
+export async function loginToken(store = credentialStore(ISSUER), issuer = ISSUER) {
+  const tokens = await store.read();
+  if (!tokens) throw new Error("Not logged in. Run moloo login or set MOLOO_SERVICE_TOKEN for CI.");
+  if (tokens.expiresAt > Date.now() + 60_000) return tokens.accessToken;
+  const updated = await readTokens(
+    await oauthPost(issuer, "/oauth2/token", {
+      grant_type: "refresh_token",
+      refresh_token: tokens.refreshToken,
+    }),
+    tokens.refreshToken,
+  );
+  await store.write(updated);
+  return updated.accessToken;
+}
+
+async function revokeTokens(issuer: string, tokens: { accessToken: string; refreshToken: string }) {
+  // Revoke both credentials; the provider also removes access tokens linked to the refresh token.
+  for (const [token, hint] of [
+    [tokens.accessToken, "access_token"],
+    [tokens.refreshToken, "refresh_token"],
+  ] as const) {
+    const response = await oauthPost(issuer, "/oauth2/revoke", { token, token_type_hint: hint });
+    if (!response.ok) throw new Error("Server revocation failed. Retry moloo logout when online.");
+  }
+}
+
+export async function logout(store: CredentialStore = credentialStore(ISSUER), issuer = ISSUER) {
+  const tokens = await store.read();
+  if (tokens) await revokeTokens(issuer, tokens);
+  await store.delete();
+  console.log(tokens ? "Logged out." : "Local credentials cleared; no parseable token, server revocation skipped.");
+}
+
+export async function publishCredentials(
+  serviceToken: string | undefined,
+  store = credentialStore(ISSUER),
+  issuer = ISSUER,
+  authorize = authorizeLogin,
+) {
+  if (serviceToken !== undefined) {
+    const token = serviceToken.trim();
+    if (!token) throw new Error("MOLOO_SERVICE_TOKEN is empty");
+    return { token, bearer: false };
+  }
+  const previous = await store.read();
+  if (!previous) throw new Error("Not logged in. Run moloo login or set MOLOO_SERVICE_TOKEN for CI.");
+  if (!previous.scopes.includes("editor:publish")) {
+    const scopes = [...new Set([...previous.scopes, "editor:publish"])];
+    const tokens = await authorize(issuer, scopes.join(" "));
+    if (!scopes.every((scope) => tokens.scopes.includes(scope))) {
+      await revokeTokens(issuer, tokens).catch(() => {});
+      throw new Error("OAuth authorization did not grant the requested publish scopes.");
+    }
+    await replaceTokens(store, issuer, previous, tokens);
+    return { token: tokens.accessToken, bearer: true };
+  }
+  return { token: await loginToken(store, issuer), bearer: true };
+}
+
+export async function cliIdentity(
+  store = credentialStore(ISSUER),
+  apiOrigin = getApiOrigin("production"),
+) {
+  const token = await loginToken(store);
+  const response = await fetch(`${apiOrigin}/v1/cli/me`, {
+    headers: { authorization: `Bearer ${token}` },
+    redirect: "error",
+    signal: AbortSignal.timeout(30_000),
+  });
+  if (!response.ok) throw new Error(`CLI identity request failed (${response.status}). Run moloo login.`);
+  const { data } = (await response.json()) as {
+    data: { user: { id: string; name: string; email: string }; workspaces: { id: string; name: string; slug: string }[] };
+  };
+  return data;
+}
+
+export async function whoami(
+  store = credentialStore(ISSUER),
+  apiOrigin = getApiOrigin("production"),
+) {
+  const data = await cliIdentity(store, apiOrigin);
+  console.log(`${data.user.name} <${data.user.email}>`);
+  for (const workspace of data.workspaces)
+    console.log(`Workspace: ${workspace.name} (${workspace.slug})`);
+  if (!data.workspaces.length) console.log("Workspace: none");
+}

package/src/cli.ts

@@ -1,35 +1,35 @@
+import { login, logout, whoami } from "./auth";
 import { resolve } from "node:path";
-import { startEditorDevServer } from "./dev-server";
+import { runEditorDev } from "./editor-dev";
 import { buildEditorPackage } from "./editor-views";
 import { publishEditorPackage } from "./publish";
+import { listWorkspaces, useWorkspace, type WorkspaceOptions } from "./workspace";
 
 const EDITOR_USAGE =
-  "Usage: moloo editor <dev|build|publish> [--dir <path>] [--out-dir <path>] [--port <port>] [--view-port <port>] [--api-url <https-origin>]";
-const USAGE = `Usage: moloo <command>\n\nCommands:\n  editor  dev | build | publish\n\n${EDITOR_USAGE}`;
+  "Usage: moloo editor <dev|build|publish> [--dir <path>] [--out-dir <path>] [--view-port <port>] [--workspace <slug>] [--api-url <https-origin>]\nDev view port: 4310 (default)";
+const WORKSPACE_USAGE = "Usage: moloo workspace list | use <slug>";
+const USAGE = `Usage: moloo <command>\n\nCommands:\n  login   [--device]\n  logout\n  whoami\n  workspace  list | use <slug>\n  editor  dev | build | publish\n\n${WORKSPACE_USAGE}\n${EDITOR_USAGE}`;
 
-type Command = (args: readonly string[]) => Promise<number>;
+type Command = (args: readonly string[], options: WorkspaceOptions) => Promise<number>;
 
 const editorCommands: Record<string, Command> = {
-  async dev(args) {
-    const hostPort = readPortFlag(args, "--port") ?? 4300;
+  async dev(args, options) {
+    for (let index = 0; index < args.length; index += 2) {
+      if (
+        !["--dir", "--view-port", "--workspace"].includes(args[index] ?? "") ||
+        !args[index + 1] ||
+        args[index + 1]?.startsWith("--")
+      ) {
+        throw new Error(EDITOR_USAGE);
+      }
+    }
     const viewPort = readPortFlag(args, "--view-port");
-    const server = await startEditorDevServer({
+    return runEditorDev({
+      ...options,
       packageRoot: packageRootFlag(args),
-      hostPort,
+      workspace: readFlag(args, "--workspace"),
       ...(viewPort !== undefined ? { viewPort } : {}),
     });
-    console.log(`${server.editorId} dev host -> ${server.hostOrigin}`);
-    console.log(`${server.editorId} view origin -> ${server.viewOrigin}`);
-    await new Promise<void>((resolveStop) => {
-      const stop = () => {
-        process.off("SIGINT", stop);
-        process.off("SIGTERM", stop);
-        void server.close().finally(resolveStop);
-      };
-      process.on("SIGINT", stop);
-      process.on("SIGTERM", stop);
-    });
-    return 0;
   },
   async build(args) {
     const packageRoot = packageRootFlag(args);
@@ -41,30 +41,84 @@ const editorCommands: Record<string, Command> = {
     return 0;
   },
   async publish(args) {
-    const result = await publishEditorPackage(packageRootFlag(args), { apiUrl: readFlag(args, "--api-url") });
+    const result = await publishEditorPackage(packageRootFlag(args), {
+      apiUrl: readFlag(args, "--api-url"),
+    });
     console.log(`${result.id} ${String(result.status)} ${result.body}`);
     return result.status === 200 || result.status === 201 ? 0 : 1;
   },
 };
 
-const groups: Record<string, { usage: string; commands: Record<string, Command> }> = {
-  editor: { usage: EDITOR_USAGE, commands: editorCommands },
+const commands: Record<string, {
+  usage: string;
+  run: (args: readonly string[], options: WorkspaceOptions) => Promise<number>;
+}> = {
+  login: {
+    usage: "Usage: moloo login [--device]",
+    async run(args) {
+      if (args.some((arg) => arg !== "--device")) throw new Error("Usage: moloo login [--device]");
+      await login(args.includes("--device"));
+      return 0;
+    },
+  },
+  logout: {
+    usage: "Usage: moloo logout",
+    async run(args) {
+      if (args.length) throw new Error("Usage: moloo logout");
+      await logout();
+      return 0;
+    },
+  },
+  whoami: {
+    usage: "Usage: moloo whoami",
+    async run(args) {
+      if (args.length) throw new Error("Usage: moloo whoami");
+      await whoami();
+      return 0;
+    },
+  },
+  workspace: {
+    usage: WORKSPACE_USAGE,
+    async run([name, ...args], options) {
+      if (name === "list" && args.length === 0) await listWorkspaces(options);
+      else if (name === "use" && args.length === 1 && args[0] && !args[0].startsWith("-")) {
+        await useWorkspace(args[0], options);
+      } else throw new Error(WORKSPACE_USAGE);
+      return 0;
+    },
+  },
+  editor: {
+    usage: EDITOR_USAGE,
+    async run([name, ...args], options) {
+      const command =
+        name === undefined
+          ? undefined
+          : Object.hasOwn(editorCommands, name)
+            ? editorCommands[name]
+            : undefined;
+      if (!command) {
+        console.error(EDITOR_USAGE);
+        return 1;
+      }
+      return command(args, options);
+    },
+  },
 };
 
-export async function runCli(argv: readonly string[]): Promise<number> {
-  const [groupName, commandName, ...rest] = argv;
-  const group = groupName === undefined ? undefined : groups[groupName];
+export async function runCli(argv: readonly string[], options: WorkspaceOptions = {}): Promise<number> {
+  const [name, ...args] = argv;
+  const command =
+    name === undefined ? undefined : Object.hasOwn(commands, name) ? commands[name] : undefined;
   const wantsHelp = argv.includes("--help") || argv.includes("-h");
-  if (!group) {
-    (wantsHelp ? console.log : console.error)(USAGE);
-    return wantsHelp ? 0 : 1;
+  if (wantsHelp) {
+    console.log(command?.usage ?? USAGE);
+    return 0;
   }
-  const command = commandName === undefined ? undefined : group.commands[commandName];
-  if (!command || wantsHelp) {
-    (wantsHelp ? console.log : console.error)(group.usage);
-    return wantsHelp ? 0 : 1;
+  if (!command) {
+    console.error(USAGE);
+    return 1;
   }
-  return command(rest);
+  return command.run(args, options);
 }
 
 function packageRootFlag(args: readonly string[]): string {

package/src/config.ts

@@ -0,0 +1,36 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+type Config = { workspace?: string };
+
+export function configPath(env = process.env, home = homedir()): string {
+  return join(env.XDG_CONFIG_HOME || join(home, ".config"), "moloo", "config.json");
+}
+
+export async function readConfig(path = configPath()): Promise<Config> {
+  let raw: string;
+  try {
+    raw = await readFile(path, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return {};
+    throw error;
+  }
+  try {
+    const value: unknown = JSON.parse(raw);
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+      if (!("workspace" in value)) return {};
+      if (typeof value.workspace === "string" && value.workspace.length > 0) {
+        return { workspace: value.workspace };
+      }
+    }
+  } catch {
+    // Report the path, never the file contents.
+  }
+  throw new Error(`Invalid CLI config at ${path}. Remove it and run moloo workspace use <slug>.`);
+}
+
+export async function writeConfig(config: Config, path = configPath()): Promise<void> {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify({ workspace: config.workspace }, null, 2)}\n`, { mode: 0o600 });
+}

package/src/credentials.ts

@@ -0,0 +1,54 @@
+const SERVICE = "dev.moloo.cli";
+
+export type Tokens = { accessToken: string; refreshToken: string; expiresAt: number; scopes: string[] };
+export type CredentialStore = {
+  /** Missing or unparseable credentials are absent; store access errors propagate. */
+  read(): Promise<Tokens | null>;
+  write(tokens: Tokens): Promise<void>;
+  delete(): Promise<void>;
+};
+
+type KeychainEntry = {
+  getPassword(): string | null;
+  setPassword(value: string): void;
+  deletePassword(): boolean;
+};
+
+/** Never fall back to a file when the OS credential store is unavailable. */
+export function credentialStore(issuer: string, entry?: KeychainEntry): CredentialStore {
+  async function keychain() {
+    if (entry) return entry;
+    const { Entry } = await import("@napi-rs/keyring");
+    entry = new Entry(SERVICE, issuer, { linux: { store: "secret-service" } });
+    return entry;
+  }
+  return {
+    async read() {
+      const value = (await keychain()).getPassword();
+      if (value === null) return null;
+      try {
+        const tokens = JSON.parse(value) as Tokens;
+        if (
+          typeof tokens.accessToken === "string" &&
+          tokens.accessToken.length &&
+          typeof tokens.refreshToken === "string" &&
+          tokens.refreshToken.length &&
+          Number.isFinite(tokens.expiresAt) &&
+          Array.isArray(tokens.scopes) &&
+          tokens.scopes.every((scope) => typeof scope === "string" && scope.length > 0)
+        )
+          return tokens;
+      } catch {
+        /* Never include a credential's contents in parse errors. */
+      }
+      return null;
+    },
+    async write(tokens) {
+      (await keychain()).setPassword(JSON.stringify(tokens));
+    },
+    async delete() {
+      const key = await keychain();
+      if (key.getPassword() !== null) key.deletePassword();
+    },
+  };
+}