@morit/cli 1.0.0

package/README.md

@@ -0,0 +1,26 @@
+# @morit/cli
+
+Official Morit Developer CLI. It owns the shared Plugin SDK, local/Cloud project
+linking, authenticated synchronization, builds, and deployments. The separate
+`@morit/plugin-mcp` package exposes these capabilities to AI clients over MCP.
+
+```powershell
+npx @morit/cli login
+npx @morit/cli plugin setup . --id com.example.plugin --name Example --publisher example
+npx @morit/cli plugin add .
+npx @morit/cli plugin validate .
+npx @morit/cli plugin build .
+npx @morit/cli plugin deploy . --visibility private
+```
+
+`morit login` uses a browser device flow. Windows credentials are protected with
+DPAPI, macOS uses Keychain, and Linux uses Secret Service through `secret-tool`.
+CI can supply `MORIT_ACCESS_TOKEN` without writing it to disk.
+
+The local link is stored in `morit-plugin.json`; it contains project identifiers
+and a revision only, never credentials. Project source and `.mplg` files also
+contain secret identifiers only. Values belong in Morit Cloud Project Secrets.
+
+Binary PNG/JPEG/WebP/GIF assets and direct `children/*.mplg` dependencies are
+encoded only while crossing the JSON Cloud boundary and are restored byte for
+byte on pull, source ZIP, and build. Other source remains strict UTF-8.

package/assets/plugin_contract.json

@@ -0,0 +1,136 @@
+{
+  "sdk_version": "1.7.5",
+  "manifest_schema_versions": [1, 2],
+  "recommended_schema_version": 2,
+  "package_content_type": "application/vnd.morit.plugin+zip",
+  "max_package_bytes": 2097152,
+  "max_entries": 64,
+  "manifest_fields": [
+    "schema_version",
+    "id",
+    "name",
+    "icon",
+    "short_description",
+    "description",
+    "category",
+    "keywords",
+    "developer",
+    "homepage_url",
+    "privacy_policy_url",
+    "publisher",
+    "version",
+    "cloud_project_id",
+    "required_secrets",
+    "min_morit_version",
+    "max_morit_version",
+    "permissions",
+    "capabilities",
+    "ui_extensions",
+    "credentials",
+    "slash_commands",
+    "connectors",
+    "dependencies",
+    "data_policy"
+  ],
+  "fragment_directories": {
+    "capabilities": {"target": "capabilities", "kind": null},
+    "tools": {"target": "capabilities", "kind": "tool"},
+    "skills": {"target": "capabilities", "kind": "skill"},
+    "search": {"target": "capabilities", "kind": "provider"},
+    "notifications": {"target": "capabilities", "kind": "notification"},
+    "background": {"target": "capabilities", "kind": "background"},
+    "ui": {"target": "ui_extensions", "kind": null},
+    "credentials": {"target": "credentials", "kind": null},
+    "slash_commands": {"target": "slash_commands", "kind": null}
+  },
+  "object_fields": {
+    "capability": ["id", "kind", "title", "description", "permissions", "timeout_seconds", "runtime"],
+    "ui_extension": ["id", "point", "title", "order", "permissions", "config"],
+    "credential": ["id", "label", "description", "kind", "required", "oauth_provider", "allow_multiple"],
+    "slash_command": ["id", "command", "title", "description", "capability", "argument_template"],
+    "connector": ["id", "kind", "label", "description", "credential_id", "cloud_connection_id", "cloud_secret_id", "endpoint", "timeout_seconds", "retry", "rate_limit"],
+    "developer": ["name", "url"],
+    "required_secret": ["id", "label", "description", "required"],
+    "dependency": ["id", "plugin_id", "required", "min_version", "max_version", "package_path", "exposed_capabilities"]
+  },
+  "capability_runtime_shorthand": ["adapter", "entrypoint", "parameters"],
+  "capability_kinds": ["tool", "skill", "provider", "background", "notification"],
+  "connector_kinds": ["https", "oauth", "api_key", "mcp"],
+  "credential_kinds": ["api_token", "oauth_access_token"],
+  "permissions": [
+    "network",
+    "user_data_read",
+    "user_data_write",
+    "attachments_read",
+    "file_write",
+    "ai_tool_call",
+    "notifications",
+    "background",
+    "account_read",
+    "storage",
+    "credentials"
+  ],
+  "runtime_adapters": [
+    "text_stats",
+    "text_template",
+    "settings_search",
+    "notification_template",
+    "calendar_store",
+    "http_json",
+    "mcp_http",
+    "child_plugin",
+    "neis_school",
+    "sandbox_python"
+  ],
+  "ui_points": ["screen", "surface", "menu", "action", "card", "settings", "workspace", "response"],
+  "ui_nodes": [
+    "column",
+    "row",
+    "wrap",
+    "grid",
+    "card",
+    "section",
+    "text",
+    "icon",
+    "divider",
+    "spacer",
+    "metric",
+    "progress",
+    "button",
+    "chip",
+    "list",
+    "timeline",
+    "calendar",
+    "chart",
+    "form",
+    "dialog",
+    "sheet",
+    "field",
+    "select",
+    "switch",
+    "empty"
+  ],
+  "signature": {
+    "algorithm": "ed25519",
+    "embedded_public_key": true,
+    "install_policy": "valid signatures are installable; trusted publisher registration is optional"
+  },
+  "workflow": [
+    "research",
+    "develop",
+    "create-files",
+    "validate",
+    "preview",
+    "build",
+    "verify",
+    "install",
+    "return-artifacts"
+  ],
+  "completion_requirements": [
+    "source files exist",
+    "validation succeeds",
+    "requested artifacts exist and are non-empty",
+    "artifact format can be reopened",
+    "package signature and Host manifest verification succeed"
+  ]
+}

package/bin/morit.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+
+import { runCli } from "../src/cli.js";
+
+runCli(process.argv.slice(2)).then(
+  (code) => { process.exitCode = code; },
+  (error) => {
+    process.stderr.write(`Morit CLI failed: ${error instanceof Error ? error.message : "unknown error"}\n`);
+    process.exitCode = 1;
+  },
+);

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@morit/cli",
+  "version": "1.0.0",
+  "description": "Official Morit Developer CLI for Cloud Projects, validation, builds, and deployments",
+  "type": "module",
+  "bin": {
+    "morit": "bin/morit.js"
+  },
+  "exports": {
+    ".": "./src/cli.js",
+    "./sdk": "./src/workspace.js",
+    "./cloud": "./src/cloud-client.js",
+    "./auth": "./src/secure-store.js",
+    "./project-config": "./src/config.js"
+  },
+  "files": [
+    "assets",
+    "bin",
+    "src",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/sync-contract.mjs",
+    "test": "node --test",
+    "prepack": "npm run build && npm test"
+  },
+  "engines": {
+    "node": ">=20.12"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "morit",
+    "developer",
+    "cli",
+    "plugin",
+    "deployment"
+  ],
+  "license": "UNLICENSED"
+}

package/src/archive.js

@@ -0,0 +1,243 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify,
+} from "node:crypto";
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+
+const ZIP_LOCAL = 0x04034b50;
+const ZIP_CENTRAL = 0x02014b50;
+const ZIP_END = 0x06054b50;
+const DOS_DATE = 33;
+const CRC_TABLE = Array.from({ length: 256 }, (_, start) => {
+  let value = start;
+  for (let bit = 0; bit < 8; bit += 1) {
+    value = (value & 1) ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
+  }
+  return value >>> 0;
+});
+
+export function canonicalJson(value) {
+  return Buffer.from(JSON.stringify(sortJson(value)), "utf8");
+}
+
+function sortJson(value) {
+  if (Array.isArray(value)) return value.map(sortJson);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(
+      Object.keys(value).sort().map((key) => [key, sortJson(value[key])]),
+    );
+  }
+  return value;
+}
+
+function crc32(content) {
+  let value = 0xffffffff;
+  for (const byte of content) value = CRC_TABLE[(value ^ byte) & 0xff] ^ (value >>> 8);
+  return (value ^ 0xffffffff) >>> 0;
+}
+
+export function createZip(entries) {
+  const local = [];
+  const central = [];
+  let offset = 0;
+  for (const [name, rawContent] of [...entries.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    const nameBytes = Buffer.from(name, "utf8");
+    const content = Buffer.from(rawContent);
+    const compressed = deflateRawSync(content, { level: 9 });
+    const checksum = crc32(content);
+    const localHeader = Buffer.alloc(30);
+    localHeader.writeUInt32LE(ZIP_LOCAL, 0);
+    localHeader.writeUInt16LE(20, 4);
+    localHeader.writeUInt16LE(0x0800, 6);
+    localHeader.writeUInt16LE(8, 8);
+    localHeader.writeUInt16LE(0, 10);
+    localHeader.writeUInt16LE(DOS_DATE, 12);
+    localHeader.writeUInt32LE(checksum, 14);
+    localHeader.writeUInt32LE(compressed.length, 18);
+    localHeader.writeUInt32LE(content.length, 22);
+    localHeader.writeUInt16LE(nameBytes.length, 26);
+    localHeader.writeUInt16LE(0, 28);
+    local.push(localHeader, nameBytes, compressed);
+
+    const centralHeader = Buffer.alloc(46);
+    centralHeader.writeUInt32LE(ZIP_CENTRAL, 0);
+    centralHeader.writeUInt16LE(0x0314, 4);
+    centralHeader.writeUInt16LE(20, 6);
+    centralHeader.writeUInt16LE(0x0800, 8);
+    centralHeader.writeUInt16LE(8, 10);
+    centralHeader.writeUInt16LE(0, 12);
+    centralHeader.writeUInt16LE(DOS_DATE, 14);
+    centralHeader.writeUInt32LE(checksum, 16);
+    centralHeader.writeUInt32LE(compressed.length, 20);
+    centralHeader.writeUInt32LE(content.length, 24);
+    centralHeader.writeUInt16LE(nameBytes.length, 28);
+    centralHeader.writeUInt16LE(0, 30);
+    centralHeader.writeUInt16LE(0, 32);
+    centralHeader.writeUInt16LE(0, 34);
+    centralHeader.writeUInt16LE(0, 36);
+    centralHeader.writeUInt32LE((0o100644 * 65536) >>> 0, 38);
+    centralHeader.writeUInt32LE(offset, 42);
+    central.push(centralHeader, nameBytes);
+    offset += localHeader.length + nameBytes.length + compressed.length;
+  }
+  const localBytes = Buffer.concat(local);
+  const centralBytes = Buffer.concat(central);
+  const end = Buffer.alloc(22);
+  end.writeUInt32LE(ZIP_END, 0);
+  end.writeUInt16LE(0, 4);
+  end.writeUInt16LE(0, 6);
+  end.writeUInt16LE(entries.size, 8);
+  end.writeUInt16LE(entries.size, 10);
+  end.writeUInt32LE(centralBytes.length, 12);
+  end.writeUInt32LE(localBytes.length, 16);
+  end.writeUInt16LE(0, 20);
+  return Buffer.concat([localBytes, centralBytes, end]);
+}
+
+export function readZip(content) {
+  const input = Buffer.from(content);
+  const entries = new Map();
+  let offset = 0;
+  while (offset + 4 <= input.length && input.readUInt32LE(offset) === ZIP_LOCAL) {
+    if (offset + 30 > input.length) throw new Error("ZIP local header is truncated");
+    const flags = input.readUInt16LE(offset + 6);
+    const method = input.readUInt16LE(offset + 8);
+    const expectedCrc = input.readUInt32LE(offset + 14);
+    const compressedSize = input.readUInt32LE(offset + 18);
+    const size = input.readUInt32LE(offset + 22);
+    const nameLength = input.readUInt16LE(offset + 26);
+    const extraLength = input.readUInt16LE(offset + 28);
+    const nameStart = offset + 30;
+    const dataStart = nameStart + nameLength + extraLength;
+    const dataEnd = dataStart + compressedSize;
+    if (flags & 0x1 || flags & 0x8) throw new Error("Encrypted or data-descriptor ZIP entries are not supported");
+    if (![0, 8].includes(method)) throw new Error("ZIP entry uses an unsupported compression method");
+    if (!nameLength || dataStart > input.length || dataEnd > input.length) {
+      throw new Error("ZIP entry exceeds archive bounds");
+    }
+    const name = input.subarray(nameStart, nameStart + nameLength).toString("utf8");
+    if (entries.has(name)) throw new Error(`ZIP contains a duplicate entry: ${name}`);
+    const compressed = input.subarray(dataStart, dataEnd);
+    const value = method === 8 ? inflateRawSync(compressed) : Buffer.from(compressed);
+    if (value.length !== size) throw new Error(`Invalid ZIP entry size: ${name}`);
+    if (crc32(value) !== expectedCrc) throw new Error(`Invalid ZIP entry checksum: ${name}`);
+    entries.set(name, value);
+    offset = dataEnd;
+  }
+  if (entries.size === 0) throw new Error("ZIP contains no files");
+  if (offset + 4 > input.length || ![ZIP_CENTRAL, ZIP_END].includes(input.readUInt32LE(offset))) {
+    throw new Error("ZIP central directory is missing or archive has trailing local data");
+  }
+  return entries;
+}
+
+export function signaturePayload(entries) {
+  const digest = createHash("sha256");
+  for (const name of [...entries.keys()].filter((value) => value !== "signature.json").sort()) {
+    const encoded = Buffer.from(name, "utf8");
+    const length = Buffer.alloc(4);
+    length.writeUInt32BE(encoded.length);
+    digest.update(length);
+    digest.update(encoded);
+    digest.update(createHash("sha256").update(entries.get(name)).digest());
+  }
+  return Buffer.concat([Buffer.from("morit-plugin-v1\0"), digest.digest()]);
+}
+
+export function generateSigningKey() {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  return {
+    privatePem: privateKey.export({ type: "pkcs8", format: "pem" }),
+    publicRaw: Buffer.from(publicKey.export({ format: "jwk" }).x, "base64url"),
+  };
+}
+
+export function signEntries(entries, publisher, privatePem) {
+  const privateKey = createPrivateKey(privatePem);
+  const publicRaw = Buffer.from(privateKey.export({ format: "jwk" }).x, "base64url");
+  const result = new Map(entries);
+  result.set(
+    "signature.json",
+    canonicalJson({
+      algorithm: "ed25519",
+      key_id: publisher,
+      public_key: publicRaw.toString("base64"),
+      signature: sign(null, signaturePayload(result), privateKey).toString("base64"),
+    }),
+  );
+  return result;
+}
+
+export function verifySignedEntries(entries) {
+  const manifest = parseJsonEntry(entries, "manifest.json");
+  const signature = parseJsonEntry(entries, "signature.json");
+  const fields = Object.keys(signature).sort();
+  if (
+    signature.algorithm !== "ed25519"
+    || ![
+      ["algorithm", "key_id", "public_key", "signature"],
+    ].some((expected) => expected.every((name, index) => fields[index] === name) && fields.length === expected.length)
+  ) {
+    throw new Error("signature.json must contain an embedded Ed25519 signature");
+  }
+  if (!manifest.publisher || signature.key_id !== manifest.publisher) {
+    throw new Error("package publisher does not match signature key_id");
+  }
+  const publicRaw = strictBase64(signature.public_key, 32, "signature public key");
+  const signatureRaw = strictBase64(signature.signature, 64, "package signature");
+  const publicKey = createPublicKey({
+    key: {
+      kty: "OKP",
+      crv: "Ed25519",
+      x: publicRaw.toString("base64url"),
+    },
+    format: "jwk",
+  });
+  if (!verify(null, signaturePayload(entries), publicKey, signatureRaw)) {
+    throw new Error("package signature is invalid or package content was modified");
+  }
+  return {
+    manifest,
+    signature: {
+      algorithm: "ed25519",
+      key_id: signature.key_id,
+      public_key_sha256: sha256(publicRaw),
+      verified: true,
+    },
+  };
+}
+
+function parseJsonEntry(entries, name) {
+  const content = entries.get(name);
+  if (!content) throw new Error(`package requires ${name}`);
+  try {
+    const value = JSON.parse(content.toString("utf8"));
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error();
+    return value;
+  } catch {
+    throw new Error(`${name} must contain a JSON object`);
+  }
+}
+
+function strictBase64(value, expectedLength, label) {
+  if (
+    typeof value !== "string"
+    || value.length % 4 !== 0
+    || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)
+  ) {
+    throw new Error(`${label} is not valid base64`);
+  }
+  const decoded = Buffer.from(value, "base64");
+  if (decoded.length !== expectedLength || decoded.toString("base64") !== value) {
+    throw new Error(`${label} has an invalid length or encoding`);
+  }
+  return decoded;
+}
+
+export function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}