@morit/cli 1.0.0 → 1.1.1

package/assets/plugin_contract.json

@@ -1,5 +1,5 @@
 {
-  "sdk_version": "1.7.5",
+  "sdk_version": "1.7.6",
   "manifest_schema_versions": [1, 2],
   "recommended_schema_version": 2,
   "package_content_type": "application/vnd.morit.plugin+zip",
@@ -88,10 +88,20 @@
     "row",
     "wrap",
     "grid",
+    "stack",
+    "positioned",
+    "scroll",
+    "padding",
+    "center",
+    "expanded",
+    "surface",
     "card",
     "section",
     "text",
     "icon",
+    "image",
+    "avatar",
+    "badge",
     "divider",
     "spacer",
     "metric",
@@ -110,6 +120,217 @@
     "switch",
     "empty"
   ],
+  "ui_runtime": {
+    "schema_version": 2,
+    "config_fields": [
+      "ui_schema",
+      "icon",
+      "description",
+      "placement",
+      "app_bar",
+      "navigation",
+      "theme",
+      "initial_state",
+      "data_sources",
+      "view"
+    ],
+    "node_fields": ["id", "type", "props", "children", "action", "visible_when"],
+    "prop_fields": [
+      "text",
+      "title",
+      "subtitle",
+      "label",
+      "supporting",
+      "icon",
+      "style",
+      "tone",
+      "align",
+      "max_lines",
+      "spacing",
+      "padding",
+      "columns",
+      "stack_at",
+      "min_item_width",
+      "size",
+      "value",
+      "source",
+      "empty_text",
+      "limit",
+      "state_key",
+      "placeholder",
+      "input_type",
+      "options",
+      "persist",
+      "selected",
+      "dense",
+      "chart_type",
+      "x_key",
+      "y_key",
+      "date_key",
+      "title_key",
+      "show_legend",
+      "full_width",
+      "width",
+      "height",
+      "min_width",
+      "max_width",
+      "min_height",
+      "max_height",
+      "margin",
+      "alignment",
+      "main_axis_alignment",
+      "cross_axis_alignment",
+      "main_axis_size",
+      "color",
+      "background_color",
+      "foreground_color",
+      "border_color",
+      "border_width",
+      "border_radius",
+      "elevation",
+      "opacity",
+      "aspect_ratio",
+      "fit",
+      "asset",
+      "url",
+      "tooltip",
+      "semantic_label",
+      "exclude_semantics",
+      "scroll_direction",
+      "clip",
+      "shrink_wrap",
+      "enabled",
+      "flex",
+      "left",
+      "top",
+      "right",
+      "bottom"
+    ],
+    "app_bar_fields": ["title", "subtitle", "center_title", "pinned", "leading", "actions"],
+    "navigation_fields": ["type", "items", "selected_state_key", "persist", "label_behavior", "rail_breakpoint"],
+    "menu_item_fields": ["id", "label", "icon", "selected_icon", "value", "show_as", "action"],
+    "theme_fields": ["color_scheme", "radius", "spacing", "density"],
+    "action_fields": ["type", "capability", "query", "arguments", "store", "target", "source", "values", "persist", "transition", "replace"],
+    "actions": ["invoke", "navigate", "set_state", "refresh", "back"],
+    "navigation_transitions": ["platform", "fade", "slide", "none"],
+    "navigation_types": ["tabs", "bar", "rail", "drawer", "adaptive"],
+    "icon_tokens": [
+      "add",
+      "analytics",
+      "arrow",
+      "arrow_back",
+      "arrow_forward",
+      "bell",
+      "calendar",
+      "check",
+      "clock",
+      "close",
+      "delete",
+      "description",
+      "download",
+      "edit",
+      "education",
+      "error",
+      "event",
+      "extension",
+      "favorite",
+      "file",
+      "folder",
+      "help",
+      "home",
+      "home_filled",
+      "inbox",
+      "info",
+      "link",
+      "list",
+      "meal",
+      "menu",
+      "more",
+      "notification",
+      "notifications",
+      "person",
+      "refresh",
+      "schedule",
+      "school",
+      "school.settings",
+      "search",
+      "settings",
+      "share",
+      "sparkle",
+      "upload"
+    ],
+    "color_formats": ["material_semantic_token", "#RRGGBB", "#AARRGGBB"],
+    "material_color_tokens": [
+      "primary",
+      "on_primary",
+      "primary_container",
+      "on_primary_container",
+      "secondary",
+      "on_secondary",
+      "secondary_container",
+      "on_secondary_container",
+      "tertiary",
+      "on_tertiary",
+      "tertiary_container",
+      "on_tertiary_container",
+      "error",
+      "on_error",
+      "error_container",
+      "on_error_container",
+      "surface",
+      "on_surface",
+      "surface_variant",
+      "on_surface_variant",
+      "outline",
+      "outline_variant",
+      "inverse_surface",
+      "inverse_on_surface",
+      "inverse_primary",
+      "shadow",
+      "scrim",
+      "transparent"
+    ],
+    "theme_color_roles": [
+      "primary",
+      "on_primary",
+      "primary_container",
+      "on_primary_container",
+      "secondary",
+      "on_secondary",
+      "secondary_container",
+      "on_secondary_container",
+      "tertiary",
+      "on_tertiary",
+      "tertiary_container",
+      "on_tertiary_container",
+      "error",
+      "on_error",
+      "error_container",
+      "on_error_container",
+      "surface",
+      "on_surface",
+      "surface_variant",
+      "on_surface_variant",
+      "outline",
+      "outline_variant",
+      "inverse_surface",
+      "inverse_on_surface",
+      "inverse_primary",
+      "shadow",
+      "scrim"
+    ],
+    "image_sources": ["package_asset", "capability_result_binding"],
+    "platforms": ["android", "ios", "desktop"],
+    "limits": {
+      "nodes": 160,
+      "depth": 12,
+      "children_per_node": 32,
+      "data_sources": 8,
+      "state_keys": 32,
+      "navigation_items": 8,
+      "app_bar_actions": 6
+    }
+  },
   "signature": {
     "algorithm": "ed25519",
     "embedded_public_key": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morit/cli",
-  "version": "1.0.0",
+  "version": "1.1.1",
   "description": "Official Morit Developer CLI for Cloud Projects, validation, builds, and deployments",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -259,6 +259,15 @@ export async function pullPluginProject(root, client, force = false) {
   return project;
 }
 
+async function saveLoginCredential(save, credential) {
+  try {
+    await save(credential);
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : "secure credential storage failed";
+    throw new Error(`Authorization succeeded, but the token could not be stored safely: ${reason}. Run morit logout to recover, then login again`);
+  }
+}
+
 async function login(parsed, options, stdout) {
   const apiUrl = parsed.flags["api-url"] || DEFAULT_API_URL;
   const fetchImpl = options.fetchImpl || fetch;
@@ -266,7 +275,11 @@ async function login(parsed, options, stdout) {
   if (directToken) {
     const client = new MoritCloudClient({ apiUrl, token: directToken, fetchImpl });
     const identity = await client.whoami();
-    await (options.saveCredential || saveCredential)({ token: directToken, apiUrl: client.apiUrl, organizationId: identity.organization_id });
+    await saveLoginCredential(options.saveCredential || saveCredential, {
+      token: directToken,
+      apiUrl: client.apiUrl,
+      organizationId: identity.organization_id,
+    });
     output(stdout, parsed.flags.json ? identity : `Signed in to organization ${identity.organization_id}`, parsed.flags.json);
     return 0;
   }
@@ -282,6 +295,7 @@ async function login(parsed, options, stdout) {
   stdout.write(`Open ${authorization.verification_uri}\nEnter code: ${authorization.user_code}\n`);
   (options.openBrowser || openBrowser)(authorization.verification_uri_complete);
   const deadline = Date.now() + authorization.expires_in * 1000;
+  let networkFailures = 0;
   while (Date.now() < deadline) {
     await (options.sleep || ((milliseconds) => new Promise((resolveSleep) => setTimeout(resolveSleep, milliseconds))))(authorization.interval * 1000);
     try {
@@ -293,7 +307,7 @@ async function login(parsed, options, stdout) {
           retries: 0,
         }),
       );
-      await (options.saveCredential || saveCredential)({
+      await saveLoginCredential(options.saveCredential || saveCredential, {
         token: token.access_token,
         apiUrl: client.apiUrl,
         organizationId: token.organization_id,
@@ -301,7 +315,17 @@ async function login(parsed, options, stdout) {
       output(stdout, parsed.flags.json ? { organization_id: token.organization_id, scopes: token.scopes } : "Morit CLI is connected", parsed.flags.json);
       return 0;
     } catch (error) {
-      if (error instanceof MoritCloudError && error.code === "authorization_pending") continue;
+      if (error instanceof MoritCloudError && error.code === "authorization_pending") {
+        networkFailures = 0;
+        continue;
+      }
+      if (error instanceof MoritCloudError && error.code === "network_error" && ++networkFailures < 3) continue;
+      if (error instanceof MoritCloudError && error.code === "access_denied") {
+        throw new Error("CLI authorization was cancelled");
+      }
+      if (error instanceof MoritCloudError && ["expired_token", "device_code_expired"].includes(error.code)) {
+        throw new Error("CLI authorization expired; run morit login again");
+      }
       throw error;
     }
   }

package/src/secure-store.js

@@ -1,4 +1,4 @@
-import { execFileSync, spawnSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import { homedir, userInfo } from "node:os";
 import { join } from "node:path";
@@ -8,14 +8,20 @@ const credentialDirectory = join(homedir(), ".morit");
 const credentialPath = join(credentialDirectory, "credentials.json");
 const serviceName = "morit-cli";
 const ACCESS_TOKEN = /^sk_live_[A-Za-z0-9]{32}$/;
+const STORAGE_BY_PLATFORM = { win32: "dpapi", darwin: "keychain", linux: "secret-tool" };
 
 function powershell(script, input = "") {
   const result = spawnSync(
     "powershell.exe",
-    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script],
+    ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", `$ErrorActionPreference='Stop';Add-Type -AssemblyName System.Security;${script}`],
     { input, encoding: "utf8", windowsHide: true, maxBuffer: 1024 * 1024 },
   );
-  if (result.status !== 0) throw new Error("Windows credential protection failed");
+  if (result.error?.code === "ENOENT") {
+    throw new Error("Windows PowerShell is required to protect Morit credentials");
+  }
+  if (result.status !== 0 || !result.stdout.trim()) {
+    throw new Error("Windows credential protection failed; verify that Windows PowerShell and DPAPI are available");
+  }
   return result.stdout.trim();
 }
 
@@ -38,55 +44,115 @@ function windowsUnprotect(payload) {
 }
 
 function linuxSecretToolAvailable() {
-  try {
-    execFileSync("secret-tool", ["--version"], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
+  const result = spawnSync("secret-tool", ["--help"], { stdio: "ignore" });
+  return !result.error && result.status === 0;
+}
+
+function nativeCredential(storage, action, account, token) {
+  let command;
+  let args;
+  if (storage === "keychain") {
+    command = "security";
+    args = action === "store"
+      ? ["add-generic-password", "-a", account, "-s", serviceName, "-w", token, "-U"]
+      : action === "read"
+        ? ["find-generic-password", "-a", account, "-s", serviceName, "-w"]
+        : ["delete-generic-password", "-a", account, "-s", serviceName];
+  } else {
+    if (!linuxSecretToolAvailable()) {
+      throw new Error("Linux Secret Service is unavailable; install secret-tool and unlock a desktop keyring, or use MORIT_ACCESS_TOKEN for this session");
+    }
+    command = "secret-tool";
+    args = action === "store"
+      ? ["store", "--label=Morit CLI", "service", serviceName, "account", account]
+      : action === "read"
+        ? ["lookup", "service", serviceName, "account", account]
+        : ["clear", "service", serviceName, "account", account];
   }
+  const result = spawnSync(command, args, {
+    input: action === "store" && storage === "secret-tool" ? token : undefined,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 1024 * 1024,
+  });
+  const label = storage === "keychain" ? "macOS Keychain" : "Linux Secret Service";
+  const stdout = result.stdout?.trim() || "";
+  const stderr = result.stderr?.trim() || "";
+  const missing = action === "delete" && (
+    (storage === "keychain" && result.status === 44)
+    || (storage === "secret-tool" && result.status === 1 && !stderr)
+  );
+  if (result.error?.code === "ENOENT") throw new Error(`${label} command is unavailable`);
+  if (result.status !== 0 && !missing) {
+    throw new Error(`Unable to ${action} the Morit token in ${label}; unlock the secure store and retry`);
+  }
+  if (action === "read" && !stdout) {
+    throw new Error(`The saved Morit token is missing from ${label}; run morit logout and login again`);
+  }
+  return stdout;
+}
+
+function validMetadata(value) {
+  if (!value || typeof value !== "object" || value.version !== 1 || typeof value.api_url !== "string") return false;
+  if (value.storage === "dpapi") return typeof value.payload === "string" && value.payload.length > 0;
+  return (value.storage === "keychain" || value.storage === "secret-tool")
+    && typeof value.account === "string" && value.account.length > 0 && value.account.length <= 256;
 }
 
-async function metadata() {
-  try { return JSON.parse(await readFile(credentialPath, "utf8")); }
-  catch (error) {
+async function metadata({ allowCorrupt = false } = {}) {
+  try {
+    const value = JSON.parse(await readFile(credentialPath, "utf8"));
+    if (!validMetadata(value)) throw new Error("invalid metadata");
+    return value;
+  } catch (error) {
     if (error.code === "ENOENT") return null;
+    if (allowCorrupt) return { corrupt: true };
     throw new Error("Morit credential metadata is unreadable; run morit logout and login again");
   }
 }
 
 async function writeMetadata(value) {
   await mkdir(credentialDirectory, { recursive: true, mode: 0o700 });
-  const temporary = `${credentialPath}.tmp`;
-  await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
-  await rename(temporary, credentialPath);
-  await chmod(credentialPath, 0o600).catch(() => undefined);
+  await chmod(credentialDirectory, 0o700).catch(() => undefined);
+  const temporary = `${credentialPath}.${process.pid}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temporary, credentialPath);
+    await chmod(credentialPath, 0o600).catch(() => undefined);
+  } catch (error) {
+    await unlink(temporary).catch(() => undefined);
+    throw new Error("Unable to update Morit credential metadata", { cause: error });
+  }
 }
 
 export async function saveCredential({ token, apiUrl, organizationId }) {
   if (!ACCESS_TOKEN.test(token || "")) throw new Error("Developer access token is invalid");
   const normalizedApiUrl = normalizeApiOrigin(apiUrl);
-  const account = userInfo().username;
-  if (process.platform === "win32") {
-    await writeMetadata({ version: 1, storage: "dpapi", payload: windowsProtect(token), api_url: normalizedApiUrl, organization_id: organizationId });
-    return;
+  const previous = await metadata();
+  const storage = STORAGE_BY_PLATFORM[process.platform];
+  if (!storage) throw new Error(`Secure credential storage is not supported on ${process.platform}`);
+  if (previous && previous.storage !== storage) {
+    throw new Error("Saved credentials belong to a different platform; run morit logout before logging in again");
   }
-  if (process.platform === "darwin") {
-    const result = spawnSync("security", ["add-generic-password", "-a", account, "-s", serviceName, "-w", token, "-U"], {
-      stdio: "ignore",
-    });
-    if (result.status !== 0) throw new Error("Unable to save token in macOS Keychain");
-    await writeMetadata({ version: 1, storage: "keychain", account, api_url: normalizedApiUrl, organization_id: organizationId });
+  if (storage === "dpapi") {
+    await writeMetadata({ version: 1, storage, payload: windowsProtect(token), api_url: normalizedApiUrl, organization_id: organizationId });
     return;
   }
-  if (!linuxSecretToolAvailable()) {
-    throw new Error("A desktop keyring is required; install secret-tool or use MORIT_ACCESS_TOKEN for this session");
+
+  const account = userInfo().username;
+  const previousToken = previous ? nativeCredential(storage, "read", previous.account) : null;
+  nativeCredential(storage, "store", account, token);
+  try {
+    await writeMetadata({ version: 1, storage, account, api_url: normalizedApiUrl, organization_id: organizationId });
+  } catch (error) {
+    try {
+      if (previousToken) nativeCredential(storage, "store", previous.account, previousToken);
+      else nativeCredential(storage, "delete", account);
+    } catch {
+      throw new Error("Credential metadata failed and secure-store recovery also failed; run morit logout before retrying");
+    }
+    throw error;
   }
-  const result = spawnSync("secret-tool", ["store", "--label=Morit CLI", "service", serviceName, "account", account], {
-    input: token,
-    encoding: "utf8",
-  });
-  if (result.status !== 0) throw new Error("Unable to save token in the desktop keyring");
-  await writeMetadata({ version: 1, storage: "secret-tool", account, api_url: normalizedApiUrl, organization_id: organizationId });
 }
 
 export async function loadCredential() {
@@ -107,24 +173,28 @@ export async function loadCredential() {
   if (value.storage === "dpapi" && process.platform === "win32") {
     token = windowsUnprotect(value.payload);
   } else if (value.storage === "keychain" && process.platform === "darwin") {
-    token = execFileSync("security", ["find-generic-password", "-a", value.account, "-s", serviceName, "-w"], { encoding: "utf8" }).trim();
-  } else if (value.storage === "secret-tool" && linuxSecretToolAvailable()) {
-    token = execFileSync("secret-tool", ["lookup", "service", serviceName, "account", value.account], { encoding: "utf8" }).trim();
+    token = nativeCredential(value.storage, "read", value.account);
+  } else if (value.storage === "secret-tool" && process.platform === "linux") {
+    token = nativeCredential(value.storage, "read", value.account);
   } else {
     throw new Error("Saved credentials belong to a different platform; run morit logout and login again");
   }
-  if (!ACCESS_TOKEN.test(token)) throw new Error("Saved Morit credential is invalid");
+  if (!ACCESS_TOKEN.test(token)) throw new Error("Saved Morit credential is invalid; run morit logout and login again");
   return { token, apiUrl, organizationId: value.organization_id, ephemeral: false };
 }
 
 export async function clearCredential() {
-  const value = await metadata();
-  if (value?.storage === "keychain" && process.platform === "darwin") {
-    spawnSync("security", ["delete-generic-password", "-a", value.account, "-s", serviceName], { stdio: "ignore" });
-  } else if (value?.storage === "secret-tool" && linuxSecretToolAvailable()) {
-    spawnSync("secret-tool", ["clear", "service", serviceName, "account", value.account], { stdio: "ignore" });
+  const value = await metadata({ allowCorrupt: true });
+  if (!value) return;
+  if (value.corrupt) {
+    if (process.platform === "darwin") nativeCredential("keychain", "delete", userInfo().username);
+    else if (process.platform === "linux") nativeCredential("secret-tool", "delete", userInfo().username);
+  } else if (value.storage === "keychain" && process.platform === "darwin") {
+    nativeCredential(value.storage, "delete", value.account);
+  } else if (value.storage === "secret-tool" && process.platform === "linux") {
+    nativeCredential(value.storage, "delete", value.account);
   }
   await unlink(credentialPath).catch((error) => {
-    if (error.code !== "ENOENT") throw error;
+    if (error.code !== "ENOENT") throw new Error("Unable to remove Morit credential metadata", { cause: error });
   });
 }